LobotomyLabs/dumpsterChat
2
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 10 Wiki Activity
267 Commits 1 Branch 21 Tags
410b7a4d6b579c43b3505f21e4936ff2570929d5
Commit Graph

267 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
hobokenchicken 410b7a4d6b fix(gateway): resolve dead session cookie infinite rejection loop for WebSocket auth 2026-07-27 12:01:48 -04:00
hobokenchicken 5eeb659b70 fix(web): normalize channel and server IDs across channel store and auto-select default channel 2026-07-27 11:56:39 -04:00
hobokenchicken 13e3aec2d5 feat(web): add automated build version tracking and update notification banner 2026-07-27 09:51:15 -04:00
hobokenchicken 83c6badc20 fix(web): prevent date parsing sort drop to top of history for real-time messages 2026-07-27 09:46:42 -04:00
hobokenchicken 43b20c5ce3 fix(docker): use handle instead of handle_path to preserve /api/v1 prefix in Caddy proxy 2026-07-27 09:33:13 -04:00
hobokenchicken b0087e12af fix(docker): reverse proxy to host service in Caddyfile 2026-07-27 09:27:11 -04:00
hobokenchicken 1a1f2fc99c fix(deploy): sync web/dist to Docker Caddy volume in deploy.sh 2026-07-27 09:21:53 -04:00
hobokenchicken e927dd2cb0 fix(server): set no-cache headers on index.html to prevent stale SPA bundles 2026-07-27 09:16:18 -04:00
hobokenchicken beb04196ca fix(gateway): direct DB query and normalized UserID matching in BroadcastToServer 2026-07-27 09:12:35 -04:00
hobokenchicken a54a67e41b fix(web): persistent WS connection, auto-refetch on ready, and direct selector binding with scroll fix 2026-07-27 09:09:27 -04:00
hobokenchicken 86717a2867 fix(web): normalize channel IDs to lowercase across stores and WS 2026-07-27 09:05:23 -04:00
hobokenchicken 4a416427e9 fix(web): robust date parsing and merge strategy in message store 2026-07-27 09:04:49 -04:00
hobokenchicken 8261555026 fix(web): use keyed Fragment in ChatArea message list 2026-07-27 09:04:35 -04:00
hobokenchicken 3cde62bdc6 fix(web): normalize conversation IDs to lowercase and bind DMChat messages selector 2026-07-27 09:01:53 -04:00
hobokenchicken 065f036807 fix(web): navigate to newly created DM in NewConversationModal
Release Desktop Apps / build-linux (push) Failing after 11m33s
Details
Release Desktop Apps / build-windows (push) Failing after 11m37s
Details
Release Desktop Apps / release (push) Has been skipped
Details
v0.3.12 		2026-07-27 08:50:14 -04:00
hobokenchicken f53cd49803 fix(web): robust date parsing and merge strategy in conversation store 2026-07-27 08:49:57 -04:00
hobokenchicken 4e48815b91 fix(web): use keyed Fragment in DMChat message mapping 2026-07-27 08:49:41 -04:00
hobokenchicken d9b3162f1c fix(web): move hasMore selector below id declaration to avoid TDZ crash in DMChat 2026-07-22 08:36:12 -04:00
hobokenchicken 6384588122 chore: bump to 0.2.10 (versionCode 2010) 2026-07-21 10:09:20 -04:00
hobokenchicken 978e94da90 fix(android): bump safe-top to 2rem, enlarge toolbar icons, fix login spacing 
- --safe-top: 1.5rem → 2rem for extra status bar clearance
- Formatting toolbar: w-3→w-4, p-1→p-1.5 for better touch targets
- Login form: increased vertical spacing between buttons, text-xs on passkey
 2026-07-21 09:58:02 -04:00
hobokenchicken 34c18c13ae fix(android): increase login form button spacing, shrink passkey text 
- forgot password link: mt-3 → mt-4
- passkey button: mt-3 → mt-4, added text-xs to prevent overflow
- create account: mt-4 → mt-5
 2026-07-21 09:45:40 -04:00
hobokenchicken cca6ea0e37 fix: stop infinite scroll feedback when no more messages 
Scroll handler now checks !hasMore to avoid calling fetchOlderMessages
when all messages are loaded. Previously the handler would fire on every
scroll event (since scrollTop stayed < 100), creating a .then() callback
loop that adjusted scroll position repeatedly, causing 'stuck' scrolling.
 2026-07-21 09:05:39 -04:00
hobokenchicken 738b9b17ff fix: add unsafe-inline to Tauri script-src CSP
Release Desktop Apps / build-linux (push) Successful in 4m50s
Details
Release Desktop Apps / build-windows (push) Successful in 16m59s
Details
Release Desktop Apps / release (push) Successful in 11s
Details
v0.3.11 		2026-07-20 13:42:21 -04:00
hobokenchicken 44370f41e5 ops: .dockerignore, non-root user, network isolation, deploy rollback 
- .dockerignore excludes .git, node_modules, certs, *.zip
- Dockerfile runs as non-root appuser
- compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks
- deploy.sh snapshots binary before pull and rolls back on failed health check
 2026-07-20 13:15:19 -04:00
hobokenchicken 1d6c9bdfe6 perf: rate limiter cleanup goroutine, DB pool constraints 
- ipLimiter evicts stale entries after 10 min of inactivity via 5 min sweep
- DB pool capped at 25 max open, 5 idle, 15 min lifetime
 2026-07-20 13:13:58 -04:00
hobokenchicken 57aec2c6b3 sec: hash tokens in DB, set Tauri CSP, escape quotes in XSS guard 
- Session and email verification/reset tokens stored as SHA-256 hash in DB
  (raw token stays client-side in cookie/email link)
- Tauri CSP set: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:; connect-src 'self' wss: https:
- escapeHtml now handles double and single quotes to prevent attribute-based XSS
 2026-07-20 13:13:09 -04:00
hobokenchicken d4ca5f576e sec: point coturn at live LE certs, remove old ./certs/ mount 2026-07-20 13:10:27 -04:00
hobokenchicken 5f2b0aea8b sec: remove certs/cookie from tracking, parameterize LiveKit secrets, add .env.example 2026-07-20 13:03:42 -04:00
hobokenchicken 6f6d1329c6 fix(linux): guard WebSocket.prototype assignment — read-only on WebKitGTK 2026-07-20 12:26:14 -04:00
hobokenchicken 156ee4197c fix: remove env() from CSS, set safe-area via JS only 2026-07-20 11:50:07 -04:00
hobokenchicken a5882f32c4 chore: bump to v0.2.9 (version code 2009) 2026-07-20 11:37:26 -04:00
hobokenchicken 516168d290 fix(android): replace env() with JS-set CSS vars for safe areas 2026-07-20 11:30:28 -04:00
hobokenchicken c2be53e53f fix: append messages locally on send, don't rely solely on WS 2026-07-20 11:07:57 -04:00
hobokenchicken 953a1e26e6 fix: add Tauri origins to CSRF allowlist 2026-07-20 11:02:34 -04:00
hobokenchicken 5d9b629dca fix: correct debug symbols structure for Play Store 2026-07-20 10:58:21 -04:00
hobokenchicken 4cc6c6f1ed chore: bump to v0.2.8 (version code 2008) 2026-07-20 10:25:47 -04:00
hobokenchicken 82f329808e fix(android): replace default icons with dumpster fire logo 2026-07-20 10:12:38 -04:00
hobokenchicken 0ab08a9374 chore: bump to v0.2.7 (version code 2007) 2026-07-20 10:01:32 -04:00
hobokenchicken c9884d1cbd chore: add native debug symbols for Play Store 2026-07-20 09:52:24 -04:00
hobokenchicken 974eca4bb2 fix(android): edge-to-edge alignment, keyboard handling, toolbar spacing 2026-07-20 09:49:38 -04:00
hobokenchicken 8437ddcb7f chore: remove leftover hashgen temp file 2026-07-17 15:48:46 -04:00
hobokenchicken aa0af5db4f feat: account deletion in settings + privacy policy with deletion link 2026-07-17 15:47:29 -04:00
hobokenchicken e79505d8b4 fix(tauri): disable WebKitGTK sandbox inside AppImage on Linux and bump version to 0.2.6 2026-07-16 15:28:36 -04:00
hobokenchicken b0d820cd92 fix(tauri): set WEBKIT_DISABLE_DMABUF_RENDERER=1 on Linux to prevent white screen 2026-07-16 15:03:10 -04:00
hobokenchicken a8cb5c5933 fix: use SameSite=Lax for session cookie 
SameSite=None requires Secure=true or modern browsers silently reject
the Set-Cookie header. Since the site is served over HTTPS via Caddy,
this was causing login to succeed (200) but the session cookie to be
dropped, making the subsequent /auth/me call fail with 401.

SameSite=Lax is the correct setting for same-origin session cookies.
 2026-07-16 14:52:13 -04:00
hobokenchicken bda4c9d73d fix: handle 401 gracefully on web; add Bearer token auth for Tauri 
- fetchMe() no longer surfaces 401 as a user-facing error (it just
  means 'no session', not a failure)
- API client auto-clears auth state on 401 mid-session so the user
  gets redirected to login instead of seeing 'ERR: Request failed: 401'
- Session middleware now accepts Authorization: Bearer <token> header
  as fallback when no cookie is present (for Tauri/native clients)
- Login, register, and WebAuthn endpoints expose X-Session-Token header
  so non-browser clients can capture the token
 2026-07-16 14:46:17 -04:00
hobokenchicken d4fff01e35 fix(desktop): implement bearer token auth for windows webview2 2026-07-16 14:30:28 -04:00
hobokenchicken 77313671b6 fix(auth): set SameSite=None for session cookies to fix cross-origin session loss in Tauri apps 2026-07-16 14:26:18 -04:00
hobokenchicken e76f755abb fix(api): add CORS headers to allow cross-origin requests from Tauri desktop app 2026-07-16 14:21:15 -04:00
hobokenchicken 3bc8f9721e added firebase json 2026-07-16 14:07:29 -04:00