257 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
hobokenchicken	86717a2867	fix(web): normalize channel IDs to lowercase across stores and WS	2026-07-27 09:05:23 -04:00
hobokenchicken	4a416427e9	fix(web): robust date parsing and merge strategy in message store	2026-07-27 09:04:49 -04:00
hobokenchicken	8261555026	fix(web): use keyed Fragment in ChatArea message list	2026-07-27 09:04:35 -04:00
hobokenchicken	3cde62bdc6	fix(web): normalize conversation IDs to lowercase and bind DMChat messages selector	2026-07-27 09:01:53 -04:00
hobokenchicken	065f036807	fix(web): navigate to newly created DM in NewConversationModal v0.3.12	2026-07-27 08:50:14 -04:00
hobokenchicken	f53cd49803	fix(web): robust date parsing and merge strategy in conversation store	2026-07-27 08:49:57 -04:00
hobokenchicken	4e48815b91	fix(web): use keyed Fragment in DMChat message mapping	2026-07-27 08:49:41 -04:00
hobokenchicken	d9b3162f1c	fix(web): move hasMore selector below id declaration to avoid TDZ crash in DMChat	2026-07-22 08:36:12 -04:00
hobokenchicken	6384588122	chore: bump to 0.2.10 (versionCode 2010)	2026-07-21 10:09:20 -04:00
hobokenchicken	978e94da90	fix(android): bump safe-top to 2rem, enlarge toolbar icons, fix login spacing ... - --safe-top: 1.5rem → 2rem for extra status bar clearance - Formatting toolbar: w-3→w-4, p-1→p-1.5 for better touch targets - Login form: increased vertical spacing between buttons, text-xs on passkey	2026-07-21 09:58:02 -04:00
hobokenchicken	34c18c13ae	fix(android): increase login form button spacing, shrink passkey text ... - forgot password link: mt-3 → mt-4 - passkey button: mt-3 → mt-4, added text-xs to prevent overflow - create account: mt-4 → mt-5	2026-07-21 09:45:40 -04:00
hobokenchicken	cca6ea0e37	fix: stop infinite scroll feedback when no more messages ... Scroll handler now checks !hasMore to avoid calling fetchOlderMessages when all messages are loaded. Previously the handler would fire on every scroll event (since scrollTop stayed < 100), creating a .then() callback loop that adjusted scroll position repeatedly, causing 'stuck' scrolling.	2026-07-21 09:05:39 -04:00
hobokenchicken	738b9b17ff	fix: add unsafe-inline to Tauri script-src CSP v0.3.11	2026-07-20 13:42:21 -04:00
hobokenchicken	44370f41e5	ops: .dockerignore, non-root user, network isolation, deploy rollback ... - .dockerignore excludes .git, node_modules, certs, *.zip - Dockerfile runs as non-root appuser - compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks - deploy.sh snapshots binary before pull and rolls back on failed health check	2026-07-20 13:15:19 -04:00
hobokenchicken	1d6c9bdfe6	perf: rate limiter cleanup goroutine, DB pool constraints ... - ipLimiter evicts stale entries after 10 min of inactivity via 5 min sweep - DB pool capped at 25 max open, 5 idle, 15 min lifetime	2026-07-20 13:13:58 -04:00
hobokenchicken	57aec2c6b3	sec: hash tokens in DB, set Tauri CSP, escape quotes in XSS guard ... - Session and email verification/reset tokens stored as SHA-256 hash in DB (raw token stays client-side in cookie/email link) - Tauri CSP set: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' wss: https: - escapeHtml now handles double and single quotes to prevent attribute-based XSS	2026-07-20 13:13:09 -04:00
hobokenchicken	d4ca5f576e	sec: point coturn at live LE certs, remove old ./certs/ mount	2026-07-20 13:10:27 -04:00
hobokenchicken	5f2b0aea8b	sec: remove certs/cookie from tracking, parameterize LiveKit secrets, add .env.example	2026-07-20 13:03:42 -04:00
hobokenchicken	6f6d1329c6	fix(linux): guard WebSocket.prototype assignment — read-only on WebKitGTK	2026-07-20 12:26:14 -04:00
hobokenchicken	156ee4197c	fix: remove env() from CSS, set safe-area via JS only	2026-07-20 11:50:07 -04:00
hobokenchicken	a5882f32c4	chore: bump to v0.2.9 (version code 2009)	2026-07-20 11:37:26 -04:00
hobokenchicken	516168d290	fix(android): replace env() with JS-set CSS vars for safe areas	2026-07-20 11:30:28 -04:00
hobokenchicken	c2be53e53f	fix: append messages locally on send, don't rely solely on WS	2026-07-20 11:07:57 -04:00
hobokenchicken	953a1e26e6	fix: add Tauri origins to CSRF allowlist	2026-07-20 11:02:34 -04:00
hobokenchicken	5d9b629dca	fix: correct debug symbols structure for Play Store	2026-07-20 10:58:21 -04:00
hobokenchicken	4cc6c6f1ed	chore: bump to v0.2.8 (version code 2008)	2026-07-20 10:25:47 -04:00
hobokenchicken	82f329808e	fix(android): replace default icons with dumpster fire logo	2026-07-20 10:12:38 -04:00
hobokenchicken	0ab08a9374	chore: bump to v0.2.7 (version code 2007)	2026-07-20 10:01:32 -04:00
hobokenchicken	c9884d1cbd	chore: add native debug symbols for Play Store	2026-07-20 09:52:24 -04:00
hobokenchicken	974eca4bb2	fix(android): edge-to-edge alignment, keyboard handling, toolbar spacing	2026-07-20 09:49:38 -04:00
hobokenchicken	8437ddcb7f	chore: remove leftover hashgen temp file	2026-07-17 15:48:46 -04:00
hobokenchicken	aa0af5db4f	feat: account deletion in settings + privacy policy with deletion link	2026-07-17 15:47:29 -04:00
hobokenchicken	e79505d8b4	fix(tauri): disable WebKitGTK sandbox inside AppImage on Linux and bump version to 0.2.6	2026-07-16 15:28:36 -04:00
hobokenchicken	b0d820cd92	fix(tauri): set WEBKIT_DISABLE_DMABUF_RENDERER=1 on Linux to prevent white screen	2026-07-16 15:03:10 -04:00
hobokenchicken	a8cb5c5933	fix: use SameSite=Lax for session cookie ... SameSite=None requires Secure=true or modern browsers silently reject the Set-Cookie header. Since the site is served over HTTPS via Caddy, this was causing login to succeed (200) but the session cookie to be dropped, making the subsequent /auth/me call fail with 401. SameSite=Lax is the correct setting for same-origin session cookies.	2026-07-16 14:52:13 -04:00
hobokenchicken	bda4c9d73d	fix: handle 401 gracefully on web; add Bearer token auth for Tauri ... - fetchMe() no longer surfaces 401 as a user-facing error (it just means 'no session', not a failure) - API client auto-clears auth state on 401 mid-session so the user gets redirected to login instead of seeing 'ERR: Request failed: 401' - Session middleware now accepts Authorization: Bearer <token> header as fallback when no cookie is present (for Tauri/native clients) - Login, register, and WebAuthn endpoints expose X-Session-Token header so non-browser clients can capture the token	2026-07-16 14:46:17 -04:00
hobokenchicken	d4fff01e35	fix(desktop): implement bearer token auth for windows webview2	2026-07-16 14:30:28 -04:00
hobokenchicken	77313671b6	fix(auth): set SameSite=None for session cookies to fix cross-origin session loss in Tauri apps	2026-07-16 14:26:18 -04:00
hobokenchicken	e76f755abb	fix(api): add CORS headers to allow cross-origin requests from Tauri desktop app	2026-07-16 14:21:15 -04:00
hobokenchicken	3bc8f9721e	added firebase json	2026-07-16 14:07:29 -04:00
hobokenchicken	a66b777712	fix(tauri): unregister and prevent service worker to fix 404 cache routing issues	2026-07-16 13:58:06 -04:00
hobokenchicken	19386c2b33	fix(tauri): redirect relative fetch and websocket urls to production backend for desktop app	2026-07-16 13:27:33 -04:00
hobokenchicken	e7deb84660	fix(ci): manually configure caching using actions/cache@v3 for gitea compatibility	2026-07-16 13:03:56 -04:00
hobokenchicken	76230bb9d6	fix(ci): recursively glob artifact files to prevent empty releases	2026-07-16 12:47:45 -04:00
hobokenchicken	908b87eb5d	fix(ci): correct rustup download URL for windows	2026-07-16 12:22:18 -04:00
hobokenchicken	e62f551e2f	fix(ci): use valid release action (softprops/action-gh-release)	2026-07-16 12:17:30 -04:00
hobokenchicken	83409cef0d	chore(ci): add rust and npm caching to speed up builds	2026-07-16 11:02:23 -04:00
hobokenchicken	a99714eec6	fix(ci): downgrade artifact actions to v3 for gitea compatibility	2026-07-16 10:46:54 -04:00
hobokenchicken	6a24b6f335	fix(ci): use curl and CI=true to prevent Windows runner hang	2026-07-16 10:33:46 -04:00
hobokenchicken	87a49118b5	added rpm to apt get list	2026-07-16 14:08:08 +00:00