patrickandClaude Sonnet 5
edc05d4d1e
Every previously-reported bug from the three QA rounds is now addressed (BUG-11 and BUG-15 mitigated rather than fully solved — see spec for why). Verified end-to-end on talkhub/matrix after each change. Security: - BUG-21: @fastify/helmet registered, CORS origin allowlist (APP_BASE_URL + localhost:5173) replaces `origin: true`. Verified: own origin gets CORS + HSTS/nosniff/X-Frame-Options headers, foreign origins get none. - BUG-13: GET /api/teams only returns matrixRoomId for teams the requester actually belongs to (was leaking every team's room id to any org member). Verified with/without team membership. - BUG-14: leftJoin now filters scope='team'; new partial unique index chat_rooms_team_id_team_scope_unique enforces one room per team at the DB level, not just in the query (migration 0002). Reliability: - BUG-5: use-team-chat.ts's setup poll now backs off exponentially (5s->60s) instead of a fixed 15s; SyncState.Error stops the client and reconnects with backoff instead of letting matrix-js-sdk retry against Synapse forever. - BUG-6: one-off backfill script (src/scripts/backfill-history-visibility.ts) sets history_visibility=shared on rooms created before that fix; run against talkhub/matrix. - BUG-9: route rate limit on GET /api/chat/room, unified 404 for nonexistent-team vs not-a-member (was a cross-org existence oracle), LRU-correct eviction order in matrix-token-cache.ts, scroll position preserved on "load older messages", and eslint.config.js added (lint never ran on this feature before — flat config was simply missing). - BUG-15 (mitigated): a small module-level credential cache in lib/matrix.ts lets useTeamChat and useTeamUnreadCounts share one fetched token instead of each hitting POST /api/chat/token independently. Reduces but doesn't eliminate rate-limit risk under rapid team switching (no in-flight dedup between the two hooks). - BUG-16: refreshCounts() checks `cancelled` before setCounts. - BUG-17: use-team-chat.ts uses getRoomUnreadNotificationCount() instead of the deprecated getUnreadNotificationCount(); left unchanged in use-team-unread-counts.ts on purpose, since importing NotificationCountType there would undo BUG-11's bundle-splitting fix. Cleanup: - BUG-10: new POST /api/chat/logout invalidates the cached token and calls Synapse's logout_all admin endpoint; frontend calls it best-effort on logout and clears its own credential cache. - BUG-22: trim() on displayName construction (trailing space with an empty last name); the reported trailing-dot localpart is moot after BUG-20 since localparts are random now, not name-derived. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0143yYvjesjHndBACoweyK67
34 lines
795 B
JSON
34 lines
795 B
JSON
{
|
|
"name": "talktime-backend",
|
|
"version": "1.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsc -p .",
|
|
"start": "node dist/server.js",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "drizzle-kit migrate"
|
|
},
|
|
"dependencies": {
|
|
"@fastify/cors": "^10.0.1",
|
|
"@fastify/helmet": "^13.1.1",
|
|
"@fastify/jwt": "^10.2.2",
|
|
"@fastify/rate-limit": "^10.1.1",
|
|
"bcryptjs": "^2.4.3",
|
|
"dotenv": "^16.4.5",
|
|
"drizzle-orm": "^0.45.2",
|
|
"fastify": "^5.1.0",
|
|
"pg": "^8.13.1",
|
|
"zod": "^4.3.5"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/node": "^20",
|
|
"@types/pg": "^8.11.10",
|
|
"drizzle-kit": "^0.31.10",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^5"
|
|
}
|
|
}
|