Every previously-reported bug from the three QA rounds is now addressed
(BUG-11 and BUG-15 mitigated rather than fully solved — see spec for
why). Verified end-to-end on talkhub/matrix after each change.
Security:
- BUG-21: @fastify/helmet registered, CORS origin allowlist (APP_BASE_URL
+ localhost:5173) replaces `origin: true`. Verified: own origin gets
CORS + HSTS/nosniff/X-Frame-Options headers, foreign origins get none.
- BUG-13: GET /api/teams only returns matrixRoomId for teams the
requester actually belongs to (was leaking every team's room id to
any org member). Verified with/without team membership.
- BUG-14: leftJoin now filters scope='team'; new partial unique index
chat_rooms_team_id_team_scope_unique enforces one room per team at
the DB level, not just in the query (migration 0002).
Reliability:
- BUG-5: use-team-chat.ts's setup poll now backs off exponentially
(5s->60s) instead of a fixed 15s; SyncState.Error stops the client
and reconnects with backoff instead of letting matrix-js-sdk retry
against Synapse forever.
- BUG-6: one-off backfill script (src/scripts/backfill-history-visibility.ts)
sets history_visibility=shared on rooms created before that fix;
run against talkhub/matrix.
- BUG-9: route rate limit on GET /api/chat/room, unified 404 for
nonexistent-team vs not-a-member (was a cross-org existence oracle),
LRU-correct eviction order in matrix-token-cache.ts, scroll position
preserved on "load older messages", and eslint.config.js added (lint
never ran on this feature before — flat config was simply missing).
- BUG-15 (mitigated): a small module-level credential cache in
lib/matrix.ts lets useTeamChat and useTeamUnreadCounts share one
fetched token instead of each hitting POST /api/chat/token
independently. Reduces but doesn't eliminate rate-limit risk under
rapid team switching (no in-flight dedup between the two hooks).
- BUG-16: refreshCounts() checks `cancelled` before setCounts.
- BUG-17: use-team-chat.ts uses getRoomUnreadNotificationCount()
instead of the deprecated getUnreadNotificationCount(); left
unchanged in use-team-unread-counts.ts on purpose, since importing
NotificationCountType there would undo BUG-11's bundle-splitting fix.
Cleanup:
- BUG-10: new POST /api/chat/logout invalidates the cached token and
calls Synapse's logout_all admin endpoint; frontend calls it
best-effort on logout and clears its own credential cache.
- BUG-22: trim() on displayName construction (trailing space with an
empty last name); the reported trailing-dot localpart is moot after
BUG-20 since localparts are random now, not name-derived.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143yYvjesjHndBACoweyK67
patrickandClaude Sonnet 5
edc05d4d1e