17 Commits (24fc8ab8ca68d092e7b12a5d51c48ca9420f72b5)

Author	SHA1	Message	Date
boojack	25feef3aad	fix(api): tolerate missing related users in memo conversions (#5809)	3 months ago
memoclaw	c53677fcba	fix(api): improve SSE hub design and fix double-broadcast on comments ... - Fix duplicate SSE event on comment creation: CreateMemoComment now suppresses the redundant memo.created broadcast from the inner CreateMemo call, emitting only memo.comment.created - Extract reaction event-building IIFEs into buildMemoReactionSSEEvent helper, removing duplicated inline DB-fetch logic - Promote resolveSSEAudienceCreatorID from method to free function (resolveSSECreatorID) since it never used the receiver - Add userID to SSE connect/disconnect log lines for traceability - Change canReceive default from permissive (return true) to deny-with-warning for unknown visibility types - Add comprehensive tests covering all new helpers, visibility edge cases, slow-client drop behavior, and the double-broadcast fix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	4 months ago
memoclaw	acddef1f3d	fix(api): switch user resource names to usernames (#5779) ... Co-authored-by: memoclaw <265580040+memoclaw@users.noreply.github.com>	4 months ago
milvasic	ea0892a8b2	feat: add live refresh via Server-Sent Events (SSE) with visual indicator (#5638) ... Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: milvasic <milvasic@users.noreply.github.com>	4 months ago
Johnny	c7b48b800f	fix: add access control checks for attachments, comments, and reactions ... Security fixes for multiple authorization bypass vulnerabilities: - GetAttachment: Add visibility check via checkAttachmentAccess helper - UpdateAttachment: Add ownership check (creator or admin only) - Fileserver: Require creator/admin auth for unlinked attachments - ListMemoAttachments: Add memo visibility check - CreateMemoComment: Add memo visibility check for target memo - ListMemoReactions: Add memo visibility check - UpsertMemoReaction: Add memo visibility check All checks follow the existing pattern used in GetMemo for consistency.	5 months ago
Johnny	d7284fe867	refactor: nest reaction resource names under memos	6 months ago
Johnny	7932f6d0d0	refactor: user auth improvements (#5360)	7 months ago
boojack	21d31e3609	fix(security): implement security review recommendations (#5228) ... Co-authored-by: Claude <noreply@anthropic.com>	8 months ago
Florian Dewald	769dcd0cf9	fix(security): add missing authorization checks to various services (#5217)	8 months ago
Johnny	efe6013c36	fix: add user authentication checks	9 months ago
varsnotwars	a9508b2546	chore: simplify convert reaction (#5001)	11 months ago
Steven	83febf9928	chore: clean resource definition	1 year ago
Steven	9972a77d9e	refactor: memo service	1 year ago
johnnyjoy	f1308ddd27	refactor: update part of resource identifier	1 year ago
Steven	e527b6a878	feat: move reaction type to setting	2 years ago
Steven	1ccfa81cf3	chore: tweak common function	2 years ago
Steven	20dd3e17f7	chore: rename router package	2 years ago