memos

Commit Graph

Author	SHA1	Message	Date
Steven	71e8a06463	chore: upgrade Echo v4 to v5.0.3	4 months ago
Johnny	c7b48b800f	fix: add access control checks for attachments, comments, and reactions Security fixes for multiple authorization bypass vulnerabilities: - GetAttachment: Add visibility check via checkAttachmentAccess helper - UpdateAttachment: Add ownership check (creator or admin only) - Fileserver: Require creator/admin auth for unlinked attachments - ListMemoAttachments: Add memo visibility check - CreateMemoComment: Add memo visibility check for target memo - ListMemoReactions: Add memo visibility check - UpsertMemoReaction: Add memo visibility check All checks follow the existing pattern used in GetMemo for consistency.	4 months ago
Johnny	86fab0cf4c	fix(fileserver): use streaming for video/audio to prevent memory exhaustion - Add serveMediaStream() to stream video/audio without loading into memory - Use http.ServeFile for local files (zero-copy, handles range requests) - Redirect to S3 presigned URLs for S3-stored media files - Refactor for better maintainability: - Extract constants and pre-compile lookup maps - Consolidate duplicated S3 client creation logic - Split authentication into focused helper methods - Group code by responsibility with section comments - Add setSecurityHeaders() and setMediaHeaders() helpers	4 months ago
Johnny	5612fb8f41	feat: add HDR image and video support - Add HDR detection utilities for wide color gamut formats (HEIC, HEIF, WebP) - Apply colorSpace attribute to image/video elements for HDR-capable files - Update frontend components (AttachmentCard, PreviewImageDialog, AttachmentList) - Expand backend thumbnail generation to support HEIC, HEIF, WebP formats - Add Color-Gamut response headers to advertise wide gamut support - Extend avatar MIME type validation for HDR formats Supported formats: - Images: HEIC, HEIF, WebP, PNG, JPEG - Videos: MP4, QuickTime, Matroska, WebM (VP9 Profile 2) Browser support: - Safari 14.1+, Chrome 118+, Edge 118+ - Gracefully degrades to sRGB on unsupported browsers	5 months ago
Johnny	d7478b8003	perf: optimize memory usage for statistics and image processing	5 months ago
Johnny	50606a850e	fix(auth): resolve token refresh and persistence issues - Fix cookie expiration timezone to use GMT (RFC 6265 compliance) - Use Connect RPC client for token refresh instead of fetch - Fix error code checking (numeric Code.Unauthenticated instead of string) - Prevent infinite redirect loop when already on /auth page - Fix protobuf Timestamp conversion using timestampDate helper - Store access token in sessionStorage to avoid unnecessary refreshes on page reload - Add refresh token cookie fallback for attachment authentication - Improve error handling with proper type checking 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>	5 months ago
Johnny	7932f6d0d0	refactor: user auth improvements (#5360 )	5 months ago
Johnny	ea14280cb3	feat: enhance attachment handling with MIME type validation	6 months ago
Johnny	edd3ced9bf	refactor: migrate to connect-rpc (#5338 )	6 months ago
Steven	1cf047707b	refactor: migrate binary file serving from gRPC to dedicated HTTP fileserver Migrates attachment and avatar binary serving from gRPC endpoints to a new dedicated HTTP fileserver package, fixing Safari video playback issues and improving architectural separation. Key changes: - Created server/router/fileserver package for all binary file serving - Removed GetAttachmentBinary and GetUserAvatar gRPC endpoints from proto - Implemented native HTTP handlers with full range request support - Added authentication support (session cookies + JWT) to fileserver - New avatar endpoint supports lookup by user ID or username - Eliminated duplicate auth constants (imports from api/v1) HTTP endpoints: - Attachments: /file/attachments/:uid/:filename (unchanged URL) - Avatars: /file/users/:identifier/avatar (new URL format) This fixes Safari video/audio playback by using http.ServeContent() which properly handles HTTP 206 Partial Content responses and range request headers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>	6 months ago

10 Commits (71e8a06463deb40fb140c78f2fc59206f45318e7)