cinny/LOTUS_BUGS.md

# Lotus Chat — Bug Report & Technical Audit

**Date:** June 2026

This document tracks identified bugs, edge cases, and architectural discrepancies.

---

## ✅ Resolved Issues (Recently Fixed)

- **GIF Sending Bypasses E2EE**: Fixed in `RoomInput.tsx`.
- **Scheduled Messages Bypass E2EE**: Fixed in `scheduledMessages.ts`.
- **Drag-and-Drop Overlay Persistence**: Fixed in `useFileDrop.ts`.
- **Stale Member List in Verification Banner**: Fixed in `useDeviceVerificationStatus.ts`.
- **Incomplete Python Comment Highlighting**: Fixed in `syntaxHighlight.ts`.
- **Search Button Hidden in E2EE Rooms**: Fixed in `RoomViewHeader.tsx`.
- **TDS Design Law Violations (Hardcoded Hex)**: Fixed in `GifPicker.tsx` and `VoiceMessageRecorder.tsx`.
- **Recent Emoji Sort Order**: Fixed in `recent-emoji.ts` (recency order, not frequency).
- **Encrypted Search Misses Historic Events**: Fixed in `useLocalMessageSearch.ts`.
- **Presence Updater Base URL Hack**: Fixed in `usePresenceUpdater.ts`.
- **Presence Badge Accessibility**: Fixed in `Presence.tsx` (`aria-label` on badge).
- **Presence Updater Wipes Custom Status**: Fixed in `usePresenceUpdater.ts` (removed `status_msg: ''`).
- **Manifest Main Icon Paths 404**: Fixed in `public/manifest.json` (`./public/android/` → `./res/android/`). Shortcut icon was already correct.

---

## 🛡️ Critical Security & Logic

### 1. Edit History Broken for E2EE

**File:** `src/app/features/room/message/EditHistoryModal.tsx`
**Status:** **OPEN**

- **Issue:** The modal fetches edit history via raw `fetch`. The returned events are not decrypted.
- **Impact:** In encrypted rooms, the edit history shows ciphertext or "(no text)" for all previous versions.
- **Recommended Fix:** After fetching raw events, check if they are encrypted. Use `mx.decryptEventIfNeeded(event)` for each event in the chunk before rendering.

### 2. Service Worker Ephemeral Sessions

**File:** `src/sw.ts`
**Status:** **OPEN**

- **Issue:** Access tokens are stored in an in-memory `sessions` Map within the SW.
- **Impact:** Closing all app tabs wipes the sessions. Background tasks (like future push notification handling or media pre-fetching) will fail.
- **Recommended Fix:** Persist the session info (accessToken/baseUrl) in IndexedDB within the Service Worker so it survives app restarts.

---

## 📱 PWA & Mobile Issues

### 1. No PWA Precaching (Offline Mode Broken)

**File:** `src/sw.ts`, `vite.config.js`
**Status:** **OPEN**

- **Issue:** The Service Worker is missing the `self.__WB_MANIFEST` injection point and `precacheAndRoute` call.
- **Impact:** The app does not work offline and fails PWA installation requirements in most browsers.
- **Recommended Fix:** Add `precacheAndRoute(self.__WB_MANIFEST)` to `sw.ts` and ensure `vite.config.js` has a valid `injectionPoint`.

### 2. PiP Resize Impossible on Mobile

**File:** `src/app/components/CallEmbedProvider.tsx`
**Status:** **OPEN**

- **Issue:** Resizing the PiP window uses `onMouseDown` handlers which do not trigger on touch devices.
- **Impact:** Mobile users cannot resize the PiP window.
- **Recommended Fix:** Implement `onTouchStart` handlers for the resize corners, mapping touch coordinates to the same resize logic.

### 3. Double Background Animation (GPU Waste)

**File:** `src/app/pages/client/SidebarNav.tsx`, `src/app/features/room/RoomView.tsx`
**Status:** **OPEN**

- **Issue:** When Glassmorphism is enabled, the chat background is mirrored to `document.body` while the `RoomView` also renders it.
- **Impact:** Two identical animations (e.g., Digital Rain) run simultaneously, doubling GPU usage on mobile.
- **Recommended Fix:** When Glassmorphism is active, make the `RoomView` background transparent and rely on the `document.body` background.