Security, performance, bug fixes, and TDS improvements

Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)

This commit is contained in:

Lotus Bot

2026-05-19 16:26:25 -04:00

parent 20ee28b423

commit 63e1085984

11 changed files with 77 additions and 12 deletions

									
										index.html
									
		+1
		-1
	
												View File
												
				@@ -3,7 +3,7 @@

				  <head>

				    <meta charset="UTF-8" />

				    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

				    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" />

				    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

				    <title>Lotus Chat</title>

				    <meta name="name" content="Lotus Chat" />

				    <meta name="author" content="Lotus Guild" />