3 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	bacfef5558	fix(security): forwarding encrypted media to a plaintext room re-uploads it ... buildForwardContent copied content.file (AES key/iv/hashes) verbatim, so forwarding from an E2EE room into an unencrypted one published the key. For unencrypted destinations the attachment is now downloaded, decrypted and re-uploaded as plaintext (url instead of file, thumbnail key stripped); if that fails the forward is refused rather than leaking. Encrypted destinations unchanged. Needs a manual check on a live encrypted -> plaintext forward. Fixes #63 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 20:28:41 -04:00
jaredandClaude Opus 4.8	21276a47fc	fix(audit): low-tail cleanup — session/logout/unread/presence/forward ... Clears the clean 🟡 remainders from the feature audit (gate-green, 677 tests): - F3: getFallbackSession prefers the session-blob/legacy source with the later expiresAt (a downgrade→upgrade could boot on a stale blob's dead token). - F6: server-forced logout (SessionLoggedOut) now mirrors logoutClient — pushSessionToSW() + best-effort revokeOidcTokens for OIDC sessions (the search plaintext wipe was already added). - N5: deleteUnreadInfo parent fallback `?? roomId` → `?? []` (latently spread the roomId string into chars). - P10: useUserPresence re-seeds when the User object appears after first render. - forward: strip m.mentions so forwarding doesn't re-ping the original mentions. Left open: F5 (OIDC expiry not reachable in persistTokens), N6/H10/D7 (minor / runtime-verify). See LOTUS_TODO. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 22:57:09 -04:00
jaredandClaude Opus 4.8	ebcd8ec926	feat(ux): forward to multiple rooms + live bookmark previews (P6-3) ... Forward: checkbox multi-select room picker + "Send to N rooms" batch send (Promise.allSettled). Full success auto-closes; partial failure keeps the dialog open with a "Forwarded to X/N — failed: …" summary and prunes the selection to only the failures (retry won't duplicate to already-sent rooms). Content builder extracted to a unit-tested forwardContent.ts (edit-forwarding, reply-strip, undecryptable-refused; 4 tests). Bookmarks: BookmarksPanel resolves each saved message's live event (useRoomEvent) so previews reflect edits and show a deleted indicator for redactions; the stored snapshot stays as the fallback while loading, on fetch failure, or after leaving the room. Stored bookmark shape unchanged. Gates: tsc/eslint/prettier clean, build OK, 665 tests. Reviewed (dup-resend on retry + Checkbox readOnly fixed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 14:30:33 -04:00