4 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	70206d6033	chore(deps): matrix-js-sdk 41.7 -> 44.0 (#201) ... Picks up three releases of MatrixRTC / delayed-event fixes and matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0. SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so the native-OAuth sign-in is ported: - login discovers the auth server via /auth_metadata, registers with OAuth2.registerClient, and keeps the PKCE verifier + device in its own sessionStorage entry keyed by `state` (single use; CSRF check); - refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16 cross-tab protection is kept by a narrow guard on refresh-token grants (the SDK calls the global fetch for OAuth, not fetchFn), which serialises them with a Web Lock and adopts a sibling tab's tokens; - logout and forced logout revoke via mx.logout() (the SDK revokes at the auth server for OAuth sessions); - the callback page parsed its params on every render, re-running the single-use code exchange in a loop; parsed once now. Also: notification_type is deprecated in MSC4075 (ring in DMs, notify elsewhere when omitted), _onRTCSessionMemberUpdate -> ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the 7.8 MB crypto wasm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 00:32:13 -04:00
jaredandClaude Opus 5	d0dccdeb67	fix(auth): OIDC token rotation no longer reloads every other tab ... useSessionSync reloaded on any out-of-tab session change, so a routine refresh in one tab hard-reloaded the others mid-call. Classify the change: removed → reload, user/device changed → reload, same device with a new token → swap it into the running client (setAccessToken + the shared refresh token) in place. The refresher takes a Web Lock and adopts tokens another tab already rotated instead of racing the issuer. Unit-tested classifier. Fixes #16 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 19:46:05 -04:00
jaredandClaude Opus 4.8	a267e9e960	fix: low-tail correctness — thread notifs, call audio, OIDC expiry ... Verify-then-fix batch of minor bugs; each staged diff reviewed by 2 agents (both SHIP). Two listed items (N6 receipt-avatar refresh, H10 room-name length reject) were already handled and left unchanged. Threads: - T5: a just-sent reply no longer under-notifies — `participated` also checks the local thread timeline for our own events, since the server-bundle `hasCurrentUserParticipated` lags. - T6: a room set to "Mentions & Keywords only" no longer over-notifies Default thread replies — new `roomMentionsOnly` gate (behavior-identical when false; +4 unit tests). - T7: thread-mode account-data writes are serialized with content carried forward (setAccountData is a bare PUT whose result lags the /sync echo, so plain serialization wouldn't stop the lost update); carry only on success. Calls / audio: - C-L2: a real incoming ring cancels a lingering Settings ringtone preview. - C-L3: the ringtone AudioContext is primed on the first page gesture (via the always-mounted CallEmbedProvider) so the first ring after a cold load isn't silent. - C-L5: useCallSpeakers depends on a stable boolean, so the tile MutationObserver + io.lotus.call_state subscription aren't rebuilt on every membership change. Crypto: - F5: the OIDC refresher forwards the freshly-refreshed token expiry (passed on the tokens object at runtime) as expiresInMs, so the persisted expiresAt no longer goes stale across reloads. Gates: tsc 0, eslint 0, prettier clean, 860/860 tests, build ok. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-19 02:47:27 -04:00
jaredandClaude Opus 4.8	67bd05fc96	feat(auth): OIDC phase 4/5/6 — token refresh, logout revocation, account link ... - initMatrix.ts: import the shared Session type; when a session has a refresh token + oidc metadata, wire a LotusOidcTokenRefresher via createClient's refreshToken + tokenRefreshFunction (reactive 401 refresh). Rust crypto is unaffected (still keyed on userId/deviceId). - client/oidcTokenRefresher.ts: OidcTokenRefresher subclass that persists rotated tokens back to the fallback session. - client/oidcLogout.ts + logoutClient: best-effort revoke access+refresh tokens at the issuer's revocation_endpoint on logout (tolerant of failure). - settings/account/OidcManageAccount.tsx: MSC2965 "Manage account" deep-link, shown only when authMetadata is present (OIDC servers); mirrors OtherDevices. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 16:12:13 -04:00