5 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	908e735933	fix(security): logout's search-index wipe coordinates across tabs ... deleteSearchCacheDatabase() resolved after a 3 s "blocked" timeout while another tab still held the DB, so decrypted rows could survive logout. It now broadcasts lotus-logout first; every tab closes its handle and refuses to reopen, then the delete proceeds. A boot with no session re-runs the wipe once in case a race was still lost. Unit-tested. Fixes #45 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-15 21:32:06 -04:00
jaredandClaude Opus 5	c8e49d3855	fix(security): persistent search index forgets redacted and left-room text ... Nothing ever removed an indexed row: redacted messages stayed searchable with full plaintext and rendered as normal results. Now: a client-level RoomEvent.Redaction listener deletes the row, leave/ban clears the room (clearRoom finally has a caller), m.replace edits upsert the original row instead of indexing the "* fallback" separately, and cached rows whose local event is redacted render through the existing redacted_because placeholder. Unit-tested. Fixes #14 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 19:46:05 -04:00
jaredandClaude Opus 4.8	fff811cb2d	fix(search): cap the encrypted-search IDB cache per room (bound disk growth) ... The on-device search index grew unbounded over a long session. putRows now prunes each touched room to MAX_ROWS_PER_ROOM (5000) — deleting the oldest rows by [roomId, ts] via a self-chaining IDB cursor within the same write tx (never awaits a non-IDB promise mid-tx, so the transaction can't auto-commit and truncate the prune). Exposed a pure, unit-tested evictCount() for the decision; the cursor path itself is browser-only (node --test has no IndexedDB). Deliberate tradeoff (documented in code): the coverage window keeps claiming the evicted tail so the search doesn't re-fetch → re-evict it forever. Net effect — in a room past 5000 cached rows, an evicted old message is silently unsearchable rather than churning. Clear cached index / logout still wipe everything. Two review agents verified the IndexedDB-spec correctness (cursor delete+continue semantics, put-then-count ordering, roomRange bracketing with no prefix bleed, tx liveness, abort→cache-miss) since CI can't. Gate-green (tsc, eslint, prettier, 925 tests, build). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-24 19:41:16 -04:00
jaredandClaude Opus 4.8	668bdaad7d	fix(wave-2): audit fixes — account-data races, search-cache wipe, export, media ... Web fixes from the Wave-2 bug-hunt (findings in LOTUS_TODO): - F1 (security): wipe the decrypted-plaintext search index on SERVER-FORCED logout too (token expiry / remote sign-out) — only manual logout did before. F4: the delete no longer reports success while onblocked (waits, 3s cap). - M1/M2 (data-loss): useBookmarks + useUserNotes account-data writes are now serialized at MODULE scope (single queue + latestRef per client, echo-driven), fixing the cross-instance lost-update clobber (useBookmarks mounts per message row, so a per-instance queue was insufficient — caught in review). - M6: room-history export gets a 200-page cap + Cancel + unmount-abort + correct date-range early-break (raw paginated ts). M4: image compression skips PNG (was flattening transparency to black), bakes EXIF orientation via createImageBitmap, .jpg-renames, and falls back to the original on decode failure instead of dropping the file. M5: MediaGallery lightbox opens the right item (shared thumb guard). M8: audio speed survives async decrypt. - Desktop web wiring: D2 badge sums leaf rooms only (space double-count, like the favicon fix); D3 useTauriDnd re-hydrates from get_tray_dnd on mount; D5 updater has a terminal state. Reviewed; M7 reverted (past-time clamp is an intentional, tested contract). tsc/eslint/prettier clean, build OK, 678 tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 20:56:27 -04:00
jaredandClaude Opus 4.8	7da960ac8c	feat(search): opt-in persistent index for encrypted-room search (P4-8) ... Raw-IndexedDB cache (lotus-search-cache: messages keyed [roomId,eventId] + per-room coverage) merged into local search with in-memory-wins dedupe. OPT-IN (default off) via a standalone atom — stores decrypted text at rest, so it ships with a privacy note, a Clear button, and an unconditional wipe on logout (initMatrix). All IDB errors degrade to cache-miss. +8 tests (1 IDB skip in node). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-01 21:19:02 -04:00