Skip to content

C
canifa_note
Switch branch/tag
  1. 02 Apr, 2026 2 commits
  3. 01 Apr, 2026 4 commits
  5. 31 Mar, 2026 4 commits
  7. 30 Mar, 2026 4 commits
  9. 29 Mar, 2026 1 commit
  11. 28 Mar, 2026 3 commits
    • memoclaw's avatar
      fix(api): make credentials write-only and restrict sensitive settings to admins · 9d3a74bc
      memoclaw authored 
      Security fixes for credential leakage across three resources:

- NOTIFICATION setting: restrict GetInstanceSetting to admin-only
  (was publicly accessible, exposing SMTP credentials)
- SMTP password: never return SmtpPassword in API responses (write-only)
- S3 secret: never return AccessKeySecret in API responses (write-only)
- OAuth2 ClientSecret: never return in API responses for any role
  (was previously returned to admins); remove redactIdentityProviderResponse
  in favor of omitting the field at the conversion layer
- Preserve-on-empty: when updating settings with an empty credential
  field, preserve the existing stored value instead of overwriting
  (applies to SmtpPassword, AccessKeySecret, and ClientSecret)
Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      9d3a74bc
    • memoclaw's avatar
      fix(api): improve SSE hub design and fix double-broadcast on comments · c53677fc
      memoclaw authored 
      - Fix duplicate SSE event on comment creation: CreateMemoComment now
  suppresses the redundant memo.created broadcast from the inner
  CreateMemo call, emitting only memo.comment.created
- Extract reaction event-building IIFEs into buildMemoReactionSSEEvent
  helper, removing duplicated inline DB-fetch logic
- Promote resolveSSEAudienceCreatorID from method to free function
  (resolveSSECreatorID) since it never used the receiver
- Add userID to SSE connect/disconnect log lines for traceability
- Change canReceive default from permissive (return true) to
  deny-with-warning for unknown visibility types
- Add comprehensive tests covering all new helpers, visibility edge
  cases, slow-client drop behavior, and the double-broadcast fix
Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      c53677fc
    • boojack's avatar
      chore: tweak featured sponsors · d720efb6
      boojack authored 
      Removed the old sponsors table and replaced it with individual sponsor links and descriptions.
Signed-off-by: 's avatarboojack <stevenlgtm@gmail.com>
      d720efb6
  13. 26 Mar, 2026 1 commit
  15. 25 Mar, 2026 2 commits
  17. 24 Mar, 2026 6 commits
  19. 23 Mar, 2026 5 commits
  21. 22 Mar, 2026 1 commit
  23. 21 Mar, 2026 3 commits
  25. 20 Mar, 2026 4 commits