6 Commits

Author	SHA1	Message	Date
ZhenYi	18ea3cc355	refactor(room): apply rustfmt formatting	2026-05-14 10:02:21 +08:00
ZhenYi	ba2490dab4	feat(core): initialize project with access control and AI integration	2026-05-10 21:01:21 +08:00
ZhenYi	abcfc5b3bb	refactor(room): simplify room core modules and connection handling ... Extract connection pool management and helper utilities. Remove redundant metrics indirection, expose counters directly. Trim room.rs boilerplate and move AI queue logic to room_ai_queue.	2026-04-30 19:16:33 +08:00
ZhenYi	bdb5393835	fix: resolve 30+ bugs from security audit ... Critical: - CORS: replace allow_any_origin + credentials with env-configured origins - XSS: escape HTML before dangerouslySetInnerHTML in search results - Path traversal: sanitize storage keys to reject ".." components - Auth missing: add Session requirement to git init/open/is-repo endpoints - Transaction: wrap issue cascade delete in DB transaction High: - Mutex poisoning: replace unwrap() with poison-recovering guards - Drop tokio::spawn: use runtime handle or fallback thread for lock release - Redis KEYS: replace with non-blocking SCAN for typing events - SSH panic: handle missing stdin/stdout/stderr gracefully - LFS auth: remove x-user-uid header injection vector, generate per-request tokens Medium: - Memory leak: remove Box::leak in provider normalization - Race conditions: query closed count directly instead of subtraction - Silent failures: add tracing::warn for AI tasks, room events, activity logs - Frontend nav: sync activeRoomId when initialRoomId prop changes - Duplicate nav: remove redundant setActiveRoom in delete handler - Callback conflict: skip undefined values in updateCallbacks merge - Stale closure: use wsClient state instead of wsClientRef.current in useMemo Low: - Captcha: validate captcha not empty before login submission - Broadcast capacity: reduce from 100K to 1000 - Error handling: add try/catch for removeMember and updateMemberRole - Loading state: show placeholder instead of null in RepositoryContextProvider - WebSocket: add heartbeat ping and jitter to reconnect backoff	2026-04-27 10:57:23 +08:00
ZhenYi	57779822dc	refactor(room): migrate from slog to tracing + upgrade metrics to 0.22 ... - Remove all use slog::* imports and log: slog::Logger fields - Replace slog macros with tracing::{info!, warn!, error!, debug!} - metrics.rs: upgrade metrics 0.21→0.22, remove register_*! macros, use functional API: metrics::gauge!(), metrics::counter!(), metrics::histogram!(), metrics::describe_gauge!() etc. - RoomMetrics: all fields now use functional metrics API, dynamic room_id labels passed as owned String to avoid lifetime issues - RoomService: remove pub log: slog::Logger field - connection.rs: remove log from subscribe_room_events, subscribe_project_room_events, subscribe_task_events_fn	2026-04-21 22:28:52 +08:00
ZhenYi	93cfff9738	init	2026-04-15 09:08:09 +08:00