5 Commits

Include renames

Author	SHA1	Message	Date
lockbitchat	0de8ab2d54	Replace free TURN with self-hosted coturn; fix Safari connectivity; release v5.4.10 ... - config/ice-servers.prod.js: swap ExpressTURN for self-hosted coturn at turn.securebit.chat (TURN udp/tcp on 3478, TURNS/TLS on 443). Long-lived REST-API credential (expiry capped at int32 max for coturn compatibility). - Add raw-IP STUN/TURN fallback (144.172.96.126): Safari's WebRTC layer fails to resolve STUN/TURN hostnames on some networks and gathers no srflx/relay candidates; reaching the server by IP fixes cross-browser (Safari<->Chrome) connections. Harmless to other browsers. - deploy/nginx.conf: never long-cache /config/ice-servers.js so clients don't lock onto a stale server list. - Bump version to 5.4.10 (header + init banner).	2026-07-22 18:10:17 -04:00
lockbitchat	c98a01b1d5	Add end-to-end encrypted voice messages; release v5.4.5 ... - Record voice notes in-browser, sent over the chunked AES-GCM file-transfer channel (per-file session key + signed SHA-256 integrity). - Captured as PCM and encoded to WAV for universal playback (incl. iOS/Safari); auto-accepted and played inline from an in-memory blob, never written to disk. - Composer mic button with live waveform + timer; desktop shows mic + send side by side, mobile swaps mic to send when typing. - CSP media-src now allows blob: so recorded/received audio can play. - Roadmap: Desktop Edition -> 5.0, new 5.5 'Secure Voice & Calls', later milestones shifted; version bumped to 5.4.5. - Update README, docs (security/API/cryptography), and CHANGELOG.	2026-07-22 00:41:58 -04:00
lockbitchat	42be55aaeb	fix(security): restore outgoing message integrity, add HSTS/Permissions-Policy ... - Remove send-path keyword blocklist that silently rejected legitimate messages (e.g. "constructor", "global", "document.", literal "javascript:") without adding protection. XSS is enforced at the rendering boundary by the receive-side DOMPurify pass and by sanitizeMessage() before encryption. - Preserve newlines/tabs/indentation in _sanitizeInputString; stop collapsing all whitespace which destroyed multi-line messages and code snippets. - Stop logging raw AAD (sessionId + keyFingerprint) on validation failure; log length only, in both message and file-message AAD validators. - Add Strict-Transport-Security (2y + preload) and Permissions-Policy (camera=self for QR, rest denied) to nginx.conf and .htaccess. - Add tests/outgoing-message-integrity.test.mjs regression suite.	2026-06-18 16:48:29 -04:00
lockbitchat	017a590220	fix(deploy): 404 missing assets instead of HTML fallback; ship public STUN config ... - nginx: asset extensions use try_files $uri =404 so a missing file (e.g. config/ice-servers.js) no longer serves index.html with the wrong content type - add config/ice-servers.prod.js (public STUN, no secrets); Dockerfile copies it to the git-ignored config/ice-servers.js so the operator-override path exists	2026-06-15 16:30:39 -04:00
lockbitchat	d58967c671	build: add Fly.io deployment (nginx static serving) ... - Dockerfile: serve the static PWA via nginx:alpine on port 8080 - deploy/nginx.conf: mirror .htaccess (jsx/mjs MIME, no-cache for shell/sw/manifest/meta/dist, long-immutable cache for assets, security headers, SPA fallback) - fly.toml: internal_port 8080, force_https, scale-to-zero - .dockerignore: exclude .git/node_modules/tests from the image	2026-06-15 16:23:14 -04:00