rogee/gochat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
557 Commits 1 Branch 0 Tags
eb83d241fede3c0bb6e2fc28f3170caa726cc2e5
Commit Graph
557 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rogeeandrogee eb83d241fe HH-547: allow cross-origin widget requests (#126) 
* HH-547: allow cross-origin widget requests

* fix(HH-547): align production preflight with wildcard CORS

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 20:11:04 +08:00
Rogeeandrogee a2e4f9a1e8 HH-540: scope iframe policy to Widget page (#123) 
* fix(HH-540): scope iframe policy to widget page

* fix(HH-540): reject non-string allowed domains

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 18:37:08 +08:00
Rogeeandrogee 867092fd99 HH-530: replace user-facing Chatwoot branding with GoChat (#117) 
* fix(HH-530): replace user-facing Chatwoot branding

* fix(HH-530): close branding review blockers

* test(HH-530): cover update banner binding

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 18:14:02 +08:00
Rogeeandrogee a635be6dc8 HH-531: remove CSP-blocked draggable shim (#122) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 17:48:30 +08:00
Rogeeandrogee f719a18ba8 HH-533: align ActionCable heartbeat protocol (#121) 
* fix(ws): align ActionCable heartbeat protocol (HH-533)

* test(ws): cover ActionCable heartbeat cadence (HH-533)

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 17:46:44 +08:00
rogee 2c5e6e595f fix(shangwutong): initialize contact attributes on inbox creation 2026-08-23 17:32:35 +08:00
rogee 25ef9ae494 fix(deploy): reuse shared redis and serve dashboard at root 2026-08-23 17:32:02 +08:00
Rogeeandrogee 56a2f2e6a5 ci: disable GitHub Actions workflow (#118) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 17:23:54 +08:00
Rogeeandrogee 3aac701495 fix(HH-528): persist auto resolve message (#116) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 16:54:20 +08:00
Rogeeandrogee 5a61aac1f2 HH-529: allow blob avatar previews in CSP (#115) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 16:52:20 +08:00
Rogeeandrogee dac8c5e068 HH-502: cover non-widget message sender events (#113) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 07:40:38 +08:00
Rogeeandrogee eaf6edef66 HH-503: harden production Docker mock assertions (#112) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 07:40:23 +08:00
Rogeeandrogee a5d244d293 HH-500: add reproducible production dist bundle (#111) 
* HH-500: add reproducible production dist bundle

* HH-500: make production bundle builds reproducible

* HH-500: lock complete runtime APK closure

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 00:22:20 +08:00
Rogeeandrogee ef8931099c HH-469: close WebSocket fanout contract gaps (#109) 
* HH-469: close websocket fanout contract gaps

* fix: unify message sender contracts

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-23 00:22:01 +08:00
Rogeeandrogee f91dc6ca1a test(HH-460): observe restore file order (#108) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:35:31 +08:00
Rogeeandrogee 4004645574 HH-459: disable worker HTTP healthcheck in quickstart (#105) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:20:44 +08:00
Rogeeandrogee 43253b51c9 HH-460: cover migration and backup restore regressions (#104) 
* test(HH-460): cover migration and restore regressions

* test(HH-460): verify real restore evidence

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:20:27 +08:00
Rogeeandrogee c86744d326 docs: update production config references (HH-465) (#103) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:20:11 +08:00
Rogeeandrogee 2b75390529 HH-452: cover upload security boundaries (#106) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:19:43 +08:00
Rogeeandrogee 6444c40531 test: preserve quality and websocket evidence (#107) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 21:19:09 +08:00
Rogeeandrogee fb83285617 HH-445: deploy production observability and runbooks (#96) 
* HH-445: deploy production observability and runbooks

* fix(ops): share production database DSN

* fix(HH-445): enforce database TLS gate

* fix(HH-445): preserve production serve command

* fix(prod): require external database dependencies

* fix(prod): unify database host rejection gates

* test(prod): enforce exact database TLS runbook contract

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 19:39:57 +08:00
Rogeeandrogee 61376a57fd HH-446: restore auditable quality gates from current main (#102) 
* HH-446: restore auditable quality gates

* test(HH-446): restore help center smoke contract

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 15:45:58 +08:00
Rogeeandrogee f719529d66 fix(security): harden auth and secret handling (HH-444) (#101) 
* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 15:45:06 +08:00
Rogeeandrogee e1557e7f21 test(HH-468): reject tampered promoted attestations (#98) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 04:35:33 +08:00
Rogeeandrogee fccfa85c3a ci(HH-464): pin browser harness Chrome (#97) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 04:30:06 +08:00
Rogeeandrogee b6b1597e90 HH-462: harden release attestation semantics (#94) 
* HH-462: bind release attestations to source and digest

* HH-462: exercise release attestation production paths

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 04:07:32 +08:00
Rogeeandrogee 0e23ccc465 ci(HH-451): harden production Compose smoke (#95) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 03:58:11 +08:00
Rogeeandrogee 02a188dc29 HH-443: establish production CI and supply-chain evidence (#93) 
* ci: enforce production release gates

* ci: close release gate review blockers

* ci: preserve verified digests during promotion

* ci: serialize and verify release cleanup

* ci: build govulncheck with Shangwutong toolchain

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 03:26:38 +08:00
Rogeeandrogee 798ea43c2f HH-442: isolate runtime processes and harden shutdown (#90) 
* HH-442: isolate runtime processes and harden shutdown

* HH-442: harden worker shutdown races

* HH-442: gate dependency shutdown on active handlers

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 02:38:15 +08:00
Rogeeandrogee 6d6d80dd86 HH-441: harden durable storage and recovery (#92) 
* HH-441: harden durable storage and recovery

* HH-441: clear recovery review blockers

* HH-441: enforce offsite backup failure domain

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-22 02:16:02 +08:00
Rogeeandrogee 77c91662d2 HH-438: close upload and remote URL attack surfaces (#89) 
* HH-438: close upload and remote URL attack surfaces

* HH-438: use valid PNG in direct upload test

* HH-438: align PostgreSQL upload staging schema

* HH-438: run upload migrations before PostgreSQL E2E

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 20:36:52 +08:00
Rogeeandrogee 7a9fec33c5 HH-439: harden production artifact pipeline (#86) 
* HH-439: harden production artifact pipeline

* fix(HH-439): address production compose review

* fix(HH-439): preserve previous JWT secrets in production

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 20:20:00 +08:00
Rogeeandrogee 7e3872170f HH-448: enforce PostgreSQL E2E gate (#87) 
* HH-448 enforce PostgreSQL E2E gate

* HH-448 fail CI when concurrency test is missing

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 20:00:41 +08:00
Rogeeandrogee cf263d10b4 HH-437: harden production auth and tenant authorization (#84) 
* HH-437 harden auth and account authorization

* HH-437 reject revoked platform access

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 19:13:10 +08:00
Rogeeandrogee 04c1654086 HH-427: add runtime config browser smoke (#81) 
* HH-427: add runtime config browser smoke

* HH-427: enforce browser smoke in CI

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 16:02:54 +08:00
Rogeeandrogee 46d63245a1 HH-424: clean up Vite build warnings (#80) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 15:06:05 +08:00
Rogeeandrogee 26d494c6d6 test(autoassignment): report cleanup errors (HH-423) (#79) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 14:41:25 +08:00
Rogeeandrogee e665abbfb8 H-417: include frontend TypeScript in format checks (#78) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 14:37:23 +08:00
Rogeeandrogee a0f668b2d8 H-419: run auto-assignment concurrency on PostgreSQL (#77) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 14:18:32 +08:00
Rogeeandrogee e8fa7c9c2c H-418: cover widget direct upload file flow (#76) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 14:17:03 +08:00
Rogeeandrogee b971b09ac7 H-409: restore frontend ESLint and Prettier baseline (#72) 
* H-409: restore frontend lint baseline

* ci(H-409): check representative frontend lint

---------

Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 14:11:08 +08:00
Rogeeandrogee 646449ebee test(autoassignment): stabilize concurrency diagnostics (#75) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:57:19 +08:00
Rogeeandrogee dddbe25899 H-412: cover legacy widget attachment parity (#73) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:50:08 +08:00
Rogeeandrogee 1afe9dddeb H-413: cover mismatched ContactInbox history (#74) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:49:11 +08:00
Rogeeandrogee 5135793bd2 test(autoassignment): cover concurrent CAS loser (#71) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:25:39 +08:00
Rogeeandrogee 40ab664b08 H-388: tighten contact inbox conversation scope (#68) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:19:12 +08:00
Rogeeandrogee a0a6c338f5 H-386: unify legacy widget message serialization (#69) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:18:13 +08:00
Rogeeandrogee 517a6090b3 test(H-359): assert direct upload completes after retry (#70) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:13:58 +08:00
Rogeeandrogee 181e9051ec H-354: cover Captain provider timeout (#67) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:10:04 +08:00
Rogeeandrogee 038f185b57 H-392: surface Captain playground failures (#66) 
Co-authored-by: Rogee <rogee@ipao.vip>
 2026-08-21 13:01:13 +08:00