added media fixes, search, push updates, pwa, metrics. preparing release 1.0

2026-09-27 23:26:15 +03:00
parent 855a62755c
commit 6fc6d977bf
59 changed files with 6823 additions and 113 deletions
@@ -0,0 +1,33 @@
+# Changelog
+
+## [1.0.0] - 2026-09-27
+
+First production release. Self-hosted messenger for family and friends,
+built from scratch.
+
+### Added
+- **Auth**: registration/login, JWT access tokens (15 min) + rotated refresh
+  tokens (30 days) in httpOnly cookies, argon2id password hashing,
+  session revocation, rate-limited auth endpoints.
+- **Chat**: direct messages and groups (roles owner/member), read receipts,
+  typing indicators, presence, unread counters, keyset pagination.
+- **Realtime**: in-process WebSocket hub delivering message.created, typing,
+  presence, read, reaction and membership events.
+- **Media**: file upload/download with image thumbnails, S3-like storage
+  interface, local disk backend, path-traversal protection, 25 MiB limit.
+- **Reactions**: emoji reactions on messages with live sync.
+- **Search**: substring message search scoped to the user's conversations.
+- **Web Push**: VAPID notifications to offline members (optional, needs keys).
+- **PWA**: installable app, offline app-shell caching, Web Push service worker.
+- **Frontend**: React + TypeScript + Tailwind, dark theme, responsive,
+  optimistic UI.
+- **Observability**: Prometheus `/metrics` (HTTP, WS, runtime), VictoriaMetrics
+  + Grafana dashboard in `deploy/`.
+- **Hardening**: security headers (CSP, X-Frame-Options, nosniff), request
+  body limits, session cleanup, graceful shutdown.
+- **Tooling**: `cmd/keygen` (VAPID keys), `cmd/seed` (demo data),
+  GitHub Actions CI with PostgreSQL service.
+
+### Notes
+- Video attachments are supported as files; inline playback is planned.
+- E2EE is on the roadmap via libsignal; TLS in transit is the current baseline.