1.6 KiB
1.6 KiB
Changelog
[1.0.0] - 2026-09-27
First production release. Self-hosted messenger for family and friends, built from scratch.
Added
- Auth: registration/login, JWT access tokens (15 min) + rotated refresh tokens (30 days) in httpOnly cookies, argon2id password hashing, session revocation, rate-limited auth endpoints.
- Chat: direct messages and groups (roles owner/member), read receipts, typing indicators, presence, unread counters, keyset pagination.
- Realtime: in-process WebSocket hub delivering message.created, typing, presence, read, reaction and membership events.
- Media: file upload/download with image thumbnails, S3-like storage interface, local disk backend, path-traversal protection, 25 MiB limit.
- Reactions: emoji reactions on messages with live sync.
- Search: substring message search scoped to the user's conversations.
- Web Push: VAPID notifications to offline members (optional, needs keys).
- PWA: installable app, offline app-shell caching, Web Push service worker.
- Frontend: React + TypeScript + Tailwind, dark theme, responsive, optimistic UI.
- Observability: Prometheus
/metrics(HTTP, WS, runtime), VictoriaMetrics- Grafana dashboard in
deploy/.
- Grafana dashboard in
- Hardening: security headers (CSP, X-Frame-Options, nosniff), request body limits, session cleanup, graceful shutdown.
- Tooling:
cmd/keygen(VAPID keys),cmd/seed(demo data), GitHub Actions CI with PostgreSQL service.
Notes
- Video attachments are supported as files; inline playback is planned.
- E2EE is on the roadmap via libsignal; TLS in transit is the current baseline.