11 Commits

Include renames

Author	SHA1	Message	Date
justme	78b4e2aa63	fix(server): trim every workspace structure response to the caller's grants and restrict avatars to shared spaces ... - structure mutations returned the full structure to any member who could call them (moving an item after sending a message exposed channels the member has no access to) - moving items now requires write access to the destination channel; new folders require an existing channel - account avatars are only readable by the owner or accounts sharing a space	2026-10-17 21:31:15 +08:00
justme	bef8898cd8	feat(server): owner role group, custom role colors with effects and animated avatars	2026-10-17 13:25:13 +08:00
justme	82d55a97f9	fix(api): let authors and owners delete unfinished uploads	2026-10-16 19:42:33 +08:00
justme	1dd54243ae	feat(api): add space roles with delegated member removal and structure management	2026-10-16 19:42:31 +08:00
justme	c858bd2a09	feat(server)!: require a logged-in account for every channel request ... Drop unauthenticated guests from channels: the allow_guests setting, the /guests endpoints and the guest seat table are gone, and requests without an account session get 401 account_required. Share links are unaffected. Contract version is now 8.0.0.	2026-10-16 06:46:15 +08:00
justme	d946fc5e8a	feat(api)!: fold devices into users and report member presence ... Contract 7.0.0 (breaking). Devices become an attribute of the account; members are managed per user, and only unauthenticated guests keep a per-terminal registration. - rename seats -> max_members, seats_used -> members_used, seats_full -> members_full, SeatJoined -> JoinResult, the `seats` stream control message -> `members`, and POST /channels/{id}/seats -> POST /channels/{id}/join (stored channel settings are migrated on start) - drop per-terminal encrypted device labels and the seat list/release endpoints; add GET/DELETE /channels/{id}/guests for guest terminals - authenticate account members by account session only: the terminal key is optional for logged-in accounts, no seat row is written for them, and gated-download grants are counted per user (per terminal for guests) - GET /channels/{id}/members now returns online, devices and online_devices per account; presence is tracked in memory from active WebSocket/SSE subscriptions and is not pushed over the stream - owner invitation list no longer returns accounts that already joined	2026-10-14 22:18:59 +08:00
justme	a6f078d009	feat(files): add per-channel storage quota [CI]	2026-10-14 20:42:08 +08:00
justme	7b8d61d1ba	feat(api): add account workspaces and signed content events	2026-10-14 04:05:30 +08:00
justme	c7d8ef15bc	feat(api): bind encrypted workspaces to accounts and devices	2026-10-13 01:38:19 +08:00
justme	7406e2fe37	feat: integrate client and server sharing workflows	2026-10-02 10:49:45 +08:00
justme	42b93ae2d8	feat(server): implement sealed share lifecycle ... Signed-off-by: JustMe <mr.toing@outlook.com>	2026-10-02 00:59:56 +08:00