exceljs (latest 4.4.0) ships years-old transitive dependencies that
npm flags as deprecated on every install (rimraf 2, glob 7, inflight,
fstream, lodash.isequal) and needed a uuid override for a security
advisory. It was only used for the single-sheet analytics XLSX export,
which write-excel-file covers with the same output (column widths,
bold/grey header, formula-injection escaping).
Removes the now-unneeded exceljs uuid override.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Modal dialogs (e.g. the create-event form) grew beyond the screen and
scrolled the page behind them. Cap the card at the viewport height and
scroll the body inside it, keeping the header pinned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Unchecking "allow recording" in room settings now also clears the
transcript/AI summary checkbox (it was only greyed out before, so a
previously enabled value stayed checked and got saved)
- Server enforces the coupling on room create and update: with
recording disabled, recording_transcript is always stored as 0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- New endpoint POST /api/calendar/events/:id/email sends event
invitations with an .ics attachment to external email addresses
(rate-limited like room email invites)
- Create-event dialog gets an optional invitations section to invite
people by email or federation address right away
- The "Invite remote" dialog on existing events now accepts email
addresses in addition to federation IDs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When the per-room AI summary/transcript setting is disabled (or the
integration is not configured), pass
meta_bbb-disable-recording-formats=transcript,summary on meeting create
so BBB skips processing and publishing those formats entirely
(bigbluebutton/bigbluebutton#25277).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ported from greenlight-tm: when TRANSCRIPTION_API_URL and
TRANSCRIPTION_API_KEY are set in the .env and the per-room
"AI summary / transcript" setting is enabled, Redlight POSTs to
${TRANSCRIPTION_API_URL}/prompt (header X-Api-Key) as soon as the
"video" format of a recording becomes available.
- transcription.js: service with env gating, timeout and logging
- bbb.js: pass meta_bbb-recording-ready-url on meeting create when the
room has the setting enabled
- recordings.js: unauthenticated /recording-ready callback that
verifies BBB's signed_parameters JWT (HS256, shared secret), caches
the recording and requests the transcription once per recording
(deduped via transcript_requested_at)
- rooms: new recording_transcript column, accepted on create/update
- branding endpoint exposes transcriptionEnabled so the UI only shows
the toggle when the server is configured
- RoomDetail: toggle under "Allow recording" (disabled when recording
is off), de/en i18n
- chore: bump version to 2.4.0
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The password reset email is rendered server-side via emaili18n.js,
which loads translations from server/i18n. The email.resetPassword
keys only existed in the frontend src/i18n locales, so t() returned
the raw key paths in the sent email. Move the EN/DE block to the
server locales and drop the unused copy from the frontend.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a self-service password reset to the login flow:
- Login page now shows a "Passwort vergessen?" link under the password field
- New /forgot-password page requests a reset email by address
- New /reset-password page sets a new password from an emailed token
- Backend: POST /auth/forgot-password and /auth/reset-password with
dedicated rate limiters; tokens stored as SHA-256 hashes with a 1h expiry
- Generic responses avoid leaking account existence or SMTP/SSO state;
SSO-only accounts are skipped
- New sendPasswordResetEmail mailer + email/auth i18n keys (de + en)
- DB migration: reset_token_hash, reset_token_expires, reset_requested_at
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security:
- rooms: rate-limit /invite-email (SMTP spam relay), validate share
target user exists, guard timingSafeEqual against length mismatch
in the presentation route (500 -> 403)
- analytics: verify callback token before parsing the 5mb body so
unauthenticated callers cannot buffer large payloads
- caldav: rate-limit failed Basic-Auth attempts (token brute force),
lowercase email lookup, case-insensitive principal check
- auth: fall back to the in-memory rate-limit store when Redis is
unavailable; previously every rate-limited endpoint (incl. login)
returned 500 when the Redis connection was down
UI/copy:
- Home: factual hero copy and feature cards (6 instead of 9), fix
double-rendered feature icon, remove fake stats row and pill badge;
keep the background gradient and card layout
- i18n: consistent informal tone, drop trailing exclamation marks
from status toasts, remove emoji from transactional emails
- new favicon (logo.svg), restore theme-based default brand logo
Chore:
- gitignore SQLite WAL/SHM files
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bug fixes:
- bbb.js: replace undefined t('defaultWelcome') call that threw a
ReferenceError when a room had an empty welcome message, breaking
meeting creation. Default welcome and the guest-invite hint are now
localised via the i18n system (new "bbb" namespace in de/en).
- auth.js: app name was read from the never-written 'branding' settings
key, so custom names never appeared in verification emails or the TOTP
issuer. Now resolved through a shared getAppName() helper.
- auth.js: lowercase the email in the registration duplicate check so
case-variant duplicates return a clean 409 instead of a 500 (UNIQUE
violation).
- federation.js: select the user's "language" column so federation
invite emails respect the recipient's language instead of always
defaulting to English.
- calendar.js: a set reminder could not be cleared. COALESCE treated an
explicit reminder_minutes: null as "keep existing"; use a direct
assignment that distinguishes "omitted" (keep) from "null" (clear).
- index.js / analytics.js: exclude the BBB learning-analytics callback
from the global 100kb body limit and give it its own 5mb limit, since
analytics payloads for large meetings can be several MB.
Cleanup:
- Add server/config/appName.js as the single source of truth for the
app name (admin setting -> APP_NAME env -> 'Redlight') and use it in
auth, admin, rooms, calendar and federation, replacing the previous
mix of wrong DB key, direct app_name reads and bare process.env reads.
- Localise the BBB default welcome message in the room owner's language.
- Remove two unused safeAppName variables in mailer.js.
- Added `htmlFor` attributes to labels for better accessibility in Calendar, Dashboard, GuestJoin, Login, Register, RoomDetail, and Settings pages.
- Included `aria-hidden` attributes for icons to improve screen reader experience.
- Set `autoComplete` attributes for input fields to enhance user experience during form filling.
- Implemented `role` and `aria` attributes for radio groups and buttons to improve accessibility compliance.
- Changed `flex-shrink-0` to `shrink-0` in multiple components for better consistency.
- Updated button and checkbox classes to use `rounded-sm` for a more uniform appearance.
- Adjusted backdrop blur classes for modals to `backdrop-blur-xs` for a subtler effect.
- Removed unused Tailwind CSS configuration file.
MichelleandClaude Fable 5