6 Commits

Include renames

Author	SHA1	Message	Date
MichelleandClaude Opus 4.8	7dd834cd35	Harden server security, rework landing page and refresh branding ... Security: - rooms: rate-limit /invite-email (SMTP spam relay), validate share target user exists, guard timingSafeEqual against length mismatch in the presentation route (500 -> 403) - analytics: verify callback token before parsing the 5mb body so unauthenticated callers cannot buffer large payloads - caldav: rate-limit failed Basic-Auth attempts (token brute force), lowercase email lookup, case-insensitive principal check - auth: fall back to the in-memory rate-limit store when Redis is unavailable; previously every rate-limited endpoint (incl. login) returned 500 when the Redis connection was down UI/copy: - Home: factual hero copy and feature cards (6 instead of 9), fix double-rendered feature icon, remove fake stats row and pill badge; keep the background gradient and card layout - i18n: consistent informal tone, drop trailing exclamation marks from status toasts, remove emoji from transactional emails - new favicon (logo.svg), restore theme-based default brand logo Chore: - gitignore SQLite WAL/SHM files Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 10:14:36 +02:00
Michelle	4aea069295	fix: resolve server bugs and unify app-name handling ... Bug fixes: - bbb.js: replace undefined t('defaultWelcome') call that threw a ReferenceError when a room had an empty welcome message, breaking meeting creation. Default welcome and the guest-invite hint are now localised via the i18n system (new "bbb" namespace in de/en). - auth.js: app name was read from the never-written 'branding' settings key, so custom names never appeared in verification emails or the TOTP issuer. Now resolved through a shared getAppName() helper. - auth.js: lowercase the email in the registration duplicate check so case-variant duplicates return a clean 409 instead of a 500 (UNIQUE violation). - federation.js: select the user's "language" column so federation invite emails respect the recipient's language instead of always defaulting to English. - calendar.js: a set reminder could not be cleared. COALESCE treated an explicit reminder_minutes: null as "keep existing"; use a direct assignment that distinguishes "omitted" (keep) from "null" (clear). - index.js / analytics.js: exclude the BBB learning-analytics callback from the global 100kb body limit and give it its own 5mb limit, since analytics payloads for large meetings can be several MB. Cleanup: - Add server/config/appName.js as the single source of truth for the app name (admin setting -> APP_NAME env -> 'Redlight') and use it in auth, admin, rooms, calendar and federation, replacing the previous mix of wrong DB key, direct app_name reads and bare process.env reads. - Localise the BBB default welcome message in the room owner's language. - Remove two unused safeAppName variables in mailer.js.	2026-06-02 09:19:21 +02:00
Michelle	45fdbe4883	feat: enforce maximum password length of 64 characters in user registration and password update	2026-04-25 20:30:29 +02:00
Michelle	cae84754e4	feat: add analytics visibility settings and export functionality ... - Added `analytics_visibility` column to `rooms` table to control who can view analytics data. - Updated analytics routes to check visibility settings before allowing access and export of analytics data. - Implemented export functionality for analytics in CSV, XLSX, and PDF formats. - Enhanced `AnalyticsList` component to include export options for analytics entries. - Updated room detail page to allow setting analytics visibility when creating or editing rooms. - Added translations for new analytics visibility options and export messages.	2026-03-13 22:36:07 +01:00
Michelle	00e563664e	feat(analytics): enhance analytics functionality with token validation and data extraction	2026-03-13 10:34:39 +01:00
Michelle	7ef173c49e	feat(analytics): implement learning analytics feature with data collection and display	2026-03-13 09:46:15 +01:00