Conversation
Delay disconnect cleanup while clients reconnect and reconcile membership through the shared Redis adapter. Deploy application services sequentially without recreating stateful dependencies.
Expose dependency-aware HTTP readiness endpoints and a Socket.IO health round trip. Point Compose and nginx at the explicit health routes for deployment verification.
Persist and retry completed solves with idempotent acknowledgements across socket reconnects. Roll services selectively with health-gated rollback so routine deploys minimize room disruption.
Preserve active solves across deploys
Avoid duplicate joins and preserve pending solves through private-room reconnects. Remember successful room passwords on-device, make same-room joins idempotent, surface password errors, redact credentials, and cover the recovery paths.
Fix private room reconnect recovery
Create a shared event catalog and route supported events through cubing.js, with Scrambow retained for custom practice scrambles.
Publish the shared event catalog as JSON so Vite can import it from the linked workspace without CommonJS export interop errors.
Add shared scramble provider
Copy the scramble workspace manifest before dependency installation and its source into the build and runtime stages so Yarn resolves the workspace locally instead of npm.
Fix Docker shared workspace build
Limit concurrent registry downloads and use a longer request timeout so production image builds tolerate transient registry latency.
Harden Docker Yarn installs
Reorganize durable project guidance into focused development, architecture, data, realtime, operations, security, and package docs. Keep AGENTS.md concise while adding code-structure, dependency, and worktree conventions.
Replace the 3x3-only SVG preview with lazy-loaded cubing.js visualizations. Add responsive click-to-enlarge dialogs so larger puzzles remain readable while preserving scramble text.
Render 2D scramble previews for all events
Request only public WCA identity, allowlist login fields, and stop MongoDB and PostgreSQL writes. Add a value-free two-phase purge with an enforced privacy rollback floor so the compatibility column can remain safely empty until a later drop.
Exit unsuccessfully when MongoDB cannot be reached and clear the PostgreSQL compatibility column independently of guarded user upserts. This prevents connection failures or equal timestamps from leaving legacy email values behind.
Add server-authorized friendship and blocking transitions, privacy-safe REST and realtime contracts, and non-blocking PostgreSQL mirrors. Document the state machine and cover concurrency, replay, blocking, privacy, metrics, and disabled-Postgres behavior.
Keep creator ownership separate from active admin handoffs and restore the creator deterministically on rejoin. Centralize role checks and document the authorization contract needed by room invitations.\n\nRefs #153
Centralize username validation and add a collision-aware MongoDB backfill. Mirror normalized keys through an additive PostgreSQL migration for safe friend discovery.
Reconcile MongoDB username targets into PostgreSQL and fail index creation while collisions remain. Canonicalize privacy markers and keep test authentication on the shared normalization path.
Gate social routes and realtime delivery behind the disabled-by-default rollout flag. Keep relationship and block tombstones revisioned for fail-closed unblock and reordered PostgreSQL mirrors, and reserve pending-request quota atomically with rollback and stale reconciliation.
Preserve the non-null admin socket contract, always select and persist a successor on removal, and reject self-removal moderation requests. Make explicit two-tab leaves remove their own socket membership before checking for remaining tabs so the last departure cannot strand a room.\n\nRefs #153
Keep in-flight quota reservations counted until their relationship write resolves, and make quota cleanup asynchronous after durable social transitions so mirrors and invalidations are never suppressed by maintenance failures.
Claim persisted room departures with a MongoDB compare-and-set on the active membership revision. This prevents competing Socket.IO processes from duplicating leave side effects or overwriting a rejoin, while retaining the reconnect grace behavior.\n\nRefs #153
Carry the membership revision captured when a socket leaves through reconnect cleanup and reject a departure when that generation no longer matches. This prevents a losing old finalizer from removing a later rejoin.\n\nRefs #153
Use an atomic, expiring Redis limiter for per-user and per-pair friend request creation so crashes cannot leak durable quota reservations or suppress relationship side effects.
Advance a durable per-user presence revision before acknowledging an already-active room membership. Departure claims now require that generation, so an old leave cannot remove a newly opened tab.\n\nRefs #153
Validate the current room state after a departure wins the duplicate-join race, preventing bans or changed access rules from being bypassed.
Replace abandoned session and analytics integrations, move the client and tooling onto supported versions, and add automated dependency and code security checks.
Load Emotion styles before the legacy JSS compatibility layer so desktop breakpoints, spacing overrides, and table flex rules win the cascade.
Preserve the MUI 4 standard TextField default and keep the first create-room label inside the dialog content boundary.
Migrate retained tests and feature code to the React 18, MUI 6, and Jest 30 toolchain so the rebased dependency update continues to validate privacy, social, and room behavior.
Migrate the remaining profile test away from removed Enzyme and Material UI v4 dependencies. Keep PostgreSQL optional for the Mongo and Redis-only Cypress stack, and register the updated session middleware directly in Express.
Modernize legacy dependencies
Use promise-based Mongoose queries for Passport deserialization and WCA profile persistence so Mongoose 8 no longer rejects callback query APIs during login.
…tion Fix Mongoose session authentication
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Keep private-room passwords out of persistent browser storage, enforce CSRF tokens for unsafe requests, and rate-limit the API and social routers to close the targeted CodeQL findings.
Fetch a session-bound token before Cypress issues state-changing API or authentication requests.
Harden browser password and API request handling
Exercise the friends authorization fixture behind the production API rate limiter and model CSRF sessions as secure proxy-served cookies so CodeQL evaluates the tests against the same security controls.
Harden security test fixtures
Authenticate test users through the browser-facing proxy and wait for the accepted notification response, avoiding a direct API-to-browser session handoff race without changing CSRF or rate limits.
…lity Stabilize notification Cypress sessions
Use Cypress session snapshots when switching test identities so the browser and direct API requests share one restored authenticated session. Assert the accepted notification through the API before rendering it.
…on-isolation Isolate Cypress test-user sessions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Synchronizes the integration branch with the current verified master baseline before introducing the dev-to-master release workflow. The dev branch has no unique commits and is 76 commits behind master.\n\nRefs #173 and #177.