Two concurrent refresh calls (double-mounted bootstrap effect, second tab)
replayed the same cookie; the loser tripped reuse detection and revoked the
whole token family, forcing re-login.
- Client: single-flight /auth/refresh — concurrent callers share one request.
- Server: 30s grace window for a just-rotated token, but only while the
family still has a live successor, so theft detection still kills a
genuinely compromised family and logout stays final.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFRyKxkKEjfAgpXygzoNiD
Notifications (web push now, Android FCM ready, iOS prepared):
- device_tokens / notification_settings / conversation_mutes (migration 006)
- REST: register/list/unregister devices, get/update settings (quiet hours,
timezone, enable), mute/unmute conversation, VAPID public key
- BullMQ queue: backend enqueues a job per new message; a dedicated stateless
`notifications` worker service drains it
- Delivery gating: skip sender, muted chats, disabled users, quiet hours, and
ONLINE users (they get the message live + an in-app toast) — offline → push
- Providers behind one interface: Web Push (VAPID/web-push) + FCM (firebase-admin,
HTTP v1; Android + iOS via the same path). Dead tokens (404/410/unregistered)
auto-retired; transient failures recorded
- Web: service worker (push display + tap-to-open the originating chat), push
registration/unregistration, in-app toast stack, deep-link via ?conversation=
In-app voice & video messages: MediaRecorder capture in the composer (mic/video),
live preview + timer, upload via the existing presigned-media path.
No emojis anywhere: replaced all glyphs with inline SVG icons (shared/ui) so the
UI renders identically across web/desktop/mobile; notification text is plain.
Chores: dedupe ioredis (BullMQ) + pin uuid>=11.1.1 (audit clean) via pnpm overrides;
reusable Centrifugo client factory for the worker.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFRyKxkKEjfAgpXygzoNiD
- Media (voice/video/image/file): private bucket, presigned PUT upload,
reference-only publish, membership-gated presigned GET for viewing
- Avatars: public bucket, presigned PUT + direct public URL, profile.update event
- messages.media_key + media_meta (migration 1720000000005_media)
- Explicit MinIO region on presigning client (avoids getBucketRegion network call)
- Event type values sourced from EventType constants (no raw string literals)
- Web: attach button, MediaView renderer, avatar upload in topbar
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFRyKxkKEjfAgpXygzoNiD
