Commit Graph
54 Commits
Author SHA1 Message Date
ancsemi 476ec6de6d v2.3.9: TOTP two-factor authentication + native OS notifications
Added:
- TOTP 2FA with QR setup, manual secret entry, backup codes
- Native OS notification toasts for new messages when tab/window hidden

Fixed:
- 2FA setup QR and secret not rendering (field name mismatch)
- Backup code browser validation error (empty pattern attribute)
- Missing copy button for backup codes
2026-03-01 02:09:56 -05:00
ancsemi bb3b40bc00 release: v2.3.8 — private channel code hidden from regular members 2026-02-28 00:15:03 -05:00
ancsemi d21aca55f3 release: v2.3.7 — private channel invite lockdown, channel creator auto-mod role 2026-02-27 23:35:01 -05:00
ancsemi c7ce5979aa release: v2.3.6 — Docker healthcheck FORCE_HTTP fix, non-ASCII filename encoding fix 2026-02-27 22:49:22 -05:00
ancsemi 0f74fd6ec3 v2.3.5: externalize donor list, fix password redirect loop, fix plugin loader scope 2026-02-26 20:24:02 -05:00
ancsemi 674fc26671 v2.3.4 — Fix duplicate effect sliders, hover popup close, channel roles in profile, donor tier styling, voice right-click 2026-02-26 14:36:46 -05:00
USBAkimbo 543089dfc1 docs: add haven example with traefik and coturn (#87)
* docs: add haven example with traefik and coturn

* docs: fix haven traefik coturn example readme

* fix: image tags for better longevity
2026-02-26 07:50:10 -05:00
ancsemi b23ee647da fix: correct Desktop Windows installer filename in website links (dots to hyphens) 2026-02-26 00:54:17 -05:00
ancsemi beaa31e48f docs: update Desktop download links to v1.0.3 2026-02-25 23:12:28 -05:00
ancsemi 9274319ff6 release: v2.3.3 member list DM/nickname, popup z-index fix, hover popup fix, role level enforcement, admin recovery 2026-02-25 19:38:27 -05:00
ancsemi 417700d3e9 release: v2.3.2 sound manager, kick revoke, role auto-assign fix, font size fixes 2026-02-25 15:52:30 -05:00
ancsemi 7ced58d0d3 release: v2.3.1 plugin CSP fix, health check 404 fix
- Add 'unsafe-eval' to CSP scriptSrc for plugins using new Function()
- servers.js health check extracts origin to avoid /path/api/health 404s
- Website updated: v2.3.1 server links, v1.0.1 desktop links
2026-02-24 22:18:03 -05:00
ancsemi 096af770f3 improve: direct download links for desktop app on website
- Replace generic GitHub releases link with direct .exe, .AppImage, .deb download buttons
- More user-friendly for non-technical users
- Sync docs/ from website/
2026-02-24 19:27:14 -05:00
ancsemi 25e2fe06c7 fix: replace haven-app.com with ancsemi.github.io/Haven, remove bad CNAME, fix desktop promo links
- Replace all haven-app.com references with https://ancsemi.github.io/Haven/
- Delete website/CNAME (domain not owned)
- Fix desktop promo popup and banner links to point to website download section
- Sync docs/ from website/
- Include package-lock.json version bump to 2.3.0
2026-02-24 19:20:25 -05:00
ancsemi 42e6fc6259 v2.3.0 Webcam video, plugin/theme system, font size, channel invites, admin members panel, desktop app beta, session invalidation, security fixes 2026-02-24 18:54:00 -05:00
ancsemi a3f75d3720 v2.2.5 Remove desktop app, security fixes, bug fixes
- Remove desktop/ directory and all desktop-grafted code from server
- Fix missing express-rate-limit import (server crash on startup)
- Validate webhook avatar_url protocol (block data: URI tracking)
- FORCE_HTTP support for reverse proxies (#48)
- Auto-assign default roles (#14)
- SSRF bypass prevention in link previews
- JWT admin claim verification from DB (13 endpoints)
- Path traversal fix in avatar uploads
- mark-read membership check
- transfer-admin race condition mutex
- Server-side sanitizeText() defense-in-depth
- broadcastChannelLists debounce (DoS fix)
- reorder-channels capped at 500
- Role color XSS prevention (server + client)
- Screen share quality controls, black screen fixes
- SSL setup script, cross-platform gameplan doc
- Website & docs updated to v2.2.5
2026-02-23 21:52:38 -05:00
ancsemi 1761b6b98d v2.2.4 security hotfix
Security:
- Fix SSRF bypass in link previews (manual redirect following with re-validation)
- Fix JWT admin claim trust (all 13 REST endpoints verify from DB)
- Fix path traversal in avatar/icon uploads (strict regex validation)
- Fix mark-read missing channel membership check
- Fix transfer-admin race condition (mutex + post-await DB re-check)
- Add server-side content sanitization (strip dangerous HTML tags/attrs)
- Patch all dependency vulnerabilities (0 remaining)

Fixed:
- Debounce broadcastChannelLists to prevent O(N) DoS
- Cap reorder-channels array to 500 items

Added:
- Desktop Electron app (initial scaffolding)
2026-02-22 09:55:49 -05:00
ancsemi 36e18c22ef v2.2.3 - Fix screen share black screen, role save UX, mid-stream quality
- Show screen share container before assigning srcObject so browser
  decodes frames immediately instead of rendering a black rectangle
- Move role Save button to always-visible modal footer (next to Close)
- Replace in-button 'Saved' flash with proper green toast notification
- Bump version to 2.2.3, update changelog, website & docs
2026-02-21 23:45:41 -05:00
ancsemi a6c43159e0 chore: bump to v2.2.2, fix Docker ARM build, update website and changelog 2026-02-21 13:30:54 -05:00
ancsemi aae065fc3f chore: bump to v2.2.1, update website download links and changelog 2026-02-20 23:00:04 -05:00
ancsemi 30bcdf3610 Revert URLs back to ancsemi.github.io/Haven 2026-02-20 09:53:47 -05:00
ancsemi 7fa4602b32 Remove CNAME temporarily — re-add after DNS is configured 2026-02-20 09:50:41 -05:00
ancsemi 6351fbf782 Update canonical URLs to haven-app.com 2026-02-20 09:18:43 -05:00
ancsemi 39937c61f9 Add CNAME for custom domain haven-app.com 2026-02-20 08:45:36 -05:00
ancsemi 8580b3e374 v2.2.0 CRT fishbowl vignette, inline YouTube embeds, emoji quickbar fix
Added:
- CRT fishbowl vignette overlay with parabolic glass simulation
- Vignette darkness slider (controls edge darkness gradient)
- Scanline intensity slider (0-80% with center-fade mask)
- CRT flicker frequency range widened (half slowest, double fastest)
- Inline YouTube video player in chat message embeds
- Emoji quickbar flip-below prevents clipping at top of viewport

Fixed:
- CRT vignette/scanline sliders now visible (injected into speed editor)
- Vignette slider functional (gradient-based, not opacity)
- Reaction picker no longer clipped for top messages

Changed:
- Website, docs, README, CHANGELOG updated to v2.2.0
2026-02-20 02:02:10 -05:00
ancsemi c4c7c0ba4d v2.1.0 E2E multi-device sync fix, channel organizer fixes, settings crash fix 2026-02-19 20:01:48 -05:00
ancsemi 04b1b73fa2 chore: bump to v2.0.1 remove vulnerable GUI installer 2026-02-19 01:17:55 -05:00
ancsemi 0e0957c95c v2.0.0 Discord history import, E2E password-change fix, scroll fix
Added:
- Discord history import  Direct Connect (paste token, pick server, select channels)
- Discord history import  File upload (DiscordChatExporter JSON/ZIP)
- Tabbed import modal (Upload File | Connect to Discord)
- Full server structure import (text, announcement, forum, media, threads)
- Forum tag resolution and display
- Discord avatar preservation (webhook_avatar column)
- Channel type indicators in import picker

Fixed:
- E2E key loss on password change (re-wraps key with new password)
- Scroll-to-bottom loop when images load while scrolled up
- ARM64 Docker support (#34)

Changed:
- Website, README, GUIDE updated with Discord import docs
- Version bumped to 2.0.0
2026-02-18 19:53:58 -05:00
ancsemi 18d3d00153 v1.9.2 image lightbox, emoji autocomplete, GIF avatars, Docker CI, voice profile clicks, DM auto-focus 2026-02-18 13:53:05 -05:00
ancsemi 98a9a34b8a feat: image lightbox, DM auto-focus, voice profile clicks, Docker CI, version bump
- Image thumbnails (180px) w/ click-to-enlarge lightbox overlay (replaces window.open)
- Client setting to switch between thumbnail and full-width Discord-style images
- Auto-focus message input when switching channels/DMs
- Voice chat usernames now clickable to open profile popup (bio, DM, etc.)
- Automated Docker image publishing via GitHub Actions on release (GHCR)
- Updated website, docs, and README to v1.9.1
2026-02-18 11:55:42 -05:00
ancsemi ecbdf13326 v1.9.0 setup wizard, one-click launcher, E2E fix, reaction improvements
Features:
- First-time admin setup wizard (4-step guided onboarding)
- Port reachability check API
- One-click Windows launcher with Node.js auto-install
- Full emoji reaction picker (searchable, all categories)
- Unified upload button with input actions toolbar
- Node.js version guard (pin to v22 LTS)

Fixes:
- E2E encryption permanent decrypt failure (stale key cache)
- DM messages pushed to right side (lock icon layout)
- Reactions inconsistent position + lost on promotion
- npm install killing batch launcher (missing call keyword)
- Node v24 build failures (no prebuilt binaries)
- dotenv MODULE_NOT_FOUND on fresh install
2026-02-17 19:40:22 -05:00
ancsemi 15928f8fed fix: npm install check, add Fluxer to comparison, update screenshot
- Start Haven.bat: check for node_modules\dotenv\ instead of just
  node_modules\  empty/corrupt folder no longer skips npm install
- Website: add Fluxer column to comparison table (self-hosted, open
  source, voice/video, custom CSS, no E2E, freemium)
- Website: swap screen sharing screenshot to updated image
- Sync docs/index.html with website/index.html
2026-02-17 17:31:29 -05:00
ancsemi b0fa2264b9 v1.8.2 PiP revert, YouTube playlists, bot modal fixes, 5 bug fixes, release tarball workflow
- Reverted PiP to native browser system (draggable across screens)
- YouTube playlist controls now work (list= param preserved in embed URL)
- YouTube auto-advance on video end for playlists
- Bot Updated toast fixed from red/error to green/success
- Toast z-index raised above modals
- Bot channel dropdown ordered with sub-channel indentation
- Uncategorized DMs now collapsible with localStorage persistence
- HTTPS redirect uses actual host instead of hardcoded localhost
- Removed duplicate /api/upload-avatar route, added 2MB size check
- Guarded global get-webhooks handler to not conflict with per-channel
- E2E safety number now full 60 digits (SHA-512 instead of SHA-256)
- Reset YouTube playlist flag on Spotify URLs
- GitHub Actions workflow attaches haven.tar.gz with fixed dir name (closes #22)
2026-02-17 03:15:42 -05:00
ancsemi 163a89dda4 v1.8.1: upload fix, optional flash games, mic icons, verification codes, mobile fix
- Fix: client-side upload limit now reads server setting (was hardcoded 25 MB)
- Fix: compact message timestamp no longer shifts text on hover
- Fix: mobile foreground resume re-fetches messages/channels/members
- Changed: mute button uses mic icon, deafen uses speaker icon
- Changed: Flash game SWFs removed from repo (~37 MB); now optional in-app download
- Added: E2E verification codes (safety numbers) for DM encryption verification
- Added: server endpoints for flash ROM status check and download-on-demand
- Added: muted mic CSS strikethrough, flash install banner, disabled game cards
- Updated: package.json, CHANGELOG, website, docs for v1.8.1
2026-02-16 21:12:25 -05:00
ancsemi 3d43daf01d v1.8.1: E2E per-account keys, W95 UI fixes, games pop-out, website overhaul
- E2E encryption: keys now sync per-account via PBKDF2 password wrapping (not per-device)
- E2E: private keys stored encrypted server-side, decrypted with user password
- Win95 theme: 3D beveled buttons for all controls (voice, sidebar, modal, toolbar)
- Win95 theme: fixed double scrollbar arrows, black text on gray backgrounds
- Games: default to pop-out window, with iframe fallback if blocked
- Dual-role display: User badge now properly stripped when higher role exists
- Ruffle/Flash: CSP headers fixed (wasm-unsafe-eval + unpkg worker-src)
- Website: carousel fixed height (no more page jumping), interval 4s
- Website: replaced screenshots with latest, updated feature cards
- Website: added E2E encryption to selling points, features grid, comparison table
- Website: updated file sharing limit (configurable up to 1.5 GB), games card expanded
2026-02-16 19:43:46 -05:00
ancsemi 365f9a6e34 v1.8.0 E2E encrypted DMs, Flash games, CRT/theme separation, Win95 fixes
Added:
- End-to-end encrypted DMs (ECDH P-256 + AES-256-GCM)
- Server-wide invite code
- Channel organize modal
- /gif slash command, music seek bar, configurable upload limits
- Flash games via Ruffle (5 SWF titles) + .io games browser
- Cloudflare Tunnel documentation

Changed:
- CRT theme no longer auto-applies CRT effect (colors/font only)
- E2E lock icon shown once on root messages, right-aligned
- Win95 scrollbars: fixed scrollbar-color:auto for bevel rendering
- Win95 channel-header now uses blue gradient
- SQLite performance pragmas

Fixed:
- User status stuck on idle (race condition in optimistic update)
- Sub-channel membership grandfathering
- Duplicate channel roles dedup
- Game iframe CSP + inline script extraction
- Cloudflare tunnel URL timeout + regex
2026-02-16 17:46:13 -05:00
ancsemi 316c39ba22 v1.7.0 role inheritance, UI polish, voice dot colors
- Role inheritance: server roles cascade to all channels, channel roles
  cascade to sub-channels (getUserEffectiveLevel, userHasPermission,
  getUserHighestRole all use getChannelRoleChain helper)
- Voice dot color matches user's highest role color (server sends
  roleColor in broadcastVoiceUsers / request-voice-users)
- Transfer Admin modal redesigned with warning box, note, and error
  styling
- Noise-suppression slider track made visible (6px, border, 0.3 alpha)
  and thumb enlarged to 14px
- User hover tooltip now opaque (bg-secondary, no backdrop-filter,
  solid box-shadow)
- Version bump 1.6.0 -> 1.7.0 in package.json, website, docs
- Changelog entries added for v1.6.0 and v1.7.0
2026-02-15 16:08:45 -05:00
ancsemi 18067a18cf fix: bust stale CSS/JS cache, fix mobile two-row input, update website to v1.6.0
- Update all cache busters from ?v=webhooks1 to ?v=1.6.0 (CSS + all JS files)
  Root cause: mobile browsers served stale cached CSS/JS despite server restart
- Fix mobile input flex-wrap: textarea now uses flex: 1 0 calc(100% - 48px)
  to force media buttons onto their own row (old flex:1 let everything fit one row)
- Add !important to mobile hamburger/users button display:flex at <=768px
- Update website + docs download links from v1.4.7 to v1.6.0
- Add v1.5.0 and v1.6.0 to version history on website
2026-02-14 23:46:51 -05:00
ancsemi 77273675e4 Website: 'no download necessary', add Music & Video Streaming feature card
- Changed hero subtitle from 'no install for them' to 'no download necessary'
- Added Music & Video Streaming as first feature card in the All Features grid
- Rich Chat moved to second position
- Applied to both website/index.html and docs/index.html
2026-02-14 14:22:22 -05:00
ancsemi 2579be5251 Hero image carousel, website description overhaul, arrow left of channel name
- Replace single hero image with rotating carousel of all 6 Issue #1 screenshots (2s interval, crossfade)
- Update all website descriptions: 25+ themes, sub-channels, editable channels, sound effects, roles
- Update meta tags (og:description, twitter:description, meta description) to 25+ themes
- Move channel collapse arrow to LEFT of channel name (between # and name)
- Remove margin-left:auto/order:99 from arrow CSS so it sits naturally on the left
- Sync website/index.html with docs/index.html
2026-02-14 10:42:37 -05:00
ancsemi ef3fb65967 Fix subchannel arrow layout, add missing login themes, ambient religious theme effects, fix hero image
- Move subchannel collapse arrow to right edge (no longer indents channel name)
- Normalize sub-channel font size to 14px to match parent channels
- Add all 9 missing themes to login page (darksouls, eldenring, minecraft, ffx, zelda, fallout, crt, win95, rgb)
- Scripture: subtle pulsating crucifix sunlight shadow effect
- Chapel: prismatic stained glass light beam effect
- Gospel: soft divine radiance descending effect
- Fix hero image with correct asset from issue #1
2026-02-14 02:48:04 -05:00
ancsemi f451fbf6e9 fix: avatar upload button, broken hero image, login theme icons
- Avatar upload: clone-replace button to clear stale listeners, add debug logging
- Replace dead hero image (bb10e3ca) with working asset (c6628170) in docs + website
- Update og:image and twitter:image meta tags to match
- Login theme bar: add flex-wrap, increase icon size (28px), constrain width
2026-02-14 02:24:30 -05:00
ancsemi 746f9ac860 fix: update docs/index.html hero text to match website 2026-02-14 02:19:03 -05:00
ancsemi 537fdde129 v1.4.7: YouTube fix, PFP upload fix, gray space fix, late joiner streams, /play search, Spotify->YT, PiP opacity, stream PiP overlays 2026-02-13 22:02:54 -05:00
ancsemi 2b8c04cb22 Discord-style status indicators on avatars, fix .env Tenor refs, sync website
- Add: Status indicator dots overlaid on user avatars (green=online, yellow=away, red=dnd, grey=offline/invisible) with dark border cutout, responsive sizing for mobile
- Fix: .env.example still referenced Tenor API  updated to GIPHY with correct URL
- Fix: CSS comment 'Tenor key'  'GIPHY key'
- Sync: website/index.html replaced with canonical docs/index.html
- Add: Help & Support footer link to docs/index.html
- Add: Deploy checklist note in CHANGELOG.md
2026-02-12 22:54:08 -05:00
ancsemi 3dc0eacf1b Fix mobile screenshots, slider fills, sidebar scroll, collapsible DMs
- Replace dead mobile screenshot URLs with permanent ones from issue #4
- Add fill gradient to voice volume sliders (.volume-slider)
- Update dynamic voice sliders to track --fill CSS variable
- Make .channel-section flex:1 with overflow so sidebar scrolls properly
  (fixes theme bar pushed off screen on mobile)
- Convert DM section to collapsible sub-menu (Discord-style toggle)
  - Click header to expand/collapse, state persists in localStorage
  - Shows total unread badge when collapsed
  - Auto-expands when a new DM opens
2026-02-12 17:52:29 -05:00
ancsemi 422e2bf5d8 Rearrange screenshots: Haven top-left, Matrix top-right, screen sharing wide bottom 2026-02-12 16:54:51 -05:00
ancsemi 833aa52308 Replace alt theme screenshot with screen sharing + voice chat screenshot 2026-02-12 16:46:33 -05:00
ancsemi 7425b73af8 Redirect help requests to help.havenapp@gmail.com 2026-02-12 15:34:30 -05:00
ancsemi ec11fef287 Add support/help page, update download to v1.4.5
- New docs/support.html: troubleshooting, FAQ, bug report instructions, contact info
- Added Help link to docs/index.html nav and footer
- Download buttons now point to v1.4.5 tagged release
- Version history updated with v1.4.5 as latest
2026-02-12 15:11:39 -05:00