fix: security hardening and Safari stability

- Remove hardcoded JWT_SECRET fallback (crash on boot if unset)
- Make LiveKit config optional with 503 guard on token endpoint
- Add REST rate limiting via @fastify/rate-limit (auth 10/15m, messages 5/5s, uploads 10/1m, global 60/1m)
- Add WebSocket token bucket rate limiter (30 burst, 2/sec refill)
- Add DM channel ownership (ownerId) with migration, enforce on add-member
- Require friendship to add users to group DMs
- Add silent 20Hz oscillator to prevent Safari AudioContext suspension
- Move WebSocket heartbeat to Web Worker to bypass Safari background throttling

This commit is contained in:

Jannis Braun

2026-02-24 04:34:36 +01:00

parent 36e27121da

commit 024833c470

16 changed files with 205 additions and 36 deletions

									
										packages/shared/src/types.ts
									
		+1
		
												View File
												
				@@ -149,6 +149,7 @@ export interface ActiveCallInfo {

				export interface DmChannel {

				  id: string;

				  ownerId?: string | null;

				  createdAt: number;

				  members: User[];

				  lastMessage?: DmMessage | null;