gsadmin/libredesk
1
0
Fork 0
mirror of https://github.com/abhinavxd/libredesk.git synced 2026-09-23 11:03:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,417 Commits 12 Branches 50 Tags
v2.2.0
Commit Graph

22 Commits

Author SHA1 Message Date
Abhinav Raut f7cbfb525c Hard widget endpoints 
- Gate widget inbox_id on UUID to prevent enumeration.
- Throttle inbound WS frames per connection (typing/page_visit/ping)
- Restrict admin-set URLs to http/https
- Apply closed-conversation reply guard to media upload path (was text-only)
- Reject empty uploads and use io.ReadAll
- Validate inbox config before DB create; drop unused func VerifySignature
 2026-04-17 02:41:40 +05:30
Abhinav Raut 00039191eb Harden widget apis: strip agent emails, fix cross-inbox merge, and tighten auth 
Don't render svgs inline for s3.
 2026-04-16 11:26:13 +05:30
Abhinav Raut fd0e871a79 Add max chat message length validation 
Use CSP headers to for trusted domains instead of referrer header checks.
Update description for trusted domains
 2026-04-16 02:30:02 +05:30
Abhinav Raut 6ef17eeae6 Make widget /auth/exchange idempotent 
Prevent tokens sent twice from widget.js, send only once.
Update doc strings & comments for clarity.
Fix error handling
 2026-04-16 01:16:24 +05:30
Abhinav Raut 99daf4e8da DRY up widget inbox validation, use validateWidgetInbox middleware 2026-04-15 00:11:19 +05:30
Abhinav Raut 3c3d6a6149 feat: replace widget JWT auth with Redis session tokens and parent-domain cookies Fix iOS Safari session loss by moving storage from iframe localStorage to first-party cookies. 
Add /auth/exchange, /auth/me endpoints for the same.

Fix duplicate network calls, and agent notification for new conversations.
 2026-04-05 18:58:45 +05:30
Abhinav Raut 02f7c19082 Move trusted domaisn check to middleware 2026-04-04 22:21:34 +05:30
Abhinav Raut 000fd83b30 Add uuid column to inboxes table to use as widget public identifiers 
Auto focus on form inputs in widget
Use defer widget in widget installation script
 2026-04-03 02:34:07 +05:30
Abhinav Raut d0a3527269 Sync contact name/email from JWT on every widget request 2026-04-01 17:15:22 +05:30
Abhinav Raut 5f6ca63dc4 Refactor use already fetched inbox config and set it in ctx for widget handlers 2026-03-30 01:22:43 +05:30
Abhinav Raut 114656e64e required jwt fields middleware for user 2026-03-30 01:10:02 +05:30
Abhinav Raut 5590ae6ae3 Create contact from JWT in widget middleware for visitor merge, fix message input focus and pending cleanup 2026-03-30 00:28:33 +05:30
Abhinav Raut 2b645fa4e8 Security fixes: rate-limit widget endpoints, remove JWT from logs, harden middleware checks 
Increase max page size to 500
Allow large out of bound page sizes by overriding to maximum set.
Reset websocket reconnect attempts when widget is back online
 2026-03-28 19:27:41 +05:30
Abhinav Raut 48175300ab Add rate limiting to public endpoints (auth, CSAT), fix rate limiter race condition and missing Content-Type header. Refactor rateLimitWidget into generic rateLimit middleware with config defaults. 2026-03-22 16:59:55 +05:30
Abhinav Raut eb0a7b437d Add page visit tracking to widget 
- fix duplicate initialization guard
- notification bell for agents
- Refactor and clean up dead code
- Fixes to pre chat form
- Add new column country to users table
- Update ratelimit pkg to be generic
 2026-03-11 03:52:07 +05:30
Abhinav Raut 81847c7f4e i18n: fix localization issues (#231) 
Not backported to main due to extensive i18n refactoring changes in this branch.
 2026-02-22 15:12:00 +05:30
Abhinav Raut 70e6ebcc48 feat(widget): merge visitor to contact when new JWT is available i.e. when user logs into a an external system. 
- Prevent file uploads on initial message, user send a message first to enable attachments.
- fix thumbs not loading with signature and expiry
 2026-01-26 02:52:28 +05:30
Abhinav Raut 1962abdc16 feat: implement rate limiting for public widget endpoints with Redis support 2025-08-19 01:58:13 +05:30
Abhinav Raut c35ab42b47 feat: configurable visitor information collection with a form before starting chat. 
fix: Chat initialization failing due to the JWT authenticated user doesn't exist in the DB yet.

fix: Always upsert custom attribues instead of replacing.
 2025-07-21 01:58:30 +05:30
Abhinav Raut f05014f412 refactor: implement widget authentication middleware with standard HTTP headers 
- Add widgetAuth middleware to handle JWT and inbox validation consistently
  - Move authentication logic from request body to standard HTTP headers:
    * JWT: Authorization: Bearer <token>
    * Inbox ID: X-Libredesk-Inbox-ID: <id>
  - Refactor all widget handlers to use middleware context instead of duplicate auth code
  - Frontend now sends auth headers via HTTP interceptor for all widget requests
 2025-07-20 17:44:36 +05:30
Abhinav Raut e2bba04669 Fix: Trusted domain validation for live chat widget, check the referrer header instead of origin. 
- Removed the widgetOrigin middleware as it would have same origin as the iFrame URL, changed this to use `Referrer` header on initial iFrame load.
- Feat(agent-view): Added external_user_id display in the conversation sidebar.
 2025-07-20 16:44:33 +05:30
Abhinav Raut 8ee81c2d64 feat: Widget dark mode and chat reply expectation message in chat title. 
feat: Add HTTP utility functions for trusted origin checks

feat: Implement typing status broadcasting for live chat clients and agents.

feat: Add support for signed URLs in media manager

fix: Update database migration to handle duplicate visitors with same email address.

feat: Add conversation subscription and typing message models for WebSocket communication

feat: Implement conversation subscription management in WebSocket hub this is used for broadcasting typing indicator.

feat: Revamp widget JavaScript to improve mobile responsiveness and show unread messages if any.
 2025-07-17 01:06:54 +05:30