v2.0.2 — OAuth security fixes

• Detect refresh-token replay and revoke the affected authorization grant, including successor tokens. Other consent grants remain active.
• Revoke all related access/refresh tokens through /oauth/revoke, with the same transaction lock used by token rotation and browser revocation.
• Replace the permanent global registration cap with a bounded, expiring pool of unused registrations. Preserve consented clients and in-progress authorization flows.
• Add regression tests for replay, cross-client isolation, concurrent refresh/revocation, registration exhaustion, expiry and pending consent preservation.

Upgrade: back up the database and apply migration 000017_oauth_security before starting the new API. The installer handles migrations. Existing clients with token/code records are preserved. OAuth clients must serialize refreshes; a replay requires reconnecting. No chat permissions are changed by this upgrade.

v2.0.1 — Chat permissions, visual media and controlled sending

Telegram Gateway now gives account owners explicit control over each chat, with photo/video-frame inspection and permission-controlled text sending.

New capabilities

• Per-chat permissions: independent read and send switches in /account. Every chat starts closed.
• Visual media: inspect_media returns a photo or a video frame at a requested timestamp. No audio transcription.
• Controlled sending: send_message requires the messages:send scope and chat permission. Durable request IDs prevent duplicate dispatch on retries.
• New account UI: Telegram-inspired layout, chat search, mobile support and dark mode.
• Release identity: /version, MCP initialization and container labels expose the running version and exact Git revision.
• Reproducible MinIO dependency: source build pinned to the original upstream commit, replacing the unavailable public registry image in CI and fresh-install instructions.

Upgrade requirements

1. Back up the database/configuration and check out v2.0.1.
2. Set TELEGRAM_AUTO_SYNC=false; automatic synchronization is no longer supported.
3. Build the updated image and apply migration 000016 using the installer. Native installations require FFmpeg.
4. Open /account, load chat names, and explicitly enable the desired read/send permissions. Existing tokens do not bypass the new policy.
5. Reconnect AI clients to consent to messages:send if needed. Message search now requires chat_id.

Version 2.0.1 is recommended over 2.0.0: it also fixes the unavailable MinIO registry dependency discovered during release verification.

Full changelog · Account management · Live version

v2.0.0 — Chat permissions, media inspection and controlled sending

Superseded by v2.0.1. Use v2.0.1 for fresh installs: it also fixes the unavailable MinIO registry dependency discovered during CI.

This release makes chat access opt-in and adds visual media inspection and controlled text sending.

Added

• Per-chat read and send permissions managed only by the account owner in /account.
• inspect_media: native MCP image content for photos and individual video frames at requested timestamps. Audio transcription is not included.
• send_message: plain-text sending with a separate messages:send scope, chat permission, rate limits, audit records and durable request IDs to prevent duplicate dispatch on retries.
• Telegram-inspired account management, searchable chat list, permission switches, mobile layouts and dark mode.
• /version, version response headers, MCP server version and container release labels for identifying the running release and source commit.
• Regression tests for default-deny access, account isolation, permission revocation, duplicate sends, image previews and video decoding.

Breaking changes

• All chats are denied initially, including previously cached chats. Existing tokens do not bypass this policy. Use /account to enable access explicitly.
• AI chat listing and chat search return only approved cached metadata. Chat discovery is an explicit browser action and does not fetch histories.
• search_messages requires chat_id; account-wide message searches are no longer available.
• TELEGRAM_AUTO_SYNC=true is rejected. Set it to false; gateway background mirroring and queued history processing remain disabled.
• Existing OAuth grants do not gain sending privileges automatically. Reconnect and consent to messages:send, or create a personal token with its send checkbox enabled.

Upgrade

1. Back up the database and private configuration, then check out v2.0.0.
2. Keep TELEGRAM_AUTO_SYNC=false. Build the updated container; it includes FFmpeg. Native installations need FFmpeg on PATH.
3. Apply migration 000016_chat_permissions before starting the new API. The provided installer applies migrations and runtime table grants.
4. Open /account, load chat names, and enable only the required read/send permissions. Both start disabled.
5. Reconnect AI clients that need sending. Use a new UUID request_id for each intended message, and reuse it on retries. accepted is not a final-delivery confirmation; ambiguous sends are never automatically dispatched again.
6. Check /version and /health/ready. The version must be 2.0.0, and revision should match the checked-out Git commit when built with VCS_REF.

Chat revocation blocks subsequent reads and previously issued media download links. Already returned content and messages already dispatched to Telegram cannot be recalled by revocation. TDLib retains its own authorized connection and local cache.

Validation

Go formatting, vet, race-enabled unit/integration tests, FFmpeg frame decoding, and browser checks at 390, 768 and 1440 pixels. Telegram sending is tested with a fake session; no real messages are sent by the test suite.