Skip to content

v0.3.2

Choose a tag to compare

View all tags
@PineappleBond PineappleBond released this 08 Oct 06:13
· 147 commits to dev since this release
v0.3.2
50d695a

Release v0.3.2

This is a major release introducing S3-compatible object storage (OSS3), a complete admin management system, enhanced RTC user management, and comprehensive observability improvements.

🚀 Major Features

OSS3 - S3-Compatible Object Storage

  • MinIO Integration: Full MinIO backend implementation with storage quota, rate limiting, and encryption
  • S3 Protocol: Complete S3 protocol implementation including SigV4 signature verification (AWS SDK)
  • Multipart Upload: Transaction-based multipart upload with compensation logic
  • Business Logic: Data access layer, business logic layer, and storage backend interface
  • Middleware: Business restriction, CORS, access log, and rate limiting middleware
  • Observability: Comprehensive metrics, tracing, and logging for storage operations
  • Security: SecretAccessKey encryption at rest, credential cache fixes, and security hardening

Admin Server - Complete Management System

  • Authentication: JWT signing/verification, JWKS client, and RFC 8693 Token Exchange
  • RBAC System: Role, permission, and user-role management with Casbin integration
  • Security: Deny-by-default policy, O(1) lookup, ILIKE injection prevention
  • User Management: RTC user management with distributed ban sync and audit logging
  • Admin APIs: User list with pagination, session/message queries, device tracking
  • Email OTP: Email-based one-time password login for admin authentication
  • Dynamic Config: Per-user configuration overrides with ConfigProvider abstraction
  • Monitoring Integration: Reverse proxies for Prometheus, Grafana, Jaeger, and Pyroscope

RTC User Management

  • Distributed Ban Sync: Real-time ban synchronization across server instances via Redis
  • Audit Logging: Comprehensive audit trails for all user management operations
  • Ban Cache: Migrate from in-memory to Redis for distributed consistency
  • Real-time Check: Real-time ban status verification for user operations

Metrics & Observability

  • Database Metrics: Prometheus metrics for GORM queries with error tracking
  • WebSocket Metrics: Centrifuge connection and lifecycle metrics
  • Queue Metrics: Asynq queue lifecycle and auth failure metrics
  • Circuit Breaker: State change metrics for circuit breaker patterns
  • Business Events: Session and message business event metrics
  • Alerts: Comprehensive Prometheus alert rules for all new metrics
  • Dashboards: Grafana dashboard panels for visualization
  • Tracing: Standardized span names and improved trace context propagation

Agent Enhancements

  • File Attachments: Load file attachments (images/text) from OSS for user messages
  • Parallel Loading: Parallel file loading with optimized MultiContent merge
  • Performance: Pre-parse ContentData and cache ownerRefID

🔒 Security Enhancements

  • JWT Key Management: Automatic JWT key generation and rotation support
  • Secret Encryption: Encrypt SecretAccessKey at rest in database
  • Trusted Proxy: Add trusted proxy support with audit logging
  • Endpoint Protection: Enforce authentication for metrics and debug endpoints in production
  • Cookie Security: Add Secure flag and unify error messages
  • Redis Atomicity: Fix rate limiter and login protection atomicity issues
  • CORS Hardening: Strengthen CORS configuration and HTTP timeouts
  • Casbin Security: Deny-by-default policy with O(1) permission lookup
  • ILIKE Injection: Prevent SQL injection in ban operations
  • Weak Secret Detection: Reject weak JWT secrets in production environment

🐛 Bug Fixes

Critical Fixes

  • Concurrent Map Writes: Prevent concurrent map writes in message Extra field
  • Transaction Support: Fix transaction support and error handling in OSS3 repos
  • SigV4 Verification: Rewrite SigV4 verification using AWS SDK
  • Pagination Loop: Fix integration test pagination infinite loop
  • Graceful Shutdown: Improve server graceful shutdown and security

Infrastructure

  • Metrics Cardinality: Fix cardinality explosion, zero latency, and missing rate limit metrics
  • SSE Stream: Fix unbounded buffer memory issue in SSE streams
  • Domain Limiter: Add domain limiter cap to prevent memory leaks in webfetch
  • Route Conflicts: Resolve gin route wildcard conflicts
  • Error Mapping: Correct error mapping for insufficient storage

Configuration

  • Redundant Queries: Eliminate redundant queries and improve transaction safety
  • Dynamic Config: Resolve 6 P2 issues in dynamic config system
  • Permission Bootstrap: Fix server_config permissions missing after bootstrap

Code Quality

  • Panic Replacement: Replace panics with error returns and unify logging
  • Depguard: Enforce facade pattern consistency and strengthen depguard rules
  • Layered Architecture: Enforce layered architecture and eliminate code duplication
  • Structured Logging: Normalize log event names and use structured logging

🔧 Refactoring & Improvements

Architecture

  • Admin Restructure: Restructure middleware, models, and usecases for better maintainability
  • Wire Consolidation: Consolidate asynq Redis configuration
  • Handler Decoupling: Decouple handlers from ServiceContext
  • Usecase Extraction: Extract AuthUsecase with PKCE support
  • Error Codes: Extract error codes to constants

Code Quality

  • Comprehensive Improvements: 32+ code quality improvements across review findings
  • Redundant Parsing: Eliminate redundant parsing and struct duplication
  • Race Detection: Enable race detection and coverage reporting in CI
  • Test Coverage: Expand test coverage across multiple modules

Configuration

  • Environment Validation: Add environment validation and example configuration
  • Config Templates: Sync config templates with recent code changes
  • Docker Config: Add token_exchange to config.docker.yaml

Build System

  • Admin UI Artifacts: Commit admin UI build artifacts for CI compatibility
  • Pre-commit Hook: Update large file detection to allow admin UI artifacts

📊 Statistics

  • 161 commits since v0.2.2
  • Major features: 6 (OSS3, Admin Server, RTC User Management, Dynamic Config, Metrics, Security)
  • Security fixes: 10+
  • Bug fixes: 30+
  • Refactoring: 15+

⚠️ Breaking Changes

  • Model Names: User → AdminUser, Role → AdminRole
  • Config Removed: features.permission_system (now always enabled)
  • JWT Secret: Weak JWT secrets rejected in production
  • Metrics Endpoints: Require authentication in production

📦 Dependencies

  • MinIO: Add minio-go/v7 for S3-compatible storage
  • AWS SDK: Use AWS SDK for SigV4 signature verification
  • Casbin: Integrated for RBAC permission system
  • Backoff: Use cenkalti/backoff for quota commit retry

🔒 Security Notes

This release includes extensive security hardening:

  • OSS3: SecretAccessKey encryption, credential cache fixes, SigV4 verification
  • Admin: JWT key management, trusted proxy support, Casbin deny-by-default
  • Infrastructure: Endpoint authentication, cookie security, Redis atomicity
  • Network: CORS hardening, ILIKE injection prevention, trusted proxy audit logging

Recommendation: Review and update your configuration files with the new security settings before deploying.

Full Changelog: v0.2.2...v0.3.2

Assets 2
Loading