v0.3.2-rc.0

Release v0.3.2-rc.0

This release introduces major security and administrative enhancements, including a complete RBAC system, RTC user management, dynamic configuration, and comprehensive monitoring integration.

🚀 Features

RBAC & Permissions

• Role-Based Access Control: Complete RBAC implementation with role, permission, and user-role management
• Casbin Integration: Integrated Casbin RBAC permission system with security hardening
• Security Enhancements: Deny-by-default policy, O(1) lookup optimization, and ILIKE injection prevention
• Self-Service Permissions: Bypass Casbin for self-service profile updates

User Management

• RTC User Management: Add comprehensive RTC user management with distributed ban sync
• Audit Logging: Real-time audit logging for all user management operations
• Ban Status Cache: Migrate ban cache from in-memory to Redis for distributed consistency
• Real-time Ban Check: Implement real-time ban check for user management operations

Dynamic Configuration

• Config System: Add dynamic configuration system with per-user overrides
• ConfigProvider: Add ConfigProvider abstraction and force-overwrite support
• Performance: Eliminate redundant queries and improve transaction safety
• Issue Resolution: Resolve 6 P2 issues in dynamic config system

Admin APIs

• User Management: Add /api/users endpoint with pagination support
• Session & Message: Add session and message query APIs with device tracking
• Email OTP: Add email OTP login for admin authentication

Monitoring & Observability

• Prometheus Integration: Add Prometheus reverse proxy with iframe embedding support
• Grafana Integration: Add Grafana reverse proxy for metrics visualization
• Tracing: Add Jaeger reverse proxy for distributed tracing
• Profiling: Add Pyroscope reverse proxy for continuous profiling

🐛 Bug Fixes

Security

• ILIKE Injection: Prevent ILIKE injection attacks in ban operations
• Casbin Hardening: Harden Casbin middleware with deny-by-default and O(1) lookup
• Cookie Security: Add cookie Secure flag and unify error messages to English
• Redis Atomicity: Fix Redis atomicity and context propagation in rate limiter and login protection
• CORS & Timeouts: Harden CORS configuration and HTTP timeouts in degraded mode

Core Systems

• Ban Watcher: Prevent nested listen calls in reconnection loop
• Route Conflicts: Resolve gin route wildcard conflict between rtc-users routes
• Permission Bootstrap: Fix server_config permissions missing after bootstrap
• Policy Counting: Correct bootstrap policy count comments for accuracy
• Route Mapping: Fix Casbin route mapping and Prometheus alert dimension issues

Infrastructure

• Database Metrics: Exclude ErrRecordNotFound from database error metrics
• Config Queries: Eliminate redundant queries and improve transaction safety
• Depguard: Resolve depguard violations and add AuditLogFilter to model

🔧 Refactoring & Improvements

• Model Naming: Rename User/Role to AdminUser/AdminRole for clarity
• Code Structure: Restructure middleware, models, and usecases for better maintainability
• Config Cleanup: Remove deprecated features.permission_system config
• Error Handling: Improve error handling and context propagation
• Build System: Commit admin UI build artifacts for CI compatibility

📊 Statistics

• 31 commits since v0.3.1-rc.0
• 14 features added
• 12 bug fixes resolved
• 6 refactoring improvements

⚠️ Breaking Changes

• Model names changed: User → AdminUser, Role → AdminRole
• Removed config key: features.permission_system (now always enabled)

🔒 Security Notes

This release includes multiple security hardening measures:

• Casbin middleware now uses deny-by-default policy
• ILIKE injection prevention in ban operations
• Cookie Secure flag enforcement
• Redis rate limiter atomicity improvements
• CORS configuration hardening

---

Full Changelog: v0.3.1-rc.0...v0.3.2-rc.0