倪程伟 77b6baeccc feat(channel): webchat session-management endpoints (list / messages / delete) ... Add per-visitor session management for the WebChat Web/API access mode: list a visitor's conversation threads, fetch a thread's messages, and delete a thread. Authorization: visitorId is a client-asserted request param, so it cannot be trusted on its own — deriving conversationId from it and then checking ownership against it is tautological (any caller passes). Instead, /stream issues a per-visitor token = HMAC-SHA256(jwtSecret, channelId:visitorId), returned in the meta event; the management endpoints require it back via the X-MC-Visitor-Token header and verify it in constant time. The signing secret is server-only (unlike the public channel API key) and the channelId in the payload makes tokens non-portable across channels. Includes regression tests for token issuance/verification semantics (forged visitorId rejected, cross-visitor and cross-channel tokens rejected, tampered tokens rejected).		2026-06-09 11:10:13 +08:00
..
src	feat(channel): webchat session-management endpoints (list / messages / delete)	2026-06-09 11:10:13 +08:00
Dockerfile	fix(wiki): surface scan errors and fix Chinese path handling in Docker (#260)	2026-06-07 16:18:49 +08:00
pom.xml	fix(build): repackage server as executable jar	2026-05-18 10:21:42 +08:00
settings.xml	build(maven): declare US + CN repositories in pom.xml, drop opaque mirror	2026-04-25 09:56:17 +08:00