Changelog

Complete 5-phase notification routing redesign modeled after Slack's architecture. Server-side per-device activity state via heartbeat, delayed and cancellable mobile push notifications, cross-device read sync, server-synced Do Not Disturb with schedule support, and per-device notification level preferences. All phases gated behind feature flags with workspace-scoped rollout.

Fixed chat and task images returning 404 after page refresh on Azure. Root cause was five backend serializers returning attachment paths without full blob storage URLs. Added a catch-all redirect route from /storage/* to Azure Blob Storage for backwards compatibility with cached bundles and historical records.

Closed 75 findings across 4 phases from a comprehensive audit of email delivery, notification dispatch, push notification, and Azure infrastructure. Includes HMAC webhook verification, cross-workspace mention validation, token-based unsubscribe, push payload sanitization, Expo circuit breaker, and Key Vault secret provisioning.

Users were being kicked to login during transient backend failures like Azure deploys. Fixed across 4 layers: backend grace-period token overlap, frontend error classification distinguishing session death from transient failures, proactive refresh with exponential backoff, and cross-tab coordination via localStorage locks.

Found and fixed 20+ security, cost, and architectural issues in the AI chat system. Eliminated cross-workspace data leaks, deleted RAG system, switched to token-proportional credit billing, added OpenAI moderation, sanitized error messages, and built permission-scoped workspace context injection.

Comprehensive audit of sidebar drag-drop reordering. Fixed 13 bugs including a critical PostgreSQL advisory lock gap, real-time Pusher sync causing UI flashes, broadcast payload built after commit with stale data, and missing transaction wrapping in personal mode batch operations.

All four backend services (Laravel API, Payment Service, AI Agent Service, YJS Server) deployed to Azure App Service. File storage migrated from local disk to Azure Blob Storage with geo-redundant storage. 32 secrets configured in Azure Key Vault. Over 100 files migrated to cloud storage.

Comprehensive audit of the Tiptap rich text editor system across the full stack. Found and resolved 45 issues across 7 critical, 12 high, and 26 medium/low severity findings. Fixes include authorization enforcement on page content updates, broadcast channel access control, image upload validation, and production logging cleanup.

End-to-end refactor of the workspace and project invitation system. Fixed 45 bugs including deferred billing from invite-time to acceptance-time, added expiration enforcement, created authorization policies, and resolved cross-workspace data leakage. 37 new tests added covering all invitation flows.

Defense-in-depth permission refactor across backend policies, route middleware, and broadcast channels. Added ClipPolicy and TaskCommentPolicy, fixed broadcast channel authentication for DMs, reduced permission cache TTL for faster role propagation, and gated frontend UI elements by role.

Complete overhaul of subscription usage tracking. AI credits now enforced via middleware, storage limits checked on upload, project and user deletions properly decrement counters. All operations use atomic database increments to prevent race conditions. Weekly storage recalculation scheduled for drift detection.

Added the ability to archive and unarchive projects from the sidebar context menu, project grid cards, and list views. Archived projects are hidden from the main project list and sidebar but can be revealed with a toggle. Full stack implementation including migration, API filtering, and frontend UI.