Backend:
- SSE endpoints changed from GET to POST for JWT auth compliance
- Chat subscription moved to /api/room/{room}/chat/subscribe (avoids route conflict)
- handleAuthCheck now returns config:write permission (was missing from response)
Frontend:
- EventSource replaced with fetch POST + Authorization Bearer header
- Token persisted in localStorage, cleared on logout
- postSSE helper with exponential backoff reconnection
- rooms.tsx: SSE/loading gated on can('room:list'), not just isAuthed
- watch.tsx: room events SSE gated on can('room:watch'), chat SSE on can('room:chat')
- watch.tsx: subscribe button disabled when lacking room:subscribe
- permissions.ts: added isPublisher() helper
This commit adds multiple major features and improvements:
1. Add runtime config API with save/reset capabilities
2. Implement per-room distributor override with global fallback
3. Add user management page and inline user controls
4. Update auth policy with admin/root permissions
5. Refine frontend navigation and error boundary
6. Update static assets and build system
7. Add CDN/SRS/Cloudflare config apply logic
- README: explain the room chat/danmaku flow and the host-only
POST /api/room/{room}/broadcast endpoint for OBS/bot/moderator use.
- Add design.md describing the Awwwards-grade visual/UX bar.
- chatHub broadcasts room danmaku over SSE; new subscribers replay the
last N messages on join so they don't face an empty room.
- Add a host-only external push endpoint POST /api/room/{room}/broadcast
(requires room:publish, Bearer token) that marks messages host:true.
- Slide-window rate limiter (room+sender+IP, 5 per 3s) guards both the
public chat and the broadcast endpoint.
- Wire RBAC room:chat policy, SPA routing and the room-creation route.
Replace the legacy vanilla HTML/CSS/JS pages with a SolidJS single-page
app (TanStack Router/Query, Ark UI, Tailwind v4) and embed its build
output into the Go binary via //go:embed. SPA routes fall back to
index.html. Includes the room chat/danmaku panel, color picker and
broadcaster overlay on the watch/publish pages. Add web/node_modules
and local data to .gitignore.
noelorin