- Implemented across bootstrap.php, chat frontend, and dashboard:
Per-tier audio bitrate: Free 64, Plus 96, Pro 128 kbps. Configurable text/voice reply threads and depth. Registration/login-only honeypot and internal CAPTCHA. Optional Google reCAPTCHA v2/v3 with server verification. Archive/export support for replies and bitrate. Dashboard controls for all settings. Verified JavaScript, JSON, SQLite migrations, desktop/mobile UI, and browser console. Native PHP lint was unavailable because PHP is not installed. Google implementation follows Siteverify and reCAPTCHA v3.
This commit is contained in:
Ty Clifford
@@ -1,12 +1,13 @@
|
||||
# CyberChat 2.1.0
|
||||
# CyberChat 2.2.0
|
||||
|
||||
CyberChat 2.1.0 is the current baseline release. It is a framework-free PHP, SQLite, JavaScript, and HTML5 chat application with text and voice messaging, configurable service tiers, Stripe subscriptions, Mailgun email verification, private archives, resilient queued polling, an administrator dashboard, and optional FFmpeg and MySQL/MariaDB integrations.
|
||||
CyberChat 2.2.0 is the current baseline release. It is a framework-free PHP, SQLite, JavaScript, and HTML5 chat application with text and voice messaging, configurable service tiers, Stripe subscriptions, Mailgun email verification, private archives, resilient queued polling, an administrator dashboard, and optional FFmpeg and MySQL/MariaDB integrations.
|
||||
|
||||
## Current Capabilities
|
||||
|
||||
### Chat and Interface
|
||||
|
||||
- Authenticated public chat with text and voice messages
|
||||
- Reply-to controls for text and voice with configurable thread depth
|
||||
- Chronological message reconciliation with the newest message at the bottom
|
||||
- Single-worker cursor polling with catch-up batches, deduplication, request timeouts, retry backoff, and immediate wake-up after sending
|
||||
- Poll recovery when the browser returns online or the tab becomes visible
|
||||
@@ -22,6 +23,7 @@ CyberChat 2.1.0 is the current baseline release. It is a framework-free PHP, SQL
|
||||
### Voice and Audio
|
||||
|
||||
- Browser microphone recording with a configurable duration and upload-size limit
|
||||
- Per-tier recording and FFmpeg output bitrate from 48 to 320 kbps
|
||||
- WebM/Opus recording by default on supported browsers
|
||||
- MP4/AAC and AAC recording fallback for Safari and iPhone
|
||||
- Upload validation for WebM, WAV, MP4/M4A, and AAC
|
||||
@@ -55,6 +57,9 @@ CyberChat 2.1.0 is the current baseline release. It is a framework-free PHP, SQL
|
||||
- Mailgun-based email delivery through a reusable cURL mailer
|
||||
- Tier-configurable email two-factor authentication
|
||||
- Six-digit login challenges with expiration and attempt limits
|
||||
- Registration/login-only internal arithmetic CAPTCHA
|
||||
- Invisible registration/login honeypot fields that reject bot-like submissions
|
||||
- Optional Google reCAPTCHA v2 checkbox or v3 score/action verification
|
||||
- Account view for email verification, 2FA, plan details, billing, and current feature entitlements
|
||||
- Tier-configurable custom username colors
|
||||
- Administrator user creation, username/color/password editing, session termination, and deletion
|
||||
@@ -67,6 +72,7 @@ CyberChat 2.1.0 is the current baseline release. It is a framework-free PHP, SQL
|
||||
- Per-tier feature toggles and archive retention
|
||||
- Current configurable entitlements:
|
||||
- Voice messages
|
||||
- Voice bitrate
|
||||
- Recording-status sending and viewing
|
||||
- Automatic voice send
|
||||
- Automatic voice play
|
||||
@@ -189,6 +195,7 @@ The defaults are starting points. Plans, prices, and every listed entitlement ca
|
||||
| Feature | Free | Plus | Pro |
|
||||
|---|---:|---:|---:|
|
||||
| Voice messages | Yes | Yes | Yes |
|
||||
| Voice bitrate | 64 kbps | 96 kbps | 128 kbps |
|
||||
| Recording status send/view | No | Yes | Yes |
|
||||
| Automatic voice send | No | Yes | Yes |
|
||||
| Automatic voice play | No | Yes | Yes |
|
||||
@@ -217,7 +224,7 @@ Important settings:
|
||||
| `voice.transcoding.enabled` | Enable server-side FFmpeg conversion |
|
||||
| `voice.transcoding.ffmpeg_path` | FFmpeg executable name or absolute path |
|
||||
| `voice.transcoding.profile` | `m4a_aac` or `mp4_h264_aac` |
|
||||
| `voice.transcoding.audio_bitrate_kbps` | AAC bitrate from 48 to 320 kbps |
|
||||
| `voice.transcoding.audio_bitrate_kbps` | Fallback AAC bitrate when no tier override is supplied |
|
||||
| `voice.transcoding.timeout_seconds` | Conversion timeout from 5 to 300 seconds |
|
||||
| `voice.transcoding.fallback_to_source` | Keep the source file if conversion fails |
|
||||
|
||||
@@ -239,6 +246,8 @@ When FFmpeg is enabled:
|
||||
- New uploads are converted; existing files are not rewritten.
|
||||
- The original file can be retained automatically if FFmpeg fails.
|
||||
|
||||
The authenticated user's `voice_bitrate_kbps` tier entitlement controls the browser MediaRecorder target and overrides the FFmpeg fallback bitrate for new clips.
|
||||
|
||||
The web server must serve `.webm`, `.wav`, `.aac`, `.m4a`, and `.mp4` with the MIME mappings shown in `.htaccess` and `nginx-example.conf`.
|
||||
|
||||
## Mailgun
|
||||
@@ -305,6 +314,27 @@ User archive behavior:
|
||||
|
||||
Voice files remain in `uploads/voice/` while their metadata moves between live and archive databases. Administrator deletion actions remove the associated recording file.
|
||||
|
||||
Reply IDs, reply depth, parent previews, and voice bitrate metadata are retained in daily archives and personal JSON/CSV exports.
|
||||
|
||||
## CAPTCHA
|
||||
|
||||
CAPTCHA checks are scoped to registration and initial password login. Email 2FA code verification, chat messages, account updates, and dashboard actions do not invoke CAPTCHA.
|
||||
|
||||
Dashboard controls under **Plans & Platform > Registration / Login CAPTCHA** configure:
|
||||
|
||||
- Registration and login protection independently
|
||||
- Invisible honeypot protection
|
||||
- Internal arithmetic challenge difficulty, expiration, and attempt limit
|
||||
- Google reCAPTCHA v2 checkbox or v3 score mode
|
||||
- Google site key, secret key, expected hostname, and v3 minimum score
|
||||
|
||||
Google tokens are verified server-side through the Siteverify API. For v3, CyberChat also validates the expected `register` or `login` action and the configured score threshold.
|
||||
|
||||
Google references:
|
||||
|
||||
- <https://developers.google.com/recaptcha/docs/verify>
|
||||
- <https://developers.google.com/recaptcha/docs/v3>
|
||||
|
||||
## Polling and Message Ordering
|
||||
|
||||
CyberChat uses one polling worker per active chat view:
|
||||
@@ -331,7 +361,7 @@ This design avoids overlapping poll requests, duplicate voice players, and tempo
|
||||
| Archives | Browse days, inspect file sizes, filter/edit/delete messages, delete days |
|
||||
| Users | Create users, edit credentials/colors, assign tiers, kick, delete |
|
||||
| Sessions | Inspect active/expired sessions and terminate one, expired, or all |
|
||||
| Plans & Platform | Plans, pricing, entitlements, Stripe, Mailgun, FFmpeg, MySQL, statistics |
|
||||
| Plans & Platform | Plans, pricing, bitrate, replies, CAPTCHA, Stripe, Mailgun, FFmpeg, MySQL, statistics |
|
||||
| Config | Edit and validate `config.json` directly |
|
||||
|
||||
## Configuration Families
|
||||
@@ -339,12 +369,12 @@ This design avoids overlapping poll requests, duplicate voice players, and tempo
|
||||
`config.json` is editable through **Admin > Config**. The primary groups are:
|
||||
|
||||
- `app`: installation base URL
|
||||
- `chat`: text limits, polling, browser buffer, and session restrictions
|
||||
- `chat`: text limits, polling, browser buffer, replies, and session restrictions
|
||||
- `archive`: archive enablement and directory
|
||||
- `voice`: recording, upload, playback defaults, storage, and FFmpeg
|
||||
- `database`: main SQLite path, archive template, and optional MySQL mirror
|
||||
- `ui`: application title and subtitle
|
||||
- `security`: password, session, bcrypt, and CORS settings
|
||||
- `security`: password, session, bcrypt, CORS, and registration/login CAPTCHA settings
|
||||
- `subscriptions`: new-subscription visibility
|
||||
- `mailgun`: verification and 2FA delivery
|
||||
- `stripe`: Checkout, webhook, and Billing Portal settings
|
||||
@@ -392,12 +422,12 @@ The diagnostic endpoint exposes deployment details and should be restricted or r
|
||||
## Embedding
|
||||
|
||||
```html
|
||||
<link rel="stylesheet" href="/chat/assets/css/cyberchat.css?v=20260609.3">
|
||||
<link rel="stylesheet" href="/chat/assets/css/cyberchat.css?v=20260609.4">
|
||||
<div id="my-chat" style="width:100%;height:600px"></div>
|
||||
<script>
|
||||
window.CYBERCHAT_BASE = '/chat';
|
||||
</script>
|
||||
<script src="/chat/assets/js/cyberchat-app.js?v=20260609.6"></script>
|
||||
<script src="/chat/assets/js/cyberchat-app.js?v=20260609.7"></script>
|
||||
<script>
|
||||
CyberChat.init('#my-chat');
|
||||
</script>
|
||||
|
||||
Reference in New Issue
Block a user