Name:           minimost
# Do not edit Version by hand. `bump-my-version bump <part>` (config in
# .bumpversion.toml) updates this line, src/minimost/_version.py, setup.cfg, and
# the tag together, so they never drift. The build reads the version from here.
Version:        0.0.4
Release:        1%{?dist}
Summary:        Lightweight self-hosted collaboration platform for messaging

# The whole tree is MIT (see LICENSE). The bundled fonts/sounds/images under
# src/minimost/static/ are covered by the same license; if any asset is ever
# added under a different license, switch this to an SPDX expression
# (e.g. "MIT AND CC-BY-4.0") and document the breakdown here.
License:        MIT
URL:            https://github.com/SamuelDonovan/minimost
Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz

# Pure-Python application: no compiled extensions, so one build serves every arch.
BuildArch:      noarch

BuildRequires:  python3-devel
# The %%pyproject_* macros. Fedora's python3-devel pulls this in implicitly, but
# EPEL/RHEL do not, so require it explicitly for a portable build.
BuildRequires:  pyproject-rpm-macros
# Provides %%{_unitdir} and the %%systemd_* scriptlet macros.
BuildRequires:  systemd-rpm-macros

%if 0%{?rhel} && 0%{?rhel} < 9
# EL8's rpm (4.14) predates dynamic BuildRequires (%%generate_buildrequires, rpm
# >= 4.15), so the deps %%pyproject_buildrequires would generate on newer distros
# are listed statically here instead. python3-flask is needed by the %%check
# import smoke test (and is EL8's runtime Flask, from AppStream).
BuildRequires:  python3-setuptools
BuildRequires:  python3-wheel
BuildRequires:  python3-pip
BuildRequires:  python3-flask
%endif

# MiniMost ships a systemd service that runs the app under gunicorn. gunicorn is
# the production WSGI server (it is NOT a setup.cfg install_requires, so the
# automatic Python dependency generator won't add it) — require it explicitly.
# Flask is declared in setup.cfg and is resolved automatically from the wheel
# metadata by the dependency generator on Fedora/EL9+.
Requires:       python3-gunicorn

%if 0%{?rhel} && 0%{?rhel} < 9
# EL8's dependency generator does not reliably emit python3dist(flask) from the
# installed wheel, so require Flask explicitly there.
Requires:       python3-flask
%endif

%description
MiniMost is a small, self-hosted team chat server: channels, direct messages,
file sharing, reactions, message search, and one-to-one voice/video calling
over WebRTC. It depends only on Flask at runtime, stores everything in SQLite,
and serves a dependency-free vanilla-JavaScript web client. A bundled pure-Python
STUN server and an auto-provisioned local TLS certificate make LAN calling work
with no external services.

%prep
%autosetup -n %{name}-%{version}

# Dynamic BuildRequires only where rpm supports the section (Fedora, EL9+). On
# EL8 the build deps are listed statically above instead.
%if 0%{?fedora} || 0%{?rhel} >= 9
%generate_buildrequires
%pyproject_buildrequires
%endif

%build
%pyproject_wheel

%install
%pyproject_install
# Record the installed package files (including the bundled templates/, static/
# assets and settings.json package-data) so they land in %%files automatically.
%pyproject_save_files minimost

# Ship the systemd unit. It runs as a DynamicUser with StateDirectory=minimost,
# so the package creates neither a system user nor /var/lib/minimost — systemd
# provisions both at first start. That keeps %%files and the scriptlets minimal.
install -D -m 0644 minimost.service %{buildroot}%{_unitdir}/minimost.service

%check
# Lightweight, non-flaky smoke test that the installed package imports cleanly.
# A plain `python -c import` (rather than %%pyproject_check_import, whose -e flag
# is absent from EL8's old pyproject-rpm-macros) keeps this portable across every
# target. MINIMOST_SKIP_TLS stops the import from provisioning a TLS cert
# (gunicorn_conf honours it); MINIMOST_DATA_DIR points the import-time SQLite
# bootstrap at a throwaway dir so nothing is written into the buildroot.
export MINIMOST_SKIP_TLS=1
export MINIMOST_DATA_DIR="$(mktemp -d)"
PYTHONPATH=%{buildroot}%{python3_sitelib} %{python3} -c "import minimost, minimost.gunicorn_conf, minimost.certs, minimost.stun, minimost.clean, minimost.preview"

%post
%systemd_post minimost.service

%preun
%systemd_preun minimost.service

%postun
%systemd_postun_with_restart minimost.service

%files -f %{pyproject_files}
%license LICENSE
%doc README.md
# Console-script entry point declared in setup.cfg ([options.entry_points]); the
# pyproject macros place it in %%{_bindir} but do not auto-list it.
%{_bindir}/minimost
%{_unitdir}/minimost.service

# No %%changelog here: the build pipeline (.copr/Makefile and the rpm.yml
# workflow) appends one generated from git history by .copr/gen-changelog.sh, so
# releases need no spec edit. When this spec moves to Fedora dist-git, drop the
# generated changelog in favour of %%autochangelog (+ %%autorelease), which dist-git
# expands natively from the packaging repo's own commits.
%changelog
* Sun Aug 09 2026 Samuel Mehalko <samuel.mehalko@gmail.com> - 0.0.4-1
- feat(sounds): replace call and message sounds with synthesised set
- feat(calls): share screens as a group, rebuild the call UI
- fix(calls): never strand a participant in a call nobody can end
- fix(chat): use math.isnan for the before-cursor NaN guard
- fix(chat): reduce and soften history loads that interrupt mobile scrolling
- fix(chat): stop history paging snapping the scroll position
- perf(chat): load channel history a page at a time
- fix: resolve all 18 SonarQube issues
- fix(security): gate uploads on channel visibility; harden message rendering
- feat(chat): add unread divider, per-channel drafts, visible edit marker
- fix(chat): repair search jump, DM persistence, and assorted UI defects
- fix(auth): validate username live and stop footer links stranding a divider
- fix(security): escape LIKE wildcards in DM channel matching
- fix(security): add COOP/COEP/CORP + Permissions-Policy, drop timestamp leak
- feat(auth): harden password policy for ASD STIG APSC-DV-001940
- fix(audit): close the log handle before renaming so rotation works on Windows
- feat(auth): regenerate the session on authentication
- fix(audit): use a cross-platform lock for log rotation, not fcntl
- feat: add generic custom error handlers
- feat(audit): rotate the audit log by size/age, configurable in settings.json
- feat(auth): show explicit logoff confirmation after logout
- feat: allow session_idle_minutes=0 to disable idle logout
- feat: make session idle timeout configurable, default 2 weeks
- feat: add session inactivity timeout and security headers
- feat(audit): add security audit logging for STIG compliance
- feat: add DoS mitigations with rate limiting and fair eviction

* Sun Jun 21 2026 Samuel Mehalko <samuel.mehalko@gmail.com> - 0.0.3-1
- fix(flask): serve downloads with a version-agnostic filename kwarg
- feat(release): adopt bump-my-version for single-source versioning
- feat(rpm): generate %changelog from git history at build time
- fix(rpm): require pyproject-rpm-macros explicitly for EPEL/RHEL
- fix(copr): read version at shell runtime in srpm Makefile
- fix(chat): stop duplicate file preview on send
- fix(dev): inline CSS on dev server to prevent unstyled pages
- feat(events): replace HTTP pollers with one SSE push stream

* Fri Jun 19 2026 Samuel Mehalko <samuel.mehalko@gmail.com> - 0.0.2-1
- fix: prevent intermittent CSS load failures on dev server
- fix: suppress false-positive codeql sql-injection alert in search

* Sun Jun 14 2026 Samuel Mehalko <samuel.mehalko@gmail.com> - 0.0.1-1
- Initial release