FAQ v5.0.7

Release Date: January 27, 2025
Tags: SECURITY HARDENING, PERFORMANCE OPTIMIZATION, ACCESSIBILITY ENHANCEMENT, ERROR HANDLING, PAGINATION

Upgrade Notes

Breaking Changes

• Search API: /api/faq/search now returns FAQ results instead of just logging
• Feedback API: Now requires authentication (was optional before)
• Type Changes: Some type definitions have been consolidated and renamed

Migration Requirements

• Database Migration: Run migration script for feedback unique constraint
• Redis Setup: Redis required for rate limiting (falls back gracefully if unavailable)
• Type Updates: Update imports to use the centralized type definitions

---

Changed

XSS Protection & Content Sanitization

• HTML Sanitization: Implemented DOMPurify for comprehensive XSS prevention
  • Frontend Sanitization: Added a sanitization step with configurable allowed tags and attributes
  • FAQ Answer Display: All FAQ answers now pass through sanitization before rendering
  • Preview Sanitization: Separate stricter sanitization for FAQ previews with limited HTML tag support
  • Security Configuration: Customizable sanitizer configuration with whitelisted tags, attributes, and URI patterns

Authentication & Authorization Improvements

• Feedback Component Security: Enhanced authentication handling for FAQ feedback submission
  • Login Detection: Proper user authentication checks before allowing feedback submission
  • UI Feedback: Toast notifications with login prompts for unauthenticated users
  • Action Buttons: Login buttons in toast notifications for seamless authentication flow
  • Visual Indicators: Clear messaging when login is required for feedback functionality

Input Validation & Sanitization System

• Backend Validation Framework: Comprehensive input validation for all FAQ operations
  • Email Validation: RFC-compliant email validation with length constraints
  • Question Validation: Length requirements (10-500 characters) with character validation
  • Answer Validation: Minimum 20 characters, maximum 10,000 characters
  • Category Validation: Alphanumeric validation with special character restrictions
  • Tag Validation: Array validation with per-tag constraints and maximum count limits
  • Page Path Validation: URL path validation with security checks

Rate Limiting Implementation

• API Protection: Redis-based rate limiting for FAQ endpoints
  • Feedback Rate Limit: 20 feedback submissions per hour per user
  • Question Rate Limit: 5 questions per day per user
  • Configurable Windows: Customizable time windows and request limits
  • IP-Based Fallback: Rate limiting by IP address for unauthenticated requests
  • Graceful Degradation: Service continues if Redis is unavailable

Pagination System

• Frontend Pagination: Complete pagination implementation for FAQ lists
  • Configurable Page Size: Default 20 items per page with customizable limits
  • Backend Support: API endpoints updated to support page and limit parameters
  • Pagination UI: Full-featured pagination component with page numbers and navigation
  • Performance Impact: Significantly reduced initial load time for large FAQ datasets
  • Backward Compatibility: Non-paginated requests still supported for legacy implementations

Search Efficiency Improvements

• Unified Search API: Combined search and analytics logging into single endpoint
  • Single Request: Eliminated duplicate API calls for search operations
  • Non-Blocking Analytics: Search logging happens asynchronously without affecting response time
  • Result Limiting: Maximum 50 results per search to prevent performance issues
  • Query Optimization: Improved database queries with proper indexing

Database Performance

• Index Optimization: Added missing database indexes for better query performance
  • Feedback Lookups: Added an index so feedback can be found by user, and a unique pairing of user and FAQ to prevent duplicate votes
  • Search Performance: Improved query execution time by up to 60%

Drag & Drop Enhancements

• Ordering Bug Fixes: Resolved issues with FAQ reordering between pages
  • Visual Feedback: Drop zones highlighted during drag operations
  • Data Refresh: Automatic FAQ list refresh after reordering
  • Empty Page Support: Can now drop FAQs onto empty page sections
  • Order Calculation: Proper order value calculation when moving between pages

Error Boundaries

• Graceful Error Handling: Fault tolerance around each FAQ component
  • Component Isolation: Errors in one FAQ component don't crash entire page
  • User-Friendly Messages: Clear error messages with retry options
  • Development Mode: Detailed error information in development environment
  • Recovery Actions: "Try Again" buttons to recover from transient errors

Accessibility Enhancements

• ARIA Labels: Comprehensive accessibility improvements
  • Search Input: Proper ARIA labels, descriptions, and autocomplete attributes
  • Search Suggestions: Full keyboard navigation with arrow keys
  • Role Attributes: Proper listbox and option roles for dropdown components
  • Screen Reader Support: Descriptive labels for all interactive elements
  • Focus Management: Proper focus handling during keyboard navigation

Authentication User Experience

• Feedback Authentication: Improved UX for unauthenticated users
  • Clear Messaging: "Login to provide feedback" message for logged-out users
  • Toast Notifications: Non-intrusive notifications with action buttons
  • Seamless Login: Direct navigation to login page with return URL
  • Visual Cues: Disabled state indicators on feedback buttons

API Responses

• Security Headers: Enhanced security headers on FAQ API responses
• Validation Errors: Every endpoint now answers an invalid request in the same shape, with a message naming the field at fault

---

Fixed

Feedback Duplicate Prevention

• Database Constraints: Unique constraint on user-FAQ feedback combinations
  • Backend Validation: Prevents duplicate feedback submissions at database level
  • Frontend Updates: Proper handling of existing feedback updates
  • Migration Script: Database migration for existing installations
  • Soft Delete Support: Constraint respects soft-deleted records

Category Filter Reset

• Filter State Management: Fixed category filter not resetting properly
  • Clear Filters: All filters now reset when clearing search
  • State Synchronization: Filter states properly synchronized across components
  • Selected Items: Clear selected FAQs when resetting filters
  • UI Consistency: Visual indicators update immediately on filter reset

Type Safety Issues

• Centralized Type Definitions: Consolidated all FAQ-related types into one place, removing the duplicate definitions that had drifted apart across components