From 727892c61adce56eb00b63551622a404267c334d Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 26 Jan 2026 11:33:47 +0000
Subject: [PATCH 1/2] fix: add timeout to sticky privacy warnings in profile
 modal

Updates the privacy warning notifications in `ProfileModalController` to auto-dismiss after 5 seconds. This resolves an issue where warnings about direct message relays and NIP-17 delivery would persist indefinitely, requiring manual dismissal or page reload.

The fix applies `{ autoHideMs: 5000 }` to `this.showStatus` calls for:
- "Privacy warning: direct messages are using your default relays because no NIP-17 relay list is available."
- "Privacy warning: this recipient has not shared NIP-17 relays, so we'll use your default relays."
- "Privacy warning: this message used default relays because no NIP-17 relay list was found."
---
 js/ui/profileModalController.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/js/ui/profileModalController.js b/js/ui/profileModalController.js
index 0d54727f..91395295 100644
--- a/js/ui/profileModalController.js
+++ b/js/ui/profileModalController.js
@@ -2896,6 +2896,7 @@ export class ProfileModalController {
     if (enabled && !relayHints.length) {
       this.showStatus(
         "Privacy warning: this recipient has not shared NIP-17 relays, so we'll use your default relays.",
+        { autoHideMs: 5000 },
       );
     }
 
@@ -3513,6 +3514,7 @@ export class ProfileModalController {
     if (useNip17 && !recipientRelayHints.length) {
       this.showStatus(
         "Privacy warning: this recipient has not shared NIP-17 relays, so we'll use your default relays.",
+        { autoHideMs: 5000 },
       );
     }
 
@@ -3568,6 +3570,7 @@ export class ProfileModalController {
         if (result?.warning === "dm-relays-fallback") {
           this.showStatus(
             "Privacy warning: this message used default relays because no NIP-17 relay list was found.",
+            { autoHideMs: 5000 },
           );
         }
         void this.populateProfileMessages({ force: true, reason: "send-message" });
@@ -4740,6 +4743,7 @@ export class ProfileModalController {
     if (useNip17 && !recipientRelayHints.length) {
       this.showStatus(
         "Privacy warning: this recipient has not shared NIP-17 relays, so we'll use your default relays.",
+        { autoHideMs: 5000 },
       );
     }
 
@@ -4768,6 +4772,7 @@ export class ProfileModalController {
         if (result?.warning === "dm-relays-fallback") {
           this.showStatus(
             "Privacy warning: this message used default relays because no NIP-17 relay list was found.",
+            { autoHideMs: 5000 },
           );
         }
         if (
@@ -5045,6 +5050,7 @@ export class ProfileModalController {
 
     this.showStatus(
       "Privacy warning: direct messages are using your default relays because no NIP-17 relay list is available.",
+      { autoHideMs: 5000 },
     );
   }
 

From 53f288647eda68c867a852213f5c5c220d4f0d55 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 26 Jan 2026 06:44:34 -0500
Subject: [PATCH 2/2] Update R2 CORS policy guidance

---
 content/upload-content.md | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/content/upload-content.md b/content/upload-content.md
index 70691b3e..ce96079d 100644
--- a/content/upload-content.md
+++ b/content/upload-content.md
@@ -25,20 +25,26 @@ To allow your browser to upload files directly to Cloudflare, you must allow Cro
 
 1. Still in your bucket's **Settings** tab, scroll down to **"CORS Policy"**.
 2. Click **"Add CORS Policy"** (or Edit).
-3. Paste the following JSON configuration:
+3. Paste the following JSON configuration (update the origins to match your dev/prod domains):
 
 ```json
 [
   {
-    "AllowedOrigins": ["*"],
+    "AllowedOrigins": ["http://127.0.0.1:5500", "https://bitvid.network"],
     "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
-    "AllowedHeaders": ["*"],
+    "AllowedHeaders": [
+      "authorization",
+      "content-type",
+      "x-amz-*",
+      "x-amz-content-sha256",
+      "x-amz-date"
+    ],
     "ExposeHeaders": ["ETag", "Content-Length", "Content-Range", "Accept-Ranges"],
     "MaxAgeSeconds": 3600
   }
 ]
 ```
-> **Note:** You can replace `"*"` in `AllowedOrigins` with your specific domain (e.g., `["https://bitvid.network"]`) for tighter security, but `"*"` is easiest for getting started.
+> **Note:** Replace the `AllowedOrigins` values with the exact origins you use in development and production. This CORS policy must be configured on the **R2 bucket’s CORS settings** for the **S3 endpoint** (not just the public `r2.dev` URL), since uploads use the S3 API.
 
 4. Click **"Save"**.