chats 0.3.1 → 0.4.0

data/app/views/chats/conversations/index.html.erb

@@ -14,6 +14,22 @@
     and on return-to-visible. It needs to wrap the <turbo-cable-stream-source>
     that `turbo_stream_from` renders so it can observe its `connected`
     attribute as the heartbeat. %>
+
+<%# The OTHER inbox-staleness case, distinct from a missed broadcast: a Turbo
+    RESTORATION visit (browser back / Hotwire Native stack pop) serves the
+    inbox's cached snapshot with no GET. Open a chat from a profile, send a
+    message, tap back — the snapshot cached before the chat existed comes back
+    and the new conversation is missing until you navigate away and return.
+    The reconciler above can't help (it only fires on reconnect / visibility,
+    not on a restore visit). `turbo-cache-control: no-cache` makes the inbox
+    uncacheable, so a restore visit re-fetches from the network and is always
+    fresh — on the web AND in Hotwire Native, whose back-pop issues a Turbo
+    `.restore` visit that honors this. Requires the host layout to
+    `yield :head` (the Rails convention); harmless no-op otherwise.
+    https://turbo.hotwired.dev/handbook/building#opting-out-of-caching %>
+<% content_for :head do %>
+  <meta name="turbo-cache-control" content="no-cache">
+<% end %>
 <%= chats_styles %>
 <div data-controller="chats--refresh-inbox">
   <%= turbo_stream_from chats_current_messager, :chats_inbox %>

data/app/views/chats/messages/_action.html.erb

@@ -0,0 +1,15 @@
+<%# A message's featured button (Chats::Action): the one place it takes you,
+    under the words it came with. Rendered inside the bubble, so it is part
+    of the single viewer-agnostic broadcast render AND of the clone the
+    long-press popup lifts — which is why it is a plain link and never a
+    form: a form would need a per-viewer CSRF token baked into a render
+    every subscriber shares. An action is a destination, not a mutation.
+
+    data-turbo-frame="_top": older pages of a thread arrive inside lazy
+    `chats_page_…` turbo-frames, and a link inside a frame navigates the
+    FRAME. _top makes it navigate the page, wherever the bubble landed.
+
+    The url was validated at the write (Chats::Message#
+    action_must_be_well_formed): http(s) or a path on this site, never
+    `javascript:` or protocol-relative. %>
+<%= link_to action.label, action.url, class: "chats-message__action", data: { turbo_frame: "_top" } %>

data/app/views/chats/messages/_composer.html.erb

@@ -1,71 +1,85 @@
 <%# The composer. Submits as a Turbo Stream (the sender's bubble appends from
     the response — instant, no cable round-trip needed); the chats--composer
     controller adds autosize, desktop Enter-to-send, throttled typing pings,
-    and reset-on-success. Plain form POST still works with JS disabled. %>
-<%# id: the swap target — a conversation that locks while this form is open
-    gets the locked notice rendered straight over it (see
-    chats/messages/locked.turbo_stream.erb). %>
-<%= form_with model: Chats::Message.new,
-      url: conversation_messages_path(conversation),
-      id: dom_id(conversation, :composer),
-      class: "chats-composer",
-      data: {
-        controller: "chats--composer",
-        "chats--composer-typing-url-value": (typing_conversation_path(conversation) if Chats.config.typing_indicators),
-        action: "turbo:submit-end->chats--composer#submitted chats:edit-message@window->chats--composer#beginEdit"
-      } do |form| %>
+    and reset-on-success. Plain form POST still works with JS disabled.
 
-<div id="<%= dom_id(conversation, :composer_errors) %>" class="chats-composer__errors"></div>
+    The outer div is the DOCK — the form plus the host's composer_actions.
+    It carries the swap id: a conversation that locks while the composer is
+    open gets the locked notice rendered straight over the whole dock
+    (chats/messages/locked.turbo_stream.erb), so the host's buttons go with
+    it. `.chats-composer` styles the dock; the form is `.chats-composer__form`. %>
+<div id="<%= dom_id(conversation, :composer) %>" class="chats-composer">
+  <%# Slot: the host's own buttons by the composer ("Create a game", "Send my
+      location"). OUTSIDE the form on purpose: host buttons are usually
+      button_to forms, and a form inside a form is invalid HTML — the browser
+      drops the inner one and its button submits THIS form instead. %>
+  <% if chats_slot?(:composer_actions) %>
+    <div class="chats-composer__actions">
+      <%= chats_slot :composer_actions, conversation: conversation %>
+    </div>
+  <% end %>
 
-<%# The edit cue (Telegram's flow): long-press → Editar loads the message
-    into this same form; this quote-style bar (left border, bold label,
-    the original trimmed to one line) is the signal that send = save.
-    The ✕ cancels back to compose mode. %>
-<div class="chats-composer__edit" data-chats--composer-target="editBar" hidden>
-  <div class="chats-composer__edit-quote">
-    <span class="chats-composer__edit-label"><%= t("chats.composer.editing") %></span>
-    <span class="chats-composer__edit-preview" data-chats--composer-target="editPreview"></span>
-  </div>
-  <button type="button"
-          class="chats-composer__edit-cancel"
-          aria-label="<%= t("chats.composer.cancel_edit") %>"
-          data-action="chats--composer#cancelEdit">×</button>
-</div>
+  <%= form_with model: Chats::Message.new,
+        url: conversation_messages_path(conversation),
+        class: "chats-composer__form",
+        data: {
+          controller: "chats--composer",
+          "chats--composer-typing-url-value": (typing_conversation_path(conversation) if Chats.config.typing_indicators),
+          action: "turbo:submit-end->chats--composer#submitted chats:edit-message@window->chats--composer#beginEdit"
+        } do |form| %>
 
-  <%# Selected-attachment previews: thumbnails with per-file remove, rendered
-      client-side from the picker selection (object URLs — nothing uploads
-      until send). This is THE feedback that files are about to go out; a
-      counter chip alone reads as noise. %>
-  <% if Chats.config.attachments %>
-    <div class="chats-composer__previews" data-chats--composer-target="previews" hidden></div>
-  <% end %>
+    <div id="<%= dom_id(conversation, :composer_errors) %>" class="chats-composer__errors"></div>
+
+    <%# The edit cue (Telegram's flow): long-press → Editar loads the message
+        into this same form; this quote-style bar (left border, bold label,
+        the original trimmed to one line) is the signal that send = save.
+        The ✕ cancels back to compose mode. %>
+    <div class="chats-composer__edit" data-chats--composer-target="editBar" hidden>
+      <div class="chats-composer__edit-quote">
+        <span class="chats-composer__edit-label"><%= t("chats.composer.editing") %></span>
+        <span class="chats-composer__edit-preview" data-chats--composer-target="editPreview"></span>
+      </div>
+      <button type="button"
+              class="chats-composer__edit-cancel"
+              aria-label="<%= t("chats.composer.cancel_edit") %>"
+              data-action="chats--composer#cancelEdit">×</button>
+    </div>
 
-  <div class="chats-composer__bar">
+    <%# Selected-attachment previews: thumbnails with per-file remove, rendered
+        client-side from the picker selection (object URLs — nothing uploads
+        until send). This is THE feedback that files are about to go out; a
+        counter chip alone reads as noise. %>
     <% if Chats.config.attachments %>
-      <label class="chats-composer__attach" aria-label="<%= t("chats.composer.attach") %>">
-        <%= form.file_field :files, multiple: true, hidden: true,
-              accept: (Chats.config.attachments == :images ? "image/*" : nil),
-              data: { "chats--composer-target": "files", action: "change->chats--composer#filesChanged" } %>
-        <span aria-hidden="true">📎</span>
-        <span class="chats-composer__file-count" data-chats--composer-target="fileCount" hidden></span>
-      </label>
+      <div class="chats-composer__previews" data-chats--composer-target="previews" hidden></div>
     <% end %>
 
-    <%= form.text_area :body,
-          rows: 1,
-          placeholder: t("chats.composer.placeholder"),
-          class: "chats-composer__input",
-          autocomplete: "off",
-          data: {
-            "chats--composer-target": "input",
-            action: "input->chats--composer#typed keydown.enter->chats--composer#enterSend"
-          } %>
+    <div class="chats-composer__bar">
+      <% if Chats.config.attachments %>
+        <label class="chats-composer__attach" aria-label="<%= t("chats.composer.attach") %>">
+          <%= form.file_field :files, multiple: true, hidden: true,
+                accept: (Chats.config.attachments == :images ? "image/*" : nil),
+                data: { "chats--composer-target": "files", action: "change->chats--composer#filesChanged" } %>
+          <span aria-hidden="true">📎</span>
+          <span class="chats-composer__file-count" data-chats--composer-target="fileCount" hidden></span>
+        </label>
+      <% end %>
 
-    <%# pointerdown/mousedown keepFocus: keeps the textarea focused (and the
-        mobile keyboard up) through the send tap — see composer controller. %>
-    <%= form.button type: :submit, class: "chats-composer__send", "aria-label": t("chats.composer.send"),
-          data: { action: "pointerdown->chats--composer#keepFocus mousedown->chats--composer#keepFocus" } do %>
-      <span aria-hidden="true">➤</span>
-    <% end %>
-  </div>
-<% end %>
+      <%= form.text_area :body,
+            rows: 1,
+            placeholder: t("chats.composer.placeholder"),
+            class: "chats-composer__input",
+            autocomplete: "off",
+            data: {
+              "chats--composer-target": "input",
+              action: "input->chats--composer#typed keydown.enter->chats--composer#enterSend"
+            } %>
+
+      <%# pointerdown/mousedown keepFocus: keeps the textarea focused (and the
+          mobile keyboard up) through the send tap — see composer controller. %>
+      <%= form.button type: :submit, class: "chats-composer__send", "aria-label": t("chats.composer.send"),
+            data: { action: "pointerdown->chats--composer#keepFocus mousedown->chats--composer#keepFocus" } do %>
+        <span aria-hidden="true">➤</span>
+      <% end %>
+    </div>
+  <% end %>
+</div>

data/app/views/chats/messages/_message.html.erb

@@ -23,7 +23,10 @@
      data-updated-at-ms="<%= (message.updated_at.to_f * 1000).ceil %>">
 
   <% if message.system? %>
-    <div class="chats-message__system"><%= message.body %></div>
+    <div class="chats-message__system<%= " chats-message__system--with-action" if message.action? %>">
+      <%= message.body %>
+      <%= render "chats/messages/action", action: message.action if message.action? %>
+    </div>
   <% else %>
     <div class="chats-message__content">
       <% if message.conversation.group? && message.sender %>
@@ -74,6 +77,8 @@
                 <% end %>
               </div>
             <% end %>
+
+            <%= render "chats/messages/action", action: message.action if message.action? %>
           <% end %>
 
           <%# Signature: who WROTE this, when that isn't who it was sent

data/config/locales/en.yml

@@ -64,6 +64,9 @@ en:
       unmuted: "Conversation unmuted."
 
   activerecord:
+    attributes:
+      chats/message:
+        action: "Action"
     errors:
       models:
         chats/conversation:
@@ -79,6 +82,8 @@ en:
             base:
               locked: "This conversation is closed."
               blocked: "You can't message this person."
+            action:
+              invalid: "needs a label of up to %{count} characters and a link to an http(s) address or to a path on this site that starts with /"
             author:
               not_a_messager: "must be a messager (acts_as_messager)"
             sender:

data/config/locales/es.yml

@@ -64,6 +64,9 @@ es:
       unmuted: "Notificaciones activadas."
 
   activerecord:
+    attributes:
+      chats/message:
+        action: "Acción"
     errors:
       models:
         chats/conversation:
@@ -79,6 +82,8 @@ es:
             base:
               locked: "Esta conversación está cerrada."
               blocked: "No puedes enviar mensajes a esta persona."
+            action:
+              invalid: "necesita un texto de hasta %{count} caracteres y un enlace a una dirección http(s) o a una ruta de este sitio que empiece por /"
             author:
               not_a_messager: "debe ser un mensajero (acts_as_messager)"
             sender:

data/lib/chats/action.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Chats
+  # The one featured button a message can carry: a label and the place it
+  # takes you.
+  #
+  #   alice.message!(bob, "Let's play!", action: { label: "Join my room", url: "/play/friend/abcd" })
+  #
+  #   message.action        # => #<data Chats::Action label="Join my room", url="/play/friend/abcd">
+  #   message.action.label  # => "Join my room"
+  #   message.action.to_h   # => { label: "Join my room", url: "/play/friend/abcd" }
+  #
+  # An immutable value, compared by value: two actions with the same label
+  # and url are the same action. It knows nothing about what makes one safe
+  # to render — Chats::Message validates that at the write, where a bad one
+  # can fail loudly instead of rendering a dead or dangerous link.
+  Action = Data.define(:label, :url) do
+    # Whatever a host hands `action:` — nil, a Hash (string or symbol keys),
+    # or an Action — as an Action, or nil.
+    #
+    # Unknown keys raise rather than vanish: `{ label:, url:, method: :post }`
+    # silently becoming a GET link is exactly the surprise this refuses.
+    def self.wrap(value)
+      case value
+      when nil, self then value
+      when Hash
+        attributes = value.to_h { |key, attribute| [key.to_s, attribute] }
+        unknown = attributes.keys - members.map(&:to_s)
+        if unknown.any?
+          raise ArgumentError, "unknown action keys: #{unknown.join(", ")} (an action is a label and a url)"
+        end
+
+        new(label: attributes["label"], url: attributes["url"])
+      else
+        raise ArgumentError, "an action is a Hash with a label and a url, or a Chats::Action — got #{value.inspect}"
+      end
+    end
+
+    # Both are text by the time they're stored: a path helper's String, a
+    # URI, a symbol label — all read back as the String the column holds.
+    # nil stays nil so a missing one is a validation error, not a "" that
+    # looks present.
+    def initialize(label:, url:)
+      super(label: label&.to_s, url: url&.to_s)
+    end
+  end
+
+  class Action
+    # How `chats_messages.action` (json/jsonb) reads and writes: an Action
+    # or nil on the Ruby side, `{"label":…,"url":…}` in the column. Every
+    # assignment goes through Action.wrap, so a Hash, an Action and nil all
+    # work, and anything else raises right where it was assigned.
+    class Type < ActiveRecord::Type::Json
+      def cast(value)
+        Action.wrap(value)
+      end
+
+      # Reads only the two keys an action has, so a row written by a later
+      # version with more of them still loads instead of raising.
+      def deserialize(value)
+        stored = super
+        Action.wrap(stored.slice("label", "url")) if stored.is_a?(Hash)
+      end
+
+      def serialize(value)
+        super(Action.wrap(value)&.to_h)
+      end
+    end
+  end
+end

data/lib/chats/engine.rb

@@ -30,7 +30,7 @@ module Chats
     CHATS_LIB = File.expand_path("chats", LIB_ROOT)
 
     ZEITWERK_IGNORED = %w[
-      version.rb errors.rb configuration.rb engine.rb macros.rb subscribers.rb
+      version.rb errors.rb configuration.rb engine.rb macros.rb subscribers.rb send_rate_limited.rb
     ].freeze
 
     initializer "chats.autoload", before: :set_autoload_paths do

data/lib/chats/inbox.rb

@@ -151,10 +151,13 @@ module Chats
       else
         stacked = Chats::Conversation.direct.where(id: stacked_seats)
         @ungrouped_relation = base_relation.where.not(id: stacked).limit(limit)
-        # Ordered by recency and limited like the other leg, which also makes
-        # the FIRST conversation of each counterpart that counterpart's
-        # freshest — that's the one the stacked row previews.
-        @stacked = apply_search(base_relation.direct.where(id: stacked_seats).limit(limit))
+        recent = base_relation.direct.where(id: stacked_seats).except(:includes).select(:id).limit(limit)
+        # Preserve the recent search window, plus the freshest conversation
+        # of each counterpart. A busy stack cannot consume another stack's
+        # row; at most twice the row limit is materialized.
+        candidates = base_relation.where(id: limited_ids(recent))
+                                  .or(base_relation.where(id: limited_ids(stack_representatives)))
+        @stacked = apply_search(candidates)
       end
 
       @ungrouped = apply_search(@ungrouped_relation)
@@ -163,6 +166,29 @@ module Chats
       @flat = @stacked.empty? && query.nil? ? @ungrouped_relation : @ungrouped + @stacked
     end
 
+    # MySQL rejects LIMIT directly in an IN subquery. A derived table keeps
+    # the bounded selection in SQL and works on all three supported adapters.
+    def limited_ids(relation)
+      Chats::Conversation.from(relation, :limited_conversations).select(:id)
+    end
+
+    # ROW_NUMBER works on every supported adapter (PostgreSQL, SQLite and
+    # MySQL 8). Ranking in SQL avoids loading an entire busy desk's history.
+    def stack_representatives
+      activity = "COALESCE(chats_conversations.last_message_at, chats_conversations.created_at)"
+      ranking = "ROW_NUMBER() OVER (PARTITION BY stack_seats.messager_type, stack_seats.messager_id " \
+                "ORDER BY #{activity} DESC, chats_conversations.id DESC) AS stack_rank"
+      ranked = base_relation.direct.except(:includes, :order)
+                            .joins("INNER JOIN chats_participants stack_seats " \
+                                   "ON stack_seats.conversation_id = chats_conversations.id")
+                            .where(stack_seats: { messager_type: grouped_types })
+                            .where.not(stack_seats: { messager_type: viewer.class.polymorphic_name,
+                                                      messager_id: viewer.id })
+                            .select("chats_conversations.id, #{activity} AS activity_at", ranking)
+      Chats::Conversation.from(ranked, :ranked_stacks).where("stack_rank = 1")
+                         .order(Arel.sql("activity_at DESC, id DESC")).limit(limit).select(:id)
+    end
+
     # Only the direct threads shared with one counterpart. Direct only, by
     # design: a group that happens to include the desk is not part of the
     # desk's stack.

data/lib/chats/models/concerns/messager.rb

@@ -10,6 +10,8 @@ module Chats
   #
   #   alice.message!(bob, "hola!")               # DM in one line
   #   alice.message!(conversation, "hola!")      # or into a conversation
+  #   alice.message!(bob, "Let's play!",         # with a button under it
+  #                  action: { label: "Join my room", url: "/play/abcd" })
   #
   #   alice.chats                                # her inbox, newest first
   #   alice.unread_chats_count                   # for the nav badge
@@ -155,19 +157,20 @@ module Chats
     # sender stays the conversation identity. See Chats::Message#signed?.
     #
     #   desk.message!(alice, "On it!", author: lucia)
-    def message!(target, body = nil, about: nil, files: [], reply_to: nil, author: nil)
-      if author && !Chats.messager_class?(author.class)
-        raise Chats::NotAllowedError,
-              "author must be a messager (acts_as_messager), got #{author.class.name}"
-      end
-
+    #
+    # `action:` is the one featured button under the words — a label and a
+    # url (see Chats::Action). It rides on a message the body rules already
+    # accept; an action alone is not a message.
+    #
+    #   alice.message!(bob, "Let's play!", action: { label: "Join my room", url: room_path(room) })
+    def message!(target, body = nil, about: nil, files: [], reply_to: nil, author: nil, action: nil)
       conversation =
         case target
         when Chats::Conversation then target
         else chat_with(target, about: about)
         end
 
-      attributes = { sender: self, body: body, reply_to: reply_to, author: author }
+      attributes = { sender: self, body: body, reply_to: reply_to, author: author, action: action }
       attributes[:files] = files if files.present?
       conversation.messages.create!(**attributes)
     end

data/lib/chats/models/conversation.rb

@@ -114,6 +114,8 @@ module Chats
     # mechanism. https://api.rubyonrails.org/classes/ActiveRecord/Relation.html#method-i-create_or_find_by
     validate :groups_must_be_enabled, if: :group?
 
+    after_create_commit -> { Chats.notify(:conversation_created, conversation: self) }
+
     # --- Finding & creating ---------------------------------------------------
 
     class << self
@@ -133,21 +135,17 @@ module Chats
         raise Chats::BlockedError, "messagers are blocked" if Chats.blocked_between?(a, b)
         raise Chats::NotAllowedError, "policy forbids messaging" unless Chats.can_message?(a, b)
 
-        conversation = create_or_find_by!(direct_key: direct_key_for([a, b], subject: about)) do |c|
-          c.kind = "direct"
-          c.subject = about
+        transaction do
+          conversation = create_or_find_by!(direct_key: direct_key_for([a, b], subject: about)) do |c|
+            c.kind = "direct"
+            c.subject = about
+          end
+          # Keep the roster in the creation transaction: the after-commit
+          # event must describe a complete conversation, including under an
+          # outer host transaction or a failed participant insertion.
+          [a, b].each { |messager| conversation.add_participant!(messager) }
+          conversation
         end
-
-        # `create_or_find_by!` may have FOUND a conversation created a moment
-        # ago by the other side — participants are ensured idempotently
-        # either way (their own unique index makes this race-safe too).
-        # `previously_new_record?` is how we tell the two apart, so the
-        # :conversation_created event fires ONCE per conversation, not on
-        # every resume.
-        created = conversation.previously_new_record?
-        [a, b].each { |messager| conversation.add_participant!(messager) }
-        Chats.notify(:conversation_created, conversation: conversation) if created
-        conversation
       end
 
       # Create a group conversation. +others+ excludes the creator (who joins
@@ -163,17 +161,12 @@ module Chats
         others = Array(others) - [creator]
         raise ArgumentError, "a group needs at least 2 other participants" if others.size < 2
 
-        conversation = transaction do
+        transaction do
           created = create!(kind: "group", title: title, subject: about)
           created.add_participant!(creator, role: "owner")
           others.each { |messager| created.add_participant!(messager) }
           created
         end
-
-        # Emitted AFTER the transaction: subscribers see a complete roster
-        # and never run inside the write that created it.
-        Chats.notify(:conversation_created, conversation: conversation)
-        conversation
       end
 
       # Deterministic identity for a direct pair (+ optional subject).
@@ -327,8 +320,13 @@ module Chats
     # cancelled", "Payment received" — rendered as a centered system note,
     # not a bubble. This is the stable entry point notification systems
     # (e.g. a Noticed delivery method) should call.
-    def post_system_message!(body)
-      messages.create!(kind: "system", body: body)
+    #
+    # `action:` puts a button under the note (see Chats::Action):
+    #
+    #   conversation.post_system_message!("Your ride was cancelled",
+    #                                     action: { label: "Book another", url: "/rides/new" })
+    def post_system_message!(body, action: nil)
+      messages.create!(kind: "system", body: body, action: action)
     end
 
     # --- Read state -----------------------------------------------------------

data/lib/chats/models/message.rb

@@ -17,6 +17,12 @@ module Chats
   # content AT REPORT TIME, so removing the body later never destroys the
   # evidence a moderator needs.
   #
+  # == Actions
+  #
+  # A message may carry ONE featured button — a label and a url, set by the
+  # host from Ruby ("Your invoice is ready" → *Pay now*). See Chats::Action
+  # for the value and #action_must_be_well_formed for what a safe one is.
+  #
   # == Real-time
   #
   # All Turbo Stream fan-out lives in Chats::Broadcasts (one place to read
@@ -28,6 +34,14 @@ module Chats
 
     KINDS = %w[text system].freeze
 
+    # The shape of a renderable action (see #action_must_be_well_formed): a
+    # label short enough to be a button, a url short enough to be a link,
+    # and only the schemes a browser navigates to safely.
+    ACTION_LABEL_LIMIT = 80
+    ACTION_URL_LIMIT = 2048
+    ACTION_URL_SCHEMES = %w[http https].freeze
+    ACTION_URL_PORTS = (1..65_535)
+
     belongs_to :conversation,
                class_name: "Chats::Conversation",
                inverse_of: :messages,
@@ -56,6 +70,11 @@ module Chats
     # see the migration template's json_column_default).
     attribute :metadata, default: -> { {} }
 
+    # The featured button (Chats::Action), or nil. Its own column rather than
+    # a key in `metadata`, which stays the host's bag: an action is a
+    # contract the bundled bubble renders, so the gem must own where it lives.
+    attribute :action, Chats::Action::Type.new
+
     scope :recent_first, -> { order(created_at: :desc, id: :desc) }
     scope :oldest_first, -> { order(created_at: :asc, id: :asc) }
     scope :visible, -> { where(deleted_at: nil) }
@@ -96,7 +115,10 @@ module Chats
     validate :sender_must_be_active_participant, on: :create
     validate :sender_must_not_be_blocked, on: :create
     validate :conversation_must_not_be_locked, on: :create
-    validate :author_must_be_a_messager
+    validate :author_must_be_persisted
+    # Checked at the write that SETS it, not on every save: an edit must
+    # never fail over an action nobody touched.
+    validate :action_must_be_well_formed, if: :will_save_change_to_action?
     validate :files_must_be_allowed
 
     after_create :register_on_conversation
@@ -110,6 +132,14 @@ module Chats
     def text? = kind == "text"
     def deleted? = deleted_at.present?
     def edited? = edited_at.present?
+    def action? = !action.nil?
+
+    # Wraps on the way in, not lazily on first read (ActiveModel casts user
+    # input when it is read): `message.action = "/pay"` raises right here,
+    # at the line that made the mistake.
+    def action=(value)
+      super(Chats::Action.wrap(value))
+    end
 
     def sender_key
       sender && Chats.messager_key(sender)
@@ -160,6 +190,10 @@ module Chats
     # Delete according to `config.deletion` (see class comment). Returns
     # false when deletion is disabled.
     #
+    # A tombstone shows neither the words nor the button that came with
+    # them, so the soft path clears the action too — and moderation, which
+    # removes content through here, takes the link down with the body.
+    #
     # `enforce_lock: false` is for MODERATION only (see
     # #remove_reported_field!): a product lock must never shield reported
     # content from removal.
@@ -170,7 +204,7 @@ module Chats
       when :soft
         transaction do
           files.purge_later if respond_to?(:files) && files.attached?
-          update!(body: nil, deleted_at: Time.current)
+          update!(body: nil, action: nil, deleted_at: Time.current)
         end
         true
       when :hard
@@ -312,13 +346,52 @@ module Chats
       errors.add(:base, :blocked) if other && Chats.blocked_between?(sender, other)
     end
 
-    # An author signs the bubble with `Chats.display_name_for`, so it has to
-    # be something that HAS a name in this system — a messager, not a ride or
-    # a listing that would render as "Listing 1".
-    def author_must_be_a_messager
-      return if author.nil? || Chats.messager_class?(author.class)
+    # Authorship is a signature, not a conversation seat. A host may keep
+    # staff in a separate model without giving them messaging capabilities.
+    # Never implicitly create that identity while sending a message.
+    def author_must_be_persisted
+      return if author.nil? || author.persisted?
+
+      errors.add(:author, :invalid)
+    end
+
+    # What a button the bubble renders may be: a short label, and a link to
+    # an http(s) URL or a path on this site. The host is trusted, but a bad
+    # action has to fail HERE, loudly, rather than render a dead link or a
+    # `javascript:` one.
+    #
+    # Two layers, because a browser and URI.parse disagree about where a url
+    # goes. First, a string check BEFORE parsing: nothing starting with `//`
+    # or `/\` is a path on this site. URI.parse reads `///evil.example/x`
+    # as a path with no host, yet a browser resolves it to
+    # https://evil.example/x, and treats `/\` like `//`. Then the parse,
+    # which rejects whitespace, control characters and backslashes anywhere
+    # (`/<tab>/evil.example` is stripped into `//evil.example` by browsers),
+    # and decides scheme, host and port.
+    def action_must_be_well_formed
+      return if action.nil?
 
-      errors.add(:author, :not_a_messager)
+      errors.add(:action, :invalid, count: ACTION_LABEL_LIMIT) unless action_label_fits? && action_url_safe?
+    end
+
+    def action_label_fits?
+      action.label.present? && action.label.length <= ACTION_LABEL_LIMIT
+    end
+
+    def action_url_safe?
+      url = action.url
+      return false if url.blank? || url.length > ACTION_URL_LIMIT
+      return false if url.start_with?("//", "/\\")
+
+      uri = URI.parse(url)
+      if uri.scheme
+        ACTION_URL_SCHEMES.include?(uri.scheme.downcase) && uri.host.present? && ACTION_URL_PORTS.cover?(uri.port)
+      else
+        # A path on this site: "/rides/new", never "//elsewhere.example".
+        url.start_with?("/") && uri.host.nil?
+      end
+    rescue URI::InvalidURIError
+      false
     end
 
     # The subject owns the conversation's openness (Chats::ChatSubject#