chats 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: baea21fb7f7a5ce0c50ec662b84fbef24adaa4ceb0c12a876de29891f88a2419
-  data.tar.gz: c199fc0c645bd667b7672e1ca0ea7257eb0e9cf05179c576f606fcf784b9feb0
+  metadata.gz: f2f76b973f012e2c86514932efaca3db25eaf8c70ed4709276d1f5f33d520de2
+  data.tar.gz: 2b88c68ad0d239a9ba87b5e907193924926a3926715ed39b62f844e2d899bf19
 SHA512:
-  metadata.gz: 7739f616cf9e555ea1ed2e6321937bc6698d9e08733ee6c496d95ed41e2331694b5340ab5be641ac2e73875a17c4a4859bfa09e01cb0b3984a5b4fa340dcceb1
-  data.tar.gz: 712ac6d49724af1505807c3aaadd4f10fd52c8fec9653efbb9d4a89843be6fa0b2ec680873e240cc4c2bc139048cb5796b1165fced263992dc13d1499d2da0fc
+  metadata.gz: be31c3ce5aad04e1c9d5d0ba141403514da0f547de42a4516ede78117025a12c7f3936060787a3935e477e4f2c03aa2fcfb7b7550c0fdca77a5c6d65a0c86db3
+  data.tar.gz: f22af91cf0ccb50bd933659d0fdc549306ecb2bfad09ee87cfb0193499a0839c2f468cd8e109ad7266ddba35200126b28d5f8958b065420fd828a065b9f40b80

data/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-10-17
+
+### Changed
+**Upgrade note: your `can_message` policy now runs on every direct send,
+not only when a thread is opened.** Read yours before upgrading. If it
+means "who may OPEN a conversation" (a listing must be live, a ride must be
+accepted), existing threads will stop taking messages the moment it turns
+false for the pair — which is usually what you want (a block already
+behaves this way), but is a change. If it is expensive, it now costs that
+on every direct message; make it cheap or cache what it reads. It must not
+raise: an exception escapes the send like any other host error. Group
+conversations and system messages are unchanged.
+
+- **`can_message` holds on every direct send.** A block placed
+  mid-conversation already stopped the next message; the host's policy
+  turning false did not, so a pair allowed when the thread was opened kept
+  talking after an account was banned or a membership ended. Every text
+  message into a direct conversation now re-runs `Chats.can_message?`
+  exactly like the block check: `:blocked` when either side blocked the
+  other, `:not_allowed` (new, in `en` and `es`) when the policy says no.
+  The policy is asked last, only of a send that is otherwise valid (a
+  stranger, a locked thread or an empty body is refused before it runs).
+  The composer answers with its errors stream as before.
+- **A direct thread with nobody on the other side takes no messages.** When
+  the counterpart's account was destroyed, its seat went with it (the
+  gem's `dependent: :destroy` on participations); a text message into that
+  thread is refused with `:not_allowed` instead of slipping past both the
+  block and the policy checks. The thread stays readable.
+
+## [0.4.1] - 2026-10-17
+
+### Fixed
+- **An action's strings are frozen copies.** `Data` freezes the action but
+  not the strings it was handed, so `action.url.replace("javascript:…")`,
+  or the caller mutating the string they passed in, could rewrite a
+  validated action in memory before the bubble rendered it. `Chats::Action`
+  now keeps a frozen copy of both members: what the validator saw is what
+  renders.
+- **An empty port suffix is refused.** `https://host:/x` parses as the
+  default port and slipped past the 1..65535 rule; a named port must have
+  digits.
+- **An action's label is a plain String.** A label handed over as an
+  html_safe string (a host's `t("…_html")`) kept the mark through the copy
+  and rendered unescaped in the button. The copy is now a plain `String`,
+  so the bubble escapes it like any other content.
+- **`config.inbox_scope` is one rule, applied once.** `Messager#chats` now
+  applies it, so the inbox relation, `unread_chats_count`, the inbox screen
+  and the live badge all agree. The badge broadcast used to count through
+  the raw `inbox_for` relation and could light up for a conversation the
+  inbox would never show (a host scoping game records out of the inbox saw
+  the badge count them). `Chats::Inbox` builds on `viewer.chats`, so a
+  host's own override of `chats` reaches the inbox screen too.
+- The README said the inbox preview still shows a soft-deleted message's
+  body; it reads "Message deleted", as for any tombstone.
+
 ## [0.4.0] - 2026-10-17
 
 Action buttons. A support desk writes "Your invoice is ready" and wants a

data/README.md

@@ -171,7 +171,7 @@ That single hook makes moderate's bidirectional block table the law everywhere c
 - **can't send** into an existing one (a block placed mid-conversation stops the very next message),
 - and **stop seeing** each other's direct threads in the inbox and unread counts — *hidden, never deleted*: lift the block and the history reappears.
 
-Two semantics worth knowing: blocking is enforced **beneath** your `can_message` policy (a permissive or buggy policy can never let a blocked pair talk), and **group conversations are exempt from pair blocks** — the industry standard: blocking someone removes your private line, not your seat in shared spaces. If your domain should eject blocked members from groups, do it in moderate's `on_block` hook by tearing down whatever domain relationship feeds the group membership.
+Two semantics worth knowing: blocking is enforced **beneath** your `can_message` policy (a permissive or buggy policy can never let a blocked pair talk), both are checked on **every direct send**, not only when the thread is opened (a block placed, or a policy turning false, mid-conversation stops the very next message with `:blocked` / `:not_allowed`), and **group conversations are exempt from pair blocks** — the industry standard: blocking someone removes your private line, not your seat in shared spaces. If your domain should eject blocked members from groups, do it in moderate's `on_block` hook by tearing down whatever domain relationship feeds the group membership.
 
 ### 2. Reportable + filtered messages
 
@@ -469,7 +469,7 @@ Chats::Action.new(label: "Pay now", url: "/pay")   # accepted anywhere a Hash is
 - `url`: at most 2048 characters, and EITHER an absolute `http://` / `https://` URL with a host (and, if it names one, a port from 1 to 65535), OR a path on your site that starts with a single `/`. Everything else is refused: `javascript:`, `data:`, `mailto:`, relative paths, and anything a browser would send to another site: `//elsewhere.example`, `///elsewhere.example`, `/\elsewhere.example`, `/<tab>/…`. URLs must be escaped, as Rails' url helpers already produce them.
 - The error is `errors.of_kind?(:action, :invalid)`, with a readable message in `en` and `es`.
 
-Body rules don't change: an action goes with a message, it is never a message by itself. Both text and system messages can carry one. `edit!` keeps the action. **A tombstone shows neither the body nor the button**: soft deletion clears the action, and so does a moderator's `remove_reported_field!`, because it goes through the same tombstone. The inbox preview still shows the body.
+Body rules don't change: an action goes with a message, it is never a message by itself. Both text and system messages can carry one. `edit!` keeps the action. **A tombstone shows neither the body nor the button**: soft deletion clears the action, and so does a moderator's `remove_reported_field!`, because it goes through the same tombstone. The inbox preview reads “Message deleted”, as for any tombstone.
 
 **Only your Ruby code sets an action.** The composer can't: `Chats::MessagesController` permits `body` and `files` only, the same as with `author:`. Restyle the button with `.chats-message__action` (eject `chats/messages/_action.html.erb` to change its markup). It uses your `--chats-accent` / `--chats-accent-contrast` colours: accent-filled under someone else's message or a system note, reversed inside your own accent-coloured bubble.
 

data/config/locales/en.yml

@@ -82,6 +82,7 @@ en:
             base:
               locked: "This conversation is closed."
               blocked: "You can't message this person."
+              not_allowed: "You can't message this person right now."
             action:
               invalid: "needs a label of up to %{count} characters and a link to an http(s) address or to a path on this site that starts with /"
             author:

data/config/locales/es.yml

@@ -82,6 +82,7 @@ es:
             base:
               locked: "Esta conversación está cerrada."
               blocked: "No puedes enviar mensajes a esta persona."
+              not_allowed: "Ahora mismo no puedes enviar mensajes a esta persona."
             action:
               invalid: "necesita un texto de hasta %{count} caracteres y un enlace a una dirección http(s) o a una ruta de este sitio que empiece por /"
             author:

data/lib/chats/action.rb

@@ -40,8 +40,23 @@ module Chats
     # URI, a symbol label — all read back as the String the column holds.
     # nil stays nil so a missing one is a validation error, not a "" that
     # looks present.
+    #
+    # Each is a frozen, PLAIN String copy. `Data` freezes the action, not the
+    # strings it was handed, so without the copy `action.url.replace(
+    # "javascript:…")` would rewrite a validated action in place — and so
+    # would the caller mutating the string they passed in. Plain, because
+    # `String.new` drops an html_safe mark: a label that arrived as a
+    # SafeBuffer (a host's `t("…_html")`) would otherwise render unescaped
+    # in the button. An action is a value: what the validator saw is what
+    # the bubble renders, and the bubble escapes it like any other content.
     def initialize(label:, url:)
-      super(label: label&.to_s, url: url&.to_s)
+      super(label: plain(label), url: plain(url))
+    end
+
+    private
+
+    def plain(value)
+      String.new(value.to_s).freeze unless value.nil?
     end
   end
 

data/lib/chats/broadcasts.rb

@@ -120,10 +120,10 @@ module Chats
           target: "chats_unread_badge",
           partial: BADGE_PARTIAL,
           # Counted at broadcast-enqueue time: the badge is advisory UI; a
-          # count that's seconds stale self-heals on the next event.
-          # reorder(nil): COUNT(DISTINCT) + the inbox's COALESCE order would
-          # error on PostgreSQL.
-          locals: { count: Chats::Conversation.inbox_for(messager).unread_by(messager).reorder(nil).distinct.count }
+          # count that's seconds stale self-heals on the next event. The
+          # SAME count the page renders (`chats_unread_badge`), so what the
+          # inbox scope hides never lights the badge.
+          locals: { count: messager.unread_chats_count }
         )
       end
 

data/lib/chats/inbox.rb

@@ -115,15 +115,12 @@ module Chats
       Chats.config.inbox_limit
     end
 
-    # Memoized so `config.inbox_scope` is consulted ONCE per inbox for the
-    # row query, however many legs it is split into (the stack aggregates
-    # apply it separately, to their own relation).
+    # The viewer's own inbox relation (`Messager#chats`: `inbox_for` with
+    # `config.inbox_scope` applied, and whatever the host's model adds on
+    # top), memoized so it is built ONCE per inbox however many legs the
+    # row query is split into (the stack aggregates build their own).
     def base_relation
-      @base_relation ||= begin
-        relation = Chats::Conversation.inbox_for(viewer)
-                                      .includes(:last_message, :subject, participants: :messager)
-        Chats.config.inbox_scope.call(relation, viewer) || relation
-      end
+      @base_relation ||= viewer.chats.includes(:last_message, :subject, participants: :messager)
     end
 
     # The polymorphic types worth splitting out. Empty when nothing stacks
@@ -244,12 +241,11 @@ module Chats
     # aggregates — independent of how deep the stack is, and of how much of
     # it we loaded.
     def stack_totals(messager)
-      scope = Chats::Conversation.inbox_for(viewer).reorder(nil).direct.where(
+      scope = viewer.chats.reorder(nil).direct.where(
         id: Chats::Participant.select(:conversation_id).where(
           messager_type: messager.class.polymorphic_name, messager_id: messager.id
         )
       )
-      scope = Chats.config.inbox_scope.call(scope, viewer) || scope
 
       {
         open: scope.distinct.count,

data/lib/chats/models/concerns/messager.rb

@@ -176,9 +176,17 @@ module Chats
     end
 
     # The inbox: every active conversation, blocked counterparts hidden,
-    # newest activity first. A relation — chain `.limit`, `.includes`, etc.
+    # `config.inbox_scope` applied, newest activity first. A relation —
+    # chain `.limit`, `.includes`, etc.
+    #
+    # THE one definition of "what is in this messager's inbox": the inbox
+    # screen, the unread count, the live badge and a host's own queries all
+    # read it, so a conversation the scope hides is hidden everywhere. Until
+    # 0.4.1 the badge counted through the raw `inbox_for` relation and could
+    # light up for a conversation the inbox would never show.
     def chats
-      Chats::Conversation.inbox_for(self)
+      relation = Chats::Conversation.inbox_for(self)
+      Chats.config.inbox_scope.call(relation, self) || relation
     end
 
     # Number of conversations with unread messages (the WhatsApp-style nav

data/lib/chats/models/message.rb

@@ -40,6 +40,8 @@ module Chats
     ACTION_LABEL_LIMIT = 80
     ACTION_URL_LIMIT = 2048
     ACTION_URL_SCHEMES = %w[http https].freeze
+    # An authority ending in ":" with nothing after it ("https://host:/x").
+    EMPTY_PORT = %r{\A[a-z][a-z0-9+.-]*://[^/?#]*:(?:[/?#]|\z)}i
     ACTION_URL_PORTS = (1..65_535)
 
     belongs_to :conversation,
@@ -113,13 +115,15 @@ module Chats
     validate :body_or_files_required
     validate :body_must_fit_length_limit
     validate :sender_must_be_active_participant, on: :create
-    validate :sender_must_not_be_blocked, on: :create
     validate :conversation_must_not_be_locked, on: :create
     validate :author_must_be_persisted
     # Checked at the write that SETS it, not on every save: an edit must
     # never fail over an action nobody touched.
     validate :action_must_be_well_formed, if: :will_save_change_to_action?
     validate :files_must_be_allowed
+    # Last on purpose: the host's policy is asked only of a send that is
+    # otherwise valid (see the method).
+    validate :sender_must_still_be_allowed, on: :create
 
     after_create :register_on_conversation
     after_create_commit :broadcast_created
@@ -335,15 +339,37 @@ module Chats
       errors.add(:sender, :not_a_participant) unless conversation.participant?(sender)
     end
 
-    # Block enforcement at the WRITE, not just at conversation creation: a
-    # block placed mid-conversation must stop the very next send. Direct
-    # threads only — see Conversation.excluding_blocked_for for the group
-    # rationale.
-    def sender_must_not_be_blocked
-      return if system? || sender.nil? || conversation.nil? || !conversation.direct?
+    # Who may talk to whom is decided at the WRITE, not just when the
+    # conversation was opened: a block placed mid-conversation stops the very
+    # next send, and so does the host's `can_message` policy turning false —
+    # an account banned, a listing closed, a membership ended. The pair was
+    # allowed when the thread began; what matters is whether it still is.
+    # Direct threads only — see Conversation.excluding_blocked_for for the
+    # group rationale. Two errors, because they read differently to the
+    # sender: `:blocked` (either side blocked the other) and `:not_allowed`
+    # (the policy said no).
+    #
+    # Asked last, and only of a send that is otherwise valid: a stranger to
+    # the conversation, a locked thread or an empty body is refused before
+    # the host's policy runs, so the policy is never consulted about a
+    # message that could not be sent anyway (it may be expensive, and it
+    # runs on every direct send now). A policy must not raise: an
+    # exception escapes the send like any other host error.
+    #
+    # A direct thread with nobody on the other side — the counterpart's
+    # account was destroyed and its seat went with it — takes no messages:
+    # there is no one the policy could allow.
+    def sender_must_still_be_allowed
+      return if system? || sender.nil? || conversation.nil? || !conversation.direct? || errors.any?
 
       other = conversation.other_participants(sender).first&.messager
-      errors.add(:base, :blocked) if other && Chats.blocked_between?(sender, other)
+      if other.nil?
+        errors.add(:base, :not_allowed)
+      elsif Chats.blocked_between?(sender, other)
+        errors.add(:base, :blocked)
+      elsif !Chats.config.can_message.call(sender, other)
+        errors.add(:base, :not_allowed)
+      end
     end
 
     # Authorship is a signature, not a conversation seat. A host may keep
@@ -382,6 +408,9 @@ module Chats
       url = action.url
       return false if url.blank? || url.length > ACTION_URL_LIMIT
       return false if url.start_with?("//", "/\\")
+      # `https://host:` parses as the default port, so an empty port suffix
+      # would pass the range check below; a named port must have digits.
+      return false if url.match?(EMPTY_PORT)
 
       uri = URI.parse(url)
       if uri.scheme

data/lib/chats/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Chats
-  VERSION = "0.4.0"
+  VERSION = "0.4.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chats
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - rameerez