collavre 0.22.0 → 0.24.0

data/app/controllers/collavre/api/v1/mobile/base_controller.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Api
+    module V1
+      module Mobile
+        # Shared base for the voice-companion mobile API. Inherits Doorkeeper
+        # bearer auth from Api::V1::BaseController.
+        #
+        # ★ The API base controller authenticates the token but does NOT run the
+        # host app's locale around_action, so I18n would otherwise serve the
+        # process-default locale. Every persisted/spoken string here must match
+        # the speaker, so we wrap every action in I18n.with_locale (app-supplied
+        # `locale` param wins, else the user's stored locale).
+        class BaseController < Collavre::Api::V1::BaseController
+          around_action :with_request_locale
+
+          private
+
+          def with_request_locale(&block)
+            I18n.with_locale(requested_locale, &block)
+          end
+
+          def requested_locale
+            normalize_locale(params[:locale].presence || current_user&.locale)
+          end
+
+          def normalize_locale(value)
+            return I18n.default_locale if value.blank?
+
+            base = value.to_s.tr("-", "_").split("_").first.to_sym
+            I18n.available_locales.include?(base) ? base : I18n.default_locale
+          end
+
+          def summarizer
+            @summarizer ||= Collavre::Mobile::EventSummarizer.new(locale: I18n.locale)
+          end
+
+          # User-owned AI agents (Claude Channel sessions, etc.).
+          def agent_ids
+            @agent_ids ||= Collavre::User.ai_agents.where(created_by_id: current_user.id).pluck(:id)
+          end
+
+          # Undecided permission prompts the token holder is the approver for.
+          def pending_approvals
+            Collavre::Comment.where(approver_id: current_user.id, action_executed_at: nil)
+                             .where.not(action: nil)
+                             .order(:created_at)
+                             .limit(50)
+                             .select(&:claude_channel_permission?)
+          end
+
+          def reply(key)
+            I18n.t("collavre.mobile.reply.#{key}")
+          end
+
+          def label_for_topic(topic_id)
+            topic = topic_id && Collavre::Topic.find_by(id: topic_id)
+            topic&.name.presence || I18n.t("collavre.mobile.default_task_label")
+          end
+
+          # List/display title for an event: "Creative#Topic" so the app can show
+          # which thread a message belongs to (spec: 제목을 크리에이티브#토픽 형태로).
+          def title_for_topic(topic_id)
+            topic = topic_id && Collavre::Topic.find_by(id: topic_id)
+            name = topic&.name.presence || I18n.t("collavre.mobile.default_task_label")
+            creative = topic&.creative&.effective_origin || topic&.creative
+            creative&.description.present? ? "#{creative.description}##{name}" : name
+          end
+
+          def render_speak(reply_key_or_text, action: {}, speak: true, status: :ok)
+            text = reply_key_or_text.is_a?(Symbol) ? reply(reply_key_or_text) : reply_key_or_text
+            render json: { reply: text, speak: speak, action: action }, status: status
+          end
+
+          # Gate + decide + broadcast a Claude Channel permission. Routes the
+          # voice path through the same approval_status gate the web path uses
+          # (Comments::ApprovalActions). Without this the caller could decide a
+          # prompt they merely own the authoring agent for but are not the
+          # designated approver of (authorized_comment? lets agent-owned events
+          # through). Returns a symbol: :ok | :unauthorized | :already_decided.
+          def decide_permission(comment, behavior)
+            return :unauthorized unless comment.can_be_approved_by?(current_user)
+
+            comment.decide_claude_channel_permission!(behavior, by: current_user)
+            comment.broadcast_claude_channel_permission_decision(behavior)
+            :ok
+          rescue Collavre::Comment::ClaudeChannelPermission::AlreadyDecided
+            :already_decided
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/collavre/api/v1/mobile/devices_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Api
+    module V1
+      module Mobile
+        # FCM registration for the Android companion. Push is a follow-up (MVP
+        # uses foreground polling), but registering the device now keeps the
+        # token current so push can light up without a client change.
+        class DevicesController < BaseController
+          def create
+            device = Collavre::Device.find_by(fcm_token: device_params[:fcm_token]) ||
+                     current_user.devices.find_or_initialize_by(client_id: device_params[:client_id])
+
+            device.assign_attributes(device_params)
+            device.user = current_user
+            device.device_type = :android if device.device_type.blank?
+            device.save!
+            head :no_content
+          end
+
+          private
+
+          def device_params
+            params.require(:device).permit(:client_id, :device_type, :app_id, :app_version, :fcm_token)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/collavre/api/v1/mobile/voice_commands_controller.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Api
+    module V1
+      module Mobile
+        # A plain mic press (no message selected) routes here: the utterance
+        # starts a new piece of work in the user's Inbox#Main, exactly like
+        # typing in the inbox chat — dispatch then matches an agent via
+        # routing_expression. Replies to a SPECIFIC message go through
+        # agent_events#respond instead (they carry the target event id).
+        class VoiceCommandsController < BaseController
+          def create
+            text = params[:text].to_s.strip
+            return render_speak(:empty_response, action: { type: "noop" }) if text.blank?
+
+            inbox = Collavre::Creative.inbox_for(current_user)
+            comment = inbox.comments.create!(content: text, user: current_user)
+            render_speak(:sent, action: { type: "message_sent", comment_id: comment.id })
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/collavre/attachments_controller.rb

@@ -64,9 +64,19 @@ module Collavre
       signed_id = blob.signed_id
       pattern = "%#{ActiveRecord::Base.sanitize_sql_like(signed_id)}%"
 
-      Creative.where("description LIKE ?", pattern).any? do |creative|
-        creative.has_permission?(Current.user, :write)
-      end
+      creatives = Creative.where("description LIKE ?", pattern).includes(:origin)
+      return false if creatives.empty?
+
+      # Permission is evaluated on the origin for linked creatives. Resolve every
+      # referencing creative to its permission base, then delegate the write-rank
+      # deny-invariant to the canonical PermissionFilter (owner wins; a
+      # user-specific entry — including an explicit no_access deny — takes
+      # precedence over the public share). readable_ids batch-loads the cache
+      # entries once, preserving the prior N+1 avoidance.
+      bases = creatives.map { |c| c.origin_id.nil? ? c : c.origin }.compact.uniq
+      Collavre::Creatives::PermissionFilter.new(user: Current.user)
+        .readable_ids(bases.map(&:id), min_permission: :write)
+        .any?
     end
   end
 end

data/app/controllers/collavre/concerns/slide_viewable.rb

@@ -134,45 +134,21 @@ module Collavre
         result
       end
 
-      # Mirrors the access check in Creative#children_with_permission, but
-      # operates on a pre-fetched set of candidate children so the work
-      # collapses to a fixed number of queries instead of one per parent.
+      # Mirrors the access check in Creative#children_with_permission via the
+      # single PermissionFilter read path: the deny-invariant (owner wins, user
+      # entry incl. no_access beats public) is served by #readable_ids, and the
+      # "a user always sees their own children" listing policy is preserved as an
+      # explicit union — identical to children_with_permission's shape, including
+      # the owned-shell-with-unreadable-origin case readable_ids gates out.
       def accessible_child_ids(candidate_ids, candidate_children, user)
         return Set.new if candidate_ids.empty?
 
-        min_rank = CreativeShare.permissions["read"]
-        accessible = Set.new
+        filter = Collavre::Creatives::PermissionFilter.new(user: user)
+        accessible = filter.readable_ids(candidate_ids, min_permission: :read).to_set
 
         if user
-          user_entries = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: user.id)
-            .pluck(:creative_id, :permission)
-
-          user_has_entry = Set.new
-          user_entries.each do |cid, perm|
-            user_has_entry << cid
-            perm_rank = CreativeSharesCache.permissions[perm]
-            if perm_rank && perm_rank >= min_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-              accessible << cid
-            end
-          end
-
-          public_accessible = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-          accessible.merge(public_accessible.reject { |cid| user_has_entry.include?(cid) })
-
           owned_ids = candidate_children.select { |c| c.user_id == user.id }.map(&:id)
           accessible.merge(owned_ids)
-        else
-          public_accessible = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-          accessible.merge(public_accessible)
         end
 
         accessible

data/app/controllers/collavre/creatives_controller.rb

@@ -6,8 +6,15 @@ module Collavre
     include Collavre::Concerns::Shareable
     include Collavre::CreativePermissionGuard
 
-    # TODO: for not for security reasons for this Collavre app, we don't expose to public, later it should be controlled by roles for each Creatives
-    # Removed unauthenticated access to index and show actions
+    # Authorization for these read actions is not open-to-public: each action
+    # enforces per-Creative read access via has_permission?(Current.user, :read)
+    # (index/children go through Creatives::IndexQuery, which permission-filters;
+    # show/slide_view/export_markdown check has_permission? directly). Anonymous
+    # requests only ever see Creatives whose share grants public read. Requiring
+    # a login for all reads is gated by SystemSetting.creatives_login_required?
+    # via enforce_creatives_login_policy below. A broader per-Creative role model
+    # (beyond the read/feedback/write/admin share levels) is a product decision
+    # tracked separately and intentionally deferred.
     allow_unauthenticated_access only: %i[ index children export_markdown show slide_view ]
     before_action :enforce_creatives_login_policy, only: %i[ index children export_markdown show slide_view ]
     before_action :set_creative, only: %i[ show edit update destroy parent_suggestions slide_view request_permission unconvert contexts update_contexts update_metadata archive unarchive trigger_action ]
@@ -39,7 +46,7 @@ module Collavre
           else
             {}
           end
-          index_result = ::Creatives::IndexQuery.new(user: Current.user, params: params.to_unsafe_h).call
+          index_result = ::Creatives::IndexQuery.new(user: Current.user, params: index_query_params).call
           @creatives = index_result.creatives || []
           @parent_creative = index_result.parent_creative
           @shared_creative = index_result.shared_creative
@@ -67,7 +74,9 @@ module Collavre
               allowed_creative_ids: @allowed_creative_ids,
               progress_map: @progress_map
             )
-            render json: { creatives: @creatives_tree_json }
+            payload = { creatives: @creatives_tree_json }
+            payload[:pagination] = index_result.pagination if index_result.pagination
+            render json: payload
           end
         end
       end
@@ -155,6 +164,10 @@ module Collavre
             render json: {
               id: @creative.id,
               description: @creative.effective_description,
+              # Embedded variant for read-only display (e.g. slide view): turns
+              # bare YouTube links into preview iframes. `description` stays the
+              # raw editable form the inline editor round-trips.
+              description_embedded_html: view_context.embed_youtube_iframe(@creative.effective_description),
               description_raw_html: @creative.description,
               origin_id: @creative.origin_id,
               parent_id: @creative.parent_id,
@@ -165,6 +178,7 @@ module Collavre
               has_children: children_count > 0,
               data: sanitized_data,
               content_type: effective.data&.dig("content_type"),
+              markdown_editor: effective.data&.dig("editor"),
               markdown_source: can_edit ? effective.data&.dig("markdown_source") : nil,
               trigger_loop: trigger_loop_data,
               is_trigger_task: parent_trigger_enabled,
@@ -210,6 +224,7 @@ module Collavre
         render json: {
           id: @creative.id,
           content_type: @creative.data&.dig("content_type"),
+          markdown_editor: @creative.data&.dig("editor"),
           markdown_source: @creative.data&.dig("markdown_source")
         }
       else
@@ -281,7 +296,8 @@ module Collavre
               progress: base.progress,
               progress_html: view_context.render_creative_progress(base),
               has_children: base.children.exists?,
-              content_type: base.data&.dig("content_type")
+              content_type: base.data&.dig("content_type"),
+              markdown_editor: base.data&.dig("editor")
             }
             # Expose the post-rewrite markdown source so the client can sync its
             # textarea after the server replaces inline data: URIs with blob paths.
@@ -394,9 +410,11 @@ module Collavre
         return
       end
       # Reserved markdown fields are not editable via metadata; preserve current values so a stale
-      # YAML payload from the metadata popup can't overwrite a concurrent markdown edit.
+      # YAML payload from the metadata popup (or an API client that omits them) can't overwrite a
+      # concurrent markdown edit. "editor" must be reserved too: dropping it would erase the "rich"
+      # authoring flag and make a Lexical-authored creative reopen in the advanced textarea.
       current_data = creative.data || {}
-      %w[markdown_source content_type].each do |key|
+      Collavre::Creative.reserved_metadata_keys.each do |key|
         if current_data.key?(key)
           new_data[key] = current_data[key]
         else
@@ -543,7 +561,20 @@ module Collavre
       end
 
       def creative_params
-        params.require(:creative).permit(:description, :progress, :parent_id, :sequence, :origin_id, :markdown_source, :content_type_input)
+        params.require(:creative).permit(:description, :progress, :parent_id, :sequence, :origin_id, :markdown_source, :content_type_input, :markdown_editor)
+      end
+
+      # Whitelist of query parameters consumed by Creatives::IndexQuery and its
+      # FilterPipeline. Passing an explicitly permitted hash (rather than
+      # params.to_unsafe_h) keeps arbitrary client-supplied keys out of the
+      # query layer while preserving every filter the index endpoint supports.
+      def index_query_params
+        params.permit(
+          :id, :simple, :search, :search_mode, :comment, :has_comments,
+          :min_progress, :max_progress, :due_before, :due_after, :has_due_date,
+          :assignee_id, :unassigned, :show_archived, :page, :per_page,
+          tags: []
+        ).to_h
       end
 
       def any_filter_active?
@@ -561,102 +592,15 @@ module Collavre
           params[:show_archived].present?
       end
 
+      # Thin delegator to Creatives::CreativeTreeSerializer. Kept as a controller
+      # method (rather than inlining the service call at the index call site) so
+      # the picker test that drives serialization via controller.send(:serialize_creatives, ...)
+      # keeps exercising the same seam.
       def serialize_creatives(collection)
-        if params[:simple].present?
-          # Preload origins so effective_origin (used per linked-shell row in both
-          # children_presence_set and the origin_id mapping below) resolves from
-          # memory instead of firing a query per shell. Only browse can hold shells;
-          # search is scoped to origin_id: nil, so this is a no-op there.
-          ActiveRecord::Associations::Preloader.new(records: collection.to_a, associations: :origin).call
-          children_ids = children_presence_set(collection)
-          searching = params[:search].present?
-          breadcrumbs = searching ? ::Creatives::BreadcrumbResolver.new(collection.map(&:id), user: Current.user, include_archived: params[:show_archived].present?).call : {}
-          # For hits routed through a linked shell, the path to expand in the
-          # user's own tree (local folders -> shell) so a breadcrumb jump can
-          # reach a shell nested under a collapsed folder.
-          reveal_paths = searching ? ::Creatives::RevealPathResolver.new(collection.map(&:id), user: Current.user, include_archived: params[:show_archived].present?).call : {}
-          collection.map do |c|
-            item = {
-              id: c.id,
-              description: c.effective_description(nil, false),
-              progress: c.progress,
-              has_children: children_ids.include?(c.id)
-            }
-            reveal = reveal_paths[c.id]
-            path = breadcrumbs[c.id]
-            if path.present?
-              item[:path] = mask_unreachable_crumbs(path, reveal)
-            end
-            item[:reveal_path] = reveal if reveal.present?
-            # For linked shells, expose the effective origin id so the picker can
-            # map a search breadcrumb (origin ids) back to the rendered shell node.
-            item[:origin_id] = c.effective_origin.id if c.origin_id
-            item
-          end
-        else
-          collection.map { |c| { id: c.id, description: c.effective_description, progress: c.progress } }
-        end
-      end
-
-      # A breadcrumb jump expands the tree from a rendered root (or, for a shared
-      # subtree, a linked shell) down to the clicked crumb. If an ancestor above a
-      # crumb is itself unrenderable (unreadable, or archived while archived rows
-      # aren't shown) and no linked shell re-roots the path at/below it, the
-      # descendant can't be expanded either — so mask it too. BreadcrumbResolver
-      # masks the unrenderable ancestor itself; this masks everything downstream of
-      # it on the plain origin chain, matching exactly what the tree can render.
-      #
-      # `reveal` is RevealPathResolver's per-origin map: a crumb whose origin id is
-      # a key re-roots navigation through its own shell (the client anchors at the
-      # nearest reveal entry at/above the clicked crumb), so it clears the block for
-      # itself and its descendants regardless of an archived/unreadable origin
-      # above it.
-      def mask_unreachable_crumbs(path, reveal)
-        blocked = false
-        path.map do |crumb|
-          if reveal&.key?(crumb[:id])
-            blocked = false
-            crumb
-          elsif crumb[:restricted]
-            blocked = true
-            crumb
-          elsif blocked
-            crumb.merge(restricted: true, description: nil)
-          else
-            crumb
-          end
-        end
-      end
-
-      # Batched "does this node have a child the user can actually browse to?"
-      # lookup so the picker tree renders expand toggles without an N+1.
-      #
-      # Must match exactly what expanding the node shows (IndexQuery#handle_id_query
-      # -> children_with_permission, minus archived unless show_archived), or the
-      # toggle either hides a reachable subtree or opens to an empty branch (and
-      # leaks that hidden children exist). Two alignments are needed:
-      #   1. Linked shells (origin_id set) store children under the effective
-      #      origin (redirect_parent_to_origin + children->origin migration), so
-      #      resolve each row to its effective origin before the lookup.
-      #   2. Apply the same archived + read-permission filters as the browse path.
-      def children_presence_set(collection)
-        return Set.new if collection.empty?
-
-        origin_id_by_id = collection.to_h { |c| [ c.id, c.effective_origin.id ] }
-
-        candidates = Creative.where(parent_id: origin_id_by_id.values.uniq)
-        candidates = candidates.where(archived_at: nil) unless params[:show_archived]
-        child_rows = candidates.pluck(:id, :parent_id) # [child_id, origin_id]
-        return Set.new if child_rows.empty?
-
-        readable = ::Creatives::PermissionFilter
-          .new(user: Current.user).readable_ids(child_rows.map(&:first)).to_set
-        origins_with_visible_children = child_rows
-          .each_with_object(Set.new) { |(child_id, origin_id), set| set << origin_id if readable.include?(child_id) }
-
-        collection.each_with_object(Set.new) do |c, set|
-          set << c.id if origins_with_visible_children.include?(origin_id_by_id[c.id])
-        end
+        # Fully-qualified name: this newly extracted service is not registered in
+        # config/initializers/collavre_model_aliases.rb, so the top-level
+        # ::Creatives::* alias used by the older sibling services is unavailable.
+        Collavre::Creatives::CreativeTreeSerializer.new(user: Current.user, params: params).serialize(collection)
       end
 
       def reorderer

data/app/controllers/collavre/inbox_items_controller.rb

@@ -38,12 +38,18 @@ module Collavre
     end
 
     def update
-      if @inbox_item.owner == Current.user
-        @inbox_item.update(state: params[:state])
-        head :no_content
-      else
+      unless @inbox_item.owner == Current.user
         head :forbidden
+        return
       end
+
+      unless InboxItem.states.key?(params[:state].to_s)
+        head :unprocessable_entity
+        return
+      end
+
+      @inbox_item.update(state: params[:state])
+      head :no_content
     end
 
     def destroy

data/app/controllers/collavre/landing_controller.rb

@@ -2,7 +2,10 @@ module Collavre
   class LandingController < ApplicationController
     allow_unauthenticated_access
 
-    def show
-    end
+    # The demo video/poster URLs live in config/locales/landing.*.yml as full
+    # absolute URLs pointing at the hosted assets. Nothing to resolve here — the
+    # view reads them directly, so the landing page has no dependency on the
+    # Creatives model and the URLs work from any environment (preview included).
+    def show; end
   end
 end

data/app/controllers/collavre/tasks_controller.rb

@@ -14,12 +14,21 @@ module Collavre
         return head :unprocessable_entity
       end
 
-      was_delegated = task.status == "delegated"
+      # These statuses count against the topic slot (occupying_topic_slot) yet no
+      # live worker will run AiAgentJob's ensure-block drain for them:
+      #   - delegated / pending_approval already returned from the job holding the
+      #     slot (should_release = false) — awaiting an MCP reply / approval.
+      #   - pending may be a waiter that dequeue_next_for_topic promoted
+      #     queued -> pending before its job starts; once cancelled, that job
+      #     early-returns at the top of #perform and never reaches the ensure drain.
+      # So free the agent slot and drain the topic queue here — otherwise
+      # cancelling the blocker leaves agent capacity and the next waiter stuck
+      # until stuck recovery. release!/dequeue are idempotent (dequeue is bounded
+      # by topic_at_capacity?), so a racing live worker that also drains is harmless.
+      held_slot_without_worker = %w[pending delegated pending_approval].include?(task.status)
       task.update!(status: "cancelled")
 
-      # Delegated tasks have no active worker to run the ensure-block release,
-      # so free the agent slot and drain the topic queue here.
-      if was_delegated && task.agent
+      if held_slot_without_worker && task.agent
         Collavre::Orchestration::ResourceTracker.for(task.agent).release!(task.id)
         Collavre::Orchestration::AgentOrchestrator.dequeue_next_for_topic(task.topic_id, task.creative_id)
       end

data/app/controllers/collavre/topics_controller.rb

@@ -128,6 +128,7 @@ module Collavre
 
     def move
       topic = @creative.topics.find(params[:id])
+      source_creative = @creative
       target_creative = Creative.find(params[:target_creative_id]).effective_origin
 
       unless target_creative.has_permission?(Current.user, :write) || target_creative.user == Current.user
@@ -144,10 +145,21 @@ module Collavre
         topic.update!(creative: target_creative)
       end
 
+      # update_all above skips counter-cache callbacks, so recompute
+      # comments_count on both sides after re-parenting the comments.
+      Creative.reset_counters(source_creative.id, :comments)
+      Creative.reset_counters(target_creative.id, :comments)
+
       broadcast_topic_event("deleted", topic_id: topic.id)
       broadcast_topic_event("created", creative: target_creative, topic: topic.slice(:id, :name))
 
-      render json: { success: true, topic: topic.slice(:id, :name), target_creative_id: target_creative.id }
+      render json: {
+        success: true,
+        topic: topic.slice(:id, :name),
+        target_creative_id: target_creative.id,
+        target_creative_name: target_creative.creative_snippet,
+        missing_members: missing_members_for_move(source_creative, target_creative)
+      }
     end
 
     def archive
@@ -204,6 +216,47 @@ module Collavre
       @creative = Creative.find(params[:creative_id]).effective_origin
     end
 
+    # When a topic moves to a different creative, members who had access on the
+    # source creative may lose visibility on the target. Returns the human
+    # members who are effectively present on the source (owner + feedback-or-
+    # higher shares) but have no resolvable access on the target, so the client
+    # can offer to re-add them with the same permission. Only returned when the
+    # current user can actually grant shares on the target (admin/owner);
+    # otherwise the suggestion would be unusable.
+    def missing_members_for_move(source_creative, target_creative)
+      return [] unless target_creative.has_permission?(Current.user, :admin) || target_creative.user == Current.user
+
+      # Any user with a resolvable share on the target chain (including inherited
+      # shares and explicit no_access blocks) already has — or is intentionally
+      # denied — access, so they are never "missing".
+      excluded_user_ids = target_creative.all_shared_users(:no_access).map(&:user_id).compact.to_set
+      excluded_user_ids << target_creative.user_id
+      excluded_user_ids << Current.user&.id
+
+      # Candidate => grant permission. Source owner had full control, so we
+      # suggest admin; shared members keep their own (closest) permission.
+      candidates = {}
+      owner = source_creative.user
+      if owner && !owner.ai_user? && excluded_user_ids.exclude?(owner.id)
+        candidates[owner.id] = { user: owner, permission: "admin" }
+      end
+
+      source_creative.all_shared_users(:feedback).each do |share|
+        user = share.user
+        next if user.nil? || user.ai_user?
+        next if excluded_user_ids.include?(user.id)
+
+        candidates[user.id] ||= { user: user, permission: share.permission }
+      end
+
+      candidates.values.map do |candidate|
+        {
+          user: view_context.user_json(candidate[:user], email: true),
+          permission: candidate[:permission]
+        }
+      end
+    end
+
     def topic_params
       params.require(:topic).permit(:name)
     end

data/app/controllers/collavre/typo_corrections_controller.rb

@@ -0,0 +1,39 @@
+module Collavre
+  # Session-authenticated endpoint backing the inline typo-correction UI. The
+  # frontend also gates by device/location, but we re-check here (fail closed)
+  # before spending an LLM call, and echo the user's auto-apply threshold so the
+  # client never has to hardcode it.
+  class TypoCorrectionsController < ApplicationController
+    # The client debounce is only a hint — a scripted/compromised page can loop
+    # this endpoint with arbitrary text, and every accepted call spends an LLM
+    # request. Bound both the call rate and the per-call size server-side. The
+    # chat composer is short text; anything larger is not a typo-correction case.
+    MAX_TEXT_LENGTH = 4_000
+    RATE_LIMIT = 120          # requests
+    RATE_PERIOD = 1.minute    # ...per user per minute
+
+    def create
+      user = Current.user
+      device = params[:device].to_s
+      location = params[:location].presence || "chat"
+      text = params[:text].to_s
+
+      unless user.typo_correction_active_for?(device: device, location: location)
+        return render json: { edits: [], threshold: user.typo_correction_threshold }
+      end
+
+      # Oversized input: skip the LLM entirely (return no edits, not an error —
+      # this is a background affordance, not a user-facing failure).
+      if text.length > MAX_TEXT_LENGTH
+        return render json: { edits: [], threshold: user.typo_correction_threshold }
+      end
+
+      # Raises RateLimitExceeded -> 429 (DynamicRateLimiting), which the client
+      # treats as "no suggestions this round".
+      check_rate_limit!(key: "typo_correction:#{user.id}", limit: RATE_LIMIT, period: RATE_PERIOD)
+
+      edits = TypoCorrector.new.correct(text)
+      render json: { edits: edits, threshold: user.typo_correction_threshold }
+    end
+  end
+end