@ai-matrx/messaging 0.11.8 → 0.12.0

package/dist/index.js

@@ -1591,6 +1591,145 @@ function formatLastSeen(lastSeenMs, now = Date.now()) {
   return `Active ${formatRelativeTime(lastSeenMs, { style: "short", now })}`;
 }
 
+// src/core/session-identity.ts
+var RESOLVING = Object.freeze({
+  state: "resolving",
+  userId: null
+});
+var SERVER_SESSION_IDENTITY = RESOLVING;
+function authOf(client) {
+  const candidate = client.auth;
+  if (candidate === null || typeof candidate !== "object") return null;
+  const auth = candidate;
+  if (typeof auth.getSession !== "function") return null;
+  if (typeof auth.onAuthStateChange !== "function") return null;
+  return auth;
+}
+function userIdOf(session) {
+  const id = session?.user?.id;
+  return typeof id === "string" && id.length > 0 ? asUserId(id) : null;
+}
+var NO_AUTH_SOURCE = {
+  message: "Messaging cannot tell who is signed in: the Supabase client it was given has no auth session source.",
+  remedy: "Pass your app's browser Supabase client \u2014 the same client it signs in with \u2014 to <MessagingProvider client={...}> or createMessagingRepository({ client }). Messaging reads the acting user from that client's session; there is no prop or option for a user id, on purpose (DD-241)."
+};
+function createSessionIdentity(options) {
+  const { client, onDiagnostic } = options;
+  const listeners = /* @__PURE__ */ new Set();
+  let current = RESOLVING;
+  let disposed = false;
+  const publish = (state, userId) => {
+    if (disposed) return;
+    if (current.state === state && current.userId === userId) return;
+    current = Object.freeze({ state, userId });
+    for (const listener of [...listeners]) listener();
+  };
+  const subscribeOnly = (hasAuthSource) => ({
+    hasAuthSource,
+    snapshot: () => current,
+    subscribe: (listener) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    dispose: () => {
+      disposed = true;
+      listeners.clear();
+    }
+  });
+  const auth = authOf(client);
+  if (auth === null) {
+    onDiagnostic?.({ level: "error", ...NO_AUTH_SOURCE });
+    current = Object.freeze({ state: "resolved", userId: null });
+    return subscribeOnly(false);
+  }
+  void (async () => {
+    try {
+      const result = await auth.getSession();
+      publish("resolved", userIdOf(result?.data?.session));
+    } catch (error) {
+      onDiagnostic?.({
+        level: "warn",
+        message: `Messaging could not read the signed-in session: ${String(
+          error?.message ?? error
+        )}`,
+        remedy: "Messages stay unavailable on this device until the session can be read. Reload the page; if it persists, sign in again."
+      });
+      publish("resolved", null);
+    }
+  })();
+  const subscription = auth.onAuthStateChange((_event, session) => {
+    publish("resolved", userIdOf(session));
+  });
+  const base = subscribeOnly(true);
+  return {
+    hasAuthSource: true,
+    snapshot: base.snapshot,
+    subscribe: base.subscribe,
+    dispose: () => {
+      base.dispose();
+      try {
+        subscription.data.subscription.unsubscribe();
+      } catch {
+      }
+    }
+  };
+}
+function actingUserIdOf(identity) {
+  return new Promise((resolve, reject) => {
+    const settle = () => {
+      const snapshot = identity.snapshot();
+      if (snapshot.state !== "resolved") return false;
+      if (snapshot.userId === null) {
+        reject(identity.hasAuthSource ? noSignedInUserError() : noAuthSourceError());
+        return true;
+      }
+      resolve(snapshot.userId);
+      return true;
+    };
+    if (settle()) return;
+    const unsubscribe = identity.subscribe(() => {
+      if (settle()) unsubscribe();
+    });
+  });
+}
+function noSignedInUserError() {
+  return new MessagingError(
+    "session-unavailable",
+    "Messaging has no signed-in user: the Supabase client's session names nobody.",
+    "Sign in, then try again. Messaging takes the acting user from the session of the client it was given \u2014 never from an id handed in by the caller (DD-241), because a handed-in id goes stale the moment the auth cookie rotates and lands on the wire as sender_id and created_by."
+  );
+}
+function noAuthSourceError() {
+  return new MessagingError(
+    "misconfigured",
+    NO_AUTH_SOURCE.message,
+    NO_AUTH_SOURCE.remedy
+  );
+}
+async function readActingUserId(client) {
+  const auth = authOf(client);
+  if (auth === null) throw noAuthSourceError();
+  let session;
+  try {
+    const result = await auth.getSession();
+    session = result?.data?.session;
+  } catch (error) {
+    throw new MessagingError(
+      "session-unavailable",
+      `Messaging could not read the signed-in session: ${String(
+        error?.message ?? error
+      )}`,
+      "Reload the page and try again; if it persists, sign in again.",
+      error
+    );
+  }
+  const userId = userIdOf(session);
+  if (userId === null) throw noSignedInUserError();
+  return userId;
+}
+
 // src/core/repository.ts
 var MESSAGING_SCHEMA = "communication";
 var MESSAGING_RPC_SCHEMA = "public";
@@ -1627,8 +1766,15 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, jittered));
 }
 function createMessagingRepository(options) {
-  const { identity } = options;
-  const org = requireOrg(identity.organizationId, "createMessagingRepository");
+  const org = requireOrg(options.organizationId, "createMessagingRepository");
+  const handedIn = options.identity;
+  if (handedIn !== void 0 && handedIn !== null && handedIn.userId !== void 0) {
+    options.onDiagnostic?.(
+      "createMessagingRepository({ identity: { userId } }) is ignored: since 0.12.0 messaging reads the acting user from the session of the client it was given (DD-241). Remove the option and pass { client, organizationId } \u2014 a handed-in id goes stale the moment the auth cookie rotates, and it lands on the wire as sender_id and created_by."
+    );
+  }
+  const sessionIdentity = options.sessionIdentity;
+  const actingUserId = () => sessionIdentity !== void 0 ? actingUserIdOf(sessionIdentity) : readActingUserId(options.client);
   const userCache = createReadCache({
     ttlMs: options.userTtlMs ?? 5 * 6e4,
     ...options.now !== void 0 ? { now: options.now } : {}
@@ -1665,6 +1811,9 @@ function createMessagingRepository(options) {
       }
     }
   }
+  function actingUser(operation) {
+    return withSessionRetry(operation, () => actingUserId());
+  }
   async function rpc(fn, args, operation) {
     const { data, error } = await rpcDb().rpc(fn, args);
     if (error !== null) throw normalizeMessagingError(error, operation);
@@ -1688,17 +1837,19 @@ function createMessagingRepository(options) {
     return found;
   }
   const repository = {
-    identity,
+    organizationId: org,
+    actingUserId,
     async listConversations(args = {}) {
       const limit = args.limit ?? 30;
       const archived = args.archived ?? DEFAULT_MESSAGING_ARCHIVE_FILTER;
       const operation = "listConversations";
+      const me = await actingUser(operation);
       const rows = await withSessionRetry(
         operation,
         () => rpc(
           RPCS.conversationsWithDetails,
           {
-            p_user_id: identity.userId,
+            p_user_id: me,
             p_limit: limit + 1,
             p_before_sort_at: args.cursor?.beforeSortAt ?? null,
             p_before_conversation_id: args.cursor?.beforeConversationId ?? null,
@@ -1715,7 +1866,7 @@ function createMessagingRepository(options) {
         throw invalidResponse(operation, `${RPCS.conversationsWithDetails} did not return rows`);
       }
       const projected = (rows ?? []).map(
-        (row) => projectConversationSummary(row, identity.userId, org)
+        (row) => projectConversationSummary(row, me, org)
       );
       const hasMore = projected.length > limit;
       const items = hasMore ? projected.slice(0, limit) : projected;
@@ -1729,12 +1880,13 @@ function createMessagingRepository(options) {
     async countArchivedConversations(args = {}) {
       const limit = args.limit ?? 100;
       const operation = "countArchivedConversations";
+      const me = await actingUser(operation);
       const rows = await withSessionRetry(
         operation,
         () => rpc(
           RPCS.conversationsWithDetails,
           {
-            p_user_id: identity.userId,
+            p_user_id: me,
             p_limit: limit + 1,
             p_before_sort_at: null,
             p_before_conversation_id: null,
@@ -1751,6 +1903,7 @@ function createMessagingRepository(options) {
     },
     async getConversation(id) {
       const operation = "getConversation";
+      const me = await actingUser(operation);
       const { data, error } = await withSessionRetry(
         operation,
         async () => db().from(TABLES.conversations).select(CONVERSATION_COLUMNS).eq("id", id).single()
@@ -1771,7 +1924,7 @@ function createMessagingRepository(options) {
           participants: [],
           unread_count: 0
         },
-        identity.userId,
+        me,
         org
       );
       return summary.conversation;
@@ -1815,6 +1968,7 @@ function createMessagingRepository(options) {
     },
     async getOrCreateDirectConversation(otherUserId) {
       const operation = "getOrCreateDirectConversation";
+      const me = await actingUser(operation);
       const id = await withSessionRetry(
         operation,
         () => rpc(
@@ -1823,7 +1977,7 @@ function createMessagingRepository(options) {
             // The RPC's own guard requires an `authenticated` caller to pass
             // THEMSELVES as user1; passing them in the other slot is a denial,
             // not a preference.
-            p_user1_id: identity.userId,
+            p_user1_id: me,
             p_user2_id: otherUserId,
             p_organization_id: org
           },
@@ -1837,13 +1991,14 @@ function createMessagingRepository(options) {
     },
     async createGroupConversation({ name, memberIds }) {
       const operation = "createGroupConversation";
+      const me = await actingUser(operation);
       const { data, error } = await withSessionRetry(
         operation,
         async () => db().from(TABLES.conversations).insert({
           type: "group",
           group_name: name,
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }).select("id").single()
       );
       if (error !== null) throw normalizeMessagingError(error, operation);
@@ -1851,14 +2006,14 @@ function createMessagingRepository(options) {
       if (typeof conversationId !== "string") {
         throw invalidResponse(operation, "insert returned no conversation id");
       }
-      const members = [.../* @__PURE__ */ new Set([identity.userId, ...memberIds])];
+      const members = [.../* @__PURE__ */ new Set([me, ...memberIds])];
       const { error: memberError } = await db().from(TABLES.participants).insert(
         members.map((userId) => ({
           conversation_id: conversationId,
           user_id: userId,
-          role: userId === identity.userId ? "owner" : "member",
+          role: userId === me ? "owner" : "member",
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }))
       );
       if (memberError !== null) throw normalizeMessagingError(memberError, operation);
@@ -1866,11 +2021,12 @@ function createMessagingRepository(options) {
     },
     async insertMessage(draft, clientMessageId) {
       const operation = "insertMessage";
+      const me = await actingUser(operation);
       const { data, error } = await db().from(TABLES.messages).insert({
         conversation_id: draft.conversationId,
-        sender_id: identity.userId,
+        sender_id: me,
         organization_id: org,
-        created_by: identity.userId,
+        created_by: me,
         content: draft.content,
         message_type: draft.kind ?? "text",
         status: "sent",
@@ -1892,10 +2048,11 @@ function createMessagingRepository(options) {
     },
     async editMessage(id, content) {
       const operation = "editMessage";
+      const me = await actingUser(operation);
       const { data, error } = await db().from(TABLES.messages).update({
         content,
         edited_at: (/* @__PURE__ */ new Date()).toISOString(),
-        updated_by: identity.userId
+        updated_by: me
       }).eq("id", id).select(MESSAGE_COLUMNS).single();
       if (error !== null) throw normalizeMessagingError(error, operation);
       if (data === null) throw invalidResponse(operation, "update returned no row");
@@ -1903,47 +2060,53 @@ function createMessagingRepository(options) {
     },
     async deleteMessage(id, forEveryone) {
       const operation = "deleteMessage";
+      const me = await actingUser(operation);
       const { error } = await db().from(TABLES.messages).update({
         deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
         deleted_for_everyone: forEveryone,
-        updated_by: identity.userId
+        updated_by: me
       }).eq("id", id);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async markRead(conversationId, at) {
       const operation = "markRead";
-      const { error } = await db().from(TABLES.participants).update({ last_read_at: at ?? (/* @__PURE__ */ new Date()).toISOString(), updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", identity.userId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ last_read_at: at ?? (/* @__PURE__ */ new Date()).toISOString(), updated_by: me }).eq("conversation_id", conversationId).eq("user_id", me);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async setConversationFlags(conversationId, flags) {
       const operation = "setConversationFlags";
-      const patch = { updated_by: identity.userId };
+      const me = await actingUser(operation);
+      const patch = { updated_by: me };
       if (flags.isMuted !== void 0) patch["is_muted"] = flags.isMuted;
       if (flags.isArchived !== void 0) patch["is_archived"] = flags.isArchived;
-      const { error } = await db().from(TABLES.participants).update(patch).eq("conversation_id", conversationId).eq("user_id", identity.userId);
+      const { error } = await db().from(TABLES.participants).update(patch).eq("conversation_id", conversationId).eq("user_id", me);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async addMembers(conversationId, memberIds) {
       const operation = "addMembers";
+      const me = await actingUser(operation);
       const { error } = await db().from(TABLES.participants).insert(
         memberIds.map((userId) => ({
           conversation_id: conversationId,
           user_id: userId,
           role: "member",
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }))
       );
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async removeMember(conversationId, memberId) {
       const operation = "removeMember";
-      const { error } = await db().from(TABLES.participants).update({ deleted_at: (/* @__PURE__ */ new Date()).toISOString(), updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", memberId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ deleted_at: (/* @__PURE__ */ new Date()).toISOString(), updated_by: me }).eq("conversation_id", conversationId).eq("user_id", memberId);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async setMemberRole(conversationId, memberId, role) {
       const operation = "setMemberRole";
-      const { error } = await db().from(TABLES.participants).update({ role, updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", memberId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ role, updated_by: me }).eq("conversation_id", conversationId).eq("user_id", memberId);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     getUser(userId) {
@@ -1989,6 +2152,7 @@ export {
   MESSAGING_SCHEMA,
   MessagingError,
   RPCS,
+  SERVER_SESSION_IDENTITY,
   TABLES,
   asClientMessageId,
   asConversationId,
@@ -2005,6 +2169,7 @@ export {
   createMessagingStore,
   createOutbox,
   createReadCache,
+  createSessionIdentity,
   createWebOutboxStorage,
   effectiveActorKey,
   extractReferences,