@ai-matrx/messaging 0.11.9 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog — `@ai-matrx/messaging`
 
+## 0.12.0
+
+**BREAKING — messaging reads the acting user from the session, never from you (DD-241).**
+
+`<MessagingProvider userId>` and `createMessagingRepository({ identity })` are gone. Who is
+acting is now read from the Supabase client you already pass, through its own
+`auth.getSession()` and `auth.onAuthStateChange`.
+
+### Why
+
+A user id handed across a package boundary is a COPY, and the only host that exists took its
+copy from Redux at boot. Nothing rewrites that copy when the domain-wide auth cookie rotates to
+another account, when the person signs out in another tab, or when a refresh returns a different
+subject. In `@ai-matrx/meet` the same defect made reads fail at 403 in tabs 8.8 h and 32.9 h old
+(DD-240, meet 0.6.0). Here it is worse, because in messaging the id is a **write** argument: it
+lands on the wire as `p_user1_id`, `sender_id`, `created_by`, `updated_by` and
+`.eq("user_id", …)`. A stale one does not merely get refused — where RLS lets it through it
+writes a row attributed to somebody the tab cannot prove it is.
+
+The same client that mints the JWT on every PostgREST request now answers "who is this?", so the
+id in the argument and the id in the token cannot disagree.
+
+### Consumer action
+
+1. **Delete the `userId` prop** from `<MessagingProvider>`. Pass the browser Supabase client your
+   app signs in with — that client IS the identity now. One still passed at run time (a stale
+   bundle, a JavaScript consumer) is ignored and reported through `onDiagnostic` at `error` with
+   the remedy; it is never taken and never dropped in silence.
+2. **Replace `createMessagingRepository({ client, identity: { userId, organizationId } })` with
+   `createMessagingRepository({ client, organizationId })`.** A stray `identity` is likewise
+   ignored and reported through `onDiagnostic`.
+3. **A service that took a `currentUserId` argument no longer needs one** — and should stop
+   accepting one, because an argument nobody can supply safely is a door, not a convenience.
+4. `repository.identity` is replaced by `repository.organizationId` and the awaited
+   `repository.actingUserId()`.
+
+### Behaviour
+
+- The provider is INERT until the first `getSession()` lands — nothing user-scoped is issued on
+  a guess, which is the page-load race that used to spend its first tick reading as a user the
+  tab could not prove it was.
+- An account switch under an open tab rebuilds the runtime; a sign-out makes it inert.
+- Nobody signed in is `session-unavailable` with a remedy, and it rides the existing single
+  `resolveSession` retry — a write landing between sign-in and token arrival heals instead of
+  becoming a red error.
+- A client with no `auth` at all is a named `misconfigured` failure, never a silent "nobody".
+
+### Proof
+
+`src/react/session-identity.test.tsx` (10 cases) asserts the ARGUMENT ON THE WIRE, and every case
+still passes the 0.11.x shape with a different person's id in it: against the pre-fix source all
+ten fail naming the handed-in copy; against this version all ten pass with the session's user.
+
 ## 0.11.9
 
 Automatic changed-only republish (docs/metadata drift since the last tag — see

package/README.md

@@ -145,7 +145,6 @@ export default function MessagesPage() {
   return (
     <MessagingProvider
       client={supabase}
-      userId={user.id}
       organizationId={org.id}
     >
       <MessagingInbox />
@@ -157,12 +156,20 @@ export default function MessagesPage() {
 That is realtime, presence, typing, optimistic send, the offline outbox, references, actionable
 messages, keyset pagination, and the whole polished UI. There is nothing else to wire.
 
+🚨 **You did not tell it who you are, and you cannot (0.12.0, DD-241).** The acting user is read
+from `client`'s own session — the same session that mints the JWT on every request — so pass the
+browser Supabase client your app signs in with. A user id handed across this boundary is a COPY,
+and a copy goes stale the moment the auth cookie rotates; in messaging it would land on the wire
+as `sender_id` and `created_by`, writing rows attributed to somebody the tab cannot prove it is.
+The provider is inert until the first session read lands, an account switch rebuilds it, and a
+sign-out makes it inert again. Same rule on the framework-free path:
+`createMessagingRepository({ client, organizationId })` — no `identity`.
+
 ### Adding the AI
 
 ```tsx
 <MessagingProvider
   client={supabase}
-  userId={user.id}
   organizationId={org.id}
   transport={matrxTransport}          // from @ai-matrx/agents/matrx
   agents={{
@@ -218,7 +225,7 @@ recognizable), and a second one under it makes each manager's writes look remote
 
 ```tsx
 <RealtimeProvider client={supabase} actorId={user.id}>   {/* the app's ONE mount */}
-  <MessagingProvider client={supabase} userId={user.id} organizationId={org.id}>
+  <MessagingProvider client={supabase} organizationId={org.id}>
     …
 ```
 

package/dist/index.cjs

@@ -26,6 +26,7 @@ __export(src_exports, {
   MESSAGING_SCHEMA: () => MESSAGING_SCHEMA,
   MessagingError: () => MessagingError,
   RPCS: () => RPCS,
+  SERVER_SESSION_IDENTITY: () => SERVER_SESSION_IDENTITY,
   TABLES: () => TABLES,
   asClientMessageId: () => asClientMessageId,
   asConversationId: () => asConversationId,
@@ -42,6 +43,7 @@ __export(src_exports, {
   createMessagingStore: () => createMessagingStore,
   createOutbox: () => createOutbox,
   createReadCache: () => createReadCache,
+  createSessionIdentity: () => createSessionIdentity,
   createWebOutboxStorage: () => createWebOutboxStorage,
   effectiveActorKey: () => effectiveActorKey,
   extractReferences: () => extractReferences,
@@ -1659,6 +1661,145 @@ function formatLastSeen(lastSeenMs, now = Date.now()) {
   return `Active ${(0, import_format.formatRelativeTime)(lastSeenMs, { style: "short", now })}`;
 }
 
+// src/core/session-identity.ts
+var RESOLVING = Object.freeze({
+  state: "resolving",
+  userId: null
+});
+var SERVER_SESSION_IDENTITY = RESOLVING;
+function authOf(client) {
+  const candidate = client.auth;
+  if (candidate === null || typeof candidate !== "object") return null;
+  const auth = candidate;
+  if (typeof auth.getSession !== "function") return null;
+  if (typeof auth.onAuthStateChange !== "function") return null;
+  return auth;
+}
+function userIdOf(session) {
+  const id = session?.user?.id;
+  return typeof id === "string" && id.length > 0 ? asUserId(id) : null;
+}
+var NO_AUTH_SOURCE = {
+  message: "Messaging cannot tell who is signed in: the Supabase client it was given has no auth session source.",
+  remedy: "Pass your app's browser Supabase client \u2014 the same client it signs in with \u2014 to <MessagingProvider client={...}> or createMessagingRepository({ client }). Messaging reads the acting user from that client's session; there is no prop or option for a user id, on purpose (DD-241)."
+};
+function createSessionIdentity(options) {
+  const { client, onDiagnostic } = options;
+  const listeners = /* @__PURE__ */ new Set();
+  let current = RESOLVING;
+  let disposed = false;
+  const publish = (state, userId) => {
+    if (disposed) return;
+    if (current.state === state && current.userId === userId) return;
+    current = Object.freeze({ state, userId });
+    for (const listener of [...listeners]) listener();
+  };
+  const subscribeOnly = (hasAuthSource) => ({
+    hasAuthSource,
+    snapshot: () => current,
+    subscribe: (listener) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    dispose: () => {
+      disposed = true;
+      listeners.clear();
+    }
+  });
+  const auth = authOf(client);
+  if (auth === null) {
+    onDiagnostic?.({ level: "error", ...NO_AUTH_SOURCE });
+    current = Object.freeze({ state: "resolved", userId: null });
+    return subscribeOnly(false);
+  }
+  void (async () => {
+    try {
+      const result = await auth.getSession();
+      publish("resolved", userIdOf(result?.data?.session));
+    } catch (error) {
+      onDiagnostic?.({
+        level: "warn",
+        message: `Messaging could not read the signed-in session: ${String(
+          error?.message ?? error
+        )}`,
+        remedy: "Messages stay unavailable on this device until the session can be read. Reload the page; if it persists, sign in again."
+      });
+      publish("resolved", null);
+    }
+  })();
+  const subscription = auth.onAuthStateChange((_event, session) => {
+    publish("resolved", userIdOf(session));
+  });
+  const base = subscribeOnly(true);
+  return {
+    hasAuthSource: true,
+    snapshot: base.snapshot,
+    subscribe: base.subscribe,
+    dispose: () => {
+      base.dispose();
+      try {
+        subscription.data.subscription.unsubscribe();
+      } catch {
+      }
+    }
+  };
+}
+function actingUserIdOf(identity) {
+  return new Promise((resolve, reject) => {
+    const settle = () => {
+      const snapshot = identity.snapshot();
+      if (snapshot.state !== "resolved") return false;
+      if (snapshot.userId === null) {
+        reject(identity.hasAuthSource ? noSignedInUserError() : noAuthSourceError());
+        return true;
+      }
+      resolve(snapshot.userId);
+      return true;
+    };
+    if (settle()) return;
+    const unsubscribe = identity.subscribe(() => {
+      if (settle()) unsubscribe();
+    });
+  });
+}
+function noSignedInUserError() {
+  return new MessagingError(
+    "session-unavailable",
+    "Messaging has no signed-in user: the Supabase client's session names nobody.",
+    "Sign in, then try again. Messaging takes the acting user from the session of the client it was given \u2014 never from an id handed in by the caller (DD-241), because a handed-in id goes stale the moment the auth cookie rotates and lands on the wire as sender_id and created_by."
+  );
+}
+function noAuthSourceError() {
+  return new MessagingError(
+    "misconfigured",
+    NO_AUTH_SOURCE.message,
+    NO_AUTH_SOURCE.remedy
+  );
+}
+async function readActingUserId(client) {
+  const auth = authOf(client);
+  if (auth === null) throw noAuthSourceError();
+  let session;
+  try {
+    const result = await auth.getSession();
+    session = result?.data?.session;
+  } catch (error) {
+    throw new MessagingError(
+      "session-unavailable",
+      `Messaging could not read the signed-in session: ${String(
+        error?.message ?? error
+      )}`,
+      "Reload the page and try again; if it persists, sign in again.",
+      error
+    );
+  }
+  const userId = userIdOf(session);
+  if (userId === null) throw noSignedInUserError();
+  return userId;
+}
+
 // src/core/repository.ts
 var MESSAGING_SCHEMA = "communication";
 var MESSAGING_RPC_SCHEMA = "public";
@@ -1695,8 +1836,15 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, jittered));
 }
 function createMessagingRepository(options) {
-  const { identity } = options;
-  const org = requireOrg(identity.organizationId, "createMessagingRepository");
+  const org = requireOrg(options.organizationId, "createMessagingRepository");
+  const handedIn = options.identity;
+  if (handedIn !== void 0 && handedIn !== null && handedIn.userId !== void 0) {
+    options.onDiagnostic?.(
+      "createMessagingRepository({ identity: { userId } }) is ignored: since 0.12.0 messaging reads the acting user from the session of the client it was given (DD-241). Remove the option and pass { client, organizationId } \u2014 a handed-in id goes stale the moment the auth cookie rotates, and it lands on the wire as sender_id and created_by."
+    );
+  }
+  const sessionIdentity = options.sessionIdentity;
+  const actingUserId = () => sessionIdentity !== void 0 ? actingUserIdOf(sessionIdentity) : readActingUserId(options.client);
   const userCache = createReadCache({
     ttlMs: options.userTtlMs ?? 5 * 6e4,
     ...options.now !== void 0 ? { now: options.now } : {}
@@ -1733,6 +1881,9 @@ function createMessagingRepository(options) {
       }
     }
   }
+  function actingUser(operation) {
+    return withSessionRetry(operation, () => actingUserId());
+  }
   async function rpc(fn, args, operation) {
     const { data, error } = await rpcDb().rpc(fn, args);
     if (error !== null) throw normalizeMessagingError(error, operation);
@@ -1756,17 +1907,19 @@ function createMessagingRepository(options) {
     return found;
   }
   const repository = {
-    identity,
+    organizationId: org,
+    actingUserId,
     async listConversations(args = {}) {
       const limit = args.limit ?? 30;
       const archived = args.archived ?? DEFAULT_MESSAGING_ARCHIVE_FILTER;
       const operation = "listConversations";
+      const me = await actingUser(operation);
       const rows = await withSessionRetry(
         operation,
         () => rpc(
           RPCS.conversationsWithDetails,
           {
-            p_user_id: identity.userId,
+            p_user_id: me,
             p_limit: limit + 1,
             p_before_sort_at: args.cursor?.beforeSortAt ?? null,
             p_before_conversation_id: args.cursor?.beforeConversationId ?? null,
@@ -1783,7 +1936,7 @@ function createMessagingRepository(options) {
         throw invalidResponse(operation, `${RPCS.conversationsWithDetails} did not return rows`);
       }
       const projected = (rows ?? []).map(
-        (row) => projectConversationSummary(row, identity.userId, org)
+        (row) => projectConversationSummary(row, me, org)
       );
       const hasMore = projected.length > limit;
       const items = hasMore ? projected.slice(0, limit) : projected;
@@ -1797,12 +1950,13 @@ function createMessagingRepository(options) {
     async countArchivedConversations(args = {}) {
       const limit = args.limit ?? 100;
       const operation = "countArchivedConversations";
+      const me = await actingUser(operation);
       const rows = await withSessionRetry(
         operation,
         () => rpc(
           RPCS.conversationsWithDetails,
           {
-            p_user_id: identity.userId,
+            p_user_id: me,
             p_limit: limit + 1,
             p_before_sort_at: null,
             p_before_conversation_id: null,
@@ -1819,6 +1973,7 @@ function createMessagingRepository(options) {
     },
     async getConversation(id) {
       const operation = "getConversation";
+      const me = await actingUser(operation);
       const { data, error } = await withSessionRetry(
         operation,
         async () => db().from(TABLES.conversations).select(CONVERSATION_COLUMNS).eq("id", id).single()
@@ -1839,7 +1994,7 @@ function createMessagingRepository(options) {
           participants: [],
           unread_count: 0
         },
-        identity.userId,
+        me,
         org
       );
       return summary.conversation;
@@ -1883,6 +2038,7 @@ function createMessagingRepository(options) {
     },
     async getOrCreateDirectConversation(otherUserId) {
       const operation = "getOrCreateDirectConversation";
+      const me = await actingUser(operation);
       const id = await withSessionRetry(
         operation,
         () => rpc(
@@ -1891,7 +2047,7 @@ function createMessagingRepository(options) {
             // The RPC's own guard requires an `authenticated` caller to pass
             // THEMSELVES as user1; passing them in the other slot is a denial,
             // not a preference.
-            p_user1_id: identity.userId,
+            p_user1_id: me,
             p_user2_id: otherUserId,
             p_organization_id: org
           },
@@ -1905,13 +2061,14 @@ function createMessagingRepository(options) {
     },
     async createGroupConversation({ name, memberIds }) {
       const operation = "createGroupConversation";
+      const me = await actingUser(operation);
       const { data, error } = await withSessionRetry(
         operation,
         async () => db().from(TABLES.conversations).insert({
           type: "group",
           group_name: name,
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }).select("id").single()
       );
       if (error !== null) throw normalizeMessagingError(error, operation);
@@ -1919,14 +2076,14 @@ function createMessagingRepository(options) {
       if (typeof conversationId !== "string") {
         throw invalidResponse(operation, "insert returned no conversation id");
       }
-      const members = [.../* @__PURE__ */ new Set([identity.userId, ...memberIds])];
+      const members = [.../* @__PURE__ */ new Set([me, ...memberIds])];
       const { error: memberError } = await db().from(TABLES.participants).insert(
         members.map((userId) => ({
           conversation_id: conversationId,
           user_id: userId,
-          role: userId === identity.userId ? "owner" : "member",
+          role: userId === me ? "owner" : "member",
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }))
       );
       if (memberError !== null) throw normalizeMessagingError(memberError, operation);
@@ -1934,11 +2091,12 @@ function createMessagingRepository(options) {
     },
     async insertMessage(draft, clientMessageId) {
       const operation = "insertMessage";
+      const me = await actingUser(operation);
       const { data, error } = await db().from(TABLES.messages).insert({
         conversation_id: draft.conversationId,
-        sender_id: identity.userId,
+        sender_id: me,
         organization_id: org,
-        created_by: identity.userId,
+        created_by: me,
         content: draft.content,
         message_type: draft.kind ?? "text",
         status: "sent",
@@ -1960,10 +2118,11 @@ function createMessagingRepository(options) {
     },
     async editMessage(id, content) {
       const operation = "editMessage";
+      const me = await actingUser(operation);
       const { data, error } = await db().from(TABLES.messages).update({
         content,
         edited_at: (/* @__PURE__ */ new Date()).toISOString(),
-        updated_by: identity.userId
+        updated_by: me
       }).eq("id", id).select(MESSAGE_COLUMNS).single();
       if (error !== null) throw normalizeMessagingError(error, operation);
       if (data === null) throw invalidResponse(operation, "update returned no row");
@@ -1971,47 +2130,53 @@ function createMessagingRepository(options) {
     },
     async deleteMessage(id, forEveryone) {
       const operation = "deleteMessage";
+      const me = await actingUser(operation);
       const { error } = await db().from(TABLES.messages).update({
         deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
         deleted_for_everyone: forEveryone,
-        updated_by: identity.userId
+        updated_by: me
       }).eq("id", id);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async markRead(conversationId, at) {
       const operation = "markRead";
-      const { error } = await db().from(TABLES.participants).update({ last_read_at: at ?? (/* @__PURE__ */ new Date()).toISOString(), updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", identity.userId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ last_read_at: at ?? (/* @__PURE__ */ new Date()).toISOString(), updated_by: me }).eq("conversation_id", conversationId).eq("user_id", me);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async setConversationFlags(conversationId, flags) {
       const operation = "setConversationFlags";
-      const patch = { updated_by: identity.userId };
+      const me = await actingUser(operation);
+      const patch = { updated_by: me };
       if (flags.isMuted !== void 0) patch["is_muted"] = flags.isMuted;
       if (flags.isArchived !== void 0) patch["is_archived"] = flags.isArchived;
-      const { error } = await db().from(TABLES.participants).update(patch).eq("conversation_id", conversationId).eq("user_id", identity.userId);
+      const { error } = await db().from(TABLES.participants).update(patch).eq("conversation_id", conversationId).eq("user_id", me);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async addMembers(conversationId, memberIds) {
       const operation = "addMembers";
+      const me = await actingUser(operation);
       const { error } = await db().from(TABLES.participants).insert(
         memberIds.map((userId) => ({
           conversation_id: conversationId,
           user_id: userId,
           role: "member",
           organization_id: org,
-          created_by: identity.userId
+          created_by: me
         }))
       );
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async removeMember(conversationId, memberId) {
       const operation = "removeMember";
-      const { error } = await db().from(TABLES.participants).update({ deleted_at: (/* @__PURE__ */ new Date()).toISOString(), updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", memberId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ deleted_at: (/* @__PURE__ */ new Date()).toISOString(), updated_by: me }).eq("conversation_id", conversationId).eq("user_id", memberId);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     async setMemberRole(conversationId, memberId, role) {
       const operation = "setMemberRole";
-      const { error } = await db().from(TABLES.participants).update({ role, updated_by: identity.userId }).eq("conversation_id", conversationId).eq("user_id", memberId);
+      const me = await actingUser(operation);
+      const { error } = await db().from(TABLES.participants).update({ role, updated_by: me }).eq("conversation_id", conversationId).eq("user_id", memberId);
       if (error !== null) throw normalizeMessagingError(error, operation);
     },
     getUser(userId) {