@antzsoft/chat-core 1.1.0 → 1.1.2

package/README.md

@@ -320,10 +320,14 @@ interface AntzChatConfig {
   tenantId?: string;
 
   /**
-   * Encryption mode. Must match the server's ENCRYPTION_MODE env var.
-   * Default: 'none'.
+   * Enable payload-level transit encryption for all HTTP and socket traffic.
+   * Uses ECDH key exchange (X25519/P-256) + AES-256-GCM to encrypt every
+   * request, response, and socket event on the wire — independent of TLS.
+   * Server must have TRANSIT_ENCRYPTION_ENABLED=true (default).
+   * Default: true. Set false only for local development or debugging.
+   * Safe to toggle anytime — no data migration needed (wire-only, never stored).
    */
-  encryptionMode?: 'none' | 'server';
+  transitEncryption?: boolean;
 
   /**
    * The user's ID in the external auth system.
@@ -747,7 +751,6 @@ interface SendData {
   attachments?: SendMessageAttachment[];
   replyTo?: string;      // messageId of the message being replied to
   tempId?: string;       // Client-generated ID for optimistic UI
-  isEncrypted?: boolean;
 }
 
 interface SearchParams {
@@ -847,7 +850,7 @@ import { conversationsApi } from '@antzsoft/chat-core';
 | `update` | `(conversationId: string, data: UpdateConversationData) => Promise<Conversation>` | Update group name or description. |
 | `uploadIcon` | `(conversationId: string, fileId: string) => Promise<Conversation>` | Set the group icon from an already-uploaded file (admin only). Call `client.uploadFiles()` first to get the `fileId`, then pass it here. Server copies `storageKey` into `conversation.iconMeta`, deletes the `chat_files` record, and returns the conversation with a fresh `iconUrl`. |
 | `delete` | `(conversationId: string) => Promise<void>` | Delete a conversation (admin only). |
-| `addParticipants` | `(conversationId: string, userIds: string[]) => Promise<Conversation>` | Add one or more participants. |
+| `addParticipants` | `(conversationId: string, userIds: string[], role?: 'admin' \| 'member') => Promise<Conversation>` | Add one or more participants. `role` defaults to `'member'`. Previously removed members who are re-added always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. |
 | `removeParticipant` | `(conversationId: string, userId: string) => Promise<Conversation>` | Remove a participant. |
 | `updateParticipantRole` | `(conversationId: string, userId: string, role: 'admin' \| 'member') => Promise<Conversation>` | Promote or demote a participant. |
 | `mute` | `(conversationId: string, mutedUntil?: string) => Promise<void>` | Mute notifications. Pass an ISO date string to mute until a specific time. |
@@ -971,9 +974,12 @@ console.log(updated.iconUrl); // fresh signed URL, regenerated on every response
 // - Previous icon deleted from storage automatically on replace
 // - Non-admins get 403 Forbidden
 
-// Add members
+// Add members (default role: member)
 await conversationsApi.addParticipants(group.id, ['user-d', 'user-e']);
 
+// Add members as admins
+await conversationsApi.addParticipants(group.id, ['user-f'], 'admin');
+
 // Mute for 8 hours
 const mutedUntil = new Date(Date.now() + 8 * 60 * 60 * 1000).toISOString();
 await conversationsApi.mute(group.id, mutedUntil);
@@ -1105,6 +1111,8 @@ const presigned = await storageApi.requestPresignedUrl({
   mimeType: 'application/pdf',
   size: 512000,
   conversationId: 'conv-abc',
+  // optional — stored on the server file record
+  metadata: { compressed: true, originalSize: 900000, compressionAlgorithm: 'gzip' },
 });
 await platformUploadFn(presigned, file, (pct) => console.log(`${pct * 100}%`));
 const fileRecord = await storageApi.confirmUpload(presigned.fileId);
@@ -1133,9 +1141,9 @@ When `platformCompressFn` is provided and `compression.enabled` is `true` (the d
 1. Determine strategy per file (`image` → WebP/JPEG resize+encode, `gzip` → text/doc compression, `skip` → no-op)
 2. Run `platformCompressFn(file, compressionConfig)` — returns a `CompressedFile`
 3. If compressed result is **larger** than the original, the original is used instead (automatic fallback)
-4. Request presigned URL with the compressed size and MIME type
+4. Request presigned URL with the compressed size, MIME type, and compression metadata (`compressed`, `originalSize`, `compressionAlgorithm`)
 5. Upload the compressed bytes
-6. Store `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record
+6. Server persists `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record alongside system fields (`userId`, `tenantId`)
 
 ### Strategy by file type
 
@@ -1633,12 +1641,14 @@ This means:
 
 **When to call `joinRoom`:**
 
-There is only one real use case — when the **user is added to a conversation while their socket is already connected** (either someone created a new group and added them, or they were added to an existing group). The server does not auto-join the user's socket to the new room — it only emits `conversation_created` to the user's personal room. The client must call `joinRoom` in response, otherwise the socket will not receive any `new_message`, `typing_indicator`, or other room events for that conversation.
+When the **user is added to a conversation while their socket is already connected**, the server now automatically joins their active sockets into the new room and emits `conversation_created` to their personal room. No `joinRoom` call is required — the user will receive `new_message`, `typing_indicator`, and all other room events immediately.
+
+Calling `joinRoom` on `conversation_created` is still safe (idempotent) and can be kept for defensive compatibility, but it is no longer necessary:
 
 ```typescript
+// Optional — server already handles this automatically
 client.socket.on('conversation_created', (conv) => {
-  // Fires when you're added to a new or existing conversation at runtime
-  client.socket.emit.joinRoom(conv.id);
+  client.socket.emit.joinRoom(conv.id); // safe no-op if already in room
 });
 ```
 
@@ -2043,9 +2053,6 @@ interface Message {
   sender?: User;
   readBy?: Array<{ userId: string; readAt: string }>;
   deliveredTo?: Array<{ userId: string; deliveredAt: string }>;
-  isEncrypted?: boolean;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  encryptedContent?: EncryptedContent;
 }
 ```
 
@@ -2072,10 +2079,21 @@ interface MessageReaction {
 ### `MessageReplyReference`
 
 ```typescript
+interface ReplyAttachmentSnapshot {
+  type: FileType;           // 'image' | 'video' | 'document' | 'audio'
+  filename: string;
+  mimeType: string;
+  size: number;
+  duration?: number;        // seconds — audio/video only
+  dimensions?: { width: number; height: number };
+  url: string;              // signed URL for the first attachment of the quoted message
+}
+
 interface MessageReplyReference {
   messageId?: string;
-  contentPreview?: string;
+  contentPreview?: string;  // text snippet, filename, or "3 Photos" / "3 Attachments" etc.
   senderName?: string;
+  attachmentSnapshot?: ReplyAttachmentSnapshot; // present only when quoted message had attachments
   // Present on optimistic messages before server confirmation
   id?: string;
   content?: MessageContent;
@@ -2083,6 +2101,8 @@ interface MessageReplyReference {
 }
 ```
 
+`attachmentSnapshot` is a denormalized copy of the first attachment from the quoted message, stored at write time. This means the reply bubble can render an attachment preview (thumbnail, filename, type icon) without fetching the original message — even if it has scrolled far out of the paginated window. The `url` is a signed URL regenerated on every response, identical to how `content.attachments[].url` works.
+
 ### `Conversation`
 
 ```typescript
@@ -2105,9 +2125,6 @@ interface Conversation {
   isPinned?: boolean;
   isMuted?: boolean;
   mutedUntil?: string;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  isEncryptionEnabled?: boolean;
-  encryptionKey?: string;
 }
 
 interface ConversationSettings {
@@ -2174,8 +2191,6 @@ interface SendMessagePayload {
   attachments?: SendMessageAttachment[];
   replyTo?: string;           // messageId
   tempId: string;             // client-generated; echoed back in message_ack
-  encryptedContent?: EncryptedContent;
-  isEncrypted?: boolean;
 }
 
 interface SendMessageAttachment {
@@ -2383,6 +2398,22 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.1.2
+- **New: Participants stored in a dedicated collection** — Participants are no longer embedded inside conversation documents. Each participant is now its own document in a separate collection, removing the MongoDB 16 MB document size ceiling for large groups and eliminating write contention on high-membership conversations. No client API changes.
+- **New: Transit encryption** — All socket payloads are now encrypted end-to-end using a per-session symmetric key negotiated on connect. Transparent to callers — no SDK API changes required.
+- **Fix: Disbanded groups now visible in read-only mode for removed members** — Previously removed members' views of disbanded groups were inconsistent. Removed participants now always see the conversation in read-only mode until they explicitly call `leave()`.
+- **Fix: Removed participant access hardened** — Removed users can no longer view messages sent after their removal via the REST API. Message history is now capped at the exact moment of removal. Removed users were also incorrectly able to search messages, view starred messages, and fetch unread counts from conversations they were removed from — all three are now blocked.
+- **Fix: Unread badge drops to zero immediately on removal** — When an admin removes a user from a group, all unread messages in that conversation are automatically marked as read for the removed user at the moment of removal. Previously the badge stayed non-zero until the user manually opened the conversation.
+- **Fix: Compression metadata now stored on the server** — When a compressed image is uploaded, the file record now correctly saves `compressed`, `originalSize`, and `compressionAlgorithm`. Previously this metadata was silently dropped by DTO validation. No changes needed on the client — handled automatically by `uploadBatch`.
+- **Fix: Delete for me also removes the message from your starred list** — Calling `deleteForMe` on a starred message now removes the star. Previously the message remained in the starred list even after being hidden.
+
+### v1.1.1
+- **New: `attachmentSnapshot` on reply messages** — `replyTo` now includes a snapshot of the first attachment from the quoted message (`type`, `filename`, `mimeType`, `size`, `duration`, `dimensions`, signed `url`). Stored at write time so reply bubbles render without fetching the original message.
+- **Fix: `contentPreview` for multi-attachment replies** — Now reflects attachment count: `"photo.jpg +2 more"`, `"3 Photos"`, `"3 Attachments"` (mixed types). Previously always showed only the first filename.
+- **New: exported `ReplyAttachmentSnapshot` type.**
+- **Fix: Pin, unpin, and unmute operations** — Server-side issues causing pin, unpin, and unmute to fail in certain states are resolved.
+- **Fix: Various backend fixes** — Stability and correctness improvements across multiple server-side paths.
+
 ### v1.1.0
 - **Fix: 500 error on device token registration** — Registering a push token that was previously registered under a different user or device ID (e.g. after app reinstall, account switch, or UUID rotation) now succeeds. The stale token record is removed before the upsert, preventing a duplicate key violation on the global `token_unique` index.
 - **Fix: 500 error on remove participant** — Removing a participant no longer errors for the removed user's subsequent actions. Message stops and socket events now correctly target only remaining active members.
@@ -2396,6 +2427,10 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 ### v1.0.9
 - **Socket reconnect resilience for `sendMessage`** — On Android, the OS suspends idle WebSocket connections during long audio recordings. `sendMessage` now waits up to 15 seconds for Socket.IO to auto-reconnect before sending, instead of immediately failing with "Socket not connected". Audio messages go through without error after upload.
 - **`settings` and `participantCount` now returned in conversation responses** — All conversation API responses and socket events (`conversation_created`, `conversation_updated`, etc.) now include `settings` (`onlyAdminsCanMessage`, `onlyAdminsCanAddMembers`, `messageConfig.editWindowSeconds`, `messageConfig.deleteWindowSeconds`) and `participantCount`. Previously these were server-side only. Fields were already in the `Conversation` type as optional.
+- **Fix: `participant_left` not received by users outside the open conversation** — The event was only sent to users who had the conversation room joined. Users on the conversation-list screen now receive it via their personal socket room. **No client action required.**
+- **Fix: Removed user could re-enter conversation room via `joinRoom`** — The socket access check was missing `isActive`, letting removed users slip back into the room and receive messages. Fixed server-side. **No client action required.**
+- **Fix: Re-added user's conversation missing from list after deletion** — If a user deleted a conversation and was re-added by an admin, it never reappeared. The server now resets `isHidden`, auto-joins the socket room, and pushes `conversation_created` to the user's personal room. **No client action required.** Existing `conversation_created → joinRoom` listeners are safe (idempotent).
+- **New: `role` parameter on `addParticipants`** — Optional third argument (`'admin' | 'member'`, default `'member'`). Re-added users always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. **Backward compatible.**
 
 ### v1.0.8
 - **`duration` field in `SendMessageAttachment`** — Pass `duration` (seconds) when sending audio or video. Server now stores and returns it in `new_message` and message list responses. **Action required (RN):** Omitting it on React Native can crash native audio player libraries on the receiver side; always pass it for audio/video. Web is unaffected.