@antzsoft/chat-core 1.1.1 → 1.1.3

package/README.md

@@ -320,10 +320,14 @@ interface AntzChatConfig {
   tenantId?: string;
 
   /**
-   * Encryption mode. Must match the server's ENCRYPTION_MODE env var.
-   * Default: 'none'.
+   * Enable payload-level transit encryption for all HTTP and socket traffic.
+   * Uses ECDH key exchange (X25519/P-256) + AES-256-GCM to encrypt every
+   * request, response, and socket event on the wire — independent of TLS.
+   * Server must have TRANSIT_ENCRYPTION_ENABLED=true (default).
+   * Default: true. Set false only for local development or debugging.
+   * Safe to toggle anytime — no data migration needed (wire-only, never stored).
    */
-  encryptionMode?: 'none' | 'server';
+  transitEncryption?: boolean;
 
   /**
    * The user's ID in the external auth system.
@@ -621,6 +625,13 @@ class AntzChatClient {
    * Same presigned URL pipeline as message attachments — platformUploadFn is handled automatically.
    */
   uploadIcon(conversationId: string, file: UploadableFile): Promise<Conversation>;
+
+  /**
+   * Remove the group icon (admin only).
+   * Deletes the asset from storage and clears iconMeta on the conversation.
+   * Returns the updated conversation with iconUrl: undefined.
+   */
+  removeIcon(conversationId: string): Promise<Conversation>;
 }
 ```
 
@@ -747,7 +758,6 @@ interface SendData {
   attachments?: SendMessageAttachment[];
   replyTo?: string;      // messageId of the message being replied to
   tempId?: string;       // Client-generated ID for optimistic UI
-  isEncrypted?: boolean;
 }
 
 interface SearchParams {
@@ -846,15 +856,16 @@ import { conversationsApi } from '@antzsoft/chat-core';
 | `createDirect` | `(data: CreateDirectData) => Promise<Conversation>` | Start or retrieve a direct conversation with another user. |
 | `update` | `(conversationId: string, data: UpdateConversationData) => Promise<Conversation>` | Update group name or description. |
 | `uploadIcon` | `(conversationId: string, fileId: string) => Promise<Conversation>` | Set the group icon from an already-uploaded file (admin only). Call `client.uploadFiles()` first to get the `fileId`, then pass it here. Server copies `storageKey` into `conversation.iconMeta`, deletes the `chat_files` record, and returns the conversation with a fresh `iconUrl`. |
-| `delete` | `(conversationId: string) => Promise<void>` | Delete a conversation (admin only). |
-| `addParticipants` | `(conversationId: string, userIds: string[], role?: 'admin' \| 'member') => Promise<Conversation>` | Add one or more participants. `role` defaults to `'member'`. Previously removed members who are re-added always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. |
-| `removeParticipant` | `(conversationId: string, userId: string) => Promise<Conversation>` | Remove a participant. |
+| `removeIcon` | `(conversationId: string) => Promise<Conversation>` | Remove the group icon (admin only). Deletes the asset from storage, clears `iconMeta` on the conversation, and returns the updated conversation with `iconUrl: undefined`. Non-admins receive `403 Forbidden`. |
+| `delete` | `(conversationId: string) => Promise<void>` | Hide a conversation from the caller's list. Works for any participant (active or inactive) on both DMs and groups — no admin role required. For DMs this is "Delete Chat"; for groups this is "Delete Group" (after already exiting). Other participants are completely unaffected. |
+| `addParticipants` | `(conversationId: string, userIds: string[], role?: 'admin' \| 'member') => Promise<Conversation>` | Add one or more participants. `role` defaults to `'member'`. Previously removed members who are re-added always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. Message visibility on re-add depends on whether the user previously deleted the conversation (see [Message History & Re-add](#message-history--re-add)). |
+| `removeParticipant` | `(conversationId: string, userId: string) => Promise<Conversation>` | Remove a participant (admin only). |
 | `updateParticipantRole` | `(conversationId: string, userId: string, role: 'admin' \| 'member') => Promise<Conversation>` | Promote or demote a participant. |
 | `mute` | `(conversationId: string, mutedUntil?: string) => Promise<void>` | Mute notifications. Pass an ISO date string to mute until a specific time. |
 | `unmute` | `(conversationId: string) => Promise<void>` | Unmute a conversation. |
 | `pin` | `(conversationId: string) => Promise<void>` | Pin a conversation to the top of the list. Max 5 pins — server returns `400` if the limit is reached. |
 | `unpin` | `(conversationId: string) => Promise<void>` | Unpin a conversation. |
-| `leave` | `(conversationId: string) => Promise<void>` | Leave a group conversation. |
+| `leave` | `(conversationId: string, andDelete?: boolean) => Promise<void>` | Leave a group conversation. Pass `andDelete: true` to also hide it from the caller's list in one atomic operation ("Exit and Delete"). When the last admin calls `leave()`, the server automatically promotes the longest-standing active member to admin before completing the exit — no client action required. |
 | `getMembers` | `(conversationId: string) => Promise<User[]>` | Fetch full user profiles for all participants. |
 
 ```typescript
@@ -971,6 +982,11 @@ console.log(updated.iconUrl); // fresh signed URL, regenerated on every response
 // - Previous icon deleted from storage automatically on replace
 // - Non-admins get 403 Forbidden
 
+// Remove the group icon (admin only).
+// Deletes the asset from storage and clears iconMeta. Returns conversation with iconUrl: undefined.
+const noIcon = await conversationsApi.removeIcon(group.id);
+// noIcon.iconUrl === undefined
+
 // Add members (default role: member)
 await conversationsApi.addParticipants(group.id, ['user-d', 'user-e']);
 
@@ -1108,6 +1124,8 @@ const presigned = await storageApi.requestPresignedUrl({
   mimeType: 'application/pdf',
   size: 512000,
   conversationId: 'conv-abc',
+  // optional — stored on the server file record
+  metadata: { compressed: true, originalSize: 900000, compressionAlgorithm: 'gzip' },
 });
 await platformUploadFn(presigned, file, (pct) => console.log(`${pct * 100}%`));
 const fileRecord = await storageApi.confirmUpload(presigned.fileId);
@@ -1136,9 +1154,9 @@ When `platformCompressFn` is provided and `compression.enabled` is `true` (the d
 1. Determine strategy per file (`image` → WebP/JPEG resize+encode, `gzip` → text/doc compression, `skip` → no-op)
 2. Run `platformCompressFn(file, compressionConfig)` — returns a `CompressedFile`
 3. If compressed result is **larger** than the original, the original is used instead (automatic fallback)
-4. Request presigned URL with the compressed size and MIME type
+4. Request presigned URL with the compressed size, MIME type, and compression metadata (`compressed`, `originalSize`, `compressionAlgorithm`)
 5. Upload the compressed bytes
-6. Store `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record
+6. Server persists `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record alongside system fields (`userId`, `tenantId`)
 
 ### Strategy by file type
 
@@ -1534,6 +1552,9 @@ import { usersApi } from '@antzsoft/chat-core';
 | `list` | `(params?: { query?: string; page?: number; limit?: number }) => Promise<PaginatedResponse<User>>` | List users, optionally filtered by a search query. Omit `page`/`limit` for all results. |
 | `getById` | `(userId: string) => Promise<User>` | Fetch a single user by their chat system ID. |
 | `getLastSeen` | `(userId: string) => Promise<{ lastSeenAt: string \| null }>` | Fetch a user's last-seen timestamp. Use on initial load; after that the store is kept live by `user_offline` socket events. |
+| `updateProfile` | `(payload: UpdateProfilePayload) => Promise<User>` | Update the current user's profile fields. Works in both builtin and non-builtin modes. |
+| `updatePreferences` | `(prefs: UserPreferences) => Promise<User>` | Partial update of notification preferences. |
+| `getPreferences` | `() => Promise<UserPreferences \| null>` | Fetch current notification preferences. Returns `null` if no record exists yet. |
 
 All methods return `User` objects that include `externalId` for non-builtin modes.
 
@@ -1555,6 +1576,43 @@ const user = await usersApi.getById('64abc...');
 console.log(user.displayName, user.externalId);
 ```
 
+#### `updateProfile` — immediate profile update
+
+Use this to push a profile change to the chat server without waiting for the next sync cycle. Useful in **non-builtin (external/SSO) modes** when the host app knows a field just changed in the identity provider — e.g. the user updated their name in the main system.
+
+```typescript
+import { usersApi, type UpdateProfilePayload } from '@antzsoft/chat-core';
+
+await usersApi.updateProfile({
+  firstName:   'Jane',
+  lastName:    'Smith',
+  displayName: 'Jane S.',   // optional — auto-derived from firstName+lastName if omitted (builtin)
+  email:       'jane@example.com',
+  phone:       '+919900000000',
+});
+```
+
+**Behaviour by mode:**
+
+| Field | Builtin | Non-builtin (external / SSO / WSO2) |
+|---|---|---|
+| `firstName` | Written directly | Written immediately; overwritten on next sync if user-service has a different value |
+| `lastName` | Written directly | Written immediately; overwritten on next sync if user-service has a different value |
+| `email` | Written directly | Written immediately; overwritten on next sync if user-service has a different value |
+| `displayName` | Written. Auto-derived from `firstName`+`lastName` if omitted | Written immediately |
+| `phone` | Written directly | Written immediately |
+| `username` | Not allowed | Not allowed |
+| `status` | Not allowed | Not allowed |
+
+**Uniqueness constraints (both modes):**
+- `email` must be unique within the tenant → `409 Conflict` if another user holds it
+- `phone` must be unique within the tenant → `409 Conflict` if another user holds it
+
+**Background sync in non-builtin mode:**
+- On `AntzChatClient` socket connect, if the user's shadow record is stale (> 6 hours since last sync), the server fires a single-user sync from the upstream user-service in the background.
+- The 2-hour bulk cron also keeps all shadow records up to date.
+- `updateProfile()` lets the host app push changes immediately rather than waiting for the next sync cycle.
+
 ---
 
 ### App Config API (`appConfigApi`)
@@ -2048,9 +2106,6 @@ interface Message {
   sender?: User;
   readBy?: Array<{ userId: string; readAt: string }>;
   deliveredTo?: Array<{ userId: string; deliveredAt: string }>;
-  isEncrypted?: boolean;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  encryptedContent?: EncryptedContent;
 }
 ```
 
@@ -2123,9 +2178,6 @@ interface Conversation {
   isPinned?: boolean;
   isMuted?: boolean;
   mutedUntil?: string;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  isEncryptionEnabled?: boolean;
-  encryptionKey?: string;
 }
 
 interface ConversationSettings {
@@ -2192,8 +2244,6 @@ interface SendMessagePayload {
   attachments?: SendMessageAttachment[];
   replyTo?: string;           // messageId
   tempId: string;             // client-generated; echoed back in message_ack
-  encryptedContent?: EncryptedContent;
-  isEncrypted?: boolean;
 }
 
 interface SendMessageAttachment {
@@ -2401,10 +2451,32 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.1.3
+- **New: `conversationsApi.leave(conversationId, andDelete?)` — `andDelete` param** — Pass `andDelete: true` to exit a group and hide it from the caller's list in a single atomic server call ("Exit and Delete"). Previously required two separate calls.
+- **New: Auto-promote on last-admin exit** — When the only admin leaves a group, the server now automatically promotes the longest-standing active member to admin before completing the exit. Previously the server returned `400 Bad Request` requiring the admin to manually promote someone first.
+- **Changed: `conversationsApi.delete()` — no longer admin-only** — Any participant (active or inactive) can call `delete()` to hide their own copy of a DM or group. For DMs this is "Delete Chat". For groups this is "Delete Group" (for already-exited members). Other participants are unaffected.
+- **New: Message visibility windows (`membershipPeriods`)** — Each participant now tracks an array of membership time windows. The message fetch API enforces these windows so gap messages (sent while the user was not a member) are always hidden. Previously re-added users could see all messages including those sent during their absence.
+- **New: DM reappear on new message** — After a user deletes a DM, if the other participant sends a new message the conversation automatically reappears in the deleted user's list. The user sees only messages from the reappearance point onwards.
+- **New: `useConversations()` returns `leaveGroup`, `leaveAndDeleteGroup`, `deleteGroup` / `deleteConversation` mutations** — Available in both the web SDK and RN SDK hooks.
+
+### v1.1.2
+- **New: `usersApi.updateProfile()`** — Update the current user's profile fields (`firstName`, `lastName`, `email`, `displayName`, `phone`) immediately without waiting for the next sync cycle. Works in both builtin and non-builtin modes. Email and phone are enforced unique per tenant (409 on conflict). In non-builtin modes, fields may be overwritten on the next background sync if user-service returns different values.
+- **New: On-connect per-user sync** — In non-builtin modes, `AntzChatClient.connect()` now triggers a background sync of the current user's profile from the upstream user-service if the shadow record is stale (> 6 hours). Previously only the 2-hour bulk cron kept shadow records updated.
+- **New: Phone number uniqueness enforced** — `phone` is now unique per tenant (schema index + pre-check on register and `updateProfile`). A `409 Conflict` is returned if another user in the same tenant already holds the phone number.
+- **New: Participants stored in a dedicated collection** — Participants are no longer embedded inside conversation documents. Each participant is now its own document in a separate collection, removing the MongoDB 16 MB document size ceiling for large groups and eliminating write contention on high-membership conversations. No client API changes.
+- **New: Transit encryption** — All socket payloads are now encrypted end-to-end using a per-session symmetric key negotiated on connect. Transparent to callers — no SDK API changes required.
+- **Fix: Disbanded groups now visible in read-only mode for removed members** — Previously removed members' views of disbanded groups were inconsistent. Removed participants now always see the conversation in read-only mode until they explicitly call `leave()`.
+- **Fix: Removed participant access hardened** — Removed users can no longer view messages sent after their removal via the REST API. Message history is now capped at the exact moment of removal. Removed users were also incorrectly able to search messages, view starred messages, and fetch unread counts from conversations they were removed from — all three are now blocked.
+- **Fix: Unread badge drops to zero immediately on removal** — When an admin removes a user from a group, all unread messages in that conversation are automatically marked as read for the removed user at the moment of removal. Previously the badge stayed non-zero until the user manually opened the conversation.
+- **Fix: Compression metadata now stored on the server** — When a compressed image is uploaded, the file record now correctly saves `compressed`, `originalSize`, and `compressionAlgorithm`. Previously this metadata was silently dropped by DTO validation. No changes needed on the client — handled automatically by `uploadBatch`.
+- **Fix: Delete for me also removes the message from your starred list** — Calling `deleteForMe` on a starred message now removes the star. Previously the message remained in the starred list even after being hidden.
+
 ### v1.1.1
 - **New: `attachmentSnapshot` on reply messages** — `replyTo` now includes a snapshot of the first attachment from the quoted message (`type`, `filename`, `mimeType`, `size`, `duration`, `dimensions`, signed `url`). Stored at write time so reply bubbles render without fetching the original message.
 - **Fix: `contentPreview` for multi-attachment replies** — Now reflects attachment count: `"photo.jpg +2 more"`, `"3 Photos"`, `"3 Attachments"` (mixed types). Previously always showed only the first filename.
 - **New: exported `ReplyAttachmentSnapshot` type.**
+- **Fix: Pin, unpin, and unmute operations** — Server-side issues causing pin, unpin, and unmute to fail in certain states are resolved.
+- **Fix: Various backend fixes** — Stability and correctness improvements across multiple server-side paths.
 
 ### v1.1.0
 - **Fix: 500 error on device token registration** — Registering a push token that was previously registered under a different user or device ID (e.g. after app reinstall, account switch, or UUID rotation) now succeeds. The stale token record is removed before the upsert, preventing a duplicate key violation on the global `token_unique` index.
@@ -2445,7 +2517,7 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 - Fix: attachment last-message content preview
 - Fix: avatar upload via `AntzChatClient`
 - Fix: `client.connect()` on React Native
-- Group icon — create & update
+- Group icon — create, update & remove
 - Scroll to first unread message
 - Push notifications — device token registration (RN & Web)