@ethora/chat-component-rn 26.7.7 → 26.7.9

package/src/hooks/useChatRoomFocus.ts

@@ -7,6 +7,7 @@ import {
   setVisibleRoom,
 } from '../roomStore/roomsSlice';
 import { store } from '../roomStore';
+import { getServerReadTimestamp } from '../helpers/getServerReadTimestamp';
 
 interface UseChatRoomFocusOptions {
   /** The room JID that the consumer's tab/screen is currently showing. */
@@ -32,7 +33,10 @@ interface UseChatRoomFocusOptions {
  * Without this hook, `useUnread()` will always return 0 for the chat
  * room because the SDK assumes "mounted == active". With this hook,
  * focus marks the room visible (clearing the badge) and blur stamps
- * `lastViewedTimestamp = Date.now()` so future messages count as unread.
+ * `lastViewedTimestamp` to the newest SERVER-acknowledged message so
+ * future messages count as unread. Deliberately not `Date.now()`: a
+ * device clock running ahead would write a future marker that the
+ * forward-only private-store merge could never correct again (bug #38).
  *
  * Usage with React Navigation:
  *
@@ -59,11 +63,16 @@ export const useChatRoomFocus = ({
   });
 
   const leaveRoom = (jid: string) => {
-    const timestamp = Date.now();
-    dispatch(setLastViewedTimestamp({ chatJID: jid, timestamp }));
+    const state = store.getState();
+    const rooms = state.rooms?.rooms;
+    const timestamp = getServerReadTimestamp(rooms?.[jid], state.roomHeapSlice);
+    // Only stamp when we actually have something to anchor to - skip
+    // rather than fall back to the device clock (bug #38).
+    if (timestamp > 0) {
+      dispatch(setLastViewedTimestamp({ chatJID: jid, timestamp }));
+    }
     dispatch(clearVisibleRoom());
-    const rooms = store.getState().rooms?.rooms;
-    (store.getState().chatSettingStore as any)?.client
+    (state.chatSettingStore as any)?.client
       ?.flushLastViewedToPrivateStoreStanza(rooms, { visibleRoomJID: jid })
       .catch(() => {});
   };

package/src/hooks/useChatWrapperInit.ts

@@ -8,7 +8,6 @@ import { AppDispatch, RootState } from '../roomStore';
 import { useXmppClient } from '../context/xmppProvider';
 import { chatAutoEnterer } from '../helpers/chatAutoEnterer';
 import { initRoomsPresence } from '../helpers/initRoomsPresence';
-import { updatedChatLastTimestamps } from '../helpers/updatedChatLastTimestamps';
 import { updateMessagesTillLast } from '../helpers/updateMessagesTillLast';
 import { refreshAuthTokensQuietly } from '../networking/authRefresh';
 import { setLangSource, setConfig } from '../roomStore/chatSettingsSlice';
@@ -170,15 +169,21 @@ const useChatWrapperInit = ({
                 }
               }
               try {
+                // getChatsPrivateStoreRequestStanza hydrates redux itself
+                // (dispatch(applyPrivateStoreMarkers(...)) internally,
+                // clamped + forward-only) - do not also apply the raw
+                // return value here. That used to double-dispatch via
+                // updatedChatLastTimestamps' unconditional
+                // setLastViewedTimestamp, which has neither the
+                // forward-only guard nor the future-marker clamp, so on
+                // every reconnect it could silently re-clobber a value
+                // the clamp had just corrected (bug #38).
                 const roomTimestampObject: any =
                   await newClient.getChatsPrivateStoreRequestStanza();
                 console.log(
                   'Got chats private store',
                   roomTimestampObject?.length || 0
                 );
-                if (roomTimestampObject) {
-                  updatedChatLastTimestamps(roomTimestampObject, dispatch);
-                }
                 if (!hasSyncedHistoryRef.current) {
                   console.log('Updating messages till last');
                   await updateMessagesTillLast(rooms, newClient);
@@ -220,15 +225,15 @@ const useChatWrapperInit = ({
             setInited(true);
             console.log(' Getting chats private store for existing client');
             try {
+              // See the "new client" branch above: getChatsPrivateStoreRequestStanza
+              // already hydrates redux (clamped + forward-only); do not
+              // also apply the raw return value here.
               const roomTimestampObject: any =
                 await client.getChatsPrivateStoreRequestStanza();
               console.log(
                 'Got chats private store for existing client',
                 roomTimestampObject?.length || 0
               );
-              if (roomTimestampObject) {
-                updatedChatLastTimestamps(roomTimestampObject, dispatch);
-              }
               if (!hasSyncedHistoryRef.current) {
                 console.log(
                   'Updating messages till last for existing client'

package/src/networking/stanzaHandlers.ts

@@ -227,11 +227,11 @@ const onMessageHistory = async (stanza: any) => {
     // what senderJID would have held — fall back to it. createMessageFromXml
     // already derives a display name from the jid when senderFirstName/
     // senderLastName are absent.
-    const innerFrom =
-      stanza
-        .getChild('result')
-        ?.getChild('forwarded')
-        ?.getChild('message')?.attrs?.from || stanza.attrs.from;
+    const forwardedMessage = stanza
+      .getChild('result')
+      ?.getChild('forwarded')
+      ?.getChild('message');
+    const innerFrom = forwardedMessage?.attrs?.from || stanza.attrs.from;
     const senderJID = data?.attrs?.senderJID || innerFrom;
     if (!data?.attrs || !senderJID) {
       // console.log(
@@ -242,11 +242,25 @@ const onMessageHistory = async (stanza: any) => {
     }
     const mergedAttrs = { ...data.attrs };
     if (!mergedAttrs.senderJID) {mergedAttrs.senderJID = senderJID;}
+    // The forwarded <message>'s own stanza id is our original send id
+    // (what `xmppId` holds on the live/wrapped paths) - capture it so
+    // this MAM-replayed message dedupes against its live echo /
+    // optimistic pending bubble the same way, instead of never carrying
+    // an xmppId at all.
+    if (forwardedMessage?.attrs?.id) {mergedAttrs.xmppId = forwardedMessage.attrs.id;}
     const rawMessage = await createMessageFromXml(
       mergedAttrs,
       body,
       id,
-      stanza.attrs.from,
+      // Bug #41: pass the resource-bearing occupant `from`
+      // (room@conference/sender-id) here, not the outer envelope's
+      // `stanza.attrs.from` (which has no resource for a MAM result).
+      // createMessageFromXml derives `user.id` from this field's
+      // resource - the same authoritative source getDataFromXml uses
+      // for live messages - so catch-up rows resolve the correct
+      // sender from the very first render instead of needing a later
+      // correction once the "official" history fetch lands.
+      innerFrom,
       !!deleted
     );
 

package/src/networking/xmpp/flushLastViewedToPrivateStore.ts

@@ -1,22 +1,32 @@
 import { getChatsPrivateStoreRequest } from './getChatsPrivateStoreRequest.xmpp';
 import { setChatsPrivateStoreRequest } from './setChatsPrivateStoreRequest.xmpp';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+  type ReadTimestampHeapState,
+} from '../../helpers/getServerReadTimestamp';
+import type { IMessage } from '../../types/types';
 
 interface RoomLike {
   jid: string;
   lastViewedTimestamp?: number;
   unreadMessages?: number;
+  // Needed to resolve a SERVER-timestamp read marker via
+  // getServerReadTimestamp instead of the device clock - see bug #38.
+  messages?: IMessage[];
 }
 
 interface FlushOpts {
   // When visibleRoomJID is set, treat it as "user just viewed everything
-  // up to now" and stamp it with Date.now() — even if its in-memory
-  // lastViewedTimestamp has not been updated yet.
+  // up to now" and stamp it with the newest server-acknowledged message
+  // timestamp for that room - even if its in-memory lastViewedTimestamp
+  // has not been updated yet.
   visibleRoomJID?: string | null;
-  // Explicit read boundary for the visible room, used INSTEAD of
-  // Date.now(). ChatRoom passes the timestamp of the newest message the
-  // user actually reached when they leave a room while scrolled up —
-  // without it, the Date.now() default writes "read everything" to the
-  // server and the messages they never scrolled down to come back as
+  // Explicit read boundary for the visible room, used INSTEAD of the
+  // newest-message fallback. ChatRoom passes the timestamp of the newest
+  // message the user actually reached when they leave a room while
+  // scrolled up - without it, the default writes "read everything" to
+  // the server and the messages they never scrolled down to come back as
   // read on the next login, even though the local count was correct.
   // Customer-reported #33 (server half).
   visibleRoomTs?: number | null;
@@ -24,6 +34,12 @@ interface FlushOpts {
   // (or the visible room). Used at logout time: rooms with outstanding
   // unread keep their old marker so the next login still surfaces them.
   onlyIfNoUnread?: boolean;
+  // Pending/failed-send state (store.getState().roomHeapSlice), combined
+  // with each room's `messages` to resolve the newest SERVER-acked
+  // message timestamp via getServerReadTimestamp. Passed in rather than
+  // read from the store here so this module stays a pure function of its
+  // arguments - existing jest coverage builds `rooms` by hand.
+  heapState?: ReadTimestampHeapState;
 }
 
 /**
@@ -33,8 +49,11 @@ interface FlushOpts {
  * each other's entries.
  *
  * Called on: tab change away from chat, AppState background/inactive,
- * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path
- * still uses actionSetTimestampToPrivateStore for the single-room case.
+ * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path also
+ * goes through this (via flushLastViewedToPrivateStoreStanza) for the
+ * single-room case - actionSetTimestampToPrivateStore is a separate,
+ * unconditional low-level write primitive kept for direct/external use
+ * and is not part of this merge path.
  */
 export async function flushLastViewedToPrivateStore(
   client: any,
@@ -42,7 +61,7 @@ export async function flushLastViewedToPrivateStore(
   opts: FlushOpts = {}
 ): Promise<boolean> {
   if (!client?.client) {return false;}
-  const { visibleRoomJID, visibleRoomTs, onlyIfNoUnread } = opts;
+  const { visibleRoomJID, visibleRoomTs, onlyIfNoUnread, heapState } = opts;
   const roomList = Object.values(rooms || {});
   if (roomList.length === 0) {return false;}
 
@@ -54,7 +73,6 @@ export async function flushLastViewedToPrivateStore(
   }
   if (!storeObj || typeof storeObj !== 'object') {storeObj = {};}
 
-  const nowMs = Date.now();
   let dirty = false;
 
   for (const room of roomList) {
@@ -62,27 +80,56 @@ export async function flushLastViewedToPrivateStore(
     const isVisible = !!visibleRoomJID && room.jid === visibleRoomJID;
     const hasUnread = Number(room.unreadMessages || 0) > 0;
 
-    // For the visible room, persist "now" — read state is driven by
-    // room visibility, not by a sentinel timestamp. The exception is an
-    // explicit `visibleRoomTs`: the caller knows the user only read up
-    // to a certain point (left the room while scrolled up), so stamping
-    // "now" here would mark genuinely-unread messages as read.
+    // Newest message this room actually has server-side proof of. Used
+    // both as the "read up to now" fallback for the visible room and as
+    // the yardstick for detecting a corrupt (future) stored marker below
+    // - never as a substitute for the device clock (bug #38: a device
+    // with a fast clock previously stamped Date.now() here, and once
+    // that future value reached the server the forward-only check a few
+    // lines down rejected every later correct write, forever).
+    const newestAckedMs = getServerReadTimestamp(room as any, heapState);
+
+    // For the visible room, persist "read up to the newest message we
+    // know the server has" - read state is driven by room visibility,
+    // not by a sentinel timestamp. The exception is an explicit
+    // `visibleRoomTs`: the caller knows the user only read up to a
+    // certain point (left the room while scrolled up), so stamping
+    // "everything" here would mark genuinely-unread messages as read.
     let ts: number | undefined;
     if (isVisible) {
       ts =
         typeof visibleRoomTs === 'number' && visibleRoomTs > 0
           ? visibleRoomTs
-          : nowMs;
+          : newestAckedMs || undefined;
     } else if (room.lastViewedTimestamp && room.lastViewedTimestamp > 0) {
       ts = room.lastViewedTimestamp;
     }
 
+    // Nothing to anchor a write to (no boundary, no existing marker, no
+    // known messages yet) - skip rather than write a device-clock guess.
     if (!ts) {continue;}
     if (onlyIfNoUnread && hasUnread && !isVisible) {continue;}
 
     const prev = storeObj[room.jid];
     const prevNum = prev != null ? Number(prev) : 0;
-    if (Number.isFinite(prevNum) && prevNum >= ts) {continue;}
+    // A currently-stored value that sits well past the newest message we
+    // know this room has is not "fresher" - it's a leftover future
+    // marker (bug #38). Forward-only logic normally protects a fresher
+    // read from being clobbered by a stale fetch, but applied to a
+    // corrupt future value it does the opposite: it permanently blocks
+    // the correct (smaller) value from ever landing. Detect that case
+    // and waive the forward-only check for it specifically; sane values
+    // keep the normal forward-only protection.
+    //
+    // "Well past the newest message we know about" is deliberately NOT
+    // sufficient on its own - see isCorruptFutureReadMarker. THIS device's
+    // copy of the room can simply be stale (history not synced yet this
+    // session), in which case a legitimate marker written by another
+    // device that HAS seen newer messages looks exactly like a corrupt
+    // one, and "healing" it here would push the server marker BACKWARDS
+    // and resurrect already-read messages on every device.
+    const prevLooksCorrupt = isCorruptFutureReadMarker(prevNum, newestAckedMs);
+    if (!prevLooksCorrupt && Number.isFinite(prevNum) && prevNum >= ts) {continue;}
     storeObj[room.jid] = String(ts);
     dirty = true;
   }

package/src/networking/xmppClient.ts

@@ -32,6 +32,10 @@ import {
   enqueueOutboundSend,
   flushOutboundSends,
 } from './outboundQueue';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+} from '../helpers/getServerReadTimestamp';
 
 // Canonical production XMPP WSS endpoint (standard wss/443, no port suffix).
 const DEFAULT_DEV_SERVER = 'xmpp.chat.ethora.com';
@@ -1060,9 +1064,37 @@ export class XmppClient {
       // `getChatsPrivateStoreRequest` directly and intentionally skip this.
       if (markers && typeof markers === 'object') {
         const normalized: Record<string, number> = {};
+        const roomsState = store.getState().rooms?.rooms || {};
+        const heapState = store.getState().roomHeapSlice;
         for (const jid of Object.keys(markers as Record<string, unknown>)) {
           const n = Number((markers as Record<string, unknown>)[jid]);
-          if (jid && Number.isFinite(n) && n > 0) {normalized[jid] = n;}
+          if (!jid || !Number.isFinite(n) || n <= 0) {continue;}
+          // Defensive clamp (bug #38): a marker written while some
+          // device's clock was ahead can land in the future relative to
+          // the newest message the server actually has for this room.
+          // The redux merge (applyPrivateStoreMarkers) and the
+          // server-side merge (flushLastViewedToPrivateStore) both treat
+          // "newer" as "better", so an uncorrected future value would
+          // block every later correct write forever - useUnread() would
+          // report 0 for that room on every cold start. When we already
+          // know this room's messages locally, clamp an implausible
+          // marker down to the newest one we actually have instead of
+          // trusting the server value verbatim.
+          //
+          // "Implausible" needs BOTH "past the newest message we know
+          // about" AND "past real time" (isCorruptFutureReadMarker):
+          // this device's cache for a room is routinely stale, and
+          // clamping on staleness alone would drag a perfectly good
+          // marker written by another device backwards.
+          const room = roomsState[jid];
+          const newestKnownMs = room
+            ? getServerReadTimestamp(room, heapState)
+            : 0;
+          if (isCorruptFutureReadMarker(n, newestKnownMs)) {
+            normalized[jid] = newestKnownMs;
+          } else {
+            normalized[jid] = n;
+          }
         }
         if (Object.keys(normalized).length > 0) {
           store.dispatch(applyPrivateStoreMarkers(normalized));
@@ -1104,7 +1136,14 @@ export class XmppClient {
   ) {
     if (this.disableLastRead) {return false;}
     try {
-      return await flushLastViewedToPrivateStore(this, rooms, opts);
+      // Auto-inject the pending/failed-send heap so every caller gets
+      // getServerReadTimestamp's exclusion of optimistic messages for
+      // free, without needing to reach into the redux store themselves.
+      const heapState = store.getState().roomHeapSlice;
+      return await flushLastViewedToPrivateStore(this, rooms, {
+        ...opts,
+        heapState,
+      });
     } catch {
       return false;
     }

package/src/roomStore/index.ts

@@ -1,14 +1,18 @@
 import { configureStore, combineReducers } from '@reduxjs/toolkit';
 import chatSettingsReducer, { setUser } from './chatSettingsSlice';
 import roomsSlice, { addRoom } from './roomsSlice';
-import { roomHeapSlice } from './roomHeapSlice';
+import { roomHeapSlice, markMessageFailed } from './roomHeapSlice';
 import callReducer from './callSlice';
 import { IRoom } from '../types/types';
 import { unreadMiddleware } from './Middleware/unreadMidlleware';
 import { logoutMiddleware } from './Middleware/logoutMiddleware';
 import { newMessageMidlleware } from './Middleware/newMessageMidlleware';
 import { reactionsMiddleware } from './Middleware/reactionsMiddleware';
-import { persistenceMiddleware, readPersistedState } from './persistence';
+import {
+  persistenceMiddleware,
+  readPersistedState,
+  computeBootTimeFailures,
+} from './persistence';
 
 const rootReducer = combineReducers({
   chatSettingStore: chatSettingsReducer,
@@ -68,11 +72,12 @@ export const getActiveRoom = (state: RootState): IRoom | null => {
     : null;
 };
 
-// Async rehydrate — read persisted slices and replay them as standard
+// Async rehydrate: read persisted slices and replay them as standard
+// actions.
 export const persistorReady =
   globalScope.__CHAT_PERSISTOR_READY__ ||
   (globalScope.__CHAT_PERSISTOR_READY__ = (async () => {
-    const { chat, rooms } = await readPersistedState();
+    const { chat, rooms, heap } = await readPersistedState();
     if (chat?.user && chat.user.walletAddress) {
       store.dispatch(setUser(chat.user));
     }
@@ -82,4 +87,35 @@ export const persistorReady =
         store.dispatch(addRoom({ roomData: room as IRoom }));
       }
     }
+
+    // bug #39: restore failures that were already flagged (watchdog or
+    // an explicit send error) before the app was killed, so the bubble
+    // still shows "Failed / tap to retry" instead of quietly reverting
+    // to a normal sent bubble.
+    // Skip entries whose bubble no longer exists in the restored cache.
+    // A failure flag is only ever READ as `failedMessages[message.id]`,
+    // so one with no matching message is dead weight that would be
+    // replayed and re-persisted on every launch forever. This happens
+    // for real: a send that reached the server but whose echo was lost
+    // gets flagged failed at boot, then the history merge replaces the
+    // optimistic bubble with the archived copy under its server id (see
+    // mergeHistoryIntoCache), leaving the flag behind.
+    const restoredFailed = heap?.failedMessages || {};
+    for (const payload of Object.values(restoredFailed)) {
+      const stillRendered = (
+        rooms?.rooms?.[payload.roomJID]?.messages || []
+      ).some((m) => m?.id === payload.id);
+      if (!stillRendered) {continue;}
+      store.dispatch(markMessageFailed(payload));
+    }
+
+    // bug #39: a message that was still `pending: true` at kill time
+    // never got a server echo AND never got the chance to trip the
+    // in-session send watchdog (messageHeap is process-lifetime only,
+    // never persisted). Treat every such message as failed so it gets
+    // a working retry instead of silently rendering as delivered.
+    const bootFailures = computeBootTimeFailures(rooms?.rooms, restoredFailed);
+    for (const payload of bootFailures) {
+      store.dispatch(markMessageFailed(payload));
+    }
   })());