@ethora/chat-component-rn 26.7.7 → 26.7.9

package/src/roomStore/persistence.ts

@@ -2,6 +2,7 @@ import AsyncStorage from '@react-native-async-storage/async-storage';
 import { Middleware } from '@reduxjs/toolkit';
 import { IMessage, IRoom, User } from '../types/types';
 import { encryptForPersist, decryptFromPersist } from '../helpers/persistCrypto';
+import type { FailedMessagePayload } from './roomHeapSlice';
 
 // -------------------------------------------------------------------
 // Lightweight RN persistence layer. Mirrors what redux-persist gives
@@ -21,12 +22,24 @@ import { encryptForPersist, decryptFromPersist } from '../helpers/persistCrypto'
 
 const KEY_CHAT = '@ethora/persist:chatSettingStore';
 const KEY_ROOMS = '@ethora/persist:rooms';
+// bug #39: a failed send needs to survive a relaunch as "failed / tap
+// to retry", not silently render as delivered. `roomHeapStore.failedMessages`
+// is the map the bubble reads (`isFailed = failedMessages[id]`, see
+// Message.tsx / useMessageHeapState): it lives in a separate, previously
+// non-persisted slice from `rooms`, so it gets its own key here.
+const KEY_HEAP = '@ethora/persist:roomHeap';
 
 // Per-room message cap on disk. Mirror this value in `roomsSlice`'s
 // in-memory cap (see `enforceMessageCap`) so the runtime and persisted
 // shapes stay aligned.
 export const MESSAGE_LIMIT = 100;
 
+// Defensive cap on the number of failed-message payloads written to
+// disk. In practice this map only grows while the user is actively
+// sending offline, but a runaway sender (or a bug that never clears an
+// entry) must not turn this key into an unbounded write.
+export const MAX_PERSISTED_FAILED_MESSAGES = 200;
+
 interface PersistedChatState {
   user: User;
 }
@@ -36,6 +49,14 @@ interface PersistedRoomsState {
   // intentionally NOT persisted: activeRoomJID, editAction, isLoading
 }
 
+interface PersistedHeapState {
+  failedMessages: Record<string, FailedMessagePayload>;
+  // intentionally NOT persisted: messageHeap, a process-lifetime
+  // "in flight" buffer (see roomHeapSlice.ts); anything still in it when
+  // the app dies is handled by the boot-time pending->failed scan below,
+  // not by replaying the heap itself.
+}
+
 const sanitizeUser = (user?: User): User | null => {
   if (!user) {return null;}
   // Drop secrets we don't want at rest — destructure to omit, then
@@ -81,6 +102,13 @@ const PERSISTED_MESSAGE_FIELDS: (keyof IMessage)[] = [
   'size',
   'langSource',
   'callLog',
+  // bug #39: without this, a message that was still in flight (no
+  // server echo yet) at kill time comes back from disk indistinguishable
+  // from a normal delivered message, so the bubble renders it as sent.
+  // Persisting `pending` lets the boot-time scan (see
+  // computeBootTimeFailures below) find exactly the messages that never
+  // got confirmed and flip them to failed instead.
+  'pending',
 ];
 
 // The sender identity that rides along on every message over the wire
@@ -180,6 +208,154 @@ const sanitizeRooms = (
   return out;
 };
 
+// Only the fields retryMessage actually needs to replay the send (see
+// FailedMessagePayload / useSendMessage.retryMessage). In particular, the
+// media `data` blob is trimmed to `uri/type/name/size` (the picker never
+// hands us auth material, but this stays defensive against a future
+// picker change smuggling extra fields, or a huge inline payload, into
+// `data`).
+const sanitizeMediaData = (
+  data: any
+): { uri?: string; type?: string; name?: string; size?: number } => {
+  if (!data || typeof data !== 'object') {return {};}
+  const out: { uri?: string; type?: string; name?: string; size?: number } = {};
+  if (typeof data.uri === 'string') {out.uri = data.uri;}
+  if (typeof data.type === 'string') {out.type = data.type;}
+  if (typeof data.name === 'string') {out.name = data.name;}
+  if (typeof data.size === 'number') {out.size = data.size;}
+  return out;
+};
+
+const sanitizeFailedMessagePayload = (
+  payload: FailedMessagePayload
+): FailedMessagePayload | null => {
+  if (!payload || typeof payload !== 'object') {return null;}
+  if (!payload.id || typeof payload.id !== 'string') {return null;}
+  if (!payload.roomJID || typeof payload.roomJID !== 'string') {return null;}
+  if (payload.kind === 'media') {
+    return {
+      kind: 'media',
+      id: payload.id,
+      roomJID: payload.roomJID,
+      data: sanitizeMediaData(payload.data),
+      type: typeof payload.type === 'string' ? payload.type : '',
+      isReply: payload.isReply,
+      isChecked: payload.isChecked,
+      mainMessage: payload.mainMessage,
+    };
+  }
+  if (payload.kind === 'text') {
+    return {
+      kind: 'text',
+      id: payload.id,
+      roomJID: payload.roomJID,
+      body: typeof payload.body === 'string' ? payload.body : '',
+      isReply: payload.isReply,
+      isChecked: payload.isChecked,
+      mainMessage: payload.mainMessage,
+    };
+  }
+  return null;
+};
+
+const sanitizeFailedMessages = (
+  failedMessages: Record<string, FailedMessagePayload> | undefined
+): Record<string, FailedMessagePayload> => {
+  if (!failedMessages || typeof failedMessages !== 'object') {return {};}
+  const out: Record<string, FailedMessagePayload> = {};
+  let count = 0;
+  for (const [id, payload] of Object.entries(failedMessages)) {
+    if (count >= MAX_PERSISTED_FAILED_MESSAGES) {break;}
+    const clean = sanitizeFailedMessagePayload(payload);
+    if (clean) {
+      out[id] = clean;
+      count++;
+    }
+  }
+  return out;
+};
+
+// -------------------------------------------------------------------
+// Boot-time pending -> failed conversion (bug #39).
+//
+// `messageHeap` (the "still sending" buffer) is intentionally NOT
+// persisted: it's a process-lifetime thing. That means on a cold start
+// there is no such thing as "still sending": a persisted message that
+// carries `pending: true` never got a server echo NOR got the chance to
+// trip the in-session watchdog (see PENDING_WATCHDOG_MS in
+// useSendMessage.tsx) before the process died. It must render as failed
+// with a working retry, not as delivered and not as stuck "sending...".
+//
+// Reconstructs the same FailedMessagePayload shape the live send path
+// builds in useSendMessage (markMessageFailed calls), from the fields we
+// persist per message.
+// -------------------------------------------------------------------
+
+export function reconstructFailedMessagePayload(
+  message: IMessage,
+  roomJID: string
+): FailedMessagePayload | null {
+  if (!message?.id || !roomJID) {return null;}
+  const isReply = !!message.isReply;
+  const isChecked = message.showInChannel === 'true';
+  const mainMessage = message.mainMessage;
+  if (message.isMediafile === 'true') {
+    return {
+      kind: 'media',
+      id: message.id,
+      roomJID,
+      data: sanitizeMediaData({
+        uri: message.location,
+        name: message.fileName,
+        type: message.mimetype,
+        size:
+          message.size !== undefined && message.size !== null
+            ? Number(message.size)
+            : undefined,
+      }),
+      type: message.mimetype || '',
+      isReply,
+      isChecked,
+      mainMessage,
+    };
+  }
+  return {
+    kind: 'text',
+    id: message.id,
+    roomJID,
+    body: message.body || '',
+    isReply,
+    isChecked,
+    mainMessage,
+  };
+}
+
+/**
+ * Scan every persisted room for messages still `pending: true` that
+ * DON'T already have a restored failure entry (those are handled by the
+ * caller separately, from the persisted `failedMessages` map), and
+ * synthesize a retry-able FailedMessagePayload for each. Pure function:
+ * the caller (roomStore/index.ts) is responsible for dispatching
+ * `markMessageFailed` for the results.
+ */
+export function computeBootTimeFailures(
+  rooms: Record<string, IRoom> | null | undefined,
+  alreadyFailed: Record<string, FailedMessagePayload> | null | undefined
+): FailedMessagePayload[] {
+  if (!rooms || typeof rooms !== 'object') {return [];}
+  const out: FailedMessagePayload[] = [];
+  for (const [jid, room] of Object.entries(rooms)) {
+    const messages = Array.isArray(room?.messages) ? room.messages : [];
+    for (const message of messages) {
+      if (!message || !message.pending) {continue;}
+      if (alreadyFailed && alreadyFailed[message.id]) {continue;}
+      const payload = reconstructFailedMessagePayload(message, jid);
+      if (payload) {out.push(payload);}
+    }
+  }
+  return out;
+}
+
 let writeTimer: ReturnType<typeof setTimeout> | null = null;
 
 /**
@@ -194,6 +370,7 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
   const type: string = action?.type || '';
   if (
     !type.startsWith('roomMessages/') &&
+    !type.startsWith('roomHeapStore/') &&
     !type.startsWith('chat/setUser') &&
     !type.startsWith('chat/updateUser') &&
     !type.startsWith('chat/refreshTokens') &&
@@ -213,13 +390,20 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
         const roomsPayload: PersistedRoomsState = {
           rooms: sanitizeRooms(state.rooms?.rooms || {}),
         };
-        const [chatCipher, roomsCipher] = await Promise.all([
+        const heapPayload: PersistedHeapState = {
+          failedMessages: sanitizeFailedMessages(
+            state.roomHeapSlice?.failedMessages
+          ),
+        };
+        const [chatCipher, roomsCipher, heapCipher] = await Promise.all([
           encryptForPersist(JSON.stringify(chatPayload)),
           encryptForPersist(JSON.stringify(roomsPayload)),
+          encryptForPersist(JSON.stringify(heapPayload)),
         ]);
         await AsyncStorage.multiSet([
           [KEY_CHAT, chatCipher],
           [KEY_ROOMS, roomsCipher],
+          [KEY_HEAP, heapCipher],
         ]);
       } catch (e) {
         console.warn('persist write failed', e);
@@ -238,15 +422,18 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
 export async function readPersistedState(): Promise<{
   chat: PersistedChatState | null;
   rooms: PersistedRoomsState | null;
+  heap: PersistedHeapState | null;
 }> {
   try {
-    const [chatRaw, roomsRaw] = await AsyncStorage.multiGet([
+    const [chatRaw, roomsRaw, heapRaw] = await AsyncStorage.multiGet([
       KEY_CHAT,
       KEY_ROOMS,
+      KEY_HEAP,
     ]);
-    const [chatPlain, roomsPlain] = await Promise.all([
+    const [chatPlain, roomsPlain, heapPlain] = await Promise.all([
       chatRaw[1] ? decryptFromPersist(chatRaw[1]) : Promise.resolve(null),
       roomsRaw[1] ? decryptFromPersist(roomsRaw[1]) : Promise.resolve(null),
+      heapRaw[1] ? decryptFromPersist(heapRaw[1]) : Promise.resolve(null),
     ]);
     // `decryptFromPersist` returns null both for "nothing stored" and
     // for "stored value isn't a valid envelope for the current key" —
@@ -257,19 +444,22 @@ export async function readPersistedState(): Promise<{
     const rooms = roomsPlain
       ? (JSON.parse(roomsPlain) as PersistedRoomsState)
       : null;
-    return { chat, rooms };
+    const heap = heapPlain
+      ? (JSON.parse(heapPlain) as PersistedHeapState)
+      : null;
+    return { chat, rooms, heap };
   } catch (e) {
     console.warn('persist read failed', e);
-    return { chat: null, rooms: null };
+    return { chat: null, rooms: null, heap: null };
   }
 }
 
 export async function clearPersistedState(): Promise<void> {
   try {
-    await AsyncStorage.multiRemove([KEY_CHAT, KEY_ROOMS]);
+    await AsyncStorage.multiRemove([KEY_CHAT, KEY_ROOMS, KEY_HEAP]);
   } catch (e) {
     console.warn('persist clear failed', e);
   }
 }
 
-export const PERSIST_KEYS = { KEY_CHAT, KEY_ROOMS };
+export const PERSIST_KEYS = { KEY_CHAT, KEY_ROOMS, KEY_HEAP };

package/src/roomStore/roomsSlice.ts

@@ -142,7 +142,6 @@ function mergeHistoryIntoCache(
   const ex = stripCallSignals(existing);
   const fe = stripCallSignals(fetched);
 
-  const pending = ex.filter((m) => m?.pending);
   const realExisting = ex.filter(
     (m) => m && !m.pending && m.id !== 'delimiter-new'
   );
@@ -151,6 +150,29 @@ function mergeHistoryIntoCache(
   // Nothing usable came back → keep the cache exactly as it was.
   if (realFetched.length === 0) {return ex;}
 
+  // Optimistic sends are preserved across a history merge - EXCEPT the
+  // ones the fetched page proves the server already has. That happens
+  // whenever a send reached the server but its echo did not reach us
+  // before the process died: the optimistic bubble is restored from disk
+  // still `pending: true` (and, since bug #39, flagged failed at boot),
+  // while MAM hands back the very same message under its ARCHIVE id.
+  // Keying only on `id` never matched those two, so the room ended up
+  // showing the message twice - once for real and once as a bubble stuck
+  // on "sending…"/"Failed" that nothing could ever clear. The archived
+  // copy carries our original stanza id as `xmppId` (getDataFromXml), so
+  // match on that too and drop the local ghost.
+  const fetchedKeys = new Set<string>();
+  for (const m of realFetched) {
+    if (m?.id != null) {fetchedKeys.add(String(m.id));}
+    if ((m as any)?.xmppId) {fetchedKeys.add(String((m as any).xmppId));}
+  }
+  const pending = ex.filter(
+    (m) =>
+      m?.pending &&
+      !fetchedKeys.has(String(m.id)) &&
+      !(m.xmppId && fetchedKeys.has(String(m.xmppId)))
+  );
+
   const byMs = (a: IMessage, b: IMessage) =>
     msgSortableMs(a) - msgSortableMs(b);
   const capTail = (arr: IMessage[]) =>
@@ -580,7 +602,19 @@ const reducers = {
      *
      * Monotonic: a marker only ever moves a baseline FORWARD, so a stale
      * server value can't resurrect already-read messages and a more-recent
-     * local read (tab blur stamping Date.now()) always wins.
+     * local read (tab blur stamping the server read timestamp) always wins.
+     *
+     * Bug #38 self-heal: forward-only is correct for a SANE existing
+     * value, but a device whose clock was ahead may have already stamped
+     * a marker in the future (either persisted locally from a previous
+     * session, or fetched from the server before this fix existed). To
+     * "only ever move forward" from a corrupt future value is to never
+     * move at all - the room would stay stuck at `unreadMessages: 0`
+     * forever. When the room is loaded, detect a marker that sits well
+     * past the newest message we actually know it has and waive the
+     * forward-only check for that one comparison, so the incoming
+     * (already-clamped, see xmppClient.getChatsPrivateStoreRequestStanza)
+     * value can correct it even though it's numerically smaller.
      */
     applyPrivateStoreMarkers: (
       state: WritableDraft<RoomMessagesState>,
@@ -592,15 +626,34 @@ const reducers = {
       for (const jid of Object.keys(markers)) {
         const ts = Number(markers[jid]);
         if (!jid || !Number.isFinite(ts) || ts <= 0) {continue;}
+
+        const room = state.rooms[jid];
+        const newestKnownMs = room ? newestAckedMessageMs(room.messages) : 0;
+        // Mirrors isCorruptFutureReadMarker in helpers/getServerReadTimestamp.ts
+        // (duplicated to avoid a roomStore <-> helpers import cycle):
+        // BOTH signals are required. "Further ahead than the newest
+        // message this room has locally" happens all the time on a room
+        // whose history hasn't synced yet, and healing on that alone
+        // would drop a legitimate marker another device wrote after
+        // reading newer messages. A real read marker can never be ahead
+        // of real time, so that second signal is what distinguishes a
+        // stale cache from a wrong clock.
+        const nowMs = Date.now();
+        const looksCorrupt = (existing: number) =>
+          newestKnownMs > 0 &&
+          existing > newestKnownMs + FUTURE_MARKER_TOLERANCE_MS &&
+          existing > nowMs + FUTURE_MARKER_TOLERANCE_MS;
+
         // Remember the marker so rooms that load LATER (via addRoom)
         // inherit it even though they don't exist in the store yet.
-        if (ts > (state.privateStoreMarkers[jid] || 0)) {
+        const cachedMarker = state.privateStoreMarkers[jid] || 0;
+        if (ts > cachedMarker || looksCorrupt(cachedMarker)) {
           state.privateStoreMarkers[jid] = ts;
         }
         // Upgrade an already-loaded room's baseline + recompute its badge.
-        // Only ever forward, so a later local read isn't clobbered.
-        const room = state.rooms[jid];
-        if (room && ts > (room.lastViewedTimestamp || 0)) {
+        // Forward-only, unless the room's CURRENT baseline is itself the
+        // corrupt value being corrected.
+        if (room && (ts > (room.lastViewedTimestamp || 0) || looksCorrupt(room.lastViewedTimestamp || 0))) {
           room.lastViewedTimestamp = ts;
           room.unreadMessages = countNewerMessages(room.messages, ts);
         }
@@ -872,6 +925,31 @@ const isOwn = (
   return false;
 };
 
+// Bug #38 tolerance: a stored read marker more than this far past the
+// newest message a room actually has is not "the user is a little
+// ahead" - it's a leftover from a device whose clock was wrong when it
+// stamped the marker. Kept in sync with (but duplicated from, to avoid
+// a roomStore ↔ helpers import cycle) FUTURE_READ_MARKER_TOLERANCE_MS
+// in helpers/getServerReadTimestamp.ts.
+const FUTURE_MARKER_TOLERANCE_MS = 5 * 60 * 1000;
+
+// Newest message in `messages` this room actually has proof the server
+// accepted - used only to sanity-check an already-stored read marker
+// against reality (see applyPrivateStoreMarkers's self-heal). Excludes
+// pending/optimistic sends via the `pending` flag alone: unlike
+// getServerReadTimestamp, this runs inside a reducer and can't reach
+// across to the roomHeapSlice slice, but `pending` already identifies
+// every optimistic send that matters for this comparison.
+const newestAckedMessageMs = (messages: IMessage[] | undefined): number => {
+  let newest = 0;
+  for (const m of messages || []) {
+    if (!m || m.id === 'delimiter-new' || m.pending) {continue;}
+    const ms = msgSortableMs(m);
+    if (ms > newest) {newest = ms;}
+  }
+  return newest;
+};
+
 const countNewerMessages = (
   messages: IMessage[],
   timestamp: number,