@openora/core 0.4.1-canary.111 → 0.4.1-canary.113

package/dist/engagement/chat/__tests__/chat.service.int.test.js

@@ -18,7 +18,7 @@ import { migrate } from '../migrate.js';
 //   NO_CLIENT_META,
 // } from '../../../testing/mock.js';
 import { chatChannel } from '@openora/core/contracts';
-import { ChatService, ChatMessageBlockedError, ChatSelfBlockError, ChatSelfIgnoreError, ChatRoomSlugConflictError, ChatRoomJoinCodeNotFoundError, ChatRoomBannedError, ChatRoomLimitReachedError, ChatRoomLastModeratorError, ChatRoomNotMemberError, ChatRoomNotModeratorError, ChatRoomSelfModerationError, ChatRoomOwnershipError, } from '../service/chat.service.js';
+import { ChatService, ChatMessageBlockedError, ChatAttachmentRejectedError, ChatSelfBlockError, ChatSelfIgnoreError, ChatRoomSlugConflictError, ChatRoomJoinCodeNotFoundError, ChatRoomBannedError, ChatRoomLimitReachedError, ChatRoomLastModeratorError, ChatRoomNotMemberError, ChatRoomNotModeratorError, ChatRoomSelfModerationError, ChatRoomOwnershipError, } from '../service/chat.service.js';
 import { ChatModerationService, ChatRoomNotFoundError, ChatMessageNotFoundError, ChatPlayerMutedError, ChatPlayerBannedError, ChatAdminPrivateRoomModerationError, } from '../service/chat-moderation.service.js';
 import { chatMessage, chatRoom, chatRoomMember, chatRoomBan, chatRoomRule, chatRoomConfiguration, chatRoomMute, chatRoomRemove, chatUserBlock, chatUserIgnore, chatMute, chatPlatformBan, } from '../schema/index.js';
 import { ChatRoomMembershipService } from '../service/chat-room-membership.service.js';
@@ -35,7 +35,7 @@ function makeService(directory = mock({
         isActive: true,
         role: 'player',
     })),
-}), socialCommands) {
+}), socialCommands, allowedAttachmentHosts = []) {
     const transport = new InProcessRealtimeTransport();
     const events = makeEventBus();
     const audit = mock({
@@ -44,7 +44,17 @@ function makeService(directory = mock({
     });
     const moderation = new ChatModerationService(db.drizzle, transport, audit);
     const identityReader = makeIdentityReader();
-    const chatService = new ChatService(db.drizzle, events, transport, directory, audit, moderation, identityReader, socialCommands);
+    const chatService = new ChatService({
+        drizzle: db.drizzle,
+        events,
+        transport,
+        directory,
+        audit,
+        moderation,
+        identityReader,
+        allowedAttachmentHosts,
+        socialCommands,
+    });
     const membership = new ChatRoomMembershipService(db.drizzle, events, audit, transport, identityReader);
     const roomBan = new ChatRoomBanService(db.drizzle, events, audit, transport, identityReader);
     const roomMute = new ChatRoomMuteService(db.drizzle, audit);
@@ -128,6 +138,7 @@ describe('ChatService realtime wiring', () => {
         content: 'hi',
         type: 'user',
         metadata: null,
+        attachment: null,
         isDeleted: false,
         createdAt: '2026-05-29T00:00:00.000Z',
     };
@@ -188,6 +199,7 @@ describe('ChatService.subscribeMessages per-viewer block filtering (real PG)', (
         content: 'hi',
         type: 'user',
         metadata: null,
+        attachment: null,
         isDeleted: false,
         createdAt: '2026-05-29T00:00:00.000Z',
     };
@@ -240,7 +252,11 @@ describe('ChatService.sendGlobalMessage (real PG)', () => {
     it('stores the username from the verified user, ignoring the header fallback', async () => {
         const { svc, events } = makeService();
         const account = await seedUser(db, { name: 'Platform Admin', username: 'platform_admin' });
-        const msg = await svc.sendGlobalMessage(account.id, 'spoofed-header-name', 'hi');
+        const msg = await svc.sendGlobalMessage({
+            userId: account.id,
+            username: 'spoofed-header-name',
+            content: 'hi',
+        });
         expect(msg.username).toBe('platform_admin');
         const [stored] = await db.drizzle.db.select().from(chatMessage);
         expect(stored).toMatchObject({ roomId: null, username: 'platform_admin' });
@@ -253,20 +269,24 @@ describe('ChatService.sendGlobalMessage (real PG)', () => {
     it('falls back to the passed name, then anonymous, when no user row exists', async () => {
         const { svc } = makeService();
         const userId = randomUUID();
-        expect((await svc.sendGlobalMessage(userId, 'fallback', 'hi')).username).toBe('fallback');
-        expect((await svc.sendGlobalMessage(userId, '', 'hi')).username).toBe('anonymous');
+        expect((await svc.sendGlobalMessage({ userId, username: 'fallback', content: 'hi' })).username).toBe('fallback');
+        expect((await svc.sendGlobalMessage({ userId, username: '', content: 'hi' })).username).toBe('anonymous');
     });
     it('blocks profane messages before they are stored or published', async () => {
         const { svc, transport } = makeService();
         const delivered = [];
         transport.subscribe('chat:global', (m) => delivered.push(m));
-        await expect(svc.sendGlobalMessage(randomUUID(), 'Alice', 'this is shit')).rejects.toThrow(ChatMessageBlockedError);
+        await expect(svc.sendGlobalMessage({ userId: randomUUID(), username: 'Alice', content: 'this is shit' })).rejects.toThrow(ChatMessageBlockedError);
         expect(delivered).toHaveLength(0);
         expect(await db.drizzle.db.select().from(chatMessage)).toHaveLength(0);
     });
     it('persists URL-sanitized content', async () => {
         const { svc } = makeService();
-        const msg = await svc.sendGlobalMessage(randomUUID(), 'Alice', 'click javascript:alert(1)');
+        const msg = await svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'Alice',
+            content: 'click javascript:alert(1)',
+        });
         expect(msg.content).toBe('click javascript alert(1)');
         const [stored] = await db.drizzle.db.select().from(chatMessage);
         expect(stored?.content).toBe('click javascript alert(1)');
@@ -275,9 +295,60 @@ describe('ChatService.sendGlobalMessage (real PG)', () => {
         const { svc, transport } = makeService();
         const delivered = [];
         transport.subscribe('chat:global', (m) => delivered.push(m));
-        const msg = await svc.sendGlobalMessage(randomUUID(), 'Alice', 'hello');
+        const msg = await svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'Alice',
+            content: 'hello',
+        });
         expect(delivered.map((m) => m.id)).toEqual([msg.id]);
     });
+    it('persists an attachment whose host is on the allow-list and publishes it', async () => {
+        const { svc, transport } = makeService(undefined, undefined, ['media.example.com']);
+        const delivered = [];
+        transport.subscribe('chat:global', (m) => delivered.push(m));
+        const attachment = {
+            kind: 'gif',
+            provider: 'example',
+            externalId: 'abc123',
+            url: 'https://media.example.com/abc123.gif',
+            previewUrl: 'https://media.example.com/abc123-preview.gif',
+            width: 320,
+            height: 240,
+            title: 'a gif',
+        };
+        const msg = await svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'Alice',
+            content: '',
+            attachment,
+        });
+        expect(msg.type).toBe('user');
+        if (msg.type === 'user') {
+            expect(msg.attachment).toEqual(attachment);
+        }
+        const [stored] = await db.drizzle.db.select().from(chatMessage);
+        expect(stored?.attachment).toEqual(attachment);
+        expect(delivered.map((m) => m.id)).toEqual([msg.id]);
+    });
+    it('rejects an attachment whose host is not on the allow-list', async () => {
+        const { svc } = makeService(undefined, undefined, ['media.example.com']);
+        await expect(svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'Alice',
+            content: '',
+            attachment: {
+                kind: 'gif',
+                provider: 'example',
+                externalId: 'abc123',
+                url: 'https://evil.example.net/abc123.gif',
+                previewUrl: 'https://evil.example.net/abc123-preview.gif',
+                width: 320,
+                height: 240,
+                title: 'a gif',
+            },
+        })).rejects.toThrow(ChatAttachmentRejectedError);
+        expect(await db.drizzle.db.select().from(chatMessage)).toHaveLength(0);
+    });
 });
 describe('ChatService message reads (real PG)', () => {
     it('returns global messages newest-first, excluding soft-deleted ones', async () => {
@@ -362,6 +433,176 @@ describe('ChatService.sendRoomMessage (real PG)', () => {
         })).rejects.toBeInstanceOf(ChatRoomNotMemberError);
         expect(await db.drizzle.db.select().from(chatMessage)).toHaveLength(0);
     });
+    it('persists an attachment whose host is on the allow-list and publishes it', async () => {
+        const { svc, transport } = makeService(undefined, undefined, ['media.example.com']);
+        const room = await seedRoom();
+        const account = await seedUser(db, { name: 'Alice', username: 'alice' });
+        const delivered = [];
+        transport.subscribe(chatChannel(room.id), (m) => delivered.push(m));
+        const attachment = {
+            kind: 'gif',
+            provider: 'example',
+            externalId: 'abc123',
+            url: 'https://media.example.com/abc123.gif',
+            previewUrl: 'https://media.example.com/abc123-preview.gif',
+            width: 320,
+            height: 240,
+            title: 'a gif',
+        };
+        const msg = await svc.sendRoomMessage({
+            userId: account.id,
+            username: 'ignored',
+            roomId: room.id,
+            content: '',
+            attachment,
+        });
+        expect(msg.type).toBe('user');
+        if (msg.type === 'user') {
+            expect(msg.attachment).toEqual(attachment);
+        }
+        const [stored] = await db.drizzle.db.select().from(chatMessage);
+        expect(stored?.attachment).toEqual(attachment);
+        expect(delivered.map((m) => m.id)).toEqual([msg.id]);
+    });
+    it('rejects an attachment whose host is not on the allow-list', async () => {
+        const { svc } = makeService(undefined, undefined, ['media.example.com']);
+        const room = await seedRoom();
+        const account = await seedUser(db, { name: 'Alice', username: 'alice' });
+        await expect(svc.sendRoomMessage({
+            userId: account.id,
+            username: 'ignored',
+            roomId: room.id,
+            content: '',
+            attachment: {
+                kind: 'gif',
+                provider: 'example',
+                externalId: 'abc123',
+                url: 'https://evil.example.net/abc123.gif',
+                previewUrl: 'https://evil.example.net/abc123-preview.gif',
+                width: 320,
+                height: 240,
+                title: 'a gif',
+            },
+        })).rejects.toThrow(ChatAttachmentRejectedError);
+        expect(await db.drizzle.db.select().from(chatMessage)).toHaveLength(0);
+    });
+});
+describe('ChatService @mention detection (real PG)', () => {
+    function mentionDirectory(summaries) {
+        return mock({
+            lookupPlayers: async () => [],
+            getPlayerByUsername: vi
+                .fn()
+                .mockImplementation((username) => Promise.resolve(summaries.find((s) => s.username.toLowerCase() === username.toLowerCase()) ?? null)),
+        });
+    }
+    function summaryFor(userId, username) {
+        return {
+            playerId: randomUUID(),
+            userId,
+            username,
+            email: `${username}@example.com`,
+            kycStatus: null,
+            language: null,
+            avatarUrl: null,
+            createdAt: new Date(),
+            level: 1,
+            currency: 'USD',
+        };
+    }
+    it('resolves an @username in a room message and emits chat.user.mentioned', async () => {
+        const bobId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(bobId, 'bob')]));
+        const room = await seedRoom();
+        const msg = await svc.sendRoomMessage({
+            userId: randomUUID(),
+            username: 'alice',
+            roomId: room.id,
+            content: 'hello @bob, welcome',
+        });
+        await waitFor(() => vi.mocked(events.emit).mock.calls.some(([topic]) => topic === 'chat.user.mentioned'));
+        expect(events.emit).toHaveBeenCalledWith('chat.user.mentioned', {
+            mentionedUserId: bobId,
+            byUserId: msg.userId,
+            roomId: room.id,
+            messageId: msg.id,
+        });
+    });
+    it('resolves an @username in a global message with a null roomId', async () => {
+        const bobId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(bobId, 'bob')]));
+        const authorId = randomUUID();
+        const msg = await svc.sendGlobalMessage({
+            userId: authorId,
+            username: 'alice',
+            content: 'hey @bob',
+        });
+        await waitFor(() => vi.mocked(events.emit).mock.calls.some(([topic]) => topic === 'chat.user.mentioned'));
+        expect(events.emit).toHaveBeenCalledWith('chat.user.mentioned', {
+            mentionedUserId: bobId,
+            byUserId: authorId,
+            roomId: null,
+            messageId: msg.id,
+        });
+    });
+    it('excludes a self-mention', async () => {
+        const authorId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(authorId, 'alice')]));
+        await svc.sendGlobalMessage({
+            userId: authorId,
+            username: 'alice',
+            content: 'talking to myself @alice',
+        });
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        expect(events.emit).not.toHaveBeenCalledWith('chat.user.mentioned', expect.anything());
+    });
+    it('emits once per uniquely mentioned user even when repeated in the message', async () => {
+        const bobId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(bobId, 'bob')]));
+        await svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'alice',
+            content: '@bob @bob are you there @Bob?',
+        });
+        await waitFor(() => vi.mocked(events.emit).mock.calls.some(([topic]) => topic === 'chat.user.mentioned'));
+        const mentionCalls = vi
+            .mocked(events.emit)
+            .mock.calls.filter(([topic]) => topic === 'chat.user.mentioned');
+        expect(mentionCalls).toHaveLength(1);
+    });
+    it('silently drops an @token that does not resolve to a known username', async () => {
+        const { svc, events } = makeService(mentionDirectory([]));
+        await expect(svc.sendGlobalMessage({ userId: randomUUID(), username: 'alice', content: 'hello @nobody' })).resolves.toBeDefined();
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        expect(events.emit).not.toHaveBeenCalledWith('chat.user.mentioned', expect.anything());
+    });
+    it('does not treat the domain part of an email address as a mention', async () => {
+        const acmeId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(acmeId, 'acme')]));
+        await expect(svc.sendGlobalMessage({
+            userId: randomUUID(),
+            username: 'alice',
+            content: 'contact me at info@acme.com',
+        })).resolves.toBeDefined();
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        expect(events.emit).not.toHaveBeenCalledWith('chat.user.mentioned', expect.anything());
+    });
+    it('does not emit chat.user.mentioned when the mentioned user has blocked the sender', async () => {
+        const bobId = randomUUID();
+        const authorId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor(bobId, 'bob')]));
+        await svc.blockUser(bobId, authorId);
+        await svc.sendGlobalMessage({ userId: authorId, username: 'alice', content: 'hello @bob' });
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        expect(events.emit).not.toHaveBeenCalledWith('chat.user.mentioned', expect.anything());
+    });
+    it('fails closed (does not emit) when the block check throws', async () => {
+        const authorId = randomUUID();
+        const { svc, events } = makeService(mentionDirectory([summaryFor('not-a-valid-uuid', 'bob')]));
+        await expect(svc.sendGlobalMessage({ userId: authorId, username: 'alice', content: 'hello @bob' })).resolves.toBeDefined();
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        expect(events.emit).not.toHaveBeenCalledWith('chat.user.mentioned', expect.anything());
+    });
 });
 describe('ChatService.deleteMessage (real PG)', () => {
     it('soft-deletes a message for a room owner and publishes a tombstone', async () => {
@@ -1200,7 +1441,7 @@ describe('ChatService moderation (real PG)', () => {
             roomId: globalRoom.id,
             readOnlyMode: true,
         });
-        await expect(svc.sendGlobalMessage(randomUUID(), 'ReadOnly', 'hello')).rejects.toBeInstanceOf(ChatPlayerMutedError);
+        await expect(svc.sendGlobalMessage({ userId: randomUUID(), username: 'ReadOnly', content: 'hello' })).rejects.toBeInstanceOf(ChatPlayerMutedError);
     });
     it.each(['__all_public', '__all'])('enforces %s mutes on global sends', async (scope) => {
         const { svc, moderation } = makeService();
@@ -1213,7 +1454,7 @@ describe('ChatService moderation (real PG)', () => {
             ...NO_CLIENT_META,
         });
         const [mute] = await db.drizzle.db.select().from(chatMute).limit(1);
-        await expect(svc.sendGlobalMessage(mute.userId, 'Muted', 'hello')).rejects.toBeInstanceOf(ChatPlayerMutedError);
+        await expect(svc.sendGlobalMessage({ userId: mute.userId, username: 'Muted', content: 'hello' })).rejects.toBeInstanceOf(ChatPlayerMutedError);
     });
     it('supports a global mute when the virtual global room has no row', async () => {
         const { svc, moderation } = makeService();
@@ -1226,7 +1467,7 @@ describe('ChatService moderation (real PG)', () => {
             actorId: randomUUID(),
             ...NO_CLIENT_META,
         })).resolves.toEqual({ success: true });
-        await expect(svc.sendGlobalMessage(userId, 'Muted', 'hello')).rejects.toBeInstanceOf(ChatPlayerMutedError);
+        await expect(svc.sendGlobalMessage({ userId, username: 'Muted', content: 'hello' })).rejects.toBeInstanceOf(ChatPlayerMutedError);
     });
     it('enforces an all-chat mute in private rooms', async () => {
         const { svc, moderation } = makeService();
@@ -1278,7 +1519,7 @@ describe('ChatService moderation (real PG)', () => {
             actorId: randomUUID(),
             ...NO_CLIENT_META,
         });
-        await expect(svc.sendGlobalMessage(userId, 'Banned', 'hello')).rejects.toBeInstanceOf(ChatPlayerBannedError);
+        await expect(svc.sendGlobalMessage({ userId, username: 'Banned', content: 'hello' })).rejects.toBeInstanceOf(ChatPlayerBannedError);
         await expect(svc.sendRoomMessage({ userId, username: 'Banned', roomId: room.id, content: 'hello' })).resolves.toMatchObject({ userId });
         await moderation.unban({
             userId,
@@ -1286,7 +1527,7 @@ describe('ChatService moderation (real PG)', () => {
             actorId: randomUUID(),
             ...NO_CLIENT_META,
         });
-        await expect(svc.sendGlobalMessage(userId, 'Banned', 'hello')).resolves.toMatchObject({
+        await expect(svc.sendGlobalMessage({ userId, username: 'Banned', content: 'hello' })).resolves.toMatchObject({
             userId,
         });
     });