domma-cms 1.8.32 → 1.8.34

package/plugins/messages/tests/call.test.js

@@ -0,0 +1,497 @@
+/**
+ * Calls in a conversation (1.4): the join links, who may join, and the
+ * "started / ended" lines - against the real CMS collection service and the
+ * real call engine (_lib/call). Snapshots and restores the tracked
+ * user-messages / user-message-threads data files, as api.test.js does.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import Fastify from 'fastify';
+import messagesPlugin from '../plugin.js';
+import {checkInvite, checkJoin, inviteLink, joinLink, LINK_TTL_MS, loadSecret, RING_MS, signJoin, whoIsCalling} from '../lib/call.js';
+import {registerDirectMessenger, unregisterDirectMessenger} from '../../../server/services/hooks.js';
+import {buildBubbles, callButton, callGroupName, callTarget, ringingCalls} from '../admin/lib/messages.js';
+
+const FILES = ['user-messages', 'user-message-threads'].map(s => path.resolve('content', 'collections', s, 'data.json'));
+const saved = {};
+const ID = {};
+const made = [];
+const notices = [];
+const resolved = [];
+let app, dataDir, calls, base;
+
+before(async () => {
+    for (const f of FILES) saved[f] = await fs.readFile(f, 'utf8').catch(() => null);
+    dataDir = await fs.mkdtemp(path.join(os.tmpdir(), 'msg-call-'));
+    const {createUser} = await import('../../../server/services/users.js');
+    await (await import('../../../server/services/roles.js')).load();
+    const tag = Math.random().toString(36).slice(2, 7);
+    for (const k of ['a', 'b', 'c']) {
+        const u = await createUser({name: `Caller ${k} ${tag}`, email: `ct-${k}-${tag}@example.test`, password: 'password123', role: 'user'});
+        ID[k] = u.id; made.push(u.id);
+    }
+    app = Fastify();
+    const authenticate = async (req) => { req.user = {id: req.headers['x-test-user'] || ID.a, role: 'user'}; };
+    const hooks = {
+        notify: (p) => { notices.push(p); },
+        resolveNotification: (key, source) => { resolved.push([key, source]); },
+        registerNotificationSource: () => {},
+        // 1.7: Messages is core's direct messenger (a call's "Add people" in any Tool).
+        registerDirectMessenger: (fn) => registerDirectMessenger('messages', fn)
+    };
+    await app.register(messagesPlugin, {auth: {authenticate, requireAdmin: async () => {}}, settings: {}, hooks, dataDir,
+        callSweepMs: 1e9, onCalls: (c) => { calls = c; }});
+    await app.listen({port: 0, host: '127.0.0.1'});
+    base = `http://127.0.0.1:${app.server.address().port}`;
+});
+
+after(async () => {
+    unregisterDirectMessenger('messages');
+    await app?.close();
+    const {deleteUser} = await import('../../../server/services/users.js');
+    for (const id of made) await deleteUser(id).catch(() => {});
+    for (const f of FILES) {
+        if (saved[f] === null) await fs.rm(f, {force: true});
+        else await fs.writeFile(f, saved[f]);
+    }
+    await fs.rm(dataDir, {recursive: true, force: true});
+});
+
+const as = (user) => async (method, url, body, headers = {}) => {
+    const res = await app.inject({method, url, payload: body, headers: {'x-test-user': user, ...headers}});
+    return {status: res.statusCode, body: res.body ? JSON.parse(res.body) : null, headers: res.headers};
+};
+const A = (...a) => as(ID.a)(...a);
+const B = (...a) => as(ID.b)(...a);
+const C = (...a) => as(ID.c)(...a);
+const credFrom = (url) => Object.fromEntries(new URL(url, 'http://x').searchParams);
+const roomOf = (url) => decodeURIComponent(new URL(url, 'http://x').pathname.split('/').pop());
+const callLines = async (threadId) => (await A('GET', `/threads/${threadId}/messages`)).body.filter(m => m.kind === 'call');
+
+/** Listen on a user's event stream; returns the events seen so far and a stop(). */
+function listen(userId) {
+    const events = [];
+    const req = http.get(`${base}/stream`, {headers: {'x-test-user': userId}});
+    let buf = '';
+    req.on('response', (res) => res.on('data', (chunk) => {
+        buf += chunk;
+        let at;
+        while ((at = buf.indexOf('\n\n')) >= 0) {
+            const block = buf.slice(0, at);
+            buf = buf.slice(at + 2);
+            const ev = /^event: (.+)$/m.exec(block)?.[1];
+            const data = /^data: (.+)$/m.exec(block)?.[1];
+            if (ev) events.push({event: ev, data: data ? JSON.parse(data) : null});
+        }
+    }));
+    req.on('error', () => {});
+    return {events, stop: () => req.destroy()};
+}
+const settle = (ms = 150) => new Promise(r => setTimeout(r, ms));
+
+// ---- The link and the rule (pure) ------------------------------------------------
+
+test('the secret is made once and kept', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'msg-secret-'));
+    const s1 = loadSecret(dir);
+    assert.match(s1, /^[0-9a-f]{64}$/);
+    assert.equal(loadSecret(dir), s1, 'read back, not remade');
+    assert.equal((await fs.stat(path.join(dir, 'call-secret'))).mode & 0o777, 0o600);
+    await fs.rm(dir, {recursive: true, force: true});
+});
+
+test('a link names its thread, its person and its expiry; anything altered, stale or far-dated is refused', () => {
+    const secret = 'a'.repeat(64);
+    const now = Date.parse('2026-09-30T10:00:00Z');
+    const url = joinLink(secret, 'thread-1', 'user-1', now);
+    assert.match(url, /^\/messages-call\/thread-1\?u=user-1&x=\d+&s=[\w-]+$/);
+    const cred = credFrom(url);
+    assert.equal(Number(cred.x), now + LINK_TTL_MS);
+    assert.equal(checkJoin(secret, 'thread-1', cred, now), 'user-1');
+    assert.equal(checkJoin(secret, 'thread-1', cred, now + LINK_TTL_MS - 1), 'user-1');
+    assert.equal(checkJoin(secret, 'thread-1', cred, now + LINK_TTL_MS), null, 'expired');
+    assert.equal(checkJoin(secret, 'thread-2', cred, now), null, 'another conversation');
+    assert.equal(checkJoin(secret, 'thread-1', {...cred, u: 'user-2'}, now), null, 'another person');
+    assert.equal(checkJoin(secret, 'thread-1', {...cred, x: String(Number(cred.x) + 1)}, now), null, 'expiry moved');
+    assert.equal(checkJoin('b'.repeat(64), 'thread-1', cred, now), null, 'another site');
+    assert.equal(checkJoin(secret, 'thread-1', {...cred, s: cred.s.slice(1)}, now), null, 'signature cut');
+    const far = now + LINK_TTL_MS * 10;
+    assert.equal(checkJoin(secret, 'thread-1', {u: 'user-1', x: String(far), s: signJoin(secret, 'thread-1', 'user-1', far)}, now), null,
+        'a link dated further ahead than one is ever made (a leaked secret cannot mint forever-links unnoticed)');
+    assert.equal(checkJoin(secret, '../x', cred, now), null);
+    assert.equal(checkJoin(secret, 'thread-1', {}, now), null);
+});
+
+test('1.7: an invitation link is its own kind - signed for invite, not usable as a member link or the other way round', () => {
+    const secret = 'f'.repeat(64);
+    const now = Date.now();
+    const cred = Object.fromEntries(new URL(inviteLink(secret, 't1', 'u3', now), 'http://x').searchParams);
+    assert.equal(cred.i, '1');
+    assert.equal(checkInvite(secret, 't1', cred, now), 'u3');
+    assert.equal(checkJoin(secret, 't1', cred, now), null, 'not a member link');
+    const {i, ...plain} = cred;
+    assert.equal(checkJoin(secret, 't1', plain, now), null, 'dropping i= does not make it a member link');
+    const member = Object.fromEntries(new URL(joinLink(secret, 't1', 'u1', now), 'http://x').searchParams);
+    assert.equal(checkInvite(secret, 't1', {...member, i: '1'}, now), null, 'a member link is not an invitation');
+    assert.equal(checkInvite(secret, 't2', cred, now), null, 'another conversation');
+});
+
+test('whoIsCalling: members only, still active; straight in (no host, no waiting room), six at most, no recording', () => {
+    const t = {id: 't1', kind: 'group-adhoc', name: 'Team', participants: ['u1', 'u2']};
+    const who = whoIsCalling(t, {id: 'u1', name: 'Sam Patel'}, 'u1');
+    assert.deepEqual(who, {mayInvite: true, inviteExternal: false, title: 'Team', host: false, autoAdmit: true, name: 'Sam Patel', max: 6,
+        recordingAllowed: false, identity: 't1:u1'});
+    assert.equal(whoIsCalling(t, {id: 'u3', name: 'X'}, 'u3'), null, 'not in the conversation');
+    // 1.7: someone invited to the running call - let in, but may not add others.
+    const guest = whoIsCalling(t, {id: 'u3', name: 'Ola'}, 'u3', {}, {invited: true});
+    assert.equal(guest.autoAdmit, true);
+    assert.equal(guest.mayInvite, false);
+    assert.equal(guest.identity, 't1:u3');
+    assert.equal(whoIsCalling(t, {id: 'u1', name: 'X', disabled: true}, 'u1'), null, 'account switched off');
+    assert.equal(whoIsCalling(t, null, 'u1'), null, 'account gone');
+    assert.equal(whoIsCalling(null, {id: 'u1'}, 'u1'), null);
+    const dm = whoIsCalling({id: 'd', kind: 'dm', participants: ['u1', 'u2']}, {id: 'u1', name: 'Ann'}, 'u1', {u1: 'Ann', u2: 'Bob'});
+    assert.equal(dm.title, 'Call: Ann and Bob');
+});
+
+test('the screen: call lines, the Call button and the "is calling" notices', () => {
+    const msgs = [
+        {id: 'm1', kind: 'call', body: 'Sam started a call', senderId: 'u2', createdAt: '2026-09-30T10:00:00Z', call: {event: 'started'}},
+        {id: 'm2', body: 'hi', senderId: 'u2', createdAt: '2026-09-30T10:01:00Z'}
+    ];
+    const b = buildBubbles(msgs, {myId: 'u1', isGroup: true, nameOf: () => 'Sam', now: Date.parse('2026-09-30T12:00:00Z'), liveCallMessageId: 'm1'});
+    const line = b.find(x => x.id === 'm1');
+    assert.equal(line.isCall, true);
+    assert.equal(line.canJoin, true);
+    assert.match(line.callText, /^Sam started a call · \d\d:\d\d$/);
+    assert.equal(b.find(x => x.id === 'm2').showSender, true, 'the next message still says who sent it');
+    assert.equal(buildBubbles(msgs, {myId: 'u1'}).find(x => x.id === 'm1').canJoin, false, 'no Join once the call is over');
+
+    const people = (n) => Array.from({length: n}, (_, i) => ({id: `u${i}`}));
+    assert.equal(callButton({participants: people(2)}).label, 'Call');
+    assert.equal(callButton({participants: people(2), call: {byName: 'Sam', in: 2}}).label, 'Join call (2)');
+    assert.match(callButton({participants: people(7)}).title, /holds 6 people/);
+    assert.doesNotMatch(callButton({participants: people(6)}).title, /holds 6/);
+
+    const threads = [
+        {id: 't1', kind: 'dm', call: {by: 'u2', byName: 'Sam', startedAt: 'S1', in: 1}},
+        {id: 't2', kind: 'group-adhoc', name: 'Team', call: {by: 'u1', byName: 'Me', startedAt: 'S2'}},
+        {id: 't3', kind: 'group-adhoc', name: 'Old', archivedBy: ['u1'], call: {by: 'u2', startedAt: 'S3'}},
+        {id: 't4', kind: 'group-adhoc', name: 'Ops', call: null}
+    ];
+    const r = ringingCalls(threads, 'u1');
+    assert.deepEqual(r.map(x => x.id), ['t1'], 'not my own call, not archived, not without a call');
+    assert.equal(r[0].text, 'Sam is calling');
+    assert.equal(r[0].count, '1 person in');
+    assert.deepEqual(ringingCalls(threads, 'u1', ['t1|S1']), [], 'put aside');
+});
+
+// ---- Through the routes and the engine -------------------------------------------
+
+let threadId, urlA;
+
+test('Call posts one "started" line (not two while it runs), tells everyone live and raises a notice for the others', async () => {
+    const g = await A('POST', '/threads', {kind: 'group-adhoc', name: 'Standup', participants: [ID.b]});
+    assert.equal(g.status, 201);
+    threadId = g.body.id;
+    const streamB = listen(ID.b);
+    await settle();
+
+    const r = await A('POST', `/threads/${threadId}/call`);
+    assert.equal(r.status, 200);
+    urlA = r.body.url;
+    assert.equal(roomOf(urlA), threadId);
+    assert.equal(credFrom(urlA).u, ID.a);
+    assert.equal(r.body.call.by, ID.a);
+
+    const again = await A('POST', `/threads/${threadId}/call`);
+    const joinB = await B('POST', `/threads/${threadId}/call`);
+    assert.equal(again.status, 200);
+    assert.equal(credFrom(joinB.body.url).u, ID.b, "each person gets a link of their own");
+    assert.equal(joinB.body.call.by, ID.a, 'B joins the call A started');
+
+    const lines = await callLines(threadId);
+    assert.equal(lines.length, 1, 'one line, however many times Call is pressed');
+    assert.match(lines[0].body, /^Caller a .+ started a call$/);
+    assert.deepEqual([...lines[0].readBy].sort(), [ID.a, ID.b].sort(), 'a call line never counts as unread');
+    assert.equal((await B('GET', '/count')).body.count, 0);
+    assert.equal((await A('PUT', `/threads/${threadId}/messages/${lines[0].id}`, {body: 'x'})).status, 403, 'a call line cannot be edited');
+
+    await settle();
+    streamB.stop();
+    const started = streamB.events.filter(e => e.event === 'call:started');
+    assert.equal(started.length, 1);
+    assert.equal(started[0].data.threadId, threadId);
+    assert.equal(started[0].data.call.by, ID.a);
+    assert.ok(streamB.events.some(e => e.event === 'message:new' && e.data.message.kind === 'call'), 'the line arrives live too');
+
+    const n = notices.filter(p => p.dedupeKey === `call:${threadId}`);
+    assert.equal(n.length, 1);
+    assert.deepEqual(n[0].audience, {userIds: [ID.b]}, 'the others, not the caller');
+    assert.equal(n[0].source, 'calls');
+
+    const list = (await B('GET', '/threads')).body.find(t => t.id === threadId);
+    assert.equal(list.call.by, ID.a, 'the conversation list says a call is on');
+});
+
+test('the call routes are mounted: a link joins; a forged, stale or outsider link does not', async () => {
+    const join = (room, cred) => app.inject({method: 'POST', url: `/call/${encodeURIComponent(room)}/join`, payload: cred});
+    const ok = await join(threadId, credFrom(urlA));
+    assert.equal(ok.statusCode, 200, ok.body);
+    const joined = JSON.parse(ok.body);
+    assert.equal(joined.state, 'in', 'straight in - no waiting room');
+    assert.equal(joined.host, false, 'nobody is "(host)" - everyone is equal');
+    assert.match(joined.name, /^Caller a /);
+    assert.equal(joined.max, 6);
+    assert.equal(joined.recordingAllowed, false);
+
+    const secret = (await fs.readFile(path.join(dataDir, 'call-secret'), 'utf8')).trim();
+    const forged = {...credFrom(urlA), s: signJoin('f'.repeat(64), threadId, ID.a, credFrom(urlA).x)};
+    assert.equal((await join(threadId, forged)).statusCode, 404, 'forged');
+    const past = Date.now() - 1000;
+    assert.equal((await join(threadId, {u: ID.a, x: String(past), s: signJoin(secret, threadId, ID.a, past)})).statusCode, 404, 'expired');
+    // A properly signed link for someone NOT in the conversation (a member who left, say) is still refused.
+    assert.equal((await join(threadId, credFrom(joinLink(secret, threadId, ID.c)))).statusCode, 404, 'not a member');
+    assert.equal((await join('someone-elses-thread', credFrom(urlA))).statusCode, 404, 'a link for another room');
+    assert.equal((await C('POST', `/threads/${threadId}/call`)).status, 404, 'an outsider cannot get a link');
+
+    // The call page itself is served by plugin.public.js (checked in the browser); here, the engine counts A in.
+    assert.equal(calls.rooms.countRoom(threadId).in, 1);
+    await calls.sweep();
+    assert.equal((await A('GET', '/threads')).body.find(t => t.id === threadId).call.in, 1);
+
+    // B joins; both leave; the sweep writes "Call ended" and tells everyone.
+    const okB = JSON.parse((await join(threadId, credFrom((await B('POST', `/threads/${threadId}/call`)).body.url))).body);
+    assert.equal(calls.rooms.countRoom(threadId).in, 2);
+    const streamA = listen(ID.a);
+    await settle();
+    for (const p of [joined, okB]) {
+        const res = await app.inject({method: 'POST', url: `/call/${threadId}/leave`, headers: {'x-call-id': p.id, 'x-call-secret': p.secret}});
+        assert.equal(res.statusCode, 200);
+    }
+    await calls.sweep();
+    const lines = await callLines(threadId);
+    assert.equal(lines.length, 2);
+    assert.match(lines[1].body, /^Call ended \((under a minute|\d+ min)\)$/);
+    assert.equal(lines[1].call.event, 'ended');
+    assert.equal(calls.live.has(threadId), false);
+    assert.deepEqual(resolved.find(([k]) => k === `call:${threadId}`), [`call:${threadId}`, 'calls'], 'the notice goes when the call ends');
+    await settle();
+    streamA.stop();
+    assert.ok(streamA.events.some(e => e.event === 'call:ended' && e.data.threadId === threadId));
+    assert.equal((await A('GET', '/threads')).body.find(t => t.id === threadId).call, null);
+});
+
+test('a call nobody joins is given up after a while; joining later starts it again', async () => {
+    const r = await A('POST', `/threads/${threadId}/call`);
+    assert.equal(r.status, 200);
+    await calls.sweep(Date.now() + 60e3);
+    assert.equal(calls.live.has(threadId), true, 'still ringing a minute on');
+    await calls.sweep(Date.now() + RING_MS + 1000);
+    assert.equal(calls.live.has(threadId), false);
+    const lines = await callLines(threadId);
+    assert.equal(lines.at(-1).body, 'Call ended - nobody joined');
+
+    // The two-hour link still works: joining starts a new call (and says so).
+    const res = await app.inject({method: 'POST', url: `/call/${threadId}/join`, payload: credFrom(r.body.url)});
+    assert.equal(res.statusCode, 200);
+    assert.equal(calls.live.has(threadId), true);
+    assert.match((await callLines(threadId)).at(-1).body, /started a call$/);
+    const p = JSON.parse(res.body);
+    await app.inject({method: 'POST', url: `/call/${threadId}/leave`, headers: {'x-call-id': p.id, 'x-call-secret': p.secret}});
+    await calls.sweep();
+    assert.match((await callLines(threadId)).at(-1).body, /^Call ended/);
+});
+
+test('two people pressing Call at once start ONE call', async () => {
+    const startedCount = async () => (await callLines(threadId)).filter(m => m.call?.event === 'started').length;
+    const before = await startedCount();
+    const [ra, rb] = await Promise.all([A('POST', `/threads/${threadId}/call`), B('POST', `/threads/${threadId}/call`)]);
+    assert.equal(await startedCount(), before + 1);
+    assert.equal(ra.body.call.startedAt, rb.body.call.startedAt);
+    await calls.sweep(Date.now() + RING_MS + 1000);
+});
+
+test('1.6: chat typed in the call is posted into the conversation once, from its sender; a reopened call shows it', async () => {
+    await calls.sweep(Date.now() + RING_MS + 1000);
+    const join = async (url) => JSON.parse((await app.inject({method: 'POST', url: `/call/${threadId}/join`, payload: credFrom(url)})).body);
+    const say = (p, text) => app.inject({method: 'POST', url: `/call/${threadId}/chat`, headers: {'x-call-id': p.id, 'x-call-secret': p.secret}, payload: {text}});
+    const leave = (p) => app.inject({method: 'POST', url: `/call/${threadId}/leave`, headers: {'x-call-id': p.id, 'x-call-secret': p.secret}});
+    const callMsgs = async (who = A) => (await who('GET', `/threads/${threadId}/messages?limit=200`)).body.filter(m => m.callChat);
+    const before = (await callMsgs()).length;
+    const streamB = listen(ID.b);
+    try {
+    await settle();
+
+    const a = await join((await A('POST', `/threads/${threadId}/call`)).body.url);
+    assert.equal((await say(a, 'Only me here')).statusCode, 200);
+    const b = await join((await B('POST', `/threads/${threadId}/call`)).body.url);
+    assert.equal((await say(a, 'Hello B')).statusCode, 200);
+    assert.equal((await say(b, 'Hi A <3')).statusCode, 200);
+
+    const got = (await callMsgs()).slice(before);
+    assert.deepEqual(got.map(m => [m.senderId, m.body]), [[ID.a, 'Only me here'], [ID.a, 'Hello B'], [ID.b, 'Hi A <3']], 'each line once, from its sender');
+    assert.deepEqual(got[0].readBy, [ID.a], 'B was not in the call yet: unread for B');
+    assert.deepEqual([...got[1].readBy].sort(), [ID.a, ID.b].sort(), 'everyone in the call has read it');
+    assert.ok(got.every(m => m.callChat.id && m.callChat.who && m.kind === undefined), 'ordinary messages, tagged with the call item');
+    const all = (await A('GET', `/threads/${threadId}/messages?limit=200`)).body;
+    assert.ok(!all.some(m => /^Caller [abc] \w+ (joined|left)$/.test(String(m.body))), 'system lines are not posted');
+    await settle();
+    assert.ok(streamB.events.some(e => e.event === 'message:new' && e.data.message.body === 'Hello B'), 'told live, like any message');
+    assert.ok(streamB.events.some(e => e.event === 'message:new' && e.data.message.body === 'Hi A <3'), 'the sender too (their screen did not send it)');
+    streamB.stop();
+    assert.equal((await A('GET', '/threads')).body.find(t => t.id === threadId).lastMessagePreview, 'Hi A <3');
+
+    // Both leave; the call ends. Joining again starts a new call whose chat shows the earlier lines - A's as A's.
+    await leave(b); await leave(a);
+    await calls.sweep();
+    const a2 = await join((await A('POST', `/threads/${threadId}/call`)).body.url);
+    const polled = JSON.parse((await app.inject({method: 'GET', url: `/call/${threadId}/poll?since=0`, headers: {'x-call-id': a2.id, 'x-call-secret': a2.secret}})).body);
+    const chat = polled.events.find(e => e.type === 'admitted').chat;
+    const old = chat.filter(i => i.kind === 'chat').slice(-3);
+    assert.deepEqual(old.map(i => [i.text, i.who === a2.who]), [['Only me here', true], ['Hello B', true], ['Hi A <3', false]]);
+    assert.deepEqual(old.map(i => i.id), got.map(m => m.callChat.id), 'the same items (the page de-duplicates by id)');
+    assert.equal((await callMsgs()).length, before + 3, 'the loaded history is not posted again');
+    // A deleted message is not brought back into a call.
+    await B('DELETE', `/threads/${threadId}/messages/${got[2].id}`);
+    await leave(a2);
+    await calls.sweep();
+    const a3 = await join((await A('POST', `/threads/${threadId}/call`)).body.url);
+    const polled3 = JSON.parse((await app.inject({method: 'GET', url: `/call/${threadId}/poll?since=0`, headers: {'x-call-id': a3.id, 'x-call-secret': a3.secret}})).body);
+    assert.ok(!polled3.events.find(e => e.type === 'admitted').chat.some(i => i.text === 'Hi A <3'));
+    await leave(a3);
+    await calls.sweep();
+    assert.equal(calls.present.has(threadId), false, 'nobody left in the call');
+    } finally { streamB.stop(); }
+});
+
+test('leaving the conversation takes you out of its call; the last one leaving ends it', async () => {
+    const urlA2 = (await A('POST', `/threads/${threadId}/call`)).body.url;
+    assert.equal(calls.live.has(threadId), true);
+    const join = (url) => app.inject({method: 'POST', url: `/call/${threadId}/join`, payload: credFrom(url)});
+    assert.equal((await join(urlA2)).statusCode, 200);
+    assert.equal((await join((await B('POST', `/threads/${threadId}/call`)).body.url)).statusCode, 200);
+    assert.equal(calls.rooms.countRoom(threadId).in, 2);
+    await A('DELETE', `/threads/${threadId}`);
+    assert.equal(calls.rooms.countRoom(threadId).in, 1, 'A left the conversation, so A is out of its call');
+    assert.equal(calls.live.get(threadId).participants.includes(ID.a), false, 'and hears no more of it');
+    await B('DELETE', `/threads/${threadId}`);
+    assert.equal(calls.live.has(threadId), false);
+});
+
+test('Call… (1.5): /me names you; picking one person calls in your DM, several in the group of exactly them, else a new one', async () => {
+    const mine = await A('GET', '/me');
+    assert.match(mine.body.name, /^Caller a /, '/me carries your name (the default group name starts with it)');
+
+    // One person: the DM you have - found on the list, and the server dedupes it too.
+    const dm = (await A('POST', '/threads', {kind: 'dm', participants: [ID.b]})).body;
+    let list = (await A('GET', '/threads')).body;
+    assert.equal(callTarget(list, ID.a, [ID.b]).id, dm.id);
+    assert.equal((await A('POST', '/threads', {kind: 'dm', participants: [ID.b]})).body.id, dm.id, 'never a second DM');
+
+    // Several: no group of exactly B and C yet -> make one, named after everyone.
+    const t1 = callTarget(list, ID.a, [ID.b, ID.c]);
+    assert.deepEqual(t1.create, {kind: 'group-adhoc', participants: [ID.b, ID.c]});
+    const people = [{name: mine.body.name}, ...t1.create.participants.map(id => list.flatMap(t => t.participants).find(p => p.id === id) || {name: 'Caller c x'})];
+    const group = (await A('POST', '/threads', {...t1.create, name: callGroupName(people)})).body;
+    assert.match(group.name, /^Caller, Caller and Caller$/);
+    list = (await A('GET', '/threads')).body;
+    assert.equal(callTarget(list, ID.a, [ID.c, ID.b]).id, group.id, 'the same people in any order: reused');
+    assert.ok(callTarget(list, ID.a, [ID.c]).create, 'a subset is not that group');
+
+    // Its call starts as the in-conversation button's does.
+    const res = await A('POST', `/threads/${group.id}/call`);
+    assert.equal(res.status, 200);
+    assert.equal(roomOf(res.body.url), group.id);
+    assert.equal(res.body.call.by, ID.a);
+
+    // Archived by you: a new group, not that one.
+    await A('POST', `/threads/${group.id}/archive`, {archived: true});
+    list = (await A('GET', '/threads')).body;
+    assert.ok(callTarget(list, ID.a, [ID.b, ID.c]).create);
+});
+
+test('1.7 Add people: someone in the call rings a team member outside the conversation - notice, DM with their own link, they join; nobody else can', async () => {
+    const dm = await A('POST', '/threads', {kind: 'dm', participants: [ID.b]});
+    const room = dm.body.id;
+    await calls.sweep(Date.now() + RING_MS + 1000);
+    const urlA = (await A('POST', `/threads/${room}/call`)).body.url;
+    const join = async (cred) => app.inject({method: 'POST', url: `/call/${room}/join`, payload: cred});
+    const a = JSON.parse((await join(credFrom(urlA))).body);
+    assert.equal(a.canInvite, true, 'a member in the call may add people');
+    assert.deepEqual(a.inviteOptions, {search: true, typed: false, copyLink: false, external: false}, 'the team only - no contacts, typed emails or copied link');
+    const h = {'x-call-id': a.id, 'x-call-secret': a.secret};
+    await app.inject({method: 'POST', url: `/call/${room}/chat`, headers: h, payload: {text: 'said before C came'}});
+
+    const people = JSON.parse((await app.inject({method: 'GET', url: `/call/${room}/people?q=`, headers: h})).body).people;
+    assert.ok(people.some(p => p.id === ID.c), 'someone not in the conversation');
+    assert.ok(!people.some(p => p.id === ID.b || p.id === ID.a), 'never someone already in it');
+    assert.ok(people.every(p => p.kind === 'user'));
+
+    // Not invited yet: a correctly signed invitation still does not open the call.
+    const early = Object.fromEntries(new URL(inviteLink(loadSecret(dataDir), room, ID.c), 'http://x').searchParams);
+    assert.equal((await join(early)).statusCode, 404);
+    const copy = await app.inject({method: 'POST', url: `/call/${room}/invite`, headers: h, payload: {people: []}});
+    assert.equal(copy.statusCode, 409, 'no link to copy in Messages');
+
+    const r = await app.inject({method: 'POST', url: `/call/${room}/invite`, headers: {...h, host: 'site.test'},
+        payload: {people: [{kind: 'user', id: ID.c}, {kind: 'user', id: ID.b}], via: {message: true}}});
+    assert.equal(r.statusCode, 200);
+    const out = JSON.parse(r.body);
+    assert.equal(out.link, '');
+    assert.equal(out.results[0].messaged, true, 'C got a direct message');
+    assert.ok(out.results[1].error, 'someone already in the conversation is refused');
+    const typed = await app.inject({method: 'POST', url: `/call/${room}/invite`, headers: h, payload: {people: [{name: 'X', email: 'x@example.com'}], via: {email: true}}});
+    assert.equal(typed.statusCode, 400, 'a typed address is refused (the team only)');
+    assert.ok(calls.live.get(room).invited.has(ID.c));
+    assert.ok(!(await C('GET', `/threads/${room}/messages`)).body?.length, 'C is NOT added to the conversation');
+
+    // The DM from A to C carries C's own invitation link.
+    const threads = (await C('GET', '/threads')).body;
+    const pair = threads.find(t => t.kind === 'dm' && t.participants.some(p => p.id === ID.a));
+    const msgs = (await C('GET', `/threads/${pair.id}/messages`)).body;
+    const link = msgs.map(m => m.body).find(b => b.includes('/messages-call/')).match(/https?:\/\/\S+/)[0];
+    const cred = credFrom(link);
+    assert.equal(cred.u, ID.c);
+    assert.equal(cred.i, '1');
+    const c = JSON.parse((await join(cred)).body);
+    assert.equal(c.state, 'in', 'straight in, like the members');
+    const cp0 = (await app.inject({method: 'GET', url: `/call/${room}/poll?since=0`, headers: {'x-call-id': c.id, 'x-call-secret': c.secret}})).json();
+    const seen = cp0.events.find(e => e.type === 'admitted').chat.map(i => i.text);
+    assert.ok(!seen.includes('said before C came'), 'an invitee is not shown the call\'s earlier chat');
+    assert.ok(!seen.some(t => /started a call/.test(t)));
+    // A member joining now still gets it all.
+    const b = JSON.parse((await join(credFrom((await B('POST', `/threads/${room}/call`)).body.url))).body);
+    const bp = (await app.inject({method: 'GET', url: `/call/${room}/poll?since=0`, headers: {'x-call-id': b.id, 'x-call-secret': b.secret}})).json();
+    assert.ok(bp.events.find(e => e.type === 'admitted').chat.some(i => i.text === 'said before C came'));
+    await app.inject({method: 'POST', url: `/call/${room}/leave`, headers: {'x-call-id': b.id, 'x-call-secret': b.secret}});
+    assert.equal(c.canInvite, false, 'an invitee cannot add others');
+    const cp = await app.inject({method: 'GET', url: `/call/${room}/people?q=`, headers: {'x-call-id': c.id, 'x-call-secret': c.secret}});
+    assert.equal(cp.statusCode, 403);
+
+    // The call ends: the invitation stops working.
+    for (const p of [a, c]) await app.inject({method: 'POST', url: `/call/${room}/leave`, headers: {'x-call-id': p.id, 'x-call-secret': p.secret}});
+    await calls.sweep();
+    assert.equal(calls.live.has(room), false);
+    assert.equal((await join(cred)).statusCode, 404, 'not a way into the next call');
+});
+
+test('1.7 the direct messenger keeps Messages\' own rule: only someone the sender may reach', async () => {
+    const {createUser, deleteUser} = await import('../../../server/services/users.js');
+    const tag = Math.random().toString(36).slice(2, 7);
+    // No shared role, not staff, never talked: A may not message them.
+    const d = await createUser({name: `Dee Outside ${tag}`, email: `dee-${tag}@example.test`, password: 'password123', role: 'jb-candidate'});
+    try {
+        assert.deepEqual(await calls.sendDirect({fromUserId: ID.a, toUserId: d.id, text: 'Join: https://x'}),
+            {sent: false, reason: 'you cannot message them in Messages'});
+        const threads = (await A('GET', '/threads')).body;
+        assert.ok(!threads.some(t => t.kind === 'dm' && t.participants.some(p => (p.id || p) === d.id)), 'no conversation made');
+        assert.deepEqual(await calls.sendDirect({fromUserId: ID.a, toUserId: ID.c, text: 'Join: https://x'}), {sent: true}, 'someone they may reach');
+    } finally {
+        await deleteUser(d.id).catch(() => {});
+    }
+});

package/plugins/messages/tests/drafts.test.js

@@ -0,0 +1,25 @@
+/** Messages - drafts are one signed-in person's, and a half-made conversation is asked about (admin/lib/messages.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {NEW_DRAFT_QUESTION, RESTORE_ANSWERS, cleanNewDraft, draftKey} from '../admin/lib/messages.js';
+
+test('draft keys carry the user id; no user, no key', () => {
+    assert.equal(draftKey('messages.drafts', 'u-1'), 'messages.drafts.u-1');
+    assert.equal(draftKey('messages.newDraft', 'u-1'), 'messages.newDraft.u-1');
+    assert.notEqual(draftKey('messages.drafts', 'a'), draftKey('messages.drafts', 'b'));
+    for (const none of [undefined, null, '', '  ', {}, 'a b', 'x'.repeat(200)]) assert.equal(draftKey('messages.drafts', none), '', String(none));
+});
+
+test('a kept new conversation is whitelisted; an empty one is nothing', () => {
+    assert.deepEqual(cleanNewDraft({kind: 'group-adhoc', name: 'Team', participants: ['a', 3, 'b'], extra: 1}), {kind: 'group-adhoc', name: 'Team', participants: ['a', 'b']});
+    assert.deepEqual(cleanNewDraft({kind: 'evil', participants: ['a']}), {kind: 'dm', name: '', participants: ['a']});
+    assert.equal(cleanNewDraft({kind: 'dm', name: ' ', participants: []}), null);
+    assert.equal(cleanNewDraft(null), null);
+    assert.equal(cleanNewDraft([]), null);
+});
+
+test('the restore question: OK throws away, Cancel keeps', () => {
+    assert.match(NEW_DRAFT_QUESTION, /^Throw away the changes you left unsaved/);
+    assert.equal(RESTORE_ANSWERS.confirmText, 'Throw away');
+    assert.equal(RESTORE_ANSWERS.cancelText, 'Keep them');
+});