Add the ability to delete a message (#53)

Message.deleted_at has existed since the initial schema but was never
wired up -- no WS envelope, no permission check, no frontend concept of
it at all. Soft delete, author-only (mirrors the existing edit
permission exactly): content and any attached image/file are cleared
and the underlying MessageImage/MessageFile row and stored file are
actually removed, not just detached, so the message becomes a "This
message was deleted" tombstone with nothing left to recover through a
stale attachment URL. A deleted message can no longer be edited or
reacted to.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/message.py

@@ -10,8 +10,12 @@ from app.models.base import Base
 class Message(Base):
     __tablename__ = "messages"
     __table_args__ = (
+        # #53: a deleted message clears content/image_id/file_id entirely
+        # (see message_service.delete_message) -- the "must have something"
+        # rule only applies while the message is actually live.
         CheckConstraint(
-            "content IS NOT NULL OR image_id IS NOT NULL OR file_id IS NOT NULL",
+            "content IS NOT NULL OR image_id IS NOT NULL OR file_id IS NOT NULL "
+            "OR deleted_at IS NOT NULL",
             name="messages_content_or_attachment_required",
         ),
     )

backend/app/routers/rooms.py

@@ -433,6 +433,7 @@ async def get_room_messages_endpoint(
             reactions=reactions_by_message.get(m.id, []),
             created_at=m.created_at,
             edited_at=m.edited_at,
+            deleted_at=m.deleted_at,
         )
         for m in messages
     ]

backend/app/schemas/message.py

@@ -44,3 +44,9 @@ class MessageRead(BaseModel):
     reactions: list[ReactionSummary]
     created_at: datetime
     edited_at: datetime | None
+    # #53: null for a live message; set once deleted, at which point
+    # content/image_id/file/link_preview are all already cleared
+    # server-side (see message_service.delete_message). `reactions` isn't
+    # cleared server-side -- the frontend just doesn't render them once
+    # deleted_at is set, same as it doesn't render the rest of a tombstone.
+    deleted_at: datetime | None

backend/app/services/message_events.py

@@ -134,6 +134,10 @@ async def _message_payload(db: AsyncSession, message: Message, username: str) ->
         "reactions": [],
         "created_at": message.created_at.isoformat(),
         "edited_at": message.edited_at.isoformat() if message.edited_at else None,
+        # Always null here -- a message just being created can't already be
+        # deleted -- but included for wire-format parity with MessageRead
+        # and message_deleted (#53).
+        "deleted_at": None,
     }
 
 
@@ -204,6 +208,16 @@ async def broadcast_message_update(
     _maybe_fetch_link_preview(broadcaster, room_id, message)
 
 
+async def broadcast_message_delete(broadcaster: Broadcaster, room_id: uuid.UUID, message_id: uuid.UUID) -> None:
+    # #53: no dispatch_event() call, deliberately -- same scope cut as
+    # broadcast_reaction_update's, and for the same reason (see
+    # backend/README.md): message.deleted isn't an outgoing-webhook event
+    # type here.
+    await broadcaster.publish(
+        room_id, {"type": "message_deleted", "id": str(message_id), "room_id": str(room_id)}
+    )
+
+
 async def broadcast_reaction_update(
     broadcaster: Broadcaster,
     room_id: uuid.UUID,

backend/app/services/message_service.py

@@ -6,11 +6,19 @@ from sqlalchemy import or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
-from app.models import Message, MessageMention, MessageReaction, MessageRoomReference
+from app.models import (
+    Message,
+    MessageFile,
+    MessageImage,
+    MessageMention,
+    MessageReaction,
+    MessageRoomReference,
+)
 from app.schemas.message import ReactionSummary
 from app.services.link_preview_service import extract_first_url
 from app.services.mention_service import extract_mentioned_user_ids
 from app.services.room_reference_service import extract_referenced_room_ids
+from app.storage import delete_file
 
 
 class MessageNotFoundError(Exception):
@@ -56,7 +64,9 @@ async def edit_message(
     db: AsyncSession, message_id: uuid.UUID, editor_id: uuid.UUID, content: str
 ) -> Message:
     message = await db.get(Message, message_id)
-    if message is None:
+    # A deleted message might as well not exist for editing purposes --
+    # same MessageNotFoundError a genuinely missing id would raise.
+    if message is None or message.deleted_at is not None:
         raise MessageNotFoundError()
     if message.user_id != editor_id:
         raise NotMessageAuthorError()
@@ -69,6 +79,50 @@ async def edit_message(
     return message
 
 
+async def delete_message(db: AsyncSession, message_id: uuid.UUID, deleter_id: uuid.UUID) -> Message:
+    message = await db.get(Message, message_id)
+    if message is None or message.deleted_at is not None:
+        raise MessageNotFoundError()
+    if message.user_id != deleter_id:
+        raise NotMessageAuthorError()
+
+    # Fetch the attachment's storage filename (if any) before clearing the
+    # message's own FK to it -- the file is only unlinked from disk after a
+    # successful commit below, mirroring delete_room's identical ordering:
+    # a rolled-back transaction should never leave us having destroyed
+    # something we couldn't get back.
+    image_filename: str | None = None
+    file_filename: str | None = None
+    if message.image_id is not None:
+        image = await db.get(MessageImage, message.image_id)
+        if image is not None:
+            image_filename = image.storage_filename
+            await db.delete(image)
+    if message.file_id is not None:
+        message_file = await db.get(MessageFile, message.file_id)
+        if message_file is not None:
+            file_filename = message_file.storage_filename
+            await db.delete(message_file)
+
+    # #53: a real delete, not just a UI hide -- content and any attachment
+    # are actually gone, not merely unlinked-but-still-fetchable. Only
+    # deleted_at (plus id/room_id/user_id/created_at, kept so the tombstone
+    # still occupies its place in history) survives.
+    message.content = None
+    message.image_id = None
+    message.file_id = None
+    message.preview_url = None
+    message.deleted_at = datetime.now(timezone.utc)
+    await db.commit()
+    await db.refresh(message)
+
+    for filename in (image_filename, file_filename):
+        if filename is not None:
+            delete_file(filename)
+
+    return message
+
+
 async def list_recent_messages(
     db: AsyncSession, room_id: uuid.UUID, limit: int = 50
 ) -> list[Message]:

backend/app/ws/chat.py

@@ -11,6 +11,7 @@ from app.services.bot_service import resolve_token
 from app.services.message_events import (
     broadcast_dm_presence_update,
     broadcast_member_updated,
+    broadcast_message_delete,
     broadcast_message_update,
     broadcast_new_message,
     broadcast_reaction_update,
@@ -19,6 +20,7 @@ from app.services.message_service import (
     MessageNotFoundError,
     NotMessageAuthorError,
     create_message,
+    delete_message,
     edit_message,
     toggle_reaction,
 )
@@ -261,6 +263,36 @@ async def chat_endpoint(websocket: WebSocket, db: AsyncSession = Depends(get_db)
                         continue
                     await broadcast_message_update(db, broadcaster, envelope.room_id, message)
 
+                elif envelope.type == "delete":
+                    if envelope.room_id is None or envelope.message_id is None:
+                        await websocket.send_json(
+                            {"type": "error", "detail": "room_id and message_id required"}
+                        )
+                        continue
+                    if _missing_scope(api_token, "write:messages"):
+                        await websocket.send_json(
+                            {"type": "error", "detail": "Token missing required scope: write:messages"}
+                        )
+                        continue
+                    if envelope.room_id not in joined_rooms or not await _is_room_member(
+                        db, envelope.room_id, user.id
+                    ):
+                        await websocket.send_json(
+                            {"type": "error", "detail": "Not a member of this room"}
+                        )
+                        continue
+                    try:
+                        await delete_message(db, envelope.message_id, user.id)
+                    except MessageNotFoundError:
+                        await websocket.send_json({"type": "error", "detail": "Message not found"})
+                        continue
+                    except NotMessageAuthorError:
+                        await websocket.send_json(
+                            {"type": "error", "detail": "You can only delete your own messages"}
+                        )
+                        continue
+                    await broadcast_message_delete(broadcaster, envelope.room_id, envelope.message_id)
+
                 elif envelope.type == "reaction":
                     if (
                         envelope.room_id is None
@@ -285,7 +317,11 @@ async def chat_endpoint(websocket: WebSocket, db: AsyncSession = Depends(get_db)
                         )
                         continue
                     target_message = await db.get(Message, envelope.message_id)
-                    if target_message is None or target_message.room_id != envelope.room_id:
+                    if (
+                        target_message is None
+                        or target_message.room_id != envelope.room_id
+                        or target_message.deleted_at is not None
+                    ):
                         await websocket.send_json({"type": "error", "detail": "Message not found"})
                         continue
                     reactions = await toggle_reaction(db, envelope.message_id, user.id, envelope.emoji)