Add direct messages (#52)

A DM is a Room with a new is_dm flag, not a separate model -- reuses
all the membership/message/WS plumbing Room already has instead of
duplicating it. The room's `name` (still required + globally unique)
is an internal, never-displayed token derived deterministically from
the two participants' sorted user IDs (dm_room_name), which makes
find-or-create a single indexed lookup and gets free race-condition
safety from the existing unique constraint -- a concurrent double-
start from both people just hits the same IntegrityError->retry-as-
lookup path create_room already established.

Both participants get the plain 'member' role (no owner/admin
distinction makes sense for a 1:1 DM), which incidentally reuses
every existing role gate to block add-member, room-settings edits,
and join-via-browse on a DM for free. update_room also gets an
explicit is_dm guard independent of that, since renaming a DM isn't
just a privacy concern -- it would silently corrupt the find-or-create
invariant. DMs are excluded from both Browse Rooms and the admin
portal's room listing (fully private, per scope).

GET /api/rooms/mine precomputes each DM's other participant (name,
avatar, presence) as dm_partner in one batched query, so the sidebar
can render a DM row without a fetch per row. Frontend: a new "Direct
Messages" sidebar section (searchable by partner name, not the
internal room name), clicking someone in the People list starts or
resumes a DM, and the chat header/composer/RoomInfoPanel all render
the partner's identity instead of a room name where it's a DM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/room.py

@@ -15,6 +15,10 @@ class Room(Base):
     description: Mapped[str | None] = mapped_column(Text)
     is_private: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
     is_archived: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    # #52: a DM is a Room whose `name` is an internal, never-displayed
+    # deterministic token (see room_service.dm_room_name) rather than a
+    # user-chosen name -- see that function's docstring for the scheme.
+    is_dm: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
     owner_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id"), nullable=False)
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), nullable=False

backend/app/routers/rooms.py

@@ -17,6 +17,7 @@ from app.schemas.message import LinkPreviewInfo, MessageFileInfo, MessageRead
 from app.schemas.message_file import MessageFileCreated
 from app.schemas.message_image import MessageImageCreated
 from app.schemas.room import (
+    DmPartnerInfo,
     MyRoomItem,
     RoomAttachmentRead,
     RoomCreate,
@@ -26,6 +27,7 @@ from app.schemas.room import (
     RoomMemberRoleUpdate,
     RoomRead,
     RoomUpdate,
+    StartDmRequest,
     TransferOwnershipRequest,
 )
 from app.schemas.webhook import (
@@ -45,6 +47,8 @@ from app.services.message_service import (
 from app.services.upload_settings_service import format_mb, get_upload_settings
 from app.services.room_service import (
     AlreadyMemberError,
+    CannotDmSelfError,
+    CannotModifyDmError,
     CannotRemoveOwnerError,
     DuplicateRoomError,
     InsufficientRoleError,
@@ -57,6 +61,7 @@ from app.services.room_service import (
     change_member_role,
     create_room,
     delete_room,
+    find_or_create_dm,
     get_room,
     join_room,
     leave_room,
@@ -105,6 +110,20 @@ async def create_room_endpoint(
         raise HTTPException(status_code=409, detail="A room with this name already exists")
 
 
+@router.post("/dm", response_model=RoomRead, status_code=201)
+async def start_dm_endpoint(
+    data: StartDmRequest,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    try:
+        return await find_or_create_dm(db, current_user.id, data.other_user_id)
+    except CannotDmSelfError:
+        raise HTTPException(status_code=400, detail="Cannot start a DM with yourself")
+    except TargetUserNotFoundError:
+        raise HTTPException(status_code=404, detail="No user with that ID")
+
+
 @router.get("", response_model=list[RoomListItem])
 async def list_rooms_endpoint(
     current_user: User = Depends(get_current_user),
@@ -117,6 +136,7 @@ async def list_rooms_endpoint(
             name=room.name,
             description=room.description,
             is_private=room.is_private,
+            is_dm=room.is_dm,
             owner_id=room.owner_id,
             created_at=room.created_at,
             is_member=is_member,
@@ -127,23 +147,38 @@ async def list_rooms_endpoint(
 
 @router.get("/mine", response_model=list[MyRoomItem])
 async def list_my_rooms_endpoint(
+    request: Request,
     current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
     rooms = await list_member_rooms(db, current_user.id)
+    partner_ids = [partner.id for *_, partner in rooms if partner is not None]
+    online_ids = await request.app.state.global_presence.online_user_ids(partner_ids)
     return [
         MyRoomItem(
             id=room.id,
             name=room.name,
             description=room.description,
             is_private=room.is_private,
+            is_dm=room.is_dm,
             owner_id=room.owner_id,
             created_at=room.created_at,
             role=role,
             has_unread=has_unread,
             has_mention=has_mention,
+            dm_partner=(
+                DmPartnerInfo(
+                    user_id=partner.id,
+                    username=partner.username,
+                    display_name=partner.display_name,
+                    avatar_filename=partner.avatar_filename,
+                    status=_member_status(partner, online_ids),
+                )
+                if partner is not None
+                else None
+            ),
         )
-        for room, role, has_unread, has_mention in rooms
+        for room, role, has_unread, has_mention, partner in rooms
     ]
 
 
@@ -167,6 +202,8 @@ async def update_room_endpoint(
         raise HTTPException(status_code=404, detail="Room not found")
     except DuplicateRoomError:
         raise HTTPException(status_code=409, detail="A room with this name already exists")
+    except CannotModifyDmError:
+        raise HTTPException(status_code=400, detail="DMs can't be edited")
 
 
 @router.delete("/{room_id}", status_code=204)

backend/app/schemas/room.py

@@ -26,6 +26,7 @@ class RoomRead(BaseModel):
     name: str
     description: str | None
     is_private: bool
+    is_dm: bool
     owner_id: uuid.UUID
     created_at: datetime
 
@@ -34,6 +35,14 @@ class RoomListItem(RoomRead):
     is_member: bool
 
 
+class DmPartnerInfo(BaseModel):
+    user_id: uuid.UUID
+    username: str
+    display_name: str | None
+    avatar_filename: str | None
+    status: Literal["online", "offline"]
+
+
 class MyRoomItem(RoomRead):
     role: RoomRole
     # Whether this room has a message newer than the caller's last_read_at --
@@ -44,6 +53,15 @@ class MyRoomItem(RoomRead):
     # over has_unread in the sidebar (see RoomRow.tsx), not shown alongside
     # it.
     has_mention: bool
+    # #52: populated only when is_dm is true -- the *other* participant,
+    # precomputed here so the sidebar can render a DM row (their name +
+    # avatar, not this room's internal `name`) without a second fetch per
+    # row. None for a regular room.
+    dm_partner: DmPartnerInfo | None = None
+
+
+class StartDmRequest(BaseModel):
+    other_user_id: uuid.UUID
 
 
 class RoomMemberRead(BaseModel):

backend/app/services/admin_service.py

@@ -93,9 +93,14 @@ async def set_user_site_admin(
 
 
 async def list_rooms_admin(db: AsyncSession) -> list[tuple[Room, int]]:
+    # #52: DMs are fully private, not just unlisted -- excluded here rather
+    # than merely omitted from the response, so there's no admin-portal
+    # surface (this list, or the audit log via anything that touches this
+    # query) that reveals a DM even exists between two users.
     result = await db.execute(
         select(Room, func.count(RoomMembership.user_id))
         .outerjoin(RoomMembership, RoomMembership.room_id == Room.id)
+        .where(Room.is_dm.is_(False))
         .group_by(Room.id)
         .order_by(Room.created_at)
     )

backend/app/services/room_service.py

@@ -60,6 +60,25 @@ class AlreadyMemberError(Exception):
     pass
 
 
+class CannotDmSelfError(Exception):
+    pass
+
+
+class CannotModifyDmError(Exception):
+    pass
+
+
+def dm_room_name(user_a_id: uuid.UUID, user_b_id: uuid.UUID) -> str:
+    """Deterministic, internal-only name for the DM room between these two
+    users -- same canonical string regardless of argument order, so
+    find_or_create_dm can look up an existing DM with a single indexed
+    query (Room.name is already unique+indexed) instead of a membership-set
+    join. Never shown to a user -- the frontend renders a DM's dm_partner
+    info instead of its `name` (see MyRoomItem)."""
+    ids = sorted((str(user_a_id), str(user_b_id)))
+    return f"dm:{ids[0]}:{ids[1]}"
+
+
 async def create_room(db: AsyncSession, owner_id: uuid.UUID, data: RoomCreate) -> Room:
     room = Room(
         name=data.name,
@@ -80,10 +99,50 @@ async def create_room(db: AsyncSession, owner_id: uuid.UUID, data: RoomCreate) -
     return room
 
 
+async def find_or_create_dm(db: AsyncSession, user_id: uuid.UUID, other_user_id: uuid.UUID) -> Room:
+    if user_id == other_user_id:
+        raise CannotDmSelfError()
+    other = await db.get(User, other_user_id)
+    if other is None:
+        raise TargetUserNotFoundError()
+
+    name = dm_room_name(user_id, other_user_id)
+    result = await db.execute(select(Room).where(Room.name == name))
+    room = result.scalar_one_or_none()
+    if room is not None:
+        return room
+
+    # is_private=True is belt-and-suspenders here -- list_open_rooms also
+    # excludes is_dm directly -- but it's also just semantically correct: a
+    # DM genuinely is a private room. Both participants get the plain
+    # `member` role (there's no meaningful owner/admin distinction for a
+    # 1:1 DM); `owner_id` still has to be someone to satisfy the column,
+    # but nothing reads it as meaningful for a DM.
+    room = Room(name=name, is_private=True, is_dm=True, owner_id=user_id)
+    db.add(room)
+    try:
+        await db.flush()
+    except IntegrityError:
+        # Lost a race with a concurrent find_or_create_dm for the same pair
+        # (e.g. both people click "message" on each other at once) -- the
+        # unique constraint on `name` is exactly what caught it, same
+        # pattern as create_room's DuplicateRoomError. The row that won the
+        # race is the room we actually want.
+        await db.rollback()
+        result = await db.execute(select(Room).where(Room.name == name))
+        return result.scalar_one()
+
+    db.add(RoomMembership(room_id=room.id, user_id=user_id, role=RoomRole.member))
+    db.add(RoomMembership(room_id=room.id, user_id=other_user_id, role=RoomRole.member))
+    await db.commit()
+    await db.refresh(room)
+    return room
+
+
 async def list_open_rooms(db: AsyncSession, user_id: uuid.UUID) -> list[tuple[Room, bool]]:
     result = await db.execute(
         select(Room)
-        .where(Room.is_private.is_(False), Room.is_archived.is_(False))
+        .where(Room.is_private.is_(False), Room.is_archived.is_(False), Room.is_dm.is_(False))
         .options(selectinload(Room.memberships))
         .order_by(Room.created_at, Room.id)
     )
@@ -95,7 +154,7 @@ async def list_open_rooms(db: AsyncSession, user_id: uuid.UUID) -> list[tuple[Ro
 
 async def list_member_rooms(
     db: AsyncSession, user_id: uuid.UUID
-) -> list[tuple[Room, RoomRole, bool, bool]]:
+) -> list[tuple[Room, RoomRole, bool, bool, User | None]]:
     last_message_at = (
         select(func.max(Message.created_at))
         .where(Message.room_id == Room.id)
@@ -130,9 +189,30 @@ async def list_member_rooms(
         # device's fetch and another's.
         .order_by(Room.created_at, Room.id)
     )
+    rows = result.all()
+
+    # #52: one batched follow-up query for every DM room's *other*
+    # participant, rather than a fetch per row -- a DM only ever has
+    # exactly two members, so "the other one" is unambiguous.
+    dm_room_ids = [room.id for room, *_ in rows if room.is_dm]
+    partners_by_room: dict[uuid.UUID, User] = {}
+    if dm_room_ids:
+        partner_result = await db.execute(
+            select(RoomMembership.room_id, User)
+            .join(User, User.id == RoomMembership.user_id)
+            .where(RoomMembership.room_id.in_(dm_room_ids), RoomMembership.user_id != user_id)
+        )
+        partners_by_room = {room_id: user for room_id, user in partner_result.all()}
+
     return [
-        (room, role, last_message_at is not None and last_message_at > last_read_at, has_mention)
-        for room, role, last_read_at, last_message_at, has_mention in result.all()
+        (
+            room,
+            role,
+            last_message_at is not None and last_message_at > last_read_at,
+            has_mention,
+            partners_by_room.get(room.id),
+        )
+        for room, role, last_read_at, last_message_at, has_mention in rows
     ]
 
 
@@ -200,6 +280,14 @@ async def add_member(
 
 
 async def update_room(db: AsyncSession, room: Room, data: RoomUpdate) -> Room:
+    # A DM's `name` is an internal token find_or_create_dm's lookup depends
+    # on being stable -- renaming it (even via the #48 site-admin bypass in
+    # the router) would silently orphan that invariant, not just leak a
+    # detail that's supposed to stay private. Blocked here, not just in the
+    # UI, since it's a correctness issue for every caller, not a permission
+    # one.
+    if room.is_dm:
+        raise CannotModifyDmError()
     if data.name is not None:
         room.name = data.name
     if data.description is not None: