Private
Public Access
ksmithandClaude Sonnet 5
0ab23c44a7
Bot accounts (User rows with is_bot=True), scoped API tokens (read:messages, write:messages, manage:rooms) authenticated via Authorization: Bearer on both REST and the WS handshake, live bot WebSocket access on the same /ws/chat endpoint humans use, message editing (WS "edit" envelope -> message_update broadcast, fans out cross-instance for free via the existing broadcaster), incoming webhooks (room-scoped, no auth beyond the URL token), and outgoing webhooks/event subscriptions (HMAC-SHA256 signed, backgrounded delivery, creation-time SSRF validation against private/loopback/link-local targets). Token auth is additive, not a parallel system: a bearer-token-authenticated bot goes through the exact same room-membership/role checks a session- authenticated human does everywhere; only read:messages/write:messages are separately scope-gated (the two message endpoints). manage:rooms scope enforcement, full per-delivery SSRF re-validation, and bot API rate limiting were explicitly scoped out (confirmed with the repo owner) as disproportionate to this phase -- documented as known gaps in backend/README.md rather than silently skipped. Admin portal gains a Bots tab (create bots, issue/revoke scoped tokens, cross-room webhook visibility); RoomInfoPanel gains room-scoped webhook/ subscription management, mirroring how invites already work there. The chat UI also gets a minimal "edit your own message" affordance -- not asked for by the issue, but the only practical way to exercise the edit pipeline by hand instead of only via a scripted bot client. Along the way: fixed a real bug caught while writing the incoming-webhook test -- offline-push notification relied on the sender being "connected" to exclude themselves, true for WS-originated messages but not for the new webhook path, which has no WS connection for the attributed sender at all. Now explicitly excluded. Also discovered the REST-only test fixture never triggered ASGI lifespan, so app.state.broadcaster/presence didn't exist for it; moved their construction out of the lifespan into create_app() itself (Redis client construction is synchronous/lazy) so both the WS and REST-only paths always have them. New tests/test_bots.py, test_message_edit.py, test_webhooks.py (full suite now 78/78, stable across repeated runs) plus a scripted end-to-end smoke test (bot WS join/post/edit, incoming webhook, SSRF rejection, outgoing delivery) and a full browser walkthrough of the new admin/room UI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
80 lines
2.9 KiB
Python
80 lines
2.9 KiB
Python
import uuid
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models import Message, Room, RoomMembership, User
|
|
from app.services.push_service import send_push_to_user
|
|
from app.services.webhook_service import dispatch_event
|
|
from app.ws.broadcaster import RoomBroadcaster
|
|
from app.ws.presence import Presence
|
|
|
|
|
|
async def _notify_offline_members(
|
|
db: AsyncSession, presence: Presence, room_id: uuid.UUID, sender: User, content: str
|
|
) -> None:
|
|
result = await db.execute(
|
|
select(RoomMembership.user_id).where(RoomMembership.room_id == room_id)
|
|
)
|
|
member_ids = {row[0] for row in result.all()}
|
|
# Subtract the sender explicitly rather than relying on them being
|
|
# "connected" (true for the WS path, since they just sent this over an
|
|
# active connection -- not true for the incoming-webhook REST path,
|
|
# which has no WS connection for the attributed sender at all).
|
|
offline_ids = member_ids - await presence.connected_user_ids(room_id) - {sender.id}
|
|
if not offline_ids:
|
|
return
|
|
|
|
room = await db.get(Room, room_id)
|
|
payload = {
|
|
"title": f"#{room.name}" if room else "New message",
|
|
"body": f"{sender.username}: {content}"[:120],
|
|
"room_id": str(room_id),
|
|
}
|
|
for user_id in offline_ids:
|
|
await send_push_to_user(db, user_id, payload)
|
|
|
|
|
|
def _message_payload(message: Message, username: str) -> dict:
|
|
return {
|
|
"type": "message",
|
|
"id": str(message.id),
|
|
"room_id": str(message.room_id),
|
|
"user_id": str(message.user_id),
|
|
"username": username,
|
|
"content": message.content,
|
|
"created_at": message.created_at.isoformat(),
|
|
"edited_at": message.edited_at.isoformat() if message.edited_at else None,
|
|
}
|
|
|
|
|
|
async def broadcast_new_message(
|
|
db: AsyncSession,
|
|
broadcaster: RoomBroadcaster,
|
|
presence: Presence,
|
|
room_id: uuid.UUID,
|
|
message: Message,
|
|
sender: User,
|
|
) -> None:
|
|
"""The full side-effect sequence for a newly created message, shared by
|
|
the WS "message" handler and the incoming-webhook receiver so both
|
|
trigger identical fan-out/push/event behavior."""
|
|
payload = _message_payload(message, sender.username)
|
|
await broadcaster.publish(room_id, payload)
|
|
await _notify_offline_members(db, presence, room_id, sender, message.content)
|
|
await dispatch_event(db, "message.created", room_id, payload)
|
|
|
|
|
|
async def broadcast_message_update(
|
|
db: AsyncSession, broadcaster: RoomBroadcaster, room_id: uuid.UUID, message: Message
|
|
) -> None:
|
|
payload = {
|
|
"type": "message_update",
|
|
"id": str(message.id),
|
|
"room_id": str(room_id),
|
|
"content": message.content,
|
|
"edited_at": message.edited_at.isoformat() if message.edited_at else None,
|
|
}
|
|
await broadcaster.publish(room_id, payload)
|
|
await dispatch_event(db, "message.updated", room_id, payload)
|