relay: file attachments, outbox, CC-self, chat view, mobile layout

Compose: attach files (encrypted, hex-named, linked via relay_uid),
CC-self checkbox tags copy with recipient name. Outbox section shows
sent messages with delete. Chat view: session-based threads/history/
send endpoints, split layout with sidebar, read receipts, 5s poll.
Mobile: threads as horizontal scroll bar above messages. Fix chat
input pushed offscreen by adding min-height:0 on flex container.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/routes/chat.php

@@ -17,8 +17,93 @@
 
 if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
 
-// $clientTenant is set by messages.php earlier in the chain via authClient().
-// We re-resolve here to keep this file self-contained.
+// ── Session-based chat (relay UI) ──
+
+if ($route === '/api/chat/threads' && $method === 'GET' && $sessionTenant) {
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $myId = $sessionTenant['id'];
+    $stmt = $db->prepare('
+        SELECT sender_username AS peer, MAX(created_at) AS last_at, COUNT(*) AS count
+        FROM chat_messages WHERE recipient_id = :r
+        GROUP BY sender_username
+        UNION
+        SELECT t.username AS peer, MAX(cm.created_at) AS last_at, COUNT(*) AS count
+        FROM chat_messages cm JOIN tenants t ON t.id = cm.recipient_id
+        WHERE cm.sender_id = :s AND cm.recipient_id != :s2
+        GROUP BY t.username
+    ');
+    $stmt->execute(['r' => $myId, 's' => $myId, 's2' => $myId]);
+    $rows = $stmt->fetchAll();
+    $threads = [];
+    foreach ($rows as $row) {
+        $peer = $row['peer'];
+        if (!isset($threads[$peer])) $threads[$peer] = ['peer' => $peer, 'last_at' => $row['last_at'], 'count' => 0];
+        $threads[$peer]['count'] += (int)$row['count'];
+        if ($row['last_at'] > $threads[$peer]['last_at']) $threads[$peer]['last_at'] = $row['last_at'];
+    }
+    usort($threads, fn($a, $b) => strcmp($b['last_at'], $a['last_at']));
+    // Add unread count per peer
+    foreach ($threads as &$t) {
+        $stmt2 = $db->prepare('SELECT COUNT(*) FROM chat_messages WHERE recipient_id = :r AND sender_username = :p AND seen = 0');
+        $stmt2->execute(['r' => $myId, 'p' => $t['peer']]);
+        $t['unread'] = (int)$stmt2->fetchColumn();
+    }
+    jsonResponse(array_values($threads));
+}
+
+if ($route === '/api/chat/history' && $method === 'GET' && $sessionTenant) {
+    $peer = trim($_GET['peer'] ?? '');
+    if (!$peer) jsonResponse(['error' => 'peer required'], 400);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $myId = $sessionTenant['id'];
+    $peerTenant = getTenantByUsername($db, $peer);
+    if (!$peerTenant) jsonResponse(['error' => 'unknown peer'], 404);
+    $peerId = $peerTenant['id'];
+    $stmt = $db->prepare('
+        SELECT id, sender_id, sender_username, body, created_at, seen
+        FROM chat_messages
+        WHERE (recipient_id = :r AND sender_id = :p) OR (recipient_id = :p2 AND sender_id = :s)
+        ORDER BY created_at ASC LIMIT 500
+    ');
+    $stmt->execute(['r' => $myId, 'p' => $peerId, 'p2' => $peerId, 's' => $myId]);
+    $rows = $stmt->fetchAll();
+    $out = [];
+    foreach ($rows as $row) {
+        $out[] = [
+            'id' => (int)$row['id'],
+            'from' => $row['sender_username'],
+            'mine' => (int)$row['sender_id'] === $myId,
+            'body' => clientDecrypt($row['body'] ?? '', $interKey),
+            'created_at' => $row['created_at'],
+            'seen' => (int)$row['seen'],
+        ];
+    }
+    // Mark incoming as seen
+    $db->prepare('UPDATE chat_messages SET seen = 1 WHERE recipient_id = :r AND sender_id = :p AND seen = 0')
+        ->execute(['r' => $myId, 'p' => $peerId]);
+    jsonResponse($out);
+}
+
+if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
+    $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $body = trim((string)($input['body'] ?? ''));
+    $recipientName = trim((string)($input['recipient'] ?? ''));
+    if ($body === '') jsonResponse(['error' => 'body required'], 400);
+    if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
+    $recipient = getTenantByUsername($db, $recipientName);
+    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stored = clientEncrypt($body, $interKey);
+    $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body) VALUES (:r, :s, :sn, :b)')
+        ->execute(['r' => $recipient['id'], 's' => $sessionTenant['id'], 'sn' => $sessionTenant['username'], 'b' => $stored]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
+}
+
+// ── Client API ──
+
 $clientTenant = $clientTenant ?? authClient($db);
 
 if ($route === '/api/chat' && $method === 'POST') {

relay/inc/routes/messages.php

@@ -27,6 +27,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
     $storedTitle = clientEncrypt($title, $interKey);
     $storedBody = clientEncrypt($body, $interKey);
+    $relayUid = $input['relay_uid'] ?? bin2hex(random_bytes(16));
 
     $db->prepare('INSERT INTO messages (recipient_id, sender_id, sender_username, title, body, color, tags, relay_uid) VALUES (:r, :s, :sn, :t, :b, :c, :tg, :uid)')
         ->execute([
@@ -37,9 +38,43 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
             'b' => $storedBody,
             'c' => $input['color'] ?? '#38bdf8',
             'tg' => $input['tags'] ?? '',
-            'uid' => $input['relay_uid'] ?? null,
+            'uid' => $relayUid,
         ]);
-    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId(), 'recipient' => $recipientName]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId(), 'recipient' => $recipientName, 'relay_uid' => $relayUid]);
+}
+
+// ── UI attachment upload: session stores files encrypted at rest ──
+
+if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant) {
+    if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
+        jsonResponse(['error' => 'no file'], 400);
+    }
+    $relayUid = $_POST['relay_uid'] ?? '';
+    $recipientName = trim($_POST['recipient'] ?? $sessionTenant['username']);
+    if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
+
+    $recipient = getTenantByUsername($db, $recipientName);
+    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+
+    // Generate hex filename so hyprcrd's poll handler accepts it
+    $origName = basename($_FILES['file']['name']);
+    $ext = pathinfo($origName, PATHINFO_EXTENSION) ?: 'bin';
+    $hexName = bin2hex(random_bytes(16)) . '.' . strtolower($ext);
+
+    $plainBytes = file_get_contents($_FILES['file']['tmp_name']);
+    // Store as base64(raw) encrypted — matches client API format.
+    // The GET endpoint re-encrypts for recipient; hyprcrd decrypts
+    // and base64_decodes to get the original file bytes.
+    $storedData = clientEncrypt(base64_encode($plainBytes), $interKey);
+
+    $db->prepare('DELETE FROM attachments WHERE recipient_id = :r AND relay_uid = :uid AND filename = :fn')
+        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $hexName]);
+    $db->prepare('INSERT INTO attachments (recipient_id, relay_uid, filename, data) VALUES (:r, :uid, :fn, :data)')
+        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $hexName, 'data' => $storedData]);
+    jsonResponse(['ok' => true, 'filename' => $hexName, 'original' => $origName]);
 }
 
 // ── UI inbox view: session reads decrypted messages ──
@@ -71,6 +106,28 @@ if ($route === '/api/messages/inbox' && $method === 'GET' && $sessionTenant) {
     jsonResponse(['messages' => $out]);
 }
 
+// ── UI sent view: messages this user sent to others ──
+
+if ($route === '/api/messages/sent' && $method === 'GET' && $sessionTenant) {
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stmt = $db->prepare('SELECT m.id, m.title, m.body, m.created_at, m.fetched, t.username AS recipient FROM messages m JOIN tenants t ON t.id = m.recipient_id WHERE m.sender_id = :s AND m.recipient_id != :s2 ORDER BY m.created_at DESC LIMIT 200');
+    $stmt->execute(['s' => $sessionTenant['id'], 's2' => $sessionTenant['id']]);
+    $rows = $stmt->fetchAll();
+    $out = [];
+    foreach ($rows as $row) {
+        $out[] = [
+            'id'         => (int)$row['id'],
+            'recipient'  => $row['recipient'] ?? '?',
+            'title'      => clientDecrypt($row['title'] ?? '', $interKey),
+            'body'       => clientDecrypt($row['body'] ?? '', $interKey),
+            'created_at' => $row['created_at'],
+            'fetched'    => (int)$row['fetched'],
+        ];
+    }
+    jsonResponse(['messages' => $out]);
+}
+
 // ── Client API auth (X-Relay-User + X-Relay-Key) ──
 
 $clientTenant = authClient($db);
@@ -155,8 +212,8 @@ if (preg_match('#^/api/messages/(\d+)$#', $route, $m) && $method === 'DELETE') {
     $tenant = $clientTenant ?: $sessionTenant;
     if (!$tenant) jsonResponse(['error' => 'unauthorized'], 401);
     $id = (int)$m[1];
-    $db->prepare('DELETE FROM messages WHERE id = :id AND recipient_id = :r')
-        ->execute(['id' => $id, 'r' => $tenant['id']]);
+    $db->prepare('DELETE FROM messages WHERE id = :id AND (recipient_id = :r OR sender_id = :s)')
+        ->execute(['id' => $id, 'r' => $tenant['id'], 's' => $tenant['id']]);
     jsonResponse(['ok' => true]);
 }