relay: file attachments, outbox, CC-self, chat view, mobile layout

Compose: attach files (encrypted, hex-named, linked via relay_uid), CC-self checkbox tags copy with recipient name. Outbox section shows sent messages with delete. Chat view: session-based threads/history/ send endpoints, split layout with sidebar, read receipts, 5s poll. Mobile: threads as horizontal scroll bar above messages. Fix chat input pushed offscreen by adding min-height:0 on flex container. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 08:48:23 +02:00
1 parent 9f85e484c4
commit 6c0ca4373b
@@ -17,8 +17,93 @@

 if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }

-// $clientTenant is set by messages.php earlier in the chain via authClient().
-// We re-resolve here to keep this file self-contained.
+// ── Session-based chat (relay UI) ──
+
+if ($route === '/api/chat/threads' && $method === 'GET' && $sessionTenant) {
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $myId = $sessionTenant['id'];
+    $stmt = $db->prepare('
+        SELECT sender_username AS peer, MAX(created_at) AS last_at, COUNT(*) AS count
+        FROM chat_messages WHERE recipient_id = :r
+        GROUP BY sender_username
+        UNION
+        SELECT t.username AS peer, MAX(cm.created_at) AS last_at, COUNT(*) AS count
+        FROM chat_messages cm JOIN tenants t ON t.id = cm.recipient_id
+        WHERE cm.sender_id = :s AND cm.recipient_id != :s2
+        GROUP BY t.username
+    ');
+    $stmt->execute(['r' => $myId, 's' => $myId, 's2' => $myId]);
+    $rows = $stmt->fetchAll();
+    $threads = [];
+    foreach ($rows as $row) {
+        $peer = $row['peer'];
+        if (!isset($threads[$peer])) $threads[$peer] = ['peer' => $peer, 'last_at' => $row['last_at'], 'count' => 0];
+        $threads[$peer]['count'] += (int)$row['count'];
+        if ($row['last_at'] > $threads[$peer]['last_at']) $threads[$peer]['last_at'] = $row['last_at'];
+    }
+    usort($threads, fn($a, $b) => strcmp($b['last_at'], $a['last_at']));
+    // Add unread count per peer
+    foreach ($threads as &$t) {
+        $stmt2 = $db->prepare('SELECT COUNT(*) FROM chat_messages WHERE recipient_id = :r AND sender_username = :p AND seen = 0');
+        $stmt2->execute(['r' => $myId, 'p' => $t['peer']]);
+        $t['unread'] = (int)$stmt2->fetchColumn();
+    }
+    jsonResponse(array_values($threads));
+}
+
+if ($route === '/api/chat/history' && $method === 'GET' && $sessionTenant) {
+    $peer = trim($_GET['peer'] ?? '');
+    if (!$peer) jsonResponse(['error' => 'peer required'], 400);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $myId = $sessionTenant['id'];
+    $peerTenant = getTenantByUsername($db, $peer);
+    if (!$peerTenant) jsonResponse(['error' => 'unknown peer'], 404);
+    $peerId = $peerTenant['id'];
+    $stmt = $db->prepare('
+        SELECT id, sender_id, sender_username, body, created_at, seen
+        FROM chat_messages
+        WHERE (recipient_id = :r AND sender_id = :p) OR (recipient_id = :p2 AND sender_id = :s)
+        ORDER BY created_at ASC LIMIT 500
+    ');
+    $stmt->execute(['r' => $myId, 'p' => $peerId, 'p2' => $peerId, 's' => $myId]);
+    $rows = $stmt->fetchAll();
+    $out = [];
+    foreach ($rows as $row) {
+        $out[] = [
+            'id' => (int)$row['id'],
+            'from' => $row['sender_username'],
+            'mine' => (int)$row['sender_id'] === $myId,
+            'body' => clientDecrypt($row['body'] ?? '', $interKey),
+            'created_at' => $row['created_at'],
+            'seen' => (int)$row['seen'],
+        ];
+    }
+    // Mark incoming as seen
+    $db->prepare('UPDATE chat_messages SET seen = 1 WHERE recipient_id = :r AND sender_id = :p AND seen = 0')
+        ->execute(['r' => $myId, 'p' => $peerId]);
+    jsonResponse($out);
+}
+
+if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
+    $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $body = trim((string)($input['body'] ?? ''));
+    $recipientName = trim((string)($input['recipient'] ?? ''));
+    if ($body === '') jsonResponse(['error' => 'body required'], 400);
+    if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
+    $recipient = getTenantByUsername($db, $recipientName);
+    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stored = clientEncrypt($body, $interKey);
+    $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body) VALUES (:r, :s, :sn, :b)')
+        ->execute(['r' => $recipient['id'], 's' => $sessionTenant['id'], 'sn' => $sessionTenant['username'], 'b' => $stored]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
+}
+
+// ── Client API ──
+
 $clientTenant = $clientTenant ?? authClient($db);

 if ($route === '/api/chat' && $method === 'POST') {