Added privacy check to ensure the reader's sendReadReceipts setting i… - #417
Merged
codebestia merged 3 commits intoJul 30, 2026
Merged
Conversation
- Updated the conversation list handler to map preview messages through serializeConversation. - Applied serializeMessage to ensure the preview shape matches the GET /:id response. - Prevented the accidental leakage of plaintext content fields in the raw conversation object. - Added explicit tests asserting the list response contains no plaintext fields. - Verified in tests that the preview message perfectly matches the standard ciphertext-safe shape. Closes codebestia#338
- Added privacy check to ensure the reader's sendReadReceipts setting is true before broadcasting. - Implemented a monotonic cursor guard to ensure lastReadMessageId only ever advances forward. - Updated the handler to stamp messageEnvelopes.readAt for the reader's device envelopes. - Ignored backwards cursor updates to prevent stale read receipts from regressing state. - Added comprehensive tests covering the privacy toggle, backwards rejection, and readAt persistence. Closes codebestia#339
johdanike
force-pushed
the
fix/read-receipts-privacy-cursor
branch
from
July 29, 2026 13:58
1bc7195 to
721c30b
Compare
|
@johdanike Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR resolves #339 by addressing three critical gaps in the
message_readhandler. Previously, read receipts were broadcasted unconditionally (ignoring user privacy settings), the read cursor could be accidentally rolled back by stale network requests, and per-device read states were completely ignored. This update secures the read receipt pipeline to be privacy-respecting, strictly monotonic, and device-accurate.Changes Made
sendReadReceiptspreference. If disabled, the local state is updated but the broadcast event is safely suppressed.conversationMembers.lastReadMessageIdis now guarded. The update evaluates whether the incoming message ID is actually newer than the current cursor; if it is an older/stale ID, the update is treated as a no-op and rejected safely.readAtStamping: The handler now correctly writes the timestamp to thereadAtcolumn inmessageEnvelopesfor the reading device's own envelope rows, accurately capturing per-device consumption up to the read point.readAtfield.Acceptance Criteria Met
message_readchecks the reading user'ssendReadReceiptssetting before broadcasting.lastReadMessageIdonly ever advances — backwards updates are rejected/no-op'd.messageEnvelopes.readAtis stamped for the reading device's own envelope rows up to the read point.readAtpersisted per envelope.Closes #339