chat

type Access struct {
	// contains filtered or unexported fields
}

type AccessOption func(*Access)

type BlocklistReader interface {
	// GetBlocked returns which of candidateIDs the owner has blocked, as a set
	// keyed by string(userID.Value). Candidates the owner has not blocked are
	// absent from the map.
	GetBlocked(ctx context.Context, ownerID *commonpb.UserId, candidateIDs []*commonpb.UserId) (map[string]bool, error)
}

type Chat struct {
	ID                     *commonpb.ChatId
	Type                   chatpb.ChatType
	Members                []*commonpb.UserId
	RosterSummary          RosterSummary
	Title                  string
	IsStaffOnly            bool
	MinimumListenerBalance *MinimumBalance
	CreatorID              *commonpb.UserId
	PictureBlobID          *blobpb.BlobId
	LastActivity           time.Time
	LastMessageID          *messagingpb.MessageId
}

type ChatEventPublisher interface {
	OnEvent(chatID *commonpb.ChatId, e *eventpb.ChatEvent)
}

type DmFeedCursor struct {
	LastActivity time.Time
	ChatID       *commonpb.ChatId
}

type GroupEdit struct {
	Title         *string
	PictureBlobID *blobpb.BlobId
}

type GroupMember struct {
	UserID   *commonpb.UserId
	JoinedAt time.Time
	Version  uint64
}

type GroupMembership struct {
	ChatID  *commonpb.ChatId
	Joined  bool
	Version uint64
}

type Media interface {
	// ResolveRenditions returns each original's full rendition set — the
	// ORIGINAL plus every derived rendition, each with a freshly minted,
	// short-lived download URL — keyed by string(BlobId.Value). Originals that
	// are unknown or not yet servable are absent from the map. It performs no
	// authorization: the caller passes only ids it has already established the
	// reader may see.
	ResolveRenditions(ctx context.Context, ids []*blobpb.BlobId) (map[string][]*blobpb.Rendition, error)

	// SetAsChatPicture attaches the blob holding a picture's ORIGINAL to chatID
	// as its picture: it verifies that ownerID owns the blob and that it is a
	// READY image original, then grants read access to it on the surfaces the
	// picture is shown from. It is idempotent. It returns one of
	// blob.ErrBlobNotFound, blob.ErrBlobNotReady, blob.ErrBlobRejected, or
	// blob.ErrBlobInvalid when the blob cannot back a picture, having granted
	// nothing; any other error is a failure to attach.
	//
	// It touches only blob-domain state, so it may be called for a chat that
	// does not exist yet — which is how a group is created with its picture in
	// place, rather than briefly without one.
	SetAsChatPicture(ctx context.Context, ownerID *commonpb.UserId, chatID *commonpb.ChatId, blobID *blobpb.BlobId) error
}

type MembersPage struct {
	Users []*commonpb.UserId
	Next  *commonpb.UserId
}

type MessageRef struct {
	ChatID    *commonpb.ChatId
	MessageID *messagingpb.MessageId
}

type MessagingReader interface {
	// LastMessages returns the message for each ref that exists, keyed by
	// string(chatID.Value). Refs without a message are absent from the map.
	LastMessages(ctx context.Context, refs []MessageRef) (map[string]*messagingpb.Message, error)

	// Pointers returns the delivered/read pointers for the members named in each
	// ref, keyed by string(chatID.Value). Chats with no matching pointers are
	// absent from the map.
	Pointers(ctx context.Context, refs []PointerRef) (map[string][]*messagingpb.Pointer, error)

	// LatestEventSequences returns the head event sequence of each given chat,
	// keyed by string(chatID.Value). Chats at head 0 (no messages) are absent from
	// the map, so a missing key means 0.
	LatestEventSequences(ctx context.Context, chatIDs []*commonpb.ChatId) (map[string]uint64, error)
}

type MinimumBalance struct {
	Currency     string
	NativeAmount float64
	Mints        []*commonpb.PublicKey
}

type Mute struct {
	Forever bool
	Until   time.Time
}

type Permissions struct {
	CanEdit bool
}

type PointerRef struct {
	ChatID  *commonpb.ChatId
	Members []*commonpb.UserId
}

type ProfileReader interface {
	// GetPhoneNumbers returns the linked phone number for each of the given
	// users that has one, keyed by string(userID.Value). Users without a linked
	// phone number are absent from the map.
	GetPhoneNumbers(ctx context.Context, userIDs []*commonpb.UserId) (map[string]*commonpb.PhoneNumber, error)

	// GetPublicProfiles returns the public profile of each of the given users the
	// profile domain knows, keyed by string(userID.Value). Unknown users are
	// absent from the map. Every public field a member row shows — display name,
	// profile picture, join timestamp — comes back in this one call.
	//
	// A member who has set neither a name nor a picture still gets an entry,
	// carrying just the join timestamp. Every chat member is a user the profile
	// domain knows, so hydration treats a missing entry as an error rather than
	// standing in a profile of its own.
	//
	// Profile pictures come back with their blob metadata already resolved —
	// including a short-lived download URL — so a client can render member avatars
	// without a follow-up call. The URL expires; to re-mint one the client calls
	// GetBlobs with an AccessContext naming that user's profile, which authorizes
	// it because a profile picture is public.
	//
	// There is one proto per user, so a caller that fills in per-member fields
	// must copy before mutating: the same user can be a member of several chats.
	GetPublicProfiles(ctx context.Context, userIDs []*commonpb.UserId) (map[string]*profilepb.UserProfile, error)
}

type Reading uint8

type RosterPosition struct {
	JoinedAt time.Time
	UserID   *commonpb.UserId
}

type RosterSummary struct {
	MemberCount uint64
	Version     uint64
}

type RuleEvaluator struct {
	// contains filtered or unexported fields
}

type Server struct {
	chatpb.UnimplementedChatServer
	// contains filtered or unexported fields
}

type Standing struct {
	IsMember   bool
	CanListen  bool
	CanPreview bool
}

type Store interface {
	// PutChat persists a new chat and its membership. It returns ErrChatExists
	// if a chat with the same ID already exists, ErrNoMembers if the member set
	// is empty, and an error when the chat ID's length does not match the chat's
	// type family.
	//
	// For a group chat (16-byte ID, type GROUP), Members become group membership
	// records, equivalent to AddGroupMembers, and are written atomically with the
	// canonical record: creation either fully succeeds or leaves nothing behind.
	// Duplicate members collapse. A set larger than MaxGroupChatCreationMembers
	// is rejected with ErrTooManyMembers rather than written non-atomically; a
	// caller wanting a larger group creates it at the cap and grows it with
	// AddGroupMembers. RosterSummary is derived from Members and ignored.
	PutChat(ctx context.Context, chat *Chat) error

	// AddGroupMembers adds users as joined members of a group chat. It is
	// idempotent: adding an already-joined member is a no-op that preserves
	// their original join time, and re-adding a departed member rejoins them
	// fresh. Each member that actually joins is one membership transition,
	// moving the group's RosterSummary atomically with their record. It
	// reports whether any member actually joined, and the summary as of the
	// last write — which may already reflect a concurrent transition by
	// another writer, and so is what a caller should publish as current. It
	// returns ErrChatNotFound if the chat does not exist, and an error if chatID
	// is not a group chat ID.
	AddGroupMembers(ctx context.Context, chatID *commonpb.ChatId, userIDs []*commonpb.UserId) (changed bool, roster RosterSummary, err error)

	// RemoveGroupMember ends a user's membership in a group chat. Departure is
	// a tombstone, not a deletion: the user stops being a member (IsMember
	// false, excluded from GetMembers) but the record of their former
	// membership is kept, and they can be re-added later. Removing a non-member
	// or unknown user is a no-op. A departure that actually happens is one
	// membership transition, moving the group's RosterSummary atomically with
	// the record; changed and roster are as for AddGroupMembers. It returns
	// ErrChatNotFound if the chat does not exist, and an error if chatID is not
	// a group chat ID.
	RemoveGroupMember(ctx context.Context, chatID *commonpb.ChatId, userID *commonpb.UserId) (changed bool, roster RosterSummary, err error)

	// SetGroupPicture sets a group chat's picture to the blob holding its
	// ORIGINAL rendition, replacing any picture already set; a nil blobID clears
	// it. It touches only the canonical record and performs no validation of the
	// blob or granting of read access — that is the blob domain's job, done
	// before this is called (see blob.Integration.SetAsChatPicture). It returns
	// ErrChatNotFound if the chat does not exist, and an error if chatID is not
	// a group chat ID.
	SetGroupPicture(ctx context.Context, chatID *commonpb.ChatId, blobID *blobpb.BlobId) error

	// EditGroup applies edit to a group chat's canonical record (see
	// GroupEdit): each field the edit names is set, and every other field is
	// left as it is, in one write. Like SetGroupPicture it touches only the
	// canonical record and validates nothing — the title is moderated and the
	// picture attached before this is called (see Server.EditChat). It returns
	// ErrChatNotFound if the chat does not exist, and an error if chatID is
	// not a group chat ID or the edit names nothing.
	EditGroup(ctx context.Context, chatID *commonpb.ChatId, edit GroupEdit) error

	// GetChatByID returns the canonical record for the chat with the given ID,
	// or ErrChatNotFound. It reads only that record: Members carries a DM's
	// inline participants and is always empty for a group chat, whose mutable
	// membership lives in its own records. A caller that needs a group's members
	// reads them explicitly via GetMembers, so the cost of enumerating a large
	// group is never paid implicitly by a metadata read. Likewise RosterSummary
	// is a DM's inline summary and zero for a group, whose summary is its own
	// read (GetGroupRosterSummary).
	GetChatByID(ctx context.Context, chatID *commonpb.ChatId) (*Chat, error)

	// GetDmFeedPage returns one page of userID's DM feed for a single chat type,
	// pinned to a snapshot: the DMs of chatType userID is a member of whose
	// last_activity is at or before snapshot, ordered by (last_activity, chat_id)
	// descending (most recent first), at most limit chats (limit <= 0 means
	// unbounded). When cursor is nil the page starts at the most recent chat in
	// the snapshot; otherwise it resumes strictly after cursor. An empty result
	// (no error) is returned when no chats remain.
	//
	// Pinning to a fixed watermark makes a multi-page read internally consistent.
	// last_activity only ever advances to a wall-clock send time, so any chat that
	// becomes active after the snapshot moves strictly above the watermark and
	// leaves the window — it can be neither duplicated onto nor skipped within a
	// later page. Those freshly-active chats are surfaced through the live
	// MetadataUpdate event stream instead (see the Chat service's GetDmChatFeed).
	//
	// It is scoped to a single DM type because each type is its own feed (see
	// GetDmChatFeedRequest.dm_chat_type). Group chats will have a parallel
	// accessor, and the server merges the descending streams into one feed.
	GetDmFeedPage(ctx context.Context, userID *commonpb.UserId, chatType chatpb.ChatType, snapshot time.Time, cursor *DmFeedCursor, limit int) ([]*Chat, error)

	// GetMembers returns the member user IDs of a chat, or ErrChatNotFound. For
	// a DM this is the canonical inline member list; for a group chat it is the
	// currently joined members.
	GetMembers(ctx context.Context, chatID *commonpb.ChatId) ([]*commonpb.UserId, error)

	// GetGroupMembersPage is GetMembers as a walk over a group's roster: the
	// currently joined members in ascending user-ID (byte) order, strictly
	// after the after cursor (nil starts at the beginning), at most limit of
	// them (limit <= 0 means unbounded). The order is the one
	// GetMutedUsersPage returns a chat's mutes in, so a fan-out can read the
	// mutes between a roster page's first and last user and never hold either
	// whole; that is what bounds a push to a large group by its page size
	// rather than its membership. A page's cursor is the last user it
	// carries whenever the limit was reached, whether or not any member
	// follows, so the walk may end on an empty, final page.
	//
	// It reads the membership records alone, never the canonical record: a
	// group that does not exist is an empty page, not ErrChatNotFound, and a
	// caller that needs the distinction reads GetChatByID first — which the
	// walkers do anyway, for the metadata a push carries. Like GetMembers, it
	// may lag a transition by a moment. It returns an error if chatID is not a
	// group chat ID.
	GetGroupMembersPage(ctx context.Context, chatID *commonpb.ChatId, after *commonpb.UserId, limit int) (MembersPage, error)

	// GetGroupRoster returns a group's RosterSummary and every joined member
	// (see GroupMember), in no particular order, from one strongly consistent
	// read: the members are exactly the roster at the summary's version, and
	// the summary's count is their number — an implementation whose read is
	// not a snapshot verifies that against the rows and re-reads, a bounded
	// number of times, when a transition landed mid-read, so the promise holds
	// short of a roster churning faster than it can be read. It is the read
	// behind a small group's roster page, which promises a client exactly
	// that (see Server.GetRoster); it costs the whole roster, so a caller
	// sizes the group first (GetGroupRosterSummary) and pages a large one with
	// GetGroupRosterPage instead. It returns ErrChatNotFound if the chat does
	// not exist, and an error if chatID is not a group chat ID.
	GetGroupRoster(ctx context.Context, chatID *commonpb.ChatId) (RosterSummary, []GroupMember, error)

	// GetGroupRosterPage is one page of a group's joined members in roster
	// order (see RosterPosition): most recently joined first, strictly after
	// the after position (nil starts at the newest member), at most limit of
	// them (limit <= 0 means unbounded). A position need not name a current
	// member: a cursor whose member has since left resumes just as well. The
	// read may lag a transition by a moment — it is served from an index of
	// the joined members in join order rather than the records themselves, so
	// a member who just joined may be missing and one who just left may still
	// appear — which is what a large group's page tolerates (see
	// Server.GetRoster). It reads the membership records alone, never the
	// canonical record, so a group that does not exist is an empty page. It
	// returns an error if chatID is not a group chat ID.
	GetGroupRosterPage(ctx context.Context, chatID *commonpb.ChatId, after *RosterPosition, limit int) ([]GroupMember, error)

	// GetGroupMemberRecords returns userID's joined membership record (see
	// GroupMember) on each of chatIDs they are currently a member of, keyed by
	// string(chatID.Value); a chat they are not joined to — never, or no
	// longer — or that does not exist is absent rather than reported, and
	// duplicate IDs collapse. The read is strongly consistent, as IsMember is
	// and for the same reason: it is asked about a chat the user just joined
	// or created, to announce the record the join wrote (see
	// RosterUpdate.MemberJoined). It returns an error if any ID is not a group
	// chat ID, and an empty map (no error) when chatIDs is empty.
	GetGroupMemberRecords(ctx context.Context, userID *commonpb.UserId, chatIDs []*commonpb.ChatId) (map[string]GroupMember, error)

	// GetGroupRosterSummary returns a group chat's RosterSummary, maintained
	// alongside its membership records rather than computed by enumerating
	// them — so a group's size and version are known without paying for its
	// member list, and stay known once GetMembers returns only a subset.
	//
	// A caller that hands both the summary and a member list to a client reads
	// the summary first: any transition that lands during the enumeration is
	// then above the version handed out, so the client sees it as stale and
	// refetches. Read the other way round, a client could hold a version newer
	// than its list. It returns ErrChatNotFound if the chat does not exist, and
	// an error if chatID is not a group chat ID.
	GetGroupRosterSummary(ctx context.Context, chatID *commonpb.ChatId) (RosterSummary, error)

	// GetGroupRosterSummaries is the cross-chat batch counterpart to
	// GetGroupRosterSummary: the summary of each given group chat, keyed by
	// string(chatID.Value), read as a batch rather than one read per chat. A
	// chat that does not exist is absent from the map rather than reported —
	// which callers passing chats they hold never hit. Duplicate IDs collapse.
	// It returns an error if any ID is not a group chat ID, and an empty map
	// (no error) when chatIDs is empty.
	GetGroupRosterSummaries(ctx context.Context, chatIDs []*commonpb.ChatId) (map[string]RosterSummary, error)

	// GetGroupRules returns a group chat's participation rules (see
	// Chat.Rules), or nil when it has none. It reads only what the rules are
	// projected from, never the full canonical record — and rules are fixed at
	// creation, so an implementation is free to cache them indefinitely. It
	// returns ErrChatNotFound if the chat does not exist, and an error if chatID
	// is not a group chat ID.
	GetGroupRules(ctx context.Context, chatID *commonpb.ChatId) (*chatpb.Rules, error)

	// IsMember reports whether userID is a member of chatID. It returns false
	// (no error) when the chat does not exist, or when a group member has been
	// removed. The read is strongly consistent: it reflects every join, leave
	// and creation that completed before it. It is the authority behind every
	// access gate (see Access), and the first thing a user does after joining
	// or creating a chat is act in it, so a read that could lag the write
	// would deny exactly that action.
	IsMember(ctx context.Context, chatID *commonpb.ChatId, userID *commonpb.UserId) (bool, error)

	// GetGroupMembershipsForUser returns every group chat userID has a
	// membership record on — joined or departed — in no particular order, each
	// with its state and the version of the user's last transition there (see
	// GroupMembership). A user with no records gets an empty result, not an
	// error. It is the inverse of GetMembers over the membership records alone
	// — no canonical chat metadata is read or returned; a caller that needs it
	// follows up with GetChatByID, and one that wants only current memberships
	// filters on Joined (see GetGroupChatsForUser).
	GetGroupMembershipsForUser(ctx context.Context, userID *commonpb.UserId) ([]GroupMembership, error)

	// GetGroupChatsForUser returns the canonical record of every group chat
	// userID is currently a joined member of, in no particular order. It is
	// GetGroupMembershipsForUser, less the departed records, followed by the
	// canonical read of each ID, and returns records exactly as GetChatByID
	// does: Members empty and RosterSummary zero. A user with no group
	// memberships gets an empty result, not an error.
	//
	// It is the group feed's source: with no per-member activity index, a user's
	// groups are ordered by reading every one of them and sorting — so this is
	// paid once per feed snapshot, and the order is carried forward from there
	// (see Server.GetGroupChatFeed).
	GetGroupChatsForUser(ctx context.Context, userID *commonpb.UserId) ([]*Chat, error)

	// GetGroupChatsForUserByIDs is GetGroupChatsForUser restricted to chatIDs:
	// the canonical record of each given group chat that exists and that userID
	// is currently a joined member of, in no particular order. IDs the user is
	// not a member of (never, or no longer) and IDs of chats that do not exist
	// are omitted rather than reported; duplicate IDs collapse. It returns an
	// error if any ID is not a group chat ID, and an empty result (no error) when
	// chatIDs is empty.
	//
	// Membership is checked here, per ID, against the membership records — the
	// IDs are a caller's hint of what to read, never its authority to read it.
	// The group feed resumes from IDs a client echoed back in a paging token,
	// and this is what keeps a tampered token, or one that outlived the caller's
	// membership, from surfacing a chat they cannot see.
	GetGroupChatsForUserByIDs(ctx context.Context, userID *commonpb.UserId, chatIDs []*commonpb.ChatId) ([]*Chat, error)

	// AdvanceLastMessage records messageID as the chat's most recent message,
	// moving last_activity forward to ts and last_message_id to messageID, and
	// reports whether it advanced. The two fields are two views of the same event
	// (the newest message) and are updated together. If the stored last_activity
	// is already at or after ts, it is a no-op and reports advanced=false. It
	// returns ErrChatNotFound if the chat does not exist.
	//
	// For a DM it also returns the chat's members — the set the new activity is
	// fanned out to, which rides on the canonical record it must load regardless.
	// A caller that goes on to broadcast the same activity can reuse this set
	// instead of issuing a separate GetMembers. Members are returned on both the
	// advanced and no-op paths; they are nil on error (including
	// ErrChatNotFound). A group chat's membership lives in its own records, so
	// members is empty and the caller reads GetMembers itself.
	AdvanceLastMessage(ctx context.Context, chatID *commonpb.ChatId, messageID *messagingpb.MessageId, ts time.Time) (advanced bool, members []*commonpb.UserId, err error)

	// SetMute records mute as userID's mute on chatID, replacing any mute
	// already set, and returns the state after the write. changed reports
	// whether anything moved: recording the mute already recorded (after
	// Mute.Normalize) is a no-op that returns the current state at its
	// current version. It returns ErrMuteUntilOutOfRange for a timed mute
	// outside the recordable range (see Mute).
	SetMute(ctx context.Context, chatID *commonpb.ChatId, userID *commonpb.UserId, mute Mute) (state ViewerState, changed bool, err error)

	// ClearMute removes userID's mute on chatID, lapsed or not, and returns
	// the state after the write. Clearing when no mute is recorded is a no-op
	// that returns the current state — the zero state when the user has no
	// record, which the no-op does not create.
	ClearMute(ctx context.Context, chatID *commonpb.ChatId, userID *commonpb.UserId) (state ViewerState, changed bool, err error)

	// GetViewerStates returns userID's state on each of chatIDs that they have
	// a record on, keyed by string(chatID.Value); a chat with no record is
	// absent rather than reported, and duplicate IDs collapse. The read is
	// strongly consistent: it reflects every write that completed before it,
	// so the user who just muted sees the mute. An empty chatIDs is an empty
	// result, not an error.
	GetViewerStates(ctx context.Context, userID *commonpb.UserId, chatIDs []*commonpb.ChatId) (map[string]ViewerState, error)

	// GetMutedUsers returns the users whose mute on chatID is active at now
	// (see Mute.Active), at most limit of them when limit is positive; which
	// users are omitted when the limit truncates is unspecified, and the
	// order is arbitrary. It reads only the recorded mutes, so it is the
	// cheaper read for a chat few have muted; see GetMutedCount for choosing.
	// The read may lag a write by a moment — it is the fan-out's read, where
	// a mute that lands during a send is tolerated, and the flag it feeds is
	// best-effort by contract — and a caller that needs a user's own current
	// state reads GetViewerStates instead.
	GetMutedUsers(ctx context.Context, chatID *commonpb.ChatId, now time.Time, limit int) ([]*commonpb.UserId, error)

	// GetMutedUsersPage is GetMutedUsers bounded to a key range: the users
	// whose mute on chatID is active at now and whose ID lies in [lo, hi]
	// (byte order, inclusive; a nil bound is open on that side), in ascending
	// user-ID order. The order is the one GetGroupMembersPage walks a group's
	// roster in, so a fan-out that holds one page of the roster asks for the
	// mutes between that page's first and last user and never holds either
	// whole; that is the read for a chat most have muted. It reads every
	// record the chat's users hold in the range, muted or not — including
	// records of users who have since left, which a caller intersects with
	// the roster — and consistency is as for GetMutedUsers.
	GetMutedUsersPage(ctx context.Context, chatID *commonpb.ChatId, now time.Time, lo, hi *commonpb.UserId) ([]*commonpb.UserId, error)

	// GetMutedCount returns how many users have a mute recorded on chatID:
	// moved with every mute first recorded or cleared, never by a replaced
	// mute or a timed one lapsing, so it bounds the active mutes from above.
	// It is what a fan-out compares against the roster size to choose
	// between GetMutedUsers and GetMutedUsersPage, and is read for that
	// alone: like them, it may lag a write by a moment, which a choice of
	// shape tolerates. A chat nobody has muted reads as zero.
	GetMutedCount(ctx context.Context, chatID *commonpb.ChatId) (uint64, error)
}

type UserEventPublisher interface {
	OnEvent(userID *commonpb.UserId, e *eventpb.Event)
}

type ViewerState struct {
	Mute    *Mute
	Version uint64
}