feat: chat — saisie auto-agrandissante, accusé de réception ✓✓, vignette de tuile #192 (BUG-109)

backend/file_chat.py

@@ -20,10 +20,12 @@ import json
 import logging
 import re
 import shutil
+import threading
 import time
 import uuid
 from pathlib import Path
 from typing import Any
+from urllib.parse import urljoin, urlparse
 
 import httpx
 
@@ -33,6 +35,11 @@ CHAT_DIR = Path("data/chats")
 MAX_MESSAGES = 500  # retention ceiling per file (oldest dropped first)
 MAX_TEXT = 4000  # characters per message
 
+# ponytail: global lock over read-modify-write — chat writes are HTTP-only and
+# serialized anyway, this just makes losing a message to a future thread (or a
+# watcher hook) impossible; per-file locks if it ever becomes contended.
+_LOCK = threading.RLock()
+
 # #190 — general (non file-bound) conversation, stored like any other one.
 GLOBAL_VAULT = "__global__"
 GLOBAL_PATH = "general"
@@ -53,6 +60,7 @@ ALLOWED_ATTACH_EXT = {
 # #191 — link preview fetch budget
 PREVIEW_TIMEOUT = 5.0  # seconds
 PREVIEW_MAX_BYTES = 512 * 1024  # only the head of the page is parsed
+PREVIEW_IMAGE_MAX = 2 * 1024 * 1024  # ponytail: 2 MB ceiling on a thumbnail
 
 
 def _chat_file(vault: str, path: str) -> Path:
@@ -117,26 +125,56 @@ def add_message(
         msg["attachment"] = attachment
     if preview:
         msg["preview"] = preview
-    doc = _read(vault, path)
-    return _append(vault, path, doc, msg)
+    return _append(vault, path, msg)
 
 
 def _append(
     vault: str,
     path: str,
-    doc: dict[str, Any],
     msg: dict[str, Any],
 ) -> dict[str, Any]:
-    """Cap, persist and return *msg* (shared by file and global chats)."""
-    messages = list(doc.get("messages", []))
-    messages.append(msg)
-    if len(messages) > MAX_MESSAGES:
-        messages = messages[-MAX_MESSAGES:]
-    doc["messages"] = messages
-    _write(_chat_file(vault, path), doc)
+    """Cap, persist and return *msg* (shared by file, global and DM chats).
+
+    The read-modify-write of the whole document happens under ``_LOCK`` so a
+    concurrent writer can never drop a message (same class of bug as
+    BUG-029 on ``users.json``).
+    """
+    with _LOCK:
+        doc = _read(vault, path)
+        messages = list(doc.get("messages", []))
+        messages.append(msg)
+        if len(messages) > MAX_MESSAGES:
+            messages = messages[-MAX_MESSAGES:]
+        doc["messages"] = messages
+        _write(_chat_file(vault, path), doc)
     return msg
 
 
+# --- #192 : accusé de réception ---------------------------------------------
+
+def get_read(vault: str, path: str) -> dict[str, float]:
+    """Return ``{username: last_read_ts}`` for a conversation (#192)."""
+    return {str(u): float(ts) for u, ts in (_read(vault, path).get("read") or {}).items()}
+
+
+def mark_read(vault: str, path: str, user: str) -> dict[str, float]:
+    """Record that *user* has seen the conversation (#192).
+
+    Returns the whole read map so the caller can broadcast it on SSE: a
+    sender learns their messages were received as soon as the recipient
+    displays the conversation.
+    """
+    if not user:
+        return get_read(vault, path)
+    with _LOCK:
+        doc = _read(vault, path)
+        read = {str(u): float(ts) for u, ts in (doc.get("read") or {}).items()}
+        read[user] = time.time()
+        doc["read"] = read
+        _write(_chat_file(vault, path), doc)
+        return read
+
+
 # --- #191 : messages privés (2 utilisateurs) -------------------------------
 
 def dm_path(user_a: str, user_b: str) -> str:
@@ -168,13 +206,14 @@ def add_dm_message(
 
 def delete_message(vault: str, path: str, message_id: str) -> bool:
     """Remove one message from a conversation. True when it existed."""
-    doc = _read(vault, path)
-    messages = list(doc.get("messages", []))
-    kept = [m for m in messages if m.get("id") != message_id]
-    if len(kept) == len(messages):
-        return False
-    doc["messages"] = kept
-    _write(_chat_file(vault, path), doc)
+    with _LOCK:
+        doc = _read(vault, path)
+        messages = list(doc.get("messages", []))
+        kept = [m for m in messages if m.get("id") != message_id]
+        if len(kept) == len(messages):
+            return False
+        doc["messages"] = kept
+        _write(_chat_file(vault, path), doc)
     return True
 
 
@@ -248,13 +287,55 @@ def _og(content: str, prop: str) -> str:
     return ""
 
 
+# BUG-109 — content-type → extension (the attachment allow-list decides).
+_IMG_EXT_BY_MIME = {
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+    "image/svg+xml": ".svg",
+}
+
+
+def _proxy_image(img_url: str, page_url: str) -> str:
+    """Download *img_url* into ``chat_uploads`` and return a same-origin URL.
+
+    The response CSP is ``img-src 'self' data: blob:``: a remote ``og:image``
+    would be blocked by the browser (BUG-109). Relative and protocol-relative
+    values are resolved against *page_url* first. Raises ``ValueError`` /
+    ``SSRFError`` on any failure — the caller keeps the card and drops only
+    the thumbnail.
+    """
+    from backend.tools.web import USER_AGENT, _assert_public_http_url
+
+    full = urljoin(page_url, img_url)
+    _assert_public_http_url(full)
+    resp = httpx.get(
+        full,
+        headers={"User-Agent": USER_AGENT},
+        timeout=PREVIEW_TIMEOUT,
+        follow_redirects=True,
+    )
+    if resp.status_code >= 400:
+        raise ValueError(f"HTTP {resp.status_code}")
+    data = resp.content
+    if not data or len(data) > PREVIEW_IMAGE_MAX:
+        raise ValueError("image vide ou trop lourde")
+    mime = (resp.headers.get("content-type") or "").split(";")[0].strip().lower()
+    ext = _IMG_EXT_BY_MIME.get(mime) or Path(urlparse(full).path).suffix.lower()
+    # save_attachment(): allow-list d'extensions + nom UUID (jamais le nom distant)
+    return str(save_attachment(f"preview{ext}", data)["url"])
+
+
 def build_preview(text: str) -> dict[str, Any] | None:
     """Fetch OpenGraph metadata for the first URL in *text* (#191).
 
     SSRF-guarded (reuses the web-tool guard), size/time capped, cached in a
     bounded dict. Returns ``{url, title, description, image, site}`` or
     ``None`` when there is no URL / the fetch fails (never raises: a dead
-    link must not block the message).
+    link must not block the message). ``image`` is a **same-origin**
+    ``/api/chat/attachment/...`` URL (BUG-109), empty when the thumbnail
+    could not be fetched.
     """
     m = _URL_RE.search(text or "")
     if not m:
@@ -276,11 +357,19 @@ def build_preview(text: str) -> dict[str, Any] | None:
         if resp.status_code >= 400:
             raise ValueError(f"HTTP {resp.status_code}")
         body = resp.text[:PREVIEW_MAX_BYTES]
+        # BUG-109 : vignette téléchargée côté serveur — une image distante
+        # échouerait à la CSP. Échec isolé = carte sans vignette.
+        image = _og(body, "og:image")
+        try:
+            image = _proxy_image(image, url) if image else ""
+        except Exception as ie:
+            logger.debug("preview image failed for %s: %s", url, ie)
+            image = ""
         preview = {
             "url": url,
             "title": _og(body, "og:title") or _og(body, "og:site_name"),
             "description": _og(body, "og:description"),
-            "image": _og(body, "og:image"),
+            "image": image,
             "site": _og(body, "og:site_name") or (url.split("/")[2] if "/" in url[8:] else url),
         }
         if not preview["title"]:

backend/routers/file_chat.py

@@ -24,7 +24,7 @@ from backend import file_chat as _store
 from backend.auth.middleware import check_vault_access, require_auth
 from backend.auth.user_store import get_all_users, get_user
 from backend.indexer import get_vault_data
-from backend.schemas import ChatHistoryResponse, ChatMessageResponse, StatusResponse
+from backend.schemas import ChatHistoryResponse, ChatMessageResponse, ChatReadResponse, StatusResponse
 from backend.services.paths import resolve_safe_path
 from backend.sse import sse_manager
 
@@ -49,7 +49,7 @@ async def api_file_chat_history(
 ):
     """Return the chat history for a file (chronological)."""
     _check(vault_name, path, current_user)
-    return {"messages": _store.get_messages(vault_name, path)}
+    return {"messages": _store.get_messages(vault_name, path), "read": _store.get_read(vault_name, path)}
 
 
 @router.post("/api/file/{vault_name}/chat", response_model=ChatMessageResponse)
@@ -93,7 +93,51 @@ def _attachment(body: dict[str, Any]) -> dict[str, Any] | None:
 @router.get("/api/chat", response_model=ChatHistoryResponse)
 async def api_chat_history(current_user: dict[str, Any] = Depends(require_auth)):
     """Return the general chat history (#190, chronological)."""
-    return {"messages": _store.get_global_messages()}
+    return {
+        "messages": _store.get_global_messages(),
+        "read": _store.get_read(_store.GLOBAL_VAULT, _store.GLOBAL_PATH),
+    }
+
+
+# --- #192 : accusé de réception ---------------------------------------------
+
+def _check_read(vault: str, path: str, current_user: dict[str, Any]) -> None:
+    """Authorization for marking a conversation read (#192).
+
+    General chat is open to any member, a DM only to the two participants,
+    a file chat follows the vault ACL.
+    """
+    if vault == _store.GLOBAL_VAULT:
+        return
+    if vault == _store.DM_VAULT:
+        if current_user.get("username") not in str(path).split("|"):
+            raise HTTPException(403, "Accès refusé à cette conversation privée")
+        return
+    _check(vault, path, current_user)
+
+
+@router.post("/api/chat/read", response_model=ChatReadResponse)
+async def api_chat_read(
+    body: dict[str, Any] = Body(...),
+    current_user: dict[str, Any] = Depends(require_auth),
+):
+    """Record that the caller has seen a conversation (#192).
+
+    Broadcast on SSE (``chat_read``) so the sender's own messages flip to
+    ✓✓ live on every connected client.
+    """
+    vault = str(body.get("vault") or "")
+    path = str(body.get("path") or "")
+    if not vault or not path:
+        raise HTTPException(400, "vault and path are required")
+    _check_read(vault, path, current_user)
+    username = current_user.get("username", "")
+    read = _store.mark_read(vault, path, username)
+    await sse_manager.broadcast(
+        "chat_read",
+        {"vault": vault, "path": path, "user": username, "ts": read.get(username, 0.0), "read": read},
+    )
+    return {"read": read, "status": "ok"}
 
 
 @router.post("/api/chat", response_model=ChatMessageResponse)
@@ -199,7 +243,10 @@ def _dm_peer(username: str, current_user: dict[str, Any]) -> str:
 async def api_chat_dm_history(username: str, current_user: dict[str, Any] = Depends(require_auth)):
     """Private history with *username* (#191)."""
     peer = _dm_peer(username, current_user)
-    return {"messages": _store.get_dm_messages(current_user["username"], peer)}
+    return {
+        "messages": _store.get_dm_messages(current_user["username"], peer),
+        "read": _store.get_read(_store.DM_VAULT, _store.dm_path(current_user["username"], peer)),
+    }
 
 
 @router.post("/api/chat/dm/{username}", response_model=ChatMessageResponse)

backend/schemas.py

@@ -172,6 +172,17 @@ class ChatHistoryResponse(BaseModel):
     """Response for ``GET /api/file/{vault}/chat``."""
 
     messages: list[ChatMessageItem] = Field(description="Messages, chronological")
+    read: dict[str, float] = Field(
+        default_factory=dict,
+        description="{username: last read unix ts} per participant (#192)",
+    )
+
+
+class ChatReadResponse(BaseModel):
+    """Response for ``POST /api/chat/read`` (#192 read receipts)."""
+
+    read: dict[str, float] = Field(description="{username: last read unix ts}")
+    status: str = Field(description="'ok'")
 
 
 class ChatMessageResponse(BaseModel):