feat: chat — suppression de post, messages privés, boîte compacte, link preview #191

backend/file_chat.py

@@ -15,14 +15,18 @@ uploaded under ``data/chat_uploads/``.
 from __future__ import annotations
 
 import hashlib
+import html
 import json
 import logging
+import re
 import shutil
 import time
 import uuid
 from pathlib import Path
 from typing import Any
 
+import httpx
+
 logger = logging.getLogger("obsigate.file_chat")
 
 CHAT_DIR = Path("data/chats")
@@ -33,6 +37,11 @@ MAX_TEXT = 4000  # characters per message
 GLOBAL_VAULT = "__global__"
 GLOBAL_PATH = "general"
 
+# #191 — private (2 users) conversations reuse the same store: the vault is
+# the reserved sentinel and the path is the sorted username pair, so the
+# storage key never depends on who asks.
+DM_VAULT = "__dm__"
+
 # #190 — attachments (image/video) live outside the vaults.
 UPLOAD_DIR = Path("data/chat_uploads")
 MAX_UPLOAD_BYTES = 25 * 1024 * 1024  # 25 MB per attachment
@@ -41,6 +50,10 @@ ALLOWED_ATTACH_EXT = {
     ".mp4", ".webm", ".ogg", ".mov", ".m4v",
 }
 
+# #191 — link preview fetch budget
+PREVIEW_TIMEOUT = 5.0  # seconds
+PREVIEW_MAX_BYTES = 512 * 1024  # only the head of the page is parsed
+
 
 def _chat_file(vault: str, path: str) -> Path:
     """Return the chat file for *(vault, path)* (hashed, traversal-proof)."""
@@ -85,11 +98,13 @@ def add_message(
     user: str,
     text: str,
     attachment: dict[str, Any] | None = None,
+    preview: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Append a message and persist it. Returns the stored message.
 
     The list is capped at :data:`MAX_MESSAGES` (oldest dropped first).
-    *attachment* (#190) is ``{name, url, mime, kind}`` for image/video/url.
+    *attachment* (#190) is ``{name, url, mime, kind}`` for image/video/url;
+    *preview* (#191) is the OpenGraph card of the first URL in *text*.
     """
     text = (text or "").strip()[:MAX_TEXT]
     msg: dict[str, Any] = {
@@ -100,6 +115,8 @@ def add_message(
     }
     if attachment:
         msg["attachment"] = attachment
+    if preview:
+        msg["preview"] = preview
     doc = _read(vault, path)
     return _append(vault, path, doc, msg)
 
@@ -120,6 +137,47 @@ def _append(
     return msg
 
 
+# --- #191 : messages privés (2 utilisateurs) -------------------------------
+
+def dm_path(user_a: str, user_b: str) -> str:
+    """Storage path for the private conversation between two users.
+
+    The pair is sorted so both participants address the same document.
+    """
+    return "|".join(sorted([user_a, user_b]))
+
+
+def get_dm_messages(user_a: str, user_b: str) -> list[dict[str, Any]]:
+    """Return the private history between two users (chronological)."""
+    return get_messages(DM_VAULT, dm_path(user_a, user_b))
+
+
+def add_dm_message(
+    user_a: str,
+    user_b: str,
+    author: str,
+    text: str,
+    attachment: dict[str, Any] | None = None,
+    preview: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Append a private message. Returns the stored message."""
+    return add_message(DM_VAULT, dm_path(user_a, user_b), author, text, attachment, preview)
+
+
+# --- #191 : suppression -----------------------------------------------------
+
+def delete_message(vault: str, path: str, message_id: str) -> bool:
+    """Remove one message from a conversation. True when it existed."""
+    doc = _read(vault, path)
+    messages = list(doc.get("messages", []))
+    kept = [m for m in messages if m.get("id") != message_id]
+    if len(kept) == len(messages):
+        return False
+    doc["messages"] = kept
+    _write(_chat_file(vault, path), doc)
+    return True
+
+
 # --- #190 : chat général (conversation centrale, hors fichier) -------------
 
 def get_global_messages() -> list[dict[str, Any]]:
@@ -131,9 +189,10 @@ def add_global_message(
     user: str,
     text: str,
     attachment: dict[str, Any] | None = None,
+    preview: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Append a message to the general chat. Returns the stored message."""
-    return add_message(GLOBAL_VAULT, GLOBAL_PATH, user, text, attachment)
+    return add_message(GLOBAL_VAULT, GLOBAL_PATH, user, text, attachment, preview)
 
 
 def save_attachment(filename: str, data: bytes) -> dict[str, Any]:
@@ -166,6 +225,75 @@ def save_attachment(filename: str, data: bytes) -> dict[str, Any]:
     }
 
 
+# --- #191 : link preview ----------------------------------------------------
+
+_URL_RE = re.compile(r"https?://[^\s<>\"']+")
+_PREVIEW_CACHE: dict[str, dict[str, Any] | None] = {}
+PREVIEW_CACHE_MAX = 200
+
+
+def _og(content: str, prop: str) -> str:
+    """Extract one OpenGraph/``<title>`` value from an HTML head (regex)."""
+    for pattern in (
+        rf'<meta[^>]+(?:property|name)="{prop}"[^>]+content="([^"]*)"',
+        rf'<meta[^>]+content="([^"]*)"[^>]+(?:property|name)="{prop}"',
+    ):
+        m = re.search(pattern, content, re.IGNORECASE)
+        if m:
+            return html.unescape(m.group(1)).strip()[:300]
+    if prop == "og:title":
+        m = re.search(r"<title[^>]*>([^<]*)</title>", content, re.IGNORECASE)
+        if m:
+            return html.unescape(m.group(1)).strip()[:300]
+    return ""
+
+
+def build_preview(text: str) -> dict[str, Any] | None:
+    """Fetch OpenGraph metadata for the first URL in *text* (#191).
+
+    SSRF-guarded (reuses the web-tool guard), size/time capped, cached in a
+    bounded dict. Returns ``{url, title, description, image, site}`` or
+    ``None`` when there is no URL / the fetch fails (never raises: a dead
+    link must not block the message).
+    """
+    m = _URL_RE.search(text or "")
+    if not m:
+        return None
+    url = m.group(0).rstrip(".,;:!?)")
+    if url in _PREVIEW_CACHE:
+        cached = _PREVIEW_CACHE[url]
+        return dict(cached) if cached else None
+    try:
+        from backend.tools.web import USER_AGENT, _assert_public_http_url
+
+        _assert_public_http_url(url)
+        resp = httpx.get(
+            url,
+            headers={"User-Agent": USER_AGENT, "Accept": "text/html,*/*"},
+            timeout=PREVIEW_TIMEOUT,
+            follow_redirects=True,
+        )
+        if resp.status_code >= 400:
+            raise ValueError(f"HTTP {resp.status_code}")
+        body = resp.text[:PREVIEW_MAX_BYTES]
+        preview = {
+            "url": url,
+            "title": _og(body, "og:title") or _og(body, "og:site_name"),
+            "description": _og(body, "og:description"),
+            "image": _og(body, "og:image"),
+            "site": _og(body, "og:site_name") or (url.split("/")[2] if "/" in url[8:] else url),
+        }
+        if not preview["title"]:
+            raise ValueError("pas de titre")
+    except Exception as e:
+        logger.debug("link preview failed for %s: %s", url, e)
+        preview = None
+    if len(_PREVIEW_CACHE) >= PREVIEW_CACHE_MAX:
+        _PREVIEW_CACHE.pop(next(iter(_PREVIEW_CACHE)))  # oldest first (dict order)
+    _PREVIEW_CACHE[url] = preview
+    return dict(preview) if preview else None
+
+
 def attachment_path(name: str) -> Path | None:
     """Resolve an attachment by its stored name (UUID+ext only, no traversal)."""
     p = Path(name)

backend/routers/file_chat.py

@@ -22,8 +22,9 @@ from fastapi.responses import FileResponse
 
 from backend import file_chat as _store
 from backend.auth.middleware import check_vault_access, require_auth
+from backend.auth.user_store import get_all_users, get_user
 from backend.indexer import get_vault_data
-from backend.schemas import ChatHistoryResponse, ChatMessageResponse
+from backend.schemas import ChatHistoryResponse, ChatMessageResponse, StatusResponse
 from backend.services.paths import resolve_safe_path
 from backend.sse import sse_manager
 
@@ -104,8 +105,10 @@ async def api_chat_post(
     text = str(body.get("text") or "")
     if not text.strip():
         raise HTTPException(400, "text is required")
+    # #191 — best-effort link preview: a dead/slow URL never blocks the post.
     msg = _store.add_global_message(
-        current_user.get("username", ""), text, _attachment(body)
+        current_user.get("username", ""), text, _attachment(body),
+        _store.build_preview(text),
     )
     await sse_manager.broadcast(
         "chat_message",
@@ -136,3 +139,105 @@ async def api_chat_attachment(name: str, current_user: dict[str, Any] = Depends(
         raise HTTPException(404, "Attachment not found")
     info = _store._MIME_BY_EXT.get(path.suffix.lower(), "application/octet-stream")
     return FileResponse(str(path), media_type=info)
+
+
+# --- #191 : suppression + messages privés -----------------------------------
+
+def _owner_or_admin(msg_user: str, current_user: dict[str, Any]) -> None:
+    """A post may be deleted by its author or by an admin."""
+    if current_user.get("role") != "admin" and current_user.get("username") != msg_user:
+        raise HTTPException(403, "Seul l'auteur ou un administrateur peut supprimer ce message")
+
+
+def _find_and_authorize(vault: str, path: str, message_id: str, current_user: dict[str, Any]) -> dict[str, Any]:
+    """Locate *message_id* in the conversation and check the delete right."""
+    for m in _store.get_messages(vault, path):
+        if m.get("id") == message_id:
+            _owner_or_admin(m.get("user", ""), current_user)
+            return m
+    raise HTTPException(404, "Message not found")
+
+
+@router.delete("/api/chat/{message_id}", response_model=StatusResponse)
+async def api_chat_delete(message_id: str, current_user: dict[str, Any] = Depends(require_auth)):
+    """Delete a message from the general chat (author or admin, #191)."""
+    _find_and_authorize(_store.GLOBAL_VAULT, _store.GLOBAL_PATH, message_id, current_user)
+    if not _store.delete_message(_store.GLOBAL_VAULT, _store.GLOBAL_PATH, message_id):
+        raise HTTPException(404, "Message not found")
+    await sse_manager.broadcast(
+        "chat_deleted",
+        {"vault": _store.GLOBAL_VAULT, "path": _store.GLOBAL_PATH, "id": message_id},
+    )
+    return {"status": "deleted"}
+
+
+@router.get("/api/chat/users", response_model=list[dict[str, Any]])
+async def api_chat_users(current_user: dict[str, Any] = Depends(require_auth)):
+    """Usernames available for a private conversation (chat DM picker, #191).
+
+    Every authenticated member may see who else is around — this is a
+    self-hosted portal, not a directory that needs hiding.
+    """
+    me = current_user.get("username", "")
+    return [
+        {"username": u.get("username", ""), "display_name": u.get("display_name") or u.get("username", "")}
+        for u in get_all_users()
+        if u.get("username") and u.get("username") != me
+    ]
+
+
+def _dm_peer(username: str, current_user: dict[str, Any]) -> str:
+    """Validate the DM peer exists and is not ourselves."""
+    if not username or username == current_user.get("username"):
+        raise HTTPException(400, "Destinataire invalide")
+    if not get_user(username):
+        raise HTTPException(404, "Utilisateur inconnu")
+    return username
+
+
+@router.get("/api/chat/dm/{username}", response_model=ChatHistoryResponse)
+async def api_chat_dm_history(username: str, current_user: dict[str, Any] = Depends(require_auth)):
+    """Private history with *username* (#191)."""
+    peer = _dm_peer(username, current_user)
+    return {"messages": _store.get_dm_messages(current_user["username"], peer)}
+
+
+@router.post("/api/chat/dm/{username}", response_model=ChatMessageResponse)
+async def api_chat_dm_post(
+    username: str,
+    body: dict[str, Any] = Body(...),
+    current_user: dict[str, Any] = Depends(require_auth),
+):
+    """Post a private message and broadcast it to both participants (#191)."""
+    peer = _dm_peer(username, current_user)
+    text = str(body.get("text") or "")
+    if not text.strip():
+        raise HTTPException(400, "text is required")
+    msg = _store.add_dm_message(
+        current_user["username"], peer, current_user.get("username", ""), text,
+        _attachment(body), _store.build_preview(text),
+    )
+    # Same shape as the general chat so the client routes on vault/path.
+    await sse_manager.broadcast(
+        "chat_message",
+        {"vault": _store.DM_VAULT, "path": _store.dm_path(current_user["username"], peer), "message": msg},
+    )
+    return {"message": msg, "status": "ok"}
+
+
+@router.delete("/api/chat/dm/{username}/{message_id}", response_model=StatusResponse)
+async def api_chat_dm_delete(
+    username: str,
+    message_id: str,
+    current_user: dict[str, Any] = Depends(require_auth),
+):
+    """Delete one private message (author or admin, #191)."""
+    peer = _dm_peer(username, current_user)
+    vault, path = _store.DM_VAULT, _store.dm_path(current_user["username"], peer)
+    _find_and_authorize(vault, path, message_id, current_user)
+    if not _store.delete_message(vault, path, message_id):
+        raise HTTPException(404, "Message not found")
+    await sse_manager.broadcast(
+        "chat_deleted", {"vault": vault, "path": path, "id": message_id}
+    )
+    return {"status": "deleted"}

backend/schemas.py

@@ -162,6 +162,10 @@ class ChatMessageItem(BaseModel):
         default=None,
         description="Optional image/video/url attachment {name, url, mime, kind}",
     )
+    preview: dict[str, Any] | None = Field(
+        default=None,
+        description="Link preview card {url, title, description, image, site} (#191)",
+    )
 
 
 class ChatHistoryResponse(BaseModel):