fix(social): re-fetch realtime messages via decrypting REST + drop dead reactions sub (#124, #231)#230
Conversation
room_messages.text is column-encrypted at rest; only the REST read path decrypts it. The realtime subscription stored payload.new and rendered payload.new.text directly, so messages from other users (which arrive only via realtime) displayed as ciphertext until a manual reload. The UPDATE handler had the same defect for edits. Treat a realtime message event as a 'something changed' signal and re-fetch through the decrypting getRoomMessages endpoint — mirroring how this component already handles room_reactions. Own messages keep their optimistic plaintext (reconciled by the POST response); own edits/deletes take only the server-side flags. The decision is a pure, unit-tested planMessageRealtimeAction. DISPLAY-ONLY: this does not address the realtime channel's missing authorization (RLS / Realtime Authorization) — tracked separately.
|
Warning Review limit reached
More reviews will be available in 38 minutes and 22 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
frontend | f41dbec | Commit Preview URL Branch Preview URL |
Jun 14 2026, 02:55 AM |
room_reactions is not in the supabase_realtime publication (confirmed live), so its INSERT/DELETE realtime handlers never fired — dead code. Remove them. Prune the two now-unused @typescript-eslint/no-explicit-any baseline entries (11->9) so the eslint ratchet stays exact. Reactions still update on load/refresh via REST; live reactions can return post-RLS by publishing the table with a membership-scoped policy (see docs/security/realtime-jwt-bridge-design.md).
Jose-Gael-Cruz-Lopez
changed the title
1 participant
Closes #124 (display bug). Also removes the dead room_reactions realtime subscription surfaced by the #231 audit.
#124 — display fix
room_messages.textis column-encrypted; only the REST read path decrypts. The realtime subscription renderedpayload.new.text(ciphertext) for other users' messages until a manual reload. Now: treat a realtime message event as a change signal and re-fetch via the decryptinggetRoomMessages(mirroring how reactions used to). Own messages keep optimistic plaintext; own edits/deletes take only server flags. Decision logic is the pure, unit-testedplanMessageRealtimeAction. Display-only — does not address authorization (#231).#231 cleanup — drop dead room_reactions subscription
Live check confirmed
room_reactionsis not in thesupabase_realtimepublication, so its INSERT/DELETE realtime handlers never fired. Removed as dead code; pruned the two now-unusedno-explicit-anyeslint baseline entries (11→9). Reactions still update on load/refresh via REST; live reactions can return post-RLS by publishing the table with a membership-scoped policy.Tests
Social.realtime.test.tscovers the planner (foreign INSERT/UPDATE → refetch; own INSERT → ignore; own UPDATE → applyOwnFlags; malformed → ignore).eslint .exits clean after the prune; tsc clean.