feat: wire agreement chat to Nest + use real agreement UUID

[Kalchaqui]

Context

Agreement chat UI exists (components/agreements/agreement-chat.tsx) but today it talks to Supabase via service-role Server Actions (lib/actions/agreement-chat.ts), bypassing Nest auth.

Nest already has JWT endpoints (ready after BE work):

• GET /v1/agreements/:agreementId/messages
• POST /v1/agreements/:agreementId/messages

Depends on: ThalosBackend#86 (schema sender_id + fail-hard participants).

Problem

1. UI agreement ids are often AGR-* / mocks / contractId — not the UUID FK expected by agreement_messages → Postgres UUID errors (#92).
2. Create flow injects optimistic AGR-… ids and does not persist a shared DB agreement UUID for both parties.
3. Chat does not use Nest JWT → no participant checks on the FE path.
4. SHOW_MOCKED_AGREEMENTS defaults to true (prod risk).

Scope (keep tight — make A↔B chat work)

• Persist agreement on create (Nest or existing DB helpers) so both parties share a UUID (or resolve contractId → agreements UUID before opening chat).
• Stop injecting fake AGR-* ids into chat after create; UI chat must receive a real UUID.
• Wire AgreementChat to Nest via lib/api + JWT (auth_token / auth store). Remove or stop using Supabase service-role chat actions for this path.
• Guard: if id is non-UUID / mock (AGR-*, ENT-*), do not call API — show clear “demo / unavailable” (covers fix: block agreement chat (and mutating actions) on mocked non-UUID agreement ids #92).
• Default mocks off for production (NEXT_PUBLIC_SHOW_MOCKED_AGREEMENTS=false or invert default); gate business ENT-* the same way as personal.

Out of scope

• Business wizard full Trustless create (can stay limited if personal A↔B works)
• Approve/release on-chain wiring beyond what’s needed to create a real agreement
• Admin mock page
• Realtime WebSockets (polling OK)
• Trustless API-key proxy (separate security follow-up)

Acceptance criteria

1. User A creates a real agreement with User B as counterparty.
2. Both see the same agreement UUID in the dashboard (not AGR-*).
3. A opens chat → sends a message → B opens the same agreement chat → sees it → replies → A sees reply.
4. Opening chat on a mock id does not hit Postgres / Nest with invalid UUID.
5. Production/demo with mocks disabled does not show demo agreements by default.

Test plan

• Two wallets / two accounts on shared Nest + Supabase
• Create → list → chat A→B→A
• Mock id path shows friendly message (no console UUID error)
• NEXT_PUBLIC_API_URL points at Nest /v1

Related

• Backend: feat: make agreement chat production-ready (schema + participants) ThalosBackend#86
• Supersedes / closes: fix: block agreement chat (and mutating actions) on mocked non-UUID agreement ids #92 (include guard in this PR)

DoD

• PR on main with Nest chat client + UUID path
• Proof: short clip or screenshots A↔B + mock guard
• Closes #NN (this issue) and Closes #92 if fixed here

[Tobiloba0]

Hi team, I would like to work on this issue.

[nurudeenheroic]

Hi! I'm ready to start immediately and deliver a polished solution. Please consider assigning this issue to me.

[Nemenwa]

Hi maintainer, I have reviewed the task description and will like to work on this issue please. I can finsih in 6hours, THank you

[diegoTech14]

Hello Thalos team

I'd like to take this one. I have experience with Next.js + NestJS integrations, JWT-authenticated API clients, and Supabase, so the migration path here is familiar.

Understanding

Chat currently goes through service-role Server Actions, so there are no participant checks on the FE path, and the ids reaching agreement_messages are often AGR-* / mock ids instead of real UUIDs. The fix is to make sure chat only ever receives a persisted agreement UUID and talks to Nest with the user's JWT.

Plan

1. Persist on create — on agreement creation, store/resolve the real DB agreement and return its UUID; stop injecting optimistic AGR-* ids into the chat flow. If only a contractId is available, resolve it to the agreements UUID before opening chat.
2. Nest chat client — add a small client in lib/api for GET/POST /v1/agreements/:agreementId/messages, attaching the JWT from auth_token / the auth store. Polling for refresh (no WebSockets).
3. Rewire AgreementChat — swap the Supabase service-role actions for the new client; drop the old chat actions from this path.
4. Mock guard — validate the id before any request; if it's non-UUID (AGR-*, ENT-*), render a clear "demo agreement — chat unavailable" state instead of calling the API. Covers fix: block agreement chat (and mutating actions) on mocked non-UUID agreement ids #92.
5. Mocks off by default — flip SHOW_MOCKED_AGREEMENTS so production defaults to false, and gate ENT-* the same way as personal agreements.

Verification

Two accounts on a shared Nest + Supabase: create → both dashboards show the same UUID → A sends, B receives, B replies, A receives. Mock id shows the friendly message with no console UUID error. NEXT_PUBLIC_API_URL pointed at Nest /v1.

I'll attach a short clip of the A↔B exchange plus the mock guard in the PR, with Closes #NN and Closes #92.

Availability

I can start as soon as ThalosBackend#86 lands and estimate 3–4 days.

Note: this depends on ThalosBackend#86 (sender_id + fail-hard participants) — if that isn't merged yet, I can start on the guard and mock-flag items (4 and 5), which are independent.

Best,
Diego Duarte Fernández.

[grantfox-oss]

🦊 GrantFox — @diegoTech14 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #98)
2. Your PR will be reviewed by the Thalos-Infrastructure maintainers

Good luck! Track your progress on GrantFox.

[ManuelJG1999]

🎉 Congratulations @diegoTech14 ! This issue has been assigned to you.

Before you start, make sure you understand the requirements. If you have any questions, ask us in our community chat:
https://t.me/ThalosOSSCommunity

Please keep us updated on your progress. If there's no activity or communication within 48 hours, the issue may be reassigned to another contributor.

Happy coding, and thanks for contributing to Thalos! 🐉