Files
OwnCord/docs/architecture/ux/channels-members-dms.md
J3vbandClaude Fable 5 1fe3df7962 test(b2-1): capture the epoch-1 protocol fixtures and retire S-15 (#1435)
* refactor(protocol): retire reserved voice_speakers and member_leave (S-15)

Neither type was ever emitted by the server; B2-1 clears them from the
schema before the epoch-1 wire fixtures are captured, so the frozen epoch
does not carry two dead message types.

Client: dropped the dead `ws.on(MEMBER_LEAVE)` / `ws.on(VOICE_SPEAKERS)`
dispatcher handlers, the `MemberLeavePayload` type and both `ServerMessage`
union members, and the tests that only exercised those WS paths.
`removeMember` (member_ban) and `setSpeakers` (LiveKit ActiveSpeakers) stay
live and keep their direct unit tests.

* test(ws): capture the epoch-1 wire fixtures

alpha.4 is the last client on the pre-epoch wire and B2-2 adds a protocol
epoch to the auth handshake next, so record what epoch 1 actually looks
like while it is still observable.

TestEpoch1Fixtures drives eleven journeys through the ws package's
in-process hub harness (full migrations, real hub, httptest WebSocket
server) and compares each journey's per-connection frame sequence with a
transcript under protocol/fixtures/epoch-1/:

- fresh-connect, auth-failure, ping
- chat-send-fanout, chat-edit-delete, reaction-add-remove
- typing, mark-read, dm-send
- resume-replay (last_seq + buffer-tier replay burst)
- voice-join-e2ee-leave (join, both voice_state forms, announce and
  offer relay, leave)

Volatile values are replaced by typed placeholders before both writing
and comparison -- any key that is id/seq/last_seq, ends in _id (except
channel_id and role_id) or _at, is timestamp/ts/last_seen, or contains
token, becomes "<class:json-type>" so a field that changes type is still
a diff, while everything else is compared verbatim.

Regenerate with: go test ./ws -run TestEpoch1Fixtures -update

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(client): pin the epoch-1 auth frame contract

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(updater): pin the epoch-1 manifest and client-update shapes

* test(ws): harden the epoch-1 fixtures against trailing frames and absent optionals

Every journey now ends with the ping/pong barrier on each recorded
connection, so a frame the server emits after the last read fails as
`expected "pong", got "X"` instead of going unrecorded; auth-failure
asserts the StatusPolicyViolation close instead, its socket being gone.

alice carries a display name, avatar, about text, custom status, identity
public key and an announce signature (bob carries none), so every optional
field is frozen in its present form as well as its absent one — a rename or
a retype of display_name or identity_public_key now moves a fixture.

The typing journey focuses the channel on "a" before typing: without the
subscription registerNow only makes for a focused client, its ping/pong
proved nothing about excludeUserID.

Comment fixes: the escaped placeholder form MarshalIndent would write, the
real (headroom) reason for the raised read limit, a note that bare id and
active_channel_id are normalised by design, and a .prettierignore line
saying these fixtures are verified by the Go comparison, not by git diff.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(protocol): document the epoch-1 fixtures

* docs(protocol): match the epoch-1 wire where the fixtures contradicted the doc

- voice_state: note the unsequenced relay-to-joiner form (table row + section)
- auth_error: correct the example message and list the real rejection messages
- member_join/presence connect example: add the seq both frames actually carry
- chat_message.user: document display_name
- voice_join reply order: state that the joiner's own voice_state broadcast is not ordered against the other three frames

* test(ws): freeze the null forms of auth_ok and member_join user fields

buildAuthOK emits display_name/about/custom_status/avatar as
always-present nulls, but only alice — who has all four set — ever
authenticated on a recorded connection, so the fixtures froze those
fields in their populated form alone. A rename, a retype or a dropped
null would have moved nothing, on the very frame B2-2 edits.

fresh-connect now records bob's handshake too, on a second connection:
his auth_ok carries the four nulls, his member_join carries avatar null
with display_name and identity_public_key omitted, and alice — idle by
then, so her reads stay in hub order — records the same pair as an
already-connected observer sees it. In voice-join-e2ee-leave bob answers
alice's signed announce with a legacy unsigned one, which freezes the
absent form of signature next to her present one. The auth frames the
test writes now carry the correlation id the real client stamps on every
frame (ws.ts send()); normalisation renders it <id:string>.

expectClosed also asserts the close reason ("authentication failed"),
not just code 1008 — HP-2 asks for both.

Comment precision, no behaviour change: the barrier guarantee now states
that pong may overtake a pending LOW-priority frame (writePump) and that
no journey is affected because every barrier is sent on an idle
connection; the ping-budget ceiling is six connections, not four; the
typing journey cites handleChannelFocusV2 rather than registerNow as the
subscribe site; resume-replay's b barrier explains why moving it past
the resume would be a flake, not a fix; and the header notes that
normalisation hides that chat_send_ok.id echoes the request id.

The client contract test's cited range for ws.ts's send() call is
441-453, not 441-454.

Regenerate with: go test ./ws -run TestEpoch1Fixtures -update

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(protocol): shape-not-value fixture rule, voice_max_video default, auth close code

The fixture rule read "a fixture may only change with an epoch bump",
which is false for the seeded values the transcripts record verbatim:
role permission masks and colours, motd, server_name, voice_max_video,
the voice_config preset. A migration that changes a default mask diffs
fresh-connect.json, and the README told the author to revert a change
that never touched the wire.

Split the rule along shape versus value. A key set, a JSON type, a key
appearing or disappearing, or per-connection frame order is a protocol
change and earns fixtures/epoch-<n+1>/. A seeded default value is a seed
change: regenerate in the same PR and read the diff frame by frame.
Normalising those values is explicitly not the answer — a placeholder
over a mask or over an enum such as voice_config.threshold_mode would
hide the drift the fixtures exist to catch.

Two wire facts corrected against the fixtures:

- voice_max_video on an unconfigured channel is 25, not 0 (migration
  004 is DEFAULT 25); the doc listed it among the zero values.
- auth_error is followed by a close with code 1008 (policy violation)
  and reason "authentication failed" (serve.go:128), which the doc left
  as "closes the connection".

Also: voice_speakers moves from discord-parity's "still dead" list to
"came off the list" — it was retired earlier on this branch. And Kick
says sessions are revoked and sockets drop on the next sweep, which is
what ForceLogout does (moderation.go:236); it does not cut sockets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(protocol): fixture rule covers enum vocabularies; header comment precision

Re-check minors from the whole-branch review: a fixed-vocabulary value the client switches on is shape, not a seeded value; drop the false 'new default channel' clause (the seed asserts channel ids); the low-priority frame is presence_update, not connect presence.

* docs(plans): record B2-1 evidence for HP-2 (PR #1435, fixture commit SHAs)

* docs(protocol): additive changes stay within an epoch; bump only for what old clients cannot process

Codex review on #1435: B2-2 keeps protocol_epoch = 1 while adding auth/ready/auth_error fields, which the previous wording would have called a break to revert. An epoch is a compatibility boundary, not a snapshot: additive keys regenerate in the same PR and are documented; removals, renames, retypes, dropped frames and reordering bump the epoch. The plan's B2-1 evidence records the refinement and hands B2-2/B2-4 the open questions (additive-tolerant replay of the epoch-1 transcript; epoch 0 vs 1 naming).

* test(client): compare auth-frame key sets order-independently

Codex review on #1435: Object.keys preserves insertion order, so a harmless property reorder in ws.ts would fail the pin. Key order has no wire meaning; the Go fixtures already compare with sorted keys. Sort both sides.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-28 15:43:30 +02:00

13 KiB

Channels, Members & Direct Messages — target UX

Verified against: commit 5630aa1, 2026-08-04 Part of the Client UX Specification.

Covers the sidebar surfaces: the channel list (switch, categories, reorder, announcement affordance), the member list (presence, typing, roles), and DMs (open/close, blocking).


1. Channel sidebar

Renders from channels.store (channels map, activeChannelId), grouped by category, sorted by position. The sidebar has two modes (ui.store.sidebarMode): channels and dms.

State Trigger Target reaction
ready Channels loaded from ready Grouped, collapsible category list
empty Zero channels "No channels yet" + hint (already the empty-state branch of renderChannels(), components/ChannelSidebar.ts)
category collapsed User toggles Persisted per-server in localStorage (ui.toggleCategory); chevron reflects state
active channel setActiveChannel Highlighted; unread cleared
unread chat_message in a non-active channel Unread pill; badge on the channel

1.1 Channel type affordances

Each channel type gets a distinct icon and interaction:

Type Icon Click behavior
text hash Focus → load messages
announcement megaphone (D1) Focus → load messages; composer read-only unless MANAGE_MESSAGES (see messaging.md §2)
voice speaker Join voice (see voice-and-e2ee.md); shows the participant roster inline
dm Not in the channel list; lives in DM mode

1.1a Per-channel notification mutes

The channel context menu offers "Mute Channel" / "Unmute Channel" (the Mute Channel item in attachChannelContextMenu(), components/channel-sidebar/context-menu.ts, backed by lib/channel-mutes.ts). Discord semantics, deliberately: a mute silences the channel's noise — no desktop notification, no chime — while the unread badge still counts but renders dimmed, and a message that mentions you still notifies and shows the red mention badge. It is a client-side preference on purpose (stored in localStorage under mutedChannels): the server has no per-user channel settings table, and "which of my devices bothers me" is a property of the device, not the account.

1.2 Channel switching

sequenceDiagram
    autonumber
    participant U as User
    participant CS as ChannelSidebar
    participant CH as channels.store
    participant CC as ChannelController
    U->>CS: click channel
    CS->>CH: setActiveChannel(id)  %% clears that channel's unread
    CH-->>CC: activeChannelId change
    CC->>CC: mountChannel(id, type) — MessageList + Typing + Composer
    CC->>SRV: channel_focus{channel_id}  %% server read-state

Target rules:

  • Switching is instantaneous from cache; the message area shows its own loading state for uncached history (messaging.md §1), never a global block.
  • If the active channel is deleted server-side (channel_delete), redirect to the first text channel by position and toast "This channel was deleted." (✓ implemented 2026-08 — the channel_delete handler in wireDispatcher(), lib/dispatcher.ts, redirects and toasts; a non-active deletion stays silent).

1.3 Reorder & CRUD (admin)

Drag-reorder and create/edit/delete are admin affordances — see settings-and-admin.md §3. Target: reorder should be optimistic (position updates locally, then PATCH per moved channel) and roll back on failure.


2. Member list

Renders from members.store (members map + typingUsers). Shows presence and role grouping.

State Trigger Target reaction
ready ready.members Grouped by role, sorted; presence dot per member
empty No online members "No members online" (already the empty-state branch of renderList(), components/MemberList.ts)
presence change presence event Live dot update; offline members styled distinctly
role change member_update Re-group live
profile change user_update Name/avatar update; if it's us, also patch auth.store (already the user_update handler in wireDispatcher(), lib/dispatcher.ts)
join/ban member_join/member_ban Add/remove with no reflow flash

2.1 Typing indicator

typing events populate members.typingUsers with a 5 s auto-clear timer. Target: show "X is typing…" / "X and Y are typing…" / "Several people are typing…" below the message list, excluding the current user (already formatTypingText() in components/TypingIndicator.ts). The client emits typing_start while composing (debounced), never per-keystroke.

2.2 Member actions (context menu)

Right-click / long-press a member → context menu (roles, kick, ban) — moderation affordances covered in settings-and-admin.md §3. Actions the user lacks permission for are not shown (menu items gated by the actor's role), consistent with the affordance principle.

✓ Resolved 2026-07-20 — single role store. Roles live only in channels.store (roles/getRoleIdByName), the store the dispatcher writes on ready (dispatcher.ts). SidebarMemberSection.ts now reads from it, and the parallel, never-updated roles.store has been deleted — so the member context menu can no longer mis-map a role name→id from stale data.


3. Direct messages

DM mode (sidebarMode: "dms") renders from dm.store (channels list, each with recipient, last-message preview, unread).

State Trigger Target reaction
ready ready.dm_channels DM list sorted by recency
empty No DMs "No direct messages yet" + "Start one from a member's profile"
open DM dm_channel_open Prepend/move-to-top, dedup (already addDmChannel(), stores/dm.store.ts)
close DM dm_channel_close Remove from list
new DM message chat_message in a DM updateDmLastMessage (unread bump + reorder) if not focused; updateDmLastMessagePreview (no bump) if own/active
last-message empty Never messaged "No messages yet" fallback (already the lastMessage fallback in buildDmConversations(), pages/main-page/SidebarDmHelpers.ts)

3.1 Opening a DM

sequenceDiagram
    autonumber
    participant U as User
    participant P as Member profile popup
    participant API as api.ts
    participant DM as dm.store
    U->>P: "Message" on a member
    P->>API: POST /dms {recipient_id}
    API-->>P: DM channel
    P->>DM: open DM mode + focus channel
    Note over U,DM: on a newly created DM the server sends dm_channel_open to the recipient

3.1a Group DMs

One picker covers 1:1 and group creation (pages/main-page/MemberPickerModal.ts): selecting a single member opens a 1:1 DM, selecting two or more creates a group (cap the MAX_GROUP_DM_PARTICIPANTS = 10 constant in lib/constants.ts) — "new conversation" is one intent, so the user is not asked to choose DM-vs-group up front. Group DMs are channels rows with type='dm' and is_group=1 server-side (migration 028), so leaving a two-person group does not collapse it back into a 1:1. "Rename Group" / "Leave Group" affordances live in the DM row context menu (the contextmenu handler in renderDmItem(), components/DmSidebar.ts; leave doubles as "Close DM" for 1:1s); ring/incoming calls work the same as 1:1 DMs (call_ring fans out to every other participant).

3.2 Blocking

Blocking gates DM delivery server-side (a blocked user can't post into the DM, and IsEitherBlocked is bidirectional). Target UX:

Action Reaction
Block user Confirm → block; DM composer becomes read-only with "You've blocked this user. Unblock to send messages."
Being blocked Composer read-only with a neutral "You can't message this user right now." (do not reveal the block state explicitly — the server returns a generic refusal)
Unblock Composer re-enables

Wired (composer gating). DM block state now drives the same disabled-with-reason composer mode (see messaging.md §2) via blocks.store. blockedByMe is loaded authoritatively from GET /blocks on every ready (dispatcher.ts) → the explicit "You've blocked this user…" reason. blockedByThem is inferred from a refused DM send (ErrBlockedFORBIDDEN, bidirectional) → the neutral "You can't message this user right now." reason, and is cleared on the next ready so a reconnect re-evaluates. ChannelController reads dmComposerBlockReason(recipientId) and subscribes to blocks.store, so an unblock (shrunken GET /blocks) re-enables the composer live. blockedByMe takes precedence when both directions apply.

✓ Implemented (2026-07/08). The in-client Block/Unblock affordance now lives in the member context menu (AdminActions.ts renders the item; MemberList.ts passes it through; the onToggleBlock handler in createSidebarMemberSection() (pages/main-page/SidebarMemberSection.ts) calls api.blockUser/api.unblockUser, updates blocks.store via setUserBlockedByMe for an instant local un-gate, and confirms with a success toast — or an error toast on failure).


Source of truth

src/components/ChannelSidebar.ts (+ channel-sidebar/), src/components/MemberList.ts, src/components/TypingIndicator.ts, src/components/DmSidebar.ts, src/components/DmProfileSidebar.ts, src/pages/main-page/SidebarArea.ts, SidebarMemberSection.ts, SidebarDmSection.ts, SidebarDmHelpers.ts, src/stores/channels.store.ts, members.store.ts, dm.store.ts, src/lib/dispatcher.ts; server Server/service/channel.go, dm.go, block.go.