feat(chat): join users to rooms on sign-in

apps/edr-freight-api/src/modules/chat/matrix.client.ts

@@ -14,6 +14,32 @@ import chatConfig from '../../config/chat.config';
  * ChatBridgeService) — one bot/admin account covers both jobs, no separate
  * bot user needed.
  */
+/**
+ * Localpart of a staff member's MXID: their name, plus the first 6 hex of
+ * their freight user id.
+ *
+ * The tail is not decoration. Names collide — 19 of the 114 users in the dev
+ * IAM share a slug with someone else ("MARKOS REGASA" and "Markos  REGASA" are
+ * two different people) — and an MXID is permanent, so a bare slug would hand
+ * two employees the same Matrix account and each other's rooms. The id is
+ * already random, so 6 hex of it separates them without a lookup or a mapping
+ * table, and keeps the derivation pure: ChatSsoService (which mints the JWT
+ * `sub`) and ChatProvisioningService (which force-joins rooms) must agree on
+ * this string exactly or they provision two accounts per person.
+ */
+export function chatLocalpart(userId: string, displayName: string): string {
+  const slug = displayName
+    // NFKD splits an accent off its letter; the non-alnum sweep below then
+    // folds the leftover mark into the same `-` run as the neighbouring space.
+    .normalize('NFKD')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+  // Amharic-only names slug to nothing — the tail still makes it unique.
+  return `${slug || 'user'}.${userId.replace(/-/g, '').slice(0, 6)}`;
+}
+
 @Injectable()
 export class MatrixClient {
   constructor(
@@ -21,11 +47,28 @@ export class MatrixClient {
     private readonly config: ConfigType<typeof chatConfig>,
   ) {}
 
+  /**
+   * Alias localparts go in a URL path segment, so a `/` in one is fatal:
+   * Synapse decodes the path before routing, and `%2F` splits the request into
+   * a route that doesn't exist ("M_UNRECOGNIZED"). resolveAlias reads that 404
+   * as "no such room" and ensureRoom then tries to create the same broken alias
+   * on every run. Position keys are `edr_freight_app/opn` shaped, so this hits
+   * every dept room but the handful whose key happens to be a bare word.
+   */
+  private static aliasSafe(alias: string): string {
+    return alias.replace(/[^A-Za-z0-9._=-]/g, '-');
+  }
+
   /** `@<localpart>:<server_name>` — the one place this format is assembled. */
   mxid(localpart: string): string {
     return `@${localpart}:${this.config.serverName}`;
   }
 
+  /** The MXID of a freight user — see {@link chatLocalpart}. */
+  mxidFor(userId: string, displayName: string): string {
+    return this.mxid(chatLocalpart(userId, displayName));
+  }
+
   get serverName(): string {
     return this.config.serverName;
   }
@@ -123,15 +166,13 @@ export class MatrixClient {
     return Object.keys(res.joined);
   }
 
-  /** Exchange a fresh access token for a one-shot login_token (5 min TTL). */
-  getLoginToken(accessToken: string): Promise<{ login_token: string }> {
-    return this.request(
-      'POST',
-      '/_matrix/client/v1/login/get_token',
-      {},
-      accessToken,
-    );
-  }
+  // No getLoginToken here on purpose. POST /_matrix/client/v1/login/get_token
+  // is rate limited to 1 request per user per MINUTE, hardcoded in Synapse
+  // (rest/client/login_token_request.py: "Ratelimit aggressively … could be
+  // abused by a malicious client to create many sessions") and not settable
+  // from homeserver.yaml. A second click inside a minute got M_LIMIT_EXCEEDED.
+  // ChatSsoService hands Element the session from loginWithJwt directly
+  // instead, which needs no second call.
 
   /** null when the alias doesn't resolve to a room yet. */
   resolveAlias(alias: string): Promise<{ room_id: string } | null> {
@@ -180,10 +221,11 @@ export class MatrixClient {
    * on every reconcile run and every bridged notification alike.
    */
   async ensureRoom(
-    alias: string,
+    rawAlias: string,
     name: string,
     opts: { isSpace?: boolean; parentSpaceId?: string } = {},
   ): Promise<string> {
+    const alias = MatrixClient.aliasSafe(rawAlias);
     const existing = await this.resolveAlias(`#${alias}:${this.config.serverName}`);
     if (existing) return existing.room_id;
 
@@ -228,6 +270,21 @@ export class MatrixClient {
     );
   }
 
+  /**
+   * Force-join, treating "already a member" as success. Synapse answers a
+   * repeat join with 403 `M_FORBIDDEN: "<user> is already in the room."`, which
+   * is a failure only if you assumed you knew the membership first. Callers
+   * that just want someone in a room (sign-in, reconcile racing itself) want
+   * this; the raw 403 tells them nothing they can act on.
+   */
+  async ensureJoined(roomIdOrAlias: string, userId: string): Promise<void> {
+    try {
+      await this.forceJoin(roomIdOrAlias, userId);
+    } catch (err) {
+      if (!/already in the room/i.test((err as Error).message)) throw err;
+    }
+  }
+
   kick(roomId: string, userId: string, reason: string): Promise<void> {
     return this.request(
       'POST',