feat: setup the attachment to the passenger api

apps/edr-passenger-api/src/modules/support/support.service.ts

@@ -1,16 +1,52 @@
 import {
+  BadRequestException,
   ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
-import { Passenger as T } from '@edr/types';
+import {
+  isSupportAttachmentAllowed,
+  Passenger as T,
+  SUPPORT_ATTACHMENT_MAX_BYTES,
+  SUPPORT_ATTACHMENT_MAX_PER_MESSAGE,
+} from '@edr/types';
+import { randomUUID } from 'crypto';
+import { Readable } from 'stream';
 import { PrismaService } from '../../common/prisma.service';
+import { MinioService } from '../storage/minio.service';
+import { decodeMessageCursor, encodeMessageCursor } from './message-cursor';
+import { SUPPORT_MESSAGES_DEFAULT_LIMIT } from './support.dto';
 import { SupportGateway } from './support.gateway';
 
 type Side = 'USER' | 'AGENT';
 type PrismaSender = 'USER' | 'BOT' | 'AGENT';
 type PrismaStatus = 'OPEN' | 'RESOLVED' | 'CLOSED';
 
+/** Stand-in preview for a message that is nothing but files. */
+const ATTACHMENT_ONLY_PREVIEW = '📎';
+
+interface MessagesQuery {
+  before?: string;
+  limit?: number;
+}
+
+type AttachmentRow = {
+  id: string;
+  name: string;
+  mimeType: string;
+  size: number;
+  url: string;
+};
+
+type MessageRow = {
+  id: string;
+  conversationId: string;
+  sender: PrismaSender;
+  text: string | null;
+  createdAt: Date;
+  attachments?: AttachmentRow[];
+};
+
 /** Who the caller is on the customer side: an authed passenger or a guest. */
 export interface CustomerOwner {
   iamUserId?: string | null;
@@ -50,6 +86,7 @@ export class SupportService {
   constructor(
     private prisma: PrismaService,
     private gateway: SupportGateway,
+    private minio: MinioService,
   ) {}
 
   // ---- FAQ (unchanged) ---------------------------------------------------
@@ -115,29 +152,37 @@ export class SupportService {
 
   // ---- customer: device-scoped single thread (portal) -------------------
 
-  /** The device's single conversation + its messages ({conversation:null} if none). */
-  async getDeviceThread(deviceId: string): Promise<T.PassengerSupportThreadDto> {
-    if (!deviceId) return { conversation: null, messages: [] };
+  /**
+   * The device's single conversation + its NEWEST page of messages
+   * ({conversation:null} if none). Not the whole thread — the client pages back
+   * with `nextCursor` exactly as the backoffice does.
+   */
+  async getDeviceThread(
+    deviceId: string,
+    query: MessagesQuery = {},
+  ): Promise<T.PassengerSupportThreadDto> {
+    const empty = { conversation: null, messages: [], nextCursor: null };
+    if (!deviceId) return empty;
     const c = (await this.prisma.supportConversation.findFirst({
       where: { guestId: deviceId },
       orderBy: { createdAt: 'asc' },
     })) as ConversationRow | null;
-    if (!c) return { conversation: null, messages: [] };
-    const rows = await this.prisma.supportMessage.findMany({
-      where: { conversationId: c.id },
-      orderBy: { createdAt: 'asc' },
-    });
+    if (!c) return empty;
+
+    const page = await this.listMessages(c.id, query);
     const unread = await this.computeUnread([c], 'USER');
     return {
       conversation: this.toConversationDto(c, unread.get(c.id) ?? 0),
-      messages: rows.map((m) => this.toMessageDto(m)),
+      messages: page.items,
+      nextCursor: page.nextCursor,
     };
   }
 
   /** Append a message to the device's thread, creating it on first message. */
   async sendDeviceMessage(
     deviceId: string,
-    text: string,
+    text: string | undefined,
+    attachments: Express.Multer.File[] = [],
   ): Promise<T.PassengerSupportMessageDto> {
     let c = (await this.prisma.supportConversation.findFirst({
       where: { guestId: deviceId },
@@ -148,9 +193,7 @@ export class SupportService {
         data: { guestId: deviceId, subject: 'Support chat', status: 'OPEN' },
       })) as ConversationRow;
     }
-    const updated = await this.appendMessage(c, 'USER', text);
-    const last = updated.messages[updated.messages.length - 1];
-    return this.toMessageDto(last);
+    return this.appendMessage(c, 'USER', text, attachments);
   }
 
   /** Mark the device's thread read (customer side). */
@@ -186,9 +229,7 @@ export class SupportService {
 
   // ---- agent (backoffice) ------------------------------------------------
 
-  async listForAgents(
-    query: ListQuery,
-  ): Promise<T.PassengerSupportConversationListResult> {
+  async listForAgents(query: ListQuery): Promise<T.PassengerSupportConversationListResult> {
     const where = this.listWhere(query);
     const rows = (await this.prisma.supportConversation.findMany({
       where,
@@ -216,32 +257,29 @@ export class SupportService {
 
   // ---- shared ------------------------------------------------------------
 
+  /** One page of a thread, newest first. See {@link listMessages}. */
   async getMessages(
     conversationId: string,
+    query: MessagesQuery = {},
     asCustomer?: CustomerOwner,
-  ): Promise<T.PassengerSupportMessageDto[]> {
+  ): Promise<T.PassengerSupportMessageListResult> {
     const conversation = await this.requireConversation(conversationId);
     if (asCustomer) this.assertOwns(conversation, asCustomer);
-    const rows = await this.prisma.supportMessage.findMany({
-      where: { conversationId },
-      orderBy: { createdAt: 'asc' },
-    });
-    return rows.map((m) => this.toMessageDto(m));
+    return this.listMessages(conversationId, query);
   }
 
   async sendMessage(
     conversationId: string,
     sender: Side,
-    text: string,
+    text: string | undefined,
     asCustomer?: CustomerOwner,
+    attachments: Express.Multer.File[] = [],
   ): Promise<T.PassengerSupportMessageDto> {
     const conversation = await this.requireConversation(conversationId);
     if (sender === 'USER') {
       this.assertOwns(conversation, asCustomer ?? {});
     }
-    const updated = await this.appendMessage(conversation, sender, text);
-    const last = updated.messages[updated.messages.length - 1];
-    return this.toMessageDto(last);
+    return this.appendMessage(conversation, sender, text, attachments);
   }
 
   async markRead(
@@ -265,10 +303,7 @@ export class SupportService {
     return this.unreadCount('AGENT');
   }
 
-  async unreadCount(
-    side: Side,
-    owner?: CustomerOwner,
-  ): Promise<{ unreadCount: number }> {
+  async unreadCount(side: Side, owner?: CustomerOwner): Promise<{ unreadCount: number }> {
     const rows = (await this.prisma.supportConversation.findMany({
       where: side === 'USER' ? this.ownerScope(owner ?? {}) : {},
       select: { id: true, userLastReadAt: true, agentLastReadAt: true },
@@ -289,49 +324,197 @@ export class SupportService {
     conversation: ConversationRow,
     text: string,
   ): Promise<T.PassengerSupportConversationDto> {
-    const { conversation: updated } = await this.appendMessageRaw(
-      conversation,
-      'USER',
-      text,
-    );
+    const { conversation: updated } = await this.appendMessageRaw(conversation, 'USER', text);
     return this.toConversationDto(updated, 0);
   }
 
   private async appendMessage(
     conversation: ConversationRow,
     sender: PrismaSender,
-    text: string,
-  ) {
-    const { conversation: updated } = await this.appendMessageRaw(
-      conversation,
-      sender,
-      text,
-    );
-    return updated as ConversationRow & { messages: any[] };
+    text: string | undefined,
+    attachments: Express.Multer.File[] = [],
+  ): Promise<T.PassengerSupportMessageDto> {
+    const { message } = await this.appendMessageRaw(conversation, sender, text, attachments);
+    return message;
   }
 
-  /** Persist a message, bump the conversation's denormalized fields, emit live. */
+  /**
+   * One page of a thread, walking backwards from newest.
+   *
+   * Keyset, not offset: a message arriving while the reader is scrolled back
+   * would shift every offset by one and duplicate/skip rows across pages. Rides
+   * the (conversationId, createdAt) index; the id is a tiebreak for messages
+   * sharing a millisecond.
+   */
+  private async listMessages(
+    conversationId: string,
+    query: MessagesQuery,
+  ): Promise<T.PassengerSupportMessageListResult> {
+    const limit = query.limit ?? SUPPORT_MESSAGES_DEFAULT_LIMIT;
+    const before = query.before ? decodeMessageCursor(query.before) : undefined;
+
+    const rows = (await this.prisma.supportMessage.findMany({
+      where: {
+        conversationId,
+        ...(before
+          ? {
+              // Strictly older than the cursor in (createdAt, id) order.
+              OR: [
+                { createdAt: { lt: before.createdAt } },
+                {
+                  createdAt: before.createdAt,
+                  id: { lt: before.id },
+                },
+              ],
+            }
+          : {}),
+      },
+      orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
+      // One more than asked, to tell "there's another page" from "this page was
+      // simply full" without a second COUNT.
+      take: limit + 1,
+      include: { attachments: { orderBy: { createdAt: 'asc' } } },
+    })) as MessageRow[];
+
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const oldest = page[page.length - 1];
+    const nextCursor =
+      hasMore && oldest
+        ? encodeMessageCursor({ createdAt: oldest.createdAt, id: oldest.id })
+        : null;
+
+    // Flip to oldest-first so a page prepends as one block.
+    const items = await Promise.all([...page].reverse().map((m) => this.toMessageDto(m)));
+    return { items, nextCursor };
+  }
+
+  /** Persist a message (+ attachments), bump denormalized fields, emit live. */
   private async appendMessageRaw(
     conversation: ConversationRow,
     sender: PrismaSender,
-    text: string,
-  ): Promise<{ conversation: ConversationRow & { messages: any[] }; message: any }> {
+    text: string | undefined,
+    attachments: Express.Multer.File[] = [],
+  ): Promise<{
+    conversation: ConversationRow;
+    message: T.PassengerSupportMessageDto;
+  }> {
+    const trimmed = (text ?? '').trim();
+    this.assertSendable(trimmed, attachments);
+
     const message = await this.prisma.supportMessage.create({
-      data: { conversationId: conversation.id, sender, text },
+      // NULL, not "", so "no text" is representable rather than inferred. The
+      // DTO flattens it back to "" for rendering.
+      data: { conversationId: conversation.id, sender, text: trimmed || null },
     });
+
+    // The row has to exist before the files, since each is stored against
+    // `messageId`. That leaves a window: if an upload fails here, the message is
+    // already committed. Undo it rather than leave the thread with a
+    // permanently blank bubble — there is no delete flow, so an orphan would be
+    // unremovable, and an attachment-only message that lost its files has no
+    // content at all.
+    let stored: AttachmentRow[];
+    try {
+      stored = await this.storeAttachments(message.id, attachments);
+    } catch (error) {
+      await this.prisma.supportMessage.delete({ where: { id: message.id } });
+      throw error;
+    }
+
     const updated = (await this.prisma.supportConversation.update({
       where: { id: conversation.id },
       data: {
         lastMessageAt: message.createdAt,
-        lastMessagePreview: text.slice(0, 280),
+        lastMessagePreview: this.buildPreview(trimmed, stored),
         lastMessageSender: sender,
       },
-      include: { messages: { orderBy: { createdAt: 'asc' } } },
-    })) as ConversationRow & { messages: any[] };
+      // Deliberately NOT `include: { messages: ... }` — that loaded every
+      // message in the thread on every send just to read back the one we had in
+      // hand.
+    })) as ConversationRow;
 
+    const messageDto = await this.toMessageDto({
+      ...(message as MessageRow),
+      attachments: stored,
+    });
     const dto = this.toConversationDto(updated, 0);
-    this.gateway.emitMessage(this.ownerRoom(updated), dto, this.toMessageDto(message));
-    return { conversation: updated, message };
+    this.gateway.emitMessage(this.ownerRoom(updated), dto, messageDto);
+    return { conversation: updated, message: messageDto };
+  }
+
+  /**
+   * Push bytes to MinIO, then record them. Object keys are namespaced by message
+   * id and the stored name is sanitized so the key survives the round-trip
+   * through its own URL (spaces/unicode would otherwise percent-encode and no
+   * longer match the key).
+   */
+  private async storeAttachments(
+    messageId: string,
+    files: Express.Multer.File[],
+  ): Promise<AttachmentRow[]> {
+    return Promise.all(
+      files.map(async (file) => {
+        const safeName = file.originalname
+          .normalize('NFKD')
+          .replace(/[^\w.\-]+/g, '_')
+          .replace(/_{2,}/g, '_')
+          .replace(/^_+|_+$/g, '');
+        // The random segment is load-bearing: `Date.now()` is NOT unique across
+        // this batch, since every callback runs to its first await in the same
+        // tick and reads the same millisecond. Two files sharing a name — e.g.
+        // two pasted screenshots, which browsers both call "image.png" — would
+        // otherwise build the same key and silently overwrite each other.
+        const objectName = `support_message/${messageId}/${Date.now()}_${randomUUID().slice(0, 8)}_${safeName}`;
+        const url = await this.minio.uploadFile(objectName, file.buffer, file.mimetype);
+        return this.prisma.supportAttachment.create({
+          data: {
+            messageId,
+            name: file.originalname,
+            mimeType: file.mimetype,
+            size: file.size,
+            url,
+          },
+        });
+      }),
+    );
+  }
+
+  /**
+   * Chat upload rules — kept in step with the freight side via the shared
+   * SUPPORT_ATTACHMENT_* constants. Notably excludes SVG: it's executable markup
+   * and this is a file one user pushes at another.
+   */
+  private assertSendable(text: string, attachments: Express.Multer.File[]): void {
+    if (!text && attachments.length === 0) {
+      throw new BadRequestException('A message needs text or at least one attachment.');
+    }
+    if (attachments.length > SUPPORT_ATTACHMENT_MAX_PER_MESSAGE) {
+      throw new BadRequestException(
+        `At most ${SUPPORT_ATTACHMENT_MAX_PER_MESSAGE} files per message.`,
+      );
+    }
+    for (const file of attachments) {
+      if (!isSupportAttachmentAllowed(file.mimetype)) {
+        throw new BadRequestException(`Unsupported attachment type: ${file.mimetype}`);
+      }
+      if (file.size > SUPPORT_ATTACHMENT_MAX_BYTES) {
+        throw new BadRequestException(
+          `"${file.originalname}" exceeds the ${
+            SUPPORT_ATTACHMENT_MAX_BYTES / (1024 * 1024)
+          }MB attachment limit.`,
+        );
+      }
+    }
+  }
+
+  /** Inbox preview line — falls back to filenames when there's no text. */
+  private buildPreview(text: string, attachments: AttachmentRow[]): string {
+    if (text) return text.slice(0, 280);
+    if (attachments.length === 1) {
+      return `${ATTACHMENT_ONLY_PREVIEW} ${attachments[0].name}`.slice(0, 280);
+    }
+    return `${ATTACHMENT_ONLY_PREVIEW} ${attachments.length} files`;
   }
 
   private async buildListResult(
@@ -340,9 +523,7 @@ export class SupportService {
     side: Side,
   ): Promise<T.PassengerSupportConversationListResult> {
     const unreadMap = await this.computeUnread(rows, side);
-    const items = rows.map((r) =>
-      this.toConversationDto(r, unreadMap.get(r.id) ?? 0),
-    );
+    const items = rows.map((r) => this.toConversationDto(r, unreadMap.get(r.id) ?? 0));
     let unreadCount = 0;
     for (const n of unreadMap.values()) if (n > 0) unreadCount++;
     return { items, count, unreadCount };
@@ -365,10 +546,7 @@ export class SupportService {
       select: { conversationId: true, createdAt: true },
     });
     const cursorById = new Map(
-      rows.map((r) => [
-        r.id,
-        side === 'USER' ? r.userLastReadAt : r.agentLastReadAt,
-      ]),
+      rows.map((r) => [r.id, side === 'USER' ? r.userLastReadAt : r.agentLastReadAt]),
     );
     for (const m of msgs) {
       const cursor = cursorById.get(m.conversationId) ?? null;
@@ -448,27 +626,75 @@ export class SupportService {
     };
   }
 
-  private toMessageDto(m: {
-    id: string;
-    conversationId: string;
-    sender: PrismaSender;
-    text: string;
-    createdAt: Date;
-  }): T.PassengerSupportMessageDto {
+  private async toMessageDto(m: MessageRow): Promise<T.PassengerSupportMessageDto> {
     return {
       id: m.id,
       conversationId: m.conversationId,
       sender: this.toDtoSender(m.sender) ?? T.PassengerSupportSender.AGENT,
-      text: m.text,
+      text: m.text ?? '',
+      attachments: (m.attachments ?? []).map((a) => this.toAttachmentDto(a)),
       createdAt: m.createdAt.toISOString(),
     };
   }
 
+  /**
+   * Where the client fetches the bytes: this API's own stream route, NOT a
+   * presigned MinIO URL. Presigned object URLs are not reachable from the
+   * browser in this deployment, which is why every working file in the platform
+   * streams through the API instead.
+   *
+   * The path is audience-independent on purpose. A new message is pushed over
+   * the socket to the device room *and* the backoffice room in one payload, so a
+   * URL that embedded the caller's identity (a `?deviceId=`, say) would be wrong
+   * for one of the two recipients.
+   *
+   * The client can't use this path as an `<img src>` either — the agent side's
+   * guard only reads a bearer header, which an image request can't send — so the
+   * web apps fetch it through their authenticated client and render a blob.
+   */
+  private toAttachmentDto(a: AttachmentRow): T.PassengerSupportAttachmentDto {
+    return {
+      id: a.id,
+      name: a.name,
+      mimeType: a.mimeType,
+      size: a.size,
+      url: `/support/attachments/${a.id}`,
+    };
+  }
+
+  /**
+   * Bytes for a chat attachment.
+   *
+   * Deliberately unscoped, and this is a trade-off worth naming: passenger
+   * support threads are already reachable by whoever holds the device/guest id
+   * (see the device routes — "anyone with the device id can see that thread",
+   * the accepted MVP posture), and the agent routes admit any authenticated
+   * caller pending real staff gating. Scoping this endpoint tighter than the
+   * thread it belongs to would buy nothing, so it matches that posture: the
+   * attachment UUID is the capability.
+   *
+   * TODO: tighten alongside the agent-route staff permission — at that point
+   * both the thread and its attachments should be gated the same way.
+   */
+  async streamAttachment(
+    fileId: string,
+  ): Promise<{ stream: Readable; mimeType: string; name: string }> {
+    const attachment = await this.prisma.supportAttachment.findUnique({
+      where: { id: fileId },
+    });
+    if (!attachment) throw new NotFoundException('Attachment not found');
+
+    const objectName = this.minio.getObjectNameFromUrl(attachment.url);
+    return {
+      stream: await this.minio.getFileStream(objectName),
+      mimeType: attachment.mimeType,
+      name: attachment.name,
+    };
+  }
+
   /** Legacy BOT messages are surfaced as AGENT to the UI. */
   private toDtoSender(s: PrismaSender | null): T.PassengerSupportSender | null {
     if (!s) return null;
-    return s === 'USER'
-      ? T.PassengerSupportSender.USER
-      : T.PassengerSupportSender.AGENT;
+    return s === 'USER' ? T.PassengerSupportSender.USER : T.PassengerSupportSender.AGENT;
   }
 }