fix(chat): settle a denied send instead of offering a retry (#1760)

* fix(chat): store a denied send as its own status

* fix(chat): settle a denied send instead of failing it

The server answers Denied when it won't take a message from this user in
this chat, so a retry gets the same answer. Text and photo sends now mark
the row DENIED instead of FAILED, and the photo path drops its stored
blob as it already does for EncryptionNotAllowed.

* fix(chat): say a denied message can't be posted instead of offering a retry

A DENIED row now reads "Not Delivered. You can't post in this chat" in
the error colour, always shows, and isn't tappable. Photo bubbles stop
offering Retry for any failure the send path marked non-retryable; they
used to ignore that flag.

* fix(chat): re-read a chat's rules after a denied send

Denied carries no reason. If a speaker rule changed, the stored rules are
stale and the composer stays up; re-reading the chat lets speakerBlock
see the new rules and hide it. A removal from the group still isn't
visible, because GetChat doesn't return the caller's membership.

* fix(chat): stop reporting a denied send, typing notice or read pointer

A denied send now settles as DENIED with its own message, and typing and
read-pointer callers already ignore the result, so these refusals no
longer need to reach Bugsnag. One user produced 6 of the 18 overnight
events this way.

* fix(chat): keep stored membership when re-reading after a denied send

ChatEntityMapper.toEntity writes is_member = 1 by default. If the stream's
MemberLeft landed before the re-read returned, the upsert put a removed
user back in the feed as a member. The re-read now keeps whatever
membership is stored.

Author: bmc08gt

apps/flipcash/core/src/main/res/values/strings.xml

@@ -892,6 +892,7 @@
     <string name="label_chatReceipt_delivered">Delivered</string>
     <string name="label_chatReceipt_read">Read</string>
     <string name="label_chatReceipt_notSent">Not Delivered. Tap to retry</string>
+    <string name="label_chatReceipt_denied">Not Delivered. You can\'t post in this chat</string>
     <string name="label_chatReceipt_yesterday">Yesterday</string>
     <string name="title_messageNotSent">Message Not Sent</string>
     <string name="description_messageNotSent">Your message could not be delivered. Would you like to try again?</string>

apps/flipcash/features/messenger/src/main/kotlin/com/flipcash/app/messenger/internal/ChatViewModel.kt

@@ -1171,6 +1171,7 @@ internal class ChatViewModel @AssistedInject constructor(
                         when (message.deliveryStatus) {
                             DeliveryStatus.SENDING -> ReceiptStatus.SENDING
                             DeliveryStatus.FAILED -> ReceiptStatus.FAILED
+                            DeliveryStatus.DENIED -> ReceiptStatus.DENIED
                             DeliveryStatus.SENT -> ReceiptStatus.SENT
                         }
                     } else null

apps/flipcash/features/messenger/src/main/kotlin/com/flipcash/app/messenger/internal/screens/components/ReceiptLabel.kt

@@ -62,6 +62,7 @@ internal fun ReceiptLabel(
                 ReceiptStatus.SENT -> stringResource(R.string.label_chatReceipt_delivered)
                 ReceiptStatus.READ -> stringResource(R.string.label_chatReceipt_read)
                 ReceiptStatus.FAILED -> stringResource(R.string.label_chatReceipt_notSent)
+                ReceiptStatus.DENIED -> stringResource(R.string.label_chatReceipt_denied)
                 else -> return@AnimatedContent
             }
 
@@ -82,7 +83,7 @@ internal fun ReceiptLabel(
                     style = CodeTheme.typography.caption.copy(
                         fontWeight = FontWeight.Bold,
                     ),
-                    color = if (animatedStatus == ReceiptStatus.FAILED) {
+                    color = if (animatedStatus == ReceiptStatus.FAILED || animatedStatus == ReceiptStatus.DENIED) {
                         CodeTheme.colors.errorText
                     } else {
                         CodeTheme.colors.textSecondary

apps/flipcash/features/messenger/src/main/kotlin/com/flipcash/app/messenger/internal/screens/components/ReceiptRules.kt

@@ -71,7 +71,7 @@ internal fun shouldShowReceiptLabel(
     // A split message's receipt goes under its last row only; the rows above share its status.
     if (!item.isLastRow) return false
     val status = effectiveReceiptStatus(item, otherReadPointer) ?: return false
-    if (status == ReceiptStatus.FAILED) return true
+    if (status == ReceiptStatus.FAILED || status == ReceiptStatus.DENIED) return true
     val confirmed = item.confirmedStatus(otherReadPointer, settlingKey) ?: return false
 
     // Walking toward the newest: it keeps its line while nothing newer takes it -- no newer send

apps/flipcash/features/messenger/src/test/kotlin/com/flipcash/app/messenger/internal/screens/components/ReceiptHandoffTest.kt

@@ -75,6 +75,13 @@ class ReceiptHandoffTest {
         assertEquals(listOf(true, true), shown(rows, settlingKey = send.messageKey))
     }
 
+    @Test
+    fun `a denied send always shows its line`() {
+        val send = mine(0, ReceiptStatus.DENIED, clientId = "c2")
+        val rows = listOf(send, mine(1, ReceiptStatus.SENT))
+        assertEquals(listOf(true, true), shown(rows, settlingKey = send.messageKey))
+    }
+
     @Test
     fun `a first send that is settling shows no line anywhere`() {
         val send = mine(1, ReceiptStatus.SENT, clientId = "c1")

apps/flipcash/shared/chat-ui/src/main/kotlin/com/flipcash/shared/chat/models/ChatListItem.kt

@@ -9,7 +9,7 @@ import com.flipcash.shared.chat.ui.UndecryptableHint
 import com.getcode.opencode.model.core.ID
 import kotlin.time.Instant
 
-enum class ReceiptStatus { SENDING, SENT, READ, FAILED }
+enum class ReceiptStatus { SENDING, SENT, READ, FAILED, DENIED }
 
 sealed interface ChatListItem {
     val itemKey: Any

apps/flipcash/shared/chat-ui/src/main/kotlin/com/flipcash/shared/chat/ui/media/MediaMessageBubble.kt

@@ -151,15 +151,18 @@ internal fun MediaMessageBubble(
     val progress by remember(item.pendingClientIdHex) {
         derivedStateOf { item.pendingClientIdHex?.let { progressOf()[it] } }
     }
-    val failed = item.receiptStatus == ReceiptStatus.FAILED || progress is MediaSendProgress.Failed
+    val denied = item.receiptStatus == ReceiptStatus.DENIED
+    val failed = denied || item.receiptStatus == ReceiptStatus.FAILED || progress is MediaSendProgress.Failed
+    // A denied or terminal failure still renders as failed, but a tap can't fix it.
+    val retryable = !denied && (progress as? MediaSendProgress.Failed)?.retryable != false
 
     var loadError by remember(model) { mutableStateOf<Throwable?>(null) }
     val unavailable = loadError?.let(::isPhotoUnavailable) == true
     val blurhashOnly = info?.blurhashOnly == true
 
     val onClick: (() -> Unit)? = when {
         !interactive -> null
-        failed -> ({ actionHandler(ChatAction.RetryMessage(item)) })
+        failed -> if (retryable) ({ actionHandler(ChatAction.RetryMessage(item)) }) else null
         canOpenPhoto(blurhashOnly, failed = false, unavailable = unavailable) && localUri == null ->
             ({ actionHandler(ChatAction.OpenPhoto(item)) })
         else -> null

apps/flipcash/shared/chat/src/main/kotlin/com/flipcash/shared/chat/internal/delegates/MediaSendDelegate.kt

@@ -333,9 +333,12 @@ class MediaSendDelegate internal constructor(
                 }
             }
             .onFailure { cause ->
-                // A chat that stopped taking ciphertext won't take this blob on a retry either.
-                val terminal = cause is SendMessageError.EncryptionNotAllowed
-                fail(chatId, clientMessageId, hex, retryable = !terminal, discard = record.takeIf { terminal })
+                // A chat that stopped taking ciphertext won't take this blob on a retry either, and
+                // a denied sender won't be let in by one.
+                val denied = cause is SendMessageError.Denied
+                val terminal = denied || cause is SendMessageError.EncryptionNotAllowed
+                fail(chatId, clientMessageId, hex, retryable = !terminal, discard = record.takeIf { terminal }, denied = denied)
+                if (denied) messaging.rereadAfterDenied(chatId)
             }
     }
 
@@ -345,8 +348,13 @@ class MediaSendDelegate internal constructor(
         hex: String,
         retryable: Boolean,
         discard: PendingMediaRecord?,
+        denied: Boolean = false,
     ) {
-        messageDataSource.failPending(chatId, clientMessageId)
+        if (denied) {
+            messageDataSource.denyPending(chatId, clientMessageId)
+        } else {
+            messageDataSource.failPending(chatId, clientMessageId)
+        }
         stages.update { it + (hex to Stage.Failed(retryable)) }
         // A terminal failure has nothing a retry could resend, so the queue entry and the file go.
         if (discard != null) discard(discard)

apps/flipcash/shared/chat/src/main/kotlin/com/flipcash/shared/chat/internal/delegates/MessagingDelegate.kt

@@ -2,6 +2,7 @@
 
 package com.flipcash.shared.chat.internal.delegates
 
+import com.flipcash.services.models.SendMessageError
 import androidx.core.app.NotificationManagerCompat
 import androidx.paging.ExperimentalPagingApi
 import androidx.paging.Pager
@@ -371,7 +372,7 @@ class MessagingDelegate @Inject constructor(
     /**
      * Seals [payload] if the chat encrypts, sends it, and settles the pending row. A failure to
      * seal fails the row like a failed request, so it can be retried; so does the server refusing
-     * the ciphertext with `EncryptionNotAllowed`.
+     * the ciphertext with `EncryptionNotAllowed`. A `Denied` settles the row as denied, with no retry.
      */
     private suspend fun send(
         chatId: ChatId,
@@ -393,8 +394,14 @@ class MessagingDelegate @Inject constructor(
                 metadataDataSource.updateLastMessageId(chatId, serverMessage.messageId)
                 metadataDataSource.updateLastActivity(chatId, serverMessage.timestamp.toEpochMilliseconds())
             }
-            .onFailure {
-                messageDataSource.failPending(chatId, clientMessageId)
+            .onFailure { cause ->
+                // The server won't take this from this user in this chat; a retry gets the same answer.
+                if (cause is SendMessageError.Denied) {
+                    messageDataSource.denyPending(chatId, clientMessageId)
+                    rereadAfterDenied(chatId)
+                } else {
+                    messageDataSource.failPending(chatId, clientMessageId)
+                }
             }
     }
 
@@ -652,6 +659,21 @@ class MessagingDelegate @Inject constructor(
         senderResolver.clear()
     }
 
+    /**
+     * The server refused a send without saying why. If a speaker rule changed, the stored rules are
+     * stale and the composer is still up; re-reading the chat lets `speakerBlock` see the new rules.
+     * A removal from the group is not visible here: GetChat does not return the caller's membership.
+     */
+    internal suspend fun rereadAfterDenied(chatId: ChatId) {
+        val metadata = chatController.getChat(chatId).getOrElse {
+            trace(tag = TAG, message = "Couldn't re-read $chatId after a denied send", type = TraceType.Silent)
+            return
+        }
+        // A removal may already have landed from the stream; don't write the caller back in.
+        metadataDataSource.upsertKeepingMembership(metadata)
+        memberDataSource.upsert(chatId, metadata.members)
+    }
+
     // endregion
 
     private companion object {

apps/flipcash/shared/chat/src/test/kotlin/com/flipcash/shared/chat/MessagingSendEncryptionTest.kt

@@ -330,6 +330,62 @@ class MessagingSendEncryptionTest {
         coVerify { messages.failPending(chatId, clientMessageId) }
     }
 
+    @Test
+    fun `Denied settles the send without a retry`() = runTest {
+        storedChat(chat())
+        answerSends()
+        coEvery { controller.sendMessage(chatId, any(), any()) } returns
+            Result.failure(SendMessageError.Denied())
+        coEvery { chatController.getChat(chatId, any()) } returns Result.failure(GetChatError.Other())
+
+        val result = delegate.sendMessage(chatId, "hello", replyToMessageId = null)
+
+        assertIs<SendMessageError.Denied>(result.exceptionOrNull())
+        coVerify { messages.denyPending(chatId, clientMessageId) }
+        coVerify(exactly = 0) { messages.failPending(any(), any()) }
+    }
+
+    @Test
+    fun `Denied re-reads the chat so its rules can hide the composer`() = runTest {
+        val stored = chat()
+        storedChat(stored)
+        answerSends()
+        coEvery { controller.sendMessage(chatId, any(), any()) } returns Result.failure(SendMessageError.Denied())
+        coEvery { chatController.getChat(chatId, any()) } returns Result.success(stored)
+
+        delegate.sendMessage(chatId, "hello", replyToMessageId = null)
+
+        coVerify { metadata.upsertKeepingMembership(stored) }
+        coVerify(exactly = 0) { metadata.upsert(any<ChatMetadata>()) }
+        coVerify { members.upsert(chatId, stored.members) }
+    }
+
+    @Test
+    fun `a failed re-read leaves the denial in place`() = runTest {
+        storedChat(chat())
+        answerSends()
+        coEvery { controller.sendMessage(chatId, any(), any()) } returns Result.failure(SendMessageError.Denied())
+        coEvery { chatController.getChat(chatId, any()) } returns Result.failure(GetChatError.Other())
+
+        val result = delegate.sendMessage(chatId, "hello", replyToMessageId = null)
+
+        assertIs<SendMessageError.Denied>(result.exceptionOrNull())
+        coVerify { messages.denyPending(chatId, clientMessageId) }
+        coVerify(exactly = 0) { metadata.upsertKeepingMembership(any()) }
+    }
+
+    @Test
+    fun `EncryptionNotAllowed does not re-read the chat`() = runTest {
+        storedChat(chat())
+        answerSends()
+        coEvery { controller.sendMessage(chatId, any(), any()) } returns
+            Result.failure(SendMessageError.EncryptionNotAllowed())
+
+        delegate.sendMessage(chatId, "hello", replyToMessageId = null)
+
+        coVerify(exactly = 0) { metadata.upsertKeepingMembership(any()) }
+    }
+
     @Test
     fun `a retry seals the stored plaintext again`() = runTest {
         storedChat(chat())