fix: sync harden star gift upgrade projections

deploy/migrations/0163_star_gift_prepaid_viewer_projection.down.sql

@@ -0,0 +1,4 @@
+-- Data-only viewer projection and durable PTS repair. Reintroducing the leaked
+-- owner hash or receiver-only capability into the sender box would be unsafe,
+-- and emitted updateEditMessage events cannot be retracted.
+SELECT 1;

deploy/migrations/0163_star_gift_prepaid_viewer_projection.up.sql

@@ -0,0 +1,183 @@
+-- inputInvoiceStarGiftPrepaidUpgrade is for prepaying someone else's gift:
+-- its peer is the gift owner. Earlier user-gift purchases copied both
+-- receiver-only can_upgrade and non-owner prepaid_upgrade_hash into both
+-- private message boxes. DrKLO therefore preferred the prepaid invoice on the
+-- owner's incoming card and substituted the private dialog peer (the sender),
+-- which correctly failed STARGIFT_INVALID.
+--
+-- Repair both viewer projections and publish a real account-scoped edit for
+-- every changed box. The saved-gift aggregate and its owner/hash remain intact;
+-- only the wire capability surface changes.
+
+LOCK TABLE public.peer_star_gifts, public.message_boxes,
+    public.private_messages IN SHARE ROW EXCLUSIVE MODE;
+
+CREATE TEMP TABLE star_gift_prepaid_viewer_sources ON COMMIT DROP AS
+SELECT gift.id AS saved_gift_id,
+       gift.owner_peer_id AS owner_user_id,
+       gift.from_user_id AS sender_user_id,
+       gift.msg_id AS owner_box_id,
+       gift.gift_id,
+       gift.prepaid_upgrade_hash,
+       owner_box.message_sender_id,
+       owner_box.private_message_id
+FROM public.peer_star_gifts gift
+JOIN public.message_boxes owner_box
+  ON owner_box.owner_user_id = gift.owner_peer_id
+ AND owner_box.box_id = gift.msg_id
+ AND NOT owner_box.deleted
+WHERE gift.owner_peer_type = 'user'
+  AND gift.lifecycle_status = 'active'
+  AND gift.unique_gift_id IS NULL
+  AND gift.prepaid_upgrade_stars = 0
+  AND gift.prepaid_upgrade_hash <> '';
+
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM public.peer_star_gifts gift
+        WHERE gift.owner_peer_type = 'user'
+          AND gift.lifecycle_status = 'active'
+          AND gift.unique_gift_id IS NULL
+          AND gift.prepaid_upgrade_stars = 0
+          AND gift.prepaid_upgrade_hash <> ''
+          AND NOT EXISTS (
+              SELECT 1
+              FROM star_gift_prepaid_viewer_sources source
+              WHERE source.saved_gift_id = gift.id
+          )
+    ) THEN
+        RAISE EXCEPTION 'active user prepaid-upgrade entitlement is missing its owner message box';
+    END IF;
+
+    IF EXISTS (
+        SELECT 1
+        FROM star_gift_prepaid_viewer_sources source
+        JOIN public.message_boxes box
+          ON box.message_sender_id = source.message_sender_id
+         AND box.private_message_id = source.private_message_id
+         AND NOT box.deleted
+        WHERE box.owner_user_id NOT IN (source.owner_user_id, source.sender_user_id)
+           OR box.media #>> '{service_action,kind}' IS DISTINCT FROM 'star_gift'
+           OR box.media #>> '{service_action,star_gift,gift_id}' IS DISTINCT FROM source.gift_id::text
+    ) THEN
+        RAISE EXCEPTION 'ordinary star gift private projections disagree with the saved aggregate';
+    END IF;
+END
+$$;
+
+CREATE TEMP TABLE star_gift_prepaid_viewer_repairs (
+    owner_user_id bigint NOT NULL,
+    box_id integer NOT NULL,
+    peer_type text NOT NULL,
+    peer_id bigint NOT NULL,
+    message_sender_id bigint NOT NULL,
+    private_message_id bigint NOT NULL,
+    repaired_media jsonb NOT NULL,
+    PRIMARY KEY (owner_user_id, box_id)
+) ON COMMIT DROP;
+
+INSERT INTO star_gift_prepaid_viewer_repairs(
+    owner_user_id, box_id, peer_type, peer_id,
+    message_sender_id, private_message_id, repaired_media
+)
+SELECT box.owner_user_id,
+       box.box_id,
+       box.peer_type,
+       box.peer_id,
+       box.message_sender_id,
+       box.private_message_id,
+       CASE
+           WHEN box.owner_user_id = source.owner_user_id THEN
+               box.media #- '{service_action,star_gift,prepaid_upgrade_hash}'
+           ELSE
+               box.media #- '{service_action,star_gift,can_upgrade}'
+       END
+FROM star_gift_prepaid_viewer_sources source
+JOIN public.message_boxes box
+  ON box.message_sender_id = source.message_sender_id
+ AND box.private_message_id = source.private_message_id
+ AND NOT box.deleted
+WHERE box.owner_user_id IN (source.owner_user_id, source.sender_user_id)
+  AND box.media IS DISTINCT FROM CASE
+      WHEN box.owner_user_id = source.owner_user_id THEN
+          box.media #- '{service_action,star_gift,prepaid_upgrade_hash}'
+      ELSE
+          box.media #- '{service_action,star_gift,can_upgrade}'
+  END;
+
+DO $$
+DECLARE
+    repair_row record;
+    next_pts integer;
+    event_date integer := EXTRACT(EPOCH FROM clock_timestamp())::integer;
+BEGIN
+    FOR repair_row IN
+        SELECT owner_user_id, box_id, peer_type, peer_id, repaired_media
+        FROM star_gift_prepaid_viewer_repairs
+        ORDER BY owner_user_id, box_id
+    LOOP
+        INSERT INTO public.user_update_watermarks(user_id, contiguous_pts)
+        VALUES(repair_row.owner_user_id, 0)
+        ON CONFLICT(user_id) DO NOTHING;
+
+        UPDATE public.user_update_watermarks
+        SET contiguous_pts = contiguous_pts + 1,
+            updated_at = now()
+        WHERE user_id = repair_row.owner_user_id
+        RETURNING contiguous_pts INTO next_pts;
+
+        UPDATE public.message_boxes
+        SET media = repair_row.repaired_media,
+            pts = next_pts
+        WHERE owner_user_id = repair_row.owner_user_id
+          AND box_id = repair_row.box_id
+          AND NOT deleted;
+
+        INSERT INTO public.user_update_events(
+            user_id, pts, pts_count, date, event_type,
+            message_box_id, peer_type, peer_id
+        ) VALUES (
+            repair_row.owner_user_id, next_pts, 1, event_date, 'edit_message',
+            repair_row.box_id, repair_row.peer_type, repair_row.peer_id
+        );
+
+        INSERT INTO public.dispatch_outbox(
+            target_user_id, pts, event_type,
+            exclude_auth_key_id, exclude_session_id
+        ) VALUES(repair_row.owner_user_id, next_pts, 'edit_message', 0, 0);
+    END LOOP;
+END
+$$;
+
+-- A shared private-message envelope is not a viewer projection. Keep neither
+-- the owner-only nor non-owner-only capability there; both durable boxes above
+-- remain authoritative for replay and history.
+UPDATE public.private_messages private_message
+SET media = private_message.media
+        #- '{service_action,star_gift,prepaid_upgrade_hash}'
+        #- '{service_action,star_gift,can_upgrade}'
+FROM star_gift_prepaid_viewer_sources source
+WHERE private_message.sender_user_id = source.message_sender_id
+  AND private_message.id = source.private_message_id;
+
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM star_gift_prepaid_viewer_sources source
+        JOIN public.message_boxes box
+          ON box.message_sender_id = source.message_sender_id
+         AND box.private_message_id = source.private_message_id
+         AND NOT box.deleted
+        WHERE (box.owner_user_id = source.owner_user_id AND
+               box.media #> '{service_action,star_gift,prepaid_upgrade_hash}' IS NOT NULL)
+           OR (box.owner_user_id = source.sender_user_id AND
+               box.owner_user_id <> source.owner_user_id AND
+               box.media #> '{service_action,star_gift,can_upgrade}' IS NOT NULL)
+    ) THEN
+        RAISE EXCEPTION 'star gift prepaid viewer projection repair did not converge';
+    END IF;
+END
+$$;