hq/bpist-squalk-forum
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow users to delete their messages

Browse source 
No more than 30 minutes old
This commit is contained in:
dtonon 2026-06-23 22:53:31 +02:00
parent 2daaec15fa
commit 9e26e9dc60
3 changed files with 76 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/lib/components/ChatSidebar.svelte
View file

@ -9,7 +9,10 @@
} from "$lib/chat.svelte";
import { auth, openLogin } from "$lib/auth.svelte";
import { isGroupAdmin } from "$lib/admins.svelte";
import { requestDelete } from "$lib/moderation.svelte";
import {
requestDelete,
withinSelfDeleteWindow,
} from "$lib/moderation.svelte";
import {
withJoin,
membershipOf,
@ -51,6 +54,13 @@
!!auth.user && isGroupAdmin(auth.user.pubkey, activeGroup.id),
);
const isOwnMessage = (msg: ChatMessageData) =>
auth.user?.pubkey === msg.pubkey;
// Admins moderate anything; authors self-delete their own.
const canDeleteMessage = (msg: ChatMessageData) =>
canModerate || isOwnMessage(msg);
// Sending needs membership regardless of flags. Only gate a confirmed guest;
// while membership resolves the input stays (withJoin nets a stray send), so a
// member never flashes "Join to chat".
@ -72,7 +82,13 @@
function requestDeleteMessage(msg: ChatMessageData) {
openMenuId = null;
requestDelete(
{ eventId: msg.id, groupId: activeGroup.id, label: "message" },
{
eventId: msg.id,
groupId: activeGroup.id,
label: "message",
self: !canModerate,
eventKind: 9,
},
() => removeChatMessage(msg.id),
);
}
@ -383,15 +399,19 @@
class="w-full px-3 py-1.5 text-left hover:bg-neutral-50 dark:text-neutral-100 dark:hover:bg-neutral-800"
>Reply</button
>
{#if canModerate}
{#if canDeleteMessage(msg)}
{@const tooOld =
!canModerate &&
!withinSelfDeleteWindow(msg.createdAt)}
<button
role="menuitem"
disabled={tooOld}
onclick={(e) => {
e.stopPropagation();
requestDeleteMessage(msg);
}}
class="w-full px-3 py-1.5 text-left text-red-600 hover:bg-red-50 dark:hover:bg-neutral-800"
>Delete</button
class="w-full px-3 py-1.5 text-left text-red-600 hover:bg-red-50 disabled:cursor-not-allowed disabled:text-neutral-400 disabled:hover:bg-transparent dark:hover:bg-neutral-800 dark:disabled:text-neutral-600"
>Delete{tooOld ? " (too old)" : ""}</button
>
{/if}
</div>

30
src/lib/moderation.svelte.ts
View file

@ -1,12 +1,24 @@
import { auth } from "$lib/auth.svelte";
import { publishForum } from "$lib/relay";
// Users may delete their own posts only within this window; afterwards the relay
// also refuses (pyramid caps group self-deletes at 2h, we're stricter on top).
export const SELF_DELETE_WINDOW = 30 * 60; // seconds
export function withinSelfDeleteWindow(createdAt: number): boolean {
return Math.floor(Date.now() / 1000) - createdAt <= SELF_DELETE_WINDOW;
}
// What's pending deletion, surfaced to the confirmation modal. `label` is the
// noun shown in the dialog copy ("discussion", "reply", "message").
// noun shown in the dialog copy ("discussion", "reply", "message"). `self` picks
// the mechanism: authors delete via NIP-09 (kind 5), admins moderate via
// NIP-29 (kind 9005). `eventKind` feeds the NIP-09 `k` tag.
type DeleteTarget = {
eventId: string;
groupId: string;
label: string;
self?: boolean;
eventKind?: number;
};
let target = $state<DeleteTarget | null>(null);
@ -45,8 +57,9 @@ export function cancelDelete() {
error = null;
}
// NIP-29 kind:9005 delete-event. The relay enforces the role check and only
// resolves the publish (OK: true) once it has processed the deletion.
// Authors self-delete with NIP-09 (kind 5); admins moderate with NIP-29
// (kind 9005). The relay enforces the matching rule (author match / role) and
// only resolves the publish (OK: true) once it has processed the deletion.
export async function confirmDelete(reason?: string) {
if (!target) return;
if (!auth.signer) {
@ -56,21 +69,28 @@ export async function confirmDelete(reason?: string) {
busy = true;
error = null;
const kind = target.self ? 5 : 9005;
const tags: string[][] = [
["h", target.groupId],
["e", target.eventId],
];
if (target.self && target.eventKind !== undefined) {
tags.push(["k", String(target.eventKind)]);
}
try {
const signed = await auth.signer.signEvent({
kind: 9005,
kind,
created_at: Math.floor(Date.now() / 1000),
tags,
content: reason?.trim() ?? "",
});
const timeout = new Promise<never>((_, reject) =>
setTimeout(() => reject(new Error("Relay did not respond in time")), 8000),
setTimeout(
() => reject(new Error("Relay did not respond in time")),
8000,
),
);
await Promise.race([Promise.all(publishForum(signed)), timeout]);

32
src/routes/thread/[id]/+page.svelte
View file

@ -12,7 +12,10 @@
} from "$lib/thread.svelte";
import { auth, openLogin } from "$lib/auth.svelte";
import { isGroupAdmin } from "$lib/admins.svelte";
import { requestDelete } from "$lib/moderation.svelte";
import {
requestDelete,
withinSelfDeleteWindow,
} from "$lib/moderation.svelte";
import { showToast } from "$lib/toast.svelte";
import {
withJoin,
@ -142,6 +145,12 @@
!!auth.user && !!detail && isGroupAdmin(auth.user.pubkey, detail.groupId),
);
const isOwnPost = (p: PostData) => auth.user?.pubkey === p.pubkey;
// Whose delete a post can offer: admins moderate anything; authors self-delete
// their own (the button still shows when too old, just disabled).
const canDeletePost = (p: PostData) => canModerate || isOwnPost(p);
let openMenuId = $state<string | null>(null);
function toggleMenu(id: string, e: MouseEvent) {
@ -150,13 +159,21 @@
}
// Deleting the OP removes the whole thread, so leave the page; a reply just
// disappears in place.
// disappears in place. Admins moderate (kind 9005); authors self-delete
// (kind 5) only inside the time window.
function requestDeletePost(p: PostData, isOp: boolean) {
if (!detail) return;
const groupId = detail.groupId;
const self = !canModerate;
openMenuId = null;
requestDelete(
{ eventId: p.id, groupId, label: isOp ? "discussion" : "reply" },
{
eventId: p.id,
groupId,
label: isOp ? "discussion" : "reply",
self,
eventKind: isOp ? 11 : 1111,
},
() => {
if (isOp) {
showToast("Discussion deleted");
@ -326,7 +343,9 @@
>
</div>
<div class="ml-4 flex flex-shrink-0 items-center gap-1">
{#if canModerate}
{#if canDeletePost(p)}
{@const tooOld =
!canModerate && !withinSelfDeleteWindow(p.createdAt)}
<div class="relative">
<button
onclick={(e) => toggleMenu(p.id, e)}
@ -353,12 +372,13 @@
>
<button
role="menuitem"
disabled={tooOld}
onclick={(e) => {
e.stopPropagation();
requestDeletePost(p, index === 0);
}}
class="w-full px-3 py-1.5 text-left text-red-600 hover:bg-red-50"
>Delete</button
class="w-full px-3 py-1.5 text-left text-red-600 hover:bg-red-50 disabled:cursor-not-allowed disabled:text-neutral-400 disabled:hover:bg-transparent dark:disabled:text-neutral-600"
>Delete{tooOld ? " (too old)" : ""}</button
>
</div>
{/if}