#18 group chat create manage send messages

[mrsumanbiswas]

PR Description

Associated Issue

Closes #18 (back-end)

Target Milestone

v0.2.0

Type of Change

• New feature (non-breaking change which adds functionality)
• Database migration / Schema update
• Security / Architecture hardening

Description & Overview

This PR delivers the complete production-ready backend infrastructure required to support multi-user channels, group administrative controls, transient event multiplexing, and a consolidated unified inbox layout.

The messaging core has been successfully extended from a 1-on-1 direct messaging system into an isolated room fan-out engine backed by relational integrity guardrails and compound temporal indexes.

---

Architectural Highlights

1. Hardened Relational Schema (migrations/006, migrations/007)

• Established groups and group_members junction tables.
• Implemented a check constraint (chk_message_destination) ensuring a message cannot target a user and a group simultaneously, or drift with zero mapping contexts.
• Added per-user tracking via group_members.last_read_at to resolve read receipts across scale boundaries without database row bloating.
• Applied compound b-tree indexes ((group_id, created_at DESC)) to prevent high I/O memory sorting under paginated query volumes.

2. Context Isolation Security Middleware (middlewares/group_auth.go)

• GroupAuthGuard: Restricts resource visibility, history retrieval, and websocket interception exclusively to verified active members. Injecting the verified role directly down the context.
• GroupAdminGuard: Blocks structural changes (adding/kicking members, altering metadata) unless the user context holds administrative clearance.

3. WebSocket Multi-Cast Fan-out (services/ws.go)

• Upgraded the central ReadPump execution engine to parse non-empty group_id structures.
• Integrated thread-safe read-locking (Hub.mu.RLock()) over the active map dictionary to broadcast text streams, group typing states, and group read receipts without echoing payloads back to the initial writer node.

4. Consolidated Unified Dashboard Query (repository/message.go)

• Implemented a robust UNION ALL timeline query compiling direct messages and group activity into a single chronological dashboard feed.
• Braced query segments inside parenthetical blocks to resolve strict PostgreSQL boundary parsing errors, utilizing explicit runtime parameter casting ($1::uuid) and COALESCE safety traps against database NULL scans.

---

New & Enhanced Endpoints Matrix

Method	Endpoint	Access Level	Description
POST	/api/groups	Authenticated	Provisions a new group room (Creator auto-assigned as admin)
GET	/api/groups	Authenticated	Lists all groups the requesting user belongs to
GET	/api/groups/{id}	Group Member	Retrieves structural metadata for the specific group room
PATCH	/api/groups/{id}	Group Admin	Updates group structural configuration parameters (e.g., name)
POST	/api/groups/{id}/leave	Group Member	Voluntarily removes the caller node from group membership mapping
GET	/api/groups/{id}/members	Group Member	Pulls full descriptive membership rosters (Admins sorted to top)
POST	/api/groups/{id}/members	Group Admin	Explicitly attaches a new targeted user profile to the channel
DELETE	/api/groups/{id}/members/{userId}	Group Admin	Administrative execution kicking a member node out of the group
GET	/api/groups/{id}/messages	Group Member	Cursor-paginated message ledger stream using before timelines
GET	/api/messages/conversations	Authenticated	Unified Feed: Combines DMs and group rows with accurate unread_count metrics
POST	/api/messages/read	Authenticated	Synchronizes read receipts dynamically for either sender_id or group_id

---

Testing Protocol Executed

• Migrations initialized and checked against isolation schemas natively.
• Verified error logging catchments via log.Printf to prevent generic 500 concealment.
• Hand-tested structural boundary constraints with Thunder Client method routing validation.
• Connected multiple real-time terminal nodes (wscat) using explicit UUID syntax mappings to verify that transient live frames (typing, text messaging, read synchronization updates) multiplex cleanly without race conditions or memory leaks.

Reviewer Notes

Backend infrastructure is fully integrated and tested out against the current mobile specification rules. API outputs are completely unblocked and ready for immediate implementation inside the Android UI layouts.