feat(search-sync-worker): restrictedRooms on user-room + tshow on message index

[Joey0538]

Summary

Prerequisite for PR #114 (search-service). Lands the search-sync-worker + pkg/model changes so search-service can read restrictedRooms{} directly from the user-room ES doc (no Mongo at query time), brings the tshow MVP parity gap forward, and hardens the HistorySharedSince publisher contract end-to-end.

Spec: docs/superpowers/specs/2026-04-21-search-service-sync-worker-extension-design.md (added in #114).

Changes

1. *int64 on HistorySharedSince + publisher contract guards

• pkg/model.InboxMemberEvent / MemberAddEvent: int64 → *int64 with omitempty to disambiguate "unrestricted" (nil) from "restricted-since-timestamp" (non-nil).
• Publisher contract: emit nil for unrestricted rooms — never &0. The Go↔painless sentinel treats any hss <= 0 as unrestricted.
• room-worker builds the pointer only when History.Mode == None && req.Timestamp > 0; logs an error (leaves pointer nil) if a restricted request arrives with a missing timestamp rather than silently emitting &0.
• inbox-worker consumer checks != nil before dereferencing.

2. restrictedRooms{} on user-room ES doc

• Template gains restrictedRooms as flattened (same approach as roomTimestamps).
• Add-script routes by params.hss: hss > 0 → restrictedRooms[rid] = hss + evict from rooms[]; hss <= 0 → rooms[] + evict from restrictedRooms{}.
• Remove-script evicts from both maps.
• Transitions (admin lifting/applying restrictions) happen atomically inside one painless execution — a rid is never in both slots for the same roomTimestamps entry.
• LWW guard unchanged, applies uniformly to both paths.
• Spotlight keeps the MVP skip for restricted rooms, aligned with user-room's hss > 0 sentinel so a leaked &0 is treated consistently as unrestricted by both indices (documented MVP gap for restricted-room typeahead).

3. tshow end-to-end on the message path

• pkg/model.Message gains TShow bool with json:"tshow,omitempty" bson:"tshow,omitempty".
• message-worker's SaveMessage (→ messages_by_room, messages_by_id) and SaveThreadMessage (→ messages_by_id) now bind msg.TShow. thread_messages_by_room is unchanged — its schema has no tshow column by design (the flag lives on the parent channel row).
• MessageSearchIndex gains TShow with es:"boolean"; the mapping auto-picks it up via esPropertiesFromStruct.
• omitempty on the wire, Mongo bson, and ES doc so unset messages don't bloat the inverted index.

Tests

• Model round-trips for nil vs non-nil HistorySharedSince and wire omission.
• Publisher tests on room-worker.processAddMembers assert pointer propagation (restricted) and wire omission (unrestricted), both for the local RoomMemberEvent and the batched cross-site outbox payload.
• User-room unit tests cover restricted routing, bulk-restricted fan-out, restricted-path upsert shape, and the remove-script evicting from both maps.
• Integration tests: TestUserRoomSync_Integration expects the restricted bulk to land in restrictedRooms{}; TestUserRoomSync_BulkInvite gains an eviction-on-remove subtest for the restricted path.
• Message tests cover tshow round-trip (true) and wire omission (false), plus the template mapping assertion.

Test plan

• make lint — 0 issues
• make test — all packages pass
• Integration tests on real ES+NATS+Cassandra containers (CI)
• Merge before PR docs: design specs for search-service (backend + sync-worker + frontend) #114 (search-service reads restrictedRooms{} from the doc shape this PR establishes)

Review notes

CodeRabbit's suggestion to reject non-nil <=0 HistorySharedSince at the user-room consumer was declined — the spec explicitly documents hss <= 0 → unrestricted as the Go↔painless sentinel, with publisher-side guards (the room-worker Timestamp > 0 check + publisher unit tests) as the source of truth. Full rationale in the resolved review thread.

https://claude.ai/code/session_018uJCyUSaHiPnmnyfUDeQUj

[coderabbitai]

Warning

Rate limit exceeded

@Joey0538 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 52 minutes and 37 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 52 minutes and 37 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 00072f8c-2ba5-415b-8759-bd9078caf872

📥 Commits

Reviewing files that changed from the base of the PR and between d7d2134 and 82cf5d5.

📒 Files selected for processing (17)

• inbox-worker/handler.go
• inbox-worker/handler_test.go
• inbox-worker/integration_test.go
• message-worker/store_cassandra.go
• pkg/model/event.go
• pkg/model/message.go
• pkg/model/model_test.go
• room-worker/handler.go
• room-worker/handler_test.go
• search-sync-worker/inbox_integration_test.go
• search-sync-worker/inbox_stream.go
• search-sync-worker/messages.go
• search-sync-worker/messages_test.go
• search-sync-worker/spotlight.go
• search-sync-worker/spotlight_test.go
• search-sync-worker/user_room.go
• search-sync-worker/user_room_test.go

📝 Walkthrough

Walkthrough

This PR transforms HistorySharedSince from an int64 sentinel value to a *int64 pointer across models and workers, where nil represents unrestricted access and non-nil values represent restricted access timestamps. Additionally, a new TShow boolean field is added to message models, and search-sync logic is updated to maintain a restrictedRooms map for tracking restricted room memberships separately.

Changes

Cohort / File(s)	Summary
Model type changes pkg/model/event.go, pkg/model/message.go	Changed InboxMemberEvent.HistorySharedSince and MemberAddEvent.HistorySharedSince from int64 to *int64 with omitempty JSON/BSON tags. Added Message.TShow boolean field with omitempty tags.
Model tests pkg/model/model_test.go	Extended JSON serialization tests for pointer semantics: verify TShow omits when false, assert HistorySharedSince omits when nil, and validate marshalling/unmarshalling of both restricted and unrestricted scenarios.
Inbox worker inbox-worker/handler.go, inbox-worker/handler_test.go, inbox-worker/integration_test.go	Updated handleMemberAdded to dereference HistorySharedSince pointer and check for nil; adjusted all test constructions to use address-of operator (&hssMillis) and nil assignments.
Room worker room-worker/handler.go, room-worker/handler_test.go	Modified processAddMembers to use historySharedSincePtr and emit pointer values; added test cases validating restricted (HistoryModeNone) and unrestricted (HistoryModeAll) room member additions.
Search-sync event parsing search-sync-worker/inbox_stream.go, search-sync-worker/inbox_integration_test.go	Updated helper function signature buildInboxMemberEvent to accept *int64 instead of int64; modified integration tests to pass nil for unrestricted and hssPtr(value) for restricted rooms.
Search-sync message indexing search-sync-worker/messages.go, search-sync-worker/messages_test.go	Added TShow field to MessageSearchIndex struct and initialized from event payload; added tests verifying tshow inclusion/omission in indexed documents.
Search-sync spotlight search-sync-worker/spotlight.go, search-sync-worker/spotlight_test.go	Changed nil check from != 0 to != nil for restricted-room short-circuit condition; updated test to construct pointer-based payload.
Search-sync user-room search-sync-worker/user_room.go, search-sync-worker/user_room_test.go	Major refactoring: added restrictedRooms map to user-room documents, updated painless scripts to route rooms by hss sentinel, modified Elasticsearch template mappings, and expanded tests to validate restricted/unrestricted routing and removal logic.

Sequence Diagram(s)

sequenceDiagram
    participant Client as Member Addition
    participant RoomWorker as room-worker
    participant EventQueue as Event Queue
    participant InboxWorker as inbox-worker
    participant SearchSync as search-sync-worker

    Client->>RoomWorker: Add member request<br/>(with HistoryMode)
    RoomWorker->>RoomWorker: Determine hss from HistoryMode<br/>(None → timestamp, All → nil)
    RoomWorker->>EventQueue: Publish MemberAddEvent<br/>(HistorySharedSince: *int64 or nil)
    
    EventQueue->>InboxWorker: Consume MemberAddEvent
    InboxWorker->>InboxWorker: Check if hss != nil<br/>Convert to UTC time if set
    
    EventQueue->>SearchSync: Consume MemberAddEvent
    SearchSync->>SearchSync: Route by nil check:<br/>nil → rooms[],<br/>non-nil → restrictedRooms[]
    SearchSync->>SearchSync: Update Elasticsearch<br/>user-room document

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Possibly related PRs

• feat(search-sync-worker): add spotlight + user-room sync via INBOX #109: Directly related—introduces the same HistorySharedSince int64-to-*int64 transformation and drives the nil-vs-non-nil sentinel changes across search-sync-worker parsing and checks.
• feat: add search-sync-worker with message sync to Elasticsearch #64: Modifies search-sync-worker message indexing and updates pkg/model message/event shapes used by message and member event sync.
• Feat/role update #72: Updates inbox-worker/handler.go handleMemberAdded logic (this PR modifies the same function's HistorySharedSince handling).

Suggested reviewers

• mliu33

Poem

🐰 With pointers swift and nil so keen,
History now unrestricted—clean!
Restricted rooms in maps align,
While TShow fields in indexes shine.
A rabbit's code review, refined! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately summarizes the two main feature additions: restrictedRooms field on user-room documents and tshow field on message index, which are the most significant changes across multiple files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/pr-114-prerequisite-pl3Zc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/model/message.go`:
- Line 15: The Cassandra INSERT statements in SaveMessage (for messages_by_room
and messages_by_id) and SaveThreadMessage (for messages_by_id) are missing the
tshow column and thus do not bind msg.TShow; update the INSERT column lists to
include tshow and add msg.TShow to the corresponding bound values in both
SaveMessage and SaveThreadMessage so Cassandra persists the TShow field (ensure
the column name tshow matches the model tag and the bound value uses msg.TShow).

In `@room-worker/handler.go`:
- Around line 623-628: The code currently assigns historySharedSincePtr = &v
when req.History.Mode == model.HistoryModeNone which can emit a non-nil pointer
to 0 if req.Timestamp is missing; change the logic so historySharedSincePtr
remains nil for unrestricted history and only set historySharedSincePtr = &v
when req.Timestamp > 0 (i.e., check req.Timestamp before taking its address).
Update the branch that references req.History.Mode, historySharedSincePtr, and
req.Timestamp to guard against emitting &0.

In `@search-sync-worker/spotlight.go`:
- Around line 65-67: The current check in spotlight.go treats any non-nil
payload.HistorySharedSince (including a pointer to 0) as restricted and skips
indexing, which diverges from user_room.go's addRoomScript logic (which treats
hss <= 0 as unrestricted); update the condition that skips spotlight indexing to
explicitly check both non-nil and positive value (e.g., require
payload.HistorySharedSince != nil && *payload.HistorySharedSince > 0) so the
spotlight index aligns with addRoomScript's semantics and avoids mismatches if a
&0 leaks.

In `@search-sync-worker/user_room.go`:
- Around line 116-123: The code silently treats a non-nil HistorySharedSince
pointer that equals 0 (or any non-positive value) as unrestricted by assigning
hss = 0; update the validation in the block handling payload.HistorySharedSince
so that if payload.HistorySharedSince != nil and *payload.HistorySharedSince <=
0 you reject the event (return an error or drop it) instead of assigning hss;
ensure this validation occurs before addRoomScript/any indexing that uses hss so
malformed &0 (or negative) values never map into the unrestricted rooms[] index.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d95e87ed-affa-4b4c-9f4d-f5048adec285

📥 Commits

Reviewing files that changed from the base of the PR and between 647f223 and d7d2134.

📒 Files selected for processing (16)

• inbox-worker/handler.go
• inbox-worker/handler_test.go
• inbox-worker/integration_test.go
• pkg/model/event.go
• pkg/model/message.go
• pkg/model/model_test.go
• room-worker/handler.go
• room-worker/handler_test.go
• search-sync-worker/inbox_integration_test.go
• search-sync-worker/inbox_stream.go
• search-sync-worker/messages.go
• search-sync-worker/messages_test.go
• search-sync-worker/spotlight.go
• search-sync-worker/spotlight_test.go
• search-sync-worker/user_room.go
• search-sync-worker/user_room_test.go

[mliu33]

Excellent work, thanks