feat(federation): deleted flag on wire profile snapshots — tombstone markers never leave the instance (dead-incarnation spec §3.3)

packages/server/src/utils/federationOutbox.participants.test.ts

@@ -0,0 +1,89 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as schema from '../db/schema.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+type TestDb = ReturnType<typeof drizzle<typeof schema>>;
+let sqlite: Database.Database;
+let testDb: TestDb;
+
+vi.mock('../db/index.js', () => ({
+  getDb: () => testDb,
+  getRawDb: () => sqlite,
+  schema,
+}));
+
+let _sf = 1;
+vi.mock('./snowflake.js', () => ({
+  generateSnowflake: () => String(_sf++),
+  setWorkerId: vi.fn(),
+}));
+
+vi.mock('./federationAuth.js', async (importActual) => {
+  const actual = await importActual<typeof import('./federationAuth.js')>();
+  return { ...actual, getOurOrigin: () => 'https://home.test' };
+});
+
+// federationOutbox.ts imports extractDomain from routes/federation.js, which in
+// turn imports connectionManager/ws — stub the minimal surface so the module
+// graph loads at test time. getDmParticipants doesn't touch any of these.
+vi.mock('../ws/handler.js', () => ({
+  connectionManager: {
+    sendToUser: vi.fn(),
+    sendToSpace: vi.fn(),
+    sendToDmMembers: vi.fn(),
+    sendToAdmins: vi.fn(),
+    getAllOnlineUserIds: () => [],
+    evictFederatedCallsForHost: vi.fn(),
+    federatedCalls: new Map(),
+    isUserOnline: vi.fn(),
+    lateBindFederatedCall: vi.fn(),
+  },
+}));
+
+function applyMigrations(db: Database.Database): void {
+  const migrationsDir = path.resolve(__dirname, '../../drizzle');
+  const files = fs.readdirSync(migrationsDir).filter(f => f.endsWith('.sql')).sort();
+  for (const f of files) {
+    const sql = fs.readFileSync(path.join(migrationsDir, f), 'utf8');
+    for (const stmt of sql.split(/-->\s*statement-breakpoint/)) {
+      const clean = stmt.trim();
+      if (clean) db.exec(clean);
+    }
+  }
+}
+
+beforeEach(() => {
+  sqlite = new Database(':memory:');
+  testDb = drizzle(sqlite, { schema });
+  applyMigrations(sqlite);
+  _sf = 1;
+});
+
+describe('getDmParticipants — deleted members', () => {
+  it('ships deleted:true and NO username for tombstoned members', async () => {
+    testDb.insert(schema.users).values([
+      { id: 'alice', username: 'alice', passwordHash: 'h', homeInstance: null, createdAt: 1 },
+      { id: 'ghost', username: '!deleted:ghost', passwordHash: 'h', homeInstance: null, isDeleted: 1, createdAt: 1 },
+    ]).run();
+    testDb.insert(schema.dmChannels).values({ id: 'ch1', federatedId: 'fed-ch1', createdAt: 1 }).run();
+    testDb.insert(schema.dmMembers).values([
+      { dmChannelId: 'ch1', userId: 'alice', closed: 0 },
+      { dmChannelId: 'ch1', userId: 'ghost', closed: 0 },
+    ]).run();
+
+    const { getDmParticipants } = await import('./federationOutbox.js');
+    const participants = getDmParticipants('ch1');
+    const ghost = participants.find(p => p.homeUserId === 'ghost')!;
+    expect(ghost.profile?.deleted).toBe(true);
+    expect(ghost.profile?.username ?? null).toBeNull();
+    expect(ghost.profile?.displayName ?? null).toBeNull();
+    const alice = participants.find(p => p.homeUserId === 'alice')!;
+    expect(alice.profile?.deleted ?? undefined).toBeUndefined();
+    expect(alice.profile?.username).toBe('alice');
+  });
+});

packages/server/src/utils/federationOutbox.ts

@@ -364,6 +364,7 @@ export function getDmParticipants(dmChannelId: string): FederationRelayParticipa
       avatar: schema.users.avatar,
       avatarColor: schema.users.avatarColor,
       status: schema.users.status,
+      isDeleted: schema.users.isDeleted,
     })
     .from(schema.dmMembers)
     .innerJoin(schema.users, eq(schema.dmMembers.userId, schema.users.id))
@@ -372,19 +373,30 @@ export function getDmParticipants(dmChannelId: string): FederationRelayParticipa
 
   const domainOrigin = getOurOrigin();
 
-  return members.map(m => ({
-    homeUserId: m.homeUserId || m.id,
-    homeInstance: m.homeInstance || domainOrigin,
-    profile: {
-      username: m.username ?? null,
-      displayName: m.displayName ?? null,
-      avatar: m.avatar ?? null,
-      avatarColor: m.avatarColor ?? null,
-      // Only carry presence for native participants — replicated stubs hold
-      // stale status owned by their home; emitting it would flap remote UIs.
-      status: !m.homeInstance ? (m.status as 'online' | 'idle' | 'dnd' | 'offline' | null) : null,
-    },
-  }));
+  return members.map(m => {
+    if (m.isDeleted) {
+      // Tombstoned member: ship the identity for attribution but no profile
+      // data — the internal '!deleted:<id>' marker never leaves this instance.
+      return {
+        homeUserId: m.homeUserId || m.id,
+        homeInstance: m.homeInstance || domainOrigin,
+        profile: { deleted: true },
+      };
+    }
+    return {
+      homeUserId: m.homeUserId || m.id,
+      homeInstance: m.homeInstance || domainOrigin,
+      profile: {
+        username: m.username ?? null,
+        displayName: m.displayName ?? null,
+        avatar: m.avatar ?? null,
+        avatarColor: m.avatarColor ?? null,
+        // Only carry presence for native participants — replicated stubs hold
+        // stale status owned by their home; emitting it would flap remote UIs.
+        status: !m.homeInstance ? (m.status as 'online' | 'idle' | 'dnd' | 'offline' | null) : null,
+      },
+    };
+  });
 }
 
 /**