feat(dm): read-only guard blocks message create/edit/delete in a Deleted-User 1-on-1 (S3)

packages/server/src/routes/dm.ts

@@ -3,7 +3,7 @@ import { eq, and, or, desc, lt, inArray, isNull, sql } from 'drizzle-orm';
 import { getDb, schema } from '../db/index.js';
 import { authenticate } from '../utils/auth.js';
 import { generateSnowflake } from '../utils/snowflake.js';
-import { isDmMember } from '../utils/permissions.js';
+import { isDmMember, isDeadOneOnOne } from '../utils/permissions.js';
 import { connectionManager } from '../ws/handler.js';
 import {
   MAX_MESSAGE_LENGTH,
@@ -2456,6 +2456,10 @@ export async function dmRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(403).send({ error: 'You are not a member of this DM channel', statusCode: 403 });
     }
 
+    if (isDeadOneOnOne(id, request.userId)) {
+      return reply.code(403).send({ error: "This user's account was deleted", code: 'recipient_deleted', statusCode: 403 });
+    }
+
     const hasContent = content && typeof content === 'string' && content.trim().length > 0;
     const hasAttachments = attachmentIds && attachmentIds.length > 0;
 
@@ -2548,6 +2552,10 @@ export async function dmRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(403).send({ error: 'You can only edit your own messages', statusCode: 403 });
     }
 
+    if (isDeadOneOnOne(msg.dmChannelId, request.userId)) {
+      return reply.code(403).send({ error: "This user's account was deleted", code: 'recipient_deleted', statusCode: 403 });
+    }
+
     const now = Date.now();
     db.update(schema.dmMessages)
       .set({ content: content.trim(), editedAt: now })
@@ -2600,6 +2608,10 @@ export async function dmRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(403).send({ error: 'You can only delete your own messages', statusCode: 403 });
     }
 
+    if (isDeadOneOnOne(msg.dmChannelId, request.userId)) {
+      return reply.code(403).send({ error: "This user's account was deleted", code: 'recipient_deleted', statusCode: 403 });
+    }
+
     // Collect attachment filenames before deleting
     const attachmentRows = db.select({ filename: schema.attachments.filename })
       .from(schema.attachments)