fix(message-gatekeeper): allow quoting a tshow message from its parent channel

Author: chenjr0719

docs/client-api.md

@@ -2384,6 +2384,7 @@ Embedded snapshot of the quoted message at the time of quoting.
 | `messageLink` | string | Optional. |
 | `threadParentId` | string | Optional. Set if the quoted message itself is a thread reply. |
 | `threadParentCreatedAt` | string | Optional. RFC 3339. |
+| `tshow` | boolean | Optional. Mirrors the quoted message's own `tshow` — set when the quoted message is a thread reply also shown in its parent channel room. |
 
 When the reader is in a restricted access window and the quoted parent falls outside it, the embedded snapshot is redacted to `{ "msg": "This message is unavailable" }` — all other quote fields are dropped.
 
@@ -4650,7 +4651,7 @@ Delivered on `chat.user.{account}.response.{requestId}`. See [Error envelope](#6
 | `not subscribed` | `forbidden` | `not_subscribed` | Sender is not a member of the room. |
 | `posting is restricted to owners and admins in this room` | `forbidden` | `large_room_post_restricted` | Non-owner/admin/bot posting a top-level message in a room above the large-room threshold (thread replies are exempt). |
 | `quoted parent {id} not found` | `not_found` | — | The quoted message lookup failed (deleted, cross-room, …). |
-| `quoted parent {id} thread context mismatch: …` | `bad_request` | — | A quoted message must be in the same thread context (main-room or the same thread) as the new message. |
+| `quoted parent {id} thread context mismatch: …` | `bad_request` | — | A quoted message must be in the same thread context (main-room or the same thread) as the new message — except a `tshow: true` thread reply, which may also be quoted from its parent channel room. |
 
 **Delivery guarantee:** every validation/authorization failure — including a `siteID` mismatch and a malformed `msg.send` subject — is replied to the client on the response subject and the JetStream message is acked (not retried). The error reply requires a routable response subject, so it can only be sent when the `{account}` segment is recoverable from the subject and the payload carries a valid hyphenated-UUID `requestId`; if neither is recoverable (a truly malformed subject or missing/invalid `requestId`) no reply is possible and the client falls back to a request timeout. **Only infrastructure failures** (store/publish errors) are nak'd and **redelivered by JetStream** — these produce no immediate reply.
 

message-gatekeeper/fetcher_history.go

@@ -54,6 +54,7 @@ type quotedParentProjection struct {
 	DecodedAttachments    []cassandra.Attachment  `json:"attachments"`
 	ThreadParentID        string                  `json:"threadParentId"`
 	ThreadParentCreatedAt *time.Time              `json:"threadParentCreatedAt"`
+	TShow                 bool                    `json:"tshow"`
 }
 
 // FetchQuotedParent issues a NATS request to history-service's GetMessageByID
@@ -101,5 +102,6 @@ func (f *historyParentFetcher) FetchQuotedParent(
 		MessageLink:           messageLink(f.chatBaseURL, parent.RoomID, messageID),
 		ThreadParentID:        parent.ThreadParentID,
 		ThreadParentCreatedAt: parent.ThreadParentCreatedAt,
+		TShow:                 parent.TShow,
 	}, nil
 }

message-gatekeeper/handler.go

@@ -433,7 +433,7 @@ func (h *Handler) resolveQuoteSnapshot(ctx context.Context, account, roomID, sit
 			"request_id", natsutil.RequestIDFromContext(ctx), "quoted_id", quotedParentMessageID, "error", err)
 		return ph, true, nil
 	}
-	if cerr := checkQuoteThreadContext(snap, quotedParentMessageID, newMessageThreadID); cerr != nil {
+	if cerr := checkQuoteThreadContext(snap, quotedParentMessageID, newMessageThreadID, roomID); cerr != nil {
 		return nil, false, cerr
 	}
 	return snap, false, nil
@@ -478,11 +478,16 @@ func (h *Handler) placeholderQuoteSnapshot(roomID, messageID, newMessageThreadID
 }
 
 // checkQuoteThreadContext enforces the same-conversation rule between the quoted
-// parent and the quoting message.
-func checkQuoteThreadContext(snap *cassandra.QuotedParentMessage, quotedParentMessageID, newMessageThreadID string) error {
+// parent and the quoting message. newMessageRoomID is the quoting message's own
+// room, needed for the TShow carve-out below.
+func checkQuoteThreadContext(snap *cassandra.QuotedParentMessage, quotedParentMessageID, newMessageThreadID, newMessageRoomID string) error {
+	// TShow ("also send to channel") carve-out: the parent also lives in its channel
+	// room, so quoting it from that room (a main-room message) is legitimate.
+	tshowChannelQuote := snap.TShow && newMessageThreadID == "" && snap.RoomID == newMessageRoomID
 	if snap.ThreadParentID != newMessageThreadID &&
 		// Thread-root quote: starter is a main-room msg (ThreadParentID=="") whose ID is the thread parent — allowed.
-		(snap.ThreadParentID != "" || quotedParentMessageID != newMessageThreadID) {
+		(snap.ThreadParentID != "" || quotedParentMessageID != newMessageThreadID) &&
+		!tshowChannelQuote {
 		return errcode.BadRequest(fmt.Sprintf("quoted parent %s thread context mismatch: parent thread %q, new message thread %q",
 			quotedParentMessageID, snap.ThreadParentID, newMessageThreadID))
 	}

message-gatekeeper/handler_test.go

@@ -1498,6 +1498,64 @@ func TestHandler_resolveQuoteSnapshot(t *testing.T) {
 				assert.Equal(t, errcode.CodeForbidden, ee.Code)
 			},
 		},
+		{
+			// chat#432: a TShow ("also send to channel") thread reply is visible in
+			// its parent channel room, so quoting it from that room (threadID=="")
+			// must be allowed even though the parent's own ThreadParentID is set.
+			name:     "tshow parent quoted from its parent channel room — allowed",
+			quotedID: quotedID,
+			threadID: "",
+			setupFetcher: func(f *MockParentMessageFetcher) {
+				f.EXPECT().FetchQuotedParent(gomock.Any(), account, roomID, siteID, quotedID).
+					Return(&cassandra.QuotedParentMessage{MessageID: quotedID, RoomID: roomID, ThreadParentID: "thread-X", TShow: true, Msg: "tshow msg"}, nil)
+			},
+			wantSnap: true,
+			assertSnap: func(t *testing.T, snap *cassandra.QuotedParentMessage) {
+				assert.Equal(t, "tshow msg", snap.Msg)
+			},
+		},
+		{
+			name:     "non-tshow thread reply quoted from the channel — still rejected",
+			quotedID: quotedID,
+			threadID: "",
+			setupFetcher: func(f *MockParentMessageFetcher) {
+				f.EXPECT().FetchQuotedParent(gomock.Any(), account, roomID, siteID, quotedID).
+					Return(&cassandra.QuotedParentMessage{MessageID: quotedID, RoomID: roomID, ThreadParentID: "thread-X", TShow: false, Msg: "thread-only msg"}, nil)
+			},
+			wantErr: true,
+			assertErr: func(t *testing.T, err error) {
+				var ee *errcode.Error
+				require.True(t, errors.As(err, &ee))
+				assert.Equal(t, errcode.CodeBadRequest, ee.Code)
+			},
+		},
+		{
+			// The carve-out is gated on the quoter being in the parent's own room —
+			// a TShow parent shown in room A must not be quotable from unrelated room B.
+			name:     "tshow parent from a different room — still rejected",
+			quotedID: quotedID,
+			threadID: "",
+			setupFetcher: func(f *MockParentMessageFetcher) {
+				f.EXPECT().FetchQuotedParent(gomock.Any(), account, roomID, siteID, quotedID).
+					Return(&cassandra.QuotedParentMessage{MessageID: quotedID, RoomID: "some-other-room", ThreadParentID: "thread-X", TShow: true, Msg: "tshow msg"}, nil)
+			},
+			wantErr: true,
+			assertErr: func(t *testing.T, err error) {
+				var ee *errcode.Error
+				require.True(t, errors.As(err, &ee))
+				assert.Equal(t, errcode.CodeBadRequest, ee.Code)
+			},
+		},
+		{
+			name:     "tshow parent quoted from within its own thread — allowed",
+			quotedID: quotedID,
+			threadID: "thread-X",
+			setupFetcher: func(f *MockParentMessageFetcher) {
+				f.EXPECT().FetchQuotedParent(gomock.Any(), account, roomID, siteID, quotedID).
+					Return(&cassandra.QuotedParentMessage{MessageID: quotedID, RoomID: roomID, ThreadParentID: "thread-X", TShow: true, Msg: "tshow msg"}, nil)
+			},
+			wantSnap: true,
+		},
 	}
 
 	for _, tc := range tests {

pkg/model/cassandra/message.go

@@ -56,6 +56,9 @@ type QuotedParentMessage struct {
 	// embedding the parent's identity so history-service can enforce access-window checks without an extra read.
 	ThreadParentID        string     `json:"threadParentId,omitempty"        cql:"thread_parent_id"`
 	ThreadParentCreatedAt *time.Time `json:"threadParentCreatedAt,omitempty" cql:"thread_parent_created_at"`
+	// TShow mirrors the quoted message's own flag: an "also send to channel"
+	// thread reply, quotable from its parent channel room (see checkQuoteThreadContext).
+	TShow bool `json:"tshow,omitempty" cql:"tshow"`
 }
 
 // Message represents a message row in the Cassandra message tables