Skip to content

Fix chat list: join participants to users, not a nonexistent profiles table (0.5.2) - #285

Merged
ralyodio merged 1 commit into
masterfrom
fix/conversations-load-users
Oct 6, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/conversations-load-users

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

qc showed "Could not load chats". The live log shows /api/conversations/load failing with PGRST200: Could not find a relationship between 'conversation_participants' and 'profiles'. There is no profiles table; the join is a leftover from the SvelteKit port. Before #284 fixed Bearer auth, qc's requests failed earlier with a 401, which hid this. The web store calls the same route.

Fix: embed user:users!conversation_participants_user_id_fkey(id, username, display_name, avatar_url, is_online, last_seen), which returns public columns only, never phone_number or salt. The exact embed was validated against the live PostgREST before merging.

🤖 Generated with Claude Code

…les table (0.5.2)

/api/conversations/load asked PostgREST for user:profiles(*), a leftover from
the SvelteKit port; there is no profiles table, so it answered PGRST200 and
the route 500'd ('Could not load chats' in qc). Join users via
conversation_participants_user_id_fkey and select public columns only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

13 finding(s)

MEDIUM: 9 | LOW: 4

Severity Rule Location
MEDIUM redos-nested-quantifier src/app/api/profile/update/route.js:73
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:38
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:66
MEDIUM js-unescaped-html-sink src/app/faq/page.jsx:57
MEDIUM js-unescaped-html-sink src/app/layout.jsx:137
MEDIUM js-unescaped-html-sink src/app/layout.jsx:141
MEDIUM js-unescaped-html-sink src/app/page.jsx:47
MEDIUM redos-nested-quantifier src/lib/auth/dns-name.js:88
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:121
LOW secret-generic-credential src/app/api/auth/register-anon/route.test.js:32
LOW secret-jwt tests/debug-sms.js:10
LOW secret-generic-credential tests/private-key-import-export.test.js:252
LOW secret-generic-credential tests/private-key-import-export.test.js:264

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit f0d0944 into master Oct 6, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant