feat: implement team chat

Author: Bulletdev

app/channels/application_cable/connection.rb

@@ -11,33 +11,47 @@ module ApplicationCable
   #   wss://api.prostaff.gg/cable?token=<JWT_ACCESS_TOKEN>
   #
   # On success, sets:
-  #   - current_user      → the authenticated User record
-  #   - current_org_id    → organization_id extracted from the user
+  #   - current_user      → the authenticated User record (nil for player tokens)
+  #   - current_player    → the authenticated Player record (nil for user tokens)
+  #   - current_org_id    → organization_id extracted from the token
   #
   # On failure, calls reject_unauthorized_connection.
   class Connection < ActionCable::Connection::Base
-    identified_by :current_user, :current_org_id
+    identified_by :current_user, :current_player, :current_org_id
 
     def connect
-      self.current_user   = find_verified_user
-      self.current_org_id = current_user.organization_id
+      payload = decode_token
+      route_by_token_type(payload)
     end
 
     private
 
-    def find_verified_user # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+    def decode_token
       token = request.params[:token]
-
       reject_unauthorized_connection if token.blank?
 
       payload = JwtService.decode(token)
 
-      # Only accept access tokens — reject refresh tokens
       if payload[:type] != 'access'
         logger.warn "[ActionCable] Rejected non-access token type: #{payload[:type]}"
         reject_unauthorized_connection
       end
 
+      payload
+    rescue JwtService::AuthenticationError => e
+      logger.warn "[ActionCable] JWT rejected: #{e.message}"
+      reject_unauthorized_connection
+    end
+
+    def route_by_token_type(payload)
+      if payload[:entity_type] == 'player'
+        authenticate_player_connection(payload)
+      else
+        authenticate_user_connection(payload)
+      end
+    end
+
+    def authenticate_user_connection(payload)
       user = User.find_by(id: payload[:user_id])
 
       if user.nil?
@@ -50,11 +64,29 @@ def find_verified_user # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         reject_unauthorized_connection
       end
 
+      self.current_user   = user
+      self.current_player = nil
+      self.current_org_id = user.organization_id
       logger.info "[ActionCable] Connected: user=#{user.id} org=#{user.organization_id}"
-      user
-    rescue JwtService::AuthenticationError => e
-      logger.warn "[ActionCable] JWT rejected: #{e.message}"
-      reject_unauthorized_connection
+    end
+
+    def authenticate_player_connection(payload)
+      player = Player.unscoped.find_by(id: payload[:player_id], player_access_enabled: true)
+
+      if player.nil?
+        logger.warn "[ActionCable] Player not found or access disabled: player_id=#{payload[:player_id]}"
+        reject_unauthorized_connection
+      end
+
+      unless player.organization_id.present?
+        logger.warn "[ActionCable] Player #{player.id} has no organization — rejected"
+        reject_unauthorized_connection
+      end
+
+      self.current_user   = nil
+      self.current_player = player
+      self.current_org_id = player.organization_id
+      logger.info "[ActionCable] Connected: player=#{player.id} org=#{player.organization_id}"
     end
   end
 end

app/modules/core/controllers/team_members_controller.rb

@@ -2,26 +2,32 @@
 
 module Core
   module Controllers
-    # TeamMembersController — lists users in the same organization.
+    # TeamMembersController — lists all messageable members in the same organization.
     #
-    # Used by the frontend to populate the team member list in the chat widget.
-    # Returns all users except the current user.
-    # Player tokens are rejected — this endpoint is for staff only.
+    # Returns staff users and players with player access enabled, used by
+    # the frontend to populate the DM recipient list in the chat widget.
+    # Player tokens are rejected — this endpoint requires a user token.
     #
     # GET /api/v1/team-members
     class TeamMembersController < Api::V1::BaseController
       before_action :require_user_auth!
 
       def index
-        members = current_organization
-                  .users
-                  .where.not(id: current_user.id)
-                  .order(:full_name)
-                  .select(:id, :full_name, :role, :last_login_at)
-
-        render_success(
-          { members: members.map { |u| serialize_member(u) } }
-        )
+        users = current_organization
+                .users
+                .where.not(id: current_user.id)
+                .order(:full_name)
+                .select(:id, :full_name, :role, :last_login_at, :avatar_url)
+                .map { |u| serialize_member(u) }
+
+        players = current_organization
+                  .players
+                  .where(player_access_enabled: true)
+                  .order(:professional_name, :real_name)
+                  .select(:id, :professional_name, :real_name, :role, :last_login_at, :avatar_url)
+                  .map { |p| serialize_player(p) }
+
+        render_success({ members: users + players })
       end
 
       private
@@ -31,9 +37,26 @@ def serialize_member(user)
           id: user.id,
           full_name: user.full_name,
           role: user.role,
-          online: user.last_login_at.present? && user.last_login_at > 15.minutes.ago
+          online: active_recently?(user.last_login_at),
+          member_type: 'user',
+          avatar_url: user.avatar_url.presence
+        }
+      end
+
+      def serialize_player(player)
+        {
+          id: player.id,
+          full_name: player.professional_name.presence || player.real_name || 'Player',
+          role: player.role || 'player',
+          online: active_recently?(player.last_login_at),
+          member_type: 'player',
+          avatar_url: player.avatar_url.presence
         }
       end
+
+      def active_recently?(last_login_at)
+        last_login_at.present? && last_login_at > 15.minutes.ago
+      end
     end
   end
 end

app/modules/messaging/channels/direct_message_channel.rb

@@ -1,35 +1,36 @@
 # frozen_string_literal: true
 
-# DirectMessageChannel — real-time private messaging between two team members.
+# DirectMessageChannel — real-time private messaging between staff and players.
 #
-# The frontend subscribes passing the recipient_id:
+# The frontend subscribes passing recipient_id and optionally recipient_type:
 #   consumer.subscriptions.create(
-#     { channel: 'DirectMessageChannel', recipient_id: '<uuid>' },
+#     { channel: 'DirectMessageChannel', recipient_id: '<uuid>', recipient_type: 'Player' },
 #     { received(data) { ... } }
 #   )
 #
 # Security guarantees:
-#   1. Sender identity comes from the verified JWT (current_user) — cannot be spoofed.
+#   1. Sender identity comes from the verified JWT (current_user or current_player) — cannot be spoofed.
 #   2. Recipient must belong to the same organization as the sender.
-#   3. Stream key is derived from sorted user IDs + org_id — impossible to subscribe
-#      to a conversation you're not a party to.
+#   3. Stream key is derived from sorted participant IDs + org_id — impossible to subscribe
+#      to a conversation you are not a party to.
 class DirectMessageChannel < ApplicationCable::Channel
   MAX_CONTENT_LENGTH = 2000
 
   def subscribed
     recipient = find_and_validate_recipient
     return unless recipient
 
-    @recipient_id = recipient.id
-    stream_from stream_key_for(recipient)
-    logger.info "[DM] #{current_user.id} subscribed to DM with #{recipient.id}"
+    @recipient_id   = recipient[:record].id
+    @recipient_type = recipient[:type]
+    stream_from Message.dm_stream_key(current_sender_id, @recipient_id, current_org_id)
+    logger.info "[DM] #{current_sender_id} subscribed to DM with #{@recipient_id}"
   end
 
   def unsubscribed
     stop_all_streams
   end
 
-  # Receives { "content" => "...", "recipient_id" => "..." } from the frontend.
+  # Receives { "content" => "...", "recipient_id" => "...", "recipient_type" => "..." } from client.
   def speak(data) # rubocop:disable Metrics/MethodLength
     content      = data['content'].to_s.strip
     recipient_id = data['recipient_id'].to_s
@@ -47,12 +48,7 @@ def speak(data) # rubocop:disable Metrics/MethodLength
     recipient = find_recipient_by_id(recipient_id)
     return unless recipient
 
-    Message.create!(
-      content: content,
-      user: current_user,
-      recipient: recipient,
-      organization_id: current_org_id
-    )
+    create_message(content: content, recipient: recipient)
   rescue ActiveRecord::RecordInvalid => e
     logger.error "[DM] Failed to create message: #{e.message}"
     transmit({ error: 'Failed to send message' })
@@ -73,24 +69,54 @@ def find_and_validate_recipient
   end
 
   def find_recipient_by_id(recipient_id)
-    recipient = User.find_by(id: recipient_id, organization_id: current_org_id)
+    recipient_type = resolve_recipient_type(params[:recipient_type])
+    record = locate_recipient(recipient_id, recipient_type)
 
-    unless recipient
-      logger.warn "[DM] Recipient #{recipient_id} not found in org #{current_org_id}"
+    unless record
+      logger.warn "[DM] Recipient #{recipient_id} (#{recipient_type}) not found in org #{current_org_id}"
       reject
       return nil
     end
 
-    if recipient.id == current_user.id
+    if record.id == current_sender_id
       logger.warn '[DM] Cannot DM yourself'
       reject
       return nil
     end
 
-    recipient
+    { record: record, type: recipient_type }
+  end
+
+  def locate_recipient(recipient_id, recipient_type)
+    if recipient_type == 'Player'
+      Player.find_by(id: recipient_id, organization_id: current_org_id, player_access_enabled: true)
+    else
+      User.find_by(id: recipient_id, organization_id: current_org_id)
+    end
+  end
+
+  def resolve_recipient_type(raw_type)
+    Message::PARTICIPANT_TYPES.include?(raw_type.to_s) ? raw_type.to_s : 'User'
+  end
+
+  def create_message(content:, recipient:)
+    Message.create!(
+      user_id: current_sender_id,
+      sender_type: current_sender_type,
+      recipient_id: recipient[:record].id,
+      recipient_type: recipient[:type],
+      organization_id: current_org_id,
+      content: content
+    )
+  end
+
+  def current_sender_id
+    return current_player.id if current_player.present?
+
+    current_user.id
   end
 
-  def stream_key_for(recipient)
-    Message.dm_stream_key(current_user.id, recipient.id, current_org_id)
+  def current_sender_type
+    current_player.present? ? 'Player' : 'User'
   end
 end

app/modules/messaging/channels/team_channel.rb

@@ -2,9 +2,9 @@
 
 # TeamChannel — Real-time messaging channel for team communication.
 #
-# Each user subscribes to the stream of their own organization.
-# The stream key is derived from `current_org_id` (set in Connection),
-# so a user cannot subscribe to another organization's stream even by
+# Each member subscribes to the stream of their own organization.
+# The stream key is derived from current_org_id (set in Connection),
+# so a member cannot subscribe to another organization's stream even by
 # manually crafting a subscription request.
 #
 # Actions:
@@ -16,24 +16,23 @@
 # Broadcasting is done by the Message model's after_create callback,
 # not directly in this channel, to keep the channel thin and testable.
 class TeamChannel < ApplicationCable::Channel
-  # Maximum message length — enforced at channel level before hitting the DB
   MAX_CONTENT_LENGTH = 2000
 
   def subscribed
     if current_org_id.blank?
-      logger.warn "[TeamChannel] Rejected subscription — no org_id for user #{current_user.id}"
+      logger.warn "[TeamChannel] Rejected subscription — no org_id for sender #{current_sender_id}"
       reject
       return
     end
 
     stream_name = "team_room_#{current_org_id}"
     stream_from stream_name
-    logger.info "[TeamChannel] user=#{current_user.id} subscribed to #{stream_name}"
+    logger.info "[TeamChannel] sender=#{current_sender_id} subscribed to #{stream_name}"
   end
 
   def unsubscribed
     stop_all_streams
-    logger.info "[TeamChannel] user=#{current_user.id} disconnected"
+    logger.info "[TeamChannel] sender=#{current_sender_id} disconnected"
   end
 
   # Receives a message sent by the frontend via cable.
@@ -52,14 +51,26 @@ def speak(data) # rubocop:disable Metrics/MethodLength
       return
     end
 
-    # Persist the message — broadcasting is triggered by after_create callback
     Message.create!(
-      content: content,
-      user: current_user,
-      organization_id: current_org_id
+      user_id: current_sender_id,
+      sender_type: current_sender_type,
+      organization_id: current_org_id,
+      content: content
     )
   rescue ActiveRecord::RecordInvalid => e
     logger.error "[TeamChannel] Failed to create message: #{e.message}"
     transmit({ error: 'Failed to send message' })
   end
+
+  private
+
+  def current_sender_id
+    return current_player.id if current_player.present?
+
+    current_user.id
+  end
+
+  def current_sender_type
+    current_player.present? ? 'Player' : 'User'
+  end
 end