[ADD] war room teams (@-mention groups) + chat message attachments — WarRoomTeam models, /war-rooms/{id}/teams REST, team-mention notification fan-out, WarRoomChatMessage.attachments JSONB with datastore file refs

Author: whitekernel

source/app/alembic/versions/f7a3b9c1d02e_add_war_room_teams_and_chat_attachments.py

@@ -0,0 +1,107 @@
+"""Add per-war-room teams and chat message attachments.
+
+Feature 1: `war_room_team` + `war_room_team_member` support @team
+mentions in chat, threads, notes and tasks. Teams are per-war-room and
+cascade with the room.
+
+Feature 2: `war_room_chat_message.attachments` is a JSONB column that
+holds inline file references (list of `{file_id, filename, mime_type,
+size_bytes}`) pointing at rows in `war_room_datastore_file`.
+
+Idempotent via `_has_table` / `_table_has_column` so re-running is safe
+across environments that already applied the migration.
+
+Revision ID: f7a3b9c1d02e
+Revises: d5e6f7a8b9c0
+Create Date: 2026-07-13 10:00:00.000000
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+from app.alembic.alembic_utils import _has_table, _table_has_column
+
+
+revision = 'f7a3b9c1d02e'
+down_revision = 'd5e6f7a8b9c0'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    if not _has_table('war_room_team'):
+        op.create_table(
+            'war_room_team',
+            sa.Column('team_id', sa.BigInteger(), primary_key=True),
+            sa.Column(
+                'war_room_id', sa.BigInteger(),
+                sa.ForeignKey('war_room.war_room_id', ondelete='CASCADE'),
+                nullable=False,
+            ),
+            sa.Column('name', sa.String(length=80), nullable=False),
+            sa.Column('description', sa.Text(), nullable=True),
+            sa.Column('color', sa.String(length=7), nullable=True),
+            sa.Column(
+                'created_at', sa.DateTime(), nullable=False,
+                server_default=sa.text('now()'),
+            ),
+            sa.Column(
+                'created_by_id', sa.BigInteger(),
+                sa.ForeignKey('user.id'), nullable=True,
+            ),
+            sa.UniqueConstraint('war_room_id', 'name',
+                                name='uq_war_room_team_name'),
+        )
+        op.create_index(
+            'ix_war_room_team_war_room_id',
+            'war_room_team',
+            ['war_room_id'],
+        )
+
+    if not _has_table('war_room_team_member'):
+        op.create_table(
+            'war_room_team_member',
+            sa.Column(
+                'team_id', sa.BigInteger(),
+                sa.ForeignKey('war_room_team.team_id', ondelete='CASCADE'),
+                primary_key=True, nullable=False,
+            ),
+            sa.Column(
+                'user_id', sa.BigInteger(),
+                sa.ForeignKey('user.id', ondelete='CASCADE'),
+                primary_key=True, nullable=False,
+            ),
+            sa.Column(
+                'added_at', sa.DateTime(), nullable=False,
+                server_default=sa.text('now()'),
+            ),
+            sa.Column(
+                'added_by_id', sa.BigInteger(),
+                sa.ForeignKey('user.id'), nullable=True,
+            ),
+            sa.UniqueConstraint('team_id', 'user_id',
+                                name='uq_war_room_team_member'),
+        )
+
+    if _has_table('war_room_chat_message') \
+            and not _table_has_column('war_room_chat_message', 'attachments'):
+        op.add_column(
+            'war_room_chat_message',
+            sa.Column('attachments', postgresql.JSONB(), nullable=True),
+        )
+
+
+def downgrade():
+    if _has_table('war_room_chat_message') \
+            and _table_has_column('war_room_chat_message', 'attachments'):
+        op.drop_column('war_room_chat_message', 'attachments')
+
+    if _has_table('war_room_team_member'):
+        op.drop_table('war_room_team_member')
+
+    if _has_table('war_room_team'):
+        op.drop_index(
+            'ix_war_room_team_war_room_id',
+            table_name='war_room_team',
+        )
+        op.drop_table('war_room_team')

source/app/blueprints/rest/v2/war_rooms/chat.py

@@ -102,6 +102,10 @@ def _serialize(row, reactions=None, viewer_id=None):
         'edited_at': row.edited_at.isoformat() if row.edited_at else None,
         'deleted_at': row.deleted_at.isoformat() if row.deleted_at else None,
         'reactions': reactions or [],
+        # Inline file attachments. May be missing on databases predating
+        # the migration or on virtual UserActivity rows — default to an
+        # empty list so the SPA can always iterate.
+        'attachments': list(getattr(row, 'attachments', None) or []),
     }
 
     # Inline the poll payload on poll-kind messages so the stream
@@ -493,8 +497,15 @@ def post_chat(war_room_id):
     if not isinstance(raw, dict):
         return response_api_error('Invalid request')
     body = raw.get('body')
+    file_ids = raw.get('file_ids') or []
     if not isinstance(body, str):
-        return response_api_error('body is required')
+        # An attachment-only post is legal — coerce a missing body to
+        # empty string; `create_message` will accept it when
+        # `file_ids` is non-empty.
+        if file_ids:
+            body = ''
+        else:
+            return response_api_error('body is required')
     # Optional `topic_id` — the currently-selected topic in the SPA.
     # NULL means Main. The business layer validates ownership /
     # archived state and raises `BusinessProcessingError` on mismatch.
@@ -601,7 +612,8 @@ def post_chat(war_room_id):
 
     try:
         msg = create_message(war_room_id, iris_current_user.id, body,
-                             topic_id=posted_topic_id)
+                             topic_id=posted_topic_id,
+                             file_ids=file_ids)
     except BusinessProcessingError as e:
         return response_api_error(e.get_message())
 

source/app/blueprints/rest/v2/war_rooms/root.py

@@ -74,6 +74,7 @@
 from app.blueprints.rest.v2.war_rooms.notes_folders import war_rooms_notes_folders_blueprint
 from app.blueprints.rest.v2.war_rooms.sitreps import war_rooms_sitreps_blueprint
 from app.blueprints.rest.v2.war_rooms.tasks import war_rooms_tasks_blueprint
+from app.blueprints.rest.v2.war_rooms.teams import war_rooms_teams_blueprint
 from app.blueprints.rest.v2.war_rooms.timelines import war_rooms_timelines_blueprint
 
 
@@ -88,6 +89,7 @@
 war_rooms_blueprint.register_blueprint(war_rooms_timelines_blueprint)
 war_rooms_blueprint.register_blueprint(war_rooms_sitreps_blueprint)
 war_rooms_blueprint.register_blueprint(war_rooms_datastore_blueprint)
+war_rooms_blueprint.register_blueprint(war_rooms_teams_blueprint)
 
 
 def _is_admin():

source/app/blueprints/rest/v2/war_rooms/teams.py

@@ -0,0 +1,223 @@
+#  IRIS Source Code
+#  Copyright (C) 2026 - DFIR-IRIS
+#  contact@dfir-iris.org
+#
+#  This program is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU Lesser General Public
+#  License as published by the Free Software Foundation; either
+#  version 3 of the License, or (at your option) any later version.
+
+"""v2 REST routes for war-room teams.
+
+Teams are per-war-room groupings used as @-mention targets. The URL
+layout mirrors members:
+
+    GET    /<war_room_id>/teams                  list teams
+    POST   /<war_room_id>/teams                  create a team
+    GET    /<war_room_id>/teams/<tid>            get a team + its members
+    PATCH  /<war_room_id>/teams/<tid>            rename / recolor
+    DELETE /<war_room_id>/teams/<tid>            remove
+    POST   /<war_room_id>/teams/<tid>/members    add a user
+    DELETE /<war_room_id>/teams/<tid>/members/<uid>   remove
+"""
+
+from flask import Blueprint, request
+
+from app.blueprints.access_controls import ac_api_requires
+from app.blueprints.iris_user import iris_current_user
+from app.blueprints.rest.endpoints import response_api_created
+from app.blueprints.rest.endpoints import response_api_deleted
+from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_not_found
+from app.blueprints.rest.endpoints import response_api_success
+from app.blueprints.rest.v2.war_rooms.access import require_war_room_read
+from app.blueprints.rest.v2.war_rooms.access import require_war_room_write
+from app.business.war_room_teams import war_room_team_create
+from app.business.war_room_teams import war_room_team_delete
+from app.business.war_room_teams import war_room_team_get
+from app.business.war_room_teams import war_room_team_list
+from app.business.war_room_teams import war_room_team_member_add
+from app.business.war_room_teams import war_room_team_member_remove
+from app.business.war_room_teams import war_room_team_members_list
+from app.business.war_room_teams import war_room_team_update
+from app.models.errors import BusinessProcessingError
+from app.models.errors import ObjectNotFoundError
+
+
+war_rooms_teams_blueprint = Blueprint(
+    'war_rooms_teams_rest_v2', __name__, url_prefix='/<int:war_room_id>/teams'
+)
+
+
+def _serialize_team(team, member_ids=None):
+    return {
+        'team_id': team.team_id,
+        'war_room_id': team.war_room_id,
+        'name': team.name,
+        'description': team.description,
+        'color': team.color,
+        'created_at': team.created_at.isoformat() if team.created_at else None,
+        'created_by_id': team.created_by_id,
+        'member_ids': sorted(member_ids) if member_ids is not None else None,
+    }
+
+
+def _serialize_member(row):
+    return {
+        'team_id': row.team_id,
+        'user_id': row.user_id,
+        'added_at': row.added_at.isoformat() if row.added_at else None,
+        'added_by_id': row.added_by_id,
+    }
+
+
+def _team_member_ids(team_id):
+    """User IDs for a team — skips the war-room scope check because the
+    caller has already resolved the team belongs to this war room."""
+    from app.db import db
+    from app.models.war_rooms import WarRoomTeamMember
+    rows = (
+        db.session.query(WarRoomTeamMember.user_id)
+        .filter(WarRoomTeamMember.team_id == team_id)
+        .all()
+    )
+    return {r.user_id for r in rows}
+
+
+@war_rooms_teams_blueprint.get('')
+@ac_api_requires()
+def list_teams(war_room_id):
+    err = require_war_room_read(war_room_id)
+    if err is not None:
+        return err
+    teams = war_room_team_list(war_room_id)
+    data = [
+        _serialize_team(t, _team_member_ids(t.team_id))
+        for t in teams
+    ]
+    return response_api_success(data=data)
+
+
+@war_rooms_teams_blueprint.post('')
+@ac_api_requires()
+def create_team(war_room_id):
+    err = require_war_room_write(war_room_id)
+    if err is not None:
+        return err
+    raw = request.get_json()
+    if not isinstance(raw, dict):
+        return response_api_error('Invalid request')
+    try:
+        team = war_room_team_create(
+            war_room_id,
+            name=raw.get('name'),
+            description=raw.get('description'),
+            color=raw.get('color'),
+            created_by_id=iris_current_user.id,
+        )
+    except BusinessProcessingError as e:
+        return response_api_error(e.get_message())
+    return response_api_created(_serialize_team(team, set()))
+
+
+@war_rooms_teams_blueprint.get('/<int:team_id>')
+@ac_api_requires()
+def get_team(war_room_id, team_id):
+    err = require_war_room_read(war_room_id)
+    if err is not None:
+        return err
+    try:
+        team = war_room_team_get(war_room_id, team_id)
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    return response_api_success(_serialize_team(team, _team_member_ids(team_id)))
+
+
+@war_rooms_teams_blueprint.patch('/<int:team_id>')
+@ac_api_requires()
+def update_team(war_room_id, team_id):
+    err = require_war_room_write(war_room_id)
+    if err is not None:
+        return err
+    raw = request.get_json()
+    if not isinstance(raw, dict):
+        return response_api_error('Invalid request')
+    try:
+        team = war_room_team_update(
+            war_room_id, team_id,
+            name=raw.get('name'),
+            description=raw.get('description'),
+            color=raw.get('color'),
+        )
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    except BusinessProcessingError as e:
+        return response_api_error(e.get_message())
+    return response_api_success(_serialize_team(team, _team_member_ids(team_id)))
+
+
+@war_rooms_teams_blueprint.delete('/<int:team_id>')
+@ac_api_requires()
+def delete_team(war_room_id, team_id):
+    err = require_war_room_write(war_room_id)
+    if err is not None:
+        return err
+    try:
+        war_room_team_delete(war_room_id, team_id)
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    return response_api_deleted()
+
+
+# --- Team members ----------------------------------------------------------
+
+@war_rooms_teams_blueprint.get('/<int:team_id>/members')
+@ac_api_requires()
+def list_team_members(war_room_id, team_id):
+    err = require_war_room_read(war_room_id)
+    if err is not None:
+        return err
+    try:
+        rows = war_room_team_members_list(war_room_id, team_id)
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    return response_api_success(data=[_serialize_member(r) for r in rows])
+
+
+@war_rooms_teams_blueprint.post('/<int:team_id>/members')
+@ac_api_requires()
+def add_team_member(war_room_id, team_id):
+    err = require_war_room_write(war_room_id)
+    if err is not None:
+        return err
+    raw = request.get_json()
+    if not isinstance(raw, dict):
+        return response_api_error('Invalid request')
+    try:
+        row, auto_added_room_member = war_room_team_member_add(
+            war_room_id, team_id,
+            user_id=raw.get('user_id'),
+            added_by_id=iris_current_user.id,
+        )
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    except BusinessProcessingError as e:
+        return response_api_error(e.get_message())
+    payload = _serialize_member(row)
+    # Flag surfaced so the SPA can show "also added to the war room as
+    # responder" without a follow-up GET on the members list.
+    payload['auto_added_room_member'] = bool(auto_added_room_member)
+    return response_api_created(payload)
+
+
+@war_rooms_teams_blueprint.delete('/<int:team_id>/members/<int:user_id>')
+@ac_api_requires()
+def remove_team_member(war_room_id, team_id, user_id):
+    err = require_war_room_write(war_room_id)
+    if err is not None:
+        return err
+    try:
+        war_room_team_member_remove(war_room_id, team_id, user_id)
+    except ObjectNotFoundError:
+        return response_api_not_found()
+    return response_api_deleted()