feat: add contacts management and thread resolution by AchoArnold · Pull Request #957 · NdoleStudio/httpsms

AchoArnold · 2026-07-19T22:06:57Z

Summary

add contact CRUD, one-or-many JSON creation, CSV import, validation, Swagger, and cached phone-to-contact resolution
add the Contacts management page with server-side search/pagination and add/edit/delete/import dialogs
display resolved contact names in message threads and add Contacts navigation

Testing

cd api && go test -vet=off ./...
cd api && go build ./...
cd web && pnpm lint
cd web && pnpm generate

codacy-production · 2026-07-19T22:08:42Z

Not up to standards ⛔

🔴 Issues50 minor

Alerts:
⚠ 50 issues (≤ 0 issues of at least minor severity)
Results:
50 new issues
Category Results
CodeStyle 50 minor
View in Codacy

🟢 Metrics535 complexity · 203 duplication

Metric Results
Complexity 535
Duplication 203
View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

greptile-apps · 2026-07-19T22:13:44Z

Greptile Summary

This PR introduces a full contacts management feature: a new Contact entity with CRUD endpoints, CSV import, cached phone-to-contact name resolution in message threads, and a server-side-paginated contacts page in the web UI.

Backend: adds ContactRepository, ContactService (with a 24 h per-user cache for the phone→contact map), ContactHandlerValidator (E.164 phone + RFC 5322 email validation, 1000-row batch cap, 500 KB CSV cap), and 5 REST endpoints under /v1/contacts. The MessageThreadService.GetThreads now accepts a WithContacts flag to resolve display names in a single cached lookup.
Frontend: new contacts Pinia store with generation-based stale-response cancellation and a full pages/contacts/index.vue with add/edit/delete/import dialogs, debounced server-side search, and VDataTableServer pagination. Message thread list and header show resolved contact names when available.

Confidence Score: 3/5

Safe to merge with caution — one data-retention gap needs to be addressed before this goes to production for any deployment that supports account deletion.

The contacts feature is well-structured and thoroughly tested, but DeleteAllForUser is wired to the repository interface and never called on account deletion, unlike every other entity in the codebase. Users who delete their accounts will have their contacts silently retained in the database. Additionally, the ILIKE search passes raw user input as a LIKE pattern without escaping % and _, so a search for _ returns all contacts.

api/pkg/repositories/contact_repository.go and the missing contacts listener file (no listener for UserAccountDeleted was added); api/pkg/repositories/gorm_contact_repository.go for the unescaped LIKE wildcards in the search query.

Important Files Changed

Filename	Overview
api/pkg/repositories/contact_repository.go	ContactRepository interface defines DeleteAllForUser but no listener is wired to call it on UserAccountDeleted, leaving orphaned contact rows when a user is deleted.
api/pkg/repositories/gorm_contact_repository.go	GORM implementation of ContactRepository; ILIKE search passes raw user query as a LIKE pattern without escaping `%`/`_` wildcards, causing overly broad matches for those characters.
api/pkg/services/contact_service.go	ContactService with cache-backed phone→contact map; GetContactMap calls FetchAll with no row limit, which could cause large memory allocations for users with many contacts.
api/pkg/handlers/contact_handler.go	HTTP handler for contact CRUD and CSV upload; correctly validates UUIDs, scopes all operations to the authenticated user, and returns 404 before delete rather than silently succeeding on a 0-row DELETE.
api/pkg/validators/contact_handler_validator.go	Validates JSON and CSV create/update contacts; phone numbers validated with libphonenumber, emails with net/mail, CSV size capped at 500 KB, batch capped at 1000 rows.
api/pkg/entities/contact.go	New Contact entity with JSONB ContactProperties custom scanner/valuer and pq.StringArray for emails/phone_numbers; model is well-structured with correct GORM tags.
api/pkg/services/message_thread_service.go	Adds optional contact resolution to GetThreads via a contactMapProvider interface and the new WithContacts flag; contact lookup errors are logged but don't fail the request.
api/pkg/requests/contact_store.go	ContactStoreRequest with custom UnmarshalJSON supporting both JSON array and wrapped-object formats; SanitizeContactItem deduplicates and normalizes phone/email values.
web/app/stores/contacts.ts	Pinia contacts store with generation-based stale-response cancellation, server-side pagination state tracking, and local optimistic delete.
web/app/pages/contacts/index.vue	Full contacts management page with server-side search/pagination via VDataTableServer, add/edit/delete/import dialogs, debounced search, and inline API error display.
api/pkg/di/container.go	Wires ContactService, ContactRepository, ContactHandler, and ContactHandlerValidator into the DI container; registers AutoMigrate for the contacts table and mounts routes.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Client
participant ContactHandler
participant ContactHandlerValidator
participant ContactService
participant ContactRepository
participant Cache
Client->>ContactHandler: POST /v1/contacts (JSON array or object)
ContactHandler->>ContactHandlerValidator: ValidateStore(request)
ContactHandlerValidator-->>ContactHandler: url.Values (errors)
ContactHandler->>ContactService: CreateMany(userID, contacts)
ContactService->>ContactRepository: Store(contacts)
ContactRepository-->>ContactService: nil
ContactService->>Cache: Set(key, empty, 24h) [invalidate]
ContactService-->>ContactHandler: nil
ContactHandler-->>Client: 201 Created
Client->>ContactHandler: "GET /v1/threads?contacts=true"
ContactHandler->>MessageThreadService: "GetThreads(WithContacts=true)"
MessageThreadService->>ContactService: GetContactMap(userID)
ContactService->>Cache: Get(key)
alt cache hit
Cache-->>ContactService: JSON map
ContactService-->>MessageThreadService: "map[phone]*Contact"
else cache miss or invalidated
Cache-->>ContactService: empty or error
ContactService->>ContactRepository: FetchAll(userID)
ContactRepository-->>ContactService: []Contact
ContactService->>Cache: Set(key, encodedMap, 24h)
ContactService-->>MessageThreadService: "map[phone]*Contact"
end
MessageThreadService-->>ContactHandler: []MessageThread with ContactDetails
ContactHandler-->>Client: 200 OK

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Client
participant ContactHandler
participant ContactHandlerValidator
participant ContactService
participant ContactRepository
participant Cache
Client->>ContactHandler: POST /v1/contacts (JSON array or object)
ContactHandler->>ContactHandlerValidator: ValidateStore(request)
ContactHandlerValidator-->>ContactHandler: url.Values (errors)
ContactHandler->>ContactService: CreateMany(userID, contacts)
ContactService->>ContactRepository: Store(contacts)
ContactRepository-->>ContactService: nil
ContactService->>Cache: Set(key, empty, 24h) [invalidate]
ContactService-->>ContactHandler: nil
ContactHandler-->>Client: 201 Created
Client->>ContactHandler: "GET /v1/threads?contacts=true"
ContactHandler->>MessageThreadService: "GetThreads(WithContacts=true)"
MessageThreadService->>ContactService: GetContactMap(userID)
ContactService->>Cache: Get(key)
alt cache hit
Cache-->>ContactService: JSON map
ContactService-->>MessageThreadService: "map[phone]*Contact"
else cache miss or invalidated
Cache-->>ContactService: empty or error
ContactService->>ContactRepository: FetchAll(userID)
ContactRepository-->>ContactService: []Contact
ContactService->>Cache: Set(key, encodedMap, 24h)
ContactService-->>MessageThreadService: "map[phone]*Contact"
end
MessageThreadService-->>ContactHandler: []MessageThread with ContactDetails
ContactHandler-->>Client: 200 OK

_{Reviews (1): Last reviewed commit: "fix(web): mark contacts headers unsortab..." | Re-trigger Greptile}

greptile-apps · 2026-07-19T22:13:48Z

+	Delete(ctx context.Context, userID entities.UserID, contactID uuid.UUID) error
+
+	// DeleteAllForUser deletes all contacts for a user.
+	DeleteAllForUser(ctx context.Context, userID entities.UserID) error


DeleteAllForUser never wired to the UserAccountDeleted event
Every other entity in the codebase — billing, Discord, heartbeat, message threads, phone notifications, webhooks, etc. — has a dedicated listener that calls DeleteAllForUser when a UserAccountDeleted event fires (see e.g. billing_listener.go, message_thread_listener.go). The ContactRepository defines this method and ContactService could expose it, but no ContactListener was registered. As a result, all contacts for a deleted user remain in the database indefinitely, constituting a data-retention/compliance gap.

greptile-apps · 2026-07-19T22:13:49Z

+	if len(query) > 0 {
+ queryPattern := "%" + query + "%"


User-supplied query is used verbatim as a LIKE pattern, enabling wildcard leakage
queryPattern is built by concatenating % around the raw query string. If a user includes SQL LIKE wildcard characters (% or _) in their search term, they act as wildcards against the columns. For example, searching _ matches every entry (any single character). The query is parameterized so there is no SQL injection risk, but the semantics are incorrect — a user expecting an exact substring match gets a much broader result. Escaping the user input before inserting it into the pattern fixes this.
Suggested change
iflen(query) >0 {
queryPattern:="%"+query+"%"
iflen(query) >0 {
escaped:=strings.NewReplacer(`%`, `\%`, `_`, `\_`).Replace(query)
queryPattern:="%"+escaped+"%"

greptile-apps · 2026-07-19T22:13:49Z

+	contacts, err := service.repository.FetchAll(ctx, userID)
+	if err != nil {
+ return nil, service.tracer.WrapErrorSpan(span, stacktrace.Propagatef(err, "cannot fetch contacts to build map for user [%s]", userID))
+	}
+
+	result := make(map[string]*entities.Contact, len(*contacts))
+	for index := range *contacts {
+ // Take a fresh copy of the slice element so the map holds a stable pointer
+ // that does not alias the underlying slice storage.
+ contact := (*contacts)[index]
+ for _, number := range contact.PhoneNumbers {
+ result[number] = &contact
+ }
+	}


FetchAll loads every contact for a user with no upper bound
GetContactMap calls FetchAll which issues a SELECT * with no LIMIT. On every cache miss or post-mutation rebuild, all of a user's contacts are pulled into memory at once. A power user with tens of thousands of contacts would trigger a very large in-memory allocation and a long-running query. Given the 24 h TTL and the fact that every mutation (create, update, delete) invalidates the cache, heavy writers could trigger this repeatedly within a day. Consider streaming or paginating the build, or at minimum adding an application-level cap with an error when the contact list exceeds a safe threshold.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dd82cae-8bc6-4eaa-9b90-95073720c577