Merge pull request #59 from maxwelljun/im-chatter-memory-isolation

Isolate IM chatter memory by sender

Author: idoubi

internal/gateway/routing.go

@@ -26,9 +26,10 @@ func chatKey(channel, accountID, chatID string) string {
 
 // processInbound consumes the message bus and routes each message to the
 // correct user's agent. Identity resolution order:
-//   1. msg.OwnerUserID set explicitly (cron, webhook with user_id)
-//   2. lookup the receiving channel's row in the channels table — its
-//      (scope, scope_id) tells us which user owns this conversation
+//  1. msg.OwnerUserID set explicitly (cron, webhook with user_id)
+//  2. lookup the receiving channel's row in the channels table — its
+//     (scope, scope_id) tells us which user owns this conversation
+//
 // If neither yields a user_id the message is dropped, never silently
 // routed to a default identity.
 func (g *Gateway) processInbound(ctx context.Context) {
@@ -135,16 +136,11 @@ func (g *Gateway) resolveChannelOwner(ctx context.Context, msg bus.InboundMessag
 //   - empty UserID → "" (caller leaves the slot empty; chatterUserID will
 //     fall back to the agent owner).
 //   - already `u_`-prefixed → assume it's already canonical, leave alone.
-//   - channel owner is an app_user (has apikey_id) → lazy-mint an
-//     app_user keyed by (apikey_id, "<channel>:<msg.UserID>") so every
-//     distinct IM sender gets a stable u_xxx of their own. Channel name
-//     is prefixed so a numeric id colliding across two channel types
-//     (telegram chat 123, line user 123) can't merge into one row.
-//   - channel owner is a regular user (no apikey_id) → treat as a single-
-//     user dogfood/personal bot and pin the chatter to the owner. This
-//     preserves the simple "I registered my own wechat to my own agent"
-//     flow without forcing the owner to start over with a fresh empty
-//     USER.md every conversation.
+//   - lazy-mint an app_user keyed by the owner namespace plus
+//     "<channel>:<accountID>:<msg.UserID>" so every distinct IM sender gets
+//     a stable u_xxx of their own. Channel and account are prefixed so the
+//     same numeric id on two platforms or two bots cannot merge into one
+//     USER.md / MEMORY.md row.
 //
 // Returns "" when the original msg.UserID should be kept unchanged
 // (empty input, already canonical, or any error path) — the caller treats
@@ -165,16 +161,15 @@ func (g *Gateway) resolveChatter(ctx context.Context, ownerID string, msg bus.In
 			"owner", ownerID, "channel", msg.Channel, "error", err)
 		return ""
 	}
-	if owner.APIKeyID == "" {
-		// Personal / dogfood install — every IM sender is treated as the
-		// channel owner so the operator's own USER.md applies.
-		return ownerID
+	namespace := owner.APIKeyID
+	if namespace == "" {
+		namespace = "owner:" + ownerID
 	}
-	extID := msg.Channel + ":" + msg.UserID
-	acc, err := g.accounts.EnsureAppUser(ctx, owner.APIKeyID, extID, "")
+	extID := msg.Channel + ":" + msg.AccountID + ":" + msg.UserID
+	acc, err := g.accounts.EnsureAppUser(ctx, namespace, extID, msg.SenderName)
 	if err != nil {
 		slog.Warn("resolveChatter: EnsureAppUser failed",
-			"apikey", owner.APIKeyID, "ext", extID, "error", err)
+			"owner", ownerID, "namespace", namespace, "ext", extID, "error", err)
 		return ""
 	}
 	return acc.ID

internal/gateway/userspace_test.go

@@ -3,9 +3,12 @@ package gateway
 import (
 	"context"
 	"testing"
+	"time"
 
+	"github.com/fastclaw-ai/fastclaw/internal/bus"
 	"github.com/fastclaw-ai/fastclaw/internal/scope"
 	"github.com/fastclaw-ai/fastclaw/internal/store"
+	"github.com/fastclaw-ai/fastclaw/internal/users"
 )
 
 // readUserScopeAgentDefaults must distinguish "user has no row" from
@@ -66,3 +69,73 @@ func TestReadUserScopeAgentDefaults(t *testing.T) {
 		t.Fatalf("other fields should still parse, got MaxTokens=%d", got.MaxTokens)
 	}
 }
+
+func TestResolveChatterSeparatesIMSendersForRegularOwner(t *testing.T) {
+	db, err := store.NewDBStore("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	defer db.Close()
+	if err := db.Migrate(context.Background()); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	ctx := context.Background()
+
+	owner := &store.UserRecord{
+		ID:           "u_owner",
+		Username:     "owner",
+		Email:        "owner@example.com",
+		PasswordHash: "x",
+		Role:         users.RoleUser,
+		Status:       users.StatusActive,
+		AgentQuota:   -1,
+		CreatedAt:    time.Now().UTC(),
+		UpdatedAt:    time.Now().UTC(),
+	}
+	if err := db.CreateUser(ctx, owner); err != nil {
+		t.Fatalf("create owner: %v", err)
+	}
+	accts, err := users.NewAccounts(db)
+	if err != nil {
+		t.Fatalf("accounts: %v", err)
+	}
+	g := &Gateway{store: db, accounts: accts}
+
+	alice := bus.InboundMessage{
+		Channel:    "telegram",
+		AccountID:  "bot-a",
+		UserID:     "111",
+		SenderName: "Alice",
+	}
+	bob := bus.InboundMessage{
+		Channel:    "telegram",
+		AccountID:  "bot-a",
+		UserID:     "222",
+		SenderName: "Bob",
+	}
+	aliceID := g.resolveChatter(ctx, owner.ID, alice)
+	if aliceID == "" || aliceID == owner.ID {
+		t.Fatalf("alice should resolve to app_user, got %q", aliceID)
+	}
+	bobID := g.resolveChatter(ctx, owner.ID, bob)
+	if bobID == "" || bobID == owner.ID {
+		t.Fatalf("bob should resolve to app_user, got %q", bobID)
+	}
+	if aliceID == bobID {
+		t.Fatalf("different Telegram senders resolved to same user: %s", aliceID)
+	}
+	if again := g.resolveChatter(ctx, owner.ID, alice); again != aliceID {
+		t.Fatalf("same sender should resolve stably: got %q want %q", again, aliceID)
+	}
+
+	aliceAccount, err := db.GetUser(ctx, aliceID)
+	if err != nil {
+		t.Fatalf("get alice app_user: %v", err)
+	}
+	if aliceAccount.APIKeyID != "owner:"+owner.ID {
+		t.Fatalf("unexpected namespace: %q", aliceAccount.APIKeyID)
+	}
+	if aliceAccount.ExternalID != "telegram:bot-a:111" {
+		t.Fatalf("unexpected external id: %q", aliceAccount.ExternalID)
+	}
+}