WPB-23789: Move operation to ConversationSubsystem

Author: blackheaven

changelog.d/5-internal/WPB-23789

@@ -0,0 +1,12 @@
+### ConversationSubsystem Migration
+
+* Move conversation-related operations into a unified Polysemy `ConversationSubsystem` effect across the wire-server codebase.
+  This consolidation improves code organization and separation of concerns for conversation logic.
+
+* Library updates:
+  - Introduced dedicated error types for ConversationSubsystem to improve error handling
+  - Consolidated conversation-related operations that were previously scattered across multiple stores and subsystems
+
+**Note:** The background-worker configuration now has a dependency on the shared global settings.
+Deployments that previously set these values in both galley and background-worker sections
+can consolidate them into the global.settings section.

charts/wire-server/templates/_helpers.tpl

@@ -163,6 +163,180 @@
 {{- end -}}
 {{- end -}}
 
+{{/* SHARED SETTINGS */}}
+{{- define "wire-server.settings.common" -}}
+maxTeamSize: {{ .maxTeamSize }}
+maxConvSize: {{ .maxConvSize }}
+intraListing: {{ .intraListing }}
+{{- if .maxFanoutSize }}
+maxFanoutSize: {{ .maxFanoutSize }}
+{{- end }}
+{{- if .exposeInvitationURLsTeamAllowlist }}
+exposeInvitationURLsTeamAllowlist: {{ toYaml .exposeInvitationURLsTeamAllowlist | nindent 8 }}
+{{- end }}
+{{- if .conversationCodeURI }}
+conversationCodeURI: {{ .conversationCodeURI | quote }}
+{{- else if .multiIngress }}
+multiIngress: {{- toYaml .multiIngress | nindent 8 }}
+{{- else }}
+{{ fail "Either settings.conversationCodeURI or settings.multiIngress have to be set" }}
+{{- end }}
+{{- if (and .conversationCodeURI .multiIngress) }}
+{{ fail "settings.conversationCodeURI and settings.multiIngress are mutually exclusive" }}
+{{- end }}
+{{- if hasKey . "httpPoolSize" }}
+httpPoolSize: {{ .httpPoolSize }}
+{{- end }}
+{{- if hasKey . "federationDomain" }}
+federationDomain: {{ .federationDomain }}
+{{- end }}
+{{- if .federationProtocols }}
+federationProtocols: {{ .federationProtocols | toJson }}
+{{- end }}
+{{- if .mlsPrivateKeyPaths }}
+mlsPrivateKeyPaths: {{- toYaml .mlsPrivateKeyPaths | nindent 8 }}
+{{- end }}
+{{- if .concurrentDeletionEvents }}
+concurrentDeletionEvents: {{ .concurrentDeletionEvents }}
+{{- end }}
+{{- if .deleteConvThrottleMillis }}
+deleteConvThrottleMillis: {{ .deleteConvThrottleMillis }}
+{{- end }}
+{{- if hasKey . "disabledAPIVersions" }}
+disabledAPIVersions: {{ toJson .disabledAPIVersions }}
+{{- end }}
+{{- if .guestLinkTTLSeconds }}
+guestLinkTTLSeconds: {{ .guestLinkTTLSeconds }}
+{{- end }}
+passwordHashingOptions: {{ toYaml .passwordHashingOptions | nindent 8 }}
+passwordHashingRateLimit: {{ toYaml .passwordHashingRateLimit | nindent 8 }}
+{{- if .checkGroupInfo }}
+checkGroupInfo: {{ .checkGroupInfo }}
+{{- end }}
+{{- if hasKey . "meetings" }}
+meetings:
+  {{- toYaml .meetings | nindent 8 }}
+{{- end }}
+{{- if .featureFlags }}
+featureFlags:
+  sso: {{ .featureFlags.sso }}
+  legalhold: {{ .featureFlags.legalhold }}
+  teamSearchVisibility: {{ .featureFlags.teamSearchVisibility }}
+  classifiedDomains:
+    {{- toYaml .featureFlags.classifiedDomains | nindent 10 }}
+  {{- if .featureFlags.fileSharing }}
+  fileSharing:
+    {{- toYaml .featureFlags.fileSharing | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.enforceFileDownloadLocation }}
+  enforceFileDownloadLocation:
+    {{- toYaml .featureFlags.enforceFileDownloadLocation | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.sndFactorPasswordChallenge }}
+  sndFactorPasswordChallenge:
+    {{- toYaml .featureFlags.sndFactorPasswordChallenge | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.searchVisibilityInbound }}
+  searchVisibilityInbound:
+    {{- toYaml .featureFlags.searchVisibilityInbound | nindent 10 }}
+  {{- end }}
+  {{- /* Accept the legacy typo in Helm values, but always render the canonical Galley key. */}}
+  {{- $validateSAMLemails := .featureFlags.validateSAMLemails | default .featureFlags.validateSAMLEmails }}
+  {{- if $validateSAMLemails }}
+  validateSAMLemails:
+    {{- toYaml $validateSAMLemails | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.appLock }}
+  appLock:
+    {{- toYaml .featureFlags.appLock | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.conferenceCalling }}
+  conferenceCalling:
+    {{- toYaml .featureFlags.conferenceCalling | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.selfDeletingMessages }}
+  selfDeletingMessages:
+    {{- toYaml .featureFlags.selfDeletingMessages | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.conversationGuestLinks }}
+  conversationGuestLinks:
+    {{- toYaml .featureFlags.conversationGuestLinks | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.mls }}
+  mls:
+    {{- toYaml .featureFlags.mls | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.outlookCalIntegration }}
+  outlookCalIntegration:
+    {{- toYaml .featureFlags.outlookCalIntegration | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.mlsE2EId }}
+  mlsE2EId:
+    {{- toYaml .featureFlags.mlsE2EId | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.mlsMigration }}
+  mlsMigration:
+    {{- toYaml .featureFlags.mlsMigration | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.limitedEventFanout }}
+  limitedEventFanout:
+    {{- toYaml .featureFlags.limitedEventFanout | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.domainRegistration }}
+  domainRegistration:
+    {{- toYaml .featureFlags.domainRegistration | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.channels }}
+  channels:
+    {{- toYaml .featureFlags.channels | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.cells }}
+  cells:
+    {{- toYaml .featureFlags.cells | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.cellsInternal }}
+  cellsInternal:
+    {{- toYaml .featureFlags.cellsInternal | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.allowedGlobalOperations }}
+  allowedGlobalOperations:
+    {{- toYaml .featureFlags.allowedGlobalOperations | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.assetAuditLog }}
+  assetAuditLog:
+    {{- toYaml .featureFlags.assetAuditLog | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.consumableNotifications }}
+  consumableNotifications:
+    {{- toYaml .featureFlags.consumableNotifications | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.chatBubbles }}
+  chatBubbles:
+    {{- toYaml .featureFlags.chatBubbles | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.apps }}
+  apps:
+    {{- toYaml .featureFlags.apps | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.simplifiedUserConnectionRequestQRCode }}
+  simplifiedUserConnectionRequestQRCode:
+    {{- toYaml .featureFlags.simplifiedUserConnectionRequestQRCode | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.stealthUsers }}
+  stealthUsers:
+    {{- toYaml .featureFlags.stealthUsers | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.meetings }}
+  meetings:
+    {{- toYaml .featureFlags.meetings | nindent 10 }}
+  {{- end }}
+  {{- if .featureFlags.meetingsPremium }}
+  meetingsPremium:
+    {{- toYaml .featureFlags.meetingsPremium | nindent 10 }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
 {{/* Compute the SCIM base URI
 
 The rules are:

charts/wire-server/values.yaml

@@ -11,6 +11,7 @@ tags:
   backoffice: false
   mlsstats: false
   integration: false
+  proxy: false
 
 galley:
   replicaCount: 3
@@ -663,43 +664,6 @@ cannon:
   #   effect: "NoSchedule"
   tolerations: []
 
-proxy:
-  replicaCount: 3
-  image:
-    repository: quay.io/wire/proxy
-    tag: do-not-use
-  service:
-    externalPort: 8080
-    internalPort: 8080
-  imagePullPolicy: ""
-  metrics:
-    serviceMonitor:
-      enabled: false
-  resources:
-    requests:
-      memory: "25Mi"
-      cpu: "50m"
-    limits:
-      memory: "50Mi"
-  config:
-    logLevel: Info
-    logFormat: StructuredJSON
-    logNetStrings: false
-    proxy: {}
-    # Disable one ore more API versions. Please make sure the configuration value is the same in all these charts:
-    # brig, cannon, cargohold, galley, gundeck, proxy, spar.
-    disabledAPIVersions: [development]
-
-  podSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - ALL
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-  secrets: {}
-
 gundeck:
   replicaCount: 3
   image:

hack/helm_vars/wire-server/values.yaml.gotmpl

@@ -5,6 +5,7 @@ tags:
   legalhold: false
   sftd: false
   integration: true
+  proxy: true
 
 consumableNotifications: false
 

libs/wire-api/src/Wire/API/Team/FeatureFlags.hs

@@ -25,6 +25,8 @@ module Wire.API.Team.FeatureFlags
     FeatureFlags,
     FanoutLimit,
     featureDefaults,
+    defaultFanoutLimit,
+    currentFanoutLimit,
     notTeamMember,
     findTeamMember,
     isTeamMember,
@@ -42,7 +44,7 @@ import Data.ByteString.UTF8 qualified as UTF8
 import Data.Default
 import Data.Id (UserId)
 import Data.OpenApi qualified as S
-import Data.Range (Range)
+import Data.Range (Range, fromRange, toRange, unsafeRange)
 import Data.SOP
 import Data.Schema
 import Data.Set qualified as Set
@@ -53,6 +55,15 @@ import Wire.API.Team.Permission
 
 type FanoutLimit = Range 1 HardTruncationLimit Int32
 
+defaultFanoutLimit :: FanoutLimit
+defaultFanoutLimit = toRange (Proxy @HardTruncationLimit)
+
+currentFanoutLimit :: Word32 -> Maybe FanoutLimit -> FanoutLimit
+currentFanoutLimit maxTeamSize maxFanoutSize =
+  let optFanoutLimit = fromIntegral . fromRange $ fromMaybe defaultFanoutLimit maxFanoutSize
+      maxSize = fromIntegral maxTeamSize
+   in unsafeRange (min maxSize optFanoutLimit)
+
 -- | Used to extract the feature config type out of 'FeatureDefaults' or
 -- related types.
 type family ConfigOf a

libs/wire-subsystems/default.nix

@@ -23,6 +23,7 @@
 , bytestring-conversion
 , case-insensitive
 , cassandra-util
+, comonad
 , conduit
 , constraints
 , containers
@@ -66,6 +67,7 @@
 , imports
 , iproute
 , iso639
+, kan-extensions
 , lens
 , lib
 , lrucaching
@@ -158,6 +160,7 @@ mkDerivation {
     bytestring-conversion
     case-insensitive
     cassandra-util
+    comonad
     conduit
     constraints
     containers
@@ -197,6 +200,7 @@ mkDerivation {
     imports
     iproute
     iso639
+    kan-extensions
     lens
     lrucaching
     memory
@@ -279,6 +283,7 @@ mkDerivation {
     bytestring-conversion
     case-insensitive
     cassandra-util
+    comonad
     conduit
     constraints
     containers
@@ -319,6 +324,7 @@ mkDerivation {
     imports
     iproute
     iso639
+    kan-extensions
     lens
     lrucaching
     memory

libs/wire-subsystems/src/Wire/BackgroundJobsRunner/Interpreter.hs

@@ -44,7 +44,7 @@ import Wire.API.UserGroup
 import Wire.BackgroundJobsPublisher
 import Wire.BackgroundJobsRunner (BackgroundJobsRunner (..))
 import Wire.ConversationStore (ConversationStore, getConversation, upsertMembers)
-import Wire.ConversationSubsystem
+import Wire.ConversationSubsystem hiding (getConversation)
 import Wire.Sem.Random
 import Wire.StoredConversation
 import Wire.UserGroupStore (UserGroupStore, getUserGroup, getUserGroupChannels)

libs/wire-subsystems/src/Wire/BrigAPIAccess.hs

@@ -71,6 +71,9 @@ module Wire.BrigAPIAccess
     deleteGroupInternal,
     deleteApp,
     DeleteGroupManagedError (..),
+
+    -- * Assertions
+    ensureConnectedToLocals,
   )
 where
 
@@ -88,6 +91,7 @@ import Polysemy
 import Polysemy.Error
 import Web.Scim.Filter qualified as Scim
 import Wire.API.Connection
+import Wire.API.Error
 import Wire.API.Error.Galley
 import Wire.API.MLS.CipherSuite
 import Wire.API.Routes.Internal.Brig
@@ -192,3 +196,17 @@ getConnectionsUnqualifiedBidi uids1 uids2 mrel1 mrel2 = do
   res1 <- getConnectionsUnqualified uids1 (Just uids2) mrel1
   res2 <- getConnectionsUnqualified uids2 (Just uids1) mrel2
   pure (res1, res2)
+
+ensureConnectedToLocals ::
+  ( Member (ErrorS 'NotConnected) r,
+    Member BrigAPIAccess r
+  ) =>
+  UserId ->
+  [UserId] ->
+  Sem r ()
+ensureConnectedToLocals _ [] = pure ()
+ensureConnectedToLocals u uids = do
+  (connsFrom, connsTo) <-
+    getConnectionsUnqualifiedBidi [u] uids (Just Accepted) (Just Accepted)
+  unless (length connsFrom == length uids && length connsTo == length uids) $
+    throwS @'NotConnected

libs/wire-subsystems/src/Wire/ConversationStore/Cassandra.hs

@@ -455,7 +455,7 @@ addMembers conv (UserList lusers rusers) = do
         -- User is remote, so we only add it to the member_remote_user
         -- table, but the reverse mapping has to be done on the remote
         -- backend; so we assume an additional call to their backend has
-        -- been (or will be) made separately. See Galley.API.Update.addMembers
+        -- been (or will be) made separately. See Wire.ConversationSubsystem.Update.addMembers
         addPrepQuery Cql.insertRemoteMember (conv, domain, uid, role)
 
   pure (map newMemberWithRole lusers, map newRemoteMemberWithRole rusers)