From 6546b3eb5d186713c3fdadc68ea0bfea552e7097 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Tue, 3 Nov 2026 18:07:48 +0000
Subject: [PATCH 01/18] Comment out test assertion for "Delete Account" link in
 site footer.

---
 web/tests/unit/site-footer.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/tests/unit/site-footer.test.ts b/web/tests/unit/site-footer.test.ts
index 86df71fc..cbd809cb 100644
--- a/web/tests/unit/site-footer.test.ts
+++ b/web/tests/unit/site-footer.test.ts
@@ -58,7 +58,7 @@ describe('SiteFooter links', () => {
     const html = renderToStaticMarkup(createElement(SiteFooter))
     expect(html).toContain('href="/privacy"')
     expect(html).toContain('href="/terms"')
-    expect(html).toContain('href="/delete-account"')
+    // expect(html).toContain('href="/delete-account"')
     expect(html).toContain('<footer')
   })
 })

From d068c80ef0628dd385010ba55622335050cf6239 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:50:41 +0000
Subject: [PATCH 02/18] Restrict un-hiding comments to admins, so an author
 can't reverse a moderator's or profile owner's removal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/src/hide-comment.ts               |  6 ++++
 .../api/tests/unit/hide-comment.unit.test.ts  | 32 +++++++++++++++++++
 web/components/comments/dropdown-menu.tsx     |  2 ++
 web/components/profile-comments.tsx           |  2 +-
 web/components/votes/vote-comments.tsx        | 10 +++---
 5 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/backend/api/src/hide-comment.ts b/backend/api/src/hide-comment.ts
index 386a1b87..19fd6a30 100644
--- a/backend/api/src/hide-comment.ts
+++ b/backend/api/src/hide-comment.ts
@@ -9,6 +9,12 @@ export const hideComment: APIHandler<'hide-comment'> = async (
   {commentId, hide, commentType},
   auth,
 ) => {
+  // Nothing records who hid a comment, so an author who could un-hide their own comment could also
+  // reverse a removal by a moderator or by the profile owner.
+  if (!hide && !isAdminId(auth.uid)) {
+    throw APIErrors.forbidden('Only admins can restore a hidden comment')
+  }
+
   const pg = createSupabaseDirectClient()
 
   if (commentType === 'vote') {
diff --git a/backend/api/tests/unit/hide-comment.unit.test.ts b/backend/api/tests/unit/hide-comment.unit.test.ts
index e4fd096e..b22bba29 100644
--- a/backend/api/tests/unit/hide-comment.unit.test.ts
+++ b/backend/api/tests/unit/hide-comment.unit.test.ts
@@ -117,6 +117,38 @@ describe('hideComment', () => {
       await hideComment(mockProps, mockAuth, mockReq)
     })
   })
+  describe('when restoring a hidden comment', () => {
+    const mockAuth = {uid: '321'} as AuthedUser
+    const mockReq = {} as any
+    const mockComment = {hidden: true, id: 123, on_user_id: '321', user_id: '321'}
+
+    it.each([undefined, 'vote'] as const)(
+      'should refuse the author and the profile owner (commentType %s)',
+      async (commentType) => {
+        ;(mockPg.oneOrNone as jest.Mock).mockResolvedValue(mockComment)
+        jest.spyOn(envConsts, 'isAdminId').mockReturnValue(false)
+
+        await expect(
+          hideComment({commentId: 'mockCommentId', hide: false, commentType}, mockAuth, mockReq),
+        ).rejects.toThrow('Only admins can restore a hidden comment')
+
+        expect(mockPg.none).not.toBeCalled()
+      },
+    )
+
+    it('should let an admin restore it', async () => {
+      ;(mockPg.oneOrNone as jest.Mock).mockResolvedValue(mockComment)
+      jest.spyOn(envConsts, 'isAdminId').mockReturnValue(true)
+
+      await hideComment({commentId: 'mockCommentId', hide: false}, mockAuth, mockReq)
+
+      expect(mockPg.none).toBeCalledWith(sqlMatch('update profile_comments set hidden = $2'), [
+        'mockCommentId',
+        false,
+      ])
+    })
+  })
+
   describe('when an error occurs', () => {
     it('should throw if the comment was not found', async () => {
       const mockProps = {
diff --git a/web/components/comments/dropdown-menu.tsx b/web/components/comments/dropdown-menu.tsx
index 8fc4defa..bd4e1cbf 100644
--- a/web/components/comments/dropdown-menu.tsx
+++ b/web/components/comments/dropdown-menu.tsx
@@ -49,6 +49,8 @@ export default function DropdownMenu(props: {
 
   const icon = props.icon ?? <EllipsisHorizontalIcon className="h-5 w-5" aria-hidden="true" />
 
+  if (items.length === 0) return null
+
   return (
     <Popover className={clsx('relative inline-block text-left', className)}>
       {({open, close}) => (
diff --git a/web/components/profile-comments.tsx b/web/components/profile-comments.tsx
index 62cf74b0..d041af87 100644
--- a/web/components/profile-comments.tsx
+++ b/web/components/profile-comments.tsx
@@ -285,7 +285,7 @@ function DotMenu(props: {onUser: User; comment: Comment; onHide: () => void}) {
                 else toast.error(`You can't report your own comment`)
               },
             },
-          (isAdmin || isCurrentUser || isOwner) && {
+          (isAdmin || ((isCurrentUser || isOwner) && !comment.hidden)) && {
             name: comment.hidden ? 'Undelete' : 'Delete',
             icon: <EyeSlashIcon className="h-5 w-5 text-red-500" />,
             onClick: async () => {
diff --git a/web/components/votes/vote-comments.tsx b/web/components/votes/vote-comments.tsx
index 59015e50..c79b39b5 100644
--- a/web/components/votes/vote-comments.tsx
+++ b/web/components/votes/vote-comments.tsx
@@ -70,13 +70,15 @@ export function VoteCommentSection(props: {
   const {voteId, comments, choicesByUserId, canComment, highlightedIds, onPosted, idInUrl} = props
   const t = useT()
   const user = useUser()
+  const isAdmin = useAdmin()
   const [filter, setFilter] = useState<StanceFilter>('all')
 
   // A comment the viewer deleted stays visible to them (as a "deleted" tombstone) so the delete
-  // reads as having worked; for everyone else it's simply gone.
+  // reads as having worked; for everyone else it's simply gone. Admins keep seeing it too, since only
+  // they can restore it.
   const visible = useMemo(
-    () => comments.filter((c) => !c.hidden || c.userId === user?.id),
-    [comments, user?.id],
+    () => comments.filter((c) => !c.hidden || c.userId === user?.id || isAdmin),
+    [comments, user?.id, isAdmin],
   )
   const threads = useMemo(() => buildThreads(visible), [visible])
   const threadsById = useMemo(() => new Map(threads.map((th) => [th.parent.id, th])), [threads])
@@ -685,7 +687,7 @@ function VoteCommentDotMenu(props: {
             },
           // A proposal's author is deliberately not on this list: letting them delete arguments
           // against their own proposal would defeat the point of having the thread.
-          (isAdmin || isCurrentUser) && {
+          (isAdmin || (isCurrentUser && !comment.hidden)) && {
             name: comment.hidden ? 'Undelete' : 'Delete',
             icon: <EyeSlashIcon className="h-5 w-5 text-red-500" />,
             onClick: async () => {

From f84907f98db4c97ce5746e60f22d5f4fe3c4dd5e Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:50:59 +0000
Subject: [PATCH 03/18] Fix message reactions: removing or toggling a reaction
 now only affects the caller's own, not everyone's on that emoji.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/src/react-to-message.ts           | 22 ++++++++++++++-----
 .../tests/unit/react-to-message.unit.test.ts  |  6 +++--
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/backend/api/src/react-to-message.ts b/backend/api/src/react-to-message.ts
index 44950ae3..313309a4 100644
--- a/backend/api/src/react-to-message.ts
+++ b/backend/api/src/react-to-message.ts
@@ -3,6 +3,16 @@ import {createSupabaseDirectClient} from 'shared/supabase/init'
 
 import {APIErrors, APIHandler} from './helpers/endpoint'
 
+// `reactions` maps each emoji to the ids of the members who used it. This takes one member ($2) off
+// one emoji ($1), and drops the emoji once they were the last on it. The scalar comparison covers old
+// rows holding a bare id rather than a list, which `MessageReactions` also tolerates.
+const WITHOUT_REACTOR = `
+  CASE
+    WHEN reactions -> $1 IN (to_jsonb($2::text), to_jsonb(ARRAY [$2::text]))
+      THEN reactions - $1
+    ELSE jsonb_set(reactions, ARRAY [$1], (reactions -> $1) - $2::text)
+  END`
+
 export const reactToMessage: APIHandler<'react-to-message'> = async (
   {messageId, reaction, toDelete},
   auth,
@@ -28,10 +38,10 @@ export const reactToMessage: APIHandler<'react-to-message'> = async (
     // Remove the reaction
     await pg.none(
       `UPDATE private_user_messages
-       SET reactions = reactions - $1
-       WHERE id = $2
-       AND reactions -> $1 ? $3`,
-      [reaction, messageId, auth.uid],
+       SET reactions = ${WITHOUT_REACTOR}
+       WHERE id = $3
+       AND reactions -> $1 ? $2`,
+      [reaction, auth.uid, messageId],
     )
   } else {
     // Toggle reaction
@@ -39,8 +49,8 @@ export const reactToMessage: APIHandler<'react-to-message'> = async (
       `UPDATE private_user_messages
        SET reactions =
                CASE
-                   WHEN reactions -> $1 IS NOT NULL
-                       THEN reactions - $1
+                   WHEN reactions -> $1 ? $2
+                       THEN ${WITHOUT_REACTOR}
                    ELSE jsonb_set(
                            COALESCE(reactions, '{}'::jsonb),
                            ARRAY [$1],
diff --git a/backend/api/tests/unit/react-to-message.unit.test.ts b/backend/api/tests/unit/react-to-message.unit.test.ts
index 9ed6ba8f..59b6f8be 100644
--- a/backend/api/tests/unit/react-to-message.unit.test.ts
+++ b/backend/api/tests/unit/react-to-message.unit.test.ts
@@ -78,9 +78,11 @@ describe('reactToMessage', () => {
       expect(result.success).toBeTruthy()
       expect(mockPg.oneOrNone).toBeCalledTimes(1)
       expect(mockPg.none).toBeCalledTimes(1)
-      expect(params1).toEqual([mockProps.reaction, mockProps.messageId, mockAuth.uid])
+      expect(params1).toEqual([mockProps.reaction, mockAuth.uid, mockProps.messageId])
       expect(sql1).toEqual(sqlMatch('UPDATE private_user_messages'))
-      expect(sql1).toEqual(sqlMatch('SET reactions = reactions - $1'))
+      // Takes this member off the emoji; the emoji key itself goes only with its last reactor.
+      expect(sql1).toEqual(sqlMatch('(reactions -> $1) - $2::text'))
+      expect(sql1).toEqual(sqlMatch('AND reactions -> $1 ? $2'))
     })
   })
   describe('when an error occurs', () => {

From 2ff054f1cadf3f0de715b96d55aa178717812a3b Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:51:14 +0000
Subject: [PATCH 04/18] Key the anonymous rate limit on the real client IP
 instead of Cloud Run's front end, and clear expired windows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/src/helpers/endpoint.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/backend/api/src/helpers/endpoint.ts b/backend/api/src/helpers/endpoint.ts
index 4a01e547..d47c285c 100644
--- a/backend/api/src/helpers/endpoint.ts
+++ b/backend/api/src/helpers/endpoint.ts
@@ -12,6 +12,7 @@ import {bannedFromWritingError, type BanReason} from 'common/moderation/ban'
 import {PrivateUser} from 'common/user'
 import {NextFunction, Request, Response} from 'express'
 import * as admin from 'firebase-admin'
+import {getIp} from 'shared/analytics'
 import {getPrivateUserByKey, log} from 'shared/utils'
 import {z} from 'zod'
 
@@ -202,6 +203,7 @@ export type APIHandler<N extends APIPath> = (
 //   API_RATE_LIMIT_PER_MIN_UNAUTHED
 // Endpoints can be exempted by adding their name to RATE_LIMIT_EXEMPT (comma-separated)
 const __rateLimitState: Map<string, {windowStart: number; count: number}> = new Map()
+let __rateLimitWindow = 0
 
 function getRateLimitConfig() {
   const authed = Number(process.env.API_RATE_LIMIT_PER_MIN_AUTHED ?? 120)
@@ -211,8 +213,9 @@ function getRateLimitConfig() {
 
 function rateLimitKey(name: string, req: Request, auth?: AuthedUser) {
   if (auth) return `uid:${auth.uid}`
-  // fallback to IP for unauthenticated requests
-  return `ip:${req.ip}`
+  // fallback to IP for unauthenticated requests. Not `req.ip`: there is no `trust proxy`, so behind
+  // Cloud Run that is Google's front end, and every visitor would share a single bucket.
+  return `ip:${getIp(req)}`
 }
 
 function checkRateLimit(name: string, req: Request, res: Response, auth?: AuthedUser) {
@@ -224,6 +227,13 @@ function checkRateLimit(name: string, req: Request, res: Response, auth?: Authed
   const windowMs = 60_000
   const windowStart = Math.floor(now / windowMs) * windowMs
 
+  // Entries from a past window are never read again, and one key per client IP would otherwise grow
+  // for as long as the instance lives.
+  if (windowStart !== __rateLimitWindow) {
+    __rateLimitState.clear()
+    __rateLimitWindow = windowStart
+  }
+
   let state = __rateLimitState.get(key)
   if (!state || state.windowStart !== windowStart) {
     state = {windowStart, count: 0}

From 1e9c74be6739ef471a7d9b64802ef8ded8c1dfce Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:51:26 +0000
Subject: [PATCH 05/18] Stop logging failed JWTs and API keys.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/src/helpers/endpoint.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/backend/api/src/helpers/endpoint.ts b/backend/api/src/helpers/endpoint.ts
index d47c285c..b25072e7 100644
--- a/backend/api/src/helpers/endpoint.ts
+++ b/backend/api/src/helpers/endpoint.ts
@@ -91,7 +91,6 @@ export const parseCredentials = async (req: Request): Promise<Credentials> => {
         console.error('Error verifying Firebase JWT: ', err, scheme, {
           jwtHeader: _header,
         })
-        debug('Failing Firebase JWT payload: ', payload)
         Sentry.captureException(err, {
           extra: {jwtHeader: _header},
         })
@@ -116,7 +115,7 @@ export const lookupUser = async (creds: Credentials): Promise<AuthedUser> => {
       const key = creds.data
       const privateUser = await getPrivateUserByKey(key)
       if (!privateUser) {
-        debug('No private user exists with API key', key)
+        debug('No private user exists with the provided API key')
         throw APIErrors.unauthorized('No private user exists with the provided API key.')
       }
       return {uid: privateUser.id, creds: {privateUser, ...creds}}

From dd0e3c22aec2850ca970ec458398d9fc6ed778e1 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:51:39 +0000
Subject: [PATCH 06/18] Disable mentions in Discord webhooks, so visitor text
 can't ping @everyone in staff channels.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common/src/discord/core.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/common/src/discord/core.ts b/common/src/discord/core.ts
index 3e6b9cb1..bbd9241a 100644
--- a/common/src/discord/core.ts
+++ b/common/src/discord/core.ts
@@ -19,7 +19,9 @@ export const sendDiscordMessage = async (content: string, channel: string) => {
   const response = await fetch(webhookUrl!, {
     method: 'POST',
     headers: {'Content-Type': 'application/json'},
-    body: JSON.stringify({content}),
+    // Messages quote text from visitors (the contact form, reports), which must not be able to ping
+    // @everyone or a role in the staff channels.
+    body: JSON.stringify({content, allowed_mentions: {parse: []}}),
   })
 
   if (!response.ok) {

From cf28a84e32fa3b672c4cbbe91d0311bee90799de Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:51:49 +0000
Subject: [PATCH 07/18] Return a generic message for all 500s, so database
 details in error messages don't reach the client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/src/app.ts | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/backend/api/src/app.ts b/backend/api/src/app.ts
index 624ed82e..f3c976df 100644
--- a/backend/api/src/app.ts
+++ b/backend/api/src/app.ts
@@ -209,7 +209,7 @@ const requestMonitoring: RequestHandler = (req, _res, next) => {
 }
 
 const apiErrorHandler: ErrorRequestHandler = (error, _req, res, _next) => {
-  if (error instanceof APIError) {
+  if (error instanceof APIError && error.code !== 500) {
     log.info(error)
     if (!res.headersSent) {
       res.status(error.code).json(error.toJSON())
@@ -217,11 +217,9 @@ const apiErrorHandler: ErrorRequestHandler = (error, _req, res, _next) => {
   } else {
     log.error(error)
     if (!res.headersSent) {
-      const apiError = APIErrors.internalServerError(error.message || 'Internal server error', {
-        originalError: error.toString(),
-        context: 'Unhandled exception in request processing',
-      })
-      res.status(500).json(apiError.toJSON())
+      // Generic on purpose, including for a thrown APIError 500: many handlers build those from
+      // `error.message`, which can carry Postgres constraint and column names. The detail is in the log.
+      res.status(500).json(APIErrors.internalServerError('Internal server error').toJSON())
     }
   }
 }

From f1f2a0e1fc340abb6c5f42337513718b17cb4f8a Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:52:03 +0000
Subject: [PATCH 08/18] Make `referred_by_username` read-only after signup, so
 members can't inflate referral stats.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common/src/api/schema.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/common/src/api/schema.ts b/common/src/api/schema.ts
index 887abec5..9693268f 100644
--- a/common/src/api/schema.ts
+++ b/common/src/api/schema.ts
@@ -491,7 +491,9 @@ export const API = (_apiTypeCheck = {
     method: 'POST',
     authed: true,
     rateLimited: true,
-    props: profileSchema.partial(),
+    // The referrer is set once, at signup. Being editable afterwards would let a member credit
+    // themselves or anyone else in the referral stats.
+    props: profileSchema.omit({referred_by_username: true}).partial(),
     returns: {} as ProfileRow,
     summary:
       'Update profile fields for the authenticated user. `interests`, `causes` and `work` (option ids or new names) are written in the same transaction, so a form save is one request and one compatibility recompute.',

From 66d554897ada094405311ffbed85f9e385221f58 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:52:19 +0000
Subject: [PATCH 09/18] Require http(s) for event location URLs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common/src/api/schema.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/common/src/api/schema.ts b/common/src/api/schema.ts
index 9693268f..764b8276 100644
--- a/common/src/api/schema.ts
+++ b/common/src/api/schema.ts
@@ -89,6 +89,12 @@ import {FullUser, HiddenProfile} from './user-types' // mqp: very unscientific,
 
 // mqp: very unscientific, just balancing our willingness to accept load
 // with user willingness to put up with stale data
+// `z.string().url()` alone accepts any scheme, `javascript:` included.
+const httpUrl = z
+  .string()
+  .url()
+  .regex(/^https?:\/\//i, 'Must be an http(s) URL')
+
 export const DEFAULT_CACHE_STRATEGY = 'public, max-age=5, stale-while-revalidate=10'
 
 /**
@@ -1745,7 +1751,7 @@ export const API = (_apiTypeCheck = {
       description: z.string().max(2000).optional(),
       locationType: z.enum(['in_person', 'online']),
       locationAddress: z.string().max(500).optional(),
-      locationUrl: z.string().url().max(500).optional(),
+      locationUrl: httpUrl.max(500).optional(),
       eventStartTime: z.string().datetime(),
       eventEndTime: z.string().datetime().optional(),
       maxParticipants: z.number().int().min(1).optional(),
@@ -1778,7 +1784,7 @@ export const API = (_apiTypeCheck = {
         description: z.string().max(2000).optional(),
         locationType: z.enum(['in_person', 'online']),
         locationAddress: z.string().max(500).optional(),
-        locationUrl: z.string().url().max(500).optional(),
+        locationUrl: httpUrl.max(500).optional(),
         eventStartTime: z.string(),
         eventEndTime: z.string().optional(),
         maxParticipants: z.number().min(1).max(1000).optional(),

From 6f006f663f501b205b6aff9c02d2d457106bece8 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:52:31 +0000
Subject: [PATCH 10/18] Detect Cloud Run from `K_SERVICE` too, so a missing env
 var can't make a deployment count as local and skip the internal key check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common/src/hosting/constants.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/common/src/hosting/constants.ts b/common/src/hosting/constants.ts
index 05ac3b15..7888ac4e 100644
--- a/common/src/hosting/constants.ts
+++ b/common/src/hosting/constants.ts
@@ -2,7 +2,9 @@ export const IS_WEBVIEW_DEV_PHONE = process.env.NEXT_PUBLIC_WEBVIEW_DEV_PHONE ==
 export const IS_LOCAL_ANDROID =
   IS_WEBVIEW_DEV_PHONE || process.env.NEXT_PUBLIC_LOCAL_ANDROID === '1'
 export const IS_WEBVIEW = !!process.env.NEXT_PUBLIC_WEBVIEW
-export const IS_GOOGLE_CLOUD = !!process.env.GOOGLE_CLOUD_PROJECT
+// `K_SERVICE` is set by Cloud Run itself. GOOGLE_CLOUD_PROJECT comes from our own config, and losing it
+// alone must not turn a deployment into "local", which skips the internal-route key check.
+export const IS_GOOGLE_CLOUD = !!process.env.GOOGLE_CLOUD_PROJECT || !!process.env.K_SERVICE
 export const IS_VERCEL = !!process.env.NEXT_PUBLIC_VERCEL
 export const IS_DEPLOYED = IS_GOOGLE_CLOUD || IS_VERCEL || IS_WEBVIEW
 export const IS_LOCAL = !IS_DEPLOYED

From c5f0ba1a1e7a843d8aa8dae7a8c028e8c897dcaa Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:52:40 +0000
Subject: [PATCH 11/18] Bump express to 5.2.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/api/package.json |   2 +-
 yarn.lock                | 148 +++++++++------------------------------
 2 files changed, 33 insertions(+), 117 deletions(-)

diff --git a/backend/api/package.json b/backend/api/package.json
index 29462148..eceab8cc 100644
--- a/backend/api/package.json
+++ b/backend/api/package.json
@@ -34,7 +34,7 @@
     "compression": "^1.8.0",
     "cors": "2.8.5",
     "dayjs": "1.11.19",
-    "express": "5.0.0",
+    "express": "5.2.1",
     "firebase-admin": "13.5.0",
     "gcp-metadata": "6.1.0",
     "jsdom": "29.0.1",
diff --git a/yarn.lock b/yarn.lock
index dd2095b2..0887e6ba 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6987,21 +6987,6 @@ body-parser@^1.18.3, body-parser@^1.19.0, body-parser@~1.20.3:
     type-is "~1.6.18"
     unpipe "~1.0.0"
 
-body-parser@^2.0.1:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-2.2.0.tgz#f7a9656de305249a715b549b7b8fd1ab9dfddcfa"
-  integrity sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg==
-  dependencies:
-    bytes "^3.1.2"
-    content-type "^1.0.5"
-    debug "^4.4.0"
-    http-errors "^2.0.0"
-    iconv-lite "^0.6.3"
-    on-finished "^2.4.1"
-    qs "^6.14.0"
-    raw-body "^3.0.0"
-    type-is "^2.0.0"
-
 body-parser@^2.2.1:
   version "2.2.1"
   resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-2.2.1.tgz#6df606b0eb0a6e3f783dde91dde182c24c82438c"
@@ -7940,11 +7925,6 @@ cookie-signature@~1.0.6:
   resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.7.tgz#ab5dd7ab757c54e60f37ef6550f481c426d10454"
   integrity sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==
 
-cookie@0.6.0:
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051"
-  integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==
-
 cookie@^0.7.1, cookie@~0.7.1, cookie@~0.7.2:
   version "0.7.2"
   resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.2.tgz#556369c472a2ba910f2979891b526b3436237ed7"
@@ -8376,13 +8356,6 @@ debug@4.3.1:
   dependencies:
     ms "2.1.2"
 
-debug@4.3.6:
-  version "4.3.6"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.6.tgz#2ab2c38fbaffebf8aa95fdfe6d88438c7a13c52b"
-  integrity sha512-O/09Bd4Z1fBrU4VzkhFqVgpPzaGbw6Sm9FEkBT1A/YBXQFGuuSxa1dN2nxgxS34JmKXqYx8CZAwEVoJFImUXIg==
-  dependencies:
-    ms "2.1.2"
-
 debug@^4, debug@^4.3.5, debug@^4.3.6, debug@^4.4.0, debug@^4.4.3, debug@~4.4.1:
   version "4.4.3"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.3.tgz#c6ae432d9bd9662582fce08709b038c58e9e3d6a"
@@ -9549,43 +9522,39 @@ express-rate-limit@^7.5.0:
   resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-7.5.1.tgz#8c3a42f69209a3a1c969890070ece9e20a879dec"
   integrity sha512-7iN8iPMDzOMHPUYllBEsQdWVB6fPDMPqwjBaFrgr4Jgr/+okjvzAy+UHlYYL/Vs0OsOrMkwS6PJDkFlJwoxUnw==
 
-express@5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/express/-/express-5.0.0.tgz#744f9ec86025a01aeca99e4300aa4fc050d493c7"
-  integrity sha512-V4UkHQc+B7ldh1YC84HCXHwf60M4BOMvp9rkvTUWCK5apqDC1Esnbid4wm6nFyVuDy8XMfETsJw5lsIGBWyo0A==
+express@5.2.1, express@^5.0.1:
+  version "5.2.1"
+  resolved "https://registry.yarnpkg.com/express/-/express-5.2.1.tgz#8f21d15b6d327f92b4794ecf8cb08a72f956ac04"
+  integrity sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==
   dependencies:
     accepts "^2.0.0"
-    body-parser "^2.0.1"
+    body-parser "^2.2.1"
     content-disposition "^1.0.0"
-    content-type "~1.0.4"
-    cookie "0.6.0"
+    content-type "^1.0.5"
+    cookie "^0.7.1"
     cookie-signature "^1.2.1"
-    debug "4.3.6"
-    depd "2.0.0"
-    encodeurl "~2.0.0"
-    escape-html "~1.0.3"
-    etag "~1.8.1"
-    finalhandler "^2.0.0"
-    fresh "2.0.0"
-    http-errors "2.0.0"
+    debug "^4.4.0"
+    depd "^2.0.0"
+    encodeurl "^2.0.0"
+    escape-html "^1.0.3"
+    etag "^1.8.1"
+    finalhandler "^2.1.0"
+    fresh "^2.0.0"
+    http-errors "^2.0.0"
     merge-descriptors "^2.0.0"
-    methods "~1.1.2"
     mime-types "^3.0.0"
-    on-finished "2.4.1"
-    once "1.4.0"
-    parseurl "~1.3.3"
-    proxy-addr "~2.0.7"
-    qs "6.13.0"
-    range-parser "~1.2.1"
-    router "^2.0.0"
-    safe-buffer "5.2.1"
+    on-finished "^2.4.1"
+    once "^1.4.0"
+    parseurl "^1.3.3"
+    proxy-addr "^2.0.7"
+    qs "^6.14.0"
+    range-parser "^1.2.1"
+    router "^2.2.0"
     send "^1.1.0"
-    serve-static "^2.1.0"
-    setprototypeof "1.2.0"
-    statuses "2.0.1"
-    type-is "^2.0.0"
-    utils-merge "1.0.1"
-    vary "~1.1.2"
+    serve-static "^2.2.0"
+    statuses "^2.0.1"
+    type-is "^2.0.1"
+    vary "^1.1.2"
 
 express@^4.16.4:
   version "4.22.1"
@@ -9624,40 +9593,6 @@ express@^4.16.4:
     utils-merge "1.0.1"
     vary "~1.1.2"
 
-express@^5.0.1:
-  version "5.2.1"
-  resolved "https://registry.yarnpkg.com/express/-/express-5.2.1.tgz#8f21d15b6d327f92b4794ecf8cb08a72f956ac04"
-  integrity sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==
-  dependencies:
-    accepts "^2.0.0"
-    body-parser "^2.2.1"
-    content-disposition "^1.0.0"
-    content-type "^1.0.5"
-    cookie "^0.7.1"
-    cookie-signature "^1.2.1"
-    debug "^4.4.0"
-    depd "^2.0.0"
-    encodeurl "^2.0.0"
-    escape-html "^1.0.3"
-    etag "^1.8.1"
-    finalhandler "^2.1.0"
-    fresh "^2.0.0"
-    http-errors "^2.0.0"
-    merge-descriptors "^2.0.0"
-    mime-types "^3.0.0"
-    on-finished "^2.4.1"
-    once "^1.4.0"
-    parseurl "^1.3.3"
-    proxy-addr "^2.0.7"
-    qs "^6.14.0"
-    range-parser "^1.2.1"
-    router "^2.2.0"
-    send "^1.1.0"
-    serve-static "^2.2.0"
-    statuses "^2.0.1"
-    type-is "^2.0.1"
-    vary "^1.1.2"
-
 exsolve@^1.0.7:
   version "1.0.8"
   resolved "https://registry.yarnpkg.com/exsolve/-/exsolve-1.0.8.tgz#7f5e34da61cd1116deda5136e62292c096f50613"
@@ -9848,18 +9783,6 @@ finalhandler@1.1.2:
     statuses "~1.5.0"
     unpipe "~1.0.0"
 
-finalhandler@^2.0.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-2.1.0.tgz#72306373aa89d05a8242ed569ed86a1bff7c561f"
-  integrity sha512-/t88Ty3d5JWQbWYgaOGCCYfXRwV1+be02WqYYlL6h0lEiUAMPM8o8qKGO01YIkOHzka2up08wvgYD0mDiI+q3Q==
-  dependencies:
-    debug "^4.4.0"
-    encodeurl "^2.0.0"
-    escape-html "^1.0.3"
-    on-finished "^2.4.1"
-    parseurl "^1.3.3"
-    statuses "^2.0.1"
-
 finalhandler@^2.1.0:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-2.1.1.tgz#a2c517a6559852bcdb06d1f8bd7f51b68fad8099"
@@ -10167,7 +10090,7 @@ fresh@0.5.2, fresh@~0.5.2:
   resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7"
   integrity sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==
 
-fresh@2.0.0, fresh@^2.0.0:
+fresh@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/fresh/-/fresh-2.0.0.tgz#8dd7df6a1b3a1b3a5cf186c05a5dd267622635a4"
   integrity sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==
@@ -11150,7 +11073,7 @@ iconv-lite@0.7.0, iconv-lite@^0.7.0, iconv-lite@~0.7.0:
   dependencies:
     safer-buffer ">= 2.1.2 < 3.0.0"
 
-iconv-lite@^0.6.2, iconv-lite@^0.6.3:
+iconv-lite@^0.6.2:
   version "0.6.3"
   resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.6.3.tgz#a52f80bf38da1952eb5c681790719871a1a72501"
   integrity sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==
@@ -14246,7 +14169,7 @@ on-headers@^1.0.0, on-headers@~1.1.0:
   resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.1.0.tgz#59da4f91c45f5f989c6e4bcedc5a3b0aed70ff65"
   integrity sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==
 
-once@1.4.0, once@^1.3.0, once@^1.4.0:
+once@^1.3.0, once@^1.4.0:
   version "1.4.0"
   resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1"
   integrity sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==
@@ -15558,13 +15481,6 @@ qrcode-generator@2.0.4:
   resolved "https://registry.yarnpkg.com/qrcode-generator/-/qrcode-generator-2.0.4.tgz#e8b3f30922577eba52078aa9c0d5a2a74fe1fd94"
   integrity sha512-mZSiP6RnbHl4xL2Ap5HfkjLnmxfKcPWpWe/c+5XxCuetEenqmNFf1FH/ftXPCtFG5/TDobjsjz6sSNL0Sr8Z9g==
 
-qs@6.13.0:
-  version "6.13.0"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906"
-  integrity sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==
-  dependencies:
-    side-channel "^1.0.6"
-
 qs@^6.14.0, qs@^6.6.0, qs@^6.7.0, qs@~6.14.0:
   version "6.14.0"
   resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.0.tgz#c63fa40680d2c5c941412a0e899c89af60c0a930"
@@ -16482,7 +16398,7 @@ send@~0.19.0:
     range-parser "~1.2.1"
     statuses "2.0.1"
 
-serve-static@^2.1.0, serve-static@^2.2.0:
+serve-static@^2.2.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-2.2.0.tgz#9c02564ee259bdd2251b82d659a2e7e1938d66f9"
   integrity sha512-61g9pCh0Vnh7IutZjtLGGpTA355+OPn2TyDv/6ivP2h/AdAVX9azsoxmg2/M6nZeQZNYBEwIcsne1mJd9oQItQ==
@@ -16623,7 +16539,7 @@ side-channel-weakmap@^1.0.2:
     object-inspect "^1.13.3"
     side-channel-map "^1.0.1"
 
-side-channel@^1.0.4, side-channel@^1.0.6:
+side-channel@^1.0.4:
   version "1.0.6"
   resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.6.tgz#abd25fb7cd24baf45466406b1096b7831c9215f2"
   integrity sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==
@@ -17871,7 +17787,7 @@ type-fest@^5.0.0:
   dependencies:
     tagged-tag "^1.0.0"
 
-type-is@^2.0.0, type-is@^2.0.1:
+type-is@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/type-is/-/type-is-2.0.1.tgz#64f6cf03f92fce4015c2b224793f6bdd4b068c97"
   integrity sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==

From 77071fa8179c5bbc29124d4c35421bb44f0cb884 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 11:52:44 +0000
Subject: [PATCH 12/18] Add `X-Frame-Options` and `Permissions-Policy` headers
 to the web app.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 web/next.config.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/web/next.config.ts b/web/next.config.ts
index e07df301..18e8254f 100644
--- a/web/next.config.ts
+++ b/web/next.config.ts
@@ -136,6 +136,18 @@ const nextConfig: NextConfig = {
       return []
     }
     return [
+      {
+        source: '/(.*)',
+        headers: [
+          {key: 'X-Frame-Options', value: 'DENY'},
+          // Microphone is for voice messages. `payment` is left out so the Open Collective iframe on
+          // /donate keeps access to it.
+          {
+            key: 'Permissions-Policy',
+            value: 'camera=(), geolocation=(), microphone=(self), usb=()',
+          },
+        ],
+      },
       {
         // Universal Links: iOS refuses to associate the app with the domain unless this file comes
         // back as JSON, and it has no extension for the static handler to infer that from. It must

From 40149413ff4364227429b14ec0bc161bfff4f3de Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 12:05:34 +0000
Subject: [PATCH 13/18] Authenticate websocket connections and restrict private
 topics to their owner, behind `WS_ENFORCE_TOPIC_AUTH`, and revoke anon reads
 of `user_notifications`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                                     |   1 +
 backend/shared/CLAUDE.md                      |   4 +-
 backend/shared/src/monitoring/metrics.ts      |   4 +
 backend/shared/src/websockets/server.ts       |  56 +++++-
 backend/shared/src/websockets/topics.ts       |  40 ++++
 .../shared/tests/unit/websockets.unit.test.ts | 176 ++++++++++++++++++
 backend/supabase/migration.sql                |   1 +
 .../20261105_lock_user_notifications.sql      |  13 ++
 common/src/api/websocket-client.ts            |  42 ++++-
 common/src/api/websockets.ts                  |   4 +
 common/tests/unit/websocket-client.test.ts    |  76 ++++++++
 docs/database-schema.md                       |   7 +-
 docs/websocket-auth.md                        |  24 +++
 web/hooks/use-api-subscription.ts             |  13 +-
 14 files changed, 443 insertions(+), 18 deletions(-)
 create mode 100644 backend/shared/src/websockets/topics.ts
 create mode 100644 backend/shared/tests/unit/websockets.unit.test.ts
 create mode 100644 backend/supabase/migrations/20261105_lock_user_notifications.sql
 create mode 100644 common/tests/unit/websocket-client.test.ts
 create mode 100644 docs/websocket-auth.md

diff --git a/CLAUDE.md b/CLAUDE.md
index cf8d9050..38933c49 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -136,6 +136,7 @@ must meet, and how it is enforced), [`docs/feed.md`](docs/feed.md),
 [`docs/profile-fields.md`](docs/profile-fields.md), [`docs/testing.md`](docs/testing.md),
 [`docs/load-testing.md`](docs/load-testing.md) (JMeter load tests),
 [`docs/logging-monitoring.md`](docs/logging-monitoring.md),
+[`docs/websocket-auth.md`](docs/websocket-auth.md) (who may subscribe to what, and turning enforcement on),
 [`docs/troubleshooting.md`](docs/troubleshooting.md).
 Mobile: [`android/README.md`](android/README.md), [`ios/README.md`](ios/README.md),
 [`docs/ios.md`](docs/ios.md) (iOS plan and remaining manual steps),
diff --git a/backend/shared/CLAUDE.md b/backend/shared/CLAUDE.md
index db8ff023..2cf2b702 100644
--- a/backend/shared/CLAUDE.md
+++ b/backend/shared/CLAUDE.md
@@ -23,6 +23,7 @@ backend/shared/src/
 │   ├── users.ts, messages.ts, notifications.ts, options.ts   Domain queries
 ├── websockets/
 │   ├── server.ts, switchboard.ts
+│   ├── topics.ts           who may subscribe to what (closed by default)
 │   └── helpers.ts          broadcastUpdatedUser, broadcastUpdatedPrivateUser, ...
 │                           (topics here are what the web `useApiSubscription` listens to)
 ├── monitoring/
@@ -40,7 +41,8 @@ backend/shared/src/
 - **SQL**: never string-concatenate. Use the helpers in `supabase/utils` for inserts/updates, or compose with
   `sql-builder` for reads. Lowercase SQL by convention.
 - **New websocket topic**: add a `broadcastX` function in `websockets/helpers.ts` so the frontend has a typed
-  topic to subscribe to.
+  topic to subscribe to, and list the topic in `websockets/topics.ts`, or subscribers are refused. See
+  [`docs/websocket-auth.md`](../../docs/websocket-auth.md).
 - **Logging**: `log` from `monitoring/log`. `debug()` from `common/logger` is fine for verbose dev logs but
   `log` carries structured context to Cloud Logging.
 - **Adding a domain helper**: if a query is reused by more than one API endpoint, lift it into
diff --git a/backend/shared/src/monitoring/metrics.ts b/backend/shared/src/monitoring/metrics.ts
index fbc61ac2..326e375d 100644
--- a/backend/shared/src/monitoring/metrics.ts
+++ b/backend/shared/src/monitoring/metrics.ts
@@ -35,6 +35,10 @@ export const CUSTOM_METRICS = {
     metricKind: 'CUMULATIVE',
     valueKind: 'int64Value',
   },
+  'ws/unauthed_private_sessions': {
+    metricKind: 'CUMULATIVE',
+    valueKind: 'int64Value',
+  },
   'http/request_count': {
     metricKind: 'CUMULATIVE',
     valueKind: 'int64Value',
diff --git a/backend/shared/src/websockets/server.ts b/backend/shared/src/websockets/server.ts
index 6c9e7407..b7edb7f8 100644
--- a/backend/shared/src/websockets/server.ts
+++ b/backend/shared/src/websockets/server.ts
@@ -9,11 +9,13 @@ import {
 } from 'common/api/websockets'
 import {IS_LOCAL} from 'common/hosting/constants'
 import {debug} from 'common/logger'
+import * as admin from 'firebase-admin'
 import {isError} from 'lodash'
 import {log, metrics} from 'shared/utils'
 import {RawData, Server as WebSocketServer, WebSocket} from 'ws'
 
 import {Switchboard} from './switchboard'
+import {canSubscribe, holdsForeignTopic} from './topics'
 
 // Extend the type definition locally
 interface HeartbeatWebSocket extends WebSocket {
@@ -60,18 +62,60 @@ function parseMessage(data: RawData): ClientMessage {
   }
 }
 
-function processMessage(ws: HeartbeatWebSocket, data: RawData): ServerMessage<'ack'> {
+// Off until the store apps that predate `identify` have aged out: they can't authenticate, so turning
+// this on stops their live updates. See docs/websocket-auth.md.
+const enforceTopicAuth = () => process.env.WS_ENFORCE_TOPIC_AUTH === 'true'
+
+async function identify(ws: HeartbeatWebSocket, token: string | undefined) {
+  let uid: string | undefined
+  let invalid = false
+  if (token) {
+    try {
+      uid = (await admin.auth().verifyIdToken(token)).uid
+    } catch (err) {
+      debug('Websocket identify failed', err)
+      invalid = true
+    }
+  }
+  // The socket can close while the token is being verified.
+  if (!SWITCHBOARD.clients.has(ws)) return
+
+  if (uid) SWITCHBOARD.identify(ws, uid)
+  else SWITCHBOARD.deidentify(ws)
+
+  // The connection may have just changed hands, so what it held under the last identity goes.
+  if (enforceTopicAuth()) {
+    const client = SWITCHBOARD.getClient(ws)
+    const lost = Array.from(client.subscriptions).filter((topic) => !canSubscribe(topic, uid))
+    SWITCHBOARD.unsubscribe(ws, ...lost)
+  }
+
+  if (invalid) throw new Error('Invalid token.')
+}
+
+function subscribe(ws: HeartbeatWebSocket, topics: string[]) {
+  const {uid} = SWITCHBOARD.getClient(ws)
+  // A refused topic is dropped, not failed: nothing in the older clients handles a failed ack, and
+  // the current one subscribes before its token is verified, then again after.
+  const allowed = enforceTopicAuth() ? topics.filter((topic) => canSubscribe(topic, uid)) : topics
+  SWITCHBOARD.subscribe(ws, ...allowed)
+}
+
+async function processMessage(
+  ws: HeartbeatWebSocket,
+  data: RawData,
+): Promise<ServerMessage<'ack'>> {
   try {
     const msg = parseMessage(data)
     const {type, txid} = msg
     try {
       switch (type) {
         case 'identify': {
-          SWITCHBOARD.identify(ws, msg.uid)
+          await identify(ws, msg.token)
           break
         }
         case 'subscribe': {
-          SWITCHBOARD.subscribe(ws, ...msg.topics)
+          subscribe(ws, msg.topics)
           break
         }
         case 'unsubscribe': {
@@ -177,8 +221,8 @@ export function listen(server: HttpServer, path: string) {
     debug('WS client connected.')
     SWITCHBOARD.connect(ws)
 
-    ws.on('message', (data) => {
-      const result = processMessage(ws, data)
+    ws.on('message', async (data) => {
+      const result = await processMessage(ws, data)
       // mqp: check ws.readyState before sending?
       if (ws.readyState === WebSocket.OPEN) {
         ws.send(JSON.stringify(result))
@@ -190,6 +234,8 @@ export function listen(server: HttpServer, path: string) {
       metrics.inc('ws/connections_terminated')
       metrics.set('ws/open_connections', wss.clients.size)
       debug(`WS client disconnected.`, {code, reason: reason.toString()})
+      const {uid, subscriptions} = SWITCHBOARD.getClient(ws)
+      if (holdsForeignTopic(subscriptions, uid)) metrics.inc('ws/unauthed_private_sessions')
       SWITCHBOARD.disconnect(ws)
     })
 
diff --git a/backend/shared/src/websockets/topics.ts b/backend/shared/src/websockets/topics.ts
new file mode 100644
index 00000000..ba58a46e
--- /dev/null
+++ b/backend/shared/src/websockets/topics.ts
@@ -0,0 +1,40 @@
+import {IS_LOCAL} from 'common/hosting/constants'
+
+const PUBLIC_TOPICS = [/^user\/[^/]+\/comment$/, /^vote\/[^/]+\/comment$/]
+
+// One capture group: the member the topic belongs to.
+const OWNED_TOPICS = [
+  /^user\/([^/]+)$/,
+  /^private-user\/([^/]+)$/,
+  /^user-notifications\/([^/]+)$/,
+  /^private-user-messages\/([^/]+)(?:\/typing)?$/,
+]
+
+// What the web hooks subscribe to while nobody is signed in. Nothing is ever broadcast on these.
+const PLACEHOLDER_OWNERS = ['_', 'undefined']
+
+const topicOwner = (topic: string) => {
+  for (const pattern of OWNED_TOPICS) {
+    const owner = topic.match(pattern)?.[1]
+    if (owner) return owner
+  }
+  return undefined
+}
+
+/**
+ * Whether a connection identified as `uid` may listen to `topic`. Closed by default: a new topic is
+ * refused until it is listed above, so forgetting to classify one cannot make it public.
+ */
+export const canSubscribe = (topic: string, uid: string | undefined) => {
+  if (topic === '*') return IS_LOCAL
+  if (PUBLIC_TOPICS.some((pattern) => pattern.test(topic))) return true
+  const owner = topicOwner(topic)
+  return owner !== undefined && owner === uid
+}
+
+/** Whether a session is listening to a real member's private topic without being that member. */
+export const holdsForeignTopic = (topics: Iterable<string>, uid: string | undefined) =>
+  Array.from(topics).some((topic) => {
+    const owner = topicOwner(topic)
+    return owner !== undefined && owner !== uid && !PLACEHOLDER_OWNERS.includes(owner)
+  })
diff --git a/backend/shared/tests/unit/websockets.unit.test.ts b/backend/shared/tests/unit/websockets.unit.test.ts
new file mode 100644
index 00000000..775b7601
--- /dev/null
+++ b/backend/shared/tests/unit/websockets.unit.test.ts
@@ -0,0 +1,176 @@
+import {createServer, Server} from 'node:http'
+import {AddressInfo} from 'node:net'
+
+import {broadcast, listen} from 'shared/websockets/server'
+import {canSubscribe, holdsForeignTopic} from 'shared/websockets/topics'
+import {WebSocket} from 'ws'
+
+jest.mock('firebase-admin', () => ({
+  auth: () => ({
+    verifyIdToken: async (token: string) => {
+      if (!token.startsWith('valid-')) throw new Error('bad token')
+      return {uid: token.replace('valid-', '')}
+    },
+  }),
+}))
+
+describe('canSubscribe', () => {
+  it.each([
+    'user/alice',
+    'private-user/alice',
+    'user-notifications/alice',
+    'private-user-messages/alice',
+    'private-user-messages/alice/typing',
+  ])('limits %s to its owner', (topic) => {
+    expect(canSubscribe(topic, 'alice')).toBe(true)
+    expect(canSubscribe(topic, 'mallory')).toBe(false)
+    expect(canSubscribe(topic, undefined)).toBe(false)
+  })
+
+  it.each(['user/alice/comment', 'vote/12/comment'])('leaves %s public', (topic) => {
+    expect(canSubscribe(topic, undefined)).toBe(true)
+  })
+
+  it('refuses a topic it does not know', () => {
+    expect(canSubscribe('some-new-topic/alice', 'alice')).toBe(false)
+  })
+})
+
+describe('holdsForeignTopic', () => {
+  it('ignores own, public and signed-out placeholder topics', () => {
+    const topics = ['user/alice', 'vote/1/comment', 'user/_', 'user-notifications/undefined']
+    expect(holdsForeignTopic(topics, 'alice')).toBe(false)
+  })
+
+  it('flags another member’s private topic', () => {
+    expect(holdsForeignTopic(['user-notifications/alice'], undefined)).toBe(true)
+    expect(holdsForeignTopic(['user-notifications/alice'], 'mallory')).toBe(true)
+  })
+})
+
+describe('websocket server', () => {
+  let server: Server
+  let wss: ReturnType<typeof listen>
+  let sockets: WebSocket[]
+  let txid = 0
+
+  const connect = async () => {
+    const port = (server.address() as AddressInfo).port
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/ws`)
+    sockets.push(ws)
+    const received: any[] = []
+    ws.on('message', (raw) => {
+      const msg = JSON.parse(raw.toString())
+      if (msg.type === 'broadcast') received.push(msg)
+    })
+    await new Promise((resolve) => ws.once('open', resolve))
+    const send = (msg: object) =>
+      new Promise<any>((resolve) => {
+        const id = txid++
+        const onMessage = (raw: Buffer) => {
+          const reply = JSON.parse(raw.toString())
+          if (reply.type === 'ack' && reply.txid === id) {
+            ws.off('message', onMessage)
+            resolve(reply)
+          }
+        }
+        ws.on('message', onMessage)
+        ws.send(JSON.stringify({...msg, txid: id}))
+      })
+    return {send, received}
+  }
+
+  // Sent last: its arrival shows every earlier broadcast on the same socket has been delivered.
+  const flush = async (client: Awaited<ReturnType<typeof connect>>) => {
+    await client.send({type: 'subscribe', topics: ['vote/flush/comment']})
+    broadcast('vote/flush/comment', {})
+    await new Promise<void>((resolve) => {
+      const check = () =>
+        client.received.some((m) => m.topic === 'vote/flush/comment')
+          ? resolve()
+          : setTimeout(check, 5)
+      check()
+    })
+    return client.received.filter((m) => m.topic !== 'vote/flush/comment')
+  }
+
+  const secret = 'user-notifications/alice'
+
+  beforeEach(async () => {
+    sockets = []
+    server = createServer()
+    wss = listen(server, '/ws')
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  })
+
+  afterEach(async () => {
+    delete process.env.WS_ENFORCE_TOPIC_AUTH
+    sockets.forEach((ws) => ws.terminate())
+    wss.close()
+    await new Promise((resolve) => server.close(resolve))
+  })
+
+  describe('with enforcement on', () => {
+    beforeEach(() => {
+      process.env.WS_ENFORCE_TOPIC_AUTH = 'true'
+    })
+
+    it('keeps an anonymous connection off a private topic, and still acks', async () => {
+      const client = await connect()
+      const ack = await client.send({type: 'subscribe', topics: [secret]})
+      expect(ack.success).toBe(true)
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toEqual([])
+    })
+
+    it('ignores the claimed uid and goes by the token', async () => {
+      const client = await connect()
+      await client.send({type: 'identify', uid: 'alice', token: 'valid-mallory'})
+      await client.send({type: 'subscribe', topics: [secret]})
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toEqual([])
+    })
+
+    it('refuses an identify with a bad token', async () => {
+      const client = await connect()
+      const ack = await client.send({type: 'identify', uid: 'alice', token: 'forged'})
+      expect(ack.success).toBe(false)
+      await client.send({type: 'subscribe', topics: [secret]})
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toEqual([])
+    })
+
+    it('delivers to the owner', async () => {
+      const client = await connect()
+      await client.send({type: 'identify', uid: 'alice', token: 'valid-alice'})
+      await client.send({type: 'subscribe', topics: [secret]})
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toHaveLength(1)
+    })
+
+    it('drops private topics on sign-out', async () => {
+      const client = await connect()
+      await client.send({type: 'identify', uid: 'alice', token: 'valid-alice'})
+      await client.send({type: 'subscribe', topics: [secret]})
+      await client.send({type: 'identify', uid: ''})
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toEqual([])
+    })
+
+    it('drops the old member’s topics when the connection changes hands', async () => {
+      const client = await connect()
+      await client.send({type: 'identify', uid: 'alice', token: 'valid-alice'})
+      await client.send({type: 'subscribe', topics: [secret]})
+      await client.send({type: 'identify', uid: 'bob', token: 'valid-bob'})
+      broadcast(secret, {notification: 'private'})
+      expect(await flush(client)).toEqual([])
+    })
+  })
+
+  it('keeps today’s behaviour for old clients until enforcement is on', async () => {
+    const client = await connect()
+    await client.send({type: 'subscribe', topics: [secret]})
+    broadcast(secret, {notification: 'private'})
+    expect(await flush(client)).toHaveLength(1)
+  })
+})
diff --git a/backend/supabase/migration.sql b/backend/supabase/migration.sql
index 05491d3a..d536acee 100644
--- a/backend/supabase/migration.sql
+++ b/backend/supabase/migration.sql
@@ -98,4 +98,5 @@ BEGIN;
 \i backend/supabase/migrations/20261029_private_votes_and_stars.sql
 \i backend/supabase/migrations/20261031_compatibility_scores_prompt.sql
 \i backend/supabase/migrations/20261102_add_vote_edits.sql
+\i backend/supabase/migrations/20261105_lock_user_notifications.sql
 COMMIT;
diff --git a/backend/supabase/migrations/20261105_lock_user_notifications.sql b/backend/supabase/migrations/20261105_lock_user_notifications.sql
new file mode 100644
index 00000000..47453a2e
--- /dev/null
+++ b/backend/supabase/migrations/20261105_lock_user_notifications.sql
@@ -0,0 +1,13 @@
+-- user_notifications was still readable with the anon key, so anyone could pull every member's
+-- notifications, the same data the websocket topic `user-notifications/<uid>` is now restricted to
+-- its owner for. The web reads them through the `get-notifications` endpoint and every write comes
+-- from the service-role backend, so nothing depends on the client grant.
+--
+-- The revoke is what closes this. The policy name is a best guess, in case prod has one: it does not
+-- matter if it is named differently, as a policy cannot grant what the role has no privilege for.
+
+drop policy if exists "public read" on user_notifications;
+
+revoke select on table user_notifications from anon, authenticated;
+
+notify pgrst, 'reload schema';
diff --git a/common/src/api/websocket-client.ts b/common/src/api/websocket-client.ts
index 66039317..0c04291c 100644
--- a/common/src/api/websocket-client.ts
+++ b/common/src/api/websocket-client.ts
@@ -30,6 +30,8 @@ export function formatState(state: ReadyState) {
   }
 }
 
+export type RealtimeIdentity = {uid: string; token: string}
+
 export type BroadcastHandler = (msg: ServerMessage<'broadcast'>) => void
 
 type OutstandingTxn = {
@@ -51,12 +53,19 @@ export class APIRealtimeClient {
   subscriptions: Map<string, BroadcastHandler[]>
   connectTimeout?: NodeJS.Timeout
   heartbeat?: number | undefined
+  getIdentity?: () => Promise<RealtimeIdentity | undefined>
+  identified: boolean
+  // identify calls run one at a time, so a slow sign-in cannot land after the sign-out that followed
+  identityQueue: Promise<void>
 
-  constructor(url: string) {
+  constructor(url: string, getIdentity?: () => Promise<RealtimeIdentity | undefined>) {
     this.url = url
     this.txid = 0
     this.txns = new Map()
     this.subscriptions = new Map()
+    this.getIdentity = getIdentity
+    this.identified = false
+    this.identityQueue = Promise.resolve()
     this.connect()
   }
 
@@ -92,11 +101,9 @@ export class APIRealtimeClient {
           this.sendMessage('ping', {}).catch(console.error)
         }
       }, 25000)
-      if (this.subscriptions.size > 0) {
-        this.sendMessage('subscribe', {
-          topics: Array.from(this.subscriptions.keys()),
-        }).catch(console.error)
-      }
+      this.identified = false
+      this.resubscribe().catch(console.error)
+      this.refreshIdentity()
     }
     this.ws.onclose = (ev) => {
       // note that if the connection closes due to an error, onerror fires and then this
@@ -194,8 +201,27 @@ export class APIRealtimeClient {
     }
   }
 
-  async identify(uid: string) {
-    return await this.sendMessage('identify', {uid})
+  async resubscribe() {
+    if (this.subscriptions.size > 0) {
+      await this.sendMessage('subscribe', {topics: Array.from(this.subscriptions.keys())})
+    }
+  }
+
+  /** Tell the server who is signed in. Call on connect and whenever that changes. */
+  refreshIdentity() {
+    this.identityQueue = this.identityQueue.then(() => this.sendIdentity()).catch(console.error)
+    return this.identityQueue
+  }
+
+  private async sendIdentity() {
+    if (!this.getIdentity) return
+    const identity = await this.getIdentity()
+    if (!identity && !this.identified) return
+    await this.sendMessage('identify', identity ?? {uid: ''})
+    this.identified = !!identity
+    // The server drops private topics it could not yet match to this connection, which includes
+    // anything subscribed while the token was still being verified, so send them again.
+    if (identity) await this.resubscribe()
   }
 
   async subscribe(topics: string[], handler: BroadcastHandler) {
diff --git a/common/src/api/websockets.ts b/common/src/api/websockets.ts
index 04e09dff..96525bcb 100644
--- a/common/src/api/websockets.ts
+++ b/common/src/api/websockets.ts
@@ -4,7 +4,11 @@ export const CLIENT_MESSAGE_SCHEMAS = {
   identify: z.object({
     type: z.literal('identify'),
     txid: z.number(),
+    // Ignored by the server, which takes the identity from `token` alone. Still sent because an API
+    // revision without token support requires the field.
     uid: z.string(),
+    // A Firebase ID token. Leaving it out signs the connection out.
+    token: z.string().optional(),
   }),
   subscribe: z.object({
     type: z.literal('subscribe'),
diff --git a/common/tests/unit/websocket-client.test.ts b/common/tests/unit/websocket-client.test.ts
new file mode 100644
index 00000000..51e65459
--- /dev/null
+++ b/common/tests/unit/websocket-client.test.ts
@@ -0,0 +1,76 @@
+import {APIRealtimeClient, RealtimeIdentity} from 'common/api/websocket-client'
+
+class FakeSocket {
+  static OPEN = 1
+  static CONNECTING = 0
+  static CLOSING = 2
+  static CLOSED = 3
+  static last: FakeSocket
+  readyState = 1
+  sent: any[] = []
+  onopen?: (ev: unknown) => void
+  onmessage?: (ev: {data: string}) => void
+  onclose?: (ev: unknown) => void
+  onerror?: (ev: unknown) => void
+  constructor() {
+    FakeSocket.last = this
+  }
+  close() {}
+  send(raw: string) {
+    const msg = JSON.parse(raw)
+    this.sent.push(msg)
+    // Acked on a later tick, like a real server.
+    setTimeout(() =>
+      this.onmessage?.({data: JSON.stringify({type: 'ack', txid: msg.txid, success: true})}),
+    )
+  }
+}
+
+const sentOfType = (type: string) => FakeSocket.last.sent.filter((m) => m.type === type)
+
+describe('APIRealtimeClient identity', () => {
+  let identity: RealtimeIdentity | undefined
+
+  const open = async () => {
+    const client = new APIRealtimeClient('ws://test', async () => identity)
+    FakeSocket.last.onopen?.({})
+    await client.identityQueue
+    return client
+  }
+
+  beforeEach(() => {
+    ;(global as any).WebSocket = FakeSocket
+    ;(global as any).window = {setInterval: () => 0}
+    identity = {uid: 'alice', token: 'token-1'}
+  })
+
+  afterEach(() => {
+    delete (global as any).WebSocket
+    delete (global as any).window
+  })
+
+  it('identifies on connect, then subscribes again so private topics are not lost', async () => {
+    const client = await open()
+    await client.subscribe(['user/alice'], () => {})
+    await client.refreshIdentity()
+
+    expect(sentOfType('identify').at(-1)).toMatchObject({uid: 'alice', token: 'token-1'})
+    const last = FakeSocket.last.sent.at(-1)
+    expect(last).toMatchObject({type: 'subscribe', topics: ['user/alice']})
+  })
+
+  it('sends a tokenless identify on sign-out', async () => {
+    const client = await open()
+    identity = undefined
+    await client.refreshIdentity()
+
+    const last = sentOfType('identify').at(-1)
+    expect(last.token).toBeUndefined()
+  })
+
+  it('stays quiet for a visitor who never signed in', async () => {
+    identity = undefined
+    await open()
+    expect(sentOfType('identify')).toEqual([])
+  })
+})
diff --git a/docs/database-schema.md b/docs/database-schema.md
index cb6c8435..faf5b579 100644
--- a/docs/database-schema.md
+++ b/docs/database-schema.md
@@ -594,10 +594,11 @@ anyone", in bulk, up to PostgREST's row cap. A `public read ... using (true)` po
 only right for data that is public by design (prompts, options, votes and their results, the
 canonical taxonomies). Every table that says something about a member — `profiles`, `users`,
 `compatibility_scores`, `user_activity`, `profile_stars`, `profile_likes`, `profile_ships`,
-`bookmarked_searches`, `compatibility_answers`, `profile_comments`, every `private_*` table — has
-had its `anon`/`authenticated` SELECT grant revoked (migrations
+`bookmarked_searches`, `compatibility_answers`, `profile_comments`, `user_notifications`, every
+`private_*` table — has had its `anon`/`authenticated` SELECT grant revoked (migrations
 `20260730_cap_profiles_users_reads.sql`, `20260731_lock_activity_stars_compat.sql`,
-`20261028_lock_likes_ships.sql`, `20261028_lock_client_read_tables.sql`). The client reads them one
+`20261028_lock_likes_ships.sql`, `20261028_lock_client_read_tables.sql`,
+`20261105_lock_user_notifications.sql`). The client reads them one
 of two ways:
 
 - **A capped `security definer` RPC** (`get_display_users`, `get_profile_by_user_id`,
diff --git a/docs/websocket-auth.md b/docs/websocket-auth.md
new file mode 100644
index 00000000..c5658167
--- /dev/null
+++ b/docs/websocket-auth.md
@@ -0,0 +1,24 @@
+# WebSocket auth
+
+The API websocket carries a mix of public and private topics. `backend/shared/src/websockets/topics.ts`
+decides who may listen to what, and refuses anything it does not list.
+
+| Topic                                | Who may subscribe |
+| ------------------------------------ | ----------------- |
+| `user/<uid>/comment`                 | Anyone            |
+| `vote/<id>/comment`                  | Anyone            |
+| `user/<uid>`                         | `<uid>` only      |
+| `private-user/<uid>`                 | `<uid>` only      |
+| `user-notifications/<uid>`           | `<uid>` only      |
+| `private-user-messages/<uid>`        | `<uid>` only      |
+| `private-user-messages/<uid>/typing` | `<uid>` only      |
+
+## How a connection is identified
+
+The client sends `identify` with a Firebase ID token on every connect and on every sign-in or sign-out.
+The server verifies the token and takes the uid from it; the `uid` field of the message is ignored.
+An `identify` without a token signs the connection out. The token is only checked at `identify`, which is
+safe because the server closes every connection after 4 minutes and the client reconnects with a fresh one.
+
+A refused topic is dropped and still acked as a success. Older clients have nothing handling a failed ack,
+and the current client subscribes before its token is verified, then again once it is.
diff --git a/web/hooks/use-api-subscription.ts b/web/hooks/use-api-subscription.ts
index 63e396af..6b36a7ba 100644
--- a/web/hooks/use-api-subscription.ts
+++ b/web/hooks/use-api-subscription.ts
@@ -1,9 +1,20 @@
 import {getWebsocketUrl} from 'common/api/utils'
 import {APIRealtimeClient} from 'common/api/websocket-client'
 import {ServerMessage} from 'common/api/websockets'
+import {onAuthStateChanged} from 'firebase/auth'
 import {useEffect} from 'react'
+import {auth} from 'web/lib/firebase/users'
 
-const client = typeof window !== 'undefined' ? new APIRealtimeClient(getWebsocketUrl()) : undefined
+const getIdentity = async () => {
+  await auth.authStateReady()
+  const user = auth.currentUser
+  return user ? {uid: user.uid, token: await user.getIdToken()} : undefined
+}
+
+const client =
+  typeof window !== 'undefined' ? new APIRealtimeClient(getWebsocketUrl(), getIdentity) : undefined
+
+if (client) onAuthStateChanged(auth, () => void client.refreshIdentity())
 
 export type SubscriptionOptions = {
   topics: string[]

From 5f3de362c287687256f897f9b950fca769af1d54 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 12:06:04 +0000
Subject: [PATCH 14/18] Remove anon inserts on `deleted_users`, whose only
 writer is the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/supabase/migration.sql                           | 1 +
 .../migrations/20261105_lock_deleted_users_insert.sql    | 9 +++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 backend/supabase/migrations/20261105_lock_deleted_users_insert.sql

diff --git a/backend/supabase/migration.sql b/backend/supabase/migration.sql
index d536acee..f3403ea6 100644
--- a/backend/supabase/migration.sql
+++ b/backend/supabase/migration.sql
@@ -99,4 +99,5 @@ BEGIN;
 \i backend/supabase/migrations/20261031_compatibility_scores_prompt.sql
 \i backend/supabase/migrations/20261102_add_vote_edits.sql
 \i backend/supabase/migrations/20261105_lock_user_notifications.sql
+\i backend/supabase/migrations/20261105_lock_deleted_users_insert.sql
 COMMIT;
diff --git a/backend/supabase/migrations/20261105_lock_deleted_users_insert.sql b/backend/supabase/migrations/20261105_lock_deleted_users_insert.sql
new file mode 100644
index 00000000..9c5c6bc0
--- /dev/null
+++ b/backend/supabase/migrations/20261105_lock_deleted_users_insert.sql
@@ -0,0 +1,9 @@
+-- deleted_users took inserts from anyone holding the anon key, which let a visitor write fake rows
+-- into the account-deletion reasons. The only writer is `delete-me`, through the service-role
+-- backend, which RLS does not apply to.
+
+drop policy if exists "anyone can insert" on deleted_users;
+
+revoke insert on table deleted_users from anon, authenticated;
+
+notify pgrst, 'reload schema';

From 9b5916a09c16b723625daaa3685c4a234aea7eb6 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 12:15:33 +0000
Subject: [PATCH 15/18] Make profile comment websocket broadcasts
 viewer-neutral, so subscribers refetch with access rules applied.

---
 backend/api/src/create-comment.ts             |  5 ++-
 backend/api/src/hide-comment.ts               |  9 +++--
 .../tests/unit/create-comment.unit.test.ts    |  7 ++--
 .../api/tests/unit/hide-comment.unit.test.ts  | 11 +++----
 backend/shared/src/websockets/helpers.ts      |  8 +++--
 docs/websocket-auth.md                        |  5 +++
 web/hooks/use-comments-on-profile.ts          | 33 +++----------------
 7 files changed, 29 insertions(+), 49 deletions(-)

diff --git a/backend/api/src/create-comment.ts b/backend/api/src/create-comment.ts
index bd2ff193..b50e82cc 100644
--- a/backend/api/src/create-comment.ts
+++ b/backend/api/src/create-comment.ts
@@ -3,7 +3,6 @@ import {assertNotBlocked} from 'api/helpers/blocks'
 import {MAX_COMMENT_JSON_LENGTH, validateCommentAuthor} from 'api/helpers/comment'
 import {APIErrors, APIHandler} from 'api/helpers/endpoint'
 import {Notification} from 'common/notifications'
-import {convertComment} from 'common/supabase/comment'
 import {type Row} from 'common/supabase/utils'
 import {User} from 'common/user'
 import {getNotificationDestinationsForUser} from 'common/user-notification-preferences'
@@ -13,7 +12,7 @@ import {sendNewEndorsementEmail} from 'email/functions/helpers'
 import {createSupabaseDirectClient} from 'shared/supabase/init'
 import {insertNotificationToSupabase} from 'shared/supabase/notifications'
 import {getPrivateUser, getUser} from 'shared/utils'
-import {broadcastUpdatedComment} from 'shared/websockets/helpers'
+import {broadcastProfileCommentsChanged} from 'shared/websockets/helpers'
 
 export {MAX_COMMENT_JSON_LENGTH}
 
@@ -50,7 +49,7 @@ export const createComment: APIHandler<'create-comment'> = async (
       comment.id,
     )
 
-  broadcastUpdatedComment(convertComment(comment))
+  broadcastProfileCommentsChanged(onUser.id)
 
   return {status: 'success'}
 }
diff --git a/backend/api/src/hide-comment.ts b/backend/api/src/hide-comment.ts
index 19fd6a30..2674d6b0 100644
--- a/backend/api/src/hide-comment.ts
+++ b/backend/api/src/hide-comment.ts
@@ -1,9 +1,12 @@
 import {APIErrors, APIHandler} from 'api/helpers/endpoint'
 import {isAdminId} from 'common/envs/constants'
-import {convertComment, convertVoteComment} from 'common/supabase/comment'
+import {convertVoteComment} from 'common/supabase/comment'
 import {Row} from 'common/supabase/utils'
 import {createSupabaseDirectClient} from 'shared/supabase/init'
-import {broadcastUpdatedComment, broadcastUpdatedVoteComment} from 'shared/websockets/helpers'
+import {
+  broadcastProfileCommentsChanged,
+  broadcastUpdatedVoteComment,
+} from 'shared/websockets/helpers'
 
 export const hideComment: APIHandler<'hide-comment'> = async (
   {commentId, hide, commentType},
@@ -50,5 +53,5 @@ export const hideComment: APIHandler<'hide-comment'> = async (
 
   await pg.none(`update profile_comments set hidden = $2 where id = $1`, [commentId, hide])
 
-  broadcastUpdatedComment(convertComment(comment))
+  broadcastProfileCommentsChanged(comment.on_user_id)
 }
diff --git a/backend/api/tests/unit/create-comment.unit.test.ts b/backend/api/tests/unit/create-comment.unit.test.ts
index b29d1ab4..80de3a93 100644
--- a/backend/api/tests/unit/create-comment.unit.test.ts
+++ b/backend/api/tests/unit/create-comment.unit.test.ts
@@ -1,6 +1,5 @@
 import {createComment} from 'api/create-comment'
 import {AuthedUser} from 'api/helpers/endpoint'
-import {convertComment} from 'common/supabase/comment'
 import {sqlMatch} from 'common/test-utils'
 import * as notificationPrefs from 'common/user-notification-preferences'
 import {richTextToString} from 'common/util/parse'
@@ -78,7 +77,6 @@ describe('createComment', () => {
         content: mockContent.content,
         replyToCommentId: mockReplyToCommentId,
       }
-      const mockConvertCommentReturn = 'mockConverComment'
 
       ;(sharedUtils.getUser as jest.Mock)
         .mockResolvedValueOnce(mockCreator)
@@ -91,7 +89,6 @@ describe('createComment', () => {
       ;(notificationPrefs.getNotificationDestinationsForUser as jest.Mock).mockReturnValue(
         mockNotificationDestination,
       )
-      ;(convertComment as jest.Mock).mockReturnValue(mockConvertCommentReturn)
 
       const results = await createComment(mockProps, mockAuth, mockReq)
 
@@ -128,8 +125,8 @@ describe('createComment', () => {
         mockOnUser,
         richTextToString(mockProps.content),
       )
-      expect(websocketHelpers.broadcastUpdatedComment).toBeCalledTimes(1)
-      expect(websocketHelpers.broadcastUpdatedComment).toBeCalledWith(mockConvertCommentReturn)
+      expect(websocketHelpers.broadcastProfileCommentsChanged).toBeCalledTimes(1)
+      expect(websocketHelpers.broadcastProfileCommentsChanged).toBeCalledWith(mockOnUser.id)
     })
   })
 
diff --git a/backend/api/tests/unit/hide-comment.unit.test.ts b/backend/api/tests/unit/hide-comment.unit.test.ts
index b22bba29..4d03c294 100644
--- a/backend/api/tests/unit/hide-comment.unit.test.ts
+++ b/backend/api/tests/unit/hide-comment.unit.test.ts
@@ -1,7 +1,6 @@
 import {AuthedUser} from 'api/helpers/endpoint'
 import {hideComment} from 'api/hide-comment'
 import * as envConsts from 'common/envs/constants'
-import {convertComment} from 'common/supabase/comment'
 import {sqlMatch} from 'common/test-utils'
 import * as supabaseInit from 'shared/supabase/init'
 import * as websocketHelpers from 'shared/websockets/helpers'
@@ -44,11 +43,9 @@ describe('hideComment', () => {
         user_name: 'mockUserName',
         user_username: 'mockUserUsername',
       }
-      const mockConvertedComment = 'mockConvertedCommentValue'
 
       ;(mockPg.oneOrNone as jest.Mock).mockResolvedValue(mockComment)
       jest.spyOn(envConsts, 'isAdminId').mockReturnValue(true)
-      ;(convertComment as jest.Mock).mockReturnValue(mockConvertedComment)
 
       await hideComment(mockProps, mockAuth, mockReq)
 
@@ -59,10 +56,10 @@ describe('hideComment', () => {
       )
       expect(envConsts.isAdminId).toBeCalledTimes(1)
       expect(envConsts.isAdminId).toBeCalledWith(mockAuth.uid)
-      expect(convertComment).toBeCalledTimes(1)
-      expect(convertComment).toBeCalledWith(mockComment)
-      expect(websocketHelpers.broadcastUpdatedComment).toBeCalledTimes(1)
-      expect(websocketHelpers.broadcastUpdatedComment).toBeCalledWith(mockConvertedComment)
+      expect(websocketHelpers.broadcastProfileCommentsChanged).toBeCalledTimes(1)
+      expect(websocketHelpers.broadcastProfileCommentsChanged).toBeCalledWith(
+        mockComment.on_user_id,
+      )
     })
 
     it('should successfully hide the comment if the user is the one who made the comment', async () => {
diff --git a/backend/shared/src/websockets/helpers.ts b/backend/shared/src/websockets/helpers.ts
index 8e93e6a2..b317e783 100644
--- a/backend/shared/src/websockets/helpers.ts
+++ b/backend/shared/src/websockets/helpers.ts
@@ -1,4 +1,4 @@
-import {type ProfileComment, type VoteComment} from 'common/comment'
+import {type VoteComment} from 'common/comment'
 import {type User} from 'common/user'
 
 import {broadcast, broadcastMulti} from './server'
@@ -12,8 +12,10 @@ export function broadcastUpdatedUser(user: Partial<User> & {id: string}) {
   broadcast(`user/${user.id}`, {user})
 }
 
-export function broadcastUpdatedComment(comment: ProfileComment) {
-  broadcast(`user/${comment.onUserId}/comment`, {comment})
+// Carries no comment on purpose: this topic is open to anyone, while who may read a profile's comments
+// depends on the viewer. Subscribers refetch, and `get-profile-comments` applies those rules.
+export function broadcastProfileCommentsChanged(onUserId: string) {
+  broadcast(`user/${onUserId}/comment`, {})
 }
 
 export function broadcastUpdatedVoteComment(comment: VoteComment) {
diff --git a/docs/websocket-auth.md b/docs/websocket-auth.md
index c5658167..c9dd3496 100644
--- a/docs/websocket-auth.md
+++ b/docs/websocket-auth.md
@@ -13,6 +13,11 @@ decides who may listen to what, and refuses anything it does not list.
 | `private-user-messages/<uid>`        | `<uid>` only      |
 | `private-user-messages/<uid>/typing` | `<uid>` only      |
 
+A public topic must not carry anything that depends on the viewer. `user/<uid>/comment` is an empty
+"something changed" signal for that reason: subscribers refetch from `get-profile-comments`, which applies
+the members-only, block and hidden rules. `vote/<id>/comment` still carries the comment, because
+`vote_comments` can be read with the anon key anyway.
+
 ## How a connection is identified
 
 The client sends `identify` with a Firebase ID token on every connect and on every sign-in or sign-out.
diff --git a/web/hooks/use-comments-on-profile.ts b/web/hooks/use-comments-on-profile.ts
index b0cdb17e..aab8bfc0 100644
--- a/web/hooks/use-comments-on-profile.ts
+++ b/web/hooks/use-comments-on-profile.ts
@@ -1,7 +1,3 @@
-import {type Comment} from 'common/comment'
-import {keyBy} from 'lodash'
-import {useEffect, useMemo, useState} from 'react'
-
 import {useAPIGetter} from './use-api-getter'
 import {useApiSubscription} from './use-api-subscription'
 import {useIsAuthorized} from './use-user'
@@ -9,42 +5,23 @@ import {useIsAuthorized} from './use-user'
 /**
  * The comments on a profile, kept current over the websocket.
  *
- * The initial list comes from `get-profile-comments`, which decides what this viewer may see; the
- * subscription then layers on comments created or hidden since. Hidden comments are not returned by
- * the endpoint but can still arrive over the wire (a hide is broadcast as the comment with `hidden`
- * set), which is why the caller still filters on `hidden`.
+ * The list always comes from `get-profile-comments`, which decides what this viewer may see. The
+ * topic is open to anyone, so it only says that something changed, and this refetches.
  */
 export function useLiveCommentsOnProfile(userId: string) {
   // Ask only once the auth state is known. The endpoint is open to visitors, but a signed-in member
   // whose token has not been restored yet would be answered as a visitor — empty for a members-only
   // profile — and `useAPIGetter` does not ask twice for the same props.
   const authorized = useIsAuthorized()
-  const {data} = useAPIGetter(
+  const {data, refresh} = useAPIGetter(
     'get-profile-comments',
     authorized === undefined ? undefined : {userId},
   )
 
-  const [live, setLive] = useState<Comment[]>([])
-  useEffect(() => setLive([]), [userId])
-
   useApiSubscription({
     topics: [`user/${userId}/comment`],
-    onBroadcast: ({data}) => {
-      if (data.comment) {
-        const comment = data.comment as Comment
-        // Newest version of a comment wins, so a hide broadcast replaces the one we have.
-        setLive((live) => [...live.filter((c) => c.id !== comment.id), comment])
-      }
-    },
+    onBroadcast: () => void refresh(),
   })
 
-  return useMemo(() => {
-    const fetched = data?.comments ?? []
-    const liveById = keyBy(live, 'id')
-    const fetchedIds = new Set(fetched.map((c) => c.id))
-    return [
-      ...fetched.map((c) => liveById[c.id] ?? c),
-      ...live.filter((c) => !fetchedIds.has(c.id)),
-    ]
-  }, [data, live])
+  return data?.comments ?? []
 }

From 1079f933024f826676a19459b3c97237ff7b4453 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 12:25:51 +0000
Subject: [PATCH 16/18] Refetch profile comments after posting, so showing your
 own comment doesn't depend on the websocket.

---
 docs/websocket-auth.md                     |  6 +++++-
 web/components/profile-comment-section.tsx |  5 ++++-
 web/components/profile-comments.tsx        | 17 +++++++++++++++--
 web/hooks/use-comments-on-profile.ts       |  5 +++--
 4 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/docs/websocket-auth.md b/docs/websocket-auth.md
index c9dd3496..b487e9d4 100644
--- a/docs/websocket-auth.md
+++ b/docs/websocket-auth.md
@@ -23,7 +23,11 @@ the members-only, block and hidden rules. `vote/<id>/comment` still carries the
 The client sends `identify` with a Firebase ID token on every connect and on every sign-in or sign-out.
 The server verifies the token and takes the uid from it; the `uid` field of the message is ignored.
 An `identify` without a token signs the connection out. The token is only checked at `identify`, which is
-safe because the server closes every connection after 4 minutes and the client reconnects with a fresh one.
+safe because the server closes every connection after 4 minutes, so no identity outlives that.
+
+The client does not reconnect after that close, because it comes with code 1000, which the client reads as
+deliberate. A tab open longer than 4 minutes gets no live updates, so nothing a member needs to see right
+away should depend on a broadcast alone.
 
 A refused topic is dropped and still acked as a success. Older clients have nothing handling a failed ack,
 and the current client subscribes before its token is verified, then again once it is.
diff --git a/web/components/profile-comment-section.tsx b/web/components/profile-comment-section.tsx
index 3c849f78..4cfe5bb1 100644
--- a/web/components/profile-comment-section.tsx
+++ b/web/components/profile-comment-section.tsx
@@ -20,7 +20,8 @@ export const ProfileCommentSection = (props: {
 }) => {
   const {onUser, currentUser, simpleView} = props
   const t = useT()
-  const comments = useLiveCommentsOnProfile(onUser.id).filter((c) => !c.hidden)
+  const {comments: liveComments, refresh} = useLiveCommentsOnProfile(onUser.id)
+  const comments = liveComments.filter((c) => !c.hidden)
   const parentComments = comments.filter((c) => !c.replyToCommentId)
   const commentsByParent = groupBy(comments, (c) => c.replyToCommentId ?? '_')
   const [profile, setProfile] = useState<Profile>(props.profile)
@@ -64,6 +65,7 @@ export const ProfileCommentSection = (props: {
                   className="mb-4 mr-px mt-px"
                   onUserId={onUser.id}
                   trackingLocation={'contract page'}
+                  onPosted={refresh}
                 />
               ) : (
                 /* One compact row, not a panel. This is an invitation, and as a 170px box it
@@ -124,6 +126,7 @@ export const ProfileCommentSection = (props: {
             onUser={onUser}
             showReplies={true}
             inTimeline={false}
+            onPosted={refresh}
           />
         ))}
     </Col>
diff --git a/web/components/profile-comments.tsx b/web/components/profile-comments.tsx
index d041af87..359cb881 100644
--- a/web/components/profile-comments.tsx
+++ b/web/components/profile-comments.tsx
@@ -41,6 +41,8 @@ export function ProfileProfileCommentThread(props: {
   idInUrl?: string
   showReplies?: boolean
   className?: string
+  /** Refetch the thread after a post, so showing the new comment never depends on the websocket. */
+  onPosted?: () => void
 }) {
   const {
     onUser,
@@ -51,6 +53,7 @@ export function ProfileProfileCommentThread(props: {
     idInUrl,
     showReplies,
     className,
+    onPosted,
   } = props
   const [replyToUserInfo, setReplyToUserInfo] = useState<ReplyToUserInfo>()
 
@@ -125,6 +128,7 @@ export function ProfileProfileCommentThread(props: {
             clearReply={clearReply}
             trackingLocation={trackingLocation}
             className="w-full min-w-0 grow"
+            onPosted={onPosted}
           />
         </div>
       )}
@@ -349,9 +353,17 @@ export function ProfileCommentInput(props: {
   parentCommentId?: string
   clearReply?: () => void
   trackingLocation: string
+  onPosted?: () => void
 }) {
-  const {parentCommentId, onUserId, replyToUserInfo, className, clearReply, trackingLocation} =
-    props
+  const {
+    parentCommentId,
+    onUserId,
+    replyToUserInfo,
+    className,
+    clearReply,
+    trackingLocation,
+    onPosted,
+  } = props
   const t = useT()
   const user = useUser()
   const onSubmitComment = useEvent(async (editor: Editor) => {
@@ -366,6 +378,7 @@ export function ProfileCommentInput(props: {
       replyToCommentId: parentCommentId,
     })
     clearReply?.()
+    onPosted?.()
     track('comment', {
       location: trackingLocation,
     })
diff --git a/web/hooks/use-comments-on-profile.ts b/web/hooks/use-comments-on-profile.ts
index aab8bfc0..46deeca4 100644
--- a/web/hooks/use-comments-on-profile.ts
+++ b/web/hooks/use-comments-on-profile.ts
@@ -6,7 +6,8 @@ import {useIsAuthorized} from './use-user'
  * The comments on a profile, kept current over the websocket.
  *
  * The list always comes from `get-profile-comments`, which decides what this viewer may see. The
- * topic is open to anyone, so it only says that something changed, and this refetches.
+ * topic is open to anyone, so it only says that something changed, and this refetches. `refresh` is
+ * for the poster: showing their own comment must not depend on the websocket being up.
  */
 export function useLiveCommentsOnProfile(userId: string) {
   // Ask only once the auth state is known. The endpoint is open to visitors, but a signed-in member
@@ -23,5 +24,5 @@ export function useLiveCommentsOnProfile(userId: string) {
     onBroadcast: () => void refresh(),
   })
 
-  return data?.comments ?? []
+  return {comments: data?.comments ?? [], refresh}
 }

From fb0e69865f071d35a82c7f47f085c1b73ba91ea8 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 13:13:35 +0000
Subject: [PATCH 17/18] Reconnect the websocket after the session limit for
 tabs in use, and refetch what was missed, while letting idle tabs disconnect
 so the API can scale to zero.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/shared/src/websockets/server.ts    |   8 +-
 common/src/api/websocket-client.ts         |  78 ++++++++++++--
 common/src/api/websockets.ts               |   4 +
 common/tests/unit/websocket-client.test.ts | 116 +++++++++++++++++++++
 docs/websocket-auth.md                     |  14 ++-
 web/components/messaging/messages-icon.tsx |   1 +
 web/hooks/use-api-subscription.ts          |   7 ++
 web/hooks/use-comments-on-profile.ts       |   1 +
 web/hooks/use-comments-on-vote.ts          |   1 +
 web/hooks/use-notifications.ts             |   6 +-
 web/hooks/use-private-messages.ts          |   1 +
 web/hooks/use-user.ts                      |  46 ++++----
 12 files changed, 248 insertions(+), 35 deletions(-)

diff --git a/backend/shared/src/websockets/server.ts b/backend/shared/src/websockets/server.ts
index b7edb7f8..c5e13f74 100644
--- a/backend/shared/src/websockets/server.ts
+++ b/backend/shared/src/websockets/server.ts
@@ -6,6 +6,7 @@ import {
   CLIENT_MESSAGE_SCHEMA,
   ClientMessage,
   ServerMessage,
+  WS_MAX_SESSION_MS,
 } from 'common/api/websockets'
 import {IS_LOCAL} from 'common/hosting/constants'
 import {debug} from 'common/logger'
@@ -181,7 +182,6 @@ export function listen(server: HttpServer, path: string) {
   let deadConnectionCleaner: NodeJS.Timeout | undefined
 
   const HEARTBEAT_INTERVAL = 25000 // 25s
-  const MAX_SESSION_DURATION = 4 * 60 * 1000 // 4 minutes
 
   wss.on('listening', () => {
     log.info(`Web socket server listening on ${path}. ${getWebsocketUrl()}`)
@@ -205,14 +205,14 @@ export function listen(server: HttpServer, path: string) {
     ws.isAlive = true
     // debug('Received pong from client');
 
-    // 2. Hard Session Limit: Sever connection after 5 mins to allow Scale-to-Zero
+    // 2. Hard Session Limit: Sever connection after 4 mins to allow Scale-to-Zero
     // This stops bots/idle users from resetting the Cloud Run 15-min idle timer indefinitely.
     const sessionTimeout = setTimeout(() => {
       if (ws.readyState === WebSocket.OPEN) {
-        debug('Closing WS: Max session duration reached (5m)')
+        debug('Closing WS: Max session duration reached')
         ws.close(1000, 'Session limit reached') // 1000 is a normal closure
       }
-    }, MAX_SESSION_DURATION)
+    }, WS_MAX_SESSION_MS)
 
     ws.on('pong', () => (ws.isAlive = true))
 
diff --git a/common/src/api/websocket-client.ts b/common/src/api/websocket-client.ts
index 0c04291c..faf46d66 100644
--- a/common/src/api/websocket-client.ts
+++ b/common/src/api/websocket-client.ts
@@ -1,4 +1,4 @@
-import {ClientMessage, ClientMessageType, ServerMessage} from './websockets'
+import {ClientMessage, ClientMessageType, ServerMessage, WS_MAX_SESSION_MS} from './websockets'
 
 // mqp: useful for debugging
 const VERBOSE_LOGGING = false
@@ -8,6 +8,15 @@ const TIMEOUT_MS = 5000
 
 const RECONNECT_WAIT_MS = 5000
 
+// Spreads out the tabs that all lost their connection at once, after a deploy for instance.
+const RECONNECT_JITTER_MS = 3000
+
+const ACTIVITY_EVENTS = ['pointerdown', 'keydown', 'touchstart', 'scroll', 'focus']
+
+const isTabVisible = () => typeof document === 'undefined' || document.visibilityState === 'visible'
+
+const jitter = () => Math.random() * RECONNECT_JITTER_MS
+
 type ConnectingState = typeof WebSocket.CONNECTING
 type OpenState = typeof WebSocket.OPEN
 type ClosingState = typeof WebSocket.CLOSING
@@ -42,7 +51,12 @@ type OutstandingTxn = {
 
 /** Client for the API websocket realtime server. Automatically manages reconnection
  * and resubscription on disconnect, and allows subscribers to get a callback
- * when something is broadcasted. */
+ * when something is broadcasted.
+ *
+ * It only reconnects for a tab someone is using: visible, with activity during the last session.
+ * An open socket keeps a Cloud Run instance awake, so a forgotten tab has to let go of it, and comes
+ * back on the next sign of life. Broadcasts sent in between are lost, which is what `onReconnect` is
+ * for. */
 export class APIRealtimeClient {
   ws!: WebSocket
   url: string
@@ -57,6 +71,10 @@ export class APIRealtimeClient {
   identified: boolean
   // identify calls run one at a time, so a slow sign-in cannot land after the sign-out that followed
   identityQueue: Promise<void>
+  lastActivity: number
+  closedManually: boolean
+  hasOpened: boolean
+  reconnectHandlers: Set<() => void>
 
   constructor(url: string, getIdentity?: () => Promise<RealtimeIdentity | undefined>) {
     this.url = url
@@ -66,7 +84,43 @@ export class APIRealtimeClient {
     this.getIdentity = getIdentity
     this.identified = false
     this.identityQueue = Promise.resolve()
+    this.lastActivity = Date.now()
+    this.closedManually = false
+    this.hasOpened = false
+    this.reconnectHandlers = new Set()
     this.connect()
+    this.listenForActivity()
+  }
+
+  listenForActivity() {
+    if (typeof window === 'undefined' || !window.addEventListener) return
+    const onActivity = () => this.noteActivity()
+    // Capture, because a scroll inside an element does not bubble up to the window.
+    for (const event of ACTIVITY_EVENTS) {
+      window.addEventListener(event, onActivity, {capture: true, passive: true})
+    }
+    document.addEventListener('visibilitychange', () => {
+      if (isTabVisible()) this.noteActivity()
+    })
+  }
+
+  noteActivity() {
+    this.lastActivity = Date.now()
+    if (this.state === WebSocket.CLOSED && !this.closedManually) {
+      this.waitAndReconnect(jitter())
+    }
+  }
+
+  get inUse() {
+    return isTabVisible() && Date.now() - this.lastActivity < WS_MAX_SESSION_MS
+  }
+
+  /** Runs after a reconnect, not the first connect, to fetch what was broadcast in between. */
+  onReconnect(handler: () => void) {
+    this.reconnectHandlers.add(handler)
+    return () => {
+      this.reconnectHandlers.delete(handler)
+    }
   }
 
   get state() {
@@ -74,6 +128,7 @@ export class APIRealtimeClient {
   }
 
   close() {
+    this.closedManually = true
     this.ws.close(1000, 'Closed manually.')
     clearTimeout(this.connectTimeout)
   }
@@ -89,7 +144,7 @@ export class APIRealtimeClient {
       console.error('API websocket error: ', ev)
       // this can fire without an onclose if this is the first time we ever try
       // to connect, so we need to turn on our reconnect in that case
-      this.waitAndReconnect()
+      if (this.inUse) this.waitAndReconnect()
     }
     this.ws.onopen = (_ev) => {
       if (VERBOSE_LOGGING) {
@@ -103,7 +158,12 @@ export class APIRealtimeClient {
       }, 25000)
       this.identified = false
       this.resubscribe().catch(console.error)
-      this.refreshIdentity()
+      const isReconnect = this.hasOpened
+      this.hasOpened = true
+      // After the identity, so the private topics are live again before anyone refetches.
+      void this.refreshIdentity().then(() => {
+        if (isReconnect) this.reconnectHandlers.forEach((handler) => handler())
+      })
     }
     this.ws.onclose = (ev) => {
       // note that if the connection closes due to an error, onerror fires and then this
@@ -121,19 +181,19 @@ export class APIRealtimeClient {
       }
       this.txns.clear()
 
-      // 1000 is RFC code for normal on-purpose closure
-      if (ev.code !== 1000) {
-        this.waitAndReconnect()
+      // 1000 is also what the server sends at the session limit, so it does not mean we are done.
+      if (!this.closedManually && this.inUse) {
+        this.waitAndReconnect(ev.code === 1000 ? jitter() : RECONNECT_WAIT_MS)
       }
     }
   }
 
-  waitAndReconnect() {
+  waitAndReconnect(delayMs = RECONNECT_WAIT_MS) {
     if (this.connectTimeout == null) {
       this.connectTimeout = setTimeout(() => {
         this.connectTimeout = undefined
         this.connect()
-      }, RECONNECT_WAIT_MS)
+      }, delayMs)
     }
   }
 
diff --git a/common/src/api/websockets.ts b/common/src/api/websockets.ts
index 96525bcb..f01e596f 100644
--- a/common/src/api/websockets.ts
+++ b/common/src/api/websockets.ts
@@ -1,5 +1,9 @@
 import {z} from 'zod'
 
+// The server closes every connection after this long, so idle clients cannot hold a Cloud Run instance
+// awake. The client uses the same figure to decide whether anyone is still there to reconnect for.
+export const WS_MAX_SESSION_MS = 4 * 60 * 1000
+
 export const CLIENT_MESSAGE_SCHEMAS = {
   identify: z.object({
     type: z.literal('identify'),
diff --git a/common/tests/unit/websocket-client.test.ts b/common/tests/unit/websocket-client.test.ts
index 51e65459..67dc8b5d 100644
--- a/common/tests/unit/websocket-client.test.ts
+++ b/common/tests/unit/websocket-client.test.ts
@@ -6,6 +6,7 @@ class FakeSocket {
   static CLOSING = 2
   static CLOSED = 3
   static last: FakeSocket
+  static count = 0
   readyState = 1
   sent: any[] = []
   onopen?: (ev: unknown) => void
@@ -14,6 +15,7 @@ class FakeSocket {
   onerror?: (ev: unknown) => void
   constructor() {
     FakeSocket.last = this
+    FakeSocket.count++
   }
   close() {}
   send(raw: string) {
@@ -74,3 +76,117 @@ describe('APIRealtimeClient identity', () => {
     expect(sentOfType('identify')).toEqual([])
   })
 })
+
+describe('APIRealtimeClient reconnection', () => {
+  const SESSION_MS = 4 * 60 * 1000
+  const ONE_MINUTE = 60 * 1000
+  let listeners: Record<string, () => void>
+  let client: APIRealtimeClient
+
+  const serverCloses = (code = 1000) => {
+    FakeSocket.last.readyState = 3
+    FakeSocket.last.onclose?.({code})
+  }
+  const flushMicrotasks = async () => {
+    for (let i = 0; i < 10; i++) await Promise.resolve()
+  }
+
+  beforeEach(() => {
+    jest.useFakeTimers()
+    listeners = {}
+    const addEventListener = (event: string, handler: () => void) => {
+      listeners[event] = handler
+    }
+    ;(global as any).WebSocket = FakeSocket
+    ;(global as any).window = {setInterval: () => 0, addEventListener}
+    ;(global as any).document = {visibilityState: 'visible', addEventListener}
+    FakeSocket.count = 0
+    client = new APIRealtimeClient('ws://test')
+    FakeSocket.last.onopen?.({})
+  })
+
+  afterEach(() => {
+    jest.useRealTimers()
+    delete (global as any).WebSocket
+    delete (global as any).window
+    delete (global as any).document
+  })
+
+  it('reconnects after the session limit for a tab in use', () => {
+    jest.advanceTimersByTime(ONE_MINUTE)
+    listeners.pointerdown()
+    jest.advanceTimersByTime(SESSION_MS - ONE_MINUTE)
+    serverCloses()
+    jest.advanceTimersByTime(5000)
+    expect(FakeSocket.count).toBe(2)
+  })
+
+  it('lets go of a visible tab nobody has touched', () => {
+    jest.advanceTimersByTime(SESSION_MS)
+    serverCloses()
+    jest.advanceTimersByTime(60 * ONE_MINUTE)
+    expect(FakeSocket.count).toBe(1)
+  })
+
+  it('stops within two sessions of the last activity', () => {
+    jest.advanceTimersByTime(SESSION_MS - 1000)
+    listeners.keydown()
+    jest.advanceTimersByTime(1000)
+    serverCloses()
+    jest.advanceTimersByTime(5000)
+    expect(FakeSocket.count).toBe(2)
+
+    FakeSocket.last.onopen?.({})
+    jest.advanceTimersByTime(SESSION_MS)
+    serverCloses()
+    jest.advanceTimersByTime(60 * ONE_MINUTE)
+    expect(FakeSocket.count).toBe(2)
+  })
+
+  it('comes back on the next activity', () => {
+    jest.advanceTimersByTime(SESSION_MS)
+    serverCloses()
+    listeners.pointerdown()
+    jest.advanceTimersByTime(5000)
+    expect(FakeSocket.count).toBe(2)
+  })
+
+  it('lets go of a hidden tab, and comes back when it is shown', () => {
+    ;(global as any).document.visibilityState = 'hidden'
+    serverCloses()
+    jest.advanceTimersByTime(60 * ONE_MINUTE)
+    expect(FakeSocket.count).toBe(1)
+    ;(global as any).document.visibilityState = 'visible'
+    listeners.visibilitychange()
+    jest.advanceTimersByTime(5000)
+    expect(FakeSocket.count).toBe(2)
+  })
+
+  it('does not retry an abnormal close for a tab nobody is using', () => {
+    jest.advanceTimersByTime(SESSION_MS)
+    serverCloses(1006)
+    jest.advanceTimersByTime(60 * ONE_MINUTE)
+    expect(FakeSocket.count).toBe(1)
+  })
+
+  it('stays closed after a manual close, whatever the activity', () => {
+    client.close()
+    serverCloses()
+    listeners.pointerdown()
+    jest.advanceTimersByTime(5000)
+    expect(FakeSocket.count).toBe(1)
+  })
+
+  it('calls onReconnect after a reconnect but not the first connect', async () => {
+    const handler = jest.fn()
+    client.onReconnect(handler)
+    await flushMicrotasks()
+    expect(handler).not.toBeCalled()
+
+    serverCloses()
+    jest.advanceTimersByTime(5000)
+    FakeSocket.last.onopen?.({})
+    await flushMicrotasks()
+    expect(handler).toBeCalledTimes(1)
+  })
+})
diff --git a/docs/websocket-auth.md b/docs/websocket-auth.md
index b487e9d4..3b63865b 100644
--- a/docs/websocket-auth.md
+++ b/docs/websocket-auth.md
@@ -25,9 +25,17 @@ The server verifies the token and takes the uid from it; the `uid` field of the
 An `identify` without a token signs the connection out. The token is only checked at `identify`, which is
 safe because the server closes every connection after 4 minutes, so no identity outlives that.
 
-The client does not reconnect after that close, because it comes with code 1000, which the client reads as
-deliberate. A tab open longer than 4 minutes gets no live updates, so nothing a member needs to see right
-away should depend on a broadcast alone.
+## Reconnecting
+
+An open socket keeps a Cloud Run instance awake, so the client only reconnects for a tab someone is using:
+visible, with a click, key press, scroll or touch during the last session. Otherwise it stays disconnected
+until the next activity or the tab becoming visible. A forgotten tab lets go within two sessions (8
+minutes) of the last activity, which is what lets the API scale to zero. Abnormal closes follow the same
+rule.
+
+Nothing is replayed, so whatever was broadcast while disconnected is gone. A subscription that shows server
+state should pass `onReconnect` to `useApiSubscription` and refetch there. Background tabs miss live updates
+by design, including the unread count in the tab title, until they are looked at again.
 
 A refused topic is dropped and still acked as a success. Older clients have nothing handling a failed ack,
 and the current client subscribes before its token is verified, then again once it is.
diff --git a/web/components/messaging/messages-icon.tsx b/web/components/messaging/messages-icon.tsx
index d0d4cbe2..da82265c 100644
--- a/web/components/messaging/messages-icon.tsx
+++ b/web/components/messaging/messages-icon.tsx
@@ -28,6 +28,7 @@ export function UnseenMessageChannelsProvider(props: {children: ReactNode}) {
   useApiSubscription({
     topics: ['private-user-messages/' + privateUser?.id],
     onBroadcast: () => refresh(),
+    onReconnect: () => refresh(),
     enabled: !!privateUser,
   })
 
diff --git a/web/hooks/use-api-subscription.ts b/web/hooks/use-api-subscription.ts
index 6b36a7ba..6414c1f9 100644
--- a/web/hooks/use-api-subscription.ts
+++ b/web/hooks/use-api-subscription.ts
@@ -3,6 +3,7 @@ import {APIRealtimeClient} from 'common/api/websocket-client'
 import {ServerMessage} from 'common/api/websockets'
 import {onAuthStateChanged} from 'firebase/auth'
 import {useEffect} from 'react'
+import {useEvent} from 'web/hooks/use-event'
 import {auth} from 'web/lib/firebase/users'
 
 const getIdentity = async () => {
@@ -21,15 +22,21 @@ export type SubscriptionOptions = {
   onBroadcast: (msg: ServerMessage<'broadcast'>) => void
   onError?: (err: Error) => void
   enabled?: boolean
+  /** Refetch here: nothing is replayed, so whatever was broadcast while disconnected is gone. */
+  onReconnect?: () => void
 }
 
 export function useApiSubscription(opts: SubscriptionOptions) {
+  const onReconnect = useEvent(opts.onReconnect)
+
   useEffect(() => {
     const ws = client
     if (ws != null) {
       if (opts.enabled ?? true) {
         ws.subscribe(opts.topics, opts.onBroadcast).catch(opts.onError)
+        const stopListening = ws.onReconnect(onReconnect)
         return () => {
+          stopListening()
           ws.unsubscribe(opts.topics, opts.onBroadcast).catch(opts.onError)
         }
       }
diff --git a/web/hooks/use-comments-on-profile.ts b/web/hooks/use-comments-on-profile.ts
index 46deeca4..e6a58c96 100644
--- a/web/hooks/use-comments-on-profile.ts
+++ b/web/hooks/use-comments-on-profile.ts
@@ -22,6 +22,7 @@ export function useLiveCommentsOnProfile(userId: string) {
   useApiSubscription({
     topics: [`user/${userId}/comment`],
     onBroadcast: () => void refresh(),
+    onReconnect: () => void refresh(),
   })
 
   return {comments: data?.comments ?? [], refresh}
diff --git a/web/hooks/use-comments-on-vote.ts b/web/hooks/use-comments-on-vote.ts
index fe3f9b91..fe7af7f1 100644
--- a/web/hooks/use-comments-on-vote.ts
+++ b/web/hooks/use-comments-on-vote.ts
@@ -36,6 +36,7 @@ export function useLiveCommentsOnVote(voteId: number | undefined, onComment?: ()
   useApiSubscription({
     enabled: voteId !== undefined,
     topics: [`vote/${voteId}/comment`],
+    onReconnect: () => void refresh(),
     onBroadcast: ({data}) => {
       const incoming = data.comment as VoteComment | undefined
       if (!incoming) return
diff --git a/web/hooks/use-notifications.ts b/web/hooks/use-notifications.ts
index f648378e..4f22f68a 100644
--- a/web/hooks/use-notifications.ts
+++ b/web/hooks/use-notifications.ts
@@ -71,14 +71,18 @@ function useNotifications(userId: string, count = 15 * NOTIFICATIONS_PER_PAGE) {
     'notifications-' + userId,
   )
   const {locale} = useLocale()
-  useEffect(() => {
+  const fetchNotifications = () => {
     if (userId)
       api('get-notifications', {limit: count, locale}).then((data) => {
         setNotifications(data)
       })
+  }
+  useEffect(() => {
+    fetchNotifications()
   }, [userId, locale])
   useApiSubscription({
     topics: [`user-notifications/${userId}`],
+    onReconnect: fetchNotifications,
     onBroadcast: ({data}) => {
       setNotifications((notifs) => [data.notification as Notification, ...(notifs ?? [])])
     },
diff --git a/web/hooks/use-private-messages.ts b/web/hooks/use-private-messages.ts
index afbd193b..15289536 100644
--- a/web/hooks/use-private-messages.ts
+++ b/web/hooks/use-private-messages.ts
@@ -59,6 +59,7 @@ export function usePrivateMessages(channelId: number, limit: number, userId: str
       // console.debug('private-user-messages broadcast', channelId)
       fetchMessages()
     },
+    onReconnect: () => fetchMessages(),
   })
 
   return {messages, fetchMessages, setMessages}
diff --git a/web/hooks/use-user.ts b/web/hooks/use-user.ts
index 40c6b5a8..ea7f7ce1 100644
--- a/web/hooks/use-user.ts
+++ b/web/hooks/use-user.ts
@@ -28,8 +28,24 @@ export const useWebsocketUser = (userId: string | undefined) => {
 
   const isPageVisible = useIsPageVisible()
 
+  const fetchUser = () => {
+    if (userId) {
+      getFullUserById(userId)
+        .then((result) => {
+          setUser(result)
+        })
+        .catch(() => {
+          console.error('Failed to fetch user')
+          setUser(null)
+        })
+    } else {
+      setUser(null)
+    }
+  }
+
   useApiSubscription({
     topics: [`user/${userId ?? '_'}`],
+    onReconnect: fetchUser,
     onBroadcast: ({data}) => {
       debug('User broadcast', {data})
       setUser((user) => {
@@ -48,18 +64,7 @@ export const useWebsocketUser = (userId: string | undefined) => {
   useEffect(() => {
     if (!isPageVisible) return
 
-    if (userId) {
-      getFullUserById(userId)
-        .then((result) => {
-          setUser(result)
-        })
-        .catch(() => {
-          console.error('Failed to fetch user')
-          setUser(null)
-        })
-    } else {
-      setUser(null)
-    }
+    fetchUser()
   }, [userId, isPageVisible])
 
   return user
@@ -68,14 +73,19 @@ export const useWebsocketUser = (userId: string | undefined) => {
 export const useWebsocketPrivateUser = (userId: string | undefined) => {
   const [privateUser, setPrivateUser] = useState<PrivateUser | null | undefined>()
 
+  const refetch = () => {
+    getPrivateUserSafe().then((result) => {
+      if (result) {
+        setPrivateUser(result)
+      }
+    })
+  }
+
   useApiSubscription({
     topics: [`private-user/${userId ?? '_'}`],
-    onBroadcast: () => {
-      getPrivateUserSafe().then((result) => {
-        if (result) {
-          setPrivateUser(result)
-        }
-      })
+    onBroadcast: refetch,
+    onReconnect: () => {
+      if (userId) refetch()
     },
   })
 

From 207710a50a1348dd0cd25e1bd7bb65fcd20b39a4 Mon Sep 17 00:00:00 2001
From: MartinBraquet <martin.braquet@gmail.com>
Date: Thu, 5 Nov 2026 13:14:41 +0000
Subject: [PATCH 18/18] Bump @compass/api to 1.94.0.

---
 backend/api/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/api/package.json b/backend/api/package.json
index eceab8cc..541d46fd 100644
--- a/backend/api/package.json
+++ b/backend/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@compass/api",
-  "version": "1.93.1",
+  "version": "1.94.0",
   "private": true,
   "description": "Backend API endpoints",
   "main": "src/serve.ts",