fix(webapp): keep the retired chats.messages column, and allow Google SSO avatars

Dropping the column was irreversible and blocked on a production row count; retiring it is not. The avatar host is an exact origin the app already knows, like the GitHub one.

Author: kathiekiwi

apps/webapp/app/utils/cspImageOrigins.test.ts

@@ -75,16 +75,17 @@ describe("parseCspImageOrigins", () => {
 });
 
 describe("buildImgSrcDirective", () => {
-  it("is self, data, blob and the GitHub avatar host by default", () => {
+  it("is self, data, blob and the SSO avatar hosts by default", () => {
     expect(buildImgSrcDirective()).toBe(
-      "img-src 'self' data: blob: https://avatars.githubusercontent.com"
+      "img-src 'self' data: blob: https://avatars.githubusercontent.com https://lh3.googleusercontent.com"
     );
   });
 
   it("has no wildcard host and no bare scheme host", () => {
     const directive = buildImgSrcDirective(parseCspImageOrigins("https://sso.example.com").origins);
     expect(directive).not.toContain("*");
-    expect(directive).not.toContain("googleusercontent.com");
+    // The avatar hosts are exact origins; a wildcard over them would not be.
+    expect(directive).not.toContain("*.googleusercontent.com");
     expect(directive).not.toMatch(/(^|\s)https?:(\s|$)/);
   });
 

apps/webapp/app/utils/cspImageOrigins.ts

@@ -4,12 +4,13 @@
  * no wildcard host, no bare scheme, nothing with a path.
  */
 
-/** Always allowed: own origin, inline data, object URLs, and the GitHub avatar host. */
+/** Always allowed: own origin, inline data, object URLs, and the SSO avatar hosts. */
 export const BASE_IMG_SRC_SOURCES = [
   "'self'",
   "data:",
   "blob:",
   "https://avatars.githubusercontent.com",
+  "https://lh3.googleusercontent.com",
 ] as const;
 
 export type RejectedOrigin = { value: string; reason: string };

apps/webapp/test/dashboardAgentImageCsp.test.ts

@@ -36,7 +36,7 @@ describe("document image CSP", () => {
 
   it("builds the directive from the configured allowlist, not a wildcard literal", () => {
     expect(source).toContain("parseCspImageOrigins(env.CSP_IMG_SRC_ALLOWLIST");
-    expect(source).not.toContain("googleusercontent.com");
+    expect(source).not.toContain("*.googleusercontent.com");
   });
 
   it("keeps a route's own img-src", () => {

apps/webapp/test/dashboardAgentLegacyMessagesColumn.test.ts

@@ -3,12 +3,14 @@ import path from "node:path";
 import { describe, expect, it } from "vitest";
 
 /**
- * `chats.messages` is gone: the transcript lives in `chat_messages`, one row per message.
+ * `chats.messages` is retired, not dropped: the transcript lives in `chat_messages`, one
+ * row per message, and the column stays declared so whatever a deployed environment
+ * already wrote remains readable.
  *
- * TypeScript already catches a reference through the Drizzle schema — the column isn't
- * there, so it doesn't compile. A raw-SQL reference compiles fine and fails at runtime,
- * which is the hole this scan covers. Zero hits today is the point; the test exists so a
- * reintroduction is caught rather than deployed.
+ * Retired means nothing reads or writes it. The column being declared is exactly why this
+ * scan matters — the compiler no longer refuses a reference to it, in Drizzle or in raw
+ * SQL. Zero hits today is the point; the test exists so a reintroduction is caught rather
+ * than deployed.
  */
 
 const ROOT = path.resolve(__dirname, "../../..");
@@ -25,7 +27,7 @@ const SCANNED = [
  * aliased table (`from chats c … c.messages`). Migrations are skipped on purpose.
  */
 
-/** A qualified reference to the dropped column, in any of the spellings Postgres accepts. */
+/** A qualified reference to the retired column, in any of the spellings Postgres accepts. */
 const QUALIFIED = /"?\bchats"?\s*\.\s*"?messages"?/i;
 
 /** An unqualified one, inside a literal that is plainly SQL against `chats`. */
@@ -74,7 +76,7 @@ function offences(file: string): string[] {
   return offencesForText(readFileSync(file, "utf8"), path.relative(ROOT, file));
 }
 
-describe("the dropped chats.messages column", () => {
+describe("the retired chats.messages column", () => {
   it("is not referenced by any production source, including in raw SQL", () => {
     const files = SCANNED.flatMap((dir) => sourceFiles(path.join(ROOT, dir)));
     // A scan that found nothing to read would pass vacuously.

internal-packages/dashboard-agent-db/drizzle/0002_watches_and_chat_messages.sql

@@ -86,8 +86,6 @@ CREATE TABLE "trigger_dashboard_agent"."watches" (
 	"cadence_minutes" integer GENERATED ALWAYS AS (((spec ->> 'checkEveryMinutes')::int)) STORED
 );
 --> statement-breakpoint
-ALTER TABLE "trigger_dashboard_agent"."chats" DROP COLUMN IF EXISTS "messages";
---> statement-breakpoint
 ALTER TABLE "trigger_dashboard_agent"."chats" ADD COLUMN IF NOT EXISTS "last_read_at" timestamp with time zone;
 --> statement-breakpoint
 ALTER TABLE "trigger_dashboard_agent"."chats" ADD COLUMN IF NOT EXISTS "next_message_position" integer DEFAULT 1 NOT NULL;

internal-packages/dashboard-agent-db/drizzle/meta/0002_snapshot.json

@@ -490,6 +490,13 @@
           "primaryKey": false,
           "notNull": true,
           "default": "now()"
+        },
+        "messages": {
+          "name": "messages",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
         }
       },
       "indexes": {

internal-packages/dashboard-agent-db/src/schema.ts

@@ -30,6 +30,12 @@ export const chats = dashboardAgentSchema.table(
     userId: text("user_id").notNull(),
     title: text("title").notNull().default("New chat"),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
+    /**
+     * @deprecated The transcript lives in `chat_messages`. Declared so drizzle doesn't
+     * offer to drop it: whatever a deployed environment already wrote stays readable
+     * until someone decides it isn't needed. Nothing reads or writes it.
+     */
+    messages: jsonb("messages").$type<unknown[]>().notNull().default([]),
     pinnedAt: timestamp("pinned_at", { withTimezone: true }),
     // NULL means never read, so everything in the chat counts as unread.
     lastReadAt: timestamp("last_read_at", { withTimezone: true }),