feat(web): role groups, last seen and unread markers in members, channels and spaces; lock channels without keys

web/src/core-bridge/worker/channelDataKeys.ts

@@ -154,6 +154,14 @@ export async function prepareObject(resource: SavedResource, session: ChannelSes
   const state = states.get(resource.id); if (state) state.objects.push(object);
   return { itemIdBytes: idBytes, itemId, channelId, domain, epoch };
 }
+/** 加密空间里没拿到聊天数据域密钥的频道:成员只能看到频道名,读写都会被拒绝。空间主的新频道首次使用时才初始化密钥,不算锁定 */
+export async function lockedThreads(resource: SavedResource, session: ChannelSession, channels: readonly { id: string; chatEpoch: number }[]): Promise<string[]> {
+  if (resource.mode !== 'enc') return [];
+  const owner = session.can('owner');
+  const missing = (keys: Record<string, string>) => channels.filter(c => !(owner && c.chatEpoch === 0) && !keys[domainId(c.id, 'chat', c.chatEpoch)]).map(c => c.id);
+  const { keys } = await cachedKeys(resource, session, data => missing(data.keys).length === 0);
+  return missing(keys);
+}
 export async function canDecryptRecord(resource: SavedResource, session: ChannelSession, itemId: string): Promise<boolean> {
   if (resource.mode !== 'enc') return true;
   let state = states.get(resource.id); let object = state?.objects.find(o => o.itemId === itemId);