feat: integrate durable chat voice transport and deployment assets

control/accounts.py

@@ -92,6 +92,9 @@ class Accounts:
         if 'session_hash' not in {r[1] for r in self.db.execute('PRAGMA table_info(rooms)')}:
             self.db.execute('ALTER TABLE rooms ADD COLUMN session_hash TEXT')
             self.db.commit()
+        if 'conversation_id' not in {r[1] for r in self.db.execute('PRAGMA table_info(rooms)')}:
+            self.db.execute('ALTER TABLE rooms ADD COLUMN conversation_id TEXT')
+            self.db.commit()
         if path != ':memory:':
             os.chmod(path, 0o600)
             for suffix in ('-wal', '-shm'):
@@ -222,7 +225,7 @@ class Accounts:
         with self.lock, self.db:
             self.db.execute('DELETE FROM sessions WHERE hash=?', (token_hash(token),))
 
-    def grant_room(self, user_id, room_name, ttl, session_token):
+    def grant_room(self, user_id, room_name, ttl, session_token, conversation_id=None):
         with self.lock, self.db:
             user = self.get(user_id)
             if not user or user['desired'] == 'deleted' or user['status'] != 'ready':
@@ -234,9 +237,15 @@ class Accounts:
             if session is None:
                 raise ValueError('Invalid session')
             self.db.execute('DELETE FROM rooms WHERE expires_at<=?', (time.time(),))
-            self.db.execute('INSERT INTO rooms(room_name,user_id,expires_at,session_hash) VALUES(?,?,?,?)', (room_name, user_id, min(time.time() + ttl, session['expires_at']), hashed))
+            if conversation_id is not None:
+                # Validate again in the grant transaction: ownership cannot be
+                # bypassed by a race or a caller-selected conversation identifier.
+                conversation = self.db.execute('SELECT id FROM chat_conversations WHERE id=? AND owner=?', (conversation_id, user_id)).fetchone()
+                if conversation is None:
+                    raise ValueError('Conversation unavailable')
+            self.db.execute('INSERT INTO rooms(room_name,user_id,expires_at,session_hash,conversation_id) VALUES(?,?,?,?,?)', (room_name, user_id, min(time.time() + ttl, session['expires_at']), hashed, conversation_id))
 
     def resolve_room(self, room_name):
         with self.lock:
-            row = self.db.execute("SELECT u.* FROM rooms r JOIN users u ON r.user_id=u.id JOIN sessions s ON s.hash=r.session_hash AND s.user_id=u.id WHERE r.room_name=? AND r.expires_at>? AND s.expires_at>? AND u.desired!='deleted' AND u.status='ready'", (room_name, time.time(), time.time())).fetchone()
+            row = self.db.execute("SELECT u.*,r.conversation_id FROM rooms r JOIN users u ON r.user_id=u.id JOIN sessions s ON s.hash=r.session_hash AND s.user_id=u.id WHERE r.room_name=? AND r.expires_at>? AND s.expires_at>? AND u.desired!='deleted' AND u.status='ready'", (room_name, time.time(), time.time())).fetchone()
             return dict(row) if row else None