From b0f9f1dada5793642d3f07e2def40fddd790054f Mon Sep 17 00:00:00 2001
From: Dennis Landmann <landmann@netzkultur.de>
Date: Sun, 19 Apr 2026 22:03:49 +0200
Subject: [PATCH] fix(keysync): silence expected RLS rejections during
 best-effort backfill

---
 apps/desktop/src-tauri/tauri.conf.json      |  2 +-
 apps/desktop/src/lib/conversationKeySync.ts | 27 +++++++++++++++------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index 1148094..a50cb8c 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",
diff --git a/apps/desktop/src/lib/conversationKeySync.ts b/apps/desktop/src/lib/conversationKeySync.ts
index 013768d..6d62289 100644
--- a/apps/desktop/src/lib/conversationKeySync.ts
+++ b/apps/desktop/src/lib/conversationKeySync.ts
@@ -164,14 +164,25 @@ async function syncOneConversationGaps(ctx: SyncCtx, convId: string): Promise<vo
     try {
       await shareConvKeyToDevice(supabase, convId, dev.id, pgHexToBytes(dev.public_key), ownCtx);
     } catch (err: unknown) {
-      // Most common: this device hasn't been wrapped for us yet either, so
-      // tryGetConvKey couldn't unwrap. Another peer with the key will fill
-      // the gap when they hit syncAllExistingGaps.
-      console.warn('keySync: shareConvKeyToDevice gap-fill failed', {
-        convId,
-        recipient: dev.id,
-        err,
-      });
+      // Backfill is best-effort. Common silent failures:
+      //   - This device hasn't been wrapped for us yet either, so
+      //     tryGetConvKey couldn't unwrap (another peer will fill the gap).
+      //   - RLS rejects because the recipient's owner is a pending (not-yet
+      //     accepted) DM member, or has been removed from the conv.
+      // Any of these are recoverable — log only at debug level.
+      const msg = err instanceof Error ? err.message : String(err);
+      const isExpected =
+        msg.includes('does not have it yet') ||
+        msg.includes('row-level security') ||
+        msg.includes('403') ||
+        msg.includes('Forbidden');
+      if (!isExpected) {
+        console.warn('keySync: shareConvKeyToDevice gap-fill failed', {
+          convId,
+          recipient: dev.id,
+          err,
+        });
+      }
     }
   }
 }