fix(keysync): silence expected RLS rejections during best-effort backfill

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",

apps/desktop/src/lib/conversationKeySync.ts

@@ -164,9 +164,19 @@ async function syncOneConversationGaps(ctx: SyncCtx, convId: string): Promise<vo
     try {
       await shareConvKeyToDevice(supabase, convId, dev.id, pgHexToBytes(dev.public_key), ownCtx);
     } catch (err: unknown) {
-      // Most common: this device hasn't been wrapped for us yet either, so
+      // Backfill is best-effort. Common silent failures:
-      // tryGetConvKey couldn't unwrap. Another peer with the key will fill
+      //   - This device hasn't been wrapped for us yet either, so
-      // the gap when they hit syncAllExistingGaps.
+      //     tryGetConvKey couldn't unwrap (another peer will fill the gap).
+      //   - RLS rejects because the recipient's owner is a pending (not-yet
+      //     accepted) DM member, or has been removed from the conv.
+      // Any of these are recoverable — log only at debug level.
+      const msg = err instanceof Error ? err.message : String(err);
+      const isExpected =
+        msg.includes('does not have it yet') ||
+        msg.includes('row-level security') ||
+        msg.includes('403') ||
+        msg.includes('Forbidden');
+      if (!isExpected) {
         console.warn('keySync: shareConvKeyToDevice gap-fill failed', {
           convId,
           recipient: dev.id,
@@ -174,6 +184,7 @@ async function syncOneConversationGaps(ctx: SyncCtx, convId: string): Promise<vo
         });
       }
     }
+  }
 }
 
 async function wrapForOneDevice(

apps/desktop/src/lib/osNotify.ts

@@ -4,6 +4,8 @@ import {
   sendNotification,
 } from '@tauri-apps/plugin-notification';
 
+import { isTauriRuntime } from './globalShortcut';
+
 // Tracks whether permission has already been requested this session so we
 // don't spam the OS prompt. Actual permission state lives in the OS.
 let permissionChecked = false;
@@ -12,6 +14,11 @@ let permissionGranted = false;
 export async function ensureNotificationPermission(): Promise<boolean> {
   if (permissionChecked) return permissionGranted;
   permissionChecked = true;
+  if (!isTauriRuntime()) {
+    // Web preview / Chrome — Tauri notification plugin not available.
+    permissionGranted = false;
+    return false;
+  }
   try {
     let granted = await isPermissionGranted();
     if (!granted) {
@@ -20,7 +27,6 @@ export async function ensureNotificationPermission(): Promise<boolean> {
     }
     permissionGranted = granted;
   } catch (err: unknown) {
-    // Not running under Tauri (e.g. web preview) — fall back silently.
     permissionGranted = false;
     console.warn('notification permission check failed', err);
   }
@@ -40,6 +46,7 @@ interface NotifyOpts {
 
 export async function notify({ title, body, force = false }: NotifyOpts): Promise<void> {
   if (!force && isAppFocused()) return;
+  if (!isTauriRuntime()) return;
   const granted = await ensureNotificationPermission();
   if (!granted) return;
   try {

packages/shared/src/chat/convKeys.ts

@@ -161,7 +161,10 @@ export async function bootstrapConvKey(
     });
   }
 
-  const { error } = await rawFrom(client, 'conversation_keys').insert(rows);
+  const { error } = await rawFrom(client, 'conversation_keys').upsert(rows, {
+    onConflict: 'conversation_id,recipient_device_id,key_version',
+    ignoreDuplicates: true,
+  });
   if (error) throw error;
 
   const handle = { conversationId, keyVersion, key: convKey };
@@ -262,15 +265,21 @@ export async function shareConvKeyToDevice(
     recipientPublicKey,
     own.privateKey,
   );
-  const { error } = await rawFrom(client, 'conversation_keys').insert({
+  const { error } = await rawFrom(client, 'conversation_keys').upsert(
+    {
       conversation_id: conversationId,
       recipient_device_id: recipientDeviceId,
       key_version: version,
       sender_device_id: own.deviceId,
       encrypted_key: bytesToPgHex(wrapped.ciphertext),
       nonce: bytesToPgHex(wrapped.nonce),
-  });
+    },
-  if (error && !String(error.message ?? '').includes('duplicate')) throw error;
+    {
+      onConflict: 'conversation_id,recipient_device_id,key_version',
+      ignoreDuplicates: true,
+    },
+  );
+  if (error) throw error;
 }
 
 // Re-exports for convenience.