Tb/messages

[tcbarzyk]

Add member messaging with image attachments
Adds a full one-on-one chat interface between social workers and patients, with support for sending text messages and a single image per send action.

What's included
Chat UI (app/routes/member.tsx)

New protected route at /member/:user rendering a real-time message thread via Firestore
Paginated message loading (load-more on scroll)
Composer with text input, image attachment preview, and single-click send
Displays sender name above received message bubbles
Image lightbox for full-size viewing
Attachment service (app/services/chat_attachment_service.ts)

Validates image file type (JPEG, PNG, WebP) and size before upload
Orchestrates Storage upload + Firestore batch write for text+image sends
Both messages share a clientBatchId / clientOrder so ordering is deterministic
Best-effort Storage cleanup if the Firestore batch fails after upload
Chat config (app/services/chat_settings.ts)

Centralizes allowed MIME types, size cap, Storage root path, and chat summary labels
Firebase rules (firebase/firestore.rules, firebase/storage.rules)

Firestore: reads and writes scoped to chat participants; message edits and deletes blocked
Storage: reads and writes scoped to chat participants; writes restricted to image MIME types and 10 MB cap; deletes blocked
Data model
Chat ID = patient UID. All social workers share the same chat per patient.
Text-only send → 1 Firestore doc (messageType: "text")
Image-only send → 1 Firestore doc (messageType: "image")
Text + image send → 2 Firestore docs in one batch, sharing a clientBatchId

Known limitations (v1)
No client-side image compression
No message deletion flow
Single image per send only; PDFs out of scope
No automated tests for this flowAdd member messaging with image attachments

[tcbarzyk]

some notes;
I modified the dev container config to let me use codex & claude code
there is a summary of changes in in docs/
claude generated some firebase security rules in firebase/ -- these are not put into effect yet and we probably want to do security rules as its own ticket, but they might be a helpful starting point