feat: add contacts management and thread resolution

[AchoArnold]

Summary

• add contact CRUD, one-or-many JSON creation, CSV import, validation, Swagger, and cached phone-to-contact resolution
• add the Contacts management page with server-side search/pagination and add/edit/delete/import dialogs
• display resolved contact names in message threads and add Contacts navigation

Testing

• cd api && go test -vet=off ./...
• cd api && go build ./...
• cd web && pnpm lint
• cd web && pnpm generate

[codacy-production]

Not up to standards ⛔

🔴 Issues 50 minor

Alerts:
⚠ 50 issues (≤ 0 issues of at least minor severity)

Results:
50 new issues

Category	Results
CodeStyle	50 minor

View in Codacy

🟢 Metrics 518 complexity · 201 duplication

Metric	Results
Complexity	518
Duplication	201

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[greptile-apps]

Greptile Summary

This PR introduces a full contacts management feature: a new Contact entity with CRUD endpoints, CSV import, cached phone-to-contact name resolution in message threads, and a server-side-paginated contacts page in the web UI.

• Backend: adds ContactRepository, ContactService (with a 24 h per-user cache for the phone→contact map), ContactHandlerValidator (E.164 phone + RFC 5322 email validation, 1000-row batch cap, 500 KB CSV cap), and 5 REST endpoints under /v1/contacts. The MessageThreadService.GetThreads now accepts a WithContacts flag to resolve display names in a single cached lookup.
• Frontend: new contacts Pinia store with generation-based stale-response cancellation and a full pages/contacts/index.vue with add/edit/delete/import dialogs, debounced server-side search, and VDataTableServer pagination. Message thread list and header show resolved contact names when available.

Confidence Score: 3/5

Safe to merge with caution — one data-retention gap needs to be addressed before this goes to production for any deployment that supports account deletion.

The contacts feature is well-structured and thoroughly tested, but DeleteAllForUser is wired to the repository interface and never called on account deletion, unlike every other entity in the codebase. Users who delete their accounts will have their contacts silently retained in the database. Additionally, the ILIKE search passes raw user input as a LIKE pattern without escaping % and _, so a search for _ returns all contacts.

api/pkg/repositories/contact_repository.go and the missing contacts listener file (no listener for UserAccountDeleted was added); api/pkg/repositories/gorm_contact_repository.go for the unescaped LIKE wildcards in the search query.

Important Files Changed

Filename	Overview
api/pkg/repositories/contact_repository.go	ContactRepository interface defines DeleteAllForUser but no listener is wired to call it on UserAccountDeleted, leaving orphaned contact rows when a user is deleted.
api/pkg/repositories/gorm_contact_repository.go	GORM implementation of ContactRepository; ILIKE search passes raw user query as a LIKE pattern without escaping %/_ wildcards, causing overly broad matches for those characters.
api/pkg/services/contact_service.go	ContactService with cache-backed phone→contact map; GetContactMap calls FetchAll with no row limit, which could cause large memory allocations for users with many contacts.
api/pkg/handlers/contact_handler.go	HTTP handler for contact CRUD and CSV upload; correctly validates UUIDs, scopes all operations to the authenticated user, and returns 404 before delete rather than silently succeeding on a 0-row DELETE.
api/pkg/validators/contact_handler_validator.go	Validates JSON and CSV create/update contacts; phone numbers validated with libphonenumber, emails with net/mail, CSV size capped at 500 KB, batch capped at 1000 rows.
api/pkg/entities/contact.go	New Contact entity with JSONB ContactProperties custom scanner/valuer and pq.StringArray for emails/phone_numbers; model is well-structured with correct GORM tags.
api/pkg/services/message_thread_service.go	Adds optional contact resolution to GetThreads via a contactMapProvider interface and the new WithContacts flag; contact lookup errors are logged but don't fail the request.
api/pkg/requests/contact_store.go	ContactStoreRequest with custom UnmarshalJSON supporting both JSON array and wrapped-object formats; SanitizeContactItem deduplicates and normalizes phone/email values.
web/app/stores/contacts.ts	Pinia contacts store with generation-based stale-response cancellation, server-side pagination state tracking, and local optimistic delete.
web/app/pages/contacts/index.vue	Full contacts management page with server-side search/pagination via VDataTableServer, add/edit/delete/import dialogs, debounced search, and inline API error display.
api/pkg/di/container.go	Wires ContactService, ContactRepository, ContactHandler, and ContactHandlerValidator into the DI container; registers AutoMigrate for the contacts table and mounts routes.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant ContactHandler
    participant ContactHandlerValidator
    participant ContactService
    participant ContactRepository
    participant Cache

    Client->>ContactHandler: POST /v1/contacts (JSON array or object)
    ContactHandler->>ContactHandlerValidator: ValidateStore(request)
    ContactHandlerValidator-->>ContactHandler: url.Values (errors)
    ContactHandler->>ContactService: CreateMany(userID, contacts)
    ContactService->>ContactRepository: Store(contacts)
    ContactRepository-->>ContactService: nil
    ContactService->>Cache: Set(key, empty, 24h) [invalidate]
    ContactService-->>ContactHandler: nil
    ContactHandler-->>Client: 201 Created

    Client->>ContactHandler: "GET /v1/threads?contacts=true"
    ContactHandler->>MessageThreadService: "GetThreads(WithContacts=true)"
    MessageThreadService->>ContactService: GetContactMap(userID)
    ContactService->>Cache: Get(key)
    alt cache hit
        Cache-->>ContactService: JSON map
        ContactService-->>MessageThreadService: "map[phone]*Contact"
    else cache miss or invalidated
        Cache-->>ContactService: empty or error
        ContactService->>ContactRepository: FetchAll(userID)
        ContactRepository-->>ContactService: []Contact
        ContactService->>Cache: Set(key, encodedMap, 24h)
        ContactService-->>MessageThreadService: "map[phone]*Contact"
    end
    MessageThreadService-->>ContactHandler: []MessageThread with ContactDetails
    ContactHandler-->>Client: 200 OK

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant ContactHandler
    participant ContactHandlerValidator
    participant ContactService
    participant ContactRepository
    participant Cache

    Client->>ContactHandler: POST /v1/contacts (JSON array or object)
    ContactHandler->>ContactHandlerValidator: ValidateStore(request)
    ContactHandlerValidator-->>ContactHandler: url.Values (errors)
    ContactHandler->>ContactService: CreateMany(userID, contacts)
    ContactService->>ContactRepository: Store(contacts)
    ContactRepository-->>ContactService: nil
    ContactService->>Cache: Set(key, empty, 24h) [invalidate]
    ContactService-->>ContactHandler: nil
    ContactHandler-->>Client: 201 Created

    Client->>ContactHandler: "GET /v1/threads?contacts=true"
    ContactHandler->>MessageThreadService: "GetThreads(WithContacts=true)"
    MessageThreadService->>ContactService: GetContactMap(userID)
    ContactService->>Cache: Get(key)
    alt cache hit
        Cache-->>ContactService: JSON map
        ContactService-->>MessageThreadService: "map[phone]*Contact"
    else cache miss or invalidated
        Cache-->>ContactService: empty or error
        ContactService->>ContactRepository: FetchAll(userID)
        ContactRepository-->>ContactService: []Contact
        ContactService->>Cache: Set(key, encodedMap, 24h)
        ContactService-->>MessageThreadService: "map[phone]*Contact"
    end
    MessageThreadService-->>ContactHandler: []MessageThread with ContactDetails
    ContactHandler-->>Client: 200 OK

Loading

_{Reviews (1): Last reviewed commit: "fix(web): mark contacts headers unsortab..." | Re-trigger Greptile}

[greptile-apps]

DeleteAllForUser never wired to the UserAccountDeleted event

Every other entity in the codebase — billing, Discord, heartbeat, message threads, phone notifications, webhooks, etc. — has a dedicated listener that calls DeleteAllForUser when a UserAccountDeleted event fires (see e.g. billing_listener.go, message_thread_listener.go). The ContactRepository defines this method and ContactService could expose it, but no ContactListener was registered. As a result, all contacts for a deleted user remain in the database indefinitely, constituting a data-retention/compliance gap.

[greptile-apps]

User-supplied query is used verbatim as a LIKE pattern, enabling wildcard leakage

queryPattern is built by concatenating % around the raw query string. If a user includes SQL LIKE wildcard characters (% or _) in their search term, they act as wildcards against the columns. For example, searching _ matches every entry (any single character). The query is parameterized so there is no SQL injection risk, but the semantics are incorrect — a user expecting an exact substring match gets a much broader result. Escaping the user input before inserting it into the pattern fixes this.

Suggested change

	if len(query) > 0 {
	queryPattern := "%" + query + "%"
	if len(query) > 0 {
	escaped := strings.NewReplacer(`%`, `\%`, `_`, `\_`).Replace(query)
	queryPattern := "%" + escaped + "%"

[greptile-apps]

FetchAll loads every contact for a user with no upper bound

GetContactMap calls FetchAll which issues a SELECT * with no LIMIT. On every cache miss or post-mutation rebuild, all of a user's contacts are pulled into memory at once. A power user with tens of thousands of contacts would trigger a very large in-memory allocation and a long-running query. Given the 24 h TTL and the fact that every mutation (create, update, delete) invalidates the cache, heavy writers could trigger this repeatedly within a day. Consider streaming or paginating the build, or at minimum adding an application-level cap with an error when the contact list exceeds a safe threshold.