block / block/buzz

Group DMs can never be renamed — no principal ever holds owner/admin on a DM channel, and community owner has no bypass

Open
#4,739 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
32.7k
Forks
4.3k
Avg merge
1d 13h
Merged PRs (30d)
253

Description

**Motivation**

Renaming a group DM is impossible for anyone, by construction:

- The relay creates DM channels under its own identity, and every participant is enrolled with the plain `member` role. No human ever gets `owner` or `admin` on a DM.
- The kind-41 handler (`crates/buzz-relay/src/handlers/side_effects.rs`) requires channel `owner`/`admin` for `name`/`about`/`archived`/`visibility`/`ttl` changes. The only escape hatch is being the NIP-OA owner of an owner-role agent in the channel, which a DM never has either.
- Community ownership doesn't help. There is no `RELAY_OWNER_PUBKEY` bypass in that code path, so even the community owner gets `actor not authorized for name/about/archived/visibility/ttl changes`.
- Desktop is consistent with this: `ChannelManagementSheet.tsx` gates the name editor on `channelType !== "dm"`, so the control never renders.

Net effect: a group DM is stuck displaying as "Group DM (N)" (or the participant list) forever. Ran into this on a self-hosted relay wanting to name a 3-person founders DM. The only working path I found was flipping my role to `owner` directly in Postgres, sending the kind-41 through the relay, then flipping it back. That obviously shouldn't be the supported path.

**Proposed solution**

Let DM participants rename their own DM. Slack's model here is the least surprising: any member of a group DM can set its name, and the name is scoped to that conversation. Concretely, in the kind-41 privileged-tag check, treat `channelType == "dm"` + actor is an active participant as sufficient for the `name` tag (the other privileged tags can stay locked down).

**Alternatives considered**

- Grant the DM creator `owner` at creation time. Works, but resurrects the orphaned-owner problem (#2928) when that identity goes away.
- A community-owner bypass for channel metadata. Broader than needed for this, and #2928 deliberately argues against widening community-owner authority over healthy channels.
- Desktop-side local aliases (client-only names). Avoids relay changes but every participant sees a different name, which defeats the point of naming a shared conversation.

**Additional context**

Related but distinct: #2928 (recovering orphaned channel ownership) and #4225 (owner_only add policy has no admin override). This one differs in that there is no owner to recover — DMs never have one.

Duplicate search: none found for DM renaming specifically.

Contributor guide

Open the contributing guide

Research direction

Start with the kind-41 privileged-tag check in crates/buzz-relay/src/handlers/side_effects.rs, then inspect the DM name-editor gate in ChannelManagementSheet.tsx. Confirm that an active DM participant can change only the name and that the other privileged tags remain restricted; done means the shared DM name can be changed through the relay and the desktop editor is available.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust, typescript
Domain
authorization, backend-api-design, desktop
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.