Reuse token-free message controls and render posting deliveries once

app/controllers/concerns/authentication/session_lookup.rb

@@ -1,7 +1,7 @@
 module Authentication::SessionLookup
   def find_session_by_cookie
     if token = cookies.signed[:session_token]
-      Session.find_by(token: token)
+      Session.eager_load(:user).find_by(token: token)
     end
   end
 end

app/controllers/concerns/cached_responses.rb

@@ -47,8 +47,6 @@ module CachedResponses
         return yield unless encoding
 
         key = response_cache_key(encoding)
-        original_session = session.to_hash.deep_dup
-
         return yield if key.bytesize > ResponseCache::MAX_KEY_BYTES
 
         entry = ResponseCache.instance.read(key, @response_cache_version)
@@ -57,6 +55,7 @@ module CachedResponses
           ResponseCache.instance.synchronize_render(key, @response_cache_version) do
             entry = ResponseCache.instance.read(key, @response_cache_version)
             if !entry && ResponseCache.instance.version == @response_cache_version
+              original_session = session.to_hash.deep_dup
               yield
               rendered = true
               entry = cache_completed_response(key, original_session, encoding)

app/controllers/messages_controller.rb

@@ -28,7 +28,9 @@ class MessagesController < ApplicationController
     set_room
     @message = @room.messages.create_with_attachment!(message_params)
 
-    @message.broadcast_create
+    # Both deliveries contain the same token-free, viewer-independent markup.
+    @message_html = render_to_string partial: "messages/message", formats: :html, locals: { message: @message }
+    @message.broadcast_create(html: @message_html)
     deliver_webhooks_to_bots
   rescue ActiveRecord::RecordNotFound
     render action: :room_not_found

app/helpers/messages_helper.rb

@@ -63,8 +63,7 @@ module MessagesHelper
     when "sound"
       message_sound_presentation(message)
     else
-      auto_link h(ContentFilters::TextMessagePresentationFilters.apply(message.body.body)),
-        html: { target: "_blank" }, sanitize_options: { tags: AUTO_LINK_ALLOWED_TAGS, attributes: AUTO_LINK_ALLOWED_ATTRIBUTES }
+      text_message_presentation(message.body.body)
     end
   rescue Exception => e
     Sentry.capture_exception(e, extra: { message: message })
@@ -73,7 +72,34 @@ module MessagesHelper
     ""
   end
 
+  # These controls contain URLs and static markup, but no viewer or token state.
+  # Keep them across database commits; attachment controls still render afresh.
+  def cache_message_actions(message, &block)
+    return capture(&block) unless controller.perform_caching && !message.attachment?
+
+    key = fragment_name_with_digest([
+      "message-actions-v1", request.base_url, request.script_name, I18n.locale, message.id, message.room_id
+    ], nil)
+    FragmentCache.store.fetch(key) { capture(&block) }
+  end
+
   private
+    def text_message_presentation(body)
+      render = -> do
+        auto_link h(ContentFilters::TextMessagePresentationFilters.apply(body)),
+          html: { target: "_blank" }, sanitize_options: { tags: AUTO_LINK_ALLOWED_TAGS, attributes: AUTO_LINK_ALLOWED_ATTRIBUTES }
+      end
+
+      # Embedded attachments render database-backed metadata and signed URLs.
+      # Plain text HTML depends only on its content, even after a foreign edit.
+      html = body.to_html
+      if controller.perform_caching && !html.include?("<action-text-attachment") && html.bytesize <= ResponseCache::MAX_ENTRY_BYTES
+        FragmentCache.store.fetch([ "text-presentation-v1", I18n.locale, Digest::SHA256.hexdigest(html) ]) { render.call }
+      else
+        render.call
+      end
+    end
+
     def messages_actions
       "turbo:before-stream-render@document->messages#beforeStreamRender keydown.up@document->messages#editMyLastMessage"
     end

app/models/message/broadcasts.rb

@@ -1,6 +1,6 @@
 module Message::Broadcasts
-  def broadcast_create
-    broadcast_append_to room, :messages, target: [ room, :messages ]
+  def broadcast_create(html: nil)
+    broadcast_append_to room, :messages, target: [ room, :messages ], **(html ? { html: html } : {})
     broadcast_unread_room_later
   end
 

app/views/messages/_actions.html.erb

@@ -1,5 +1,6 @@
 <%# Be sure to check/update messages/_template.html.erb when changing this file %>
 
+<%= cache_message_actions(message) do %>
 <div class="message__actions" data-controller="soft-keyboard">
   <%= tag.details class: "position-relative",
       data: { controller: "popup", action: "keydown.esc->popup#close toggle->popup#toggle click@document->popup#closeOnClickOutside", popup_orientation_top_class: "popup-orientation-top" } do %>
@@ -56,3 +57,4 @@
     </div>
   <% end %>
 </div>
+<% end %>

app/views/messages/create.turbo_stream.erb

@@ -1 +1 @@
-<%= turbo_stream.append dom_id(@message.room, :messages), @message %>
+<%= turbo_stream.append dom_id(@message.room, :messages), @message_html %>