Enforce Append-Only Conversations

[david-rocca]

Ticket: Enforce Append-Only Conversations

Description,

To improve data integrity and auditability, conversations must be append-only.
This means once a conversation message is created, it cannot be modified.
Any API endpoints or internal logic that allows updating existing conversation messages must be removed or disabled.

Acceptance Criteria / TODOs

Backend Changes

• Remove Update Endpoint:

  • Remove the PUT /api/conversation/:uuid/message route configuration in src/controller/conversation.controller/index.js.
  • Remove the updateMessage function in src/controller/conversation.controller/conversation.controller.js.

• Refactor Repository Layer:

  • Remove the updateConversation method from src/repositories/conversationRepository.js.
  • Update processConversationHistory in src/repositories/conversationRepository.js:
    • Identify where it calls updateConversation (currently when a conversation UUID is present).
    • Change logic to strictly ignore or throw an error if an update is attempted.
    • Ensure it only calls createConversation for new entries.

• Verify Dependencies:

  • Search the codebase for any other references to updateConversation or the PUT endpoint to ensure no other flows rely on modifying messages.

Testing

• Verify API:
  • Attempting to call PUT /api/conversation/:uuid/message should return a 404 Not Found.
• Verify Logic:
  • Existing flows that might trigger processConversationHistory (like updateOrg with conversation data) should still work for new messages but must not update old ones.