From 7b60e47c5e51d5b692eb9552a827d5450a066987 Mon Sep 17 00:00:00 2001
From: Vishal Narkhede <vishalnarkhede.iitd@gmail.com>
Date: Thu, 25 May 2023 10:19:35 +0200
Subject: [PATCH] fix: disallow pending message feature on client side (#1127)

---
 src/channel.ts       |  4 ++++
 test/unit/channel.js | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/src/channel.ts b/src/channel.ts
index 156fac20c..ab8c85ff5 100644
--- a/src/channel.ts
+++ b/src/channel.ts
@@ -178,6 +178,10 @@ export class Channel<StreamChatGenerics extends ExtendableGenerics = DefaultGene
       skip_push?: boolean;
     },
   ) {
+    if (options?.is_pending_message !== undefined && !this._client._isUsingServerAuth()) {
+      throw new Error('Setting is_pending_message on client side is not supported');
+    }
+
     const sendMessageResponse = await this.getClient().post<SendMessageAPIResponse<StreamChatGenerics>>(
       this._channelURL() + '/message',
       {
diff --git a/test/unit/channel.js b/test/unit/channel.js
index 281205305..7181d6ede 100644
--- a/test/unit/channel.js
+++ b/test/unit/channel.js
@@ -758,3 +758,35 @@ describe('Channel _initializeState', () => {
 		expect(Object.keys(channel.state.members)).deep.to.be.equal(['alice']);
 	});
 });
+
+describe('pending message', () => {
+	it('should not allow setting is_pending_message from client side', async () => {
+		const client = await getClientWithUser();
+		const channel = client.channel('messaging', uuidv4());
+		try {
+			await channel.sendMessage(
+				{ text: 'hi' },
+				{
+					is_pending_message: true,
+				},
+			);
+		} catch (e) {
+			expect(e.message).to.be.equal('Setting is_pending_message on client side is not supported');
+		}
+
+		const serverClient = new StreamChat('apiKey', 'secret');
+		serverClient.post = () =>
+			new Promise((resolve) => {
+				resolve(true);
+			});
+		const serverChannel = serverClient.channel('messaging', uuidv4());
+		const response = await serverChannel.sendMessage(
+			{ text: 'hi' },
+			{
+				is_pending_message: true,
+			},
+		);
+
+		expect(response).to.be.equal(true);
+	});
+});