core: share links to channels and verify shared links when connecting (#6810)

* core: share links to channels and verify shared links when connecting * refactor * improve * refactor case * simplify * exctract encodeChatBinding * share api * corrections Co-authored-by: Evgeny <evgeny@poberezkin.com> * tests * verify signature in the tests * drop signature if context does not match on reception * try to test "fake" forward * fix * fix direct chat sharing test * channel test * sign link * rename api * refactor view * chal link item CLI view, tests * clean up * share channel in channel as channel * query plan * fix test * refactor * whitespace * simpler * refactor * dont use partial field update --------- Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
2026-08-29 01:09:15 +00:00 · 2026-04-16 23:48:19 +01:00
parent e2a55291fc
commit 30ae0d864c
21 changed files with 791 additions and 93 deletions
@@ -341,6 +341,7 @@ data ChatCommand
  | APIGetReactionMembers {userId :: UserId, groupId :: GroupId, chatItemId :: ChatItemId, reaction :: MsgReaction}
  | APIPlanForwardChatItems {fromChatRef :: ChatRef, chatItemIds :: NonEmpty ChatItemId}
  | APIForwardChatItems {toChatRef :: ChatRef, sendAsGroup :: ShowGroupAsSender, fromChatRef :: ChatRef, chatItemIds :: NonEmpty ChatItemId, ttl :: Maybe Int}
+  | APIShareChatMsgContent {shareChatRef :: ChatRef, toSendRef :: SendRef}
  | APIUserRead UserId
  | UserRead
  | APIChatRead {chatRef :: ChatRef}
@@ -469,7 +470,7 @@ data ChatCommand
  | AddContact IncognitoEnabled
  | APISetConnectionIncognito Int64 IncognitoEnabled
  | APIChangeConnectionUser Int64 UserId -- new user id to switch connection to
-  | APIConnectPlan {userId :: UserId, connectionLink :: Maybe AConnectionLink} -- Maybe is used to report link parsing failure as special error
+  | APIConnectPlan {userId :: UserId, connectionLink :: Maybe AConnectionLink, linkOwnerSig :: Maybe LinkOwnerSig} -- Maybe AConnectionLink is used to report link parsing failure as special error
  | APIPrepareContact UserId ACreatedConnLink ContactShortLinkData
  | APIPrepareGroup UserId CreatedLinkContact DirectLink GroupShortLinkData
  | APIChangePreparedContactUser ContactId UserId
@@ -500,6 +501,7 @@ data ChatCommand
  | ForwardMessage {toChatName :: ChatName, fromContactName :: ContactName, forwardedMsg :: Text}
  | ForwardGroupMessage {toChatName :: ChatName, fromGroupName :: GroupName, fromMemberName_ :: Maybe ContactName, forwardedMsg :: Text}
  | ForwardLocalMessage {toChatName :: ChatName, forwardedMsg :: Text}
+  | SharePublicGroup {shareGroupName :: GroupName, toChatName :: ChatName}
  | SendMessage SendName Text
  | SendMemberContactMessage GroupName ContactName Text
  | AcceptMemberContact ContactName
@@ -760,6 +762,7 @@ data ChatResponse
  | CRLeftMemberUser {user :: User, groupInfo :: GroupInfo}
  | CRGroupDeletedUser {user :: User, groupInfo :: GroupInfo, msgSigned :: Bool}
  | CRForwardPlan {user :: User, itemsCount :: Int, chatItemIds :: [ChatItemId], forwardConfirmation :: Maybe ForwardConfirmation}
+  | CRChatMsgContent {user :: User, msgContent :: MsgContent}
  | CRRcvFileAccepted {user :: User, chatItem :: AChatItem}
  -- TODO add chatItem :: AChatItem
  | CRRcvFileAcceptedSndCancelled {user :: User, rcvFileTransfer :: RcvFileTransfer}
@@ -1007,14 +1010,14 @@ data ConnectionPlan
  deriving (Show)

 data InvitationLinkPlan
-  = ILPOk {contactSLinkData_ :: Maybe ContactShortLinkData}
+  = ILPOk {contactSLinkData_ :: Maybe ContactShortLinkData, ownerVerification :: Maybe OwnerVerification}
  | ILPOwnLink
  | ILPConnecting {contact_ :: Maybe Contact}
  | ILPKnown {contact :: Contact}
  deriving (Show)

 data ContactAddressPlan
-  = CAPOk {contactSLinkData_ :: Maybe ContactShortLinkData}
+  = CAPOk {contactSLinkData_ :: Maybe ContactShortLinkData, ownerVerification :: Maybe OwnerVerification}
  | CAPOwnLink
  | CAPConnectingConfirmReconnect
  | CAPConnectingProhibit {contact :: Contact}
@@ -1023,13 +1026,18 @@ data ContactAddressPlan
  deriving (Show)

 data GroupLinkPlan
-  = GLPOk {groupSLinkInfo_ :: Maybe GroupShortLinkInfo, groupSLinkData_ :: Maybe GroupShortLinkData}
+  = GLPOk {groupSLinkInfo_ :: Maybe GroupShortLinkInfo, groupSLinkData_ :: Maybe GroupShortLinkData, ownerVerification :: Maybe OwnerVerification}
  | GLPOwnLink {groupInfo :: GroupInfo}
  | GLPConnectingConfirmReconnect
  | GLPConnectingProhibit {groupInfo_ :: Maybe GroupInfo}
  | GLPKnown {groupInfo :: GroupInfo}
  deriving (Show)

+data OwnerVerification
+  = OVVerified
+  | OVFailed {reason :: Text}
+  deriving (Show)
+
 type DirectLink = Bool

 data GroupShortLinkInfo = GroupShortLinkInfo
@@ -1042,11 +1050,11 @@ data GroupShortLinkInfo = GroupShortLinkInfo
 connectionPlanProceed :: ConnectionPlan -> Bool
 connectionPlanProceed = \case
  CPInvitationLink ilp -> case ilp of
-    ILPOk _ -> True
+    ILPOk {} -> True
    ILPOwnLink -> True
    _ -> False
  CPContactAddress cap -> case cap of
-    CAPOk _ -> True
+    CAPOk {} -> True
    CAPOwnLink -> True
    CAPConnectingConfirmReconnect -> True
    CAPContactViaAddress _ -> True
@@ -1631,6 +1639,8 @@ $(JQ.deriveJSON (enumJSON $ dropPrefix "HS") ''HelpSection)

 $(JQ.deriveJSON (sumTypeJSON $ dropPrefix "CLQ") ''ChatListQuery)

+$(JQ.deriveJSON (sumTypeJSON $ dropPrefix "OV") ''OwnerVerification)
+
 $(JQ.deriveJSON (sumTypeJSON $ dropPrefix "ILP") ''InvitationLinkPlan)

 $(JQ.deriveJSON (sumTypeJSON $ dropPrefix "CAP") ''ContactAddressPlan)
@@ -101,6 +101,7 @@ import qualified Simplex.Messaging.Crypto.ShortLink as SL
 import Simplex.Messaging.Crypto.File (CryptoFile (..), CryptoFileArgs (..))
 import qualified Simplex.Messaging.Crypto.File as CF
 import Simplex.Messaging.Crypto.Ratchet (PQEncryption (..), PQSupport (..), pattern IKPQOff, pattern IKPQOn, pattern PQEncOff, pattern PQSupportOff, pattern PQSupportOn)
+import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (base64P)
 import Simplex.Messaging.Protocol (AProtoServerWithAuth (..), AProtocolType (..), MsgFlags (..), NtfServer, ProtoServerWithAuth (..), ProtocolServer, ProtocolType (..), ProtocolTypeI (..), SProtocolType (..), SubscriptionMode (..), UserProtocol, userProtocol)
@@ -690,7 +691,7 @@ processChatCommand vr nm = \case
      gInfo@GroupInfo {groupId, membership} <- withFastStore $ \db -> getGroupInfo db vr user chatId
      when (isNothing scope) $ assertUserGroupRole gInfo GRAuthor
      let (_, ft_) = msgContentTexts mc
-      if prohibitedSimplexLinks gInfo membership ft_
+      if prohibitedSimplexLinks gInfo membership mc ft_
        then throwCmdError ("feature not allowed " <> T.unpack (groupFeatureNameText GFSimplexLinks))
        else do
          -- TODO [knocking] check chat item scope?
@@ -999,7 +1000,13 @@ processChatCommand vr nm = \case
        CTContactConnection -> throwCmdError "not supported"
        where
          prepareMsgReq :: CChatItem c -> CM (Maybe (MsgContent, Maybe CryptoFile))
-          prepareMsgReq (CChatItem _ ci) = forwardMsgContent ci $>>= forwardContent ci
+          prepareMsgReq (CChatItem md ci) = forwardMsgContent ci $>>= forwardContent ci . dropOwnerSig
+            where
+              dropOwnerSig = \case
+                mc@MCChat {text, chatLink}
+                  | SMDSnd <- md, fromChat == toChat -> mc
+                  | otherwise -> MCChat {text, chatLink, ownerSig = Nothing}
+                mc -> mc
          forwardCIFF :: ChatItem c d -> Maybe CIForwardedFrom -> Maybe CIForwardedFrom
          forwardCIFF ChatItem {meta = CIMeta {itemForwarded}} ciff = case itemForwarded of
            Nothing -> ciff
@@ -1067,6 +1074,41 @@ processChatCommand vr nm = \case
            let formattedDate = formatTime defaultTimeLocale "%Y%m%d_%H%M%S" currentDate
            let ext = takeExtension fileName
            pure $ prefix <> formattedDate <> ext
+  APIShareChatMsgContent (ChatRef CTGroup groupId _) toSendRef -> withUser $ \user -> do
+    GroupInfo {groupProfile = gp@GroupProfile {publicGroup}, membership = GroupMember {memberId, memberRole}, groupKeys} <-
+      withFastStore $ \db -> getGroupInfo db vr user groupId
+    case publicGroup of
+      Nothing -> throwCmdError "not a public group"
+      Just PublicGroupProfile {groupLink} -> do
+        let signingKeys = case (memberRole, groupKeys) of
+              (GROwner, Just gk@GroupKeys {groupRootKey = GRKPrivate _}) -> Just gk
+              _ -> Nothing
+        ownerSig <-
+          pure signingKeys $>>= \GroupKeys {memberPrivKey} ->
+            mkLinkOwnerSig memberPrivKey groupLink memberId <$$> shareChatBinding user toSendRef
+        let text = safeDecodeUtf8 $ strEncode groupLink
+        pure $ CRChatMsgContent user MCChat {text, chatLink = MCLGroup groupLink gp, ownerSig}
+    where
+      mkLinkOwnerSig :: ConnectionModeI m => C.PrivateKeyEd25519 -> ConnShortLink m -> MemberId -> (ChatBinding, ByteString) -> LinkOwnerSig
+      mkLinkOwnerSig privKey connLink MemberId {unMemberId} (cbTag, bindingData) =
+        let ownerId = Just $ B64UrlByteString unMemberId
+            cb = encodeChatBinding cbTag bindingData
+            ownerSig = C.sign' privKey $ cb <> smpEncode connLink
+         in LinkOwnerSig {ownerId, chatBinding = B64UrlByteString cb, ownerSig}
+      shareChatBinding :: User -> SendRef -> CM (Maybe (ChatBinding, ByteString))
+      shareChatBinding u = \case
+        SRDirect contactId -> do
+          ct <- withFastStore $ \db -> getContact db vr u contactId
+          forM (contactConn ct) $ \conn ->
+            (CBDirect,) <$> withAgent (`getConnectionRatchetAdHash` aConnId conn)
+        SRGroup toGroupId _ asGroup -> do
+          GroupInfo {groupProfile = GroupProfile {publicGroup}, membership = m} <- withFastStore $ \db -> getGroupInfo db vr u toGroupId
+          pure $ mkBinding m <$> publicGroup
+          where
+            mkBinding GroupMember {memberId} PublicGroupProfile {publicGroupId = pgId}
+              | asGroup = (CBChannel, smpEncode pgId)
+              | otherwise = (CBGroup, smpEncode (pgId, memberId))
+  APIShareChatMsgContent _ _ -> throwCmdError "sharing is only supported for public groups"
  APIUserRead userId -> withUserId userId $ \user -> withFastStore' (`setUserChatsRead` user) >> ok user
  UserRead -> withUser $ \User {userId} -> processChatCommand vr nm $ APIUserRead userId
  APIChatRead chatRef@(ChatRef cType chatId scope_) -> withUser $ \_ -> case cType of
@@ -1933,9 +1975,9 @@ processChatCommand vr nm = \case
          createDirectConnection db newUser agConnId ccLink' Nothing ConnNew Nothing subMode initialChatVersion PQSupportOn
        deleteAgentConnectionAsync (aConnId' conn)
        pure conn'
-  APIConnectPlan userId (Just cLink) -> withUserId userId $ \user ->
-    uncurry (CRConnectionPlan user) <$> connectPlan user cLink
-  APIConnectPlan _ Nothing -> throwChatError CEInvalidConnReq
+  APIConnectPlan userId (Just cLink) linkOwnerSig_ -> withUserId userId $ \user ->
+    uncurry (CRConnectionPlan user) <$> connectPlan user cLink linkOwnerSig_
+  APIConnectPlan _ Nothing _ -> throwChatError CEInvalidConnReq
  APIPrepareContact userId accLink contactSLinkData -> withUserId userId $ \user -> do
    let ContactShortLinkData {profile, message, business} = contactSLinkData
    welcomeSharedMsgId <- forM message $ \_ -> getSharedMsgId
@@ -2176,7 +2218,7 @@ processChatCommand vr nm = \case
  Connect incognito (Just cLink@(ACL m cLink')) -> withUser $ \user -> do
    -- TODO [relays] member: /c api to support groups with relays
    -- TODO   - possibly by going through APIPrepareGroup -> APIConnectPreparedGroup
-    (ccLink, plan) <- connectPlan user cLink `catchAllErrors` \e -> case cLink' of CLFull cReq -> pure (ACCL m (CCLink cReq Nothing), CPInvitationLink (ILPOk Nothing)); _ -> throwError e
+    (ccLink, plan) <- connectPlan user cLink Nothing `catchAllErrors` \e -> case cLink' of CLFull cReq -> pure (ACCL m (CCLink cReq Nothing), CPInvitationLink (ILPOk Nothing Nothing)); _ -> throwError e
    connectWithPlan user incognito ccLink plan
  Connect _ Nothing -> throwChatError CEInvalidConnReq
  APIConnectContactViaAddress userId incognito contactId -> withUserId userId $ \user -> do
@@ -2194,7 +2236,7 @@ processChatCommand vr nm = \case
      toView $ CEvtChatInfoUpdated user (AChatInfo SCTDirect $ DirectChat ct')
      throwError e
  ConnectSimplex incognito -> withUser $ \user -> do
-    plan <- contactRequestPlan user adminContactReq Nothing `catchAllErrors` const (pure $ CPContactAddress (CAPOk Nothing))
+    plan <- contactRequestPlan user adminContactReq Nothing Nothing `catchAllErrors` const (pure $ CPContactAddress (CAPOk Nothing Nothing))
    connectWithPlan user incognito (ACCL SCMContact (CCLink adminContactReq Nothing)) plan
  DeleteContact cName cdm -> withContactName cName $ \ctId -> APIDeleteChat (ChatRef CTDirect ctId Nothing) cdm
  ClearContact cName -> withContactName cName $ \chatId -> APIClearChat $ ChatRef CTDirect chatId Nothing
@@ -2288,6 +2330,19 @@ processChatCommand vr nm = \case
    toChatRef <- getChatRef user toChatName
    asGroup <- getSendAsGroup user toChatRef
    processChatCommand vr nm $ APIForwardChatItems toChatRef asGroup (ChatRef CTLocal folderId Nothing) (forwardedItemId :| []) Nothing
+  SharePublicGroup shareGroupName toChatName -> withUser $ \user -> do
+    groupId <- withFastStore $ \db -> getGroupIdByName db user shareGroupName
+    toChatRef <- getChatRef user toChatName
+    sendRef <- case toChatRef of
+      ChatRef CTDirect ctId _ -> pure $ SRDirect ctId
+      ChatRef CTGroup gId scope_ -> do
+        gInfo <- withFastStore $ \db -> getGroupInfo db vr user gId
+        pure $ SRGroup gId scope_ (useRelays' gInfo)
+      _ -> throwCmdError "unsupported share target"
+    processChatCommand vr nm (APIShareChatMsgContent (ChatRef CTGroup groupId Nothing) sendRef) >>= \case
+      CRChatMsgContent _ mc ->
+        processChatCommand vr nm $ APISendMessages sendRef False Nothing [composedMessage Nothing mc]
+      r -> pure r
  SendMessage sendName msg -> withUser $ \user -> do
    let mc = MCText msg
    case sendName of
@@ -3888,28 +3943,29 @@ processChatCommand vr nm = \case
            pure (gId, chatSettings)
        _ -> throwCmdError "not supported"
      processChatCommand vr nm $ APISetChatSettings (ChatRef cType chatId Nothing) $ updateSettings chatSettings
-    connectPlan :: User -> AConnectionLink -> CM (ACreatedConnLink, ConnectionPlan)
-    connectPlan user (ACL SCMInvitation cLink) = case cLink of
-      CLFull cReq -> invitationReqAndPlan cReq Nothing Nothing
+    connectPlan :: User -> AConnectionLink -> Maybe LinkOwnerSig -> CM (ACreatedConnLink, ConnectionPlan)
+    connectPlan user (ACL SCMInvitation cLink) sig_ = case cLink of
+      CLFull cReq -> invitationReqAndPlan cReq Nothing Nothing Nothing
      CLShort l -> do
        let l' = serverShortLink l
        knownLinkPlans l' >>= \case
          Just r -> pure r
          Nothing -> do
-            (FixedLinkData {linkConnReq = cReq}, cData) <- getShortLinkConnReq nm user l'
+            (FixedLinkData {linkConnReq = cReq, rootKey}, cData) <- getShortLinkConnReq nm user l'
            contactSLinkData_ <- liftIO $ decodeLinkUserData cData
-            invitationReqAndPlan cReq (Just l') contactSLinkData_
+            let ov = verifyLinkOwner rootKey [] l sig_
+            invitationReqAndPlan cReq (Just l') contactSLinkData_ ov
      where
        knownLinkPlans l' = withFastStore $ \db -> do
          let inv cReq = ACCL SCMInvitation $ CCLink cReq (Just l')
          liftIO (getConnectionEntityViaShortLink db vr user l') >>= \case
-            Just (cReq, ent) -> pure $ Just (inv cReq, invitationEntityPlan Nothing ent)
+            Just (cReq, ent) -> pure $ Just (inv cReq, invitationEntityPlan Nothing Nothing ent)
            -- deleted contact is returned as known, as invitation link cannot be re-used too connect anyway
            Nothing -> bimap inv (CPInvitationLink . ILPKnown) <$$> getContactViaShortLinkToConnect db vr user l'
-        invitationReqAndPlan cReq sLnk_ contactSLinkData_ = do
-          plan <- invitationRequestPlan user cReq contactSLinkData_ `catchAllErrors` (pure . CPError)
+        invitationReqAndPlan cReq sLnk_ cld ov = do
+          plan <- invitationRequestPlan user cReq cld ov `catchAllErrors` (pure . CPError)
          pure (ACCL SCMInvitation (CCLink cReq sLnk_), plan)
-    connectPlan user (ACL SCMContact cLink) = case cLink of
+    connectPlan user (ACL SCMContact cLink) sig_ = case cLink of
      CLFull cReq -> do
        plan <- contactOrGroupRequestPlan user cReq `catchAllErrors` (pure . CPError)
        pure (ACCL SCMContact $ CCLink cReq Nothing, plan)
@@ -3919,12 +3975,14 @@ processChatCommand vr nm = \case
            knownLinkPlans >>= \case
              Just r -> pure r
              Nothing -> do
-                (FixedLinkData {linkConnReq = cReq}, cData) <- getShortLinkConnReq nm user l'
+                (FixedLinkData {linkConnReq = cReq, rootKey}, cData) <- getShortLinkConnReq nm user l'
                withFastStore' (\db -> getContactWithoutConnViaShortAddress db vr user l') >>= \case
                  Just ct' | not (contactDeleted ct') -> pure (con cReq, CPContactAddress (CAPContactViaAddress ct'))
                  _ -> do
                    contactSLinkData_ <- liftIO $ decodeLinkUserData cData
-                    plan <- contactRequestPlan user cReq contactSLinkData_
+                    let ContactLinkData _ UserContactData {owners} = cData
+                        ov = verifyLinkOwner rootKey owners l' sig_
+                    plan <- contactRequestPlan user cReq contactSLinkData_ ov
                    pure (con cReq, plan)
            where
              knownLinkPlans = withFastStore $ \db ->
@@ -3945,8 +4003,8 @@ processChatCommand vr nm = \case
            knownLinkPlans >>= \case
              Just r -> pure r
              Nothing -> do
-                (fd, cData@(ContactLinkData _ UserContactData {direct, relays})) <- getShortLinkConnReq nm user l'
-                let FixedLinkData {linkConnReq = cReq, linkEntityId} = fd
+                (fd, cData@(ContactLinkData _ UserContactData {direct, owners, relays})) <- getShortLinkConnReq nm user l'
+                let FixedLinkData {linkConnReq = cReq, linkEntityId, rootKey} = fd
                    linkInfo = GroupShortLinkInfo {direct, groupRelays = relays, publicGroupId = B64UrlByteString <$> linkEntityId}
                groupSLinkData_ <- liftIO $ decodeLinkUserData cData
                -- Cross-validate linkEntityId and publicGroupId from profile:
@@ -3957,7 +4015,8 @@ processChatCommand vr nm = \case
                  (Just entityId, Just publicGroupId) | entityId == publicGroupId -> pure ()
                  (Nothing, Nothing) -> pure ()
                  _ -> throwChatError CEInvalidConnReq
-                plan <- groupJoinRequestPlan user cReq (Just linkInfo) groupSLinkData_
+                let ov = verifyLinkOwner rootKey owners l' sig_
+                plan <- groupJoinRequestPlan user cReq (Just linkInfo) groupSLinkData_ ov
                pure (con cReq, plan)
            where
              knownLinkPlans = withFastStore $ \db ->
@@ -3973,9 +4032,9 @@ processChatCommand vr nm = \case
              processChatCommand vr nm $ APIConnectContactViaAddress userId incognito contactId
            _ -> processChatCommand vr nm $ APIConnect userId incognito $ Just ccLink
      | otherwise = pure $ CRConnectionPlan user ccLink plan
-    invitationRequestPlan :: User -> ConnReqInvitation -> Maybe ContactShortLinkData -> CM ConnectionPlan
-    invitationRequestPlan user cReq contactSLinkData_ = do
-      maybe (CPInvitationLink (ILPOk contactSLinkData_)) (invitationEntityPlan contactSLinkData_)
+    invitationRequestPlan :: User -> ConnReqInvitation -> Maybe ContactShortLinkData -> Maybe OwnerVerification -> CM ConnectionPlan
+    invitationRequestPlan user cReq cld ov = do
+      maybe (CPInvitationLink (ILPOk cld ov)) (invitationEntityPlan cld ov)
        <$> withFastStore' (\db -> getConnectionEntityByConnReq db vr user $ invCReqSchemas cReq)
      where
        invCReqSchemas :: ConnReqInvitation -> (ConnReqInvitation, ConnReqInvitation)
@@ -3983,15 +4042,15 @@ processChatCommand vr nm = \case
          ( CRInvitationUri crData {crScheme = SSSimplex} e2e,
            CRInvitationUri crData {crScheme = simplexChat} e2e
          )
-    invitationEntityPlan :: Maybe ContactShortLinkData -> ConnectionEntity -> ConnectionPlan
-    invitationEntityPlan contactSLinkData_ = \case
+    invitationEntityPlan :: Maybe ContactShortLinkData -> Maybe OwnerVerification -> ConnectionEntity -> ConnectionPlan
+    invitationEntityPlan cld ov = \case
      RcvDirectMsgConnection Connection {connStatus, contactConnInitiated} ct_ -> case ct_ of
        Just ct
          | contactActive ct -> CPInvitationLink (ILPKnown ct)
-          | otherwise -> CPInvitationLink (ILPOk contactSLinkData_)
+          | otherwise -> CPInvitationLink (ILPOk cld ov)
        Nothing
          | connStatus == ConnNew && contactConnInitiated -> CPInvitationLink ILPOwnLink
-          | connStatus == ConnPrepared -> CPInvitationLink (ILPOk contactSLinkData_)
+          | connStatus == ConnPrepared -> CPInvitationLink (ILPOk cld ov)
          | otherwise -> CPInvitationLink (ILPConnecting Nothing)
      _ -> CPError $ ChatError $ CECommandError "found connection entity is not RcvDirectMsgConnection"
    contactOrGroupRequestPlan ::  User -> ConnReqContact -> CM ConnectionPlan
@@ -3999,10 +4058,10 @@ processChatCommand vr nm = \case
      let ConnReqUriData {crClientData} = crData
          groupLinkId = crClientData >>= decodeJSON >>= \(CRDataGroup gli) -> Just gli
      case groupLinkId of
-        Nothing -> contactRequestPlan user cReq Nothing
-        Just _ -> groupJoinRequestPlan user cReq Nothing Nothing
-    contactRequestPlan :: User -> ConnReqContact -> Maybe ContactShortLinkData -> CM ConnectionPlan
-    contactRequestPlan user (CRContactUri crData) contactSLinkData_ = do
+        Nothing -> contactRequestPlan user cReq Nothing Nothing
+        Just _ -> groupJoinRequestPlan user cReq Nothing Nothing Nothing
+    contactRequestPlan :: User -> ConnReqContact -> Maybe ContactShortLinkData -> Maybe OwnerVerification -> CM ConnectionPlan
+    contactRequestPlan user (CRContactUri crData) cld ov = do
      let cReqSchemas = contactCReqSchemas crData
          cReqHashes = bimap contactCReqHash contactCReqHash cReqSchemas
      withFastStore' (\db -> getUserContactLinkByConnReq db user cReqSchemas) >>= \case
@@ -4012,19 +4071,19 @@ processChatCommand vr nm = \case
            Nothing ->
              withFastStore' (\db -> getContactWithoutConnViaAddress db vr user cReqSchemas) >>= \case
                Just ct | not (contactDeleted ct) -> pure $ CPContactAddress (CAPContactViaAddress ct)
-                _ -> pure $ CPContactAddress (CAPOk contactSLinkData_)
+                _ -> pure $ CPContactAddress (CAPOk cld ov)
            Just (RcvDirectMsgConnection Connection {connStatus} Nothing)
-              | connStatus == ConnPrepared -> pure $ CPContactAddress (CAPOk contactSLinkData_)
+              | connStatus == ConnPrepared -> pure $ CPContactAddress (CAPOk cld ov)
              | otherwise -> pure $ CPContactAddress CAPConnectingConfirmReconnect
            Just (RcvDirectMsgConnection _ (Just ct))
              | not (contactReady ct) && contactActive ct -> pure $ CPContactAddress (CAPConnectingProhibit ct)
-              | contactDeleted ct -> pure $ CPContactAddress (CAPOk contactSLinkData_)
+              | contactDeleted ct -> pure $ CPContactAddress (CAPOk cld ov)
              | otherwise -> pure $ CPContactAddress (CAPKnown ct)
            -- TODO [short links] RcvGroupMsgConnection branch is deprecated? (old group link protocol?)
-            Just (RcvGroupMsgConnection _ gInfo _) -> groupPlan gInfo Nothing Nothing
+            Just (RcvGroupMsgConnection _ gInfo _) -> groupPlan gInfo Nothing Nothing Nothing
            Just _ -> throwCmdError "found connection entity is not RcvDirectMsgConnection or RcvGroupMsgConnection"
-    groupJoinRequestPlan :: User -> ConnReqContact -> Maybe GroupShortLinkInfo -> Maybe GroupShortLinkData -> CM ConnectionPlan
-    groupJoinRequestPlan user (CRContactUri crData) groupSLinkInfo_ groupSLinkData_ = do
+    groupJoinRequestPlan :: User -> ConnReqContact -> Maybe GroupShortLinkInfo -> Maybe GroupShortLinkData -> Maybe OwnerVerification -> CM ConnectionPlan
+    groupJoinRequestPlan user (CRContactUri crData) linkInfo gld ov = do
      let cReqSchemas = contactCReqSchemas crData
          cReqHashes = bimap contactCReqHash contactCReqHash cReqSchemas
      withFastStore' (\db -> getGroupInfoByUserContactLinkConnReq db vr user cReqSchemas) >>= \case
@@ -4033,21 +4092,21 @@ processChatCommand vr nm = \case
          connEnt_ <- withFastStore' $ \db -> getContactConnEntityByConnReqHash db vr user cReqHashes
          gInfo_ <- withFastStore' $ \db -> getGroupInfoByGroupLinkHash db vr user cReqHashes
          case (gInfo_, connEnt_) of
-            (Nothing, Nothing) -> pure $ CPGroupLink (GLPOk groupSLinkInfo_ groupSLinkData_)
+            (Nothing, Nothing) -> pure $ CPGroupLink (GLPOk linkInfo gld ov)
            -- TODO [short links] RcvDirectMsgConnection branches are deprecated? (old group link protocol?)
            (Nothing, Just (RcvDirectMsgConnection _conn Nothing)) -> pure $ CPGroupLink GLPConnectingConfirmReconnect
            (Nothing, Just (RcvDirectMsgConnection _ (Just ct)))
              | not (contactReady ct) && contactActive ct -> pure $ CPGroupLink (GLPConnectingProhibit gInfo_)
-              | otherwise -> pure $ CPGroupLink (GLPOk groupSLinkInfo_ groupSLinkData_)
+              | otherwise -> pure $ CPGroupLink (GLPOk linkInfo gld ov)
            (Nothing, Just _) -> throwCmdError "found connection entity is not RcvDirectMsgConnection"
-            (Just gInfo, _) -> groupPlan gInfo groupSLinkInfo_ groupSLinkData_
-    groupPlan :: GroupInfo -> Maybe GroupShortLinkInfo -> Maybe GroupShortLinkData -> CM ConnectionPlan
-    groupPlan gInfo@GroupInfo {membership} groupSLinkInfo_ groupSLinkData_
+            (Just gInfo, _) -> groupPlan gInfo linkInfo gld ov
+    groupPlan :: GroupInfo -> Maybe GroupShortLinkInfo -> Maybe GroupShortLinkData -> Maybe OwnerVerification -> CM ConnectionPlan
+    groupPlan gInfo@GroupInfo {membership} linkInfo gld ov
      | memberStatus membership == GSMemRejected = pure $ CPGroupLink (GLPKnown gInfo)
      | not (memberActive membership) && not (memberRemoved membership) =
          pure $ CPGroupLink (GLPConnectingProhibit $ Just gInfo)
      | memberActive membership = pure $ CPGroupLink (GLPKnown gInfo)
-      | otherwise = pure $ CPGroupLink (GLPOk groupSLinkInfo_ groupSLinkData_)
+      | otherwise = pure $ CPGroupLink (GLPOk linkInfo gld ov)
    contactCReqSchemas :: ConnReqUriData -> (ConnReqContact, ConnReqContact)
    contactCReqSchemas crData =
      ( CRContactUri crData {crScheme = SSSimplex},
@@ -4059,6 +4118,16 @@ processChatCommand vr nm = \case
    serverShortLink = \case
      CSLInvitation _ srv lnkId linkKey -> CSLInvitation SLSServer srv lnkId linkKey
      CSLContact _ ct srv linkKey -> CSLContact SLSServer ct srv linkKey
+    verifyLinkOwner :: ConnectionModeI m => C.PublicKeyEd25519 -> [OwnerAuth] -> ConnShortLink m -> Maybe LinkOwnerSig -> Maybe OwnerVerification
+    verifyLinkOwner rootKey owners connLink =
+      fmap $ \LinkOwnerSig {ownerId, chatBinding = B64UrlByteString bindingBytes, ownerSig} ->
+        let signedData = bindingBytes <> smpEncode connLink
+            findOwner (B64UrlByteString oId) = find (\OwnerAuth {ownerId = oId'} -> oId' == oId) owners
+         in case maybe (Just rootKey) (fmap ownerKey . findOwner) ownerId of
+              Nothing -> OVFailed "unknown owner"
+              Just key
+                | C.verify' key ownerSig signedData -> OVVerified
+                | otherwise -> OVFailed "signature verification failed"
    contactShortLinkData :: Profile -> Maybe AddressSettings -> UserLinkData
    contactShortLinkData p settings =
      let msg = autoReply =<< settings
@@ -4772,6 +4841,7 @@ chatCommandP =
      "/_reaction members " *> (APIGetReactionMembers <$> A.decimal <* " #" <*> A.decimal <* A.space <*> A.decimal <* A.space <*> (knownReaction <$?> jsonP)),
      "/_forward plan " *> (APIPlanForwardChatItems <$> chatRefP <*> _strP),
      "/_forward " *> (APIForwardChatItems <$> chatRefP <*> (" as_group=" *> onOffP <|> pure False) <* A.space <*> chatRefP <*> _strP <*> sendMessageTTLP),
+      "/_share chat content " *> (APIShareChatMsgContent <$> chatRefP <* A.space <*> sendRefP),
      "/_read user " *> (APIUserRead <$> A.decimal),
      "/read user" $> UserRead,
      "/_read chat " *> (APIChatRead <$> chatRefP),
@@ -4943,7 +5013,7 @@ chatCommandP =
      (">#" <|> "> #") *> (SendGroupMessageQuote <$> displayNameP <* A.space <* char_ '@' <*> (Just <$> displayNameP) <* A.space <*> quotedMsg <*> msgTextP),
      "/_contacts " *> (APIListContacts <$> A.decimal),
      "/contacts" $> ListContacts,
-      "/_connect plan " *> (APIConnectPlan <$> A.decimal <* A.space <*> ((Just <$> strP) <|> A.takeTill (== ' ') $> Nothing)),
+      "/_connect plan " *> (APIConnectPlan <$> A.decimal <* A.space <*> ((Just <$> strP) <|> A.takeTill (== ' ') $> Nothing) <*> optional (" sig=" *> jsonP)),
      "/_prepare contact " *> (APIPrepareContact <$> A.decimal <* A.space <*> connLinkP <* A.space <*> jsonP),
      "/_prepare group " *> (APIPrepareGroup <$> A.decimal <* A.space <*> connLinkP' <*> (" direct=" *> onOffP <|> pure True) <* A.space <*> jsonP),
      "/_set contact user @" *> (APIChangePreparedContactUser <$> A.decimal <* A.space <*> A.decimal),
@@ -4960,6 +5030,7 @@ chatCommandP =
      ForwardGroupMessage <$> chatNameP <* " <- #" <*> displayNameP <* A.space <* A.char '@' <*> (Just <$> displayNameP) <* A.space <*> msgTextP,
      ForwardGroupMessage <$> chatNameP <* " <- #" <*> displayNameP <*> pure Nothing <* A.space <*> msgTextP,
      ForwardLocalMessage <$> chatNameP <* " <- * " <*> msgTextP,
+      "/share chat #" *> (SharePublicGroup <$> displayNameP <* A.space <*> chatNameP),
      SendMessage <$> sendNameP <* A.space <*> msgTextP,
      "@#" *> (SendMemberContactMessage <$> displayNameP <* A.space <* char_ '@' <*> displayNameP <* A.space <*> msgTextP),
      "/accept_member_contact @" *> (AcceptMemberContact <$> displayNameP),
@@ -341,7 +341,7 @@ prohibitedGroupContent gInfo@GroupInfo {membership = mem@GroupMember {memberRole
  | isVoice mc && not (groupFeatureMemberAllowed SGFVoice m gInfo) && not hostApprovalVoice = Just GFVoice
  | isNothing scopeInfo && not (isVoice mc) && isJust file_ && not (groupFeatureMemberAllowed SGFFiles m gInfo) = Just GFFiles
  | isNothing scopeInfo && isReport mc && (badReportUser || not (groupFeatureAllowed SGFReports gInfo)) = Just GFReports
-  | isNothing scopeInfo && prohibitedSimplexLinks gInfo m ft = Just GFSimplexLinks
+  | isNothing scopeInfo && prohibitedSimplexLinks gInfo m mc ft = Just GFSimplexLinks
  | otherwise = Nothing
  where
    hostApprovalVoice
@@ -358,10 +358,14 @@ prohibitedGroupContent gInfo@GroupInfo {membership = mem@GroupMember {memberRole
      | sent = userRole >= GRModerator
      | otherwise = userRole < GRModerator

-prohibitedSimplexLinks :: GroupInfo -> GroupMember -> Maybe MarkdownList -> Bool
-prohibitedSimplexLinks gInfo m ft =
+prohibitedSimplexLinks :: GroupInfo -> GroupMember -> MsgContent -> Maybe MarkdownList -> Bool
+prohibitedSimplexLinks gInfo m mc ft =
  not (groupFeatureMemberAllowed SGFSimplexLinks m gInfo)
-    && maybe False (any ftIsSimplexLink) ft
+    && (isChatLink mc || maybe False (any ftIsSimplexLink) ft)
+  where
+    isChatLink = \case
+      MCChat {} -> True
+      _ -> False

 ftIsSimplexLink :: FormattedText -> Bool
 ftIsSimplexLink FormattedText {format} = maybe False isSimplexLink format
@@ -1726,7 +1726,16 @@ processAgentMessageConn vr user@User {userId} corrId agentConnId agentMessage =

    newContentMessage :: Contact -> MsgContainer -> RcvMessage -> MsgMeta -> CM ()
    newContentMessage ct mc msg@RcvMessage {sharedMsgId_} msgMeta = do
-      let MsgContainer {content, file = fInv_} = mc
+      let MsgContainer {content = c, file = fInv_} = mc
+      content <- case c of
+        MCChat {text, chatLink, ownerSig = Just LinkOwnerSig {chatBinding = B64UrlByteString binding}} -> do
+          keepSig <- case contactConn ct of
+            Nothing -> pure False
+            Just conn -> do
+              adHash <- withAgent (`getConnectionRatchetAdHash` aConnId conn)
+              pure $ encodeChatBinding CBDirect adHash == binding
+          pure $ if keepSig then c else MCChat {text, chatLink, ownerSig = Nothing}
+        _ -> pure c
      -- Uncomment to test stuck delivery on errors - see test testDirectMessageDelete
      -- case content of
      --   MCText "hello 111" ->
@@ -1979,7 +1988,16 @@ processAgentMessageConn vr user@User {userId} corrId agentConnId agentMessage =
        rejected gInfo' m' scopeInfo f = newChatItem gInfo' m' scopeInfo (ciContentNoParse $ CIRcvGroupFeatureRejected f) Nothing Nothing False
        timed_ gInfo' = if forwarded then rcvCITimed_ (Just Nothing) itemTTL else rcvGroupCITimed gInfo' itemTTL
        live' = fromMaybe False live_
-        MsgContainer {content, mentions = MsgMentions mentions, file = fInv_, ttl = itemTTL, live = live_, scope = msgScope_, asGroup = asGroup_} = mc
+        MsgContainer {content = c, mentions = MsgMentions mentions, file = fInv_, ttl = itemTTL, live = live_, scope = msgScope_, asGroup = asGroup_} = mc
+        content = case c of
+          MCChat {text, chatLink, ownerSig = Just LinkOwnerSig {chatBinding = B64UrlByteString binding}} -> case publicGroup of
+            Just pgp | maybe False (binding ==) (expectedBinding pgp) -> c
+            _ -> MCChat {text, chatLink, ownerSig = Nothing}
+          _ -> c
+        expectedBinding PublicGroupProfile {publicGroupId}
+          | sentAsGroup = Just $ encodeChatBinding CBChannel (smpEncode publicGroupId)
+          | otherwise = (\GroupMember {memberId} -> encodeChatBinding CBGroup (smpEncode (publicGroupId, memberId))) <$> m_
+        GroupInfo {groupProfile = GroupProfile {publicGroup}} = gInfo
        sentAsGroup = asGroup_ == Just True
        ts@(_, ft_) = msgContentTexts content
        -- m' is Maybe GroupMember
@@ -2030,7 +2048,7 @@ processAgentMessageConn vr user@User {userId} corrId agentConnId agentMessage =

    groupMessageUpdate :: GroupInfo -> Maybe GroupMember -> SharedMsgId -> MsgContent -> Map MemberName MsgMention -> Maybe MsgScope -> RcvMessage -> UTCTime -> Maybe Int -> Maybe Bool -> Maybe Bool -> CM (Maybe DeliveryTaskContext)
    groupMessageUpdate gInfo@GroupInfo {groupId} m_ sharedMsgId mc mentions msgScope_ msg@RcvMessage {msgId} brokerTs ttl_ live_ asGroup_
-      | Just m <- m_, prohibitedSimplexLinks gInfo m ft_ =
+      | Just m <- m_, prohibitedSimplexLinks gInfo m mc ft_ =
          messageWarning ("x.msg.update ignored: feature not allowed " <> groupFeatureNameText GFSimplexLinks) $> Nothing
      | otherwise = do
          updateRcvChatItem `catchCINotFound` \_ -> do
@@ -318,7 +318,7 @@ data AChatMessage = forall e. MsgEncodingI e => ACMsg (SMsgEncoding e) (ChatMess
 data KeyRef = KRMember
  deriving (Eq, Show)

-data ChatBinding = CBGroup
+data ChatBinding = CBGroup | CBDirect | CBChannel
  deriving (Eq, Show)

 data MsgSignature = MsgSignature KeyRef C.ASignature
@@ -381,10 +381,15 @@ instance Encoding KeyRef where
      c -> fail $ "invalid KeyRef tag: " <> show c

 instance Encoding ChatBinding where
-  smpEncode CBGroup = "G"
+  smpEncode = \case
+    CBGroup -> "G"
+    CBDirect -> "D"
+    CBChannel -> "C"
  smpP =
    A.anyChar >>= \case
      'G' -> pure CBGroup
+      'D' -> pure CBDirect
+      'C' -> pure CBChannel
      c -> fail $ "invalid ChatBinding: " <> show c

 instance ToField ChatBinding where toField = toField . decodeLatin1 . smpEncode
@@ -411,7 +416,8 @@ data MsgSigning = MsgSigning
    privKey :: C.PrivateKeyEd25519
  }

-
+encodeChatBinding :: ChatBinding -> ByteString -> ByteString
+encodeChatBinding cb bindingData = smpEncode cb <> bindingData

 data ChatMsgEvent (e :: MsgEncoding) where
  XMsgNew :: MsgContainer -> ChatMsgEvent 'Json
@@ -685,7 +691,7 @@ data MsgContent
  | MCVoice {text :: Text, duration :: Int}
  | MCFile {text :: Text}
  | MCReport {text :: Text, reason :: ReportReason}
-  | MCChat {text :: Text, chatLink :: MsgChatLink}
+  | MCChat {text :: Text, chatLink :: MsgChatLink, ownerSig :: Maybe LinkOwnerSig}
  | MCUnknown {tag :: Text, text :: Text, json :: J.Object}
  deriving (Eq, Show)

@@ -695,6 +701,13 @@ data MsgChatLink
  | MCLGroup {connLink :: ShortLinkContact, groupProfile :: GroupProfile}
  deriving (Eq, Show)

+data LinkOwnerSig = LinkOwnerSig
+  { ownerId :: Maybe B64UrlByteString,
+    chatBinding :: B64UrlByteString,
+    ownerSig :: C.Signature 'C.Ed25519
+  }
+  deriving (Eq, Show)
+
 msgContentText :: MsgContent -> Text
 msgContentText = \case
  MCText t -> t
@@ -757,6 +770,8 @@ newtype MsgMentions = MsgMentions (Map MemberName MsgMention)

 $(JQ.deriveJSON (taggedObjectJSON $ dropPrefix "MCL") ''MsgChatLink)

+$(JQ.deriveJSON defaultJSON ''LinkOwnerSig)
+
 $(JQ.deriveJSON defaultJSON ''MsgMention)

 instance FromJSON MsgMentions where
@@ -803,7 +818,8 @@ instance FromJSON MsgContent where
      MCChat_ -> do
        text <- v .: "text"
        chatLink <- v .: "chatLink"
-        pure MCChat {text, chatLink}
+        ownerSig <- v .:? "ownerSig"
+        pure MCChat {text, chatLink, ownerSig}
      MCUnknown_ tag -> do
        text <- fromMaybe unknownMsgType <$> v .:? "text"
        pure MCUnknown {tag, text, json = v}
@@ -813,6 +829,9 @@ instance FromJSON MsgContent where
 unknownMsgType :: Text
 unknownMsgType = "unknown message type"

+(.=?) :: ToJSON v => JT.Key -> Maybe v -> [(J.Key, J.Value)] -> [(J.Key, J.Value)]
+key .=? value = maybe id ((:) . (key .=)) value
+
 instance ToJSON MsgContent where
  toJSON = \case
    MCUnknown {json} -> J.Object json
@@ -823,7 +842,7 @@ instance ToJSON MsgContent where
    MCVoice {text, duration} -> J.object ["type" .= MCVoice_, "text" .= text, "duration" .= duration]
    MCFile t -> J.object ["type" .= MCFile_, "text" .= t]
    MCReport {text, reason} -> J.object ["type" .= MCReport_, "text" .= text, "reason" .= reason]
-    MCChat {text, chatLink} -> J.object ["type" .= MCChat_, "text" .= text, "chatLink" .= chatLink]
+    MCChat {text, chatLink, ownerSig} -> J.object $ ("ownerSig" .=? ownerSig) ["type" .= MCChat_, "text" .= text, "chatLink" .= chatLink]
  toEncoding = \case
    MCUnknown {json} -> JE.value $ J.Object json
    MCText t -> J.pairs $ "type" .= MCText_ <> "text" .= t
@@ -833,7 +852,7 @@ instance ToJSON MsgContent where
    MCVoice {text, duration} -> J.pairs $ "type" .= MCVoice_ <> "text" .= text <> "duration" .= duration
    MCFile t -> J.pairs $ "type" .= MCFile_ <> "text" .= t
    MCReport {text, reason} -> J.pairs $ "type" .= MCReport_ <> "text" .= text <> "reason" .= reason
-    MCChat {text, chatLink} -> J.pairs $ "type" .= MCChat_ <> "text" .= text <> "chatLink" .= chatLink
+    MCChat {text, chatLink, ownerSig} -> J.pairs $ "type" .= MCChat_ <> "text" .= text <> "chatLink" .= chatLink <> maybe mempty ("ownerSig" .=) ownerSig

 $(JQ.deriveJSON defaultJSON ''MsgContainer)

@@ -1324,9 +1343,6 @@ appJsonToCM AppMessageJson {v, msgId, event, params} = do
      XOk_ -> pure XOk
      XUnknown_ t -> pure $ XUnknown t params

-(.=?) :: ToJSON v => JT.Key -> Maybe v -> [(J.Key, J.Value)] -> [(J.Key, J.Value)]
-key .=? value = maybe id ((:) . (key .=)) value
-
 chatToAppMessage :: forall e. MsgEncodingI e => ChatMessage e -> AppMessage e
 chatToAppMessage chatMsg@ChatMessage {chatVRange, msgId, chatMsgEvent} = case encoding @e of
  SBinary -> AMBinary AppMessageBinary {msgId = Nothing, tag = B.head $ strEncode tag, body = chatMsgBinaryToBody chatMsg}
@@ -229,7 +229,7 @@ createNewSndMessage db gVar connOrGroupId chatMsgEvent msgSigning_ encodeMessage
      ECMEncoded msgBody -> do
        let signedMsg_ = signBody <$> msgSigning_
            signBody MsgSigning {bindingTag, bindingData, keyRef, privKey} =
-              let sig = C.ASignature C.SEd25519 $ C.sign' privKey (smpEncode bindingTag <> bindingData <> msgBody)
+              let sig = C.ASignature C.SEd25519 $ C.sign' privKey (encodeChatBinding bindingTag bindingData <> msgBody)
               in SignedMsg {chatBinding = bindingTag, signatures = MsgSignature keyRef sig :| [], signedBody = msgBody}
        createdAt <- getCurrentTime
        DB.execute
@@ -240,7 +240,7 @@ createNewSndMessage db gVar connOrGroupId chatMsgEvent msgSigning_ encodeMessage
              shared_msg_id, shared_msg_id_user, created_at, updated_at
            ) VALUES (?,?,?,?,?,?,?,?,?,?,?)
          |]
-          ((MDSnd, toCMEventTag chatMsgEvent, DB.Binary msgBody, chatBinding <$> signedMsg_, DB.Binary . smpEncode . signatures <$> signedMsg_, connId_, groupId_)
+          ((MDSnd, toCMEventTag chatMsgEvent, DB.Binary msgBody, (\SignedMsg {chatBinding} -> chatBinding) <$> signedMsg_, DB.Binary . smpEncode . signatures <$> signedMsg_, connId_, groupId_)
           :. (DB.Binary sharedMsgId, Just (BI True), createdAt, createdAt))
        msgId <- insertedRowId db
        pure $ Right SndMessage {msgId, sharedMsgId = SharedMsgId sharedMsgId, msgBody, signedMsg_}
@@ -327,7 +327,7 @@ createNewRcvMessage db connOrGroupId NewRcvMessage {chatMsgEvent, verifiedMsg, b
             shared_msg_id, author_group_member_id, forwarded_by_group_member_id)
          VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)
        |]
-        ((MDRcv, toCMEventTag chatMsgEvent, DB.Binary msgBody, chatBinding <$> signedMsg_, DB.Binary . smpEncode . signatures <$> signedMsg_, brokerTs, currentTs, currentTs, connId_, groupId_)
+        ((MDRcv, toCMEventTag chatMsgEvent, DB.Binary msgBody, (\SignedMsg {chatBinding} -> chatBinding) <$> signedMsg_, DB.Binary . smpEncode . signatures <$> signedMsg_, brokerTs, currentTs, currentTs, connId_, groupId_)
         :. (sharedMsgId_, authorMember, forwardedByMember))
      msgId <- insertedRowId db
      pure RcvMessage {msgId, chatMsgEvent = ACME (encoding @e) chatMsgEvent, sharedMsgId_, msgSigned, forwardedByMember}
@@ -1842,6 +1842,41 @@ SEARCH group_members USING COVERING INDEX idx_group_members_invited_by_group_mem
 SEARCH contacts USING COVERING INDEX idx_contacts_grp_direct_inv_from_group_member_id (grp_direct_inv_from_group_member_id=?)
 SEARCH contacts USING COVERING INDEX idx_contacts_contact_group_member_id (contact_group_member_id=?)

+Query: 
+        INSERT INTO group_members
+          ( group_id, index_in_group, member_id, member_role, member_category, member_status, member_relations_vector, invited_by,
+            user_id, local_display_name, contact_id, contact_profile_id, member_pub_key, created_at, updated_at,
+            peer_chat_min_version, peer_chat_max_version)
+        VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+      
+Plan:
+SEARCH group_relays USING COVERING INDEX idx_group_relays_group_member_id (group_member_id=?)
+SEARCH delivery_jobs USING COVERING INDEX idx_delivery_jobs_single_sender_group_member_id (single_sender_group_member_id=?)
+SEARCH delivery_jobs USING COVERING INDEX idx_delivery_jobs_job_scope_support_gm_id (job_scope_support_gm_id=?)
+SEARCH delivery_tasks USING COVERING INDEX idx_delivery_tasks_sender_group_member_id (sender_group_member_id=?)
+SEARCH delivery_tasks USING COVERING INDEX idx_delivery_tasks_job_scope_support_gm_id (job_scope_support_gm_id=?)
+SEARCH received_probes USING COVERING INDEX idx_received_probes_group_member_id (group_member_id=?)
+SEARCH sent_probe_hashes USING COVERING INDEX idx_sent_probe_hashes_group_member_id (group_member_id=?)
+SEARCH sent_probes USING COVERING INDEX idx_sent_probes_group_member_id (group_member_id=?)
+SEARCH group_snd_item_statuses USING COVERING INDEX idx_group_snd_item_statuses_group_member_id (group_member_id=?)
+SEARCH chat_item_moderations USING COVERING INDEX idx_chat_item_moderations_moderator_member_id (moderator_member_id=?)
+SEARCH chat_item_reactions USING COVERING INDEX idx_chat_item_reactions_group_member_id (group_member_id=?)
+SEARCH chat_items USING COVERING INDEX idx_chat_items_group_scope_group_member_id (group_scope_group_member_id=?)
+SEARCH chat_items USING COVERING INDEX idx_chat_items_forwarded_by_group_member_id (forwarded_by_group_member_id=?)
+SEARCH chat_items USING COVERING INDEX idx_chat_items_item_deleted_by_group_member_id (item_deleted_by_group_member_id=?)
+SEARCH chat_items USING COVERING INDEX idx_chat_items_group_member_id (group_member_id=?)
+SEARCH pending_group_messages USING COVERING INDEX idx_pending_group_messages_group_member_id (group_member_id=?)
+SEARCH messages USING COVERING INDEX idx_messages_forwarded_by_group_member_id (forwarded_by_group_member_id=?)
+SEARCH messages USING COVERING INDEX idx_messages_author_group_member_id (author_group_member_id=?)
+SEARCH connections USING COVERING INDEX idx_connections_group_member_id (group_member_id=?)
+SEARCH rcv_files USING COVERING INDEX idx_rcv_files_group_member_id (group_member_id=?)
+SEARCH snd_files USING COVERING INDEX idx_snd_files_group_member_id (group_member_id=?)
+SEARCH group_member_intros USING COVERING INDEX idx_group_member_intros_to_group_member_id (to_group_member_id=?)
+SEARCH group_member_intros USING COVERING INDEX idx_group_member_intros_re_group_member_id (re_group_member_id=?)
+SEARCH group_members USING COVERING INDEX idx_group_members_invited_by_group_member_id (invited_by_group_member_id=?)
+SEARCH contacts USING COVERING INDEX idx_contacts_grp_direct_inv_from_group_member_id (grp_direct_inv_from_group_member_id=?)
+SEARCH contacts USING COVERING INDEX idx_contacts_contact_group_member_id (contact_group_member_id=?)
+
 Query: 
        INSERT INTO group_relays
          (group_id, group_member_id, chat_relay_id, relay_status, created_at, updated_at)
@@ -6530,6 +6565,10 @@ Query: SELECT COUNT(1) FROM contacts WHERE user_id = ? AND chat_item_ttl > 0
 Plan:
 SEARCH contacts USING INDEX idx_contacts_chat_ts (user_id=?)

+Query: SELECT COUNT(1) FROM group_members WHERE member_role = 'owner' AND member_pub_key IS NOT NULL
+Plan:
+SCAN group_members
+
 Query: SELECT COUNT(1) FROM groups WHERE user_id = ? AND chat_item_ttl > 0
 Plan:
 SEARCH groups USING INDEX sqlite_autoindex_groups_2 (user_id=?)
@@ -22,7 +22,7 @@ import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Char (isSpace, toUpper)
 import Data.Function (on)
 import Data.Int (Int64)
-import Data.List (groupBy, intercalate, intersperse, sortOn)
+import Data.List (groupBy, intercalate, intersperse, nub, sortOn)
 import Data.List.NonEmpty (NonEmpty (..))
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
@@ -148,8 +148,8 @@ chatResponseToView hu cfg@ChatConfig {logLevel, showReactions, testView} liveIte
  CRConnectionVerified u verified code -> ttyUser u [plain $ if verified then "connection verified" else "connection not verified, current code is " <> code]
  CRContactCode u ct code -> ttyUser u $ viewContactCode ct code testView
  CRGroupMemberCode u g m code -> ttyUser u $ viewGroupMemberCode g m code testView
-  CRNewChatItems u chatItems -> viewChatItems ttyUser unmuted u chatItems ts tz
-  CRChatItems u _ chatItems -> ttyUser u $ concatMap (\(AChatItem _ _ chat item) -> viewChatItem chat item True ts tz <> viewItemReactions item) chatItems
+  CRNewChatItems u chatItems -> viewChatItems ttyUser unmuted u chatItems ts tz testView
+  CRChatItems u _ chatItems -> ttyUser u $ concatMap (\(AChatItem _ _ chat item) -> viewChatItem chat item True ts tz <> viewItemReactions item <> viewTestInfo testView item) chatItems
  CRChatItemInfo u ci ciInfo -> ttyUser u $ viewChatItemInfo ci ciInfo tz
  CRChatItemId u itemId -> ttyUser u [plain $ maybe "no item" show itemId]
  CRChatItemUpdated u (AChatItem _ _ chat item) -> ttyUser u $ unmuted u chat item $ viewItemUpdate chat item liveItems ts tz
@@ -222,6 +222,7 @@ chatResponseToView hu cfg@ChatConfig {logLevel, showReactions, testView} liveIte
  CRLeftMemberUser u g -> ttyUser u $ [ttyGroup' g <> ": you left the group"] <> groupPreserved g
  CRGroupDeletedUser u g signed -> ttyUser u [ttyGroup' g <> ": you deleted the group" <> signedStr signed]
  CRForwardPlan u count itemIds fc -> ttyUser u $ viewForwardPlan count itemIds fc
+  CRChatMsgContent u mc -> ttyUser u $ ttyMsgContent mc <> viewMsgTestInfo testView mc
  CRRcvFileAccepted u ci -> ttyUser u $ savingFile' ci
  CRRcvFileAcceptedSndCancelled u ft -> ttyUser u $ viewRcvFileSndCancelled ft
  CRSndFileCancelled u _ ftm fts -> ttyUser u $ viewSndFileCancelled ftm fts
@@ -407,7 +408,7 @@ chatEventToView hu ChatConfig {logLevel, showReactions, showReceipts, testView}
  CEvtContactRatchetSync u ct progress -> ttyUser u $ viewContactRatchetSync ct progress
  CEvtGroupMemberRatchetSync u g m progress -> ttyUser u $ viewGroupMemberRatchetSync g m progress
  CEvtChatInfoUpdated _ _ -> []
-  CEvtNewChatItems u chatItems -> viewChatItems ttyUser unmuted u chatItems ts tz
+  CEvtNewChatItems u chatItems -> viewChatItems ttyUser unmuted u chatItems ts tz testView
  CEvtChatItemsStatusesUpdated u chatItems
    | length chatItems <= 20 ->
        concatMap
@@ -646,11 +647,12 @@ viewChatItems ::
  [AChatItem] ->
  UTCTime ->
  TimeZone ->
+  Bool ->
  [StyledString]
-viewChatItems ttyUser unmuted u chatItems ts tz
+viewChatItems ttyUser unmuted u chatItems ts tz testView
  | length chatItems <= 20 =
      concatMap
-        (\(AChatItem _ _ chat item) -> ttyUser u $ unmuted u chat item $ viewChatItem chat item False ts tz <> viewItemReactions item)
+        (\(AChatItem _ _ chat item) -> ttyUser u $ unmuted u chat item $ viewChatItem chat item False ts tz <> viewItemReactions item <> viewTestInfo testView item)
        chatItems
  | all (\aci -> aChatItemDir aci == MDRcv) chatItems = ttyUser u [sShow (length chatItems) <> " new messages"]
  | all (\aci -> aChatItemDir aci == MDSnd) chatItems = ttyUser u [sShow (length chatItems) <> " messages sent"]
@@ -949,6 +951,14 @@ viewItemReactions ChatItem {reactions} = ["      " <> viewReactions reactions |
    viewReaction CIReactionCount {reaction = MREmoji (MREmojiChar emoji), userReacted, totalReacted} =
      plain [emoji, ' '] <> (if userReacted then styled Italic else plain) (show totalReacted)

+viewTestInfo :: Bool -> ChatItem c d -> [StyledString]
+viewTestInfo testView ChatItem {content} = maybe [] (viewMsgTestInfo testView) $ ciMsgContent content
+
+viewMsgTestInfo :: Bool -> MsgContent -> [StyledString]
+viewMsgTestInfo testView = \case
+  MCChat {ownerSig = Just sig} | testView -> [viewJSON sig]
+  _ -> []
+
 viewReactionMembers :: [MemberReaction] -> [StyledString]
 viewReactionMembers memberReactions = [sShow (length memberReactions) <> " member(s) reacted"]

@@ -2039,7 +2049,7 @@ viewGroupUserChanged
 viewConnectionPlan :: ChatConfig -> ACreatedConnLink -> ConnectionPlan -> [StyledString]
 viewConnectionPlan ChatConfig {logLevel, testView} _connLink = \case
  CPInvitationLink ilp -> case ilp of
-    ILPOk contactSLinkData -> [invOrBiz contactSLinkData "ok to connect"] <> [viewJSON contactSLinkData | testView]
+    ILPOk contactSLinkData ov -> [invOrBiz contactSLinkData "ok to connect"] <> viewSigVerification ov <> [viewJSON contactSLinkData | testView]
    ILPOwnLink -> [invLink "own link"]
    ILPConnecting Nothing -> [invLink "connecting"]
    ILPConnecting (Just ct) -> [invLink ("connecting to contact " <> ttyContact' ct)]
@@ -2057,7 +2067,7 @@ viewConnectionPlan ChatConfig {logLevel, testView} _connLink = \case
          | business -> ("business address: " <>)
        _ -> ("invitation link: " <>)
  CPContactAddress cap -> case cap of
-    CAPOk contactSLinkData -> [addrOrBiz contactSLinkData "ok to connect"] <> [viewJSON contactSLinkData | testView]
+    CAPOk contactSLinkData ov -> [addrOrBiz contactSLinkData "ok to connect"] <> viewSigVerification ov <> [viewJSON contactSLinkData | testView]
    CAPOwnLink -> [ctAddr "own address"]
    CAPConnectingConfirmReconnect -> [ctAddr "connecting, allowed to reconnect"]
    CAPConnectingProhibit ct -> [ctAddr ("connecting to contact " <> ttyContact' ct)]
@@ -2075,9 +2085,10 @@ viewConnectionPlan ChatConfig {logLevel, testView} _connLink = \case
          | business -> ("business address: " <>)
        _ -> ("contact address: " <>)
  CPGroupLink glp -> case glp of
-    GLPOk groupSLinkInfo_ groupSLinkData ->
+    GLPOk groupSLinkInfo_ groupSLinkData ov ->
      let direct = maybe True (\(GroupShortLinkInfo {direct = d}) -> d) groupSLinkInfo_
       in [grpLink $ if direct then "ok to connect directly" else "ok to connect via relays"]
+            <> viewSigVerification ov
            <> [viewJSON groupSLinkData | testView]
    GLPOwnLink g -> [grpLink "own link for group " <> ttyGroup' g]
    GLPConnectingConfirmReconnect -> [grpLink "connecting, allowed to reconnect"]
@@ -2113,6 +2124,10 @@ viewConnectionPlan ChatConfig {logLevel, testView} _connLink = \case
    nextConnectPrepared Contact {preparedContact, activeConn} = case preparedContact of
      Just _ -> maybe True (\c -> connStatus c == ConnPrepared) activeConn
      _ -> False
+    viewSigVerification = \case
+      Just OVVerified -> ["owner signature: verified"]
+      Just (OVFailed r) -> ["owner signature: FAILED (" <> plain r <> ")"]
+      Nothing -> []

 viewContactUpdated :: Contact -> Contact -> [StyledString]
 viewContactUpdated
@@ -2212,7 +2227,26 @@ sentWithTime_ ts tz styledMsg CIMeta {itemTs} =
  prependFirst (ttyMsgTime ts tz itemTs <> " ") styledMsg

 ttyMsgContent :: MsgContent -> [StyledString]
-ttyMsgContent = msgPlain . msgContentText
+ttyMsgContent = \case
+  MCChat {text, chatLink, ownerSig} ->
+    let (linkInfo, name, links) = viewChatLink chatLink
+        signed = if isJust ownerSig then " (signed)" else ""
+        body = if T.null text || text `elem` links then [] else msgPlain text
+     in [plain $ linkInfo <> viewName name <> signed <> ":"] <> map plain links <> body
+  mc -> msgPlain $ msgContentText mc
+  where
+    viewChatLink = \case
+      MCLGroup {connLink, groupProfile = GroupProfile {displayName, publicGroup}} ->
+        let (ref, links) = case publicGroup of
+              Just PublicGroupProfile {groupType, groupLink} -> (textEncode groupType, nub [enc connLink, enc groupLink])
+              Nothing -> ("group", [enc connLink])
+         in ("link to join " <> ref <> " #", displayName, links)
+      MCLContact {connLink, profile = Profile {displayName}} ->
+        ("contact address of @", displayName, [enc connLink])
+      MCLInvitation {invLink, profile = Profile {displayName}} ->
+        ("one-time link of @", displayName, [enc invLink])
+    enc :: StrEncoding a => a -> Text
+    enc = safeDecodeUtf8 . strEncode

 prependFirst :: StyledString -> [StyledString] -> [StyledString]
 prependFirst s [] = [s]