OWASP-BLT · DonnieBLT · Apr 5, 2025 · Mar 21, 2025 · Mar 22, 2025 · Mar 24, 2025
diff --git a/blt/urls.py b/blt/urls.py
@@ -303,6 +303,7 @@
     contributors_view,
     create_wallet,
     delete_notification,
+    delete_thread,
     deletions,
     fetch_notifications,
     follow_user,
@@ -1090,6 +1091,7 @@
     path("api/messaging/set-public-key/", set_public_key, name="set_public_key"),
     path("api/messaging/<int:thread_id>/get-public-key/", get_public_key, name="get_public_key"),
     path("repository/<slug:slug>/activity-data/", repo_activity_data, name="repo_activity_data"),
+    path("api/messaging/thread/<int:thread_id>/delete/", delete_thread, name="delete_thread"),
     path("style-guide/", StyleGuideView.as_view(), name="style_guide"),
 ]
 

diff --git a/website/templates/messaging.html b/website/templates/messaging.html
@@ -25,11 +25,12 @@
              class="w-[30%] bg-[#e74c3c] p-[10px] overflow-y-auto">
             <h2 class="text-center text-white">Conversations</h2>
             {% for thread in threads %}
-                <div class="conversation cursor-pointer p-[10px] border-b border-white text-white hover:bg-[#e74c3c]"
+                <div class="conversation flex justify-between items-center cursor-pointer p-[10px] border-b border-white text-white hover:bg-[#e74c3c]"
                      data-id="{{ thread.id }}">
                     {% for participant in thread.participants.all %}
                         {% if participant != request.user %}{{ participant.username }}{% endif %}
                     {% endfor %}
+                    {% if participant != request.user %}<i class="fa-solid fa-xmark del-thread"></i>{% endif %}
                 </div>
             {% endfor %}
         </div>
@@ -255,6 +256,7 @@ <h2 class="text-center text-white">Conversations</h2>
                     }
                 };
                 socket.onerror = function(error) {
+                    console.error("WebSocket error:", error);
                     isConnecting = false;
                     updateConnectionStatus(false);
                 };
@@ -404,6 +406,53 @@ <h2 class="text-center text-white">Conversations</h2>
         document.getElementById("unlock-button").addEventListener("click", async function() {
             await initializeEncryptionKeys();
         });
+
+        // ===== Delete Thread =====
+
+        document.querySelectorAll('.del-thread').forEach(deleteBtn => {
+            deleteBtn.addEventListener('click', async function(e) {
+                e.stopPropagation();
+                const threadElement = this.closest('.conversation');
+                const threadId = threadElement.dataset.id;
+
+                if (confirm('Are you sure you want to delete this conversation? This cannot be undone.')) {
+                    try {
+                        const response = await fetch(`/api/messaging/thread/${threadId}/delete/`, {
+                            method: 'POST',
+                            headers: {
+                                'X-CSRFToken': getCookie('csrftoken'),
+                                'Content-Type': 'application/json'
+                            }
+                        });
+
+                        const data = await response.json();
+                        if (data.status === 'success') {
+                            // Remove the thread from UI
+                            threadElement.remove();
+
+                            // Clear chat window if this was the active thread
+                            if (currentThreadId === threadId) {
+                                document.getElementById('message-list').innerHTML = '<p id="welcome-message">Welcome to BLT DMs, search a user to start chatting.</p>';
+                                document.getElementById('message-input').style.display = 'none';
+                                document.getElementById('send-message').style.display = 'none';
+                                document.getElementById('welcome-message').style.display = 'block';
+
+                                // Close WebSocket connection
+                                if (socket) {
+                                    socket.close();
+                                }
+                                currentThreadId = null;
+                            }
+                        } else {
+                            alert('Failed to delete conversation');
+                        }
+                    } catch (error) {
+                        console.error('Error deleting thread:', error);
+                        alert('Failed to delete conversation');
+                    }
+                }
+            });
+        });
     });
     </script>
 {% endblock %}
diff --git a/website/views/user.py b/website/views/user.py
@@ -1028,6 +1028,21 @@ def view_thread(request, thread_id):
     return JsonResponse(data, safe=False)
 
 
+@login_required
+def delete_thread(request, thread_id):
+    if request.method == "POST":
+        try:
+            thread = Thread.objects.get(id=thread_id)
+            # Check if user is a participant
+            if request.user in thread.participants.all():
+                thread.delete()
+                return JsonResponse({"status": "success"})
+            return JsonResponse({"status": "error", "message": "Unauthorized"}, status=403)
+        except Thread.DoesNotExist:
+            return JsonResponse({"status": "error", "message": "Thread not found"}, status=404)
+    return JsonResponse({"status": "error", "message": "Invalid method"}, status=405)
+
+
 @login_required
 @require_http_methods(["GET"])
 def get_public_key(request, thread_id):