fix(whatsapp): guard updateLastRoute when dmScope isolates DM sessions

When session.dmScope is set to 'per-channel-peer', WhatsApp DMs correctly
resolve isolated session keys, but updateLastRouteInBackground unconditionally
wrote lastTo to the main session key. This caused reply routing corruption
and privacy violations.

Only update main session's lastRoute when the DM session actually IS
the main session (sessionKey === mainSessionKey).

Fixes #24912
This commit is contained in:
shenghui kevin
2026-02-23 17:56:51 -08:00
committed by Peter Steinberger
parent 6f44d92d76
commit 57783680ad

View File

@@ -324,7 +324,10 @@ export async function processMessage(params: {
OriginatingTo: params.msg.from,
});
if (dmRouteTarget) {
// Only update main session's lastRoute when DM actually IS the main session.
// When dmScope="per-channel-peer", the DM uses an isolated sessionKey,
// and updating mainSessionKey would corrupt routing for the session owner.
if (dmRouteTarget && params.route.sessionKey === params.route.mainSessionKey) {
updateLastRouteInBackground({
cfg: params.cfg,
backgroundTasks: params.backgroundTasks,