allow bot membership in gdm streams

[miguel-nascimento]

Allows the user stream side of bot gdm. Stacked on #4860

• Allow GDM streams in validUserMembershipStream() for app users
• Handle GDM stream type in ownerChainAuthForInviter() (no ownership check needed - authorization is handled by gdmBotSponsorEntitlements() on the GDM stream side)

Claude take on why:

  The event flow:

  1. GDM created with bot
  2. derivedGDMMembershipEvents() → UserPayload_UserMembership for bot
  3. Event added to bot's user stream
  4. validUserMembershipStream() ← BLOCKS HERE (returns false for GDM)
  5. chainAuthForUserMembership() → ownerChainAuthForInviter() ← ERRORS HERE
  6. parentEventForUserMembership() → MemberPayload_Membership for GDM
  7. gdmBotSponsorEntitlements() runs ← PR 4860 added this

  PR 4860 added step 7 - the gdmBotSponsorEntitlements() check.

  My changes fix steps 4 and 5:
  ┌──────┬──────────────────────────────────────────────────────────────────────┬────────────────────────────────────┐
  │ Step │                               Problem                                │               My Fix               │
  ├──────┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────┤
  │ 4    │ validUserMembershipStream() returns false for GDM streams            │ Remove GDM from the blocked list   │
  ├──────┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────┤
  │ 5    │ ownerChainAuthForInviter() only handles Space/Channel, errors on GDM │ Add GDM case that returns nil, nil │
  └──────┴──────────────────────────────────────────────────────────────────────┴────────────────────────────────────┘
  Without my changes, the flow dies at step 4 or 5 and never reaches step 7 where PR 4860's entitlement check runs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
river-sample-app	Ready	Preview, Comment	Jan 15, 2026 6:31am

[cursor]

PR Summary

Allow bot membership in GDMs; refine auth handling

• Permits app users to join GDM streams by relaxing validUserMembershipStream() (DMs still disallowed for apps)
• Handles GDM in ownerChainAuthForInviter() by returning no ownership check; bot authorization handled via gdmBotSponsorEntitlements() on the GDM stream side

^{Written by Cursor Bugbot for commit c173f49. This will update automatically on new commits. Configure here.}

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
node/rpc/TestGDMBotMembership_BotJoinWithSponsor	View Logs

[cursor]

Bots cannot self-leave GDM streams due to unhandled case

Medium Severity

When a bot initiates its own leave from a GDM, chainAuthForUserMembership() calls addRemoveChannelChainAuthForApp() (since Inviter equals the bot's own address). However, addRemoveChannelChainAuthForApp() only handles STREAM_CHANNEL_BIN and returns an error for GDM streams: "Invalid stream for app join, wanted channel". The PR updated ownerChainAuthForInviter() to return nil, nil for GDMs (handling member-initiated bot additions) but didn't update the self-initiated path. Bots can join GDMs but cannot leave on their own.

Additional Locations (1)

• core/node/rules/can_add_event.go#L1698-L1704

 

[texuf]

If it feels good ship it i will review it thoroughly on friday when im back.