fix: add additional validation on legacy nonce value

fixes #169

Porting code forwards from an older revision of the codebase; https://github.com/revoltchat/backend/blob/0.5.3-alpha.10/src/database/entities/server.rs

crates/delta/src/routes/channels/message_send.rs

@@ -21,6 +21,7 @@ pub struct DataMessageSend {
     /// Unique token to prevent duplicate message sending
     ///
     /// **This is deprecated and replaced by `Idempotency-Key`!**
+    #[validate(length(min = 1, max = 64))]
     nonce: Option<String>,
 
     /// Message content to send

crates/quark/src/impl/generic/channels/channel.rs

@@ -242,7 +242,12 @@ impl Channel {
     /// Add user to a group
     pub async fn add_user_to_group(&mut self, db: &Database, user: &str, by: &str) -> Result<()> {
         if let Channel::Group { recipients, .. } = self {
-            recipients.push(user.to_string());
+            let user = user.to_string();
+            if recipients.contains(&user) {
+                return Err(Error::AlreadyInGroup);
+            }
+
+            recipients.push(user);
         }
 
         match &self {

crates/quark/src/impl/mongo/channels/channel_unread.rs

@@ -37,30 +37,46 @@ impl AbstractChannelUnread for MongoDb {
     }
 
     async fn acknowledge_channels(&self, user: &str, channels: &[String]) -> Result<()> {
+        let current_time = Ulid::new().to_string();
+
         self.col::<Document>(COL)
-            .update_one(
+            .delete_many(
                 doc! {
                     "_id.channel": {
                         "$in": channels
                     },
-                    "_id.user": user,
+                    "_id.user": user
                 },
-                doc! {
-                    "$unset": {
-                        "mentions": 1_i32
-                    },
-                    "$set": {
-                        "last_id": Ulid::new().to_string()
-                    }
-                },
-                UpdateOptions::builder().upsert(true).build(),
+                None,
             )
             .await
-            .map(|_| ())
             .map_err(|_| Error::DatabaseError {
-                operation: "update",
-                with: "channel_unread",
+                operation: "delete_many",
+                with: "channel_unreads",
+            })?;
+
+        self.col::<Document>(COL)
+            .insert_many(
+                channels
+                    .iter()
+                    .map(|channel| {
+                        doc! {
+                            "_id": {
+                                "channel": channel,
+                                "user": user
+                            },
+                            "last_id": &current_time
+                        }
+                    })
+                    .collect::<Vec<Document>>(),
+                None,
+            )
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_many",
+                with: "channel_unreads",
             })
+            .map(|_| ())
     }
 
     async fn add_mention_to_unread<'a>(