cleanup

apps/client/src/ee/ai-chat/components/ai-chat-layout.tsx

@@ -13,6 +13,15 @@ export default function AiChatLayout() {
   const location = useLocation();
   const navigate = useNavigate();
   const chatInfoQuery = useChatInfoQuery(chatId);
+
+  // If the URL points at a chat the user does not own, the info fetch 404s.
+  // Bounce them back to /ai so they cannot interact with any chat UI (including
+  // kicking off orphan uploads) tied to a chat they have no access to.
+  useEffect(() => {
+    if (chatId && chatInfoQuery.isError) {
+      navigate("/ai", { replace: true });
+    }
+  }, [chatId, chatInfoQuery.isError, navigate]);
   const {
     messages,
     streamingContent,
@@ -48,6 +57,12 @@ export default function AiChatLayout() {
 
   const hasMessages = messages.length > 0 || isStreaming;
 
+  // While the redirect effect is running (or if the user is still on this
+  // component for any reason) never render the chat UI for a forbidden chat.
+  if (chatId && chatInfoQuery.isError) {
+    return null;
+  }
+
   return (
     <div className={classes.main}>
       {error && (

apps/client/src/ee/ai-chat/components/aside-chat-panel.tsx

@@ -73,6 +73,15 @@ export default function AsideChatPanel() {
     }
   }, [chatInfoQuery.data, hydrateFromServer]);
 
+  // Drop the open chatId if the current user lost access to it (404/403 on
+  // the info fetch). Reverts the panel to a fresh chat instead of presenting
+  // an input tied to a chat the user does not own.
+  useEffect(() => {
+    if (chatId && chatInfoQuery.isError) {
+      setChatId(undefined);
+    }
+  }, [chatId, chatInfoQuery.isError]);
+
   const handleNewChat = useCallback(
     (event: React.MouseEvent<HTMLAnchorElement>) => {
       if (