How do we plan to inform other clients about message being pinned? Shouldn't we send some kind of update?

This might be a little surprising for a user of this api to send a request with true here which means that the message will be not pinned. Maybe we should rename this to simply pin or even newPinState, or something else, but less confusing?

Yeah I plan to handle that in https://linear.app/comm/issue/ENG-3190/include-robotext-for-the-chat-when-a-message-is-pinned-and-unpinned

Good point, I'll change isPinned

A robotext message is only one part of this. But we have to make sure that clients get the info that a message is pinned so that they can display it as pinned. Do we plan to introduce a new update type? Or is the plan different?

Between our conversation on D6924 and here, I've created a task to handle this to not block review here.

https://linear.app/comm/issue/ENG-3392/alert-the-client-of-a-message-pin-unpin

From a security perspective, if we're worried about a client who has pin / unpin privileges in one thread making a request with a message from another thread, maybe an easier solution would be to update the query to

UPDATE messages
      SET pinned = 1, pin_time = ${Date.now()}
      WHERE id = ${messageID} AND thread = ${threadID}

would be a solution to prevent another query? From my thinking, this validates 1) permissions between thread and viewer, and 2) ensures that the requested message is part of the thread that the viewer has permission to pin in.

If I'm missing something though, I can also fetch the threadID from the messageID.

Yeah I have the same opinion in my comment here - if we change it there I'll change it here

Yeah that's fair I'll update to do this instead

It also makes sense. But the downside is that we won't inform a client that setting pin failed. Still, adding a condition on thread is beneficial.

Arguably we could just fetch the message and use the threadID from that