security: access control for particles (#169)

* setup firebase custom token

* docs

* docs

* feat: allow admin removing members from a network

* fix: properly handle fallback avatar and names

This is especially helpful in the case of members who were removed from
a network

js/src/hooks/use-member-management.ts

@@ -50,3 +50,13 @@ export function useRevokeInvitation(networkId: string) {
     },
   });
 }
+
+export function useRemoveMember(networkId: string) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (humanId: string) => apiClient.removeMember(networkId, humanId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["networks"] });
+    },
+  });
+}

js/src/hooks/use-stream-autoplay.ts

@@ -4,7 +4,7 @@ import type { Network, Particle, StreamProperties } from "@/api/types";
 import { apiClient } from "@/api/client";
 import { useAuthStore } from "@/stores/auth-store";
 import { useAutoplayStore } from "@/stores/autoplay-store";
-import { getInitials } from "@/lib/utils";
+import { resolveHumanDisplay } from "@/lib/humans";
 
 /**
  * Triggers autoplay when a stream's latest child changes to a new media particle.
@@ -44,9 +44,10 @@ export function useStreamAutoplay(
     if (latestChild.type !== "media") return;
 
     const particle = latestChild;
-    const creator = network?.humans?.find((h) => h.id === particle.created_by_human_id);
-    const senderName = creator?.email_prefix ?? particle.created_by_human_id;
-    const senderInitials = creator ? getInitials(creator.email) : particle.created_by_human_id.slice(0, 2).toUpperCase();
+    const { displayName, initials } = resolveHumanDisplay(
+      particle.created_by_human_id,
+      network?.humans,
+    );
 
     apiClient.getParticleDownloadUrl(particle.properties.object_id).then((downloadUrl) => {
       window.electronAutoplay.play({
@@ -56,8 +57,8 @@ export function useStreamAutoplay(
         downloadUrl,
         mimeType: particle.properties.mime_type,
         durationMs: particle.properties.duration_ms,
-        senderName,
-        senderInitials,
+        senderName: displayName,
+        senderInitials: initials,
       });
     }).catch(() => {
       // Failed to get download URL — skip autoplay silently