chat read fails when batch public-keys endpoint is unavailable but per-user endpoint succeeds #94

Environment

• xurl: v1.3.1
• Platform: macOS (Apple Silicon)
• Authentication: OAuth 2.0 user context
• X App: Pay-per-use package, Production environment
• Chat keys: restored locally and registered key matches this machine

Problem

xurl chat read <conversation-id> --json --no-mark-read cannot decrypt messages because loading signing public keys fails with:

Client Forbidden
reason: client-not-enrolled

The App is already in the Pay-per-use package and Production environment. Other authenticated X API reads, the Chat conversation list, and Chat key status work.

Reproduction

The per-user public-key endpoint succeeds with the same xurl App and OAuth user:

xurl --app <app> -u <username> \
  '/2/users/<user-id>/public_keys'

Observed result:

exit=0
data present

The batch endpoint fails with the same App and OAuth user:

xurl --app <app> -u <username> \
  '/2/users/public_keys?ids=<user-id-1>,<user-id-2>'

Observed result:

Client Forbidden
reason: client-not-enrolled

The batch endpoint also fails when ids contains only one user.

Result in chat read

Because the signing keys are unavailable, the command emits errors such as:

Signature verification failed: signature missing or no matching signing key

Some conversations print null; others exit with:

Invalid events JSON: invalid type: null, expected a sequence

Suspected cause

loadSigningKeys() calls GetChatUsersPublicKeys(), which always uses:

GET /2/users/public_keys?ids=...

There is no fallback to the working per-user endpoint:

GET /2/users/:id/public_keys

Suggested fix

Keep the batch endpoint as the preferred path. If it returns 403, client-not-enrolled, or another unsupported-endpoint response, retry the missing users individually with GetChatPublicKeys() and merge successful results before calling SetSigningKeys().

No OAuth tokens, credentials, key material, or account identifiers are included in this report.