@hapi/nes 14.0.0 → 14.0.2

package/lib/client.d.ts

@@ -1,3 +1,6 @@
+import type { ClientRequestArgs } from "http";
+import type { ClientOptions } from "ws";
+
 // Same as exported type in @hapi/hapi v20
 type HTTP_METHODS = 'ACL' | 'BIND' | 'CHECKOUT' | 'CONNECT' | 'COPY' | 'DELETE' | 'GET' | 'HEAD' | 'LINK' | 'LOCK' |
     'M-SEARCH' | 'MERGE' | 'MKACTIVITY' | 'MKCALENDAR' | 'MKCOL' | 'MOVE' | 'NOTIFY' | 'OPTIONS' | 'PATCH' | 'POST' |
@@ -173,7 +176,7 @@ export class Client {
     constructor(
         url: `ws://${string}` | `wss://${string}`,
         options?: {
-            ws?: string | string[];
+            ws?: ClientOptions | ClientRequestArgs;
             timeout?: number | boolean;
         });
 
@@ -369,4 +372,4 @@ export class Client {
      * `client.connect()`
      */
     reauthenticate(auth: ClientConnectOptions['auth']): Promise<unknown>;
-}
+}

package/lib/listener.js

@@ -441,26 +441,37 @@ internals.Sockets.prototype.add = function (socket) {
 };
 
 
-internals.Sockets.prototype.auth = function (socket) {
+internals.Sockets.prototype.auth = function (socket, previous, credentials) {
+
+    // Called before the socket credentials are replaced
+
+    if (!this._listener._settings.auth.index ||
+        !this._items[socket.id]) {                              // Closed while authenticating
 
-    if (!this._listener._settings.auth.index) {
         return;
     }
 
-    if (!socket.auth.credentials.user) {
-        return;
+    const user = credentials.user;
+    if (user === previous) {
+        return;                                                 // Same user as before, index unchanged
     }
 
-    const user = socket.auth.credentials.user;
-    if (this._listener._settings.auth.maxConnectionsPerUser &&
+    if (user &&
+        this._listener._settings.auth.maxConnectionsPerUser &&
         this._byUser[user] &&
         this._byUser[user].length >= this._listener._settings.auth.maxConnectionsPerUser) {
 
         throw Boom.serverUnavailable('Too many connections for the authenticated user');
     }
 
-    this._byUser[user] = this._byUser[user] ?? [];
-    this._byUser[user].push(socket);
+    if (previous) {
+        this._deindex(socket, previous);
+    }
+
+    if (user) {
+        this._byUser[user] = this._byUser[user] ?? [];
+        this._byUser[user].push(socket);
+    }
 };
 
 
@@ -471,12 +482,17 @@ internals.Sockets.prototype.remove = function (socket) {
     if (socket.auth.credentials &&
         socket.auth.credentials.user) {
 
-        const user = socket.auth.credentials.user;
-        if (this._byUser[user]) {
-            this._byUser[user] = this._byUser[user].filter((item) => item !== socket);
-            if (!this._byUser[user].length) {
-                delete this._byUser[user];
-            }
+        this._deindex(socket, socket.auth.credentials.user);
+    }
+};
+
+
+internals.Sockets.prototype._deindex = function (socket, user) {
+
+    if (this._byUser[user]) {
+        this._byUser[user] = this._byUser[user].filter((item) => item !== socket);
+        if (!this._byUser[user].length) {
+            delete this._byUser[user];
         }
     }
 };
@@ -582,15 +598,52 @@ internals.Subscribers.prototype._remove = async function (socket, path, params)
 };
 
 
+internals.Subscribers.prototype.reauth = function (socket, previous) {
+
+    // Called after the socket credentials are replaced
+
+    if (!this._settings.auth ||
+        !this._settings.auth.index) {
+
+        return;
+    }
+
+    const user = socket.auth.credentials.user;
+    if (user === previous) {
+        return;
+    }
+
+    const item = this._items[socket.id];
+    if (!item) {
+        return;                                                 // Removed while the socket was closing
+    }
+
+    if (previous) {
+        this._deindex(item, previous);
+    }
+
+    if (user) {
+        this._byUser[user] = this._byUser[user] ?? [];
+        this._byUser[user].push(item);
+    }
+};
+
+
 internals.Subscribers.prototype._cleanup = function (socket, item) {
 
     delete this._items[socket.id];
 
     if (socket.auth.credentials &&
-        socket.auth.credentials.user &&
-        this._byUser[socket.auth.credentials.user]) {
+        socket.auth.credentials.user) {
+
+        this._deindex(item, socket.auth.credentials.user);
+    }
+};
+
+
+internals.Subscribers.prototype._deindex = function (item, user) {
 
-        const user = socket.auth.credentials.user;
+    if (this._byUser[user]) {
         this._byUser[user] = this._byUser[user].filter((record) => record !== item);
         if (!this._byUser[user].length) {
             delete this._byUser[user];

package/lib/socket.js

@@ -237,7 +237,7 @@ internals.Socket.prototype._onMessage = async function (message) {
     try {
         var request = JSON.parse(message);
     }
-    catch (err) {
+    catch {
         return this._error(Boom.badRequest('Cannot parse message'));
     }
 
@@ -563,7 +563,7 @@ internals.Socket.prototype._authenticate = async function (request) {
             const auth = await Iron.unseal(request.auth, config.password, config.iron ?? Iron.defaults);
             this._setCredentials(auth);
         }
-        catch (err) {
+        catch {
             throw Boom.unauthorized('Invalid token');
         }
     }
@@ -585,7 +585,7 @@ internals.Socket.prototype._authByCookie = async function () {
     try {
         var { states } = await this.server.states.parse(cookies);
     }
-    catch (err) {
+    catch {
         throw Boom.unauthorized('Invalid nes authentication cookie');
     }
 
@@ -598,6 +598,9 @@ internals.Socket.prototype._authByCookie = async function () {
 
 internals.Socket.prototype._setCredentials = function (auth) {
 
+    const previous = this.auth.credentials ? this.auth.credentials.user : undefined;
+    this._listener._sockets.auth(this, previous, auth.credentials);     // Throws before any state changes when the user limit is reached
+
     this.auth.isAuthenticated = true;
     this.auth.credentials = auth.credentials;
     this.auth.artifacts = auth.artifacts;
@@ -605,7 +608,9 @@ internals.Socket.prototype._setCredentials = function (auth) {
 
     this.auth._verified = Date.now();
 
-    this._listener._sockets.auth(this);
+    for (const subscribers of new Set(Object.values(this._subscriptions))) {     // Paths on the same route share one subscribers object
+        subscribers.reauth(this, previous);
+    }
 };
 
 

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@hapi/nes",
   "description": "WebSocket adapter plugin for hapi routes",
-  "version": "14.0.0",
-  "repository": "git://github.com/hapijs/nes",
+  "version": "14.0.2",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/hapijs/nes"
+  },
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "engines": {
@@ -16,34 +19,30 @@
     "plugin",
     "websocket"
   ],
-  "eslintConfig": {
-    "extends": [
-      "plugin:@hapi/module"
-    ]
-  },
   "dependencies": {
     "@hapi/boom": "^10.0.1",
-    "@hapi/bounce": "^3.0.1",
+    "@hapi/bounce": "^3.0.2",
     "@hapi/call": "^9.0.1",
     "@hapi/cryptiles": "^6.0.1",
-    "@hapi/hoek": "^11.0.2",
+    "@hapi/hoek": "^11.0.7",
     "@hapi/iron": "^7.0.1",
     "@hapi/teamwork": "^6.0.0",
     "@hapi/validate": "^2.0.1",
-    "ws": "^8.17.1"
+    "@types/ws": "^8.5.13",
+    "ws": "^8.18.0"
   },
   "devDependencies": {
     "@hapi/code": "^9.0.3",
-    "@hapi/eslint-plugin": "*",
-    "@hapi/hapi": "^21.3.9",
-    "@hapi/lab": "^25.2.0",
-    "@types/node": "^20.14.2",
+    "@hapi/eslint-plugin": "^7.0.0",
+    "@hapi/hapi": "^21.3.12",
+    "@hapi/lab": "^26.0.0",
+    "@types/node": "^20.17.12",
     "joi": "^17.13.3",
     "typescript": "^5.4.5"
   },
+  "license": "BSD-3-Clause",
   "scripts": {
     "test": "lab -a @hapi/code -t 100 -L -m 10000 -Y",
     "test-cov-html": "lab -a @hapi/code -r html -o coverage.html -m 10000"
-  },
-  "license": "BSD-3-Clause"
-}
+  }
+}