@hapi/nes 14.0.1 → 14.0.2

package/lib/listener.js

@@ -441,26 +441,37 @@ internals.Sockets.prototype.add = function (socket) {
 };
 
 
-internals.Sockets.prototype.auth = function (socket) {
+internals.Sockets.prototype.auth = function (socket, previous, credentials) {
+
+    // Called before the socket credentials are replaced
+
+    if (!this._listener._settings.auth.index ||
+        !this._items[socket.id]) {                              // Closed while authenticating
 
-    if (!this._listener._settings.auth.index) {
         return;
     }
 
-    if (!socket.auth.credentials.user) {
-        return;
+    const user = credentials.user;
+    if (user === previous) {
+        return;                                                 // Same user as before, index unchanged
     }
 
-    const user = socket.auth.credentials.user;
-    if (this._listener._settings.auth.maxConnectionsPerUser &&
+    if (user &&
+        this._listener._settings.auth.maxConnectionsPerUser &&
         this._byUser[user] &&
         this._byUser[user].length >= this._listener._settings.auth.maxConnectionsPerUser) {
 
         throw Boom.serverUnavailable('Too many connections for the authenticated user');
     }
 
-    this._byUser[user] = this._byUser[user] ?? [];
-    this._byUser[user].push(socket);
+    if (previous) {
+        this._deindex(socket, previous);
+    }
+
+    if (user) {
+        this._byUser[user] = this._byUser[user] ?? [];
+        this._byUser[user].push(socket);
+    }
 };
 
 
@@ -471,12 +482,17 @@ internals.Sockets.prototype.remove = function (socket) {
     if (socket.auth.credentials &&
         socket.auth.credentials.user) {
 
-        const user = socket.auth.credentials.user;
-        if (this._byUser[user]) {
-            this._byUser[user] = this._byUser[user].filter((item) => item !== socket);
-            if (!this._byUser[user].length) {
-                delete this._byUser[user];
-            }
+        this._deindex(socket, socket.auth.credentials.user);
+    }
+};
+
+
+internals.Sockets.prototype._deindex = function (socket, user) {
+
+    if (this._byUser[user]) {
+        this._byUser[user] = this._byUser[user].filter((item) => item !== socket);
+        if (!this._byUser[user].length) {
+            delete this._byUser[user];
         }
     }
 };
@@ -582,15 +598,52 @@ internals.Subscribers.prototype._remove = async function (socket, path, params)
 };
 
 
+internals.Subscribers.prototype.reauth = function (socket, previous) {
+
+    // Called after the socket credentials are replaced
+
+    if (!this._settings.auth ||
+        !this._settings.auth.index) {
+
+        return;
+    }
+
+    const user = socket.auth.credentials.user;
+    if (user === previous) {
+        return;
+    }
+
+    const item = this._items[socket.id];
+    if (!item) {
+        return;                                                 // Removed while the socket was closing
+    }
+
+    if (previous) {
+        this._deindex(item, previous);
+    }
+
+    if (user) {
+        this._byUser[user] = this._byUser[user] ?? [];
+        this._byUser[user].push(item);
+    }
+};
+
+
 internals.Subscribers.prototype._cleanup = function (socket, item) {
 
     delete this._items[socket.id];
 
     if (socket.auth.credentials &&
-        socket.auth.credentials.user &&
-        this._byUser[socket.auth.credentials.user]) {
+        socket.auth.credentials.user) {
+
+        this._deindex(item, socket.auth.credentials.user);
+    }
+};
+
+
+internals.Subscribers.prototype._deindex = function (item, user) {
 
-        const user = socket.auth.credentials.user;
+    if (this._byUser[user]) {
         this._byUser[user] = this._byUser[user].filter((record) => record !== item);
         if (!this._byUser[user].length) {
             delete this._byUser[user];

package/lib/socket.js

@@ -598,6 +598,9 @@ internals.Socket.prototype._authByCookie = async function () {
 
 internals.Socket.prototype._setCredentials = function (auth) {
 
+    const previous = this.auth.credentials ? this.auth.credentials.user : undefined;
+    this._listener._sockets.auth(this, previous, auth.credentials);     // Throws before any state changes when the user limit is reached
+
     this.auth.isAuthenticated = true;
     this.auth.credentials = auth.credentials;
     this.auth.artifacts = auth.artifacts;
@@ -605,7 +608,9 @@ internals.Socket.prototype._setCredentials = function (auth) {
 
     this.auth._verified = Date.now();
 
-    this._listener._sockets.auth(this);
+    for (const subscribers of new Set(Object.values(this._subscriptions))) {     // Paths on the same route share one subscribers object
+        subscribers.reauth(this, previous);
+    }
 };
 
 

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@hapi/nes",
   "description": "WebSocket adapter plugin for hapi routes",
-  "version": "14.0.1",
-  "repository": "git://github.com/hapijs/nes",
+  "version": "14.0.2",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/hapijs/nes"
+  },
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "engines": {
@@ -37,9 +40,9 @@
     "joi": "^17.13.3",
     "typescript": "^5.4.5"
   },
+  "license": "BSD-3-Clause",
   "scripts": {
     "test": "lab -a @hapi/code -t 100 -L -m 10000 -Y",
     "test-cov-html": "lab -a @hapi/code -r html -o coverage.html -m 10000"
-  },
-  "license": "BSD-3-Clause"
-}
+  }
+}