@mantiq/realtime 0.5.23 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mantiq/realtime",
-  "version": "0.5.23",
+  "version": "0.6.1",
   "description": "WebSocket, SSE, channels, broadcasting",
   "type": "module",
   "license": "MIT",

package/src/contracts/RealtimeConfig.ts

@@ -20,6 +20,19 @@ export interface RealtimeConfig {
     heartbeatInterval: number
     /** Close connection if no pong after this many ms. */
     heartbeatTimeout: number
+    /**
+     * Allow unauthenticated WebSocket connections.
+     * When false (default), connections are rejected unless an authenticator
+     * is registered via WebSocketServer.authenticate(). Must be explicitly
+     * set to true to allow anonymous connections.
+     */
+    allowAnonymous?: boolean
+    /**
+     * Maximum WebSocket message payload size in bytes.
+     * Messages exceeding this limit will cause the connection to be closed.
+     * Default: 65536 (64 KB). Passed to Bun.serve's WebSocket config.
+     */
+    maxPayloadLength?: number
   }
 
   /** SSE fallback settings. */
@@ -55,6 +68,8 @@ export const DEFAULT_CONFIG: RealtimeConfig = {
     maxConnections: 0,
     heartbeatInterval: 25_000,
     heartbeatTimeout: 10_000,
+    allowAnonymous: false,
+    maxPayloadLength: 65_536, // 64 KB
   },
   sse: {
     enabled: true,

package/src/server/WebSocketServer.ts

@@ -25,6 +25,9 @@ export class WebSocketServer implements WebSocketHandler {
   constructor(private config: RealtimeConfig) {
     this.connections = new ConnectionManager(config)
     this.channels = new ChannelManager(config)
+
+    // Security: if allowAnonymous is not explicitly true and no authenticator
+    // is registered, connections will be rejected by default (see onUpgrade).
   }
 
   // ── Configuration ──────────────────────────────────────────────────────
@@ -70,6 +73,11 @@ export class WebSocketServer implements WebSocketHandler {
       }
       userId = result.userId
       metadata = result.metadata ?? {}
+    } else if (!this.config.websocket.allowAnonymous) {
+      // Security: reject connections by default when no authenticator is
+      // configured. The developer must either register an authenticator via
+      // authenticate() or explicitly set allowAnonymous: true in config.
+      return null
     }
 
     return {
@@ -96,10 +104,29 @@ export class WebSocketServer implements WebSocketHandler {
     }
   }
 
+  /**
+   * Returns the configured maxPayloadLength for Bun.serve's WebSocket config.
+   * This enforces a server-side limit on incoming message sizes.
+   */
+  getMaxPayloadLength(): number {
+    return this.config.websocket.maxPayloadLength ?? 65_536
+  }
+
   /**
    * Called when a message is received from a client.
    */
   async message(ws: RealtimeSocket, raw: string | Buffer): Promise<void> {
+    // Security: enforce message size limit. Bun enforces maxPayloadLength at
+    // the transport level, but we double-check here as a defense-in-depth
+    // measure in case the transport config is misconfigured.
+    const maxPayload = this.config.websocket.maxPayloadLength ?? 65_536
+    const messageSize = typeof raw === 'string' ? raw.length : raw.byteLength
+    if (messageSize > maxPayload) {
+      ws.send(serialize({ event: 'error', message: 'Message exceeds maximum allowed size' }))
+      ws.close(1009, 'Message too large')
+      return
+    }
+
     const msg = parseClientMessage(raw)
     if (!msg) {
       ws.send(serialize({ event: 'error', message: 'Invalid message format' }))

package/src/sse/SSEManager.ts

@@ -137,12 +137,26 @@ export class SSEManager {
 
   /**
    * Subscribe an SSE connection to a channel.
-   * Note: SSE only supports public channels (no auth handshake).
+   *
+   * Security: private and presence channels (prefixed with `private-` or
+   * `presence-`) require authorization and are rejected via SSE, which has
+   * no auth handshake. Only public channels are allowed.
    */
   subscribe(connId: string, channel: string): boolean {
     const conn = this.connections.get(connId)
     if (!conn) return false
 
+    // Security: reject subscriptions to private/presence channels.
+    // SSE is a unidirectional transport with no auth handshake, so there
+    // is no way to authorize the client for private channels.
+    if (channel.startsWith('private-') || channel.startsWith('presence-')) {
+      this.sendEvent(conn, 'subscription_error', {
+        channel,
+        error: 'Private and presence channels are not available over SSE. Use WebSockets instead.',
+      })
+      return false
+    }
+
     conn.channels.add(channel)
 
     if (!this.channelSubscriptions.has(channel)) {