@raclettejs/core 0.1.18 → 0.1.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raclettejs/core",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "racletteJS core package",
   "repository": "https://gitlab.com/raclettejs/core",
   "author": "Pacifico Digital Explorations GmbH <info@raclettejs.com>",
@@ -55,21 +55,26 @@
       "import": "./services/frontend/src/orchestrator/index.ts"
     }
   },
+  "config": {},
   "dependencies": {
+    "@inquirer/prompts": "8.2.0",
+    "@types/mustache": "4.2.6",
     "chalk": "5.6.2",
     "chokidar": "3.6.0",
+    "cli-highlight": "2.1.11",
     "commander": "14.0.1",
     "dotenv": "17.2.2",
     "esbuild": "0.25.9",
     "fs-extra": "11.3.2",
     "globby": "14.1.0",
     "js-yaml": "4.1.0",
+    "mustache": "4.2.0",
     "ramda": "0.31.3",
     "tsc-alias": "1.8.16"
   },
   "devDependencies": {
     "@eslint/js": "9.35.0",
-    "@raclettejs/types": "^0.1.18",
+    "@raclettejs/types": "^0.1.20",
     "@types/fs-extra": "11.0.4",
     "@types/js-yaml": "4.0.9",
     "@types/node": "24.5.1",
@@ -87,6 +92,5 @@
     "typescript": "5.9.2",
     "typescript-eslint": "8.44.0",
     "vue-eslint-parser": "10.2.0"
-  },
-  "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"
-}
+  }
+}

package/services/backend/package.json

@@ -28,6 +28,7 @@
     "@fastify/jwt": "10.0.0",
     "@fastify/schedule": "6.0.0",
     "@fastify/sensible": "6.0.3",
+    "@fastify/rate-limit": "10.3.0",
     "@sinclair/typebox": "0.34.41",
     "@types/vary": "1.1.3",
     "axios": "1.13.2",

package/services/backend/src/app.ts

@@ -17,6 +17,7 @@ import registerCore from "./domains"
 import { registerPlugins } from "./core/pluginSystem/pluginLoader"
 import initializeSocketSystem from "./core/sockets/socketManager"
 import jwt from "./modules/authentication"
+import rateLimiter from "./modules/hooks/rate-limiter"
 import eventbus from "./core/eventBus"
 import headersPlugin from "./core/http/headers"
 import httpClient from "./core/http/httpService"
@@ -137,6 +138,8 @@ export default async (): Promise<FastifyInstance> => {
   await fastify.register(mongodb, { uri: process.env.MONGO_HOST ?? "" })
   fastify.register(headersPlugin)
   fastify.register(jwt, { secret: process.env.SERVER_TOKEN_SECRET })
+  fastify.register(rateLimiter)
+
   fastify.register(valkeyPlugin, {
     url: process.env.CACHE_URL,
     options: {
@@ -202,6 +205,7 @@ export default async (): Promise<FastifyInstance> => {
       "app-request-code",
       "app-broadcast-channels",
       "http-client-used",
+      "x-work-session-id", // For work session authentication
       "Cache-Control", // For streaming
       "Connection", // For streaming
     ],

package/services/backend/src/core/config/configService.ts

@@ -6,6 +6,10 @@ type RacletteBackendConfig = {
   sockets?: {
     autoSend?: any
   }
+  accessRateLimit?: {
+    max: number
+    timeWindow: string
+  }
   cache?: {
     persistence?: string
   }
@@ -66,7 +70,7 @@ export class ConfigService {
   public getConfig(): RacletteBackendConfig | null {
     if (!this.config) {
       if (!cachedConfig) {
-        console.error("Failed to load Raclette configuration")
+        console.error("Failed to load racletteJS configuration")
       }
       this.config = cachedConfig
     }
@@ -118,7 +122,12 @@ export class ConfigService {
 
     return socketConfig.options || {}
   }
+  // get fastify rate limiter config
+  public getFastifyRateLimits() {
+    const config = this.getConfig()
 
+    return config?.accessRateLimit ?? { max: 1000, timeWindow: "1 minute" }
+  }
   // Helper to check if a specific auto-send feature is enabled
   // Default to true unless explicitly set to false
   public isAutoSendEnabled(feature: socketDefaultAutoSend): boolean {

package/services/backend/src/core/events/eventEmitter.ts

@@ -9,6 +9,7 @@
  */
 
 type Listener = (...args: any[]) => void
+type BroadcastHook = (eventName: string, data: unknown) => void
 
 class EventEmitter {
   /*
@@ -22,6 +23,11 @@ class EventEmitter {
    */
   private eventMap?: Record<string, any>
 
+  /*
+   * @type {function} broadcastHook - optional hook for broadcasting plugin events
+   */
+  private broadcastHook?: BroadcastHook
+
   /*
    * @param {array} eventMap
    */
@@ -36,6 +42,18 @@ class EventEmitter {
     this.eventMap = eventMap
   }
 
+  /*
+   * setBroadcastHook
+   *
+   * Registers a hook function that will be called for plugin events (events containing "--")
+   * This allows the EventEmitter to broadcast plugin events to sockets without direct dependencies
+   *
+   * @param {function} hook - callback function that receives (eventName, data)
+   */
+  setBroadcastHook(hook: BroadcastHook): void {
+    this.broadcastHook = hook
+  }
+
   /*
    * on
    *
@@ -81,13 +99,20 @@ class EventEmitter {
     if (!this.isValid(event)) {
       return false
     }
-    if (typeof this.events[event] === "object") {
+
+    const hasListeners = typeof this.events[event] === "object"
+    if (hasListeners) {
       this.events[event].forEach((listener) => listener.apply(this, args))
+    }
 
-      return true
+    // Broadcast plugin events (those containing "--") to sockets if hook is registered
+    // Plugin events have format: "pluginKey--eventName" (e.g., "pacifico__cheesy-slides--marpUpdated")
+    // We broadcast regardless of whether there are listeners, as this is for socket communication
+    if (this.broadcastHook && event.includes("--") && args.length > 0) {
+      this.broadcastHook(event, args[0])
     }
 
-    return false
+    return hasListeners
   }
 
   /*
@@ -110,13 +135,13 @@ class EventEmitter {
    * isValid
    *
    * If an eventMap is present this method checks if the given event exists as
-   * key in the map. This is only done for core events, not for plugins.
+   * key in the map. Plugin events (containing "--") skip eventMap validation.
    * @param {string} event - event name
    */
   private isValid(event: string): boolean {
-    // Skip validation for plugin-prefixed events
-    if (event.includes("__") && event.includes("--")) {
-      // assume plugin
+    // Skip eventMap validation for plugin events (containing "--")
+    // Plugin events have format: "pluginKey--eventName"
+    if (event.includes("--")) {
       return true
     }
 

package/services/backend/src/core/http/request-params.plugin.ts

@@ -27,7 +27,7 @@ export default fastifyPlugin(async (fastify) => {
   fastify.addHook("onRequest", (request, reply, done) => {
     const url = request.raw.url || ""
     if (!isExcluded(url)) {
-      request.log.info(
+      request.log.debug(
         { url: request.raw.url, id: request.id },
         "Received request",
       )
@@ -39,7 +39,7 @@ export default fastifyPlugin(async (fastify) => {
   fastify.addHook("onResponse", (request, reply, done) => {
     const url = request.raw.url || ""
     if (!isExcluded(url)) {
-      request.log.info(
+      request.log.debug(
         {
           url: request.raw.url,
           statusCode: reply.statusCode,

package/services/backend/src/core/pluginSystem/pluginFastifyInstance.ts

@@ -56,6 +56,10 @@ export const createPluginFastifyInstance = (
     patch: fastify.patch,
     delete: fastify.delete,
     authenticate: fastify.authenticate,
+    authenticatedOrWorksession: () =>
+      fastify.authenticatedOrWorksession(pluginOptions.key),
+    checkPermissions: (permissionsArr) =>
+      fastify.checkPermissions(permissionsArr),
 
     // Plugin-scoped logger with plugin-specific prefix
     log: pluginLogger,
@@ -110,7 +114,6 @@ export const createPluginFastifyInstance = (
 
         fastify.log.info("[Eventbus] Emit Event " + prefixedEventName)
         fastify.eventbus.emit(prefixedEventName, data)
-        fastify.wss.emit(prefixedEventName, data)
       }
     },
 

package/services/backend/src/core/pluginSystem/pluginTypes.ts

@@ -46,7 +46,9 @@ export type PluginFastifyInstance = {
   patch: FastifyInstance["patch"]
   delete: FastifyInstance["delete"]
   authenticate: preHandlerHookHandler
-
+  /** Allow JWT or work session (X-Work-Session-Id). Plugin handles permission checks. */
+  authenticatedOrWorksession: () => preHandlerHookHandler
+  checkPermissions: () => preHandlerHookHandler
   /* LOG */
   log: ReturnType<FastifyInstance["log"]["child"]>
   /* DB */

package/services/backend/src/core/sockets/createSystemEventHandlers.ts

@@ -7,11 +7,18 @@ export const createSystemEventHandlers = (fastify: FastifyInstance) => {
 
   const sendToChannel = (payload: FrontendPayload<unknown>, key: string) => {
     // TODO rework this to handle spaces instead of project and in the future document rooms -> y.js?
+    // Is this even used? SocketManager also has wss.emit
+    fastify.log.debug(
+      `[Socket] sendToChannel ${key} to room ${payload.project} and ${payload.workSessionId}`,
+    )
     if (payload.project) {
       wss.in(payload.project).emit(key, payload)
     } else {
       wss.emit(key, payload)
     }
+    if (payload.workSessionId) {
+      wss.in(payload.workSessionId).emit(key, payload)
+    }
   }
 
   return {

package/services/backend/src/core/sockets/index.ts

@@ -2,6 +2,8 @@ import fastifyPlugin from "fastify-plugin"
 import { Server } from "socket.io"
 import configService from "@c/config/configService"
 import { getAllowedOrigins } from "@/helpers"
+import { validate } from "uuid"
+import { validateWorkSession } from "./socketManager"
 
 export default fastifyPlugin((fastify, opts, done) => {
   // Get socket configuration using the wrfastifyer
@@ -30,30 +32,76 @@ export default fastifyPlugin((fastify, opts, done) => {
         )
       }
 
-      // Instead of socketio-jwt, use this custom middleware
-      socketServer.use((socket, next) => {
+      // Dual authentication middleware: JWT or workSession
+      socketServer.use(async (socket, next) => {
+        fastify.log.debug(
+          `[Socket Auth] Starting authentication for socket: ${socket.id}`,
+        )
         try {
           const token =
             socket.handshake.auth?.token ??
             socket.handshake.headers.authorization?.split(" ")[1]
 
-          if (!token) {
-            fastify.log.warn(`Socket connection without token: ${socket.id}`)
+          // Try JWT authentication first
+          if (token) {
+            try {
+              // Verify token using fastify-jwt
+              const decoded = fastify.jwt.verify(token)
+
+              // Store decoded token on socket
+              socket.decoded_token = decoded
+              socket.isWorkSession = false
 
-            return next(new Error("Authentication failed: No token provided"))
+              return next()
+            } catch (jwtError: any) {
+              // JWT verification failed, continue to workSession check
+              fastify.log.debug(
+                `[Socket Auth] JWT verification failed for ${socket.id}: ${jwtError.message}, checking workSession`,
+              )
+            }
           }
-          // Verify token using fastify-jwt
-          const decoded = fastify.jwt.verify(token)
 
-          // Log successful authentication
-          fastify.log.debug(`Socket authenticated: ${socket.id}`)
+          // Check for workSession authentication (same validation as socketManager.validateWorkSession)
+          const sessionId = socket.handshake.auth?.sessionId
 
-          // Store decoded token on socket
-          socket.decoded_token = decoded
+          if (sessionId) {
+            fastify.log.info(
+              `[Socket Auth] Attempting workSession authentication for socket: ${socket.id}, sessionId: ${sessionId}`,
+            )
+            if (!validate(sessionId)) {
+              fastify.log.warn(
+                `[Socket Auth] Invalid sessionId format for socket: ${socket.id}`,
+              )
+              return next(
+                new Error("Authentication failed: Invalid session ID format"),
+              )
+            }
+            try {
+              const workSession = await validateWorkSession(fastify, sessionId)
+              socket.workSession = workSession as any
+              socket.isWorkSession = true
+              return next()
+            } catch (err: any) {
+              fastify.log.warn(
+                `[Socket Auth] WorkSession validation failed for socket: ${socket.id}, error: ${err.message}`,
+              )
+              return next(new Error("Invalid or expired session"))
+            }
+          }
 
-          next()
+          // No valid authentication method found
+          fastify.log.warn(
+            `[Socket Auth] Socket connection without valid authentication: ${socket.id}, hasToken: ${!!token}, hasSessionId: ${!!sessionId}`,
+          )
+          return next(
+            new Error(
+              "Authentication failed: No valid token or session provided",
+            ),
+          )
         } catch (error: any) {
-          fastify.log.error(`Socket authentication error: ${error.message}`)
+          fastify.log.error(
+            `[Socket Auth] Socket authentication error for ${socket.id}: ${error.message}, stack: ${error.stack}`,
+          )
           next(new Error("Authentication failed: Invalid token"))
         }
       })