@rapidmx/meet-plugin 0.14.1 → 0.16.0

package/dist/lib/routes/BaseVideoMeetingRoute.js

@@ -22,8 +22,9 @@ import { buildIceServers } from "../util/IceServerUtils.js";
 import { hashPassword, verifyPassword as verifyPasswordHash } from "../util/PasswordUtils.js";
 import { buildBaseUrl } from "../util/PublicUrlUtils.js";
 import { RedisRelayBus } from "../util/RedisRelayBus.js";
-import { parseRelayEnabled, RELAY_LARGE_PAYLOAD_BYTES, RELAY_MAX_PAYLOAD_BYTES, RELAY_WS_MAX_BACKPRESSURE_BYTES, RelayHub, } from "../util/RelayHub.js";
+import { parseRelayEnabled, RELAY_LARGE_PAYLOAD_BYTES, RELAY_MAX_PAYLOAD_BYTES, RELAY_WS_MAX_BACKPRESSURE_BYTES, InProcessRelayBus, RelayHub, } from "../util/RelayHub.js";
 import { stripTrustedRoles } from "../util/RouteAccessUtils.js";
+import { SIGNALING_LARGE_PAYLOAD_BYTES, SIGNALING_MAX_PAYLOAD_BYTES, SignalingHub } from "../util/SignalingHub.js";
 import { JOIN_TOKEN_PATTERN, PUBLIC_SLUG_PATTERN, mintJoinToken, mintPublicSlug } from "../util/TokenUtils.js";
 import { VideoMeetingStatus, VideoMeetingVisibility } from "../models/types.js";
 const { Config, Destroy, Init, Inject, Logger } = ObjectDecorators;
@@ -42,6 +43,12 @@ const RELAY_MESSAGE_LIMIT_BYTES = WS_ROUTE_OPTIONS_SUPPORTED ? RELAY_LARGE_PAYLO
 const RELAY_WS_OPTIONS = WS_ROUTE_OPTIONS_SUPPORTED
     ? { maxPayloadLength: RELAY_LARGE_PAYLOAD_BYTES, maxBackpressure: RELAY_WS_MAX_BACKPRESSURE_BYTES }
     : undefined;
+/** The largest message a signaling socket may send: what the route asks the framework for and what `ready` tells
+ * the client. */
+const SIGNALING_MESSAGE_LIMIT_BYTES = WS_ROUTE_OPTIONS_SUPPORTED ? SIGNALING_LARGE_PAYLOAD_BYTES : SIGNALING_MAX_PAYLOAD_BYTES;
+/** The signaling route's WebSocket options: bigger messages, so a late joiner's whiteboard catch-up is a few messages.
+ * `undefined` (the framework's defaults) where it cannot be set. */
+const SIGNALING_WS_OPTIONS = WS_ROUTE_OPTIONS_SUPPORTED ? { maxPayloadLength: SIGNALING_LARGE_PAYLOAD_BYTES } : undefined;
 /** Upper bounds on caller-supplied text, matching the general shape `booking-plugin`'s `BaseBookingRoute` bounds
  * its own free-text fields with. */
 const MAX_TITLE_LENGTH = 200;
@@ -108,11 +115,11 @@ const RELAY_MAX_QUEUED_MESSAGES = 8;
  *
  * ## Why `VideoMeeting` gets its own per-record `AccessControlList`
  *
- * Unlike `Booking`, `VideoMeeting.uid` doubles as a `/push` signaling channel (see `.claude/NOTES.md`'s "Signaling"
- * design note): SDP offers/answers and ICE candidates are ordinary `NotificationUtils.sendMessage()` payloads
- * published to it, exactly as `MailPushRoute`'s doc comment describes for a `Mailbox`/`Folder` channel. A `/push`
- * channel is authorized purely by `ACLUtils.hasPermission(user, channelUid, action)` against a per-record
- * `AccessControlList` document keyed by that exact uid - there being no such document at all (the case for
+ * Unlike `Booking`, `VideoMeeting.uid` doubles as the meeting's signaling channel: SDP offers/answers and ICE
+ * candidates travel over `signal()`'s WebSocket (see "The signaling WebSocket" below; until it replaced them they
+ * were published on the server's shared `/push` route), whose room is the meeting's uid. Like a `/push` channel
+ * before it, that socket is authorized purely by `ACLUtils.hasPermission(user, meetingUid, action)` against a
+ * per-record `AccessControlList` document keyed by that exact uid - there being no such document at all (the case for
  * `Booking`, whose `@Protect` sets `recordACL: false`) makes `hasPermission()` always answer `false`. So
  * `VideoMeetingMongo`/`VideoMeetingSQL` set `recordACL: true`, and `create()` below claims that per-record ACL
  * with `parentUid` set to the meeting's own `mailboxUid` (mirroring `BaseFolderRoute`'s identical `acl: { uid,
@@ -123,17 +130,17 @@ const RELAY_MAX_QUEUED_MESSAGES = 8;
  *
  * ## The channel-ACL-grant mechanism
  *
- * An anonymous guest holds no `AccessControlList` grant of their own and has no `JWTUser` to authenticate `/push`
- * with in the first place - `join()` therefore does two things together: it mints a short-lived, scope-limited
+ * An anonymous guest holds no `AccessControlList` grant of their own and has no `JWTUser` to authenticate the
+ * meeting's WebSockets with in the first place - `join()` therefore does two things together: it mints a short-lived, scope-limited
  * guest JWT (`mintGuestToken()`: a synthetic `guest:<random>` uid, no roles, `GUEST_JWT_TTL_SECONDS` expiry, real and
  * verifiable since it's signed with the same `auth` config every other token is), and it adds an explicit
  * `ACLRecord` for that exact uid onto the meeting's own `AccessControlList` (`ensureChannelGrant()`), granting
- * `READ` (so `BasePushRoute`'s SUBSCRIBE succeeds) and `CREATE` (so a publish does - see `MailPushRoute`'s doc
- * comment: "publishing to a channel needs CREATE on it as an ordinary user would"). The grant is scoped to exactly
+ * `READ` and `CREATE` - the pair `signal()` and `relay()` both require (`authorizeMeetingSocket()`), the same pair
+ * `/push` demanded to subscribe to and publish on a channel when signaling still went through it. The grant is scoped to exactly
  * that one meeting's uid, nothing else - the same "possession of a link is the credential" pattern
  * `BaseBookingRoute.requireBookingByToken()`/`resolveEffectiveUser()`'s `share:<token>` identity already establish
- * elsewhere in this codebase, extended one step further because signaling needs a channel *subscription*, not just
- * a stateless REST call.
+ * elsewhere in this codebase, extended one step further because signaling needs a long-lived socket, not just a
+ * stateless REST call.
  *
  * **Known limitation, documented rather than silently assumed away**: because each `join()` call for an anonymous
  * caller mints a *fresh* random guest uid (so simultaneous participants of one shared link are distinguishable from
@@ -153,16 +160,16 @@ const RELAY_MAX_QUEUED_MESSAGES = 8;
  * authenticated-optional endpoint in this codebase's family (e.g. `BaseScopedChildRoute.resolveEffectiveUser()`'s
  * "prefer the real authenticated user, fall back to the anonymous token" precedent). This matters because a
  * logged-in RapidMX user's browser already carries a real, `HttpOnly` `jwt` session cookie for this origin - a
- * cookie `apps/shared/push/GuestSignalingClient.ts` cannot overwrite with a guest token even if `join()` minted one
+ * cookie `apps/shared/signaling/SignalingClient.ts` cannot overwrite with a guest token even if `join()` minted one
  * (browsers refuse to let a script override an `HttpOnly` cookie of the same name), so a guest-only `join()` would
- * leave that browser's `/push` WebSocket authenticating as the real session while the meeting's ACL only names a
- * synthetic guest uid - the subscribe is simply, safely refused, and the real user could never actually join.
+ * leave that browser's signaling WebSocket authenticating as the real session while the meeting's ACL only names a
+ * synthetic guest uid - the socket is simply, safely refused, and the real user could never actually join.
  *
  * The fix: when `user` is present and is a *real* identity - not a guest uid from a previous `join()` call, told
  * apart by the `GUEST_UID_PREFIX` a guest uid always starts with and a real, mailbox-owning identity never can -
  * `join()` grants `user.uid` itself (not a synthetic one) `READ`/`CREATE` on the meeting's channel via
  * `ensureChannelGrant()`, mints no guest JWT at all, and returns `authenticated: true` with `selfUid: user.uid`. The
- * caller's own already-existing session cookie now already authenticates `/push` for them with zero new
+ * caller's own already-existing session cookie now already authenticates `signal()` for them with zero new
  * client-side auth handling - the frontend must not write a cookie of its own in this case (see
  * `VideoMeetingJoinResult`'s doc comment). When `user` is absent (the common, true-anonymous case - no existing
  * session at all), behavior is exactly Phase 1's: a fresh guest identity is minted and granted instead.
@@ -223,6 +230,19 @@ const RELAY_MAX_QUEUED_MESSAGES = 8;
  * it): a disabled relay closes every socket with 1008 "Relay disabled." and `join()` reports `relayEnabled: false`, so
  * clients don't try it.
  *
+ * ## The signaling WebSocket (`signal()`)
+ *
+ * Every participant's offers, answers, ICE candidates, presence, moderation signals, chat messages and whiteboard
+ * strokes travel over this plugin's own WebSocket, `signal()` at `/signal/:id`
+ * (`/api/mail/video-meetings/signal/<meetingUid>`), not the server's shared `/push` route: one socket in both
+ * directions, so a message is not a whole HTTP request, and a meeting's traffic never mixes with the webmail's own
+ * push notifications. `SignalingHub` carries the messages (see it for the protocol and limits) on the same bus as the
+ * relay, so it crosses replicas exactly when the relay does. It is authorized exactly as `relay()` is (the same
+ * `READ`/`CREATE` grant from `join()`, the same live-meeting check, the same "Not permitted." for every refusal) but
+ * is never switched off - without it there is no call. The hub stamps every message with the socket's own uid and
+ * peer id, so nobody can speak as someone else, and a point-to-point message (`to`) reaches only that peer. `kick()`
+ * closes the removed participant's sockets at once.
+ *
  * ## Other known limitations
  *
  * **`VideoMeetingInvitee.joinToken` never expires** and has no GC job - identical tradeoff to `Booking.manageToken`.
@@ -257,10 +277,6 @@ export class BaseVideoMeetingRoute {
         /** The deployment's `events` datastore (`datastores:events`) - the Redis the framework's push system publishes
          * across replicas on; `null` when the deployment has none. Decides how `initRelayBus()` carries relay frames. */
         this.eventsConfig = null;
-        /** The rooms of this process's relay sockets. One per route instance. It starts out on an in-process bus, which
-         * is what a route that was never initialized (a test's) keeps; `initRelayBus()` swaps in a hub on a Redis bus
-         * when the deployment has one, before any socket can attach. Its socket caps are per server replica. */
-        this.relayHub = new RelayHub({ maxPayloadBytes: RELAY_MESSAGE_LIMIT_BYTES, logger: { debug: (message) => this.logger.debug(message) } });
         /** Every meeting's pending admission requests (`VideoMeeting.waitingRoomEnabled`), keyed by meeting uid then by
          * the requester's own uid (real or freshly minted guest). In-memory and per server instance only - the same
          * accepted tradeoff `relayHub` above already has: a restart drops anyone currently waiting, who simply
@@ -280,30 +296,53 @@ export class BaseVideoMeetingRoute {
         return this.constructor.modelClass;
     }
     /**
-     * Picks how relay frames travel between server replicas, once the route is created: over Redis pub/sub
-     * (`RedisRelayBus`) when `datastores:events` is configured, else in-process only with a single warning that
-     * participants on different replicas cannot relay to each other. A Redis bus that cannot be created (the `redis`
+     * Picks how relay frames and signaling messages travel between server replicas, once the route is created: over
+     * Redis pub/sub (`RedisRelayBus`) when `datastores:events` is configured, else in-process only with a single
+     * warning that participants on different replicas cannot reach each other. A Redis bus that cannot be created (the `redis`
      * package is missing, an unusable URL) falls back the same way, with the error logged. Runs before the route
      * serves anything, so no socket is attached to the hub it replaces.
      */
     async initRelayBus() {
+        if (!this._objectFactory) {
+            throw new Error("objectFactory is not set.");
+        }
+        if (this.relayHub) {
+            return;
+        }
+        // Named after the concrete route, so the two backends' routes never share an instance.
+        const name = this.constructor.name;
+        let bus;
         const url = this.eventsConfig?.url;
         if (!url) {
-            this.logger.warn("The `events` datastore is not configured: the video meeting relay only carries media between participants " +
+            this.logger.warn("The `events` datastore is not configured: video meeting signaling and the media relay only reach participants " +
                 "connected to this server instance, not between server replicas.");
-            return;
         }
-        const bus = new RedisRelayBus({ url, logger: this.logger });
-        try {
-            await bus.connect();
+        else {
+            const redisBus = await this._objectFactory.newInstance(RedisRelayBus, {
+                name: `${name}RedisRelayBus`,
+                args: [{ url, logger: this.logger }],
+            });
+            try {
+                await redisBus.connect();
+                this.relayBus = redisBus;
+                bus = redisBus;
+            }
+            catch (err) {
+                this.logger.error("Could not create the video meeting relay's Redis bus, so signaling and relay only work between participants connected to this " +
+                    `server instance: ${err?.message ?? err}`);
+            }
         }
-        catch (err) {
-            this.logger.error("Could not create the video meeting relay's Redis bus, so relay only works between participants connected to this " +
-                `server instance: ${err?.message ?? err}`);
-            return;
+        if (!bus) {
+            bus = await this._objectFactory.newInstance(InProcessRelayBus, { name: `${name}InProcessRelayBus`, args: [] });
         }
-        this.relayBus = bus;
-        this.relayHub = new RelayHub({ bus, maxPayloadBytes: RELAY_MESSAGE_LIMIT_BYTES, logger: { debug: (message) => this.logger.debug(message) } });
+        this.relayHub = await this._objectFactory.newInstance(RelayHub, {
+            name: `${name}RelayHub`,
+            args: [{ bus, maxPayloadBytes: RELAY_MESSAGE_LIMIT_BYTES, logger: { debug: (message) => this.logger.debug(message) } }],
+        });
+        this.signalingHub = await this._objectFactory.newInstance(SignalingHub, {
+            name: `${name}SignalingHub`,
+            args: [{ bus, maxPayloadBytes: SIGNALING_MESSAGE_LIMIT_BYTES, logger: { debug: (message) => this.logger.debug(message) } }],
+        });
     }
     /** Disconnects the Redis relay bus, if there is one, when the object factory destroys the route. (The factory
      * runs one destroy method per object: a subclass declaring its own `@Destroy` must call this one.) */
@@ -311,17 +350,21 @@ export class BaseVideoMeetingRoute {
         this.relayBus?.close();
         this.relayBus = undefined;
     }
-    async init() {
-        if (!this.meetingRepo) {
+    /** Builds the model repositories once, before the route serves anything. */
+    async initialize() {
+        if (!this._objectFactory) {
+            throw new Error("objectFactory is not set.");
+        }
+        if (!this.meetingRepo && this.meetingClass) {
             this.meetingRepo = await this._objectFactory.newInstance(RepoUtils, { name: this.meetingClass.name, args: [this.meetingClass] });
         }
-        if (!this.inviteeRepo) {
+        if (!this.inviteeRepo && this.inviteeClass) {
             this.inviteeRepo = await this._objectFactory.newInstance(RepoUtils, { name: this.inviteeClass.name, args: [this.inviteeClass] });
         }
-        if (!this.mailboxRepo) {
+        if (!this.mailboxRepo && this.mailboxClass) {
             this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, { name: this.mailboxClass.name, args: [this.mailboxClass] });
         }
-        if (!this.attendeeLinkRepo) {
+        if (!this.attendeeLinkRepo && this.attendeeLinkClass) {
             this.attendeeLinkRepo = await this._objectFactory.newInstance(RepoUtils, {
                 name: this.attendeeLinkClass.name,
                 args: [this.attendeeLinkClass],
@@ -511,7 +554,6 @@ export class BaseVideoMeetingRoute {
         return rest;
     }
     async create(rawBody, req, user) {
-        await this.init();
         const { mailboxUid, visibility } = this.validateCreateBody(rawBody);
         const body = rawBody;
         const startTime = this.requireOptionalDate(body.startTime, "startTime");
@@ -558,7 +600,6 @@ export class BaseVideoMeetingRoute {
         return result;
     }
     async find(mailboxUid, limit, page, user) {
-        await this.init();
         if (typeof mailboxUid !== "string" || !mailboxUid) {
             throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
         }
@@ -572,7 +613,6 @@ export class BaseVideoMeetingRoute {
         return meetings.map((meeting) => this.withJoinUrls(meeting));
     }
     async personalRoom(user) {
-        await this.init();
         if (!user?.uid) {
             throw new ApiError(ApiErrors.AUTH_REQUIRED, 401, ApiErrorMessages.AUTH_REQUIRED);
         }
@@ -595,12 +635,10 @@ export class BaseVideoMeetingRoute {
         throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
     }
     async findById(id, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.READ);
         return this.withJoinUrls(meeting);
     }
     async update(id, body, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.UPDATE);
         const patch = { uid: meeting.uid, version: meeting.version };
         if (body?.title !== undefined) {
@@ -653,7 +691,6 @@ export class BaseVideoMeetingRoute {
         return this.withoutPasswordHash(updated);
     }
     async delete(id, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.DELETE);
         const strippedUser = stripTrustedRoles(user, this.trustedRoles);
         const invitees = await this.findInvitees(meeting);
@@ -664,12 +701,11 @@ export class BaseVideoMeetingRoute {
         await this.meetingRepo.delete(meeting.uid, { user: strippedUser, ignoreACL: true });
     }
     async kick(id, uid, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.UPDATE);
         await this.revokeChannelGrant(meeting.uid, uid);
+        this.signalingHub?.evict(meeting.uid, uid);
     }
     async listWaiting(id, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.READ);
         const pending = this.pendingAdmissions.get(meeting.uid);
         if (!pending) {
@@ -681,7 +717,6 @@ export class BaseVideoMeetingRoute {
             .map(([uid, request]) => ({ uid, name: request.name, requestedAt: request.requestedAt.toISOString() }));
     }
     async admit(id, uid, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.UPDATE);
         const request = this.pendingAdmissions.get(meeting.uid)?.get(uid);
         if (request) {
@@ -689,7 +724,6 @@ export class BaseVideoMeetingRoute {
         }
     }
     async deny(id, uid, user) {
-        await this.init();
         const meeting = await this.requireOwnedMeeting(id, user, ACLAction.UPDATE);
         const request = this.pendingAdmissions.get(meeting.uid)?.get(uid);
         if (request) {
@@ -803,9 +837,9 @@ export class BaseVideoMeetingRoute {
     }
     /**
      * Removes `uid`'s `ACLRecord` from `meetingUid`'s own `AccessControlList`, if it has one - the mirror image of
-     * `ensureChannelGrant()`, used to enforce a kick (see `kick()`): once removed, `uid` can no longer subscribe to
-     * or publish on the meeting's `/push` channel, so even a client that ignores the cooperative `"kicked"` signal
-     * (`SignalMessage`'s doc comment) cannot keep participating. A no-op when `uid` holds no grant (already kicked,
+     * `ensureChannelGrant()`, used to enforce a kick (see `kick()`, which also closes `uid`'s open signaling sockets):
+     * once removed, `uid` can no longer open the meeting's signaling (`signal()`) or relay (`relay()`) socket, so even
+     * a client that ignores the cooperative `"kicked"` signal (`SignalMessage`'s doc comment) cannot keep participating. A no-op when `uid` holds no grant (already kicked,
      * or never joined) or the meeting has no ACL, rather than an error - the caller wants "not able to rejoin",
      * which is already true either way. Same optimistic-lock retry as `ensureChannelGrant()`, for the same reason:
      * a concurrent joiner or the owner editing the ACL directly may save first.
@@ -954,7 +988,6 @@ export class BaseVideoMeetingRoute {
         pending.set(uid, { name, requestedAt: new Date(), status: "pending" });
     }
     async join(token, user) {
-        await this.init();
         const { meeting, resolvedVia } = await this.requireMeetingByToken(token);
         await this.requireOrganizerAuth(meeting, resolvedVia, user);
         const publicMeeting = await this.buildPublicMeeting(meeting);
@@ -969,7 +1002,6 @@ export class BaseVideoMeetingRoute {
         return this.completeJoin(meeting, publicMeeting, user);
     }
     async verifyPassword(token, body, user) {
-        await this.init();
         const { meeting, resolvedVia } = await this.requireMeetingByToken(token);
         await this.requireOrganizerAuth(meeting, resolvedVia, user);
         const bypassed = resolvedVia === "organizerSlug";
@@ -988,7 +1020,6 @@ export class BaseVideoMeetingRoute {
         return this.completeJoin(meeting, publicMeeting, user);
     }
     async pollAdmission(token, user) {
-        await this.init();
         const { meeting } = await this.requireMeetingByToken(token);
         const pending = this.pendingAdmissions.get(meeting.uid)?.get(user.uid);
         if (!pending) {
@@ -1015,7 +1046,7 @@ export class BaseVideoMeetingRoute {
     /**
      * Decides whether `user` may open a relay socket to meeting `id`: the relay must be enabled, `user` must hold BOTH
      * `READ` and `CREATE` on the meeting's uid - exactly what `ensureChannelGrant()` gives a joined participant, and
-     * what `/push` demands to subscribe and publish - and the meeting must exist and be neither cancelled nor ended.
+     * what `signal()` demands too (`authorizeMeetingSocket()`) - and the meeting must exist and be neither cancelled nor ended.
      * Returns the reason to close the socket with, or `undefined` when permitted.
      *
      * `hasPermission()` gets `user` with its trusted roles stripped (`stripTrustedRoles()`), exactly as
@@ -1028,11 +1059,16 @@ export class BaseVideoMeetingRoute {
         if (!this.isRelayEnabled()) {
             return "Relay disabled.";
         }
+        return this.authorizeMeetingSocket(id, user);
+    }
+    /** Why a meeting WebSocket (`relay()`, `signal()`) of `user` for meeting `id` must be refused, or `undefined` to
+     * accept it - see `authorizeRelay()`'s doc comment for the rules, which are the same for both apart from the
+     * relay's own on/off setting. */
+    async authorizeMeetingSocket(id, user) {
         // `hasPermission()` answers `true` for an empty ACL uid, so an empty id must never reach it.
         if (!user || !id) {
             return RELAY_NOT_PERMITTED;
         }
-        await this.init();
         const checked = stripTrustedRoles(user, this.trustedRoles);
         if (!(await this.aclUtils.hasPermission(checked, id, ACLAction.READ)) || !(await this.aclUtils.hasPermission(checked, id, ACLAction.CREATE))) {
             return RELAY_NOT_PERMITTED;
@@ -1044,14 +1080,14 @@ export class BaseVideoMeetingRoute {
         return undefined;
     }
     /**
-     * The meeting uid a relay socket's URL names. `@Param("id")` is filled in by the Bun router, but NOT by the uWS
+     * The meeting uid a relay or signaling socket's URL names. `@Param("id")` is filled in by the Bun router, but NOT by the uWS
      * router this framework actually serves with: it never populates `req.params` for a WebSocket upgrade (a
      * `@WebSocket()` route has, so far, never had a path parameter - `BasePushRoute.connect()` has none). So when the
      * decorated argument is empty this reads the last segment of the request path instead, which the
-     * `/relay/:id` pattern guarantees is the id (the framework also registers the trailing-slash form; the path
+     * `/relay/:id` and `/signal/:id` patterns guarantee is the id (the framework also registers the trailing-slash form; the path
      * never carries the query string). Returns `undefined` when there is none or it isn't valid percent-encoding.
      */
-    relayMeetingId(paramId, req) {
+    socketMeetingId(paramId, req) {
         if (typeof paramId === "string" && paramId) {
             return paramId;
         }
@@ -1064,7 +1100,7 @@ export class BaseVideoMeetingRoute {
         }
     }
     async relay(paramId, req, sock, user) {
-        const id = this.relayMeetingId(paramId, req);
+        const id = this.socketMeetingId(paramId, req);
         // Listeners first, before the first await: the client may send its `hello` the moment the socket opens,
         // while the meeting is still being looked up, and an event with no listener is lost. Whatever arrives until
         // the socket is admitted is held (a few messages at most) and replayed to it.
@@ -1105,6 +1141,45 @@ export class BaseVideoMeetingRoute {
             conn?.message(message.data, message.isBinary);
         }
     }
+    async signal(paramId, req, sock, user) {
+        const id = this.socketMeetingId(paramId, req);
+        // Listeners first, before the first await - see `relay()`, which this mirrors.
+        let conn;
+        let closed = false;
+        const queued = [];
+        sock.on("message", (data, isBinary) => {
+            if (conn) {
+                conn.message(data, isBinary);
+            }
+            else if (queued.length < RELAY_MAX_QUEUED_MESSAGES) {
+                queued.push({ data, isBinary });
+            }
+        });
+        sock.on("close", () => {
+            closed = true;
+            conn?.close();
+        });
+        let refusal;
+        try {
+            refusal = await this.authorizeMeetingSocket(id, user);
+        }
+        catch (err) {
+            this.logger.error(`Failed to authorize a signaling socket for meeting ${id}: ${err?.message ?? err}`);
+            sock.close(1011, "Signaling unavailable.");
+            return;
+        }
+        if (refusal) {
+            sock.close(1008, refusal);
+            return;
+        }
+        if (closed) {
+            return;
+        }
+        conn = this.signalingHub.attach(id, user.uid, sock);
+        for (const message of queued) {
+            conn?.message(message.data, message.isBinary);
+        }
+    }
 }
 __decorate([
     Inject(ACLUtils),
@@ -1166,6 +1241,12 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", void 0)
 ], BaseVideoMeetingRoute.prototype, "destroyRelayBus", null);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseVideoMeetingRoute.prototype, "initialize", null);
 __decorate([
     Transactional(),
     __metadata("design:type", Function),
@@ -1244,7 +1325,7 @@ __decorate([
     Summary("Deletes a video meeting."),
     Description("Deletes the meeting, every one of its invitees and the calendar invite links written for them. Deleting the meeting also removes its own " +
         "per-record AccessControlList (RepoUtils.delete()'s standard recordACL cleanup - see the VideoMeeting " +
-        "interface's doc comment), so its uid stops working as a push channel immediately. Requires DELETE on " +
+        "interface's doc comment), so its uid stops authorizing a signaling or relay socket immediately. Requires DELETE on " +
         "the meeting's owning mailbox."),
     Delete("/:id"),
     __param(0, Param("id")),
@@ -1255,8 +1336,8 @@ __decorate([
 ], BaseVideoMeetingRoute.prototype, "delete", null);
 __decorate([
     Summary("Removes a participant from a video meeting."),
-    Description("Revokes 'uid's grant on the meeting's own push channel (revokeChannelGrant()), so they can no longer " +
-        "subscribe to or publish on it - and therefore can no longer signal or relay media, even if their " +
+    Description("Revokes 'uid's grant on the meeting (revokeChannelGrant()) and closes every signaling socket they hold in it " +
+        "(on every replica the bus reaches), so they can no longer signal, chat, draw or relay media, even if their " +
         "client ignores the cooperative 'kicked' signal the host's own UI also sends over the mesh (see " +
         "SignalMessage's doc comment for why that signal alone isn't enforcement). A no-op if 'uid' holds no " +
         "grant (already removed, or never joined). Requires UPDATE on the meeting's owning mailbox. " +
@@ -1317,11 +1398,11 @@ __decorate([
     Summary("Joins a video meeting."),
     Description("Resolves an invitee's join token or a public meeting's slug. If the caller already presents a valid " +
         "session for a real RapidMX identity (not a returning guest), that identity is granted READ/CREATE " +
-        "on the meeting's own push channel directly and the response carries 'authenticated: true' with no " +
-        "guest token at all - the caller's own existing session cookie/header already authenticates /push " +
-        "for them. Otherwise (the common anonymous case) mints a short-lived guest JWT (see " +
-        "GUEST_JWT_TTL_SECONDS) already granted READ/CREATE on the same channel, ready to use against /push " +
-        "to exchange WebRTC signaling messages. Requires no authentication beyond the token itself; a " +
+        "on the meeting directly and the response carries 'authenticated: true' with no " +
+        "guest token at all - the caller's own existing session cookie/header already authenticates the " +
+        "meeting's signaling WebSocket (/signal/<meetingUid>) for them. Otherwise (the common anonymous case) " +
+        "mints a short-lived guest JWT (see GUEST_JWT_TTL_SECONDS) already granted READ/CREATE on the same " +
+        "meeting, ready to use against /signal/<meetingUid> to exchange WebRTC signaling messages. Requires no authentication beyond the token itself; a " +
         "stale/unknown token answers 404. The one exception is a private meeting's organizerSlug, which is " +
         "never an anonymous surface: it additionally requires an already-authenticated caller holding READ on " +
         "the meeting's owning mailbox, and answers the very same 404 for anyone else. If the meeting requires " +
@@ -1397,4 +1478,25 @@ __decorate([
     __metadata("design:paramtypes", [Object, Object, Object, Object]),
     __metadata("design:returntype", Promise)
 ], BaseVideoMeetingRoute.prototype, "relay", null);
+__decorate([
+    Summary("Carries a video meeting's signaling over a WebSocket."),
+    Description("The meeting's own signaling channel: a WebSocket at /signal/<meetingUid> carrying JSON messages - WebRTC " +
+        "offers, answers and ICE candidates, presence, moderation, chat and whiteboard - between the meeting's " +
+        "participants (see SignalingHub for the protocol: a 'hello' first, answered with 'ready', then 'signal' " +
+        "messages both ways). The server stamps each message with the sender's own uid and peer id, and delivers a " +
+        "message naming a recipient ('to') to that participant only. Requires a JWT (a real user's, or the guest " +
+        "token join() minted) holding READ and CREATE on the meeting - the grant join() gives - and an existing, " +
+        "unended, uncancelled meeting; anything else closes the socket with code 1008. Removing a participant " +
+        "(kick) closes their sockets. With the events datastore (Redis) configured, messages reach participants " +
+        "connected to other server replicas too."),
+    Auth(["jwt"]),
+    WebSocket("/signal/:id", SIGNALING_WS_OPTIONS),
+    __param(0, Param("id")),
+    __param(1, Request),
+    __param(2, Socket),
+    __param(3, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseVideoMeetingRoute.prototype, "signal", null);
 //# sourceMappingURL=BaseVideoMeetingRoute.js.map