@resolveio/server-lib 22.1.17 → 22.1.19

package/server-app.js

@@ -76,6 +76,7 @@ exports.ResolveIOMainServer = void 0;
 var express = require("express");
 var xmlParser = require("express-xml-bodyparser");
 var http_1 = require("http");
+var crypto = require("crypto");
 var fs = require("fs");
 var jwt = require("jsonwebtoken");
 var moment = require("moment-timezone");
@@ -142,9 +143,16 @@ var ResolveIOMainServer = /** @class */ (function () {
         this._isWorkersEnabled = false;
         this._isWorkerInstance = false;
         this._safeShutdown = false;
+        this._dynamicAppGatewayEnabled = false;
+        this._dynamicAppGatewayCache = new Map();
+        this._socketTier = '';
+        this._maxClientSockets = 0;
+        this._singleIpPerUser = false;
+        this._socketPolicyUpgradeUrl = '';
         this._clientHeartbeatIntervalMs = 20000;
         this._clientHeartbeatInitialDelayMs = 5000;
         this._clientHeartbeatBackpressureBytes = 5 * 1024 * 1024;
+        this._dynamicAppGatewayCacheMs = 30 * 1000;
     }
     ResolveIOMainServer.create = function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -184,6 +192,18 @@ var ResolveIOMainServer = /** @class */ (function () {
                         this._timerDebugSampleRate = this.resolveTimerDebugSampleRate();
                         this._timerDebugLogLimit = this.resolveTimerDebugLogLimit();
                         this._aiWorkerDebug = this.parseDebugFlag(process.env.AI_ASSISTANT_WORKER_DEBUG);
+                        this._dynamicAppGatewayEnabled = this.resolveDynamicAppGatewayEnabled();
+                        this._socketTier = this.resolveSocketTier();
+                        this._maxClientSockets = this.resolveMaxClientSockets(this._socketTier);
+                        this._singleIpPerUser = this.resolveSingleIpPerUserPolicy(this._socketTier);
+                        this._socketPolicyUpgradeUrl = this.resolveSocketPolicyUpgradeUrl();
+                        if (this._maxClientSockets > 0 || this._singleIpPerUser) {
+                            console.info(new Date(), '[Socket Policy] configured', {
+                                tier: this._socketTier || 'none',
+                                maxClientSockets: this._maxClientSockets,
+                                singleIpPerUser: this._singleIpPerUser
+                            });
+                        }
                         _a = this;
                         return [4 /*yield*/, monitor_manager_1.MonitorManager.create()];
                     case 1:
@@ -566,6 +586,7 @@ var ResolveIOMainServer = /** @class */ (function () {
         if (this.LOGGER === 'DEBUG') {
             console.log('Setup cors');
         }
+        this.installDynamicAppGatewayMiddleware();
         // Set up http login route
         (0, auth_1.setupAuthRoutes)(this, this._app, resolveio_server_app_1.ResolveIOServer.getServerConfig());
         (0, health_1.setupHealthRoutes)(this._app);
@@ -577,6 +598,377 @@ var ResolveIOMainServer = /** @class */ (function () {
             console.log('Setup express routes');
         }
     };
+    ResolveIOMainServer.prototype.installDynamicAppGatewayMiddleware = function () {
+        var _this = this;
+        if (!this._dynamicAppGatewayEnabled) {
+            return;
+        }
+        this._app.use(function (req, res, next) { return __awaiter(_this, void 0, void 0, function () {
+            var appId, appDoc, allowedHosts, controlHosts, requestHost, originHeader, originHost, expectedToken, providedToken, error_4;
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        appId = this.extractDynamicAppGatewayId(req);
+                        if (!appId) {
+                            next();
+                            return [2 /*return*/];
+                        }
+                        _d.label = 1;
+                    case 1:
+                        _d.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.resolveCachedDynamicAppGatewayApp(appId)];
+                    case 2:
+                        appDoc = _d.sent();
+                        if (!appDoc) {
+                            res.status(404).send(JSON.stringify({
+                                error: true,
+                                result: 'App not found.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        allowedHosts = this.resolveDynamicAppAllowedHosts(appDoc);
+                        controlHosts = this.resolveDynamicAppControlHosts();
+                        requestHost = this.normalizeHostname(this.normalizeHeaderValue((_a = req.headers) === null || _a === void 0 ? void 0 : _a['x-forwarded-host'])
+                            || this.normalizeHeaderValue((_b = req.headers) === null || _b === void 0 ? void 0 : _b.host));
+                        originHeader = this.normalizeHeaderValue((_c = req.headers) === null || _c === void 0 ? void 0 : _c.origin);
+                        originHost = this.resolveOriginHostname(originHeader);
+                        if (requestHost && controlHosts.has(requestHost) && !this.isLocalHostname(requestHost)) {
+                            res.status(403).send(JSON.stringify({
+                                error: true,
+                                result: 'App API must be requested from an app domain.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        if (requestHost && !allowedHosts.has(requestHost) && !this.isLocalHostname(requestHost)) {
+                            res.status(403).send(JSON.stringify({
+                                error: true,
+                                result: 'Host not allowed for app API.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        if (originHost && controlHosts.has(originHost) && !this.isLocalHostname(originHost)) {
+                            res.status(403).send(JSON.stringify({
+                                error: true,
+                                result: 'App API origin must be an app domain.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        if (originHost && !allowedHosts.has(originHost)) {
+                            res.status(403).send(JSON.stringify({
+                                error: true,
+                                result: 'Origin not allowed for app API.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        if (originHeader) {
+                            this.applyDynamicAppGatewayCorsHeaders(res, originHeader);
+                        }
+                        if (req.method === 'OPTIONS') {
+                            res.status(204).end();
+                            return [2 /*return*/];
+                        }
+                        expectedToken = this.normalizeHeaderValue(appDoc === null || appDoc === void 0 ? void 0 : appDoc.rio_token);
+                        if (!expectedToken) {
+                            res.status(500).send(JSON.stringify({
+                                error: true,
+                                result: 'App token is not configured.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        providedToken = this.resolveDynamicAppGatewayToken(req);
+                        if (!providedToken || providedToken !== expectedToken) {
+                            res.status(401).send(JSON.stringify({
+                                error: true,
+                                result: 'Invalid or missing RIO token.'
+                            }));
+                            return [2 /*return*/];
+                        }
+                        next();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        error_4 = _d.sent();
+                        console.error(new Date(), '[DynamicAppGateway] middleware failure', error_4);
+                        res.status(500).send(JSON.stringify({
+                            error: true,
+                            result: (error_4 === null || error_4 === void 0 ? void 0 : error_4.message) || 'Dynamic app gateway error.'
+                        }));
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        }); });
+    };
+    ResolveIOMainServer.prototype.resolveDynamicAppGatewayEnabled = function () {
+        var _a;
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        var raw = (_a = config['AI_CODER_DYNAMIC_APP_GATEWAY']) !== null && _a !== void 0 ? _a : process.env.AI_CODER_DYNAMIC_APP_GATEWAY;
+        if (raw !== undefined && raw !== null && "".concat(raw).trim() !== '') {
+            return this.parseDebugFlag(raw);
+        }
+        var urls = [
+            config['ROOT_URL'],
+            config['SEC_ROOT_URL'],
+            config['SERVER_URL'],
+            process.env.ROOT_URL,
+            process.env.SEC_ROOT_URL,
+            process.env.SERVER_URL
+        ]
+            .map(function (value) { return "".concat(value || '').trim().toLowerCase(); })
+            .filter(Boolean);
+        return urls.some(function (value) { return value.includes('aicoder'); });
+    };
+    ResolveIOMainServer.prototype.extractDynamicAppGatewayId = function (req) {
+        var rawPath = "".concat(req.originalUrl || req.url || req.path || '');
+        var normalizedPath = rawPath.split('?')[0];
+        if (!normalizedPath.startsWith('/api/apps/')) {
+            return '';
+        }
+        var parts = normalizedPath.split('/').filter(Boolean);
+        if (parts.length < 3) {
+            return '';
+        }
+        return "".concat(parts[2] || '').trim();
+    };
+    ResolveIOMainServer.prototype.resolveDynamicAppGatewayToken = function (req) {
+        var e_1, _a, e_2, _b, e_3, _c;
+        var _d, _e, _f, _g, _h;
+        var authHeader = this.normalizeHeaderValue(((_d = req.headers) === null || _d === void 0 ? void 0 : _d.authorization) || ((_e = req.headers) === null || _e === void 0 ? void 0 : _e.Authorization));
+        if (authHeader) {
+            var bearerMatch = authHeader.match(/^bearer\s+(.+)$/i);
+            if (bearerMatch && bearerMatch[1]) {
+                return bearerMatch[1].trim();
+            }
+        }
+        var headerCandidates = [
+            (_f = req.headers) === null || _f === void 0 ? void 0 : _f['x-rio-token'],
+            (_g = req.headers) === null || _g === void 0 ? void 0 : _g['x-app-token'],
+            (_h = req.headers) === null || _h === void 0 ? void 0 : _h['x-api-key']
+        ];
+        try {
+            for (var headerCandidates_1 = __values(headerCandidates), headerCandidates_1_1 = headerCandidates_1.next(); !headerCandidates_1_1.done; headerCandidates_1_1 = headerCandidates_1.next()) {
+                var candidate = headerCandidates_1_1.value;
+                var value = this.normalizeHeaderValue(candidate);
+                if (value) {
+                    return value;
+                }
+            }
+        }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        finally {
+            try {
+                if (headerCandidates_1_1 && !headerCandidates_1_1.done && (_a = headerCandidates_1.return)) _a.call(headerCandidates_1);
+            }
+            finally { if (e_1) throw e_1.error; }
+        }
+        var body = req.body || {};
+        var query = req.query || {};
+        var bodyCandidates = [body.rioToken, body.rio_token, body.apiKey, body.token];
+        try {
+            for (var bodyCandidates_1 = __values(bodyCandidates), bodyCandidates_1_1 = bodyCandidates_1.next(); !bodyCandidates_1_1.done; bodyCandidates_1_1 = bodyCandidates_1.next()) {
+                var candidate = bodyCandidates_1_1.value;
+                var value = this.normalizeHeaderValue(candidate);
+                if (value) {
+                    return value;
+                }
+            }
+        }
+        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        finally {
+            try {
+                if (bodyCandidates_1_1 && !bodyCandidates_1_1.done && (_b = bodyCandidates_1.return)) _b.call(bodyCandidates_1);
+            }
+            finally { if (e_2) throw e_2.error; }
+        }
+        var queryCandidates = [query.rioToken, query.rio_token, query.apiKey, query.token];
+        try {
+            for (var queryCandidates_1 = __values(queryCandidates), queryCandidates_1_1 = queryCandidates_1.next(); !queryCandidates_1_1.done; queryCandidates_1_1 = queryCandidates_1.next()) {
+                var candidate = queryCandidates_1_1.value;
+                var value = this.normalizeHeaderValue(candidate);
+                if (value) {
+                    return value;
+                }
+            }
+        }
+        catch (e_3_1) { e_3 = { error: e_3_1 }; }
+        finally {
+            try {
+                if (queryCandidates_1_1 && !queryCandidates_1_1.done && (_c = queryCandidates_1.return)) _c.call(queryCandidates_1);
+            }
+            finally { if (e_3) throw e_3.error; }
+        }
+        return '';
+    };
+    ResolveIOMainServer.prototype.normalizeHeaderValue = function (value) {
+        if (Array.isArray(value)) {
+            return value.map(function (entry) { return "".concat(entry || '').trim(); }).filter(Boolean).join(',');
+        }
+        return "".concat(value || '').trim();
+    };
+    ResolveIOMainServer.prototype.normalizeHostname = function (value) {
+        var raw = "".concat(value || '').trim();
+        if (!raw) {
+            return '';
+        }
+        var candidate = raw.split(',')[0].trim();
+        if (!candidate) {
+            return '';
+        }
+        try {
+            if (candidate.startsWith('http://') || candidate.startsWith('https://')) {
+                return new url_1.URL(candidate).hostname.toLowerCase();
+            }
+            if (candidate.includes('/')) {
+                return new url_1.URL("http://".concat(candidate)).hostname.toLowerCase();
+            }
+        }
+        catch (_a) { }
+        candidate = candidate.replace(/^\[/, '').replace(/\]$/, '');
+        var lastColon = candidate.lastIndexOf(':');
+        if (lastColon > -1 && candidate.indexOf(':') === lastColon) {
+            candidate = candidate.slice(0, lastColon);
+        }
+        return candidate.toLowerCase();
+    };
+    ResolveIOMainServer.prototype.resolveOriginHostname = function (origin) {
+        var raw = "".concat(origin || '').trim();
+        if (!raw) {
+            return '';
+        }
+        try {
+            return new url_1.URL(raw).hostname.toLowerCase();
+        }
+        catch (_a) {
+            return this.normalizeHostname(raw);
+        }
+    };
+    ResolveIOMainServer.prototype.isLocalHostname = function (hostname) {
+        var normalized = this.normalizeHostname(hostname);
+        return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+    };
+    ResolveIOMainServer.prototype.resolveDynamicAppControlHosts = function () {
+        var e_4, _a;
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        var hosts = new Set();
+        var candidates = [
+            config['ROOT_URL'],
+            config['SEC_ROOT_URL'],
+            config['SERVER_URL'],
+            process.env.ROOT_URL,
+            process.env.SEC_ROOT_URL,
+            process.env.SERVER_URL,
+            process.env.AI_CODER_ROOT_URL,
+            process.env.AI_CODER_SEC_ROOT_URL,
+            process.env.AI_CODER_SERVER_URL
+        ];
+        try {
+            for (var candidates_1 = __values(candidates), candidates_1_1 = candidates_1.next(); !candidates_1_1.done; candidates_1_1 = candidates_1.next()) {
+                var candidate = candidates_1_1.value;
+                var normalized = this.normalizeHostname("".concat(candidate || ''));
+                if (normalized) {
+                    hosts.add(normalized);
+                }
+            }
+        }
+        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+        finally {
+            try {
+                if (candidates_1_1 && !candidates_1_1.done && (_a = candidates_1.return)) _a.call(candidates_1);
+            }
+            finally { if (e_4) throw e_4.error; }
+        }
+        return hosts;
+    };
+    ResolveIOMainServer.prototype.resolveDynamicAppAllowedHosts = function (appDoc) {
+        var e_5, _a;
+        var hosts = new Set();
+        var candidates = [
+            appDoc === null || appDoc === void 0 ? void 0 : appDoc.domain,
+            appDoc === null || appDoc === void 0 ? void 0 : appDoc.backend_domain
+        ];
+        if ((appDoc === null || appDoc === void 0 ? void 0 : appDoc.subdomain) && (appDoc === null || appDoc === void 0 ? void 0 : appDoc.domain_base)) {
+            candidates.push("".concat(appDoc.subdomain, ".").concat(appDoc.domain_base));
+        }
+        try {
+            for (var candidates_2 = __values(candidates), candidates_2_1 = candidates_2.next(); !candidates_2_1.done; candidates_2_1 = candidates_2.next()) {
+                var candidate = candidates_2_1.value;
+                var normalized = this.normalizeHostname("".concat(candidate || ''));
+                if (normalized) {
+                    hosts.add(normalized);
+                }
+            }
+        }
+        catch (e_5_1) { e_5 = { error: e_5_1 }; }
+        finally {
+            try {
+                if (candidates_2_1 && !candidates_2_1.done && (_a = candidates_2.return)) _a.call(candidates_2);
+            }
+            finally { if (e_5) throw e_5.error; }
+        }
+        return hosts;
+    };
+    ResolveIOMainServer.prototype.applyDynamicAppGatewayCorsHeaders = function (res, origin) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization, X-Rio-Token, X-API-Key');
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+        res.setHeader('Access-Control-Max-Age', '600');
+    };
+    ResolveIOMainServer.prototype.resolveCachedDynamicAppGatewayApp = function (appId) {
+        return __awaiter(this, void 0, void 0, function () {
+            var now, cached, db, appCollection, appDoc, generated;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        now = Date.now();
+                        cached = this._dynamicAppGatewayCache.get(appId);
+                        if (cached && cached.expiresAt > now) {
+                            return [2 /*return*/, cached.app];
+                        }
+                        db = resolveio_server_app_1.ResolveIOServer.getMainDB();
+                        if (!db) {
+                            return [2 /*return*/, null];
+                        }
+                        appCollection = db.collection('ai-coder-apps');
+                        return [4 /*yield*/, appCollection.findOne({ _id: appId }, {
+                                projection: {
+                                    _id: 1,
+                                    domain: 1,
+                                    backend_domain: 1,
+                                    subdomain: 1,
+                                    domain_base: 1,
+                                    rio_token: 1
+                                }
+                            })];
+                    case 1:
+                        appDoc = _a.sent();
+                        if (!appDoc) {
+                            this._dynamicAppGatewayCache.delete(appId);
+                            return [2 /*return*/, null];
+                        }
+                        if (!!this.normalizeHeaderValue(appDoc.rio_token)) return [3 /*break*/, 3];
+                        generated = crypto.randomBytes(32).toString('hex');
+                        return [4 /*yield*/, appCollection.updateOne({ _id: appId }, {
+                                $set: {
+                                    rio_token: generated,
+                                    updatedAt: new Date()
+                                }
+                            })];
+                    case 2:
+                        _a.sent();
+                        appDoc.rio_token = generated;
+                        _a.label = 3;
+                    case 3:
+                        this._dynamicAppGatewayCache.set(appId, {
+                            expiresAt: now + this._dynamicAppGatewayCacheMs,
+                            app: appDoc
+                        });
+                        return [2 /*return*/, appDoc];
+                }
+            });
+        });
+    };
     ResolveIOMainServer.prototype.safeShutdown = function () {
         return __awaiter(this, void 0, void 0, function () {
             var _a;
@@ -760,36 +1152,44 @@ var ResolveIOMainServer = /** @class */ (function () {
                         }
                         else {
                             jwt.verify(token, resolveio_server_app_1.ResolveIOServer.getServerConfig()['JWT_SECRET'], function (err, decoded) { return __awaiter(_this, void 0, void 0, function () {
-                                var user, _a;
+                                var user, socketAdmission, _a;
                                 return __generator(this, function (_b) {
                                     switch (_b.label) {
                                         case 0:
                                             if (!err) return [3 /*break*/, 1];
                                             cb(false, 401, 'Unauthorized');
-                                            return [3 /*break*/, 5];
+                                            return [3 /*break*/, 8];
                                         case 1:
                                             info.req['id_user'] = decoded['id_user'];
                                             _b.label = 2;
                                         case 2:
-                                            _b.trys.push([2, 4, , 5]);
+                                            _b.trys.push([2, 7, , 8]);
                                             return [4 /*yield*/, user_collection_1.Users.findById(decoded['id_user'])];
                                         case 3:
                                             user = _b.sent();
-                                            if (user) {
-                                                info.req['user'] = user.fullname;
-                                                info.req['user_readonly'] = user.readonly || false;
-                                                info.req['doc_user'] = user;
-                                                cb(true);
-                                            }
-                                            else {
-                                                cb(false);
-                                            }
-                                            return [3 /*break*/, 5];
+                                            if (!user) return [3 /*break*/, 5];
+                                            return [4 /*yield*/, this.evaluateClientSocketAdmission(decoded['id_user'], info.req)];
                                         case 4:
+                                            socketAdmission = _b.sent();
+                                            if (!socketAdmission.allowed) {
+                                                cb(false, socketAdmission.statusCode, socketAdmission.message || 'Socket connection rejected.');
+                                                return [2 /*return*/];
+                                            }
+                                            info.req['user'] = user.fullname;
+                                            info.req['user_readonly'] = user.readonly || false;
+                                            info.req['doc_user'] = user;
+                                            info.req['client_ip'] = socketAdmission.clientIp;
+                                            cb(true);
+                                            return [3 /*break*/, 6];
+                                        case 5:
+                                            cb(false);
+                                            _b.label = 6;
+                                        case 6: return [3 /*break*/, 8];
+                                        case 7:
                                             _a = _b.sent();
                                             cb(false);
-                                            return [3 /*break*/, 5];
-                                        case 5: return [2 /*return*/];
+                                            return [3 /*break*/, 8];
+                                        case 8: return [2 /*return*/];
                                     }
                                 });
                             }); });
@@ -808,288 +1208,334 @@ var ResolveIOMainServer = /** @class */ (function () {
         this._serverHTTP.listen(this._portHTTP, host, function () {
             console.log('Running HTTP/WS server on port %s', _this._portHTTP);
         });
-        this._serverWSS.on('connection', function (ws, req) {
-            var _a, _b;
-            if (req.url && req.url.includes('workerToken=')) {
-                // It's a WORKER
-                var workerId_1 = (0, common_1.objectIdHexString)();
-                ws['id_worker'] = workerId_1;
-                var workerIndex = null;
-                var workerInstance = null;
-                ws['supportsBinary'] = true;
-                if (req.url) {
-                    var rootUrl = resolveio_server_app_1.ResolveIOServer.getServerConfig()['ROOT_URL'] || 'http://localhost';
-                    try {
-                        var requestUrl = new url_1.URL(req.url, rootUrl);
-                        workerIndex = requestUrl.searchParams.get('workerIndex');
-                        workerInstance = requestUrl.searchParams.get('workerInstance');
-                    }
-                    catch (_c) {
+        this._serverWSS.on('connection', function (ws, req) { return __awaiter(_this, void 0, void 0, function () {
+            var workerId_1, workerIndex, workerInstance, rootUrl, requestUrl, workerIndexForLog, workerInstanceForLog, interval_1, lastComm_1, missedPongs_1, heartbeatIntervalMs, maxMissedPongs_1, maxSilenceMs_1, socketAdmission, socketPolicyError_1;
+            var _this = this;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (!(req.url && req.url.includes('workerToken='))) return [3 /*break*/, 1];
+                        workerId_1 = (0, common_1.objectIdHexString)();
+                        ws['id_worker'] = workerId_1;
                         workerIndex = null;
                         workerInstance = null;
-                    }
-                }
-                if (!workerIndex && req['workerIndex']) {
-                    workerIndex = req['workerIndex'];
-                }
-                if (!workerInstance && req['workerInstance']) {
-                    workerInstance = req['workerInstance'];
-                }
-                if (workerIndex !== null && workerIndex !== undefined) {
-                    ws['workerIndex'] = workerIndex;
-                }
-                if (workerInstance !== null && workerInstance !== undefined) {
-                    ws['workerInstance'] = workerInstance;
-                }
-                var workerIndexForLog = ws['workerIndex'] || 'UNKNOWN';
-                var workerInstanceForLog = ws['workerInstance'] || 'UNKNOWN';
-                console.log(new Date(), 'Worker Connected', workerIndexForLog, workerInstanceForLog);
-                _this._workerDispatcherManager.addWorker(ws);
-                var interval_1 = null;
-                var lastComm_1 = new Date();
-                var missedPongs_1 = 0;
-                var heartbeatIntervalMs = 30000;
-                var maxMissedPongs_1 = 2;
-                var maxSilenceMs_1 = heartbeatIntervalMs * (maxMissedPongs_1 + 1);
-                _this._workerDispatcherManager.sendWorkerPayload(ws, 'ping');
-                interval_1 = setInterval(function () {
-                    var now = Date.now();
-                    var last = lastComm_1 ? lastComm_1.getTime() : 0;
-                    var silenceMs = last ? now - last : maxSilenceMs_1 + 1;
-                    if (silenceMs > maxSilenceMs_1 || missedPongs_1 > maxMissedPongs_1) {
-                        _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
-                        ws.close();
-                        return;
-                    }
-                    missedPongs_1 += 1;
-                    _this._workerDispatcherManager.sendWorkerPayload(ws, 'ping');
-                }, heartbeatIntervalMs);
-                ws.on('message', function (message) {
-                    lastComm_1 = new Date();
-                    if (typeof message === 'string') {
-                        if (message === 'ping') {
-                            _this._workerDispatcherManager.sendWorkerPayload(ws, 'pong');
-                        }
-                        else if (message === 'pong') {
-                            missedPongs_1 = 0;
+                        ws['supportsBinary'] = true;
+                        if (req.url) {
+                            rootUrl = resolveio_server_app_1.ResolveIOServer.getServerConfig()['ROOT_URL'] || 'http://localhost';
+                            try {
+                                requestUrl = new url_1.URL(req.url, rootUrl);
+                                workerIndex = requestUrl.searchParams.get('workerIndex');
+                                workerInstance = requestUrl.searchParams.get('workerInstance');
+                            }
+                            catch (_c) {
+                                workerIndex = null;
+                                workerInstance = null;
+                            }
                         }
-                        else {
-                            _this._workerDispatcherManager.handleWorkerMessage(ws['id_worker'], message);
+                        if (!workerIndex && req['workerIndex']) {
+                            workerIndex = req['workerIndex'];
                         }
-                        return;
-                    }
-                    var buffer;
-                    if (Buffer.isBuffer(message)) {
-                        buffer = message;
-                    }
-                    else if (Array.isArray(message)) {
-                        var chunks = message;
-                        buffer = Buffer.concat(chunks);
-                    }
-                    else if (message instanceof ArrayBuffer) {
-                        buffer = Buffer.from(message);
-                    }
-                    else if (ArrayBuffer.isView(message)) {
-                        var view = message;
-                        buffer = Buffer.from(view.buffer, view.byteOffset, view.byteLength);
-                    }
-                    else {
-                        buffer = Buffer.from(message);
-                    }
-                    if (buffer.length === 4) {
-                        var heartbeat = buffer.toString('utf8');
-                        if (heartbeat === 'ping') {
-                            _this._workerDispatcherManager.sendWorkerPayload(ws, 'pong');
-                            return;
+                        if (!workerInstance && req['workerInstance']) {
+                            workerInstance = req['workerInstance'];
                         }
-                        else if (heartbeat === 'pong') {
-                            missedPongs_1 = 0;
-                            return;
+                        if (workerIndex !== null && workerIndex !== undefined) {
+                            ws['workerIndex'] = workerIndex;
                         }
-                    }
-                    _this._workerDispatcherManager.handleWorkerMessage(ws['id_worker'], buffer);
-                });
-                ws.on('close', function () {
-                    _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
-                    console.log(new Date(), 'Worker disconnected:', workerId_1);
-                    if (interval_1) {
-                        clearInterval(interval_1);
-                    }
-                });
-                ws.on('error', function (error) {
-                    _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
-                    console.error('Error on WS Worker', error);
-                    ws.close();
-                });
-            }
-            else {
-                // Normal client
-                ws['id_socket'] = (0, common_1.objectIdHexString)();
-                ws['supportsBinary'] = true;
-                ws['id_user'] = req['id_user'];
-                ws['user'] = req['user'];
-                ws['user_readonly'] = req['user_readonly'];
-                ws['doc_user'] = req['doc_user'];
-                _this._websocketManager.addWebSocket(ws);
-                _this.logConnectDebug('WS client connected', {
-                    id_socket: ws['id_socket'],
-                    id_user: ws['id_user'],
-                    user: ws['user'],
-                    url: req === null || req === void 0 ? void 0 : req.url,
-                    ip: (_a = req === null || req === void 0 ? void 0 : req.socket) === null || _a === void 0 ? void 0 : _a.remoteAddress,
-                    origin: (_b = req === null || req === void 0 ? void 0 : req.headers) === null || _b === void 0 ? void 0 : _b.origin
-                });
-                setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
-                    return __generator(this, function (_a) {
-                        switch (_a.label) {
-                            case 0: return [4 /*yield*/, this.triggerClientHeartbeat(ws)];
-                            case 1:
-                                _a.sent();
-                                return [2 /*return*/];
-                        }
-                    });
-                }); }, _this._clientHeartbeatInitialDelayMs);
-                if (_this.LOGGER === 'DEBUG') {
-                    console.log('Connection from user: ' + req['user']);
-                }
-                ws['isAlive'] = true;
-                ws['retryCnt'] = 0;
-                ws.on('pong', function () {
-                    ws['isAlive'] = true;
-                    ws['pongTime'] = new Date();
-                    if (ws['pingTime']) {
-                        ws['latency'] = moment.duration(moment(ws['pongTime']).diff(ws['pingTime'])).asMilliseconds();
-                        _this._subscriptionManager.loggedInLatency(ws);
-                    }
-                });
-                ws.on('message', function (message) { return __awaiter(_this, void 0, void 0, function () {
-                    var socketData, usedBinary, bufferPayload, decodeResult, decodeResult, decodeResult, view, decodeResult, e_1, correlationId, context;
-                    return __generator(this, function (_a) {
-                        switch (_a.label) {
-                            case 0:
-                                this._debugMsgRecv += 1;
-                                socketData = [];
-                                usedBinary = false;
-                                _a.label = 1;
-                            case 1:
-                                _a.trys.push([1, 2, , 4]);
-                                if (typeof message === 'string') {
-                                    if (message === 'ping' || message === 'pong') {
-                                        socketData = message;
-                                    }
-                                    else {
-                                        socketData = JSON.parse(message, common_1.dateReviver);
-                                    }
-                                }
-                                else if (Buffer.isBuffer(message)) {
-                                    bufferPayload = message;
-                                    decodeResult = this.decodeBufferPayload(bufferPayload);
-                                    socketData = decodeResult.data;
-                                    usedBinary = decodeResult.usedBinary;
+                        if (workerInstance !== null && workerInstance !== undefined) {
+                            ws['workerInstance'] = workerInstance;
+                        }
+                        workerIndexForLog = ws['workerIndex'] || 'UNKNOWN';
+                        workerInstanceForLog = ws['workerInstance'] || 'UNKNOWN';
+                        console.log(new Date(), 'Worker Connected', workerIndexForLog, workerInstanceForLog);
+                        this._workerDispatcherManager.addWorker(ws);
+                        interval_1 = null;
+                        lastComm_1 = new Date();
+                        missedPongs_1 = 0;
+                        heartbeatIntervalMs = 30000;
+                        maxMissedPongs_1 = 2;
+                        maxSilenceMs_1 = heartbeatIntervalMs * (maxMissedPongs_1 + 1);
+                        this._workerDispatcherManager.sendWorkerPayload(ws, 'ping');
+                        interval_1 = setInterval(function () {
+                            var now = Date.now();
+                            var last = lastComm_1 ? lastComm_1.getTime() : 0;
+                            var silenceMs = last ? now - last : maxSilenceMs_1 + 1;
+                            if (silenceMs > maxSilenceMs_1 || missedPongs_1 > maxMissedPongs_1) {
+                                _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
+                                ws.close();
+                                return;
+                            }
+                            missedPongs_1 += 1;
+                            _this._workerDispatcherManager.sendWorkerPayload(ws, 'ping');
+                        }, heartbeatIntervalMs);
+                        ws.on('message', function (message) {
+                            lastComm_1 = new Date();
+                            if (typeof message === 'string') {
+                                if (message === 'ping') {
+                                    _this._workerDispatcherManager.sendWorkerPayload(ws, 'pong');
                                 }
-                                else if (Array.isArray(message)) {
-                                    bufferPayload = Buffer.concat(message);
-                                    decodeResult = this.decodeBufferPayload(bufferPayload);
-                                    socketData = decodeResult.data;
-                                    usedBinary = decodeResult.usedBinary;
+                                else if (message === 'pong') {
+                                    missedPongs_1 = 0;
                                 }
-                                else if (message instanceof ArrayBuffer) {
-                                    bufferPayload = Buffer.from(message);
-                                    decodeResult = this.decodeBufferPayload(bufferPayload);
-                                    socketData = decodeResult.data;
-                                    usedBinary = decodeResult.usedBinary;
+                                else {
+                                    _this._workerDispatcherManager.handleWorkerMessage(ws['id_worker'], message);
                                 }
-                                else if (ArrayBuffer.isView(message)) {
-                                    view = message;
-                                    bufferPayload = Buffer.from(view.buffer, view.byteOffset, view.byteLength);
-                                    decodeResult = this.decodeBufferPayload(bufferPayload);
-                                    socketData = decodeResult.data;
-                                    usedBinary = decodeResult.usedBinary;
+                                return;
+                            }
+                            var buffer;
+                            if (Buffer.isBuffer(message)) {
+                                buffer = message;
+                            }
+                            else if (Array.isArray(message)) {
+                                var chunks = message;
+                                buffer = Buffer.concat(chunks);
+                            }
+                            else if (message instanceof ArrayBuffer) {
+                                buffer = Buffer.from(message);
+                            }
+                            else if (ArrayBuffer.isView(message)) {
+                                var view = message;
+                                buffer = Buffer.from(view.buffer, view.byteOffset, view.byteLength);
+                            }
+                            else {
+                                buffer = Buffer.from(message);
+                            }
+                            if (buffer.length === 4) {
+                                var heartbeat = buffer.toString('utf8');
+                                if (heartbeat === 'ping') {
+                                    _this._workerDispatcherManager.sendWorkerPayload(ws, 'pong');
+                                    return;
                                 }
-                                else {
-                                    throw new Error('Unsupported WebSocket message type: ' + typeof message);
+                                else if (heartbeat === 'pong') {
+                                    missedPongs_1 = 0;
+                                    return;
                                 }
-                                return [3 /*break*/, 4];
-                            case 2:
-                                e_1 = _a.sent();
-                                console.log('Error - WS message parse', e_1);
-                                correlationId = (0, common_1.objectIdHexString)();
-                                context = {
-                                    rawBinary: bufferPayload ? bufferPayload.toString('base64') : undefined,
-                                    rawMessage: typeof message === 'string' ? message : undefined,
-                                    error: e_1 instanceof Error ? { name: e_1.name, message: e_1.message, stack: e_1.stack } : e_1
-                                };
-                                return [4 /*yield*/, this.reportServerError('SERVER - JSON Parse Error - ' + resolveio_server_app_1.ResolveIOServer.getServerConfig()['CLIENT_NAME'], correlationId, context, { context: 'websocket-message-parse' }, 'error', e_1 instanceof Error ? e_1.stack : undefined)];
-                            case 3:
-                                _a.sent();
-                                return [2 /*return*/];
-                            case 4:
-                                if (usedBinary) {
-                                    ws['supportsBinary'] = true;
+                            }
+                            _this._workerDispatcherManager.handleWorkerMessage(ws['id_worker'], buffer);
+                        });
+                        ws.on('close', function () {
+                            _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
+                            console.log(new Date(), 'Worker disconnected:', workerId_1);
+                            if (interval_1) {
+                                clearInterval(interval_1);
+                            }
+                        });
+                        ws.on('error', function (error) {
+                            _this._workerDispatcherManager.disconnectWorker(ws['id_worker']);
+                            console.error('Error on WS Worker', error);
+                            ws.close();
+                        });
+                        return [3 /*break*/, 6];
+                    case 1:
+                        // Normal client
+                        ws['id_socket'] = (0, common_1.objectIdHexString)();
+                        ws['supportsBinary'] = true;
+                        ws['id_user'] = req['id_user'];
+                        ws['user'] = req['user'];
+                        ws['user_readonly'] = req['user_readonly'];
+                        ws['doc_user'] = req['doc_user'];
+                        ws['client_ip'] = this.resolveClientIp(req);
+                        socketAdmission = void 0;
+                        _b.label = 2;
+                    case 2:
+                        _b.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, this.evaluateClientSocketAdmission(ws['id_user'], req)];
+                    case 3:
+                        socketAdmission = _b.sent();
+                        return [3 /*break*/, 5];
+                    case 4:
+                        socketPolicyError_1 = _b.sent();
+                        this.logConnectDebug('WS socket policy evaluation failed', {
+                            id_socket: ws['id_socket'],
+                            id_user: ws['id_user'],
+                            user: ws['user'],
+                            ip: ws['client_ip'],
+                            error: (socketPolicyError_1 === null || socketPolicyError_1 === void 0 ? void 0 : socketPolicyError_1.message) || socketPolicyError_1
+                        });
+                        try {
+                            ws.close(1011, 'Socket policy error');
+                        }
+                        catch (_d) { }
+                        return [2 /*return*/];
+                    case 5:
+                        if (!socketAdmission.allowed) {
+                            this.logConnectDebug('WS client rejected', {
+                                id_socket: ws['id_socket'],
+                                id_user: ws['id_user'],
+                                user: ws['user'],
+                                ip: ws['client_ip'],
+                                reason: socketAdmission.message
+                            });
+                            try {
+                                ws.close(1008, this.buildSocketLimitCloseReason());
+                            }
+                            catch (_e) { }
+                            return [2 /*return*/];
+                        }
+                        ws['client_ip'] = socketAdmission.clientIp || ws['client_ip'];
+                        this._websocketManager.addWebSocket(ws);
+                        this.logConnectDebug('WS client connected', {
+                            id_socket: ws['id_socket'],
+                            id_user: ws['id_user'],
+                            user: ws['user'],
+                            url: req === null || req === void 0 ? void 0 : req.url,
+                            ip: ws['client_ip'],
+                            origin: (_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a.origin
+                        });
+                        setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, this.triggerClientHeartbeat(ws)];
+                                    case 1:
+                                        _a.sent();
+                                        return [2 /*return*/];
                                 }
-                                // call our existing processSocketMessage
-                                return [4 /*yield*/, this.processSocketMessage(ws, socketData)];
-                            case 5:
-                                // call our existing processSocketMessage
-                                _a.sent();
-                                return [2 /*return*/];
-                        }
-                    });
-                }); })
-                    .on('end', function () {
-                    ws.close();
-                })
-                    .on('error', function () {
-                    ws.close();
-                })
-                    .on('close', function () { return __awaiter(_this, void 0, void 0, function () {
-                    return __generator(this, function (_a) {
-                        switch (_a.label) {
-                            case 0:
-                                this.logConnectDebug('WS client closed', {
-                                    id_socket: ws['id_socket'],
-                                    id_user: ws['id_user'],
-                                    user: ws['user']
-                                });
-                                return [4 /*yield*/, this.unsubscribeWS(ws)];
-                            case 1:
-                                _a.sent();
-                                return [2 /*return*/];
-                        }
-                    });
-                }); });
-                // Do not block message handler registration on DB write; this avoids losing
-                // very-early subscription messages sent immediately after websocket open.
-                setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
-                    var error_4;
-                    return __generator(this, function (_a) {
-                        switch (_a.label) {
-                            case 0:
-                                _a.trys.push([0, 2, , 3]);
-                                return [4 /*yield*/, this._subscriptionManager.createLoggedInUser(ws['id_socket'])];
-                            case 1:
-                                _a.sent();
-                                return [3 /*break*/, 3];
-                            case 2:
-                                error_4 = _a.sent();
-                                console.error(new Date(), 'Error creating logged-in user', ws['id_socket'], error_4);
-                                this.logConnectDebug('Create logged-in user failed', {
-                                    id_socket: ws['id_socket'],
-                                    id_user: ws['id_user'],
-                                    user: ws['user'],
-                                    error: (error_4 === null || error_4 === void 0 ? void 0 : error_4.message) || error_4
-                                });
-                                return [3 /*break*/, 3];
-                            case 3: return [2 /*return*/];
+                            });
+                        }); }, this._clientHeartbeatInitialDelayMs);
+                        if (this.LOGGER === 'DEBUG') {
+                            console.log('Connection from user: ' + req['user']);
                         }
-                    });
-                }); }, 0);
-            }
-        });
+                        ws['isAlive'] = true;
+                        ws['retryCnt'] = 0;
+                        ws.on('pong', function () {
+                            ws['isAlive'] = true;
+                            ws['pongTime'] = new Date();
+                            if (ws['pingTime']) {
+                                ws['latency'] = moment.duration(moment(ws['pongTime']).diff(ws['pingTime'])).asMilliseconds();
+                                _this._subscriptionManager.loggedInLatency(ws);
+                            }
+                        });
+                        ws.on('message', function (message) { return __awaiter(_this, void 0, void 0, function () {
+                            var socketData, usedBinary, bufferPayload, decodeResult, decodeResult, decodeResult, view, decodeResult, e_6, correlationId, context;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        this._debugMsgRecv += 1;
+                                        socketData = [];
+                                        usedBinary = false;
+                                        _a.label = 1;
+                                    case 1:
+                                        _a.trys.push([1, 2, , 4]);
+                                        if (typeof message === 'string') {
+                                            if (message === 'ping' || message === 'pong') {
+                                                socketData = message;
+                                            }
+                                            else {
+                                                socketData = JSON.parse(message, common_1.dateReviver);
+                                            }
+                                        }
+                                        else if (Buffer.isBuffer(message)) {
+                                            bufferPayload = message;
+                                            decodeResult = this.decodeBufferPayload(bufferPayload);
+                                            socketData = decodeResult.data;
+                                            usedBinary = decodeResult.usedBinary;
+                                        }
+                                        else if (Array.isArray(message)) {
+                                            bufferPayload = Buffer.concat(message);
+                                            decodeResult = this.decodeBufferPayload(bufferPayload);
+                                            socketData = decodeResult.data;
+                                            usedBinary = decodeResult.usedBinary;
+                                        }
+                                        else if (message instanceof ArrayBuffer) {
+                                            bufferPayload = Buffer.from(message);
+                                            decodeResult = this.decodeBufferPayload(bufferPayload);
+                                            socketData = decodeResult.data;
+                                            usedBinary = decodeResult.usedBinary;
+                                        }
+                                        else if (ArrayBuffer.isView(message)) {
+                                            view = message;
+                                            bufferPayload = Buffer.from(view.buffer, view.byteOffset, view.byteLength);
+                                            decodeResult = this.decodeBufferPayload(bufferPayload);
+                                            socketData = decodeResult.data;
+                                            usedBinary = decodeResult.usedBinary;
+                                        }
+                                        else {
+                                            throw new Error('Unsupported WebSocket message type: ' + typeof message);
+                                        }
+                                        return [3 /*break*/, 4];
+                                    case 2:
+                                        e_6 = _a.sent();
+                                        console.log('Error - WS message parse', e_6);
+                                        correlationId = (0, common_1.objectIdHexString)();
+                                        context = {
+                                            rawBinary: bufferPayload ? bufferPayload.toString('base64') : undefined,
+                                            rawMessage: typeof message === 'string' ? message : undefined,
+                                            error: e_6 instanceof Error ? { name: e_6.name, message: e_6.message, stack: e_6.stack } : e_6
+                                        };
+                                        return [4 /*yield*/, this.reportServerError('SERVER - JSON Parse Error - ' + resolveio_server_app_1.ResolveIOServer.getServerConfig()['CLIENT_NAME'], correlationId, context, { context: 'websocket-message-parse' }, 'error', e_6 instanceof Error ? e_6.stack : undefined)];
+                                    case 3:
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                    case 4:
+                                        if (usedBinary) {
+                                            ws['supportsBinary'] = true;
+                                        }
+                                        // call our existing processSocketMessage
+                                        return [4 /*yield*/, this.processSocketMessage(ws, socketData)];
+                                    case 5:
+                                        // call our existing processSocketMessage
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                            .on('end', function () {
+                            ws.close();
+                        })
+                            .on('error', function () {
+                            ws.close();
+                        })
+                            .on('close', function () { return __awaiter(_this, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        this.logConnectDebug('WS client closed', {
+                                            id_socket: ws['id_socket'],
+                                            id_user: ws['id_user'],
+                                            user: ws['user']
+                                        });
+                                        return [4 /*yield*/, this.unsubscribeWS(ws)];
+                                    case 1:
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); });
+                        // Do not block message handler registration on DB write; this avoids losing
+                        // very-early subscription messages sent immediately after websocket open.
+                        setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
+                            var error_5;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        _a.trys.push([0, 2, , 3]);
+                                        return [4 /*yield*/, this._subscriptionManager.createLoggedInUser(ws['id_socket'])];
+                                    case 1:
+                                        _a.sent();
+                                        return [3 /*break*/, 3];
+                                    case 2:
+                                        error_5 = _a.sent();
+                                        console.error(new Date(), 'Error creating logged-in user', ws['id_socket'], error_5);
+                                        this.logConnectDebug('Create logged-in user failed', {
+                                            id_socket: ws['id_socket'],
+                                            id_user: ws['id_user'],
+                                            user: ws['user'],
+                                            error: (error_5 === null || error_5 === void 0 ? void 0 : error_5.message) || error_5
+                                        });
+                                        return [3 /*break*/, 3];
+                                    case 3: return [2 /*return*/];
+                                }
+                            });
+                        }); }, 0);
+                        _b.label = 6;
+                    case 6: return [2 /*return*/];
+                }
+            });
+        }); });
         // Keep alive timer
         setInterval(function () { return __awaiter(_this, void 0, void 0, function () {
-            var _a, _b, ws, e_2_1;
-            var e_2, _c;
+            var _a, _b, ws, e_7_1;
+            var e_7, _c;
             return __generator(this, function (_d) {
                 switch (_d.label) {
                     case 0:
@@ -1130,14 +1576,14 @@ var ResolveIOMainServer = /** @class */ (function () {
                         return [3 /*break*/, 1];
                     case 9: return [3 /*break*/, 12];
                     case 10:
-                        e_2_1 = _d.sent();
-                        e_2 = { error: e_2_1 };
+                        e_7_1 = _d.sent();
+                        e_7 = { error: e_7_1 };
                         return [3 /*break*/, 12];
                     case 11:
                         try {
                             if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
                         }
-                        finally { if (e_2) throw e_2.error; }
+                        finally { if (e_7) throw e_7.error; }
                         return [7 /*endfinally*/];
                     case 12: return [2 /*return*/];
                 }
@@ -1146,8 +1592,8 @@ var ResolveIOMainServer = /** @class */ (function () {
     };
     ResolveIOMainServer.prototype.processSocketMessage = function (ws, socketData) {
         return __awaiter(this, void 0, void 0, function () {
-            var socketData_1, socketData_1_1, message, e_3_1;
-            var e_3, _a;
+            var socketData_1, socketData_1_1, message, e_8_1;
+            var e_8, _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
@@ -1191,14 +1637,14 @@ var ResolveIOMainServer = /** @class */ (function () {
                         return [3 /*break*/, 2];
                     case 5: return [3 /*break*/, 8];
                     case 6:
-                        e_3_1 = _b.sent();
-                        e_3 = { error: e_3_1 };
+                        e_8_1 = _b.sent();
+                        e_8 = { error: e_8_1 };
                         return [3 /*break*/, 8];
                     case 7:
                         try {
                             if (socketData_1_1 && !socketData_1_1.done && (_a = socketData_1.return)) _a.call(socketData_1);
                         }
-                        finally { if (e_3) throw e_3.error; }
+                        finally { if (e_8) throw e_8.error; }
                         return [7 /*endfinally*/];
                     case 8: return [2 /*return*/];
                 }
@@ -1605,6 +2051,267 @@ var ResolveIOMainServer = /** @class */ (function () {
         }
         return false;
     };
+    ResolveIOMainServer.prototype.parseOptionalBoolean = function (value) {
+        if (value === null || value === undefined) {
+            return null;
+        }
+        var normalized = "".concat(value).trim();
+        if (!normalized) {
+            return null;
+        }
+        return this.parseDebugFlag(normalized);
+    };
+    ResolveIOMainServer.prototype.parseNonNegativeInt = function (value, fallback) {
+        var parsed = parseInt("".concat(value !== null && value !== void 0 ? value : ''), 10);
+        if (Number.isNaN(parsed) || parsed < 0) {
+            return fallback;
+        }
+        return parsed;
+    };
+    ResolveIOMainServer.prototype.resolveSocketTier = function () {
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        return "".concat(process.env.AI_CODER_PLAN_TIER || config['AI_CODER_PLAN_TIER'] || '').trim().toLowerCase();
+    };
+    ResolveIOMainServer.prototype.resolveSocketTierKeySuffix = function (planTier) {
+        return "".concat(planTier || '')
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]+/g, '_');
+    };
+    ResolveIOMainServer.prototype.resolveMaxClientSockets = function (planTier) {
+        var _a, _b, _c;
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        var explicitLimit = this.parseNonNegativeInt((_a = config['AI_CODER_MAX_SOCKETS']) !== null && _a !== void 0 ? _a : process.env.AI_CODER_MAX_SOCKETS, -1);
+        if (explicitLimit >= 0) {
+            return explicitLimit;
+        }
+        var normalizedTier = "".concat(planTier || '').trim().toLowerCase();
+        var tierKeySuffix = this.resolveSocketTierKeySuffix(normalizedTier);
+        if (tierKeySuffix) {
+            var tierLimitKey = "AI_CODER_MAX_SOCKETS_".concat(tierKeySuffix);
+            var tierLimit = this.parseNonNegativeInt((_b = config[tierLimitKey]) !== null && _b !== void 0 ? _b : process.env[tierLimitKey], -1);
+            if (tierLimit >= 0) {
+                return tierLimit;
+            }
+        }
+        var maxUsers = this.parseNonNegativeInt((_c = config['AI_CODER_MAX_USERS']) !== null && _c !== void 0 ? _c : process.env.AI_CODER_MAX_USERS, -1);
+        if (maxUsers > 0) {
+            return maxUsers === 1 ? 1 : maxUsers * 2;
+        }
+        if (normalizedTier === 'tool') {
+            return 1;
+        }
+        if (normalizedTier === 'small') {
+            return 10;
+        }
+        if (normalizedTier === 'medium') {
+            return 50;
+        }
+        if (normalizedTier === 'large') {
+            return 200;
+        }
+        if (normalizedTier === 'enterprise') {
+            return 0;
+        }
+        return 0;
+    };
+    ResolveIOMainServer.prototype.resolveSingleIpPerUserPolicy = function (planTier) {
+        var _a, _b;
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        var normalizedTier = "".concat(planTier || '').trim().toLowerCase();
+        var tierKeySuffix = this.resolveSocketTierKeySuffix(normalizedTier);
+        if (tierKeySuffix) {
+            var tierPolicyKey = "AI_CODER_SINGLE_IP_PER_USER_".concat(tierKeySuffix);
+            var tierPolicy = this.parseOptionalBoolean((_a = config[tierPolicyKey]) !== null && _a !== void 0 ? _a : process.env[tierPolicyKey]);
+            if (tierPolicy !== null) {
+                return tierPolicy;
+            }
+        }
+        var policy = this.parseOptionalBoolean((_b = config['AI_CODER_SINGLE_IP_PER_USER']) !== null && _b !== void 0 ? _b : process.env.AI_CODER_SINGLE_IP_PER_USER);
+        if (policy !== null) {
+            return policy;
+        }
+        return !!normalizedTier;
+    };
+    ResolveIOMainServer.prototype.resolveSocketPolicyUpgradeUrl = function () {
+        var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+        var direct = "".concat(config['AI_CODER_SOCKET_UPGRADE_URL'] || process.env.AI_CODER_SOCKET_UPGRADE_URL || '').trim();
+        if (direct) {
+            return direct.replace(/\/$/, '');
+        }
+        var dashboard = "".concat(config['AI_CODER_CLIENT_DASHBOARD_URL'] || process.env.AI_CODER_CLIENT_DASHBOARD_URL || '').trim();
+        if (dashboard) {
+            return dashboard.replace(/\/$/, '');
+        }
+        var root = "".concat(config['AI_CODER_ROOT_URL'] || process.env.AI_CODER_ROOT_URL || config['ROOT_URL'] || process.env.ROOT_URL || '').trim();
+        if (!root) {
+            return '';
+        }
+        return "".concat(root.replace(/\/$/, ''), "/dashboard/client");
+    };
+    ResolveIOMainServer.prototype.resolveSocketUpgradeUrlWithAppId = function () {
+        var base = "".concat(this._socketPolicyUpgradeUrl || '').trim();
+        if (!base) {
+            return '';
+        }
+        var appId = "".concat(process.env.AI_CODER_APP_ID || '').trim();
+        if (!appId) {
+            return base;
+        }
+        var separator = base.includes('?') ? '&' : '?';
+        return "".concat(base).concat(separator, "appId=").concat(encodeURIComponent(appId));
+    };
+    ResolveIOMainServer.prototype.normalizeIpAddress = function (value) {
+        var ip = "".concat(value || '').trim();
+        if (!ip) {
+            return '';
+        }
+        if (ip.includes(',')) {
+            ip = ip.split(',')[0].trim();
+        }
+        if (ip.startsWith('::ffff:')) {
+            ip = ip.slice(7);
+        }
+        if (/^\d+\.\d+\.\d+\.\d+:\d+$/.test(ip)) {
+            ip = ip.split(':')[0].trim();
+        }
+        if (ip === '::1') {
+            return '127.0.0.1';
+        }
+        return ip.toLowerCase();
+    };
+    ResolveIOMainServer.prototype.resolveClientIp = function (req) {
+        var _a, _b, _c, _d;
+        var forwardedFor = this.normalizeHeaderValue((_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a['x-forwarded-for']);
+        if (forwardedFor) {
+            return this.normalizeIpAddress(forwardedFor);
+        }
+        var realIp = this.normalizeHeaderValue((_b = req === null || req === void 0 ? void 0 : req.headers) === null || _b === void 0 ? void 0 : _b['x-real-ip']);
+        if (realIp) {
+            return this.normalizeIpAddress(realIp);
+        }
+        var socketIp = ((_c = req === null || req === void 0 ? void 0 : req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) || ((_d = req === null || req === void 0 ? void 0 : req.connection) === null || _d === void 0 ? void 0 : _d.remoteAddress) || (req === null || req === void 0 ? void 0 : req.ip) || '';
+        return this.normalizeIpAddress(socketIp);
+    };
+    ResolveIOMainServer.prototype.buildSocketLimitMessage = function (activeSockets) {
+        var tierLabel = this._socketTier ? this._socketTier[0].toUpperCase() + this._socketTier.slice(1) : 'Current';
+        var upgradeUrl = this.resolveSocketUpgradeUrlWithAppId();
+        var base = "Socket connection limit reached (".concat(activeSockets, "/").concat(this._maxClientSockets, ") for the ").concat(tierLabel, " tier.");
+        if (!upgradeUrl) {
+            return "".concat(base, " Upgrade to increase capacity.");
+        }
+        return "".concat(base, " Upgrade at ").concat(upgradeUrl, ".");
+    };
+    ResolveIOMainServer.prototype.buildSocketLimitCloseReason = function () {
+        return "Socket limit reached (".concat(this._maxClientSockets, ")");
+    };
+    ResolveIOMainServer.prototype.disconnectUserSocketsFromDifferentIps = function (idUser, incomingIp) {
+        return __awaiter(this, void 0, void 0, function () {
+            var normalizedUser, normalizedIncomingIp, userSockets, disconnected, userSockets_1, userSockets_1_1, existingSocket, existingIp, e_9_1;
+            var e_9, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (!this._websocketManager) {
+                            return [2 /*return*/, 0];
+                        }
+                        normalizedUser = "".concat(idUser || '').trim();
+                        normalizedIncomingIp = this.normalizeIpAddress(incomingIp);
+                        if (!normalizedUser || !normalizedIncomingIp) {
+                            return [2 /*return*/, 0];
+                        }
+                        userSockets = this._websocketManager.getUserWebSockets(normalizedUser);
+                        disconnected = 0;
+                        _b.label = 1;
+                    case 1:
+                        _b.trys.push([1, 6, 7, 8]);
+                        userSockets_1 = __values(userSockets), userSockets_1_1 = userSockets_1.next();
+                        _b.label = 2;
+                    case 2:
+                        if (!!userSockets_1_1.done) return [3 /*break*/, 5];
+                        existingSocket = userSockets_1_1.value;
+                        existingIp = this.normalizeIpAddress(existingSocket === null || existingSocket === void 0 ? void 0 : existingSocket['client_ip']);
+                        if (!existingIp || existingIp === normalizedIncomingIp) {
+                            return [3 /*break*/, 4];
+                        }
+                        this.logConnectDebug('WS single-ip enforcement disconnect', {
+                            id_socket: existingSocket === null || existingSocket === void 0 ? void 0 : existingSocket['id_socket'],
+                            id_user: normalizedUser,
+                            existingIp: existingIp,
+                            incomingIp: normalizedIncomingIp
+                        });
+                        return [4 /*yield*/, this.unsubscribeWS(existingSocket)];
+                    case 3:
+                        _b.sent();
+                        if (existingSocket.readyState === WebSocket.OPEN || existingSocket.readyState === WebSocket.CONNECTING) {
+                            try {
+                                existingSocket.close(1008, 'Signed in from another IP');
+                            }
+                            catch (_c) { }
+                        }
+                        disconnected += 1;
+                        _b.label = 4;
+                    case 4:
+                        userSockets_1_1 = userSockets_1.next();
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 8];
+                    case 6:
+                        e_9_1 = _b.sent();
+                        e_9 = { error: e_9_1 };
+                        return [3 /*break*/, 8];
+                    case 7:
+                        try {
+                            if (userSockets_1_1 && !userSockets_1_1.done && (_a = userSockets_1.return)) _a.call(userSockets_1);
+                        }
+                        finally { if (e_9) throw e_9.error; }
+                        return [7 /*endfinally*/];
+                    case 8: return [2 /*return*/, disconnected];
+                }
+            });
+        });
+    };
+    ResolveIOMainServer.prototype.evaluateClientSocketAdmission = function (idUser, req) {
+        return __awaiter(this, void 0, void 0, function () {
+            var normalizedUser, clientIp, activeSockets, message;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        normalizedUser = "".concat(idUser || '').trim();
+                        clientIp = this.resolveClientIp(req);
+                        if (!this._singleIpPerUser) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.disconnectUserSocketsFromDifferentIps(normalizedUser, clientIp)];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        if (this._maxClientSockets > 0 && this._websocketManager) {
+                            activeSockets = this._websocketManager.getActiveWebSocketCount();
+                            if (activeSockets >= this._maxClientSockets) {
+                                message = this.buildSocketLimitMessage(activeSockets);
+                                this.logConnectDebug('WS socket limit blocked', {
+                                    id_user: normalizedUser,
+                                    clientIp: clientIp,
+                                    activeSockets: activeSockets,
+                                    maxClientSockets: this._maxClientSockets
+                                });
+                                return [2 /*return*/, {
+                                        allowed: false,
+                                        statusCode: 429,
+                                        message: message,
+                                        clientIp: clientIp
+                                    }];
+                            }
+                        }
+                        return [2 /*return*/, {
+                                allowed: true,
+                                statusCode: 200,
+                                message: '',
+                                clientIp: clientIp
+                            }];
+                }
+            });
+        });
+    };
     ResolveIOMainServer.prototype.logConnectDebug = function (message, details) {
         if (!this._wsConnectDebug) {
             return;
@@ -1953,7 +2660,7 @@ var ResolveIOMainServer = /** @class */ (function () {
                             });
                         }
                         setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
-                            var error_5;
+                            var error_6;
                             return __generator(this, function (_a) {
                                 switch (_a.label) {
                                     case 0:
@@ -1963,8 +2670,8 @@ var ResolveIOMainServer = /** @class */ (function () {
                                         _a.sent();
                                         return [3 /*break*/, 3];
                                     case 2:
-                                        error_5 = _a.sent();
-                                        console.error(new Date(), 'aiCoderTerminalRunCodex failed:', error_5);
+                                        error_6 = _a.sent();
+                                        console.error(new Date(), 'aiCoderTerminalRunCodex failed:', error_6);
                                         return [3 /*break*/, 3];
                                     case 3: return [2 /*return*/];
                                 }