@syncular/server-hono 0.0.6-84 → 0.0.6-86

package/dist/console/routes.js

@@ -1639,9 +1639,31 @@ export function createConsoleRoutes(options) {
         const upgradeWebSocket = options.websocket.upgradeWebSocket;
         const heartbeatIntervalMs = options.websocket.heartbeatIntervalMs ?? 30000;
         const wsState = new WeakMap();
+        const closeUnauthenticated = (ws) => {
+            try {
+                ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
+            }
+            catch {
+                // ignore send errors
+            }
+            ws.close(4001, 'Unauthenticated');
+        };
+        const cleanup = (ws) => {
+            const state = wsState.get(ws);
+            if (!state)
+                return;
+            if (state.listener) {
+                emitter.removeListener(state.listener);
+            }
+            if (state.heartbeatInterval) {
+                clearInterval(state.heartbeatInterval);
+            }
+            if (state.authTimeout) {
+                clearTimeout(state.authTimeout);
+            }
+            wsState.delete(ws);
+        };
         routes.get('/events/live', upgradeWebSocket(async (c) => {
-            // Auth check via query param (WebSocket doesn't support headers easily)
-            const token = c.req.query('token');
             const authHeader = c.req.header('Authorization');
             const partitionId = c.req.query('partitionId')?.trim() || undefined;
             const replaySince = c.req.query('since');
@@ -1655,34 +1677,159 @@ export function createConsoleRoutes(options) {
             const mockContext = {
                 req: {
                     header: (name) => name === 'Authorization' ? authHeader : undefined,
-                    query: (name) => (name === 'token' ? token : undefined),
+                    query: () => undefined,
                 },
             };
-            const auth = await options.authenticate(mockContext);
+            const initialAuth = await options.authenticate(mockContext);
+            const authenticateWithBearer = async (token) => {
+                const trimmedToken = token.trim();
+                if (!trimmedToken)
+                    return null;
+                const authContext = {
+                    req: {
+                        header: (name) => name === 'Authorization' ? `Bearer ${trimmedToken}` : undefined,
+                        query: () => undefined,
+                    },
+                };
+                return options.authenticate(authContext);
+            };
             return {
                 onOpen(_event, ws) {
+                    const state = {
+                        listener: null,
+                        heartbeatInterval: null,
+                        authTimeout: null,
+                        isAuthenticated: false,
+                    };
+                    wsState.set(ws, state);
+                    const startAuthenticatedSession = () => {
+                        if (state.isAuthenticated)
+                            return;
+                        state.isAuthenticated = true;
+                        if (state.authTimeout) {
+                            clearTimeout(state.authTimeout);
+                            state.authTimeout = null;
+                        }
+                        const listener = (event) => {
+                            if (partitionId) {
+                                const eventPartitionId = event.data.partitionId;
+                                if (typeof eventPartitionId !== 'string' ||
+                                    eventPartitionId !== partitionId) {
+                                    return;
+                                }
+                            }
+                            try {
+                                ws.send(JSON.stringify(event));
+                            }
+                            catch {
+                                // Connection closed
+                            }
+                        };
+                        emitter.addListener(listener);
+                        state.listener = listener;
+                        ws.send(JSON.stringify({
+                            type: 'connected',
+                            timestamp: new Date().toISOString(),
+                        }));
+                        const replayEvents = emitter.replay({
+                            since: replaySince,
+                            limit: replayLimit,
+                            partitionId,
+                        });
+                        for (const replayEvent of replayEvents) {
+                            try {
+                                ws.send(JSON.stringify(replayEvent));
+                            }
+                            catch {
+                                // Connection closed
+                                break;
+                            }
+                        }
+                        const heartbeatInterval = setInterval(() => {
+                            try {
+                                ws.send(JSON.stringify({
+                                    type: 'heartbeat',
+                                    timestamp: new Date().toISOString(),
+                                }));
+                            }
+                            catch {
+                                clearInterval(heartbeatInterval);
+                            }
+                        }, heartbeatIntervalMs);
+                        state.heartbeatInterval = heartbeatInterval;
+                    };
+                    if (initialAuth) {
+                        startAuthenticatedSession();
+                        return;
+                    }
+                    state.authTimeout = setTimeout(() => {
+                        const current = wsState.get(ws);
+                        if (!current || current.isAuthenticated) {
+                            return;
+                        }
+                        closeUnauthenticated(ws);
+                        cleanup(ws);
+                    }, 5_000);
+                },
+                async onMessage(event, ws) {
+                    const state = wsState.get(ws);
+                    if (!state || state.isAuthenticated) {
+                        return;
+                    }
+                    if (typeof event.data !== 'string') {
+                        closeUnauthenticated(ws);
+                        cleanup(ws);
+                        return;
+                    }
+                    let token = '';
+                    try {
+                        const parsed = JSON.parse(event.data);
+                        if (parsed.type === 'auth' &&
+                            typeof parsed.token === 'string' &&
+                            parsed.token.trim().length > 0) {
+                            token = parsed.token;
+                        }
+                    }
+                    catch {
+                        // Ignore parse errors and close as unauthenticated below.
+                    }
+                    if (!token) {
+                        closeUnauthenticated(ws);
+                        cleanup(ws);
+                        return;
+                    }
+                    const auth = await authenticateWithBearer(token);
+                    const currentState = wsState.get(ws);
+                    if (!currentState || currentState.isAuthenticated) {
+                        return;
+                    }
                     if (!auth) {
-                        ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
-                        ws.close(4001, 'Unauthenticated');
+                        closeUnauthenticated(ws);
+                        cleanup(ws);
                         return;
                     }
-                    const listener = (event) => {
+                    currentState.isAuthenticated = true;
+                    if (currentState.authTimeout) {
+                        clearTimeout(currentState.authTimeout);
+                        currentState.authTimeout = null;
+                    }
+                    const listener = (liveEvent) => {
                         if (partitionId) {
-                            const eventPartitionId = event.data.partitionId;
+                            const eventPartitionId = liveEvent.data.partitionId;
                             if (typeof eventPartitionId !== 'string' ||
                                 eventPartitionId !== partitionId) {
                                 return;
                             }
                         }
                         try {
-                            ws.send(JSON.stringify(event));
+                            ws.send(JSON.stringify(liveEvent));
                         }
                         catch {
                             // Connection closed
                         }
                     };
                     emitter.addListener(listener);
-                    // Send connected message
+                    currentState.listener = listener;
                     ws.send(JSON.stringify({
                         type: 'connected',
                         timestamp: new Date().toISOString(),
@@ -1701,7 +1848,6 @@ export function createConsoleRoutes(options) {
                             break;
                         }
                     }
-                    // Start heartbeat
                     const heartbeatInterval = setInterval(() => {
                         try {
                             ws.send(JSON.stringify({
@@ -1713,23 +1859,13 @@ export function createConsoleRoutes(options) {
                             clearInterval(heartbeatInterval);
                         }
                     }, heartbeatIntervalMs);
-                    wsState.set(ws, { listener, heartbeatInterval });
+                    currentState.heartbeatInterval = heartbeatInterval;
                 },
                 onClose(_event, ws) {
-                    const state = wsState.get(ws);
-                    if (!state)
-                        return;
-                    emitter.removeListener(state.listener);
-                    clearInterval(state.heartbeatInterval);
-                    wsState.delete(ws);
+                    cleanup(ws);
                 },
                 onError(_event, ws) {
-                    const state = wsState.get(ws);
-                    if (!state)
-                        return;
-                    emitter.removeListener(state.listener);
-                    clearInterval(state.heartbeatInterval);
-                    wsState.delete(ws);
+                    cleanup(ws);
                 },
             };
         }));
@@ -2704,25 +2840,17 @@ async function hashApiKey(secretKey) {
  * The token can be set via SYNC_CONSOLE_TOKEN env var or passed directly.
  */
 export function createTokenAuthenticator(token) {
-    const expectedToken = token ?? process.env.SYNC_CONSOLE_TOKEN;
+    const expectedToken = (token ?? process.env.SYNC_CONSOLE_TOKEN)?.trim() ?? '';
     return async (c) => {
-        if (!expectedToken) {
-            // No token configured, allow all requests (not recommended for production)
-            return { consoleUserId: 'anonymous' };
-        }
-        // Check Authorization header
-        const authHeader = c.req.header('Authorization');
+        if (!expectedToken)
+            return null;
+        const authHeader = c.req.header('Authorization')?.trim();
         if (authHeader?.startsWith('Bearer ')) {
-            const bearerToken = authHeader.slice(7);
+            const bearerToken = authHeader.slice(7).trim();
             if (bearerToken === expectedToken) {
                 return { consoleUserId: 'token' };
             }
         }
-        // Check query parameter
-        const queryToken = c.req.query('token');
-        if (queryToken === expectedToken) {
-            return { consoleUserId: 'token' };
-        }
         return null;
     };
 }