@taskforcehq/taskforce 0.3.168

package/dist/server/index.rateLimit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/index.rateLimit.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { shouldApplyAuthRateLimitForPath } from './index';
+describe('shouldApplyAuthRateLimitForPath', () => {
+    it('applies auth rate limit to invite accept endpoint', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/invite/accept')).toBe(true);
+    });
+    it('excludes auth session endpoint', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/session')).toBe(false);
+    });
+    it('does not apply to non-auth routes', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/tasks')).toBe(false);
+    });
+});

package/dist/server/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/index.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+import { ensureBillingWebhookAuthExclusion, isBillingWebhookPath, shouldApplyAuthRateLimitForPath } from './index.js';
+describe('server index helper policies', () => {
+    it('adds webhook path to auth exclusions without duplicates', () => {
+        const base = ['/api/taskforce/health', '/api/taskforce/auth'];
+        const next = ensureBillingWebhookAuthExclusion(base);
+        expect(next).toContain('/api/taskforce/billing/webhook');
+        expect(next.filter((entry) => entry === '/api/taskforce/billing/webhook')).toHaveLength(1);
+    });
+    it('identifies billing webhook path exactly', () => {
+        expect(isBillingWebhookPath('/api/taskforce/billing/webhook')).toBe(true);
+        expect(isBillingWebhookPath('/api/taskforce/billing/webhook/v2')).toBe(false);
+    });
+    it('applies auth limiter only to auth routes except session', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/login')).toBe(true);
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/session')).toBe(false);
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/billing/webhook')).toBe(false);
+    });
+});

package/dist/server/rateLimit.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage } from 'http';
+import type { ServerResponse } from 'http';
+export interface RateLimitResult {
+    allowed: boolean;
+    limit: number;
+    remaining: number;
+    resetAt: number;
+    retryAfterSeconds: number;
+}
+export declare class InMemoryRateLimiter {
+    private readonly limit;
+    private readonly windowMs;
+    private readonly buckets;
+    private checksSinceCleanup;
+    constructor(limit: number, windowMs: number);
+    check(key: string, now?: number): RateLimitResult;
+    private pruneExpired;
+}
+export declare function resolveClientIp(req: IncomingMessage): string;
+export declare function resolveRateLimitKey(params: {
+    req: IncomingMessage;
+    pathname: string;
+    method?: string;
+    authenticated?: boolean;
+    sessionId?: string | null;
+    userId?: string | null;
+}): string;
+export declare function applyRateLimitHeaders(res: ServerResponse, result: RateLimitResult): void;
+export declare function applyPrefixedRateLimitHeaders(res: ServerResponse, result: RateLimitResult, prefix: string): void;

package/dist/server/rateLimit.js

@@ -0,0 +1,99 @@
+export class InMemoryRateLimiter {
+    limit;
+    windowMs;
+    buckets = new Map();
+    checksSinceCleanup = 0;
+    constructor(limit, windowMs) {
+        this.limit = Math.max(1, Math.floor(limit));
+        this.windowMs = Math.max(1000, Math.floor(windowMs));
+    }
+    check(key, now = Date.now()) {
+        this.checksSinceCleanup += 1;
+        if (this.checksSinceCleanup >= 500) {
+            this.pruneExpired(now);
+            this.checksSinceCleanup = 0;
+        }
+        const safeKey = key || 'unknown';
+        const existing = this.buckets.get(safeKey);
+        if (!existing || now >= existing.resetAt) {
+            const resetAt = now + this.windowMs;
+            this.buckets.set(safeKey, { count: 1, resetAt });
+            return {
+                allowed: true,
+                limit: this.limit,
+                remaining: Math.max(0, this.limit - 1),
+                resetAt,
+                retryAfterSeconds: Math.max(1, Math.ceil(this.windowMs / 1000))
+            };
+        }
+        existing.count += 1;
+        this.buckets.set(safeKey, existing);
+        const retryAfterSeconds = Math.max(1, Math.ceil((existing.resetAt - now) / 1000));
+        const remaining = Math.max(0, this.limit - existing.count);
+        if (existing.count > this.limit) {
+            return {
+                allowed: false,
+                limit: this.limit,
+                remaining: 0,
+                resetAt: existing.resetAt,
+                retryAfterSeconds
+            };
+        }
+        return {
+            allowed: true,
+            limit: this.limit,
+            remaining,
+            resetAt: existing.resetAt,
+            retryAfterSeconds
+        };
+    }
+    pruneExpired(now) {
+        for (const [bucketKey, bucket] of this.buckets.entries()) {
+            if (now >= bucket.resetAt) {
+                this.buckets.delete(bucketKey);
+            }
+        }
+    }
+}
+export function resolveClientIp(req) {
+    const forwardedFor = req.headers['x-forwarded-for'];
+    if (typeof forwardedFor === 'string' && forwardedFor.trim()) {
+        return forwardedFor.split(',')[0].trim();
+    }
+    if (Array.isArray(forwardedFor) && forwardedFor.length > 0) {
+        return forwardedFor[0].split(',')[0].trim();
+    }
+    return req.socket?.remoteAddress || 'unknown';
+}
+export function resolveRateLimitKey(params) {
+    const { req, pathname } = params;
+    const method = String(params.method || req.method || 'GET').trim().toUpperCase() || 'GET';
+    const userId = String(params.userId || '').trim();
+    const sessionId = String(params.sessionId || '').trim();
+    const authenticated = params.authenticated === true;
+    const ip = resolveClientIp(req) || 'unknown';
+    const route = String(pathname || '/').trim() || '/';
+    if (authenticated && userId && userId !== 'anonymous') {
+        return `user:${userId}:${method}:${route}`;
+    }
+    if (authenticated && sessionId) {
+        return `session:${sessionId}:${method}:${route}`;
+    }
+    return `ip:${ip}:${method}:${route}`;
+}
+export function applyRateLimitHeaders(res, result) {
+    res.setHeader('X-RateLimit-Limit', String(result.limit));
+    res.setHeader('X-RateLimit-Remaining', String(result.remaining));
+    res.setHeader('X-RateLimit-Reset', String(Math.ceil(result.resetAt / 1000)));
+    if (!result.allowed) {
+        res.setHeader('Retry-After', String(result.retryAfterSeconds));
+    }
+}
+export function applyPrefixedRateLimitHeaders(res, result, prefix) {
+    res.setHeader(`${prefix}-Limit`, String(result.limit));
+    res.setHeader(`${prefix}-Remaining`, String(result.remaining));
+    res.setHeader(`${prefix}-Reset`, String(Math.ceil(result.resetAt / 1000)));
+    if (!result.allowed) {
+        res.setHeader(`${prefix}-Retry-After`, String(result.retryAfterSeconds));
+    }
+}

package/dist/server/rateLimit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/rateLimit.test.js

@@ -0,0 +1,107 @@
+import { describe, expect, it } from 'vitest';
+import { applyPrefixedRateLimitHeaders, InMemoryRateLimiter, resolveClientIp, resolveRateLimitKey } from './rateLimit';
+describe('InMemoryRateLimiter', () => {
+    it('allows requests within limit and blocks over limit', () => {
+        const limiter = new InMemoryRateLimiter(2, 60_000);
+        const now = 1_000;
+        const first = limiter.check('ip:1', now);
+        const second = limiter.check('ip:1', now + 1);
+        const third = limiter.check('ip:1', now + 2);
+        expect(first.allowed).toBe(true);
+        expect(first.remaining).toBe(1);
+        expect(second.allowed).toBe(true);
+        expect(second.remaining).toBe(0);
+        expect(third.allowed).toBe(false);
+        expect(third.retryAfterSeconds).toBeGreaterThan(0);
+    });
+    it('resets bucket after window', () => {
+        const limiter = new InMemoryRateLimiter(1, 1_000);
+        const first = limiter.check('ip:2', 1_000);
+        const blocked = limiter.check('ip:2', 1_500);
+        const reset = limiter.check('ip:2', 2_001);
+        expect(first.allowed).toBe(true);
+        expect(blocked.allowed).toBe(false);
+        expect(reset.allowed).toBe(true);
+        expect(reset.remaining).toBe(0);
+    });
+});
+describe('resolveClientIp', () => {
+    it('uses x-forwarded-for when present', () => {
+        const req = {
+            headers: { 'x-forwarded-for': '203.0.113.5, 10.0.0.1' },
+            socket: { remoteAddress: '127.0.0.1' }
+        };
+        expect(resolveClientIp(req)).toBe('203.0.113.5');
+    });
+    it('falls back to remoteAddress', () => {
+        const req = {
+            headers: {},
+            socket: { remoteAddress: '127.0.0.2' }
+        };
+        expect(resolveClientIp(req)).toBe('127.0.0.2');
+    });
+});
+describe('applyPrefixedRateLimitHeaders', () => {
+    it('applies prefixed headers without default header names', () => {
+        const headers = new Map();
+        const res = {
+            setHeader: (name, value) => headers.set(name, value)
+        };
+        applyPrefixedRateLimitHeaders(res, {
+            allowed: true,
+            limit: 10,
+            remaining: 8,
+            resetAt: 1_700_000_000_000,
+            retryAfterSeconds: 30
+        }, 'X-Auth-RateLimit');
+        expect(headers.get('X-Auth-RateLimit-Limit')).toBe('10');
+        expect(headers.get('X-Auth-RateLimit-Remaining')).toBe('8');
+        expect(headers.get('X-Auth-RateLimit-Reset')).toBe(String(Math.ceil(1_700_000_000_000 / 1000)));
+        expect(headers.has('X-RateLimit-Limit')).toBe(false);
+    });
+});
+describe('resolveRateLimitKey', () => {
+    it('uses authenticated user identity when available', () => {
+        const req = {
+            method: 'GET',
+            headers: { 'x-forwarded-for': '203.0.113.10' },
+            socket: { remoteAddress: '127.0.0.1' }
+        };
+        const key = resolveRateLimitKey({
+            req,
+            pathname: '/api/taskforce/tasks',
+            authenticated: true,
+            userId: 'user-123',
+            sessionId: 'session-abc'
+        });
+        expect(key).toBe('user:user-123:GET:/api/taskforce/tasks');
+    });
+    it('falls back to session identity for authenticated anonymous users', () => {
+        const req = {
+            method: 'patch',
+            headers: {},
+            socket: { remoteAddress: '127.0.0.5' }
+        };
+        const key = resolveRateLimitKey({
+            req,
+            pathname: '/api/taskforce/task/1',
+            authenticated: true,
+            userId: 'anonymous',
+            sessionId: 'session-123'
+        });
+        expect(key).toBe('session:session-123:PATCH:/api/taskforce/task/1');
+    });
+    it('falls back to IP identity for unauthenticated requests', () => {
+        const req = {
+            method: 'post',
+            headers: { 'x-forwarded-for': '198.51.100.11, 10.0.0.1' },
+            socket: { remoteAddress: '127.0.0.1' }
+        };
+        const key = resolveRateLimitKey({
+            req,
+            pathname: '/api/taskforce/config',
+            authenticated: false
+        });
+        expect(key).toBe('ip:198.51.100.11:POST:/api/taskforce/config');
+    });
+});

package/dist/server/realtimeSync.auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/realtimeSync.auth.test.js

@@ -0,0 +1,62 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import { createRealtimeSyncWsManager } from './realtimeSyncWs';
+import { createSessionTokenCookie, resolveAuthConfigFromEnv } from './auth';
+class MockWs extends EventEmitter {
+    readyState = 1;
+    sent = [];
+    closeCode;
+    closeReason;
+    send(data) {
+        this.sent.push(data);
+    }
+    close(code, reason) {
+        this.closeCode = code;
+        this.closeReason = reason;
+        this.readyState = 3;
+    }
+}
+function makeReq(cookie) {
+    return {
+        headers: cookie ? { cookie } : {}
+    };
+}
+describe('server/realtimeSyncWs auth', () => {
+    it('rejects unauthenticated websocket connections when auth is required', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({ resolveUserAccess: vi.fn(() => null) }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const ws = new MockWs();
+        manager.handleConnection(ws, makeReq());
+        expect(ws.closeCode).toBe(1008);
+        expect(ws.closeReason).toBe('unauthorized');
+    });
+    it('accepts authenticated websocket connections', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const sessionCookie = createSessionTokenCookie('session-1', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        });
+        const cookieHeader = sessionCookie.split(';')[0];
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a'
+                ? { workspaceId }
+                : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const ws = new MockWs();
+        manager.handleConnection(ws, makeReq(cookieHeader));
+        expect(ws.closeCode).toBeUndefined();
+        manager.broadcastTaskforceUpdate('workspace-a');
+        expect(ws.sent).toContain(JSON.stringify({ type: 'taskforce:update', workspaceId: 'workspace-a' }));
+    });
+});

package/dist/server/realtimeSync.replay.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/realtimeSync.replay.test.js

@@ -0,0 +1,192 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import { createRealtimeSyncWsManager } from './realtimeSyncWs';
+import { createSessionTokenCookie, resolveAuthConfigFromEnv } from './auth';
+class MockWs extends EventEmitter {
+    readyState = 1;
+    bufferedAmount = 0;
+    sent = [];
+    closeCode;
+    closeReason;
+    send(data) {
+        this.sent.push(data);
+    }
+    close(code, reason) {
+        this.closeCode = code;
+        this.closeReason = reason;
+        this.readyState = 3;
+    }
+}
+function makeReq(cookie) {
+    return {
+        headers: cookie ? { cookie } : {}
+    };
+}
+function parseMessages(ws) {
+    return ws.sent.map((entry) => JSON.parse(entry));
+}
+function makeEvent(seq, workspaceId = 'workspace-a', serverEpoch = 'epoch-1') {
+    return {
+        eventId: `${serverEpoch}:${seq}`,
+        workspaceId,
+        cursor: `${serverEpoch}:${seq}`,
+        serverEpoch,
+        seq,
+        entityType: 'task',
+        changeType: 'upsert',
+        entityIds: [`task-${seq}`],
+        dataVersion: seq,
+        serverTs: new Date().toISOString()
+    };
+}
+describe('server/realtimeSyncWs replay + backpressure', () => {
+    it('replays events after a cursor for subscribed workspace', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const ws = new MockWs();
+        const cookie = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(ws, makeReq(cookie));
+        manager.broadcastMutation(makeEvent(1));
+        manager.broadcastMutation(makeEvent(2));
+        manager.broadcastMutation(makeEvent(3));
+        ws.emit('message', JSON.stringify({
+            type: 'taskforce:replay',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:1'
+        }));
+        const replayMsg = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay');
+        expect(replayMsg).toBeTruthy();
+        expect(Array.isArray(replayMsg?.events)).toBe(true);
+        const events = (replayMsg?.events || []);
+        expect(events.map((event) => event.seq)).toEqual([2, 3]);
+    });
+    it('returns deterministic replay-reset on server-epoch mismatch', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const ws = new MockWs();
+        const cookie = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(ws, makeReq(cookie));
+        manager.broadcastMutation(makeEvent(1, 'workspace-a', 'epoch-2'));
+        ws.emit('message', JSON.stringify({
+            type: 'taskforce:replay',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:1'
+        }));
+        const reset = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay-reset');
+        expect(reset).toBeTruthy();
+        expect(reset?.reason).toBe('server-epoch-mismatch');
+        expect(reset?.serverEpoch).toBe('epoch-2');
+    });
+    it('returns replay-gap when cursor has been evicted from buffer window', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() }, { replayMaxEvents: 2, replayTtlMs: 60_000 });
+        const ws = new MockWs();
+        const cookie = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(ws, makeReq(cookie));
+        manager.broadcastMutation(makeEvent(1));
+        manager.broadcastMutation(makeEvent(2));
+        manager.broadcastMutation(makeEvent(3));
+        ws.emit('message', JSON.stringify({
+            type: 'taskforce:replay',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:0'
+        }));
+        const gap = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay-gap');
+        expect(gap).toBeTruthy();
+        expect(gap?.reason).toBe('cursor-evicted');
+        expect(gap?.earliestSeq).toBe(2);
+        expect(gap?.cursorSeq).toBe(0);
+    });
+    it('drops slow consumers instead of blocking broadcast loop', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() }, { maxBufferedBytes: 10 });
+        const ws = new MockWs();
+        ws.bufferedAmount = 9999;
+        const cookie = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(ws, makeReq(cookie));
+        manager.broadcastMutation(makeEvent(1));
+        expect(ws.closeCode).toBe(1013);
+        expect(ws.closeReason).toBe('slow-consumer');
+    });
+    it('returns stable replay batches across repeated requests with same cursor', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const ws = new MockWs();
+        const cookie = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(ws, makeReq(cookie));
+        manager.broadcastMutation(makeEvent(1));
+        manager.broadcastMutation(makeEvent(2));
+        manager.broadcastMutation(makeEvent(3));
+        ws.emit('message', JSON.stringify({
+            type: 'taskforce:replay',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:1'
+        }));
+        ws.emit('message', JSON.stringify({
+            type: 'taskforce:replay',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:1'
+        }));
+        const replays = parseMessages(ws).filter((msg) => msg.type === 'taskforce:replay');
+        expect(replays.length).toBeGreaterThanOrEqual(2);
+        const firstEvents = (replays[0]?.events || []).map((event) => event.eventId);
+        const secondEvents = (replays[1]?.events || []).map((event) => event.eventId);
+        expect(firstEvents).toEqual(['epoch-1:2', 'epoch-1:3']);
+        expect(secondEvents).toEqual(firstEvents);
+    });
+});

package/dist/server/realtimeSync.workspaceIsolation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/realtimeSync.workspaceIsolation.test.js

@@ -0,0 +1,101 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import { createRealtimeSyncWsManager } from './realtimeSyncWs';
+import { createSessionTokenCookie, resolveAuthConfigFromEnv } from './auth';
+class MockWs extends EventEmitter {
+    readyState = 1;
+    sent = [];
+    closeCode;
+    send(data) {
+        this.sent.push(data);
+    }
+    close(code) {
+        this.closeCode = code;
+        this.readyState = 3;
+    }
+}
+function makeReq(cookie) {
+    return {
+        headers: cookie ? { cookie } : {}
+    };
+}
+function parseMessages(ws) {
+    return ws.sent.map((entry) => JSON.parse(entry));
+}
+describe('server/realtimeSyncWs workspace isolation', () => {
+    it('delivers workspace updates only to subscribers of that workspace', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => {
+                if (userId === 'user-a' && workspaceId === 'workspace-a')
+                    return { workspaceId };
+                if (userId === 'user-b' && workspaceId === 'workspace-b')
+                    return { workspaceId };
+                return null;
+            })
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const wsA = new MockWs();
+        const wsB = new MockWs();
+        const cookieA = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        const cookieB = createSessionTokenCookie('session-b', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-b',
+            userId: 'user-b'
+        }).split(';')[0];
+        manager.handleConnection(wsA, makeReq(cookieA));
+        manager.handleConnection(wsB, makeReq(cookieB));
+        manager.broadcastTaskforceUpdate('workspace-a');
+        manager.broadcastMutation({
+            eventId: 'epoch-1:1',
+            workspaceId: 'workspace-a',
+            cursor: 'epoch-1:1',
+            serverEpoch: 'epoch-1',
+            seq: 1,
+            entityType: 'task',
+            changeType: 'upsert',
+            entityIds: ['task-1'],
+            dataVersion: 1,
+            serverTs: new Date().toISOString()
+        });
+        expect(parseMessages(wsA).some((m) => m.type === 'taskforce:update' && m.workspaceId === 'workspace-a')).toBe(true);
+        expect(parseMessages(wsA).some((m) => m.type === 'taskforce:mutation' && m.workspaceId === 'workspace-a')).toBe(true);
+        expect(parseMessages(wsB).some((m) => m.type === 'taskforce:update' && m.workspaceId === 'workspace-a')).toBe(false);
+        expect(parseMessages(wsB).some((m) => m.type === 'taskforce:mutation' && m.workspaceId === 'workspace-a')).toBe(false);
+    });
+    it('rejects cross-workspace subscribe attempts', () => {
+        const authConfig = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
+            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
+        });
+        const manager = createRealtimeSyncWsManager({
+            resolveUserAccess: vi.fn((userId, workspaceId) => {
+                if (userId === 'user-a' && workspaceId === 'workspace-a')
+                    return { workspaceId };
+                return null;
+            })
+        }, authConfig, { log: vi.fn(), warn: vi.fn() });
+        const wsA = new MockWs();
+        const cookieA = createSessionTokenCookie('session-a', authConfig, {
+            role: 'member',
+            workspaceId: 'workspace-a',
+            userId: 'user-a'
+        }).split(';')[0];
+        manager.handleConnection(wsA, makeReq(cookieA));
+        wsA.emit('message', JSON.stringify({ type: 'taskforce:subscribe', workspaceId: 'workspace-b' }));
+        manager.broadcastTaskforceUpdate('workspace-b');
+        const messages = parseMessages(wsA);
+        expect(messages.some((m) => m.type === 'taskforce:subscription-error' && m.workspaceId === 'workspace-b')).toBe(true);
+        expect(messages.some((m) => m.type === 'taskforce:update' && m.workspaceId === 'workspace-b')).toBe(false);
+    });
+});