Harden room discovery and health metrics

server/.env.example

@@ -1,4 +1,6 @@
 PORT=3000
 MIN_VERSION=1.0.0
 MAX_ROOMS=1000
-MAX_PEERS_PER_ROOM=50
+MAX_PEERS_PER_ROOM=25
+# Optional: enables aggregate-only admin metrics on /health with Authorization: Bearer <token>
+ADMIN_METRICS_TOKEN=

server/README.md

@@ -14,10 +14,17 @@ Copy `.env.example` to `.env` and configure your settings.
 ```bash
 PORT=3000
 MAX_ROOMS=1000
-MAX_PEERS_PER_ROOM=50
+MAX_PEERS_PER_ROOM=25
 MIN_VERSION=1.0.0
+# Optional: enables aggregate-only admin metrics on /health with Authorization: Bearer <token>
+ADMIN_METRICS_TOKEN=
 ```
 
+### Health & Metrics
+`GET /` and `GET /health` are IP-rate-limited. By default `/health` returns only basic service status, uptime, room count, connection count, and a timestamp.
+
+If `ADMIN_METRICS_TOKEN` is set, requests with `Authorization: Bearer <token>` receive additional aggregate metrics such as total peers, average peers per room, max room size, active lobby count, rate-limit map sizes, and process memory usage. The metrics response does not include room IDs, peer IDs, usernames, IP addresses, media titles, or other user-level data.
+
 ### Docker (Recommended)
 The server is available as a pre-built image on GHCR.
 ```bash
@@ -38,6 +45,7 @@ npm start
 
 ## Security
 - **Rate Limiting**: IP-based connection limits and socket-based event limits.
+- **Room Discovery Throttle**: Room-list refreshes are rate-limited server-side to one request every 10 seconds per socket.
 - **Token Handshake**: Requires a valid token defined in the root `shared/constants.js`.
 - **Single Source of Truth**: The server imports constants directly from the root `shared/` directory.
 - **In-Memory**: Rooms are automatically pruned after 2 hours of inactivity.

server/index.js

@@ -4,6 +4,7 @@ import { Server } from 'socket.io';
 import crypto from 'crypto';
 import dotenv from 'dotenv';
 import { EVENTS, OFFICIAL_SERVER_TOKEN, PROTOCOL_VERSION } from '../shared/constants.js';
+import { buildHealthPayload, checkCooldown, isAdminMetricsAuthorized } from './ops.js';
 
 dotenv.config();
 
@@ -15,8 +16,10 @@ function hashPassword(password) {
 
 const PORT = process.env.PORT || 3000;
 const MAX_ROOMS = parseInt(process.env.MAX_ROOMS) || 1000;
-const MAX_PEERS_PER_ROOM = parseInt(process.env.MAX_PEERS_PER_ROOM) || 50;
+const MAX_PEERS_PER_ROOM = parseInt(process.env.MAX_PEERS_PER_ROOM) || 25;
 const MIN_VERSION = process.env.MIN_VERSION || '1.0.0';
+const ADMIN_METRICS_TOKEN = process.env.ADMIN_METRICS_TOKEN || '';
+const ROOM_LIST_COOLDOWN_MS = 10000;
 
 const app = express();
 app.set('trust proxy', 1); // For real client IP through reverse proxy
@@ -35,13 +38,20 @@ app.get('/health', (req, res) => {
     if (!checkHealthRate(clientIp)) {
         return res.status(429).json({ error: 'Rate limited' });
     }
-    res.json({
-        status: 'ok',
-        uptime: process.uptime(),
-        rooms: rooms.size,
+    const includeMetrics = isAdminMetricsAuthorized(req.get('authorization'), ADMIN_METRICS_TOKEN);
+    res.json(buildHealthPayload({
+        rooms,
         connections: io.engine?.clientsCount ?? 0,
-        timestamp: Date.now()
-    });
+        includeMetrics,
+        uptime: process.uptime(),
+        rateLimitSizes: {
+            connections: connectionCounts.size,
+            events: eventCounts.size,
+            health: healthCounts.size,
+            authFailures: failedAuthAttempts.size,
+            roomList: roomListCooldowns.size
+        }
+    }));
 });
 
 const httpServer = createServer(app);
@@ -139,6 +149,7 @@ setInterval(() => {
 
 const eventCounts = new Map(); // socketId -> { count, resetTime }
 const healthCounts = new Map(); // ip -> { count, resetTime }
+const roomListCooldowns = new Map(); // socketId -> last allowed timestamp
 
 // Clean up connection counts and event counts to prevent memory leak
 setInterval(() => {
@@ -158,6 +169,11 @@ setInterval(() => {
             healthCounts.delete(ip);
         }
     }
+    for (const [socketId] of roomListCooldowns.entries()) {
+        if (!io.sockets.sockets.has(socketId)) {
+            roomListCooldowns.delete(socketId);
+        }
+    }
 }, 60000);
 
 function checkConnectionRate(ip) {
@@ -541,6 +557,10 @@ io.on('connection', (socket) => {
             socket.disconnect(true);
             return;
         }
+        if (!checkCooldown(roomListCooldowns, socket.id, ROOM_LIST_COOLDOWN_MS)) {
+            socket.emit(EVENTS.ERROR, { message: 'Room list refresh is rate limited. Try again in a few seconds.' });
+            return;
+        }
         const list = Array.from(rooms.entries()).map(([id, r]) => ({
             id,
             peerCount: r.peers.size,
@@ -584,6 +604,7 @@ io.on('connection', (socket) => {
 
     socket.on('disconnect', () => {
         eventCounts.delete(socket.id);
+        roomListCooldowns.delete(socket.id);
         const mapping = socketToRoom.get(socket.id);
         if (mapping) {
             // Socket is already disconnected — no need to call socket.leave().

server/ops.js

@@ -0,0 +1,76 @@
+import crypto from 'crypto';
+
+export function checkCooldown(cooldowns, key, windowMs, now = Date.now()) {
+    const lastAllowedAt = cooldowns.get(key) || 0;
+    if (now - lastAllowedAt < windowMs) {
+        return false;
+    }
+    cooldowns.set(key, now);
+    return true;
+}
+
+export function isAdminMetricsAuthorized(authHeader, adminToken) {
+    if (!adminToken || typeof adminToken !== 'string') return false;
+    if (!authHeader || typeof authHeader !== 'string') return false;
+
+    const prefix = 'Bearer ';
+    if (!authHeader.startsWith(prefix)) return false;
+
+    const provided = authHeader.slice(prefix.length);
+    if (!provided) return false;
+
+    const expectedBuffer = Buffer.from(adminToken);
+    const providedBuffer = Buffer.from(provided);
+
+    if (expectedBuffer.length !== providedBuffer.length) return false;
+    return crypto.timingSafeEqual(expectedBuffer, providedBuffer);
+}
+
+export function buildHealthPayload({
+    rooms,
+    connections,
+    includeMetrics = false,
+    now = Date.now(),
+    uptime = 0,
+    memoryUsage = () => process.memoryUsage(),
+    rateLimitSizes = {}
+}) {
+    const payload = {
+        status: 'ok',
+        uptime,
+        rooms: rooms.size,
+        connections,
+        timestamp: now
+    };
+
+    if (!includeMetrics) return payload;
+
+    const roomValues = Array.from(rooms.values());
+    const roomSizes = roomValues.map(room => room.peers?.size || 0);
+    const peers = roomSizes.reduce((sum, size) => sum + size, 0);
+    const maxPeersInRoom = roomSizes.length > 0 ? Math.max(...roomSizes) : 0;
+    const avgPeersPerRoom = roomSizes.length > 0
+        ? Math.round((peers / roomSizes.length) * 100) / 100
+        : 0;
+    const mem = memoryUsage();
+
+    return {
+        ...payload,
+        peers,
+        roomsWithLobby: roomValues.filter(room => !!room.activeLobby).length,
+        avgPeersPerRoom,
+        maxPeersInRoom,
+        rateLimitEntries: {
+            connections: rateLimitSizes.connections || 0,
+            events: rateLimitSizes.events || 0,
+            health: rateLimitSizes.health || 0,
+            authFailures: rateLimitSizes.authFailures || 0,
+            roomList: rateLimitSizes.roomList || 0
+        },
+        memory: {
+            rss: mem.rss,
+            heapUsed: mem.heapUsed,
+            heapTotal: mem.heapTotal
+        }
+    };
+}

server/package-lock.json

@@ -9,7 +9,6 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
-        "bcryptjs": "^3.0.3",
         "dotenv": "^17.4.2",
         "express": "^5.2.1",
         "socket.io": "^4.8.3"
@@ -70,15 +69,6 @@
         "node": "^4.5.0 || >= 5.9"
       }
     },
-    "node_modules/bcryptjs": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
-      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
-      "license": "BSD-3-Clause",
-      "bin": {
-        "bcrypt": "bin/bcrypt"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",

server/package.json

@@ -11,7 +11,6 @@
   "license": "ISC",
   "type": "module",
   "dependencies": {
-    "bcryptjs": "^3.0.3",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
     "socket.io": "^4.8.3"