gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-16 13:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): align WebSocket token_version checks with HTTP (#1744)

Browse Source 
* test(auth): cover legacy no-tv JWT rejection on WebSocket upgrades

* fix(auth): treat missing tv claim as token_version 1 on WebSocket upgrades
This commit is contained in:
Anso
2026-08-02 17:13:44 -04:00
committed by GitHub
parent ba017ee665
commit a74905ff1e
4 changed files with 50 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/websocket/generic.ts
+3 -1
View File
@@ -85,7 +85,9 @@ export function handleGenericWs(
console.warn('[Exec] User account not found:', decoded.username);
return reject(socket, 401, 'Unauthorized');
}
if (decoded.tv !== undefined && execUser.token_version !== decoded.tv) {
// Missing `tv` is a pre-migration legacy token at version 1, same default
// as `authMiddleware`; a bumped account version must reject it.
if (execUser.token_version !== (decoded.tv ?? 1)) {
console.warn('[Exec] Session invalidated (token version mismatch):', decoded.username);
return reject(socket, 401, 'Unauthorized');
}
backend/src/websocket/upgradeHandler.ts
+3 -1
View File
@@ -201,7 +201,9 @@ export function attachUpgrade(
if (!decoded.scope && decoded.username) {
const dbUser = DatabaseService.getInstance().getUserByUsername(decoded.username);
if (!dbUser) return reject(socket, 401, 'Unauthorized');
if (decoded.tv !== undefined && dbUser.token_version !== decoded.tv) {
// Missing `tv` is a pre-migration legacy token at version 1, same default
// as `authMiddleware`; a bumped account version must reject it.
if (dbUser.token_version !== (decoded.tv ?? 1)) {
console.log('[Auth] WS session rejected: token version mismatch for:', decoded.username);
return reject(socket, 401, 'Unauthorized');
}