growqr-app/growqr-backend
3
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: enforce websocket ticket session ownership

Browse Source
This commit is contained in:
-Puter
2026-07-13 20:20:12 +05:30
parent eafca3aafb
commit a56172c7ac
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/services.ts
+17 -4
View File
@@ -93,6 +93,15 @@ type SessionMissionContext = {
mission?: Record<string, unknown>;
taskId?: string;
};
async function assertSessionOwnership(serviceId: "interview" | "roleplay", sessionId: string, userId: string): Promise<void> {
const [row] = await db
.select({ userId: missionServiceSessions.userId })
.from(missionServiceSessions)
.where(and(eq(missionServiceSessions.serviceId, serviceId), eq(missionServiceSessions.externalId, sessionId)))
.limit(1);
if (!row) throw new HTTPException(404, { message: "session not found" });
if (row.userId !== userId) throw new HTTPException(403, { message: "session ownership mismatch" });
}
async function sessionMissionContext(serviceId: "interview" | "roleplay", sessionId: string): Promise<SessionMissionContext> {
const [row] = await db
@@ -943,10 +952,12 @@ export function serviceRoutes(options: { skipAuth?: boolean } = {}) {
});
app.get("/interview/leaderboard", async (c) => c.json(await interviewService.leaderboard()));
app.get("/interview/artifacts/:sessionId/:artifactType", async (c) => c.json(await interviewService.artifact(c.req.param("sessionId"), c.req.param("artifactType"), c.get("userId"))));
app.post("/interview/sessions/:sessionId/ticket", (c) => {
app.post("/interview/sessions/:sessionId/ticket", async (c) => {
if (!config.sessionTicketSecret) throw new HTTPException(503, { message: "session ticket signing is not configured" });
const sessionId = c.req.param("sessionId");
const issued = signWsTicket({ secret: config.sessionTicketSecret, audience: "interview", subject: c.get("userId"), sessionId });
const userId = c.get("userId");
await assertSessionOwnership("interview", sessionId, userId);
const issued = signWsTicket({ secret: config.sessionTicketSecret, audience: "interview", subject: userId, sessionId });
return c.json({ ticket: issued.ticket, expiresAt: issued.expiresAt });
});
app.post("/interview/sessions/:sessionId/video/upload-url", async (c) => c.json(await interviewService.createVideoUploadUrl(c.req.param("sessionId"), c.get("userId"))));
@@ -1020,10 +1031,12 @@ export function serviceRoutes(options: { skipAuth?: boolean } = {}) {
});
app.get("/roleplay/leaderboard", async (c) => c.json(await roleplayService.leaderboard()));
app.get("/roleplay/artifacts/:sessionId/:artifactType", async (c) => c.json(await roleplayService.artifact(c.req.param("sessionId"), c.req.param("artifactType"), c.get("userId"))));
app.post("/roleplay/sessions/:sessionId/ticket", (c) => {
app.post("/roleplay/sessions/:sessionId/ticket", async (c) => {
if (!config.sessionTicketSecret) throw new HTTPException(503, { message: "session ticket signing is not configured" });
const sessionId = c.req.param("sessionId");
const issued = signWsTicket({ secret: config.sessionTicketSecret, audience: "roleplay", subject: c.get("userId"), sessionId });
const userId = c.get("userId");
await assertSessionOwnership("roleplay", sessionId, userId);
const issued = signWsTicket({ secret: config.sessionTicketSecret, audience: "roleplay", subject: userId, sessionId });
return c.json({ ticket: issued.ticket, expiresAt: issued.expiresAt });
});
app.post("/roleplay/sessions/:sessionId/video/upload-url", async (c) => c.json(await roleplayService.createVideoUploadUrl(c.req.param("sessionId"), c.get("userId"))));