Changeset 0.28.8 (#194)

server/main.go

@@ -375,7 +375,11 @@ func main() {
 	base := r.Group(cfg.BasePath)
 
 	// ── WebSocket Hub ─────────────────────────
-	hub := events.NewHub(bus)
+	hub := events.NewHub(bus, middleware.GetAllowedOrigins(cfg))
+
+	// ── WebSocket Ticket Store (v0.28.8) ─────
+	ticketStore := events.NewTicketStore()
+	defer ticketStore.Stop()
 
 	// ── Notification Service (v0.20.0) ───────
 	var notifSvc *notifications.Service
@@ -429,7 +433,7 @@ func main() {
 	})
 
 	// WebSocket endpoint
-	base.GET("/ws", middleware.Auth(cfg, stores.Users, userCache), hub.HandleWebSocket)
+	base.GET("/ws", middleware.WsAuth(cfg, stores.Users, userCache, ticketStore), hub.HandleWebSocket)
 
 	// ── Auth routes (rate limited) ──────────────
 	authMode, err := auth.ParseMode(cfg.AuthMode)
@@ -515,6 +519,19 @@ func main() {
 		protected.Use(middleware.Auth(cfg, stores.Users, userCache))
 		protected.Use(middleware.ValidatePathParams())
 		{
+			// ── WebSocket Ticket (v0.28.8) ───────────
+			// Issue a single-use ticket for WebSocket auth.
+			// Client fetches this, then connects with ?ticket=<opaque>.
+			protected.POST("/ws/ticket", func(c *gin.Context) {
+				userID := c.GetString("user_id")
+				ticket, err := ticketStore.Issue(userID)
+				if err != nil {
+					c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to issue ticket"})
+					return
+				}
+				c.JSON(http.StatusOK, gin.H{"ticket": ticket})
+			})
+
 			// Channels
 			channels := handlers.NewChannelHandler()
 			protected.GET("/channels", channels.ListChannels)