Function authenticateSocket

packages/server/src/socket/middleware/auth.ts:29–69

(
  socket: AuthenticatedSocket,
  next: NextFunction
)

}

async function authenticateSocket(
  socket: AuthenticatedSocket,
  next: NextFunction
): Promise<void> {
  const headers = socket.request.headers
  const isTunnel = !!(headers['cf-connecting-ip'] || headers['cf-ray'])
  const cookieToken = extractTunnelSessionTokenFromCookieHeader(headers.cookie)

  if (isTunnel && TunnelService.isRunning()) {
    if (!cookieToken || !TunnelService.validateToken(cookieToken)) {
      return next(new Error('Unauthorized: valid tunnel session cookie required'))
    }
  }

  const internalToken = headers[INTERNAL_API_TOKEN_HEADER]
  const normalizedInternalToken = Array.isArray(internalToken) ? internalToken[0] : internalToken
  if (internalToken !== undefined) {
    if (!validateInternalApiToken(normalizedInternalToken)) {
      return next(new Error('Unauthorized: invalid internal token'))
    }
    socket.accessAuthSessionSecretGeneration = AccessAuthService.getSessionSecretGeneration()
  } else {
    const accessToken = AccessAuthService.extractCookieFromHeader(headers.cookie)
    const accessAuthResult = await AccessAuthService.validateSessionTokenWithGeneration(accessToken)
    if (!accessAuthResult.valid) {
      return next(new Error('Unauthorized: access password required'))
    }
    socket.accessAuthSessionSecretGeneration = accessAuthResult.generation
  }

  // 设置用户标识
  if (cookieToken) {
    socket.userId = cookieToken
    socket.username = `User-${cookieToken.slice(0, 6)}`
  } else {
    socket.userId = `anonymous-${socket.id.slice(0, 8)}`
    socket.username = 'Anonymous'
  }

  next()
}