[roncodes]

What

Admins can now manage socket authentication from Admin → Configure → Socket, and the socket server applies the changes at runtime without a restart.

Socket server (socket/)

• Config polling. When SOCKETCLUSTER_AUTH_KEY is set, the server polls the API's signed GET int/v1/socket/config every SOCKETCLUSTER_CONFIG_POLL_SECONDS (default 30; 0 disables). Requests are signed with the authorize key and time out after 2 s. SOCKETCLUSTER_CONFIG_URL defaults to the authorize URL with /authorize replaced by /config. Without a key there is no polling and the server uses its environment only, as before.
• Applied at runtime: enabled, mode (including allowClientPublish = mode !== 'enforce') and origins. A null mode or origins falls back to the socket server's own environment value. The environment is the starting config. When the API is unreachable, times out or answers with something malformed, the last good config stays in force.
• The key is passed to SocketCluster whenever one is set, so tokens verify even while auth is off and switching on needs no restart. Behaviour is gated by the runtime mode. With a key, /publish and /stats also work while auth is off. That way the API can publish over HTTP as soon as its own switch flips, before the next poll.
• Entering enforce at runtime disconnects every socket once (close code 4100). Clients reconnect after their usual reconnect delay, and subscriptions made under looser auth go through the authorizer again.
• /stats additions:
  • config: {enabled, mode, origins, source: env|api, last_sync_at, last_sync_error};
  • denials: the top 50 {client, prefix, reason, count, last_at}. The prefix is the channel up to its first ., or other. Rows are capped and never contain tokens, subjects, company ids or full channel names.
• Helm exposes socketcluster.configUrl / configPollSeconds. docker-compose needs nothing new, since the default derives from the authorize URL.

Which SocketCluster 17 settings can change live: allowClientPublish, origins and _allowAllOrigins are plain AGServer fields, read on every inbound #publish and every handshake, so setting them on the running server works. Origin changes only affect new handshakes; open connections are not re-checked.

Console (console/)

• The Configure → Socket page now has three panels:
  • Status: whether the socket server is reachable, the effective switch and mode with Console setting / Environment badges, whether the key is configured, connections, what the server runs and its last config sync, and out-of-sync / sync-error notices.
  • Denials: a table of the aggregated denials.
  • Settings form: every field has a "Use environment" option (sent as null). Saving into enforce asks for confirmation, and key_missing gets its own message.
• The page explains that the key stays in the environment and how to rotate it.
• XSS fix: the test console rendered event content (channel data and refusal reasons from the network) with html-safe. It is now escaped text.

Why

Before this, switching socket auth on or changing its mode or origins meant editing env on the API and the socket server and restarting both. This lets an admin roll out log and then enforce from the console and see what would be denied first.

Related

• core-api: feat(socket): admin socket settings (switch, mode, token TTL, origins) with signed config for the socket server core-api#314 (GET/POST int/v1/settings/socket, signed GET int/v1/socket/config) into release/v1.6.71
• Release PR: release/v0.7.70 #721
• Docs: fleetbase/fleetbase.io#136

Tests

• socket/test/: unit tests for the config URL/interval, runtime config, poller (signing, failures, timeout, no overlap) and denials aggregation. Real-server integration tests cover:
  • a poll applies changes;
  • an unreachable API keeps the last good config;
  • no key means no polling;
  • enabling at runtime starts verifying and authorizing;
  • switching to enforce blocks client publish;
  • an origins change applies to new handshakes;
  • /stats denials contain no tokens or ids.
• console/tests/integration/components/configure/socket-test.js: covers every branch of the page component and the XSS fix.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (cfcb4f0) to head (7d7536f).
⚠️ Report is 1 commits behind head on release/v0.7.70.

Additional details and impacted files

@@                 Coverage Diff                 @@
##             release/v0.7.70      #722   +/-   ##
===================================================
  Coverage             100.00%   100.00%           
  Complexity                38        38           
===================================================
  Files                    196       196           
  Lines                   4028      4092   +64     
===================================================
+ Hits                    4028      4092   +64     

Flag	Coverage Δ
api	100.00% <ø> (ø)
console	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
console/app/components/configure/socket.js	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.