feat: remove authenticated socket logic #598
Conversation
WalkthroughThis change refactors browser management and socket connection logic to remove implicit user authentication via sockets. User ID is now explicitly passed as an argument to relevant functions and event handlers, eliminating authentication middleware and context registration. Function signatures and event handler registrations are updated accordingly. Changes
Sequence Diagram(s)sequenceDiagram
participant Controller
participant SocketConnection
participant InputHandlers
participant Client
Controller->>SocketConnection: createSocketConnection(namespace, userId, callback)
SocketConnection->>Client: Accepts socket connection
SocketConnection->>InputHandlers: registerInputHandlers(socket, userId)
Client->>InputHandlers: Event (e.g., mousedown, keydown)
InputHandlers->>InputHandlers: Handler(eventData, userId)
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
server/src/browser-management/controller.ts (1)
18-22: JSDoc is out-of-sync with the actual function signature
initializeRemoteBrowserForRecordingnow receives onlyuserId, but the docstring still documents anoptionsparameter.
Keeping comments accurate is key for IDE tooltips and generated docs.- * @param options {@link RemoteBrowserOptions} to be used when launching the browser + * @param userId The id of the user who owns the browser sessionserver/src/socket-connection/connection.ts (1)
5-11: Missing documentation for the newuserIdparameterThe header still lists only
ioandcallback. Please adduserIdto avoid confusion.- * @param io dynamic namespace on the socket.io server - * @param callback function called after the connection is created providing the socket resource + * @param io Dynamic namespace on the socket.io server + * @param userId The id of the user that owns the connection (used by input handlers) + * @param callback Function called after the connection is created providing the socket resourceserver/src/browser-management/inputHandlers.ts (2)
15-27: Update JSDoc after signature change
handleWrapperno longer receives asocket, but the comment still describes that parameter. The same mismatch exists for most wrapper helpers below.- * @param socket - socket with authenticated request + * @param userId – id of the user whose active browser should receive the eventSearch & update similar blocks (
onMousedown,onWheel, …) to keep generated docs valid.
480-496:registerInputHandlersnow needsuserId– reflect that in typings & docsThe function signature was updated, but the docstring (and external typings, if any) still show a single
socketparameter. Please add the second parameter to avoid type-checking surprises for consumers.- * @param socket websocket with established connection + * @param socket Websocket with established connection + * @param userId Id of the user owning the remote browser
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
server/src/browser-management/controller.ts(3 hunks)server/src/browser-management/inputHandlers.ts(16 hunks)server/src/socket-connection/connection.ts(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (2)
server/src/browser-management/controller.ts (1)
server/src/server.ts (1)
io(79-79)
server/src/browser-management/inputHandlers.ts (1)
src/components/recorder/canvas.tsx (1)
Coordinates(24-27)
🔇 Additional comments (1)
server/src/socket-connection/connection.ts (1)
12-22: Potential security regression after dropping socket authentication
createSocketConnectionnow blindly trusts theuserIdsupplied by the caller.
Because the namespace (io.of(id)) is public, any client that guesses or obtains the browser-id can open a socket and emit inputs that will be processed under the provideduserId.At minimum, consider:
- Generating an unguessable one-time token and verifying it in the connection handshake, or
- Re-introducing a lightweight auth check (e.g. signed JWT in the query string).
If this is handled elsewhere, please document it next to this function.
What this PR does?
Removes the authenticated socket middleware logic and operates solely on the basis of user id
Summary by CodeRabbit