feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/services/ws_pump_security_test.go

@@ -0,0 +1,139 @@
+package services
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"agent-desk/internal/pkg/enums"
+	"github.com/gorilla/websocket"
+)
+
+// The listener exists only inside the test. No app server or external service is
+// involved; the DB fixture is temporary and every pump is joined before cleanup.
+func newSecuritySocketPair(t *testing.T) (*websocket.Conn, *websocket.Conn) {
+	t.Helper()
+	accepted := make(chan *websocket.Conn, 1)
+	failed := make(chan error, 1)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := websocket.Upgrader{}
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			failed <- err
+			return
+		}
+		accepted <- conn
+	}))
+	t.Cleanup(server.Close)
+	client, _, err := websocket.DefaultDialer.Dial("ws"+strings.TrimPrefix(server.URL, "http"), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var serverConn *websocket.Conn
+	select {
+	case serverConn = <-accepted:
+	case err := <-failed:
+		t.Fatal(err)
+	case <-time.After(time.Second):
+		t.Fatal("test websocket upgrade timed out")
+	}
+	t.Cleanup(func() { _ = client.Close(); _ = serverConn.Close() })
+	return serverConn, client
+}
+
+func startSecurityPumps(t *testing.T, ws *wsService, session *ClientSession, reader bool) {
+	t.Helper()
+	written := make(chan struct{})
+	go func() { defer close(written); ws.writePump(session) }()
+	var read chan struct{}
+	if reader {
+		read = make(chan struct{})
+		go func() { defer close(read); ws.readPump(session) }()
+	}
+	t.Cleanup(func() {
+		ws.closeSession(session)
+		select {
+		case <-written:
+		case <-time.After(time.Second):
+			t.Error("write pump did not stop")
+		}
+		if read != nil {
+			select {
+			case <-read:
+			case <-time.After(time.Second):
+				t.Error("read pump did not stop")
+			}
+		}
+	})
+}
+
+func requireSecuritySocketClosed(t *testing.T, client *websocket.Conn) {
+	t.Helper()
+	_ = client.SetReadDeadline(time.Now().Add(time.Second))
+	_, _, err := client.ReadMessage()
+	if err == nil {
+		t.Fatal("revoked connection delivered a buffered message")
+	}
+	if networkErr, ok := err.(interface{ Timeout() bool }); ok && networkErr.Timeout() {
+		t.Fatal("revoked connection stayed open until test deadline")
+	}
+}
+
+func TestWsWritePumpRejectsBufferedEventAfterRevocation(t *testing.T) {
+	f := newWsAuthFixture(t, true)
+	ws := newWsService()
+	session := newWsAuthClient(f, "buffered", realtimeRoleAdmin)
+	serverConn, client := newSecuritySocketPair(t)
+	session.Conn = serverConn
+	ws.manager.Register(session, ws.defaultTopics(session))
+	session.enqueueEvent(ws.newEvent(realtimeTopicAdminAll, RealtimeConversationChangedEvent{Type: enums.IMRealtimeEventConversationUpdated}))
+	if err := f.db.Model(&f.session).Update("revoked_at", time.Now()).Error; err != nil {
+		t.Fatal(err)
+	}
+	startSecurityPumps(t, ws, session, false)
+	requireSecuritySocketClosed(t, client)
+	if !session.Closed.Load() {
+		t.Fatal("writer did not revoke session")
+	}
+}
+
+func TestWsReadPumpRejectsIncomingFrameAfterRevocation(t *testing.T) {
+	f := newWsAuthFixture(t, true)
+	ws := newWsService()
+	session := newWsAuthClient(f, "incoming", realtimeRoleAdmin)
+	serverConn, client := newSecuritySocketPair(t)
+	session.Conn = serverConn
+	ws.manager.Register(session, ws.defaultTopics(session))
+	startSecurityPumps(t, ws, session, true)
+	if err := f.db.Model(&f.session).Update("revoked_at", time.Now()).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := client.WriteMessage(websocket.TextMessage, []byte(`{"type":"ping"}`)); err != nil {
+		t.Fatal(err)
+	}
+	requireSecuritySocketClosed(t, client)
+	if !session.Closed.Load() {
+		t.Fatal("reader did not revoke session")
+	}
+}
+
+func TestWsIdlePumpClosesRevokedConnection(t *testing.T) {
+	f := newWsAuthFixture(t, true)
+	ws := newWsService()
+	// Same production timer path, shortened only on this isolated service instance.
+	ws.authCheckPeriod = 10 * time.Millisecond
+	session := newWsAuthClient(f, "idle", realtimeRoleAdmin)
+	serverConn, client := newSecuritySocketPair(t)
+	session.Conn = serverConn
+	ws.manager.Register(session, ws.defaultTopics(session))
+	startSecurityPumps(t, ws, session, false)
+	if err := f.db.Model(&f.session).Update("revoked_at", time.Now()).Error; err != nil {
+		t.Fatal(err)
+	}
+	requireSecuritySocketClosed(t, client)
+	if !session.Closed.Load() {
+		t.Fatal("idle authorization timer did not revoke session")
+	}
+}