fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/services/ws_pump_security_test.go

@@ -0,0 +1,104 @@
+package services
+
+import (
+ "net/http"
+ "net/http/httptest"
+ "strings"
+ "testing"
+ "time"
+
+ "agent-desk/internal/pkg/enums"
+ "github.com/gorilla/websocket"
+)
+
+// The listener exists only inside the test. No app server or external service is
+// involved; the DB fixture is temporary and every pump is joined before cleanup.
+func newSecuritySocketPair(t *testing.T) (*websocket.Conn,*websocket.Conn) {
+ t.Helper()
+ accepted:=make(chan *websocket.Conn,1)
+ failed:=make(chan error,1)
+ server:=httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter,r *http.Request){
+  upgrader:=websocket.Upgrader{}
+  conn,err:=upgrader.Upgrade(w,r,nil)
+  if err!=nil{failed<-err;return}
+  accepted<-conn
+ }))
+ t.Cleanup(server.Close)
+ client,_,err:=websocket.DefaultDialer.Dial("ws"+strings.TrimPrefix(server.URL,"http"),nil)
+ if err!=nil{t.Fatal(err)}
+ var serverConn *websocket.Conn
+ select{
+ case serverConn=<-accepted:
+ case err:=<-failed:t.Fatal(err)
+ case <-time.After(time.Second):t.Fatal("test websocket upgrade timed out")
+ }
+ t.Cleanup(func(){_ = client.Close();_ = serverConn.Close()})
+ return serverConn,client
+}
+
+func startSecurityPumps(t *testing.T,ws *wsService,session *ClientSession,reader bool) {
+ t.Helper()
+ written:=make(chan struct{})
+ go func(){defer close(written);ws.writePump(session)}()
+ var read chan struct{}
+ if reader{
+  read=make(chan struct{})
+  go func(){defer close(read);ws.readPump(session)}()
+ }
+ t.Cleanup(func(){
+  ws.closeSession(session)
+  select{case <-written:case <-time.After(time.Second):t.Error("write pump did not stop")}
+  if read!=nil{select{case <-read:case <-time.After(time.Second):t.Error("read pump did not stop")}}
+ })
+}
+
+func requireSecuritySocketClosed(t *testing.T,client *websocket.Conn) {
+ t.Helper()
+ _ = client.SetReadDeadline(time.Now().Add(time.Second))
+ _,_,err:=client.ReadMessage()
+ if err==nil{t.Fatal("revoked connection delivered a buffered message")}
+ if networkErr,ok:=err.(interface{Timeout()bool});ok && networkErr.Timeout(){t.Fatal("revoked connection stayed open until test deadline")}
+}
+
+func TestWsWritePumpRejectsBufferedEventAfterRevocation(t *testing.T) {
+ f:=newWsAuthFixture(t,true)
+ ws:=newWsService()
+ session:=newWsAuthClient(f,"buffered",realtimeRoleAdmin)
+ serverConn,client:=newSecuritySocketPair(t)
+ session.Conn=serverConn
+ ws.manager.Register(session,ws.defaultTopics(session))
+ session.enqueueEvent(ws.newEvent(realtimeTopicAdminAll,RealtimeConversationChangedEvent{Type:enums.IMRealtimeEventConversationUpdated}))
+ if err:=f.db.Model(&f.session).Update("revoked_at",time.Now()).Error;err!=nil{t.Fatal(err)}
+ startSecurityPumps(t,ws,session,false)
+ requireSecuritySocketClosed(t,client)
+ if !session.Closed.Load(){t.Fatal("writer did not revoke session")}
+}
+
+func TestWsReadPumpRejectsIncomingFrameAfterRevocation(t *testing.T) {
+ f:=newWsAuthFixture(t,true)
+ ws:=newWsService()
+ session:=newWsAuthClient(f,"incoming",realtimeRoleAdmin)
+ serverConn,client:=newSecuritySocketPair(t)
+ session.Conn=serverConn
+ ws.manager.Register(session,ws.defaultTopics(session))
+ startSecurityPumps(t,ws,session,true)
+ if err:=f.db.Model(&f.session).Update("revoked_at",time.Now()).Error;err!=nil{t.Fatal(err)}
+ if err:=client.WriteMessage(websocket.TextMessage,[]byte(`{"type":"ping"}`));err!=nil{t.Fatal(err)}
+ requireSecuritySocketClosed(t,client)
+ if !session.Closed.Load(){t.Fatal("reader did not revoke session")}
+}
+
+func TestWsIdlePumpClosesRevokedConnection(t *testing.T) {
+ f:=newWsAuthFixture(t,true)
+ ws:=newWsService()
+ // Same production timer path, shortened only on this isolated service instance.
+ ws.authCheckPeriod=10*time.Millisecond
+ session:=newWsAuthClient(f,"idle",realtimeRoleAdmin)
+ serverConn,client:=newSecuritySocketPair(t)
+ session.Conn=serverConn
+ ws.manager.Register(session,ws.defaultTopics(session))
+ startSecurityPumps(t,ws,session,false)
+ if err:=f.db.Model(&f.session).Update("revoked_at",time.Now()).Error;err!=nil{t.Fatal(err)}
+ requireSecuritySocketClosed(t,client)
+ if !session.Closed.Load(){t.Fatal("idle authorization timer did not revoke session")}
+}