Halit Aksoy
30ad51c493
- New auth module verifies Keycloak access tokens offline against the realm's signing keys (issuer, RS256, typ=Bearer, allowed azp); guests are recognised by the guest realm role - Clients send an auth message after connecting and get on_auth or on_auth_error; unauthenticated sockets are closed after 5 seconds and their messages ignored; a socket can refresh its token but not switch user - A user can be connected from several sockets; a late close of an old socket no longer drops the new one - Malformed messages are ignored instead of throwing - Games store player names and guest flags and send them with the connection info - Legacy ?userKey= clients and /register stay available behind LEGACY_USERKEY_AUTH; legacy keys must be UUIDs so they cannot take a Keycloak user's kc: id - TypeScript target raised to es2020 for async/await |
||
|---|---|---|
| .. | ||
| auth | ||
| rtmt | ||
| mancala.test.ts | ||