Skip to content

feat(socket): notify drivers on JWT expiration during active WebSocket session - #166

Merged
Tybravo merged 3 commits into
SwiftChainn:mainfrom
obswrld:feat-Fix-token-expiration-edge-cases-causing-location-updates-to-silently-fail-mid-delivery
Aug 30, 2026
Merged

feat(socket): notify drivers on JWT expiration during active WebSocket session#166
Tybravo merged 3 commits into
SwiftChainn:mainfrom
obswrld:feat-Fix-token-expiration-edge-cases-causing-location-updates-to-silently-fail-mid-delivery

Conversation

@obswrld

@obswrld obswrld commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

closes #151

Summary

Ensures drivers are notified when their JWT token expires during an active WebSocket session. The server now periodically validates the token, emits an auth_expired event to prompt the client to refresh, and gracefully disconnects if the token is not refreshed in time.

Changes Made

Modified files:

  • src/services/authService.ts — Fixed verifyToken() to check decoded.userId first, matching the actual JWT payload shape.
  • src/sockets/connectionHandler.ts — Extracts and stores the raw JWT token from auth.token or query param onto socket.data.token.
  • src/sockets/socket.service.ts — Added validateSocketToken() method that verifies the JWT via authService.verifyToken() and checks the user's DB status (active/suspended/banned).
  • src/sockets/socket.types.ts — Added AuthExpiredPayload, AuthRefreshPayload, AuthRefreshAckPayload interfaces; added auth_expired and auth_refresh_ack to ServerToClientEvents; added auth_refresh to ClientToServerEvents; added token?: string to SocketData.
  • src/sockets/locationHandler.ts — Implemented setupTokenExpirationCheck():
  • Validates the token on a configurable interval (default: 60s, env: SOCKET_TOKEN_CHECK_INTERVAL_MS)
  • Emits auth_expired event with a grace period (default: 30s, env: SOCKET_TOKEN_GRACE_PERIOD_MS) on failure
  • Handles auth_refresh client event to accept a new JWT without reconnecting
  • Gracefully disconnects if the client doesn't refresh within the grace period
  • Cleans up intervals on disconnect
  • tests/socket.service.test.ts — Added 6 unit tests for validateSocketToken (valid token, expired token, missing user, suspended user, banned user).
  • tests/locationHandler.test.ts — Added 7 unit tests covering the full token expiration flow (skip unauthenticated, periodic validation, auth_expired emission, graceful disconnect, auth_refresh success/failure, cleanup on disconnect).
    New files:
  • tests/locationHandler.test.ts — Unit tests for the token expiration check in locationHandler.ts.

obswrld and others added 3 commits August 29, 2026 07:37
- Fix authService.verifyToken to check decoded.userId first
- Store raw JWT token on socket.data during connection handshake
- Add SocketService.validateSocketToken for DB-backed token validation
- Implement setupTokenExpirationCheck in locationHandler:
  - Periodic JWT validation on configurable interval (default 60s)
  - Emit auth_expired event with grace period (default 30s)
  - Handle auth_refresh to accept new JWT without reconnecting
  - Graceful disconnect if token not refreshed in time
- Extend socket.types with AuthExpiredPayload, AuthRefreshPayload, etc.
- Add unit tests for validateSocketToken and token expiration flow
…-location-updates-to-silently-fail-mid-delivery
@Tybravo
Tybravo merged commit 61dddc1 into SwiftChainn:main Aug 30, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Fix token expiration edge cases causing location updates to silently fail mid-delivery

2 participants