Add authenticated websocket connections and data flows#723
Open
JustSamuel wants to merge 7 commits intodevelopfrom
Open
Add authenticated websocket connections and data flows#723JustSamuel wants to merge 7 commits intodevelopfrom
JustSamuel wants to merge 7 commits intodevelopfrom
Conversation
JustSamuel
force-pushed
the
feature/authenticated-websocket-messages
branch
from
cd1ff0e to
f1a4c95
Compare
There was a problem hiding this comment.
Pull request overview
Adds authenticated WebSocket infrastructure with room-based authorization and event-based emission, and wires transaction creation to broadcast WebSocket events to subscribed clients.
Changes:
- Refactors
WebSocketServiceinto an instance-based singleton with room policy + event handler registries. - Adds room parsing/matching utilities plus guard/resolver abstractions for event-to-room routing.
- Emits
transaction:createdWebSocket events after transaction creation.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| src/service/websocket/room-policy.ts | Introduces room policy registry and request context for authorizing subscriptions. |
| src/service/websocket/room-authorization.ts | Adds room parsing and {id}-pattern matching helpers. |
| src/service/websocket/pos-relation-helper.ts | Extracts POS relation lookup used by room authorization. |
| src/service/websocket/event-registry.ts | Adds event handler registry with resolver/guard model for room emission. |
| src/service/websocket/event-guards.ts | Adds guards to filter events to POS/user/global rooms. |
| src/service/websocket-service.ts | Implements authenticated subscriptions, room policy checks, and event-based emission; refactors to singleton instance. |
| src/service/transaction-service.ts | Emits a WebSocket event after successfully creating a transaction response. |
| src/index.ts | Instantiates WebSocketService at startup and stores it on the Application instance. |
Comments suppressed due to low confidence (1)
src/index.ts:111
Application.stop()closes the HTTP server and DB connection but does not close the WebSocket server that is now started duringcreateApp(). This can leave open handles (and in development, a bound port) after shutdown. Add cleanup forthis.webSocketService(e.g., close Socket.IO and the underlying HTTP server).
webSocketService: WebSocketService;
public async stop(): Promise<void> {
this.logger.info('Stopping application instance...');
await util.promisify(this.server.close).bind(this.server)();
this.tasks.forEach((task) => task.stop());
await this.connection.destroy();
this.logger.info('Application stopped.');
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
JustSamuel
force-pushed
the
feature/authenticated-websocket-messages
branch
6 times, most recently
from
99569bf to
fa4d090
Compare
JustSamuel
force-pushed
the
feature/authenticated-websocket-messages
branch
6 times, most recently
from
5297d26 to
feb1a5a
Compare
JustSamuel
force-pushed
the
feature/authenticated-websocket-messages
branch
from
110bdd9 to
217577b
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
RubenLWF
requested changes
Jan 27, 2026
Contributor
RubenLWF
left a comment
RubenLWF
left a comment
There was a problem hiding this comment.
This is already looking really good! 🙂
I have left a few comments.
JustSamuel
force-pushed
the
feature/authenticated-websocket-messages
branch
from
7e6a977 to
0805b10
Compare
RubenLWF
requested changes
Feb 1, 2026
RubenLWF
reviewed
Feb 1, 2026
| ``` | ||
|
|
||
| The server will be available at `http://localhost:3000` | ||
|
|
Contributor
There was a problem hiding this comment.
issue:
you removed a line too many here :)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refactors WebSocketService from static methods to an instance-based singleton. Adds event registry where each event type has resolver and guard functions, so emission only processes handlers for that event type instead of all rooms. Room subscriptions use a policy registry that checks permissions before allowing access to rooms like
pos:{id}:transactions,user:{id}:transactions, andtransactions:all.Splits functionality into modules:
room-authorizationparses room patterns,room-policyhandles authorization,event-registrymanages event handlers,event-guardsfilter events to rooms, andpos-relation-helperextracts POS relation logic. Transaction creation now emits WebSocket events to subscribed clients in relevant rooms based on transaction data.Static methods delegate to the singleton instance for backward compatibility. Service initializes at app startup with TokenHandler and RoleManager injected. Existing functionality unchanged.
Related issues/external references
Types of changes
✅ PR Checklist
npm run test)🔗 Additional Notes