| |
|
|
|
|
|
|
|
|
|
|
| |
POS terminals log into the websocket with the "<uid>-ro" token that the
web flasher pre-fills. track() looked that id up as a user, failed, and
closed the socket a second later, dropping the invoice subscription, so
devices were listening about one second in six. Strip the suffix the
way lib/auth.ts does for HTTP, flag the socket read-only, and forward
only "payment" events to it.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_014gVYGi29FjTeLdNTiutkZx
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The websocket auth gate used jwt.decode(), which parses the payload but
never checks the signature — anyone could forge {id: <victim uid>}
(alg:none or any key), register their socket under the victim's uid, and
receive every emit for that account. Switch both track() and the "login"
gate to jwt.verify(token, config.jwt), rejecting forged/altered tokens.
Also project the full-record socket emits through pick(user, whitelist)
so a "user" event can never carry the bcrypt hash, TOTP secret, or PIN —
matching the shape /login and /me already return.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
