release: WRNexusJS 0.7.0

packages/core/test/realtime.test.ts

@@ -159,3 +159,46 @@ test("room.state and count() track the live room", async () => {
   expect(a.sent[0]).toMatchObject({ online: 1, hits: 1 });
   expect(b.sent[0]).toMatchObject({ online: 2, hits: 2 });
 });
+
+test("realtime security enforces authentication, message size, rate, and safe shapes", async () => {
+  const violations: string[] = [];
+  const def = defineRoom({
+    security: {
+      requireUser: true,
+      maxMessageBytes: 64,
+      maxMessagesPerSecond: 1,
+      onViolation(reason) {
+        violations.push(reason);
+      },
+    },
+  });
+  const now = { value: 0 };
+  const reg = createRealtimeRegistry({ now: () => now.value });
+  const anonymousClosures: Array<[number | undefined, string | undefined]> = [];
+  const anonymous: RawSocket = {
+    send() {},
+    close(code, reason) {
+      anonymousClosures.push([code, reason]);
+    },
+  };
+  await reg.open(anonymous, { room: "/secure", def });
+  expect(anonymousClosures[0]).toEqual([1008, "Authentication required"]);
+
+  const closures: Array<[number | undefined, string | undefined]> = [];
+  const socket: RawSocket = {
+    send() {},
+    close(code, reason) {
+      closures.push([code, reason]);
+    },
+  };
+  await reg.open(socket, { room: "/secure", def, user: "u1" });
+  await reg.message(socket, JSON.stringify({ ok: true }));
+  await reg.message(socket, JSON.stringify({ ok: true }));
+  expect(closures.at(-1)).toEqual([1008, "Message rate exceeded"]);
+  expect(violations).toContain("message-rate-limit");
+
+  now.value = 2_000;
+  const unsafe = '{"constructor":{"prototype":{"admin":true}}}';
+  await reg.message(socket, unsafe);
+  expect(violations).toContain("invalid-message-shape");
+});