Kevin JahnsandAnthony LC
02c83861a7
Add POST /collaboration/reset-connections/v1/{org}/{docid} (optional
X-User-Id header) to yhub-server. It distributes yhub recheckAuth: every
server re-runs the access check per matching connection and closes only
those whose access actually changed (close code 4401), so unaffected
clients see no reconnect churn. The endpoint authenticates with the
RS256 admin JWT issued by JWTService, verified against the backend JWKS
(new jose dependency); the admin token acts as the "system" user and is
the only principal granted the reset-connections access purpose. The
backend does not trigger it on permission changes yet - that wiring
comes separately, now that CollaborationService is gone.
yhub is upgraded to 0.4.0 and serves every route under the
/collaboration/ prefix (server.apiPrefix): the websocket moves to
/collaboration/ws/v1/docs, and the built-in document apis are meant to
be publicly exposed alongside it, with reset-connections as the one
backend-internal exception.
Also harden websocket auth: fail closed when the backend errors (only a
genuine 401/403 falls back to the anonymous identity, so a signed-in
editor can never hide from a targeted recheck under an anon userid) and
tolerate small clock skew when verifying the cached admin token.
Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>
2.7 KiB
yhub-server
This directory contains the La Suite Docs-specific configuration for
yhub (@y/hub), the collaboration
server that synchronizes Yjs documents between editors in real time.
It is not a fork of yhub — it is a thin wrapper (server.js) that:
- starts a yhub instance (websocket sync on port 3002, backed by Redis/Valkey and PostgreSQL),
- plugs in an auth plugin that resolves users and per-document access rights
by calling the Docs Django backend (
/api/v1.0/users/me/and/api/v1.0/documents/{id}/), - serves every route under the
/collaboration/prefix (server.apiPrefix), including the websocket sync route/collaboration/ws/v1/{org}/{docid}, - exposes
POST /collaboration/reset-connections/v1/{org}/{docid}(optionalX-User-Idheader), for the Django backend to re-check the authorization of a document's connected clients when permissions change (backend wiring pending) — authenticated with an RS256 admin JWT issued by Django and verified against its JWKS (/api/v1.0/jwks); thereset-connectionspurpose is granted only to that admin token, never to regular users, - mirrors the environment conventions used elsewhere in this repository
(
*_FILEsecret indirection,COLLABORATION_SERVER_ORIGINallowlist, …).
Public exposure: route the whole /collaboration/ prefix to this server —
the websocket and the built-in document APIs (ydoc, rollback, prune,
changeset, activity) are all guarded by the same cookie-based document
authorization and are meant to be reachable by browsers. The one exception
is /collaboration/reset-connections/, which is backend-internal and should
not be routed through the public ingress.
The Dockerfile builds the container image used by the yhub service in
compose.yml.
⚠️ License warning (AGPL)
This directory depends on @y/hub, which is licensed under the
GNU AGPL-3.0 (or a separate proprietary license from its author). Unlike
the rest of this repository (MIT), the code in this directory is loaded into
the same process as AGPL-licensed code. As a consequence:
- Any modification to the code in this directory (in particular
server.js) must be released under an AGPL-compatible license if you run or distribute the resulting server, including making it available to users over a network (AGPL section 13). - See the LICENSE file in this directory for details.
The rest of La Suite Docs is not affected. The Django backend and the frontend never link against yhub; they communicate with it exclusively through network requests (REST/HTTP and WebSocket). They remain under the MIT license of the repository root.