Changeset 8f2f97c in Klonkt for src/server.js

Timestamp:

06/23/2026 02:24:46 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

cb01666

Parents:

24cdcc6

Message:

Prutter (DM feature) fully removed

Reason: redundant feature + unnecessary attack surface (real-time WebSocket +
storing private messages = privacy/abuse risk). Removed: routes/prutter.js,
PrutterService, the WebSocket server in server.js, both DM views, all nav links
(topnav/bottom-tab), the DM button on profiles, the per-site enable_prutter
toggle and column. Existing (empty) DM tables in old DBs remain untouched but
are no longer referenced anywhere. No WebSocket left in the app.

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (6 diffs)

src/server.js

@@ -19 +19 @@
 import { SqliteSessionStore } from './services/SqliteSessionStore.js';
 import { ensurePrimarySite } from './services/ensurePrimarySite.js';
-import PrutterService from './services/PrutterService.js';
-import { WebSocketServer } from 'ws';
-
 import { resolveSite, loadAudioTracks, loadTheme } from './middleware/site.js';
 import { isViewer } from './middleware/auth.js';
@@ -36 +33 @@
 import adminSettingsRoutes from './routes/admin-settings.js';
 import adminSeoRoutes from './routes/admin-seo.js';
-import prutterRoutes from './routes/prutter.js';
 import audioRoutes from './routes/audio.js';
 import searchRoutes from './routes/search.js';
@@ -206 +202 @@
 })();
 
-// Singleton PrutterService — routes get it via req.app.locals.prutter.
-const prutter = new PrutterService(db);
-app.locals.prutter = prutter;
-
 // Cirkels-federatie: publieke, site-agnostische endpoints (/.klonkt/*).
 // Vóór resolveSite/theme — ze hebben geen site-context nodig.
@@ -274 +266 @@
 app.use('/admin/epk', adminEpkRoutes);
 app.use('/admin', adminRoutes);
-app.use('/prutter', prutterRoutes);
 app.use('/audio', audioRoutes);
 app.use('/search', searchRoutes);
@@ -422 +413 @@
 });
 
-// ==================== WebSocket: Prutter real-time ====================
-// Authenticate via the existing session cookie. We reuse sessionMiddleware
-// during the HTTP upgrade so req.session is populated; if no user, abort.
-const wss = new WebSocketServer({ noServer: true });
-
-server.on('upgrade', (req, socket, head) => {
-  if (req.url !== '/ws/prutter') {
-    socket.destroy();
-    return;
-  }
-  // Run session middleware on the upgrade request.
-  // (Express's middleware accepts (req, res, next); we pass a stub res.)
-  const stubRes = { setHeader: () => {}, getHeader: () => undefined, on: () => {}, end: () => {} };
-  sessionMiddleware(req, stubRes, () => {
-    if (!req.session?.user) {
-      socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
-      socket.destroy();
-      return;
-    }
-    // Kijker-accounts zijn alleen-lezen: weiger de WS-upgrade. De HTTP-guard
-    // dekt geen WS, dus dit is de plek om schrijven via een (toekomstige)
-    // message-handler te voorkomen.
-    if (isViewer(req.session.user)) {
-      socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
-      socket.destroy();
-      return;
-    }
-    wss.handleUpgrade(req, socket, head, (ws) => {
-      ws.userId = req.session.user.id;
-      wss.emit('connection', ws, req);
-    });
-  });
-});
-
-wss.on('connection', (ws) => {
-  prutter.addConnection(ws.userId, ws);
-  ws.on('close', () => prutter.removeConnection(ws.userId, ws));
-  ws.on('error', () => prutter.removeConnection(ws.userId, ws));
-  // Optional: ping every 30s to keep connections alive through proxies
-  ws.isAlive = true;
-  ws.on('pong', () => { ws.isAlive = true; });
-});
-const wsPing = setInterval(() => {
-  for (const ws of wss.clients) {
-    if (ws.isAlive === false) { ws.terminate(); continue; }
-    ws.isAlive = false;
-    try { ws.ping(); } catch {}
-  }
-}, 30000);
-if (wsPing.unref) wsPing.unref();
-
 server.listen(PORT, () => {
   console.log('');
@@ -483 +423 @@
   console.log(`   ✓ Auth:     wachtwoord (beheer) + Google (luisteraars) / logout`);
   console.log(`   ✓ Posts:    create / edit / view / archive`);
-  console.log(`   ✓ Realtime: WebSocket server ready (Prutter)`);
   console.log('');
   console.log(`   Mode: ${isDev ? 'development' : 'PRODUCTION'}`);