mosaicstack/stack
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

feat(plugins): plugin-to-gateway WebSocket auth mechanism #94

New Issue
Open
opened 2026-03-13 17:08:57 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-03-13 17:08:57 +00:00
Owner
Copy Link

Context

PR #85 added validateSocketSession to ChatGateway.handleConnection — all WebSocket connections now require a valid session cookie.

PR #93 (@mosaic/telegram-plugin) connects to the /chat gateway WebSocket without auth headers. Once PR #85 merges, the plugin will be disconnected immediately.

Needed

A mechanism for internal channel plugins to authenticate against the gateway WebSocket. Options:

  1. Service API key — gateway accepts X-Plugin-Token header (env-configured shared secret), bypasses Better Auth session check for plugin connections
  2. Trusted localhost bypass — allow connections from 127.0.0.1 without session validation (simpler but less secure in container environments)
  3. Bot service account — plugins authenticate using a real Better Auth session (service account user)

Recommendation

Option 1 (service API key) — add PLUGIN_API_KEY env var, check in handleConnection before calling validateSocketSession.

Affected

  • apps/gateway/src/chat/chat.gateway.ts
  • plugins/telegram/src/index.ts
  • plugins/discord/src/index.ts (if applicable)
## Context PR #85 added `validateSocketSession` to `ChatGateway.handleConnection` — all WebSocket connections now require a valid session cookie. PR #93 (`@mosaic/telegram-plugin`) connects to the `/chat` gateway WebSocket without auth headers. Once PR #85 merges, the plugin will be disconnected immediately. ## Needed A mechanism for internal channel plugins to authenticate against the gateway WebSocket. Options: 1. **Service API key** — gateway accepts `X-Plugin-Token` header (env-configured shared secret), bypasses Better Auth session check for plugin connections 2. **Trusted localhost bypass** — allow connections from 127.0.0.1 without session validation (simpler but less secure in container environments) 3. **Bot service account** — plugins authenticate using a real Better Auth session (service account user) ## Recommendation Option 1 (service API key) — add `PLUGIN_API_KEY` env var, check in `handleConnection` before calling `validateSocketSession`. ## Affected - `apps/gateway/src/chat/chat.gateway.ts` - `plugins/telegram/src/index.ts` - `plugins/discord/src/index.ts` (if applicable)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#94
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?