make kestrel a tak server, so that it can send and receive pois as cots data

server/api/live/webrtc/connect-transport.post.js

@@ -3,7 +3,7 @@ import { getLiveSession } from '../../../utils/liveSessions.js'
 import { getTransport } from '../../../utils/mediasoup.js'
 
 export default defineEventHandler(async (event) => {
-  requireAuth(event) // Verify authentication
+  const user = requireAuth(event) // Verify authentication
   const body = await readBody(event).catch(() => ({}))
   const { sessionId, transportId, dtlsParameters } = body
 
@@ -15,8 +15,12 @@ export default defineEventHandler(async (event) => {
   if (!session) {
     throw createError({ statusCode: 404, message: 'Session not found' })
   }
-  // Note: Both publisher and viewers can connect their own transports
-  // The transportId ensures they can only connect transports they created
+
+  // Verify user has permission to connect transport for this session
+  // Only session owner or admin/leader can connect transports
+  if (session.userId !== user.id && user.role !== 'admin' && user.role !== 'leader') {
+    throw createError({ statusCode: 403, message: 'Forbidden' })
+  }
 
   const transport = getTransport(transportId)
   if (!transport) {

server/api/live/webrtc/create-consumer.post.js

@@ -3,7 +3,7 @@ import { getLiveSession } from '../../../utils/liveSessions.js'
 import { getRouter, getTransport, getProducer, createConsumer } from '../../../utils/mediasoup.js'
 
 export default defineEventHandler(async (event) => {
-  requireAuth(event) // Verify authentication
+  const user = requireAuth(event) // Verify authentication
   const body = await readBody(event).catch(() => ({}))
   const { sessionId, transportId, rtpCapabilities } = body
 
@@ -15,6 +15,12 @@ export default defineEventHandler(async (event) => {
   if (!session) {
     throw createError({ statusCode: 404, message: `Session not found: ${sessionId}` })
   }
+  
+  // Authorization check: only session owner or admin/leader can consume
+  if (session.userId !== user.id && user.role !== 'admin' && user.role !== 'leader') {
+    throw createError({ statusCode: 403, message: 'Forbidden' })
+  }
+  
   if (!session.producerId) {
     throw createError({ statusCode: 404, message: 'No producer available for this session' })
   }

server/api/live/webrtc/create-producer.post.js

@@ -1,6 +1,7 @@
 import { requireAuth } from '../../../utils/authHelpers.js'
 import { getLiveSession, updateLiveSession } from '../../../utils/liveSessions.js'
 import { getTransport, producers } from '../../../utils/mediasoup.js'
+import { acquire } from '../../../utils/asyncLock.js'
 
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
@@ -11,33 +12,48 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 400, message: 'sessionId, transportId, kind, and rtpParameters required' })
   }
 
-  const session = getLiveSession(sessionId)
-  if (!session) {
-    throw createError({ statusCode: 404, message: 'Session not found' })
-  }
-  if (session.userId !== user.id) {
-    throw createError({ statusCode: 403, message: 'Forbidden' })
-  }
+  return await acquire(`create-producer-${sessionId}`, async () => {
+    const session = getLiveSession(sessionId)
+    if (!session) {
+      throw createError({ statusCode: 404, message: 'Session not found' })
+    }
+    if (session.userId !== user.id) {
+      throw createError({ statusCode: 403, message: 'Forbidden' })
+    }
 
-  const transport = getTransport(transportId)
-  if (!transport) {
-    throw createError({ statusCode: 404, message: 'Transport not found' })
-  }
+    const transport = getTransport(transportId)
+    if (!transport) {
+      throw createError({ statusCode: 404, message: 'Transport not found' })
+    }
 
-  const producer = await transport.produce({ kind, rtpParameters })
-  producers.set(producer.id, producer)
-  producer.on('close', () => {
-    producers.delete(producer.id)
-    const s = getLiveSession(sessionId)
-    if (s && s.producerId === producer.id) {
-      updateLiveSession(sessionId, { producerId: null })
+    const producer = await transport.produce({ kind, rtpParameters })
+    producers.set(producer.id, producer)
+    producer.on('close', async () => {
+      producers.delete(producer.id)
+      const s = getLiveSession(sessionId)
+      if (s && s.producerId === producer.id) {
+        try {
+          await updateLiveSession(sessionId, { producerId: null })
+        }
+        catch {
+          // Ignore errors during cleanup
+        }
+      }
+    })
+
+    try {
+      await updateLiveSession(sessionId, { producerId: producer.id })
+    }
+    catch (err) {
+      if (err.message === 'Session not found') {
+        throw createError({ statusCode: 404, message: 'Session not found' })
+      }
+      throw err
+    }
+
+    return {
+      id: producer.id,
+      kind: producer.kind,
     }
   })
-
-  updateLiveSession(sessionId, { producerId: producer.id })
-
-  return {
-    id: producer.id,
-    kind: producer.kind,
-  }
 })

server/api/live/webrtc/create-transport.post.js

@@ -2,6 +2,7 @@ import { getRequestURL } from 'h3'
 import { requireAuth } from '../../../utils/authHelpers.js'
 import { getLiveSession, updateLiveSession } from '../../../utils/liveSessions.js'
 import { getRouter, createTransport } from '../../../utils/mediasoup.js'
+import { acquire } from '../../../utils/asyncLock.js'
 
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
@@ -12,28 +13,38 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 400, message: 'sessionId required' })
   }
 
-  const session = getLiveSession(sessionId)
-  if (!session) {
-    throw createError({ statusCode: 404, message: 'Session not found' })
-  }
+  return await acquire(`create-transport-${sessionId}`, async () => {
+    const session = getLiveSession(sessionId)
+    if (!session) {
+      throw createError({ statusCode: 404, message: 'Session not found' })
+    }
 
-  // Only publisher (session owner) can create producer transport
-  // Viewers can create consumer transports
-  if (isProducer && session.userId !== user.id) {
-    throw createError({ statusCode: 403, message: 'Forbidden' })
-  }
+    // Only publisher (session owner) can create producer transport
+    // Viewers can create consumer transports
+    if (isProducer && session.userId !== user.id) {
+      throw createError({ statusCode: 403, message: 'Forbidden' })
+    }
 
-  const url = getRequestURL(event)
-  const requestHost = url.hostname
-  const router = await getRouter(sessionId)
-  const { transport, params } = await createTransport(router, requestHost)
+    const url = getRequestURL(event)
+    const requestHost = url.hostname
+    const router = await getRouter(sessionId)
+    const { transport, params } = await createTransport(router, requestHost)
 
-  if (isProducer) {
-    updateLiveSession(sessionId, {
-      transportId: transport.id,
-      routerId: router.id,
-    })
-  }
+    if (isProducer) {
+      try {
+        await updateLiveSession(sessionId, {
+          transportId: transport.id,
+          routerId: router.id,
+        })
+      }
+      catch (err) {
+        if (err.message === 'Session not found') {
+          throw createError({ statusCode: 404, message: 'Session not found' })
+        }
+        throw err
+      }
+    }
 
-  return params
+    return params
+  })
 })

server/api/live/webrtc/router-rtp-capabilities.get.js

@@ -3,7 +3,7 @@ import { getLiveSession } from '../../../utils/liveSessions.js'
 import { getRouter } from '../../../utils/mediasoup.js'
 
 export default defineEventHandler(async (event) => {
-  requireAuth(event)
+  const user = requireAuth(event)
   const sessionId = getQuery(event).sessionId
 
   if (!sessionId) {
@@ -15,6 +15,11 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, message: 'Session not found' })
   }
 
+  // Only session owner or admin/leader can access
+  if (session.userId !== user.id && user.role !== 'admin' && user.role !== 'leader') {
+    throw createError({ statusCode: 403, message: 'Forbidden' })
+  }
+
   const router = await getRouter(sessionId)
   return router.rtpCapabilities
 })