make kestrel a tak server, so that it can send and receive pois as cots data

server/plugins/websocket.js

@@ -1,6 +1,7 @@
 import { WebSocketServer } from 'ws'
 import { getDb } from '../utils/db.js'
 import { handleWebSocketMessage } from '../utils/webrtcSignaling.js'
+import { registerCleanup } from '../utils/shutdown.js'
 
 function parseCookie(cookieHeader) {
   const cookies = {}
@@ -79,8 +80,15 @@ export default defineNitroPlugin((nitroApp) => {
             callback(false, 401, 'Unauthorized')
             return
           }
-          // Store user_id in request for later use
+          // Get user role for authorization checks
+          const user = await get('SELECT id, role FROM users WHERE id = ?', [session.user_id])
+          if (!user) {
+            callback(false, 401, 'Unauthorized')
+            return
+          }
+          // Store user_id and role in request for later use
           info.req.userId = session.user_id
+          info.req.userRole = user.role
           callback(true)
         }
         catch (err) {
@@ -92,7 +100,8 @@ export default defineNitroPlugin((nitroApp) => {
 
     wss.on('connection', (ws, req) => {
       const userId = req.userId
-      if (!userId) {
+      const userRole = req.userRole
+      if (!userId || !userRole) {
         ws.close(1008, 'Unauthorized')
         return
       }
@@ -109,6 +118,20 @@ export default defineNitroPlugin((nitroApp) => {
             return
           }
 
+          // Verify user has access to this session (authorization check per message)
+          const { getLiveSession } = await import('../utils/liveSessions.js')
+          const session = getLiveSession(sessionId)
+          if (!session) {
+            ws.send(JSON.stringify({ error: 'Session not found' }))
+            return
+          }
+          
+          // Only session owner or admin/leader can access the session
+          if (session.userId !== userId && userRole !== 'admin' && userRole !== 'leader') {
+            ws.send(JSON.stringify({ error: 'Forbidden' }))
+            return
+          }
+
           // Track session connection
           if (currentSessionId !== sessionId) {
             if (currentSessionId) {
@@ -142,6 +165,13 @@ export default defineNitroPlugin((nitroApp) => {
     })
 
     console.log('[websocket] WebSocket server started on /ws')
+
+    registerCleanup(async () => {
+      if (wss) {
+        wss.close()
+        wss = null
+      }
+    })
   })
 
   nitroApp.hooks.hook('close', () => {