major: kestrel is now a tak server (#6)

## Added

- CoT (Cursor on Target) server on port 8089 enabling ATAK/iTAK device connectivity
- Support for TAK stream protocol and traditional XML CoT messages
- TLS/SSL support with automatic fallback to plain TCP
- Username/password authentication for CoT connections
- Real-time device position tracking with TTL-based expiration (90s default)
- API endpoints: `/api/cot/config`, `/api/cot/server-package`, `/api/cot/truststore`, `/api/me/cot-password`
- TAK Server section in Settings with QR code for iTAK setup
- ATAK password management in Account page for OIDC users
- CoT device markers on map showing real-time positions
- Comprehensive documentation in `docs/` directory
- Environment variables: `COT_PORT`, `COT_TTL_MS`, `COT_REQUIRE_AUTH`, `COT_SSL_CERT`, `COT_SSL_KEY`, `COT_DEBUG`
- Dependencies: `fast-xml-parser`, `jszip`, `qrcode`

## Changed

- Authentication system supports CoT password management for OIDC users
- Database schema includes `cot_password_hash` field
- Test suite refactored to follow functional design principles

## Removed

- Consolidated utility modules: `authConfig.js`, `authSkipPaths.js`, `bootstrap.js`, `poiConstants.js`, `session.js`

## Security

- XML entity expansion protection in CoT parser
- Enhanced input validation and SQL injection prevention
- Authentication timeout to prevent hanging connections

## Breaking Changes

- Port 8089 must be exposed for CoT server. Update firewall rules and Docker/Kubernetes configurations.

## Migration Notes

- OIDC users must set ATAK password via Account settings before connecting
- Docker: expose port 8089 (`-p 8089:8089`)
- Kubernetes: update Helm values to expose port 8089

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #6

test/unit/mediasoup.spec.js

@@ -3,28 +3,30 @@ import { createSession, deleteLiveSession } from '../../../server/utils/liveSess
 import { getRouter, createTransport, closeRouter, getTransport, createProducer, getProducer, createConsumer } from '../../../server/utils/mediasoup.js'
 
 describe('Mediasoup', () => {
-  let sessionId
+  const testState = {
+    sessionId: null,
+  }
 
   beforeEach(() => {
-    sessionId = createSession('test-user', 'Test Session').id
+    testState.sessionId = createSession('test-user', 'Test Session').id
   })
 
   afterEach(async () => {
-    if (sessionId) {
-      await closeRouter(sessionId)
-      deleteLiveSession(sessionId)
+    if (testState.sessionId) {
+      await closeRouter(testState.sessionId)
+      deleteLiveSession(testState.sessionId)
     }
   })
 
   it('should create a router for a session', async () => {
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     expect(router).toBeDefined()
     expect(router.id).toBeDefined()
     expect(router.rtpCapabilities).toBeDefined()
   })
 
   it('should create a transport', async () => {
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport, params } = await createTransport(router)
     expect(transport).toBeDefined()
     expect(params.id).toBe(transport.id)
@@ -34,7 +36,7 @@ describe('Mediasoup', () => {
   })
 
   it('should create a transport with requestHost IPv4 and return valid params', async () => {
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport, params } = await createTransport(router, '192.168.2.100')
     expect(transport).toBeDefined()
     expect(params.id).toBe(transport.id)
@@ -45,13 +47,13 @@ describe('Mediasoup', () => {
   })
 
   it('should reuse router for same session', async () => {
-    const router1 = await getRouter(sessionId)
-    const router2 = await getRouter(sessionId)
+    const router1 = await getRouter(testState.sessionId)
+    const router2 = await getRouter(testState.sessionId)
     expect(router1.id).toBe(router2.id)
   })
 
   it('should get transport by ID', async () => {
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport } = await createTransport(router, true)
     const retrieved = getTransport(transport.id)
     expect(retrieved).toBe(transport)
@@ -59,7 +61,7 @@ describe('Mediasoup', () => {
 
   it.skip('should create a producer with mock track', async () => {
     // Mediasoup produce() requires a real MediaStreamTrack (native addon); plain mocks fail with "invalid kind"
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport } = await createTransport(router, true)
     const mockTrack = {
       id: 'mock-track-id',
@@ -77,24 +79,25 @@ describe('Mediasoup', () => {
 
   it.skip('should cleanup producer on close', async () => {
     // Depends on createProducer which requires real MediaStreamTrack in Node
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport } = await createTransport(router, true)
     const mockTrack = { id: 'mock-track-id', kind: 'video', enabled: true, readyState: 'live' }
     const producer = await createProducer(transport, mockTrack)
     const producerId = producer.id
     expect(getProducer(producerId)).toBe(producer)
     producer.close()
-    let attempts = 0
-    while (getProducer(producerId) && attempts < 50) {
+    const waitForCleanup = async (maxAttempts = 50) => {
+      if (maxAttempts <= 0 || !getProducer(producerId)) return
       await new Promise(resolve => setTimeout(resolve, 10))
-      attempts++
+      return waitForCleanup(maxAttempts - 1)
     }
+    await waitForCleanup()
     expect(getProducer(producerId) || producer.closed).toBeTruthy()
   })
 
   it.skip('should create a consumer', async () => {
     // Depends on createProducer which requires real MediaStreamTrack in Node
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport } = await createTransport(router, true)
     const mockTrack = { id: 'mock-track-id', kind: 'video', enabled: true, readyState: 'live' }
     const producer = await createProducer(transport, mockTrack)
@@ -110,7 +113,7 @@ describe('Mediasoup', () => {
   })
 
   it('should cleanup transport on close', async () => {
-    const router = await getRouter(sessionId)
+    const router = await getRouter(testState.sessionId)
     const { transport } = await createTransport(router, true)
     const transportId = transport.id
     expect(getTransport(transportId)).toBe(transport)
@@ -118,19 +121,20 @@ describe('Mediasoup', () => {
     transport.close()
     // Wait for async cleanup (mediasoup fires 'close' event asynchronously)
     // Use a promise that resolves when transport is removed or timeout
-    let attempts = 0
-    while (getTransport(transportId) && attempts < 50) {
+    const waitForCleanup = async (maxAttempts = 50) => {
+      if (maxAttempts <= 0 || !getTransport(transportId)) return
       await new Promise(resolve => setTimeout(resolve, 10))
-      attempts++
+      return waitForCleanup(maxAttempts - 1)
     }
+    await waitForCleanup()
     // Transport should be removed from Map (or at least closed)
     expect(getTransport(transportId) || transport.closed).toBeTruthy()
   })
 
   it('should cleanup router on closeRouter', async () => {
-    await getRouter(sessionId)
-    await closeRouter(sessionId)
-    const routerAfter = await getRouter(sessionId)
+    await getRouter(testState.sessionId)
+    await closeRouter(testState.sessionId)
+    const routerAfter = await getRouter(testState.sessionId)
     // New router should have different ID (or same if cached, but old one should be closed)
     // This test verifies closeRouter doesn't throw
     expect(routerAfter).toBeDefined()