Repository navigation
fix(rtc): config + signalling require auth by default (ADR-0101, #252) - #254
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes tina4-python#252 at four-framework parity: the RTC config route and the
signalling socket now require auth by default.
With TURN configured,
GET {prefix}/api/rtc/configmints a fresh coturncredential on every call and
{prefix}/ws/rtc/{room}relays a call. Both werepublic, so anyone could use the operator's TURN server as a relay (unbounded
bandwidth on their bill), and the short credential TTL did not bound it. There
was no way to close them.
ADR-0101: both are secured by default. An app that genuinely wants anonymous
calling opts out with
TINA4_RTC_REQUIRE_AUTH=false(or0/no/off). Theparse is a blacklist of falsey values, so a typo keeps the routes secured
rather than silently opening the relay. Each framework secures through its own
existing mechanism (Python
_secured, PHP->secure(), Ruby.secure, Node.secure()).BREAKING for an anonymous-calling app that does not set the opt-out — those
endpoints start returning 401. One env var restores the old behaviour.
Verified at HEAD, no mocks (auth_required read off the real route tables after a
real registration): 6/6 in all four frameworks, each mutation-proven. Existing
realtime suites updated for the new default (python config test authenticates;
node relay/content tests opt out). New contract
rtc_auth_contract.json.🤖 Generated with Claude Code