Package com.tnsai.server.security

Class WsCapabilityGate

java.lang.Object

com.tnsai.server.security.WsCapabilityGate

public final class WsCapabilityGate
extends Object

WebSocket upgrade-time capability gate (TNS-302).

The client connects to /chat?sessionId=<id>&capability=<token>. This handler runs as wsBeforeUpgrade(...) (HTTP-level), so it can short-circuit the upgrade with 403 before the socket exists. After upgrade, WsHandler relies on the connection-binding contract: the first frame's sessionId locks the connection, and subsequent frames with a different sessionId are rejected.

Behaviour:

• sessionId missing — let through (legacy CLI / explorer; the first frame creates the session and mints a capability via the response on first HTTP touch).
• sessionId present, session-or-token already exists, capability matches — let through.
• sessionId present, session exists, capability missing/wrong — reject 403.
• sessionId present, session is new — mint a token and echo via X-Session-Capability response header.

Constructor Summary

Constructors

Constructor	Description
WsCapabilityGate(SessionManager sessionManager, SessionCapabilityStore store)

Method Summary

Modifier and Type	Method	Description
void	before(io.javalin.http.Context ctx)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

WsCapabilityGate

public WsCapabilityGate(SessionManager sessionManager,
 SessionCapabilityStore store)

Method Details

before

public void before(io.javalin.http.Context ctx)