fix: reject expired link sessions

apis/link/src/relay.ts

@@ -86,6 +86,12 @@ export function handleRelaySocket(socket: WebSocket, app: FastifyInstance) {
         return;
       }
 
+      if (session.status !== "approved") {
+        sendJson(socket, { type: "relay.reject", reason: "Session not approved" });
+        socket.close();
+        return;
+      }
+
       // Verify deviceId matches session participants
       if (role === "desktop" && session.desktopDeviceId !== deviceId) {
         sendJson(socket, { type: "relay.reject", reason: "deviceId mismatch" });

convex/linkSessions.test.ts

@@ -184,4 +184,23 @@ describe("get", () => {
 
     expect(result).toBeNull();
   });
+
+  it("does not return expired sessions", async () => {
+    const ctx = makeCtx(userId);
+    const id = await ctx.db.insert("linkSessions", {
+      userId,
+      desktopDeviceId: "d1",
+      mobileDeviceId: "m1",
+      mode: "mirror",
+      status: "approved",
+      transport: "websocket",
+      createdAt: Date.now() - 7200000,
+      expiresAt: Date.now() - 3600000,
+    });
+
+    const result = await (get as any).handler(ctx, { sessionId: id });
+
+    expect(result).toBeNull();
+  });
+
 });

convex/linkSessions.ts

@@ -2,6 +2,10 @@ import { query, mutation } from "./_generated/server";
 import { v } from "convex/values";
 import { getAuthUserId } from "@convex-dev/auth/server";
 
+function isExpired(session: { expiresAt: number }) {
+  return session.expiresAt <= Date.now();
+}
+
 export const create = mutation({
   args: {
     desktopDeviceId: v.string(),
@@ -41,6 +45,7 @@ export const updateStatus = mutation({
     if (!userId) throw new Error("Not authenticated");
     const session = await ctx.db.get(args.sessionId);
     if (!session || session.userId !== userId) throw new Error("Session not found");
+    if (isExpired(session)) throw new Error("Session expired");
     await ctx.db.patch(args.sessionId, { status: args.status });
   },
 });
@@ -52,6 +57,7 @@ export const updateTransport = mutation({
     if (!userId) throw new Error("Not authenticated");
     const session = await ctx.db.get(args.sessionId);
     if (!session || session.userId !== userId) throw new Error("Session not found");
+    if (isExpired(session)) throw new Error("Session expired");
     await ctx.db.patch(args.sessionId, { transport: args.transport });
   },
 });
@@ -63,6 +69,7 @@ export const get = query({
     if (!userId) throw new Error("Not authenticated");
     const session = await ctx.db.get(args.sessionId);
     if (!session || session.userId !== userId) return null;
+    if (isExpired(session)) return null;
     return session;
   },
 });