diff --git a/.changeset/player-forced-subscribe-crash.md b/.changeset/player-forced-subscribe-crash.md deleted file mode 100644 index 2d3bc2a13..000000000 --- a/.changeset/player-forced-subscribe-crash.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@epicgames-ps/lib-pixelstreamingsignalling-ue5.8': patch -'@epicgames-ps/wilbur': patch ---- - -Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, `sendToStreamer` force-subscribes it to the first available streamer and then forwards through `this.subscribedStreamer!`. `subscribe()` can decline — most commonly because `maxSubscribers` is already reached — and reports that only by leaving `subscribedStreamer` unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not. diff --git a/.changeset/server-player-keepalive.md b/.changeset/server-player-keepalive.md deleted file mode 100644 index 3d28bd7cc..000000000 --- a/.changeset/server-player-keepalive.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@epicgames-ps/lib-pixelstreamingsignalling-ue5.7': patch -'@epicgames-ps/wilbur': patch ---- - -Add an optional server-side keepalive that disconnects players whose connection has died without a clean close. Previously `KeepaliveMonitor` was only used on the client, so a player whose socket dropped silently (sleeping laptop, lost Wi-Fi, killed tab) stayed subscribed until the OS TCP keepalive reaped it, which could hold a `maxSubscribers` slot in the meantime. The new `IServerConfig.playerKeepaliveTimeout` controls this; the signalling server exposes it as `--player_keepalive_timeout ` (default 30000, 0 disables). diff --git a/.changeset/streamer-id-authorizer-hook.md b/.changeset/streamer-id-authorizer-hook.md deleted file mode 100644 index b109586e4..000000000 --- a/.changeset/streamer-id-authorizer-hook.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@epicgames-ps/lib-pixelstreamingsignalling-ue5.7': minor ---- - -Add extension points so consumers can plug in their own authentication and authorization without the library shipping an auth scheme. Connections now expose the HTTP upgrade `request` (`IStreamer.request` / `IPlayer.request`) so identity attached during a `verifyClient` check survives to later decisions, and `IServerConfig.authorizeStreamerId` lets a consumer authorize, override (e.g. namespace per tenant), or reject the id a streamer registers as — the seam for preventing streamer-id squatting. Default behaviour is unchanged when these are not supplied. See `Docs/Security-Guidelines.md`. diff --git a/.changeset/turn-ephemeral-credentials.md b/.changeset/turn-ephemeral-credentials.md deleted file mode 100644 index f078541dd..000000000 --- a/.changeset/turn-ephemeral-credentials.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@epicgames-ps/lib-pixelstreamingsignalling-ue5.8': minor -'@epicgames-ps/wilbur': minor ---- - -Allow TURN credentials to be issued per connection rather than shared by every session. `peerOptions` is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. `IServerConfig.peerOptionsProvider` is consulted once per connecting peer and returns the peer options for that peer, falling back to `peerOptions` if it throws. On top of it the signalling server adds `--turn_secret` (or `--turn_secret_file`) and `--turn_ttl`, which give every `turn:`/`turns:` entry a time limited username and credential in the form coturn's `use-auth-secret` mode expects. Default behaviour is unchanged when no secret is supplied. See `Docs/Security-Guidelines.md`. diff --git a/Signalling/CHANGELOG.md b/Signalling/CHANGELOG.md index 103902214..3c894d767 100644 --- a/Signalling/CHANGELOG.md +++ b/Signalling/CHANGELOG.md @@ -1,5 +1,17 @@ # @epicgames-ps/lib-pixelstreamingsignalling-ue5.6 +## 0.3.0 + +### Minor Changes + +- 4fcf502: Add extension points so consumers can plug in their own authentication and authorization without the library shipping an auth scheme. Connections now expose the HTTP upgrade `request` (`IStreamer.request` / `IPlayer.request`) so identity attached during a `verifyClient` check survives to later decisions, and `IServerConfig.authorizeStreamerId` lets a consumer authorize, override (e.g. namespace per tenant), or reject the id a streamer registers as — the seam for preventing streamer-id squatting. Default behaviour is unchanged when these are not supplied. See `Docs/Security-Guidelines.md`. +- 47cfc6e: Allow TURN credentials to be issued per connection rather than shared by every session. `peerOptions` is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. `IServerConfig.peerOptionsProvider` is consulted once per connecting peer and returns the peer options for that peer, falling back to `peerOptions` if it throws. On top of it the signalling server adds `--turn_secret` (or `--turn_secret_file`) and `--turn_ttl`, which give every `turn:`/`turns:` entry a time limited username and credential in the form coturn's `use-auth-secret` mode expects. Default behaviour is unchanged when no secret is supplied. See `Docs/Security-Guidelines.md`. + +### Patch Changes + +- e1b4d03: Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, `sendToStreamer` force-subscribes it to the first available streamer and then forwards through `this.subscribedStreamer!`. `subscribe()` can decline — most commonly because `maxSubscribers` is already reached — and reports that only by leaving `subscribedStreamer` unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not. +- c69198d: Add an optional server-side keepalive that disconnects players whose connection has died without a clean close. Previously `KeepaliveMonitor` was only used on the client, so a player whose socket dropped silently (sleeping laptop, lost Wi-Fi, killed tab) stayed subscribed until the OS TCP keepalive reaped it, which could hold a `maxSubscribers` slot in the meantime. The new `IServerConfig.playerKeepaliveTimeout` controls this; the signalling server exposes it as `--player_keepalive_timeout ` (default 30000, 0 disables). + ## 0.2.1 ### Patch Changes diff --git a/Signalling/package.json b/Signalling/package.json index bbf14e2af..49091528b 100644 --- a/Signalling/package.json +++ b/Signalling/package.json @@ -1,6 +1,6 @@ { "name": "@epicgames-ps/lib-pixelstreamingsignalling-ue5.6", - "version": "0.2.1", + "version": "0.3.0", "description": "Basic signalling library for developers wishing to build applications that signal a Pixel Streaming application.", "main": "dist/cjs/pixelstreamingsignalling.js", "module": "dist/esm/pixelstreamingsignalling.js", diff --git a/SignallingWebServer/CHANGELOG.md b/SignallingWebServer/CHANGELOG.md index 805a2f7f3..99e99582e 100644 --- a/SignallingWebServer/CHANGELOG.md +++ b/SignallingWebServer/CHANGELOG.md @@ -1,5 +1,21 @@ # @epicgames-ps/wilbur +## 2.5.0 + +### Minor Changes + +- 47cfc6e: Allow TURN credentials to be issued per connection rather than shared by every session. `peerOptions` is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. `IServerConfig.peerOptionsProvider` is consulted once per connecting peer and returns the peer options for that peer, falling back to `peerOptions` if it throws. On top of it the signalling server adds `--turn_secret` (or `--turn_secret_file`) and `--turn_ttl`, which give every `turn:`/`turns:` entry a time limited username and credential in the form coturn's `use-auth-secret` mode expects. Default behaviour is unchanged when no secret is supplied. See `Docs/Security-Guidelines.md`. + +### Patch Changes + +- e1b4d03: Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, `sendToStreamer` force-subscribes it to the first available streamer and then forwards through `this.subscribedStreamer!`. `subscribe()` can decline — most commonly because `maxSubscribers` is already reached — and reports that only by leaving `subscribedStreamer` unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not. +- c69198d: Add an optional server-side keepalive that disconnects players whose connection has died without a clean close. Previously `KeepaliveMonitor` was only used on the client, so a player whose socket dropped silently (sleeping laptop, lost Wi-Fi, killed tab) stayed subscribed until the OS TCP keepalive reaped it, which could hold a `maxSubscribers` slot in the meantime. The new `IServerConfig.playerKeepaliveTimeout` controls this; the signalling server exposes it as `--player_keepalive_timeout ` (default 30000, 0 disables). +- Updated dependencies [e1b4d03] +- Updated dependencies [c69198d] +- Updated dependencies [4fcf502] +- Updated dependencies [47cfc6e] + - @epicgames-ps/lib-pixelstreamingsignalling-ue5.6@0.3.0 + ## 2.4.1 ### Patch Changes diff --git a/SignallingWebServer/package.json b/SignallingWebServer/package.json index ee17fed72..dc2a79d61 100644 --- a/SignallingWebServer/package.json +++ b/SignallingWebServer/package.json @@ -1,6 +1,6 @@ { "name": "@epicgames-ps/wilbur", - "version": "2.4.1", + "version": "2.5.0", "description": "A basic signalling server application for Unreal Engine's Pixel Streaming applications.", "main": "dist/index.js", "private": true,