allow channel-token ws subscriptions within their own namespace

[ayush-that]

The web channel's out-of-band subscription client (amiko-chat, amiko-platform #1229) authenticates with a bare channel token, which carries no channelUserId, so since b24f5bc every session.subscribe was rejected with SESSION_NOT_FOUND and generated media never reached chat. This restores the namespace carve-out from #231 that was dropped when it got reworked into #238: channel-token connections may subscribe to sessions inside their own namespace, mirroring the SSE events route. User JWTs keep the participant check.

Covered by apps/gateway/test/ws-subscribe-scope.test.ts.

Summary by CodeRabbit

• New Features

  • Channel-authenticated WebSocket connections can now subscribe to sessions that fall within their configured channel namespace (e.g., namespace:*).

• Bug Fixes

  • Updated session.subscribe authorization behavior to correctly apply access checks based on the connection’s auth scope, preventing unauthorized cross-namespace subscriptions.

• Tests

  • Added WebSocket subscription authorization coverage to verify success within the namespace and rejection with SESSION_NOT_FOUND outside it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f10745b4-4dfe-4908-a8e4-d78ab798cce7

📥 Commits

Reviewing files that changed from the base of the PR and between 511a903 and ad4fab0.

📒 Files selected for processing (1)

• apps/gateway/test/ws-subscribe-scope.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• apps/gateway/test/ws-subscribe-scope.test.ts

---

📝 Walkthrough

Walkthrough

Channel-authenticated WebSocket subscriptions now bypass participant verification for sessions within the configured channel namespace. Subscriptions outside that namespace remain access-checked, with integration tests covering both outcomes.

Changes

Channel subscription scope

Layer / File(s)	Summary
Namespace authorization apps/gateway/src/ws-handler.ts	session.subscribe skips participant verification for channel-authenticated session IDs matching channelNamespace, while retaining access checks for other session IDs.
Subscription scope integration tests apps/gateway/test/ws-subscribe-scope.test.ts	WebSocket tests configure channel authentication and verify successful in-namespace subscriptions and SESSION_NOT_FOUND responses for out-of-namespace sessions.

Estimated code review effort: 2 (Simple) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WebSocketClient
  participant handleRequest
  participant AccessCheck
  participant RuntimeEvents

  WebSocketClient->>handleRequest: session.subscribe(sessionId)
  alt sessionId matches channel namespace
    handleRequest->>RuntimeEvents: subscribeFrom(sessionId)
    RuntimeEvents-->>WebSocketClient: subscribed=true
  else sessionId is outside namespace
    handleRequest->>AccessCheck: requireSessionAccess(sessionId)
    AccessCheck-->>WebSocketClient: SESSION_NOT_FOUND
  end

Loading

Poem

A bunny hops through channels bright,
Subscribing where the names fit right.
Beyond the bounds, checks guard the way,
Matching sessions bloom today.
WebSockets cheer: “Subscribed!” 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: channel-token WebSocket subscriptions are allowed within their own namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/channel-scoped-ws-subscribe

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/gateway/test/ws-subscribe-scope.test.ts`:
- Around line 105-107: Update both finally blocks in
apps/gateway/test/ws-subscribe-scope.test.ts at lines 105-107 and 119-121 to
await the asynchronous server.close() operation by wrapping it in a promise.
Ensure each test waits for the listener to be fully released before finishing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ba6eba50-ac4f-4088-8918-14d352cba2bc

📥 Commits

Reviewing files that changed from the base of the PR and between a80687e and 511a903.

📒 Files selected for processing (2)

• apps/gateway/src/ws-handler.ts
• apps/gateway/test/ws-subscribe-scope.test.ts

[ayush-that]

please review @williamwa.