WebSocket auth handshake: tokens off URLs, in-band refresh#1502

Open

JSv4 wants to merge 17 commits intomainfrom

feature/websocket-auth-handshake

Commits on May 3, 2026

Rewrite WS JWTAuthMiddleware to read token from Sec-WebSocket-Protocol only
JSv4
committed
Add AuthHandshakeMixin for in-band WS token refresh + security guards
JSv4
committed
Wire AuthHandshakeMixin into UnifiedAgentConsumer; refactor resource perm checks
JSv4
committed
Wire AuthHandshakeMixin into ThreadUpdatesConsumer
JSv4
committed
Wire AuthHandshakeMixin into NotificationUpdatesConsumer
JSv4
committed
Add frontend websocketAuth helpers (subprotocol + AUTH frame builders)
JSv4
committed
Add useWebSocketAuth shared hook (subprotocol + in-band refresh)
JSv4
committed
Strip token from WS URL builders; delete deprecated DocumentQuery/CorpusQuery wrappers
JSv4
committed
Refactor useNotificationWebSocket to compose useWebSocketAuth
JSv4
committed
Refactor useAgentChat to compose useWebSocketAuth (no token in URL)
JSv4
committed
Migrate CorpusChat and document utils to tokenless WS URLs
JSv4
committed
Add WS auth handshake manual test script + CHANGELOG entry
JSv4
committed
Merge remote-tracking branch 'origin/main' into feature/websocket-auth-handshake
JSv4
committed
Ratchet any-baseline after WS auth refactor (460→454)
JSv4
committed

Commits on May 4, 2026

⚡