fix: token auth for websocket

Author: ruslan-hut

internal/auth/middleware.go

@@ -34,6 +34,23 @@ func (s *Service) Middleware(next http.Handler) http.Handler {
 			}
 		}
 
+		// Try JWT token from query parameter (for WebSocket connections)
+		if user == nil {
+			tokenParam := r.URL.Query().Get("token")
+			if tokenParam != "" {
+				claims, err := s.ValidateJWT(tokenParam)
+				if err != nil {
+					sendError(w, http.StatusUnauthorized, err.Error())
+					return
+				}
+				user = &AuthenticatedUser{
+					Username: claims.Username,
+					Role:     claims.Role,
+					AuthType: "jwt",
+				}
+			}
+		}
+
 		// Try API key from X-API-Key header
 		if user == nil {
 			apiKey := r.Header.Get("X-API-Key")

web/src/pages/Messages.jsx

@@ -8,7 +8,7 @@ const WS_URL = import.meta.env.VITE_WS_URL ||
   (window.location.protocol === 'https:' ? 'wss://' : 'ws://') + window.location.host
 
 function Messages() {
-  const { isAdmin } = useAuth()
+  const { isAdmin, token } = useAuth()
   const [messages, setMessages] = useState([])
   const [stats, setStats] = useState(null)
   const [loading, setLoading] = useState(true)
@@ -173,13 +173,16 @@ function Messages() {
         wsRef.current = null
       }
     }
-  }, [liveUpdates, filters.stationId])
+  }, [liveUpdates, filters.stationId, token])
 
   const connectWebSocket = () => {
     try {
       // Build WebSocket URL with filters
       let wsUrl = `${WS_URL}/api/ws/messages`
       const params = new URLSearchParams()
+      if (token) {
+        params.append('token', token)
+      }
       if (filters.stationId) {
         params.append('stationId', filters.stationId)
       }

web/src/pages/ScenarioRunner.jsx

@@ -7,7 +7,7 @@ const WS_URL = import.meta.env.VITE_WS_URL ||
   (window.location.protocol === 'https:' ? 'wss://' : 'ws://') + window.location.host
 
 function ScenarioRunner() {
-  const { isAdmin } = useAuth()
+  const { isAdmin, token } = useAuth()
   const [scenarios, setScenarios] = useState([])
   const [executions, setExecutions] = useState([])
   const [stations, setStations] = useState([])
@@ -85,7 +85,10 @@ function ScenarioRunner() {
     if (!activeExecution) return
 
     const stationId = activeExecution.stationId
-    const wsUrl = `${WS_URL}/api/ws/messages?stationId=${encodeURIComponent(stationId)}`
+    const params = new URLSearchParams()
+    if (token) params.append('token', token)
+    params.append('stationId', stationId)
+    const wsUrl = `${WS_URL}/api/ws/messages?${params.toString()}`
 
     const connect = () => {
       wsRef.current = new WebSocket(wsUrl)
@@ -135,7 +138,7 @@ function ScenarioRunner() {
         wsRef.current.close()
       }
     }
-  }, [activeExecution?.executionId, activeExecution?.stationId])
+  }, [activeExecution?.executionId, activeExecution?.stationId, token])
 
   // Poll for execution updates
   useEffect(() => {