Add WebSocket Room-Level Authorisation

[RUKAYAT-CODER]

Overview

websocket.gateway.ts has JWT authentication but no room-level authorisation. Any authenticated user can subscribe to any quest room and receive private updates.

Background

A submitter should only receive updates for quests they have submitted to (or created). Verifiers should receive updates for quests they verify. Currently the room is open to all authenticated users.

Specifications

Features:

• Room-level guard checking that the joining user has a role in the quest
• Distinct event channels per role (submitter vs verifier vs creator)
• Emit only relevant events per room member

Tasks:

• Add room authorisation check in websocket.gateway.ts handleJoinRoom`n- Create WsRoomGuard that queries quest membership
• Add gateway unit tests for auth scenarios

Impacted Files:

• BackEnd/src/modules/websocket/websocket.gateway.tsn- BackEnd/src/modules/websocket/ws-jwt.guard.tsn

Acceptance Criteria:

• User cannot join a quest room they have no role in
• JWT expiry disconnects the socket session

[YfengJ]

I would like to apply for this issue.

If assigned, my plan is to add a room-level WebSocket guard that checks the authenticated user has a valid quest role before joining a quest room, then separate or filter emitted events by submitter/verifier/creator role so users only receive relevant private updates. I would add gateway unit tests for unauthorized users, valid submitter/verifier/creator joins, JWT expiry/disconnect behavior, and event filtering.

I will wait for assignment or explicit maintainer confirmation before opening a PR.

[divysam]

@divysam has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello
I would love to work on this issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @divysam to this issue.

[AlphaMaleBaDI]

@AlphaMaleBaDI has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I will implement WebSocket room-level authorization and distinct role-based event channels inside the EarnQuestOne/stellar_Earn repository.

To deliver a pristine, 100% compliant security enhancement matching all stated acceptance criteria, I plan to:

• Create a dedicated WsRoomGuard inside BackEnd/src/modules/websocket/ws-jwt.guard.ts (or a matching sibling module) that intercepts room subscription requests and verifies the joining user's role relative to the target quest.
• Update handleJoinRoom in BackEnd/src/modules/websocket/websocket.gateway.ts to seamlessly invoke this room authorization check, rejecting connections or subscriptions if the authenticated user is neither a submitter, verifier, nor creator for that quest.
• Establish separate event channels/rooms per role (e.g., quest_submitter, quest_verifier, quest_creator) to isolate sensitive data and emit only context-relevant events to authorized room members.
• Ensure the WebSocket session automatically disconnects upon JWT expiration to eliminate stale, unauthenticated socket listeners.
• Expand the gateway unit test suite to rigorously cover unauthorized subscription attempts, successful multi-role validations, and token expiry handling.

Since my local workspace is perfectly calibrated for NestJS WebSocket gateways, custom WsGuards, and secure real-time streaming architectures, I can jump straight into the gateway modules and submit a highly polished PR immediately. Ready to lock it in!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AlphaMaleBaDI to this issue.