fix: add room membership checks. Broadcast errors to room only

[jiexi]

Explanation

• ping and ack handlers (socket-config.ts) now bail out with a
  warning if socket.rooms.has(channelId) is false, mirroring the existing
  message and leave_channel guards. Non-member sockets can no longer reach
  handlePing / handleAck.
• rejected handler (handleChannelRejected.ts) gets a participant
  check. A naive room-membership guard would break the legitimate flow because
  rejectChannel.ts reconnects the socket before emitting rejected and the
  reconnected socket is no longer in the channel room. Instead we accept the
  request only if either:
  1. the socket is currently in the channel room (live participant), or
  2. an existing channel_config.clients.wallet entry is recorded in Redis
     (the wallet had previously joined and is rejecting after a reconnect).
     An invalid channel ID also short-circuits with error_id now.
• handleMessage.ts:178 error broadcast is scoped to the channel room
  (socket.broadcast.to(channelId).emit(...)), so an in-room client's error
  no longer leaks the channel ID to every other connected socket.

References

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-1549

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've highlighted breaking changes using the "BREAKING" category above as appropriate

---

Note

High Risk
Changes authorization on live Socket.IO channel operations and Redis side effects; mistakes could break legitimate wallet reconnect/reject flows or leave channels open to abuse.

Overview
Addresses HackerOne 3604630 by tightening who can act on a channel in sdk-socket-server-next.

Socket layer: ack and ping (and existing message wiring covered by tests) now bail out unless socket.rooms includes the channel ID, so unrelated connections cannot ack/delete or pull queued messages for arbitrary UUIDs.

handleChannelRejected: Validates channelId as a UUID, then requires the socket to be in the room or a known wallet participant (post-reconnect reject) before writing Redis or broadcasting; other callers get not authorized / error_id with no setex.

handleMessage: On failure, errors are emitted via broadcast.to(channelId) instead of a global broadcast, avoiding leakage of active channel IDs.

Adds package Jest config/setup (env for analytics-api, logger init) and regression tests; e2e import updated to analytics-api.

^{Reviewed by Cursor Bugbot for commit 93319fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 93319fb. Configure here.}

[cursor]

Reject auth too broad

Medium Severity

The new off-room guard allows any socket to complete handleChannelRejected when channelConfig.clients.wallet is set, without tying the request to the wallet. A non-member who knows the channel UUID can mark the channel rejected and broadcast to the room, not only a reconnecting wallet.

 

^{Reviewed by Cursor Bugbot for commit 93319fb. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.99%. Comparing base (0391475) to head (93319fb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1391   +/-   ##
=======================================
  Coverage   74.99%   74.99%           
=======================================
  Files         184      184           
  Lines        4519     4519           
  Branches     1108     1108           
=======================================
  Hits         3389     3389           
  Misses       1130     1130           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud