report system

src/accessLive.ts

@@ -0,0 +1,48 @@
+import type { AccessMessage, AccessRequest } from "./access.ts";
+
+/**
+ * Live access-request updates over WebSocket (replaces HTTP polling).
+ *
+ * Two channels, mirroring the HTTP auth model (no weakening):
+ * - ticket socket  `/api/access/ws/:id` — capability auth by unguessable
+ *   UUID, exactly like GET /api/access/ticket/:id. Receives this ticket's
+ *   messages + status changes.
+ * - admin socket   `/api/admin/ws?token=…` — admin Bearer (query param
+ *   because browsers can't set WS headers). Receives every access event,
+ *   driving the AdminCenter badge + triage list.
+ */
+
+export type AccessLiveEvent =
+  | { type: "access_message"; request_id: string; message: AccessMessage }
+  | { type: "access_status"; request_id: string; request: AccessRequest }
+  | { type: "access_created"; request_id: string; request: AccessRequest };
+
+export interface AccessLiveSubscriber {
+  /** Ticket to follow, or null for the admin firehose. */
+  ticketId: string | null;
+  isAdmin: boolean;
+  /** Send a pre-serialized frame. Return false when the socket is dead. */
+  send: (data: string) => boolean;
+}
+
+const subscribers = new Set<AccessLiveSubscriber>();
+
+export function subscribeAccessLive(s: AccessLiveSubscriber): () => void {
+  subscribers.add(s);
+  return () => {
+    subscribers.delete(s);
+  };
+}
+
+export function broadcastAccessLive(evt: AccessLiveEvent): void {
+  if (subscribers.size === 0) return;
+  const data = JSON.stringify(evt);
+  for (const s of [...subscribers]) {
+    if (s.ticketId !== evt.request_id && !(s.isAdmin && s.ticketId === null)) continue;
+    try {
+      if (!s.send(data)) subscribers.delete(s);
+    } catch {
+      subscribers.delete(s);
+    }
+  }
+}