fix: websocket credentials (#2687)

* fix: websocket syncing on redis

* fix: websocket syncing on redis

.github/workflows/test.yml

@@ -42,47 +42,6 @@ jobs:
           path: coverage
           retention-days: 5
 
-      - name: Publish backend coverage summary
-        if: ${{ always() && matrix.node-version == '24.x' }}
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const globModule = require('glob');
-
-            const matches = globModule.sync('coverage/**/coverage-summary.json', {
-              cwd: process.cwd(),
-              ignore: ['**/node_modules/**'],
-            });
-
-            if (!matches.length) {
-              core.warning('Coverage summary not found (expected coverage/**/coverage-summary.json). Did Vitest run with --coverage and include the json-summary reporter?');
-              return;
-            }
-
-            const summaryPath = path.resolve(matches[0]);
-            const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
-            const metrics = ['lines', 'statements', 'branches', 'functions']
-              .map((key) => ({
-                label: key.charAt(0).toUpperCase() + key.slice(1),
-                ...summary.total[key],
-              }));
-
-            core.summary
-              .addHeading('Backend coverage')
-              .addTable([
-                ['Metric', 'Covered', 'Total', 'Pct'],
-                ...metrics.map(({ label, covered, total, pct }) => [
-                  label,
-                  `${covered}`,
-                  `${total}`,
-                  `${pct}%`,
-                ]),
-              ])
-              .addRaw('Full HTML report is available in the uploaded `backend-coverage-${{ matrix.node-version }}` artifact.')
-              .write();
-
   api-test:
     name: API tests (node env, api-test)
     runs-on: ubuntu-latest

src/backend/package.json

@@ -25,6 +25,7 @@
     "@opentelemetry/sdk-node": "^0.49.1",
     "@pagerduty/pdjs": "^2.2.4",
     "@smithy/node-http-handler": "^2.2.2",
+    "@socket.io/redis-streams-adapter": "^0.3.1",
     "args": "^5.0.3",
     "axios": "^1.8.2",
     "bcrypt": "^5.1.0",

src/backend/src/modules/web/SocketioService.js

@@ -19,6 +19,8 @@
 
 const BaseService = require('../../services/BaseService');
 const socketio = require('socket.io');
+const { createAdapter } = require('@socket.io/redis-streams-adapter');
+const { redisClient } = require('../../clients/redis/redisSingleton');
 
 /**
  * SocketioService provides a service for sending messages to clients.
@@ -35,11 +37,16 @@ class SocketioService extends BaseService {
         /**
          * @type {import('socket.io').Server}
          */
-        this.io = socketio(server, {
+        const socketioOptions = {
             cors: {
-                origin: '*',
+                origin: (origin, callback) => {
+                    callback(null, origin);
+                },
+                credentials: true,
             },
-        });
+            adapter: createAdapter(redisClient),
+        };
+        this.io = socketio(server, socketioOptions);
     }
 
     /**

src/gui/src/UI/Dashboard/UIDashboard.js

@@ -170,6 +170,8 @@ async function UIDashboard (options) {
         auth: {
             auth_token: window.auth_token,
         },
+        transports: ['websocket', 'polling'],
+        withCredentials: true,
     });
 
     window.socket.on('error', (error) => {

src/gui/src/UI/UIDesktop.js

@@ -118,6 +118,8 @@ async function UIDesktop (options) {
         auth: {
             auth_token: window.auth_token,
         },
+        transports: ['websocket', 'polling'],
+        withCredentials: true,
     });
 
     window.socket.on('error', (error) => {
@@ -2650,4 +2652,4 @@ $(document).on('click', '.btn-show-ai', function () {
     $('.window[data-app="ai"]').makeWindowVisible();
 });
 
-export default UIDesktop;
+export default UIDesktop;

src/puter-js/src/modules/FileSystem/index.js

@@ -98,12 +98,33 @@ export class PuterJSFileSystemModule {
             auth: {
                 auth_token: this.authToken,
             },
-            autoUnref: this.puter.env === 'nodejs',
+            // socket.io's autoUnref path expects ws._socket.unref() to exist.
+            // Enable it only for Node runtimes that expose a ws-like WebSocket.
+            autoUnref: this.shouldUseSocketAutoUnref(),
+            transports: ['websocket', 'polling'],
+            withCredentials: true,
         });
 
         this.bindSocketEvents();
     }
 
+    shouldUseSocketAutoUnref () {
+        if ( this.puter.env !== 'nodejs' ) {
+            return false;
+        }
+
+        const WebSocketImpl = globalThis.WebSocket;
+        if ( typeof WebSocketImpl !== 'function' ) {
+            return false;
+        }
+
+        const wsPrototype = WebSocketImpl.prototype ?? {};
+        // ws package instances are EventEmitter-like; Undici WebSocket is EventTarget-like.
+        // autoUnref is only safe on the ws path.
+        return typeof wsPrototype.on === 'function' &&
+            typeof wsPrototype.removeListener === 'function';
+    }
+
     bindSocketEvents () {
         // this.socket.on('cache.updated', (msg) => {
         //     // check original_client_socket_id and if it matches this.socket.id, don't post update