Production-harden Socket.IO Redis adapter with auth room ACLs

[josephchimebuka]

Summary

Ensure websocket rooms for user notifications/chat enforce JWT identity ACLs and survive Redis adapter failover without leaking events across users.

Why this matters

Realtime is mounted on both modes; forged or mis-routed room joins are a privacy/security risk at hackathon scale.

Where to work

• src/socket.ts
• src/services/websocket.service.ts
• src/utils/socket-adapter.ts
• auth middleware for sockets

What to implement

1. Validate JWT on connect and subscribe.
2. Bind rooms to userId/wallet claims only.
3. Reject cross-user room joins.
4. Test adapter multi-node emit + ACL denial cases.
5. Document required Redis config for multi-instance.

Acceptance criteria

• Users cannot subscribe to another user's private room.
• Multi-node emit still works with adapter.
• Unauthorized connect rejected.
• Security tests added.

Done when

Websocket delivery is authenticated and tenant-safe.

Metadata

Field	Value
Difficulty	advanced
Complexity	high
Good first contribution?	no

[abimbolaalabi]

Hi Maintainer, haven reviewed the description of the issue, and I would like to hop on the issue and sure to deliver at ETA 2hrs

[johnvin489-cloud]

@johnvin489-cloud has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’ve reviewed the issue requirements thoroughly and can deliver a solution that aligns with the expected design and acceptance criteria.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @johnvin489-cloud to this issue.