feat: relay room authorization for default password

- Default password (pass123) can join existing rooms but cannot create new ones
- Track firstAuthorized flag per room
- Defer authorization check until both peers connect
- At least one peer must know the correct relay password
- Auto-cleanup unauthorized rooms after UNAUTHORIZED_ROOM_TTL (1 minute)
- Tests: default password join, correct password access, wrong password rejection

Author: abakum

src/tcp/defaults.go

@@ -6,4 +6,5 @@ const (
 	DEFAULT_LOG_LEVEL             = "debug"
 	DEFAULT_ROOM_CLEANUP_INTERVAL = 10 * time.Minute
 	DEFAULT_ROOM_TTL              = 3 * time.Hour
+	UNAUTHORIZED_ROOM_TTL         = time.Minute
 )

src/tcp/tcp.go

@@ -34,10 +34,11 @@ type server struct {
 }
 
 type roomInfo struct {
-	first  *comm.Comm
-	second *comm.Comm
-	opened time.Time
-	full   bool
+	first           *comm.Comm
+	second          *comm.Comm
+	opened          time.Time
+	full            bool
+	firstAuthorized bool // true if first peer knows the correct relay password
 }
 
 type roomMap struct {
@@ -203,6 +204,7 @@ func (s *server) run() (err error) {
 					break
 				}
 				if roomData.first != nil {
+					deleteIt = !roomData.firstAuthorized && time.Since(roomData.opened) > UNAUTHORIZED_ROOM_TTL
 					errSend := roomData.first.Send([]byte{1})
 					if errSend != nil {
 						log.Debug(errSend)
@@ -325,13 +327,19 @@ func (s *server) clientCommunication(c *comm.Comm) (room string, err error) {
 	if err != nil {
 		return
 	}
-	if strings.TrimSpace(string(passwordBytes)) != s.password {
+	clientPassword := strings.TrimSpace(string(passwordBytes))
+	passwordMatch := clientPassword == s.password
+	isDefaultPassword := clientPassword == models.DEFAULT_PASSPHRASE
+
+	if !passwordMatch && !isDefaultPassword {
+		// reject if password is neither correct nor default
 		err = fmt.Errorf("bad password")
 		enc, _ := crypt.Encrypt([]byte(err.Error()), strongKeyForEncryption)
 		if err = c.Send(enc); err != nil {
 			return "", fmt.Errorf("send error: %w", err)
 		}
 		return
+		// default password: authorization checked later
 	}
 
 	// send ok to tell client they are connected
@@ -365,8 +373,9 @@ func (s *server) clientCommunication(c *comm.Comm) (room string, err error) {
 	// create the room if it is new
 	if _, ok := s.rooms.rooms[room]; !ok {
 		s.rooms.rooms[room] = roomInfo{
-			first:  c,
-			opened: time.Now(),
+			first:           c,
+			opened:          time.Now(),
+			firstAuthorized: passwordMatch,
 		}
 		s.rooms.Unlock()
 		// tell the client that they got the room
@@ -398,37 +407,52 @@ func (s *server) clientCommunication(c *comm.Comm) (room string, err error) {
 		return
 	}
 	log.Debugf("room %s has 2", room)
+	firstAuthorized := s.rooms.rooms[room].firstAuthorized
+	secondAuthorized := passwordMatch
 	s.rooms.rooms[room] = roomInfo{
-		first:  s.rooms.rooms[room].first,
-		second: c,
-		opened: s.rooms.rooms[room].opened,
-		full:   true,
+		first:           s.rooms.rooms[room].first,
+		second:          c,
+		opened:          s.rooms.rooms[room].opened,
+		full:            true,
+		firstAuthorized: firstAuthorized,
 	}
 	otherConnection := s.rooms.rooms[room].first
 	s.rooms.Unlock()
 
+	// check authorization: at least one peer must know the correct relay password
+	if !firstAuthorized && !secondAuthorized {
+		log.Debugf("unauthorized: both peers use default password in room %s", room)
+		err = fmt.Errorf("bad password")
+		enc, _ := crypt.Encrypt([]byte(err.Error()), strongKeyForEncryption)
+		c.Send(enc)
+		s.deleteRoom(room)
+		return
+	}
+
+	// tell the sender everything is ready
+	bSend, err = crypt.Encrypt([]byte("ok"), strongKeyForEncryption)
+	if err != nil {
+		return
+	}
+	err = c.Send(bSend)
+	if err != nil {
+		s.deleteRoom(room)
+		return
+	}
+
 	// second connection is the sender, time to staple connections
 	var wg sync.WaitGroup
 	wg.Add(1)
 
 	// start piping
+	// after tell the sender everything is ready prevent race sending to sender
 	go func(com1, com2 *comm.Comm, wg *sync.WaitGroup) {
 		log.Debug("starting pipes")
 		pipe(com1.Connection(), com2.Connection())
 		wg.Done()
 		log.Debug("done piping")
 	}(otherConnection, c, &wg)
 
-	// tell the sender everything is ready
-	bSend, err = crypt.Encrypt([]byte("ok"), strongKeyForEncryption)
-	if err != nil {
-		return
-	}
-	err = c.Send(bSend)
-	if err != nil {
-		s.deleteRoom(room)
-		return
-	}
 	wg.Wait()
 
 	// delete room

src/tcp/tcp_test.go

@@ -285,6 +285,77 @@ func TestLargeDataTransfer(t *testing.T) {
 	c2.Close()
 }
 
+func TestDefaultPasswordCanJoinExistingRoom(t *testing.T) {
+	log.SetLevel("error")
+	go Run("debug", "127.0.0.1", "8395", "secretpass", "8396")
+	time.Sleep(100 * time.Millisecond)
+
+	roomName := "restrictedRoom"
+
+	// Sender creates room with correct password
+	c1, _, _, err := ConnectToTCPServer("127.0.0.1:8395", "secretpass", roomName)
+	assert.Nil(t, err)
+	assert.NotNil(t, c1)
+
+	// Recipient joins existing room with default password (pass123)
+	c2, _, _, err := ConnectToTCPServer("127.0.0.1:8395", "pass123", roomName)
+	assert.Nil(t, err)
+	assert.NotNil(t, c2)
+
+	// Verify data exchange works
+	assert.Nil(t, c1.Send([]byte("hello from sender")))
+	var data []byte
+	for {
+		data, err = c2.Receive()
+		if bytes.Equal(data, []byte{1}) {
+			continue
+		}
+		break
+	}
+	assert.Nil(t, err)
+	assert.Equal(t, []byte("hello from sender"), data)
+
+	c1.Close()
+	c2.Close()
+}
+
+func TestCorrectPasswordFullAccess(t *testing.T) {
+	log.SetLevel("error")
+	go Run("debug", "127.0.0.1", "8399", "secretpass", "8400")
+	time.Sleep(100 * time.Millisecond)
+
+	// Client with correct password can create room
+	c1, _, _, err := ConnectToTCPServer("127.0.0.1:8399", "secretpass", "fullAccessRoom")
+	assert.Nil(t, err)
+	assert.NotNil(t, c1)
+
+	// Another client with correct password can join
+	c2, _, _, err := ConnectToTCPServer("127.0.0.1:8399", "secretpass", "fullAccessRoom")
+	assert.Nil(t, err)
+	assert.NotNil(t, c2)
+
+	c1.Close()
+	c2.Close()
+}
+
+func TestArbitraryWrongPasswordRejected(t *testing.T) {
+	log.SetLevel("error")
+	go Run("debug", "127.0.0.1", "8401", "secretpass", "8402")
+	time.Sleep(100 * time.Millisecond)
+
+	// Sender creates room with correct password
+	c1, _, _, err := ConnectToTCPServer("127.0.0.1:8401", "secretpass", "arbRoom")
+	assert.Nil(t, err)
+	assert.NotNil(t, c1)
+
+	// Client with arbitrary wrong password (not default) should be rejected immediately
+	_, _, _, err = ConnectToTCPServer("127.0.0.1:8401", "somegarbage", "arbRoom")
+	assert.NotNil(t, err)
+	assert.Contains(t, err.Error(), "bad password")
+
+	c1.Close()
+}
+
 func TestServerReleasesPort(t *testing.T) {
 	log.SetLevel("trace")
 	host := "127.0.0.1"