Room socket events do not enforce room membership or host permissions

[ionfwsrijan]

Problem

Room socket events trust client-supplied roomId and guestId values.

Evidence

Affected code:

• backend/server.js
• frontend/src/components/chat/RoomChatPanel.tsx

Client emits:

socket.emit("joinRoom", roomId)
socket.emit("roomMessage", { roomId, text })
socket.emit("removeGuest", { roomId, guestId })

The server must verify that:

• the sender belongs to the room
• the sender is host before removing guests
• guests cannot join arbitrary rooms

Impact

A malicious socket client can join or send messages to arbitrary rooms, impersonate room activity, or attempt to remove guests without host authority.

Expected fix

• Store server-side room membership and host identity
• Validate every room socket event against that state
• Reject unauthorized removeGuest
• Add socket integration tests for guest, host, and non-member cases

[ionfwsrijan]

@ThePlator You may review and assign me this issue

[saurabhhhcodes]

I can work on this with a focused socket authorization patch. Plan: keep room membership and host identity server-side, validate joinRoom/roomMessage/removeGuest against that state, reject non-members and non-host removals without broadcasting the action, and add socket integration coverage for host, guest, and unauthorized client cases. I will keep the frontend changes limited to sending the current event payloads and handling rejected actions if needed.

[sanudking]

Hello @ThePlator! I'd like to contribute to this issue. I'm a GSSoC 2026 contributor with skills in Javascript. Would you assign this to me? I'll keep you updated on progress.

[sanudking]

Hello @ThePlator! I'd like to contribute to this issue. I'm a GSSoC 2026 contributor with skills in Javascript. Would you assign this to me? I'll keep you updated on progress.

[sanudking]

Hi @ThePlator, I'd like to contribute to this! I'm familiar with Javascript and this seems like a good fit for my skill set. Please assign it to me — I'll post a plan before opening a PR.

[vipul674]

I would like to work on this under GSSoC'26. Please assign it to me.