feat(realtime): add websocket gateway and command ack/retry flow

Backend/routes/commands.ts

@@ -0,0 +1,212 @@
+import { and, desc, eq } from 'drizzle-orm';
+import { Router } from 'express';
+import { z } from 'zod';
+
+import { db } from '../db/client';
+import { deviceCommands, deviceLinks, devices } from '../db/schema';
+import { requireAuth } from '../middleware/auth';
+import { requireDeviceAuth } from '../middleware/device-auth';
+import { dispatchCommandById } from '../realtime/gateway';
+
+const router = Router();
+
+const commandCreateSchema = z.object({
+  sourceDeviceId: z.string().uuid(),
+  targetDeviceId: z.string().uuid(),
+  commandType: z.enum(['start_stream', 'stop_stream', 'ping', 'update_settings']),
+  payload: z.record(z.string(), z.unknown()).optional(),
+});
+
+const ackSchema = z.object({
+  status: z.enum(['acknowledged', 'rejected']),
+  error: z.string().optional(),
+});
+const commandParamSchema = z.object({
+  commandId: z.string().uuid(),
+});
+
+const querySchema = z.object({
+  sourceDeviceId: z.string().uuid().optional(),
+  targetDeviceId: z.string().uuid().optional(),
+  status: z.string().optional(),
+  limit: z.coerce.number().int().min(1).max(100).default(25),
+});
+
+router.post('/', requireAuth, async (req, res) => {
+  const parsed = commandCreateSchema.safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ message: 'Invalid request body', errors: parsed.error.flatten() });
+    return;
+  }
+
+  const authSession = req.auth;
+
+  if (!authSession?.user?.id) {
+    res.status(401).json({ message: 'Unauthorized' });
+    return;
+  }
+
+  if (parsed.data.sourceDeviceId === parsed.data.targetDeviceId) {
+    res.status(400).json({ message: 'sourceDeviceId and targetDeviceId must differ' });
+    return;
+  }
+
+  const [sourceDevice, targetDevice] = await Promise.all([
+    db.query.devices.findFirst({
+      where: and(eq(devices.id, parsed.data.sourceDeviceId), eq(devices.userId, authSession.user.id)),
+    }),
+    db.query.devices.findFirst({
+      where: and(eq(devices.id, parsed.data.targetDeviceId), eq(devices.userId, authSession.user.id)),
+    }),
+  ]);
+
+  if (!sourceDevice || !targetDevice) {
+    res.status(400).json({ message: 'Both source and target devices must belong to the authenticated user' });
+    return;
+  }
+
+  const validRoleDirection = sourceDevice.role === 'client' && targetDevice.role === 'camera';
+
+  if (!validRoleDirection) {
+    res.status(400).json({ message: 'Commands are currently allowed only from client -> camera devices' });
+    return;
+  }
+
+  const link = await db.query.deviceLinks.findFirst({
+    where: and(
+      eq(deviceLinks.ownerUserId, authSession.user.id),
+      eq(deviceLinks.cameraDeviceId, targetDevice.id),
+      eq(deviceLinks.clientDeviceId, sourceDevice.id),
+      eq(deviceLinks.status, 'active'),
+    ),
+  });
+
+  if (!link) {
+    res.status(403).json({ message: 'No active camera-client link found for command routing' });
+    return;
+  }
+
+  const now = new Date();
+
+  const [command] = await db
+    .insert(deviceCommands)
+    .values({
+      ownerUserId: authSession.user.id,
+      sourceDeviceId: sourceDevice.id,
+      targetDeviceId: targetDevice.id,
+      commandType: parsed.data.commandType,
+      payload: parsed.data.payload ?? null,
+      status: 'queued',
+      lastDispatchedAt: now,
+      updatedAt: now,
+    })
+    .returning();
+
+  if (!command) {
+    res.status(500).json({ message: 'Failed creating command' });
+    return;
+  }
+
+  await dispatchCommandById(command.id);
+
+  const refreshed = await db.query.deviceCommands.findFirst({ where: eq(deviceCommands.id, command.id) });
+
+  res.status(201).json({
+    message: 'Command queued',
+    command: refreshed ?? command,
+  });
+});
+
+router.get('/', requireAuth, async (req, res) => {
+  const parsed = querySchema.safeParse(req.query);
+
+  if (!parsed.success) {
+    res.status(400).json({ message: 'Invalid query params', errors: parsed.error.flatten() });
+    return;
+  }
+
+  const authSession = req.auth;
+
+  if (!authSession?.user?.id) {
+    res.status(401).json({ message: 'Unauthorized' });
+    return;
+  }
+
+  const commands = await db.query.deviceCommands.findMany({
+    where: eq(deviceCommands.ownerUserId, authSession.user.id),
+    orderBy: [desc(deviceCommands.createdAt)],
+    limit: parsed.data.limit,
+  });
+
+  const filtered = commands.filter((command) => {
+    if (parsed.data.sourceDeviceId && command.sourceDeviceId !== parsed.data.sourceDeviceId) {
+      return false;
+    }
+
+    if (parsed.data.targetDeviceId && command.targetDeviceId !== parsed.data.targetDeviceId) {
+      return false;
+    }
+
+    if (parsed.data.status && command.status !== parsed.data.status) {
+      return false;
+    }
+
+    return true;
+  });
+
+  res.json({ count: filtered.length, commands: filtered });
+});
+
+router.post('/:commandId/ack', requireDeviceAuth, async (req, res) => {
+  const parsedParams = commandParamSchema.safeParse(req.params);
+  if (!parsedParams.success) {
+    res.status(400).json({ message: 'Invalid commandId', errors: parsedParams.error.flatten() });
+    return;
+  }
+
+  const parsed = ackSchema.safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ message: 'Invalid request body', errors: parsed.error.flatten() });
+    return;
+  }
+
+  const deviceAuth = req.deviceAuth;
+
+  if (!deviceAuth) {
+    res.status(401).json({ message: 'Unauthorized' });
+    return;
+  }
+
+  const command = await db.query.deviceCommands.findFirst({
+    where: eq(deviceCommands.id, parsedParams.data.commandId),
+  });
+
+  if (!command) {
+    res.status(404).json({ message: 'Command not found' });
+    return;
+  }
+
+  if (command.targetDeviceId !== deviceAuth.deviceId) {
+    res.status(403).json({ message: 'Only target device can acknowledge this command' });
+    return;
+  }
+
+  const now = new Date();
+
+  const [updated] = await db
+    .update(deviceCommands)
+    .set({
+      status: parsed.data.status,
+      acknowledgedAt: now,
+      updatedAt: now,
+      error: parsed.data.status === 'rejected' ? parsed.data.error ?? 'rejected' : null,
+    })
+    .where(eq(deviceCommands.id, command.id))
+    .returning();
+
+  res.json({ message: 'Command acknowledged', command: updated });
+});
+
+export default router;