feat: Security

toju-app/src/app/infrastructure/realtime/realtime-session.service.ts

@@ -40,6 +40,7 @@ import { ServerSignalingCoordinator } from './signaling/server-signaling-coordin
 import { SignalingManager } from './signaling/signaling.manager';
 import { SignalingTransportHandler } from './signaling/signaling-transport-handler';
 import { WebRtcStateController } from './state/webrtc-state-controller';
+import { AuthTokenStoreService } from '../../domains/authentication';
 
 @Injectable({
   providedIn: 'root'
@@ -49,6 +50,7 @@ export class WebRTCService implements OnDestroy {
   private readonly debugging = inject(DebuggingService);
   private readonly screenShareSourcePicker = inject(ScreenShareSourcePickerService);
   private readonly iceServerSettings = inject(IceServerSettingsService);
+  private readonly authTokenStore = inject(AuthTokenStoreService);
 
   private readonly logger = new WebRTCLogger(() => this.debugging.enabled());
   private readonly state = new WebRtcStateController();
@@ -144,7 +146,22 @@ export class WebRTCService implements OnDestroy {
     this.signalingTransportHandler = new SignalingTransportHandler({
       signalingCoordinator: this.signalingCoordinator,
       logger: this.logger,
-      getLocalPeerId: () => this.state.getLocalPeerId()
+      getLocalPeerId: () => this.state.getLocalPeerId(),
+      resolveSessionToken: (signalUrl) => {
+        if (signalUrl) {
+          return this.authTokenStore.getToken(signalUrl.replace(/^ws/, 'http'));
+        }
+
+        for (const { signalUrl: connectedUrl } of this.signalingCoordinator.getConnectedSignalingManagers()) {
+          const token = this.authTokenStore.getToken(connectedUrl.replace(/^ws/, 'http'));
+
+          if (token) {
+            return token;
+          }
+        }
+
+        return null;
+      }
     });
 
     // Now wire up cross-references (all managers are instantiated)