zwave-js / zwave-js-ui / 25098177446

19%

push

github

fix: socket reconnection loop and trust proxy validation error (#4604)

## Summary

Fixes two issues affecting users behind reverse proxies (notably the
Home Assistant addon).

### Socket reconnection loop (Fixes #4564)

When the server's auth middleware rejected a socket connection (e.g.
expired JWT), the client silently looped on reconnection forever.
Socket.IO v4 emits `connect_error` on rejected handshakes, but the
client only listened for `error`.

- `src/App.vue` — JWT expiry is checked client-side before attempting to
connect; an expired token triggers `logout()` instead of a connect
attempt.
- `src/App.vue` — added a `connect_error` handler. Three consecutive
auth failures trigger logout (single failures are tolerated to ride out
transient issues); other errors update status to *Reconnecting*.

### `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR` validation error (Fixes #4535)

`express-rate-limit` emitted a noisy `ValidationError` on every restart
for users running behind a reverse proxy. The pre-existing `TRUST_PROXY`
env-var path looked correct but was effectively broken: `TRUST_PROXY=1`
was forwarded to `app.set('trust proxy', '1')` as a string, which
Express treats as the IP literal `"1"` — leaving trust proxy effectively
off and the validation error firing.

- `api/app.ts` — `parseTrustProxy()` coerces the raw env value:
`"true"`/`"false"` → boolean, numeric strings → hop count integer,
anything else → passed through verbatim (IP/CIDR list or preset name).
- `api/app.ts` — moved `app.set('trust proxy', ...)` into
`startServer()` via `configureTrustProxy()`, mirroring how HTTPS is
handled. Logs the resolved value at startup.
- `docs/guide/env-vars.md` — expanded the `TRUST_PROXY` description with
accepted formats and a note about `ERR_ERL_PERMISSIVE_TRUST_PROXY`
(don't set it to `true`; prefer an explicit hop count or IP list).

This pairs with home-assistant/addons#4597, which sets `TRUST_PROXY=1`
by default in the HA addon — that PR only actually r... (continued)

335 of 445 branches covered (75.28%)

Branch coverage included in aggregate %.

0 of 27 new or added lines in 1 file covered. (0.0%)

4054 of 23558 relevant lines covered (17.21%)

1.09 hits per line