# Harden presence after review: wss URL, pass hygiene, lifetimes · dara/icarus

[View on GitCafe](https://git.cafe/dara/icarus/commit/ed776227eb6c34974bdac252ee24044238afa287)

Repository: [dara/icarus](https://git.cafe/dara/icarus)

Visibility: public

Requested revision: ed776227eb6c34974bdac252ee24044238afa287

Requested commit: ed776227eb6c34974bdac252ee24044238afa287

Commit: ed776227eb6c34974bdac252ee24044238afa287

Tree: e2c0fe5692a35b406f5033c198a17d87ec7458b1

Author: Dara Adedeji

Committer: Dara Adedeji

## Message

```
Harden presence after review: wss URL, pass hygiene, lifetimes

- Convex returns the room as wss://; WebSocket clients refuse https://,
  so presence never connected.
- The Worker keeps passes out of logs (redact_query_string) and never
  forwards the query to the room.
- Rooms stop sending to a socket as soon as its pass runs out, and wake at
  the earliest expiry, so revoked access ends on time even for a silent
  socket.
- One person gets at most four sessions per room; renewals faster than one
  per ten seconds are ignored before any HMAC work; malformed passes are
  rejected with 401 instead of throwing.
- The presence provider auto-disposes, so leaving the editor any way
  (including browser back) leaves the room.
- The cursor is re-sent when the map moves under a still pointer: scroll
  zoom, page or side change, resize.
- Person colors use arithmetic that is exact on web and native, and the
  cursor shadows use the named card shadow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

```

## Parents

- [4c3ef86f8e60d9bddd4ad26cba279cd1f71638fb](https://git.cafe/dara/icarus/commit/4c3ef86f8e60d9bddd4ad26cba279cd1f71638fb?format=markdown)

[Source at this commit](https://git.cafe/dara/icarus/tree/ed776227eb6c34974bdac252ee24044238afa287?format=markdown)