Initial commit: watch-together phases 0-4 + presence hardening, internet-tested

packages/server/test/lifecycle_test.dart

@@ -0,0 +1,97 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+
+class _ProbeClient {
+  final WebSocket ws;
+  final Completer<void> welcomed = Completer<void>();
+  final Completer<String> closed = Completer<String>();
+  _ProbeClient(this.ws) {
+    ws.listen(
+      (m) {
+        if (!welcomed.isCompleted) {
+          final decoded = jsonDecode('$m') as Map;
+          expect(decoded['t'], 'welcome');
+          welcomed.complete();
+        }
+      },
+      onDone: () {
+        if (!closed.isCompleted) {
+          closed.complete('done code=${ws.closeCode} reason=${ws.closeReason}');
+        }
+      },
+      onError: (Object e) {
+        if (!closed.isCompleted) closed.complete('error $e');
+      },
+    );
+  }
+
+  static Future<_ProbeClient> hello(int port, String name) async {
+    final ws = await WebSocket.connect('ws://127.0.0.1:$port/sync');
+    final c = _ProbeClient(ws);
+    ws.add(jsonEncode({
+      't': 'hello',
+      'proto': RelayConstants.protoVersion,
+      'secret': 'cycle',
+      'user': {'name': name},
+      'media': {'name': '', 'size': 0, 'duration': 0.0},
+    }));
+    await c.welcomed.future.timeout(const Duration(seconds: 5));
+    return c;
+  }
+}
+
+Future<void> _pollBool(
+  FutureOr<bool> Function() cond,
+  String what, {
+  Duration timeout = const Duration(seconds: 8),
+}) async {
+  final deadline = DateTime.now().add(timeout);
+  while (DateTime.now().isBefore(deadline)) {
+    if (await cond()) return;
+    await Future.delayed(const Duration(milliseconds: 100));
+  }
+  fail('timed out: $what');
+}
+
+void main() {
+  group('presence lifecycle live', () {
+    late RoomServer server;
+
+    setUp(() async {
+      server = RoomServer(
+          const AppConfig(port: 0, secret: 'cycle', name: 'cycle'));
+      await server.start();
+    });
+
+    tearDown(() async {
+      await server.stop();
+    });
+
+    test('clean client close removes member within seconds, not timeout',
+        () async {
+      final client = await _ProbeClient.hello(server.boundPort, 'alice');
+      await _pollBool(
+          () => server.hub.engine.members.length == 1, 'join visible');
+      await client.ws.close();
+      await _pollBool(
+          () => server.hub.engine.members.isEmpty, 'member removed');
+      expect(server.session.tokens, isEmpty);
+      expect(server.hub.sockets, isEmpty);
+    });
+
+    test('server stop closes client sockets', () async {
+      final client = await _ProbeClient.hello(server.boundPort, 'bob');
+      await _pollBool(
+          () => server.hub.engine.members.length == 1, 'join visible');
+      await server.stop();
+      final outcome = await client.closed.future
+          .timeout(const Duration(seconds: 5), onTimeout: () => 'TIMEOUT');
+      expect(outcome, isNot('TIMEOUT'), reason: 'client never saw close');
+    });
+  });
+}

packages/server/test/media_endpoint_test.dart

@@ -0,0 +1,172 @@
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:relic/relic.dart';
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+
+void main() {
+  group('resolveMediaRequest pure table', () {
+    test('no Range -> 200 full with exact length', () {
+      final r = resolveMediaRequest(rangeHeader: null, size: 1000, filename: 'a.mkv');
+      expect(r.status, 200);
+      expect(r.headers['accept-ranges'], 'bytes');
+      expect(r.headers['content-type'], 'video/x-matroska');
+      expect(r.headers['content-length'], '1000');
+      expect(r.start, 0);
+      expect(r.end, isNull);
+    });
+
+    test('closed range -> 206 exact bytes + content-range', () {
+      final r = resolveMediaRequest(rangeHeader: 'bytes=0-99', size: 1000, filename: 'a.mkv');
+      expect(r.status, 206);
+      expect(r.headers['content-range'], 'bytes 0-99/1000');
+      expect(r.headers['content-length'], '100');
+    });
+
+    test('open-ended range -> 206 to EOF', () {
+      final r = resolveMediaRequest(rangeHeader: 'bytes=900-', size: 1000, filename: 'b.mp4');
+      expect(r.status, 206);
+      expect(r.headers['content-range'], 'bytes 900-999/1000');
+      expect(r.headers['content-length'], '100');
+      expect(r.headers['content-type'], 'video/mp4');
+    });
+
+    test('suffix range -> tail (mkv cues probe)', () {
+      final r = resolveMediaRequest(rangeHeader: 'bytes=-500', size: 1000, filename: 'c.mkv');
+      expect(r.status, 206);
+      expect(r.start, 500);
+      expect(r.headers['content-length'], '500');
+    });
+
+    test('out-of-range start -> 416 with bytes */size', () {
+      final r = resolveMediaRequest(rangeHeader: 'bytes=5000-6000', size: 1000, filename: 'a.mkv');
+      expect(r.status, 416);
+      expect(r.headers['content-range'], 'bytes */1000');
+    });
+
+    test('gates: gone/auth/forbidden/offline', () {
+      expect(
+          resolveMediaRequest(rangeHeader: null, size: 10, filename: 'a.mkv', gate: MediaGate.gone).status,
+          410);
+      expect(
+          resolveMediaRequest(rangeHeader: null, size: 10, filename: 'a.mkv', gate: MediaGate.unauthorized)
+              .status,
+          401);
+      expect(
+          resolveMediaRequest(rangeHeader: null, size: 10, filename: 'a.mkv', gate: MediaGate.forbidden).status,
+          403);
+      final off =
+          resolveMediaRequest(rangeHeader: null, size: 10, filename: 'a.mkv', gate: MediaGate.offline);
+      expect(off.status, 503);
+      expect(off.headers['retry-after'], isNotEmpty);
+    });
+
+    test('content types by extension', () {
+      expect(contentTypeForFile('x.MKV'), 'video/x-matroska');
+      expect(contentTypeForFile('x.mp4'), 'video/mp4');
+      expect(contentTypeForFile('x.webm'), 'video/webm');
+      expect(contentTypeForFile('x.avi'), 'video/x-msvideo');
+      expect(contentTypeForFile('x.unknown'), 'application/octet-stream');
+    });
+  });
+
+  group('live Relic media route (byte-exact)', () {
+    late File file;
+    late Uint8List bytes;
+    late RelicApp app;
+    late RelicServer server;
+    late HttpClient client;
+
+    setUp(() async {
+      bytes = Uint8List.fromList(List<int>.generate(65536, (i) => i % 251));
+      file = File('${Directory.systemTemp.path}/media_test_${DateTime.now().microsecondsSinceEpoch}.bin');
+      await file.writeAsBytes(bytes);
+      app = RelicApp();
+      mountMediaRoute(app, file);
+      server = await app.serve(address: InternetAddress.loopbackIPv4, port: 0);
+      client = HttpClient();
+    });
+
+    tearDown(() async {
+      client.close();
+      await app.close();
+      await file.delete();
+    });
+
+    Future<HttpClientResponse> get(String path, {String? range}) async {
+      final req = await client.get('127.0.0.1', server.port, path);
+      if (range != null) req.headers.set('range', range);
+      return req.close();
+    }
+
+    Future<List<int>> readAll(HttpClientResponse resp) async {
+      final out = <int>[];
+      await for (final chunk in resp) {
+        out.addAll(chunk);
+      }
+      return out;
+    }
+
+    test('200 full body matches file bytes', () async {
+      final resp = await get('/m/file');
+      expect(resp.statusCode, 200);
+      expect(resp.headers.value('accept-ranges'), 'bytes');
+      expect(resp.headers.value('content-length'), '${bytes.length}');
+      expect(await readAll(resp), bytes);
+    });
+
+    test('206 closed range byte-exact', () async {
+      final resp = await get('/m/file', range: 'bytes=100-199');
+      expect(resp.statusCode, 206);
+      expect(resp.headers.value('content-range'), 'bytes 100-199/${bytes.length}');
+      expect(resp.headers.value('content-length'), '100');
+      expect(await readAll(resp), bytes.sublist(100, 200));
+    });
+
+    test('206 open-ended streams to EOF', () async {
+      final resp = await get('/m/file', range: 'bytes=${bytes.length - 1000}-');
+      expect(resp.statusCode, 206);
+      expect(resp.headers.value('content-length'), '1000');
+      expect(await readAll(resp), bytes.sublist(bytes.length - 1000));
+    });
+
+    test('206 suffix tail byte-exact', () async {
+      final resp = await get('/m/file', range: 'bytes=-256');
+      expect(resp.statusCode, 206);
+      expect(await readAll(resp), bytes.sublist(bytes.length - 256));
+    });
+
+    test('seek storm: 20 rapid seeks all byte-exact', () async {
+      for (var i = 0; i < 20; i++) {
+        final start = (i * 997) % (bytes.length - 512);
+        final resp = await get('/m/file', range: 'bytes=$start-${start + 511}');
+        expect(resp.statusCode, 206);
+        expect(await readAll(resp), bytes.sublist(start, start + 512));
+      }
+    });
+
+    test('onLog hook records method/range/status/bytes', () async {
+      final seen = <MediaLog>[];
+      final logApp = RelicApp();
+      mountMediaRoute(logApp, file, route: '/m/logged', onLog: seen.add);
+      final logServer =
+          await logApp.serve(address: InternetAddress.loopbackIPv4, port: 0);
+      try {
+        final req = await client.get('127.0.0.1', logServer.port, '/m/logged');
+        req.headers.set('range', 'bytes=0-9');
+        final resp = await req.close();
+        await resp.drain();
+        expect(resp.statusCode, 206);
+      } finally {
+        await logApp.close();
+      }
+      expect(seen, hasLength(1));
+      expect(seen.single.status, 206);
+      expect(seen.single.bytesWritten, 10);
+      expect(seen.single.rangeHeader, 'bytes=0-9');
+      expect(seen.single.toString(), contains('206'));
+    });
+  });
+}

packages/server/test/room_auth_test.dart

@@ -0,0 +1,391 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+import 'package:web_socket_channel/web_socket_channel.dart';
+
+void main() {
+  group('room auth live', () {
+    late File file;
+    late Uint8List bytes;
+    late RoomServer server;
+    late HttpClient http;
+
+    setUp(() async {
+      bytes = Uint8List.fromList(List<int>.generate(8192, (i) => i % 251));
+      file = File(
+          '${Directory.systemTemp.path}/room_test_${DateTime.now().microsecondsSinceEpoch}.bin');
+      await file.writeAsBytes(bytes);
+      server = RoomServer(AppConfig(
+          port: 0, secret: 'shh', name: 'test', mediaPath: file.path));
+      await server.start();
+      http = HttpClient();
+    });
+
+    tearDown(() async {
+      http.close();
+      await server.stop();
+      await file.delete();
+    });
+
+    Future<HttpClientResponse> mediaGet(String path, {String? range}) async {
+      final req = await http.get('127.0.0.1', server.boundPort, path);
+      if (range != null) req.headers.set('range', range);
+      return req.close();
+    }
+
+    Future<String> hello(String secret,
+        {int proto = RelayConstants.protoVersion,
+        Duration timeout = const Duration(seconds: 5)}) async {
+      final ch = WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final msg = HelloMessage(
+          proto: proto,
+          secret: secret,
+          user: const HelloUser(name: 'alice'),
+          media:
+              const HelloMedia(name: 'f.bin', size: 8192, duration: 10.0)).toJson();
+      ch.sink.add(jsonEncode(msg));
+      try {
+        final first = await ch.stream.first.timeout(timeout);
+        await ch.sink.close();
+        return '$first';
+      } catch (_) {
+        try {
+          await ch.sink.close();
+        } catch (_) {}
+        rethrow;
+      }
+    }
+
+    test('health reports room, proto, viewers, bytes', () async {
+      final req = await http.get('127.0.0.1', server.boundPort, '/health');
+      final resp = await req.close();
+      expect(resp.statusCode, 200);
+      final body = await resp.transform(utf8.decoder).join();
+      final decoded = jsonDecode(body) as Map;
+      expect(decoded['ok'], isTrue);
+      expect(decoded['room'], 'test');
+      expect(decoded['proto'], RelayConstants.protoVersion);
+      expect(decoded['viewers'], 0);
+      expect(decoded['bytesServed'], 0);
+      expect(decoded['media'], isNotNull);
+    });
+
+    test('wrong secret gets err, right secret gets welcome+token', () async {
+      final bad = await hello('wrong');
+      expect(jsonDecode(bad)['t'], 'err');
+
+      final good = await hello('shh');
+      final decoded = jsonDecode(good) as Map;
+      expect(decoded['t'], 'welcome');
+      final token = decoded['token'] as String;
+      expect(token, hasLength(32));
+      expect(decoded['mediaUrl'], contains(token));
+
+      final req = await http.get('127.0.0.1', server.boundPort, '/health');
+      final resp = await req.close();
+      await resp.drain();
+      expect(server.session.tokens.length, 1);
+    });
+
+    test('proto mismatch rejected', () async {
+      final reply =
+          await hello('shh', proto: RelayConstants.protoVersion + 99);
+      expect(jsonDecode(reply)['t'], 'err');
+      expect(server.session.tokens, isEmpty);
+    });
+
+    test('media: no token 401, bad token 401, good token 200 byte-exact',
+        () async {
+      final good = await hello('shh');
+      final token = (jsonDecode(good) as Map)['token'] as String;
+      final name = file.path.split(Platform.pathSeparator).last;
+
+      var resp = await mediaGet('/m/default/notoken/$name');
+      expect(resp.statusCode, 401);
+      await resp.drain();
+
+      resp = await mediaGet('/m/default/deadbeefdeadbeefdeadbeefdeadbeef/$name');
+      expect(resp.statusCode, 401);
+      await resp.drain();
+
+      resp = await mediaGet('/m/default/$token/$name', range: 'bytes=0-99');
+      expect(resp.statusCode, 206);
+      expect(resp.headers.value('content-range'), 'bytes 0-99/8192');
+      final body = <int>[];
+      await for (final c in resp) {
+        body.addAll(c);
+      }
+      expect(body, bytes.sublist(0, 100));
+      expect(server.session.tokens[token]!.bytesServed, 100);
+    });
+
+    test('unknown session -> 410', () async {
+      final resp = await mediaGet('/m/nosuch/abc/file');
+      expect(resp.statusCode, 410);
+      await resp.drain();
+    });
+
+    test('kick: WS drops and media goes 403', () async {
+      final ch = WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final firstCompleter = Completer<String>();
+      var wsClosed = false;
+      final sub = ch.stream.listen(
+        (m) {
+          if (!firstCompleter.isCompleted) firstCompleter.complete('$m');
+        },
+        onDone: () => wsClosed = true,
+      );
+      final msg = HelloMessage(
+          proto: RelayConstants.protoVersion,
+          secret: 'shh',
+          user: const HelloUser(name: 'mallory'),
+          media:
+              const HelloMedia(name: 'f.bin', size: 8192, duration: 10.0)).toJson();
+      ch.sink.add(jsonEncode(msg));
+      final first =
+          await firstCompleter.future.timeout(const Duration(seconds: 5));
+      final token = (jsonDecode(first) as Map)['token'] as String;
+
+      await server.session.kick(token);
+      final deadline = DateTime.now().add(const Duration(seconds: 5));
+      while (!wsClosed && DateTime.now().isBefore(deadline)) {
+        await Future.delayed(const Duration(milliseconds: 50));
+      }
+      expect(wsClosed, isTrue);
+      try {
+        await sub.cancel();
+      } catch (_) {}
+      try {
+        await ch.sink.close();
+      } catch (_) {}
+
+      final name = file.path.split(Platform.pathSeparator).last;
+      final resp = await mediaGet('/m/default/$token/$name');
+      expect(resp.statusCode, 403);
+      await resp.drain();
+    });
+
+    test('kick delivers reason then drops; instant rejoin works', () async {
+      final ch = WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final messages = <String>[];
+      var wsClosed = false;
+      final sub = ch.stream.listen(
+        (m) => messages.add('$m'),
+        onDone: () => wsClosed = true,
+      );
+      HelloMessage helloFor(String who) => HelloMessage(
+          proto: RelayConstants.protoVersion,
+          secret: 'shh',
+          user: HelloUser(name: who),
+          media: const HelloMedia(
+              name: 'f.bin', size: 8192, duration: 10.0));
+      ch.sink.add(jsonEncode(helloFor(' sleepy').toJson()));
+      Map<String, Object?>? welcome;
+      final welcomeDeadline = DateTime.now().add(const Duration(seconds: 5));
+      while (DateTime.now().isBefore(welcomeDeadline)) {
+        for (final m in messages) {
+          final decoded = jsonDecode(m) as Map;
+          if (decoded['t'] == 'welcome') {
+            welcome = Map<String, Object?>.from(decoded);
+          }
+        }
+        if (welcome != null) break;
+        await Future.delayed(const Duration(milliseconds: 50));
+      }
+      expect(welcome, isNotNull);
+      final token = welcome!['token'] as String;
+
+      await server.session.kick(token, reason: 'idle too long');
+      final deadline = DateTime.now().add(const Duration(seconds: 5));
+      Map<String, Object?>? kicked;
+      while (DateTime.now().isBefore(deadline)) {
+        for (final m in messages.skip(1)) {
+          final decoded = jsonDecode(m) as Map;
+          if (decoded['t'] == 'kicked') {
+            kicked = Map<String, Object?>.from(decoded);
+          }
+        }
+        if (wsClosed && kicked != null) break;
+        await Future.delayed(const Duration(milliseconds: 50));
+      }
+      expect(wsClosed, isTrue);
+      expect(kicked, isNotNull);
+      expect(kicked!['reason'], 'idle too long');
+      try {
+        await sub.cancel();
+      } catch (_) {}
+      try {
+        await ch.sink.close();
+      } catch (_) {}
+
+      final rejoin = await hello('shh');
+      final decoded = jsonDecode(rejoin) as Map;
+      expect(decoded['t'], 'welcome');
+      final token2 = decoded['token'] as String;
+      expect(token2, isNot(token));
+      final name = file.path.split(Platform.pathSeparator).last;
+      final resp = await mediaGet('/m/default/$token2/$name');
+      expect(resp.statusCode, 200);
+      await resp.drain();
+    });
+
+    test('kick via socket: peer kicked, unknown target errors', () async {
+      WebSocketChannel open() => WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      Future<(WebSocketChannel, String, String, List<String>)> join(String who) async {
+        final ch = open();
+        final messages = <String>[];
+        ch.stream.listen((m) => messages.add('$m'));
+        final msg = HelloMessage(
+            proto: RelayConstants.protoVersion,
+            secret: 'shh',
+            user: HelloUser(name: who),
+            media: const HelloMedia(
+                name: 'f.bin', size: 8192, duration: 10.0)).toJson();
+        ch.sink.add(jsonEncode(msg));
+        Map<String, Object?>? welcome;
+        final deadline = DateTime.now().add(const Duration(seconds: 5));
+        while (DateTime.now().isBefore(deadline)) {
+          for (final m in messages) {
+            final decoded = jsonDecode(m) as Map;
+            if (decoded['t'] == 'welcome') {
+              welcome = Map<String, Object?>.from(decoded);
+            }
+          }
+          if (welcome != null) break;
+          await Future.delayed(const Duration(milliseconds: 50));
+        }
+        expect(welcome, isNotNull,
+            reason: 'no welcome for $who: $messages');
+        final w = welcome!;
+        return (ch, w['token'] as String, w['memberId'] as String, messages);
+      }
+
+      Map<String, Object?>? findType(List<String> messages, String type) {
+        for (final m in messages) {
+          final decoded = jsonDecode(m) as Map;
+          if (decoded['t'] == type) return Map<String, Object?>.from(decoded);
+        }
+        return null;
+      }
+
+      Future<Map<String, Object?>?> waitType(
+          List<String> messages, String type, Duration timeout) async {
+        final deadline = DateTime.now().add(timeout);
+        while (DateTime.now().isBefore(deadline)) {
+          final found = findType(messages, type);
+          if (found != null) return found;
+          await Future.delayed(const Duration(milliseconds: 50));
+        }
+        return findType(messages, type);
+      }
+
+      final (a, _, _, messagesA) = await join('alice');
+      final (b, tokenB, idB, messagesB) = await join('bob');
+      try {
+        a.sink.add(jsonEncode(
+            KickRequest(target: idB, reason: 'afk?').toJson()));
+        final kicked = await waitType(
+            messagesB, 'kicked', const Duration(seconds: 5));
+        expect(kicked, isNotNull);
+        expect(kicked!['reason'], 'afk?');
+        expect(server.session.gate(tokenB), MediaGate.forbidden);
+
+        a.sink.add(
+            jsonEncode(const KickRequest(target: 'm99').toJson()));
+        final err = await waitType(
+            messagesA, 'err', const Duration(seconds: 5));
+        expect(err, isNotNull);
+      } finally {
+        try {
+          await a.sink.close();
+        } catch (_) {}
+        try {
+          await b.sink.close();
+        } catch (_) {}
+      }
+    });
+
+    test('silent socket dropped and member removed', () async {
+      final ch = WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final messages = <String>[];
+      var wsClosed = false;
+      final sub = ch.stream.listen(
+        (m) => messages.add('$m'),
+        onDone: () => wsClosed = true,
+      );
+      final msg = HelloMessage(
+          proto: RelayConstants.protoVersion,
+          secret: 'shh',
+          user: const HelloUser(name: 'ghost'),
+          media: const HelloMedia(
+              name: 'f.bin', size: 8192, duration: 10.0)).toJson();
+      ch.sink.add(jsonEncode(msg));
+      final deadline = DateTime.now().add(const Duration(seconds: 5));
+      while (messages.isEmpty && DateTime.now().isBefore(deadline)) {
+        await Future.delayed(const Duration(milliseconds: 50));
+      }
+      final token =
+          (jsonDecode(messages.firstWhere((m) => (jsonDecode(m) as Map)['t'] == 'welcome')) as Map)['token']
+              as String;
+      server.hub.engine.members[token]!.lastSeen =
+          DateTime.now().toUtc().subtract(const Duration(seconds: 61));
+      server.hub.dropSilentSockets();
+      final closeDeadline = DateTime.now().add(const Duration(seconds: 5));
+      while ((!wsClosed ||
+              server.hub.engine.members.containsKey(token) ||
+              server.session.tokens.containsKey(token)) &&
+          DateTime.now().isBefore(closeDeadline)) {
+        await Future.delayed(const Duration(milliseconds: 50));
+      }
+      expect(wsClosed, isTrue);
+      expect(server.hub.engine.members.containsKey(token), isFalse);
+      expect(server.session.tokens.containsKey(token), isFalse);
+      try {
+        await sub.cancel();
+      } catch (_) {}
+      try {
+        await ch.sink.close();
+      } catch (_) {}
+    });
+
+    test('any frame touches lastSeen (heartbeat baseline)', () async {
+      final good = await hello('shh');
+      final token = (jsonDecode(good) as Map)['token'] as String;
+      final viewer = server.session.tokens[token]!;
+      viewer.touch(DateTime.utc(2020, 1, 1));
+      expect(viewer.isStale(const Duration(seconds: 30)), isTrue);
+
+      final ch = WebSocketChannel.connect(
+          Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final sub = ch.stream.listen((_) {});
+      ch.sink.add(jsonEncode(HelloMessage(
+              proto: RelayConstants.protoVersion,
+              secret: 'shh',
+              user: const HelloUser(name: 'hb'),
+              media: const HelloMedia(
+                  name: 'f.bin', size: 8192, duration: 10.0))
+          .toJson()));
+      await Future.delayed(const Duration(seconds: 1));
+      final hbToken = server.session.tokens.keys
+          .firstWhere((k) => server.session.tokens[k]!.name == 'hb');
+      expect(server.session.tokens[hbToken]!.isStale(const Duration(seconds: 30)), isFalse);
+      expect(viewer.isStale(const Duration(seconds: 30)), isTrue);
+      try {
+        await sub.cancel();
+      } catch (_) {}
+      try {
+        await ch.sink.close();
+      } catch (_) {}
+    });
+  });
+}

packages/server/test/server_test.dart

@@ -0,0 +1,61 @@
+import 'dart:io';
+
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test('server has zero flutter imports', () async {
+    final libDir = Directory('lib');
+    final binDir = Directory('bin');
+    final offenders = <String>[];
+    for (final dir in [libDir, binDir]) {
+      if (!await dir.exists()) continue;
+      await for (final entity in dir.list(recursive: true)) {
+        if (entity is! File || !entity.path.endsWith('.dart')) continue;
+        final content = await entity.readAsString();
+        if (content.contains('package:flutter/') || content.contains('dart:ui')) {
+          offenders.add(entity.path);
+        }
+      }
+    }
+    expect(offenders, isEmpty, reason: 'Flutter imports in server: $offenders');
+  });
+
+  test('server starts, answers /health, stops cleanly', () async {
+    final server = RoomServer(const AppConfig(port: 0, secret: 't', name: 'test'));
+    await server.start();
+    expect(server.isRunning, isTrue);
+    final port = server.boundPort;
+    expect(port, greaterThan(0));
+
+    final client = HttpClient();
+    try {
+      final req = await client.get('127.0.0.1', port, '/health');
+      final resp = await req.close();
+      expect(resp.statusCode, 200);
+      final body = await resp.transform(const SystemEncoding().decoder).join();
+      expect(body, contains('test'));
+    } finally {
+      client.close();
+    }
+
+    await server.stop();
+    expect(server.isRunning, isFalse);
+  });
+
+  test('unknown path returns 404', () async {
+    final server = RoomServer(const AppConfig(port: 0, secret: 't', name: 'test'));
+    await server.start();
+    final client = HttpClient();
+    try {
+      final req = await client.get('127.0.0.1', server.boundPort, '/nope');
+      final resp = await req.close();
+      expect(resp.statusCode, 404);
+      await resp.drain();
+    } finally {
+      client.close();
+    }
+    await server.stop();
+  });
+}

packages/server/test/session_test.dart

@@ -0,0 +1,115 @@
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+
+void main() {
+  group('Session model', () {
+    test('tokens are unique 128-bit hex', () {
+      final s = Session(id: 'default', secret: 'shh');
+      final a = s.issueToken('alice', '');
+      final b = s.issueToken('bob', '');
+      expect(a, hasLength(32));
+      expect(a, isNot(b));
+      expect(RegExp(r'^[0-9a-f]{32}$').hasMatch(a), isTrue);
+    });
+
+    test('gate: unknown -> unauthorized, known -> ok', () {
+      final s = Session(id: 'default', secret: 'shh');
+      expect(s.gate(null), MediaGate.unauthorized);
+      expect(s.gate('nope'), MediaGate.unauthorized);
+      final t = s.issueToken('alice', '');
+      expect(s.gate(t), MediaGate.ok);
+    });
+
+    test('kick unknown throws, kick known forbids + drops', () async {
+      final s = Session(id: 'default', secret: 'shh');
+      expect(() => s.kick('nope'), throwsA(isA<AuthException>()));
+      final t = s.issueToken('mallory', '');
+      var dropped = false;
+      String? gotReason;
+      s.tokens[t]!.onKick = (reason) async {
+        dropped = true;
+        gotReason = reason;
+      };
+      await s.kick(t, reason: 'idle');
+      expect(s.gate(t), MediaGate.forbidden);
+      expect(dropped, isTrue);
+      expect(gotReason, 'idle');
+    });
+
+    test('oversize avatar rejected', () {
+      final s = Session(id: 'default', secret: 'shh');
+      final big = 'x' * (RelayConstants.maxAvatarBytes + 1);
+      expect(() => s.issueToken('alice', big), throwsA(isA<AuthException>()));
+    });
+
+    test('names truncated to cap, blank becomes ?', () {
+      final s = Session(id: 'default', secret: 'shh');
+      final long = s.issueToken('a' * 100, '');
+      expect(s.tokens[long]!.name, hasLength(RelayConstants.maxNameLength));
+      final blank = s.issueToken('   ', '');
+      expect(s.tokens[blank]!.name, '?');
+    });
+
+    test('byte counters accumulate', () {      final s = Session(id: 'default', secret: 'shh');
+      final a = s.issueToken('alice', '');
+      final b = s.issueToken('bob', '');
+      s.addBytes(a, 100);
+      s.addBytes(b, 50);
+      s.addBytes('ghost', 999);
+      expect(s.tokens[a]!.bytesServed, 100);
+      expect(s.totalBytesServed, 150);
+    });
+
+    test('SessionMap create/get/drop', () {
+      final m = SessionMap();
+      expect(m.get('default'), isNull);
+      final s = m.getOrCreate('default', 'shh');
+      expect(m.get('default'), same(s));
+      expect(m.getOrCreate('default', 'other'), same(s));
+      m.drop('default');
+      expect(m.get('default'), isNull);
+    });
+  });
+
+  group('core welcome + proto', () {
+    test('proto bumped to 4 for readiness + room fan-out', () {
+      expect(RelayConstants.protoVersion, 4);
+    });
+
+    test('welcome round-trips with token + member id', () {
+      const w = WelcomeMessage(token: 'abc', memberId: 'm1', mediaUrl: 'http://h/m');
+      final back = WelcomeMessage.fromJson(Map<String, Object?>.from(w.toJson()));
+      expect(back.token, 'abc');
+      expect(back.memberId, 'm1');
+      expect(back.mediaUrl, 'http://h/m');
+      expect(back.state, isNull);
+    });
+
+    test('welcome rejects wrong type', () {
+      expect(() => WelcomeMessage.fromJson({'t': 'hello'}), throwsA(isA<ProtocolException>()));
+    });
+
+    test('kicked + kick request round-trip', () {
+      const k = KickedMessage(reason: 'idle');
+      final back = KickedMessage.fromJson(Map<String, Object?>.from(k.toJson()));
+      expect(back.reason, 'idle');
+      const r = KickRequest(target: 'abc', reason: 'afk?');
+      final backR = KickRequest.fromJson(Map<String, Object?>.from(r.toJson()));
+      expect(backR.target, 'abc');
+      expect(backR.reason, 'afk?');
+      expect(() => KickedMessage.fromJson({'t': 'err'}), throwsA(isA<ProtocolException>()));
+      expect(() => KickRequest.fromJson({'t': 'err'}), throwsA(isA<ProtocolException>()));
+    });
+
+    test('lastSeen touch + stale helper', () {
+      final s = Session(id: 'default', secret: 'shh');
+      final t = s.issueToken('alice', '');
+      final viewer = s.tokens[t]!;
+      expect(viewer.isStale(const Duration(seconds: 30)), isFalse);
+      viewer.touch(DateTime.utc(2020, 1, 1));
+      expect(viewer.isStale(const Duration(seconds: 30)), isTrue);
+      expect(viewer.isStale(const Duration(seconds: 30), DateTime.utc(2020, 1, 1, 0, 0, 10)), isFalse);
+    });
+  });
+}