Building Real-Time Applications with Socket.io and JavaScript

import { createServer } from "node:http";
import { Server } from "socket.io";

const PORT = Number(process.env.PORT) || 3000;
const DEFAULT_ROOM = "general";
const MAX_MESSAGE_LENGTH = 1000;

// Create a native HTTP server for Socket.io to attach to.
const httpServer = createServer((request, response) => {
  // Provide a simple health endpoint for monitoring.
  if (request.url === "/health") {
    response.writeHead(200, { "Content-Type": "application/json" });
    response.end(JSON.stringify({ status: "ok" }));
    return;
  }

  response.writeHead(200, { "Content-Type": "text/plain" });
  response.end("Real-time messaging server is running.\n");
});

// Initialize Socket.io with explicit cross-origin configuration.
// Replace the example origin with your actual frontend origin in production.
const io = new Server(httpServer, {
  cors: {
    origin: process.env.CLIENT_ORIGIN || "http://localhost:5173",
    methods: ["GET", "POST"]
  },
  connectionStateRecovery: {
    maxDisconnectionDuration: 2 * 60 * 1000,
    skipMiddlewares: false
  }
});

// Log a clear startup message when the server begins listening.
httpServer.listen(PORT, () => {
  console.log(`[STARTUP] HTTP and Socket.io server listening on port ${PORT}`);
  console.log(`[STARTUP] Health check: http://localhost:${PORT}/health`);
});

// Register a handler for every newly connected Socket.io client.
io.on("connection", (socket) => {
  console.log(`[CONNECT] Client connected: ${socket.id}`);

  // Join the default room so connected clients share the same conversation.
  socket.join(DEFAULT_ROOM);
  console.log(`[ROOM] ${socket.id} joined ${DEFAULT_ROOM}`);

  // Send a welcome event directly to this newly connected client.
  socket.emit("chat:welcome", {
    message: "Welcome! You are connected to the general chat room.",
    socketId: socket.id,
    room: DEFAULT_ROOM,
    timestamp: new Date().toISOString()
  });

  // Listen for a custom event sent by a connected client.
  socket.on("chat:message", (payload, acknowledge) => {
    console.log(`[EVENT] Received chat:message from ${socket.id}`);

    // Check the payload before broadcasting untrusted client input.
    if (
      !payload ||
      typeof payload.text !== "string" ||
      payload.text.trim().length === 0 ||
      payload.text.length > MAX_MESSAGE_LENGTH
    ) {
      console.warn(`[VALIDATION] Rejected invalid message from ${socket.id}`);

      // Acknowledgements let the sender know whether processing succeeded.
      if (typeof acknowledge === "function") {
        acknowledge({ ok: false, error: "Invalid message payload." });
      }
      return;
    }

    // Never trust a client-provided identity as proof of who sent a message.
    // A real application should obtain the user ID from authenticated server state.
    const message = {
      id: crypto.randomUUID(),
      senderId: socket.data.userId || socket.id,
      text: payload.text.trim(),
      room: DEFAULT_ROOM,
      timestamp: new Date().toISOString()
    };

    console.log(`[MESSAGE] Broadcasting message ${message.id}`);

    // Send the event to every client in the room, including the sender.
    io.to(DEFAULT_ROOM).emit("chat:new-message", message);

    // Confirm successful processing to the client that sent the message.
    if (typeof acknowledge === "function") {
      acknowledge({ ok: true, messageId: message.id });
    }
  });

  // Demonstrate a lightweight room membership request.
  socket.on("chat:join-room", (roomName, acknowledge) => {
    if (
      typeof roomName !== "string" ||
      !/^[a-zA-Z0-9_-]{1,50}$/.test(roomName)
    ) {
      if (typeof acknowledge === "function") {
        acknowledge({ ok: false, error: "Invalid room name." });
      }
      return;
    }

    // Production applications must authorize access before joining a room.
    socket.join(roomName);
    console.log(`[ROOM] ${socket.id} joined ${roomName}`);

    if (typeof acknowledge === "function") {
      acknowledge({ ok: true, room: roomName });
    }
  });

  // Listen for disconnections and record the reason for observability.
  socket.on("disconnect", (reason) => {
    console.log(`[DISCONNECT] ${socket.id} disconnected: ${reason}`);
  });
});

// Handle unexpected HTTP server errors instead of failing silently.
httpServer.on("error", (error) => {
  console.error("[SERVER ERROR] HTTP server encountered an error:", error);
  process.exitCode = 1;
});

// Close connections cleanly when the process receives a termination signal.
function shutdown(signal) {
  console.log(`[SHUTDOWN] Received ${signal}; closing the server...`);

  io.close(() => {
    console.log("[SHUTDOWN] Socket.io connections have been closed.");
    process.exit(0);
  });

  // Avoid waiting indefinitely if a connection fails to close cleanly.
  setTimeout(() => {
    console.error("[SHUTDOWN] Forced exit after the shutdown timeout.");
    process.exit(1);
  }, 10000).unref();
}

process.once("SIGINT", () => shutdown("SIGINT"));
process.once("SIGTERM", () => shutdown("SIGTERM"));