From 893de1510dbf28b70d442c24e9e6940385c68dfd Mon Sep 17 00:00:00 2001
From: Pierre Arnaud <arnaud@epsitec.ch>
Date: Fri, 30 Jan 2026 22:35:39 +0100
Subject: [PATCH] Phase 3: Pass authentication token to SignalR connection URL

- Modified main.js to pass authToken to SignalRBridge constructor
- Updated signalr-bridge.js to append token to hub URL
- Removed skip logic for negotiate endpoint in middleware
- SignalR negotiate request now includes token for authentication
- Cookie is set after successful negotiate for subsequent requests

This enables SignalR connections to authenticate using the same
token-based mechanism as HTTP requests, completing the authentication
flow for both Blazor pages and SignalR hub communication.
---
 .../Middleware/ElectronAuthenticationMiddleware.cs        | 7 -------
 src/ElectronNET.Host/api/signalr-bridge.js                | 8 ++++++--
 src/ElectronNET.Host/main.js                              | 4 +++-
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/src/ElectronNET.AspNet/Middleware/ElectronAuthenticationMiddleware.cs b/src/ElectronNET.AspNet/Middleware/ElectronAuthenticationMiddleware.cs
index a235925..9bb94e0 100644
--- a/src/ElectronNET.AspNet/Middleware/ElectronAuthenticationMiddleware.cs
+++ b/src/ElectronNET.AspNet/Middleware/ElectronAuthenticationMiddleware.cs
@@ -24,13 +24,6 @@ namespace ElectronNET.AspNet.Middleware
 
         public async Task InvokeAsync(HttpContext context)
         {
-            // Skip authentication for SignalR negotiation (will be handled by cookie)
-            if (context.Request.Path.StartsWithSegments("/electron-hub/negotiate"))
-            {
-                await _next(context);
-                return;
-            }
-
             // Check if authentication cookie exists
             var authCookie = context.Request.Cookies[AuthCookieName];
             
diff --git a/src/ElectronNET.Host/api/signalr-bridge.js b/src/ElectronNET.Host/api/signalr-bridge.js
index fa9fdf0..828cbfb 100644
--- a/src/ElectronNET.Host/api/signalr-bridge.js
+++ b/src/ElectronNET.Host/api/signalr-bridge.js
@@ -30,8 +30,9 @@ const safeConsole = {
 };
 
 class SignalRBridge {
-    constructor(hubUrl) {
+    constructor(hubUrl, authToken) {
         this.hubUrl = hubUrl;
+        this.authToken = authToken;
         this.connection = null;
         this.isConnected = false;
         this.eventHandlers = new Map(); // For socket.io-style .on() handlers
@@ -39,8 +40,11 @@ class SignalRBridge {
     }
 
     async connect() {
+        // Append authentication token to the SignalR connection URL
+        const connectionUrl = this.authToken ? `${this.hubUrl}?token=${this.authToken}` : this.hubUrl;
+        
         this.connection = new signalR.HubConnectionBuilder()
-            .withUrl(this.hubUrl)
+            .withUrl(connectionUrl)
             .withAutomaticReconnect()
             .configureLogging(signalR.LogLevel.Warning)
             .build();
diff --git a/src/ElectronNET.Host/main.js b/src/ElectronNET.Host/main.js
index 49bb7d6..7f9220e 100644
--- a/src/ElectronNET.Host/main.js
+++ b/src/ElectronNET.Host/main.js
@@ -445,7 +445,9 @@ function startSocketApiBridge(port) {
 async function startSignalRApiBridge(baseUrl) {
     const { SignalRBridge } = require('./api/signalr-bridge');
     const hubUrl = `${baseUrl}/electron-hub`;
-    const signalRBridge = new SignalRBridge(hubUrl);
+    
+    // Pass the authentication token to the SignalR bridge
+    const signalRBridge = new SignalRBridge(hubUrl, global.authToken);
     
     try {
         const connected = await signalRBridge.connect();