Initial project snapshot

workers/rdp-worker/include/rdp_worker/dataplane/direct_wss_server.hpp

@@ -0,0 +1,53 @@
+#pragma once
+
+#include <atomic>
+#include <chrono>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <thread>
+
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/asio/ssl/context.hpp>
+
+#include "rdp_worker/common/logger.hpp"
+#include "rdp_worker/config/config.hpp"
+#include "rdp_worker/dataplane/token_validator.hpp"
+#include "rdp_worker/runtime/session_manager.hpp"
+
+namespace rdp_worker::dataplane {
+
+class DirectWssServer {
+public:
+    DirectWssServer(config::Config config,
+                    std::shared_ptr<runtime::SessionManager> session_manager,
+                    std::shared_ptr<common::Logger> logger);
+    ~DirectWssServer();
+
+    DirectWssServer(const DirectWssServer&) = delete;
+    DirectWssServer& operator=(const DirectWssServer&) = delete;
+
+    void Start();
+    void Stop();
+
+private:
+    void Run();
+    void HandleConnection(boost::asio::ip::tcp::socket socket);
+    bool ConsumeJti(const DataPlaneTokenClaims& claims);
+
+    config::Config config_;
+    std::shared_ptr<runtime::SessionManager> session_manager_;
+    std::shared_ptr<common::Logger> logger_;
+    DataPlaneTokenValidator token_validator_;
+    boost::asio::io_context io_context_;
+    boost::asio::ssl::context ssl_context_;
+    std::optional<boost::asio::ip::tcp::acceptor> acceptor_;
+    std::thread thread_;
+    std::atomic<bool> stop_requested_{false};
+    std::mutex jti_mutex_;
+    std::map<std::string, std::chrono::system_clock::time_point> used_jti_;
+};
+
+}  // namespace rdp_worker::dataplane

workers/rdp-worker/include/rdp_worker/dataplane/token_validator.hpp

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace rdp_worker::dataplane {
+
+struct DataPlaneTokenClaims {
+    std::string session_id;
+    std::string attachment_id;
+    std::string user_id;
+    std::string organization_id;
+    std::string worker_id;
+    std::string resource_id;
+    std::vector<std::string> allowed_channels;
+    std::int64_t expires_at_unix{0};
+    std::string jti;
+};
+
+struct TokenValidationResult {
+    bool ok{false};
+    std::string reason;
+    DataPlaneTokenClaims claims;
+};
+
+class DataPlaneTokenValidator {
+public:
+    DataPlaneTokenValidator(std::string public_key_pem, std::string expected_worker_id);
+
+    [[nodiscard]] TokenValidationResult Validate(const std::string& token) const;
+
+private:
+    std::string public_key_pem_;
+    std::string expected_worker_id_;
+};
+
+}  // namespace rdp_worker::dataplane