Add turbosync example - synchronized video playback with Durable Objects#311
Add turbosync example - synchronized video playback with Durable Objects#311AliSananS wants to merge 1 commit intocloudflare:mainfrom
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd0ec7e8ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const slug = toSlug(body.name); | ||
| const stub = env.ROOM.get(env.ROOM.idFromName(slug)); |
There was a problem hiding this comment.
The create-room handler derives the Durable Object key from toSlug(body.name) but never validates the result, so inputs like "!!!" produce an empty slug and still create a room under idFromName(""). The response then returns slug: "", which causes the client to navigate to /room/ and fail to join via /ws/:roomId, leaving users with a created but practically unreachable room; return a 400 when the slug is empty.
Useful? React with 👍 / 👎.
| const existingHostPeerId = await this.ctx.storage.get<string>("hostPeerId"); | ||
|
|
||
| // If the room is already claimed (has a stored hostPeerId), reject it | ||
| if (existingName && existingHostPeerId) { |
There was a problem hiding this comment.
Room ownership conflict is only triggered when both name and hostPeerId are already stored, but hostPeerId is optional on create, so a client can create a room without it and later requests to the same slug can overwrite room data (including password/permissions) before a host joins. This makes room creation non-atomic and allows unintended takeover of an existing room state; treat any existing room record as a conflict (or require hostPeerId at creation).
Useful? React with 👍 / 👎.
1 participant
Summary
Github Repo
https://github.com/AliSananS/turbosync
Live Demo