fix(webapp): harden session channel routes from review

Reject channel initialize on an expired session (matching the append
route), sanitize a client-forged webhook action source on channel .in
appends, resolve the channel records route replica-first with a writer
fallback so a fresh session isn't a spurious 404, and URL-encode the
session id and channel in the span inspector's channel stream path.

Author: ericallam

apps/webapp/app/routes/realtime.v1.sessions.$session.channels.$channel.$io.append.ts

@@ -4,6 +4,7 @@ import { nanoid } from "nanoid";
 import { z } from "zod";
 import { logger } from "~/services/logger.server";
 import { S2RealtimeStreams } from "~/services/realtime/s2realtimeStreams.server";
+import { stripClientWebhookActionSource } from "~/services/realtime/sanitizeSessionInput.server";
 import {
   SESSION_CHANNEL_NAME_REGEX,
   sessionChannelResources,
@@ -83,7 +84,10 @@ const { action, loader } = createActionApiRoute(
     const addressingKey = canonicalSessionAddressingKey(session, params.session);
     const claimKey = `${addressingKey}:channels:${params.channel}`;
 
-    const part = await request.text();
+    let part = await request.text();
+    if (params.io === "in") {
+      part = stripClientWebhookActionSource(part);
+    }
 
     const clientPartId = request.headers.get("X-Part-Id");
     const partId = clientPartId ?? nanoid(7);

apps/webapp/app/routes/realtime.v1.sessions.$session.channels.$channel.$io.records.ts

@@ -1,6 +1,5 @@
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
-import { $replica } from "~/db.server";
 import { S2RealtimeStreams } from "~/services/realtime/s2realtimeStreams.server";
 import {
   SESSION_CHANNEL_NAME_REGEX,
@@ -9,7 +8,7 @@ import {
 import {
   canonicalSessionAddressingKey,
   isSessionFriendlyIdForm,
-  resolveSessionByIdOrExternalId,
+  resolveSessionWithWriterFallback,
 } from "~/services/realtime/sessions.server";
 import { getRealtimeStreamInstance } from "~/services/realtime/v1StreamsGlobal.server";
 import { anyResource, createLoaderApiRoute } from "~/services/routeBuilders/apiBuilder.server";
@@ -31,11 +30,7 @@ export const loader = createLoaderApiRoute(
     allowJWT: true,
     corsStrategy: "all",
     findResource: async (params, auth) => {
-      const row = await resolveSessionByIdOrExternalId(
-        $replica,
-        auth.environment.id,
-        params.session
-      );
+      const row = await resolveSessionWithWriterFallback(auth.environment.id, params.session);
       if (!row && isSessionFriendlyIdForm(params.session)) {
         return undefined;
       }

apps/webapp/app/routes/realtime.v1.sessions.$session.channels.$channel.$io.ts

@@ -56,6 +56,10 @@ const { action } = createActionApiRoute(
       return new Response("Cannot initialize a channel on a closed session", { status: 400 });
     }
 
+    if (maybeSession?.expiresAt && maybeSession.expiresAt.getTime() < Date.now()) {
+      return new Response("Cannot initialize a channel on an expired session", { status: 400 });
+    }
+
     const realtimeStream = getRealtimeStreamInstance(authentication.environment, "v2", {
       session: maybeSession,
       organization: maybeSession ? null : authentication.environment.organization,

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.$runParam.spans.$spanParam/route.tsx

@@ -1805,8 +1805,10 @@ function SpanEntity({ span }: { span: Span }) {
     }
     case "session-stream": {
       const { runId, sessionId, channel, io } = span.entity.object;
-      const base = `/resources/orgs/${organization.slug}/projects/${project.slug}/env/${environment.slug}/runs/${runId}/realtime/v1/sessions/${sessionId}`;
-      const resourcePath = channel ? `${base}/channels/${channel}/${io}` : `${base}/${io}`;
+      const base = `/resources/orgs/${organization.slug}/projects/${project.slug}/env/${environment.slug}/runs/${runId}/realtime/v1/sessions/${encodeURIComponent(sessionId)}`;
+      const resourcePath = channel
+        ? `${base}/channels/${encodeURIComponent(channel)}/${io}`
+        : `${base}/${io}`;
       const displayName = channel ? `${channel}.${io}` : `${sessionId}.${io}`;
       return (
         <RealtimeStreamViewer