fix: only require userId on hello; add package-lock

package-lock.json

@@ -0,0 +1,40 @@
+{
+  "name": "dshwatch-server",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "dshwatch-server",
+      "version": "0.1.0",
+      "license": "MIT",
+      "dependencies": {
+        "ws": "^8.18.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

server.js

@@ -170,17 +170,23 @@ function handleMessage(ws, raw) {
     return;
   }
   if (!msg || typeof msg !== 'object') return;
+  if (msg.type === 'hello' && !ws.role) {
     const userId = msg.userId;
     if (typeof userId !== 'string' || userId.length === 0) {
       send(ws, { type: 'auth-error', message: 'missing userId' });
       ws.close();
       return;
     }
-  if (msg.type === 'hello' && !ws.role) {
     if (msg.role === 'dsh') handleDshHello(userId, ws, msg);
     else handleClientHello(userId, ws, msg);
     return;
   }
+  const userId = userIdOf(ws);
+  if (!userId) {
+    send(ws, { type: 'auth-error', message: 'hello required' });
+    ws.close();
+    return;
+  }
   if (ws.role === 'dsh') {
     handleHarnessMessage(userId, ws, msg);
   } else if (ws.role === 'client') {