VanishText More Info

This page documents the behavior of the current server and browser client implementation.

Runtime Overview

VanishText consists of:

• An Express HTTP server (static frontend + middleware).
• A Socket.IO server (real-time chat events).
• Utility modules for user state and command handling.

Server startup flow:

1. Load .env with dotenv.config().
2. Resolve runtime flags from env vars.
3. Configure cookie parser + auth middleware.
4. Serve the bundled frontend assets.
5. Start HTTP server and attach Socket.IO.

Server Entry (main server file)

Key imports

• express: HTTP server and middleware.
• socket.io (Server): WebSocket transport and rooms.
• cookie-parser: reads req.cookies.auth for protection mode.
• dotenv: injects environment variables.
• Readable from stream: pipes fetched remote frontend assets.
• runCommand: handles /! command messages.
• utilities.js: username validation and room/user state helpers.

Important exported constants

• ADMIN: system sender name used for unclaimable system messages.
• commandsEnabled: command feature switch.
• UsersState: in-memory user store wrapper.
• io: shared Socket.IO server instance.

HTTP middleware behavior

• If protection is disabled and request path is /, requests are redirected to /chat.html.
• For /chat.html, access is allowed when:
  • protection is disabled, or
  • auth cookie value exists in PROTECTION_PASSWORDS.
• Otherwise requests are redirected to /.

Static frontend selection

The server serves the local built-in frontend directory (frontend) by default.

Socket.IO Event Reference

Server emits

Event	Payload	When it is emitted
config	{ autoReconnect: boolean }	Immediately after client connects
message	buildMsg(name, text)	System and chat messages
userList	{ users, room }	Room membership updates
chat_image	{ name, type, image, time }	Image message in a room
activity	name	Typing indicator to other users

Server listens

Event	Expected payload	Main behavior
enterRoom	{ name, room }	Validates user, leaves previous room, joins new room, updates user list
message	{ name, text }	Filters dangerous substrings, executes /! commands, broadcasts message
chat_image	{ name, type, image }	Sends image to current room if image sharing enabled
activity	name	Broadcasts typing activity to other room members
disconnect	none	Removes user, broadcasts leave message, refreshes room user list

Message and Name Validation

Name rules

• Reserved names are blocked (SYSTEM, ADMIN, etc.).
• Allowed characters are limited to A-Z, 0-9, _, -.
• Validation happens on room join and message/image/activity events.

Message filtering

Before message broadcast, text is lowercased and checked against a denylist containing:

• HTML tags such as <script>, <iframe>, <img>, <style>, etc.
• Event handler terms like onerror, onclick, onload.
• Dangerous attribute/protocol fragments (src=, href=, javascript:, data:).

If blocked, the message is not emitted to the room.

Frontend Client Reference (chat page script)

Core UI bindings

• Message form submit -> emits message.
• Join form submit -> emits enterRoom.
• Message input keypress -> emits activity.

Connection handling

• On connect: enables inputs and sets connected status text.
• On disconnect: disables image/message actions and shows disconnected status.

Rendering behavior

• message event:
  • own messages are right-aligned,
  • other users are left-aligned,
  • system messages use dedicated system style,
  • command messages beginning with /! are not displayed in chat list.
• chat_image event:
  • reconstructs image Blob from payload,
  • creates object URL and appends an <img> preview to chat list.
• userList event:
  • displays up to 15 usernames and summarizes overflow (and N more).
• activity event:
  • tracks typing users with timeout-based cleanup,
  • renders is typing... / are typing... indicator.

Function Reference

Function	Location	Purpose
buildMsg(name, text)	Server	Builds standardized chat payload with timestamp
middleware(req, res, next)	Server	Redirect/auth gate for protected access
showUsers(users, room)	Client	Creates compact user list display string
stringtocolor(str)	Client	Assigns deterministic pseudo-random color to names

Deployment Notes

• In production (NODE_ENV=production), Socket.IO CORS origin is disabled (false) by current config.
• If commands should be disabled in production, ensure ENABLE_COMMANDS=false and enforce the check inside command execution paths.

Troubleshooting Quick Reference

Symptom	Likely cause	Check
Redirect loop between / and /chat.html	Protection settings/cookie mismatch	ENABLE_PROTECTION, PROTECTION_PASSWORDS, auth cookie
Users cannot connect from external domain	CORS restriction in production	Socket.IO cors.origin and reverse proxy setup
Images do not send	Image feature disabled	ENABLE_IMAGES=true
Commands ignored	Commands disabled or filtered path	ENABLE_COMMANDS, runCommand integration