feat: serve plugin http and websockets from one mount instead of ports

plugins/remote-desktop/src/backend/index.ts

@@ -1,33 +1,51 @@
 import type { PluginContext } from "@termix/plugin-sdk/backend";
 import {
-  GUAC_WS_PORT,
   getGuacSessionInfo,
+  handleGuacamoleUpgrade,
   restartGuacServer,
   startGuacamoleService,
   stopGuacamoleService,
   tokenService,
 } from "./guacamole-server.js";
-import { router } from "./routes.js";
-import {
-  registerGuacamoleBridge,
-  unregisterGuacamoleBridge,
-} from "../../../../src/backend/database/routes/guacamole-dispatch.js";
+import { startRemoteDesktopService } from "./routes.js";
 
 export async function activate(ctx: PluginContext) {
   await startGuacamoleService();
 
-  registerGuacamoleBridge({
-    router,
+  startRemoteDesktopService(ctx.http.router());
+
+  // guacamole-lite owns its own WebSocketServer, so it takes the raw upgrade.
+  //
+  // Public because a Guacamole display authenticates with the encrypted,
+  // single-use connection token minted by POST /token, not with a session
+  // JWT. guacamole-lite decrypts and validates that token itself, and the
+  // route that mints one is authenticated normally.
+  ctx.ws.upgrade(
+    "/display",
+    (request, socket, head) =>
+      handleGuacamoleUpgrade(
+        request as Parameters<typeof handleGuacamoleUpgrade>[0],
+        socket as Parameters<typeof handleGuacamoleUpgrade>[1],
+        head as Buffer,
+      ),
+    { public: true },
+  );
+
+  // What collab, session-sharing and the admin guacd setting need from a
+  // running Guacamole server. Revoked automatically on deactivate, and
+  // hosts/guacamole-sessions.ts degrades safely while it is gone.
+  ctx.registry.provide("remote-desktop.sessions", {
     restart: restartGuacServer,
     createJoinToken: (guacamoleConnectionId: string, readOnly: boolean) =>
       tokenService.createJoinToken(guacamoleConnectionId, readOnly),
     getSessionInfo: getGuacSessionInfo,
   });
 
-  ctx.log.info(`Remote Desktop listening on ${GUAC_WS_PORT ?? 30008}`);
+  ctx.log.info(
+    "Remote Desktop mounted at /plugin-api/remote-desktop and /plugin-ws/remote-desktop/display",
+  );
 }
 
 export async function deactivate() {
-  unregisterGuacamoleBridge();
   await stopGuacamoleService();
 }