Hire Dedicated PHP Developers Who Won't Disappear in 6 Months

<?php
// PHP 8.3 - Production WebSocket with Security Best Practices
declare(strict_types=1);

namespace App\WebSocket;

use Swoole\WebSocket\Server;
use Swoole\Http\Request;
use Swoole\Http\Response;
use Swoole\WebSocket\Frame;
use App\Domain\ValueObjects\{UserId, RoomId};
use App\Application\Services\{AuthService, MessageService};
use App\Application\DTOs\WebSocketEventDTO;
use App\Infrastructure\{MonologLogger, PrometheusMetrics, RateLimiter};
use App\Shared\{Sanitizer, AppConfig};

final readonly class WebSocketServer
{
    private Server $server;
    private ConnectionManager $connections;
    private MessageService $messages;
    private AuthService $auth;
    private MonologLogger $logger;
    private PrometheusMetrics $metrics;
    private RateLimiter $rateLimiter;

    public function __construct(private AppConfig $config)
    {
        $this->initServices();
        $this->createServer();
    }

    private function initServices(): void
    {
        $this->logger = new MonologLogger($this->config->get('logging.channel'));
        $this->metrics = new PrometheusMetrics($this->config->get('metrics.namespace'));

        $redis = new \Redis();
        try {
            $redis->connect($this->config->get('redis.host'), $this->config->get('redis.port'));
        } catch (\RedisException $e) {
            $this->logger->error('Redis connection failed', ['error' => $e->getMessage()]);
            throw $e;
        }

        $this->rateLimiter = new RateLimiter($redis, 100, 60);
        $this->messages = new MessageService($redis, $this->logger);
        $this->auth = new AuthService($this->config->get('auth.jwtSecret'), $redis);
        $this->connections = new ConnectionManager($redis, $this->logger);

        $this->logger->info('Services initialized');
    }

    private function createServer(): void
    {
        $this->server = new Server(
            $this->config->get('websocket.host'),
            $this->config->get('websocket.port')
        );

        $this->server->set([
            'worker_num' => $this->config->get('websocket.workers', 4),
            'max_connection' => 10000,
            'heartbeat_check_interval' => 30,
            'heartbeat_idle_time' => 60,
            'enable_coroutine' => true,
            'package_max_length' => 65536, // 64KB max message
        ]);

        $this->server->on('Start', $this->onStart(...));
        $this->server->on('Open', $this->onOpen(...));
        $this->server->on('Message', $this->onMessage(...));
        $this->server->on('Close', $this->onClose(...));
        $this->server->on('Request', $this->onHttpRequest(...));
    }

    // Sanitize input to prevent XSS
    private function sanitize(string $input, int $maxLen = 1000): string
    {
        $clean = strip_tags($input);
        $clean = htmlspecialchars($clean, ENT_QUOTES | ENT_HTML5, 'UTF-8');
        return mb_substr(trim($clean), 0, $maxLen);
    }

    // Validate room ID format
    private function validateRoomId(string $roomId): ?RoomId
    {
        if (strlen($roomId) > 64 || !preg_match('/^[a-zA-Z0-9_-]+$/', $roomId)) {
            return null;
        }
        return new RoomId(rawurlencode($roomId));
    }

    // Add security headers to response
    private function addSecurityHeaders(Response $response): void
    {
        $response->header('X-Content-Type-Options', 'nosniff');
        $response->header('X-Frame-Options', 'DENY');
        $response->header('X-XSS-Protection', '1; mode=block');
        $response->header('Content-Security-Policy', "default-src 'self'");
        $response->header('Referrer-Policy', 'strict-origin-when-cross-origin');
    }

    public function onStart(Server $server): void
    {
        $this->logger->info('Server started', [
            'host' => $this->config->get('websocket.host'),
            'port' => $this->config->get('websocket.port')
        ]);
        $this->metrics->registerGauge('websocket_connections', 0);
    }

    public function onOpen(Server $server, Request $request): void
    {
        try {
            // Auth check
            $token = $request->header['authorization'] ?? '';
            $user = $this->auth->validateToken($token);
            if (!$user) {
                $server->disconnect($request->fd, 1008, 'Unauthorized');
                return;
            }

            // Rate limit
            if (!$this->rateLimiter->check($user->getId()->toString())) {
                $server->disconnect($request->fd, 1008, 'Rate limit exceeded');
                return;
            }

            // Validate room ID
            parse_str($request->server['query_string'] ?? '', $query);
            $roomId = $this->validateRoomId($query['room'] ?? '');
            if (!$roomId) {
                $server->disconnect($request->fd, 1008, 'Invalid room ID');
                return;
            }

            // Check room access
            if (!$this->auth->canAccessRoom($user->getId(), $roomId)) {
                $server->disconnect($request->fd, 1008, 'Access denied');
                return;
            }

            // Register connection
            $this->connections->add($request->fd, $user->getId(), $roomId);

            // Send acknowledgment
            $server->push($request->fd, json_encode([
                'type' => 'connected',
                'payload' => [
                    'userId' => $user->getId()->toString(),
                    'roomId' => $roomId->toString()
                ]
            ], JSON_THROW_ON_ERROR));

            $this->metrics->incrementGauge('websocket_connections');
            $this->logger->info('Connected', ['fd' => $request->fd, 'user' => $user->getId()->toString()]);

        } catch (\Throwable $e) {
            $this->logger->error('Connection error', ['error' => $e->getMessage()]);
            $server->disconnect($request->fd, 1011, 'Server error');
        }
    }

    public function onMessage(Server $server, Frame $frame): void
    {
        $timer = $this->metrics->startTimer('message_duration');

        try {
            $conn = $this->connections->get($frame->fd);
            if (!$conn) {
                throw new \RuntimeException('Connection not found');
            }

            // Size check
            if (strlen($frame->data) > 65536) {
                $this->sendError($server, $frame->fd, 'MESSAGE_TOO_LARGE');
                return;
            }

            $data = json_decode($frame->data, true, 512, JSON_THROW_ON_ERROR);
            $event = WebSocketEventDTO::fromArray($data);

            match ($event->type) {
                'message' => $this->handleChatMessage($server, $frame->fd, $event, $conn),
                'typing' => $this->handleTyping($server, $conn, (bool)($event->payload['is_typing'] ?? false)),
                'heartbeat' => $server->push($frame->fd, json_encode(['type' => 'pong'], JSON_THROW_ON_ERROR)),
                default => $this->logger->warning('Unknown event', ['type' => $event->type])
            };

        } catch (\JsonException) {
            $this->sendError($server, $frame->fd, 'INVALID_JSON');
        } catch (\Throwable $e) {
            $this->logger->error('Message error', ['error' => $e->getMessage()]);
            $this->sendError($server, $frame->fd, 'SERVER_ERROR');
        } finally {
            $timer();
        }
    }

    private function handleChatMessage(Server $server, int $fd, WebSocketEventDTO $event, object $conn): void
    {
        $text = $this->sanitize($event->payload['text'] ?? '');
        if (empty($text)) return;

        $message = $this->messages->create($text, $conn->userId, $conn->roomId);

        $this->broadcastToRoom($conn->roomId, [
            'type' => 'message',
            'payload' => $message->toArray()
        ]);
    }

    private function handleTyping(Server $server, object $conn, bool $isTyping): void
    {
        $this->broadcastToRoom($conn->roomId, [
            'type' => 'typing',
            'payload' => ['userId' => $conn->userId->toString(), 'isTyping' => $isTyping]
        ], $conn->fd);
    }

    private function sendError(Server $server, int $fd, string $code): void
    {
        if ($this->server->isEstablished($fd)) {
            $server->push($fd, json_encode(['type' => 'error', 'code' => $code], JSON_THROW_ON_ERROR));
        }
    }

    private function broadcastToRoom(RoomId $roomId, array $data, ?int $exclude = null): void
    {
        $json = json_encode($data, JSON_THROW_ON_ERROR);
        foreach ($this->connections->getByRoom($roomId) as $fd => $conn) {
            if ($fd !== $exclude && $this->server->isEstablished($fd)) {
                $this->server->push($fd, $json);
            }
        }
    }

    public function onClose(Server $server, int $fd): void
    {
        $conn = $this->connections->remove($fd);
        if ($conn) {
            $this->broadcastToRoom($conn->roomId, [
                'type' => 'user_left',
                'payload' => ['userId' => $conn->userId->toString()]
            ]);
            $this->metrics->decrementGauge('websocket_connections');
            $this->logger->info('Disconnected', ['fd' => $fd]);
        }
    }

    public function onHttpRequest(Request $request, Response $response): void
    {
        $this->addSecurityHeaders($response);

        match ($request->server['path_info']) {
            '/health' => $this->handleHealth($response),
            '/metrics' => $this->handleMetrics($response),
            default => $response->status(404)->end('Not Found')
        };
    }

    private function handleHealth(Response $response): void
    {
        $response->header('Content-Type', 'application/json');
        $response->end(json_encode([
            'status' => 'healthy',
            'connections' => $this->connections->count(),
            'timestamp' => time()
        ], JSON_THROW_ON_ERROR));
    }

    private function handleMetrics(Response $response): void
    {
        $response->header('Content-Type', 'text/plain');
        $response->end($this->metrics->export());
    }

    public function start(): void
    {
        $this->server->start();
    }
}

// Bootstrap
$server = new WebSocketServer(new AppConfig(__DIR__ . '/../config'));
$server->start();