WebSocket for live status updates

[Ovich]

To improve network efficiency and reduce consumption, we propose replacing certains of current active polling method (periodic HTTP requests) with a single WebSocket connection for each active user. This WebSocket connection will handle server to client communications only, ensuring that client are informed of relevant state changes without the need for frequent http requests.

The related active pooling requests that should be replaced with websocket are those that are generally involved in periods of intensive network loads such as exams and tests.

Current Active Pooling Use Cases:

Student Evaluation Updates: Students need to be updated about:

The evaluation phase changes (e.g., in-progress, terminated). Student status in relation to the evaluation (e.g., allowed or denied access based on the access list, inprogress or terminated) Connectivity Updates: Clients need to be informed about the network connectivity status between the client and the server.

Future Active Pooling Use Cases:

Session Interruption Notification: Clients must be updated if the current login session is invalidated by the server.

Single Session Policy for Evaluations:

For evaluations (exams and tests), enforce a single session policy by invalidating any existing active session when the student use the link. The evaluation link will sign off and invalidate any active session insuring the student re-authenticates for this evaluation from his current client. If a second sign-in attempt occurs during an evaluation, the student should be blocked, requiring server-to-client communication to inform the client. He would need to reach out to the professor to resolve this situation.

WebSocket Message Types:

We currently have one active pooling request to insure the server is reachable. The websocket lost connection would be, by it self, a robust mean to identify network issues between the client and the server. Which is crucial to insure no client work is lost due to this interruption. This approach should work regardless if the client has lost internet connection or vpn connection.

SESSION_INVALIDATED message

Informs the client that the current login session has been invalidated. It is generally more secure to ensure we have a single device with an active session. If a currently active device has an invalid session, it should be notified by a message to do the client side signoff procedure and display the login screen.

EVALUATION_UPDATE message

Phase Change Notification: Notifies the client about changes in the evaluation phase. (draft to in-progress, in-progress to grading etc...) Status Update: Updates the client on their status in relation to the evaluation (e.g., the professor has changed the status to in-progress or terminated, or the student has been added to / removed from the access list). Strict Login Policy Enforcement: Notifies the client if they are blocked from the evaluation due to a single session policy breach (e.g., another login attempt during the evaluation from same or another device). End DateTime Change: Informs the client about any changes to the evaluation's end date and time.

[Ovich]

@bchapuis What do you think?

[bchapuis]

Why not using SSE? It is usually more robust, especially if we only send events from the server to the client.