Add user-agent requirement

Author: tstromberg

README.md

@@ -27,10 +27,15 @@ go run ./cmd/client
 
 ## Client examples
 
+**Important**: All clients must provide a User-Agent header in the format `client-name/version` (e.g., `myapp/v1.0.0`). Connections without a valid User-Agent will be rejected with a 400 Bad Request error.
+
 ### Subscribe to organization events
 ```javascript
 const ws = new WebSocket('wss://your-server/ws', {
-  headers: { 'Authorization': 'Bearer ghp_your_github_token' }
+  headers: {
+    'Authorization': 'Bearer ghp_your_github_token',
+    'User-Agent': 'myapp/v1.0.0'
+  }
 });
 
 ws.on('open', () => {

cmd/client/main.go

@@ -112,6 +112,7 @@ func run() error {
 	// Create client configuration
 	config := client.Config{
 		ServerURL:      url,
+		UserAgent:      fmt.Sprintf("sprinkler-cli/%s", client.Version),
 		Organization:   *org,
 		Token:          githubToken,
 		EventTypes:     eventTypesList,

cmd/server/main.go

@@ -35,7 +35,10 @@ const (
 // contextKey is a custom type for context keys to avoid collisions.
 type contextKey string
 
-const reservationTokenKey contextKey = "reservation_token"
+const (
+	reservationTokenKey contextKey = "reservation_token"
+	userAgentKey        contextKey = "user_agent"
+)
 
 var (
 	webhookSecret = flag.String("webhook-secret", os.Getenv("GITHUB_WEBHOOK_SECRET"), "GitHub webhook secret for signature verification")
@@ -185,6 +188,22 @@ func main() {
 			return
 		}
 
+		// Validate User-Agent header format
+		userAgent, err := security.ParseUserAgent(r)
+		if err != nil {
+			log.Printf("WebSocket 400: invalid user-agent ip=%s error=%q user_agent=%q",
+				ip, err.Error(), r.UserAgent())
+			w.WriteHeader(http.StatusBadRequest)
+			msg := fmt.Sprintf("400 Bad Request: %s\n", err.Error())
+			if _, writeErr := w.Write([]byte(msg)); writeErr != nil {
+				log.Printf("failed to write 400 response: %v", writeErr)
+			}
+			return
+		}
+
+		// Store parsed User-Agent in context for handler to use
+		r = r.WithContext(context.WithValue(r.Context(), userAgentKey, userAgent))
+
 		// Pre-validate authentication before WebSocket upgrade
 		authHeader := r.Header.Get("Authorization")
 		if !wsHandler.PreValidateAuth(r) {
@@ -235,7 +254,7 @@ func main() {
 		}
 
 		// Set reservation token in request context so websocket handler can commit it
-		r = r.WithContext(context.WithValue(r.Context(), reservationTokenKey, reservationToken))
+		r = r.WithContext(context.WithValue(r.Context(), reservationTokenKey, reservationToken)) //nolint:contextcheck // We're properly using r.Context() to derive the new context
 
 		// Log successful auth and proceed to upgrade
 		log.Printf("WebSocket UPGRADE: ip=%s duration=%v", ip, time.Since(startTime))

pkg/client/client.go

@@ -30,6 +30,9 @@ const (
 	// DefaultServerAddress is the default webhook sprinkler server address.
 	DefaultServerAddress = "webhook.github.codegroove.app"
 
+	// Version is the client library version.
+	Version = "v0.5.0"
+
 	// UI constants for logging.
 	separatorLine = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
 	msgTypeField  = "type"
@@ -65,6 +68,7 @@ type Config struct {
 	ServerURL      string
 	Token          string
 	TokenProvider  func() (string, error) // Optional: dynamically provide fresh tokens for reconnection
+	UserAgent      string                 // Required: User-Agent in format "client-name/version" (e.g., "myapp/v1.0.0")
 	Organization   string
 	EventTypes     []string
 	PullRequests   []string
@@ -112,6 +116,9 @@ func New(config Config) (*Client, error) {
 	if config.ServerURL == "" {
 		return nil, errors.New("serverURL is required")
 	}
+	if config.UserAgent == "" {
+		return nil, errors.New("userAgent is required (format: client-name/version, e.g., myapp/v1.0.0)")
+	}
 	if config.Organization == "" && len(config.PullRequests) == 0 {
 		return nil, errors.New("organization or pull requests required")
 	}
@@ -291,9 +298,10 @@ func (c *Client) connect(ctx context.Context) error {
 		return fmt.Errorf("config: %w", err)
 	}
 
-	// Add Authorization header
+	// Add Authorization and User-Agent headers
 	wsConfig.Header = make(map[string][]string)
 	wsConfig.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", token)}
+	wsConfig.Header["User-Agent"] = []string{c.config.UserAgent}
 
 	// Dial the server
 	ws, err := websocket.DialConfig(wsConfig)