FISM Community Chat

A production WordPress integration for a private, real-time member community. The plugin connects authenticated WordPress users to a companion Node.js/Socket.io service, while keeping identity, permissions, legal acceptance, moderation configuration, and administrative controls inside WordPress.

See the public Community Chat page

Portfolio release: this repository currently contains the WordPress side of the system. The companion real-time service is not included yet, so this is source for architecture review rather than a one-command standalone deployment.

Why it exists

The inherited chat experience failed in several user-visible ways: authenticated members were not signed in reliably, message input could remain disabled, and mobile viewport and scrolling behavior broke the primary experience. This version rebuilds the integration around an explicit signed identity handoff and a clearer separation between WordPress responsibilities and real-time messaging.

What the plugin handles

• Custom chat rooms and navigation links
• Signed HS256 JWT identity for the Socket.io service
• Role- and tier-aware room permissions
• Member nickname management
• Terms acceptance, versioning, audit records, and CSV export
• Moderation configuration and service-to-WordPress notification routes
• Administrative health and configuration views
• Responsive embedded chat interface
• WordPress nonces, capability checks, input sanitization, and output escaping

Architecture

Authenticated member
       |
       v
WordPress / WooCommerce
  - identity and roles
  - permissions and terms
  - signed JWT generation
       |
       v
Node.js + Socket.io service
  - rooms and presence
  - real-time messages
  - moderation events
       |
       v
Secret-authenticated WordPress REST routes
  - notifications
  - moderation configuration
  - permission lookups

Security model

• The browser receives a short-lived signed identity token; it never receives the shared service secret.
• Administrative actions require WordPress capabilities and CSRF protection.
• Service write routes compare the shared secret with hash_equals to avoid timing leaks.
• Data crossing the service boundary is still treated as untrusted and sanitized before use.
• Public deployments must define secrets outside source control in wp-config.php and the companion service environment.

See SECURITY.md for responsible-disclosure guidance and deployment cautions.

Local review

The current artifact is a single-file production snapshot. Before using it in another environment:

1. Review the configuration constants at the top of fism-community-chat.php.
2. Define secrets outside the repository.
3. Install and configure the companion Socket.io service.
4. Test permissions, terms acceptance, moderation, email delivery, and mobile behavior in staging.
5. Run WordPress coding-standard, static-analysis, and integration checks.

Roadmap for the public edition

• Split PHP, browser JavaScript, CSS, and templates into maintainable modules
• Add Composer autoloading and WordPress Coding Standards
• Add PHPUnit coverage for permissions, token claims, terms, and REST routes
• Add an end-to-end test harness with the companion Socket.io service
• Add GitHub Actions for linting, static analysis, and tests
• Publish the companion service and an architecture decision record

About the work

Built and maintained by Elijah Kelley as part of his responsibility for a production subscriber platform serving approximately 23,000 registered users.