Authorize

The Authorize type describes a function that decides whether a client may join a path on a WsServer, and if so, how.

(
  pathId: Id,
  request: IncomingMessage,
): ClientAccess | undefined | Promise<ClientAccess | undefined>

It is called with the Id of the path and the HTTP request that opened the client's WebSocket, from which you can read a token (from the URL query string, for example) or a cookie. It should return a ClientAccess object to let the client join, or undefined to refuse it. It can be asynchronous, and messages from the client are held until it has resolved. If it throws, the client is refused.

A refused client's WebSocket is closed with the code 1008. For a WebSocket that multiplexes several paths, it is called for each path the client subscribes to, and refusing any one of them closes the whole WebSocket.