authorize()

protected authorize(_token, _req?): readonly Claim[] | Promise<readonly Claim[]>

Policy seam: resolve a connection’s credential into its claims (grants). Called by the default webSocket once per connection — with the token the client attached with (or undefined for a client that never presented one) and the connection’s upgrade request, whose headers carry whatever an authenticating front door stamped on it. Return the claims to grant; throw to reject the connection. Claims are application-defined strings; the SDK itself only interprets "rpc", which a connection needs to invoke @rpc() methods remotely. The default admits every connection as a read-only watcher — it never grants "rpc", and it never validates the token (an unvalidated credential must not confer rights). Remote RPC therefore requires an explicit override that verifies the token and/or the request’s identity headers and grants "rpc" deliberately. Parameters Returns readonly Claim[] | Promise<readonly Claim[]> The claims granted to this connection. Default Value ["read"] — for every connection, token or not.

​

Claim

Claim = "read" | "rpc" | (string & {})

A capability a connection can be granted. Open-ended: custom claims allowed.