@painda/auth (Enterprise)

Overview

The PPAuthMiddleware sits directly on top of the WebSocket connection layer. By acting as an interceptor, it validates JSON Web Tokens (JWT) or custom session objects before any application-level `onMessage` listeners are fired.

import { PPServer } from "@painda/core";
import { PPAuthMiddleware } from "@painda/auth";

const server = new PPServer({ port: 7000 });

// Secure the server with zero boilerplate
new PPAuthMiddleware(server, {
  validator: async (token) => {
    return await verifyJwt(token, process.env.JWT_SECRET);
  },
  allowGuest: false
});

Key Features

• Zero-Trust Architecture: Drops unauthenticated sockets instantly without burning CPU cycles parsing complex application messages.
• Context Injection: The validated user profile is automatically injected into the socket object: client.userContext.
• Guest Mode: Pass allowGuest: true to allow read-only connections or limited permissions.