Authenticate and authorize connections

A viewer may receive public events, while only an on-call operator can acknowledge an incident. That contrast gives us something useful to test instead of a rule to memorize.

Connection authentication establishes identity once; authorization still belongs at every privileged action and can change during a session. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

The happy path can hide a bad design: you can put a long-lived secret in the WebSocket URL and treat connection success as permanent authorization and still get one successful demo. Push past the demo. use secure handshake credentials, check origin where relevant, authorize each command, and close or refresh stale sessions, then test the condition most likely to prove the choice wrong.

The module is moving toward one outcome: Build a bidirectional operator channel with explicit messages, bounded queues, and observable connection state. Save the before-and-after evidence now; it will make the final project review much more honest.

Test an anonymous viewer, an operator, a revoked operator, and a cross-origin connection against the same channel. Save the evidence, then explain which requirement would force you to choose a different design.