@geometra/auth — Example

Geometra's server is the rendering authority — it computes layout and streams geometry. @geometra/auth gates connections via token verification and gates messages via per-role policies, all at the WebSocket layer.

1 Connect as Admin — full access. Click the Increment button and watch the count update live.

2 Connect as Viewer — read-only. You see the same UI but click events are blocked by the server's role policy.

3 Invalid Token — connection refused. The server rejects the WebSocket handshake (code 4001).

How it works

Connection gating — client sends token as a query param. Server's verify() maps it to a role or rejects with close code 4001.
Message policies — each role has an allow/deny list for message types. The viewer policy is { allow: ['resize'] }, so click and key events never reach the app.
Protocol-level auth — because Geometra's server owns rendering, a viewer literally can't interact. There's no client-side UI to bypass; the server simply won't process blocked events.