Short-lived, signed credentials to join one room as one actor.
Your LiveView signs a token after it has authenticated the person and
checked they may join; the browser joins the room's channel with it.
The token holds the actor's identity (Issho.Identity, with your
claims) and what it may do: :read or :write. A read token never
writes, whatever the browser sends.
token = Issho.Token.sign(MyApp.Issho, current_user, "board:42", can: :write)Tokens are good for joining for the instance's :token_max_age (300
seconds). The browser renews them through the LiveView before then; a
session already joined stays until it leaves, its access is revoked
(Issho.revoke/3), or the policy refuses it.
Summary
Functions
Signs a token for the actor to join the room. Options: :can (:write
or :read, :write unless given), :claims (a small map of your own
for the policy) and :on_behalf_of (the actor an agent acts for).
Verifies a token for the room. Gives {:ok, identity, can}, or
{:error, :expired | :invalid | :other_room}.
Functions
@spec sign(atom(), Issho.Actor.t() | Issho.Identity.t(), String.t(), keyword()) :: String.t()
Signs a token for the actor to join the room. Options: :can (:write
or :read, :write unless given), :claims (a small map of your own
for the policy) and :on_behalf_of (the actor an agent acts for).
@spec verify(atom(), String.t(), String.t()) :: {:ok, Issho.Identity.t(), :read | :write} | {:error, :expired | :invalid | :other_room}
Verifies a token for the room. Gives {:ok, identity, can}, or
{:error, :expired | :invalid | :other_room}.