Add Authorization Callback Support for WebSocket Subscriptions

Summary

Added optional authorize callback to enable server-side authorization checks before allowing WebSocket subscriptions. This allows applications to enforce access control policies on subscription requests.

Motivation

The WebSocket server previously accepted all subscription requests without authorization checks. Applications like Solid servers need to enforce ACL permissions before allowing clients to subscribe to resource updates.

Changes

Modified lib/server.js:

• Added authorize option to constructor (line 18)
• Integrated authorization check in message handler (lines 54-68)
• Calls authorize(iri, req, callback) before subscription
• Returns err <uri> forbidden when authorization denies access
• Returns ack <uri> when authorization allows subscription
• Backward compatible - if no authorize callback provided, subscriptions proceed as before

Usage

const SolidWs = require('solid-ws')

const pubsub = new SolidWs(server, {
  authorize: function(iri, req, callback) {
    // Custom authorization logic
    const allowed = checkPermissions(iri, req)
    callback(null, allowed)
  }
})

The authorize callback receives:

• iri - Resource URI being subscribed to
• req - HTTP upgrade request object
• callback(err, allowed) - Call with (null, true) to allow, (null, false) or (error) to deny

Tests

Added 3 authorization callback tests in test/websockets.js:

• ✅ should receive ack when authorization allows subscription
• ✅ should receive err when authorization denies subscription
• ✅ should receive err when authorization callback returns error

Test Results: 8 passing (82ms) - All existing tests remain passing

Compatibility

• ✅ Fully backward compatible - authorization is optional
• ✅ Existing code without authorize option works unchanged
• ✅ No breaking changes to API
• ✅ No new dependencies

Security

• Authorization checks occur before subscription is established
• Invalid subscriptions receive err <uri> forbidden message
• Authorization errors handled gracefully
• Request object available for authentication/authorization context