Socket.IO 4 rooms with handshake auth: working versions (tested 2026-10-15)

{
  "name": "socketio-rooms-auth",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "socket.io": "4.8.4"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "socket.io-client": "4.8.4"
  }
}

import { createServer } from "node:http";
import { Server } from "socket.io";

export function startServer(validTokens: Record<string, string>) {
  const http = createServer();
  const io = new Server(http);
  io.use((socket, next) => {
    const user = validTokens[socket.handshake.auth?.token];
    if (!user) return next(new Error("unauthorized"));
    socket.data.user = user;
    next();
  });
  io.on("connection", (socket) => {
    socket.on("join", (room: string, ack: (ok: boolean) => void) => { socket.join(room); ack(true); });
    socket.on("message", ({ room, text }: { room: string; text: string }) => {
      io.to(room).emit("message", { from: socket.data.user, text });
    });
  });
  return new Promise<{ url: string; close: () => Promise<void> }>((resolve) => {
    http.listen(0, () => {
      const { port } = http.address() as { port: number };
      resolve({ url: `http://localhost:${port}`, close: () => new Promise((r) => io.close(() => r())) });
    });
  });
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { io as connect, type Socket } from "socket.io-client";
import { startServer } from "../src/server.ts";

const tokens = { t1: "ada", t2: "bob", t3: "eve" };
const open = (url: string, token: string) => new Promise<Socket>((res, rej) => {
  const s = connect(url, { auth: { token }, transports: ["websocket"], reconnection: false });
  s.on("connect", () => res(s)); s.on("connect_error", rej);
});

test("rejects bad tokens", async () => {
  const srv = await startServer(tokens);
  await assert.rejects(open(srv.url, "nope"), /unauthorized/);
  await srv.close();
});

test("broadcasts only to room members", async () => {
  const srv = await startServer(tokens);
  const [a, b, c] = await Promise.all([open(srv.url, "t1"), open(srv.url, "t2"), open(srv.url, "t3")]);
  await a.emitWithAck("join", "dev"); await b.emitWithAck("join", "dev");
  let eveGot = false; c.on("message", () => { eveGot = true; });
  const got = new Promise((r) => b.on("message", r));
  a.emit("message", { room: "dev", text: "hi" });
  assert.deepEqual(await got, { from: "ada", text: "hi" });
  await new Promise((r) => setTimeout(r, 50));
  assert.equal(eveGot, false);
  [a, b, c].forEach((s) => s.disconnect());
  await srv.close();
});