websocket

type Conn struct {
	// contains filtered or unexported fields
}

type UpgradeConfig struct {
	// AllowedOrigins lists the origin patterns authorized for the upgrade.
	// Each entry must be an origin pattern in the form scheme://host[:port],
	// optionally with glob wildcards (e.g. "https://example.com",
	// "https://*.example.com", "http://*", "http://localhost:*"). Bare host
	// patterns (e.g. "example.com") are rejected because coder/websocket's
	// OriginPatterns matches against the request's Origin header, which
	// always carries a scheme — a bare host would never match a real
	// browser handshake and would silently disable origin checking.
	//
	// AllowedOrigins must be non-empty and must not contain the full
	// wildcard "*". The error-returning UpgradeHandler rejects invalid
	// configuration; UpgradeHandler returns an error for invalid configuration.
	// Validate normalizes whitespace in-place so that
	// the slice handed to coder/websocket is the exact one that passed
	// validation (no trim drift between check and runtime).
	AllowedOrigins []string

	// Authenticator validates the HTTP request before WebSocket upgrade.
	// Required (nil → ErrWebsocketAuthenticatorMissing at construction).
	//
	// The Authenticator runs BEFORE websocket.Accept; rejection writes a
	// plain-text 401 directly to the response writer (browser WebSocket APIs
	// cannot read the response body, so envelope JSON is meaningless).
	//
	// Composition root selects one of:
	//   - auth.NewJWTAuthenticator(verifier)        — token-via-Authorization-header
	//   - auth.NewContextAuthenticator()            — already authenticated by listener middleware
	//   - auth.NewAnonymousAuthenticator()          — explicit unauthenticated channel
	//   - custom auth.AuthenticatorFunc             — query-param / cookie / subprotocol token
	//
	// ref: coder/websocket accept.go — http.Error(w, err.Error(), code) before Accept
	Authenticator auth.Authenticator
}