ruby-on-rails - 使用 Pusherapp 的私有(private) channel (使用 Rails)

Question

我刚刚通过了 hello world对于 Pusherapp。现在我想创建私有(private) channel ，以便用户只阅读他们应该阅读的消息。

Pusher 文档仅提供了有关如何执行此操作的一些详细信息，我有点迷路了。

来自docs :

... The Pusher JS library is returned a socket_id when it connects to Pusher.

When it attempts to subscribe to a private channel, it sends back an AJAX request to your server with the channel_name and socket_id as parameters.

The default URL for this is http://yourserver.com/pusher/auth. ...

class PusherController < ApplicationController
  def auth
    if current_user
      response = Pusher[params[:channel_name]].authenticate(params[:socket_id])
      render :json => response
    else
      render :text => "Not authorized", :status => '403'
    end
  end
end

给定一个唯一的用户 ID (current_user.id)，我如何验证该用户然后让他/她订阅相应的 channel ？

谢谢

Answer 1

这篇关于实现的博文似乎解释得更多:https://pusher.com/docs/client_api_guide/client_private_channels

The authorization scheme is based on the idea that, rather than implementing custom user authentication, and adding complexity and state to pusher, we should trust the existing level of authentication offered by your application. We also wanted to ensure that someone reading data sent from your application to the browser would not be able to connect to a channel as that user, and therefore couldn't include any secrets in the page HTML.

听起来您的应用程序的业务逻辑应该对用户进行身份验证并决定他们应该访问私有(private) channel 。

他们的图表显示:

一旦通过身份验证，应用程序就会请求订阅用户。 Pusher 回复 socket_id。然后他们使用它连接。

他们是这样描述的:

As shown in this diagram, a unique socket id is generated and sent to the browser by Pusher. This is sent to your application (1) via an AJAX request which authorizes the user to access the channel against your existing authentication system. If successful your application returns an authorization string to the browser signed with you Pusher secret. This is sent to Pusher over the WebSocket, which completes the authorization (2) if the authorization string matches.

博文底部的例子进一步阐明了:

假设您有一个名为 project-3 的 channel ，用户 A 和 B 可以访问该 channel ，但 C 不能访问。您希望将此 channel 设为私有(private)，这样用户 C 就无法收听私有(private)事件。只需将事件发送到 private-project-3 并在浏览器中订阅即可。只要您使用的是最新的 javascript(1.3 或更高版本)，您就会看到向您的应用程序发送了一个 POST 请求到/pusher/auth。这目前会失败，因此不会向套接字发出订阅请求。

所以，对我来说这听起来像:1)订阅请求被发送到Pusher2) Pusher POSTs 到你的/auth 方法来确定用户是否可以访问该 channel 3)如果你的业务逻辑允许用户访问这个 channel ，auth方法返回“ok”响应:

auth = Pusher[params[:channel_name]].socket_auth(params[:socket_id])

    content_type 'application/json'
    return JSON.generate({
      :auth => auth
    })

我没有使用过 Pusher 本身，但它的模型似乎反射(reflect)了其他基于推送的模型的结构。希望这对您有所帮助!