feat: add chat

internal/handler/broadcasting_auth.go

@@ -55,6 +55,22 @@ func NotificationsRule() ChannelRule {
 	}
 }
 
+// ConversationRule allows a caller to subscribe to a thread's channel only
+// while they are a participant. isParticipant is injected rather than taking a
+// repository dependency here, so the authorization check stays the service's
+// single source of truth.
+func ConversationRule(isParticipant func(ctx context.Context, userID, conversationID string) (bool, error)) ChannelRule {
+	return ChannelRule{
+		Prefix: "private-conversation.",
+		Authorize: func(ctx context.Context, userID, suffix string) (bool, error) {
+			if suffix == "" {
+				return false, nil
+			}
+			return isParticipant(ctx, userID, suffix)
+		},
+	}
+}
+
 type broadcastingAuthResp struct {
 	Auth        string `json:"auth"`
 	ChannelData string `json:"channel_data,omitempty"`