VibeConnect
- Challenge
- Two transports (REST + WebSocket) had to agree on state, and an unauthenticated client couldn't be allowed to subscribe to a live channel.
- Technical Decision
- JWT is verified at the Socket.io handshake itself, not inherited from the REST session — writes land in MongoDB before they broadcast.
- Result
- Real-time and REST auth share the same boundary; a dropped broadcast never desyncs a client, since a refresh always re-reads the same MongoDB truth.