Phoenix Channels Authorization Example

In the user_socket.ex, I do something like this

  def connect(%{"token" => token}, socket) do
    with {:ok, user_id} <- verify_token(token),
      user <- Accounting.get_user(user_id) do
      
      {:ok, assign(socket, :current_user, user)}
    else
      {:error, _reason} ->
        :error
    end
  end

I decode a token (a phoenix token), with this helper

  @salt "blah salt"
  @max_age 86400

  def verify_token(token), do:
    Phoenix.Token.verify(BlahWeb.Endpoint, @salt, token, max_age: @max_age)

Then, in the channel, I know I will get a user

  def join("user:" <> id, _params, socket) do
    if String.to_integer(id) === socket.assigns.current_user.id do
      {:ok, socket}
    else
      {:error, %{reason: "Not authorized"}}
    end
  end

In your case, You might just check for socket.assigns.current_user

I do the authentication in user_socket to get the user id.

Now in room_channel, to authorize the user, would it be a good idea to set the argument of authorized?/1 as socket.assigns.current_user?

def join("room:" <> room_id, payload, socket) do
 if authorized?(socket.assigns.current_user) do
  {:ok, socket}
 else
  {:error, "nope not authorized"}
 end
end

.

defp authorized?(useridpayload) do
 useridpayload = String.to_integer(useridpayload)
  ... repo get user role pseudocode..
  case role do
   "admin" -> true
   "user" -> true
    _ -> false
  end 
 end

That is what I do, I use socket.assigns.current_user as my authentication param…

Thanks for your help!