Streaming: what happens, told as it happens

Mastodon's streaming API: /api/v1/streaming as a WebSocket (streams
subscribed in the URL or by message) and /api/v1/streaming/{stream} as
server-sent events, with health and the URL advertised. The user stream
tells posts reaching the persona's home (not those an exclusive list keeps
apart, which its list stream tells), notifications, edits and deletions;
public, hashtag and list streams tell what belongs in them. An in-process
hub carries ids only; each connection maps a post or a notification for its
own persona as it sends it, so nothing it may not see, or whose author it
blocked or muted, goes out. A deletion reaches only the streams that showed
the post. The token comes as access_token, header or WebSocket protocol.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Program.cs

@@ -154,10 +154,25 @@ try
 
 		app.UseRequestLocalization(await localizationService.Get());
 
+		app.UseWebSockets(new WebSocketOptions { KeepAliveInterval = TimeSpan.FromSeconds(30) });
 		app.UseRouting();
 		app.UseTrafficMeter();
 		app.UseRateLimiter();
 
+		// a stream's token may come as access_token or as the WebSocket's protocol, as Mastodon's clients send it
+		app.Use(async (context, next) =>
+		{
+			if (context.Request.Path.StartsWithSegments("/api/v1/streaming") && !context.Request.Headers.ContainsKey("Authorization"))
+			{
+				var token = context.Request.Query["access_token"].ToString();
+				if (string.IsNullOrEmpty(token))
+					token = context.Request.Headers["Sec-WebSocket-Protocol"].ToString();
+				if (!string.IsNullOrEmpty(token))
+					context.Request.Headers.Authorization = "Bearer " + token;
+			}
+			await next();
+		});
+
 		app.UseAuthentication();
 		app.UseAuthorization();
 		//app.UseWhen(context => context.Request.Path.StartsWithSegments("/peasants") ||