What problem does it solve? Adding WebSocket functionality to a Nodefony app by hand means losing routing by channel, shared HTTP authentication, and backpressure handling. This Skill guides you to add realtime streams through the framework's proper layer — a RealtimeController with channel decorators — and to close channels to specific roles instead of leaving them public by default. ## Core Features & Use Cases - Scaffold a realtime controller: Run npx nodefony create controller Ops --kind realtime to generate a RealtimeController subclass with a decorated channel and action, fully wired. - Channel and action authorization: Apply @RealtimeChannel and @RealtimeAction decorators with roles or authenticated policies, understanding that channel policy controls subscription while action policy controls invocation. - Avoid the dynamic channel name trap: Learn why channels with runtime-computed names (like room:${id}) are not covered by any declared policy and are born public. - Client-side subscription: Use RealtimeClient from nodefony/client (never the root nodefony import) to subscribe to channels in the browser, with React hooks available. - Use Case: You need to push live ops alerts only to administrators. Generate the controller, decorate the channel with { roles: ["ROLE_ADMIN"] }, subscribe from the client facade, and verify with three identities that anonymous and non-admin users receive nothing while the public scaffold channel still works. ## Quick Start Ask the AI to add a realtime channel named ops:alerts restricted to ROLE_ADMIN in your Nodefony application and show the client subscription code.
