Presence channel auth signature omits channel_data — real Pusher backends are rejected

[stephenjason89]

Problem

Pusher signs presence channel auth as:

HMAC_SHA256("{socket_id}:{channel_name}:{channel_data}", app_secret)

isAuthorized in src/websocket.ts only ever signs socketId:channel:

const sha256 = generateHmacSHA256HexDigest(`${socketId}:${data.channel}`, String(import.meta.env.PUSHER_APP_SECRET))
return data.auth === `${import.meta.env.PUSHER_APP_KEY}:${sha256}`

Any unmodified Pusher auth backend (Laravel Broadcast::auth, pusher-http-node authorizeChannel, pusher-php-server presence_auth) includes channel_data in the signature, so BunPulse rejects every legitimate presence subscription. Presence channels currently only work if the backend implements BunPulse's non-standard signature — which defeats "drop-in replacement".

What's needed

• When channel_data is present (presence channels), verify against socket_id:channel:channel_data using the raw string as sent by the client
• Keep socket_id:channel for private channels
• Use a constant-time comparison for the signature check
• Add tests with signatures generated by a real server SDK

Reference: Pusher auth signature spec