You can choose between a server-side and a client-side strategy.
If you process the events on the client side, before deciding whether to display them or not, a hacker could bypass the JavaScript code and get all the events. On the other hand, if you enforce your routing policies on the server side, only the right events will be delivered to the right people.
For the client-side strategy, you can manipulate incoming events through the
onItemUpdateand
onChangingValues callbacks.
For the server-side strategy, you can use your Metadata Adapter to decide which item names each specific user can actually subscribe to, based on the sending party. Consider that the Metadata Adapter is responsible for all the aspects concerning authentication, authorization, entitlement, etc., so it's the best place where to implement your logic.
