Presence state computed from server connection state, not forgeable client heartbeats

Presence derived from client-controlled heartbeats can be forged: a disconnected or banned user can keep pinging to appear online, and a connected user can simply stop sending heartbeats to appear offline. CWE-287 (Improper Authentication) and OWASP A07 identify any system that trusts client-reported state for security decisions as broken. In a community platform, forged presence undermines moderation dashboards, violates user expectations about who can see them, and breaks features like "last seen" timestamps that users rely on to make trust decisions.

Derive presence exclusively from server-observed connection events — connection and disconnect. Never update presence in response to a client-emitted event.

const presence = new Map<string, 'online' | 'offline'>();

io.on('connection', (socket) => {
  presence.set(socket.userId, 'online');
  io.emit('presence_update', { userId: socket.userId, status: 'online' });

  socket.on('disconnect', () => {
    presence.set(socket.userId, 'offline');
    io.emit('presence_update', { userId: socket.userId, status: 'offline', lastSeen: Date.now() });
  });

  // Never handle a 'set_status' event from the client
});

If users need a voluntary "Do Not Disturb" status, store it as a separate preference field — it must not override the authoritative online/offline derived from connection state.