Websocket authorzation handler - return something that isn't `500`?

Question / help needed

I'm trying to get authorization working before connecting to websockets, which works, but I'm struggling to return an error message that isn't 500.

I've managed to make an auth handler, like so:

    connectHandler: {
      handler: 'handler.connectHandler',
      events: [
        {
          "websocket": {
            route: "$connect",
            authorizer: {
              name: "authHandler",
              identitySource: [
                // No identity source, leave it up to the handler
              ],
            },
          },
        },
      ],
      environment: {
        // ..
      },
    },

Any my authHandler:

export const authHandler = async (event, _context) => {
  console.log('🔑 Auth request received', event.requestContext)

  const token = event.headers.Authorization ?? event.queryStringParameters.Authorization;
  console.log('Token:', token)

  if (token !== 'secret') {
    return {
      statusCode: 401,
    }
  }

  return {
    "principalId": "user",
    "policyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "execute-api:Invoke",
          "Effect": "Allow",
          "Resource": event.methodArn
        }
      ]
    }
  };
}

Questions:

• what should I return in case of an error? Any request to my websocket-server that doesn't have the secret header/querystring returns 500 right now, and I'd prefer it to return a 4xx status code.

• what is the correct type for the authorization handler? I'm using APIGatewayProxyHandler on the other fn handlers which gives me nice inline errors.

  How my other handlers look like, which gives me pleasant TypeScript-errors when I do something wrong

  ```ts

  export const connectHandler: APIGatewayProxyHandler = async (event, _context) => {
  const connectionId = event.requestContext.connectionId!

  console.log('➕ Adding connection ', connectionId)

  await client.query('INSERT INTO "public"."Connection"("id") VALUES($1) RETURNING *', [connectionId])
  return {
  statusCode: 200,
  body: '',
  };
  }

  </details>

Start with the $connect websocket configuration and the authHandler return values, then compare them with the API Gateway authorizer contract and the observed 500 response. Done means the supported error status and TypeScript handler type are established for this example, with a reproducible check for requests lacking the secret.