fix(files): recheck access after content-room admission

Author: waleedlatif1

apps/realtime/src/handlers/file-doc.test.ts

@@ -1308,6 +1308,73 @@ describe('setupWorkspaceFileDocHandlers', () => {
     }
   )
 
+  it.each(['revoked', 'expired', 'unchanged'] as const)(
+    'checks %s access after an asynchronous content-room join',
+    async (access) => {
+      mockFetchFileDocSeed.mockResolvedValue(seedResult('# Private', 'doc-private'))
+      const { io } = createIo()
+      const memberships = new Set<string>()
+      let finishSubscription!: () => void
+      const subscription = new Promise<void>((resolve) => {
+        finishSubscription = resolve
+      })
+      const pending = setup('socket-content-subscription-access', io, {
+        join: vi.fn((name: string) => {
+          if (name === ROOM_NAME)
+            return subscription.then(() => {
+              memberships.add(name)
+            })
+          memberships.add(name)
+        }),
+        leave: vi.fn((name: string) => memberships.delete(name)),
+      })
+      const clock = vi.spyOn(Date, 'now')
+      const joining = pending.handlers[FILE_DOC_EVENTS.JOIN]({ fileId: 'file-1', clientId: 1 })
+      try {
+        await vi.waitFor(() => expect(pending.socket.join).toHaveBeenCalledWith(ROOM_NAME))
+        expect(joinSuccessFileId(pending.socket)).toBeUndefined()
+        if (access === 'revoked') {
+          commitRoomPermission(
+            'user-1',
+            { type: ROOM_TYPES.WORKSPACE_FILE_DOC, id: 'file-1' },
+            'read',
+            beginRoomPermissionRead()
+          )
+        } else if (access === 'expired') {
+          clock.mockReturnValue(Date.now() + ROLE_REVALIDATION_TTL_MS + 1)
+        }
+        finishSubscription()
+        await joining
+        expect(memberships.has(fileDocAdmissionRoom('file-1'))).toBe(false)
+        expect(memberships.has(ROOM_NAME)).toBe(access === 'unchanged')
+        if (access === 'unchanged') {
+          expect(joinSuccessFileId(pending.socket)).toBe('file-1')
+        } else {
+          expect(joinSuccessFileId(pending.socket)).toBeUndefined()
+          expect(pending.socket.emit).toHaveBeenCalledWith(
+            FILE_DOC_EVENTS.JOIN_ERROR,
+            expect.objectContaining({
+              code: access === 'revoked' ? 'ACCESS_DENIED' : 'JOIN_FAILED',
+              retryable: access === 'expired',
+            })
+          )
+          expect(pending.socket.emit).not.toHaveBeenCalledWith(
+            FILE_DOC_EVENTS.MESSAGE,
+            expect.anything()
+          )
+          expect(pending.socket.emit).not.toHaveBeenCalledWith(
+            FILE_DOC_EVENTS.PRESENCE,
+            expect.anything()
+          )
+        }
+      } finally {
+        clock.mockRestore()
+        finishSubscription()
+        await joining
+      }
+    }
+  )
+
   it('keeps a shared provisional subscription until the other provider finishes joining', async () => {
     mockFetchFileDocSeed.mockResolvedValue(seedResult('# Shared', 'doc-shared'))
     const { io } = createIo()

apps/realtime/src/handlers/file-doc.ts

@@ -1441,6 +1441,20 @@ export function setupWorkspaceFileDocHandlers(
         !socket.disconnected &&
         joinGeneration.get(socket.id) === generation &&
         fileDocRooms.get(name) === entry
+      const canRegisterJoin = () => {
+        if (!isCurrentJoin()) return false
+        const permission = peekRoomPermission(userId, room)
+        if (satisfiesRoomMembership(permission ?? null, ROOM_TYPES.WORKSPACE_FILE_DOC)) return true
+        emitJoinError(
+          socket,
+          fileId,
+          clientId,
+          'File access changed while joining',
+          permission === undefined ? 'JOIN_FAILED' : 'ACCESS_DENIED',
+          permission === undefined
+        )
+        return false
+      }
       try {
         // A client is attached to a WHOLE document or to nothing. A room assembles itself from the
         // shared stream and the server seed, and both land in the same Y.Doc that fans every update out
@@ -1495,22 +1509,10 @@ export function setupWorkspaceFileDocHandlers(
           )
           return
         }
-        /** The generation read may wait; a revoked or expired access decision must not admit content. */
-        const membershipPermission = peekRoomPermission(userId, room)
-        if (!satisfiesRoomMembership(membershipPermission ?? null, ROOM_TYPES.WORKSPACE_FILE_DOC)) {
-          emitJoinError(
-            socket,
-            fileId,
-            clientId,
-            'File access changed while joining',
-            membershipPermission === undefined ? 'JOIN_FAILED' : 'ACCESS_DENIED',
-            membershipPermission === undefined
-          )
-          return
-        }
+        if (!canRegisterJoin()) return
         await socket.join(name)
-        /** An asynchronous adapter join can be superseded by a leave, switch, or disconnect. */
-        if (!isCurrentJoin()) return
+        /** Adapter joins can wait; recheck access and liveness before ownership or synchronization. */
+        if (!canRegisterJoin()) return
 
         // A client id must be owned by at most one user, or a peer could bind an active
         // collaborator's id and pass the per-frame ownership check to spoof/clear its caret.