[waleedlatif1]

Summary

• A member whose permission group withholds the Files module (hideFilesTab) was refused by every HTTP file operation but could still join a workspace file's collaborative document room over the socket, receive the file's content as the seed, and write edits that persist to the file. Room authorization checked only the workspace role and never files.use.
• The relay now asks the app to authorize workspace document rooms at join and on every revalidation, the same way Project rooms already work. Only the app can resolve the permission group, because that depends on billing governance and deployment flags. A new internal route, POST /api/internal/file-doc/access, returns authorizeRoom plus the files.use capability.
• Withdrawing Files mid-session evicts the member on the next revalidation sweep, and their writes are refused from that point.
• A refusal is a 200 body decision, not an HTTP status. While the app and relay roll out separately, an app without the route answers 404. The relay treats that as an outage: the join error is retryable, writes are held, and nobody is evicted. It does not read it as "file deleted".
• The realtime protocol's room-authority table now declares the workspace-file-doc authority, and admission and revalidation both dispatch on it through one authorizeRoomAccess.
• Not gated:
  • Workspace list, table, and table-list rooms only carry invalidation pings and presence, never content.
  • The seed and persist relay calls stay shared-secret only. Persist's userId attributes the last editor of a shared doc, so gating it would block co-editors' saves.

Type of Change

• Bug fix

Testing

• apps/sim/lib/collab-doc/access.integration.ts (real Postgres; new):
  • A Files-restricted writer is refused by the room authorizer exactly where files.read_metadata refuses.
  • The route checks: 401 without the secret, refusal returned in the body, otherwise the role.
  • Red when the capability check is disabled.
• apps/realtime/src/handlers/file-doc-capabilities.integration.ts (Socket.IO + Redis + Postgres; new checks):
  • Refused at join.
  • Withdrawal evicts on revalidation.
  • An app that predates the route holds the room instead of revoking it.
  • Red when the relay's workspace-document branch is removed.
• Realtime unit suite 197/197; realtime-protocol tests; tsc for realtime and realtime-protocol.
• One stale-cache unit test was repaired so it fails if the re-read allows.
• check:boundaries, check:api-validation:strict, check:permission-group-enforcement, check:utils, check:comment-hygiene, check:test-patterns, check:explicit-any, check:file-names, check:source-conventions, and biome on changed files.
• Not run locally: full type-check, check:audits, and root bun run test. CI covers them.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 2, 2026 8:43pm UTC

[cubic-dev-ai]

No issues found across 12 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no new actionable issues.

Summary

Workspace document rooms now check files.use through the app at join and during access rechecks.

• Workspace file rooms check the Files capability before sharing documents.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Join or access recheck] --> B[Relay asks app for document access]
  B --> C{Workspace access and Files allowed?}
  C -->|Yes| D[Return current role]
  C -->|No| E[Return denial in response body]
  E --> F[Refuse join or remove member]
  B -->|Request fails or route is missing| G[Retry without recording a denial]

Loading

_{Reviews (2) · Last reviewed commit: "fix(realtime): pass the route context in..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 12 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}