fix(realtime): re-check access before workspace-list room joins too

The workspace-files / workspace-tables joins committed straight from their
authorize result, so a join that authorized just before a revocation could put
the socket back in a room the sweep had already evicted it from. Mirrors the
guard the file-doc and table joins already had.

Author: waleedlatif1

apps/realtime/src/handlers/workspace-invalidation-room.test.ts

@@ -19,6 +19,7 @@ vi.mock('@sim/platform-authz/rooms', () => ({
 }))
 
 import { setupWorkspaceInvalidationRoom } from '@/handlers/workspace-invalidation-room'
+import { recordRoomPermission } from '@/middleware/permissions'
 
 type Payload = { workspaceId?: string }
 
@@ -157,6 +158,30 @@ describe.each([ROOM_TYPES.WORKSPACE_FILES, ROOM_TYPES.WORKSPACE_TABLES] as const
       expect(roomManager.broadcastPresenceUpdate).not.toHaveBeenCalled()
     })
 
+    it('does not join when access was revoked while the join was in flight', async () => {
+      // The sweep records a revocation before it evicts, so a join whose authorize
+      // completed just before that must not put the socket back in the room.
+      const { handlers, socket } = createSocket({ id: 'socket-race', userId: 'user-race' })
+      setupWorkspaceInvalidationRoom(
+        socket as unknown as Parameters<typeof setupWorkspaceInvalidationRoom>[0],
+        createRoomManager(),
+        roomType
+      )
+
+      mockAuthorizeRoom.mockImplementation(async () => {
+        recordRoomPermission('user-race', { type: roomType, id: 'ws-race' }, null)
+        return { allowed: true, status: 200, workspaceId: 'ws-race', workspacePermission: 'admin' }
+      })
+
+      await handlers[joinEvent]({ workspaceId: 'ws-race' })
+
+      expect(socket.emit).toHaveBeenCalledWith(
+        errorEvent,
+        expect.objectContaining({ code: 'ACCESS_DENIED', retryable: false })
+      )
+      expect(socket.join).not.toHaveBeenCalled()
+    })
+
     it('leaves a previously-joined room when switching workspaces', async () => {
       const { socket, handlers, rooms } = createSocket()
       rooms.add(roomOf('ws-old'))

apps/realtime/src/handlers/workspace-invalidation-room.ts

@@ -1,8 +1,9 @@
 import { createLogger } from '@sim/logger'
-import { ROOM_MEMBERSHIP_ACTIONS } from '@sim/platform-authz/room-policy'
+import { ROOM_MEMBERSHIP_ACTIONS, satisfiesRoomMembership } from '@sim/platform-authz/room-policy'
 import { type RoomRef, type RoomType, roomName } from '@sim/realtime-protocol/rooms'
 import { resolveRoomJoinAuth } from '@/handlers/room-join-auth'
 import type { AuthenticatedSocket } from '@/middleware/auth'
+import { peekRoomPermission } from '@/middleware/permissions'
 import type { IRoomManager } from '@/rooms'
 
 const logger = createLogger('WorkspaceInvalidationRoom')
@@ -107,6 +108,22 @@ export function setupWorkspaceInvalidationRoom(
       // stale join can't leave the room the client has since switched to.
       if (joinGeneration !== joinAttempt || socket.disconnected) return
 
+      // Re-check the cached decision before committing: the access re-validation sweep
+      // records a revocation BEFORE it evicts, so a join that authorized just before the
+      // revocation must not complete afterwards and put the socket back in the room.
+      // `undefined` (nothing cached) is "unknown", never a denial — the authorize above
+      // is then the freshest word we have. Mirrors the file-doc and table joins.
+      const recheck = peekRoomPermission(socket.userId, ref)
+      if (recheck !== undefined && !satisfiesRoomMembership(recheck, roomType)) {
+        socket.emit(errorEvent, {
+          workspaceId,
+          error: 'Access denied to workspace',
+          code: 'ACCESS_DENIED',
+          retryable: false,
+        })
+        return
+      }
+
       // Leave any previously-joined room of this type (workspace switch), read straight from the
       // socket's native room membership so there's no presence store to keep in sync.
       const target = roomName(ref)