refactor(realtime): one shared eviction path for revoked room access

The sweep and both per-frame gates each open-coded emit + leave + local-state
cleanup. Route them all through evictSocketFromRoom so they cannot diverge on
what eviction means; workflow keeps its historical access-revoked payload.

Author: waleedlatif1

apps/realtime/src/access-revalidation.ts

@@ -1,10 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { ROOM_MEMBERSHIP_ACTIONS, satisfiesRoomMembership } from '@sim/platform-authz/room-policy'
-import {
-  type AccessRevokedBroadcast,
-  ROOM_ACCESS_REVOKED_EVENT,
-  type RoomAccessRevokedBroadcast,
-} from '@sim/realtime-protocol/events'
+import type { AccessRevokedBroadcast } from '@sim/realtime-protocol/events'
 import {
   parseRoomName,
   ROOM_TYPES,
@@ -13,7 +9,7 @@ import {
   roomName,
 } from '@sim/realtime-protocol/rooms'
 import { sleep } from '@sim/utils/helpers'
-import { runRoomEvictionHandler } from '@/handlers/room-eviction'
+import { evictSocketFromRoom, runRoomEvictionHandler } from '@/handlers/room-eviction'
 import type { AuthenticatedSocket } from '@/middleware/auth'
 import { ROLE_REVALIDATION_TTL_MS, resolveCurrentRoomPermission } from '@/middleware/permissions'
 import type { IRoomManager } from '@/rooms'
@@ -266,24 +262,20 @@ export function startAccessRevalidationSweep(roomManager: IRoomManager): AccessR
     // gates its document writes). Redis presence cleanup is only ENQUEUED here —
     // the cleanup lane performs that work, so eviction never blocks on it.
     if (room.type === ROOM_TYPES.WORKFLOW) {
+      // Workflow keeps its historical wire event and payload shape, which existing
+      // clients key off `workflowId`; every other type shares the generic path.
       const payload: AccessRevokedBroadcast = {
         workflowId: room.id,
         message: 'Your access to this workflow has been revoked',
         timestamp: Date.now(),
       }
       socket.emit('access-revoked', payload)
+      socket.leave(name)
+      runRoomEvictionHandler(socket.id, room, io)
+      logger.info(`Revoked live access for user ${socket.userId} on ${name} (socket ${socket.id})`)
     } else {
-      const payload: RoomAccessRevokedBroadcast = {
-        room,
-        message: 'Your access to this resource has been revoked',
-        timestamp: Date.now(),
-      }
-      socket.emit(ROOM_ACCESS_REVOKED_EVENT, payload)
+      evictSocketFromRoom(socket, room, 'Your access to this resource has been revoked', io)
     }
-    socket.leave(name)
-    runRoomEvictionHandler(socket.id, room, io)
-
-    logger.info(`Revoked live access for user ${socket.userId} on ${name} (socket ${socket.id})`)
 
     if (PRESENCE_ROOM_TYPES.has(room.type)) {
       pendingCleanups.set(`${socket.id}:${name}`, { socketId: socket.id, room })

apps/realtime/src/handlers/file-doc.ts

@@ -25,10 +25,6 @@
  */
 import { createLogger } from '@sim/logger'
 import { ROOM_MEMBERSHIP_ACTIONS, satisfiesRoomMembership } from '@sim/platform-authz/room-policy'
-import {
-  ROOM_ACCESS_REVOKED_EVENT,
-  type RoomAccessRevokedBroadcast,
-} from '@sim/realtime-protocol/events'
 import {
   FILE_DOC_EVENTS,
   FILE_DOC_MESSAGE_TYPE,
@@ -56,7 +52,7 @@ import {
   REDIS_ORIGIN,
   REDIS_SNAPSHOT_ORIGIN,
 } from '@/handlers/file-doc-store'
-import { registerRoomEvictionHandler } from '@/handlers/room-eviction'
+import { evictSocketFromRoom, registerRoomEvictionHandler } from '@/handlers/room-eviction'
 import { resolveRoomJoinAuth } from '@/handlers/room-join-auth'
 import type { AuthenticatedSocket } from '@/middleware/auth'
 import { peekRoomPermission, resolveCurrentRoomPermission } from '@/middleware/permissions'
@@ -851,29 +847,6 @@ function emitJoinError(
  */
 const FILE_DOC_ACTION = ROOM_MEMBERSHIP_ACTIONS[ROOM_TYPES.WORKSPACE_FILE_DOC]
 
-/**
- * Evicts a socket from its file-doc room: emit the revocation, leave the Socket.IO
- * room, and drop the pod-local binding + presence. Dropping `socketToRoomName` is
- * the load-bearing part — {@link handleMessage} gates every inbound frame on it, so
- * once it is gone the socket cannot apply another document update, even if it keeps
- * sending them.
- */
-function evictFromFileDoc(
-  socket: AuthenticatedSocket,
-  io: Server,
-  name: string,
-  fileId: string
-): void {
-  const payload: RoomAccessRevokedBroadcast = {
-    room: fileDocRoom(fileId),
-    message: 'Your access to this document has been revoked',
-    timestamp: Date.now(),
-  }
-  socket.emit(ROOM_ACCESS_REVOKED_EVENT, payload)
-  socket.leave(name)
-  cleanupFileDocForSocket(socket.id, io)
-}
-
 /**
  * Per-frame authorization for a socket's inbound document/awareness frames.
  *
@@ -909,7 +882,11 @@ function isFileDocWriteAllowed(socket: AuthenticatedSocket, io: Server, name: st
   logger.warn(
     `Dropping file-doc frame from user ${userId} whose access to file ${fileId} no longer permits writing`
   )
-  evictFromFileDoc(socket, io, name, fileId)
+  // Evicting (not just dropping the frame) is what makes this stick: the registered
+  // eviction handler clears `socketToRoomName`, and every inbound frame is gated on
+  // that binding — so the socket cannot apply another document update even if it
+  // keeps sending them.
+  evictSocketFromRoom(socket, room, 'Your access to this document has been revoked', io)
   return false
 }
 

apps/realtime/src/handlers/room-eviction.ts

@@ -1,6 +1,11 @@
 import { createLogger } from '@sim/logger'
-import type { RoomRef, RoomType } from '@sim/realtime-protocol/rooms'
+import {
+  ROOM_ACCESS_REVOKED_EVENT,
+  type RoomAccessRevokedBroadcast,
+} from '@sim/realtime-protocol/events'
+import { type RoomRef, type RoomType, roomName } from '@sim/realtime-protocol/rooms'
 import type { Server } from 'socket.io'
+import type { AuthenticatedSocket } from '@/middleware/auth'
 
 const logger = createLogger('RoomEviction')
 
@@ -40,3 +45,32 @@ export function runRoomEvictionHandler(socketId: string, room: RoomRef, io: Serv
     logger.warn(`Room eviction cleanup failed for socket ${socketId} on ${room.type}`, error)
   }
 }
+
+/**
+ * Evicts one socket from one non-workflow room after a confirmed loss of access:
+ * tell the client, stop it receiving room broadcasts, and drop the handler-local
+ * state that would otherwise still accept its frames.
+ *
+ * The single eviction path shared by both enforcement points — the periodic
+ * re-validation sweep and the per-frame gates that catch a revocation first — so
+ * they cannot diverge on what "evicted" means. Everything here is synchronous and
+ * pod-local; any Redis presence removal is the caller's own follow-up (the sweep
+ * owns a retrying cleanup lane for it).
+ *
+ * Workflow rooms keep their own `access-revoked` wire event for client
+ * compatibility and are deliberately not routed through here.
+ */
+export function evictSocketFromRoom(
+  socket: AuthenticatedSocket,
+  room: RoomRef,
+  message: string,
+  io: Server
+): void {
+  const payload: RoomAccessRevokedBroadcast = { room, message, timestamp: Date.now() }
+  socket.emit(ROOM_ACCESS_REVOKED_EVENT, payload)
+  socket.leave(roomName(room))
+  runRoomEvictionHandler(socket.id, room, io)
+  logger.info(
+    `Revoked live access for user ${socket.userId} on ${roomName(room)} (socket ${socket.id})`
+  )
+}

apps/realtime/src/handlers/tables.ts

@@ -1,9 +1,5 @@
 import { createLogger } from '@sim/logger'
 import { ROOM_MEMBERSHIP_ACTIONS, satisfiesRoomMembership } from '@sim/platform-authz/room-policy'
-import {
-  ROOM_ACCESS_REVOKED_EVENT,
-  type RoomAccessRevokedBroadcast,
-} from '@sim/realtime-protocol/events'
 import { ROOM_TYPES, type RoomRef, roomName } from '@sim/realtime-protocol/rooms'
 import {
   type JoinTablePayload,
@@ -12,6 +8,7 @@ import {
   type TableCellSelection,
 } from '@sim/realtime-protocol/table-presence'
 import { resolveAvatarUrl } from '@/handlers/avatar'
+import { evictSocketFromRoom } from '@/handlers/room-eviction'
 import { resolveRoomJoinAuth } from '@/handlers/room-join-auth'
 import type { AuthenticatedSocket } from '@/middleware/auth'
 import { peekRoomPermission, resolveCurrentRoomPermission } from '@/middleware/permissions'
@@ -92,24 +89,17 @@ function normalizeCellSelection(cell: unknown): TableCellSelection | undefined {
 }
 
 /**
- * Evicts a socket from a table room after a confirmed loss of access: emit the
- * revocation, leave the Socket.IO room, and drop its presence so peers stop seeing
- * its selection. Best-effort on the presence half — the socket has already left the
- * room, and the sweep's cleanup lane retries any removal that fails here.
+ * Evicts a socket from a table room after a confirmed loss of access, then drops
+ * its presence so peers stop seeing its selection. The presence half is
+ * best-effort — the socket has already left the room, and the sweep's cleanup lane
+ * retries any removal that fails here.
  */
 async function evictFromTable(
   socket: AuthenticatedSocket,
   roomManager: IRoomManager,
   room: RoomRef
 ): Promise<void> {
-  const payload: RoomAccessRevokedBroadcast = {
-    room,
-    message: 'Your access to this table has been revoked',
-    timestamp: Date.now(),
-  }
-  socket.emit(ROOM_ACCESS_REVOKED_EVENT, payload)
-  socket.leave(roomName(room))
-  logger.warn(`Evicted user ${socket.userId} from table room ${room.id}: access revoked`)
+  evictSocketFromRoom(socket, room, 'Your access to this table has been revoked', roomManager.io)
   try {
     await roomManager.removeUserFromRoom(room, socket.id)
     await roomManager.broadcastPresenceUpdate(room, socket.id)