chore(realtime): drop the test-only unguarded role-cache writer

Tests can express the same setup with commitRoomPermission + a read ticket, so
the cache has exactly one write path and no export without a production caller.

Author: waleedlatif1

apps/realtime/src/handlers/file-doc.test.ts

@@ -39,7 +39,7 @@ import {
   flushAllFileDocRooms,
   setupWorkspaceFileDocHandlers,
 } from '@/handlers/file-doc'
-import { recordRoomPermission } from '@/middleware/permissions'
+import { beginRoomPermissionRead, commitRoomPermission } from '@/middleware/permissions'
 
 type Handler = (payload?: unknown) => Promise<void> | void
 
@@ -255,7 +255,12 @@ describe('setupWorkspaceFileDocHandlers', () => {
     mockAuthorizeRoom.mockImplementation(async () => {
       // Simulate the revocation landing between this join's authorize and its commit,
       // exactly as the sweep would record it.
-      recordRoomPermission('user-race', { type: ROOM_TYPES.WORKSPACE_FILE_DOC, id: 'file-1' }, null)
+      commitRoomPermission(
+        'user-race',
+        { type: ROOM_TYPES.WORKSPACE_FILE_DOC, id: 'file-1' },
+        null,
+        beginRoomPermissionRead()
+      )
       return { allowed: true, status: 200, workspaceId: 'ws-1', workspacePermission: 'write' }
     })
 

apps/realtime/src/handlers/tables.test.ts

@@ -20,7 +20,7 @@ vi.mock('@sim/platform-authz/rooms', () => ({
 }))
 
 import { setupTablesHandlers } from '@/handlers/tables'
-import { recordRoomPermission } from '@/middleware/permissions'
+import { beginRoomPermissionRead, commitRoomPermission } from '@/middleware/permissions'
 
 const TABLE_ROOM = { type: ROOM_TYPES.TABLE, id: 'table-1' }
 
@@ -183,7 +183,12 @@ describe('setupTablesHandlers', () => {
     setupTablesHandlers(socket as unknown as SetupArg, roomManager)
 
     mockAuthorizeRoom.mockImplementation(async () => {
-      recordRoomPermission('user-race', { type: ROOM_TYPES.TABLE, id: 'table-race' }, null)
+      commitRoomPermission(
+        'user-race',
+        { type: ROOM_TYPES.TABLE, id: 'table-race' },
+        null,
+        beginRoomPermissionRead()
+      )
       return { allowed: true, status: 200, workspaceId: 'ws-1', workspacePermission: 'admin' }
     })
 

apps/realtime/src/handlers/workspace-invalidation-room.test.ts

@@ -19,7 +19,7 @@ vi.mock('@sim/platform-authz/rooms', () => ({
 }))
 
 import { setupWorkspaceInvalidationRoom } from '@/handlers/workspace-invalidation-room'
-import { recordRoomPermission } from '@/middleware/permissions'
+import { beginRoomPermissionRead, commitRoomPermission } from '@/middleware/permissions'
 
 type Payload = { workspaceId?: string }
 
@@ -169,7 +169,12 @@ describe.each([ROOM_TYPES.WORKSPACE_FILES, ROOM_TYPES.WORKSPACE_TABLES] as const
       )
 
       mockAuthorizeRoom.mockImplementation(async () => {
-        recordRoomPermission('user-race', { type: roomType, id: 'ws-race' }, null)
+        commitRoomPermission(
+          'user-race',
+          { type: roomType, id: 'ws-race' },
+          null,
+          beginRoomPermissionRead()
+        )
         return { allowed: true, status: 200, workspaceId: 'ws-race', workspacePermission: 'admin' }
       })
 

apps/realtime/src/middleware/permissions.ts

@@ -340,19 +340,6 @@ export function commitRoomPermission(
   commitRoleDecision(roleCacheKey(userId, room), permission, readSeq)
 }
 
-/**
- * Records a decision as the newest word, taking its read ticket at write time.
- * For callers that have just observed the authoritative state with no query of
- * their own to order against.
- */
-export function recordRoomPermission(
-  userId: string,
-  room: RoomRef,
-  permission: PermissionType | null
-): void {
-  recordRoleDecision(roleCacheKey(userId, room), permission, beginRoomPermissionRead())
-}
-
 /**
  * Live permission gate for mutating socket operations. Re-validates the user's workspace
  * role against the database (cached per pod for {@link ROLE_REVALIDATION_TTL_MS}) so that