fix(realtime): keep the join generation guard after the access re-check

The access re-resolve added in the previous commit sat AFTER the generation /
superseded guard in the table and workspace-list joins, so a leave or a newer
join landing during that await no longer cancelled the stale join — it would go
on to leave the room the client had switched to and commit the abandoned one.
The guard is now the last thing before the commit in all three handlers, as it
already was for file-doc and workflow.

Author: waleedlatif1

apps/realtime/src/handlers/tables.ts

@@ -256,10 +256,6 @@ export function setupTablesHandlers(socket: AuthenticatedSocket, roomManager: IR
         }
       }
 
-      // Final re-check before the membership commit: a LEAVE or a newer JOIN enqueued during the
-      // awaits above bumped the generation, or the socket disconnected. Abort before registering.
-      if (superseded()) return
-
       // Re-check access too: the access re-validation sweep records a revocation BEFORE
       // it evicts, so a join that authorized just before the revocation must not
       // complete afterwards and put the socket back in the room. RE-RESOLVES rather
@@ -277,6 +273,12 @@ export function setupTablesHandlers(socket: AuthenticatedSocket, roomManager: IR
         return
       }
 
+      // Final re-check before the membership commit: a LEAVE or a newer JOIN enqueued during the
+      // awaits above — including the access re-resolve — bumped the generation, or the socket
+      // disconnected. This is the LAST await before registering, so nothing can interleave
+      // between it and the commit.
+      if (superseded()) return
+
       socket.join(roomName(room))
 
       const presence: UserPresence = {

apps/realtime/src/handlers/workspace-invalidation-room.test.ts

@@ -158,6 +158,53 @@ describe.each([ROOM_TYPES.WORKSPACE_FILES, ROOM_TYPES.WORKSPACE_TABLES] as const
       expect(roomManager.broadcastPresenceUpdate).not.toHaveBeenCalled()
     })
 
+    it('aborts a join superseded during the access re-check await', async () => {
+      // The access re-resolve is an await like any other: a leave landing during it must
+      // still cancel this join, or the stale join would leave the room the client
+      // switched to and commit the abandoned one. Forced down the re-resolve's DB path
+      // by expiring the cached decision mid-join, so the interleaving is deterministic
+      // rather than dependent on microtask ordering.
+      vi.useFakeTimers()
+      try {
+        const { handlers, socket } = createSocket({ id: 'socket-sup', userId: 'user-sup' })
+        setupWorkspaceInvalidationRoom(
+          socket as unknown as Parameters<typeof setupWorkspaceInvalidationRoom>[0],
+          createRoomManager(),
+          roomType
+        )
+
+        let call = 0
+        mockAuthorizeRoom.mockImplementation(async () => {
+          call += 1
+          if (call === 1) {
+            // A later-started read commits, so this join's own decision is dropped; then
+            // the join stalls past the TTL so that decision is expired by re-check time.
+            commitRoomPermission(
+              'user-sup',
+              { type: roomType, id: 'ws-sup' },
+              'admin',
+              beginRoomPermissionRead()
+            )
+            await new Promise((resolve) => setTimeout(resolve, 31_000))
+          } else {
+            // Second call is the re-check's re-resolve: the client leaves during it.
+            handlers[leaveEvent]({ workspaceId: 'ws-sup' })
+          }
+          return { allowed: true, status: 200, workspaceId: 'ws-sup', workspacePermission: 'admin' }
+        })
+
+        const joining = handlers[joinEvent]({ workspaceId: 'ws-sup' })
+        await vi.advanceTimersByTimeAsync(31_000)
+        await joining
+
+        expect(call).toBe(2)
+        expect(socket.join).not.toHaveBeenCalled()
+        expect(socket.emit).not.toHaveBeenCalledWith(successEvent, expect.anything())
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
     it('does not join when access was revoked while the join was in flight', async () => {
       // The sweep records a revocation before it evicts, so a join whose authorize
       // completed just before that must not put the socket back in the room.

apps/realtime/src/handlers/workspace-invalidation-room.ts

@@ -104,10 +104,6 @@ export function setupWorkspaceInvalidationRoom(
       })
       if (!authorized) return
 
-      // A newer join started on this socket during authorize (or it dropped): abort so a
-      // stale join can't leave the room the client has since switched to.
-      if (joinGeneration !== joinAttempt || socket.disconnected) return
-
       // Re-check access before committing: the access re-validation sweep records a
       // revocation BEFORE it evicts, so a join that authorized just before the
       // revocation must not complete afterwards and put the socket back in the room.
@@ -130,6 +126,11 @@ export function setupWorkspaceInvalidationRoom(
         return
       }
 
+      // A newer join started on this socket during the awaits above — including the access
+      // re-resolve — or it dropped: abort so a stale join can't leave the room the client has
+      // since switched to. Last await before the commit, so nothing interleaves after it.
+      if (joinGeneration !== joinAttempt || socket.disconnected) return
+
       // Leave any previously-joined room of this type (workspace switch), read straight from the
       // socket's native room membership so there's no presence store to keep in sync.
       const target = roomName(ref)