@jacktea/pdf-viewer-server 0.1.3

package/dist/server.js

@@ -0,0 +1,928 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const socket_io_1 = require("socket.io");
+const http_1 = require("http");
+// ============================================================================
+// Configuration
+// ============================================================================
+/**
+ * Server configuration from environment variables
+ */
+const config = {
+    port: process.env.PORT ? parseInt(process.env.PORT, 10) : 3000,
+    /**
+     * CORS allowed origins - comma-separated list or "*" for development only
+     * Example: "https://example.com,https://app.example.com"
+     */
+    corsOrigins: process.env.CORS_ORIGINS || "http://localhost:5173",
+    /**
+     * Whether to allow any origin (development mode only)
+     * WARNING: Do not enable in production!
+     */
+    allowAllOrigins: process.env.ALLOW_ALL_ORIGINS === "true",
+    /**
+     * Room cleanup timeout in milliseconds (default: 5 minutes)
+     */
+    roomCleanupTimeout: parseInt(process.env.ROOM_CLEANUP_TIMEOUT || "300000", 10),
+    /**
+     * Whether websocket collaboration requires authentication token.
+     */
+    requireAuth: process.env.REQUIRE_AUTH === "true",
+    /**
+     * Default role when authentication is not required and no token role is resolved.
+     * Allowed values: "user" | "viewer". Falls back to "user".
+     */
+    defaultRole: getDefaultRole(process.env.DEFAULT_USER_ROLE),
+    /**
+     * Token-to-role mapping. Format:
+     * COLLAB_AUTH_TOKENS="tokenA:admin,tokenB:user,tokenC:viewer"
+     */
+    authTokenRoles: parseAuthTokenRoles(process.env.COLLAB_AUTH_TOKENS || ""),
+};
+function parseUserRole(input) {
+    if (input === "admin" || input === "user" || input === "viewer") {
+        return input;
+    }
+    return undefined;
+}
+function getDefaultRole(input) {
+    const parsed = parseUserRole(input);
+    if (parsed === "viewer")
+        return "viewer";
+    return "user";
+}
+function parseAuthTokenRoles(raw) {
+    const entries = raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    const mapping = new Map();
+    for (const entry of entries) {
+        const separatorIndex = entry.indexOf(":");
+        if (separatorIndex <= 0)
+            continue;
+        const token = entry.slice(0, separatorIndex).trim();
+        const role = parseUserRole(entry.slice(separatorIndex + 1).trim());
+        if (!token || !role)
+            continue;
+        mapping.set(token, role);
+    }
+    return mapping;
+}
+function resolveRoleForConnection(token) {
+    const tokenRole = token ? config.authTokenRoles.get(token) : undefined;
+    if (config.requireAuth && !tokenRole) {
+        return null;
+    }
+    return tokenRole ?? config.defaultRole;
+}
+function readHandshakeTokenValue(value) {
+    if (typeof value === "string" && value.trim()) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (typeof entry === "string" && entry.trim()) {
+                return entry;
+            }
+        }
+    }
+    return undefined;
+}
+function getHandshakeAuthToken(socket) {
+    const queryToken = readHandshakeTokenValue(socket.handshake.query.authToken);
+    if (queryToken)
+        return queryToken;
+    return readHandshakeTokenValue(socket.handshake.auth?.authToken);
+}
+/**
+ * Parse CORS origins configuration
+ */
+function getCorsOrigins() {
+    if (config.allowAllOrigins) {
+        console.warn("[Security Warning] ALLOW_ALL_ORIGINS is enabled. Do not use in production!");
+        return "*";
+    }
+    const origins = config.corsOrigins.split(",").map(o => o.trim()).filter(Boolean);
+    return origins.length === 1 ? origins[0] : origins;
+}
+const httpServer = (0, http_1.createServer)();
+const io = new socket_io_1.Server(httpServer, {
+    cors: {
+        origin: getCorsOrigins(),
+        methods: ["GET", "POST"],
+        credentials: true,
+    },
+    // Heartbeat configuration for connection health detection
+    pingInterval: 25000, // Send ping every 25 seconds
+    pingTimeout: 20000, // Wait 20 seconds for pong response
+});
+// ============================================================================
+// State Management
+// ============================================================================
+// In-memory store (consider Redis for production)
+const rooms = new Map();
+// Room cleanup timers
+const roomCleanupTimers = new Map();
+/**
+ * Get or create a room
+ */
+function getOrCreateRoom(documentId) {
+    let room = rooms.get(documentId);
+    if (!room) {
+        room = {
+            annotations: [],
+            comments: [],
+            users: [],
+            mode: "normal",
+            createdAt: Date.now(),
+            lastActivityAt: Date.now(),
+        };
+        rooms.set(documentId, room);
+    }
+    return room;
+}
+/**
+ * Update room activity timestamp
+ */
+function touchRoom(documentId) {
+    const room = rooms.get(documentId);
+    if (room) {
+        room.lastActivityAt = Date.now();
+    }
+}
+/**
+ * Schedule room cleanup when empty
+ */
+function scheduleRoomCleanup(documentId) {
+    // Clear existing timer
+    const existingTimer = roomCleanupTimers.get(documentId);
+    if (existingTimer) {
+        clearTimeout(existingTimer);
+    }
+    // Schedule new cleanup
+    const timer = setTimeout(() => {
+        const room = rooms.get(documentId);
+        if (room && room.users.length === 0) {
+            rooms.delete(documentId);
+            roomCleanupTimers.delete(documentId);
+            console.log(`[${new Date().toISOString()}] Room ${documentId} cleaned up after inactivity`);
+        }
+    }, config.roomCleanupTimeout);
+    roomCleanupTimers.set(documentId, timer);
+}
+/**
+ * Cancel scheduled room cleanup
+ */
+function cancelRoomCleanup(documentId) {
+    const timer = roomCleanupTimers.get(documentId);
+    if (timer) {
+        clearTimeout(timer);
+        roomCleanupTimers.delete(documentId);
+    }
+}
+// ============================================================================
+// Permission Helpers
+// ============================================================================
+const DEFAULT_POLICY = {
+    rules: [
+        { effect: "allow", actions: "*", roles: ["admin"] },
+        {
+            effect: "allow",
+            actions: ["annotation.view", "comment.view"],
+            roles: ["viewer"],
+        },
+        {
+            effect: "allow",
+            actions: [
+                "annotation.view",
+                "annotation.create",
+                "annotation.comment.create",
+                "comment.view",
+            ],
+            roles: ["user"],
+        },
+        {
+            effect: "allow",
+            actions: ["annotation.update", "annotation.delete"],
+            roles: ["user"],
+            owner: true,
+        },
+        {
+            effect: "allow",
+            actions: [
+                "comment.update",
+                "comment.delete",
+                "comment.reply",
+                "thread.resolve",
+                "thread.reopen",
+            ],
+            roles: ["user"],
+            owner: true,
+        },
+    ],
+};
+function isViewAction(action) {
+    return action === "annotation.view" || action === "comment.view";
+}
+function actionMatches(rule, action) {
+    if (rule.actions === "*")
+        return true;
+    return rule.actions.includes(action);
+}
+function principalMatches(rule, userId, roles) {
+    const hasRoleConstraint = Array.isArray(rule.roles) && rule.roles.length > 0;
+    const hasUserConstraint = Array.isArray(rule.users) && rule.users.length > 0;
+    const roleMatched = !hasRoleConstraint || rule.roles.some((role) => roles.includes(role));
+    const userMatched = !hasUserConstraint || rule.users.includes(userId);
+    return roleMatched && userMatched;
+}
+function ownerMatches(rule, ownerId, userId) {
+    if (!rule.owner)
+        return true;
+    return Boolean(ownerId && ownerId === userId);
+}
+function evaluateRuleSet(rules, action, userId, roles, ownerId) {
+    if (!rules || rules.length === 0)
+        return undefined;
+    let hasAllow = false;
+    for (const rule of rules) {
+        if (!actionMatches(rule, action))
+            continue;
+        if (!principalMatches(rule, userId, roles))
+            continue;
+        if (!ownerMatches(rule, ownerId, userId))
+            continue;
+        if (rule.effect === "deny") {
+            return "deny";
+        }
+        hasAllow = true;
+    }
+    return hasAllow ? "allow" : undefined;
+}
+function evaluatePermission(options) {
+    const roles = [options.userRole ?? "user"];
+    if (options.previewMode && !isViewAction(options.action)) {
+        return { allowed: false, reason: "preview_mode" };
+    }
+    const resourceDecision = evaluateRuleSet(options.resourcePolicy?.rules, options.action, options.userId, roles, options.ownerId);
+    if (resourceDecision === "deny")
+        return { allowed: false, reason: "resource_explicit_deny" };
+    if (resourceDecision === "allow")
+        return { allowed: true };
+    const globalDecision = evaluateRuleSet(DEFAULT_POLICY.rules, options.action, options.userId, roles, options.ownerId);
+    if (globalDecision === "deny")
+        return { allowed: false, reason: "global_explicit_deny" };
+    if (globalDecision === "allow")
+        return { allowed: true };
+    return { allowed: false, reason: "no_matching_allow" };
+}
+function buildAnnotationCapabilities(annotation, userId, userRole, previewMode) {
+    return {
+        view: evaluatePermission({
+            action: "annotation.view",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        update: evaluatePermission({
+            action: "annotation.update",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        delete: evaluatePermission({
+            action: "annotation.delete",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        commentCreate: evaluatePermission({
+            action: "annotation.comment.create",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        resolveThread: evaluatePermission({
+            action: "thread.resolve",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        reopenThread: evaluatePermission({
+            action: "thread.reopen",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+    };
+}
+function buildCommentCapabilities(comment, annotation, userId, userRole, previewMode) {
+    const canReply = evaluatePermission({
+        action: "comment.reply",
+        userId,
+        userRole,
+        ownerId: comment.authorId,
+        resourcePolicy: comment.acl,
+        previewMode,
+    }).allowed;
+    return {
+        view: evaluatePermission({
+            action: "comment.view",
+            userId,
+            userRole,
+            ownerId: comment.authorId,
+            resourcePolicy: comment.acl,
+            previewMode,
+        }).allowed,
+        update: evaluatePermission({
+            action: "comment.update",
+            userId,
+            userRole,
+            ownerId: comment.authorId,
+            resourcePolicy: comment.acl,
+            previewMode,
+        }).allowed,
+        delete: evaluatePermission({
+            action: "comment.delete",
+            userId,
+            userRole,
+            ownerId: comment.authorId,
+            resourcePolicy: comment.acl,
+            previewMode,
+        }).allowed,
+        reply: canReply,
+    };
+}
+function buildThreadCapabilities(annotation, thread, userId, userRole, previewMode) {
+    return {
+        resolve: evaluatePermission({
+            action: "thread.resolve",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+        reopen: evaluatePermission({
+            action: "thread.reopen",
+            userId,
+            userRole,
+            ownerId: annotation.metadata.authorId,
+            resourcePolicy: annotation.metadata.acl,
+            previewMode,
+        }).allowed,
+    };
+}
+function sanitizeAnnotationPayload(input) {
+    const { capabilities: _capabilities, ...annotation } = input;
+    return {
+        ...annotation,
+        metadata: {
+            ...annotation.metadata,
+        },
+    };
+}
+function sanitizeCommentPayload(input) {
+    const { capabilities: _capabilities, ...comment } = input;
+    return {
+        ...comment,
+    };
+}
+function buildSyncPayload(room, userId, userRole) {
+    const visibleAnnotations = [];
+    for (const annotation of room.annotations) {
+        const capabilities = buildAnnotationCapabilities(annotation, userId, userRole, room.mode === "preview");
+        if (!capabilities.view) {
+            continue;
+        }
+        visibleAnnotations.push({
+            ...annotation,
+            capabilities,
+        });
+    }
+    const visibleAnnotationMap = new Map(visibleAnnotations.map((annotation) => [annotation.id, annotation]));
+    const visibleThreads = [];
+    for (const thread of room.comments) {
+        const annotation = visibleAnnotationMap.get(thread.targetAnnotationId);
+        if (!annotation)
+            continue;
+        const visibleComments = [];
+        for (const comment of thread.comments) {
+            const capabilities = buildCommentCapabilities(comment, annotation, userId, userRole, room.mode === "preview");
+            if (!capabilities.view) {
+                continue;
+            }
+            visibleComments.push({
+                ...comment,
+                capabilities,
+            });
+        }
+        visibleThreads.push({
+            ...thread,
+            comments: visibleComments,
+            capabilities: buildThreadCapabilities(annotation, thread, userId, userRole, room.mode === "preview"),
+        });
+    }
+    return {
+        annotations: visibleAnnotations,
+        comments: visibleThreads,
+        activeUsers: room.users,
+        documentMode: room.mode,
+    };
+}
+function canSetDocumentMode(userRole) {
+    return userRole === "admin";
+}
+/**
+ * Validate annotation change payload
+ */
+function isValidAnnotationChange(change) {
+    if (!change || typeof change !== "object")
+        return false;
+    const c = change;
+    const validTypes = ["add", "update", "remove"];
+    return typeof c.type === "string" && validTypes.includes(c.type);
+}
+/**
+ * Validate comment change payload
+ */
+function isValidCommentChange(change) {
+    if (!change || typeof change !== "object")
+        return false;
+    const c = change;
+    const validTypes = ["add", "update", "remove"];
+    return typeof c.type === "string" && validTypes.includes(c.type);
+}
+function toTimestamp(value) {
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (!trimmed)
+            return undefined;
+        const asNumber = Number(trimmed);
+        if (Number.isFinite(asNumber)) {
+            return asNumber;
+        }
+        const parsed = Date.parse(trimmed);
+        if (!Number.isNaN(parsed)) {
+            return parsed;
+        }
+    }
+    return undefined;
+}
+io.use((socket, next) => {
+    if (!config.requireAuth) {
+        next();
+        return;
+    }
+    const authToken = getHandshakeAuthToken(socket);
+    const resolvedRole = resolveRoleForConnection(authToken);
+    if (!resolvedRole) {
+        console.warn(`[${new Date().toISOString()}] Unauthorized handshake: socket=${socket.id}, ip=${socket.handshake.address}`);
+        next(new Error("Unauthorized collaboration connection"));
+        return;
+    }
+    next();
+});
+// ============================================================================
+// Socket Event Handlers
+// ============================================================================
+io.on("connection", (socket) => {
+    console.log(`[${new Date().toISOString()}] New connection: ${socket.id}`);
+    // Error handling for this socket
+    socket.on("error", (error) => {
+        console.error(`[${new Date().toISOString()}] Socket error for ${socket.id}:`, error.message);
+    });
+    socket.on("join-document", ({ documentId, user, token }) => {
+        // Validate input
+        if (!documentId || typeof documentId !== "string") {
+            socket.emit("error", { message: "Invalid document ID" });
+            return;
+        }
+        if (!user || typeof user.id !== "string") {
+            socket.emit("error", { message: "Invalid user information" });
+            return;
+        }
+        const payloadToken = typeof token === "string" ? token : undefined;
+        const handshakeToken = getHandshakeAuthToken(socket);
+        const authToken = config.requireAuth ? handshakeToken : payloadToken || handshakeToken;
+        const resolvedRole = resolveRoleForConnection(authToken);
+        if (!resolvedRole) {
+            socket.emit("error", { message: "Unauthorized collaboration connection" });
+            console.warn(`[${new Date().toISOString()}] Unauthorized join attempt: socket=${socket.id}, document=${documentId}`);
+            socket.disconnect(true);
+            return;
+        }
+        socket.join(documentId);
+        // Cancel any pending cleanup for this room
+        cancelRoomCleanup(documentId);
+        const room = getOrCreateRoom(documentId);
+        const existingUser = room.users.find((u) => u.id === user.id);
+        if (!existingUser) {
+            room.users.push({
+                id: user.id,
+                name: user.name,
+                color: user.color,
+                avatar: user.avatar,
+                role: resolvedRole,
+            });
+        }
+        else {
+            existingUser.name = user.name ?? existingUser.name;
+            existingUser.color = user.color ?? existingUser.color;
+            existingUser.avatar = user.avatar ?? existingUser.avatar;
+            existingUser.role = resolvedRole;
+        }
+        // Associate socket with user/room for cleanup
+        socket.documentId = documentId;
+        socket.userId = user.id;
+        socket.userRole = resolvedRole;
+        // Count actual socket connections in this room
+        const socketsInRoom = io.sockets.adapter.rooms.get(documentId)?.size || 0;
+        console.log(`[${new Date().toISOString()}] User ${user.name} (${user.id}) joined document ${documentId} as ${resolvedRole}. Unique users: ${room.users.length}, Connections: ${socketsInRoom}`);
+        // Send initial sync
+        socket.emit("sync", buildSyncPayload(room, user.id, resolvedRole));
+        // Broadcast user joined
+        io.to(documentId).emit("users:update", room.users);
+        touchRoom(documentId);
+    });
+    socket.on("client:change", (payload) => {
+        const { documentId, userId, userRole } = socket;
+        if (!documentId || !userId)
+            return;
+        const room = rooms.get(documentId);
+        if (!room)
+            return;
+        // Validate payload structure
+        if (!payload || typeof payload !== "object" || !payload.type) {
+            console.warn(`[${new Date().toISOString()}] Invalid change payload from ${socket.id}`);
+            return;
+        }
+        const previewMode = room.mode === "preview";
+        const deny = (action, reason) => {
+            const message = reason === "preview_mode"
+                ? "PERMISSION_DENIED_PREVIEW_MODE"
+                : "PERMISSION_DENIED";
+            socket.emit("error", { message, action, reason });
+        };
+        const can = (action, options = {}) => {
+            const decision = evaluatePermission({
+                action,
+                userId,
+                userRole,
+                ownerId: options.ownerId,
+                resourcePolicy: options.resourcePolicy,
+                previewMode,
+            });
+            if (!decision.allowed) {
+                deny(action, decision.reason);
+            }
+            return decision.allowed;
+        };
+        let outboundPayload = null;
+        if (payload.type === "annotation") {
+            const { change } = payload;
+            if (!isValidAnnotationChange(change)) {
+                console.warn(`[${new Date().toISOString()}] Invalid annotation change from ${socket.id}`);
+                return;
+            }
+            // Apply change
+            if (change.type === "add" && change.annotation) {
+                const inputAnnotation = sanitizeAnnotationPayload(change.annotation);
+                if (!can("annotation.create")) {
+                    return;
+                }
+                // Ensure authorId is set to the current user
+                const annotationToAdd = {
+                    ...inputAnnotation,
+                    metadata: {
+                        ...inputAnnotation.metadata,
+                        authorId: userId,
+                        createdAt: toTimestamp(inputAnnotation.metadata?.createdAt) ?? Date.now(),
+                    }
+                };
+                room.annotations.push(annotationToAdd);
+                outboundPayload = {
+                    type: "annotation",
+                    change: {
+                        type: "add",
+                        annotation: annotationToAdd,
+                    },
+                };
+            }
+            else if (change.type === "update" && change.annotation) {
+                const inputAnnotation = sanitizeAnnotationPayload(change.annotation);
+                const existingAnnotation = room.annotations.find((item) => item.id === inputAnnotation.id);
+                if (!existingAnnotation) {
+                    return;
+                }
+                const previousStatus = existingAnnotation.metadata.status === "resolved" ? "resolved" : "open";
+                const requestedStatus = inputAnnotation.metadata.status === "resolved"
+                    ? "resolved"
+                    : inputAnnotation.metadata.status === "open"
+                        ? "open"
+                        : previousStatus;
+                const statusChanged = requestedStatus !== previousStatus;
+                const stripStatusFields = (annotation) => {
+                    const { status: _status, updatedAt: _updatedAt, ...metadata } = annotation.metadata;
+                    return {
+                        ...annotation,
+                        metadata,
+                    };
+                };
+                const isStatusOnlyUpdate = JSON.stringify(stripStatusFields(existingAnnotation)) ===
+                    JSON.stringify(stripStatusFields(inputAnnotation));
+                if (!isStatusOnlyUpdate &&
+                    !can("annotation.update", {
+                        ownerId: existingAnnotation.metadata.authorId,
+                        resourcePolicy: existingAnnotation.metadata.acl,
+                    })) {
+                    return;
+                }
+                if (statusChanged &&
+                    !can(requestedStatus === "resolved" ? "thread.resolve" : "thread.reopen", {
+                        ownerId: existingAnnotation.metadata.authorId,
+                        resourcePolicy: existingAnnotation.metadata.acl,
+                    })) {
+                    return;
+                }
+                const idx = room.annotations.findIndex(a => a.id === inputAnnotation.id);
+                if (idx !== -1) {
+                    const updatedAnnotation = {
+                        ...inputAnnotation,
+                        metadata: {
+                            ...inputAnnotation.metadata,
+                            status: requestedStatus,
+                            updatedAt: Date.now(),
+                        }
+                    };
+                    room.annotations[idx] = updatedAnnotation;
+                    outboundPayload = {
+                        type: "annotation",
+                        change: {
+                            type: "update",
+                            annotation: updatedAnnotation,
+                        },
+                    };
+                }
+            }
+            else if (change.type === "remove" && change.annotation) {
+                const existingAnnotation = room.annotations.find((item) => item.id === change.annotation?.id);
+                if (!existingAnnotation) {
+                    return;
+                }
+                if (!can("annotation.delete", {
+                    ownerId: existingAnnotation.metadata.authorId,
+                    resourcePolicy: existingAnnotation.metadata.acl,
+                })) {
+                    return;
+                }
+                room.annotations = room.annotations.filter(a => a.id !== change.annotation?.id);
+                outboundPayload = {
+                    type: "annotation",
+                    change: {
+                        type: "remove",
+                        annotation: existingAnnotation,
+                    },
+                };
+            }
+        }
+        else if (payload.type === "comment") {
+            const { change } = payload;
+            if (!isValidCommentChange(change)) {
+                console.warn(`[${new Date().toISOString()}] Invalid comment change from ${socket.id}`);
+                return;
+            }
+            if (change.type === "add" && change.comment) {
+                const inputComment = sanitizeCommentPayload(change.comment);
+                const targetAnnotation = room.annotations.find((item) => item.id === inputComment.targetAnnotationId);
+                if (!targetAnnotation) {
+                    return;
+                }
+                if (inputComment.parentId) {
+                    const existingThread = room.comments.find((item) => item.targetAnnotationId === inputComment.targetAnnotationId);
+                    const parentComment = existingThread?.comments.find((item) => item.id === inputComment.parentId);
+                    if (!parentComment) {
+                        return;
+                    }
+                    if (!can("comment.reply", {
+                        ownerId: parentComment.authorId,
+                        resourcePolicy: parentComment.acl,
+                    })) {
+                        return;
+                    }
+                }
+                else if (!can("annotation.comment.create", {
+                    ownerId: targetAnnotation.metadata.authorId,
+                    resourcePolicy: targetAnnotation.metadata.acl,
+                })) {
+                    return;
+                }
+                // Find or create thread for this comment
+                let thread = room.comments.find(t => t.targetAnnotationId === inputComment.targetAnnotationId);
+                if (!thread) {
+                    thread = {
+                        id: inputComment.targetAnnotationId,
+                        targetAnnotationId: inputComment.targetAnnotationId,
+                        comments: [],
+                    };
+                    room.comments.push(thread);
+                }
+                // Ensure authorId is set to current user
+                const commentToAdd = {
+                    ...inputComment,
+                    authorId: userId,
+                    createdAt: toTimestamp(inputComment.createdAt) ?? Date.now(),
+                };
+                thread.comments.push(commentToAdd);
+                outboundPayload = {
+                    type: "comment",
+                    change: {
+                        type: "add",
+                        comment: commentToAdd,
+                    },
+                };
+            }
+            else if (change.type === "update" && change.comment) {
+                const inputComment = sanitizeCommentPayload(change.comment);
+                // Find the thread and comment
+                const thread = room.comments.find(t => t.targetAnnotationId === inputComment.targetAnnotationId);
+                if (thread) {
+                    const existingComment = thread.comments.find(c => c.id === inputComment.id);
+                    if (existingComment) {
+                        if (!can("comment.update", {
+                            ownerId: existingComment.authorId,
+                            resourcePolicy: existingComment.acl,
+                        })) {
+                            return;
+                        }
+                        // Update the comment
+                        const idx = thread.comments.findIndex(c => c.id === inputComment.id);
+                        if (idx !== -1) {
+                            const updatedComment = {
+                                ...inputComment,
+                                updatedAt: Date.now(),
+                            };
+                            thread.comments[idx] = updatedComment;
+                            outboundPayload = {
+                                type: "comment",
+                                change: {
+                                    type: "update",
+                                    comment: updatedComment,
+                                },
+                            };
+                        }
+                    }
+                }
+            }
+            else if (change.type === "remove" && change.comment) {
+                const inputComment = sanitizeCommentPayload(change.comment);
+                // Find the thread and comment
+                const thread = room.comments.find(t => t.targetAnnotationId === inputComment.targetAnnotationId);
+                if (thread) {
+                    const existingComment = thread.comments.find(c => c.id === inputComment.id);
+                    if (existingComment) {
+                        if (!can("comment.delete", {
+                            ownerId: existingComment.authorId,
+                            resourcePolicy: existingComment.acl,
+                        })) {
+                            return;
+                        }
+                        // Remove the comment
+                        thread.comments = thread.comments.filter(c => c.id !== inputComment.id);
+                        outboundPayload = {
+                            type: "comment",
+                            change: {
+                                type: "remove",
+                                comment: existingComment,
+                            },
+                        };
+                        // If thread is empty, remove the thread as well
+                        if (thread.comments.length === 0) {
+                            room.comments = room.comments.filter(t => t.id !== thread.id);
+                        }
+                    }
+                }
+            }
+        }
+        // Broadcast to other clients
+        if (outboundPayload) {
+            socket.broadcast.to(documentId).emit("remote:change", outboundPayload);
+        }
+        const roomSockets = io.sockets.adapter.rooms.get(documentId);
+        if (roomSockets) {
+            for (const socketId of roomSockets) {
+                const roomSocket = io.sockets.sockets.get(socketId);
+                if (!roomSocket?.userId)
+                    continue;
+                roomSocket.emit("sync", buildSyncPayload(room, roomSocket.userId, roomSocket.userRole));
+            }
+        }
+        touchRoom(documentId);
+    });
+    socket.on("document:set-mode", ({ mode }) => {
+        const { documentId, userRole } = socket;
+        if (!documentId)
+            return;
+        const room = rooms.get(documentId);
+        if (!room)
+            return;
+        if (mode !== "normal" && mode !== "preview") {
+            return;
+        }
+        if (!canSetDocumentMode(userRole)) {
+            socket.emit("error", { message: "PERMISSION_DENIED", action: "document.setMode" });
+            return;
+        }
+        if (room.mode === mode) {
+            return;
+        }
+        room.mode = mode;
+        io.to(documentId).emit("document:mode:changed", mode);
+        const roomSockets = io.sockets.adapter.rooms.get(documentId);
+        if (!roomSockets)
+            return;
+        for (const socketId of roomSockets) {
+            const roomSocket = io.sockets.sockets.get(socketId);
+            if (!roomSocket?.userId)
+                continue;
+            roomSocket.emit("sync", buildSyncPayload(room, roomSocket.userId, roomSocket.userRole));
+        }
+    });
+    socket.on("client:interaction", (payload) => {
+        const { documentId, userId } = socket;
+        if (!documentId || !userId)
+            return;
+        if (!rooms.has(documentId))
+            return;
+        // Validate payload
+        if (!payload || typeof payload !== "object" || !payload.type) {
+            return;
+        }
+        // Ensure userId matches the socket's authenticated user
+        const safePayload = {
+            ...payload,
+            userId, // Override with authenticated user ID
+        };
+        // Interactions are ephemeral, just broadcast
+        socket.broadcast.to(documentId).emit("remote:interaction", safePayload);
+    });
+    socket.on("disconnect", () => {
+        const { documentId, userId } = socket;
+        if (documentId && rooms.has(documentId)) {
+            const room = rooms.get(documentId);
+            // Check if this user has any other active connections in this room
+            const roomSockets = io.sockets.adapter.rooms.get(documentId);
+            let userHasOtherConnections = false;
+            if (roomSockets) {
+                for (const socketId of roomSockets) {
+                    if (socketId === socket.id)
+                        continue;
+                    const otherSocket = io.sockets.sockets.get(socketId);
+                    if (otherSocket?.userId === userId) {
+                        userHasOtherConnections = true;
+                        break;
+                    }
+                }
+            }
+            // Only remove user from list if they have no other connections
+            if (!userHasOtherConnections) {
+                room.users = room.users.filter(u => u.id !== userId);
+                io.to(documentId).emit("users:update", room.users);
+            }
+            const remainingConnections = (roomSockets?.size || 1) - 1; // Subtract the disconnecting socket
+            console.log(`[${new Date().toISOString()}] User ${userId} disconnected from ${documentId}. Remaining connections: ${remainingConnections}, Unique users: ${room.users.length}`);
+            // Schedule cleanup if room is empty
+            if (room.users.length === 0) {
+                console.log(`[${new Date().toISOString()}] Room ${documentId} is now empty, scheduling cleanup`);
+                scheduleRoomCleanup(documentId);
+            }
+        }
+    });
+});
+// ============================================================================
+// Server Startup
+// ============================================================================
+httpServer.listen(config.port, () => {
+    console.log(`[${new Date().toISOString()}] Collaboration server running on port ${config.port}`);
+    console.log(`[${new Date().toISOString()}] CORS origins: ${getCorsOrigins()}`);
+    console.log(`[${new Date().toISOString()}] Heartbeat: pingInterval=25s, pingTimeout=20s`);
+    console.log(`[${new Date().toISOString()}] Room cleanup timeout: ${config.roomCleanupTimeout}ms`);
+    console.log(`[${new Date().toISOString()}] Auth mode: requireAuth=${config.requireAuth}, tokenRoles=${config.authTokenRoles.size}, defaultRole=${config.defaultRole}`);
+});

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@jacktea/pdf-viewer-server",
+  "version": "0.1.3",
+  "private": false,
+  "bin": {
+    "pdf-viewer-server": "./dist/server.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "socket.io": "^4.7.5",
+    "ts-node": "^10.9.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.12.7",
+    "typescript": "^5.4.5",
+    "nodemon": "^3.1.0"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "build": "tsc -p tsconfig.json",
+    "start": "node ./dist/server.js",
+    "dev": "nodemon --exec ts-node src/server.ts"
+  }
+}