@tldraw/sync-collaboration 0.0.0-bootstrap

package/README.md

@@ -0,0 +1,5 @@
+# @tldraw/sync-collaboration
+
+Server-side logic for tldraw's collaboration features: write authorization for comment, comment-thread, and comment-reaction records, for use with a sync server's `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). This package has no react or client-editor dependencies, so it is safe to import from workers and node servers.
+
+See [tldraw.dev](https://tldraw.dev) for docs. License: see `LICENSE.md`.

package/dist-cjs/comment-authorizers.js

@@ -0,0 +1,139 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var comment_authorizers_exports = {};
+__export(comment_authorizers_exports, {
+  createCommentAuthorizers: () => createCommentAuthorizers
+});
+module.exports = __toCommonJS(comment_authorizers_exports);
+var import_tlschema = require("@tldraw/tlschema");
+function createCommentAuthorizers(opts) {
+  const { getUserId } = opts;
+  function withUserId(rule) {
+    return (args) => rule(getUserId(args.session), args);
+  }
+  function authorizeAuthored(field, { ownerOnlyUpdate = false } = {}) {
+    return (userId, { type, prev, next }) => {
+      if (type === "create") {
+        if (!userId) return null;
+        return { ...next, [field]: userId };
+      }
+      if (type === "update") {
+        if (next[field] !== prev[field]) return null;
+        if (ownerOnlyUpdate && userId !== prev[field]) return null;
+        return next;
+      }
+      return prev;
+    };
+  }
+  function authorizeSoftDeleted(ownerOf, base) {
+    return (userId, args) => {
+      if (args.type === "delete") return null;
+      const result = base(userId, args);
+      if (!result) return null;
+      if (args.type === "create" && args.next.isDeleted) return null;
+      if (args.type === "update") {
+        const { prev, next } = args;
+        if (prev.isDeleted !== next.isDeleted) {
+          if (prev.isDeleted) return null;
+          if (userId !== ownerOf(prev)) return null;
+        }
+      }
+      return result;
+    };
+  }
+  const authorizeThreadResolution = (userId, args) => {
+    const result = authorizeAuthored("createdBy")(userId, args);
+    if (!result) return null;
+    if (args.type === "create") {
+      const { next } = args;
+      if (next.resolved && next.resolved.by !== userId) return null;
+    }
+    if (args.type === "update") {
+      const { prev, next } = args;
+      const changed = prev.resolved?.at !== next.resolved?.at || prev.resolved?.by !== next.resolved?.by;
+      if (changed && next.resolved && next.resolved.by !== userId) return null;
+    }
+    return result;
+  };
+  function immutableFields(fields, base) {
+    return (userId, args) => {
+      if (args.type === "update") {
+        const { prev, next } = args;
+        for (const field of fields) {
+          if (next[field] !== prev[field]) return null;
+        }
+      }
+      return base(userId, args);
+    };
+  }
+  const authorizeReactionBase = authorizeAuthored("userId", {
+    ownerOnlyUpdate: true
+  });
+  const authorizeReaction = (userId, args) => {
+    if (args.type === "delete") {
+      return userId && userId === args.prev.userId ? args.prev : null;
+    }
+    const result = authorizeReactionBase(userId, args);
+    if (!result) return null;
+    if (args.type === "create") {
+      if (!userId) return null;
+      const { next } = args;
+      if (next.id !== (0, import_tlschema.createCommentReactionId)(next.commentId, userId, next.emoji)) {
+        return null;
+      }
+    }
+    if (args.type === "update") {
+      const { prev, next } = args;
+      if (next.commentId !== prev.commentId) return null;
+      if (next.threadId !== prev.threadId) return null;
+      if (next.pageId !== prev.pageId) return null;
+      if (next.emoji !== prev.emoji) return null;
+    }
+    return result;
+  };
+  return {
+    comment: withUserId(
+      authorizeSoftDeleted(
+        (comment) => comment.authorId,
+        // `pageId` stays mutable: it's denormalized from the thread, and moving an anchored
+        // thread between pages rewrites it on every comment in the thread.
+        immutableFields(
+          ["threadId", "createdAt"],
+          authorizeAuthored("authorId", { ownerOnlyUpdate: true })
+        )
+      )
+    ),
+    "comment-thread": withUserId(
+      authorizeSoftDeleted(
+        (thread) => thread.createdBy,
+        immutableFields(["createdAt"], authorizeThreadResolution)
+      )
+    ),
+    // A reaction is one user's own record, so the standard attribution rules mostly cover it:
+    // `userId` is stamped from the session and only the reactor can change their reaction, and
+    // the wrapper's id check ties the record to its (comment, user, emoji) slot — so no one can
+    // forge or hijack another user's reaction. Deletion, though, is deliberately open: anyone
+    // with access to the room may hard-delete any reaction. Reactions have no soft-delete /
+    // `isDeleted` flag (unlike comments) on purpose — a reaction is a toggle, so removing one is
+    // a plain record delete, and a host cascading a comment or thread deletion must sweep every
+    // reactor's records, not just the caller's own.
+    "comment-reaction": withUserId(authorizeReaction)
+  };
+}
+//# sourceMappingURL=comment-authorizers.js.map

package/dist-cjs/comment-authorizers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/comment-authorizers.ts"],
+  "sourcesContent": ["import type { UnknownRecord } from '@tldraw/store'\nimport type { TLRecordAuthorizer, TLRecordAuthorizers } from '@tldraw/sync-core'\nimport {\n\tcreateCommentReactionId,\n\ttype TLComment,\n\ttype TLCommentReaction,\n\ttype TLCommentThread,\n} from '@tldraw/tlschema'\n\n/**\n * Options for {@link createCommentAuthorizers}.\n *\n * @public\n */\nexport interface CommentAuthorizerOptions<SessionMeta> {\n\t/**\n\t * Resolve the authenticated user id for a session from its host-provided `meta`. Return\n\t * `null` for anonymous sessions \u2014 they can't create comments or threads, and can't perform\n\t * any owner-only action. Called exactly once per authorized write.\n\t */\n\tgetUserId(session: { sessionId: string; meta: SessionMeta }): string | null\n}\n\n/**\n * Server-side write authorization for comment records, for use with a sync server's\n * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and\n * thread authorship from the session's identity so nothing can be posted, resolved, or deleted\n * in someone else's name:\n *\n * - `comment`: `authorId` is stamped from the session on create (anonymous creates are\n *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`\n *   are immutable too \u2014 a comment can't be re-parented or back-dated after the fact.\n * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access\n *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.\n * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the\n *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable\n *   on update, and only the reactor may delete their own reaction.\n * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the\n *   record's owner may set, never cleared, never set at create. Client hard-deletes are always\n *   rejected \u2014 record removals are server-side only.\n *\n * Comment records ride alongside your document records, so widen the room's record union to\n * include them, then spread the result into the authorizer map alongside your own entries:\n *\n * @example\n * ```ts\n * interface SessionMeta {\n * \tuserId: string | null\n * }\n *\n * type MyRecord = TLRecord | TLComment | TLCommentThread | TLCommentReaction\n *\n * new TLSocketRoom<MyRecord, SessionMeta>({\n * \tauthorizeRecord: {\n * \t\t...createCommentAuthorizers<SessionMeta>({ getUserId: (session) => session.meta.userId }),\n * \t},\n * })\n * ```\n *\n * @public\n */\nexport function createCommentAuthorizers<SessionMeta>(\n\topts: CommentAuthorizerOptions<SessionMeta>\n): TLRecordAuthorizers<TLComment | TLCommentThread | TLCommentReaction, SessionMeta> {\n\tconst { getUserId } = opts\n\n\t/** A rule is an authorizer that receives the session's user id, resolved for it exactly once. */\n\ttype Rule<Rec extends UnknownRecord> = (\n\t\tuserId: string | null,\n\t\targs: Parameters<TLRecordAuthorizer<Rec, SessionMeta>>[0]\n\t) => Rec | null\n\n\t/** Adapt a rule to the authorizer signature, resolving the session's user id exactly once. */\n\tfunction withUserId<Rec extends UnknownRecord>(\n\t\trule: Rule<Rec>\n\t): TLRecordAuthorizer<Rec, SessionMeta> {\n\t\treturn (args) => rule(getUserId(args.session), args)\n\t}\n\n\t/**\n\t * Authorize a record whose attribution lives in `field`: stamped from the session on create,\n\t * immutable on update. With `ownerOnlyUpdate`, only the author may update it at all.\n\t */\n\tfunction authorizeAuthored<Rec extends UnknownRecord>(\n\t\tfield: keyof Rec & string,\n\t\t{ ownerOnlyUpdate = false } = {}\n\t): Rule<Rec> {\n\t\treturn (userId, { type, prev, next }) => {\n\t\t\tif (type === 'create') {\n\t\t\t\tif (!userId) return null // no identity to attribute \u2192 reject\n\t\t\t\treturn { ...next, [field]: userId } as Rec\n\t\t\t}\n\t\t\tif (type === 'update') {\n\t\t\t\tif (next[field] !== prev[field]) return null // attribution is immutable\n\t\t\t\tif (ownerOnlyUpdate && userId !== prev[field]) return null // only the author edits\n\t\t\t\treturn next\n\t\t\t}\n\t\t\treturn prev\n\t\t}\n\t}\n\n\t/**\n\t * Police a soft-deleted record type on top of `base`: deletion is a write-once `isDeleted`\n\t * flag \u2014 set exactly once, never cleared, only by the record's owner (`ownerOf`), never on\n\t * create \u2014 and clients never hard-delete these records at all. Record removals are\n\t * server-initiated only (server-side deletes don't run authorizers), so once the server\n\t * prunes a flagged record there is no un-delete.\n\t */\n\tfunction authorizeSoftDeleted<Rec extends UnknownRecord & { isDeleted: boolean }>(\n\t\townerOf: (rec: Rec) => string,\n\t\tbase: Rule<Rec>\n\t): Rule<Rec> {\n\t\treturn (userId, args) => {\n\t\t\tif (args.type === 'delete') return null\n\t\t\tconst result = base(userId, args)\n\t\t\tif (!result) return null\n\t\t\t// A record can't be born deleted \u2014 that would smuggle a deletion past the update checks.\n\t\t\tif (args.type === 'create' && args.next.isDeleted) return null\n\t\t\tif (args.type === 'update') {\n\t\t\t\tconst { prev, next } = args\n\t\t\t\tif (prev.isDeleted !== next.isDeleted) {\n\t\t\t\t\tif (prev.isDeleted) return null // write-once: never cleared\n\t\t\t\t\tif (userId !== ownerOf(prev)) return null // only the owner deletes\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn result\n\t\t}\n\t}\n\n\t/**\n\t * Threads stay editable by anyone with access (resolve/reopen), but resolution is itself an\n\t * attribution: a non-null `resolved.by`, set at create or changed by update, must be the\n\t * session's own user.\n\t */\n\tconst authorizeThreadResolution: Rule<TLCommentThread> = (userId, args) => {\n\t\tconst result = authorizeAuthored<TLCommentThread>('createdBy')(userId, args)\n\t\tif (!result) return null\n\t\tif (args.type === 'create') {\n\t\t\t// Delete + re-put could otherwise smuggle in a resolution forged in someone else's name.\n\t\t\tconst { next } = args\n\t\t\tif (next.resolved && next.resolved.by !== userId) return null\n\t\t}\n\t\tif (args.type === 'update') {\n\t\t\tconst { prev, next } = args\n\t\t\tconst changed =\n\t\t\t\tprev.resolved?.at !== next.resolved?.at || prev.resolved?.by !== next.resolved?.by\n\t\t\tif (changed && next.resolved && next.resolved.by !== userId) return null\n\t\t}\n\t\treturn result\n\t}\n\n\t/**\n\t * Reject an update that changes any of `fields`. Used for the structural fields an update must\n\t * never touch: a comment's parent thread and its creation time. `threadId` is what ties a\n\t * comment to its conversation (and, downstream, to a file), so letting an author re-parent an\n\t * existing comment would move it between threads \u2014 and, where threads span files, between\n\t * files. `createdAt` orders threads and bounds the notification feed, so a mutable one lets a\n\t * comment be re-sorted after the fact.\n\t */\n\tfunction immutableFields<Rec extends UnknownRecord>(\n\t\tfields: readonly (keyof Rec & string)[],\n\t\tbase: Rule<Rec>\n\t): Rule<Rec> {\n\t\treturn (userId, args) => {\n\t\t\tif (args.type === 'update') {\n\t\t\t\tconst { prev, next } = args\n\t\t\t\tfor (const field of fields) {\n\t\t\t\t\tif (next[field] !== prev[field]) return null\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn base(userId, args)\n\t\t}\n\t}\n\n\tconst authorizeReactionBase = authorizeAuthored<TLCommentReaction>('userId', {\n\t\townerOnlyUpdate: true,\n\t})\n\n\t/**\n\t * A reaction's id is derived from its (comment, user, emoji) triple (see\n\t * `createCommentReactionId`), which is what makes reaction identity structural. The base rule\n\t * already stamps `userId` from the session and lets only the owner change a reaction \u2014 but the\n\t * id, the comment it points at, and the emoji are all client-supplied, so this wrapper adds two\n\t * things:\n\t *\n\t * - On **create**, the id must be the canonical id for `commentId` + the session's user +\n\t *   `next.emoji`. Without this a forged client could create a record at another user's id slot\n\t *   (locking them out of that reaction), or push a mismatched id that lands two records on one\n\t *   (comment, user, emoji) \u2014 an invariant any persistence layer keyed on the triple relies on.\n\t *\n\t * - On **update**, everything identity-bearing is immutable: `commentId`, `threadId`, `pageId`,\n\t *   and `emoji` all feed the id (directly or by denormalization), so a re-react is a\n\t *   create/delete, not an update. The only thing an update may touch is `createdAt`/`meta`.\n\t *   So the id and the fields it is derived from can never drift apart.\n\t */\n\tconst authorizeReaction: Rule<TLCommentReaction> = (userId, args) => {\n\t\t// Only the reactor may remove their own reaction. Cascades still sweep every reactor's\n\t\t// records because server-initiated writes carry no session and so skip authorizers\n\t\t// entirely \u2014 an open client delete was never what made the sweep work.\n\t\tif (args.type === 'delete') {\n\t\t\treturn userId && userId === args.prev.userId ? args.prev : null\n\t\t}\n\t\tconst result = authorizeReactionBase(userId, args)\n\t\tif (!result) return null\n\t\tif (args.type === 'create') {\n\t\t\t// Unreachable: the base rule already rejected identity-less creates. Checked to narrow.\n\t\t\tif (!userId) return null\n\t\t\tconst { next } = args\n\t\t\tif (next.id !== createCommentReactionId(next.commentId, userId, next.emoji)) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t}\n\t\tif (args.type === 'update') {\n\t\t\tconst { prev, next } = args\n\t\t\tif (next.commentId !== prev.commentId) return null\n\t\t\tif (next.threadId !== prev.threadId) return null\n\t\t\tif (next.pageId !== prev.pageId) return null\n\t\t\tif (next.emoji !== prev.emoji) return null\n\t\t}\n\t\treturn result\n\t}\n\n\treturn {\n\t\tcomment: withUserId(\n\t\t\tauthorizeSoftDeleted<TLComment>(\n\t\t\t\t(comment) => comment.authorId,\n\t\t\t\t// `pageId` stays mutable: it's denormalized from the thread, and moving an anchored\n\t\t\t\t// thread between pages rewrites it on every comment in the thread.\n\t\t\t\timmutableFields<TLComment>(\n\t\t\t\t\t['threadId', 'createdAt'],\n\t\t\t\t\tauthorizeAuthored<TLComment>('authorId', { ownerOnlyUpdate: true })\n\t\t\t\t)\n\t\t\t)\n\t\t),\n\t\t'comment-thread': withUserId(\n\t\t\tauthorizeSoftDeleted<TLCommentThread>(\n\t\t\t\t(thread) => thread.createdBy,\n\t\t\t\timmutableFields<TLCommentThread>(['createdAt'], authorizeThreadResolution)\n\t\t\t)\n\t\t),\n\t\t// A reaction is one user's own record, so the standard attribution rules mostly cover it:\n\t\t// `userId` is stamped from the session and only the reactor can change their reaction, and\n\t\t// the wrapper's id check ties the record to its (comment, user, emoji) slot \u2014 so no one can\n\t\t// forge or hijack another user's reaction. Deletion, though, is deliberately open: anyone\n\t\t// with access to the room may hard-delete any reaction. Reactions have no soft-delete /\n\t\t// `isDeleted` flag (unlike comments) on purpose \u2014 a reaction is a toggle, so removing one is\n\t\t// a plain record delete, and a host cascading a comment or thread deletion must sweep every\n\t\t// reactor's records, not just the caller's own.\n\t\t'comment-reaction': withUserId(authorizeReaction),\n\t}\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,sBAKO;AAsDA,SAAS,yBACf,MACoF;AACpF,QAAM,EAAE,UAAU,IAAI;AAStB,WAAS,WACR,MACuC;AACvC,WAAO,CAAC,SAAS,KAAK,UAAU,KAAK,OAAO,GAAG,IAAI;AAAA,EACpD;AAMA,WAAS,kBACR,OACA,EAAE,kBAAkB,MAAM,IAAI,CAAC,GACnB;AACZ,WAAO,CAAC,QAAQ,EAAE,MAAM,MAAM,KAAK,MAAM;AACxC,UAAI,SAAS,UAAU;AACtB,YAAI,CAAC,OAAQ,QAAO;AACpB,eAAO,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,OAAO;AAAA,MACnC;AACA,UAAI,SAAS,UAAU;AACtB,YAAI,KAAK,KAAK,MAAM,KAAK,KAAK,EAAG,QAAO;AACxC,YAAI,mBAAmB,WAAW,KAAK,KAAK,EAAG,QAAO;AACtD,eAAO;AAAA,MACR;AACA,aAAO;AAAA,IACR;AAAA,EACD;AASA,WAAS,qBACR,SACA,MACY;AACZ,WAAO,CAAC,QAAQ,SAAS;AACxB,UAAI,KAAK,SAAS,SAAU,QAAO;AACnC,YAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,UAAI,CAAC,OAAQ,QAAO;AAEpB,UAAI,KAAK,SAAS,YAAY,KAAK,KAAK,UAAW,QAAO;AAC1D,UAAI,KAAK,SAAS,UAAU;AAC3B,cAAM,EAAE,MAAM,KAAK,IAAI;AACvB,YAAI,KAAK,cAAc,KAAK,WAAW;AACtC,cAAI,KAAK,UAAW,QAAO;AAC3B,cAAI,WAAW,QAAQ,IAAI,EAAG,QAAO;AAAA,QACtC;AAAA,MACD;AACA,aAAO;AAAA,IACR;AAAA,EACD;AAOA,QAAM,4BAAmD,CAAC,QAAQ,SAAS;AAC1E,UAAM,SAAS,kBAAmC,WAAW,EAAE,QAAQ,IAAI;AAC3E,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,KAAK,SAAS,UAAU;AAE3B,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,KAAK,YAAY,KAAK,SAAS,OAAO,OAAQ,QAAO;AAAA,IAC1D;AACA,QAAI,KAAK,SAAS,UAAU;AAC3B,YAAM,EAAE,MAAM,KAAK,IAAI;AACvB,YAAM,UACL,KAAK,UAAU,OAAO,KAAK,UAAU,MAAM,KAAK,UAAU,OAAO,KAAK,UAAU;AACjF,UAAI,WAAW,KAAK,YAAY,KAAK,SAAS,OAAO,OAAQ,QAAO;AAAA,IACrE;AACA,WAAO;AAAA,EACR;AAUA,WAAS,gBACR,QACA,MACY;AACZ,WAAO,CAAC,QAAQ,SAAS;AACxB,UAAI,KAAK,SAAS,UAAU;AAC3B,cAAM,EAAE,MAAM,KAAK,IAAI;AACvB,mBAAW,SAAS,QAAQ;AAC3B,cAAI,KAAK,KAAK,MAAM,KAAK,KAAK,EAAG,QAAO;AAAA,QACzC;AAAA,MACD;AACA,aAAO,KAAK,QAAQ,IAAI;AAAA,IACzB;AAAA,EACD;AAEA,QAAM,wBAAwB,kBAAqC,UAAU;AAAA,IAC5E,iBAAiB;AAAA,EAClB,CAAC;AAmBD,QAAM,oBAA6C,CAAC,QAAQ,SAAS;AAIpE,QAAI,KAAK,SAAS,UAAU;AAC3B,aAAO,UAAU,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO;AAAA,IAC5D;AACA,UAAM,SAAS,sBAAsB,QAAQ,IAAI;AACjD,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,KAAK,SAAS,UAAU;AAE3B,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,KAAK,WAAO,yCAAwB,KAAK,WAAW,QAAQ,KAAK,KAAK,GAAG;AAC5E,eAAO;AAAA,MACR;AAAA,IACD;AACA,QAAI,KAAK,SAAS,UAAU;AAC3B,YAAM,EAAE,MAAM,KAAK,IAAI;AACvB,UAAI,KAAK,cAAc,KAAK,UAAW,QAAO;AAC9C,UAAI,KAAK,aAAa,KAAK,SAAU,QAAO;AAC5C,UAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,UAAI,KAAK,UAAU,KAAK,MAAO,QAAO;AAAA,IACvC;AACA,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN,SAAS;AAAA,MACR;AAAA,QACC,CAAC,YAAY,QAAQ;AAAA;AAAA;AAAA,QAGrB;AAAA,UACC,CAAC,YAAY,WAAW;AAAA,UACxB,kBAA6B,YAAY,EAAE,iBAAiB,KAAK,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAAA,IACA,kBAAkB;AAAA,MACjB;AAAA,QACC,CAAC,WAAW,OAAO;AAAA,QACnB,gBAAiC,CAAC,WAAW,GAAG,yBAAyB;AAAA,MAC1E;AAAA,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,oBAAoB,WAAW,iBAAiB;AAAA,EACjD;AACD;",
+  "names": []
+}

package/dist-cjs/index.d.ts

@@ -0,0 +1,63 @@
+import { TLComment } from '@tldraw/tlschema';
+import { TLCommentReaction } from '@tldraw/tlschema';
+import { TLCommentThread } from '@tldraw/tlschema';
+import type { TLRecordAuthorizers } from '@tldraw/sync-core';
+
+/**
+ * Options for {@link createCommentAuthorizers}.
+ *
+ * @public
+ */
+export declare interface CommentAuthorizerOptions<SessionMeta> {
+    /**
+     * Resolve the authenticated user id for a session from its host-provided `meta`. Return
+     * `null` for anonymous sessions — they can't create comments or threads, and can't perform
+     * any owner-only action. Called exactly once per authorized write.
+     */
+    getUserId(session: {
+        meta: SessionMeta;
+        sessionId: string;
+    }): null | string;
+}
+
+/**
+ * Server-side write authorization for comment records, for use with a sync server's
+ * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and
+ * thread authorship from the session's identity so nothing can be posted, resolved, or deleted
+ * in someone else's name:
+ *
+ * - `comment`: `authorId` is stamped from the session on create (anonymous creates are
+ *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`
+ *   are immutable too — a comment can't be re-parented or back-dated after the fact.
+ * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access
+ *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.
+ * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the
+ *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable
+ *   on update, and only the reactor may delete their own reaction.
+ * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the
+ *   record's owner may set, never cleared, never set at create. Client hard-deletes are always
+ *   rejected — record removals are server-side only.
+ *
+ * Comment records ride alongside your document records, so widen the room's record union to
+ * include them, then spread the result into the authorizer map alongside your own entries:
+ *
+ * @example
+ * ```ts
+ * interface SessionMeta {
+ * 	userId: string | null
+ * }
+ *
+ * type MyRecord = TLRecord | TLComment | TLCommentThread | TLCommentReaction
+ *
+ * new TLSocketRoom<MyRecord, SessionMeta>({
+ * 	authorizeRecord: {
+ * 		...createCommentAuthorizers<SessionMeta>({ getUserId: (session) => session.meta.userId }),
+ * 	},
+ * })
+ * ```
+ *
+ * @public
+ */
+export declare function createCommentAuthorizers<SessionMeta>(opts: CommentAuthorizerOptions<SessionMeta>): TLRecordAuthorizers<TLComment | TLCommentReaction | TLCommentThread, SessionMeta>;
+
+export { }

package/dist-cjs/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  createCommentAuthorizers: () => import_comment_authorizers.createCommentAuthorizers
+});
+module.exports = __toCommonJS(index_exports);
+var import_utils = require("@tldraw/utils");
+var import_comment_authorizers = require("./comment-authorizers");
+(0, import_utils.registerTldrawLibraryVersion)(
+  "@tldraw/sync-collaboration",
+  "0.0.0-bootstrap",
+  "cjs"
+);
+//# sourceMappingURL=index.js.map

package/dist-cjs/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import { registerTldrawLibraryVersion } from '@tldraw/utils'\n\n// Server-side logic for tldraw's collaboration features, safe to import from any sync\n// server \u2014 no react or client-editor dependencies.\nexport { type CommentAuthorizerOptions, createCommentAuthorizers } from './comment-authorizers'\n\nregisterTldrawLibraryVersion(\n\t(globalThis as any).TLDRAW_LIBRARY_NAME,\n\t(globalThis as any).TLDRAW_LIBRARY_VERSION,\n\t(globalThis as any).TLDRAW_LIBRARY_MODULES\n)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA6C;AAI7C,iCAAwE;AAAA,IAExE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AACF;",
+  "names": []
+}

package/dist-esm/comment-authorizers.mjs

@@ -0,0 +1,121 @@
+import {
+  createCommentReactionId
+} from "@tldraw/tlschema";
+function createCommentAuthorizers(opts) {
+  const { getUserId } = opts;
+  function withUserId(rule) {
+    return (args) => rule(getUserId(args.session), args);
+  }
+  function authorizeAuthored(field, { ownerOnlyUpdate = false } = {}) {
+    return (userId, { type, prev, next }) => {
+      if (type === "create") {
+        if (!userId) return null;
+        return { ...next, [field]: userId };
+      }
+      if (type === "update") {
+        if (next[field] !== prev[field]) return null;
+        if (ownerOnlyUpdate && userId !== prev[field]) return null;
+        return next;
+      }
+      return prev;
+    };
+  }
+  function authorizeSoftDeleted(ownerOf, base) {
+    return (userId, args) => {
+      if (args.type === "delete") return null;
+      const result = base(userId, args);
+      if (!result) return null;
+      if (args.type === "create" && args.next.isDeleted) return null;
+      if (args.type === "update") {
+        const { prev, next } = args;
+        if (prev.isDeleted !== next.isDeleted) {
+          if (prev.isDeleted) return null;
+          if (userId !== ownerOf(prev)) return null;
+        }
+      }
+      return result;
+    };
+  }
+  const authorizeThreadResolution = (userId, args) => {
+    const result = authorizeAuthored("createdBy")(userId, args);
+    if (!result) return null;
+    if (args.type === "create") {
+      const { next } = args;
+      if (next.resolved && next.resolved.by !== userId) return null;
+    }
+    if (args.type === "update") {
+      const { prev, next } = args;
+      const changed = prev.resolved?.at !== next.resolved?.at || prev.resolved?.by !== next.resolved?.by;
+      if (changed && next.resolved && next.resolved.by !== userId) return null;
+    }
+    return result;
+  };
+  function immutableFields(fields, base) {
+    return (userId, args) => {
+      if (args.type === "update") {
+        const { prev, next } = args;
+        for (const field of fields) {
+          if (next[field] !== prev[field]) return null;
+        }
+      }
+      return base(userId, args);
+    };
+  }
+  const authorizeReactionBase = authorizeAuthored("userId", {
+    ownerOnlyUpdate: true
+  });
+  const authorizeReaction = (userId, args) => {
+    if (args.type === "delete") {
+      return userId && userId === args.prev.userId ? args.prev : null;
+    }
+    const result = authorizeReactionBase(userId, args);
+    if (!result) return null;
+    if (args.type === "create") {
+      if (!userId) return null;
+      const { next } = args;
+      if (next.id !== createCommentReactionId(next.commentId, userId, next.emoji)) {
+        return null;
+      }
+    }
+    if (args.type === "update") {
+      const { prev, next } = args;
+      if (next.commentId !== prev.commentId) return null;
+      if (next.threadId !== prev.threadId) return null;
+      if (next.pageId !== prev.pageId) return null;
+      if (next.emoji !== prev.emoji) return null;
+    }
+    return result;
+  };
+  return {
+    comment: withUserId(
+      authorizeSoftDeleted(
+        (comment) => comment.authorId,
+        // `pageId` stays mutable: it's denormalized from the thread, and moving an anchored
+        // thread between pages rewrites it on every comment in the thread.
+        immutableFields(
+          ["threadId", "createdAt"],
+          authorizeAuthored("authorId", { ownerOnlyUpdate: true })
+        )
+      )
+    ),
+    "comment-thread": withUserId(
+      authorizeSoftDeleted(
+        (thread) => thread.createdBy,
+        immutableFields(["createdAt"], authorizeThreadResolution)
+      )
+    ),
+    // A reaction is one user's own record, so the standard attribution rules mostly cover it:
+    // `userId` is stamped from the session and only the reactor can change their reaction, and
+    // the wrapper's id check ties the record to its (comment, user, emoji) slot — so no one can
+    // forge or hijack another user's reaction. Deletion, though, is deliberately open: anyone
+    // with access to the room may hard-delete any reaction. Reactions have no soft-delete /
+    // `isDeleted` flag (unlike comments) on purpose — a reaction is a toggle, so removing one is
+    // a plain record delete, and a host cascading a comment or thread deletion must sweep every
+    // reactor's records, not just the caller's own.
+    "comment-reaction": withUserId(authorizeReaction)
+  };
+}
+export {
+  createCommentAuthorizers
+};
+//# sourceMappingURL=comment-authorizers.mjs.map

package/dist-esm/comment-authorizers.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/comment-authorizers.ts"],
+  "sourcesContent": ["import type { UnknownRecord } from '@tldraw/store'\nimport type { TLRecordAuthorizer, TLRecordAuthorizers } from '@tldraw/sync-core'\nimport {\n\tcreateCommentReactionId,\n\ttype TLComment,\n\ttype TLCommentReaction,\n\ttype TLCommentThread,\n} from '@tldraw/tlschema'\n\n/**\n * Options for {@link createCommentAuthorizers}.\n *\n * @public\n */\nexport interface CommentAuthorizerOptions<SessionMeta> {\n\t/**\n\t * Resolve the authenticated user id for a session from its host-provided `meta`. Return\n\t * `null` for anonymous sessions \u2014 they can't create comments or threads, and can't perform\n\t * any owner-only action. Called exactly once per authorized write.\n\t */\n\tgetUserId(session: { sessionId: string; meta: SessionMeta }): string | null\n}\n\n/**\n * Server-side write authorization for comment records, for use with a sync server's\n * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and\n * thread authorship from the session's identity so nothing can be posted, resolved, or deleted\n * in someone else's name:\n *\n * - `comment`: `authorId` is stamped from the session on create (anonymous creates are\n *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`\n *   are immutable too \u2014 a comment can't be re-parented or back-dated after the fact.\n * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access\n *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.\n * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the\n *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable\n *   on update, and only the reactor may delete their own reaction.\n * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the\n *   record's owner may set, never cleared, never set at create. Client hard-deletes are always\n *   rejected \u2014 record removals are server-side only.\n *\n * Comment records ride alongside your document records, so widen the room's record union to\n * include them, then spread the result into the authorizer map alongside your own entries:\n *\n * @example\n * ```ts\n * interface SessionMeta {\n * \tuserId: string | null\n * }\n *\n * type MyRecord = TLRecord | TLComment | TLCommentThread | TLCommentReaction\n *\n * new TLSocketRoom<MyRecord, SessionMeta>({\n * \tauthorizeRecord: {\n * \t\t...createCommentAuthorizers<SessionMeta>({ getUserId: (session) => session.meta.userId }),\n * \t},\n * })\n * ```\n *\n * @public\n */\nexport function createCommentAuthorizers<SessionMeta>(\n\topts: CommentAuthorizerOptions<SessionMeta>\n): TLRecordAuthorizers<TLComment | TLCommentThread | TLCommentReaction, SessionMeta> {\n\tconst { getUserId } = opts\n\n\t/** A rule is an authorizer that receives the session's user id, resolved for it exactly once. */\n\ttype Rule<Rec extends UnknownRecord> = (\n\t\tuserId: string | null,\n\t\targs: Parameters<TLRecordAuthorizer<Rec, SessionMeta>>[0]\n\t) => Rec | null\n\n\t/** Adapt a rule to the authorizer signature, resolving the session's user id exactly once. */\n\tfunction withUserId<Rec extends UnknownRecord>(\n\t\trule: Rule<Rec>\n\t): TLRecordAuthorizer<Rec, SessionMeta> {\n\t\treturn (args) => rule(getUserId(args.session), args)\n\t}\n\n\t/**\n\t * Authorize a record whose attribution lives in `field`: stamped from the session on create,\n\t * immutable on update. With `ownerOnlyUpdate`, only the author may update it at all.\n\t */\n\tfunction authorizeAuthored<Rec extends UnknownRecord>(\n\t\tfield: keyof Rec & string,\n\t\t{ ownerOnlyUpdate = false } = {}\n\t): Rule<Rec> {\n\t\treturn (userId, { type, prev, next }) => {\n\t\t\tif (type === 'create') {\n\t\t\t\tif (!userId) return null // no identity to attribute \u2192 reject\n\t\t\t\treturn { ...next, [field]: userId } as Rec\n\t\t\t}\n\t\t\tif (type === 'update') {\n\t\t\t\tif (next[field] !== prev[field]) return null // attribution is immutable\n\t\t\t\tif (ownerOnlyUpdate && userId !== prev[field]) return null // only the author edits\n\t\t\t\treturn next\n\t\t\t}\n\t\t\treturn prev\n\t\t}\n\t}\n\n\t/**\n\t * Police a soft-deleted record type on top of `base`: deletion is a write-once `isDeleted`\n\t * flag \u2014 set exactly once, never cleared, only by the record's owner (`ownerOf`), never on\n\t * create \u2014 and clients never hard-delete these records at all. Record removals are\n\t * server-initiated only (server-side deletes don't run authorizers), so once the server\n\t * prunes a flagged record there is no un-delete.\n\t */\n\tfunction authorizeSoftDeleted<Rec extends UnknownRecord & { isDeleted: boolean }>(\n\t\townerOf: (rec: Rec) => string,\n\t\tbase: Rule<Rec>\n\t): Rule<Rec> {\n\t\treturn (userId, args) => {\n\t\t\tif (args.type === 'delete') return null\n\t\t\tconst result = base(userId, args)\n\t\t\tif (!result) return null\n\t\t\t// A record can't be born deleted \u2014 that would smuggle a deletion past the update checks.\n\t\t\tif (args.type === 'create' && args.next.isDeleted) return null\n\t\t\tif (args.type === 'update') {\n\t\t\t\tconst { prev, next } = args\n\t\t\t\tif (prev.isDeleted !== next.isDeleted) {\n\t\t\t\t\tif (prev.isDeleted) return null // write-once: never cleared\n\t\t\t\t\tif (userId !== ownerOf(prev)) return null // only the owner deletes\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn result\n\t\t}\n\t}\n\n\t/**\n\t * Threads stay editable by anyone with access (resolve/reopen), but resolution is itself an\n\t * attribution: a non-null `resolved.by`, set at create or changed by update, must be the\n\t * session's own user.\n\t */\n\tconst authorizeThreadResolution: Rule<TLCommentThread> = (userId, args) => {\n\t\tconst result = authorizeAuthored<TLCommentThread>('createdBy')(userId, args)\n\t\tif (!result) return null\n\t\tif (args.type === 'create') {\n\t\t\t// Delete + re-put could otherwise smuggle in a resolution forged in someone else's name.\n\t\t\tconst { next } = args\n\t\t\tif (next.resolved && next.resolved.by !== userId) return null\n\t\t}\n\t\tif (args.type === 'update') {\n\t\t\tconst { prev, next } = args\n\t\t\tconst changed =\n\t\t\t\tprev.resolved?.at !== next.resolved?.at || prev.resolved?.by !== next.resolved?.by\n\t\t\tif (changed && next.resolved && next.resolved.by !== userId) return null\n\t\t}\n\t\treturn result\n\t}\n\n\t/**\n\t * Reject an update that changes any of `fields`. Used for the structural fields an update must\n\t * never touch: a comment's parent thread and its creation time. `threadId` is what ties a\n\t * comment to its conversation (and, downstream, to a file), so letting an author re-parent an\n\t * existing comment would move it between threads \u2014 and, where threads span files, between\n\t * files. `createdAt` orders threads and bounds the notification feed, so a mutable one lets a\n\t * comment be re-sorted after the fact.\n\t */\n\tfunction immutableFields<Rec extends UnknownRecord>(\n\t\tfields: readonly (keyof Rec & string)[],\n\t\tbase: Rule<Rec>\n\t): Rule<Rec> {\n\t\treturn (userId, args) => {\n\t\t\tif (args.type === 'update') {\n\t\t\t\tconst { prev, next } = args\n\t\t\t\tfor (const field of fields) {\n\t\t\t\t\tif (next[field] !== prev[field]) return null\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn base(userId, args)\n\t\t}\n\t}\n\n\tconst authorizeReactionBase = authorizeAuthored<TLCommentReaction>('userId', {\n\t\townerOnlyUpdate: true,\n\t})\n\n\t/**\n\t * A reaction's id is derived from its (comment, user, emoji) triple (see\n\t * `createCommentReactionId`), which is what makes reaction identity structural. The base rule\n\t * already stamps `userId` from the session and lets only the owner change a reaction \u2014 but the\n\t * id, the comment it points at, and the emoji are all client-supplied, so this wrapper adds two\n\t * things:\n\t *\n\t * - On **create**, the id must be the canonical id for `commentId` + the session's user +\n\t *   `next.emoji`. Without this a forged client could create a record at another user's id slot\n\t *   (locking them out of that reaction), or push a mismatched id that lands two records on one\n\t *   (comment, user, emoji) \u2014 an invariant any persistence layer keyed on the triple relies on.\n\t *\n\t * - On **update**, everything identity-bearing is immutable: `commentId`, `threadId`, `pageId`,\n\t *   and `emoji` all feed the id (directly or by denormalization), so a re-react is a\n\t *   create/delete, not an update. The only thing an update may touch is `createdAt`/`meta`.\n\t *   So the id and the fields it is derived from can never drift apart.\n\t */\n\tconst authorizeReaction: Rule<TLCommentReaction> = (userId, args) => {\n\t\t// Only the reactor may remove their own reaction. Cascades still sweep every reactor's\n\t\t// records because server-initiated writes carry no session and so skip authorizers\n\t\t// entirely \u2014 an open client delete was never what made the sweep work.\n\t\tif (args.type === 'delete') {\n\t\t\treturn userId && userId === args.prev.userId ? args.prev : null\n\t\t}\n\t\tconst result = authorizeReactionBase(userId, args)\n\t\tif (!result) return null\n\t\tif (args.type === 'create') {\n\t\t\t// Unreachable: the base rule already rejected identity-less creates. Checked to narrow.\n\t\t\tif (!userId) return null\n\t\t\tconst { next } = args\n\t\t\tif (next.id !== createCommentReactionId(next.commentId, userId, next.emoji)) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t}\n\t\tif (args.type === 'update') {\n\t\t\tconst { prev, next } = args\n\t\t\tif (next.commentId !== prev.commentId) return null\n\t\t\tif (next.threadId !== prev.threadId) return null\n\t\t\tif (next.pageId !== prev.pageId) return null\n\t\t\tif (next.emoji !== prev.emoji) return null\n\t\t}\n\t\treturn result\n\t}\n\n\treturn {\n\t\tcomment: withUserId(\n\t\t\tauthorizeSoftDeleted<TLComment>(\n\t\t\t\t(comment) => comment.authorId,\n\t\t\t\t// `pageId` stays mutable: it's denormalized from the thread, and moving an anchored\n\t\t\t\t// thread between pages rewrites it on every comment in the thread.\n\t\t\t\timmutableFields<TLComment>(\n\t\t\t\t\t['threadId', 'createdAt'],\n\t\t\t\t\tauthorizeAuthored<TLComment>('authorId', { ownerOnlyUpdate: true })\n\t\t\t\t)\n\t\t\t)\n\t\t),\n\t\t'comment-thread': withUserId(\n\t\t\tauthorizeSoftDeleted<TLCommentThread>(\n\t\t\t\t(thread) => thread.createdBy,\n\t\t\t\timmutableFields<TLCommentThread>(['createdAt'], authorizeThreadResolution)\n\t\t\t)\n\t\t),\n\t\t// A reaction is one user's own record, so the standard attribution rules mostly cover it:\n\t\t// `userId` is stamped from the session and only the reactor can change their reaction, and\n\t\t// the wrapper's id check ties the record to its (comment, user, emoji) slot \u2014 so no one can\n\t\t// forge or hijack another user's reaction. Deletion, though, is deliberately open: anyone\n\t\t// with access to the room may hard-delete any reaction. Reactions have no soft-delete /\n\t\t// `isDeleted` flag (unlike comments) on purpose \u2014 a reaction is a toggle, so removing one is\n\t\t// a plain record delete, and a host cascading a comment or thread deletion must sweep every\n\t\t// reactor's records, not just the caller's own.\n\t\t'comment-reaction': withUserId(authorizeReaction),\n\t}\n}\n"],
+  "mappings": "AAEA;AAAA,EACC;AAAA,OAIM;AAsDA,SAAS,yBACf,MACoF;AACpF,QAAM,EAAE,UAAU,IAAI;AAStB,WAAS,WACR,MACuC;AACvC,WAAO,CAAC,SAAS,KAAK,UAAU,KAAK,OAAO,GAAG,IAAI;AAAA,EACpD;AAMA,WAAS,kBACR,OACA,EAAE,kBAAkB,MAAM,IAAI,CAAC,GACnB;AACZ,WAAO,CAAC,QAAQ,EAAE,MAAM,MAAM,KAAK,MAAM;AACxC,UAAI,SAAS,UAAU;AACtB,YAAI,CAAC,OAAQ,QAAO;AACpB,eAAO,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,OAAO;AAAA,MACnC;AACA,UAAI,SAAS,UAAU;AACtB,YAAI,KAAK,KAAK,MAAM,KAAK,KAAK,EAAG,QAAO;AACxC,YAAI,mBAAmB,WAAW,KAAK,KAAK,EAAG,QAAO;AACtD,eAAO;AAAA,MACR;AACA,aAAO;AAAA,IACR;AAAA,EACD;AASA,WAAS,qBACR,SACA,MACY;AACZ,WAAO,CAAC,QAAQ,SAAS;AACxB,UAAI,KAAK,SAAS,SAAU,QAAO;AACnC,YAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,UAAI,CAAC,OAAQ,QAAO;AAEpB,UAAI,KAAK,SAAS,YAAY,KAAK,KAAK,UAAW,QAAO;AAC1D,UAAI,KAAK,SAAS,UAAU;AAC3B,cAAM,EAAE,MAAM,KAAK,IAAI;AACvB,YAAI,KAAK,cAAc,KAAK,WAAW;AACtC,cAAI,KAAK,UAAW,QAAO;AAC3B,cAAI,WAAW,QAAQ,IAAI,EAAG,QAAO;AAAA,QACtC;AAAA,MACD;AACA,aAAO;AAAA,IACR;AAAA,EACD;AAOA,QAAM,4BAAmD,CAAC,QAAQ,SAAS;AAC1E,UAAM,SAAS,kBAAmC,WAAW,EAAE,QAAQ,IAAI;AAC3E,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,KAAK,SAAS,UAAU;AAE3B,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,KAAK,YAAY,KAAK,SAAS,OAAO,OAAQ,QAAO;AAAA,IAC1D;AACA,QAAI,KAAK,SAAS,UAAU;AAC3B,YAAM,EAAE,MAAM,KAAK,IAAI;AACvB,YAAM,UACL,KAAK,UAAU,OAAO,KAAK,UAAU,MAAM,KAAK,UAAU,OAAO,KAAK,UAAU;AACjF,UAAI,WAAW,KAAK,YAAY,KAAK,SAAS,OAAO,OAAQ,QAAO;AAAA,IACrE;AACA,WAAO;AAAA,EACR;AAUA,WAAS,gBACR,QACA,MACY;AACZ,WAAO,CAAC,QAAQ,SAAS;AACxB,UAAI,KAAK,SAAS,UAAU;AAC3B,cAAM,EAAE,MAAM,KAAK,IAAI;AACvB,mBAAW,SAAS,QAAQ;AAC3B,cAAI,KAAK,KAAK,MAAM,KAAK,KAAK,EAAG,QAAO;AAAA,QACzC;AAAA,MACD;AACA,aAAO,KAAK,QAAQ,IAAI;AAAA,IACzB;AAAA,EACD;AAEA,QAAM,wBAAwB,kBAAqC,UAAU;AAAA,IAC5E,iBAAiB;AAAA,EAClB,CAAC;AAmBD,QAAM,oBAA6C,CAAC,QAAQ,SAAS;AAIpE,QAAI,KAAK,SAAS,UAAU;AAC3B,aAAO,UAAU,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO;AAAA,IAC5D;AACA,UAAM,SAAS,sBAAsB,QAAQ,IAAI;AACjD,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,KAAK,SAAS,UAAU;AAE3B,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,KAAK,OAAO,wBAAwB,KAAK,WAAW,QAAQ,KAAK,KAAK,GAAG;AAC5E,eAAO;AAAA,MACR;AAAA,IACD;AACA,QAAI,KAAK,SAAS,UAAU;AAC3B,YAAM,EAAE,MAAM,KAAK,IAAI;AACvB,UAAI,KAAK,cAAc,KAAK,UAAW,QAAO;AAC9C,UAAI,KAAK,aAAa,KAAK,SAAU,QAAO;AAC5C,UAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,UAAI,KAAK,UAAU,KAAK,MAAO,QAAO;AAAA,IACvC;AACA,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN,SAAS;AAAA,MACR;AAAA,QACC,CAAC,YAAY,QAAQ;AAAA;AAAA;AAAA,QAGrB;AAAA,UACC,CAAC,YAAY,WAAW;AAAA,UACxB,kBAA6B,YAAY,EAAE,iBAAiB,KAAK,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAAA,IACA,kBAAkB;AAAA,MACjB;AAAA,QACC,CAAC,WAAW,OAAO;AAAA,QACnB,gBAAiC,CAAC,WAAW,GAAG,yBAAyB;AAAA,MAC1E;AAAA,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,oBAAoB,WAAW,iBAAiB;AAAA,EACjD;AACD;",
+  "names": []
+}

package/dist-esm/index.d.mts

@@ -0,0 +1,63 @@
+import { TLComment } from '@tldraw/tlschema';
+import { TLCommentReaction } from '@tldraw/tlschema';
+import { TLCommentThread } from '@tldraw/tlschema';
+import type { TLRecordAuthorizers } from '@tldraw/sync-core';
+
+/**
+ * Options for {@link createCommentAuthorizers}.
+ *
+ * @public
+ */
+export declare interface CommentAuthorizerOptions<SessionMeta> {
+    /**
+     * Resolve the authenticated user id for a session from its host-provided `meta`. Return
+     * `null` for anonymous sessions — they can't create comments or threads, and can't perform
+     * any owner-only action. Called exactly once per authorized write.
+     */
+    getUserId(session: {
+        meta: SessionMeta;
+        sessionId: string;
+    }): null | string;
+}
+
+/**
+ * Server-side write authorization for comment records, for use with a sync server's
+ * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and
+ * thread authorship from the session's identity so nothing can be posted, resolved, or deleted
+ * in someone else's name:
+ *
+ * - `comment`: `authorId` is stamped from the session on create (anonymous creates are
+ *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`
+ *   are immutable too — a comment can't be re-parented or back-dated after the fact.
+ * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access
+ *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.
+ * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the
+ *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable
+ *   on update, and only the reactor may delete their own reaction.
+ * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the
+ *   record's owner may set, never cleared, never set at create. Client hard-deletes are always
+ *   rejected — record removals are server-side only.
+ *
+ * Comment records ride alongside your document records, so widen the room's record union to
+ * include them, then spread the result into the authorizer map alongside your own entries:
+ *
+ * @example
+ * ```ts
+ * interface SessionMeta {
+ * 	userId: string | null
+ * }
+ *
+ * type MyRecord = TLRecord | TLComment | TLCommentThread | TLCommentReaction
+ *
+ * new TLSocketRoom<MyRecord, SessionMeta>({
+ * 	authorizeRecord: {
+ * 		...createCommentAuthorizers<SessionMeta>({ getUserId: (session) => session.meta.userId }),
+ * 	},
+ * })
+ * ```
+ *
+ * @public
+ */
+export declare function createCommentAuthorizers<SessionMeta>(opts: CommentAuthorizerOptions<SessionMeta>): TLRecordAuthorizers<TLComment | TLCommentReaction | TLCommentThread, SessionMeta>;
+
+export { }

package/dist-esm/index.mjs

@@ -0,0 +1,11 @@
+import { registerTldrawLibraryVersion } from "@tldraw/utils";
+import { createCommentAuthorizers } from "./comment-authorizers.mjs";
+registerTldrawLibraryVersion(
+  "@tldraw/sync-collaboration",
+  "0.0.0-bootstrap",
+  "esm"
+);
+export {
+  createCommentAuthorizers
+};
+//# sourceMappingURL=index.mjs.map

package/dist-esm/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import { registerTldrawLibraryVersion } from '@tldraw/utils'\n\n// Server-side logic for tldraw's collaboration features, safe to import from any sync\n// server \u2014 no react or client-editor dependencies.\nexport { type CommentAuthorizerOptions, createCommentAuthorizers } from './comment-authorizers'\n\nregisterTldrawLibraryVersion(\n\t(globalThis as any).TLDRAW_LIBRARY_NAME,\n\t(globalThis as any).TLDRAW_LIBRARY_VERSION,\n\t(globalThis as any).TLDRAW_LIBRARY_MODULES\n)\n"],
+  "mappings": "AAAA,SAAS,oCAAoC;AAI7C,SAAwC,gCAAgC;AAExE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AACF;",
+  "names": []
+}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@tldraw/sync-collaboration",
+  "description": "tldraw sync collaboration: server-side write authorization for collaboration features.",
+  "version": "0.0.0-bootstrap",
+  "author": {
+    "name": "tldraw Inc.",
+    "email": "hello@tldraw.com"
+  },
+  "homepage": "https://tldraw.dev",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tldraw/tldraw"
+  },
+  "bugs": {
+    "url": "https://github.com/tldraw/tldraw/issues"
+  },
+  "main": "dist-cjs/index.js",
+  "scripts": {
+    "test-ci": "yarn run -T vitest run --passWithNoTests",
+    "test": "yarn run -T vitest --passWithNoTests",
+    "test-coverage": "yarn run -T vitest run --coverage --passWithNoTests",
+    "build": "yarn run -T tsx ../../internal/scripts/build-package.ts",
+    "build-api": "yarn run -T tsx ../../internal/scripts/build-api.ts",
+    "prepack": "yarn run -T tsx ../../internal/scripts/prepack.ts",
+    "postpack": "../../internal/scripts/postpack.sh",
+    "pack-tarball": "yarn pack",
+    "lint": "yarn run -T tsx ../../internal/scripts/lint.ts"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "dependencies": {
+    "@tldraw/store": "5.2.5",
+    "@tldraw/sync-core": "5.2.5",
+    "@tldraw/tlschema": "5.2.5",
+    "@tldraw/utils": "5.2.5"
+  },
+  "module": "dist-esm/index.mjs",
+  "source": "src/index.ts",
+  "exports": {
+    ".": {
+      "import": "./dist-esm/index.mjs",
+      "require": "./dist-cjs/index.js"
+    }
+  },
+  "files": [
+    "dist-esm",
+    "dist-cjs",
+    "src"
+  ]
+}

package/src/comment-authorizers.test.ts

@@ -0,0 +1,408 @@
+import {
+	TLComment,
+	TLCommentReaction,
+	TLCommentThread,
+	TLPageId,
+	createComment,
+	createCommentId,
+	createCommentReaction,
+	createCommentReactionId,
+	createCommentThread,
+	toRichText,
+} from '@tldraw/tlschema'
+import { describe, expect, it } from 'vitest'
+import { createCommentAuthorizers } from './comment-authorizers'
+
+interface TestMeta {
+	userId: string | null
+}
+
+const authorizers = createCommentAuthorizers<TestMeta>({
+	getUserId: (session) => session.meta.userId,
+})
+
+const pageId = 'page:test' as TLPageId
+const thread = createCommentThread({
+	pageId,
+	anchor: { type: 'page' },
+	createdBy: 'client-claims-alice',
+})
+
+function session(userId: string | null): { sessionId: string; meta: TestMeta } {
+	return { sessionId: 's1', meta: { userId } }
+}
+
+describe('createCommentAuthorizers', () => {
+	// getUserId is documented as called exactly once per write. More than once would let an
+	// impure host callback split identity across checks — e.g. a reaction create where the
+	// stamped userId and the canonical-id check disagree about who is reacting.
+	it('resolves the session user exactly once per authorization', () => {
+		let calls = 0
+		const counted = createCommentAuthorizers<TestMeta>({
+			getUserId: (s) => {
+				calls++
+				return s.meta.userId
+			},
+		})
+		// the worst former offender: a thread update touching both resolution and the soft-delete flag
+		const prev = createCommentThread({ pageId, anchor: { type: 'page' }, createdBy: 'real-bob' })
+		const next = { ...prev, resolved: { at: 1, by: 'real-bob' }, isDeleted: true }
+		expect(
+			counted['comment-thread']!({ session: session('real-bob'), type: 'update', prev, next })
+		).toBe(next)
+		expect(calls).toBe(1)
+	})
+
+	describe('comment', () => {
+		const authorize = authorizers.comment!
+		const comment = (authorId: string) =>
+			createComment({ threadId: thread.id, pageId, authorId, body: toRichText('hi') })
+
+		it('stamps authorId from the session on create, overriding the client value', () => {
+			const result = authorize({
+				session: session('real-bob'),
+				type: 'create',
+				prev: null,
+				next: comment('client-claims-alice'),
+			}) as TLComment
+			expect(result.authorId).toBe('real-bob')
+		})
+
+		it('rejects a create with no authenticated user', () => {
+			expect(
+				authorize({ session: session(null), type: 'create', prev: null, next: comment('anon') })
+			).toBeNull()
+		})
+
+		it('allows the author to edit their own comment', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, body: toRichText('edited') }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes an edit from someone who is not the author', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, body: toRichText('sneakily rewritten') }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes an update that changes the author', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, authorId: 'someone-else' }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes every client hard-delete, even from the author (deletion is soft)', () => {
+			const prev = comment('real-bob')
+			expect(
+				authorize({ session: session('real-bob'), type: 'delete', prev, next: null })
+			).toBeNull()
+			expect(
+				authorize({ session: session('real-mallory'), type: 'delete', prev, next: null })
+			).toBeNull()
+			expect(authorize({ session: session(null), type: 'delete', prev, next: null })).toBeNull()
+		})
+
+		it('lets the author soft-delete their own comment', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, isDeleted: true }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a non-author soft-deleting the comment', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, isDeleted: true }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBeNull()
+			expect(authorize({ session: session(null), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes clearing a soft-delete, even by the author (write-once)', () => {
+			const prev = { ...comment('real-bob'), isDeleted: true }
+			const next = { ...prev, isDeleted: false }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('allows an update that leaves an existing soft-delete untouched', () => {
+			const prev = { ...comment('real-bob'), isDeleted: true }
+			const next = { ...prev, body: toRichText('edited') }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a create with the soft-delete flag already set', () => {
+			const next = { ...comment('real-bob'), isDeleted: true }
+			expect(
+				authorize({ session: session('real-bob'), type: 'create', prev: null, next })
+			).toBeNull()
+		})
+
+		// threadId ties a comment to its conversation (and downstream to a file), so re-parenting an
+		// existing comment must not be an update — even by its own author.
+		it('vetoes re-parenting a comment to another thread', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, threadId: 'comment-thread:other' as TLCommentThread['id'] }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		// createdAt orders threads and bounds the notification feed, so a mutable one lets a comment
+		// be re-sorted (or pinned to the top of the feed) after the fact.
+		it('vetoes back-dating a comment', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, createdAt: 1 }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		// the anchor lifecycle rewrites pageId on every comment when a thread moves pages
+		it('allows a pageId update (threads can move between pages)', () => {
+			const prev = comment('real-bob')
+			const next = { ...prev, pageId: 'page:other' as TLPageId }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBe(next)
+		})
+	})
+
+	describe('comment-thread', () => {
+		const authorize = authorizers['comment-thread']!
+		const makeThread = (createdBy: string) =>
+			createCommentThread({ pageId, anchor: { type: 'page' }, createdBy })
+
+		it('stamps createdBy from the session on create, overriding the client value', () => {
+			const result = authorize({
+				session: session('real-bob'),
+				type: 'create',
+				prev: null,
+				next: makeThread('client-claims-alice'),
+			}) as TLCommentThread
+			expect(result.createdBy).toBe('real-bob')
+		})
+
+		it('vetoes an update that changes the creator', () => {
+			const prev = makeThread('real-bob')
+			const next = { ...prev, createdBy: 'someone-else' }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('lets a non-creator resolve the thread as themselves', () => {
+			const prev = makeThread('real-bob')
+			const next = { ...prev, resolved: { at: 1, by: 'real-mallory' } }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('lets a non-creator reopen a resolved thread', () => {
+			const prev = { ...makeThread('real-bob'), resolved: { at: 1, by: 'real-alice' } }
+			const next = { ...prev, resolved: null }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a resolution attributed to someone else', () => {
+			const prev = makeThread('real-bob')
+			const next = { ...prev, resolved: { at: 1, by: 'real-alice' } }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('allows an update that leaves an existing resolution untouched', () => {
+			const prev = { ...makeThread('real-bob'), resolved: { at: 1, by: 'real-alice' } }
+			// new object reference, same value — must not be treated as a change
+			const next = { ...prev, resolved: { ...prev.resolved } }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a create with a resolution attributed to someone else', () => {
+			const next = { ...makeThread('real-mallory'), resolved: { at: 1, by: 'real-alice' } }
+			expect(
+				authorize({ session: session('real-mallory'), type: 'create', prev: null, next })
+			).toBeNull()
+		})
+
+		it('allows a create resolved by the creator themselves', () => {
+			const next = { ...makeThread('real-bob'), resolved: { at: 1, by: 'real-bob' } }
+			const result = authorize({
+				session: session('real-bob'),
+				type: 'create',
+				prev: null,
+				next,
+			}) as TLCommentThread
+			expect(result.resolved).toEqual({ at: 1, by: 'real-bob' })
+		})
+
+		it('vetoes every client hard-delete, even from the creator (deletion is soft)', () => {
+			const prev = makeThread('real-bob')
+			expect(
+				authorize({ session: session('real-bob'), type: 'delete', prev, next: null })
+			).toBeNull()
+			expect(
+				authorize({ session: session('real-mallory'), type: 'delete', prev, next: null })
+			).toBeNull()
+		})
+
+		it('lets the creator soft-delete their own thread', () => {
+			const prev = makeThread('real-bob')
+			const next = { ...prev, isDeleted: true }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a non-creator soft-deleting the thread', () => {
+			const prev = makeThread('real-bob')
+			const next = { ...prev, isDeleted: true }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBeNull()
+			expect(authorize({ session: session(null), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes clearing a soft-delete, even by the creator (write-once)', () => {
+			const prev = { ...makeThread('real-bob'), isDeleted: true }
+			const next = { ...prev, isDeleted: false }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('allows an update that leaves an existing soft-delete untouched', () => {
+			const prev = { ...makeThread('real-bob'), isDeleted: true }
+			const next = { ...prev, resolved: { at: 2, by: 'real-mallory' } }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBe(next)
+		})
+
+		it('vetoes a create with the soft-delete flag already set', () => {
+			const next = { ...makeThread('real-bob'), isDeleted: true }
+			expect(
+				authorize({ session: session('real-bob'), type: 'create', prev: null, next })
+			).toBeNull()
+		})
+	})
+
+	// A reaction is one user's own record, so it needs no bespoke rule: the standard attribution
+	// guards cover forging (userId is stamped from the session) and tampering (owner-only update).
+	// Crucially there is no shared field, so one person's write can't reach another's reaction.
+	describe('comment-reaction', () => {
+		const authorize = authorizers['comment-reaction']!
+		const makeReaction = (userId: string, emoji = '👍') =>
+			createCommentReaction({
+				commentId: createCommentId('c1'),
+				threadId: thread.id,
+				pageId,
+				userId,
+				emoji,
+			})
+
+		it('stamps userId from the session on create, overriding the client value', () => {
+			// id is bob's canonical slot (so it passes the id check), but the userId field claims
+			// someone else — the server stamps it back to the session user
+			const next: TLCommentReaction = { ...makeReaction('real-bob'), userId: 'client-claims-alice' }
+			const result = authorize({
+				session: session('real-bob'),
+				type: 'create',
+				prev: null,
+				next,
+			}) as TLCommentReaction
+			expect(result.userId).toBe('real-bob')
+		})
+
+		it('rejects a create from a session with no identity', () => {
+			expect(
+				authorize({
+					session: session(null),
+					type: 'create',
+					prev: null,
+					next: makeReaction('anyone'),
+				})
+			).toBeNull()
+		})
+
+		it('vetoes an update that changes the reacting user', () => {
+			const prev = makeReaction('real-bob')
+			const next = { ...prev, userId: 'real-alice' }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		// emoji feeds the id now, so switching emoji is a delete+create, never an update — an update
+		// that changes emoji is rejected (its id would no longer match its emoji)
+		it('vetoes an update that changes the emoji', () => {
+			const prev = makeReaction('real-bob', '👍')
+			const next = { ...prev, emoji: '🎉' }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes changing someone else’s reaction', () => {
+			const prev = makeReaction('real-alice')
+			const next = { ...prev, emoji: '💩' }
+			expect(authorize({ session: session('real-mallory'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('lets the reactor remove their own reaction', () => {
+			const prev = makeReaction('real-bob')
+			expect(authorize({ session: session('real-bob'), type: 'delete', prev, next: null })).toBe(
+				prev
+			)
+		})
+
+		it('vetoes deleting someone else’s reaction', () => {
+			// cascades still sweep every reactor's records: server-initiated writes carry no session
+			// and skip authorizers entirely, so this doesn't need to be open to clients
+			const prev = makeReaction('real-alice')
+			expect(
+				authorize({ session: session('real-mallory'), type: 'delete', prev, next: null })
+			).toBeNull()
+			expect(authorize({ session: session(null), type: 'delete', prev, next: null })).toBeNull()
+		})
+
+		// The id is derived from (comment, user, emoji). A create must land at the session user's own
+		// canonical slot, or a forger could occupy someone else's slot (locking them out) or push a
+		// mismatched id that wedges the table's unique constraint at drain time.
+		it('vetoes a create whose id is not the session user’s canonical slot', () => {
+			// mallory forges a reaction at alice's id slot on the same comment + emoji
+			const next: TLCommentReaction = {
+				...makeReaction('real-mallory', '👍'),
+				id: createCommentReactionId(createCommentId('c1'), 'real-alice', '👍'),
+			}
+			expect(
+				authorize({ session: session('real-mallory'), type: 'create', prev: null, next })
+			).toBeNull()
+		})
+
+		// the id also encodes the emoji, so an id that doesn't match the record's own emoji field
+		// (e.g. id says 👍 but the field says 🎉) is a mismatch and rejected
+		it('vetoes a create whose id emoji disagrees with its emoji field', () => {
+			const next: TLCommentReaction = {
+				...makeReaction('real-mallory', '🎉'),
+				id: createCommentReactionId(createCommentId('c1'), 'real-mallory', '👍'),
+			}
+			expect(
+				authorize({ session: session('real-mallory'), type: 'create', prev: null, next })
+			).toBeNull()
+		})
+
+		it('allows a create whose id is the session user’s canonical slot', () => {
+			const next = makeReaction('real-mallory')
+			expect(
+				authorize({ session: session('real-mallory'), type: 'create', prev: null, next })
+			).not.toBeNull()
+		})
+
+		// the reaction's comment is fixed by its id; an update must not move it onto another comment,
+		// or the id would disagree with commentId and two rows could collide on (commentId, userId)
+		it('vetoes an update that moves the reaction to a different comment', () => {
+			const prev = makeReaction('real-bob')
+			const next = { ...prev, commentId: createCommentId('c2') }
+			expect(authorize({ session: session('real-bob'), type: 'update', prev, next })).toBeNull()
+		})
+
+		it('vetoes an update that changes the denormalized threadId or pageId', () => {
+			const prev = makeReaction('real-bob')
+			expect(
+				authorize({
+					session: session('real-bob'),
+					type: 'update',
+					prev,
+					next: {
+						...prev,
+						threadId: createCommentThread({ pageId, anchor: { type: 'page' }, createdBy: 'x' }).id,
+					},
+				})
+			).toBeNull()
+			expect(
+				authorize({
+					session: session('real-bob'),
+					type: 'update',
+					prev,
+					next: { ...prev, pageId: 'page:other' as typeof prev.pageId },
+				})
+			).toBeNull()
+		})
+	})
+})

package/src/comment-authorizers.ts

@@ -0,0 +1,251 @@
+import type { UnknownRecord } from '@tldraw/store'
+import type { TLRecordAuthorizer, TLRecordAuthorizers } from '@tldraw/sync-core'
+import {
+	createCommentReactionId,
+	type TLComment,
+	type TLCommentReaction,
+	type TLCommentThread,
+} from '@tldraw/tlschema'
+
+/**
+ * Options for {@link createCommentAuthorizers}.
+ *
+ * @public
+ */
+export interface CommentAuthorizerOptions<SessionMeta> {
+	/**
+	 * Resolve the authenticated user id for a session from its host-provided `meta`. Return
+	 * `null` for anonymous sessions — they can't create comments or threads, and can't perform
+	 * any owner-only action. Called exactly once per authorized write.
+	 */
+	getUserId(session: { sessionId: string; meta: SessionMeta }): string | null
+}
+
+/**
+ * Server-side write authorization for comment records, for use with a sync server's
+ * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and
+ * thread authorship from the session's identity so nothing can be posted, resolved, or deleted
+ * in someone else's name:
+ *
+ * - `comment`: `authorId` is stamped from the session on create (anonymous creates are
+ *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`
+ *   are immutable too — a comment can't be re-parented or back-dated after the fact.
+ * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access
+ *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.
+ * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the
+ *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable
+ *   on update, and only the reactor may delete their own reaction.
+ * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the
+ *   record's owner may set, never cleared, never set at create. Client hard-deletes are always
+ *   rejected — record removals are server-side only.
+ *
+ * Comment records ride alongside your document records, so widen the room's record union to
+ * include them, then spread the result into the authorizer map alongside your own entries:
+ *
+ * @example
+ * ```ts
+ * interface SessionMeta {
+ * 	userId: string | null
+ * }
+ *
+ * type MyRecord = TLRecord | TLComment | TLCommentThread | TLCommentReaction
+ *
+ * new TLSocketRoom<MyRecord, SessionMeta>({
+ * 	authorizeRecord: {
+ * 		...createCommentAuthorizers<SessionMeta>({ getUserId: (session) => session.meta.userId }),
+ * 	},
+ * })
+ * ```
+ *
+ * @public
+ */
+export function createCommentAuthorizers<SessionMeta>(
+	opts: CommentAuthorizerOptions<SessionMeta>
+): TLRecordAuthorizers<TLComment | TLCommentThread | TLCommentReaction, SessionMeta> {
+	const { getUserId } = opts
+
+	/** A rule is an authorizer that receives the session's user id, resolved for it exactly once. */
+	type Rule<Rec extends UnknownRecord> = (
+		userId: string | null,
+		args: Parameters<TLRecordAuthorizer<Rec, SessionMeta>>[0]
+	) => Rec | null
+
+	/** Adapt a rule to the authorizer signature, resolving the session's user id exactly once. */
+	function withUserId<Rec extends UnknownRecord>(
+		rule: Rule<Rec>
+	): TLRecordAuthorizer<Rec, SessionMeta> {
+		return (args) => rule(getUserId(args.session), args)
+	}
+
+	/**
+	 * Authorize a record whose attribution lives in `field`: stamped from the session on create,
+	 * immutable on update. With `ownerOnlyUpdate`, only the author may update it at all.
+	 */
+	function authorizeAuthored<Rec extends UnknownRecord>(
+		field: keyof Rec & string,
+		{ ownerOnlyUpdate = false } = {}
+	): Rule<Rec> {
+		return (userId, { type, prev, next }) => {
+			if (type === 'create') {
+				if (!userId) return null // no identity to attribute → reject
+				return { ...next, [field]: userId } as Rec
+			}
+			if (type === 'update') {
+				if (next[field] !== prev[field]) return null // attribution is immutable
+				if (ownerOnlyUpdate && userId !== prev[field]) return null // only the author edits
+				return next
+			}
+			return prev
+		}
+	}
+
+	/**
+	 * Police a soft-deleted record type on top of `base`: deletion is a write-once `isDeleted`
+	 * flag — set exactly once, never cleared, only by the record's owner (`ownerOf`), never on
+	 * create — and clients never hard-delete these records at all. Record removals are
+	 * server-initiated only (server-side deletes don't run authorizers), so once the server
+	 * prunes a flagged record there is no un-delete.
+	 */
+	function authorizeSoftDeleted<Rec extends UnknownRecord & { isDeleted: boolean }>(
+		ownerOf: (rec: Rec) => string,
+		base: Rule<Rec>
+	): Rule<Rec> {
+		return (userId, args) => {
+			if (args.type === 'delete') return null
+			const result = base(userId, args)
+			if (!result) return null
+			// A record can't be born deleted — that would smuggle a deletion past the update checks.
+			if (args.type === 'create' && args.next.isDeleted) return null
+			if (args.type === 'update') {
+				const { prev, next } = args
+				if (prev.isDeleted !== next.isDeleted) {
+					if (prev.isDeleted) return null // write-once: never cleared
+					if (userId !== ownerOf(prev)) return null // only the owner deletes
+				}
+			}
+			return result
+		}
+	}
+
+	/**
+	 * Threads stay editable by anyone with access (resolve/reopen), but resolution is itself an
+	 * attribution: a non-null `resolved.by`, set at create or changed by update, must be the
+	 * session's own user.
+	 */
+	const authorizeThreadResolution: Rule<TLCommentThread> = (userId, args) => {
+		const result = authorizeAuthored<TLCommentThread>('createdBy')(userId, args)
+		if (!result) return null
+		if (args.type === 'create') {
+			// Delete + re-put could otherwise smuggle in a resolution forged in someone else's name.
+			const { next } = args
+			if (next.resolved && next.resolved.by !== userId) return null
+		}
+		if (args.type === 'update') {
+			const { prev, next } = args
+			const changed =
+				prev.resolved?.at !== next.resolved?.at || prev.resolved?.by !== next.resolved?.by
+			if (changed && next.resolved && next.resolved.by !== userId) return null
+		}
+		return result
+	}
+
+	/**
+	 * Reject an update that changes any of `fields`. Used for the structural fields an update must
+	 * never touch: a comment's parent thread and its creation time. `threadId` is what ties a
+	 * comment to its conversation (and, downstream, to a file), so letting an author re-parent an
+	 * existing comment would move it between threads — and, where threads span files, between
+	 * files. `createdAt` orders threads and bounds the notification feed, so a mutable one lets a
+	 * comment be re-sorted after the fact.
+	 */
+	function immutableFields<Rec extends UnknownRecord>(
+		fields: readonly (keyof Rec & string)[],
+		base: Rule<Rec>
+	): Rule<Rec> {
+		return (userId, args) => {
+			if (args.type === 'update') {
+				const { prev, next } = args
+				for (const field of fields) {
+					if (next[field] !== prev[field]) return null
+				}
+			}
+			return base(userId, args)
+		}
+	}
+
+	const authorizeReactionBase = authorizeAuthored<TLCommentReaction>('userId', {
+		ownerOnlyUpdate: true,
+	})
+
+	/**
+	 * A reaction's id is derived from its (comment, user, emoji) triple (see
+	 * `createCommentReactionId`), which is what makes reaction identity structural. The base rule
+	 * already stamps `userId` from the session and lets only the owner change a reaction — but the
+	 * id, the comment it points at, and the emoji are all client-supplied, so this wrapper adds two
+	 * things:
+	 *
+	 * - On **create**, the id must be the canonical id for `commentId` + the session's user +
+	 *   `next.emoji`. Without this a forged client could create a record at another user's id slot
+	 *   (locking them out of that reaction), or push a mismatched id that lands two records on one
+	 *   (comment, user, emoji) — an invariant any persistence layer keyed on the triple relies on.
+	 *
+	 * - On **update**, everything identity-bearing is immutable: `commentId`, `threadId`, `pageId`,
+	 *   and `emoji` all feed the id (directly or by denormalization), so a re-react is a
+	 *   create/delete, not an update. The only thing an update may touch is `createdAt`/`meta`.
+	 *   So the id and the fields it is derived from can never drift apart.
+	 */
+	const authorizeReaction: Rule<TLCommentReaction> = (userId, args) => {
+		// Only the reactor may remove their own reaction. Cascades still sweep every reactor's
+		// records because server-initiated writes carry no session and so skip authorizers
+		// entirely — an open client delete was never what made the sweep work.
+		if (args.type === 'delete') {
+			return userId && userId === args.prev.userId ? args.prev : null
+		}
+		const result = authorizeReactionBase(userId, args)
+		if (!result) return null
+		if (args.type === 'create') {
+			// Unreachable: the base rule already rejected identity-less creates. Checked to narrow.
+			if (!userId) return null
+			const { next } = args
+			if (next.id !== createCommentReactionId(next.commentId, userId, next.emoji)) {
+				return null
+			}
+		}
+		if (args.type === 'update') {
+			const { prev, next } = args
+			if (next.commentId !== prev.commentId) return null
+			if (next.threadId !== prev.threadId) return null
+			if (next.pageId !== prev.pageId) return null
+			if (next.emoji !== prev.emoji) return null
+		}
+		return result
+	}
+
+	return {
+		comment: withUserId(
+			authorizeSoftDeleted<TLComment>(
+				(comment) => comment.authorId,
+				// `pageId` stays mutable: it's denormalized from the thread, and moving an anchored
+				// thread between pages rewrites it on every comment in the thread.
+				immutableFields<TLComment>(
+					['threadId', 'createdAt'],
+					authorizeAuthored<TLComment>('authorId', { ownerOnlyUpdate: true })
+				)
+			)
+		),
+		'comment-thread': withUserId(
+			authorizeSoftDeleted<TLCommentThread>(
+				(thread) => thread.createdBy,
+				immutableFields<TLCommentThread>(['createdAt'], authorizeThreadResolution)
+			)
+		),
+		// A reaction is one user's own record, so the standard attribution rules mostly cover it:
+		// `userId` is stamped from the session and only the reactor can change their reaction, and
+		// the wrapper's id check ties the record to its (comment, user, emoji) slot — so no one can
+		// forge or hijack another user's reaction. Deletion, though, is deliberately open: anyone
+		// with access to the room may hard-delete any reaction. Reactions have no soft-delete /
+		// `isDeleted` flag (unlike comments) on purpose — a reaction is a toggle, so removing one is
+		// a plain record delete, and a host cascading a comment or thread deletion must sweep every
+		// reactor's records, not just the caller's own.
+		'comment-reaction': withUserId(authorizeReaction),
+	}
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+import { registerTldrawLibraryVersion } from '@tldraw/utils'
+
+// Server-side logic for tldraw's collaboration features, safe to import from any sync
+// server — no react or client-editor dependencies.
+export { type CommentAuthorizerOptions, createCommentAuthorizers } from './comment-authorizers'
+
+registerTldrawLibraryVersion(
+	(globalThis as any).TLDRAW_LIBRARY_NAME,
+	(globalThis as any).TLDRAW_LIBRARY_VERSION,
+	(globalThis as any).TLDRAW_LIBRARY_MODULES
+)