@tldraw/sync-collaboration 0.0.0-bootstrap → 5.3.0-canary.04044ed9e96d

package/dist-esm/index.d.mts

@@ -10,33 +10,124 @@ import type { TLRecordAuthorizers } from '@tldraw/sync-core';
  */
 export declare interface CommentAuthorizerOptions<SessionMeta> {
     /**
-     * Resolve the authenticated user id for a session from its host-provided `meta`. Return
-     * `null` for anonymous sessions — they can't create comments or threads, and can't perform
-     * any owner-only action. Called exactly once per authorized write.
+     * Resolve the authenticated user id for a session from its host-provided `meta`. Return `null`
+     * for anonymous sessions — they can't create records, and own none, so the default
+     * {@link CommentAuthorizerOptions.canModifyComment} grants them no edits or deletes either.
      */
     getUserId(session: {
+        isReadonly: boolean;
         meta: SessionMeta;
         sessionId: string;
     }): null | string;
+    /**
+     * Whether a session may write comment records at all — checked before the per-type rules.
+     * Defaults to `({ isReadonly }) => !isReadonly`, so read-only viewers can read threads but not
+     * post. Override to decouple the lanes: `() => true` allows commenting on a read-only canvas.
+     */
+    canComment?(session: {
+        isReadonly: boolean;
+        meta: SessionMeta;
+        sessionId: string;
+    }): boolean;
+    /**
+     * Whether a session may make a particular write against a particular stored record: editing or
+     * deleting a comment, or deleting a thread. Defaults to
+     * `({ userId, ownerId }) => userId === ownerId` — the owner-only rule enforced up to now.
+     * Override to widen it (a workspace admin or moderator who may take down anyone's comment) or
+     * to narrow it (no edits after an hour).
+     *
+     * The counterpart to `canModifyComment` in `@tldraw/commenting`, which decides which
+     * affordances the UI offers. This one is the real rule, and the two want widening together: a
+     * delete the client offers and this rejects is applied locally, vetoed, and rebased away — the
+     * comment comes back with nothing to explain it.
+     *
+     * Asked after {@link CommentAuthorizerOptions.canComment} and after the structural rules, so it
+     * can only widen *who* may write, never *what* a write may contain. However permissive the
+     * callback, attribution is still stamped from the session and immutable, `isDeleted` is still
+     * write-once and never set at create, `threadId` and `createdAt` are still frozen, a
+     * resolution is still the resolver's own, and clients still can't hard-delete.
+     *
+     * A soft delete that changes anything besides the flag is asked about twice — once as the
+     * delete, once as an edit — so granting deletes alone can't be talked into an edit.
+     *
+     * Called at most once per authorized write, twice for that combined case.
+     *
+     * @example
+     * ```ts
+     * createCommentAuthorizers<SessionMeta>({
+     * 	getUserId: (session) => session.meta.userId,
+     * 	// Moderators may take anything down. Editing stays the author's, whoever you are.
+     * 	canModifyComment: (ctx) =>
+     * 		(ctx.action !== 'edit-comment' && isModerator(ctx.session.meta)) ||
+     * 		ctx.userId === ctx.ownerId,
+     * })
+     * ```
+     */
+    canModifyComment?(ctx: CommentModificationAuthContext<SessionMeta>): boolean;
 }
 
+/**
+ * A comment write that belongs to someone in particular, and the stored record it targets — the
+ * argument to {@link CommentAuthorizerOptions.canModifyComment}, and the server-side mirror of
+ * `CommentModification` in `@tldraw/commenting`.
+ *
+ * The record is the one the room holds, never the client's version of it: the incoming record is
+ * the thing being authorized, so a rule that read it would be asking the writer who owns what
+ * they're writing to.
+ *
+ * Resolving, reopening, and reacting aren't here, matching the client option: none of them is
+ * anyone's in particular, so {@link CommentAuthorizerOptions.canComment} is the only gate on them.
+ *
+ * @public
+ */
+export declare type CommentModification = {
+    readonly action: 'delete-comment';
+    readonly comment: TLComment;
+} | {
+    readonly action: 'delete-thread';
+    readonly thread: TLCommentThread;
+} | {
+    readonly action: 'edit-comment';
+    readonly comment: TLComment;
+};
+
+/**
+ * The argument to {@link CommentAuthorizerOptions.canModifyComment}: which write, against which
+ * stored record, by which session.
+ *
+ * `ownerId` is that record's owner — a comment's `authorId`, a thread's `createdBy` — so a callback
+ * widening the default doesn't have to know which field each record keeps it in.
+ *
+ * @public
+ */
+export declare type CommentModificationAuthContext<SessionMeta> = {
+    readonly ownerId: string;
+    readonly session: {
+        isReadonly: boolean;
+        meta: SessionMeta;
+        sessionId: string;
+    };
+    readonly userId: null | string;
+} & CommentModification;
+
 /**
  * Server-side write authorization for comment records, for use with a sync server's
- * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces comment and
- * thread authorship from the session's identity so nothing can be posted, resolved, or deleted
- * in someone else's name:
- *
- * - `comment`: `authorId` is stamped from the session on create (anonymous creates are
- *   rejected) and immutable afterwards; only the author may update. `threadId` and `createdAt`
- *   are immutable too — a comment can't be re-parented or back-dated after the fact.
- * - `comment-thread`: `createdBy` and `createdAt` are stamped/fixed on create. Anyone with access
- *   may resolve/reopen, but a non-null `resolved.by` must be the session's own user.
- * - `comment-reaction`: `userId` is stamped on create and immutable; a create must land at the
- *   canonical id for its (comment, user, emoji) triple, everything identity-bearing is immutable
- *   on update, and only the reactor may delete their own reaction.
- * - Deletion is soft for comments and threads: a write-once `isDeleted` flag that only the
- *   record's owner may set, never cleared, never set at create. Client hard-deletes are always
- *   rejected — record removals are server-side only.
+ * `authorizeRecord` option (see `TLSocketRoom` in `@tldraw/sync-core`). Forces authorship from the
+ * session's identity so nothing can be posted, resolved, or deleted in someone else's name:
+ *
+ * - `comment`: `authorId` is stamped on create (anonymous creates rejected) and immutable after,
+ *   and who may update is `canModifyComment`'s call — the author's, unless widened. `threadId` and
+ *   `createdAt` are immutable too.
+ * - `comment-thread`: `createdBy` and `createdAt` are fixed on create. Anyone with access may
+ *   resolve/reopen, but a non-null `resolved.by` must be the session's own user.
+ * - `comment-reaction`: `userId` is stamped and immutable, a create must land at the canonical id
+ *   for its (comment, user, emoji) triple, and only the reactor may delete their own.
+ * - Deletion is soft for comments and threads: a write-once `isDeleted` flag, never set at create.
+ *   Client hard-deletes are always rejected — record removals are server-side only.
+ * - `canComment` gates every write before the per-type rules, defaulting to `!isReadonly`.
+ * - `canModifyComment` decides who may edit a comment, delete a comment, or delete a thread. It
+ *   defaults to the record's owner, and is asked after the structural rules above, so widening it
+ *   grants no more than those three writes on records the session doesn't own.
  *
  * Comment records ride alongside your document records, so widen the room's record union to
  * include them, then spread the result into the authorizer map alongside your own entries:

package/dist-esm/index.mjs

@@ -1,8 +1,10 @@
 import { registerTldrawLibraryVersion } from "@tldraw/utils";
-import { createCommentAuthorizers } from "./comment-authorizers.mjs";
+import {
+  createCommentAuthorizers
+} from "./comment-authorizers.mjs";
 registerTldrawLibraryVersion(
   "@tldraw/sync-collaboration",
-  "0.0.0-bootstrap",
+  "5.3.0-canary.04044ed9e96d",
   "esm"
 );
 export {

package/dist-esm/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["import { registerTldrawLibraryVersion } from '@tldraw/utils'\n\n// Server-side logic for tldraw's collaboration features, safe to import from any sync\n// server \u2014 no react or client-editor dependencies.\nexport { type CommentAuthorizerOptions, createCommentAuthorizers } from './comment-authorizers'\n\nregisterTldrawLibraryVersion(\n\t(globalThis as any).TLDRAW_LIBRARY_NAME,\n\t(globalThis as any).TLDRAW_LIBRARY_VERSION,\n\t(globalThis as any).TLDRAW_LIBRARY_MODULES\n)\n"],
-  "mappings": "AAAA,SAAS,oCAAoC;AAI7C,SAAwC,gCAAgC;AAExE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["import { registerTldrawLibraryVersion } from '@tldraw/utils'\n\n// Server-side logic for tldraw's collaboration features, safe to import from any sync\n// server \u2014 no react or client-editor dependencies.\nexport {\n\ttype CommentAuthorizerOptions,\n\ttype CommentModification,\n\ttype CommentModificationAuthContext,\n\tcreateCommentAuthorizers,\n} from './comment-authorizers'\n\nregisterTldrawLibraryVersion(\n\t(globalThis as any).TLDRAW_LIBRARY_NAME,\n\t(globalThis as any).TLDRAW_LIBRARY_VERSION,\n\t(globalThis as any).TLDRAW_LIBRARY_MODULES\n)\n"],
+  "mappings": "AAAA,SAAS,oCAAoC;AAI7C;AAAA,EAIC;AAAA,OACM;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tldraw/sync-collaboration",
   "description": "tldraw sync collaboration: server-side write authorization for collaboration features.",
-  "version": "0.0.0-bootstrap",
+  "version": "5.3.0-canary.04044ed9e96d",
   "author": {
     "name": "tldraw Inc.",
     "email": "hello@tldraw.com"
@@ -31,10 +31,10 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@tldraw/store": "5.2.5",
-    "@tldraw/sync-core": "5.2.5",
-    "@tldraw/tlschema": "5.2.5",
-    "@tldraw/utils": "5.2.5"
+    "@tldraw/store": "5.3.0-canary.04044ed9e96d",
+    "@tldraw/sync-core": "5.3.0-canary.04044ed9e96d",
+    "@tldraw/tlschema": "5.3.0-canary.04044ed9e96d",
+    "@tldraw/utils": "5.3.0-canary.04044ed9e96d"
   },
   "module": "dist-esm/index.mjs",
   "source": "src/index.ts",