@tldraw/sync-core 5.3.0-internal.d205573d66cb → 5.3.0-next.0362a8b4a246

package/src/lib/TLSyncRoom.ts

@@ -121,6 +121,69 @@ export interface RoomSnapshot {
 	schema?: SerializedSchema
 }
 
+/**
+ * Authorizes a single record write from a client: any per-record, per-session rule the host wants
+ * to enforce server-side — veto writes the session isn't allowed to make, or rewrite the record on
+ * create. The session's `meta` carries whatever the rule needs (identity, roles, …); for example,
+ * force a comment's `authorId` to the signed-in user so nobody can post in someone else's name.
+ *
+ * Called on **create**, **update**, and **delete** of records whose `typeName` it's registered for
+ * (see {@link TLRecordAuthorizers}), and only for client pushes — never for server-initiated writes.
+ *
+ * `prev` and `next` are always at the **server's** schema version: client writes are migrated
+ * before the authorizer runs, so guarding or stamping a field never requires knowing what older
+ * clients call it. On create, the record you return is what gets stored (after validation) — no
+ * migration runs afterwards, so stamped fields can't be clobbered.
+ *
+ * Return `null` to reject the write — it's skipped and the client self-corrects, exactly like the
+ * `objectAccess` gate. Otherwise the write is allowed, and:
+ *
+ * - on **create**, the record you return is what gets stored, so stamp identity fields here (e.g.
+ *   set `authorId` from `session.meta`);
+ * - on **update** and **delete**, only allow-vs-reject is used (the returned record's contents are
+ *   ignored), so use them to veto changes to immutable fields or unauthorized deletes — return
+ *   `next`/`prev` to allow, `null` to reject.
+ *
+ * ⚠︎ Runs synchronously inside the commit transaction, on the same path as every document edit — it
+ * must be fast and do **no** I/O. `next`/`prev` are client-controlled records, so treat their
+ * contents as untrusted; prefer returning `null` to reject over throwing, though a throw is
+ * caught, logged, and treated as a rejection (fail closed) rather than crashing the push. For
+ * expensive, async checks (e.g. resolving mentions against who can access a file), react after the
+ * fact via `onCommittedChanges`.
+ *
+ * @public
+ */
+export type TLRecordAuthorizer<Rec extends UnknownRecord, SessionMeta> = (
+	args: {
+		/** The session performing the write: its host-provided `meta` (e.g. the authenticated user
+		 *  id) and the canvas-lane `isReadonly` state, for hosts whose object-lane policy follows
+		 *  canvas access. */
+		session: { sessionId: string; isReadonly: boolean; meta: SessionMeta }
+	} & (
+		| { type: 'create'; prev: null; next: Rec }
+		| { type: 'update'; prev: Rec; next: Rec }
+		| { type: 'delete'; prev: Rec; next: null }
+	)
+) => Rec | null
+
+/**
+ * A map from record `typeName` to a {@link TLRecordAuthorizer} for that record type. Only listed
+ * types are authorized; every other record writes through untouched, so this stays off the hot path
+ * for the vast majority of writes (shape drags etc.).
+ *
+ * Each authorizer is typed to its record — e.g. `next` in the `comment` entry is a `TLComment` — so
+ * renaming a field on the record makes the authorizer that reads it fail to compile, rather than
+ * silently stamp or guard the wrong field.
+ *
+ * Presence records are never authorized (presence is per-session and ephemeral); registering the
+ * presence typeName is a construction-time error.
+ *
+ * @public
+ */
+export type TLRecordAuthorizers<R extends UnknownRecord, SessionMeta> = {
+	[K in R['typeName']]?: TLRecordAuthorizer<Extract<R, { typeName: K }>, SessionMeta>
+}
+
 /**
  * A collaborative workspace that manages multiple client sessions and synchronizes
  * document changes between them. The room serves as the authoritative source for
@@ -248,8 +311,33 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	public readonly schema: StoreSchema<R, any>
 	private onPresenceChange?(): void
 	private onCommittedChanges?(args: { diff: TLSyncForwardDiff<R>; documentClock: number }): void
+	private readonly authorizeRecord?: TLRecordAuthorizers<R, SessionMeta>
 	private readonly sessionIdleTimeout: number
 
+	/**
+	 * The authorizer registered for a record type, widened to the room's record union. Each entry in
+	 * `authorizeRecord` is typed to its specific record; the cast here is the one place we can't
+	 * statically correlate a runtime `typeName` with its record type, so it lives in the library
+	 * rather than in every consumer.
+	 */
+	private authorizerFor(typeName: R['typeName']): TLRecordAuthorizer<R, SessionMeta> | undefined {
+		const authorize = this.authorizeRecord?.[typeName] as
+			| TLRecordAuthorizer<R, SessionMeta>
+			| undefined
+		if (!authorize) return undefined
+		// Fail closed: an authorizer that throws rejects the write (and is logged) rather than
+		// aborting the whole push. Authorizers are security-sensitive, so a bug must never let a
+		// write through.
+		return (args) => {
+			try {
+				return authorize(args)
+			} catch (e) {
+				this.log?.error?.('record authorizer threw; rejecting the write', e)
+				return null
+			}
+		}
+	}
+
 	constructor(opts: {
 		log?: TLSyncLog
 		schema: StoreSchema<R, any>
@@ -267,6 +355,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		 * gated per session by `objectAccess` rather than `isReadonly`.
 		 */
 		objectTypes?: readonly string[]
+		/**
+		 * Per-type authorizers for client record writes (create, update, delete): veto or, on
+		 * create, rewrite. See {@link TLRecordAuthorizers}.
+		 */
+		authorizeRecord?: TLRecordAuthorizers<R, SessionMeta>
 		storage: TLSyncStorage<R>
 		clientTimeout?: number
 	}) {
@@ -274,6 +367,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		this.log = opts.log
 		this.onPresenceChange = opts.onPresenceChange
 		this.onCommittedChanges = opts.onCommittedChanges
+		this.authorizeRecord = opts.authorizeRecord
 		this.storage = opts.storage
 		this.sessionIdleTimeout = opts.clientTimeout ?? SESSION_IDLE_TIMEOUT
 
@@ -315,6 +409,15 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 		this.presenceType = presenceTypes.values().next()?.value ?? null
 
+		// The presence lane never consults authorizers, so a presence key in `authorizeRecord`
+		// would be a silent no-op — fail loudly at construction instead.
+		if (this.presenceType && this.authorizeRecord) {
+			assert(
+				!getOwnProperty(this.authorizeRecord, this.presenceType.typeName),
+				`TLSyncRoom: authorizeRecord['${this.presenceType.typeName}'] is a presence type; presence records are not authorized`
+			)
+		}
+
 		const { documentClock } = this.storage.transaction((txn) => {
 			this.schema.migrateStorage(txn)
 		})
@@ -1079,7 +1182,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			storage: MinimalDocStore<R>,
 			changes: ActualChanges,
 			id: string,
-			_state: R
+			_state: R,
+			authorize?: (prev: R | null, next: R) => R | null
 		): Result<void, void> => {
 			const res = session
 				? this.schema.migratePersistedRecord(_state, session.serializedSchema, 'up')
@@ -1087,11 +1191,19 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			if (res.type === 'error') {
 				throw new TLSyncError(res.reason, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
 			}
-			const { value: state } = res
+			let { value: state } = res
 
 			// Get the existing document, if any
 			const doc = storage.get(id) as R | undefined
 
+			// Authorize on the up-migrated record; on create the authorizer's return is stored as-is,
+			// so no later migration can clobber stamped fields.
+			if (authorize) {
+				const result = authorize(doc ?? null, state)
+				if (!result) return Result.ok(undefined) // vetoed: skip the op, the client self-corrects
+				if (!doc) state = result // create: store the authorizer's (stamped) record
+			}
+
 			if (doc) {
 				// If there's an existing document, replace it with the new state
 				// but propagate a diff rather than the entire value
@@ -1118,7 +1230,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			storage: MinimalDocStore<R>,
 			changes: ActualChanges,
 			id: string,
-			patch: ObjectDiff
+			patch: ObjectDiff,
+			authorize?: (prev: R, next: R) => R | null
 		) => {
 			// if it was already deleted, there's no need to apply the patch
 			const doc = storage.get(id) as R | undefined
@@ -1138,6 +1251,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				// If the versions are compatible, apply the patch and propagate the patch op
 				const diff = applyAndDiffRecord(doc, patch, recordType, legacyAppendMode)
 				if (diff) {
+					// Authorize on the committed candidate — the record that will actually be stored.
+					if (authorize && !authorize(doc, diff[1])) return
 					storage.set(id, diff[1])
 					propagateOp(changes, id, [RecordOpType.Patch, diff[0]], doc, diff[1])
 				}
@@ -1157,6 +1272,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				// replace the state with the upgraded version and propagate the patch op
 				const diff = diffAndValidateRecord(doc, upgraded.value, recordType, legacyAppendMode)
 				if (diff) {
+					// Authorize on the committed candidate — the upgraded record, not a raw preview.
+					if (authorize && !authorize(doc, upgraded.value)) return
 					storage.set(id, upgraded.value)
 					propagateOp(changes, id, [RecordOpType.Patch, diff], doc, upgraded.value)
 				}
@@ -1227,7 +1344,72 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 										TLSyncErrorCloseEventReason.INVALID_RECORD
 									)
 								}
-								addDocument(txn, docChanges, id, op[1])
+								const record = op[1]
+								// A put must not change the record's typeName. Two reasons, and the first
+								// applies whether or not authorizers are configured: the write gate above
+								// keyed off the *incoming* typeName, so a swap between lanes (document <->
+								// object) would let a session denied on one lane write through the other by
+								// relabeling an existing record. The second is that the authorizer lookup
+								// also keys off the incoming typeName while the replace path validates
+								// against the stored one, so a swap would consult the wrong authorizer (or
+								// none). Skip it like a veto; the client self-corrects.
+								const prevRecord = session ? ((txn.get(id) as R | undefined) ?? null) : null
+								if (session && prevRecord && prevRecord.typeName !== record.typeName) {
+									this.log?.warn?.(
+										'skipping put that changes typeName',
+										`${prevRecord.typeName} -> ${record.typeName}`,
+										id,
+										'session:',
+										session.sessionId
+									)
+									continue
+								}
+								// Per-type authorizer: stamp/veto the write from the session's identity.
+								// Client pushes only; runs inside `addDocument`, on the up-migrated record.
+								let authorize: ((prev: R | null, next: R) => R | null) | undefined
+								if (session && this.authorizeRecord) {
+									const authorizePut = this.authorizerFor(record.typeName)
+									if (authorizePut) {
+										authorize = (prevRec, next) => {
+											const result = authorizePut(
+												prevRec
+													? {
+															session: {
+																sessionId: session.sessionId,
+																isReadonly: session.isReadonly,
+																meta: session.meta,
+															},
+															type: 'update',
+															prev: prevRec,
+															next,
+														}
+													: {
+															session: {
+																sessionId: session.sessionId,
+																isReadonly: session.isReadonly,
+																meta: session.meta,
+															},
+															type: 'create',
+															prev: null,
+															next,
+														}
+											)
+											if (!result) {
+												this.log?.warn?.(
+													'authorizer vetoed put',
+													record.typeName,
+													id,
+													'session:',
+													session.sessionId
+												)
+												return null
+											}
+											// create: store the stamped record; update: allow/veto only
+											return prevRec ? next : result
+										}
+									}
+								}
+								addDocument(txn, docChanges, id, record, authorize)
 								break
 							}
 							case RecordOpType.Patch: {
@@ -1235,17 +1417,69 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								// if it was already deleted, there's no need to apply the patch
 								if (!doc) continue
 								if (!canWrite(doc.typeName)) continue
+								// Per-type authorizer (update, allow/veto only): runs inside `patchDocument`
+								// on the committed candidate, never on a raw client-version preview.
+								const authorizePatch = session && this.authorizerFor(doc.typeName)
+								const authorize = authorizePatch
+									? (prev: R, next: R) => {
+											const result = authorizePatch({
+												session: {
+													sessionId: session.sessionId,
+													isReadonly: session.isReadonly,
+													meta: session.meta,
+												},
+												type: 'update',
+												prev,
+												next,
+											})
+											if (!result) {
+												this.log?.warn?.(
+													'authorizer vetoed patch',
+													doc.typeName,
+													id,
+													'session:',
+													session.sessionId
+												)
+											}
+											return result
+										}
+									: undefined
 								// Try to patch the document. If it fails, stop here.
-								patchDocument(txn, docChanges, id, op[1])
+								patchDocument(txn, docChanges, id, op[1], authorize)
 								break
 							}
 							case RecordOpType.Remove: {
-								const doc = txn.get(id)
+								const doc = txn.get(id) as R | undefined
 								if (!doc) {
 									// If the doc was already deleted, don't do anything, no need to propagate a delete op
 									continue
 								}
 								if (!canWrite(doc.typeName)) continue
+								// Per-type authorizer (delete): veto deletes the session isn't allowed to make,
+								// e.g. deleting someone else's comment. Allow/veto only.
+								const authorizeRemove = session && this.authorizerFor(doc.typeName)
+								if (
+									authorizeRemove &&
+									!authorizeRemove({
+										session: {
+											sessionId: session.sessionId,
+											isReadonly: session.isReadonly,
+											meta: session.meta,
+										},
+										type: 'delete',
+										prev: doc,
+										next: null,
+									})
+								) {
+									this.log?.warn?.(
+										'authorizer vetoed delete',
+										doc.typeName,
+										id,
+										'session:',
+										session.sessionId
+									)
+									continue
+								}
 
 								// Delete the document and propagate the delete op
 								// delete automatically creates tombstones

package/src/test/objectStore.test.ts

@@ -83,6 +83,15 @@ function makeRoom(
 		snapshot?: RoomSnapshot
 		objectTypes?: readonly string[]
 		onCommittedChanges?(args: { diff: any; documentClock: number }): void
+		authorizeRecord?: {
+			[typeName: string]: (args: {
+				session: { sessionId: string; isReadonly: boolean; meta: any }
+				type: 'create' | 'update' | 'delete'
+				prev: any
+				next: any
+			}) => any
+		}
+		log?: any
 	} = {}
 ) {
 	const storage = new InMemorySyncStorage<R>({
@@ -100,6 +109,8 @@ function makeRoom(
 		storage,
 		objectTypes: opts.objectTypes,
 		onCommittedChanges: opts.onCommittedChanges,
+		authorizeRecord: opts.authorizeRecord,
+		log: opts.log,
 	})
 	disposables.push(() => room.close())
 	return { storage, room }
@@ -112,13 +123,14 @@ function connectSession(
 		isReadonly?: boolean
 		objectAccess?: 'read' | 'write'
 		clear?: boolean
+		meta?: any
 	} = {}
 ): MockSocket {
 	const socket = makeSocket()
 	room.handleNewSession({
 		sessionId,
 		socket,
-		meta: undefined,
+		meta: opts.meta,
 		isReadonly: opts.isReadonly ?? false,
 		objectAccess: opts.objectAccess,
 	})
@@ -384,4 +396,284 @@ describe('object store lane', () => {
 			expect(onCommittedChanges).not.toHaveBeenCalled()
 		})
 	})
+
+	describe('authorizeRecord', () => {
+		it('rejects a presence typeName key at construction', () => {
+			expect(() => makeRoom({ authorizeRecord: { presence: ({ next }: any) => next } })).toThrow(
+				/presence/
+			)
+		})
+
+		// A per-type authorizer like dotcom's: stamp the note's text from the session's user id on
+		// create, keep it immutable on update, allow deletes.
+		const authorizeNote = ({ session, type, prev, next }: any) => {
+			if (type === 'create') {
+				const userId = session.meta?.userId
+				if (!userId) return null
+				return { ...next, text: `by:${userId}` }
+			}
+			if (type === 'update') return next.text === prev.text ? next : null
+			return prev // delete allowed
+		}
+
+		function withNote(authorize: any, extra: any = {}) {
+			return makeRoom({ objectTypes: ['note'], authorizeRecord: { note: authorize }, ...extra })
+		}
+
+		function seededWithNote(authorize: any) {
+			const note = Note.create({ text: 'by:user-alice' })
+			const { room, storage } = withNote(authorize, {
+				snapshot: {
+					documents: [{ state: note, lastChangedClock: 0 }],
+					clock: 0,
+					documentClock: 0,
+					schema: schema.serialize(),
+				},
+			})
+			return { room, storage, note }
+		}
+
+		const storedNote = (storage: InMemorySyncStorage<R>, id: string) =>
+			storage.getObjectsSnapshot().find((d) => d.state.id === id)?.state as any
+
+		it('exposes the session isReadonly flag to the authorizer', () => {
+			const authorize = vi.fn(({ next }: any) => next)
+			const { room } = withNote(authorize)
+			// a canvas-readonly session can still write the object lane (objectAccess defaults to
+			// 'write'), which is exactly why authorizers need to see isReadonly independently
+			connectSession(room, 'reader', { isReadonly: true, meta: { userId: 'u' } })
+
+			const note = Note.create({ text: 'x' })
+			push(room, 'reader', { [note.id]: [RecordOpType.Put, note] })
+
+			expect(authorize.mock.calls[0][0].session.isReadonly).toBe(true)
+
+			authorize.mockClear()
+			connectSession(room, 'writer', { isReadonly: false, meta: { userId: 'u' } })
+			const note2 = Note.create({ text: 'y' })
+			push(room, 'writer', { [note2.id]: [RecordOpType.Put, note2] })
+
+			expect(authorize.mock.calls[0][0].session.isReadonly).toBe(false)
+		})
+
+		it('stamps a created record from the session, overriding the client value', () => {
+			const { room, storage } = withNote(authorizeNote)
+			const socket = connectSession(room, 'alice', { meta: { userId: 'user-alice' } })
+
+			const note = Note.create({ text: 'forged' })
+			push(room, 'alice', { [note.id]: [RecordOpType.Put, note] })
+
+			// the server rewrote the record, so it rebases the client onto the stamped value
+			expect(lastPushResult(socket)).toMatchObject({
+				action: {
+					rebaseWithDiff: { [note.id]: [RecordOpType.Put, { ...note, text: 'by:user-alice' }] },
+				},
+			})
+			expect(storedNote(storage, note.id)?.text).toBe('by:user-alice')
+		})
+
+		it('rejects a create the authorizer denies (returns null)', () => {
+			const { room, storage } = withNote(authorizeNote)
+			const socket = connectSession(room, 'anon', { meta: { userId: null } })
+
+			const note = Note.create({ text: 'nope' })
+			push(room, 'anon', { [note.id]: [RecordOpType.Put, note] })
+
+			expect(socket.close).not.toHaveBeenCalled()
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedIds(storage)).toEqual([])
+		})
+
+		it('only runs for registered types — other records write through untouched', () => {
+			const seen: string[] = []
+			const { room, storage } = withNote(({ next }: any) => {
+				seen.push('note')
+				return next
+			})
+			connectSession(room, 'writer', { meta: { userId: 'u' } })
+
+			const doc = Doc.create({ title: 'hi' })
+			push(room, 'writer', { [doc.id]: [RecordOpType.Put, doc] })
+
+			expect(seen).toEqual([])
+			expect(storedIds(storage)).toEqual([doc.id])
+		})
+
+		it('authorizes document-lane record types', () => {
+			// authorize `doc`, a document-lane record
+			const { room, storage } = makeRoom({
+				objectTypes: ['note'],
+				authorizeRecord: {
+					doc: ({ type, next }: any) => (type === 'create' ? { ...next, title: 'stamped' } : next),
+				},
+			})
+			connectSession(room, 'writer', { meta: { userId: 'u' } })
+
+			const doc = Doc.create({ title: 'client' })
+			push(room, 'writer', { [doc.id]: [RecordOpType.Put, doc] })
+
+			const stored = storage.getSnapshot().documents.find((d) => d.state.id === doc.id)
+				?.state as any
+			expect(stored?.title).toBe('stamped')
+		})
+
+		it('vetoes an update that changes an immutable field (patch)', () => {
+			const { room, storage, note } = seededWithNote(authorizeNote)
+			const socket = connectSession(room, 'mallory', { meta: { userId: 'user-mallory' } })
+
+			push(room, 'mallory', {
+				[note.id]: [RecordOpType.Patch, { text: [ValueOpType.Put, 'tampered'] }],
+			})
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedNote(storage, note.id)?.text).toBe('by:user-alice')
+		})
+
+		it('allows an update the authorizer permits (patch)', () => {
+			const { room, storage, note } = seededWithNote(({ type, prev, next }: any) =>
+				type === 'delete' ? prev : next
+			)
+			connectSession(room, 'alice', { meta: { userId: 'u' } })
+
+			push(room, 'alice', {
+				[note.id]: [RecordOpType.Patch, { text: [ValueOpType.Put, 'edited'] }],
+			})
+
+			expect(storedNote(storage, note.id)?.text).toBe('edited')
+		})
+
+		it('does not consult the authorizer for a no-op patch', () => {
+			const authorize = vi.fn(({ type, prev, next }: any) => (type === 'delete' ? prev : next))
+			const { room, note } = seededWithNote(authorize)
+			connectSession(room, 'alice', { meta: { userId: 'u' } })
+			authorize.mockClear()
+
+			push(room, 'alice', {
+				[note.id]: [RecordOpType.Patch, { text: [ValueOpType.Put, note.text] }],
+			})
+
+			expect(authorize).not.toHaveBeenCalled()
+		})
+
+		it('vetoes a delete the authorizer rejects', () => {
+			const { room, storage, note } = seededWithNote(({ type, next }: any) =>
+				type === 'delete' ? null : next
+			)
+			const socket = connectSession(room, 'mallory', { meta: { userId: 'm' } })
+
+			push(room, 'mallory', { [note.id]: [RecordOpType.Remove] })
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedIds(storage)).toEqual([note.id])
+		})
+
+		it('vetoes a put that changes the typeName of an existing record', () => {
+			const { room, storage, note } = seededWithNote(authorizeNote)
+			const socket = connectSession(room, 'mallory', { meta: { userId: 'user-mallory' } })
+
+			// a `doc`-shaped record reusing the note's id: the authorizer lookup keys off the incoming
+			// typeName, so the swap would consult the doc authorizer (here: none) instead of note's
+			push(room, 'mallory', {
+				[note.id]: [RecordOpType.Put, { id: note.id, typeName: 'doc', title: 'swapped' } as any],
+			})
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedNote(storage, note.id)?.typeName).toBe('note')
+		})
+
+		// The typeName guard must not depend on authorizers being configured: the write gate keys
+		// off the *incoming* typeName, so relabeling an existing object-lane record as a document
+		// type would otherwise let an objectAccess:'read' session write through the document lane.
+		it('vetoes a typeName swap even with no authorizeRecord configured', () => {
+			const note = Note.create({ text: 'by:user-alice' })
+			const { room, storage } = makeRoom({
+				objectTypes: ['note'],
+				snapshot: {
+					documents: [{ state: note, lastChangedClock: 0 }],
+					clock: 0,
+					documentClock: 0,
+					schema: schema.serialize(),
+				},
+			})
+			// denied on the object lane, but allowed on the document lane
+			const socket = connectSession(room, 'mallory', {
+				objectAccess: 'read',
+				meta: { userId: 'user-mallory' },
+			})
+
+			push(room, 'mallory', {
+				[note.id]: [RecordOpType.Put, { id: note.id, typeName: 'doc', title: 'swapped' } as any],
+			})
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedNote(storage, note.id)?.typeName).toBe('note')
+			expect(storedNote(storage, note.id)?.text).toBe('by:user-alice')
+		})
+
+		it('vetoes a put over an existing record that changes an immutable field', () => {
+			const { room, storage, note } = seededWithNote(authorizeNote)
+			const socket = connectSession(room, 'mallory', { meta: { userId: 'user-mallory' } })
+
+			push(room, 'mallory', { [note.id]: [RecordOpType.Put, { ...note, text: 'tampered' }] })
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedNote(storage, note.id)?.text).toBe('by:user-alice')
+		})
+
+		it('ignores the record returned by an update authorizer (allow/veto only)', () => {
+			const { room, storage, note } = seededWithNote(({ type, prev, next }: any) => {
+				if (type === 'update') return { ...next, text: 'stamped-on-update' }
+				return type === 'delete' ? prev : next
+			})
+			connectSession(room, 'alice', { meta: { userId: 'u' } })
+
+			push(room, 'alice', { [note.id]: [RecordOpType.Put, { ...note, text: 'edited' }] })
+
+			expect(storedNote(storage, note.id)?.text).toBe('edited')
+		})
+
+		it('rejects the write (fail closed) when the authorizer throws, without crashing the push', () => {
+			const { room, storage } = withNote(() => {
+				throw new Error('boom')
+			})
+			const socket = connectSession(room, 'alice', { meta: { userId: 'u' } })
+			const note = Note.create({ text: 'x' })
+
+			expect(() => push(room, 'alice', { [note.id]: [RecordOpType.Put, note] })).not.toThrow()
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedIds(storage)).toEqual([])
+		})
+
+		it('passes the change type for create, update, and delete', () => {
+			const types: string[] = []
+			const note = Note.create({ text: 'x' })
+			const { room } = withNote(({ type, prev, next }: any) => {
+				types.push(type)
+				return type === 'delete' ? prev : next
+			})
+			connectSession(room, 'alice', { meta: { userId: 'u' } })
+
+			push(room, 'alice', { [note.id]: [RecordOpType.Put, note] }, 1)
+			push(room, 'alice', { [note.id]: [RecordOpType.Patch, { text: [ValueOpType.Put, 'y'] }] }, 2)
+			push(room, 'alice', { [note.id]: [RecordOpType.Remove] }, 3)
+
+			expect(types).toEqual(['create', 'update', 'delete'])
+		})
+
+		it('logs a warning when a write is vetoed', () => {
+			const warn = vi.fn()
+			const note = Note.create({ text: 'by:user-alice' })
+			const { room } = makeRoom({
+				objectTypes: ['note'],
+				authorizeRecord: { note: () => null },
+				log: { warn },
+			})
+			connectSession(room, 'mallory', { meta: { userId: 'user-mallory' } })
+
+			push(room, 'mallory', { [note.id]: [RecordOpType.Put, note] })
+
+			expect(warn).toHaveBeenCalledTimes(1)
+			expect(warn.mock.calls[0].join(' ')).toContain(note.id)
+		})
+	})
 })