fix(realtime): close the table join window between re-check and commit

Moving the prior-room leave after the access re-check left Redis awaits between
that check and socket.join, and superseded() only watches the join generation —
so a sweep revocation landing in that window could still put a revoked socket
back in the room. A synchronous cache peek immediately before the commit closes
it without reintroducing the await; the authoritative resolve moments earlier
wrote a fresh entry, so a differing read IS the revocation being guarded.

Author: waleedlatif1

apps/realtime/src/handlers/tables.test.ts

@@ -346,6 +346,33 @@ describe('setupTablesHandlers', () => {
     }
   })
 
+  it('aborts the join when a revocation lands during the prior-room leave', async () => {
+    // The prior-room leave is the only await left between the authoritative access
+    // re-check and the commit, so a sweep revocation recorded in that window must still
+    // stop the join — `superseded()` alone only watches the join generation.
+    const prior = { type: ROOM_TYPES.TABLE, id: 'table-prior-2' }
+    const target = { type: ROOM_TYPES.TABLE, id: 'table-target-2' }
+    const { socket, handlers } = createSocket({ id: 'socket-window', userId: 'user-window' })
+    const roomManager = createRoomManager({
+      getRoomForSocket: vi.fn().mockResolvedValue(prior),
+      removeUserFromRoom: vi.fn().mockImplementation(async () => {
+        // The sweep records the revocation while the prior-room leave is in flight.
+        commitRoomPermission('user-window', target, null, beginRoomPermissionRead())
+        return true
+      }),
+    })
+    setupTablesHandlers(socket as unknown as SetupArg, roomManager)
+
+    await handlers[TABLE_PRESENCE_EVENTS.JOIN]({ tableId: 'table-target-2' })
+
+    expect(socket.emit).toHaveBeenCalledWith(
+      TABLE_PRESENCE_EVENTS.JOIN_ERROR,
+      expect.objectContaining({ code: 'ACCESS_DENIED', retryable: false })
+    )
+    expect(socket.join).not.toHaveBeenCalled()
+    expect(roomManager.addUserToRoom).not.toHaveBeenCalled()
+  })
+
   it('drops a malformed cell selection without storing or relaying it', async () => {
     const { socket, handlers, toEmit } = createSocket()
     const roomManager = createRoomManager({

apps/realtime/src/handlers/tables.ts

@@ -278,10 +278,32 @@ export function setupTablesHandlers(socket: AuthenticatedSocket, roomManager: IR
 
       // Final re-check before the membership commit: a LEAVE or a newer JOIN enqueued during the
       // awaits above — including the access re-resolve — bumped the generation, or the socket
-      // disconnected. This is the LAST await before registering, so nothing can interleave
-      // between it and the commit.
+      // disconnected.
       if (superseded()) return
 
+      // The prior-room leave above is the one place this handler still awaits AFTER the
+      // authoritative access re-check (file-doc and the workspace-list rooms leave
+      // synchronously, so they have no such window). A sweep revocation landing in that
+      // window would otherwise let this join put a revoked socket back in the room, since
+      // `superseded()` only watches the join generation. A cache PEEK is the right
+      // instrument here and needs no await: the authoritative resolve moments ago wrote a
+      // fresh entry, so the only way this reads differently is a newer decision recorded
+      // since — exactly the revocation being guarded against. Synchronous, so nothing can
+      // interleave between it and the join below.
+      // `undefined` stays "unknown, not denied" here as everywhere else in this handler —
+      // only a definitively cached insufficient permission aborts a join the authoritative
+      // check just passed.
+      const finalCheck = peekRoomPermission(userId, room)
+      if (finalCheck !== undefined && !satisfiesRoomMembership(finalCheck, ROOM_TYPES.TABLE)) {
+        socket.emit(TABLE_PRESENCE_EVENTS.JOIN_ERROR, {
+          tableId,
+          error: 'Access denied to table',
+          code: 'ACCESS_DENIED',
+          retryable: false,
+        })
+        return
+      }
+
       socket.join(roomName(room))
 
       const presence: UserPresence = {