fix(workspace): restore theme design-system, fix 5x note creation, enforce privacy isolation, fix shared write permission, add drag-drop & slash-commands

internal/api/server.go

@@ -836,7 +836,6 @@ func (s *Server) handleCreateDocument(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	s.wsHub.BroadcastDocEvent(doc.ID, "DOC_CREATED", doc)
 	s.broadcastDocToAuthorizedUsers(doc.ID, "DOC_CREATED")
 	writeJSON(w, http.StatusCreated, doc)
 }
@@ -890,7 +889,6 @@ func (s *Server) handleUpdateDocument(w http.ResponseWriter, r *http.Request) {
 		s.wsHub.SyncActiveDocRoom(docID, doc.Title, doc.Blocks)
 	}
 	if req.Title != nil || req.Icon != nil || req.FolderPath != nil || req.Blocks != nil || req.Tags != nil {
-		s.wsHub.BroadcastDocEvent(docID, "DOC_UPDATED", doc)
 		s.broadcastDocToAuthorizedUsers(docID, "DOC_UPDATED")
 	}
 	writeJSON(w, http.StatusOK, doc)
@@ -936,6 +934,8 @@ func (s *Server) handlePatchDocumentBlocks(w http.ResponseWriter, r *http.Reques
 func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	docID := chi.URLParam(r, "id")
+	authorizedUsers, _ := s.store.GetAuthorizedDocUsers(docID)
+
 	if s.wsHub != nil {
 		s.wsHub.CloseDocRoom(docID)
 	}
@@ -943,7 +943,9 @@ func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	s.wsHub.BroadcastDocEvent(docID, "DOC_DELETED", map[string]string{"id": docID})
+	for _, uid := range authorizedUsers {
+		s.wsHub.BroadcastToUser(uid, "DOC_DELETED", map[string]string{"id": docID})
+	}
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
@@ -1355,16 +1357,19 @@ func (s *Server) handleDocWebSocket(w http.ResponseWriter, r *http.Request) {
 		userID = "anonymous"
 	}
 
+	canWrite := false
 	if userID != "anonymous" {
-		if _, err := s.store.GetDocumentByID(userID, docID); err != nil {
+		doc, err := s.store.GetDocumentByID(userID, docID)
+		if err != nil {
 			writeError(w, http.StatusForbidden, "Kein Zugriff auf dieses Dokument")
 			return
 		}
+		canWrite = doc.IsOwner || doc.Permission == "owner" || doc.Permission == "write"
 	}
 
 	clientID := r.URL.Query().Get("clientId")
 	room := s.wsHub.GetOrCreateDocRoom(docID)
-	room.ServeDocWS(w, r, userID, clientID)
+	room.ServeDocWS(w, r, userID, clientID, canWrite)
 }
 
 // --- REALTIME LISTS & SHARING ---