fix(workspace): restore theme design-system, fix 5x note creation, enforce privacy isolation, fix shared write permission, add drag-drop & slash-commands

internal/ws/docroom.go

@@ -18,6 +18,7 @@ type DocWSClient struct {
 	conn     *websocket.Conn
 	userID   string
 	clientID string
+	canWrite bool
 	send     chan []byte
 }
 
@@ -433,7 +434,7 @@ func (r *DocRoom) Flush() {
 }
 
 // ServeDocWS handles WebSocket connections for GET /api/v1/ws/docs/{id}
-func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID string, clientID string) {
+func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID string, clientID string, canWrite bool) {
 	conn, err := upgrader.Upgrade(w, req, nil)
 	if err != nil {
 		log.Printf("[doc-ws] upgrade error for doc %s: %v", r.docID, err)
@@ -453,6 +454,7 @@ func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID st
 		conn:     conn,
 		userID:   userID,
 		clientID: clientID,
+		canWrite: canWrite,
 		send:     make(chan []byte, 256),
 	}
 
@@ -509,6 +511,10 @@ func (c *DocWSClient) readPump() {
 
 		var evt DocSyncEvent
 		if err := json.Unmarshal(message, &evt); err == nil && evt.Type != "" {
+			if !c.canWrite {
+				// Read-only clients cannot mutate the document
+				continue
+			}
 			c.room.HandleEvent(evt, c)
 		}
 	}