added liveblocks live verification , ui changes

.gitignore

@@ -9,6 +9,7 @@ node_modules
 coverage
 dist
 build
+tsconfig.tsbuildinfo
 
 /app/generated/prisma
 

app/(auth)/layout.tsx

@@ -1,6 +1,8 @@
 import type { ReactNode } from "react";
 import { Sparkles, Share2, FileText } from "lucide-react";
 
+import { ThemeToggle } from "@/components/theme-toggle";
+
 interface AuthLayoutProps {
   children: ReactNode;
 }

app/api/invitations/[invitationId]/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from "next/server";
 
 import { prisma } from "@/lib/prisma";
 import { getCurrentIdentity } from "@/lib/project-access";
+import { gateRequest } from "@/lib/rate-limit";
 
 interface RouteContext {
   params: Promise<{ invitationId: string }>;
@@ -18,6 +19,9 @@ export async function POST(request: Request, ctx: RouteContext) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const denied = gateRequest(`invitations:${identity.userId}`, "mutate");
+  if (denied) return denied;
+
   const { invitationId } = await ctx.params;
 
   let body: ActionBody;

app/api/invitations/route.ts

@@ -0,0 +1,18 @@
+import { auth } from "@clerk/nextjs/server";
+import { NextResponse } from "next/server";
+
+import { getProjectsForCurrentUser } from "@/lib/projects-data";
+import { gateRequest } from "@/lib/rate-limit";
+
+export async function GET() {
+  const { userId } = await auth();
+  if (!userId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const denied = gateRequest(`invitations:${userId}`, "list");
+  if (denied) return denied;
+
+  const { invitations } = await getProjectsForCurrentUser();
+  return NextResponse.json({ invitations });
+}

app/api/liveblocks-auth/route.ts

@@ -1,9 +1,11 @@
 import { auth } from "@clerk/nextjs/server";
+import type { RoomAccesses } from "@liveblocks/node";
 import { NextResponse } from "next/server";
 
 import { getUserProfileById } from "@/lib/collaborators";
 import { getCursorColorForUser, getLiveblocksClient } from "@/lib/liveblocks";
 import { getProjectForAccess } from "@/lib/project-access";
+import { gateRequest } from "@/lib/rate-limit";
 
 interface AuthRequestBody {
   room?: string;
@@ -15,6 +17,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const denied = gateRequest(`liveblocks-auth:${userId}`, "liveblocks");
+  if (denied) return denied;
+
   let body: AuthRequestBody = {};
   try {
     body = (await request.json()) as AuthRequestBody;
@@ -38,25 +43,35 @@ export async function POST(request: Request) {
   const { project } = access;
   const liveblocks = getLiveblocksClient();
 
+  // The room grant is the authoritative permission boundary: a view-only
+  // collaborator gets presence (cursors) but cannot mutate storage, so the
+  // server rejects writes even if the client UI is bypassed.
+  const accesses: RoomAccesses[string] = project.canEdit
+    ? ["room:write"]
+    : ["room:read", "room:presence:write"];
+
   const existing = await liveblocks.getRoom(project.id).catch(() => null);
   if (!existing) {
     await liveblocks.createRoom(project.id, {
       defaultAccesses: [],
-      usersAccesses: {
-        [userId]: ["room:write"],
-      },
+      usersAccesses: { [userId]: accesses },
     });
   } else {
     await liveblocks.updateRoom(project.id, {
-      usersAccesses: {
-        [userId]: ["room:write"],
-      },
+      usersAccesses: { [userId]: accesses },
     });
   }
 
   const profile = await getUserProfileById(userId);
   const color = getCursorColorForUser(userId);
-  const name = profile?.displayName ?? profile?.email ?? "Anonymous";
+  // Prefer the account username so team members always see who is active on the
+  // canvas; fall back to a display name or email, and only to "Anonymous" when
+  // the account carries no identity at all.
+  const name =
+    profile?.username ??
+    profile?.displayName ??
+    profile?.email ??
+    "Anonymous";
   const userInfo: { name: string; avatar?: string; color: string } = {
     name,
     color,

app/api/notifications/route.ts

@@ -0,0 +1,76 @@
+import { auth } from "@clerk/nextjs/server";
+import { NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import type { ClientNotification } from "@/lib/notifications";
+import { gateRequest } from "@/lib/rate-limit";
+
+interface MarkReadBody {
+  id?: unknown;
+}
+
+export async function GET() {
+  const { userId } = await auth();
+  if (!userId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const denied = gateRequest(`notifications:${userId}`, "list");
+  if (denied) return denied;
+
+  const rows = await prisma.projectNotification.findMany({
+    where: { userId },
+    orderBy: [{ readAt: "asc" }, { createdAt: "desc" }],
+    take: 50,
+    select: {
+      id: true,
+      projectId: true,
+      projectName: true,
+      type: true,
+      createdAt: true,
+      readAt: true,
+    },
+  });
+
+  const notifications: ClientNotification[] = rows.map((row) => ({
+    id: row.id,
+    projectId: row.projectId,
+    projectName: row.projectName,
+    type: row.type as ClientNotification["type"],
+    createdAt: row.createdAt.toISOString(),
+    read: row.readAt !== null,
+  }));
+
+  return NextResponse.json({ notifications });
+}
+
+export async function POST(request: Request) {
+  const { userId } = await auth();
+  if (!userId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const denied = gateRequest(`notifications:${userId}`, "mutate");
+  if (denied) return denied;
+
+  let body: MarkReadBody;
+  try {
+    body = (await request.json()) as MarkReadBody;
+  } catch {
+    return NextResponse.json({ error: "Malformed JSON" }, { status: 400 });
+  }
+
+  if (typeof body.id === "string") {
+    await prisma.projectNotification.updateMany({
+      where: { id: body.id, userId },
+      data: { readAt: new Date() },
+    });
+  } else {
+    await prisma.projectNotification.updateMany({
+      where: { userId, readAt: null },
+      data: { readAt: new Date() },
+    });
+  }
+
+  return NextResponse.json({ success: true });
+}

app/api/projects/[projectId]/access/route.ts

@@ -0,0 +1,47 @@
+import { auth } from "@clerk/nextjs/server";
+import { NextResponse } from "next/server";
+
+import { prisma } from "@/lib/prisma";
+import { getProjectForAccess } from "@/lib/project-access";
+import { gateRequest } from "@/lib/rate-limit";
+
+interface RouteContext {
+  params: Promise<{ projectId: string }>;
+}
+
+/**
+ * Lightweight real-time access probe used by the open workspace to reflect an
+ * owner's deletion (or a revoked membership) immediately instead of waiting for
+ * a reload. Distinguishes "deleted" from "denied" by checking row existence.
+ */
+export async function GET(_request: Request, ctx: RouteContext) {
+  const { userId } = await auth();
+  if (!userId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const denied = gateRequest(`projects:${userId}:access`, "read");
+  if (denied) return denied;
+
+  const { projectId } = await ctx.params;
+
+  const result = await getProjectForAccess(projectId);
+  if (result.kind === "unauthenticated") {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (result.kind === "ok") {
+    return NextResponse.json({ ok: true });
+  }
+
+  // The caller lost access — is it because the workspace was deleted, or because
+  // the membership is gone while the project still exists?
+  const exists = await prisma.project.findUnique({
+    where: { id: projectId },
+    select: { id: true },
+  });
+
+  return NextResponse.json({
+    ok: false,
+    reason: exists ? "denied" : "deleted",
+  });
+}

app/api/projects/[projectId]/collaborators/[collaboratorId]/route.ts

@@ -1,15 +1,19 @@
 import { PrismaClientKnownRequestError } from "@prisma/client/runtime/client";
 import { NextResponse } from "next/server";
 
+import { getUserIdByEmail } from "@/lib/collaborators";
+import { getLiveblocksClient } from "@/lib/liveblocks";
 import { prisma } from "@/lib/prisma";
 import { getCurrentIdentity } from "@/lib/project-access";
+import { gateRequest } from "@/lib/rate-limit";
 
 interface RouteContext {
   params: Promise<{ projectId: string; collaboratorId: string }>;
 }
 
 interface PatchBody {
   canShare?: unknown;
+  canEdit?: unknown;
 }
 
 export async function PATCH(request: Request, ctx: RouteContext) {
@@ -18,6 +22,9 @@ export async function PATCH(request: Request, ctx: RouteContext) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const denied = gateRequest(`collaborators:${identity.userId}`, "mutate");
+  if (denied) return denied;
+
   const { projectId, collaboratorId } = await ctx.params;
 
   let body: PatchBody;
@@ -27,12 +34,28 @@ export async function PATCH(request: Request, ctx: RouteContext) {
     return NextResponse.json({ error: "Malformed JSON" }, { status: 400 });
   }
 
-  if (typeof body.canShare !== "boolean") {
+  if (body.canShare !== undefined && typeof body.canShare !== "boolean") {
     return NextResponse.json(
       { error: "`canShare` must be a boolean" },
       { status: 400 },
     );
   }
+  if (body.canEdit !== undefined && typeof body.canEdit !== "boolean") {
+    return NextResponse.json(
+      { error: "`canEdit` must be a boolean" },
+      { status: 400 },
+    );
+  }
+
+  const data: { canShare?: boolean; canEdit?: boolean } = {};
+  if (typeof body.canShare === "boolean") data.canShare = body.canShare;
+  if (typeof body.canEdit === "boolean") data.canEdit = body.canEdit;
+  if (Object.keys(data).length === 0) {
+    return NextResponse.json(
+      { error: "Provide `canShare` and/or `canEdit`" },
+      { status: 400 },
+    );
+  }
 
   const project = await prisma.project.findUnique({
     where: { id: projectId },
@@ -48,9 +71,21 @@ export async function PATCH(request: Request, ctx: RouteContext) {
   try {
     const updated = await prisma.projectCollaborator.update({
       where: { id: collaboratorId },
-      data: { canShare: body.canShare },
-      select: { id: true, email: true, status: true, canShare: true },
+      data,
+      select: {
+        id: true,
+        email: true,
+        status: true,
+        canShare: true,
+        canEdit: true,
+      },
     });
+    // Push the new grant into the room now, so a revoked collaborator loses
+    // write access on their current connection instead of at token expiry.
+    if (typeof data.canEdit === "boolean") {
+      await syncRoomAccess(projectId, updated.email, data.canEdit);
+    }
+
     return NextResponse.json({ collaborator: updated });
   } catch (error) {
     if (
@@ -62,3 +97,29 @@ export async function PATCH(request: Request, ctx: RouteContext) {
     throw error;
   }
 }
+
+async function syncRoomAccess(
+  projectId: string,
+  email: string,
+  canEdit: boolean,
+): Promise<void> {
+  try {
+    const collaboratorUserId = await getUserIdByEmail(email);
+    if (!collaboratorUserId) return;
+
+    const liveblocks = getLiveblocksClient();
+    const room = await liveblocks.getRoom(projectId).catch(() => null);
+    if (!room) return;
+
+    await liveblocks.updateRoom(projectId, {
+      usersAccesses: {
+        [collaboratorUserId]: canEdit
+          ? ["room:write"]
+          : ["room:read", "room:presence:write"],
+      },
+    });
+  } catch {
+    // Non-fatal: the database is the source of truth and liveblocks-auth
+    // re-derives access on the collaborator's next connection.
+  }
+}