Collaboration & Live Co-editing

Projects were single-owner by design. Collaboration adds two layers on top, independently:

1. Shared ownership — multiple users share access to a project, per-project, under graded roles (owner / admin / editor / viewer). Everyone always works the latest version.
2. Live peer co-editing — when two collaborators are in the same project, their edits stream to each other in real time with presence cursors.

Both are additive: a project with no collaborators and MEMO_REALTIME_PROVIDER=off behaves exactly as the original single-user editor.

Shared ownership#

Data model#

project_members — resolved collaborators. Graded roles now ship — owner / admin / editor / viewer (src/lib/auth/roles.ts); new invites default to editor. The DB column default stays "owner" for backward-compat with rows created before RBAC.

Unique on (project_id, user_id); indexed on user_id.

project_invites — pending invites for an email with no account yet.

Unique on (project_id, email) and on (token).

projects.owner_id stays the creator (it still drives the URL namespace + cascade). Access is owner OR member — the creator is not duplicated as a member row.

Access — requireProjectAccess#

lib/api/ownership.ts exposes the membership-aware gate that replaced the single-owner check across ~30 routes + project pages:

// The project iff userId is the creator OR a project_members collaborator, else null.
requireProjectAccess(projectId, userId): Promise<Project | null>

It left-joins project_members (filtered to userId) and matches projects.owner_id = userId OR project_members.user_id IS NOT NULL. Two companions:

• accessibleProjectIds(userId) — owned ∪ member project IDs; the dashboard listings (index, projects, activity, people, per-person timeline) scope to this so shared projects appear under "shared with me."
• listProjectMembers(projectId) — members joined to users, for the management UI.

URL model#

No URL or assertOwner change was needed: every user opens a project under their own namespace — /u/<you>/projects/<id> — assertOwner keeps [username] = you, and requireProjectAccess grants entry if you own or collaborate on it. So A opens it at /u/A/projects/X, B opens the same project at /u/B/projects/X.

Invite flow + accept-on-signup#

POST /api/owner/projects/[id]/members { email } (any collaborator can invite):

• Email already has an account → insert a project_members row immediately → instant full access; the project shows up in their dashboard.
• No account yet → insert a pending project_invites row. On first sign-up, acceptPendingInvites() in lib/auth/owner.ts (called from provisionUser) converts every pending invite for that email into a membership and stamps accepted_at. Best-effort — it never blocks sign-in.

A best-effort notification email goes out via sendProjectInviteEmail (Resend).

API#

Behind withOwner, gated by requireProjectAccess:

The creator (projects.owner_id) is not a member row and so can't be removed here.

UI#

A Collaborators tab (in ProjectTabs) → /u/[username]/projects/[projectId]/collaborators — invite form (declarative data-async), the people-with-access table (owner + members, each removable / "Leave"), and the pending-invites list (revocable).

Scope note: spaces/data-rooms stay owner-scoped (no membership), so a collaborator sees a shared project's link visits but not the owner's space-room visits. An accessibleSpaceIds helper would extend collaboration to spaces if ever wanted.

Live co-editing#

Built on Yjs (a CRDT), so the editor binding, presence, and persistence are identical regardless of how updates travel — only the transport differs. This mirrors the RecordingProvider pattern used for session recording.

Transport-agnostic core#

lib/collab/ defines a thin CollabSession interface and a factory that lazy-imports the chosen adapter (so the realtime SDKs only enter the bundle when collaboration is on):

createCollabSession(config): Promise<CollabSession | null>
// CollabSession = { doc: Y.Doc; awareness; whenSynced; destroy() }

Editor binding#

The useCollab hook (components/editor/useCollab.ts) opens one session per project and binds the active file's Y.Text (file:<path>) to the Monaco model via y-monaco's MonacoBinding — which also renders remote cursors from awareness. It's wired into EditorShell additively + gated on the realtime prop: with provider:"off" the editor is byte-for-byte its single-user self; presence avatars appear in the toolbar when peers join.

Persistence is unchanged. Edits (local or remote) mutate the Monaco model → the editor's existing onChange → buffer → debounced save → publish pipeline. Yjs is the live concurrency authority between clients; the server save is the durable snapshot. Durable file storage stays in R2 — the realtime layer only brokers live sync.

Auth#

The Durable Objects Worker#

apps/memo/workers/realtime/ is a standalone Cloudflare Worker (not in the app build or pnpm workspace), deployed via its own wrangler. A y-partyserver YServer Durable Object hosts the Yjs doc per project:<id> room over WebSocket Hibernation and persists it to DO storage. SQLite-backed DOs + Hibernation run on the free Workers plan — no new R2, no paid plan. The Worker verifies the durable-token JWT (same MEMO_REALTIME_SECRET) and that its projectId matches the room before accepting the socket.

Configuration#

Flipping transports is a config change, not a rewrite — the editor code is identical. Deploy + ops steps live in apps/memo/workers/realtime/README.md.