share funxtions

src/api.rs

@@ -295,9 +295,9 @@ pub async fn authorized_workspace(
     let workspace = db::find_workspace(&state.db, slug)
         .await?
         .ok_or_else(ApiError::not_found_workspace)?;
-    if workspace.password_hash.is_some()
-        && !db::verify_workspace_password(&workspace, password)
-        && !verify_resource_access_token(state, "workspace", slug, access_token).await? {
+    let token_access = verify_resource_access_token(state, "workspace", slug, access_token).await?;
+    if workspace.is_private != 0 && !token_access { return Err(ApiError::forbidden("This workspace is private.")); }
+    if workspace.password_hash.is_some() && !db::verify_workspace_password(&workspace, password) && !token_access {
         return Err(ApiError::unauthorized());
     }
     Ok(workspace)
@@ -566,9 +566,9 @@ async fn authorized_pad(
     let pad = db::find_pad(&state.db, slug)
         .await?
         .ok_or_else(ApiError::not_found_note)?;
-    if pad.password_hash.is_some()
-        && !db::verify_pad_password(&pad, password)
-        && !verify_resource_access_token(state, "pad", slug, access_token).await? {
+    let token_access = verify_resource_access_token(state, "pad", slug, access_token).await?;
+    if pad.is_private != 0 && !token_access { return Err(ApiError::forbidden("This note is private.")); }
+    if pad.password_hash.is_some() && !db::verify_pad_password(&pad, password) && !token_access {
         return Err(ApiError::unauthorized());
     }
     Ok(pad)
@@ -872,6 +872,9 @@ pub async fn verify_resource_access_token(
     let Some(token) = token.map(str::trim).filter(|value| !value.is_empty()) else {
         return Ok(false);
     };
+    if crate::auth::resource_permission(state, kind, slug, Some(token)).await.map_err(|error| ApiError::forbidden(&error.message))?.is_some() {
+        return Ok(true);
+    }
     let count: i64 = sqlx::query_scalar(queries::get(state.db.kind(), "SELECT COUNT(*) FROM resource_access_tokens WHERE token_hash = ? AND resource_kind = ? AND resource_slug = ? AND expires_at > ?"))
         .bind(hash_access_token(token))
         .bind(kind)

src/app.rs

@@ -37,6 +37,7 @@ pub fn router(state: SharedState, static_dir: &str, upload_max_size_bytes: usize
         .route("/s/{token}", get(public_page))
         .route("/w/{workspace_slug}", get(workspace))
         .route("/w/{workspace_slug}/n/{note_slug}", get(note))
+        .route("/errors/private-workspace", get(private_workspace_error))
         .route("/health", get(health))
         .route("/f/{token}/{filename}", get(api::download_file))
         .route("/files/{directory}/{filename}", get(api::download_legacy_file))
@@ -48,6 +49,9 @@ pub fn router(state: SharedState, static_dir: &str, upload_max_size_bytes: usize
         .route("/api/auth/me", get(auth::me))
         .route("/api/auth/logout", post(auth::logout))
         .route("/api/auth/resources", get(auth::resources).put(auth::update_resource).delete(auth::delete_resource))
+        .route("/api/auth/resources/privacy", post(auth::set_resource_privacy))
+        .route("/api/auth/resources/sharing", get(auth::resource_sharing).post(auth::share_resource_users).delete(auth::remove_resource_user))
+        .route("/api/auth/resources/share-links", post(auth::create_share_link).put(auth::update_share_link).delete(auth::revoke_share_link))
         .route("/api/auth/password-reset", post(auth::request_reset))
         .route("/api/auth/password-reset/confirm", post(auth::confirm_reset))
         .route("/api/public/{token}", get(api::public_page))
@@ -109,6 +113,19 @@ pub fn router(state: SharedState, static_dir: &str, upload_max_size_bytes: usize
         .with_state(state)
 }
 
+
+async fn private_workspace_error(State(state): State<SharedState>) -> Response {
+    error_response(
+        StatusCode::FORBIDDEN,
+        "403",
+        "Private workspace",
+        "You do not have permission to access this private workspace. Ask the owner to share it with your account or use a valid share link.",
+        "/",
+        "Home page",
+        &state.asset_version,
+    )
+}
+
 async fn health() -> &'static str {
     "ok"
 }

src/auth.rs

@@ -37,8 +37,18 @@ pub struct User {
     kind: String, slug: String, #[serde(default)] password: Option<String>
 }
 #[derive(Serialize, FromRow)] pub struct ResourceItem {
-    slug: String, title: String, protected: i64, updated_at: String
+    slug: String, title: String, protected: i64, updated_at: String, #[sqlx(rename = "private")]
+    #[serde(rename = "private")]
+    private_resource: i64, owned: i64, permission: String, shared_by: String
 }
+
+#[derive(Deserialize)] pub struct PrivacyRequest { kind: String, slug: String, private: bool }
+#[derive(Deserialize)] pub struct ShareUsersRequest { kind: String, slug: String, emails: String, permission: String }
+#[derive(Deserialize)] pub struct RemoveShareRequest { kind: String, slug: String, email: String }
+#[derive(Deserialize)] pub struct CreateShareLinkRequest { kind: String, slug: String, permission: String, expires_at: Option<String> }
+#[derive(Deserialize)] pub struct UpdateShareLinkRequest { kind: String, slug: String, token: String, permission: String, expires_at: Option<String> }
+#[derive(Deserialize)] pub struct RevokeShareLinkRequest { kind: String, slug: String, token: String }
+
 #[derive(Serialize)] pub struct ResourceList {
     workspaces: Vec<ResourceItem>, pads: Vec<ResourceItem>
 }
@@ -161,8 +171,8 @@ pub async fn me(State(state): State<SharedState>, headers: HeaderMap) -> Result<
 
 pub async fn resources(State(state): State<SharedState>, headers: HeaderMap) -> Result<Json<ResourceList>, AuthError> {
     let user = require_user(&state, &headers).await?;
-    let workspaces = sqlx::query_as::<_, ResourceItem>(queries::get(state.db.kind(), queries::USER_LIST_WORKSPACES)).bind(user.id).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
-    let pads = sqlx::query_as::<_, ResourceItem>(queries::get(state.db.kind(), queries::USER_LIST_PADS)).bind(user.id).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
+    let workspaces = sqlx::query_as::<_, ResourceItem>(queries::get(state.db.kind(), queries::USER_LIST_WORKSPACES)).bind(user.id).bind(user.id).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
+    let pads = sqlx::query_as::<_, ResourceItem>(queries::get(state.db.kind(), queries::USER_LIST_PADS)).bind(user.id).bind(user.id).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
     Ok(Json(ResourceList { workspaces, pads }))
 }
 
@@ -202,6 +212,115 @@ async fn ensure_owner(state: &SharedState, user_id: i64, kind: &str, slug: &str)
     Ok(())
 }
 
+
+pub async fn set_resource_privacy(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<PrivacyRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let user = require_user(&state, &headers).await?;
+    ensure_owner(&state, user.id, &req.kind, &req.slug).await?;
+    let table = match req.kind.as_str() { "workspace" => "workspaces", "pad" => "pads", _ => return Err(AuthError::bad_request("Unknown resource type.")) };
+    let query = format!("UPDATE {table} SET is_private = ?, updated_at = CURRENT_TIMESTAMP WHERE slug = ?");
+    sqlx::query(&query).bind(req.private).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    Ok(Json(serde_json::json!({"ok":true})))
+}
+
+pub async fn share_resource_users(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<ShareUsersRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    ensure_owner(&state, owner.id, &req.kind, &req.slug).await?;
+    let permission = validate_permission(&req.permission)?;
+    let emails: Vec<String> = req.emails.split(',').map(|v| normalize(v)).filter(|v| !v.is_empty()).collect();
+    if emails.is_empty() || emails.len() > 100 { return Err(AuthError::bad_request("Enter between 1 and 100 registered e-mail addresses.")); }
+    let mut missing = Vec::new();
+    for email in emails {
+        let user = find_user_by_email(&state, &email).await?;
+        let Some(user) = user else { missing.push(email); continue; };
+        if user.id == owner.id { continue; }
+        sqlx::query(queries::get(state.db.kind(), "DELETE FROM resource_permissions WHERE resource_kind = ? AND resource_slug = ? AND user_id = ?"))
+            .bind(&req.kind).bind(req.slug.trim()).bind(user.id).execute(state.db.pool()).await.map_err(AuthError::database)?;
+        sqlx::query(queries::get(state.db.kind(), "INSERT INTO resource_permissions (resource_kind, resource_slug, user_id, permission) VALUES (?, ?, ?, ?)"))
+            .bind(&req.kind).bind(req.slug.trim()).bind(user.id).bind(permission).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    }
+    if !missing.is_empty() { return Err(AuthError::bad_request(&format!("No registered account for: {}", missing.join(", ")))); }
+    Ok(Json(serde_json::json!({"ok":true})))
+}
+
+pub async fn remove_resource_user(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<RemoveShareRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    ensure_owner(&state, owner.id, &req.kind, &req.slug).await?;
+    let email = normalize(&req.email);
+    if let Some(user) = find_user_by_email(&state, &email).await? {
+        sqlx::query(queries::get(state.db.kind(), "DELETE FROM resource_permissions WHERE resource_kind = ? AND resource_slug = ? AND user_id = ?"))
+            .bind(&req.kind).bind(req.slug.trim()).bind(user.id).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    }
+    Ok(Json(serde_json::json!({"ok":true})))
+}
+
+pub async fn resource_sharing(State(state): State<SharedState>, headers: HeaderMap, axum::extract::Query(params): axum::extract::Query<std::collections::HashMap<String,String>>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    let kind = params.get("kind").ok_or_else(|| AuthError::bad_request("Missing kind."))?;
+    let slug = params.get("slug").ok_or_else(|| AuthError::bad_request("Missing slug."))?;
+    ensure_owner(&state, owner.id, kind, slug).await?;
+    let users: Vec<(String,String,String)> = sqlx::query_as(queries::get(state.db.kind(), "SELECT u.email, u.nickname, rp.permission FROM resource_permissions rp JOIN users u ON u.id = rp.user_id WHERE rp.resource_kind = ? AND rp.resource_slug = ? ORDER BY u.email"))
+        .bind(kind).bind(slug).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
+    let links: Vec<(String,String,Option<String>,String)> = sqlx::query_as(queries::get(state.db.kind(), "SELECT token_hash, permission, expires_at, created_at FROM resource_share_links WHERE resource_kind = ? AND resource_slug = ? AND revoked_at IS NULL ORDER BY created_at DESC"))
+        .bind(kind).bind(slug).fetch_all(state.db.pool()).await.map_err(AuthError::database)?;
+    Ok(Json(serde_json::json!({"users":users.into_iter().map(|(email,nickname,permission)|serde_json::json!({"email":email,"nickname":nickname,"permission":permission})).collect::<Vec<_>>(), "links":links.into_iter().map(|(token,permission,expires_at,created_at)|serde_json::json!({"token":token,"permission":permission,"expires_at":expires_at,"created_at":created_at})).collect::<Vec<_>>() })))
+}
+
+pub async fn create_share_link(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<CreateShareLinkRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    ensure_owner(&state, owner.id, &req.kind, &req.slug).await?;
+    let permission = validate_permission(&req.permission)?;
+    validate_share_expiration(req.expires_at.as_deref())?;
+    let token = random_token(); let token_hash = hash_token(&token);
+    sqlx::query(queries::get(state.db.kind(), "INSERT INTO resource_share_links (token_hash, resource_kind, resource_slug, permission, expires_at, created_by) VALUES (?, ?, ?, ?, ?, ?)"))
+        .bind(token_hash).bind(&req.kind).bind(req.slug.trim()).bind(permission).bind(&req.expires_at).bind(owner.id).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    let base = if req.kind == "workspace" { format!("/w/{}", req.slug.trim()) } else { format!("/p/{}", req.slug.trim()) };
+    Ok(Json(serde_json::json!({"token":token,"url":format!("{base}?share={token}"),"permission":permission,"expires_at":req.expires_at})))
+}
+
+
+pub async fn update_share_link(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<UpdateShareLinkRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    ensure_owner(&state, owner.id, &req.kind, &req.slug).await?;
+    let permission = validate_permission(&req.permission)?;
+    validate_share_expiration(req.expires_at.as_deref())?;
+    let result = sqlx::query(queries::get(state.db.kind(), "UPDATE resource_share_links SET permission = ?, expires_at = ? WHERE token_hash = ? AND resource_kind = ? AND resource_slug = ? AND revoked_at IS NULL"))
+        .bind(permission).bind(&req.expires_at).bind(req.token.trim()).bind(&req.kind).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    if result.rows_affected() == 0 { return Err(AuthError::bad_request("Share link was not found or is already revoked.")); }
+    Ok(Json(serde_json::json!({"ok":true,"permission":permission,"expires_at":req.expires_at})))
+}
+
+pub async fn revoke_share_link(State(state): State<SharedState>, headers: HeaderMap, Json(req): Json<RevokeShareLinkRequest>) -> Result<Json<serde_json::Value>, AuthError> {
+    let owner = require_user(&state, &headers).await?;
+    ensure_owner(&state, owner.id, &req.kind, &req.slug).await?;
+    sqlx::query(queries::get(state.db.kind(), "UPDATE resource_share_links SET revoked_at = ? WHERE token_hash = ? AND resource_kind = ? AND resource_slug = ?"))
+        .bind(Utc::now().to_rfc3339()).bind(req.token.trim()).bind(&req.kind).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    Ok(Json(serde_json::json!({"ok":true})))
+}
+
+fn validate_permission(value: &str) -> Result<&str, AuthError> { match value { "ro"|"rw" => Ok(value), _ => Err(AuthError::bad_request("Permission must be ro or rw.")) } }
+
+fn validate_share_expiration(value: Option<&str>) -> Result<(), AuthError> {
+    let Some(value) = value else { return Ok(()); };
+    let expires = chrono::DateTime::parse_from_rfc3339(value).map_err(|_| AuthError::bad_request("Invalid expiration date."))?.with_timezone(&Utc);
+    if expires <= Utc::now() { return Err(AuthError::bad_request("Expiration must be in the future.")); }
+    Ok(())
+}
+
+pub async fn resource_permission(state: &SharedState, kind: &str, slug: &str, token: Option<&str>) -> Result<Option<String>, AuthError> {
+    let Some(token) = token.filter(|v| !v.is_empty()) else { return Ok(None); };
+    if let Some(user) = user_from_token(state, token).await? {
+        let owns = ensure_owner(state, user.id, kind, slug).await.is_ok();
+        if owns { return Ok(Some("rw".into())); }
+        let permission: Option<String> = sqlx::query_scalar(queries::get(state.db.kind(), "SELECT permission FROM resource_permissions WHERE resource_kind = ? AND resource_slug = ? AND user_id = ?"))
+            .bind(kind).bind(slug).bind(user.id).fetch_optional(state.db.pool()).await.map_err(AuthError::database)?;
+        return Ok(permission);
+    }
+    let now = Utc::now().to_rfc3339();
+    let permission: Option<String> = sqlx::query_scalar(queries::get(state.db.kind(), "SELECT permission FROM resource_share_links WHERE token_hash = ? AND resource_kind = ? AND resource_slug = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)"))
+        .bind(hash_token(token)).bind(kind).bind(slug).bind(now).fetch_optional(state.db.pool()).await.map_err(AuthError::database)?;
+    Ok(permission)
+}
+
 pub async fn logout(State(state): State<SharedState>, headers: HeaderMap) -> Result<Json<serde_json::Value>, AuthError> {
     if let Some(token) = bearer(&headers) {
         let result = sqlx::query(queries::get(state.db.kind(), queries::AUTH_DELETE_SESSION_BY_TOKEN)).bind(token).execute(state.db.pool()).await.map_err(AuthError::database)?;

src/db.rs

@@ -30,6 +30,7 @@ pub struct Workspace {
     pub password_hash: Option<String>,
     pub created_at: String,
     pub updated_at: String,
+    pub is_private: i64,
 }
 
 #[derive(Debug, Clone, Serialize, FromRow)]
@@ -299,6 +300,7 @@ pub struct Pad {
     pub created_at: String,
     pub updated_at: String,
     pub owner_map: String,
+    pub is_private: i64,
 }
 
 pub async fn find_pad(pool: &Database, slug: &str) -> Result<Option<Pad>, sqlx::Error> {

src/queries.rs

@@ -33,8 +33,8 @@ pub const AUTH_USER_BY_NICKNAME: &str = "SELECT id, nickname, email, password_ha
 pub const AUTH_USER_BY_EMAIL: &str = "SELECT id, nickname, email, password_hash, confirmed_at FROM users WHERE email_key = ?";
 pub const USER_ATTACH_WORKSPACE: &str = "INSERT INTO user_workspaces (user_id, workspace_id) SELECT ?, id FROM workspaces WHERE slug = ?";
 pub const USER_ATTACH_PAD: &str = "INSERT INTO user_pads (user_id, pad_id) SELECT ?, id FROM pads WHERE slug = ?";
-pub const USER_LIST_WORKSPACES: &str = "SELECT w.slug, w.title, CASE WHEN w.password_hash IS NULL THEN 0 ELSE 1 END AS protected, w.updated_at FROM user_workspaces uw JOIN workspaces w ON w.id = uw.workspace_id WHERE uw.user_id = ? ORDER BY w.updated_at DESC";
-pub const USER_LIST_PADS: &str = "SELECT p.slug, p.title, CASE WHEN p.password_hash IS NULL THEN 0 ELSE 1 END AS protected, p.updated_at FROM user_pads up JOIN pads p ON p.id = up.pad_id WHERE up.user_id = ? ORDER BY p.updated_at DESC";
+pub const USER_LIST_WORKSPACES: &str = "SELECT w.slug, w.title, CASE WHEN w.password_hash IS NULL THEN 0 ELSE 1 END AS protected, w.updated_at, CASE WHEN w.is_private THEN 1 ELSE 0 END AS private, 1 AS owned, 'rw' AS permission, '' AS shared_by FROM user_workspaces uw JOIN workspaces w ON w.id = uw.workspace_id WHERE uw.user_id = ? UNION SELECT w.slug, w.title, CASE WHEN w.password_hash IS NULL THEN 0 ELSE 1 END, w.updated_at, CASE WHEN w.is_private THEN 1 ELSE 0 END, 0, rp.permission, COALESCE((SELECT u.nickname FROM user_workspaces owner_uw JOIN users u ON u.id = owner_uw.user_id WHERE owner_uw.workspace_id = w.id LIMIT 1), 'Unknown user') AS shared_by FROM resource_permissions rp JOIN workspaces w ON w.slug = rp.resource_slug WHERE rp.resource_kind = 'workspace' AND rp.user_id = ? ORDER BY updated_at DESC";
+pub const USER_LIST_PADS: &str = "SELECT p.slug, p.title, CASE WHEN p.password_hash IS NULL THEN 0 ELSE 1 END AS protected, p.updated_at, CASE WHEN p.is_private THEN 1 ELSE 0 END AS private, 1 AS owned, 'rw' AS permission, '' AS shared_by FROM user_pads up JOIN pads p ON p.id = up.pad_id WHERE up.user_id = ? UNION SELECT p.slug, p.title, CASE WHEN p.password_hash IS NULL THEN 0 ELSE 1 END, p.updated_at, CASE WHEN p.is_private THEN 1 ELSE 0 END, 0, rp.permission, COALESCE((SELECT u.nickname FROM user_pads owner_up JOIN users u ON u.id = owner_up.user_id WHERE owner_up.pad_id = p.id LIMIT 1), 'Unknown user') AS shared_by FROM resource_permissions rp JOIN pads p ON p.slug = rp.resource_slug WHERE rp.resource_kind = 'pad' AND rp.user_id = ? ORDER BY updated_at DESC";
 pub const USER_OWNS_WORKSPACE: &str = "SELECT COUNT(*) FROM user_workspaces uw JOIN workspaces w ON w.id = uw.workspace_id WHERE uw.user_id = ? AND w.slug = ?";
 pub const USER_OWNS_PAD: &str = "SELECT COUNT(*) FROM user_pads up JOIN pads p ON p.id = up.pad_id WHERE up.user_id = ? AND p.slug = ?";
 pub const USER_DELETE_WORKSPACE: &str = "DELETE FROM workspaces WHERE slug = ?";
@@ -43,7 +43,7 @@ pub const USER_SET_WORKSPACE_PASSWORD: &str = "UPDATE workspaces SET password_ha
 pub const USER_SET_PAD_PASSWORD: &str = "UPDATE pads SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE slug = ?";
 
 
-pub const Q001: &str = "SELECT id, slug, title, password_hash, created_at, updated_at FROM workspaces WHERE slug = ?";
+pub const Q001: &str = "SELECT id, slug, title, password_hash, created_at, updated_at, CAST(CASE WHEN is_private THEN 1 ELSE 0 END AS BIGINT) AS is_private FROM workspaces WHERE slug = ?";
 pub const Q002: &str = "INSERT INTO workspaces (slug, title, password_hash) VALUES (?, ?, ?)";
 pub const Q003: &str = "SELECT id, workspace_id, slug, title, content, created_at, updated_at, owner_map, protected, created_by FROM notes WHERE workspace_id = ? ORDER BY updated_at DESC, id DESC";
 pub const Q004: &str = "SELECT id, workspace_id, slug, title, content, created_at, updated_at, owner_map, protected, created_by FROM notes WHERE workspace_id = ? AND slug = ?";
@@ -53,7 +53,7 @@ pub const Q007: &str = "UPDATE workspaces SET updated_at = CURRENT_TIMESTAMP WHE
 pub const Q008: &str = "INSERT INTO note_revisions (note_id, content, author, owner_map) VALUES (?, ?, ?, ?)";
 pub const Q009: &str = "SELECT updated_at FROM notes WHERE id = ?";
 pub const Q010: &str = "SELECT id, content, created_at, author, owner_map FROM note_revisions WHERE note_id = ? ORDER BY id DESC LIMIT 100";
-pub const Q011: &str = "SELECT id, slug, title, content, password_hash, created_at, updated_at, owner_map FROM pads WHERE slug = ?";
+pub const Q011: &str = "SELECT id, slug, title, content, password_hash, created_at, updated_at, owner_map, CAST(CASE WHEN is_private THEN 1 ELSE 0 END AS BIGINT) AS is_private FROM pads WHERE slug = ?";
 pub const Q012: &str = "INSERT INTO pads (slug, title, password_hash) VALUES (?, ?, ?)";
 pub const Q013: &str = "UPDATE pads SET content = ?, owner_map = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?";
 pub const Q014: &str = "INSERT INTO revisions (pad_id, content, author, owner_map) VALUES (?, ?, ?, ?)";

src/websocket.rs

@@ -40,8 +40,12 @@ async fn handle_socket(mut socket: WebSocket, state: SharedState, workspace_slug
             _ => { let _=send_error(&mut socket,"Wymagane uwierzytelnienie").await; return; }
         }, _ => return
     };
-    let nickname = match auth::authorize_nickname(&state, nickname, session_token).await { Ok(value) => value, Err(message) => { let _=send_error(&mut socket,&message).await; return; } };
-    if workspace.password_hash.is_some() && !db::verify_workspace_password(&workspace, password.as_deref()) && !crate::api::verify_resource_access_token(&state, "workspace", &workspace_slug, access_token.as_deref()).await.unwrap_or(false) { warn!(workspace_id = workspace.id, note_id = note.id, "note websocket rejected: invalid workspace password"); let _=send_error(&mut socket,"Invalid password").await; return; }
+    let nickname = match auth::authorize_nickname(&state, nickname, session_token.clone()).await { Ok(value) => value, Err(message) => { let _=send_error(&mut socket,&message).await; return; } };
+    let permission = auth::resource_permission(&state, "workspace", &workspace_slug, session_token.as_deref().or(access_token.as_deref())).await.ok().flatten();
+    let password_ok = db::verify_workspace_password(&workspace, password.as_deref());
+    if workspace.is_private != 0 && permission.is_none() { let _=send_error(&mut socket,"This workspace is private").await; return; }
+    if workspace.password_hash.is_some() && !password_ok && permission.is_none() { warn!(workspace_id = workspace.id, note_id = note.id, "note websocket rejected: invalid workspace password"); let _=send_error(&mut socket,"Invalid password").await; return; }
+    let write_allowed = password_ok || permission.as_deref() != Some("ro");
     info!(workspace_id = workspace.id, note_id = note.id, nickname = ?nickname, "note websocket authenticated");
     if send(&mut socket,&ServerMessage::Authenticated { workspace_title:workspace.title.clone(), note_title:note.title.clone(), content:note.content.clone(), owner_map:note.owner_map.clone() }).await.is_err(){return;}
     let room_key = AppState::note_room_key(&workspace_slug, &note_slug);
@@ -56,6 +60,7 @@ async fn handle_socket(mut socket: WebSocket, state: SharedState, workspace_slug
         incoming=receiver.next()=>match incoming {
             Some(Ok(Message::Text(text)))=>match serde_json::from_str::<ClientMessage>(&text) {
                 Ok(ClientMessage::Update{content,owner_map})=>{
+                    if !write_allowed { let _=send_split(&mut sender,&ServerMessage::Error{message:"Read-only access".into()}).await; continue; }
                     if content.len()>2_000_000 { let _=send_split(&mut sender,&ServerMessage::Error{message:"The document is too large".into()}).await; continue; }
                     let owner_map=owner_map.unwrap_or_else(||"[]".into());
                     match db::save_revision(&state.db,note.id,workspace.id,&content,nickname.as_deref(),&owner_map).await {
@@ -129,8 +134,12 @@ async fn handle_pad_socket(mut socket:WebSocket,state:SharedState,slug:String){
             _=>{let _=send_pad(&mut socket,&PadServerMessage::Error{message:"Wymagane uwierzytelnienie".into()}).await;return;}
         },_=>return
     };
-    let nickname=match auth::authorize_nickname(&state,nickname,session_token).await{Ok(value)=>value,Err(message)=>{let _=send_pad(&mut socket,&PadServerMessage::Error{message}).await;return;}};
-    if pad.password_hash.is_some() && !db::verify_pad_password(&pad,password.as_deref()) && !crate::api::verify_resource_access_token(&state,"pad",&slug,access_token.as_deref()).await.unwrap_or(false){warn!(pad_id = pad.id, "pad websocket rejected: invalid password");let _=send_pad(&mut socket,&PadServerMessage::Error{message:"Invalid password".into()}).await;return;}
+    let nickname=match auth::authorize_nickname(&state,nickname,session_token.clone()).await{Ok(value)=>value,Err(message)=>{let _=send_pad(&mut socket,&PadServerMessage::Error{message}).await;return;}};
+    let permission=auth::resource_permission(&state,"pad",&slug,session_token.as_deref().or(access_token.as_deref())).await.ok().flatten();
+    let password_ok=db::verify_pad_password(&pad,password.as_deref());
+    if pad.is_private != 0 && permission.is_none(){let _=send_pad(&mut socket,&PadServerMessage::Error{message:"This note is private".into()}).await;return;}
+    if pad.password_hash.is_some() && !password_ok && permission.is_none(){warn!(pad_id = pad.id, "pad websocket rejected: invalid password");let _=send_pad(&mut socket,&PadServerMessage::Error{message:"Invalid password".into()}).await;return;}
+    let write_allowed=password_ok || permission.as_deref()!=Some("ro");
     info!(pad_id = pad.id, nickname = ?nickname, "pad websocket authenticated");
     if send_pad(&mut socket,&PadServerMessage::Authenticated{title:pad.title.clone(),content:pad.content.clone(),owner_map:pad.owner_map.clone()}).await.is_err(){return;}
     let room_key = AppState::pad_room_key(&slug);
@@ -144,7 +153,7 @@ async fn handle_pad_socket(mut socket:WebSocket,state:SharedState,slug:String){
     loop{tokio::select!{
         incoming=receiver.next()=>match incoming{
             Some(Ok(Message::Text(text)))=>match serde_json::from_str::<ClientMessage>(&text){
-                Ok(ClientMessage::Update{content,owner_map})=>{
+                Ok(ClientMessage::Update{content,owner_map})=>{if !write_allowed{let _=send_pad_split(&mut sender,&PadServerMessage::Error{message:"Read-only access".into()}).await;continue;}
                     if content.len()>2_000_000 { let _=send_pad_split(&mut sender,&PadServerMessage::Error{message:"The document is too large".into()}).await; continue; }
                     let owner_map=owner_map.unwrap_or_else(||"[]".into());
                     if let Ok((revision_id,updated_at))=db::save_pad_revision(&state.db,pad.id,&content,nickname.as_deref(),&owner_map).await{