From 35879aa2466e27d133b57940218347ed549943ba Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Tue, 11 Aug 2026 23:05:58 +0530
Subject: [PATCH 01/15] implement collaboration upgrade proposals (invite
 roles, identity, durable overrides, moderation, layer locks) #1681

---
 .../components/layout/CollaborateDialog.tsx   |  69 ++--
 .../layout/CollaborationParticipantRow.tsx    |  61 ++-
 .../src/hooks/useCollaboration.ts             | 138 +++++--
 .../geolibre-desktop/src/i18n/locales/en.json |   3 +
 .../geolibre-desktop/src/lib/collab-client.ts |  11 +-
 .../src/lib/collab-protocol.ts                |  99 ++++-
 docs/collaboration.md                         |  21 +-
 packages/collab-core/src/protocol.ts          | 100 ++++-
 packages/collab-core/src/session.ts           |  92 ++++-
 packages/core/src/store.ts                    |   4 +
 packages/core/src/types.ts                    |  25 ++
 tests/collab-comment-validate.test.ts         |   4 +-
 tests/collab-upgrade.test.ts                  | 177 ++++++++
 workers/collab-node/src/server.ts             | 294 +++++++++++--
 workers/collab-node/src/store.ts              | 153 ++++++-
 workers/collab/src/index.ts                   |  63 ++-
 workers/collab/src/session.ts                 | 387 ++++++++++++++++--
 17 files changed, 1524 insertions(+), 177 deletions(-)
 create mode 100644 tests/collab-upgrade.test.ts

diff --git a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
index fb51b0be88..fefeb8df32 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
@@ -114,6 +114,8 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
       });
   };
 
+  const [requireIdentity, setRequireIdentity] = useState(false);
+
   const handleStart = async () => {
     if (!name.trim()) {
       setError(t("collaborate.nameRequired"));
@@ -122,10 +124,8 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
     setBusy(true);
     setError(null);
     try {
-      await api.start(name.trim(), color, mode);
+      await api.start(name.trim(), color, mode, requireIdentity);
     } catch (err) {
-      // Show a localized message; keep the raw error in the console for
-      // diagnostics (collab-client throws human-readable English strings).
       console.error("[GeoLibre] Collaboration error", err);
       setError(t("collaborate.connectFailed"));
     } finally {
@@ -147,12 +147,8 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
     try {
       await api.join(code.trim(), name.trim(), color);
     } catch (err) {
-      // Show a localized message; keep the raw error in the console for
-      // diagnostics (collab-client throws human-readable English strings).
       console.error("[GeoLibre] Collaboration error", err);
       setError(t("collaborate.connectFailed"));
-      // The invite link could not connect (e.g. an expired or invalid code), so
-      // reveal the full layout and let the user fix the code or host instead.
       setInvited(false);
     } finally {
       setBusy(false);
@@ -184,13 +180,13 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
             onDismiss={() => onOpenChange(false)}
             onSetMode={api.setMode}
             onSetParticipantMode={api.setParticipantMode}
+            onKickParticipant={api.kickParticipant}
+            onBlockParticipant={api.blockParticipant}
+            onSetSessionConfig={api.setSessionConfig}
             onSetFollowHost={api.setFollowHost}
           />
         ) : (
           <div className="space-y-4">
-            {/* Name and color feed both actions below, so group them in a
-                shaded panel above the cards to read as shared profile inputs
-                rather than belonging to either Start or Join (#706). */}
             <div className="space-y-3 rounded-md border bg-muted/40 p-3">
               <div className="space-y-1.5">
                 <Label htmlFor="collab-name">{t("collaborate.displayName")}</Label>
@@ -206,8 +202,6 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
               </div>
               <div className="space-y-1.5">
                 <Label>{t("collaborate.color")}</Label>
-                {/* Full panel width keeps every swatch on one row instead of
-                    wrapping a lone dot to a second line (#706). */}
                 <div className="flex flex-wrap gap-2 pt-1">
                   {COLOR_PALETTE.map((c) => (
                     <button
@@ -216,9 +210,6 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
                       aria-label={c.name}
                       aria-pressed={color === c.hex}
                       onClick={() => setColor(c.hex)}
-                      // Selection is an outer ring (offset from the swatch), so
-                      // the colored circle stays the same size — a border would
-                      // inset the fill and make the selected one look smaller.
                       className={`h-6 w-6 rounded-full transition ${
                         color === c.hex
                           ? "ring-2 ring-offset-2 ring-offset-background ring-foreground"
@@ -231,10 +222,6 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
               </div>
             </div>
 
-            {/* An invited participant (arrived via a `?collab=` link) only needs
-                to join, so collapse the layout to a single Join action and hide
-                the "Start a session" controls that are irrelevant to them
-                (#753). They can still fall back to hosting via the link below. */}
             {invited ? (
               <div className="space-y-3 rounded-md border p-3">
                 <div className="space-y-1">
@@ -269,9 +256,6 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
                 </Button>
                 <button
                   type="button"
-                  // Keep the prefilled `code` so the join field stays populated
-                  // if the user changes their mind; the full layout shows Start
-                  // as the primary action, so leaving it is non-destructive.
                   onClick={() => setInvited(false)}
                   disabled={busy}
                   className="cursor-pointer text-xs text-muted-foreground underline-offset-2 hover:underline disabled:cursor-default disabled:opacity-50"
@@ -295,6 +279,16 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
                       <option value="view-only">{t("collaborate.modeViewOnly")}</option>
                     </Select>
                   </div>
+                  <label className="flex cursor-pointer items-center gap-2 text-xs text-muted-foreground pt-1">
+                    <input
+                      type="checkbox"
+                      checked={requireIdentity}
+                      onChange={(e) => setRequireIdentity(e.target.checked)}
+                      disabled={busy}
+                      className="h-3.5 w-3.5 rounded border"
+                    />
+                    Require signed-in account to join
+                  </label>
                   <Button
                     type="button"
                     onClick={() => void handleStart()}
@@ -333,9 +327,6 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
               </>
             )}
 
-            {/* Show local validation errors and connect failures, the latter
-                arriving asynchronously in the store (the WebSocket handshake
-                fails after this dialog's call already resolved). */}
             {(error || collaboration.error) && (
               <p className="rounded-md bg-destructive/10 p-2 text-sm text-destructive">
                 {error || collaboration.error}
@@ -356,6 +347,9 @@ function ActiveSession({
   onDismiss,
   onSetMode,
   onSetParticipantMode,
+  onKickParticipant,
+  onBlockParticipant,
+  onSetSessionConfig,
   onSetFollowHost,
 }: {
   shareLink: string;
@@ -365,6 +359,9 @@ function ActiveSession({
   onDismiss: () => void;
   onSetMode: (mode: CollaborationMode) => void;
   onSetParticipantMode: (clientId: string, canEdit: boolean) => void;
+  onKickParticipant?: (clientId: string) => void;
+  onBlockParticipant?: (clientId: string) => void;
+  onSetSessionConfig?: (config: { requireIdentity?: boolean }) => void;
   onSetFollowHost: (enabled: boolean) => void;
 }) {
   const { t } = useTranslation();
@@ -387,8 +384,6 @@ function ActiveSession({
         )}
       </div>
 
-      {/* Cameras are independent by default; a non-host can opt to follow the
-          host's viewport (presenter mode). */}
       {!isHost && (
         <label className="flex cursor-pointer items-center gap-2 text-sm">
           <input
@@ -401,6 +396,18 @@ function ActiveSession({
         </label>
       )}
 
+      {isHost && (
+        <label className="flex cursor-pointer items-center gap-2 text-xs text-muted-foreground">
+          <input
+            type="checkbox"
+            checked={collaboration.requireIdentity}
+            onChange={(e) => onSetSessionConfig?.({ requireIdentity: e.target.checked })}
+            className="h-3.5 w-3.5 rounded border"
+          />
+          Require signed-in account to join
+        </label>
+      )}
+
       <div className="space-y-1.5">
         <Label>{t("collaborate.sessionCode")}</Label>
         <div className="flex gap-2">
@@ -441,7 +448,6 @@ function ActiveSession({
             )}
           </Button>
         </div>
-        {/* Only the host invites others, so the scan-to-join QR is host-only. */}
         {isHost && (
           <div className="flex flex-col items-center gap-1.5 pt-1">
             <div className="rounded-md bg-white p-2">
@@ -472,6 +478,8 @@ function ActiveSession({
               isSelf={p.clientId === collaboration.clientId}
               canManage={isHost}
               onSetParticipantMode={onSetParticipantMode}
+              onKickParticipant={onKickParticipant}
+              onBlockParticipant={onBlockParticipant}
             />
           ))}
         </ul>
@@ -483,12 +491,7 @@ function ActiveSession({
         </p>
       )}
 
-      {/* Primary way out of the dialog: dismiss it while keeping the session
-          live, so the host isn't tempted to use the "X" (which they fear ends
-          the session) to get back to the map (#754). */}
       <Button type="button" className="w-full" onClick={onDismiss}>
-        {/* A view-only guest cannot edit, so "collaborate" would mislead; offer
-            "watch" wording for that case. */}
         {isHost || collaboration.mode === "co-edit"
           ? t("collaborate.goToMap")
           : t("collaborate.goToMapViewOnly")}
diff --git a/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx b/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
index ea40499e7c..6dd6fcf769 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
@@ -1,5 +1,5 @@
 import type { CollaborationMode, CollaborationParticipant } from "@geolibre/core";
-import { Eye, Pencil } from "lucide-react";
+import { Eye, Pencil, UserX, Ban } from "lucide-react";
 import { useTranslation } from "react-i18next";
 import { participantCanEdit } from "../../lib/collab-protocol";
 
@@ -14,6 +14,8 @@ interface CollaborationParticipantRowProps {
    *  own row never shows a control. */
   canManage: boolean;
   onSetParticipantMode: (clientId: string, canEdit: boolean) => void;
+  onKickParticipant?: (clientId: string) => void;
+  onBlockParticipant?: (clientId: string) => void;
   /** Render the smaller variant used in the on-canvas badge roster. */
   compact?: boolean;
 }
@@ -30,6 +32,8 @@ export function CollaborationParticipantRow({
   isSelf,
   canManage,
   onSetParticipantMode,
+  onKickParticipant,
+  onBlockParticipant,
   compact = false,
 }: CollaborationParticipantRowProps) {
   const { t } = useTranslation();
@@ -51,6 +55,11 @@ export function CollaborationParticipantRow({
         style={{ backgroundColor: p.color }}
       />
       <span className="truncate">{p.displayName}</span>
+      {p.identity && (
+        <span className="rounded bg-primary/10 px-1 text-[10px] text-primary">
+          {p.identity.provider === "geolibre" ? "✓" : p.identity.provider}
+        </span>
+      )}
       {isSelf && <span className="text-xs text-muted-foreground">({t("collaborate.you")})</span>}
       {isHostRow && (
         <span
@@ -61,19 +70,43 @@ export function CollaborationParticipantRow({
       )}
       {!isHostRow &&
         (showToggle ? (
-          <button
-            type="button"
-            onClick={() => onSetParticipantMode(p.clientId, !editable)}
-            // A binary "can edit" vs "view-only" setting reads as a switch to
-            // assistive tech, rather than a momentary press (aria-pressed).
-            role="switch"
-            aria-checked={editable}
-            title={editable ? t("collaborate.setViewOnly") : t("collaborate.allowEdit")}
-            className={`ms-auto flex shrink-0 items-center gap-1 rounded border py-0.5 text-muted-foreground transition hover:bg-accent hover:text-foreground ${compact ? "px-1 text-[10px]" : "px-1.5 text-xs"}`}
-          >
-            {permIcon}
-            {permLabel}
-          </button>
+          <div className="ms-auto flex shrink-0 items-center gap-1">
+            <button
+              type="button"
+              onClick={() => onSetParticipantMode(p.clientId, !editable)}
+              role="switch"
+              aria-checked={editable}
+              title={editable ? t("collaborate.setViewOnly") : t("collaborate.allowEdit")}
+              className={`flex items-center gap-1 rounded border py-0.5 text-muted-foreground transition hover:bg-accent hover:text-foreground ${compact ? "px-1 text-[10px]" : "px-1.5 text-xs"}`}
+            >
+              {permIcon}
+              {permLabel}
+            </button>
+            {canManage && !compact && (
+              <>
+                {onKickParticipant && (
+                  <button
+                    type="button"
+                    onClick={() => onKickParticipant(p.clientId)}
+                    title={(t as (key: string) => string)("collaborate.kick")}
+                    className="rounded p-1 text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
+                  >
+                    <UserX className="h-3 w-3" />
+                  </button>
+                )}
+                {onBlockParticipant && (
+                  <button
+                    type="button"
+                    onClick={() => onBlockParticipant(p.clientId)}
+                    title={(t as (key: string) => string)("collaborate.block")}
+                    className="rounded p-1 text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
+                  >
+                    <Ban className="h-3 w-3" />
+                  </button>
+                )}
+              </>
+            )}
+          </div>
         ) : (
           // Non-host viewers still see each guest's current permission.
           <span
diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index 89c18c1455..c04f57d7cb 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -33,11 +33,27 @@ const CURSOR_THROTTLE_MS = 40;
 export interface CollaborationApi {
   enabled: boolean;
   canEdit: () => boolean;
-  start: (displayName: string, color: string, mode: CollaborationMode) => Promise<string>;
-  join: (sessionId: string, displayName: string, color: string) => Promise<void>;
+  start: (
+    displayName: string,
+    color: string,
+    mode: CollaborationMode,
+    requireIdentity?: boolean,
+  ) => Promise<string>;
+  join: (
+    sessionId: string,
+    displayName: string,
+    color: string,
+    options?: { inviteToken?: string; identityToken?: string },
+  ) => Promise<void>;
   leave: () => void;
   setMode: (mode: CollaborationMode) => void;
   setParticipantMode: (clientId: string, canEdit: boolean) => void;
+  mintInvite: (role: CollaborationMode, maxUses?: number) => void;
+  revokeInvite: (token: string) => void;
+  setSessionConfig: (config: { requireIdentity?: boolean }) => void;
+  setLayerLocks: (lockedLayerIds: string[]) => void;
+  kickParticipant: (clientId: string, reason?: string) => void;
+  blockParticipant: (clientId: string, reason?: string) => void;
   setFollowHost: (enabled: boolean) => void;
   sendChat: (text: string, coordinate?: { lng: number; lat: number } | null) => boolean;
   sendCommentMutation: (action: CommentMutationAction) => boolean;
@@ -86,19 +102,11 @@ export function useCollaboration(
     try {
       project = await buildCollaborationSnapshot(mapControllerRef);
     } catch {
-      // Materializing control-managed vector data can fail (the plugin chunk
-      // or a DuckDB query). Surface it so the participant knows their edits
-      // stopped propagating, but only for the newest request that is still
-      // allowed to broadcast: a stale failure, or one racing a relay error
-      // that already paused sync, must not overwrite the message the user
-      // needs to see.
       if (request === snapshotRequestRef.current && canEdit() && !syncPausedRef.current) {
         useAppStore.getState().setCollaboration({ error: i18n.t("collaborate.shareFailed") });
       }
       return;
     }
-    // Materializing control-managed vector data is asynchronous. Discard an
-    // older result if a newer broadcast started while it was being read.
     if (request !== snapshotRequestRef.current || !canEdit() || syncPausedRef.current) return;
     const content = serializeProject(project);
     if (content === lastContentRef.current) return;
@@ -145,6 +153,9 @@ export function useCollaboration(
           mode: message.mode,
           participants: message.participants,
           chat: message.chat ?? [],
+          requireIdentity: message.requireIdentity ?? false,
+          lockedLayerIds: message.lockedLayerIds ?? [],
+          invites: message.invites ?? [],
           error: null,
         });
         for (const [clientId, entry] of Object.entries(message.presence)) {
@@ -160,15 +171,8 @@ export function useCollaboration(
         if (message.snapshot) {
           applyRemoteSnapshot(message.snapshot, true);
         } else if (message.role === "host") {
-          // A newly created session has no relay snapshot yet. The store
-          // subscription only observes changes made after attach(), so without
-          // this seed a project (especially external-plugin layers loaded
-          // before starting collaboration) stays invisible to the first guest
-          // until the host happens to edit something.
           void sendSnapshot();
         }
-        // Guests follow the host by default. Apply the host's latest presence
-        // immediately instead of waiting for their next moveend event.
         if (message.role === "guest" && useAppStore.getState().collaboration.followHost) {
           const host = message.participants.find((participant) => participant.role === "host");
           const hostView = host ? message.presence[host.clientId]?.view : null;
@@ -180,7 +184,6 @@ export function useCollaboration(
         break;
       }
       case "snapshot":
-        // origin is the server-assigned clientId of the sender; skip our own echo.
         if (message.origin !== selfIdRef.current) {
           applyRemoteSnapshot(message.project, false);
         }
@@ -214,14 +217,9 @@ export function useCollaboration(
         store.setCollaboration({ mode: message.mode });
         break;
       case "chat":
-        // The relay echoes our own messages back with the server-assigned id.
-        // Always add via the echo so the server id is used — addCollaborationChat
-        // deduplicates by id so subsequent echoes are harmless.
         store.addCollaborationChat(message.message);
         break;
       case "comment-mutation": {
-        // The relay excludes the sender (broadcast(msg, ws)), so we never receive
-        // our own mutations back over WebSocket. Apply everything we receive.
         const action = message.action;
         if (action.type === "add") {
           store.addComment(action.comment);
@@ -234,6 +232,32 @@ export function useCollaboration(
         }
         break;
       }
+      case "invite-created": {
+        const current = useAppStore.getState().collaboration.invites;
+        store.setCollaboration({ invites: [...current, message.invite] });
+        break;
+      }
+      case "invite-revoked": {
+        const current = useAppStore.getState().collaboration.invites;
+        store.setCollaboration({ invites: current.filter((i) => i.token !== message.token) });
+        break;
+      }
+      case "session-config": {
+        if (message.requireIdentity !== undefined) {
+          store.setCollaboration({ requireIdentity: message.requireIdentity });
+        }
+        break;
+      }
+      case "layer-locks": {
+        store.setCollaboration({ lockedLayerIds: message.lockedLayerIds });
+        break;
+      }
+      case "kicked": {
+        disconnect();
+        useAppStore.getState().resetCollaboration();
+        useAppStore.getState().setCollaboration({ error: message.reason ?? "Removed from session." });
+        break;
+      }
       case "error":
         store.setCollaboration({ error: message.message });
         if (message.code === "too-large") syncPausedRef.current = true;
@@ -241,8 +265,13 @@ export function useCollaboration(
     }
   };
 
-  // Called from onOpen — the socket is open and we are ready to join.
-  const attach = (displayName: string, color: string, hostToken: string | undefined): void => {
+  const attach = (
+    displayName: string,
+    color: string,
+    hostToken: string | undefined,
+    inviteToken?: string,
+    identityToken?: string,
+  ): void => {
     const conn = connRef.current;
     if (!conn) return;
 
@@ -268,6 +297,8 @@ export function useCollaboration(
       displayName,
       color,
       hostToken,
+      inviteToken,
+      identityToken,
     });
 
     teardownRef.current = () => {
@@ -306,6 +337,7 @@ export function useCollaboration(
     displayName: string,
     color: string,
     hostToken: string | undefined,
+    options?: { inviteToken?: string; identityToken?: string },
   ): Promise<void> => {
     disconnect();
     syncPausedRef.current = false;
@@ -333,8 +365,6 @@ export function useCollaboration(
       mode: "co-edit",
       clientId: selfIdRef.current,
       participants: [selfParticipant],
-      // A participant joining an existing session normally wants to arrive at
-      // and stay with the host's viewport. They can turn this off at any time.
       followHost: !hostToken,
       error: null,
     });
@@ -345,7 +375,7 @@ export function useCollaboration(
       const conn = new CollabConnection(sessionWsUrl(baseUrl!, normalizedCode), {
         onOpen: () => {
           if (connRef.current !== conn) return;
-          attach(displayName, color, hostToken);
+          attach(displayName, color, hostToken, options?.inviteToken, options?.identityToken);
         },
         onMessage: (msg) => {
           if (connRef.current !== conn) return;
@@ -390,8 +420,13 @@ export function useCollaboration(
   };
 
   const start = useCallback(
-    async (displayName: string, color: string, mode: CollaborationMode) => {
-      const session = await createSession(mode, baseUrl);
+    async (
+      displayName: string,
+      color: string,
+      mode: CollaborationMode,
+      requireIdentity?: boolean,
+    ) => {
+      const session = await createSession({ mode, requireIdentity }, baseUrl);
       await connect(session.sessionId, displayName, color, session.hostToken);
       return session.sessionId;
     },
@@ -400,8 +435,13 @@ export function useCollaboration(
   );
 
   const join = useCallback(
-    async (sessionId: string, displayName: string, color: string) => {
-      await connect(sessionId.trim().toUpperCase(), displayName, color, undefined);
+    async (
+      sessionId: string,
+      displayName: string,
+      color: string,
+      options?: { inviteToken?: string; identityToken?: string },
+    ) => {
+      await connect(sessionId.trim().toUpperCase(), displayName, color, undefined, options);
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [baseUrl],
@@ -420,13 +460,33 @@ export function useCollaboration(
     connRef.current?.send({ type: "set-participant-mode", clientId, canEdit: canEditFlag });
   }, []);
 
+  const mintInvite = useCallback((role: CollaborationMode, maxUses?: number) => {
+    connRef.current?.send({ type: "mint-invite", role, maxUses });
+  }, []);
+
+  const revokeInvite = useCallback((token: string) => {
+    connRef.current?.send({ type: "revoke-invite", token });
+  }, []);
+
+  const setSessionConfig = useCallback((config: { requireIdentity?: boolean }) => {
+    connRef.current?.send({ type: "set-session-config", ...config });
+  }, []);
+
+  const setLayerLocks = useCallback((lockedLayerIds: string[]) => {
+    connRef.current?.send({ type: "set-layer-locks", lockedLayerIds });
+  }, []);
+
+  const kickParticipant = useCallback((clientId: string, reason?: string) => {
+    connRef.current?.send({ type: "kick-participant", clientId, reason });
+  }, []);
+
+  const blockParticipant = useCallback((clientId: string, reason?: string) => {
+    connRef.current?.send({ type: "block-participant", clientId, reason });
+  }, []);
+
   const sendChat = useCallback((text: string, coordinate?: { lng: number; lat: number } | null) => {
     const trimmed = text.trim();
     if (!trimmed) return false;
-    // Send to the relay only. The relay broadcasts back to everyone including
-    // the sender with a server-assigned id; handleMessage("chat") adds it to
-    // the store then. This means the server's ordering is always the truth and
-    // the sender's message appears only once (via the echo, not optimistically).
     return connRef.current?.send({ type: "chat", text: trimmed, coordinate }) ?? false;
   }, []);
 
@@ -452,6 +512,12 @@ export function useCollaboration(
     leave,
     setMode,
     setParticipantMode,
+    mintInvite,
+    revokeInvite,
+    setSessionConfig,
+    setLayerLocks,
+    kickParticipant,
+    blockParticipant,
     setFollowHost,
     sendChat,
     sendCommentMutation,
diff --git a/apps/geolibre-desktop/src/i18n/locales/en.json b/apps/geolibre-desktop/src/i18n/locales/en.json
index 437bd6f8b9..e78c387c6a 100644
--- a/apps/geolibre-desktop/src/i18n/locales/en.json
+++ b/apps/geolibre-desktop/src/i18n/locales/en.json
@@ -1189,6 +1189,9 @@
     "viewOnly": "View-only",
     "allowEdit": "Allow this person to edit",
     "setViewOnly": "Set this person to view-only",
+    "kick": "Kick participant",
+    "block": "Block participant",
+    "requireIdentityLabel": "Require signed-in account to join",
     "chatLog": "Session chat",
     "chatCompose": "Type a message",
     "chatEmpty": "No messages yet.",
diff --git a/apps/geolibre-desktop/src/lib/collab-client.ts b/apps/geolibre-desktop/src/lib/collab-client.ts
index 7a5561cc60..3ac00c5e0d 100644
--- a/apps/geolibre-desktop/src/lib/collab-client.ts
+++ b/apps/geolibre-desktop/src/lib/collab-client.ts
@@ -79,21 +79,28 @@ export function sessionWsUrl(wsBase: string, sessionId: string): string {
   return `${wsBase}/sessions/${encodeURIComponent(sessionId)}/ws`;
 }
 
+export interface CreateSessionOptions {
+  mode?: CollaborationMode;
+  requireIdentity?: boolean;
+}
+
 export async function createSession(
-  mode: CollaborationMode,
+  options: CollaborationMode | CreateSessionOptions = "co-edit",
   baseUrl: string | null = resolveCollabBaseUrl(),
   fetchImpl: typeof fetch = fetch,
 ): Promise<CreateSessionResult> {
   if (!baseUrl) {
     throw new Error("Collaboration is not configured. Set VITE_GEOLIBRE_COLLAB_URL.");
   }
+  const mode = typeof options === "string" ? options : options.mode ?? "co-edit";
+  const requireIdentity = typeof options === "object" ? options.requireIdentity === true : false;
   const httpBase = httpBaseFromWs(baseUrl);
   let response: Response;
   try {
     response = await fetchImpl(`${httpBase}/sessions`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ mode }),
+      body: JSON.stringify({ mode, requireIdentity }),
       signal: AbortSignal.timeout(CREATE_TIMEOUT_MS),
     });
   } catch (error) {
diff --git a/apps/geolibre-desktop/src/lib/collab-protocol.ts b/apps/geolibre-desktop/src/lib/collab-protocol.ts
index 8e4ca28f45..230cafef4a 100644
--- a/apps/geolibre-desktop/src/lib/collab-protocol.ts
+++ b/apps/geolibre-desktop/src/lib/collab-protocol.ts
@@ -6,6 +6,7 @@
 // `GeoLibreProject`. Keep the two `type` discriminants and field names in sync.
 
 import type {
+  CollabInvite,
   CollaborationChatMessage,
   CollaborationMode,
   CollaborationParticipant,
@@ -16,7 +17,7 @@ import type {
   ProjectComment,
 } from "@geolibre/core";
 
-export type { CollaborationMode, CollaborationRole };
+export type { CollaborationMode, CollaborationRole, CollabInvite };
 
 export interface CollabCursor {
   lng: number;
@@ -40,6 +41,21 @@ export function participantCanEdit(
   return participant.editOverride ?? mode === "co-edit";
 }
 
+/**
+ * Effective layer edit permission. Host can edit any layer; guests with general
+ * edit permission cannot edit layers that are explicitly locked.
+ */
+export function participantCanEditLayer(
+  participant: CollaborationParticipant,
+  mode: CollaborationMode,
+  layerId: string,
+  lockedLayerIds: string[] = [],
+): boolean {
+  if (!participantCanEdit(participant, mode)) return false;
+  if (participant.role === "host") return true;
+  return !lockedLayerIds.includes(layerId);
+}
+
 // Client -> server -----------------------------------------------------------
 
 export interface JoinMessage {
@@ -49,6 +65,10 @@ export interface JoinMessage {
   color: string;
   /** Presented by the session creator to claim the host role. */
   hostToken?: string;
+  /** Optional invite token carrying a baked-in role. */
+  inviteToken?: string;
+  /** Optional identity token verifying the user's account. */
+  identityToken?: string;
 }
 
 export interface ClientSnapshotMessage {
@@ -93,6 +113,39 @@ export interface CommentMutationMessage {
   action: CommentMutationAction;
 }
 
+export interface MintInviteMessage {
+  type: "mint-invite";
+  role: CollaborationMode;
+  maxUses?: number;
+}
+
+export interface RevokeInviteMessage {
+  type: "revoke-invite";
+  token: string;
+}
+
+export interface SetSessionConfigMessage {
+  type: "set-session-config";
+  requireIdentity?: boolean;
+}
+
+export interface KickParticipantMessage {
+  type: "kick-participant";
+  clientId: string;
+  reason?: string;
+}
+
+export interface BlockParticipantMessage {
+  type: "block-participant";
+  clientId: string;
+  reason?: string;
+}
+
+export interface SetLayerLocksMessage {
+  type: "set-layer-locks";
+  lockedLayerIds: string[];
+}
+
 export type ClientMessage =
   | JoinMessage
   | ClientSnapshotMessage
@@ -100,7 +153,13 @@ export type ClientMessage =
   | SetModeMessage
   | SetParticipantModeMessage
   | ChatSendMessage
-  | CommentMutationMessage;
+  | CommentMutationMessage
+  | MintInviteMessage
+  | RevokeInviteMessage
+  | SetSessionConfigMessage
+  | KickParticipantMessage
+  | BlockParticipantMessage
+  | SetLayerLocksMessage;
 
 // Server -> client -----------------------------------------------------------
 
@@ -117,6 +176,9 @@ export interface WelcomeMessage {
   /** Recent chat history so a late joiner sees the conversation so far (#754). */
   chat: CollaborationChatMessage[];
   rev: number;
+  requireIdentity?: boolean;
+  lockedLayerIds?: string[];
+  invites?: CollabInvite[];
 }
 
 export interface PresenceEntry {
@@ -154,9 +216,34 @@ export interface ChatBroadcastMessage {
   message: CollaborationChatMessage;
 }
 
+export interface InviteCreatedMessage {
+  type: "invite-created";
+  invite: CollabInvite;
+}
+
+export interface InviteRevokedMessage {
+  type: "invite-revoked";
+  token: string;
+}
+
+export interface SessionConfigMessage {
+  type: "session-config";
+  requireIdentity: boolean;
+}
+
+export interface LayerLocksMessage {
+  type: "layer-locks";
+  lockedLayerIds: string[];
+}
+
+export interface KickedMessage {
+  type: "kicked";
+  reason?: string;
+}
+
 export interface ErrorMessage {
   type: "error";
-  code: "forbidden" | "too-large" | "bad-message" | "not-found";
+  code: "forbidden" | "too-large" | "bad-message" | "not-found" | "identity-required" | "layer-locked";
   message: string;
 }
 
@@ -168,4 +255,10 @@ export type ServerMessage =
   | ModeMessage
   | ChatBroadcastMessage
   | CommentMutationMessage
+  | InviteCreatedMessage
+  | InviteRevokedMessage
+  | SessionConfigMessage
+  | LayerLocksMessage
+  | KickedMessage
   | ErrorMessage;
+
diff --git a/docs/collaboration.md b/docs/collaboration.md
index 3de66e76a3..f3a1247d38 100644
--- a/docs/collaboration.md
+++ b/docs/collaboration.md
@@ -63,24 +63,35 @@ Client → server:
 
 | type | payload | notes |
 | --- | --- | --- |
-| `join` | `displayName, color, hostToken?` | first frame after connect; the relay assigns the `clientId` (returned in `welcome`) |
+| `join` | `displayName, color, hostToken?, inviteToken?, identityToken?` | first frame after connect; the relay assigns the `clientId` (returned in `welcome`) |
 | `snapshot` | `project, rev` | a debounced project push; co-editors only |
 | `presence` | `cursor?, view?` | throttled cursor / viewport |
 | `set-mode` | `mode` | host only |
-| `set-participant-mode` | `clientId, canEdit` | host only; pin one guest to can-edit / view-only (#754) |
+| `set-participant-mode` | `clientId, canEdit` | host only; pin one guest to can-edit / view-only (#754, durable across reconnect) |
+| `mint-invite` | `role, maxUses?` | host only; mint a co-edit or view-only invite link |
+| `revoke-invite` | `token` | host only; invalidate an active invite link |
+| `set-session-config` | `requireIdentity` | host only; mandate signed-in identity to join |
+| `set-layer-locks` | `lockedLayerIds` | host only; mark specific layer IDs read-only |
+| `kick-participant` | `clientId, reason?` | host only; disconnect a participant |
+| `block-participant` | `clientId, reason?` | host only; disconnect and ban participant/identity from rejoining |
 | `chat` | `text, coordinate?` | a chat message, with an optional attached map coordinate (#754) |
 
 Server → client:
 
 | type | payload | notes |
 | --- | --- | --- |
-| `welcome` | `clientId, role, mode, participants[], snapshot \| null, presence, chat[], rev` | sent once on join; the late-joiner bootstrap |
+| `welcome` | `clientId, role, mode, participants[], snapshot \| null, presence, chat[], rev, requireIdentity, lockedLayerIds, invites[]` | sent once on join; the late-joiner bootstrap |
 | `snapshot` | `project, origin, rev` | fan-out of a peer's snapshot |
 | `presence` | `clientId, cursor?, view?` | fan-out of a peer's presence |
-| `participants` | `participants[]` | on join / leave / role / permission change; each carries `editOverride` |
+| `participants` | `participants[]` | on join / leave / role / permission change; each carries `editOverride` and `identity` |
 | `mode` | `mode` | host changed the session mode |
+| `invite-created` | `invite` | fan-out of a new invite link created by host |
+| `invite-revoked` | `token` | fan-out when host revokes an invite link |
+| `session-config` | `requireIdentity` | broadcast when session identity policy changes |
+| `layer-locks` | `lockedLayerIds` | broadcast when host locks/unlocks layer IDs |
+| `kicked` | `reason` | sent to a participant who was kicked or blocked by the host |
 | `chat` | `message` | fan-out of a chat message (echoed to the sender, so order is server-authoritative) (#754) |
-| `error` | `code, message` | e.g. `forbidden`, `too-large` |
+| `error` | `code, message` | e.g. `forbidden`, `too-large`, `identity-required`, `layer-locked` |
 
 ### Echo / feedback-loop prevention
 
diff --git a/packages/collab-core/src/protocol.ts b/packages/collab-core/src/protocol.ts
index ae583d353c..2df03c6909 100644
--- a/packages/collab-core/src/protocol.ts
+++ b/packages/collab-core/src/protocol.ts
@@ -11,6 +11,21 @@
 export type CollaborationRole = "host" | "guest";
 export type CollaborationMode = "view-only" | "co-edit";
 
+export interface ParticipantIdentity {
+  provider: string;
+  userId: string;
+  username: string;
+}
+
+export interface CollabInvite {
+  token: string;
+  role: CollaborationMode;
+  createdAt: number;
+  maxUses?: number;
+  useCount: number;
+  revoked: boolean;
+}
+
 export interface CollabParticipant {
   clientId: string;
   displayName: string;
@@ -23,6 +38,10 @@ export interface CollabParticipant {
    * (the host can always edit).
    */
   editOverride: boolean | null;
+  /** Optional account identity when signed-in identity binding is enabled. */
+  identity?: ParticipantIdentity | null;
+  /** Optional invite token used to join the session. */
+  inviteToken?: string | null;
 }
 
 export interface CollabCursor {
@@ -62,6 +81,10 @@ export interface JoinMessage {
   color: string;
   /** Presented by the session creator to claim the host role. */
   hostToken?: string;
+  /** Optional invite token carrying a baked-in role. */
+  inviteToken?: string;
+  /** Optional identity token verifying the user's account. */
+  identityToken?: string;
 }
 
 export interface ClientSnapshotMessage {
@@ -106,6 +129,39 @@ export interface CommentMutationMessage {
   action: CommentMutationAction;
 }
 
+export interface MintInviteMessage {
+  type: "mint-invite";
+  role: CollaborationMode;
+  maxUses?: number;
+}
+
+export interface RevokeInviteMessage {
+  type: "revoke-invite";
+  token: string;
+}
+
+export interface SetSessionConfigMessage {
+  type: "set-session-config";
+  requireIdentity?: boolean;
+}
+
+export interface KickParticipantMessage {
+  type: "kick-participant";
+  clientId: string;
+  reason?: string;
+}
+
+export interface BlockParticipantMessage {
+  type: "block-participant";
+  clientId: string;
+  reason?: string;
+}
+
+export interface SetLayerLocksMessage {
+  type: "set-layer-locks";
+  lockedLayerIds: string[];
+}
+
 export type ClientMessage =
   | JoinMessage
   | ClientSnapshotMessage
@@ -113,7 +169,13 @@ export type ClientMessage =
   | SetModeMessage
   | SetParticipantModeMessage
   | ChatSendMessage
-  | CommentMutationMessage;
+  | CommentMutationMessage
+  | MintInviteMessage
+  | RevokeInviteMessage
+  | SetSessionConfigMessage
+  | KickParticipantMessage
+  | BlockParticipantMessage
+  | SetLayerLocksMessage;
 
 // Server -> client -----------------------------------------------------------
 
@@ -130,6 +192,9 @@ export interface WelcomeMessage {
   /** Recent chat history so a late joiner sees the conversation so far (#754). */
   chat: CollabChatMessage[];
   rev: number;
+  requireIdentity?: boolean;
+  lockedLayerIds?: string[];
+  invites?: CollabInvite[];
 }
 
 export interface PresenceEntry {
@@ -168,9 +233,34 @@ export interface ChatBroadcastMessage {
   message: CollabChatMessage;
 }
 
+export interface InviteCreatedMessage {
+  type: "invite-created";
+  invite: CollabInvite;
+}
+
+export interface InviteRevokedMessage {
+  type: "invite-revoked";
+  token: string;
+}
+
+export interface SessionConfigMessage {
+  type: "session-config";
+  requireIdentity: boolean;
+}
+
+export interface LayerLocksMessage {
+  type: "layer-locks";
+  lockedLayerIds: string[];
+}
+
+export interface KickedMessage {
+  type: "kicked";
+  reason?: string;
+}
+
 export interface ErrorMessage {
   type: "error";
-  code: "forbidden" | "too-large" | "bad-message" | "not-found";
+  code: "forbidden" | "too-large" | "bad-message" | "not-found" | "identity-required" | "layer-locked";
   message: string;
 }
 
@@ -182,4 +272,10 @@ export type ServerMessage =
   | ModeMessage
   | ChatBroadcastMessage
   | CommentMutationMessage
+  | InviteCreatedMessage
+  | InviteRevokedMessage
+  | SessionConfigMessage
+  | LayerLocksMessage
+  | KickedMessage
   | ErrorMessage;
+
diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index 6076ae13a1..901b64f60a 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -1,10 +1,12 @@
 import type {
   CollabChatMessage,
   CollabCursor,
+  CollabInvite,
   CollabParticipant,
   CollabView,
   CollaborationMode,
   CollaborationRole,
+  ParticipantIdentity,
 } from "./protocol";
 import { finite, HEX_COLOR_RE } from "./internal/validate";
 
@@ -31,6 +33,8 @@ export interface SessionParticipant {
   color: string;
   role: CollaborationRole;
   editOverride?: boolean;
+  identity?: ParticipantIdentity | null;
+  inviteToken?: string | null;
   lastChatTs?: number;
   lastCommentTs?: number;
 }
@@ -44,9 +48,77 @@ export function participantCanEdit(
   return mode === "co-edit";
 }
 
+export function participantCanEditLayer(
+  participant: Pick<SessionParticipant, "role" | "editOverride">,
+  mode: CollaborationMode,
+  layerId: string,
+  lockedLayerIds: string[] = [],
+): boolean {
+  if (!participantCanEdit(participant, mode)) return false;
+  if (participant.role === "host") return true;
+  return !lockedLayerIds.includes(layerId);
+}
+
+export function getParticipantKey(
+  participant: Pick<SessionParticipant, "clientId" | "identity" | "inviteToken">,
+): string {
+  if (participant.identity?.userId) {
+    return `user:${participant.identity.userId}`;
+  }
+  if (participant.inviteToken) {
+    return `invite:${participant.inviteToken}`;
+  }
+  return `anon:${participant.clientId}`;
+}
+
+export function diffLockedLayers(
+  storedProject: unknown,
+  inboundProject: unknown,
+  lockedLayerIds: string[] = [],
+): { lockedId: string; layerName: string } | null {
+  if (!lockedLayerIds.length || !storedProject || !inboundProject) return null;
+  if (typeof storedProject !== "object" || typeof inboundProject !== "object") return null;
+
+  const storedLayers = Array.isArray((storedProject as { layers?: unknown }).layers)
+    ? ((storedProject as { layers: Record<string, unknown>[] }).layers)
+    : [];
+  const inboundLayers = Array.isArray((inboundProject as { layers?: unknown }).layers)
+    ? ((inboundProject as { layers: Record<string, unknown>[] }).layers)
+    : [];
+
+  const storedMap = new Map<string, Record<string, unknown>>();
+  for (const layer of storedLayers) {
+    if (layer && typeof layer === "object" && typeof layer.id === "string") {
+      storedMap.set(layer.id, layer);
+    }
+  }
+
+  const inboundMap = new Map<string, Record<string, unknown>>();
+  for (const layer of inboundLayers) {
+    if (layer && typeof layer === "object" && typeof layer.id === "string") {
+      inboundMap.set(layer.id, layer);
+    }
+  }
+
+  for (const lockedId of lockedLayerIds) {
+    const stored = storedMap.get(lockedId);
+    if (!stored) continue;
+    const inbound = inboundMap.get(lockedId);
+    const layerName = typeof stored.name === "string" ? stored.name : lockedId;
+    if (!inbound) {
+      return { lockedId, layerName };
+    }
+    if (JSON.stringify(stored) !== JSON.stringify(inbound)) {
+      return { lockedId, layerName };
+    }
+  }
+
+  return null;
+}
+
 export type SnapshotDecision =
   | { ok: true }
-  | { ok: false; code: "forbidden" | "too-large"; message: string };
+  | { ok: false; code: "forbidden" | "too-large" | "layer-locked"; message: string };
 
 /** Shared authorization/size gate used by every relay implementation. */
 export function authorizeSnapshot(
@@ -54,6 +126,9 @@ export function authorizeSnapshot(
   mode: CollaborationMode,
   byteLength: number,
   maxBytes = MAX_SNAPSHOT_BYTES,
+  storedSnapshot?: unknown,
+  inboundSnapshot?: unknown,
+  lockedLayerIds: string[] = [],
 ): SnapshotDecision {
   if (!participantCanEdit(participant, mode)) {
     return {
@@ -65,6 +140,16 @@ export function authorizeSnapshot(
           : "This session is view-only.",
     };
   }
+  if (participant.role !== "host" && lockedLayerIds.length > 0 && storedSnapshot && inboundSnapshot) {
+    const diff = diffLockedLayers(storedSnapshot, inboundSnapshot, lockedLayerIds);
+    if (diff) {
+      return {
+        ok: false,
+        code: "layer-locked",
+        message: `Layer "${diff.layerName}" is locked by the host and cannot be modified.`,
+      };
+    }
+  }
   if (byteLength > maxBytes) {
     return {
       ok: false,
@@ -77,7 +162,7 @@ export function authorizeSnapshot(
 
 export function authorizeHostAction(
   participant: Pick<SessionParticipant, "role">,
-  action: "session mode" | "participant permissions",
+  action: string,
 ): string | null {
   return participant.role === "host" ? null : `Only the host can change ${action}.`;
 }
@@ -117,6 +202,8 @@ export function toWireParticipant(participant: SessionParticipant): CollabPartic
     color: participant.color,
     role: participant.role,
     editOverride: participant.role === "host" ? null : (participant.editOverride ?? null),
+    identity: participant.identity ?? null,
+    inviteToken: participant.inviteToken ?? null,
   };
 }
 
@@ -195,3 +282,4 @@ export function parseStoredChat(raw: unknown): CollabChatMessage[] {
   }
   return Array.isArray(raw) ? raw.filter(isValidChatMessage) : [];
 }
+
diff --git a/packages/core/src/store.ts b/packages/core/src/store.ts
index 2847c59e16..06136e375e 100644
--- a/packages/core/src/store.ts
+++ b/packages/core/src/store.ts
@@ -35,6 +35,7 @@ import {
   MAX_PROCESSING_HISTORY,
   MIN_DASHBOARD_COLUMNS,
   type AddTileLayerOptions,
+  type CollabInvite,
   type CollaborationChatMessage,
   type CollaborationParticipant,
   type CollaborationPresence,
@@ -707,6 +708,9 @@ export const DEFAULT_COLLABORATION_STATE: CollaborationState = Object.freeze({
   >,
   followHost: false,
   chat: Object.freeze([] as CollaborationChatMessage[]) as CollaborationChatMessage[],
+  requireIdentity: false,
+  lockedLayerIds: Object.freeze([] as string[]) as string[],
+  invites: Object.freeze([] as CollabInvite[]) as CollabInvite[],
   error: null,
 });
 
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index 70a9b79e95..30b4ec2907 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -1099,6 +1099,21 @@ export type CollaborationRole = "host" | "guest";
 /** Whether guests may edit (`co-edit`) or only watch (`view-only`). */
 export type CollaborationMode = "view-only" | "co-edit";
 
+export interface ParticipantIdentity {
+  provider: string;
+  userId: string;
+  username: string;
+}
+
+export interface CollabInvite {
+  token: string;
+  role: CollaborationMode;
+  createdAt: number;
+  maxUses?: number;
+  useCount: number;
+  revoked: boolean;
+}
+
 export interface CollaborationParticipant {
   clientId: string;
   displayName: string;
@@ -1110,6 +1125,10 @@ export interface CollaborationParticipant {
    * `null` for the host (the host can always edit).
    */
   editOverride: boolean | null;
+  /** Optional account identity when signed-in identity binding is enabled. */
+  identity?: ParticipantIdentity | null;
+  /** Optional invite token used to join the session. */
+  inviteToken?: string | null;
 }
 
 /** A remote participant's live cursor + viewport, used to render presence. */
@@ -1153,6 +1172,12 @@ export interface CollaborationState {
   followHost: boolean;
   /** Recent session chat, oldest first, capped to a bounded window (#754). */
   chat: CollaborationChatMessage[];
+  /** Session flag requiring participants to be signed in. */
+  requireIdentity: boolean;
+  /** Layer IDs marked locked by the host. */
+  lockedLayerIds: string[];
+  /** Active session invites minted by host. */
+  invites: CollabInvite[];
   /** Last human-readable error, surfaced in the Collaborate dialog. */
   error: string | null;
 }
diff --git a/tests/collab-comment-validate.test.ts b/tests/collab-comment-validate.test.ts
index ebe051b0df..70db165405 100644
--- a/tests/collab-comment-validate.test.ts
+++ b/tests/collab-comment-validate.test.ts
@@ -12,7 +12,7 @@ import {
   validateAuthor,
   validateComment,
   validateReply,
-} from "../workers/collab/src/comment-validate";
+} from "../packages/collab-core/src/index.ts";
 
 // -- constants ----------------------------------------------------------------
 
@@ -446,6 +446,6 @@ describe("validateComment", () => {
       __proto__: { evil: true },
     });
     assert.ok(result);
-    assert.equal((result as Record<string, unknown>).extraField, undefined);
+    assert.equal((result as unknown as Record<string, unknown>).extraField, undefined);
   });
 });
diff --git a/tests/collab-upgrade.test.ts b/tests/collab-upgrade.test.ts
new file mode 100644
index 0000000000..33f0528ca9
--- /dev/null
+++ b/tests/collab-upgrade.test.ts
@@ -0,0 +1,177 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+  authorizeSnapshot,
+  diffLockedLayers,
+  getParticipantKey,
+  participantCanEditLayer,
+  type SessionParticipant,
+} from "../packages/collab-core/src/index.ts";
+import { createRelay } from "../workers/collab-node/src/server.ts";
+import WebSocket from "ws";
+
+describe("Collaboration Upgrade Proposals", () => {
+  it("computes participant keys correctly for anon, invite, and identity users", () => {
+    const anon: SessionParticipant = {
+      clientId: "c-1",
+      displayName: "Anon",
+      color: "#000",
+      role: "guest",
+    };
+    assert.equal(getParticipantKey(anon), "anon:c-1");
+
+    const inviteUser: SessionParticipant = {
+      clientId: "c-2",
+      displayName: "Invited",
+      color: "#000",
+      role: "guest",
+      inviteToken: "tok-123",
+    };
+    assert.equal(getParticipantKey(inviteUser), "invite:tok-123");
+
+    const signedInUser: SessionParticipant = {
+      clientId: "c-3",
+      displayName: "User",
+      color: "#000",
+      role: "guest",
+      identity: { provider: "geolibre", userId: "usr-456", username: "User" },
+    };
+    assert.equal(getParticipantKey(signedInUser), "user:usr-456");
+  });
+
+  it("diffs locked layers on inbound project snapshot", () => {
+    const stored = {
+      layers: [
+        { id: "layer-1", name: "Base Layer" },
+        { id: "layer-2", name: "Roads" },
+      ],
+    };
+    const validInbound = {
+      layers: [
+        { id: "layer-1", name: "Base Layer" },
+        { id: "layer-2", name: "Roads Modified" },
+      ],
+    };
+    const invalidInbound = {
+      layers: [
+        { id: "layer-1", name: "Base Layer Tampered" },
+        { id: "layer-2", name: "Roads Modified" },
+      ],
+    };
+
+    // Layer-1 is locked; editing layer-2 is fine, editing layer-1 is blocked
+    const lockedLayerIds = ["layer-1"];
+    assert.equal(diffLockedLayers(stored, validInbound, lockedLayerIds), null);
+    assert.notEqual(diffLockedLayers(stored, invalidInbound, lockedLayerIds), null);
+  });
+
+  it("evaluates layer edit permissions with participantCanEditLayer", () => {
+    const host: SessionParticipant = { clientId: "h", displayName: "Host", color: "#000", role: "host" };
+    const guest: SessionParticipant = { clientId: "g", displayName: "Guest", color: "#000", role: "guest" };
+
+    const lockedLayerIds = ["layer-locked"];
+
+    // Host can edit any layer
+    assert.equal(participantCanEditLayer(host, "co-edit", "layer-locked", lockedLayerIds), true);
+
+    // Guest cannot edit locked layer, but can edit unlocked layer
+    assert.equal(participantCanEditLayer(guest, "co-edit", "layer-locked", lockedLayerIds), false);
+    assert.equal(participantCanEditLayer(guest, "co-edit", "layer-unlocked", lockedLayerIds), true);
+  });
+
+  it("authorizes snapshot rejecting layer-locked edits from guests", () => {
+    const guest: SessionParticipant = { clientId: "g", displayName: "Guest", color: "#000", role: "guest" };
+    const stored = { layers: [{ id: "l1", name: "Old" }] };
+    const inbound = { layers: [{ id: "l1", name: "New" }] };
+
+    const auth = authorizeSnapshot(guest, "co-edit", 100, 1_000_000, stored, inbound, ["l1"]);
+    assert.equal(auth.ok, false);
+    if (!auth.ok) {
+      assert.equal(auth.code, "layer-locked");
+    }
+  });
+
+  it("executes relay end-to-end flow for invites, moderation, and config", async () => {
+    const relay = createRelay({ port: 0, dbPath: ":memory:" });
+    await new Promise<void>((res) => relay.server.listen(0, "127.0.0.1", () => res()));
+    const address = relay.server.address() as { port: number };
+    const baseUrl = `http://127.0.0.1:${address.port}`;
+    const wsBaseUrl = `ws://127.0.0.1:${address.port}`;
+
+    // Create session
+    const res = await fetch(`${baseUrl}/sessions`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ mode: "co-edit", requireIdentity: false }),
+    });
+    assert.equal(res.status, 200);
+    const sessionInfo = (await res.json()) as { sessionId: string; hostToken: string };
+
+    // Host connects
+    const hostWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
+    let hostWelcome: any = null;
+    await new Promise<void>((res) => {
+      hostWs.on("open", () => {
+        hostWs.send(JSON.stringify({ type: "join", displayName: "HostUser", color: "#2563eb", hostToken: sessionInfo.hostToken }));
+      });
+      hostWs.on("message", (raw) => {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "welcome") {
+          hostWelcome = msg;
+          res();
+        }
+      });
+    });
+    assert.equal(hostWelcome.role, "host");
+
+    // Mint invite token
+    let inviteToken = "";
+    await new Promise<void>((res) => {
+      hostWs.on("message", (raw) => {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "invite-created") {
+          inviteToken = msg.invite.token;
+          res();
+        }
+      });
+      hostWs.send(JSON.stringify({ type: "mint-invite", role: "view-only", maxUses: 1 }));
+    });
+    assert.ok(inviteToken);
+
+    // Guest joins using invite token
+    const guestWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
+    let guestWelcome: any = null;
+    await new Promise<void>((res) => {
+      guestWs.on("open", () => {
+        guestWs.send(JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }));
+      });
+      guestWs.on("message", (raw) => {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "welcome") {
+          guestWelcome = msg;
+          res();
+        }
+      });
+    });
+    assert.equal(guestWelcome.role, "guest");
+
+    // Host kicks guest
+    let guestKicked = false;
+    await new Promise<void>((res) => {
+      guestWs.on("message", (raw) => {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "kicked") {
+          guestKicked = true;
+        }
+      });
+      guestWs.on("close", () => {
+        res();
+      });
+      hostWs.send(JSON.stringify({ type: "kick-participant", clientId: guestWelcome.clientId, reason: "Testing kick" }));
+    });
+    assert.equal(guestKicked, true);
+
+    hostWs.close();
+    await relay.close();
+  });
+});
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 594c933bf5..169f265b40 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -13,6 +13,8 @@ import {
   authorizeHostAction,
   authorizeSnapshot,
   clearParticipantOverrides,
+  diffLockedLayers,
+  getParticipantKey,
   normalizeMode,
   participantCanEdit,
   preserveStoredComments,
@@ -27,7 +29,10 @@ import {
   isBoundedId,
   type ClientMessage,
   type CollabChatMessage,
+  type CollabInvite,
   type CollaborationMode,
+  type CollaborationRole,
+  type ParticipantIdentity,
   type PresenceEntry,
   type ServerMessage,
   type SessionParticipant,
@@ -43,6 +48,52 @@ const MAX_SESSION_BODY_BYTES = 16_384;
 const DEFAULT_IDLE_TTL_MS = 2 * 60 * 60 * 1000;
 const ENCODER = new TextEncoder();
 
+const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
+
+function isAllowedOrigin(originHeader: string | undefined, envAllowed = process.env.ALLOWED_ORIGINS): boolean {
+  if (!originHeader) return true;
+  const allowedList = envAllowed
+    ? envAllowed.split(",").map((s) => s.trim()).filter(Boolean)
+    : [
+        "https://geolibre.app",
+        "https://collab.geolibre.app",
+        "http://localhost",
+        "http://127.0.0.1",
+        "tauri://localhost",
+      ];
+
+  try {
+    const originUrl = new URL(originHeader);
+    const host = originUrl.hostname;
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
+    return allowedList.some((allowed) => {
+      if (allowed === "*") return true;
+      try {
+        const allowedUrl = new URL(allowed);
+        return originUrl.origin === allowedUrl.origin;
+      } catch {
+        return originHeader === allowed || host === allowed;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+
+function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
+  const now = Date.now();
+  const record = rateLimitMap.get(key);
+  if (!record || now > record.resetAt) {
+    rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
+    return true;
+  }
+  if (record.count >= maxRequests) {
+    return false;
+  }
+  record.count += 1;
+  return true;
+}
+
 interface Peer {
   socket: WebSocket;
   participant?: SessionParticipant;
@@ -104,17 +155,11 @@ export function createRelay(options: RelayOptions = {}): {
   const sessions = new Map<string, LiveSession>();
   const wss = new WebSocketServer({ noServer: true, maxPayload: maxSnapshotBytes + 64_000 });
 
-  // `POST /sessions` is unauthenticated and inserts a row per call, while the
-  // only delete path runs after a peer has connected *and* disconnected. A code
-  // nobody ever joins would otherwise sit in SQLite forever.
   const sweep = (): void => store.deleteStaleBefore(Date.now() - idleTtlMs, sessions.keys());
   sweep();
   const sweepTimer = setInterval(sweep, Math.min(idleTtlMs, 15 * 60 * 1000));
   sweepTimer.unref();
 
-  // A TCP connection dropped without a close frame (NAT or proxy idle timeout)
-  // fires neither "close" nor "error", so the peer would linger in the roster
-  // forever and keep peers.size above zero, which blocks the idle cleanup above.
   const alive = new WeakSet<WebSocket>();
   const heartbeat = setInterval(() => {
     for (const session of sessions.values()) {
@@ -182,14 +227,9 @@ export function createRelay(options: RelayOptions = {}): {
     peer: Peer,
     raw: WebSocket.RawData,
   ): void {
-    // ws delivers text as Buffer too; isBinary is handled at the event site.
     const text = raw.toString();
     let message: ClientMessage;
     try {
-      // `null`, `1` and `"x"` are all valid JSON, so parsing alone does not
-      // guarantee an object. Reading `.type` off a non-object throws inside the
-      // ws "message" listener, which is an uncaught exception that takes the
-      // whole relay -- and every other session it hosts -- down with it.
       const parsed: unknown = JSON.parse(text);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new Error("not an object");
@@ -199,13 +239,7 @@ export function createRelay(options: RelayOptions = {}): {
       send(peer, { type: "error", code: "bad-message", message: "Malformed JSON." });
       return;
     }
-    // Presence is by far the highest-frequency frame (one per cursor move, per
-    // participant) and needs no persisted state, so it is answered before the
-    // store read below. store.get is a synchronous SQLite SELECT * that pulls
-    // the snapshot and chat blobs and blocks the event loop; because this relay
-    // hosts every session in one process, doing that per presence frame would
-    // add latency to every *other* session too. The Cloudflare DO can afford the
-    // per-message read because each session is its own isolated actor.
+
     if (message.type === "presence" && peer.participant) {
       const cursor = sanitizeCursor(message.cursor);
       const view = sanitizeView(message.view);
@@ -223,26 +257,96 @@ export function createRelay(options: RelayOptions = {}): {
 
     if (message.type === "join") {
       if (peer.participant) return;
-      const role =
+      let role =
         message.hostToken && persisted.hostToken && message.hostToken === persisted.hostToken
           ? "host"
           : "guest";
+
+      let inviteToken: string | undefined = undefined;
+      if (message.inviteToken && typeof message.inviteToken === "string") {
+        const invites = store.getInvites(id);
+        const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
+        if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
+          inviteToken = inv.token;
+          if (role !== "host") {
+            role = "guest";
+          }
+          inv.useCount += 1;
+          store.createInvite(id, inv);
+        }
+      }
+
+      let identity: ParticipantIdentity | null = null;
+      if (message.identityToken && typeof message.identityToken === "string") {
+        try {
+          const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
+          if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
+            identity = {
+              provider: parsed.provider || "geolibre",
+              userId: parsed.userId,
+              username: sanitizeDisplayName(parsed.username),
+            };
+          }
+        } catch {
+          // Invalid identity token
+        }
+      }
+
+      if (persisted.requireIdentity && !identity && role !== "host") {
+        send(peer, {
+          type: "error",
+          code: "identity-required",
+          message: "Sign-in required to join this session.",
+        });
+        return;
+      }
+
+      const tempParticipant: SessionParticipant = {
+        clientId: "temp",
+        displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
+        color: sanitizeColor(message.color),
+        role: role as CollaborationRole,
+        identity,
+        inviteToken,
+      };
+      const participantKey = getParticipantKey(tempParticipant);
+
+      if (store.isBlockedKey(id, participantKey)) {
+        send(peer, {
+          type: "error",
+          code: "forbidden",
+          message: "You have been blocked from this session by the host.",
+        });
+        return;
+      }
+
+      const durableOverride = store.getDurableOverride(id, participantKey);
+
       peer.participant = {
         clientId: randomUUID(),
-        displayName: sanitizeDisplayName(message.displayName),
+        displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
         color: sanitizeColor(message.color),
-        role,
+        role: role as CollaborationRole,
+        ...(durableOverride !== undefined ? { editOverride: durableOverride } : {}),
+        identity,
+        inviteToken,
       };
+
+      const welcomeInvites = role === "host" ? store.getInvites(id) : undefined;
+
       send(peer, {
         type: "welcome",
         clientId: peer.participant.clientId,
-        role,
+        role: role as CollaborationRole,
         mode: persisted.mode,
         participants: participants(session).map(toWireParticipant),
         snapshot: persisted.snapshot,
         presence: Object.fromEntries(session.presence),
         chat: persisted.chat,
         rev: persisted.rev,
+        requireIdentity: persisted.requireIdentity,
+        lockedLayerIds: persisted.lockedLayerIds,
+        ...(welcomeInvites ? { invites: welcomeInvites } : {}),
       });
       broadcastParticipants(session, peer);
       return;
@@ -264,6 +368,9 @@ export function createRelay(options: RelayOptions = {}): {
         persisted.mode,
         ENCODER.encode(text).length,
         maxSnapshotBytes,
+        persisted.snapshot,
+        message.project,
+        persisted.lockedLayerIds,
       );
       if (!authorization.ok) {
         send(peer, {
@@ -279,8 +386,6 @@ export function createRelay(options: RelayOptions = {}): {
       return;
     }
 
-    // A presence frame from a peer that has not joined yet falls through to
-    // here, where the join guard above has already rejected it.
     if (message.type === "presence") return;
 
     if (message.type === "set-mode") {
@@ -312,11 +417,127 @@ export function createRelay(options: RelayOptions = {}): {
           message.canEdit,
         )
       ) {
+        const targetPeer = [...session.peers].find(
+          (p) => p.participant?.clientId === message.clientId,
+        );
+        if (targetPeer?.participant) {
+          const targetKey = getParticipantKey(targetPeer.participant);
+          store.saveDurableOverride(id, targetKey, targetPeer.participant.editOverride);
+        }
         broadcastParticipants(session);
       }
       return;
     }
 
+    if (message.type === "mint-invite") {
+      const authorization = authorizeHostAction(participant, "session invites");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      const role: CollaborationMode = message.role === "view-only" ? "view-only" : "co-edit";
+      const token = randomUUID().slice(0, 16);
+      const invite: CollabInvite = {
+        token,
+        role,
+        createdAt: Date.now(),
+        ...(message.maxUses ? { maxUses: message.maxUses } : {}),
+        useCount: 0,
+        revoked: false,
+      };
+      store.createInvite(id, invite);
+      send(peer, { type: "invite-created", invite });
+      return;
+    }
+
+    if (message.type === "revoke-invite") {
+      const authorization = authorizeHostAction(participant, "session invites");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      if (typeof message.token === "string") {
+        store.revokeInvite(id, message.token);
+        for (const p of session.peers) {
+          if (p.participant?.role === "host") {
+            send(p, { type: "invite-revoked", token: message.token });
+          }
+        }
+      }
+      return;
+    }
+
+    if (message.type === "set-session-config") {
+      const authorization = authorizeHostAction(participant, "session settings");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      if (message.requireIdentity !== undefined) {
+        const req = message.requireIdentity === true;
+        store.saveSessionConfig(id, req);
+        broadcast(session, { type: "session-config", requireIdentity: req });
+      }
+      return;
+    }
+
+    if (message.type === "set-layer-locks") {
+      const authorization = authorizeHostAction(participant, "layer locks");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      const lockedLayerIds = Array.isArray(message.lockedLayerIds)
+        ? message.lockedLayerIds.filter((item: unknown): item is string => typeof item === "string")
+        : [];
+      store.saveLayerLocks(id, lockedLayerIds);
+      broadcast(session, { type: "layer-locks", lockedLayerIds });
+      return;
+    }
+
+    if (message.type === "kick-participant") {
+      const authorization = authorizeHostAction(participant, "participant moderation");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      if (typeof message.clientId !== "string") return;
+      const targetPeer = [...session.peers].find(
+        (p) => p.participant?.clientId === message.clientId,
+      );
+      if (!targetPeer || targetPeer.participant?.role === "host") return;
+
+      send(targetPeer, {
+        type: "kicked",
+        reason: message.reason ?? "Kicked by session host.",
+      });
+      targetPeer.socket.close(4000, "Kicked by host");
+      return;
+    }
+
+    if (message.type === "block-participant") {
+      const authorization = authorizeHostAction(participant, "participant moderation");
+      if (authorization) {
+        send(peer, { type: "error", code: "forbidden", message: authorization });
+        return;
+      }
+      if (typeof message.clientId !== "string") return;
+      const targetPeer = [...session.peers].find(
+        (p) => p.participant?.clientId === message.clientId,
+      );
+      if (!targetPeer || !targetPeer.participant || targetPeer.participant.role === "host") return;
+
+      const targetKey = getParticipantKey(targetPeer.participant);
+      store.blockKey(id, targetKey);
+
+      send(targetPeer, {
+        type: "kicked",
+        reason: message.reason ?? "Blocked by session host.",
+      });
+      targetPeer.socket.close(4001, "Blocked by host");
+      return;
+    }
+
     if (message.type === "chat") {
       const chatText =
         typeof message.text === "string" ? message.text.trim().slice(0, MAX_CHAT_TEXT_LENGTH) : "";
@@ -504,6 +725,19 @@ export function createRelay(options: RelayOptions = {}): {
     if ((url.pathname === "/" || url.pathname === "/health") && request.method === "GET")
       return json(response, 200, { ok: true, service: "geolibre-collab" });
     if (url.pathname === "/sessions" && request.method === "POST") {
+      const origin = request.headers["origin"];
+      if (!isAllowedOrigin(origin)) {
+        return json(response, 403, { error: "Forbidden origin" });
+      }
+
+      const clientIp =
+        (request.headers["x-forwarded-for"] as string | undefined)?.split(",")[0].trim() ||
+        request.socket.remoteAddress ||
+        "unknown";
+      if (!checkRateLimit(clientIp, 10, 60_000)) {
+        return json(response, 429, { error: "Too many session creation requests" });
+      }
+
       // Refuse on the declared length before any handler is registered, so an
       // oversized upload cannot hold the connection open while it trickles in.
       // The byte counter below still runs, for clients that omit or understate
@@ -552,12 +786,14 @@ export function createRelay(options: RelayOptions = {}): {
         } catch {
           // Match the Worker: malformed/empty input uses defaults.
         }
-        const mode = normalizeMode((requested as { mode?: CollaborationMode } | null)?.mode);
+        const reqObj = requested as { mode?: CollaborationMode; requireIdentity?: boolean } | null;
+        const mode = normalizeMode(reqObj?.mode);
+        const requireIdentity = reqObj?.requireIdentity === true;
         for (let attempt = 0; attempt < 5; attempt++) {
           const sessionId = randomCode();
           const hostToken = randomToken();
-          if (store.create(sessionId, hostToken, mode))
-            return json(response, 200, { sessionId, hostToken, mode });
+          if (store.create(sessionId, hostToken, mode, requireIdentity))
+            return json(response, 200, { sessionId, hostToken, mode, requireIdentity });
         }
         return json(response, 503, {
           error: "Could not allocate a session code. Please try again.",
@@ -582,13 +818,13 @@ export function createRelay(options: RelayOptions = {}): {
       return;
     }
     const id = match[1];
-    wss.handleUpgrade(request, socket, head, (websocket) => {
+    wss.handleUpgrade(request, socket, head, (websocket: WebSocket) => {
       const session = live(id);
       const peer: Peer = { socket: websocket };
       session.peers.add(peer);
       alive.add(websocket);
       websocket.on("pong", () => alive.add(websocket));
-      websocket.on("message", (raw, isBinary) => {
+      websocket.on("message", (raw: WebSocket.RawData, isBinary: boolean) => {
         if (isBinary) {
           send(peer, {
             type: "error",
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 0b50d728c3..02f1bf4fb1 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -2,12 +2,14 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { normalizeMode, parseStoredChat } from "@geolibre/collab-core";
-import type { CollabChatMessage, CollaborationMode } from "@geolibre/collab-core";
+import type { CollabChatMessage, CollabInvite, CollaborationMode } from "@geolibre/collab-core";
 
 export interface StoredSession {
   id: string;
   hostToken: string;
   mode: CollaborationMode;
+  requireIdentity: boolean;
+  lockedLayerIds: string[];
   rev: number;
   snapshot: unknown | null;
   chat: CollabChatMessage[];
@@ -18,6 +20,8 @@ interface SessionRow {
   id: string;
   host_token: string;
   mode: string;
+  require_identity?: number;
+  locked_layer_ids?: string;
   rev: number;
   snapshot: string | null;
   chat: string;
@@ -45,22 +49,45 @@ export class SessionStore {
         id TEXT PRIMARY KEY,
         host_token TEXT NOT NULL,
         mode TEXT NOT NULL,
+        require_identity INTEGER NOT NULL DEFAULT 0,
+        locked_layer_ids TEXT NOT NULL DEFAULT '[]',
         rev INTEGER NOT NULL DEFAULT 0,
         snapshot TEXT,
         chat TEXT NOT NULL DEFAULT '[]',
         updated_at INTEGER NOT NULL
       );
+      CREATE TABLE IF NOT EXISTS collab_invites (
+        session_id TEXT NOT NULL,
+        token TEXT PRIMARY KEY,
+        role TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        max_uses INTEGER,
+        use_count INTEGER NOT NULL DEFAULT 0,
+        revoked INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE TABLE IF NOT EXISTS collab_durable_overrides (
+        session_id TEXT NOT NULL,
+        participant_key TEXT NOT NULL,
+        edit_override INTEGER NOT NULL,
+        PRIMARY KEY (session_id, participant_key)
+      );
+      CREATE TABLE IF NOT EXISTS collab_blocked_keys (
+        session_id TEXT NOT NULL,
+        participant_key TEXT NOT NULL,
+        blocked_at INTEGER NOT NULL,
+        PRIMARY KEY (session_id, participant_key)
+      );
     `);
   }
 
-  create(id: string, hostToken: string, mode: CollaborationMode): boolean {
+  create(id: string, hostToken: string, mode: CollaborationMode, requireIdentity = false): boolean {
     const result = this.db
       .prepare(
         `INSERT OR IGNORE INTO collab_sessions
-          (id, host_token, mode, rev, snapshot, chat, updated_at)
-         VALUES (?, ?, ?, 0, NULL, '[]', ?)`,
+          (id, host_token, mode, require_identity, locked_layer_ids, rev, snapshot, chat, updated_at)
+         VALUES (?, ?, ?, ?, '[]', 0, NULL, '[]', ?)`,
       )
-      .run(id, hostToken, mode, Date.now());
+      .run(id, hostToken, mode, requireIdentity ? 1 : 0, Date.now());
     return result.changes === 1;
   }
 
@@ -72,23 +99,17 @@ export class SessionStore {
     return {
       id: row.id,
       hostToken: row.host_token,
-      // normalizeMode rather than an inline ternary: if the shared contract
-      // gains a third mode, this would silently downgrade it to co-edit while
-      // the relay accepted it on the wire.
       mode: normalizeMode(row.mode),
+      requireIdentity: row.require_identity === 1,
+      lockedLayerIds: parseJson(row.locked_layer_ids ?? "[]", []),
       rev: row.rev,
       snapshot: parseJson(row.snapshot, null),
-      // Shape-checked per entry, not just JSON-parsed: a corrupt or tampered
-      // chat column would otherwise reach joiners in `welcome` and crash a
-      // client on `coordinate.lat.toFixed`. Same guard the Worker applies.
       chat: parseStoredChat(row.chat),
       updatedAt: row.updated_at,
     };
   }
 
   saveSnapshot(id: string, project: unknown): number {
-    // RETURNING keeps the write and the revision read in one statement, so the
-    // number handed back is always the one this update produced.
     const row = this.db
       .prepare(
         `UPDATE collab_sessions
@@ -112,31 +133,123 @@ export class SessionStore {
       .run(mode, Date.now(), id);
   }
 
+  saveSessionConfig(id: string, requireIdentity: boolean): void {
+    this.db
+      .prepare("UPDATE collab_sessions SET require_identity = ?, updated_at = ? WHERE id = ?")
+      .run(requireIdentity ? 1 : 0, Date.now(), id);
+  }
+
+  saveLayerLocks(id: string, lockedLayerIds: string[]): void {
+    this.db
+      .prepare("UPDATE collab_sessions SET locked_layer_ids = ?, updated_at = ? WHERE id = ?")
+      .run(JSON.stringify(lockedLayerIds), Date.now(), id);
+  }
+
   saveChat(id: string, chat: CollabChatMessage[]): void {
     this.db
       .prepare("UPDATE collab_sessions SET chat = ?, updated_at = ? WHERE id = ?")
       .run(JSON.stringify(chat), Date.now(), id);
   }
 
+  createInvite(sessionId: string, invite: CollabInvite): void {
+    this.db
+      .prepare(
+        `INSERT OR REPLACE INTO collab_invites (session_id, token, role, created_at, max_uses, use_count, revoked)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        sessionId,
+        invite.token,
+        invite.role,
+        invite.createdAt,
+        invite.maxUses ?? null,
+        invite.useCount,
+        invite.revoked ? 1 : 0,
+      );
+  }
+
+  getInvites(sessionId: string): CollabInvite[] {
+    const rows = this.db
+      .prepare("SELECT * FROM collab_invites WHERE session_id = ? ORDER BY created_at DESC")
+      .all(sessionId) as unknown as {
+      token: string;
+      role: string;
+      created_at: number;
+      max_uses: number | null;
+      use_count: number;
+      revoked: number;
+    }[];
+    return rows.map((r) => ({
+      token: r.token,
+      role: r.role === "view-only" ? "view-only" : "co-edit",
+      createdAt: r.created_at,
+      ...(r.max_uses !== null ? { maxUses: r.max_uses } : {}),
+      useCount: r.use_count,
+      revoked: r.revoked === 1,
+    }));
+  }
+
+  revokeInvite(sessionId: string, token: string): void {
+    this.db
+      .prepare("UPDATE collab_invites SET revoked = 1 WHERE session_id = ? AND token = ?")
+      .run(sessionId, token);
+  }
+
+  getDurableOverride(sessionId: string, participantKey: string): boolean | undefined {
+    const row = this.db
+      .prepare("SELECT edit_override FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?")
+      .get(sessionId, participantKey) as { edit_override: number } | undefined;
+    return row ? row.edit_override === 1 : undefined;
+  }
+
+  saveDurableOverride(sessionId: string, participantKey: string, canEdit: boolean | undefined): void {
+    if (canEdit === undefined) {
+      this.db
+        .prepare("DELETE FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?")
+        .run(sessionId, participantKey);
+    } else {
+      this.db
+        .prepare(
+          "INSERT OR REPLACE INTO collab_durable_overrides (session_id, participant_key, edit_override) VALUES (?, ?, ?)",
+        )
+        .run(sessionId, participantKey, canEdit ? 1 : 0);
+    }
+  }
+
+  isBlockedKey(sessionId: string, participantKey: string): boolean {
+    const row = this.db
+      .prepare("SELECT participant_key FROM collab_blocked_keys WHERE session_id = ? AND participant_key = ?")
+      .get(sessionId, participantKey);
+    return row !== undefined;
+  }
+
+  blockKey(sessionId: string, participantKey: string): void {
+    this.db
+      .prepare("INSERT OR REPLACE INTO collab_blocked_keys (session_id, participant_key, blocked_at) VALUES (?, ?, ?)")
+      .run(sessionId, participantKey, Date.now());
+  }
+
   delete(id: string): void {
     this.db.prepare("DELETE FROM collab_sessions WHERE id = ?").run(id);
+    this.db.prepare("DELETE FROM collab_invites WHERE session_id = ?").run(id);
+    this.db.prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?").run(id);
+    this.db.prepare("DELETE FROM collab_blocked_keys WHERE session_id = ?").run(id);
   }
 
-  /**
-   * Drop sessions untouched since `cutoff`, skipping any that are currently live
-   * in memory. Reclaims codes that were allocated by `POST /sessions` but never
-   * joined, which no socket-close path ever reaches.
-   */
   deleteStaleBefore(cutoff: number, keep: Iterable<string>): void {
     const keepSet = new Set(keep);
     const rows = this.db
       .prepare("SELECT id FROM collab_sessions WHERE updated_at < ?")
       .all(cutoff) as { id: string }[];
-    const remove = this.db.prepare("DELETE FROM collab_sessions WHERE id = ?");
-    for (const row of rows) if (!keepSet.has(row.id)) remove.run(row.id);
+    for (const row of rows) {
+      if (!keepSet.has(row.id)) {
+        this.delete(row.id);
+      }
+    }
   }
 
   close(): void {
     this.db.close();
   }
 }
+
diff --git a/workers/collab/src/index.ts b/workers/collab/src/index.ts
index f69efb3528..1504841680 100644
--- a/workers/collab/src/index.ts
+++ b/workers/collab/src/index.ts
@@ -24,6 +24,52 @@ const CORS_HEADERS: Record<string, string> = {
   "Access-Control-Max-Age": "86400",
 };
 
+const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
+
+function isAllowedOrigin(originHeader: string | null, envAllowed?: string): boolean {
+  if (!originHeader) return true;
+  const allowedList = envAllowed
+    ? envAllowed.split(",").map((s) => s.trim()).filter(Boolean)
+    : [
+        "https://geolibre.app",
+        "https://collab.geolibre.app",
+        "http://localhost",
+        "http://127.0.0.1",
+        "tauri://localhost",
+      ];
+
+  try {
+    const originUrl = new URL(originHeader);
+    const host = originUrl.hostname;
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
+    return allowedList.some((allowed) => {
+      if (allowed === "*") return true;
+      try {
+        const allowedUrl = new URL(allowed);
+        return originUrl.origin === allowedUrl.origin;
+      } catch {
+        return originHeader === allowed || host === allowed;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+
+function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
+  const now = Date.now();
+  const record = rateLimitMap.get(key);
+  if (!record || now > record.resetAt) {
+    rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
+    return true;
+  }
+  if (record.count >= maxRequests) {
+    return false;
+  }
+  record.count += 1;
+  return true;
+}
+
 function randomCode(): string {
   const bytes = new Uint8Array(CODE_LENGTH);
   crypto.getRandomValues(bytes);
@@ -57,10 +103,22 @@ export default {
 
     // Create a session.
     if (url.pathname === "/sessions" && request.method === "POST") {
+      const origin = request.headers.get("Origin") ?? request.headers.get("Referer");
+      if (!isAllowedOrigin(origin, env.ALLOWED_ORIGINS)) {
+        return json({ error: "Origin not allowed to create sessions." }, 403);
+      }
+
+      const clientKey = origin ?? request.headers.get("CF-Connecting-IP") ?? "anonymous";
+      if (!checkRateLimit(clientKey)) {
+        return json({ error: "Too many session creation requests. Please try again later." }, 429);
+      }
+
       const body = (await request.json().catch(() => ({}))) as {
         mode?: string;
+        requireIdentity?: boolean;
       };
       const mode = body.mode === "view-only" ? "view-only" : "co-edit";
+      const requireIdentity = body.requireIdentity === true;
       // Retry on the (rare) collision with an existing active session: /init
       // is a no-op when the code is already taken, so without this the caller
       // would receive a hostToken that doesn't match the stored one and be
@@ -71,13 +129,13 @@ export default {
         const stub = env.COLLAB_SESSION.get(env.COLLAB_SESSION.idFromName(sessionId));
         const initRes = await stub.fetch("https://collab/init", {
           method: "POST",
-          body: JSON.stringify({ mode, hostToken }),
+          body: JSON.stringify({ mode, hostToken, requireIdentity }),
         });
         const initBody = (await initRes.json().catch(() => ({}))) as {
           alreadyInitialized?: boolean;
         };
         if (!initBody.alreadyInitialized) {
-          return json({ sessionId, hostToken, mode });
+          return json({ sessionId, hostToken, mode, requireIdentity });
         }
       }
       return json({ error: "Could not allocate a session code. Please try again." }, 503);
@@ -100,3 +158,4 @@ export default {
     return json({ error: "Not found" }, 404);
   },
 };
+
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 9713e54e06..1679277bcc 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -1,12 +1,14 @@
 import { DurableObject } from "cloudflare:workers";
 import type {
   CollabChatMessage,
+  CollabInvite,
   CollabParticipant,
   ClientMessage,
   CollaborationMode,
   CollaborationRole,
   PresenceEntry,
   ServerMessage,
+  ParticipantIdentity,
 } from "./protocol";
 import {
   isBoundedId,
@@ -22,7 +24,9 @@ import {
   authorizeSnapshot,
   CHAT_HISTORY_LIMIT,
   clearParticipantOverrides,
+  diffLockedLayers,
   EMPTY_SESSION_TTL_MS,
+  getParticipantKey,
   MAX_CHAT_STORAGE_BYTES,
   MAX_CHAT_TEXT_LENGTH,
   MAX_SNAPSHOT_BYTES,
@@ -54,6 +58,8 @@ export interface Env {
   COLLAB_SESSION: DurableObjectNamespace<CollabSession>;
   /** Optional deployment-specific snapshot ceiling, expressed in bytes. */
   COLLAB_MAX_SNAPSHOT_BYTES?: string;
+  /** Optional allowed origins list for session creation. */
+  ALLOWED_ORIGINS?: string;
 }
 
 // The snapshot cap, empty-session TTL, and chat limits now live in
@@ -102,10 +108,110 @@ export class CollabSession extends DurableObject<Env> {
     return Number.isSafeInteger(configured) && configured > 0 ? configured : MAX_SNAPSHOT_BYTES;
   }
 
-  private ensureSnapshotTable(): void {
+  private ensureTables(): void {
     this.ctx.storage.sql.exec(
       "CREATE TABLE IF NOT EXISTS collab_snapshot_chunks (seq INTEGER PRIMARY KEY, value TEXT NOT NULL)",
     );
+    this.ctx.storage.sql.exec(
+      "CREATE TABLE IF NOT EXISTS collab_invites (token TEXT PRIMARY KEY, role TEXT NOT NULL, created_at INTEGER NOT NULL, max_uses INTEGER, use_count INTEGER NOT NULL DEFAULT 0, revoked INTEGER NOT NULL DEFAULT 0)",
+    );
+    this.ctx.storage.sql.exec(
+      "CREATE TABLE IF NOT EXISTS collab_durable_overrides (participant_key TEXT PRIMARY KEY, edit_override INTEGER NOT NULL)",
+    );
+    this.ctx.storage.sql.exec(
+      "CREATE TABLE IF NOT EXISTS collab_blocked_keys (participant_key TEXT PRIMARY KEY, blocked_at INTEGER NOT NULL)",
+    );
+  }
+
+  private readDurableOverride(participantKey: string): boolean | undefined {
+    this.ensureTables();
+    const rows = this.ctx.storage.sql
+      .exec<{ edit_override: number }>(
+        "SELECT edit_override FROM collab_durable_overrides WHERE participant_key = ?",
+        participantKey,
+      )
+      .toArray();
+    return rows.length > 0 ? rows[0].edit_override === 1 : undefined;
+  }
+
+  private writeDurableOverride(participantKey: string, editOverride: boolean | undefined): void {
+    this.ensureTables();
+    if (editOverride === undefined) {
+      this.ctx.storage.sql.exec(
+        "DELETE FROM collab_durable_overrides WHERE participant_key = ?",
+        participantKey,
+      );
+    } else {
+      this.ctx.storage.sql.exec(
+        "INSERT OR REPLACE INTO collab_durable_overrides (participant_key, edit_override) VALUES (?, ?)",
+        participantKey,
+        editOverride ? 1 : 0,
+      );
+    }
+  }
+
+  private isBlockedKey(participantKey: string): boolean {
+    this.ensureTables();
+    const rows = this.ctx.storage.sql
+      .exec<{ participant_key: string }>(
+        "SELECT participant_key FROM collab_blocked_keys WHERE participant_key = ?",
+        participantKey,
+      )
+      .toArray();
+    return rows.length > 0;
+  }
+
+  private blockKey(participantKey: string): void {
+    this.ensureTables();
+    this.ctx.storage.sql.exec(
+      "INSERT OR REPLACE INTO collab_blocked_keys (participant_key, blocked_at) VALUES (?, ?)",
+      participantKey,
+      Date.now(),
+    );
+  }
+
+  private readInvites(): CollabInvite[] {
+    this.ensureTables();
+    const rows = this.ctx.storage.sql
+      .exec<{
+        token: string;
+        role: string;
+        created_at: number;
+        max_uses: number | null;
+        use_count: number;
+        revoked: number;
+      }>("SELECT token, role, created_at, max_uses, use_count, revoked FROM collab_invites ORDER BY created_at DESC")
+      .toArray();
+    return rows.map((r) => ({
+      token: r.token,
+      role: r.role === "view-only" ? "view-only" : "co-edit",
+      createdAt: r.created_at,
+      ...(r.max_uses !== null ? { maxUses: r.max_uses } : {}),
+      useCount: r.use_count,
+      revoked: r.revoked === 1,
+    }));
+  }
+
+  private writeInvite(invite: CollabInvite): void {
+    this.ensureTables();
+    this.ctx.storage.sql.exec(
+      "INSERT OR REPLACE INTO collab_invites (token, role, created_at, max_uses, use_count, revoked) VALUES (?, ?, ?, ?, ?, ?)",
+      invite.token,
+      invite.role,
+      invite.createdAt,
+      invite.maxUses ?? null,
+      invite.useCount,
+      invite.revoked ? 1 : 0,
+    );
+  }
+
+  private revokeInviteToken(token: string): boolean {
+    this.ensureTables();
+    this.ctx.storage.sql.exec(
+      "UPDATE collab_invites SET revoked = 1 WHERE token = ?",
+      token,
+    );
+    return true;
   }
 
   /**
@@ -115,7 +221,7 @@ export class CollabSession extends DurableObject<Env> {
    * before this table existed still serves late joiners.
    */
   private readSqlSnapshot(): string | undefined {
-    this.ensureSnapshotTable();
+    this.ensureTables();
     // Not `.one()`: that throws unless the result set holds exactly one row,
     // so a session that has not stored a snapshot yet would fail instead of
     // falling through to the legacy KV read below.
@@ -141,7 +247,7 @@ export class CollabSession extends DurableObject<Env> {
    * run of rows, so the project is split and rejoined on read.
    */
   private async writeSnapshot(snapshot: string): Promise<void> {
-    this.ensureSnapshotTable();
+    this.ensureTables();
     this.ctx.storage.sql.exec("DELETE FROM collab_snapshot_chunks");
     for (
       let offset = 0, seq = 0;
@@ -175,11 +281,14 @@ export class CollabSession extends DurableObject<Env> {
       const body = (await request.json()) as {
         mode?: CollaborationMode;
         hostToken?: string;
+        requireIdentity?: boolean;
       };
       const mode: CollaborationMode = body.mode === "view-only" ? "view-only" : "co-edit";
       await this.ctx.storage.put({
         mode,
         hostToken: body.hostToken ?? "",
+        requireIdentity: body.requireIdentity === true,
+        lockedLayerIds: [] as string[],
         rev: 0,
       });
       return Response.json({ ok: true });
@@ -268,6 +377,24 @@ export class CollabSession extends DurableObject<Env> {
       case "comment-mutation":
         await this.handleCommentMutation(ws, attachment, message);
         break;
+      case "mint-invite":
+        this.handleMintInvite(ws, attachment, message);
+        break;
+      case "revoke-invite":
+        this.handleRevokeInvite(ws, attachment, message);
+        break;
+      case "set-session-config":
+        await this.handleSetSessionConfig(ws, attachment, message);
+        break;
+      case "kick-participant":
+        this.handleKickParticipant(ws, attachment, message);
+        break;
+      case "block-participant":
+        this.handleBlockParticipant(ws, attachment, message);
+        break;
+      case "set-layer-locks":
+        await this.handleSetLayerLocks(ws, attachment, message);
+        break;
     }
   }
 
@@ -315,53 +442,107 @@ export class CollabSession extends DurableObject<Env> {
     // close handler only deletes the current clientId).
     if (ws.deserializeAttachment()) return;
 
-    const [storedToken, mode, rev, snapshot, chat] = await Promise.all([
+    const [storedToken, mode, rev, snapshot, chat, requireIdentity, lockedLayerIds] = await Promise.all([
       this.ctx.storage.get<string>("hostToken"),
       this.ctx.storage.get<CollaborationMode>("mode"),
       this.ctx.storage.get<number>("rev"),
       this.readSnapshot(),
       this.ctx.storage.get<string>("chat"),
+      this.ctx.storage.get<boolean>("requireIdentity"),
+      this.ctx.storage.get<string[]>("lockedLayerIds"),
     ]);
 
-    const role: CollaborationRole =
+    let role: CollaborationRole =
       message.hostToken && storedToken && message.hostToken === storedToken ? "host" : "guest";
 
+    let inviteToken: string | undefined = undefined;
+    if (message.inviteToken && typeof message.inviteToken === "string") {
+      const invites = this.readInvites();
+      const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
+      if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
+        inviteToken = inv.token;
+        if (role !== "host") {
+          role = "guest";
+        }
+        inv.useCount += 1;
+        this.writeInvite(inv);
+      }
+    }
+
+    let identity: ParticipantIdentity | null = null;
+    if (message.identityToken && typeof message.identityToken === "string") {
+      try {
+        const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
+        if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
+          identity = {
+            provider: parsed.provider || "geolibre",
+            userId: parsed.userId,
+            username: sanitizeDisplayName(parsed.username),
+          };
+        }
+      } catch {
+        // Invalid token
+      }
+    }
+
+    if (requireIdentity && !identity && role !== "host") {
+      this.send(ws, {
+        type: "error",
+        code: "identity-required",
+        message: "Sign-in required to join this session.",
+      });
+      return;
+    }
+
+    const tempParticipant: SessionParticipant = {
+      clientId: "temp",
+      displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
+      color: sanitizeColor(message.color),
+      role,
+      identity,
+      inviteToken,
+    };
+    const participantKey = getParticipantKey(tempParticipant);
+
+    if (this.isBlockedKey(participantKey)) {
+      this.send(ws, {
+        type: "error",
+        code: "forbidden",
+        message: "You have been blocked from this session by the host.",
+      });
+      return;
+    }
+
+    const durableOverride = this.readDurableOverride(participantKey);
+
     const attachment: SocketAttachment = {
-      // Assign the id server-side instead of trusting the client's, so a
-      // participant can't claim another's clientId to hijack their presence or
-      // collide React keys. The welcome echoes it back for the client to adopt.
       clientId: crypto.randomUUID(),
-      // Guard against a non-string displayName (JSON.parse won't enforce the
-      // type) so a crafted frame can't crash the handler on `.slice`.
-      displayName: sanitizeDisplayName(message.displayName),
-      // Only accept a hex color; fall back to neutral grey so a hostile value
-      // never reaches peers (defense-in-depth with the client's DOM rendering).
-      // Guard the type first: `.test()` coerces a non-string (number/array) to a
-      // string, which could spuriously pass and store a non-string color.
+      displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
       color: sanitizeColor(message.color),
       role,
+      ...(durableOverride !== undefined ? { editOverride: durableOverride } : {}),
+      identity,
+      inviteToken,
     };
     ws.serializeAttachment(attachment);
 
+    const welcomeInvites = role === "host" ? this.readInvites() : undefined;
+
     this.send(ws, {
       type: "welcome",
       clientId: attachment.clientId,
       role,
       mode: mode ?? "co-edit",
       participants: this.participants(),
-      // A corrupt stored snapshot (partial write/storage error) must not throw
-      // here — that would close the socket 1011 and every reconnect would hit
-      // the same poison value, locking the whole session out. Fall back to null.
       snapshot: parseStoredSnapshot(snapshot),
-      // Bootstrap the joiner with existing participants' live cursors/viewports.
       presence: Object.fromEntries(this.presence),
-      // Bootstrap the joiner with the recent chat history.
       chat: parseStoredChat(chat),
       rev: rev ?? 0,
+      requireIdentity: requireIdentity ?? false,
+      lockedLayerIds: lockedLayerIds ?? [],
+      ...(welcomeInvites ? { invites: welcomeInvites } : {}),
     });
 
-    // The joiner already has the up-to-date list from `welcome` above; only the
-    // other participants need the update.
     this.broadcastParticipants(ws);
   }
 
@@ -371,11 +552,22 @@ export class CollabSession extends DurableObject<Env> {
     message: Extract<ClientMessage, { type: "snapshot" }>,
     byteLength: number,
   ): Promise<void> {
-    const mode = (await this.ctx.storage.get<CollaborationMode>("mode")) ?? "co-edit";
-    // A host-set per-participant override takes precedence over the session
-    // default, so a single guest can be pinned to view-only (or granted edit) in
-    // an otherwise co-edit (or view-only) session (#754, Part 3).
-    const decision = authorizeSnapshot(attachment, mode, byteLength, this.maxSnapshotBytes());
+    const [mode, lockedLayerIds, storedRaw] = await Promise.all([
+      (await this.ctx.storage.get<CollaborationMode>("mode")) ?? "co-edit",
+      (await this.ctx.storage.get<string[]>("lockedLayerIds")) ?? [],
+      this.readSnapshot(),
+    ]);
+    const storedSnapshot = parseStoredSnapshot(storedRaw);
+
+    const decision = authorizeSnapshot(
+      attachment,
+      mode,
+      byteLength,
+      this.maxSnapshotBytes(),
+      storedSnapshot,
+      message.project,
+      lockedLayerIds,
+    );
     if (!decision.ok) {
       this.send(ws, {
         type: "error",
@@ -853,4 +1045,145 @@ export class CollabSession extends DurableObject<Env> {
 
     this.broadcast(sanitizedMessage, ws);
   }
+
+  private handleMintInvite(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "mint-invite" }>,
+  ): void {
+    const forbidden = authorizeHostAction(attachment, "session invites");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    const role: CollaborationMode = message.role === "view-only" ? "view-only" : "co-edit";
+    const token = crypto.randomUUID().slice(0, 16);
+    const invite: CollabInvite = {
+      token,
+      role,
+      createdAt: Date.now(),
+      ...(message.maxUses ? { maxUses: message.maxUses } : {}),
+      useCount: 0,
+      revoked: false,
+    };
+    this.writeInvite(invite);
+    this.send(ws, { type: "invite-created", invite });
+  }
+
+  private handleRevokeInvite(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "revoke-invite" }>,
+  ): void {
+    const forbidden = authorizeHostAction(attachment, "session invites");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    if (typeof message.token === "string") {
+      this.revokeInviteToken(message.token);
+      this.broadcastHostOnly({ type: "invite-revoked", token: message.token });
+    }
+  }
+
+  private async handleSetSessionConfig(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "set-session-config" }>,
+  ): Promise<void> {
+    const forbidden = authorizeHostAction(attachment, "session settings");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    if (message.requireIdentity !== undefined) {
+      const req = message.requireIdentity === true;
+      await this.ctx.storage.put("requireIdentity", req);
+      this.broadcast({ type: "session-config", requireIdentity: req });
+    }
+  }
+
+  private async handleSetLayerLocks(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "set-layer-locks" }>,
+  ): Promise<void> {
+    const forbidden = authorizeHostAction(attachment, "layer locks");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    const lockedLayerIds = Array.isArray(message.lockedLayerIds)
+      ? message.lockedLayerIds.filter((id: unknown): id is string => typeof id === "string")
+      : [];
+    await this.ctx.storage.put("lockedLayerIds", lockedLayerIds);
+    this.broadcast({ type: "layer-locks", lockedLayerIds });
+  }
+
+  private handleKickParticipant(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "kick-participant" }>,
+  ): void {
+    const forbidden = authorizeHostAction(attachment, "participant moderation");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    if (typeof message.clientId !== "string") return;
+    const target = this.attachedSockets().find((entry) => entry.attachment.clientId === message.clientId);
+    if (!target || target.attachment.role === "host") return;
+
+    this.send(target.socket, {
+      type: "kicked",
+      reason: message.reason ?? "Kicked by session host.",
+    });
+    try {
+      target.socket.close(4000, "Kicked by host");
+    } catch {
+      // Already closing
+    }
+  }
+
+  private handleBlockParticipant(
+    ws: WebSocket,
+    attachment: SocketAttachment,
+    message: Extract<ClientMessage, { type: "block-participant" }>,
+  ): void {
+    const forbidden = authorizeHostAction(attachment, "participant moderation");
+    if (forbidden) {
+      this.send(ws, { type: "error", code: "forbidden", message: forbidden });
+      return;
+    }
+    if (typeof message.clientId !== "string") return;
+    const target = this.attachedSockets().find((entry) => entry.attachment.clientId === message.clientId);
+    if (!target || target.attachment.role === "host") return;
+
+    const targetKey = getParticipantKey(target.attachment);
+    this.blockKey(targetKey);
+
+    this.send(target.socket, {
+      type: "kicked",
+      reason: message.reason ?? "Blocked by session host.",
+    });
+    try {
+      target.socket.close(4001, "Blocked by host");
+    } catch {
+      // Already closing
+    }
+  }
+
+  private broadcastHostOnly(message: ServerMessage): void {
+    const payload = JSON.stringify(message);
+    for (const socket of this.ctx.getWebSockets()) {
+      const a = socket.deserializeAttachment() as SocketAttachment | null;
+      if (a?.role === "host") {
+        try {
+          socket.send(payload);
+        } catch {
+          // ignore
+        }
+      }
+    }
+  }
 }

From acf9808c7d8e4f6786e44b60d8d00ad76e9c04a4 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 17:38:30 +0000
Subject: [PATCH 02/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 .../src/hooks/useCollaboration.ts             |  4 +-
 .../geolibre-desktop/src/lib/collab-client.ts |  2 +-
 .../src/lib/collab-protocol.ts                |  9 +++-
 packages/collab-core/src/protocol.ts          |  9 +++-
 packages/collab-core/src/session.ts           | 12 ++++--
 tests/collab-upgrade.test.ts                  | 42 ++++++++++++++++---
 workers/collab-node/src/server.ts             | 10 ++++-
 workers/collab-node/src/store.ts              | 23 +++++++---
 workers/collab/src/index.ts                   |  6 ++-
 workers/collab/src/session.ts                 | 36 +++++++++-------
 10 files changed, 111 insertions(+), 42 deletions(-)

diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index c04f57d7cb..3cd5d0e1d3 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -255,7 +255,9 @@ export function useCollaboration(
       case "kicked": {
         disconnect();
         useAppStore.getState().resetCollaboration();
-        useAppStore.getState().setCollaboration({ error: message.reason ?? "Removed from session." });
+        useAppStore
+          .getState()
+          .setCollaboration({ error: message.reason ?? "Removed from session." });
         break;
       }
       case "error":
diff --git a/apps/geolibre-desktop/src/lib/collab-client.ts b/apps/geolibre-desktop/src/lib/collab-client.ts
index 3ac00c5e0d..3906211322 100644
--- a/apps/geolibre-desktop/src/lib/collab-client.ts
+++ b/apps/geolibre-desktop/src/lib/collab-client.ts
@@ -92,7 +92,7 @@ export async function createSession(
   if (!baseUrl) {
     throw new Error("Collaboration is not configured. Set VITE_GEOLIBRE_COLLAB_URL.");
   }
-  const mode = typeof options === "string" ? options : options.mode ?? "co-edit";
+  const mode = typeof options === "string" ? options : (options.mode ?? "co-edit");
   const requireIdentity = typeof options === "object" ? options.requireIdentity === true : false;
   const httpBase = httpBaseFromWs(baseUrl);
   let response: Response;
diff --git a/apps/geolibre-desktop/src/lib/collab-protocol.ts b/apps/geolibre-desktop/src/lib/collab-protocol.ts
index 230cafef4a..43a620cd9a 100644
--- a/apps/geolibre-desktop/src/lib/collab-protocol.ts
+++ b/apps/geolibre-desktop/src/lib/collab-protocol.ts
@@ -243,7 +243,13 @@ export interface KickedMessage {
 
 export interface ErrorMessage {
   type: "error";
-  code: "forbidden" | "too-large" | "bad-message" | "not-found" | "identity-required" | "layer-locked";
+  code:
+    | "forbidden"
+    | "too-large"
+    | "bad-message"
+    | "not-found"
+    | "identity-required"
+    | "layer-locked";
   message: string;
 }
 
@@ -261,4 +267,3 @@ export type ServerMessage =
   | LayerLocksMessage
   | KickedMessage
   | ErrorMessage;
-
diff --git a/packages/collab-core/src/protocol.ts b/packages/collab-core/src/protocol.ts
index 2df03c6909..2060b9e12a 100644
--- a/packages/collab-core/src/protocol.ts
+++ b/packages/collab-core/src/protocol.ts
@@ -260,7 +260,13 @@ export interface KickedMessage {
 
 export interface ErrorMessage {
   type: "error";
-  code: "forbidden" | "too-large" | "bad-message" | "not-found" | "identity-required" | "layer-locked";
+  code:
+    | "forbidden"
+    | "too-large"
+    | "bad-message"
+    | "not-found"
+    | "identity-required"
+    | "layer-locked";
   message: string;
 }
 
@@ -278,4 +284,3 @@ export type ServerMessage =
   | LayerLocksMessage
   | KickedMessage
   | ErrorMessage;
-
diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index 901b64f60a..aee31786ee 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -80,10 +80,10 @@ export function diffLockedLayers(
   if (typeof storedProject !== "object" || typeof inboundProject !== "object") return null;
 
   const storedLayers = Array.isArray((storedProject as { layers?: unknown }).layers)
-    ? ((storedProject as { layers: Record<string, unknown>[] }).layers)
+    ? (storedProject as { layers: Record<string, unknown>[] }).layers
     : [];
   const inboundLayers = Array.isArray((inboundProject as { layers?: unknown }).layers)
-    ? ((inboundProject as { layers: Record<string, unknown>[] }).layers)
+    ? (inboundProject as { layers: Record<string, unknown>[] }).layers
     : [];
 
   const storedMap = new Map<string, Record<string, unknown>>();
@@ -140,7 +140,12 @@ export function authorizeSnapshot(
           : "This session is view-only.",
     };
   }
-  if (participant.role !== "host" && lockedLayerIds.length > 0 && storedSnapshot && inboundSnapshot) {
+  if (
+    participant.role !== "host" &&
+    lockedLayerIds.length > 0 &&
+    storedSnapshot &&
+    inboundSnapshot
+  ) {
     const diff = diffLockedLayers(storedSnapshot, inboundSnapshot, lockedLayerIds);
     if (diff) {
       return {
@@ -282,4 +287,3 @@ export function parseStoredChat(raw: unknown): CollabChatMessage[] {
   }
   return Array.isArray(raw) ? raw.filter(isValidChatMessage) : [];
 }
-
diff --git a/tests/collab-upgrade.test.ts b/tests/collab-upgrade.test.ts
index 33f0528ca9..fcd2fa7d6e 100644
--- a/tests/collab-upgrade.test.ts
+++ b/tests/collab-upgrade.test.ts
@@ -66,8 +66,18 @@ describe("Collaboration Upgrade Proposals", () => {
   });
 
   it("evaluates layer edit permissions with participantCanEditLayer", () => {
-    const host: SessionParticipant = { clientId: "h", displayName: "Host", color: "#000", role: "host" };
-    const guest: SessionParticipant = { clientId: "g", displayName: "Guest", color: "#000", role: "guest" };
+    const host: SessionParticipant = {
+      clientId: "h",
+      displayName: "Host",
+      color: "#000",
+      role: "host",
+    };
+    const guest: SessionParticipant = {
+      clientId: "g",
+      displayName: "Guest",
+      color: "#000",
+      role: "guest",
+    };
 
     const lockedLayerIds = ["layer-locked"];
 
@@ -80,7 +90,12 @@ describe("Collaboration Upgrade Proposals", () => {
   });
 
   it("authorizes snapshot rejecting layer-locked edits from guests", () => {
-    const guest: SessionParticipant = { clientId: "g", displayName: "Guest", color: "#000", role: "guest" };
+    const guest: SessionParticipant = {
+      clientId: "g",
+      displayName: "Guest",
+      color: "#000",
+      role: "guest",
+    };
     const stored = { layers: [{ id: "l1", name: "Old" }] };
     const inbound = { layers: [{ id: "l1", name: "New" }] };
 
@@ -112,7 +127,14 @@ describe("Collaboration Upgrade Proposals", () => {
     let hostWelcome: any = null;
     await new Promise<void>((res) => {
       hostWs.on("open", () => {
-        hostWs.send(JSON.stringify({ type: "join", displayName: "HostUser", color: "#2563eb", hostToken: sessionInfo.hostToken }));
+        hostWs.send(
+          JSON.stringify({
+            type: "join",
+            displayName: "HostUser",
+            color: "#2563eb",
+            hostToken: sessionInfo.hostToken,
+          }),
+        );
       });
       hostWs.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
@@ -143,7 +165,9 @@ describe("Collaboration Upgrade Proposals", () => {
     let guestWelcome: any = null;
     await new Promise<void>((res) => {
       guestWs.on("open", () => {
-        guestWs.send(JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }));
+        guestWs.send(
+          JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }),
+        );
       });
       guestWs.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
@@ -167,7 +191,13 @@ describe("Collaboration Upgrade Proposals", () => {
       guestWs.on("close", () => {
         res();
       });
-      hostWs.send(JSON.stringify({ type: "kick-participant", clientId: guestWelcome.clientId, reason: "Testing kick" }));
+      hostWs.send(
+        JSON.stringify({
+          type: "kick-participant",
+          clientId: guestWelcome.clientId,
+          reason: "Testing kick",
+        }),
+      );
     });
     assert.equal(guestKicked, true);
 
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 169f265b40..293d8b0c6d 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -50,10 +50,16 @@ const ENCODER = new TextEncoder();
 
 const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
 
-function isAllowedOrigin(originHeader: string | undefined, envAllowed = process.env.ALLOWED_ORIGINS): boolean {
+function isAllowedOrigin(
+  originHeader: string | undefined,
+  envAllowed = process.env.ALLOWED_ORIGINS,
+): boolean {
   if (!originHeader) return true;
   const allowedList = envAllowed
-    ? envAllowed.split(",").map((s) => s.trim()).filter(Boolean)
+    ? envAllowed
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
     : [
         "https://geolibre.app",
         "https://collab.geolibre.app",
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 02f1bf4fb1..e7d26ef1e4 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -197,15 +197,23 @@ export class SessionStore {
 
   getDurableOverride(sessionId: string, participantKey: string): boolean | undefined {
     const row = this.db
-      .prepare("SELECT edit_override FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?")
+      .prepare(
+        "SELECT edit_override FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?",
+      )
       .get(sessionId, participantKey) as { edit_override: number } | undefined;
     return row ? row.edit_override === 1 : undefined;
   }
 
-  saveDurableOverride(sessionId: string, participantKey: string, canEdit: boolean | undefined): void {
+  saveDurableOverride(
+    sessionId: string,
+    participantKey: string,
+    canEdit: boolean | undefined,
+  ): void {
     if (canEdit === undefined) {
       this.db
-        .prepare("DELETE FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?")
+        .prepare(
+          "DELETE FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?",
+        )
         .run(sessionId, participantKey);
     } else {
       this.db
@@ -218,14 +226,18 @@ export class SessionStore {
 
   isBlockedKey(sessionId: string, participantKey: string): boolean {
     const row = this.db
-      .prepare("SELECT participant_key FROM collab_blocked_keys WHERE session_id = ? AND participant_key = ?")
+      .prepare(
+        "SELECT participant_key FROM collab_blocked_keys WHERE session_id = ? AND participant_key = ?",
+      )
       .get(sessionId, participantKey);
     return row !== undefined;
   }
 
   blockKey(sessionId: string, participantKey: string): void {
     this.db
-      .prepare("INSERT OR REPLACE INTO collab_blocked_keys (session_id, participant_key, blocked_at) VALUES (?, ?, ?)")
+      .prepare(
+        "INSERT OR REPLACE INTO collab_blocked_keys (session_id, participant_key, blocked_at) VALUES (?, ?, ?)",
+      )
       .run(sessionId, participantKey, Date.now());
   }
 
@@ -252,4 +264,3 @@ export class SessionStore {
     this.db.close();
   }
 }
-
diff --git a/workers/collab/src/index.ts b/workers/collab/src/index.ts
index 1504841680..45b5b49a5b 100644
--- a/workers/collab/src/index.ts
+++ b/workers/collab/src/index.ts
@@ -29,7 +29,10 @@ const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
 function isAllowedOrigin(originHeader: string | null, envAllowed?: string): boolean {
   if (!originHeader) return true;
   const allowedList = envAllowed
-    ? envAllowed.split(",").map((s) => s.trim()).filter(Boolean)
+    ? envAllowed
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
     : [
         "https://geolibre.app",
         "https://collab.geolibre.app",
@@ -158,4 +161,3 @@ export default {
     return json({ error: "Not found" }, 404);
   },
 };
-
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 1679277bcc..18aa606334 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -180,7 +180,9 @@ export class CollabSession extends DurableObject<Env> {
         max_uses: number | null;
         use_count: number;
         revoked: number;
-      }>("SELECT token, role, created_at, max_uses, use_count, revoked FROM collab_invites ORDER BY created_at DESC")
+      }>(
+        "SELECT token, role, created_at, max_uses, use_count, revoked FROM collab_invites ORDER BY created_at DESC",
+      )
       .toArray();
     return rows.map((r) => ({
       token: r.token,
@@ -207,10 +209,7 @@ export class CollabSession extends DurableObject<Env> {
 
   private revokeInviteToken(token: string): boolean {
     this.ensureTables();
-    this.ctx.storage.sql.exec(
-      "UPDATE collab_invites SET revoked = 1 WHERE token = ?",
-      token,
-    );
+    this.ctx.storage.sql.exec("UPDATE collab_invites SET revoked = 1 WHERE token = ?", token);
     return true;
   }
 
@@ -442,15 +441,16 @@ export class CollabSession extends DurableObject<Env> {
     // close handler only deletes the current clientId).
     if (ws.deserializeAttachment()) return;
 
-    const [storedToken, mode, rev, snapshot, chat, requireIdentity, lockedLayerIds] = await Promise.all([
-      this.ctx.storage.get<string>("hostToken"),
-      this.ctx.storage.get<CollaborationMode>("mode"),
-      this.ctx.storage.get<number>("rev"),
-      this.readSnapshot(),
-      this.ctx.storage.get<string>("chat"),
-      this.ctx.storage.get<boolean>("requireIdentity"),
-      this.ctx.storage.get<string[]>("lockedLayerIds"),
-    ]);
+    const [storedToken, mode, rev, snapshot, chat, requireIdentity, lockedLayerIds] =
+      await Promise.all([
+        this.ctx.storage.get<string>("hostToken"),
+        this.ctx.storage.get<CollaborationMode>("mode"),
+        this.ctx.storage.get<number>("rev"),
+        this.readSnapshot(),
+        this.ctx.storage.get<string>("chat"),
+        this.ctx.storage.get<boolean>("requireIdentity"),
+        this.ctx.storage.get<string[]>("lockedLayerIds"),
+      ]);
 
     let role: CollaborationRole =
       message.hostToken && storedToken && message.hostToken === storedToken ? "host" : "guest";
@@ -1131,7 +1131,9 @@ export class CollabSession extends DurableObject<Env> {
       return;
     }
     if (typeof message.clientId !== "string") return;
-    const target = this.attachedSockets().find((entry) => entry.attachment.clientId === message.clientId);
+    const target = this.attachedSockets().find(
+      (entry) => entry.attachment.clientId === message.clientId,
+    );
     if (!target || target.attachment.role === "host") return;
 
     this.send(target.socket, {
@@ -1156,7 +1158,9 @@ export class CollabSession extends DurableObject<Env> {
       return;
     }
     if (typeof message.clientId !== "string") return;
-    const target = this.attachedSockets().find((entry) => entry.attachment.clientId === message.clientId);
+    const target = this.attachedSockets().find(
+      (entry) => entry.attachment.clientId === message.clientId,
+    );
     if (!target || target.attachment.role === "host") return;
 
     const targetKey = getParticipantKey(target.attachment);

From ae9217f2d807f2250addb82060ae9c6f0791591d Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Tue, 11 Aug 2026 23:35:08 +0530
Subject: [PATCH 03/15] fix: address review fixes

---
 .../components/layout/CollaborateDialog.tsx   |  4 +-
 .../layout/CollaborationParticipantRow.tsx    |  6 +-
 .../src/hooks/useCollaboration.ts             | 11 ++-
 packages/collab-core/src/protocol.ts          |  2 -
 packages/collab-core/src/session.ts           | 74 ++++++++++----
 packages/core/src/types.ts                    |  2 -
 tests/collab-upgrade.test.ts                  | 64 +++++++-----
 workers/collab-node/src/server.ts             | 44 ++++++---
 workers/collab-node/src/store.ts              | 97 +++++++++++++------
 workers/collab/src/session.ts                 | 37 ++++---
 10 files changed, 237 insertions(+), 104 deletions(-)

diff --git a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
index fefeb8df32..c877b43508 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
@@ -287,7 +287,7 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
                       disabled={busy}
                       className="h-3.5 w-3.5 rounded border"
                     />
-                    Require signed-in account to join
+                    {(t as (key: string) => string)("collaborate.requireIdentityLabel")}
                   </label>
                   <Button
                     type="button"
@@ -404,7 +404,7 @@ function ActiveSession({
             onChange={(e) => onSetSessionConfig?.({ requireIdentity: e.target.checked })}
             className="h-3.5 w-3.5 rounded border"
           />
-          Require signed-in account to join
+          {(t as (key: string) => string)("collaborate.requireIdentityLabel")}
         </label>
       )}
 
diff --git a/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx b/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
index 6dd6fcf769..2615bd9905 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborationParticipantRow.tsx
@@ -89,9 +89,10 @@ export function CollaborationParticipantRow({
                     type="button"
                     onClick={() => onKickParticipant(p.clientId)}
                     title={(t as (key: string) => string)("collaborate.kick")}
+                    aria-label={(t as (key: string) => string)("collaborate.kick")}
                     className="rounded p-1 text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
                   >
-                    <UserX className="h-3 w-3" />
+                    <UserX className="h-3 w-3" aria-hidden="true" />
                   </button>
                 )}
                 {onBlockParticipant && (
@@ -99,9 +100,10 @@ export function CollaborationParticipantRow({
                     type="button"
                     onClick={() => onBlockParticipant(p.clientId)}
                     title={(t as (key: string) => string)("collaborate.block")}
+                    aria-label={(t as (key: string) => string)("collaborate.block")}
                     className="rounded p-1 text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
                   >
-                    <Ban className="h-3 w-3" />
+                    <Ban className="h-3 w-3" aria-hidden="true" />
                   </button>
                 )}
               </>
diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index 3cd5d0e1d3..210281de05 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -260,10 +260,19 @@ export function useCollaboration(
           .setCollaboration({ error: message.reason ?? "Removed from session." });
         break;
       }
-      case "error":
+      case "error": {
+        if (pendingConnectRef.current) {
+          const pending = pendingConnectRef.current;
+          pendingConnectRef.current = null;
+          disconnect();
+          store.setCollaboration({ connecting: false, error: message.message });
+          pending.reject(new Error(message.message));
+          return;
+        }
         store.setCollaboration({ error: message.message });
         if (message.code === "too-large") syncPausedRef.current = true;
         break;
+      }
     }
   };
 
diff --git a/packages/collab-core/src/protocol.ts b/packages/collab-core/src/protocol.ts
index 2060b9e12a..0f567bd9b3 100644
--- a/packages/collab-core/src/protocol.ts
+++ b/packages/collab-core/src/protocol.ts
@@ -40,8 +40,6 @@ export interface CollabParticipant {
   editOverride: boolean | null;
   /** Optional account identity when signed-in identity binding is enabled. */
   identity?: ParticipantIdentity | null;
-  /** Optional invite token used to join the session. */
-  inviteToken?: string | null;
 }
 
 export interface CollabCursor {
diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index aee31786ee..fcacbced98 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -71,6 +71,34 @@ export function getParticipantKey(
   return `anon:${participant.clientId}`;
 }
 
+function isStructurallyEqual(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!isStructurallyEqual(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  const keysA = Object.keys(a as object);
+  const keysB = Object.keys(b as object);
+  if (keysA.length !== keysB.length) return false;
+  for (const k of keysA) {
+    if (!Object.prototype.hasOwnProperty.call(b, k)) return false;
+    if (
+      !isStructurallyEqual(
+        (a as Record<string, unknown>)[k],
+        (b as Record<string, unknown>)[k],
+      )
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
 export function diffLockedLayers(
   storedProject: unknown,
   inboundProject: unknown,
@@ -108,7 +136,7 @@ export function diffLockedLayers(
     if (!inbound) {
       return { lockedId, layerName };
     }
-    if (JSON.stringify(stored) !== JSON.stringify(inbound)) {
+    if (!isStructurallyEqual(stored, inbound)) {
       return { lockedId, layerName };
     }
   }
@@ -140,6 +168,13 @@ export function authorizeSnapshot(
           : "This session is view-only.",
     };
   }
+  if (byteLength > maxBytes) {
+    return {
+      ok: false,
+      code: "too-large",
+      message: `Snapshot byte length (${byteLength}) exceeds maximum allowed (${maxBytes}).`,
+    };
+  }
   if (
     participant.role !== "host" &&
     lockedLayerIds.length > 0 &&
@@ -155,13 +190,6 @@ export function authorizeSnapshot(
       };
     }
   }
-  if (byteLength > maxBytes) {
-    return {
-      ok: false,
-      code: "too-large",
-      message: "Project is too large to sync live. Share it via URL instead.",
-    };
-  }
   return { ok: true };
 }
 
@@ -177,15 +205,28 @@ export function normalizeMode(mode: unknown): CollaborationMode {
 }
 
 export function setParticipantOverride(
-  actor: Pick<SessionParticipant, "role">,
-  participants: SessionParticipant[],
-  clientId: unknown,
-  canEdit: unknown,
+  actorOrParticipants: Pick<SessionParticipant, "role"> | SessionParticipant[],
+  participantsOrClientId: SessionParticipant[] | string | unknown,
+  clientIdOrCanEdit?: unknown,
+  canEditVal?: unknown,
 ): boolean {
-  if (actor.role !== "host" || typeof clientId !== "string") return false;
-  const target = participants.find((participant) => participant.clientId === clientId);
+  if (Array.isArray(actorOrParticipants)) {
+    const target = actorOrParticipants.find((p) => p.clientId === participantsOrClientId);
+    if (!target || target.role === "host") return false;
+    target.editOverride = clientIdOrCanEdit === true;
+    return true;
+  }
+  const actor = actorOrParticipants as Pick<SessionParticipant, "role">;
+  if (
+    actor.role !== "host" ||
+    !Array.isArray(participantsOrClientId) ||
+    typeof clientIdOrCanEdit !== "string"
+  ) {
+    return false;
+  }
+  const target = participantsOrClientId.find((p) => p.clientId === clientIdOrCanEdit);
   if (!target || target.role === "host") return false;
-  target.editOverride = canEdit === true;
+  target.editOverride = canEditVal === true;
   return true;
 }
 
@@ -207,8 +248,7 @@ export function toWireParticipant(participant: SessionParticipant): CollabPartic
     color: participant.color,
     role: participant.role,
     editOverride: participant.role === "host" ? null : (participant.editOverride ?? null),
-    identity: participant.identity ?? null,
-    inviteToken: participant.inviteToken ?? null,
+    identity: participant.identity ? { provider: participant.identity.provider, userId: participant.identity.userId, username: participant.identity.username } : null,
   };
 }
 
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index 30b4ec2907..b701becadd 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -1127,8 +1127,6 @@ export interface CollaborationParticipant {
   editOverride: boolean | null;
   /** Optional account identity when signed-in identity binding is enabled. */
   identity?: ParticipantIdentity | null;
-  /** Optional invite token used to join the session. */
-  inviteToken?: string | null;
 }
 
 /** A remote participant's live cursor + viewport, used to render presence. */
diff --git a/tests/collab-upgrade.test.ts b/tests/collab-upgrade.test.ts
index fcd2fa7d6e..32ec4f2976 100644
--- a/tests/collab-upgrade.test.ts
+++ b/tests/collab-upgrade.test.ts
@@ -106,8 +106,17 @@ describe("Collaboration Upgrade Proposals", () => {
     }
   });
 
-  it("executes relay end-to-end flow for invites, moderation, and config", async () => {
+  it("executes relay end-to-end flow for invites, moderation, and config", async (t) => {
     const relay = createRelay({ port: 0, dbPath: ":memory:" });
+    let hostWs: WebSocket | null = null;
+    let guestWs: WebSocket | null = null;
+
+    t.after(async () => {
+      hostWs?.close();
+      guestWs?.close();
+      await relay.close();
+    });
+
     await new Promise<void>((res) => relay.server.listen(0, "127.0.0.1", () => res()));
     const address = relay.server.address() as { port: number };
     const baseUrl = `http://127.0.0.1:${address.port}`;
@@ -123,11 +132,12 @@ describe("Collaboration Upgrade Proposals", () => {
     const sessionInfo = (await res.json()) as { sessionId: string; hostToken: string };
 
     // Host connects
-    const hostWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
+    hostWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
     let hostWelcome: any = null;
-    await new Promise<void>((res) => {
-      hostWs.on("open", () => {
-        hostWs.send(
+    await new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("Host connect timeout")), 5000);
+      hostWs!.on("open", () => {
+        hostWs!.send(
           JSON.stringify({
             type: "join",
             displayName: "HostUser",
@@ -136,11 +146,12 @@ describe("Collaboration Upgrade Proposals", () => {
           }),
         );
       });
-      hostWs.on("message", (raw) => {
+      hostWs!.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "welcome") {
           hostWelcome = msg;
-          res();
+          clearTimeout(timer);
+          resolve();
         }
       });
     });
@@ -148,32 +159,36 @@ describe("Collaboration Upgrade Proposals", () => {
 
     // Mint invite token
     let inviteToken = "";
-    await new Promise<void>((res) => {
-      hostWs.on("message", (raw) => {
+    await new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("Mint invite timeout")), 5000);
+      hostWs!.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "invite-created") {
           inviteToken = msg.invite.token;
-          res();
+          clearTimeout(timer);
+          resolve();
         }
       });
-      hostWs.send(JSON.stringify({ type: "mint-invite", role: "view-only", maxUses: 1 }));
+      hostWs!.send(JSON.stringify({ type: "mint-invite", role: "view-only", maxUses: 1 }));
     });
     assert.ok(inviteToken);
 
     // Guest joins using invite token
-    const guestWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
+    guestWs = new WebSocket(`${wsBaseUrl}/sessions/${sessionInfo.sessionId}/ws`);
     let guestWelcome: any = null;
-    await new Promise<void>((res) => {
-      guestWs.on("open", () => {
-        guestWs.send(
+    await new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("Guest join timeout")), 5000);
+      guestWs!.on("open", () => {
+        guestWs!.send(
           JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }),
         );
       });
-      guestWs.on("message", (raw) => {
+      guestWs!.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "welcome") {
           guestWelcome = msg;
-          res();
+          clearTimeout(timer);
+          resolve();
         }
       });
     });
@@ -181,17 +196,19 @@ describe("Collaboration Upgrade Proposals", () => {
 
     // Host kicks guest
     let guestKicked = false;
-    await new Promise<void>((res) => {
-      guestWs.on("message", (raw) => {
+    await new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("Kick guest timeout")), 5000);
+      guestWs!.on("message", (raw) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "kicked") {
           guestKicked = true;
         }
       });
-      guestWs.on("close", () => {
-        res();
+      guestWs!.on("close", () => {
+        clearTimeout(timer);
+        resolve();
       });
-      hostWs.send(
+      hostWs!.send(
         JSON.stringify({
           type: "kick-participant",
           clientId: guestWelcome.clientId,
@@ -200,8 +217,5 @@ describe("Collaboration Upgrade Proposals", () => {
       );
     });
     assert.equal(guestKicked, true);
-
-    hostWs.close();
-    await relay.close();
   });
 });
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 293d8b0c6d..d58bad6440 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -88,6 +88,11 @@ function isAllowedOrigin(
 
 function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
   const now = Date.now();
+  if (rateLimitMap.size > 5000) {
+    for (const [k, rec] of rateLimitMap.entries()) {
+      if (now > rec.resetAt) rateLimitMap.delete(k);
+    }
+  }
   const record = rateLimitMap.get(key);
   if (!record || now > record.resetAt) {
     rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
@@ -307,15 +312,16 @@ export function createRelay(options: RelayOptions = {}): {
         return;
       }
 
-      const tempParticipant: SessionParticipant = {
-        clientId: "temp",
+      const socketClientId = randomUUID();
+      const joiningParticipant: SessionParticipant = {
+        clientId: socketClientId,
         displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
         color: sanitizeColor(message.color),
         role: role as CollaborationRole,
         identity,
         inviteToken,
       };
-      const participantKey = getParticipantKey(tempParticipant);
+      const participantKey = getParticipantKey(joiningParticipant);
 
       if (store.isBlockedKey(id, participantKey)) {
         send(peer, {
@@ -327,13 +333,22 @@ export function createRelay(options: RelayOptions = {}): {
       }
 
       const durableOverride = store.getDurableOverride(id, participantKey);
+      let initialOverride: boolean | undefined = undefined;
+      if (durableOverride !== undefined) {
+        initialOverride = durableOverride;
+      } else if (inviteToken) {
+        const inv = store.getInvites(id).find((i) => i.token === inviteToken && !i.revoked);
+        if (inv) {
+          initialOverride = inv.role === "co-edit";
+        }
+      }
 
       peer.participant = {
-        clientId: randomUUID(),
+        clientId: socketClientId,
         displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
         color: sanitizeColor(message.color),
         role: role as CollaborationRole,
-        ...(durableOverride !== undefined ? { editOverride: durableOverride } : {}),
+        ...(initialOverride !== undefined ? { editOverride: initialOverride } : {}),
         identity,
         inviteToken,
       };
@@ -387,8 +402,10 @@ export function createRelay(options: RelayOptions = {}): {
         return;
       }
       const project = preserveStoredComments(message.project ?? null, persisted.snapshot);
-      const rev = store.saveSnapshot(id, project);
-      broadcast(session, { type: "snapshot", project, origin: participant.clientId, rev }, peer);
+      const nextRev = (persisted.rev ?? 0) + 1;
+      store.saveSnapshot(id, project, nextRev);
+      persisted.rev = nextRev;
+      broadcast(session, { type: "snapshot", project, origin: participant.clientId, rev: nextRev }, peer);
       return;
     }
 
@@ -442,17 +459,22 @@ export function createRelay(options: RelayOptions = {}): {
         return;
       }
       const role: CollaborationMode = message.role === "view-only" ? "view-only" : "co-edit";
-      const token = randomUUID().slice(0, 16);
+      const token = randomUUID();
+      const maxUses = Number.isSafeInteger(message.maxUses) && (message.maxUses as number) > 0 ? (message.maxUses as number) : undefined;
       const invite: CollabInvite = {
         token,
         role,
         createdAt: Date.now(),
-        ...(message.maxUses ? { maxUses: message.maxUses } : {}),
+        ...(maxUses !== undefined ? { maxUses } : {}),
         useCount: 0,
         revoked: false,
       };
-      store.createInvite(id, invite);
-      send(peer, { type: "invite-created", invite });
+      store.saveInvite(id, invite);
+      for (const p of session.peers) {
+        if (p.participant?.role === "host") {
+          send(p, { type: "invite-created", invite });
+        }
+      }
       return;
     }
 
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index e7d26ef1e4..043406c7bf 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -58,13 +58,15 @@ export class SessionStore {
       );
       CREATE TABLE IF NOT EXISTS collab_invites (
         session_id TEXT NOT NULL,
-        token TEXT PRIMARY KEY,
+        token TEXT NOT NULL,
         role TEXT NOT NULL,
         created_at INTEGER NOT NULL,
         max_uses INTEGER,
         use_count INTEGER NOT NULL DEFAULT 0,
-        revoked INTEGER NOT NULL DEFAULT 0
+        revoked INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (session_id, token)
       );
+      CREATE INDEX IF NOT EXISTS idx_collab_invites_session_id ON collab_invites(session_id);
       CREATE TABLE IF NOT EXISTS collab_durable_overrides (
         session_id TEXT NOT NULL,
         participant_key TEXT NOT NULL,
@@ -78,6 +80,18 @@ export class SessionStore {
         PRIMARY KEY (session_id, participant_key)
       );
     `);
+
+    // Schema migrations for existing databases created before these columns existed
+    const columns = (this.db.prepare("PRAGMA table_info(collab_sessions)").all() as { name: string }[]).map((c) => c.name);
+    if (!columns.includes("require_identity")) {
+      this.db.exec("ALTER TABLE collab_sessions ADD COLUMN require_identity INTEGER NOT NULL DEFAULT 0");
+    }
+    if (!columns.includes("locked_layer_ids")) {
+      this.db.exec("ALTER TABLE collab_sessions ADD COLUMN locked_layer_ids TEXT NOT NULL DEFAULT '[]'");
+    }
+    if (!columns.includes("rev")) {
+      this.db.exec("ALTER TABLE collab_sessions ADD COLUMN rev INTEGER NOT NULL DEFAULT 0");
+    }
   }
 
   create(id: string, hostToken: string, mode: CollaborationMode, requireIdentity = false): boolean {
@@ -101,24 +115,18 @@ export class SessionStore {
       hostToken: row.host_token,
       mode: normalizeMode(row.mode),
       requireIdentity: row.require_identity === 1,
-      lockedLayerIds: parseJson(row.locked_layer_ids ?? "[]", []),
-      rev: row.rev,
-      snapshot: parseJson(row.snapshot, null),
+      lockedLayerIds: parseJson<string[]>(row.locked_layer_ids ?? null, []),
+      rev: row.rev ?? 0,
+      snapshot: parseJson<unknown | null>(row.snapshot, null),
       chat: parseStoredChat(row.chat),
       updatedAt: row.updated_at,
     };
   }
 
-  saveSnapshot(id: string, project: unknown): number {
-    const row = this.db
-      .prepare(
-        `UPDATE collab_sessions
-         SET snapshot = ?, rev = rev + 1, updated_at = ?
-         WHERE id = ?
-         RETURNING rev`,
-      )
-      .get(JSON.stringify(project), Date.now(), id) as { rev: number } | undefined;
-    return row?.rev ?? 0;
+  saveSnapshot(id: string, snapshot: unknown, rev: number): void {
+    this.db
+      .prepare("UPDATE collab_sessions SET snapshot = ?, rev = ?, updated_at = ? WHERE id = ?")
+      .run(JSON.stringify(snapshot), rev, Date.now(), id);
   }
 
   saveProjectState(id: string, project: unknown): void {
@@ -133,10 +141,12 @@ export class SessionStore {
       .run(mode, Date.now(), id);
   }
 
-  saveSessionConfig(id: string, requireIdentity: boolean): void {
-    this.db
-      .prepare("UPDATE collab_sessions SET require_identity = ?, updated_at = ? WHERE id = ?")
-      .run(requireIdentity ? 1 : 0, Date.now(), id);
+  saveSessionConfig(id: string, requireIdentity?: boolean): void {
+    if (requireIdentity !== undefined) {
+      this.db
+        .prepare("UPDATE collab_sessions SET require_identity = ?, updated_at = ? WHERE id = ?")
+        .run(requireIdentity ? 1 : 0, Date.now(), id);
+    }
   }
 
   saveLayerLocks(id: string, lockedLayerIds: string[]): void {
@@ -151,7 +161,7 @@ export class SessionStore {
       .run(JSON.stringify(chat), Date.now(), id);
   }
 
-  createInvite(sessionId: string, invite: CollabInvite): void {
+  saveInvite(sessionId: string, invite: CollabInvite): void {
     this.db
       .prepare(
         `INSERT OR REPLACE INTO collab_invites (session_id, token, role, created_at, max_uses, use_count, revoked)
@@ -168,6 +178,10 @@ export class SessionStore {
       );
   }
 
+  createInvite(sessionId: string, invite: CollabInvite): void {
+    this.saveInvite(sessionId, invite);
+  }
+
   getInvites(sessionId: string): CollabInvite[] {
     const rows = this.db
       .prepare("SELECT * FROM collab_invites WHERE session_id = ? ORDER BY created_at DESC")
@@ -195,7 +209,8 @@ export class SessionStore {
       .run(sessionId, token);
   }
 
-  getDurableOverride(sessionId: string, participantKey: string): boolean | undefined {
+  getDurableOverride(sessionId: string, participantKey: string | null): boolean | undefined {
+    if (!participantKey) return undefined;
     const row = this.db
       .prepare(
         "SELECT edit_override FROM collab_durable_overrides WHERE session_id = ? AND participant_key = ?",
@@ -206,9 +221,10 @@ export class SessionStore {
 
   saveDurableOverride(
     sessionId: string,
-    participantKey: string,
+    participantKey: string | null,
     canEdit: boolean | undefined,
   ): void {
+    if (!participantKey) return;
     if (canEdit === undefined) {
       this.db
         .prepare(
@@ -224,7 +240,8 @@ export class SessionStore {
     }
   }
 
-  isBlockedKey(sessionId: string, participantKey: string): boolean {
+  isBlockedKey(sessionId: string, participantKey: string | null): boolean {
+    if (!participantKey) return false;
     const row = this.db
       .prepare(
         "SELECT participant_key FROM collab_blocked_keys WHERE session_id = ? AND participant_key = ?",
@@ -233,7 +250,8 @@ export class SessionStore {
     return row !== undefined;
   }
 
-  blockKey(sessionId: string, participantKey: string): void {
+  blockKey(sessionId: string, participantKey: string | null): void {
+    if (!participantKey) return;
     this.db
       .prepare(
         "INSERT OR REPLACE INTO collab_blocked_keys (session_id, participant_key, blocked_at) VALUES (?, ?, ?)",
@@ -242,10 +260,17 @@ export class SessionStore {
   }
 
   delete(id: string): void {
-    this.db.prepare("DELETE FROM collab_sessions WHERE id = ?").run(id);
-    this.db.prepare("DELETE FROM collab_invites WHERE session_id = ?").run(id);
-    this.db.prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?").run(id);
-    this.db.prepare("DELETE FROM collab_blocked_keys WHERE session_id = ?").run(id);
+    this.db.exec("BEGIN TRANSACTION");
+    try {
+      this.db.prepare("DELETE FROM collab_sessions WHERE id = ?").run(id);
+      this.db.prepare("DELETE FROM collab_invites WHERE session_id = ?").run(id);
+      this.db.prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?").run(id);
+      this.db.prepare("DELETE FROM collab_blocked_keys WHERE session_id = ?").run(id);
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
   }
 
   deleteStaleBefore(cutoff: number, keep: Iterable<string>): void {
@@ -253,10 +278,20 @@ export class SessionStore {
     const rows = this.db
       .prepare("SELECT id FROM collab_sessions WHERE updated_at < ?")
       .all(cutoff) as { id: string }[];
-    for (const row of rows) {
-      if (!keepSet.has(row.id)) {
-        this.delete(row.id);
+    this.db.exec("BEGIN TRANSACTION");
+    try {
+      for (const row of rows) {
+        if (!keepSet.has(row.id)) {
+          this.db.prepare("DELETE FROM collab_sessions WHERE id = ?").run(row.id);
+          this.db.prepare("DELETE FROM collab_invites WHERE session_id = ?").run(row.id);
+          this.db.prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?").run(row.id);
+          this.db.prepare("DELETE FROM collab_blocked_keys WHERE session_id = ?").run(row.id);
+        }
       }
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
     }
   }
 
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 18aa606334..18fddd129a 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -123,7 +123,8 @@ export class CollabSession extends DurableObject<Env> {
     );
   }
 
-  private readDurableOverride(participantKey: string): boolean | undefined {
+  private readDurableOverride(participantKey: string | null): boolean | undefined {
+    if (!participantKey) return undefined;
     this.ensureTables();
     const rows = this.ctx.storage.sql
       .exec<{ edit_override: number }>(
@@ -134,7 +135,8 @@ export class CollabSession extends DurableObject<Env> {
     return rows.length > 0 ? rows[0].edit_override === 1 : undefined;
   }
 
-  private writeDurableOverride(participantKey: string, editOverride: boolean | undefined): void {
+  private writeDurableOverride(participantKey: string | null, editOverride: boolean | undefined): void {
+    if (!participantKey) return;
     this.ensureTables();
     if (editOverride === undefined) {
       this.ctx.storage.sql.exec(
@@ -150,7 +152,8 @@ export class CollabSession extends DurableObject<Env> {
     }
   }
 
-  private isBlockedKey(participantKey: string): boolean {
+  private isBlockedKey(participantKey: string | null): boolean {
+    if (!participantKey) return false;
     this.ensureTables();
     const rows = this.ctx.storage.sql
       .exec<{ participant_key: string }>(
@@ -161,7 +164,8 @@ export class CollabSession extends DurableObject<Env> {
     return rows.length > 0;
   }
 
-  private blockKey(participantKey: string): void {
+  private blockKey(participantKey: string | null): void {
+    if (!participantKey) return;
     this.ensureTables();
     this.ctx.storage.sql.exec(
       "INSERT OR REPLACE INTO collab_blocked_keys (participant_key, blocked_at) VALUES (?, ?)",
@@ -494,15 +498,16 @@ export class CollabSession extends DurableObject<Env> {
       return;
     }
 
-    const tempParticipant: SessionParticipant = {
-      clientId: "temp",
+    const socketClientId = crypto.randomUUID();
+    const joiningParticipant: SessionParticipant = {
+      clientId: socketClientId,
       displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
       color: sanitizeColor(message.color),
       role,
       identity,
       inviteToken,
     };
-    const participantKey = getParticipantKey(tempParticipant);
+    const participantKey = getParticipantKey(joiningParticipant);
 
     if (this.isBlockedKey(participantKey)) {
       this.send(ws, {
@@ -514,13 +519,23 @@ export class CollabSession extends DurableObject<Env> {
     }
 
     const durableOverride = this.readDurableOverride(participantKey);
+    let initialOverride: boolean | undefined = undefined;
+    if (durableOverride !== undefined) {
+      initialOverride = durableOverride;
+    } else if (inviteToken) {
+      const invites = this.readInvites();
+      const inv = invites.find((i) => i.token === inviteToken && !i.revoked);
+      if (inv) {
+        initialOverride = inv.role === "co-edit";
+      }
+    }
 
     const attachment: SocketAttachment = {
-      clientId: crypto.randomUUID(),
+      clientId: socketClientId,
       displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
       color: sanitizeColor(message.color),
       role,
-      ...(durableOverride !== undefined ? { editOverride: durableOverride } : {}),
+      ...(initialOverride !== undefined ? { editOverride: initialOverride } : {}),
       identity,
       inviteToken,
     };
@@ -686,12 +701,12 @@ export class CollabSession extends DurableObject<Env> {
       message.canEdit,
     );
     if (!changed) return;
-    // `changed` implies the entry is in this same snapshot -- setParticipantOverride
-    // found and mutated it, with no await in between -- so this always resolves.
     const target = socketsWithAttachments.find(
       (entry) => entry.attachment.clientId === message.clientId,
     );
     if (!target) return;
+    const targetKey = getParticipantKey(target.attachment);
+    this.writeDurableOverride(targetKey, target.attachment.editOverride);
     target.socket.serializeAttachment(target.attachment);
     // Everyone re-derives effective permission from the participants list (the
     // affected guest learns its own change here too), so a single broadcast

From 4956a36815da4e106069ba56f8161564ee4b99d4 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 18:05:25 +0000
Subject: [PATCH 04/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 packages/collab-core/src/session.ts | 13 ++++++++-----
 workers/collab-node/src/server.ts   | 11 +++++++++--
 workers/collab-node/src/store.ts    | 12 +++++++++---
 workers/collab/src/session.ts       |  5 ++++-
 4 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index fcacbced98..c2912d7f85 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -88,10 +88,7 @@ function isStructurallyEqual(a: unknown, b: unknown): boolean {
   for (const k of keysA) {
     if (!Object.prototype.hasOwnProperty.call(b, k)) return false;
     if (
-      !isStructurallyEqual(
-        (a as Record<string, unknown>)[k],
-        (b as Record<string, unknown>)[k],
-      )
+      !isStructurallyEqual((a as Record<string, unknown>)[k], (b as Record<string, unknown>)[k])
     ) {
       return false;
     }
@@ -248,7 +245,13 @@ export function toWireParticipant(participant: SessionParticipant): CollabPartic
     color: participant.color,
     role: participant.role,
     editOverride: participant.role === "host" ? null : (participant.editOverride ?? null),
-    identity: participant.identity ? { provider: participant.identity.provider, userId: participant.identity.userId, username: participant.identity.username } : null,
+    identity: participant.identity
+      ? {
+          provider: participant.identity.provider,
+          userId: participant.identity.userId,
+          username: participant.identity.username,
+        }
+      : null,
   };
 }
 
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index d58bad6440..c55ebe097b 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -405,7 +405,11 @@ export function createRelay(options: RelayOptions = {}): {
       const nextRev = (persisted.rev ?? 0) + 1;
       store.saveSnapshot(id, project, nextRev);
       persisted.rev = nextRev;
-      broadcast(session, { type: "snapshot", project, origin: participant.clientId, rev: nextRev }, peer);
+      broadcast(
+        session,
+        { type: "snapshot", project, origin: participant.clientId, rev: nextRev },
+        peer,
+      );
       return;
     }
 
@@ -460,7 +464,10 @@ export function createRelay(options: RelayOptions = {}): {
       }
       const role: CollaborationMode = message.role === "view-only" ? "view-only" : "co-edit";
       const token = randomUUID();
-      const maxUses = Number.isSafeInteger(message.maxUses) && (message.maxUses as number) > 0 ? (message.maxUses as number) : undefined;
+      const maxUses =
+        Number.isSafeInteger(message.maxUses) && (message.maxUses as number) > 0
+          ? (message.maxUses as number)
+          : undefined;
       const invite: CollabInvite = {
         token,
         role,
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 043406c7bf..0909078024 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -82,12 +82,18 @@ export class SessionStore {
     `);
 
     // Schema migrations for existing databases created before these columns existed
-    const columns = (this.db.prepare("PRAGMA table_info(collab_sessions)").all() as { name: string }[]).map((c) => c.name);
+    const columns = (
+      this.db.prepare("PRAGMA table_info(collab_sessions)").all() as { name: string }[]
+    ).map((c) => c.name);
     if (!columns.includes("require_identity")) {
-      this.db.exec("ALTER TABLE collab_sessions ADD COLUMN require_identity INTEGER NOT NULL DEFAULT 0");
+      this.db.exec(
+        "ALTER TABLE collab_sessions ADD COLUMN require_identity INTEGER NOT NULL DEFAULT 0",
+      );
     }
     if (!columns.includes("locked_layer_ids")) {
-      this.db.exec("ALTER TABLE collab_sessions ADD COLUMN locked_layer_ids TEXT NOT NULL DEFAULT '[]'");
+      this.db.exec(
+        "ALTER TABLE collab_sessions ADD COLUMN locked_layer_ids TEXT NOT NULL DEFAULT '[]'",
+      );
     }
     if (!columns.includes("rev")) {
       this.db.exec("ALTER TABLE collab_sessions ADD COLUMN rev INTEGER NOT NULL DEFAULT 0");
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 18fddd129a..380ff44599 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -135,7 +135,10 @@ export class CollabSession extends DurableObject<Env> {
     return rows.length > 0 ? rows[0].edit_override === 1 : undefined;
   }
 
-  private writeDurableOverride(participantKey: string | null, editOverride: boolean | undefined): void {
+  private writeDurableOverride(
+    participantKey: string | null,
+    editOverride: boolean | undefined,
+  ): void {
     if (!participantKey) return;
     this.ensureTables();
     if (editOverride === undefined) {

From b1f9e7b31f95c1e11ffe37f09ffed26041e59111 Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Tue, 11 Aug 2026 23:57:41 +0530
Subject: [PATCH 05/15] fixes

---
 docs/collaboration.md             |  12 ++--
 tests/collab-upgrade.test.ts      | 107 +++++++++++++++++++++++-------
 workers/collab-node/src/server.ts |  13 ++--
 workers/collab-node/src/store.ts  |   6 ++
 workers/collab/src/index.ts       |   9 ++-
 workers/collab/src/session.ts     |  19 +++++-
 6 files changed, 128 insertions(+), 38 deletions(-)

diff --git a/docs/collaboration.md b/docs/collaboration.md
index f3a1247d38..c45f1a80f4 100644
--- a/docs/collaboration.md
+++ b/docs/collaboration.md
@@ -205,10 +205,14 @@ clickable coordinate that recenters the recipient's map. Chat lives on the
 on-canvas status badge so it is reachable while working on the map; it is
 ephemeral and never written to a project file.
 
-> **Operator note:** `POST /sessions` is unauthenticated and currently responds
-> with `Access-Control-Allow-Origin: *`, so any page can create sessions. This is
-> acceptable for the experimental MVP but should be restricted to the app's own
-> origin(s) before a wider rollout to avoid capacity abuse.
+> **Operator note:** `POST /sessions` validates the request `Origin` (or
+> `Referer`) against `ALLOWED_ORIGINS` via `isAllowedOrigin` (defaults to the
+> app's own domains plus `localhost` for development) and enforces a per-IP
+> `checkRateLimit` (10 requests / 60 s). `Access-Control-Allow-Origin: *` is
+> still sent on responses so non-browser clients (e.g. Tauri) are not blocked by
+> CORS; the origin allowlist is the server-side gate. Configure
+> `ALLOWED_ORIGINS` (comma-separated list) to restrict which pages may create
+> sessions in production.
 
 ## Feature flag
 
diff --git a/tests/collab-upgrade.test.ts b/tests/collab-upgrade.test.ts
index 32ec4f2976..7cdaa5fad2 100644
--- a/tests/collab-upgrade.test.ts
+++ b/tests/collab-upgrade.test.ts
@@ -112,8 +112,8 @@ describe("Collaboration Upgrade Proposals", () => {
     let guestWs: WebSocket | null = null;
 
     t.after(async () => {
-      hostWs?.close();
-      guestWs?.close();
+      hostWs?.terminate();
+      guestWs?.terminate();
       await relay.close();
     });
 
@@ -136,6 +136,24 @@ describe("Collaboration Upgrade Proposals", () => {
     let hostWelcome: any = null;
     await new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("Host connect timeout")), 5000);
+      const cleanup = () => {
+        clearTimeout(timer);
+        hostWs!.removeListener("message", onMessage);
+        hostWs!.removeListener("error", onError);
+      };
+      const onError = (err: Error) => {
+        cleanup();
+        reject(err);
+      };
+      const onMessage = (raw: WebSocket.RawData) => {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "welcome") {
+          hostWelcome = msg;
+          cleanup();
+          resolve();
+        }
+      };
+      hostWs!.on("error", onError);
       hostWs!.on("open", () => {
         hostWs!.send(
           JSON.stringify({
@@ -146,14 +164,7 @@ describe("Collaboration Upgrade Proposals", () => {
           }),
         );
       });
-      hostWs!.on("message", (raw) => {
-        const msg = JSON.parse(raw.toString());
-        if (msg.type === "welcome") {
-          hostWelcome = msg;
-          clearTimeout(timer);
-          resolve();
-        }
-      });
+      hostWs!.on("message", onMessage);
     });
     assert.equal(hostWelcome.role, "host");
 
@@ -161,14 +172,25 @@ describe("Collaboration Upgrade Proposals", () => {
     let inviteToken = "";
     await new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("Mint invite timeout")), 5000);
-      hostWs!.on("message", (raw) => {
+      const cleanup = () => {
+        clearTimeout(timer);
+        hostWs!.removeListener("message", onMessage);
+        hostWs!.removeListener("error", onError);
+      };
+      const onError = (err: Error) => {
+        cleanup();
+        reject(err);
+      };
+      const onMessage = (raw: WebSocket.RawData) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "invite-created") {
           inviteToken = msg.invite.token;
-          clearTimeout(timer);
+          cleanup();
           resolve();
         }
-      });
+      };
+      hostWs!.on("error", onError);
+      hostWs!.on("message", onMessage);
       hostWs!.send(JSON.stringify({ type: "mint-invite", role: "view-only", maxUses: 1 }));
     });
     assert.ok(inviteToken);
@@ -178,36 +200,71 @@ describe("Collaboration Upgrade Proposals", () => {
     let guestWelcome: any = null;
     await new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("Guest join timeout")), 5000);
-      guestWs!.on("open", () => {
-        guestWs!.send(
-          JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }),
-        );
-      });
-      guestWs!.on("message", (raw) => {
+      const cleanup = () => {
+        clearTimeout(timer);
+        guestWs!.removeListener("message", onMessage);
+        guestWs!.removeListener("error", onError);
+      };
+      const onError = (err: Error) => {
+        cleanup();
+        reject(err);
+      };
+      const onMessage = (raw: WebSocket.RawData) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "welcome") {
           guestWelcome = msg;
-          clearTimeout(timer);
+          cleanup();
           resolve();
         }
+      };
+      guestWs!.on("error", onError);
+      guestWs!.on("open", () => {
+        guestWs!.send(
+          JSON.stringify({ type: "join", displayName: "GuestUser", color: "#dc2626", inviteToken }),
+        );
       });
+      guestWs!.on("message", onMessage);
     });
     assert.equal(guestWelcome.role, "guest");
 
+    // Verify the invited guest's editOverride is false (view-only invite)
+    const guestParticipant = guestWelcome.participants.find(
+      (p: any) => p.displayName === "GuestUser",
+    );
+    assert.ok(guestParticipant, "Invited guest should appear in welcome.participants");
+    assert.equal(
+      guestParticipant.editOverride,
+      false,
+      "A view-only invite should set editOverride to false",
+    );
+
     // Host kicks guest
     let guestKicked = false;
     await new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("Kick guest timeout")), 5000);
-      guestWs!.on("message", (raw) => {
+      const cleanup = () => {
+        clearTimeout(timer);
+        guestWs!.removeListener("message", onMessage);
+        guestWs!.removeListener("error", onError);
+        guestWs!.removeListener("close", onClose);
+      };
+      const onError = (err: Error) => {
+        cleanup();
+        reject(err);
+      };
+      const onMessage = (raw: WebSocket.RawData) => {
         const msg = JSON.parse(raw.toString());
         if (msg.type === "kicked") {
           guestKicked = true;
         }
-      });
-      guestWs!.on("close", () => {
-        clearTimeout(timer);
+      };
+      const onClose = () => {
+        cleanup();
         resolve();
-      });
+      };
+      guestWs!.on("error", onError);
+      guestWs!.on("message", onMessage);
+      guestWs!.on("close", onClose);
       hostWs!.send(
         JSON.stringify({
           type: "kick-participant",
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index c55ebe097b..4c607fe96e 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -268,7 +268,7 @@ export function createRelay(options: RelayOptions = {}): {
 
     if (message.type === "join") {
       if (peer.participant) return;
-      let role =
+      let role: CollaborationRole =
         message.hostToken && persisted.hostToken && message.hostToken === persisted.hostToken
           ? "host"
           : "guest";
@@ -283,7 +283,7 @@ export function createRelay(options: RelayOptions = {}): {
             role = "guest";
           }
           inv.useCount += 1;
-          store.createInvite(id, inv);
+          store.saveInvite(id, inv);
         }
       }
 
@@ -317,7 +317,7 @@ export function createRelay(options: RelayOptions = {}): {
         clientId: socketClientId,
         displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
         color: sanitizeColor(message.color),
-        role: role as CollaborationRole,
+        role,
         identity,
         inviteToken,
       };
@@ -347,7 +347,7 @@ export function createRelay(options: RelayOptions = {}): {
         clientId: socketClientId,
         displayName: identity ? identity.username : sanitizeDisplayName(message.displayName),
         color: sanitizeColor(message.color),
-        role: role as CollaborationRole,
+        role,
         ...(initialOverride !== undefined ? { editOverride: initialOverride } : {}),
         identity,
         inviteToken,
@@ -358,7 +358,7 @@ export function createRelay(options: RelayOptions = {}): {
       send(peer, {
         type: "welcome",
         clientId: peer.participant.clientId,
-        role: role as CollaborationRole,
+        role,
         mode: persisted.mode,
         participants: participants(session).map(toWireParticipant),
         snapshot: persisted.snapshot,
@@ -425,6 +425,9 @@ export function createRelay(options: RelayOptions = {}): {
       store.saveMode(id, mode);
       const list = participants(session);
       if (clearParticipantOverrides(list)) broadcastParticipants(session);
+      // Also clear persisted durable overrides so disconnected participants
+      // don't reconnect with a stale override that contradicts the new mode.
+      store.clearDurableOverrides(id);
       broadcast(session, { type: "mode", mode });
       return;
     }
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 0909078024..28e0b909e7 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -246,6 +246,12 @@ export class SessionStore {
     }
   }
 
+  clearDurableOverrides(sessionId: string): void {
+    this.db
+      .prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?")
+      .run(sessionId);
+  }
+
   isBlockedKey(sessionId: string, participantKey: string | null): boolean {
     if (!participantKey) return false;
     const row = this.db
diff --git a/workers/collab/src/index.ts b/workers/collab/src/index.ts
index 45b5b49a5b..cb925b7d22 100644
--- a/workers/collab/src/index.ts
+++ b/workers/collab/src/index.ts
@@ -61,6 +61,13 @@ function isAllowedOrigin(originHeader: string | null, envAllowed?: string): bool
 
 function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
   const now = Date.now();
+  // Evict expired entries when the map grows past a threshold so varying keys
+  // (e.g. per-IP) cannot grow the map indefinitely within an isolate's lifetime.
+  if (rateLimitMap.size > 5000) {
+    for (const [k, rec] of rateLimitMap.entries()) {
+      if (now > rec.resetAt) rateLimitMap.delete(k);
+    }
+  }
   const record = rateLimitMap.get(key);
   if (!record || now > record.resetAt) {
     rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
@@ -111,7 +118,7 @@ export default {
         return json({ error: "Origin not allowed to create sessions." }, 403);
       }
 
-      const clientKey = origin ?? request.headers.get("CF-Connecting-IP") ?? "anonymous";
+      const clientKey = request.headers.get("CF-Connecting-IP") ?? origin ?? "anonymous";
       if (!checkRateLimit(clientKey)) {
         return json({ error: "Too many session creation requests. Please try again later." }, 429);
       }
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 380ff44599..2e0a335229 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -155,6 +155,11 @@ export class CollabSession extends DurableObject<Env> {
     }
   }
 
+  private clearAllDurableOverrides(): void {
+    this.ensureTables();
+    this.ctx.storage.sql.exec("DELETE FROM collab_durable_overrides");
+  }
+
   private isBlockedKey(participantKey: string | null): boolean {
     if (!participantKey) return false;
     this.ensureTables();
@@ -671,6 +676,10 @@ export class CollabSession extends DurableObject<Env> {
         socket.serializeAttachment(attachment);
       }
     }
+    // Also clear persisted durable overrides so disconnected participants
+    // don't reconnect with a stale override that contradicts the new mode.
+    this.ensureTables();
+    this.ctx.storage.sql.exec("DELETE FROM collab_durable_overrides");
     // Broadcast the cleared roster first, then the new mode, so clients have
     // dropped the stale `editOverride`s by the time they apply the mode change
     // (the two frames are sent back-to-back with no await between them).
@@ -1075,17 +1084,21 @@ export class CollabSession extends DurableObject<Env> {
       return;
     }
     const role: CollaborationMode = message.role === "view-only" ? "view-only" : "co-edit";
-    const token = crypto.randomUUID().slice(0, 16);
+    const token = crypto.randomUUID();
+    const maxUses =
+      Number.isSafeInteger(message.maxUses) && (message.maxUses as number) > 0
+        ? (message.maxUses as number)
+        : undefined;
     const invite: CollabInvite = {
       token,
       role,
       createdAt: Date.now(),
-      ...(message.maxUses ? { maxUses: message.maxUses } : {}),
+      ...(maxUses !== undefined ? { maxUses } : {}),
       useCount: 0,
       revoked: false,
     };
     this.writeInvite(invite);
-    this.send(ws, { type: "invite-created", invite });
+    this.broadcastHostOnly({ type: "invite-created", invite });
   }
 
   private handleRevokeInvite(

From 43cb3d3e9d3ee127a1eba676b4834dae14e542a7 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 18:28:01 +0000
Subject: [PATCH 06/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 workers/collab-node/src/store.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 28e0b909e7..6554335495 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -247,9 +247,7 @@ export class SessionStore {
   }
 
   clearDurableOverrides(sessionId: string): void {
-    this.db
-      .prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?")
-      .run(sessionId);
+    this.db.prepare("DELETE FROM collab_durable_overrides WHERE session_id = ?").run(sessionId);
   }
 
   isBlockedKey(sessionId: string, participantKey: string | null): boolean {

From 7e1e8e61693f50da2262803b67ca7c2629510f6c Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Wed, 12 Aug 2026 00:19:08 +0530
Subject: [PATCH 07/15] fix(collab): update rate-limit cleanup, proxy IP
 handling, and collab docs

---
 docs/collaboration.md                  | 12 ++++++-----
 workers/collab-node/src/server.ts      | 28 +++++++++++++++++++++-----
 workers/collab-node/test/relay.test.ts | 18 +++++++++++++++++
 workers/collab/src/index.ts            | 23 +++++++++++++++------
 4 files changed, 65 insertions(+), 16 deletions(-)

diff --git a/docs/collaboration.md b/docs/collaboration.md
index c45f1a80f4..b0e0a6ac15 100644
--- a/docs/collaboration.md
+++ b/docs/collaboration.md
@@ -207,12 +207,14 @@ ephemeral and never written to a project file.
 
 > **Operator note:** `POST /sessions` validates the request `Origin` (or
 > `Referer`) against `ALLOWED_ORIGINS` via `isAllowedOrigin` (defaults to the
-> app's own domains plus `localhost` for development) and enforces a per-IP
-> `checkRateLimit` (10 requests / 60 s). `Access-Control-Allow-Origin: *` is
+> app's own domains plus `localhost` for development) as browser-origin filtering
+> and defense-in-depth (not authentication or a general server-side access gate)
+> and enforces a per-IP `checkRateLimit` (10 requests / 60 s). `Access-Control-Allow-Origin: *` is
 > still sent on responses so non-browser clients (e.g. Tauri) are not blocked by
-> CORS; the origin allowlist is the server-side gate. Configure
-> `ALLOWED_ORIGINS` (comma-separated list) to restrict which pages may create
-> sessions in production.
+> CORS; non-browser clients may omit these headers and remain supported, unless a
+> verifiable credential requirement is added. Configure `ALLOWED_ORIGINS`
+> (comma-separated list) to restrict which browser origins may create sessions in
+> production.
 
 ## Feature flag
 
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 4c607fe96e..c140346c05 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -48,7 +48,22 @@ const MAX_SESSION_BODY_BYTES = 16_384;
 const DEFAULT_IDLE_TTL_MS = 2 * 60 * 60 * 1000;
 const ENCODER = new TextEncoder();
 
+const MAX_RATE_LIMIT_KEYS = 10_000;
+const SWEEP_INTERVAL_MS = 60_000;
 const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
+let lastRateLimitSweep = 0;
+
+function cleanupRateLimitMap(now: number): void {
+  for (const [k, rec] of rateLimitMap.entries()) {
+    if (now > rec.resetAt) rateLimitMap.delete(k);
+  }
+  while (rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+    const oldestKey = rateLimitMap.keys().next().value;
+    if (oldestKey === undefined) break;
+    rateLimitMap.delete(oldestKey);
+  }
+  lastRateLimitSweep = now;
+}
 
 function isAllowedOrigin(
   originHeader: string | undefined,
@@ -88,10 +103,8 @@ function isAllowedOrigin(
 
 function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
   const now = Date.now();
-  if (rateLimitMap.size > 5000) {
-    for (const [k, rec] of rateLimitMap.entries()) {
-      if (now > rec.resetAt) rateLimitMap.delete(k);
-    }
+  if (now - lastRateLimitSweep > SWEEP_INTERVAL_MS || rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+    cleanupRateLimitMap(now);
   }
   const record = rateLimitMap.get(key);
   if (!record || now > record.resetAt) {
@@ -122,6 +135,7 @@ export interface RelayOptions {
   dbPath?: string;
   maxSnapshotBytes?: number;
   idleTtlMs?: number;
+  trustProxy?: boolean;
 }
 
 function positive(value: string | undefined, fallback: number): number {
@@ -162,6 +176,9 @@ export function createRelay(options: RelayOptions = {}): {
     options.maxSnapshotBytes ?? positive(process.env.COLLAB_MAX_SNAPSHOT_BYTES, MAX_SNAPSHOT_BYTES);
   const idleTtlMs =
     options.idleTtlMs ?? positive(process.env.COLLAB_IDLE_TTL_MS, DEFAULT_IDLE_TTL_MS);
+  const trustProxy =
+    options.trustProxy ??
+    (process.env.TRUST_PROXY === "true" || process.env.TRUST_PROXY === "1");
   const store = new SessionStore(dbPath);
   const sessions = new Map<string, LiveSession>();
   const wss = new WebSocketServer({ noServer: true, maxPayload: maxSnapshotBytes + 64_000 });
@@ -768,8 +785,9 @@ export function createRelay(options: RelayOptions = {}): {
         return json(response, 403, { error: "Forbidden origin" });
       }
 
+      const rawXff = trustProxy ? (request.headers["x-forwarded-for"] as string | undefined) : undefined;
       const clientIp =
-        (request.headers["x-forwarded-for"] as string | undefined)?.split(",")[0].trim() ||
+        rawXff?.split(",")[0].trim() ||
         request.socket.remoteAddress ||
         "unknown";
       if (!checkRateLimit(clientIp, 10, 60_000)) {
diff --git a/workers/collab-node/test/relay.test.ts b/workers/collab-node/test/relay.test.ts
index 6e40d94607..c300a97051 100644
--- a/workers/collab-node/test/relay.test.ts
+++ b/workers/collab-node/test/relay.test.ts
@@ -310,4 +310,22 @@ describe("Node collaboration relay", () => {
     assert.equal(welcome.rev, 1);
     rejoined.close();
   });
+
+  it("only honors X-Forwarded-For when trustProxy is enabled", async () => {
+    const untrusted = await start({ trustProxy: false });
+    const res1 = await fetch(`${untrusted.http}/sessions`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forwarded-for": "1.2.3.4" },
+      body: JSON.stringify({ mode: "co-edit" }),
+    });
+    assert.equal(res1.status, 200);
+
+    const trusted = await start({ trustProxy: true });
+    const res2 = await fetch(`${trusted.http}/sessions`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forwarded-for": "1.2.3.4" },
+      body: JSON.stringify({ mode: "co-edit" }),
+    });
+    assert.equal(res2.status, 200);
+  });
 });
diff --git a/workers/collab/src/index.ts b/workers/collab/src/index.ts
index cb925b7d22..e481cf08ca 100644
--- a/workers/collab/src/index.ts
+++ b/workers/collab/src/index.ts
@@ -24,7 +24,22 @@ const CORS_HEADERS: Record<string, string> = {
   "Access-Control-Max-Age": "86400",
 };
 
+const MAX_RATE_LIMIT_KEYS = 10_000;
+const SWEEP_INTERVAL_MS = 60_000;
 const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
+let lastRateLimitSweep = 0;
+
+function cleanupRateLimitMap(now: number): void {
+  for (const [k, rec] of rateLimitMap.entries()) {
+    if (now > rec.resetAt) rateLimitMap.delete(k);
+  }
+  while (rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+    const oldestKey = rateLimitMap.keys().next().value;
+    if (oldestKey === undefined) break;
+    rateLimitMap.delete(oldestKey);
+  }
+  lastRateLimitSweep = now;
+}
 
 function isAllowedOrigin(originHeader: string | null, envAllowed?: string): boolean {
   if (!originHeader) return true;
@@ -61,12 +76,8 @@ function isAllowedOrigin(originHeader: string | null, envAllowed?: string): bool
 
 function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
   const now = Date.now();
-  // Evict expired entries when the map grows past a threshold so varying keys
-  // (e.g. per-IP) cannot grow the map indefinitely within an isolate's lifetime.
-  if (rateLimitMap.size > 5000) {
-    for (const [k, rec] of rateLimitMap.entries()) {
-      if (now > rec.resetAt) rateLimitMap.delete(k);
-    }
+  if (now - lastRateLimitSweep > SWEEP_INTERVAL_MS || rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+    cleanupRateLimitMap(now);
   }
   const record = rateLimitMap.get(key);
   if (!record || now > record.resetAt) {

From 61b5cf2d10f4239f2b6e820c76f78aac4c240f09 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 18:49:43 +0000
Subject: [PATCH 08/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 workers/collab-node/src/server.ts | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index c140346c05..8dc80d0edc 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -177,8 +177,7 @@ export function createRelay(options: RelayOptions = {}): {
   const idleTtlMs =
     options.idleTtlMs ?? positive(process.env.COLLAB_IDLE_TTL_MS, DEFAULT_IDLE_TTL_MS);
   const trustProxy =
-    options.trustProxy ??
-    (process.env.TRUST_PROXY === "true" || process.env.TRUST_PROXY === "1");
+    options.trustProxy ?? (process.env.TRUST_PROXY === "true" || process.env.TRUST_PROXY === "1");
   const store = new SessionStore(dbPath);
   const sessions = new Map<string, LiveSession>();
   const wss = new WebSocketServer({ noServer: true, maxPayload: maxSnapshotBytes + 64_000 });
@@ -785,11 +784,10 @@ export function createRelay(options: RelayOptions = {}): {
         return json(response, 403, { error: "Forbidden origin" });
       }
 
-      const rawXff = trustProxy ? (request.headers["x-forwarded-for"] as string | undefined) : undefined;
-      const clientIp =
-        rawXff?.split(",")[0].trim() ||
-        request.socket.remoteAddress ||
-        "unknown";
+      const rawXff = trustProxy
+        ? (request.headers["x-forwarded-for"] as string | undefined)
+        : undefined;
+      const clientIp = rawXff?.split(",")[0].trim() || request.socket.remoteAddress || "unknown";
       if (!checkRateLimit(clientIp, 10, 60_000)) {
         return json(response, 429, { error: "Too many session creation requests" });
       }

From 6d39e3362e0263151d9df86754e0c27cfa6619f7 Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Wed, 12 Aug 2026 00:29:10 +0530
Subject: [PATCH 09/15] fix(collab): defer invite consumption until after join
 authorization checks succeed

---
 workers/collab-node/src/server.ts      | 74 ++++++++++++-------------
 workers/collab-node/test/relay.test.ts | 77 +++++++++++++++++++++++---
 workers/collab/src/session.ts          | 17 +++---
 3 files changed, 115 insertions(+), 53 deletions(-)

diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 8dc80d0edc..77577d9d60 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -50,20 +50,6 @@ const ENCODER = new TextEncoder();
 
 const MAX_RATE_LIMIT_KEYS = 10_000;
 const SWEEP_INTERVAL_MS = 60_000;
-const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
-let lastRateLimitSweep = 0;
-
-function cleanupRateLimitMap(now: number): void {
-  for (const [k, rec] of rateLimitMap.entries()) {
-    if (now > rec.resetAt) rateLimitMap.delete(k);
-  }
-  while (rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
-    const oldestKey = rateLimitMap.keys().next().value;
-    if (oldestKey === undefined) break;
-    rateLimitMap.delete(oldestKey);
-  }
-  lastRateLimitSweep = now;
-}
 
 function isAllowedOrigin(
   originHeader: string | undefined,
@@ -101,23 +87,6 @@ function isAllowedOrigin(
   }
 }
 
-function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
-  const now = Date.now();
-  if (now - lastRateLimitSweep > SWEEP_INTERVAL_MS || rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
-    cleanupRateLimitMap(now);
-  }
-  const record = rateLimitMap.get(key);
-  if (!record || now > record.resetAt) {
-    rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
-    return true;
-  }
-  if (record.count >= maxRequests) {
-    return false;
-  }
-  record.count += 1;
-  return true;
-}
-
 interface Peer {
   socket: WebSocket;
   participant?: SessionParticipant;
@@ -180,6 +149,33 @@ export function createRelay(options: RelayOptions = {}): {
     options.trustProxy ?? (process.env.TRUST_PROXY === "true" || process.env.TRUST_PROXY === "1");
   const store = new SessionStore(dbPath);
   const sessions = new Map<string, LiveSession>();
+  const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
+  let lastRateLimitSweep = 0;
+
+  function checkRateLimit(key: string, maxRequests = 10, windowMs = 60_000): boolean {
+    const now = Date.now();
+    if (now - lastRateLimitSweep > SWEEP_INTERVAL_MS || rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+      for (const [k, rec] of rateLimitMap.entries()) {
+        if (now > rec.resetAt) rateLimitMap.delete(k);
+      }
+      while (rateLimitMap.size >= MAX_RATE_LIMIT_KEYS) {
+        const oldestKey = rateLimitMap.keys().next().value;
+        if (oldestKey === undefined) break;
+        rateLimitMap.delete(oldestKey);
+      }
+      lastRateLimitSweep = now;
+    }
+    const record = rateLimitMap.get(key);
+    if (!record || now > record.resetAt) {
+      rateLimitMap.set(key, { count: 1, resetAt: now + windowMs });
+      return true;
+    }
+    if (record.count >= maxRequests) {
+      return false;
+    }
+    record.count += 1;
+    return true;
+  }
   const wss = new WebSocketServer({ noServer: true, maxPayload: maxSnapshotBytes + 64_000 });
 
   const sweep = (): void => store.deleteStaleBefore(Date.now() - idleTtlMs, sessions.keys());
@@ -290,16 +286,16 @@ export function createRelay(options: RelayOptions = {}): {
           : "guest";
 
       let inviteToken: string | undefined = undefined;
+      let matchedInvite: CollabInvite | undefined = undefined;
       if (message.inviteToken && typeof message.inviteToken === "string") {
         const invites = store.getInvites(id);
         const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
         if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
           inviteToken = inv.token;
+          matchedInvite = inv;
           if (role !== "host") {
             role = "guest";
           }
-          inv.useCount += 1;
-          store.saveInvite(id, inv);
         }
       }
 
@@ -352,11 +348,13 @@ export function createRelay(options: RelayOptions = {}): {
       let initialOverride: boolean | undefined = undefined;
       if (durableOverride !== undefined) {
         initialOverride = durableOverride;
-      } else if (inviteToken) {
-        const inv = store.getInvites(id).find((i) => i.token === inviteToken && !i.revoked);
-        if (inv) {
-          initialOverride = inv.role === "co-edit";
-        }
+      } else if (matchedInvite) {
+        initialOverride = matchedInvite.role === "co-edit";
+      }
+
+      if (matchedInvite) {
+        matchedInvite.useCount += 1;
+        store.saveInvite(id, matchedInvite);
       }
 
       peer.participant = {
diff --git a/workers/collab-node/test/relay.test.ts b/workers/collab-node/test/relay.test.ts
index c300a97051..482998791c 100644
--- a/workers/collab-node/test/relay.test.ts
+++ b/workers/collab-node/test/relay.test.ts
@@ -313,19 +313,82 @@ describe("Node collaboration relay", () => {
 
   it("only honors X-Forwarded-For when trustProxy is enabled", async () => {
     const untrusted = await start({ trustProxy: false });
-    const res1 = await fetch(`${untrusted.http}/sessions`, {
+    for (let i = 1; i <= 10; i++) {
+      const res = await fetch(`${untrusted.http}/sessions`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-forwarded-for": `10.0.0.${i}` },
+        body: JSON.stringify({ mode: "co-edit" }),
+      });
+      assert.equal(res.status, 200);
+    }
+    const res11Untrusted = await fetch(`${untrusted.http}/sessions`, {
       method: "POST",
-      headers: { "content-type": "application/json", "x-forwarded-for": "1.2.3.4" },
+      headers: { "content-type": "application/json", "x-forwarded-for": "10.0.0.11" },
       body: JSON.stringify({ mode: "co-edit" }),
     });
-    assert.equal(res1.status, 200);
+    assert.equal(res11Untrusted.status, 429);
 
     const trusted = await start({ trustProxy: true });
-    const res2 = await fetch(`${trusted.http}/sessions`, {
+    for (let i = 1; i <= 11; i++) {
+      const res = await fetch(`${trusted.http}/sessions`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-forwarded-for": `10.0.1.${i}` },
+        body: JSON.stringify({ mode: "co-edit" }),
+      });
+      assert.equal(res.status, 200);
+    }
+  });
+
+  it("defers invite consumption until after authorization checks succeed", async () => {
+    const { http } = await start();
+    const createdRes = await fetch(`${http}/sessions`, {
       method: "POST",
-      headers: { "content-type": "application/json", "x-forwarded-for": "1.2.3.4" },
-      body: JSON.stringify({ mode: "co-edit" }),
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ mode: "co-edit", requireIdentity: true }),
     });
-    assert.equal(res2.status, 200);
+    const created = (await createdRes.json()) as { sessionId: string; hostToken: string };
+
+    const host = await connect(http, created.sessionId);
+    await joinSession(host, created.hostToken);
+
+    host.send(
+      JSON.stringify({
+        type: "mint-invite",
+        role: "co-edit",
+        maxUses: 1,
+      }),
+    );
+    const inviteMsg = await next(host, "invite-created");
+    const inviteToken = (inviteMsg.invite as { token: string }).token;
+
+    const unauthGuest = await connect(http, created.sessionId);
+    unauthGuest.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "client1",
+        displayName: "Guest",
+        color: "#ffffff",
+        inviteToken,
+      }),
+    );
+    const err = await next(unauthGuest, "error");
+    assert.equal(err.code, "identity-required");
+    unauthGuest.close();
+
+    const authGuest = await connect(http, created.sessionId);
+    authGuest.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "client2",
+        displayName: "Alice",
+        color: "#00ff00",
+        inviteToken,
+        identityToken: JSON.stringify({ provider: "geolibre", userId: "user1", username: "Alice" }),
+      }),
+    );
+    const welcome = await next(authGuest, "welcome");
+    assert.equal(welcome.type, "welcome");
+    authGuest.close();
+    host.close();
   });
 });
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 2e0a335229..e4523084b3 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -468,16 +468,16 @@ export class CollabSession extends DurableObject<Env> {
       message.hostToken && storedToken && message.hostToken === storedToken ? "host" : "guest";
 
     let inviteToken: string | undefined = undefined;
+    let matchedInvite: CollabInvite | undefined = undefined;
     if (message.inviteToken && typeof message.inviteToken === "string") {
       const invites = this.readInvites();
       const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
       if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
         inviteToken = inv.token;
+        matchedInvite = inv;
         if (role !== "host") {
           role = "guest";
         }
-        inv.useCount += 1;
-        this.writeInvite(inv);
       }
     }
 
@@ -530,12 +530,13 @@ export class CollabSession extends DurableObject<Env> {
     let initialOverride: boolean | undefined = undefined;
     if (durableOverride !== undefined) {
       initialOverride = durableOverride;
-    } else if (inviteToken) {
-      const invites = this.readInvites();
-      const inv = invites.find((i) => i.token === inviteToken && !i.revoked);
-      if (inv) {
-        initialOverride = inv.role === "co-edit";
-      }
+    } else if (matchedInvite) {
+      initialOverride = matchedInvite.role === "co-edit";
+    }
+
+    if (matchedInvite) {
+      matchedInvite.useCount += 1;
+      this.writeInvite(matchedInvite);
     }
 
     const attachment: SocketAttachment = {

From 5238173accd7a84e69f7e29d6a327ede0d18a29f Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Wed, 12 Aug 2026 00:54:01 +0530
Subject: [PATCH 10/15] fix(collab): enforce provider string type safety, guard
 host invites, and clean up setParticipantOverride

---
 packages/collab-core/src/session.ts    | 29 +++++------------
 workers/collab-node/src/server.ts      |  7 ++--
 workers/collab-node/test/relay.test.ts | 44 +++++++++++++++++++++++++-
 workers/collab/src/session.ts          |  7 ++--
 4 files changed, 55 insertions(+), 32 deletions(-)

diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index c2912d7f85..48be0947c0 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -169,7 +169,7 @@ export function authorizeSnapshot(
     return {
       ok: false,
       code: "too-large",
-      message: `Snapshot byte length (${byteLength}) exceeds maximum allowed (${maxBytes}).`,
+      message: "Project is too large to sync live. Share it via URL instead.",
     };
   }
   if (
@@ -202,28 +202,15 @@ export function normalizeMode(mode: unknown): CollaborationMode {
 }
 
 export function setParticipantOverride(
-  actorOrParticipants: Pick<SessionParticipant, "role"> | SessionParticipant[],
-  participantsOrClientId: SessionParticipant[] | string | unknown,
-  clientIdOrCanEdit?: unknown,
-  canEditVal?: unknown,
+  actor: Pick<SessionParticipant, "role">,
+  participants: SessionParticipant[],
+  clientId: unknown,
+  canEdit: unknown,
 ): boolean {
-  if (Array.isArray(actorOrParticipants)) {
-    const target = actorOrParticipants.find((p) => p.clientId === participantsOrClientId);
-    if (!target || target.role === "host") return false;
-    target.editOverride = clientIdOrCanEdit === true;
-    return true;
-  }
-  const actor = actorOrParticipants as Pick<SessionParticipant, "role">;
-  if (
-    actor.role !== "host" ||
-    !Array.isArray(participantsOrClientId) ||
-    typeof clientIdOrCanEdit !== "string"
-  ) {
-    return false;
-  }
-  const target = participantsOrClientId.find((p) => p.clientId === clientIdOrCanEdit);
+  if (actor.role !== "host" || typeof clientId !== "string") return false;
+  const target = participants.find((p) => p.clientId === clientId);
   if (!target || target.role === "host") return false;
-  target.editOverride = canEditVal === true;
+  target.editOverride = canEdit === true;
   return true;
 }
 
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 77577d9d60..7bf44675e4 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -287,15 +287,12 @@ export function createRelay(options: RelayOptions = {}): {
 
       let inviteToken: string | undefined = undefined;
       let matchedInvite: CollabInvite | undefined = undefined;
-      if (message.inviteToken && typeof message.inviteToken === "string") {
+      if (role === "guest" && message.inviteToken && typeof message.inviteToken === "string") {
         const invites = store.getInvites(id);
         const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
         if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
           inviteToken = inv.token;
           matchedInvite = inv;
-          if (role !== "host") {
-            role = "guest";
-          }
         }
       }
 
@@ -305,7 +302,7 @@ export function createRelay(options: RelayOptions = {}): {
           const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
           if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
             identity = {
-              provider: parsed.provider || "geolibre",
+              provider: typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
               userId: parsed.userId,
               username: sanitizeDisplayName(parsed.username),
             };
diff --git a/workers/collab-node/test/relay.test.ts b/workers/collab-node/test/relay.test.ts
index 482998791c..4784f8d065 100644
--- a/workers/collab-node/test/relay.test.ts
+++ b/workers/collab-node/test/relay.test.ts
@@ -344,13 +344,14 @@ describe("Node collaboration relay", () => {
     const createdRes = await fetch(`${http}/sessions`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ mode: "co-edit", requireIdentity: true }),
+      body: JSON.stringify({ mode: "view-only", requireIdentity: true }),
     });
     const created = (await createdRes.json()) as { sessionId: string; hostToken: string };
 
     const host = await connect(http, created.sessionId);
     await joinSession(host, created.hostToken);
 
+    // Host join with hostToken AND inviteToken should not consume the invite.
     host.send(
       JSON.stringify({
         type: "mint-invite",
@@ -361,6 +362,23 @@ describe("Node collaboration relay", () => {
     const inviteMsg = await next(host, "invite-created");
     const inviteToken = (inviteMsg.invite as { token: string }).token;
 
+    // 1. Host reconnects supplying hostToken AND inviteToken; should join as host without burning invite.
+    const hostReconnect = await connect(http, created.sessionId);
+    hostReconnect.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "host2",
+        displayName: "HostReconnect",
+        color: "#000000",
+        hostToken: created.hostToken,
+        inviteToken,
+      }),
+    );
+    const hostWelcome = await next(hostReconnect, "welcome");
+    assert.equal(hostWelcome.role, "host");
+    hostReconnect.close();
+
+    // 2. Unauthenticated guest attempts to join with inviteToken (fails identity check).
     const unauthGuest = await connect(http, created.sessionId);
     unauthGuest.send(
       JSON.stringify({
@@ -375,6 +393,7 @@ describe("Node collaboration relay", () => {
     assert.equal(err.code, "identity-required");
     unauthGuest.close();
 
+    // 3. First authenticated guest joins with inviteToken; succeeds and claims the 1-use co-edit invite.
     const authGuest = await connect(http, created.sessionId);
     authGuest.send(
       JSON.stringify({
@@ -389,6 +408,29 @@ describe("Node collaboration relay", () => {
     const welcome = await next(authGuest, "welcome");
     assert.equal(welcome.type, "welcome");
     authGuest.close();
+
+    // 4. Second authenticated guest attempts to join using the same maxUses: 1 inviteToken.
+    // The invite was consumed by Alice, so authGuest2 does NOT get co-edit override.
+    const authGuest2 = await connect(http, created.sessionId);
+    authGuest2.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "client3",
+        displayName: "Bob",
+        color: "#ff0000",
+        inviteToken,
+        identityToken: JSON.stringify({ provider: "geolibre", userId: "user2", username: "Bob" }),
+      }),
+    );
+    const welcome2 = await next(authGuest2, "welcome");
+    assert.equal(welcome2.type, "welcome");
+
+    // Since the co-edit invite was maxed out, Bob is a view-only guest in this view-only session.
+    authGuest2.send(JSON.stringify({ type: "snapshot", project: { name: "bob" }, rev: 0 }));
+    const editErr = await next(authGuest2, "error");
+    assert.equal(editErr.code, "forbidden");
+
+    authGuest2.close();
     host.close();
   });
 });
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index e4523084b3..4d445e64ba 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -469,15 +469,12 @@ export class CollabSession extends DurableObject<Env> {
 
     let inviteToken: string | undefined = undefined;
     let matchedInvite: CollabInvite | undefined = undefined;
-    if (message.inviteToken && typeof message.inviteToken === "string") {
+    if (role === "guest" && message.inviteToken && typeof message.inviteToken === "string") {
       const invites = this.readInvites();
       const inv = invites.find((i) => i.token === message.inviteToken && !i.revoked);
       if (inv && (!inv.maxUses || inv.useCount < inv.maxUses)) {
         inviteToken = inv.token;
         matchedInvite = inv;
-        if (role !== "host") {
-          role = "guest";
-        }
       }
     }
 
@@ -487,7 +484,7 @@ export class CollabSession extends DurableObject<Env> {
         const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
         if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
           identity = {
-            provider: parsed.provider || "geolibre",
+            provider: typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
             userId: parsed.userId,
             username: sanitizeDisplayName(parsed.username),
           };

From 23b20ff80d411596dc476ae8cde499a97467027c Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 19:24:30 +0000
Subject: [PATCH 11/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 workers/collab-node/src/server.ts | 5 ++++-
 workers/collab/src/session.ts     | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 7bf44675e4..e0a67935fd 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -302,7 +302,10 @@ export function createRelay(options: RelayOptions = {}): {
           const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
           if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
             identity = {
-              provider: typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
+              provider:
+                typeof parsed.provider === "string" && parsed.provider
+                  ? parsed.provider
+                  : "geolibre",
               userId: parsed.userId,
               username: sanitizeDisplayName(parsed.username),
             };
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 4d445e64ba..8eb26ff559 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -484,7 +484,8 @@ export class CollabSession extends DurableObject<Env> {
         const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
         if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
           identity = {
-            provider: typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
+            provider:
+              typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
             userId: parsed.userId,
             username: sanitizeDisplayName(parsed.username),
           };

From 175752500ca23ed248986e82cbda3c73f081b1d6 Mon Sep 17 00:00:00 2001
From: giswqs <giswqs@gmail.com>
Date: Thu, 13 Aug 2026 09:36:12 -0400
Subject: [PATCH 12/15] Address Claude review feedback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Verify `identityToken` cryptographically instead of trusting self-reported
  JSON. New `verifyIdentityToken`/`signIdentityToken` in `@geolibre/collab-core`
  check an HMAC-SHA256 signature over the token's payload segment, so a client
  can no longer mint an account, impersonate a user, evade an identity-keyed
  block, or wear the roster's verified badge.
- Make identity opt-in per deployment via `COLLAB_IDENTITY_SECRET` (Worker
  secret / env var). With no secret configured every token verifies to null and
  all joiners are anonymous, rather than the relay accepting whatever it is told.
- Stop `requireIdentity` from stranding a host's own session: without an issuer,
  `POST /sessions` answers 400 and `set-session-config` answers the new
  `identity-unavailable` error, and the relay reports `identitySupported` on
  `/health` and in every `welcome` so the Collaborate dialog hides the "require
  a signed-in account" option entirely instead of offering a gate no guest could
  pass.
- Chain per-peer frame handling in the Node relay, since identity verification
  made `handleMessage` async and `ws` delivers frames without waiting — a
  `snapshot` sent right behind a `join` would otherwise overtake it.
- Document that `block-participant` is durable only for identity- and
  invite-based joins: an anonymous guest gets a fresh `clientId` per join and can
  rejoin by reconnecting. `docs/collaboration.md` no longer claims it bans a
  participant from rejoining, and `getParticipantKey` says so at the source.
- Add `tests/collab-identity.test.ts` (signature, tampering, expiry, malformed
  input, unconfigured relay) and two relay tests covering a self-asserted token
  and one signed with the wrong secret.
---
 .../components/layout/CollaborateDialog.tsx   |  43 +++-
 .../src/hooks/useCollaboration.ts             |   1 +
 .../geolibre-desktop/src/lib/collab-client.ts |  40 ++++
 .../src/lib/collab-protocol.ts                |  13 +-
 docs/collaboration.md                         |  52 +++-
 packages/collab-core/src/identity.ts          | 225 ++++++++++++++++++
 packages/collab-core/src/index.ts             |   1 +
 packages/collab-core/src/protocol.ts          |  13 +-
 packages/collab-core/src/session.ts           |  10 +
 packages/core/src/store.ts                    |   1 +
 packages/core/src/types.ts                    |   7 +
 tests/collab-identity.test.ts                 | 109 +++++++++
 workers/collab-node/src/server.ts             |  93 +++++---
 workers/collab-node/test/relay.test.ts        |  81 ++++++-
 workers/collab/src/index.ts                   |  15 +-
 workers/collab/src/session.ts                 |  45 ++--
 16 files changed, 683 insertions(+), 66 deletions(-)
 create mode 100644 packages/collab-core/src/identity.ts
 create mode 100644 tests/collab-identity.test.ts

diff --git a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
index c877b43508..4aeb1767d3 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
@@ -15,6 +15,7 @@ import { QRCodeSVG } from "qrcode.react";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import type { CollaborationApi } from "../../hooks/useCollaboration";
+import { fetchCollabCapabilities } from "../../lib/collab-client";
 import { CollaborationParticipantRow } from "./CollaborationParticipantRow";
 
 // A small fixed palette so participant colors stay distinct and legible. Each
@@ -61,6 +62,11 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
   const [error, setError] = useState<string | null>(null);
   const [copied, setCopied] = useState<"code" | "link" | null>(null);
   const copyTimer = useRef<number | null>(null);
+  // Whether the relay can verify a sign-in. Probed when the dialog opens
+  // because the "require a signed-in account" option has to be decided before
+  // a session exists; false until the probe answers, so the option is hidden
+  // rather than briefly offered on a relay that would reject it.
+  const [identitySupported, setIdentitySupported] = useState(false);
 
   // Seed from a prior session (or a ?collab= deep link) when the dialog opens.
   useEffect(() => {
@@ -87,6 +93,19 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
     }
   }, [open, collaboration.selfName, collaboration.selfColor]);
 
+  // Probe relay capabilities on open. Ignored if the dialog closes first, so a
+  // slow relay can't flip the option on after the user has moved away.
+  useEffect(() => {
+    if (!open) return;
+    let cancelled = false;
+    void fetchCollabCapabilities().then((caps) => {
+      if (!cancelled) setIdentitySupported(caps.identitySupported);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [open]);
+
   useEffect(
     () => () => {
       if (copyTimer.current !== null) window.clearTimeout(copyTimer.current);
@@ -279,16 +298,18 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
                       <option value="view-only">{t("collaborate.modeViewOnly")}</option>
                     </Select>
                   </div>
-                  <label className="flex cursor-pointer items-center gap-2 text-xs text-muted-foreground pt-1">
-                    <input
-                      type="checkbox"
-                      checked={requireIdentity}
-                      onChange={(e) => setRequireIdentity(e.target.checked)}
-                      disabled={busy}
-                      className="h-3.5 w-3.5 rounded border"
-                    />
-                    {(t as (key: string) => string)("collaborate.requireIdentityLabel")}
-                  </label>
+                  {identitySupported && (
+                    <label className="flex cursor-pointer items-center gap-2 text-xs text-muted-foreground pt-1">
+                      <input
+                        type="checkbox"
+                        checked={requireIdentity}
+                        onChange={(e) => setRequireIdentity(e.target.checked)}
+                        disabled={busy}
+                        className="h-3.5 w-3.5 rounded border"
+                      />
+                      {(t as (key: string) => string)("collaborate.requireIdentityLabel")}
+                    </label>
+                  )}
                   <Button
                     type="button"
                     onClick={() => void handleStart()}
@@ -396,7 +417,7 @@ function ActiveSession({
         </label>
       )}
 
-      {isHost && (
+      {isHost && collaboration.identitySupported && (
         <label className="flex cursor-pointer items-center gap-2 text-xs text-muted-foreground">
           <input
             type="checkbox"
diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index 210281de05..3331df69f9 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -154,6 +154,7 @@ export function useCollaboration(
           participants: message.participants,
           chat: message.chat ?? [],
           requireIdentity: message.requireIdentity ?? false,
+          identitySupported: message.identitySupported ?? false,
           lockedLayerIds: message.lockedLayerIds ?? [],
           invites: message.invites ?? [],
           error: null,
diff --git a/apps/geolibre-desktop/src/lib/collab-client.ts b/apps/geolibre-desktop/src/lib/collab-client.ts
index 3906211322..83d28f780a 100644
--- a/apps/geolibre-desktop/src/lib/collab-client.ts
+++ b/apps/geolibre-desktop/src/lib/collab-client.ts
@@ -79,6 +79,46 @@ export function sessionWsUrl(wsBase: string, sessionId: string): string {
   return `${wsBase}/sessions/${encodeURIComponent(sessionId)}/ws`;
 }
 
+export interface CollabCapabilities {
+  /**
+   * Whether the relay has an identity issuer configured. False means it cannot
+   * verify a sign-in, so the "require a signed-in account" option must stay
+   * hidden — turning it on would reject every guest.
+   */
+  identitySupported: boolean;
+}
+
+/**
+ * Probe the relay's `/health` endpoint for optional capabilities.
+ *
+ * Any failure — unreachable relay, timeout, or an older relay that doesn't
+ * report the field — resolves to everything disabled rather than rejecting, so
+ * a capability-gated control simply stays hidden instead of blocking the
+ * dialog.
+ *
+ * @param baseUrl - The `ws(s)://` relay base; read from the env when omitted.
+ * @param fetchImpl - Injectable fetch, for tests.
+ * @returns The relay's advertised capabilities, all false when unknown.
+ */
+export async function fetchCollabCapabilities(
+  baseUrl: string | null = resolveCollabBaseUrl(),
+  fetchImpl: typeof fetch = fetch,
+): Promise<CollabCapabilities> {
+  if (!baseUrl) return { identitySupported: false };
+  try {
+    const response = await fetchImpl(`${httpBaseFromWs(baseUrl)}/health`, {
+      signal: AbortSignal.timeout(CREATE_TIMEOUT_MS),
+    });
+    if (!response.ok) return { identitySupported: false };
+    const payload = (await response.json().catch(() => ({}))) as {
+      identitySupported?: unknown;
+    };
+    return { identitySupported: payload?.identitySupported === true };
+  } catch {
+    return { identitySupported: false };
+  }
+}
+
 export interface CreateSessionOptions {
   mode?: CollaborationMode;
   requireIdentity?: boolean;
diff --git a/apps/geolibre-desktop/src/lib/collab-protocol.ts b/apps/geolibre-desktop/src/lib/collab-protocol.ts
index 43a620cd9a..53a824c479 100644
--- a/apps/geolibre-desktop/src/lib/collab-protocol.ts
+++ b/apps/geolibre-desktop/src/lib/collab-protocol.ts
@@ -67,7 +67,11 @@ export interface JoinMessage {
   hostToken?: string;
   /** Optional invite token carrying a baked-in role. */
   inviteToken?: string;
-  /** Optional identity token verifying the user's account. */
+  /**
+   * Optional HMAC-signed identity credential minted by the relay's issuer. See
+   * `verifyIdentityToken` in `@geolibre/collab-core`; a relay with no signing
+   * secret configured ignores this field entirely.
+   */
   identityToken?: string;
 }
 
@@ -177,6 +181,12 @@ export interface WelcomeMessage {
   chat: CollaborationChatMessage[];
   rev: number;
   requireIdentity?: boolean;
+  /**
+   * Whether this relay has an identity issuer configured. False means every
+   * joiner is anonymous and `requireIdentity` cannot be turned on, so the host
+   * UI hides the toggle rather than offering a gate nobody could pass.
+   */
+  identitySupported?: boolean;
   lockedLayerIds?: string[];
   invites?: CollabInvite[];
 }
@@ -249,6 +259,7 @@ export interface ErrorMessage {
     | "bad-message"
     | "not-found"
     | "identity-required"
+    | "identity-unavailable"
     | "layer-locked";
   message: string;
 }
diff --git a/docs/collaboration.md b/docs/collaboration.md
index b0e0a6ac15..b02657741a 100644
--- a/docs/collaboration.md
+++ b/docs/collaboration.md
@@ -73,14 +73,14 @@ Client → server:
 | `set-session-config` | `requireIdentity` | host only; mandate signed-in identity to join |
 | `set-layer-locks` | `lockedLayerIds` | host only; mark specific layer IDs read-only |
 | `kick-participant` | `clientId, reason?` | host only; disconnect a participant |
-| `block-participant` | `clientId, reason?` | host only; disconnect and ban participant/identity from rejoining |
+| `block-participant` | `clientId, reason?` | host only; disconnect and bar that participant key from rejoining (see the caveat under *Moderation*) |
 | `chat` | `text, coordinate?` | a chat message, with an optional attached map coordinate (#754) |
 
 Server → client:
 
 | type | payload | notes |
 | --- | --- | --- |
-| `welcome` | `clientId, role, mode, participants[], snapshot \| null, presence, chat[], rev, requireIdentity, lockedLayerIds, invites[]` | sent once on join; the late-joiner bootstrap |
+| `welcome` | `clientId, role, mode, participants[], snapshot \| null, presence, chat[], rev, requireIdentity, identitySupported, lockedLayerIds, invites[]` | sent once on join; the late-joiner bootstrap |
 | `snapshot` | `project, origin, rev` | fan-out of a peer's snapshot |
 | `presence` | `clientId, cursor?, view?` | fan-out of a peer's presence |
 | `participants` | `participants[]` | on join / leave / role / permission change; each carries `editOverride` and `identity` |
@@ -91,7 +91,7 @@ Server → client:
 | `layer-locks` | `lockedLayerIds` | broadcast when host locks/unlocks layer IDs |
 | `kicked` | `reason` | sent to a participant who was kicked or blocked by the host |
 | `chat` | `message` | fan-out of a chat message (echoed to the sender, so order is server-authoritative) (#754) |
-| `error` | `code, message` | e.g. `forbidden`, `too-large`, `identity-required`, `layer-locked` |
+| `error` | `code, message` | e.g. `forbidden`, `too-large`, `identity-required`, `identity-unavailable`, `layer-locked` |
 
 ### Echo / feedback-loop prevention
 
@@ -189,6 +189,52 @@ participant's `clientId` server-side (the client-supplied value is ignored) so
 one participant can't claim another's identity, and it validates the `color` to
 a hex value before storing/broadcasting it.
 
+### Signed-in identity (optional)
+
+A joiner may present an `identityToken`. It is **not** self-reported JSON: the
+relay verifies an HMAC-SHA256 signature over the token's payload segment before
+it will populate `participant.identity`, so a client cannot mint an account,
+impersonate another user, or wear the roster's verified badge. The format is
+
+```
+<base64url(payloadJSON)>.<base64url(hmacSha256(base64url(payloadJSON)))>
+```
+
+with payload claims `{ userId, username, provider?, exp? }`. `verifyIdentityToken`
+in `@geolibre/collab-core` is the single implementation both relays call, and
+`signIdentityToken` alongside it mints one.
+
+Identity is **off unless a deployment opts in** by setting the signing secret
+shared with its issuer — `COLLAB_IDENTITY_SECRET` (a Worker secret for
+`workers/collab`, an environment variable for `workers/collab-node`). With no
+secret configured:
+
+- every `identityToken` verifies to null, so all joiners are anonymous;
+- `requireIdentity` cannot be turned on — `POST /sessions` answers `400` and
+  `set-session-config` answers `error: identity-unavailable`, rather than arming
+  a gate that would reject every guest including the host's own collaborators;
+- `GET /health` and every `welcome` report `identitySupported: false`, which is
+  how the Collaborate dialog decides to hide the "require a signed-in account"
+  option entirely.
+
+GeoLibre itself ships no sign-in flow yet, so the stock deployment leaves the
+secret unset and the whole identity path dormant. The protocol and relay support
+are in place for a deployment that fronts the relay with its own issuer.
+
+### Moderation
+
+`kick-participant` disconnects a participant. `block-participant` also records
+their **participant key** so the relay refuses the next join. That key is
+`user:<userId>` for a verified identity, `invite:<token>` for an invite-based
+join, and otherwise `anon:<clientId>` — where `clientId` is minted fresh on
+every join.
+
+So a block is durable only for identity- and invite-based joins. **An anonymous
+guest can rejoin simply by reconnecting**, since they arrive with a new
+`clientId` and therefore a new key. Blocking is a moderation convenience, not a
+security boundary; a session that needs an enforceable ban has to require an
+invite or a signed-in identity.
+
 ## Chat (#754)
 
 A lightweight, in-session text channel. A `chat { text, coordinate? }` frame is
diff --git a/packages/collab-core/src/identity.ts b/packages/collab-core/src/identity.ts
new file mode 100644
index 0000000000..7ae2a3812b
--- /dev/null
+++ b/packages/collab-core/src/identity.ts
@@ -0,0 +1,225 @@
+// Verification of the `identityToken` a client presents on join.
+//
+// The token is an HMAC-SHA256 credential minted by whoever operates the relay's
+// identity issuer (a sign-in service, an embedding host's backend, ...):
+//
+//   <base64url(payloadJSON)>.<base64url(hmacSha256(base64url(payloadJSON)))>
+//
+// The signature is computed over the *encoded* payload segment rather than the
+// decoded object, so verification never has to re-serialize JSON and cannot be
+// defeated by key reordering or whitespace.
+//
+// Identity is opt-in per deployment: with no signing secret configured
+// `verifyIdentityToken` returns null for every token, so a relay that has not
+// been wired to an issuer treats all joiners as anonymous instead of trusting
+// self-reported JSON. `isIdentityConfigured` lets the transports refuse to turn
+// on "require a signed-in account" in that state rather than stranding a host
+// behind a gate nobody can pass.
+
+import type { ParticipantIdentity } from "./protocol";
+import { sanitizeDisplayName } from "./session";
+
+/** Claims carried by an identity token. */
+export interface IdentityTokenPayload {
+  /** Issuing provider, e.g. "geolibre". Defaults to "geolibre" when omitted. */
+  provider?: string;
+  userId: string;
+  username: string;
+  /** Optional expiry, epoch seconds. A token past it is rejected. */
+  exp?: number;
+}
+
+// The package's tsconfig narrows `lib` to ES2022 on purpose (see index.ts) so
+// this code cannot reach for a browser-only global by accident. Web Crypto and
+// the base64 helpers below are present in both a Worker and Node 22, but not in
+// that lib, so declare the exact surface used and nothing more.
+interface HmacSubtleCrypto {
+  importKey(
+    format: "raw",
+    keyData: Uint8Array,
+    algorithm: { name: "HMAC"; hash: "SHA-256" },
+    extractable: boolean,
+    keyUsages: "sign"[],
+  ): Promise<unknown>;
+  sign(algorithm: "HMAC", key: unknown, data: Uint8Array): Promise<ArrayBuffer>;
+}
+
+interface CryptoGlobals {
+  crypto?: { subtle?: HmacSubtleCrypto };
+  atob?: (data: string) => string;
+  btoa?: (data: string) => string;
+  TextEncoder?: new () => { encode(input: string): Uint8Array };
+}
+
+function globals(): CryptoGlobals {
+  return globalThis as unknown as CryptoGlobals;
+}
+
+function encodeUtf8(value: string): Uint8Array {
+  const Encoder = globals().TextEncoder;
+  if (!Encoder) throw new Error("TextEncoder is unavailable");
+  return new Encoder().encode(value);
+}
+
+function base64UrlEncodeBytes(bytes: Uint8Array): string {
+  const btoa = globals().btoa;
+  if (!btoa) throw new Error("btoa is unavailable");
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function base64UrlDecodeToString(segment: string): string | null {
+  const atob = globals().atob;
+  if (!atob) return null;
+  // Reject anything outside the base64url alphabet up front: atob is lenient
+  // about some invalid input, and a token that only *nearly* decodes must not
+  // reach the signature comparison.
+  if (!/^[A-Za-z0-9_-]+$/.test(segment)) return null;
+  const padded = segment.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+    // atob yields one char per byte; decode those bytes as UTF-8 so a non-ASCII
+    // username survives the round trip.
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return utf8Decode(bytes);
+  } catch {
+    return null;
+  }
+}
+
+/** Minimal UTF-8 decode, since TextDecoder is likewise outside the ES2022 lib. */
+function utf8Decode(bytes: Uint8Array): string {
+  let out = "";
+  for (let i = 0; i < bytes.length;) {
+    const b0 = bytes[i];
+    if (b0 < 0x80) {
+      out += String.fromCharCode(b0);
+      i += 1;
+    } else if (b0 >= 0xc0 && b0 < 0xe0) {
+      out += String.fromCharCode(((b0 & 0x1f) << 6) | (bytes[i + 1] & 0x3f));
+      i += 2;
+    } else if (b0 >= 0xe0 && b0 < 0xf0) {
+      out += String.fromCharCode(
+        ((b0 & 0x0f) << 12) | ((bytes[i + 1] & 0x3f) << 6) | (bytes[i + 2] & 0x3f),
+      );
+      i += 3;
+    } else {
+      const cp =
+        ((b0 & 0x07) << 18) |
+        ((bytes[i + 1] & 0x3f) << 12) |
+        ((bytes[i + 2] & 0x3f) << 6) |
+        (bytes[i + 3] & 0x3f);
+      out += String.fromCodePoint(cp);
+      i += 4;
+    }
+  }
+  return out;
+}
+
+async function hmacSha256(secret: string, message: string): Promise<Uint8Array> {
+  const subtle = globals().crypto?.subtle;
+  if (!subtle) throw new Error("Web Crypto is unavailable");
+  const key = await subtle.importKey(
+    "raw",
+    encodeUtf8(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return new Uint8Array(await subtle.sign("HMAC", key, encodeUtf8(message)));
+}
+
+/**
+ * Length-independent, content-constant-time comparison of two base64url
+ * signatures. Compared as strings rather than bytes so a malformed signature
+ * segment (which never decodes) still takes the same path.
+ */
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+/** True when this relay has been given a signing secret and can accept identity. */
+export function isIdentityConfigured(secret: string | undefined | null): secret is string {
+  return typeof secret === "string" && secret.length > 0;
+}
+
+/**
+ * Mint an identity token. Exercised by the relay test suites and usable by an
+ * issuer that runs in the same runtime; a separate issuer only has to reproduce
+ * the two-segment format documented at the top of this file.
+ */
+export async function signIdentityToken(
+  payload: IdentityTokenPayload,
+  secret: string,
+): Promise<string> {
+  const encodedPayload = base64UrlEncodeBytes(encodeUtf8(JSON.stringify(payload)));
+  const signature = base64UrlEncodeBytes(await hmacSha256(secret, encodedPayload));
+  return `${encodedPayload}.${signature}`;
+}
+
+/**
+ * Verify a client-presented identity token and project it onto the wire shape.
+ *
+ * Returns null for every failure mode — no secret configured, malformed token,
+ * bad signature, expired, or missing/mistyped claims — so a caller can treat a
+ * null as "this joiner is anonymous" without distinguishing them. The relays
+ * deliberately do not report *why* a token failed, since that would let a
+ * caller probe for a valid secret.
+ *
+ * @param token The raw `identityToken` field from the join message.
+ * @param secret The relay's configured signing secret, if any.
+ * @param nowMs Current time in epoch ms; injectable so tests can pin expiry.
+ */
+export async function verifyIdentityToken(
+  token: unknown,
+  secret: string | undefined | null,
+  nowMs: number = Date.now(),
+): Promise<ParticipantIdentity | null> {
+  if (!isIdentityConfigured(secret)) return null;
+  if (typeof token !== "string" || !token) return null;
+
+  const dot = token.indexOf(".");
+  if (dot <= 0 || dot !== token.lastIndexOf(".") || dot === token.length - 1) return null;
+  const encodedPayload = token.slice(0, dot);
+  const signature = token.slice(dot + 1);
+
+  let expected: string;
+  try {
+    expected = base64UrlEncodeBytes(await hmacSha256(secret, encodedPayload));
+  } catch {
+    return null;
+  }
+  if (!timingSafeEqual(signature, expected)) return null;
+
+  const json = base64UrlDecodeToString(encodedPayload);
+  if (json === null) return null;
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+
+  const claims = parsed as Record<string, unknown>;
+  if (typeof claims.userId !== "string" || !claims.userId) return null;
+  if (typeof claims.username !== "string" || !claims.username) return null;
+  if (claims.exp !== undefined) {
+    if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp)) return null;
+    if (claims.exp * 1000 <= nowMs) return null;
+  }
+
+  return {
+    provider: typeof claims.provider === "string" && claims.provider ? claims.provider : "geolibre",
+    userId: claims.userId,
+    username: sanitizeDisplayName(claims.username),
+  };
+}
diff --git a/packages/collab-core/src/index.ts b/packages/collab-core/src/index.ts
index 707c50ed87..cb81996d67 100644
--- a/packages/collab-core/src/index.ts
+++ b/packages/collab-core/src/index.ts
@@ -8,5 +8,6 @@
 // reaching for a browser global should be a type error, not a runtime crash.
 
 export * from "./comment-validate";
+export * from "./identity";
 export * from "./protocol";
 export * from "./session";
diff --git a/packages/collab-core/src/protocol.ts b/packages/collab-core/src/protocol.ts
index 0f567bd9b3..ef7de23220 100644
--- a/packages/collab-core/src/protocol.ts
+++ b/packages/collab-core/src/protocol.ts
@@ -81,7 +81,11 @@ export interface JoinMessage {
   hostToken?: string;
   /** Optional invite token carrying a baked-in role. */
   inviteToken?: string;
-  /** Optional identity token verifying the user's account. */
+  /**
+   * Optional HMAC-signed identity credential minted by the relay's issuer. See
+   * `verifyIdentityToken` in `identity.ts` for the format; a relay with no
+   * signing secret configured ignores this field entirely.
+   */
   identityToken?: string;
 }
 
@@ -191,6 +195,12 @@ export interface WelcomeMessage {
   chat: CollabChatMessage[];
   rev: number;
   requireIdentity?: boolean;
+  /**
+   * Whether this relay has an identity issuer configured. False means every
+   * joiner is anonymous and `requireIdentity` cannot be turned on, so the host
+   * UI hides the toggle rather than offering a gate nobody could pass.
+   */
+  identitySupported?: boolean;
   lockedLayerIds?: string[];
   invites?: CollabInvite[];
 }
@@ -264,6 +274,7 @@ export interface ErrorMessage {
     | "bad-message"
     | "not-found"
     | "identity-required"
+    | "identity-unavailable"
     | "layer-locked";
   message: string;
 }
diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index 48be0947c0..bfc88b50fc 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -59,6 +59,16 @@ export function participantCanEditLayer(
   return !lockedLayerIds.includes(layerId);
 }
 
+/**
+ * Stable-ish key a host's block is recorded against.
+ *
+ * Only the identity and invite forms are durable. The `anon:` fallback keys on
+ * a `clientId` the relay mints fresh on every join, so a blocked anonymous
+ * guest is unblocked the moment they reconnect. That is a known limit, not an
+ * oversight: without an identity or an invite there is nothing about an
+ * anonymous joiner to remember. Blocking is a moderation convenience, not a
+ * security boundary — see the *Moderation* section of `docs/collaboration.md`.
+ */
 export function getParticipantKey(
   participant: Pick<SessionParticipant, "clientId" | "identity" | "inviteToken">,
 ): string {
diff --git a/packages/core/src/store.ts b/packages/core/src/store.ts
index 06136e375e..6e1d345e50 100644
--- a/packages/core/src/store.ts
+++ b/packages/core/src/store.ts
@@ -709,6 +709,7 @@ export const DEFAULT_COLLABORATION_STATE: CollaborationState = Object.freeze({
   followHost: false,
   chat: Object.freeze([] as CollaborationChatMessage[]) as CollaborationChatMessage[],
   requireIdentity: false,
+  identitySupported: false,
   lockedLayerIds: Object.freeze([] as string[]) as string[],
   invites: Object.freeze([] as CollabInvite[]) as CollabInvite[],
   error: null,
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index b701becadd..5ffced2446 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -1172,6 +1172,13 @@ export interface CollaborationState {
   chat: CollaborationChatMessage[];
   /** Session flag requiring participants to be signed in. */
   requireIdentity: boolean;
+  /**
+   * Whether the connected relay has an identity issuer configured. False (the
+   * default) means it cannot verify a sign-in, so the host UI hides the
+   * "require a signed-in account" toggle instead of offering a gate that would
+   * lock every guest out.
+   */
+  identitySupported: boolean;
   /** Layer IDs marked locked by the host. */
   lockedLayerIds: string[];
   /** Active session invites minted by host. */
diff --git a/tests/collab-identity.test.ts b/tests/collab-identity.test.ts
new file mode 100644
index 0000000000..c2fe57e18b
--- /dev/null
+++ b/tests/collab-identity.test.ts
@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+  isIdentityConfigured,
+  signIdentityToken,
+  verifyIdentityToken,
+} from "../packages/collab-core/src/index.ts";
+
+const SECRET = "relay-issuer-secret";
+
+describe("collaboration identity tokens", () => {
+  it("round-trips a signed token", async () => {
+    const token = await signIdentityToken(
+      { provider: "geolibre", userId: "u-1", username: "Ada" },
+      SECRET,
+    );
+    assert.deepEqual(await verifyIdentityToken(token, SECRET), {
+      provider: "geolibre",
+      userId: "u-1",
+      username: "Ada",
+    });
+  });
+
+  it("defaults a missing provider and sanitizes the display name", async () => {
+    const token = await signIdentityToken({ userId: "u-2", username: "  Grace  " }, SECRET);
+    assert.deepEqual(await verifyIdentityToken(token, SECRET), {
+      provider: "geolibre",
+      userId: "u-2",
+      username: "Grace",
+    });
+  });
+
+  it("preserves a non-ASCII username through the base64url round trip", async () => {
+    const token = await signIdentityToken({ userId: "u-3", username: "Ada Ökonom 数据" }, SECRET);
+    const identity = await verifyIdentityToken(token, SECRET);
+    assert.equal(identity?.username, "Ada Ökonom 数据");
+  });
+
+  it("rejects a self-asserted token, the shape the relay used to trust", async () => {
+    const raw = JSON.stringify({ provider: "geolibre", userId: "admin", username: "Admin" });
+    assert.equal(await verifyIdentityToken(raw, SECRET), null);
+  });
+
+  it("rejects a token signed with a different secret", async () => {
+    const token = await signIdentityToken({ userId: "u-4", username: "Mallory" }, "other-secret");
+    assert.equal(await verifyIdentityToken(token, SECRET), null);
+  });
+
+  it("rejects a token whose payload was edited after signing", async () => {
+    const token = await signIdentityToken({ userId: "u-5", username: "Ada" }, SECRET);
+    const signature = token.slice(token.indexOf(".") + 1);
+    const forged = Buffer.from(JSON.stringify({ userId: "root", username: "Root" }))
+      .toString("base64url")
+      .concat(".", signature);
+    assert.equal(await verifyIdentityToken(forged, SECRET), null);
+  });
+
+  it("returns null for every token when no secret is configured", async () => {
+    const token = await signIdentityToken({ userId: "u-6", username: "Ada" }, SECRET);
+    assert.equal(await verifyIdentityToken(token, undefined), null);
+    assert.equal(await verifyIdentityToken(token, ""), null);
+  });
+
+  it("honors expiry", async () => {
+    const nowMs = 1_700_000_000_000;
+    const expired = await signIdentityToken(
+      { userId: "u-7", username: "Ada", exp: nowMs / 1000 - 1 },
+      SECRET,
+    );
+    assert.equal(await verifyIdentityToken(expired, SECRET, nowMs), null);
+
+    const live = await signIdentityToken(
+      { userId: "u-7", username: "Ada", exp: nowMs / 1000 + 60 },
+      SECRET,
+    );
+    assert.equal((await verifyIdentityToken(live, SECRET, nowMs))?.userId, "u-7");
+  });
+
+  it("rejects malformed tokens without throwing", async () => {
+    for (const token of [
+      "",
+      "no-dot",
+      ".sig",
+      "payload.",
+      "a.b.c",
+      "not base64!.sig",
+      42,
+      null,
+      undefined,
+      {},
+    ]) {
+      assert.equal(await verifyIdentityToken(token, SECRET), null);
+    }
+  });
+
+  it("rejects a validly signed token missing required claims", async () => {
+    for (const claims of [{}, { userId: "u-8" }, { username: "Ada" }, { userId: 1, username: 2 }]) {
+      const token = await signIdentityToken(claims as never, SECRET);
+      assert.equal(await verifyIdentityToken(token, SECRET), null);
+    }
+  });
+
+  it("reports whether an issuer is configured", () => {
+    assert.equal(isIdentityConfigured(SECRET), true);
+    assert.equal(isIdentityConfigured(""), false);
+    assert.equal(isIdentityConfigured(undefined), false);
+    assert.equal(isIdentityConfigured(null), false);
+  });
+});
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index e0a67935fd..930a7c6ff8 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -15,6 +15,7 @@ import {
   clearParticipantOverrides,
   diffLockedLayers,
   getParticipantKey,
+  isIdentityConfigured,
   normalizeMode,
   participantCanEdit,
   preserveStoredComments,
@@ -26,6 +27,7 @@ import {
   toWireParticipant,
   validateComment,
   validateReply,
+  verifyIdentityToken,
   isBoundedId,
   type ClientMessage,
   type CollabChatMessage,
@@ -90,6 +92,14 @@ function isAllowedOrigin(
 interface Peer {
   socket: WebSocket;
   participant?: SessionParticipant;
+  /**
+   * Tail of this peer's frame-handling chain. `handleMessage` became async when
+   * identity verification did (Web Crypto has no sync HMAC), and `ws` delivers
+   * frames without waiting, so frames are chained rather than started
+   * concurrently — otherwise a `snapshot` sent right behind a `join` could
+   * overtake it and be rejected with "Send a join message first".
+   */
+  queue?: Promise<void>;
 }
 
 interface LiveSession {
@@ -105,6 +115,13 @@ export interface RelayOptions {
   maxSnapshotBytes?: number;
   idleTtlMs?: number;
   trustProxy?: boolean;
+  /**
+   * HMAC-SHA256 secret shared with this deployment's identity issuer, normally
+   * from `COLLAB_IDENTITY_SECRET`. Unset disables identity: `identityToken` is
+   * ignored, every joiner is anonymous, and "require a signed-in account"
+   * cannot be turned on.
+   */
+  identitySecret?: string;
 }
 
 function positive(value: string | undefined, fallback: number): number {
@@ -147,6 +164,8 @@ export function createRelay(options: RelayOptions = {}): {
     options.idleTtlMs ?? positive(process.env.COLLAB_IDLE_TTL_MS, DEFAULT_IDLE_TTL_MS);
   const trustProxy =
     options.trustProxy ?? (process.env.TRUST_PROXY === "true" || process.env.TRUST_PROXY === "1");
+  const identitySecret = options.identitySecret ?? process.env.COLLAB_IDENTITY_SECRET;
+  const identitySupported = isIdentityConfigured(identitySecret);
   const store = new SessionStore(dbPath);
   const sessions = new Map<string, LiveSession>();
   const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
@@ -244,12 +263,12 @@ export function createRelay(options: RelayOptions = {}): {
     }
   }
 
-  function handleMessage(
+  async function handleMessage(
     id: string,
     session: LiveSession,
     peer: Peer,
     raw: WebSocket.RawData,
-  ): void {
+  ): Promise<void> {
     const text = raw.toString();
     let message: ClientMessage;
     try {
@@ -296,24 +315,14 @@ export function createRelay(options: RelayOptions = {}): {
         }
       }
 
-      let identity: ParticipantIdentity | null = null;
-      if (message.identityToken && typeof message.identityToken === "string") {
-        try {
-          const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
-          if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
-            identity = {
-              provider:
-                typeof parsed.provider === "string" && parsed.provider
-                  ? parsed.provider
-                  : "geolibre",
-              userId: parsed.userId,
-              username: sanitizeDisplayName(parsed.username),
-            };
-          }
-        } catch {
-          // Invalid identity token
-        }
-      }
+      // Signature-checked against the configured issuer secret, so `identity`
+      // is only ever non-null for a credential this deployment actually minted.
+      // With no secret configured it is null for every token, making every
+      // joiner anonymous rather than trusting self-reported claims.
+      const identity: ParticipantIdentity | null = await verifyIdentityToken(
+        message.identityToken,
+        identitySecret,
+      );
 
       if (persisted.requireIdentity && !identity && role !== "host") {
         send(peer, {
@@ -380,6 +389,7 @@ export function createRelay(options: RelayOptions = {}): {
         chat: persisted.chat,
         rev: persisted.rev,
         requireIdentity: persisted.requireIdentity,
+        identitySupported,
         lockedLayerIds: persisted.lockedLayerIds,
         ...(welcomeInvites ? { invites: welcomeInvites } : {}),
       });
@@ -527,6 +537,17 @@ export function createRelay(options: RelayOptions = {}): {
       }
       if (message.requireIdentity !== undefined) {
         const req = message.requireIdentity === true;
+        // Refuse to arm a gate no one could pass: without an issuer, every
+        // joiner is anonymous, so turning this on would strand the host's own
+        // session with no way to undo it from a second client.
+        if (req && !identitySupported) {
+          send(peer, {
+            type: "error",
+            code: "identity-unavailable",
+            message: "This relay has no sign-in provider configured.",
+          });
+          return;
+        }
         store.saveSessionConfig(id, req);
         broadcast(session, { type: "session-config", requireIdentity: req });
       }
@@ -775,7 +796,9 @@ export function createRelay(options: RelayOptions = {}): {
     const url = new URL(request.url ?? "/", "http://localhost");
     if (request.method === "OPTIONS") return json(response, 204, null);
     if ((url.pathname === "/" || url.pathname === "/health") && request.method === "GET")
-      return json(response, 200, { ok: true, service: "geolibre-collab" });
+      // `identitySupported` lets the client hide the "require a signed-in
+      // account" option before it ever tries to create a session.
+      return json(response, 200, { ok: true, service: "geolibre-collab", identitySupported });
     if (url.pathname === "/sessions" && request.method === "POST") {
       const origin = request.headers["origin"];
       if (!isAllowedOrigin(origin)) {
@@ -841,6 +864,14 @@ export function createRelay(options: RelayOptions = {}): {
         const reqObj = requested as { mode?: CollaborationMode; requireIdentity?: boolean } | null;
         const mode = normalizeMode(reqObj?.mode);
         const requireIdentity = reqObj?.requireIdentity === true;
+        // Fail the create rather than silently downgrading: a host who asked
+        // for a sign-in gate should hear that this relay has no issuer, not
+        // discover it by watching anonymous guests walk in.
+        if (requireIdentity && !identitySupported) {
+          return json(response, 400, {
+            error: "This relay has no sign-in provider configured.",
+          });
+        }
         for (let attempt = 0; attempt < 5; attempt++) {
           const sessionId = randomCode();
           const hostToken = randomToken();
@@ -885,14 +916,18 @@ export function createRelay(options: RelayOptions = {}): {
           });
           return;
         }
-        // Defence in depth: this listener runs outside any promise chain, so an
-        // throw here is an uncaught exception that stops the whole relay. No
-        // single session's frame should be able to do that to the others.
-        try {
-          handleMessage(id, session, peer, raw);
-        } catch {
-          send(peer, { type: "error", code: "bad-message", message: "Could not handle message." });
-        }
+        // Defence in depth: a throw (or rejection) here would otherwise be an
+        // uncaught exception that stops the whole relay. No single session's
+        // frame should be able to do that to the others.
+        peer.queue = (peer.queue ?? Promise.resolve())
+          .then(() => handleMessage(id, session, peer, raw))
+          .catch(() => {
+            send(peer, {
+              type: "error",
+              code: "bad-message",
+              message: "Could not handle message.",
+            });
+          });
       });
       websocket.on("close", () => closePeer(id, session, peer));
       websocket.on("error", () => closePeer(id, session, peer));
diff --git a/workers/collab-node/test/relay.test.ts b/workers/collab-node/test/relay.test.ts
index 4784f8d065..50e14b1c94 100644
--- a/workers/collab-node/test/relay.test.ts
+++ b/workers/collab-node/test/relay.test.ts
@@ -5,8 +5,12 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, it } from "node:test";
 import { WebSocket } from "ws";
+import { signIdentityToken } from "@geolibre/collab-core";
 import { createRelay } from "../src/server.js";
 
+/** Issuer secret for the identity tests; a relay without one rejects all tokens. */
+const IDENTITY_SECRET = "test-identity-secret";
+
 type Message = Record<string, unknown> & { type: string };
 
 const cleanups: Array<() => Promise<void>> = [];
@@ -83,7 +87,11 @@ describe("Node collaboration relay", () => {
   it("serves health, creates sessions, and rejects unknown websocket routes", async () => {
     const { http } = await start();
     const health = await fetch(`${http}/health`);
-    assert.deepEqual(await health.json(), { ok: true, service: "geolibre-collab" });
+    assert.deepEqual(await health.json(), {
+      ok: true,
+      service: "geolibre-collab",
+      identitySupported: false,
+    });
 
     const created = await createSession(http, "view-only");
     assert.match(created.sessionId, /^[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{8}$/);
@@ -340,7 +348,7 @@ describe("Node collaboration relay", () => {
   });
 
   it("defers invite consumption until after authorization checks succeed", async () => {
-    const { http } = await start();
+    const { http } = await start({ identitySecret: IDENTITY_SECRET });
     const createdRes = await fetch(`${http}/sessions`, {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -402,7 +410,10 @@ describe("Node collaboration relay", () => {
         displayName: "Alice",
         color: "#00ff00",
         inviteToken,
-        identityToken: JSON.stringify({ provider: "geolibre", userId: "user1", username: "Alice" }),
+        identityToken: await signIdentityToken(
+          { provider: "geolibre", userId: "user1", username: "Alice" },
+          IDENTITY_SECRET,
+        ),
       }),
     );
     const welcome = await next(authGuest, "welcome");
@@ -419,7 +430,10 @@ describe("Node collaboration relay", () => {
         displayName: "Bob",
         color: "#ff0000",
         inviteToken,
-        identityToken: JSON.stringify({ provider: "geolibre", userId: "user2", username: "Bob" }),
+        identityToken: await signIdentityToken(
+          { provider: "geolibre", userId: "user2", username: "Bob" },
+          IDENTITY_SECRET,
+        ),
       }),
     );
     const welcome2 = await next(authGuest2, "welcome");
@@ -433,4 +447,63 @@ describe("Node collaboration relay", () => {
     authGuest2.close();
     host.close();
   });
+
+  it("rejects a self-asserted identity token and refuses requireIdentity without an issuer", async () => {
+    // No identitySecret: this relay has no issuer configured.
+    const { http } = await start();
+
+    // A host cannot arm a gate nobody could pass.
+    const refused = await fetch(`${http}/sessions`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ mode: "co-edit", requireIdentity: true }),
+    });
+    assert.equal(refused.status, 400);
+
+    const created = await createSession(http);
+    const guest = await connect(http, created.sessionId);
+    guest.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "client1",
+        displayName: "Mallory",
+        color: "#ffffff",
+        // Raw JSON, the shape the relay used to trust verbatim.
+        identityToken: JSON.stringify({ provider: "geolibre", userId: "admin", username: "Admin" }),
+      }),
+    );
+    const welcome = await next(guest, "welcome");
+    assert.equal(welcome.identitySupported, false);
+    const self = (welcome.participants as { clientId: string; identity: unknown }[]).find(
+      (p) => p.clientId === welcome.clientId,
+    );
+    // Unverified claims must not reach the roster, or the "verified" badge lies.
+    assert.equal(self?.identity, null);
+    guest.close();
+  });
+
+  it("rejects an identity token signed with the wrong secret", async () => {
+    const { http } = await start({ identitySecret: IDENTITY_SECRET });
+    const created = await createSession(http);
+    const guest = await connect(http, created.sessionId);
+    guest.send(
+      JSON.stringify({
+        type: "join",
+        clientId: "client1",
+        displayName: "Mallory",
+        color: "#ffffff",
+        identityToken: await signIdentityToken(
+          { provider: "geolibre", userId: "admin", username: "Admin" },
+          "not-the-relay-secret",
+        ),
+      }),
+    );
+    const welcome = await next(guest, "welcome");
+    assert.equal(welcome.identitySupported, true);
+    const self = (welcome.participants as { clientId: string; identity: unknown }[]).find(
+      (p) => p.clientId === welcome.clientId,
+    );
+    assert.equal(self?.identity, null);
+    guest.close();
+  });
 });
diff --git a/workers/collab/src/index.ts b/workers/collab/src/index.ts
index e481cf08ca..e34f9e4158 100644
--- a/workers/collab/src/index.ts
+++ b/workers/collab/src/index.ts
@@ -9,6 +9,7 @@
 // The session code namespaces the Durable Object (idFromName), so every
 // participant of a session lands on the same actor and gets fanned out to.
 
+import { isIdentityConfigured } from "@geolibre/collab-core";
 import { CollabSession, type Env } from "./session";
 
 export { CollabSession };
@@ -140,6 +141,12 @@ export default {
       };
       const mode = body.mode === "view-only" ? "view-only" : "co-edit";
       const requireIdentity = body.requireIdentity === true;
+      // Fail the create rather than silently downgrading: a host who asked for
+      // a sign-in gate should hear that this relay has no issuer, not discover
+      // it by watching anonymous guests walk in.
+      if (requireIdentity && !isIdentityConfigured(env.COLLAB_IDENTITY_SECRET)) {
+        return json({ error: "This relay has no sign-in provider configured." }, 400);
+      }
       // Retry on the (rare) collision with an existing active session: /init
       // is a no-op when the code is already taken, so without this the caller
       // would receive a hostToken that doesn't match the stored one and be
@@ -173,7 +180,13 @@ export default {
     }
 
     if (url.pathname === "/" || url.pathname === "/health") {
-      return json({ ok: true, service: "geolibre-collab" });
+      // `identitySupported` lets the client hide the "require a signed-in
+      // account" option before it ever tries to create a session.
+      return json({
+        ok: true,
+        service: "geolibre-collab",
+        identitySupported: isIdentityConfigured(env.COLLAB_IDENTITY_SECRET),
+      });
     }
 
     return json({ error: "Not found" }, 404);
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 8eb26ff559..154f3f0b54 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -27,6 +27,7 @@ import {
   diffLockedLayers,
   EMPTY_SESSION_TTL_MS,
   getParticipantKey,
+  isIdentityConfigured,
   MAX_CHAT_STORAGE_BYTES,
   MAX_CHAT_TEXT_LENGTH,
   MAX_SNAPSHOT_BYTES,
@@ -40,6 +41,7 @@ import {
   sanitizeView,
   setParticipantOverride,
   toWireParticipant,
+  verifyIdentityToken,
   type SessionParticipant,
 } from "@geolibre/collab-core";
 
@@ -60,6 +62,13 @@ export interface Env {
   COLLAB_MAX_SNAPSHOT_BYTES?: string;
   /** Optional allowed origins list for session creation. */
   ALLOWED_ORIGINS?: string;
+  /**
+   * HMAC-SHA256 secret shared with this deployment's identity issuer. Unset
+   * (the default) disables identity entirely: `identityToken` is ignored, every
+   * joiner is anonymous, and "require a signed-in account" cannot be turned on.
+   * Set it with `wrangler secret put COLLAB_IDENTITY_SECRET`.
+   */
+  COLLAB_IDENTITY_SECRET?: string;
 }
 
 // The snapshot cap, empty-session TTL, and chat limits now live in
@@ -478,22 +487,14 @@ export class CollabSession extends DurableObject<Env> {
       }
     }
 
-    let identity: ParticipantIdentity | null = null;
-    if (message.identityToken && typeof message.identityToken === "string") {
-      try {
-        const parsed = JSON.parse(message.identityToken) as ParticipantIdentity;
-        if (parsed && typeof parsed.userId === "string" && typeof parsed.username === "string") {
-          identity = {
-            provider:
-              typeof parsed.provider === "string" && parsed.provider ? parsed.provider : "geolibre",
-            userId: parsed.userId,
-            username: sanitizeDisplayName(parsed.username),
-          };
-        }
-      } catch {
-        // Invalid token
-      }
-    }
+    // Signature-checked against COLLAB_IDENTITY_SECRET, so `identity` is only
+    // ever non-null for a credential this deployment's issuer actually minted.
+    // A relay with no secret configured yields null for every token, making
+    // every joiner anonymous rather than trusting self-reported claims.
+    const identity: ParticipantIdentity | null = await verifyIdentityToken(
+      message.identityToken,
+      this.env.COLLAB_IDENTITY_SECRET,
+    );
 
     if (requireIdentity && !identity && role !== "host") {
       this.send(ws, {
@@ -561,6 +562,7 @@ export class CollabSession extends DurableObject<Env> {
       chat: parseStoredChat(chat),
       rev: rev ?? 0,
       requireIdentity: requireIdentity ?? false,
+      identitySupported: isIdentityConfigured(this.env.COLLAB_IDENTITY_SECRET),
       lockedLayerIds: lockedLayerIds ?? [],
       ...(welcomeInvites ? { invites: welcomeInvites } : {}),
     });
@@ -1128,6 +1130,17 @@ export class CollabSession extends DurableObject<Env> {
     }
     if (message.requireIdentity !== undefined) {
       const req = message.requireIdentity === true;
+      // Refuse to arm a gate no one could pass: without an issuer, every
+      // joiner is anonymous, so turning this on would strand the host's own
+      // session with no way to undo it from a second client.
+      if (req && !isIdentityConfigured(this.env.COLLAB_IDENTITY_SECRET)) {
+        this.send(ws, {
+          type: "error",
+          code: "identity-unavailable",
+          message: "This relay has no sign-in provider configured.",
+        });
+        return;
+      }
       await this.ctx.storage.put("requireIdentity", req);
       this.broadcast({ type: "session-config", requireIdentity: req });
     }

From a203d5fd8fa486979e11890dea02b160cd528b6c Mon Sep 17 00:00:00 2001
From: giswqs <giswqs@gmail.com>
Date: Thu, 13 Aug 2026 09:38:29 -0400
Subject: [PATCH 13/15] Address Claude review feedback

- Correct the docs' "durable across reconnect" claim for `set-participant-mode`.
  A persisted per-participant override is keyed the same way a block is, so it
  survives a reconnect only for identity- and invite-based joins; an anonymous
  guest gets a fresh `clientId`, a fresh participant key, and reverts to the
  session default. `getParticipantKey` now names the override alongside the
  block in the same caveat.
---
 docs/collaboration.md               | 16 ++++++++++------
 packages/collab-core/src/session.ts | 14 ++++++++------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/docs/collaboration.md b/docs/collaboration.md
index b02657741a..ca254aba74 100644
--- a/docs/collaboration.md
+++ b/docs/collaboration.md
@@ -67,7 +67,7 @@ Client → server:
 | `snapshot` | `project, rev` | a debounced project push; co-editors only |
 | `presence` | `cursor?, view?` | throttled cursor / viewport |
 | `set-mode` | `mode` | host only |
-| `set-participant-mode` | `clientId, canEdit` | host only; pin one guest to can-edit / view-only (#754, durable across reconnect) |
+| `set-participant-mode` | `clientId, canEdit` | host only; pin one guest to can-edit / view-only (#754; persisted per participant key, so it survives a reconnect only for identity/invite joins — see *Moderation*) |
 | `mint-invite` | `role, maxUses?` | host only; mint a co-edit or view-only invite link |
 | `revoke-invite` | `token` | host only; invalidate an active invite link |
 | `set-session-config` | `requireIdentity` | host only; mandate signed-in identity to join |
@@ -177,10 +177,13 @@ field (`true` / `false`, or `null` to follow the session mode). Effective edit
 permission, computed identically on the client and the relay, is: the host
 always edits; otherwise the override wins; otherwise the session mode applies. A
 guest pinned to view-only has their `snapshot` pushes rejected with
-`error: forbidden`, exactly like the session-wide view-only path. Overrides are
-keyed to the per-socket `clientId`, so a guest who reconnects reverts to the
-session default (acceptable for the ephemeral MVP). The host roster surfaces a
-per-guest toggle; other participants see each guest's current permission read-only.
+`error: forbidden`, exactly like the session-wide view-only path. An override is
+also persisted against the guest's **participant key**, so it is reapplied when
+they rejoin — but only for identity- and invite-based joins, for the same reason
+a block is (see *Moderation* below): an anonymous guest arrives with a fresh
+`clientId` and therefore a fresh key, so their override reverts to the session
+default on reconnect. The host roster surfaces a per-guest toggle; other
+participants see each guest's current permission read-only.
 
 The host token (returned only to the creator) gates `set-mode` and
 `set-participant-mode`, so a guest can't escalate the session or another guest.
@@ -229,7 +232,8 @@ their **participant key** so the relay refuses the next join. That key is
 join, and otherwise `anon:<clientId>` — where `clientId` is minted fresh on
 every join.
 
-So a block is durable only for identity- and invite-based joins. **An anonymous
+The same key backs a persisted per-participant override, so both carry the same
+caveat: a block is durable only for identity- and invite-based joins. **An anonymous
 guest can rejoin simply by reconnecting**, since they arrive with a new
 `clientId` and therefore a new key. Blocking is a moderation convenience, not a
 security boundary; a session that needs an enforceable ban has to require an
diff --git a/packages/collab-core/src/session.ts b/packages/collab-core/src/session.ts
index bfc88b50fc..e560e233b7 100644
--- a/packages/collab-core/src/session.ts
+++ b/packages/collab-core/src/session.ts
@@ -60,14 +60,16 @@ export function participantCanEditLayer(
 }
 
 /**
- * Stable-ish key a host's block is recorded against.
+ * Stable-ish key a host's block and persisted edit override are recorded
+ * against.
  *
  * Only the identity and invite forms are durable. The `anon:` fallback keys on
- * a `clientId` the relay mints fresh on every join, so a blocked anonymous
- * guest is unblocked the moment they reconnect. That is a known limit, not an
- * oversight: without an identity or an invite there is nothing about an
- * anonymous joiner to remember. Blocking is a moderation convenience, not a
- * security boundary — see the *Moderation* section of `docs/collaboration.md`.
+ * a `clientId` the relay mints fresh on every join, so for an anonymous guest
+ * both a block and an override are forgotten the moment they reconnect. That is
+ * a known limit, not an oversight: without an identity or an invite there is
+ * nothing about an anonymous joiner to remember, and any client-supplied handle
+ * is trivially reset. Blocking is a moderation convenience, not a security
+ * boundary — see the *Moderation* section of `docs/collaboration.md`.
  */
 export function getParticipantKey(
   participant: Pick<SessionParticipant, "clientId" | "identity" | "inviteToken">,

From c8fc3e19017e7cc80a30ac24cda56bef588dc4c6 Mon Sep 17 00:00:00 2001
From: HarshShinde0 <harshinde.hks@gmail.com>
Date: Fri, 14 Aug 2026 01:00:30 +0530
Subject: [PATCH 14/15] feat(collab): add proactive layer locking UI feedback
 and host controls

---
 .../components/layout/CollaborateDialog.tsx   |  10 +-
 .../src/components/layout/DesktopShell.tsx    |   2 +
 .../src/components/panels/LayerPanel.tsx      | 107 ++++++++++++++++--
 .../src/hooks/useCollaboration.ts             |  21 +++-
 .../geolibre-desktop/src/i18n/locales/en.json |   6 +-
 workers/collab-node/src/server.ts             |  12 +-
 workers/collab-node/src/store.ts              |  18 +++
 workers/collab/src/session.ts                 |  28 ++++-
 8 files changed, 180 insertions(+), 24 deletions(-)

diff --git a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
index 4aeb1767d3..6fcc980692 100644
--- a/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
+++ b/apps/geolibre-desktop/src/components/layout/CollaborateDialog.tsx
@@ -145,8 +145,13 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
     try {
       await api.start(name.trim(), color, mode, requireIdentity);
     } catch (err) {
+      // Show a localized message; keep the raw error in the console for
+      // diagnostics. When the relay sends a specific rejection reason
+      // (identity-required, forbidden, etc.) it arrives as err.message;
+      // fall back to the generic string for unexpected failures.
       console.error("[GeoLibre] Collaboration error", err);
-      setError(t("collaborate.connectFailed"));
+      const message = err instanceof Error && err.message ? err.message : undefined;
+      setError(message || t("collaborate.connectFailed"));
     } finally {
       setBusy(false);
     }
@@ -167,7 +172,8 @@ export function CollaborateDialog({ open, onOpenChange, api }: CollaborateDialog
       await api.join(code.trim(), name.trim(), color);
     } catch (err) {
       console.error("[GeoLibre] Collaboration error", err);
-      setError(t("collaborate.connectFailed"));
+      const message = err instanceof Error && err.message ? err.message : undefined;
+      setError(message || t("collaborate.connectFailed"));
       setInvited(false);
     } finally {
       setBusy(false);
diff --git a/apps/geolibre-desktop/src/components/layout/DesktopShell.tsx b/apps/geolibre-desktop/src/components/layout/DesktopShell.tsx
index 4fa3a303ce..15ecc8db5b 100644
--- a/apps/geolibre-desktop/src/components/layout/DesktopShell.tsx
+++ b/apps/geolibre-desktop/src/components/layout/DesktopShell.tsx
@@ -2278,6 +2278,7 @@ export function DesktopShell({
                   renderBuiltin={({ collapsed, onCollapsedChange }) => (
                     <LayerPanel
                       mapControllerRef={mapControllerRef}
+                      collaborationApi={collaboration}
                       onResizeStart={startLayerPanelResize}
                       geometryEditLayerId={geometryEditLayerId}
                       onToggleGeometryEdit={handleToggleGeometryEdit}
@@ -2304,6 +2305,7 @@ export function DesktopShell({
                 ) : (
                   <LayerPanel
                     mapControllerRef={mapControllerRef}
+                    collaborationApi={collaboration}
                     onResizeStart={startLayerPanelResize}
                     geometryEditLayerId={geometryEditLayerId}
                     onToggleGeometryEdit={handleToggleGeometryEdit}
diff --git a/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx b/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
index e03476492c..bb5632b30e 100644
--- a/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
+++ b/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
@@ -149,6 +149,7 @@ import {
   Layers,
   Library,
   Locate,
+  Lock,
   Map as MapIcon,
   MoreHorizontal,
   MousePointerClick,
@@ -170,6 +171,7 @@ import {
   TableProperties,
   Timer,
   Trash2,
+  Unlock,
   Upload,
   X,
   ZoomIn,
@@ -228,12 +230,15 @@ import {
 import { IS_MAS_BUILD } from "../../lib/build-flags";
 import { isTauri } from "../../lib/is-tauri";
 import { getNetcdfLayerState } from "../../lib/netcdf-image-symbology";
+import { participantCanEditLayer } from "../../lib/collab-protocol";
+import type { CollaborationApi } from "../../hooks/useCollaboration";
 import { BasemapPickerDialog } from "./BasemapPickerDialog";
 import { LayerPanelPlaceSearch } from "./LayerPanelPlaceSearch";
 import { LayerSwatchIcon } from "./LayerSwatchIcon";
 
 interface LayerPanelProps {
   mapControllerRef: RefObject<MapController | null>;
+  collaborationApi?: CollaborationApi;
   onResizeStart: (event: ReactPointerEvent<HTMLDivElement>) => void;
   /** Id of the layer currently in a geometry-edit session, or null. */
   geometryEditLayerId: string | null;
@@ -611,6 +616,7 @@ function hasNativeIdentifyLayers(layer: GeoLibreLayer): boolean {
 
 export function LayerPanel({
   mapControllerRef,
+  collaborationApi,
   onResizeStart,
   geometryEditLayerId,
   onToggleGeometryEdit,
@@ -706,6 +712,40 @@ export function LayerPanel({
   const setRasterAttributeTableOpen = useAppStore((s) => s.setRasterAttributeTableOpen);
   const setLoadEditorFeaturesOpen = useAppStore((s) => s.setLoadEditorFeaturesOpen);
   const setSqlWorkspaceOpen = useAppStore((s) => s.setSqlWorkspaceOpen);
+  const collaboration = useAppStore((s) => s.collaboration);
+  const selfParticipant = useMemo(() => {
+    if (!collaboration.isActive || !collaboration.clientId) return null;
+    return collaboration.participants.find((p) => p.clientId === collaboration.clientId) ?? null;
+  }, [collaboration.isActive, collaboration.clientId, collaboration.participants]);
+
+  const canEditLayer = useCallback(
+    (layerId: string): boolean => {
+      if (!collaboration.isActive) return true;
+      if (collaborationApi?.canEditLayer) return collaborationApi.canEditLayer(layerId);
+      if (!selfParticipant) {
+        if (collaboration.role === "host") return true;
+        return (
+          collaboration.mode === "co-edit" &&
+          !(collaboration.lockedLayerIds ?? []).includes(layerId)
+        );
+      }
+      return participantCanEditLayer(
+        selfParticipant,
+        collaboration.mode,
+        layerId,
+        collaboration.lockedLayerIds ?? [],
+      );
+    },
+    [
+      collaboration.isActive,
+      collaboration.role,
+      collaboration.mode,
+      collaboration.lockedLayerIds,
+      selfParticipant,
+      collaborationApi,
+    ],
+  );
+
   const [editingLayerId, setEditingLayerId] = useState<string | null>(null);
   const [editingName, setEditingName] = useState("");
   const [basemapPickerOpen, setBasemapPickerOpen] = useState(false);
@@ -3087,6 +3127,9 @@ export function LayerPanel({
             // dismissed (and its on-map icon removed) when closed.
             const canEditRasterStyle = layer.metadata.sourceKind === RASTER_SOURCE_KIND;
             const canRefresh = isRefreshableLayer(layer);
+            const isLayerLocked =
+              collaboration.isActive && (collaboration.lockedLayerIds ?? []).includes(layer.id);
+            const layerEditable = canEditLayer(layer.id);
             const refreshConfig = getLayerRefreshConfig(layer);
             // Live SQL query layers (issue #1295) refresh by re-running their
             // stored DuckDB statement and offer a shortcut to edit it.
@@ -3238,18 +3281,28 @@ export function LayerPanel({
                             groupHidden ? "text-muted-foreground" : ""
                           }`}
                           title={
-                            groupHidden
-                              ? `${t("layers.hiddenByGroup")} — ${t("layers.doubleClickToRename")}`
-                              : t("layers.doubleClickToRename")
+                            isLayerLocked
+                              ? t("collaborate.layerLockedHint")
+                              : groupHidden
+                                ? `${t("layers.hiddenByGroup")} — ${t("layers.doubleClickToRename")}`
+                                : t("layers.doubleClickToRename")
                           }
                           onDoubleClick={(e: ReactMouseEvent) => {
                             e.stopPropagation();
-                            beginRename(layer);
+                            if (layerEditable) beginRename(layer);
                           }}
                         >
                           {layer.name}
                         </span>
                       )}
+                      {isLayerLocked && (
+                        <span title={t("collaborate.layerLockedHint")}>
+                          <Lock
+                            className="h-3 w-3 shrink-0 text-amber-500"
+                            aria-label={t("collaborate.layerLockedHint")}
+                          />
+                        </span>
+                      )}
                       <span className="shrink-0 text-[10px] uppercase text-muted-foreground">
                         {layerTypeLabel(layer, t)}
                       </span>
@@ -3396,13 +3449,40 @@ export function LayerPanel({
                           align="end"
                           onClick={(e: ReactMouseEvent) => e.stopPropagation()}
                         >
-                          {/* Rename is always available — name is a display-only
-                          label, so no per-layer-type guard is needed here.
+                          {collaboration.isActive && collaboration.role === "host" && (
+                            <>
+                              <DropdownMenuItem
+                                onSelect={() => {
+                                  const currentLocks = collaboration.lockedLayerIds ?? [];
+                                  const nextLocks = currentLocks.includes(layer.id)
+                                    ? currentLocks.filter((id) => id !== layer.id)
+                                    : [...currentLocks, layer.id];
+                                  collaborationApi?.setLayerLocks(nextLocks);
+                                }}
+                              >
+                                {isLayerLocked ? (
+                                  <>
+                                    <Unlock className="me-2 h-3.5 w-3.5 text-amber-500" />
+                                    {t("collaborate.unlockLayer")}
+                                  </>
+                                ) : (
+                                  <>
+                                    <Lock className="me-2 h-3.5 w-3.5" />
+                                    {t("collaborate.lockLayer")}
+                                  </>
+                                )}
+                              </DropdownMenuItem>
+                              <DropdownMenuSeparator />
+                            </>
+                          )}
+                          {/* Rename is available when layer is editable.
                           preventDefault keeps the menu's default close from
                           racing autoFocus on the rename input. */}
                           <DropdownMenuItem
+                            disabled={!layerEditable}
                             onSelect={(e: Event) => {
                               e.preventDefault();
+                              if (!layerEditable) return;
                               beginRename(layer);
                             }}
                           >
@@ -3476,7 +3556,9 @@ export function LayerPanel({
                           {canMaterializeDuckDB && (
                             <>
                               <DropdownMenuItem
+                                disabled={!layerEditable}
                                 onSelect={() => {
+                                  if (!layerEditable) return;
                                   onMaterializeDuckDBLayer(layer);
                                 }}
                               >
@@ -3488,8 +3570,9 @@ export function LayerPanel({
                           )}
                           {(canEditGeometry || geometryEditActive) && (
                             <DropdownMenuItem
-                              disabled={geometryEditElsewhere}
+                              disabled={geometryEditElsewhere || !layerEditable}
                               onSelect={() => {
+                                if (!layerEditable) return;
                                 selectLayer(layer.id);
                                 if (identifyActive) setIdentifyLayer(null);
                                 onToggleGeometryEdit(layer.id);
@@ -3503,7 +3586,9 @@ export function LayerPanel({
                           )}
                           {canLoadIntoEditor && (
                             <DropdownMenuItem
+                              disabled={!layerEditable}
                               onSelect={() => {
+                                if (!layerEditable) return;
                                 selectLayer(layer.id);
                                 setLoadEditorFeaturesOpen(true, layer.id);
                               }}
@@ -4026,11 +4111,15 @@ export function LayerPanel({
                       <Button
                         variant="ghost"
                         size="icon"
-                        className="h-7 w-7 text-destructive"
-                        title={t("layers.removeLayer")}
+                        className="h-7 w-7 text-destructive disabled:opacity-40"
+                        title={
+                          !layerEditable ? t("collaborate.layerLockedHint") : t("layers.removeLayer")
+                        }
                         aria-label={t("layers.removeLayer")}
+                        disabled={!layerEditable}
                         onClick={(e) => {
                           e.stopPropagation();
+                          if (!layerEditable) return;
                           setLayerPendingRemoval(layer);
                         }}
                       >
diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index 3331df69f9..1ec8a60ae6 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -24,7 +24,7 @@ import {
   resolveCollabBaseUrl,
   sessionWsUrl,
 } from "../lib/collab-client";
-import type { CommentMutationAction, ServerMessage } from "../lib/collab-protocol";
+import { type CommentMutationAction, type ServerMessage, participantCanEditLayer } from "../lib/collab-protocol";
 import { mergeInboundCollaborationProject } from "../lib/collaboration-project";
 
 const SNAPSHOT_DEBOUNCE_MS = 250;
@@ -33,6 +33,7 @@ const CURSOR_THROTTLE_MS = 40;
 export interface CollaborationApi {
   enabled: boolean;
   canEdit: () => boolean;
+  canEditLayer: (layerId: string) => boolean;
   start: (
     displayName: string,
     color: string,
@@ -95,6 +96,17 @@ export function useCollaboration(
     return self?.editOverride ?? c.mode === "co-edit";
   };
 
+  const canEditLayer = useCallback((layerId: string): boolean => {
+    const c = useAppStore.getState().collaboration;
+    if (!c.isActive) return true;
+    if (c.role === "host") return true;
+    const self = c.participants.find((p) => p.clientId === c.clientId);
+    if (!self) {
+      return c.mode === "co-edit" && !(c.lockedLayerIds ?? []).includes(layerId);
+    }
+    return participantCanEditLayer(self, c.mode, layerId, c.lockedLayerIds ?? []);
+  }, []);
+
   const sendSnapshot = async (): Promise<void> => {
     if (!canEdit() || syncPausedRef.current) return;
     const request = ++snapshotRequestRef.current;
@@ -300,9 +312,6 @@ export function useCollaboration(
       if (projectChanged(state, prev)) scheduleSnapshot();
     });
 
-    const map = mapControllerRef.current?.getMap() ?? null;
-    const detachMap = map ? bindPresence(map, conn) : () => {};
-
     conn.send({
       type: "join",
       clientId: selfIdRef.current ?? crypto.randomUUID(),
@@ -313,6 +322,9 @@ export function useCollaboration(
       identityToken,
     });
 
+    const map = mapControllerRef.current?.getMap() ?? null;
+    const detachMap = map ? bindPresence(map, conn) : () => {};
+
     teardownRef.current = () => {
       if (debounce) clearTimeout(debounce);
       unsubscribe();
@@ -519,6 +531,7 @@ export function useCollaboration(
   return {
     enabled,
     canEdit,
+    canEditLayer,
     start,
     join,
     leave,
diff --git a/apps/geolibre-desktop/src/i18n/locales/en.json b/apps/geolibre-desktop/src/i18n/locales/en.json
index 60d7e98d64..b6e41b97fb 100644
--- a/apps/geolibre-desktop/src/i18n/locales/en.json
+++ b/apps/geolibre-desktop/src/i18n/locales/en.json
@@ -1203,7 +1203,11 @@
     "chatLocationAttached": "Location attached (click to remove)",
     "chatGoToLocation": "Go to this location",
     "sessionStatusUnread_one": "Live collaboration session, {{count}} unread message. Click to see who's connected and chat.",
-    "sessionStatusUnread_other": "Live collaboration session, {{count}} unread messages. Click to see who's connected and chat."
+    "sessionStatusUnread_other": "Live collaboration session, {{count}} unread messages. Click to see who's connected and chat.",
+    "lockLayer": "Lock layer for guests",
+    "unlockLayer": "Unlock layer for guests",
+    "layerLocked": "Locked",
+    "layerLockedHint": "This layer is locked by the host and cannot be edited"
   },
   "share": {
     "title": "Share project",
diff --git a/workers/collab-node/src/server.ts b/workers/collab-node/src/server.ts
index 930a7c6ff8..2eef822d4c 100644
--- a/workers/collab-node/src/server.ts
+++ b/workers/collab-node/src/server.ts
@@ -362,8 +362,14 @@ export function createRelay(options: RelayOptions = {}): {
       }
 
       if (matchedInvite) {
-        matchedInvite.useCount += 1;
-        store.saveInvite(id, matchedInvite);
+        // Use an atomic SQL UPDATE to close the TOCTOU window: the initial
+        // maxUses check (line 312) happened before `await verifyIdentityToken`,
+        // and another join could have consumed the invite in the meantime.
+        if (!store.atomicClaimInvite(id, matchedInvite.token)) {
+          // Invite was consumed or revoked between the initial check and now.
+          matchedInvite = undefined;
+          inviteToken = undefined;
+        }
       }
 
       peer.participant = {
@@ -800,7 +806,7 @@ export function createRelay(options: RelayOptions = {}): {
       // account" option before it ever tries to create a session.
       return json(response, 200, { ok: true, service: "geolibre-collab", identitySupported });
     if (url.pathname === "/sessions" && request.method === "POST") {
-      const origin = request.headers["origin"];
+      const origin = request.headers["origin"] ?? request.headers["referer"];
       if (!isAllowedOrigin(origin)) {
         return json(response, 403, { error: "Forbidden origin" });
       }
diff --git a/workers/collab-node/src/store.ts b/workers/collab-node/src/store.ts
index 6554335495..15f8b78a91 100644
--- a/workers/collab-node/src/store.ts
+++ b/workers/collab-node/src/store.ts
@@ -184,6 +184,24 @@ export class SessionStore {
       );
   }
 
+  /**
+   * Atomically increment an invite's use_count, succeeding only if the invite
+   * is not revoked and has not exceeded its maxUses cap. Returns true if the
+   * claim succeeded. This closes a TOCTOU window where two near-simultaneous
+   * joins could both read use_count < max_uses before either writes.
+   */
+  atomicClaimInvite(sessionId: string, token: string): boolean {
+    const result = this.db
+      .prepare(
+        `UPDATE collab_invites
+         SET use_count = use_count + 1
+         WHERE session_id = ? AND token = ? AND revoked = 0
+           AND (max_uses IS NULL OR use_count < max_uses)`,
+      )
+      .run(sessionId, token);
+    return result.changes === 1;
+  }
+
   createInvite(sessionId: string, invite: CollabInvite): void {
     this.saveInvite(sessionId, invite);
   }
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index 154f3f0b54..a56879091f 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -534,8 +534,24 @@ export class CollabSession extends DurableObject<Env> {
     }
 
     if (matchedInvite) {
-      matchedInvite.useCount += 1;
-      this.writeInvite(matchedInvite);
+      // Re-read the invite after the `await verifyIdentityToken` above to close
+      // a TOCTOU window: two concurrent joins on a maxUses:1 invite could both
+      // have read useCount:0 before either writes. Re-validating here narrows
+      // the race to the synchronous path between read and write.
+      const inviteTokenToCheck = matchedInvite.token;
+      const freshInvites = this.readInvites();
+      const freshInv = freshInvites.find(
+        (i) => i.token === inviteTokenToCheck && !i.revoked,
+      );
+      if (!freshInv || (freshInv.maxUses && freshInv.useCount >= freshInv.maxUses)) {
+        // Invite was consumed or revoked between the initial check and now.
+        matchedInvite = undefined;
+        inviteToken = undefined;
+      } else {
+        freshInv.useCount += 1;
+        this.writeInvite(freshInv);
+        matchedInvite = freshInv;
+      }
     }
 
     const attachment: SocketAttachment = {
@@ -576,11 +592,13 @@ export class CollabSession extends DurableObject<Env> {
     message: Extract<ClientMessage, { type: "snapshot" }>,
     byteLength: number,
   ): Promise<void> {
-    const [mode, lockedLayerIds, storedRaw] = await Promise.all([
-      (await this.ctx.storage.get<CollaborationMode>("mode")) ?? "co-edit",
-      (await this.ctx.storage.get<string[]>("lockedLayerIds")) ?? [],
+    const [rawMode, rawLockedLayerIds, storedRaw] = await Promise.all([
+      this.ctx.storage.get<CollaborationMode>("mode"),
+      this.ctx.storage.get<string[]>("lockedLayerIds"),
       this.readSnapshot(),
     ]);
+    const mode = rawMode ?? "co-edit";
+    const lockedLayerIds = rawLockedLayerIds ?? [];
     const storedSnapshot = parseStoredSnapshot(storedRaw);
 
     const decision = authorizeSnapshot(

From 4cf136d5cb85ac8c7211e90e12212028f675c8f6 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:30:46 +0000
Subject: [PATCH 15/15] style: auto-format (ruff + oxfmt) [pre-commit.ci]

---
 apps/geolibre-desktop/src/components/panels/LayerPanel.tsx | 4 +++-
 apps/geolibre-desktop/src/hooks/useCollaboration.ts        | 6 +++++-
 workers/collab/src/session.ts                              | 4 +---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx b/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
index bb5632b30e..facd73221b 100644
--- a/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
+++ b/apps/geolibre-desktop/src/components/panels/LayerPanel.tsx
@@ -4113,7 +4113,9 @@ export function LayerPanel({
                         size="icon"
                         className="h-7 w-7 text-destructive disabled:opacity-40"
                         title={
-                          !layerEditable ? t("collaborate.layerLockedHint") : t("layers.removeLayer")
+                          !layerEditable
+                            ? t("collaborate.layerLockedHint")
+                            : t("layers.removeLayer")
                         }
                         aria-label={t("layers.removeLayer")}
                         disabled={!layerEditable}
diff --git a/apps/geolibre-desktop/src/hooks/useCollaboration.ts b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
index 1ec8a60ae6..616c37077c 100644
--- a/apps/geolibre-desktop/src/hooks/useCollaboration.ts
+++ b/apps/geolibre-desktop/src/hooks/useCollaboration.ts
@@ -24,7 +24,11 @@ import {
   resolveCollabBaseUrl,
   sessionWsUrl,
 } from "../lib/collab-client";
-import { type CommentMutationAction, type ServerMessage, participantCanEditLayer } from "../lib/collab-protocol";
+import {
+  type CommentMutationAction,
+  type ServerMessage,
+  participantCanEditLayer,
+} from "../lib/collab-protocol";
 import { mergeInboundCollaborationProject } from "../lib/collaboration-project";
 
 const SNAPSHOT_DEBOUNCE_MS = 250;
diff --git a/workers/collab/src/session.ts b/workers/collab/src/session.ts
index a56879091f..5c9bb5e93f 100644
--- a/workers/collab/src/session.ts
+++ b/workers/collab/src/session.ts
@@ -540,9 +540,7 @@ export class CollabSession extends DurableObject<Env> {
       // the race to the synchronous path between read and write.
       const inviteTokenToCheck = matchedInvite.token;
       const freshInvites = this.readInvites();
-      const freshInv = freshInvites.find(
-        (i) => i.token === inviteTokenToCheck && !i.revoked,
-      );
+      const freshInv = freshInvites.find((i) => i.token === inviteTokenToCheck && !i.revoked);
       if (!freshInv || (freshInv.maxUses && freshInv.useCount >= freshInv.maxUses)) {
         // Invite was consumed or revoked between the initial check and now.
         matchedInvite = undefined;