fix: allow share-link users to view/edit and autosave via share token

Users without personal document access can still load/save state when
a valid share token is present, matching the permission level granted
by the share link.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

frontend/src/api/document.ts

@@ -64,12 +64,16 @@ export const documentsApi = {
   },
 
   // Update document Yjs state
-  updateState: async (id: string, state: Uint8Array): Promise<void> => {
+  updateState: async (id: string, state: Uint8Array, shareToken?: string): Promise<void> => {
     // Create a new ArrayBuffer copy to ensure compatibility
     const buffer = new ArrayBuffer(state.byteLength);
     new Uint8Array(buffer).set(state);
 
-    const response = await authFetch(`${API_BASE_URL}/documents/${id}/state`, {
+    const url = shareToken
+      ? `${API_BASE_URL}/documents/${id}/state?share=${shareToken}`
+      : `${API_BASE_URL}/documents/${id}/state`;
+
+    const response = await authFetch(url, {
       method: "PUT",
       headers: { "Content-Type": "application/octet-stream" },
       body: buffer,

frontend/src/hooks/useAutoSave.ts

@@ -2,7 +2,7 @@ import { useEffect, useRef } from 'react';
 import * as Y from 'yjs';
 import { documentsApi } from '../api/document';
 
-export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
+export const useAutoSave = (documentId: string, ydoc: Y.Doc | null, shareToken?: string) => {
   const saveTimeoutRef = useRef<number | null>(null);
   const isSavingRef = useRef(false);
 
@@ -25,7 +25,7 @@ export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
         isSavingRef.current = true;
         try {
           const state = Y.encodeStateAsUpdate(ydoc);
-          await documentsApi.updateState(documentId, state);
+          await documentsApi.updateState(documentId, state, shareToken);
           console.log('✓ Document saved to database');
         } catch (error) {
           console.error('Failed to save document:', error);
@@ -44,5 +44,5 @@ export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
         clearTimeout(saveTimeoutRef.current);
       }
     };
-  }, [documentId, ydoc]);
+  }, [documentId, ydoc, shareToken]);
 };

frontend/src/hooks/useYjsDocument.ts

@@ -17,7 +17,7 @@ export const useYjsDocument = (documentId: string, shareToken?: string) => {
   const [role, setRole] = useState<string | null>(null);
 
   // Enable auto-save when providers are ready
-  useAutoSave(documentId, providers?.ydoc || null);
+  useAutoSave(documentId, providers?.ydoc || null, shareToken);
 
   // Fetch permission when component mounts
   useEffect(() => {