fix(realtime): leave the prior table room only once the join is certain

A table switch left the previous room before the access re-check ran, so a
denial there aborted the join and left the client in no table room at all —
silently dropped from one it may still be allowed to occupy. The leave now
happens after the re-check, matching the file-doc and workspace-list joins.

Author: waleedlatif1

apps/realtime/src/handlers/tables.test.ts

@@ -3,6 +3,7 @@
  */
 import { ROOM_TYPES } from '@sim/realtime-protocol/rooms'
 import { TABLE_PRESENCE_EVENTS } from '@sim/realtime-protocol/table-presence'
+import { sleep } from '@sim/utils/helpers'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { IRoomManager } from '@/rooms'
 
@@ -296,6 +297,55 @@ describe('setupTablesHandlers', () => {
     }
   })
 
+  it('keeps the prior table room when a switch is denied at the access re-check', async () => {
+    // A denied switch must not silently drop the client from a table it may still be
+    // allowed to occupy, so the prior room is left only once the join is certain.
+    vi.useFakeTimers()
+    try {
+      const prior = { type: ROOM_TYPES.TABLE, id: 'table-prior' }
+      const { socket, handlers } = createSocket({ id: 'socket-switch', userId: 'user-switch' })
+      const roomManager = createRoomManager({
+        getRoomForSocket: vi.fn().mockResolvedValue(prior),
+      })
+      setupTablesHandlers(socket as unknown as SetupArg, roomManager)
+
+      let call = 0
+      mockAuthorizeRoom.mockImplementation(async () => {
+        call += 1
+        if (call === 1) {
+          // A later-started read drops this join's own decision, and the join stalls past
+          // the TTL so that decision is expired by re-check time — forcing the re-resolve
+          // down its database path below.
+          commitRoomPermission(
+            'user-switch',
+            { type: ROOM_TYPES.TABLE, id: 'table-target' },
+            'admin',
+            beginRoomPermissionRead()
+          )
+          await sleep(31_000)
+          return { allowed: true, status: 200, workspaceId: 'ws-1', workspacePermission: 'admin' }
+        }
+        // The authoritative current answer: access is gone.
+        return { allowed: false, status: 403, workspaceId: 'ws-1', workspacePermission: null }
+      })
+
+      const joining = handlers[TABLE_PRESENCE_EVENTS.JOIN]({ tableId: 'table-target' })
+      await vi.advanceTimersByTimeAsync(31_000)
+      await joining
+
+      expect(socket.emit).toHaveBeenCalledWith(
+        TABLE_PRESENCE_EVENTS.JOIN_ERROR,
+        expect.objectContaining({ code: 'ACCESS_DENIED', retryable: false })
+      )
+      // Neither joined the target nor abandoned the prior room.
+      expect(socket.join).not.toHaveBeenCalled()
+      expect(socket.leave).not.toHaveBeenCalled()
+      expect(roomManager.removeUserFromRoom).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('drops a malformed cell selection without storing or relaying it', async () => {
     const { socket, handlers, toEmit } = createSocket()
     const roomManager = createRoomManager({

apps/realtime/src/handlers/tables.ts

@@ -225,16 +225,6 @@ export function setupTablesHandlers(socket: AuthenticatedSocket, roomManager: IR
       // Server-authenticated avatar for the presence roster.
       const avatarUrl = await resolveAvatarUrl(socket, userId)
 
-      // Leave a previously-joined table room if switching tables. No generation guard is needed
-      // around this: serialization guarantees no concurrent op committed to a different room
-      // during the lookup, so `currentRoom` is the socket's genuine prior room, safe to leave.
-      const currentRoom = await roomManager.getRoomForSocket(socket.id, ROOM_TYPES.TABLE)
-      if (currentRoom && currentRoom.id !== tableId) {
-        socket.leave(roomName(currentRoom))
-        await roomManager.removeUserFromRoom(currentRoom, socket.id)
-        await roomManager.broadcastPresenceUpdate(currentRoom)
-      }
-
       // Reclaim presence orphaned by an ungraceful disconnect (no `disconnecting`
       // event fires on a pod crash; the room hashes have no TTL). Returns the roster it
       // read so the same-tab dedup below reuses it instead of issuing a second read.
@@ -273,6 +263,19 @@ export function setupTablesHandlers(socket: AuthenticatedSocket, roomManager: IR
         return
       }
 
+      // Only now that the join is certain to proceed, leave a previously-joined table room
+      // if switching. Deliberately AFTER the access re-check: a denial there aborts the
+      // join, and leaving first would silently drop the client from a prior table it may
+      // still be allowed to occupy. No generation guard is needed around this —
+      // serialization guarantees no concurrent op committed to a different room during the
+      // lookup, so `currentRoom` is the socket's genuine prior room, safe to leave.
+      const currentRoom = await roomManager.getRoomForSocket(socket.id, ROOM_TYPES.TABLE)
+      if (currentRoom && currentRoom.id !== tableId) {
+        socket.leave(roomName(currentRoom))
+        await roomManager.removeUserFromRoom(currentRoom, socket.id)
+        await roomManager.broadcastPresenceUpdate(currentRoom)
+      }
+
       // Final re-check before the membership commit: a LEAVE or a newer JOIN enqueued during the
       // awaits above — including the access re-resolve — bumped the generation, or the socket
       // disconnected. This is the LAST await before registering, so nothing can interleave