Merge remote-tracking branch 'origin/access-list-kick-sessions' into 2026.4-rc

src/worker/components/pad.ts

@@ -167,6 +167,7 @@ const _join: Callback = (ctx, clientId, data) => {
     }
 
     const isNew = typeof channels[channelId] === "undefined";
+    const isAnonymousSession = !store.loggedIn;
 
     // Create or get existing channel object
     const channel = channels[channelId] ||= {
@@ -201,7 +202,7 @@ const _join: Callback = (ctx, clientId, data) => {
     }
 
     // Existing pad already loaded: send userlist and history
-    if (!isNew && channel.wc) {
+    const sendExistingState = () => {
         postMessage(clientId, "PAD_CONNECT", { // Initialize
             myID: channel.wc.myID,
             id: channel.wc.id,
@@ -218,7 +219,29 @@ const _join: Callback = (ctx, clientId, data) => {
             });
         });
         postMessage(clientId, "PAD_READY"); // Ready
-        return;
+    };
+    const preflightAnonAccess = (cb) => {
+        const allow = () => { cb(true); };
+        const deny = () => {
+            Cache?.clearChannel?.(channelId);
+            channel.bcast("PAD_ERROR", { type: "ERESTRICTED" });
+            ctx.leavePad(null, data, function () {});
+            cb(false);
+        };
+
+        if (!isAnonymousSession) { return void allow(); }
+        if (!store.anon_rpc) { return void allow(); }
+        _getMetadata(ctx, clientId, { channel: channelId }, md => {
+            if (md?.rejected) { return void deny(); }
+            allow();
+        });
+    };
+
+    if (!isNew) {
+        return void preflightAnonAccess((ok) => {
+            if (!ok) { return; }
+            sendExistingState();
+        });
     }
 
     // chainpad-netflux config
@@ -231,7 +254,7 @@ const _join: Callback = (ctx, clientId, data) => {
         }
         channel.bcast("PAD_ERROR", err);
 
-        if (type === "EDELETED" && Cache?.clearChannel) {
+        if (["EDELETED", "EEXPIRED", "ERESTRICTED"].includes(type) && Cache?.clearChannel) {
             Cache.clearChannel(channelId);
         }
 
@@ -343,7 +366,10 @@ const _join: Callback = (ctx, clientId, data) => {
             });
         }
     };
-    channel.cpNf = CpNetflux.start(conf);
+    preflightAnonAccess((ok) => {
+        if (!ok) { return; }
+        channel.cpNf = CpNetflux.start(conf);
+    });
 };
 
 // Send a message to a pad we already joined

www/common/common-icons.js

@@ -28,7 +28,7 @@ define([
         "grid": "layout-grid",
         "list": "list",
         "document-owner": "id-card-lanyard",
-        "burn-drive": "ban",
+        "burn-drive": "eraser",
         // Teams
         "teams": "users-round",
         "promote": "chevrons-up",

www/common/common-ui-elements.js

@@ -3271,6 +3271,10 @@ define([
             }
 
             if (toolbar && typeof toolbar.failed === "function") { toolbar.failed(true); }
+            sframeChan.event('EV_SHARE_OPEN', {hidden: true});
+            UI.errorLoadingScreen(msg, false, false);
+            (cb || function () {})();
+            return;
         } else if (err.type === 'HASH_NOT_FOUND' && priv.isHistoryVersion) {
             msg = Messages.oo_deletedVersion;
             if (toolbar && typeof toolbar.failed === "function") { toolbar.failed(true); }

www/drive/inner.js

@@ -41,7 +41,19 @@ define([
         for (var k in objRef) { delete objRef[k]; }
         $.extend(true, objRef, objToCopy);
     };
-    var updateSharedFolders = function (sframeChan, manager, drive, folders, cb) {
+    var lockoutAnonSharedFolder = function (common) {
+        APP.newSharedFolder = null;
+        APP.closed = true;
+        var msg = Messages.restrictedError;
+        if (common && !common.isLoggedIn()) {
+            msg = UIElements.loginErrorScreenContent(common);
+        }
+        setTimeout(function () {
+            UI.errorLoadingScreen(msg, false, false);
+        }, 0);
+    };
+
+    var updateSharedFoldersCore = function (common, sframeChan, manager, drive, folders, cb) {
         if (!drive || !drive.sharedFolders) {
             return void cb();
         }
@@ -57,6 +69,12 @@ define([
                     sharedFolder: fId
                 }, waitFor(function (err, newObj) {
                     if (!APP.loggedIn && APP.newSharedFolder) {
+                        if (newObj && newObj.restricted) {
+                            lockoutAnonSharedFolder(common);
+                            waitFor.abort();
+                            return;
+                        }
+                        if (err) { return; }
                         if (!newObj || !Object.keys(newObj).length) {
                             // Empty anon drive: deleted
                             var msg = Messages.deletedError + '<br>' + Messages.errorRedirectToHome;
@@ -103,6 +121,11 @@ define([
             cb();
         });
     };
+    var updateSharedFolders = function (common) {
+        return function (sframeChan, manager, drive, folders, cb) {
+            updateSharedFoldersCore(common, sframeChan, manager, drive, folders, cb);
+        };
+    };
     var updateObject = function (sframeChan, obj, cb) {
         sframeChan.query('Q_DRIVE_GETOBJECT', null, function (err, newObj) {
             copyObjectValue(obj, newObj);
@@ -303,7 +326,7 @@ define([
                 proxy: proxy,
                 folders: folders,
                 updateObject: updateObject,
-                updateSharedFolders: updateSharedFolders,
+                updateSharedFolders: updateSharedFolders(common),
                 history: history,
                 toolbar: toolbar,
                 APP: APP