RTC Tokens and Shared Join Authority — 3 Editor Presence Failures
本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。
Use room-scoped, expiring tokens when a media editor must keep collaborative cursors accurate after membership changes; reserve a shared join link for sessions where possession of the URL is intentionally enough to enter. TL;DR: the decisive constraint is not connection setup. It is whether the server must distinguish one participant, device, role, and expiry from another while a video call and editor presence share a room.
当媒体编辑器需要在成员变更后保持协作光标的准确性时，请使用房间范围内的过期令牌；对于仅凭 URL 即可进入的会话，则保留共享加入链接。简而言之：决定性约束不在于连接设置，而在于当视频通话和编辑器状态共享一个房间时，服务器是否必须区分不同的参与者、设备、角色和过期时间。
A link is wonderfully cheap in developer attention. Paste, click, join. But once everyone presents the same secret, the authorization layer has little evidence for explaining who is still allowed to publish presence. A token adds an issuance step and validation code, yet it gives the room boundary explicit inputs. This is a lifecycle problem.
链接在开发者精力投入方面非常廉价。粘贴、点击、加入。但一旦每个人都出示相同的密钥，授权层就几乎没有证据来解释谁仍被允许发布状态。令牌增加了一个签发步骤和验证代码，但它为房间边界提供了明确的输入。这是一个生命周期问题。
WebRTC defines browser-side real-time connection APIs, but an application still has to arrange signaling and decide who may join its session. Treating the invitation URL as both discovery and durable authority hides that decision in a string that people copy everywhere. Should RTC room tokens replace a shared join link?
WebRTC 定义了浏览器端的实时连接 API，但应用程序仍需安排信令并决定谁可以加入会话。将邀请 URL 同时视为发现机制和持久授权，会将该决策隐藏在一个被到处复制的字符串中。RTC 房间令牌应该取代共享加入链接吗？
A collaborative cursor is a claim: participant p_17 is active in document cut_42, at revision 918, near character 603. The video tile beside it is another live capability. Both may travel through the same conceptual room, but they do not have identical permissions or lifetimes. Presence should disappear when the participant disconnects, loses editor rights, leaves the document, or is replaced by a newer connection.
协作光标是一种声明：参与者 p_17 在文档 cut_42 中处于活跃状态，修订版本为 918，位置在字符 603 附近。旁边的视频磁贴是另一种实时功能。两者可能在同一个概念房间中传输，但它们并不具备相同的权限或生命周期。当参与者断开连接、失去编辑权限、离开文档或被新连接替换时，状态应该消失。
A shared join link can represent a session-level grant. That works for an open production review where anybody holding the URL may enter under the same policy. It gets awkward when the application needs per-participant answers. Which device should win after a reconnect? Can a guest publish a cursor or only receive the call? Does removing one contractor invalidate access for everybody who has the URL?
共享加入链接可以代表会话级别的授权。这适用于开放的生产评审，即任何持有 URL 的人都可以根据相同的策略进入。当应用程序需要针对每个参与者的答案时，情况就会变得棘手。重新连接后哪个设备应该胜出？访客可以发布光标还是只能接收通话？移除一名承包商是否会使所有拥有该 URL 的人的访问权限失效？
If the only credential is shared, selective revocation requires another identity layer or rotating the shared secret and redistributing it. The glue returns. A room token can carry, or point to, the narrower decision: subject, room, allowed actions, issuance time, expiry, and a unique identifier. The server must still validate those fields and bind them to its own room state. A signed blob is not magic. It is a compact input to an authorization check.
如果唯一的凭据是共享的，那么选择性撤销就需要另一个身份层，或者轮换共享密钥并重新分发。粘合剂又回来了。房间令牌可以携带或指向更具体的决策：主体、房间、允许的操作、签发时间、过期时间和唯一标识符。服务器仍必须验证这些字段并将它们绑定到其自身的房间状态。签名的二进制数据不是魔法，它是授权检查的紧凑输入。
| Failure mode | Shared join link | Room-scoped token |
|---|---|---|
| Presence consequence | URL is forwarded | New holder has the shared grant unless another check intervenes |
| Shared authority makes unattributed cursors easier to admit | One member is removed | Selective removal needs separate identity state or link rotation |
| The removed cursor can expire without ejecting the room | Client reconnects twice | Both connections present the same room secret |
| One canonical cursor can replace the stale one | Long-lived bearer tokens copied into logs recreate the shared-link failure with extra ceremony. Bad inputs, same result. That limitation matters. |
| 故障模式 | 共享加入链接 | 房间范围令牌 |
|---|---|---|
| 状态后果 | URL 被转发 | 新持有者拥有共享授权，除非有其他检查介入 |
| 共享权限使未归属的光标更容易被接纳 | 移除一名成员 | 选择性移除需要单独的身份状态或链接轮换 |
| 被移除的光标可以在不踢出房间的情况下过期 | 客户端重新连接两次 | 两个连接都出示相同的房间密钥 |
| 一个规范的光标可以替换陈旧的光标 | 复制到日志中的长效持有者令牌会以额外的仪式重现共享链接故障。错误的输入，相同的结果。该限制很重要。 |
The smallest implementation I would ship I would keep invitation and authorization separate. The invitation URL contains an opaque lookup key. Opening it asks the application server for a short-lived room grant after the normal participant check. The real-time gateway validates that grant, then creates a server-owned presence lease. Cursor messages never choose their own participant identity.
我愿意发布的最小实现方案是将邀请和授权分开。邀请 URL 包含一个不透明的查找键。打开它后，在通过常规参与者检查后，会向应用程序服务器请求一个短期的房间授权。实时网关验证该授权，然后创建一个服务器拥有的状态租约。光标消息从不自行选择其参与者身份。
(Code snippets omitted for brevity)
（代码片段为简洁起见已省略）
This is intentionally boring TypeScript. I judge an authorization design by how quickly another developer can locate the denial and by how few configuration files stand between a request and that decision. If the policy needs a diagram to explain why a cursor may move, it is already too clever.
这是刻意编写的枯燥 TypeScript 代码。我通过另一位开发者定位拒绝原因的速度，以及请求与决策之间隔了多少配置文件来评判授权设计。如果策略需要图表来解释为什么光标可以移动，那它就已经太复杂了。
Test the three ugly transitions Happy-path join latency is the easy benchmark. Measure the transitions that make presence lie: removal, reconnect, and expiry. The useful interval runs from the authoritative membership change to the last accepted cursor update from the old connection. Separately measure how long other clients display that cursor. Those timestamps expose server rejection and client cleanup as different problems. Start with deterministic state tests, then repeat them across the deployed signaling path with control.
测试这三种棘手的转换。正常路径下的加入延迟是简单的基准。测量那些导致状态出现偏差的转换：移除、重新连接和过期。有效间隔从权威的成员变更开始，到旧连接最后一次被接受的光标更新结束。分别测量其他客户端显示该光标的时长。这些时间戳将服务器拒绝和客户端清理暴露为不同的问题。从确定性状态测试开始，然后在部署的信令路径上进行对照重复测试。