From 355ac8f4a03cefc6a1e08f13ab592b99b2de7d82 Mon Sep 17 00:00:00 2001
From: Nick the Sick <computers@nickthesick.com>
Date: Wed, 8 Jul 2026 04:59:14 +0200
Subject: [PATCH] Demo server: userid from connection string

---
 bin/conf.js | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/bin/conf.js b/bin/conf.js
index 0f8cb00..99953c3 100644
--- a/bin/conf.js
+++ b/bin/conf.js
@@ -51,11 +51,16 @@ export const conf = {
     // latter is safe here only because `credentials` stays off; browsers reject that pair.
     cors: corsOrigin === null ? undefined : { origin: corsOrigin.includes(',') ? corsOrigin.split(',').map(origin => origin.trim()).filter(origin => origin !== '') : corsOrigin.trim() },
     auth: types.createAuthPlugin({
-      // this demo configuration picks a "unique" userid and grants everyone full document
-      // access - including the destructive permissions the old blanket 'rw' implied. No
-      // org/branch/global grants: scopes without a handler deny, and this demo serves no
-      // endpoints at those scopes.
-      async authenticate (_req) { return { userid: random.oneOf(userIdChoices) } },
+      // Open demo server: the userid is taken straight from the connection
+      // string (e.g. ws://host/ws/:org/:docid?userid=alice). Attributions are
+      // saved against this userid. Falls back to a random name when omitted.
+      async authenticate (req) {
+        const userid = req.getQuery('userid')
+        return { userid: userid || random.oneOf(userIdChoices) }
+      },
+      // this demo configuration grants everyone full document access - including the
+      // destructive permissions the old blanket 'rw' implied. No org/branch/global grants:
+      // scopes without a handler deny, and this demo serves no endpoints at those scopes.
       authorize: types.createAuthorize({
         document: async () => ({
           type: 'permissions:document:v1',