fix: add server-side role check on sync-elements and sync-state socket events

[HunarBhatia]

Fixes #81

Problem

The sync-elements and sync-state socket events had no server-side authorization check. Any authenticated student could emit these events directly from the browser console and completely overwrite the entire board state — both in the live session and the database — bypassing the existing allowedStudents and allowStudentEditing permission system entirely.

Fix

Added a board ownership check to both events using socket.userId compared against board.createdBy:

const board = await Board.findOne({ roomId });
if (!board || board.createdBy.toString() !== socket.userId) {
  return socket.emit('error', { message: 'Unauthorized: only the board teacher can sync elements' });
}

Events Fixed

• sync-elements — only board owner can sync full element array
• sync-state — only board owner can sync full board state

File Changed

• server/index.js

[vercel]

Someone is attempting to deploy a commit to the MINHA's projects Team on Vercel.

A member of the Team first needs to authorize it.

[HunarBhatia]

@KENZY004 PR submitted! Would it be possible to add relevant labels like security or bug to this issue? Also wanted to confirm — will this be counted under GSSoC '26 points once merged?

[KENZY004]

Looks great overall! Just one small issue: sync-elements and sync-state are currently restricted to board.createdBy. Students with editing access (allowedStudents or allowStudentEditing) should also be allowed to sync, otherwise Undo/Redo won't work for them.

Could you update the condition to include those cases? Once that's done, I'll merge it right away.