fix: pass owner_did to WebSocket handler so collaborators can connect

internal/handler/handler.go

···
 		return
 	}
 
-	client, err := h.xrpcClient(session.UserID)
-	if err != nil {
-		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
-		return
+	// If owner_did is provided, fetch the document from the owner's PDS
+	// (used by collaborators whose copy lives on a different PDS).
+	ownerDID := r.URL.Query().Get("owner_did")
+	var docClient *xrpc.Client
+	var docRepoDID string
+	if ownerDID != "" {
+		ownerUser, err := h.DB.GetUserByDID(ownerDID)
+		if err != nil {
+			log.Printf("CollaboratorWebSocket: get owner by DID %s: %v", ownerDID, err)
+			http.Error(w, "Document owner not found", http.StatusForbidden)
+			return
+		}
+		docClient, err = h.xrpcClient(ownerUser.ID)
+		if err != nil {
+			http.Error(w, "Failed to connect to owner PDS", http.StatusInternalServerError)
+			return
+		}
+		docRepoDID = ownerDID
+	} else {
+		docClient, err = h.xrpcClient(session.UserID)
+		if err != nil {
+			http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+			return
+		}
+		docRepoDID = did
 	}
 
-	doc, err := client.GetDocument(rKey)
+	value, _, err := docClient.GetRecord(docRepoDID, collectionDocument, rKey)
 	if err != nil {
 		http.Error(w, "Document not found", http.StatusNotFound)
 		return
 	}
+	doc := &model.Document{}
+	if err := json.Unmarshal(value, doc); err != nil {
+		http.Error(w, "Invalid document", http.StatusInternalServerError)
+		return
+	}
 
-	isCollaborator := false
+	// Owner always has access; collaborators must be in the collaborators list.
+	isCollaborator := did == docRepoDID
 	for _, c := range doc.Collaborators {
 		if c == did {
 			isCollaborator = true

templates/document_edit.html

···
         if (!isCollaborator || !accessToken) return;
 
         const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
-        const wsUrl = `${protocol}//${window.location.host}/ws/docs/${rkey}?access_token=${encodeURIComponent(accessToken)}&dpop_proof=placeholder`;
+        const ownerParam = ownerDID ? `&owner_did=${encodeURIComponent(ownerDID)}` : '';
+        const wsUrl = `${protocol}//${window.location.host}/ws/docs/${rkey}?access_token=${encodeURIComponent(accessToken)}&dpop_proof=placeholder${ownerParam}`;
 
         ws = new WebSocket(wsUrl);