fix(realtime): allow the write role to persist a block retry policy

`update-retry` was added to the protocol but not to the write-role allowlist, so
the editor applied the change optimistically while the server dropped it and the
policy never reached the database.

Adds a test asserting the write role holds every per-block operation the protocol
declares, so the next block setting cannot repeat this silently.

Author: waleedlatif1

apps/realtime/src/middleware/permissions.test.ts

@@ -7,7 +7,7 @@
  * - Edge cases and invalid inputs
  */
 
-import { ALL_SOCKET_OPERATIONS } from '@sim/realtime-protocol/constants'
+import { ALL_SOCKET_OPERATIONS, BLOCK_OPERATIONS } from '@sim/realtime-protocol/constants'
 import {
   expectPermissionAllowed,
   expectPermissionDenied,
@@ -232,6 +232,17 @@ describe('checkRolePermission', () => {
       expect(adminOnly.length).toBeGreaterThan(0)
     })
 
+    it('grants write every per-block operation the protocol declares', () => {
+      // A block operation that reaches this gate is an ordinary editor edit, so the
+      // write role must hold all of them. Without this, adding a block setting to
+      // the protocol and forgetting the ACL entry fails silently at runtime: the
+      // editor applies the change optimistically and the server drops the write.
+      const denied = Object.values(BLOCK_OPERATIONS).filter(
+        (operation) => !checkRolePermission('write', operation).allowed
+      )
+      expect(denied).toEqual([])
+    })
+
     it('grants read nothing, so it is trivially a subset of write', () => {
       const readAllowed = ALL_SOCKET_OPERATIONS.filter(
         (operation) => checkRolePermission('read', operation).allowed

apps/realtime/src/middleware/permissions.ts

@@ -30,6 +30,7 @@ const WRITE_OPERATIONS: string[] = [
   BLOCK_OPERATIONS.UPDATE_PARENT,
   BLOCK_OPERATIONS.UPDATE_ADVANCED_MODE,
   BLOCK_OPERATIONS.UPDATE_ERROR_ENABLED,
+  BLOCK_OPERATIONS.UPDATE_RETRY,
   BLOCK_OPERATIONS.UPDATE_CANONICAL_MODE,
   BLOCK_OPERATIONS.REPLACE_CANONICAL_MODES,
   BLOCK_OPERATIONS.TOGGLE_HANDLES,