Yjs-server to achieve read-only or one-way only sync

I implemented the read-only mode for the yDoc object on the server side through a method I found in the community before read-only-or-one-way-only-sync
However, after the y-websokcet suite used on the client side connects, even if the connection is in read-only mode, the modification will still be broadcast to other clients.
The current effect is that a read-only connection cannot modify the Ydoc object in the server memory, but this modification will still be broadcast to other clients. Is it necessary to modify other synchronization data codes here?

import type * as encoding from 'lib0/encoding';
import * as decoding from 'lib0/decoding';
import { readSyncStep1, readSyncStep2, readUpdate } from 'y-protocols/sync';
import type { Doc } from 'yjs';
import { IWebSocket, PermissionType } from './types';

export const messageYjsSyncStep1 = 0;
export const messageYjsSyncStep2 = 1;
export const messageYjsUpdate = 2;
export const readSyncMessage = (
  conn: IWebSocket,
  decoder: decoding.Decoder,
  encoder: encoding.Encoder,
  doc: Doc,
  transactionOrigin: unknown,
) => {
  const messageType = decoding.readVarUint(decoder);
  switch (messageType) {
    case messageYjsSyncStep1:
      readSyncStep1(decoder, encoder, doc);
      break;
    case messageYjsSyncStep2:
      conn.permission === PermissionType.WRITEANDREAD &&
        readSyncStep2(decoder, doc, transactionOrigin);
      break;
    case messageYjsUpdate:
      conn.permission === PermissionType.WRITEANDREAD &&
        readUpdate(decoder, doc, transactionOrigin);
      break;
    default:
      throw new Error('Unknown message type');
  }
  return messageType;
};

y-websocket supports “cross-tab communication via the BroadcastChannel API”. Locally, your data is shared with other tabs directly.

Usually, this is what you want. Permissions don’t really matter in cross-tab communication. As it would only be shared with the same user.

If you want to disable this feature, you can pass disableBc: true when instantiating the WebsocketProvider:

const provider = new WebsocketProvider(URL, room, ydoc, { disableBc: true })

Sorry, it’s my problem, I found out that in the collaborative page I tested locally, I had two identical pages open in one browser, so the connection to the websocket was shared (possibly), and when I opened the page with two different browsers to operate, the result was as expected