Address review: redact plant owner ids, cache-control, 400, DRY reset

- Security (2-model, security+correctness): the public payload zeroed Garden.OwnerID but referenced custom plants still carried Plant.OwnerID, leaking the owner's user id to anonymous viewers. Redact plant owner ids too, and assert it in the service test. - Set Cache-Control: no-store on the public read so a capability-URL response isn't held in a shared proxy cache and always reflects the live garden. - createShareLink now 400s on a present-but-malformed JSON body instead of silently enabling (an empty body still means enable-without-rotate). - Extract the transient-editor-state reset into a shared resetTransient store action (3-model finding) and use it from PublicGardenPage. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
2026-07-19 02:17:15 -04:00
parent f3b0ca572d
commit 0842618ad1
5 changed files with 43 additions and 11 deletions
@@ -38,10 +38,14 @@ func (s *Service) PublicGarden(ctx context.Context, token string) (*FullGarden,
 	if err != nil {
 		return nil, err
 	}
-	// Minimize what an anonymous viewer learns: no role, and don't expose the
-	// owner's user id (the page renders fine without it).
+	// Minimize what an anonymous viewer learns: no role, and no owner user id —
+	// neither the garden's owner nor the owner of any referenced custom plant
+	// (built-ins already have a nil OwnerID). The page renders fine without them.
 	full.Garden.MyRole = ""
 	full.Garden.OwnerID = 0
+	for i := range full.Plants {
+		full.Plants[i].OwnerID = nil
+	}
 	return full, nil
 }