Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action.

Closes #41.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/api/api.go

@@ -90,6 +90,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gardens.PATCH("/:id/shares/:userId", h.updateShare)
 	gardens.DELETE("/:id/shares/:userId", h.removeShare)
 
+	// Public read-only share link (owner-managed): GET reports state, POST
+	// enables/rotates, DELETE disables. The link itself is served unauthenticated
+	// below.
+	gardens.GET("/:id/share-link", h.getShareLink)
+	gardens.POST("/:id/share-link", h.createShareLink)
+	gardens.DELETE("/:id/share-link", h.deleteShareLink)
+
 	// Objects are addressed by their own id; the service resolves the owning
 	// garden for the permission check.
 	objects := v1.Group("/objects", h.requireAuth())
@@ -110,6 +117,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plants.PATCH("/:id", h.updatePlant)
 	plants.DELETE("/:id", h.deletePlant)
 
+	// Public, unauthenticated read of a garden by its share token. Deliberately
+	// NOT behind requireAuth: the token is the capability, so a logged-out visitor
+	// opens a shared link without being redirected to /login or OIDC. Only GET,
+	// only the read-only /full payload — never a mutation.
+	public := v1.Group("/public")
+	public.GET("/gardens/:token", h.getPublicGarden)
+
 	return r
 }
 

internal/api/public.go

@@ -0,0 +1,79 @@
+package api
+
+import (
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// getPublicGarden serves the read-only /full payload for a garden addressed by a
+// public share token. It sits OUTSIDE requireAuth — the token itself is the
+// capability — so a logged-out visitor can open a shared link without ever being
+// bounced to /login or the OIDC flow. An unknown or disabled token is a 404.
+func (h *handlers) getPublicGarden(c *gin.Context) {
+	full, err := h.svc.PublicGarden(c.Request.Context(), c.Param("token"))
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	// The token is a capability in the URL: keep the response out of any shared
+	// proxy cache, and always serve the live garden (the owner may have edited or
+	// revoked it since the last view).
+	c.Header("Cache-Control", "no-store")
+	c.JSON(http.StatusOK, full)
+}
+
+// getShareLink reports the garden's public-link state (and, to the owner, the
+// current token) so the share dialog can show/copy the URL. Owner only.
+func (h *handlers) getShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	link, err := h.svc.GetPublicShareLink(c.Request.Context(), mustActor(c).ID, id)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// createShareLink enables the public link (idempotent) or, with {"rotate":true},
+// issues a fresh token that invalidates the previous URL. Owner only. The body is
+// optional — a missing/malformed one just means enable-without-rotate.
+func (h *handlers) createShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	var req struct {
+		Rotate bool `json:"rotate"`
+	}
+	// The body is optional (an empty body means enable-without-rotate), but a
+	// present-yet-malformed body is a client error, not a silent enable.
+	if err := c.ShouldBindJSON(&req); err != nil && !errors.Is(err, io.EOF) {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "invalid request body")
+		return
+	}
+	link, err := h.svc.EnablePublicShareLink(c.Request.Context(), mustActor(c).ID, id, req.Rotate)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// deleteShareLink disables the public link. Owner only; idempotent.
+func (h *handlers) deleteShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	if err := h.svc.DisablePublicShareLink(c.Request.Context(), mustActor(c).ID, id); err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"enabled": false})
+}

internal/api/public_test.go

@@ -0,0 +1,105 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+func shareLinkPath(gid int64) string {
+	return "/api/v1/gardens/" + strconv.FormatInt(gid, 10) + "/share-link"
+}
+func publicGardenPath(token string) string { return "/api/v1/public/gardens/" + token }
+
+// TestPublicShareLinkAPI checks the HTTP surface: owner-only link management, and
+// an unauthenticated public read that returns 200 (never a redirect) for a live
+// token and 404 for an unknown/rotated/disabled one — without a session cookie.
+func TestPublicShareLinkAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	owner := registerAndCookie(t, r, "[email protected]")
+	other := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, owner, "Owner's yard")
+
+	// Seed a bed so the public payload has visible content.
+	if w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "bed", "xCm": 500, "yCm": 500, "widthCm": 200, "heightCm": 200}, owner); w.Code != http.StatusCreated {
+		t.Fatalf("seed bed = %d, body %s", w.Code, w.Body.String())
+	}
+
+	// Disabled by default.
+	w := doJSON(t, r, http.MethodGet, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get link = %d, body %s", w.Code, w.Body.String())
+	}
+	if decodeMap(t, w.Body.Bytes())["enabled"] != false {
+		t.Fatalf("new garden link should be disabled: %s", w.Body.String())
+	}
+
+	// A non-owner can't manage the link (garden invisible to them → 404 masked).
+	if w := doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, other); w.Code != http.StatusNotFound {
+		t.Errorf("non-owner enable = %d, want 404", w.Code)
+	}
+
+	// Owner enables → a token.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("enable = %d, body %s", w.Code, w.Body.String())
+	}
+	body := decodeMap(t, w.Body.Bytes())
+	if body["enabled"] != true {
+		t.Fatalf("enable body = %s, want enabled", w.Body.String())
+	}
+	tok, _ := body["token"].(string)
+	if tok == "" {
+		t.Fatalf("no token in enable body: %s", w.Body.String())
+	}
+
+	// Public read works with NO cookie — the whole point is no login/redirect.
+	w = doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("public read = %d, body %s", w.Code, w.Body.String())
+	}
+	var full struct {
+		Garden  map[string]any   `json:"garden"`
+		Objects []map[string]any `json:"objects"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &full); err != nil {
+		t.Fatalf("decode public: %v", err)
+	}
+	if int64(full.Garden["id"].(float64)) != gid {
+		t.Errorf("public garden id mismatch: %s", w.Body.String())
+	}
+	if len(full.Objects) != 1 {
+		t.Errorf("public objects = %d, want 1", len(full.Objects))
+	}
+	if _, leaked := full.Garden["publicToken"]; leaked {
+		t.Errorf("public_token leaked into the garden payload: %s", w.Body.String())
+	}
+
+	// Rotate → a new token; the old one stops resolving.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), map[string]any{"rotate": true}, owner)
+	newTok, _ := decodeMap(t, w.Body.Bytes())["token"].(string)
+	if newTok == "" || newTok == tok {
+		t.Fatalf("rotate token = %q (old %q), want a fresh token", newTok, tok)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("old token after rotate = %d, want 404", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusOK {
+		t.Errorf("new token = %d, want 200", w.Code)
+	}
+
+	// Disable → the link is off and the token 404s.
+	if w := doJSON(t, r, http.MethodDelete, shareLinkPath(gid), nil, owner); w.Code != http.StatusOK {
+		t.Errorf("disable = %d, body %s", w.Code, w.Body.String())
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("token after disable = %d, want 404", w.Code)
+	}
+
+	// An unknown token is a plain 404, never a redirect to login.
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath("nope"), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("unknown token = %d, want 404", w.Code)
+	}
+}

internal/service/objects.go

@@ -164,15 +164,23 @@ func (s *Service) GardenFull(ctx context.Context, actorID, gardenID int64) (*Ful
 	if err != nil {
 		return nil, err
 	}
-	objects, err := s.store.ListObjectsForGarden(ctx, gardenID)
+	return s.assembleFull(ctx, g)
+}
+
+// assembleFull builds the read-only /full payload for an already-authorized
+// garden: its objects, active plops (with DerivedCount filled in), and the
+// plants those plops reference. Shared by the authenticated GardenFull and the
+// unauthenticated PublicGarden read, so both return the identical shape.
+func (s *Service) assembleFull(ctx context.Context, g *domain.Garden) (*FullGarden, error) {
+	objects, err := s.store.ListObjectsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plantings, err := s.store.ListActivePlantingsForGarden(ctx, gardenID)
+	plantings, err := s.store.ListActivePlantingsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plants, err := s.store.ListReferencedPlants(ctx, gardenID)
+	plants, err := s.store.ListReferencedPlants(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}

internal/service/public.go

@@ -0,0 +1,97 @@
+package service
+
+import (
+	"context"
+	"strings"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// PublicShareLink is the owner-visible state of a garden's public read-only link.
+// Token is omitted (and empty) when the link is disabled.
+type PublicShareLink struct {
+	Enabled bool   `json:"enabled"`
+	Token   string `json:"token,omitempty"`
+}
+
+func linkState(token *string) *PublicShareLink {
+	if token == nil {
+		return &PublicShareLink{Enabled: false}
+	}
+	return &PublicShareLink{Enabled: true, Token: *token}
+}
+
+// PublicGarden returns the read-only /full payload for the garden addressed by a
+// public share token. The token is the capability — anyone holding a valid one
+// may read — so there is no actor or ACL check. An unknown, empty, or disabled
+// token yields domain.ErrNotFound (existence is masked, same as a private row).
+func (s *Service) PublicGarden(ctx context.Context, token string) (*FullGarden, error) {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return nil, domain.ErrNotFound
+	}
+	g, err := s.store.GetGardenByPublicToken(ctx, token)
+	if err != nil {
+		return nil, err
+	}
+	full, err := s.assembleFull(ctx, g)
+	if err != nil {
+		return nil, err
+	}
+	// Minimize what an anonymous viewer learns: no role, and no owner user id —
+	// neither the garden's owner nor the owner of any referenced custom plant
+	// (built-ins already have a nil OwnerID). The page renders fine without them.
+	full.Garden.MyRole = ""
+	full.Garden.OwnerID = 0
+	for i := range full.Plants {
+		full.Plants[i].OwnerID = nil
+	}
+	return full, nil
+}
+
+// GetPublicShareLink reports whether the garden's public link is on, and (to the
+// owner) the current token. Owner only.
+func (s *Service) GetPublicShareLink(ctx context.Context, actorID, gardenID int64) (*PublicShareLink, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return nil, err
+	}
+	token, err := s.store.GetGardenPublicToken(ctx, gardenID)
+	if err != nil {
+		return nil, err
+	}
+	return linkState(token), nil
+}
+
+// EnablePublicShareLink turns the public link on and returns the token. It is
+// idempotent when rotate is false (an existing link keeps its token); when rotate
+// is true it always issues a fresh token, invalidating the previous URL. Owner
+// only.
+func (s *Service) EnablePublicShareLink(ctx context.Context, actorID, gardenID int64, rotate bool) (*PublicShareLink, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return nil, err
+	}
+	token, err := s.store.GetGardenPublicToken(ctx, gardenID)
+	if err != nil {
+		return nil, err
+	}
+	if token == nil || rotate {
+		fresh, err := newPublicToken()
+		if err != nil {
+			return nil, err
+		}
+		if err := s.store.SetGardenPublicToken(ctx, gardenID, &fresh); err != nil {
+			return nil, err
+		}
+		token = &fresh
+	}
+	return linkState(token), nil
+}
+
+// DisablePublicShareLink turns the public link off (clears the token). Owner
+// only; idempotent (disabling an already-disabled link is a no-op success).
+func (s *Service) DisablePublicShareLink(ctx context.Context, actorID, gardenID int64) error {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return err
+	}
+	return s.store.SetGardenPublicToken(ctx, gardenID, nil)
+}

internal/service/public_test.go

@@ -0,0 +1,131 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// TestPublicShareLink covers the owner-only link lifecycle (enable / idempotent
+// re-enable / rotate / disable) and the unauthenticated read it gates: a valid
+// token returns the read-only /full payload with no role, an unknown/blank/
+// rotated/disabled token is masked as ErrNotFound, and non-owners can't manage
+// the link.
+func TestPublicShareLink(t *testing.T) {
+	ctx := context.Background()
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	editor := seedUser(t, s, "[email protected]")
+	stranger := seedUser(t, s, "[email protected]")
+
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 10)
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 10}); err != nil {
+		t.Fatalf("seed plop: %v", err)
+	}
+	if _, err := s.AddShare(ctx, owner, g.ID, "[email protected]", domain.RoleEditor); err != nil {
+		t.Fatalf("share editor: %v", err)
+	}
+
+	// Disabled by default.
+	link, err := s.GetPublicShareLink(ctx, owner, g.ID)
+	if err != nil {
+		t.Fatalf("get link: %v", err)
+	}
+	if link.Enabled {
+		t.Fatalf("a new garden should have no public link")
+	}
+
+	// Non-owners can neither read nor manage the link. A shared editor sees the
+	// garden (ErrForbidden); a stranger's view is masked (ErrNotFound).
+	if _, err := s.GetPublicShareLink(ctx, editor, g.ID); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("editor get link = %v, want ErrForbidden", err)
+	}
+	if _, err := s.EnablePublicShareLink(ctx, editor, g.ID, false); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("editor enable = %v, want ErrForbidden", err)
+	}
+	if _, err := s.EnablePublicShareLink(ctx, stranger, g.ID, false); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("stranger enable = %v, want ErrNotFound", err)
+	}
+
+	// Owner enables → a token; the public read works with no actor.
+	link, err = s.EnablePublicShareLink(ctx, owner, g.ID, false)
+	if err != nil {
+		t.Fatalf("enable: %v", err)
+	}
+	if !link.Enabled || link.Token == "" {
+		t.Fatalf("enable returned %+v, want enabled with a token", link)
+	}
+	tok := link.Token
+
+	// Re-enabling without rotate keeps the same token (idempotent).
+	again, err := s.EnablePublicShareLink(ctx, owner, g.ID, false)
+	if err != nil {
+		t.Fatalf("re-enable: %v", err)
+	}
+	if again.Token != tok {
+		t.Errorf("re-enable changed the token: %q -> %q", tok, again.Token)
+	}
+
+	full, err := s.PublicGarden(ctx, tok)
+	if err != nil {
+		t.Fatalf("public read: %v", err)
+	}
+	if full.Garden.ID != g.ID {
+		t.Errorf("public garden id = %d, want %d", full.Garden.ID, g.ID)
+	}
+	if full.Garden.MyRole != "" {
+		t.Errorf("public garden MyRole = %q, want empty (no role for a public viewer)", full.Garden.MyRole)
+	}
+	if len(full.Objects) != 1 || len(full.Plantings) != 1 || len(full.Plants) != 1 {
+		t.Errorf("public full = %d objs / %d plops / %d plants, want 1/1/1",
+			len(full.Objects), len(full.Plantings), len(full.Plants))
+	}
+	// The referenced plant is the owner's custom plant; its OwnerID must be
+	// redacted so an anonymous viewer can't learn the owner's user id.
+	for _, pl := range full.Plants {
+		if pl.OwnerID != nil {
+			t.Errorf("public plant %d leaks OwnerID %d, want nil", pl.ID, *pl.OwnerID)
+		}
+	}
+
+	// Unknown / blank tokens are masked, never a distinct error.
+	for _, bad := range []string{"does-not-exist", "  ", ""} {
+		if _, err := s.PublicGarden(ctx, bad); !errors.Is(err, domain.ErrNotFound) {
+			t.Errorf("PublicGarden(%q) = %v, want ErrNotFound", bad, err)
+		}
+	}
+
+	// Rotate → fresh token; the old URL stops working.
+	rotated, err := s.EnablePublicShareLink(ctx, owner, g.ID, true)
+	if err != nil {
+		t.Fatalf("rotate: %v", err)
+	}
+	if rotated.Token == "" || rotated.Token == tok {
+		t.Fatalf("rotate token = %q (old %q), want a fresh non-empty token", rotated.Token, tok)
+	}
+	if _, err := s.PublicGarden(ctx, tok); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("old token after rotate = %v, want ErrNotFound", err)
+	}
+	if _, err := s.PublicGarden(ctx, rotated.Token); err != nil {
+		t.Errorf("new token = %v, want success", err)
+	}
+
+	// Disable → link off, token no longer resolves.
+	if err := s.DisablePublicShareLink(ctx, owner, g.ID); err != nil {
+		t.Fatalf("disable: %v", err)
+	}
+	if _, err := s.PublicGarden(ctx, rotated.Token); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("token after disable = %v, want ErrNotFound", err)
+	}
+	link, err = s.GetPublicShareLink(ctx, owner, g.ID)
+	if err != nil {
+		t.Fatalf("get link after disable: %v", err)
+	}
+	if link.Enabled {
+		t.Errorf("link still enabled after disable")
+	}
+}

internal/service/service.go

@@ -59,16 +59,25 @@ func formatTime(t time.Time) string { return t.UTC().Format(timeLayout) }
 // parseTime parses a canonical pansy timestamp.
 func parseTime(s string) (time.Time, error) { return time.Parse(timeLayout, s) }
 
-// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
-// entropy). The raw token goes in the cookie; only its hash is persisted.
-func newSessionToken() (string, error) {
-	b := make([]byte, 32)
+// randToken returns nBytes of cryptographic randomness as a URL-safe string.
+func randToken(nBytes int) (string, error) {
+	b := make([]byte, nBytes)
 	if _, err := rand.Read(b); err != nil {
-		return "", fmt.Errorf("service: generate session token: %w", err)
+		return "", fmt.Errorf("service: generate token: %w", err)
 	}
 	return base64.RawURLEncoding.EncodeToString(b), nil
 }
 
+// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
+// entropy). The raw token goes in the cookie; only its hash is persisted.
+func newSessionToken() (string, error) { return randToken(32) }
+
+// newPublicToken returns a fresh unguessable token for a garden's public share
+// link (18 bytes → 144 bits; a 24-char URL segment). Unlike a session token it's
+// stored raw (it must be shown back to the owner to copy) and grants only
+// read-only access to one garden.
+func newPublicToken() (string, error) { return randToken(18) }
+
 // hashToken maps a raw bearer token to the hex sha256 stored as the session's
 // primary key.
 func hashToken(raw string) string {

internal/store/gardens.go

@@ -153,3 +153,63 @@ func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
 	}
 	return nil
 }
+
+// GetGardenByPublicToken returns the garden whose public_token matches, or
+// domain.ErrNotFound. Possession of the token is the capability, so there is no
+// owner/actor check here — the service exposes this only for the unauthenticated
+// public-read path. public_token itself is never selected into the row (it stays
+// out of gardenColumns), so it can't leak through the returned garden.
+func (d *DB) GetGardenByPublicToken(ctx context.Context, token string) (*domain.Garden, error) {
+	g, err := scanGarden(d.sql.QueryRowContext(ctx,
+		`SELECT `+gardenColumns+` FROM gardens WHERE public_token = ?`, token))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get garden by public token: %w", err)
+	}
+	return g, nil
+}
+
+// GetGardenPublicToken returns the garden's current public token (nil when the
+// public link is disabled), or domain.ErrNotFound if the garden is gone.
+func (d *DB) GetGardenPublicToken(ctx context.Context, gardenID int64) (*string, error) {
+	var tok sql.NullString
+	err := d.sql.QueryRowContext(ctx, `SELECT public_token FROM gardens WHERE id = ?`, gardenID).Scan(&tok)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get garden public token: %w", err)
+	}
+	if !tok.Valid {
+		return nil, nil
+	}
+	return &tok.String, nil
+}
+
+// SetGardenPublicToken sets the garden's public token (enabling/rotating the
+// link) or clears it with a nil token (disabling the link). It does not bump the
+// garden version — the public link is out-of-band from garden edits, so toggling
+// it must not spuriously conflict a concurrent editor. Returns domain.ErrNotFound
+// if the garden is gone.
+func (d *DB) SetGardenPublicToken(ctx context.Context, gardenID int64, token *string) error {
+	var val any
+	if token != nil {
+		val = *token
+	}
+	res, err := d.sql.ExecContext(ctx,
+		`UPDATE gardens SET public_token = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now') WHERE id = ?`,
+		val, gardenID)
+	if err != nil {
+		return fmt.Errorf("store: set garden public token: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("store: set garden public token rows: %w", err)
+	}
+	if n == 0 {
+		return domain.ErrNotFound
+	}
+	return nil
+}

internal/store/migrations/0004_garden_public_token.sql

@@ -0,0 +1,7 @@
+-- Per-garden public share token. When set, anyone holding the token may read the
+-- garden read-only via /api/v1/public/gardens/:token, with no login and no OIDC.
+-- NULL disables the public link. Unique (over non-NULL values) so a token maps to
+-- at most one garden; rotating the token invalidates the previous URL.
+ALTER TABLE gardens ADD COLUMN public_token TEXT;
+
+CREATE UNIQUE INDEX idx_gardens_public_token ON gardens (public_token) WHERE public_token IS NOT NULL;