Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action.

Closes #41.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/api/api.go

@@ -90,6 +90,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gardens.PATCH("/:id/shares/:userId", h.updateShare)
 	gardens.DELETE("/:id/shares/:userId", h.removeShare)
 
+	// Public read-only share link (owner-managed): GET reports state, POST
+	// enables/rotates, DELETE disables. The link itself is served unauthenticated
+	// below.
+	gardens.GET("/:id/share-link", h.getShareLink)
+	gardens.POST("/:id/share-link", h.createShareLink)
+	gardens.DELETE("/:id/share-link", h.deleteShareLink)
+
 	// Objects are addressed by their own id; the service resolves the owning
 	// garden for the permission check.
 	objects := v1.Group("/objects", h.requireAuth())
@@ -110,6 +117,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plants.PATCH("/:id", h.updatePlant)
 	plants.DELETE("/:id", h.deletePlant)
 
+	// Public, unauthenticated read of a garden by its share token. Deliberately
+	// NOT behind requireAuth: the token is the capability, so a logged-out visitor
+	// opens a shared link without being redirected to /login or OIDC. Only GET,
+	// only the read-only /full payload — never a mutation.
+	public := v1.Group("/public")
+	public.GET("/gardens/:token", h.getPublicGarden)
+
 	return r
 }
 

internal/api/public.go

@@ -0,0 +1,79 @@
+package api
+
+import (
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// getPublicGarden serves the read-only /full payload for a garden addressed by a
+// public share token. It sits OUTSIDE requireAuth — the token itself is the
+// capability — so a logged-out visitor can open a shared link without ever being
+// bounced to /login or the OIDC flow. An unknown or disabled token is a 404.
+func (h *handlers) getPublicGarden(c *gin.Context) {
+	full, err := h.svc.PublicGarden(c.Request.Context(), c.Param("token"))
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	// The token is a capability in the URL: keep the response out of any shared
+	// proxy cache, and always serve the live garden (the owner may have edited or
+	// revoked it since the last view).
+	c.Header("Cache-Control", "no-store")
+	c.JSON(http.StatusOK, full)
+}
+
+// getShareLink reports the garden's public-link state (and, to the owner, the
+// current token) so the share dialog can show/copy the URL. Owner only.
+func (h *handlers) getShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	link, err := h.svc.GetPublicShareLink(c.Request.Context(), mustActor(c).ID, id)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// createShareLink enables the public link (idempotent) or, with {"rotate":true},
+// issues a fresh token that invalidates the previous URL. Owner only. The body is
+// optional — a missing/malformed one just means enable-without-rotate.
+func (h *handlers) createShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	var req struct {
+		Rotate bool `json:"rotate"`
+	}
+	// The body is optional (an empty body means enable-without-rotate), but a
+	// present-yet-malformed body is a client error, not a silent enable.
+	if err := c.ShouldBindJSON(&req); err != nil && !errors.Is(err, io.EOF) {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "invalid request body")
+		return
+	}
+	link, err := h.svc.EnablePublicShareLink(c.Request.Context(), mustActor(c).ID, id, req.Rotate)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// deleteShareLink disables the public link. Owner only; idempotent.
+func (h *handlers) deleteShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	if err := h.svc.DisablePublicShareLink(c.Request.Context(), mustActor(c).ID, id); err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"enabled": false})
+}

internal/api/public_test.go

@@ -0,0 +1,105 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+func shareLinkPath(gid int64) string {
+	return "/api/v1/gardens/" + strconv.FormatInt(gid, 10) + "/share-link"
+}
+func publicGardenPath(token string) string { return "/api/v1/public/gardens/" + token }
+
+// TestPublicShareLinkAPI checks the HTTP surface: owner-only link management, and
+// an unauthenticated public read that returns 200 (never a redirect) for a live
+// token and 404 for an unknown/rotated/disabled one — without a session cookie.
+func TestPublicShareLinkAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	owner := registerAndCookie(t, r, "[email protected]")
+	other := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, owner, "Owner's yard")
+
+	// Seed a bed so the public payload has visible content.
+	if w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "bed", "xCm": 500, "yCm": 500, "widthCm": 200, "heightCm": 200}, owner); w.Code != http.StatusCreated {
+		t.Fatalf("seed bed = %d, body %s", w.Code, w.Body.String())
+	}
+
+	// Disabled by default.
+	w := doJSON(t, r, http.MethodGet, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get link = %d, body %s", w.Code, w.Body.String())
+	}
+	if decodeMap(t, w.Body.Bytes())["enabled"] != false {
+		t.Fatalf("new garden link should be disabled: %s", w.Body.String())
+	}
+
+	// A non-owner can't manage the link (garden invisible to them → 404 masked).
+	if w := doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, other); w.Code != http.StatusNotFound {
+		t.Errorf("non-owner enable = %d, want 404", w.Code)
+	}
+
+	// Owner enables → a token.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("enable = %d, body %s", w.Code, w.Body.String())
+	}
+	body := decodeMap(t, w.Body.Bytes())
+	if body["enabled"] != true {
+		t.Fatalf("enable body = %s, want enabled", w.Body.String())
+	}
+	tok, _ := body["token"].(string)
+	if tok == "" {
+		t.Fatalf("no token in enable body: %s", w.Body.String())
+	}
+
+	// Public read works with NO cookie — the whole point is no login/redirect.
+	w = doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("public read = %d, body %s", w.Code, w.Body.String())
+	}
+	var full struct {
+		Garden  map[string]any   `json:"garden"`
+		Objects []map[string]any `json:"objects"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &full); err != nil {
+		t.Fatalf("decode public: %v", err)
+	}
+	if int64(full.Garden["id"].(float64)) != gid {
+		t.Errorf("public garden id mismatch: %s", w.Body.String())
+	}
+	if len(full.Objects) != 1 {
+		t.Errorf("public objects = %d, want 1", len(full.Objects))
+	}
+	if _, leaked := full.Garden["publicToken"]; leaked {
+		t.Errorf("public_token leaked into the garden payload: %s", w.Body.String())
+	}
+
+	// Rotate → a new token; the old one stops resolving.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), map[string]any{"rotate": true}, owner)
+	newTok, _ := decodeMap(t, w.Body.Bytes())["token"].(string)
+	if newTok == "" || newTok == tok {
+		t.Fatalf("rotate token = %q (old %q), want a fresh token", newTok, tok)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("old token after rotate = %d, want 404", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusOK {
+		t.Errorf("new token = %d, want 200", w.Code)
+	}
+
+	// Disable → the link is off and the token 404s.
+	if w := doJSON(t, r, http.MethodDelete, shareLinkPath(gid), nil, owner); w.Code != http.StatusOK {
+		t.Errorf("disable = %d, body %s", w.Code, w.Body.String())
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("token after disable = %d, want 404", w.Code)
+	}
+
+	// An unknown token is a plain 404, never a redirect to login.
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath("nope"), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("unknown token = %d, want 404", w.Code)
+	}
+}