Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action.

Closes #41.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/service/objects.go

@@ -164,15 +164,23 @@ func (s *Service) GardenFull(ctx context.Context, actorID, gardenID int64) (*Ful
 	if err != nil {
 		return nil, err
 	}
-	objects, err := s.store.ListObjectsForGarden(ctx, gardenID)
+	return s.assembleFull(ctx, g)
+}
+
+// assembleFull builds the read-only /full payload for an already-authorized
+// garden: its objects, active plops (with DerivedCount filled in), and the
+// plants those plops reference. Shared by the authenticated GardenFull and the
+// unauthenticated PublicGarden read, so both return the identical shape.
+func (s *Service) assembleFull(ctx context.Context, g *domain.Garden) (*FullGarden, error) {
+	objects, err := s.store.ListObjectsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plantings, err := s.store.ListActivePlantingsForGarden(ctx, gardenID)
+	plantings, err := s.store.ListActivePlantingsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plants, err := s.store.ListReferencedPlants(ctx, gardenID)
+	plants, err := s.store.ListReferencedPlants(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}

internal/service/public.go

@@ -0,0 +1,97 @@
+package service
+
+import (
+	"context"
+	"strings"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// PublicShareLink is the owner-visible state of a garden's public read-only link.
+// Token is omitted (and empty) when the link is disabled.
+type PublicShareLink struct {
+	Enabled bool   `json:"enabled"`
+	Token   string `json:"token,omitempty"`
+}
+
+func linkState(token *string) *PublicShareLink {
+	if token == nil {
+		return &PublicShareLink{Enabled: false}
+	}
+	return &PublicShareLink{Enabled: true, Token: *token}
+}
+
+// PublicGarden returns the read-only /full payload for the garden addressed by a
+// public share token. The token is the capability — anyone holding a valid one
+// may read — so there is no actor or ACL check. An unknown, empty, or disabled
+// token yields domain.ErrNotFound (existence is masked, same as a private row).
+func (s *Service) PublicGarden(ctx context.Context, token string) (*FullGarden, error) {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return nil, domain.ErrNotFound
+	}
+	g, err := s.store.GetGardenByPublicToken(ctx, token)
+	if err != nil {
+		return nil, err
+	}
+	full, err := s.assembleFull(ctx, g)
+	if err != nil {
+		return nil, err
+	}
+	// Minimize what an anonymous viewer learns: no role, and no owner user id —
+	// neither the garden's owner nor the owner of any referenced custom plant
+	// (built-ins already have a nil OwnerID). The page renders fine without them.
+	full.Garden.MyRole = ""
+	full.Garden.OwnerID = 0
+	for i := range full.Plants {
+		full.Plants[i].OwnerID = nil
+	}
+	return full, nil
+}
+
+// GetPublicShareLink reports whether the garden's public link is on, and (to the
+// owner) the current token. Owner only.
+func (s *Service) GetPublicShareLink(ctx context.Context, actorID, gardenID int64) (*PublicShareLink, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return nil, err
+	}
+	token, err := s.store.GetGardenPublicToken(ctx, gardenID)
+	if err != nil {
+		return nil, err
+	}
+	return linkState(token), nil
+}
+
+// EnablePublicShareLink turns the public link on and returns the token. It is
+// idempotent when rotate is false (an existing link keeps its token); when rotate
+// is true it always issues a fresh token, invalidating the previous URL. Owner
+// only.
+func (s *Service) EnablePublicShareLink(ctx context.Context, actorID, gardenID int64, rotate bool) (*PublicShareLink, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return nil, err
+	}
+	token, err := s.store.GetGardenPublicToken(ctx, gardenID)
+	if err != nil {
+		return nil, err
+	}
+	if token == nil || rotate {
+		fresh, err := newPublicToken()
+		if err != nil {
+			return nil, err
+		}
+		if err := s.store.SetGardenPublicToken(ctx, gardenID, &fresh); err != nil {
+			return nil, err
+		}
+		token = &fresh
+	}
+	return linkState(token), nil
+}
+
+// DisablePublicShareLink turns the public link off (clears the token). Owner
+// only; idempotent (disabling an already-disabled link is a no-op success).
+func (s *Service) DisablePublicShareLink(ctx context.Context, actorID, gardenID int64) error {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
+		return err
+	}
+	return s.store.SetGardenPublicToken(ctx, gardenID, nil)
+}

internal/service/public_test.go

@@ -0,0 +1,131 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// TestPublicShareLink covers the owner-only link lifecycle (enable / idempotent
+// re-enable / rotate / disable) and the unauthenticated read it gates: a valid
+// token returns the read-only /full payload with no role, an unknown/blank/
+// rotated/disabled token is masked as ErrNotFound, and non-owners can't manage
+// the link.
+func TestPublicShareLink(t *testing.T) {
+	ctx := context.Background()
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	editor := seedUser(t, s, "[email protected]")
+	stranger := seedUser(t, s, "[email protected]")
+
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 10)
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 10}); err != nil {
+		t.Fatalf("seed plop: %v", err)
+	}
+	if _, err := s.AddShare(ctx, owner, g.ID, "[email protected]", domain.RoleEditor); err != nil {
+		t.Fatalf("share editor: %v", err)
+	}
+
+	// Disabled by default.
+	link, err := s.GetPublicShareLink(ctx, owner, g.ID)
+	if err != nil {
+		t.Fatalf("get link: %v", err)
+	}
+	if link.Enabled {
+		t.Fatalf("a new garden should have no public link")
+	}
+
+	// Non-owners can neither read nor manage the link. A shared editor sees the
+	// garden (ErrForbidden); a stranger's view is masked (ErrNotFound).
+	if _, err := s.GetPublicShareLink(ctx, editor, g.ID); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("editor get link = %v, want ErrForbidden", err)
+	}
+	if _, err := s.EnablePublicShareLink(ctx, editor, g.ID, false); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("editor enable = %v, want ErrForbidden", err)
+	}
+	if _, err := s.EnablePublicShareLink(ctx, stranger, g.ID, false); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("stranger enable = %v, want ErrNotFound", err)
+	}
+
+	// Owner enables → a token; the public read works with no actor.
+	link, err = s.EnablePublicShareLink(ctx, owner, g.ID, false)
+	if err != nil {
+		t.Fatalf("enable: %v", err)
+	}
+	if !link.Enabled || link.Token == "" {
+		t.Fatalf("enable returned %+v, want enabled with a token", link)
+	}
+	tok := link.Token
+
+	// Re-enabling without rotate keeps the same token (idempotent).
+	again, err := s.EnablePublicShareLink(ctx, owner, g.ID, false)
+	if err != nil {
+		t.Fatalf("re-enable: %v", err)
+	}
+	if again.Token != tok {
+		t.Errorf("re-enable changed the token: %q -> %q", tok, again.Token)
+	}
+
+	full, err := s.PublicGarden(ctx, tok)
+	if err != nil {
+		t.Fatalf("public read: %v", err)
+	}
+	if full.Garden.ID != g.ID {
+		t.Errorf("public garden id = %d, want %d", full.Garden.ID, g.ID)
+	}
+	if full.Garden.MyRole != "" {
+		t.Errorf("public garden MyRole = %q, want empty (no role for a public viewer)", full.Garden.MyRole)
+	}
+	if len(full.Objects) != 1 || len(full.Plantings) != 1 || len(full.Plants) != 1 {
+		t.Errorf("public full = %d objs / %d plops / %d plants, want 1/1/1",
+			len(full.Objects), len(full.Plantings), len(full.Plants))
+	}
+	// The referenced plant is the owner's custom plant; its OwnerID must be
+	// redacted so an anonymous viewer can't learn the owner's user id.
+	for _, pl := range full.Plants {
+		if pl.OwnerID != nil {
+			t.Errorf("public plant %d leaks OwnerID %d, want nil", pl.ID, *pl.OwnerID)
+		}
+	}
+
+	// Unknown / blank tokens are masked, never a distinct error.
+	for _, bad := range []string{"does-not-exist", "  ", ""} {
+		if _, err := s.PublicGarden(ctx, bad); !errors.Is(err, domain.ErrNotFound) {
+			t.Errorf("PublicGarden(%q) = %v, want ErrNotFound", bad, err)
+		}
+	}
+
+	// Rotate → fresh token; the old URL stops working.
+	rotated, err := s.EnablePublicShareLink(ctx, owner, g.ID, true)
+	if err != nil {
+		t.Fatalf("rotate: %v", err)
+	}
+	if rotated.Token == "" || rotated.Token == tok {
+		t.Fatalf("rotate token = %q (old %q), want a fresh non-empty token", rotated.Token, tok)
+	}
+	if _, err := s.PublicGarden(ctx, tok); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("old token after rotate = %v, want ErrNotFound", err)
+	}
+	if _, err := s.PublicGarden(ctx, rotated.Token); err != nil {
+		t.Errorf("new token = %v, want success", err)
+	}
+
+	// Disable → link off, token no longer resolves.
+	if err := s.DisablePublicShareLink(ctx, owner, g.ID); err != nil {
+		t.Fatalf("disable: %v", err)
+	}
+	if _, err := s.PublicGarden(ctx, rotated.Token); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("token after disable = %v, want ErrNotFound", err)
+	}
+	link, err = s.GetPublicShareLink(ctx, owner, g.ID)
+	if err != nil {
+		t.Fatalf("get link after disable: %v", err)
+	}
+	if link.Enabled {
+		t.Errorf("link still enabled after disable")
+	}
+}

internal/service/service.go

@@ -59,16 +59,25 @@ func formatTime(t time.Time) string { return t.UTC().Format(timeLayout) }
 // parseTime parses a canonical pansy timestamp.
 func parseTime(s string) (time.Time, error) { return time.Parse(timeLayout, s) }
 
-// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
-// entropy). The raw token goes in the cookie; only its hash is persisted.
-func newSessionToken() (string, error) {
-	b := make([]byte, 32)
+// randToken returns nBytes of cryptographic randomness as a URL-safe string.
+func randToken(nBytes int) (string, error) {
+	b := make([]byte, nBytes)
 	if _, err := rand.Read(b); err != nil {
-		return "", fmt.Errorf("service: generate session token: %w", err)
+		return "", fmt.Errorf("service: generate token: %w", err)
 	}
 	return base64.RawURLEncoding.EncodeToString(b), nil
 }
 
+// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
+// entropy). The raw token goes in the cookie; only its hash is persisted.
+func newSessionToken() (string, error) { return randToken(32) }
+
+// newPublicToken returns a fresh unguessable token for a garden's public share
+// link (18 bytes → 144 bits; a 24-char URL segment). Unlike a session token it's
+// stored raw (it must be shown back to the owner to copy) and grants only
+// read-only access to one garden.
+func newPublicToken() (string, error) { return randToken(18) }
+
 // hashToken maps a raw bearer token to the hex sha256 stored as the session's
 // primary key.
 func hashToken(raw string) string {