Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action.

Closes #41.

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/service/objects.go

@@ -164,15 +164,23 @@ func (s *Service) GardenFull(ctx context.Context, actorID, gardenID int64) (*Ful
 	if err != nil {
 		return nil, err
 	}
-	objects, err := s.store.ListObjectsForGarden(ctx, gardenID)
+	return s.assembleFull(ctx, g)
+}
+
+// assembleFull builds the read-only /full payload for an already-authorized
+// garden: its objects, active plops (with DerivedCount filled in), and the
+// plants those plops reference. Shared by the authenticated GardenFull and the
+// unauthenticated PublicGarden read, so both return the identical shape.
+func (s *Service) assembleFull(ctx context.Context, g *domain.Garden) (*FullGarden, error) {
+	objects, err := s.store.ListObjectsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plantings, err := s.store.ListActivePlantingsForGarden(ctx, gardenID)
+	plantings, err := s.store.ListActivePlantingsForGarden(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}
-	plants, err := s.store.ListReferencedPlants(ctx, gardenID)
+	plants, err := s.store.ListReferencedPlants(ctx, g.ID)
 	if err != nil {
 		return nil, err
 	}