Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action. Closes #41. Co-authored-by: Steve Dudenhoeffer <[email protected]>
2026-07-19 06:18:31 +00:00
parent 5cdc2779d7
commit 9968c06243
15 changed files with 782 additions and 9 deletions
@@ -49,6 +49,12 @@ interface EditorState {
  // pan gesture stands down (both listen on the same svg).
  objectDragging: boolean
  setObjectDragging: (v: boolean) => void
+
+  // Clear all transient (non-persisted) editor state at once — selection, focus,
+  // armed plant/kind, and any in-flight live geometry — when entering a garden
+  // view fresh (e.g. the public read-only page on mount). The viewport is left
+  // alone; the canvas re-fits it from the loaded garden.
+  resetTransient: () => void
 }

 export const useEditorStore = create<EditorState>((set) => ({
@@ -78,4 +84,15 @@ export const useEditorStore = create<EditorState>((set) => ({

  objectDragging: false,
  setObjectDragging: (v) => set({ objectDragging: v }),
+
+  resetTransient: () =>
+    set({
+      selectedId: null,
+      selectedPlantingId: null,
+      focusedObjectId: null,
+      armedPlant: null,
+      armedKind: null,
+      liveObject: null,
+      livePlanting: null,
+    }),
 }))