Public read-only share link (no login / no OIDC) (#41) (#43)

Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action. Closes #41. Co-authored-by: Steve Dudenhoeffer <[email protected]>
2026-07-19 06:18:31 +00:00
parent 5cdc2779d7
commit 9968c06243
15 changed files with 782 additions and 9 deletions
@@ -12,6 +12,7 @@ import { LoginPage } from '@/pages/LoginPage'
 import { RegisterPage } from '@/pages/RegisterPage'
 import { GardensPage } from '@/pages/GardensPage'
 import { GardenEditorPage } from '@/pages/GardenEditorPage'
+import { PublicGardenPage } from '@/pages/PublicGardenPage'
 import { PlantsPage } from '@/pages/PlantsPage'
 import { meQueryOptions } from '@/lib/auth'
 import { queryClient } from '@/lib/queryClient'
@@ -108,6 +109,15 @@ const plantsRoute = createRoute({
  component: PlantsPage,
 })

+// Public read-only garden by share token. Deliberately has NO beforeLoad auth
+// guard, so a logged-out visitor viewing a shared link is never redirected to
+// /login or OIDC.
+const publicGardenRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: 'g/$token',
+  component: PublicGardenPage,
+})
+
 const routeTree = rootRoute.addChildren([
  indexRoute,
  loginRoute,
@@ -115,6 +125,7 @@ const routeTree = rootRoute.addChildren([
  gardensRoute,
  gardenEditorRoute,
  plantsRoute,
+  publicGardenRoute,
 ])

 export const router = createRouter({