Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/api.go

@@ -90,6 +90,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gardens.PATCH("/:id/shares/:userId", h.updateShare)
 	gardens.DELETE("/:id/shares/:userId", h.removeShare)
 
+	// Public read-only share link (owner-managed): GET reports state, POST
+	// enables/rotates, DELETE disables. The link itself is served unauthenticated
+	// below.
+	gardens.GET("/:id/share-link", h.getShareLink)
+	gardens.POST("/:id/share-link", h.createShareLink)
+	gardens.DELETE("/:id/share-link", h.deleteShareLink)
+
 	// Objects are addressed by their own id; the service resolves the owning
 	// garden for the permission check.
 	objects := v1.Group("/objects", h.requireAuth())
@@ -110,6 +117,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plants.PATCH("/:id", h.updatePlant)
 	plants.DELETE("/:id", h.deletePlant)
 
+	// Public, unauthenticated read of a garden by its share token. Deliberately
+	// NOT behind requireAuth: the token is the capability, so a logged-out visitor
+	// opens a shared link without being redirected to /login or OIDC. Only GET,
+	// only the read-only /full payload — never a mutation.
+	public := v1.Group("/public")
+	public.GET("/gardens/:token", h.getPublicGarden)
+
 	return r
 }
 

internal/api/public.go

@@ -0,0 +1,68 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// getPublicGarden serves the read-only /full payload for a garden addressed by a
+// public share token. It sits OUTSIDE requireAuth — the token itself is the
+// capability — so a logged-out visitor can open a shared link without ever being
+// bounced to /login or the OIDC flow. An unknown or disabled token is a 404.
+func (h *handlers) getPublicGarden(c *gin.Context) {
+	full, err := h.svc.PublicGarden(c.Request.Context(), c.Param("token"))
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, full)
+}
+
+// getShareLink reports the garden's public-link state (and, to the owner, the
+// current token) so the share dialog can show/copy the URL. Owner only.
+func (h *handlers) getShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	link, err := h.svc.GetPublicShareLink(c.Request.Context(), mustActor(c).ID, id)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// createShareLink enables the public link (idempotent) or, with {"rotate":true},
+// issues a fresh token that invalidates the previous URL. Owner only. The body is
+// optional — a missing/malformed one just means enable-without-rotate.
+func (h *handlers) createShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	var req struct {
+		Rotate bool `json:"rotate"`
+	}
+	_ = c.ShouldBindJSON(&req)
+	link, err := h.svc.EnablePublicShareLink(c.Request.Context(), mustActor(c).ID, id, req.Rotate)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// deleteShareLink disables the public link. Owner only; idempotent.
+func (h *handlers) deleteShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	if err := h.svc.DisablePublicShareLink(c.Request.Context(), mustActor(c).ID, id); err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"enabled": false})
+}

internal/api/public_test.go

@@ -0,0 +1,105 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+func shareLinkPath(gid int64) string {
+	return "/api/v1/gardens/" + strconv.FormatInt(gid, 10) + "/share-link"
+}
+func publicGardenPath(token string) string { return "/api/v1/public/gardens/" + token }
+
+// TestPublicShareLinkAPI checks the HTTP surface: owner-only link management, and
+// an unauthenticated public read that returns 200 (never a redirect) for a live
+// token and 404 for an unknown/rotated/disabled one — without a session cookie.
+func TestPublicShareLinkAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	owner := registerAndCookie(t, r, "[email protected]")
+	other := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, owner, "Owner's yard")
+
+	// Seed a bed so the public payload has visible content.
+	if w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "bed", "xCm": 500, "yCm": 500, "widthCm": 200, "heightCm": 200}, owner); w.Code != http.StatusCreated {
+		t.Fatalf("seed bed = %d, body %s", w.Code, w.Body.String())
+	}
+
+	// Disabled by default.
+	w := doJSON(t, r, http.MethodGet, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get link = %d, body %s", w.Code, w.Body.String())
+	}
+	if decodeMap(t, w.Body.Bytes())["enabled"] != false {
+		t.Fatalf("new garden link should be disabled: %s", w.Body.String())
+	}
+
+	// A non-owner can't manage the link (garden invisible to them → 404 masked).
+	if w := doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, other); w.Code != http.StatusNotFound {
+		t.Errorf("non-owner enable = %d, want 404", w.Code)
+	}
+
+	// Owner enables → a token.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), nil, owner)
+	if w.Code != http.StatusOK {
+		t.Fatalf("enable = %d, body %s", w.Code, w.Body.String())
+	}
+	body := decodeMap(t, w.Body.Bytes())
+	if body["enabled"] != true {
+		t.Fatalf("enable body = %s, want enabled", w.Body.String())
+	}
+	tok, _ := body["token"].(string)
+	if tok == "" {
+		t.Fatalf("no token in enable body: %s", w.Body.String())
+	}
+
+	// Public read works with NO cookie — the whole point is no login/redirect.
+	w = doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("public read = %d, body %s", w.Code, w.Body.String())
+	}
+	var full struct {
+		Garden  map[string]any   `json:"garden"`
+		Objects []map[string]any `json:"objects"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &full); err != nil {
+		t.Fatalf("decode public: %v", err)
+	}
+	if int64(full.Garden["id"].(float64)) != gid {
+		t.Errorf("public garden id mismatch: %s", w.Body.String())
+	}
+	if len(full.Objects) != 1 {
+		t.Errorf("public objects = %d, want 1", len(full.Objects))
+	}
+	if _, leaked := full.Garden["publicToken"]; leaked {
+		t.Errorf("public_token leaked into the garden payload: %s", w.Body.String())
+	}
+
+	// Rotate → a new token; the old one stops resolving.
+	w = doJSON(t, r, http.MethodPost, shareLinkPath(gid), map[string]any{"rotate": true}, owner)
+	newTok, _ := decodeMap(t, w.Body.Bytes())["token"].(string)
+	if newTok == "" || newTok == tok {
+		t.Fatalf("rotate token = %q (old %q), want a fresh token", newTok, tok)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(tok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("old token after rotate = %d, want 404", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusOK {
+		t.Errorf("new token = %d, want 200", w.Code)
+	}
+
+	// Disable → the link is off and the token 404s.
+	if w := doJSON(t, r, http.MethodDelete, shareLinkPath(gid), nil, owner); w.Code != http.StatusOK {
+		t.Errorf("disable = %d, body %s", w.Code, w.Body.String())
+	}
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath(newTok), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("token after disable = %d, want 404", w.Code)
+	}
+
+	// An unknown token is a plain 404, never a redirect to login.
+	if w := doJSON(t, r, http.MethodGet, publicGardenPath("nope"), nil, nil); w.Code != http.StatusNotFound {
+		t.Errorf("unknown token = %d, want 404", w.Code)
+	}
+}