A per-garden public link that anyone can open read-only, without logging in and without tripping OIDC.
Toggle on/off, and regenerate (new nonce invalidates the old URL).
Non-authenticated users can view; must NOT redirect to login/OIDC.
Backend
Migration 0004: gardens.public_token TEXT nullable + unique index (where not null).
Owner-only management: GET /gardens/:id/share-link (state), POST (enable / rotate), DELETE (disable).
UnauthenticatedGET /api/v1/public/gardens/:token → read-only full garden (garden + objects + plantings + plants). No requireAuth; the token is the capability. Never leak the token to non-owners in the normal garden payload.
Frontend
/g/$token route with no auth guard (SPA fallback already serves any non-API GET); renders GardenCanvas read-only with minimal chrome; no login redirect.
"Public link" section in the share modal: toggle, copy URL, regenerate.
From a direct request during a working session.
A per-garden public link that anyone can open read-only, without logging in and without tripping OIDC.
- Toggle on/off, and regenerate (new nonce invalidates the old URL).
- Non-authenticated users can view; must NOT redirect to login/OIDC.
## Backend
- Migration `0004`: `gardens.public_token TEXT` nullable + unique index (where not null).
- Owner-only management: `GET /gardens/:id/share-link` (state), `POST` (enable / rotate), `DELETE` (disable).
- **Unauthenticated** `GET /api/v1/public/gardens/:token` → read-only full garden (garden + objects + plantings + plants). No `requireAuth`; the token is the capability. Never leak the token to non-owners in the normal garden payload.
## Frontend
- `/g/$token` route with **no** auth guard (SPA fallback already serves any non-API GET); renders `GardenCanvas` read-only with minimal chrome; no login redirect.
- "Public link" section in the share modal: toggle, copy URL, regenerate.
From a direct request during a working session.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
A per-garden public link that anyone can open read-only, without logging in and without tripping OIDC.
Backend
0004:gardens.public_token TEXTnullable + unique index (where not null).GET /gardens/:id/share-link(state),POST(enable / rotate),DELETE(disable).GET /api/v1/public/gardens/:token→ read-only full garden (garden + objects + plantings + plants). NorequireAuth; the token is the capability. Never leak the token to non-owners in the normal garden payload.Frontend
/g/$tokenroute with no auth guard (SPA fallback already serves any non-API GET); rendersGardenCanvasread-only with minimal chrome; no login redirect.From a direct request during a working session.