steve/pansy
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Public read-only share link (no login / no OIDC) (#41) #43

Merged
steve merged 2 commits from feat/public-share-link into main 2026-07-19 06:18:31 +00:00
Conversation 3 Commits 2 Files Changed 15
+782 -9
2 Commits
Author SHA1 Message Date
steveandClaude Opus 4.8 0842618ad1 Address review: redact plant owner ids, cache-control, 400, DRY reset
Build image / build-and-push (push) Successful in 15s
Details 
- Security (2-model, security+correctness): the public payload zeroed
  Garden.OwnerID but referenced custom plants still carried Plant.OwnerID,
  leaking the owner's user id to anonymous viewers. Redact plant owner ids
  too, and assert it in the service test.
- Set Cache-Control: no-store on the public read so a capability-URL response
  isn't held in a shared proxy cache and always reflects the live garden.
- createShareLink now 400s on a present-but-malformed JSON body instead of
  silently enabling (an empty body still means enable-without-rotate).
- Extract the transient-editor-state reset into a shared resetTransient store
  action (3-model finding) and use it from PublicGardenPage.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
 2026-07-19 02:17:15 -04:00
steveandClaude Opus 4.8 f3b0ca572d Public read-only share link (#41)
Build image / build-and-push (push) Successful in 8s
Details
Gadfly review (reusable) / review (pull_request) Successful in 10m11s
Details
Adversarial Review (Gadfly) / review (pull_request) Successful in 10m11s
Details 
A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
 2026-07-19 02:04:11 -04:00