trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/link-share-tokens/tasks.md
Ullrich Schäfer 5dd4968626 docs+openspec: prior-art research (Organic Maps, Endurain, wanderer) and 15 proposals 
Add docs/inspirations.md as the durable record of the 2026-07-05/06
prior-art research — per-project learnings with source paths, canonical
credit lines, and the changes each spawned — and extend the
acknowledgment lists in philosophy.md/architecture.md (Organic Maps,
Endurain, wanderer).

New OpenSpec changes (proposal/design/specs/tasks each):
- Organic Maps: elevation-profile-hardening, gpx-parser-robustness,
  hiking-time-estimate, poi-index, hiking-foot-profile
- Endurain: account-export, activity-duplicate-review,
  fit-parsing-hardening, activity-locations, self-hosting-guide,
  activity-privacy-controls
- wanderer: federation-hardening, link-share-tokens
- credits-page (user-visible acknowledgments)

Updated in-flight changes with wanderer prior-art sections:
route-federation, route-discovery.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 07:23:00 +02:00

1.4 KiB
Raw Permalink Blame History

1. Schema & token core

  • 1.1 Add share_links table (resource type+id, owner FK, token hash, label, expiresAt, revokedAt, createdAt, lastUsedAt; cascade on resource delete) + migration
  • 1.2 Token helpers: generate (128-bit base64url), hash, resolve (single indexed lookup, throttled lastUsedAt update); unit tests

2. Access integration

  • 2.1 Route + activity detail loaders: accept ?share= token → non-owner read view for private resources; token echoed to sub-resource fetches (elevation, thumbnail); noindex on link-accessed pages
  • 2.2 Compose with privacy mask (if activity-privacy-controls landed) and GPX-download rules; regression test: fully-flagged activity via link leaks nothing extra
  • 2.3 Rate-limit token resolution per IP (reuse rate-limiting package); test 429 path
  • 2.4 Verify feeds/listings/search/outbox remain unaffected by link existence (assertion test)

3. UI

  • 3.1 "Share links" section in the route/activity share dialog: create (optional expiry + label), one-time token copy, list with created/last-used, revoke (i18n en/de)
  • 3.2 E2E: create link as owner → open in logged-out context → read view renders; revoke → link dead; second link unaffected

4. Docs & verification

  • 4.1 Privacy manifest: document share links (what's stored: hash + last-used; query-token-in-logs note)
  • 4.2 Run pnpm typecheck && pnpm lint && pnpm test && pnpm test:e2e