5dd4968626
Add docs/inspirations.md as the durable record of the 2026-07-05/06 prior-art research — per-project learnings with source paths, canonical credit lines, and the changes each spawned — and extend the acknowledgment lists in philosophy.md/architecture.md (Organic Maps, Endurain, wanderer). New OpenSpec changes (proposal/design/specs/tasks each): - Organic Maps: elevation-profile-hardening, gpx-parser-robustness, hiking-time-estimate, poi-index, hiking-foot-profile - Endurain: account-export, activity-duplicate-review, fit-parsing-hardening, activity-locations, self-hosting-guide, activity-privacy-controls - wanderer: federation-hardening, link-share-tokens - credits-page (user-visible acknowledgments) Updated in-flight changes with wanderer prior-art sections: route-federation, route-discovery. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
21 lines
1.4 KiB
Markdown
21 lines
1.4 KiB
Markdown
## 1. Schema & token core
|
|
|
|
- [ ] 1.1 Add `share_links` table (resource type+id, owner FK, token hash, label, expiresAt, revokedAt, createdAt, lastUsedAt; cascade on resource delete) + migration
|
|
- [ ] 1.2 Token helpers: generate (128-bit base64url), hash, resolve (single indexed lookup, throttled lastUsedAt update); unit tests
|
|
|
|
## 2. Access integration
|
|
|
|
- [ ] 2.1 Route + activity detail loaders: accept `?share=` token → non-owner read view for private resources; token echoed to sub-resource fetches (elevation, thumbnail); `noindex` on link-accessed pages
|
|
- [ ] 2.2 Compose with privacy mask (if `activity-privacy-controls` landed) and GPX-download rules; regression test: fully-flagged activity via link leaks nothing extra
|
|
- [ ] 2.3 Rate-limit token resolution per IP (reuse rate-limiting package); test 429 path
|
|
- [ ] 2.4 Verify feeds/listings/search/outbox remain unaffected by link existence (assertion test)
|
|
|
|
## 3. UI
|
|
|
|
- [ ] 3.1 "Share links" section in the route/activity share dialog: create (optional expiry + label), one-time token copy, list with created/last-used, revoke (i18n en/de)
|
|
- [ ] 3.2 E2E: create link as owner → open in logged-out context → read view renders; revoke → link dead; second link unaffected
|
|
|
|
## 4. Docs & verification
|
|
|
|
- [ ] 4.1 Privacy manifest: document share links (what's stored: hash + last-used; query-token-in-logs note)
|
|
- [ ] 4.2 Run `pnpm typecheck && pnpm lint && pnpm test && pnpm test:e2e`
|