feat: add public read-only sharing for computers

Adds the ability for an owner to share a computer build via a public,
unauthenticated link, inspired by a feature request from the original
pcbuilder repo (no such feature actually existed there — implemented
from scratch here).

- New columns on computers: share_token (unique, nullable), share_enabled,
  share_show_sell_price, share_show_cost
- computer_share_service.ts: generates a non-guessable share token
  (crypto.randomBytes, base64url), enables/disables sharing, and supports
  rotating the token to invalidate previously distributed links
- ComputerShareController (authenticated, owner-scoped like the rest of
  the app): PUT /computers/:id/share to update settings, POST
  /computers/:id/share/rotate to rotate the token
- PublicComputerController + GET /share/:token (outside any auth/guest
  group, reachable anonymously): resolves only computers with
  share_enabled = true, 404 otherwise
- ComputerPublicTransformer: dedicated read-only projection that never
  leaks userId, and only includes sellPrice/cost when the owner opted in
  via share_show_sell_price / share_show_cost — everything else (title,
  scores, state, components, pictures) is always visible on a shared link
- ComputerShareModal.vue: owner-facing UI (toggle sharing, choose which
  prices to expose, copy the public link, revoke/rotate it) wired into
  computers/show.vue via a new 'Share' button
- share/show.vue: public page rendered with EmptyLayout (no authenticated
  header/sidebar)
- Boolean columns use a  cast since MySQL returns tinyint(1),
  not native booleans, through Lucid
- 6 new functional tests covering: enabling sharing, price visibility
  toggles, disabling sharing revokes the link, cross-user protection on
  the share settings endpoint (404), token rotation invalidating the old
  link, and anonymous access to a shared computer

app/controllers/computer_share_controller.ts

@@ -0,0 +1,46 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import Computer from '#models/computer'
+import { updateShareSettingsValidator } from '#validators/Computers/share'
+import { disableSharing, enableSharing, rotateShareToken } from '#services/computer_share_service'
+
+export default class ComputerShareController {
+  /**
+   * Update the share settings (enable/disable + which prices are visible)
+   * for a computer owned by the current user.
+   */
+  async update({ auth, params, request, response }: HttpContext) {
+    const user = await auth.authenticate()
+    const computer = await Computer.query()
+      .where('user_id', user.id)
+      .andWhere('id', params.id)
+      .firstOrFail()
+
+    const { enabled, showSellPrice, showCost } = await request.validateUsing(
+      updateShareSettingsValidator
+    )
+
+    if (enabled) {
+      await enableSharing(computer, { showSellPrice, showCost })
+    } else {
+      await disableSharing(computer)
+    }
+
+    return response.redirect(`/computers/${computer.id}`)
+  }
+
+  /**
+   * Rotate the share token for a computer, invalidating any previously
+   * distributed public link.
+   */
+  async rotate({ auth, params, response }: HttpContext) {
+    const user = await auth.authenticate()
+    const computer = await Computer.query()
+      .where('user_id', user.id)
+      .andWhere('id', params.id)
+      .firstOrFail()
+
+    await rotateShareToken(computer)
+
+    return response.redirect(`/computers/${computer.id}`)
+  }
+}

app/controllers/computers_controller.ts

@@ -80,7 +80,9 @@ export default class ComputersController {
       .where('user_id', user.id)
       .andWhere('id', computerId)
       .firstOrFail()
-    return inertia.render('computers/show', { computer: asPageProp(computer.serialize()) })
+    return inertia.render('computers/show', {
+      computer: asPageProp({ ...computer.serialize(), shareToken: computer.shareToken }),
+    })
   }
 
   async edit({ params, inertia, auth }: HttpContext) {

app/controllers/public_computer_controller.ts

@@ -0,0 +1,32 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import Computer from '#models/computer'
+import ComputerPublicTransformer from '#transformers/computer_public_transformer'
+
+export default class PublicComputerController {
+  /**
+   * Publicly display a computer via its share token. No authentication
+   * required. Only resolves computers with sharing explicitly enabled.
+   */
+  async show({ params, inertia, response }: HttpContext) {
+    const computer = await Computer.query()
+      .where('share_token', params.token)
+      .andWhere('share_enabled', true)
+      .preload('state')
+      .preload('components', (componentsQuery) => {
+        componentsQuery.preload('type')
+      })
+      .preload('pictures', (picturesQuery) => {
+        picturesQuery.orderBy('order')
+      })
+      .first()
+
+    if (!computer) {
+      response.status(404)
+      return inertia.render('errors/not_found', {})
+    }
+
+    return inertia.render('share/show', {
+      computer: ComputerPublicTransformer.transform(computer),
+    })
+  }
+}

app/models/computer.ts

@@ -44,6 +44,18 @@ export default class Computer extends BaseModel {
   @column({ serializeAs: null })
   declare userId: number
 
+  @column({ serializeAs: null })
+  declare shareToken: string | null
+
+  @column({ consume: (value: unknown) => Boolean(value) })
+  declare shareEnabled: boolean
+
+  @column({ consume: (value: unknown) => Boolean(value) })
+  declare shareShowSellPrice: boolean
+
+  @column({ consume: (value: unknown) => Boolean(value) })
+  declare shareShowCost: boolean
+
   @column.dateTime({ autoCreate: true })
   declare createdAt: DateTime
 

app/services/computer_share_service.ts

@@ -0,0 +1,50 @@
+import { randomBytes } from 'node:crypto'
+import Computer from '#models/computer'
+
+/**
+ * Generates a URL-safe, non-guessable share token.
+ */
+function generateShareToken(): string {
+  return randomBytes(24).toString('base64url')
+}
+
+/**
+ * Enables sharing for a computer, generating a share token if it doesn't
+ * already have one. Idempotent: calling it again just updates the display
+ * options without rotating the existing token.
+ */
+async function enableSharing(
+  computer: Computer,
+  options: { showSellPrice: boolean; showCost: boolean }
+) {
+  if (!computer.shareToken) {
+    computer.shareToken = generateShareToken()
+  }
+  computer.shareEnabled = true
+  computer.shareShowSellPrice = options.showSellPrice
+  computer.shareShowCost = options.showCost
+  await computer.save()
+  return computer
+}
+
+/**
+ * Disables sharing for a computer. The share token is kept so re-enabling
+ * later doesn't require distributing a new link, but the public route only
+ * resolves computers where shareEnabled is true.
+ */
+async function disableSharing(computer: Computer) {
+  computer.shareEnabled = false
+  await computer.save()
+  return computer
+}
+
+/**
+ * Rotates the share token, invalidating any previously distributed link.
+ */
+async function rotateShareToken(computer: Computer) {
+  computer.shareToken = generateShareToken()
+  await computer.save()
+  return computer
+}
+
+export { enableSharing, disableSharing, rotateShareToken }

app/transformers/computer_public_transformer.ts

@@ -0,0 +1,30 @@
+import type Computer from '#models/computer'
+
+/**
+ * Transforms a Computer into the shape exposed on the public share page.
+ * Unlike the regular serialize(), this never leaks the owner id, and only
+ * includes sellPrice/cost when the owner explicitly enabled that on the
+ * share settings.
+ */
+export default class ComputerPublicTransformer {
+  static transform(computer: typeof Computer.prototype) {
+    return {
+      id: computer.id,
+      title: computer.title,
+      gpuScore: computer.gpuScore,
+      cpuScore: computer.cpuScore,
+      globalScore: computer.globalScore,
+      state: { name: computer.state.name },
+      sellPrice: computer.shareShowSellPrice ? computer.sellPrice : null,
+      cost: computer.shareShowCost ? computer.cost : null,
+      pictures: computer.pictures
+        .map((picture) => ({ link: picture.link, order: picture.order }))
+        .sort((a, b) => a.order - b.order),
+      components: computer.components.map((component) => ({
+        id: component.id,
+        name: component.name,
+        type: { name: component.type.name },
+      })),
+    }
+  }
+}

app/validators/Computers/share.ts

@@ -0,0 +1,9 @@
+import vine from '@vinejs/vine'
+
+export const updateShareSettingsValidator = vine.compile(
+  vine.object({
+    enabled: vine.boolean(),
+    showSellPrice: vine.boolean(),
+    showCost: vine.boolean(),
+  })
+)