Kevin L'Hereec
da71d33450
Adds the ability for an owner to share a computer build via a public, unauthenticated link, inspired by a feature request from the original pcbuilder repo (no such feature actually existed there — implemented from scratch here). - New columns on computers: share_token (unique, nullable), share_enabled, share_show_sell_price, share_show_cost - computer_share_service.ts: generates a non-guessable share token (crypto.randomBytes, base64url), enables/disables sharing, and supports rotating the token to invalidate previously distributed links - ComputerShareController (authenticated, owner-scoped like the rest of the app): PUT /computers/:id/share to update settings, POST /computers/:id/share/rotate to rotate the token - PublicComputerController + GET /share/:token (outside any auth/guest group, reachable anonymously): resolves only computers with share_enabled = true, 404 otherwise - ComputerPublicTransformer: dedicated read-only projection that never leaks userId, and only includes sellPrice/cost when the owner opted in via share_show_sell_price / share_show_cost — everything else (title, scores, state, components, pictures) is always visible on a shared link - ComputerShareModal.vue: owner-facing UI (toggle sharing, choose which prices to expose, copy the public link, revoke/rotate it) wired into computers/show.vue via a new 'Share' button - share/show.vue: public page rendered with EmptyLayout (no authenticated header/sidebar) - Boolean columns use a cast since MySQL returns tinyint(1), not native booleans, through Lucid - 6 new functional tests covering: enabling sharing, price visibility toggles, disabling sharing revokes the link, cross-user protection on the share settings endpoint (404), token rotation invalidating the old link, and anonymous access to a shared computer
31 lines
1.1 KiB
TypeScript
31 lines
1.1 KiB
TypeScript
import type Computer from '#models/computer'
|
|
|
|
/**
|
|
* Transforms a Computer into the shape exposed on the public share page.
|
|
* Unlike the regular serialize(), this never leaks the owner id, and only
|
|
* includes sellPrice/cost when the owner explicitly enabled that on the
|
|
* share settings.
|
|
*/
|
|
export default class ComputerPublicTransformer {
|
|
static transform(computer: typeof Computer.prototype) {
|
|
return {
|
|
id: computer.id,
|
|
title: computer.title,
|
|
gpuScore: computer.gpuScore,
|
|
cpuScore: computer.cpuScore,
|
|
globalScore: computer.globalScore,
|
|
state: { name: computer.state.name },
|
|
sellPrice: computer.shareShowSellPrice ? computer.sellPrice : null,
|
|
cost: computer.shareShowCost ? computer.cost : null,
|
|
pictures: computer.pictures
|
|
.map((picture) => ({ link: picture.link, order: picture.order }))
|
|
.sort((a, b) => a.order - b.order),
|
|
components: computer.components.map((component) => ({
|
|
id: component.id,
|
|
name: component.name,
|
|
type: { name: component.type.name },
|
|
})),
|
|
}
|
|
}
|
|
}
|