Kevin L'Hereec
da71d33450
Adds the ability for an owner to share a computer build via a public, unauthenticated link, inspired by a feature request from the original pcbuilder repo (no such feature actually existed there — implemented from scratch here). - New columns on computers: share_token (unique, nullable), share_enabled, share_show_sell_price, share_show_cost - computer_share_service.ts: generates a non-guessable share token (crypto.randomBytes, base64url), enables/disables sharing, and supports rotating the token to invalidate previously distributed links - ComputerShareController (authenticated, owner-scoped like the rest of the app): PUT /computers/:id/share to update settings, POST /computers/:id/share/rotate to rotate the token - PublicComputerController + GET /share/:token (outside any auth/guest group, reachable anonymously): resolves only computers with share_enabled = true, 404 otherwise - ComputerPublicTransformer: dedicated read-only projection that never leaks userId, and only includes sellPrice/cost when the owner opted in via share_show_sell_price / share_show_cost — everything else (title, scores, state, components, pictures) is always visible on a shared link - ComputerShareModal.vue: owner-facing UI (toggle sharing, choose which prices to expose, copy the public link, revoke/rotate it) wired into computers/show.vue via a new 'Share' button - share/show.vue: public page rendered with EmptyLayout (no authenticated header/sidebar) - Boolean columns use a cast since MySQL returns tinyint(1), not native booleans, through Lucid - 6 new functional tests covering: enabling sharing, price visibility toggles, disabling sharing revokes the link, cross-user protection on the share settings endpoint (404), token rotation invalidating the old link, and anonymous access to a shared computer
51 lines
1.4 KiB
TypeScript
51 lines
1.4 KiB
TypeScript
import { randomBytes } from 'node:crypto'
|
|
import Computer from '#models/computer'
|
|
|
|
/**
|
|
* Generates a URL-safe, non-guessable share token.
|
|
*/
|
|
function generateShareToken(): string {
|
|
return randomBytes(24).toString('base64url')
|
|
}
|
|
|
|
/**
|
|
* Enables sharing for a computer, generating a share token if it doesn't
|
|
* already have one. Idempotent: calling it again just updates the display
|
|
* options without rotating the existing token.
|
|
*/
|
|
async function enableSharing(
|
|
computer: Computer,
|
|
options: { showSellPrice: boolean; showCost: boolean }
|
|
) {
|
|
if (!computer.shareToken) {
|
|
computer.shareToken = generateShareToken()
|
|
}
|
|
computer.shareEnabled = true
|
|
computer.shareShowSellPrice = options.showSellPrice
|
|
computer.shareShowCost = options.showCost
|
|
await computer.save()
|
|
return computer
|
|
}
|
|
|
|
/**
|
|
* Disables sharing for a computer. The share token is kept so re-enabling
|
|
* later doesn't require distributing a new link, but the public route only
|
|
* resolves computers where shareEnabled is true.
|
|
*/
|
|
async function disableSharing(computer: Computer) {
|
|
computer.shareEnabled = false
|
|
await computer.save()
|
|
return computer
|
|
}
|
|
|
|
/**
|
|
* Rotates the share token, invalidating any previously distributed link.
|
|
*/
|
|
async function rotateShareToken(computer: Computer) {
|
|
computer.shareToken = generateShareToken()
|
|
await computer.save()
|
|
return computer
|
|
}
|
|
|
|
export { enableSharing, disableSharing, rotateShareToken }
|