feat: Add session sharing with granular access control #25
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add Prisma models for session sharing feature including direct user-to-user sharing, public shareable links, access logging, and user blocking. Files: - prisma/schema.prisma - prisma/migrations/20260109044634_add_session_sharing/migration.sql
Implement access control functions for session sharing including owner checks, permission validation, and public share access verification. Files: - sources/app/share/accessControl.ts
Implement REST API endpoints for user-to-user session sharing including create, update, delete shares and list shared sessions. Files: - sources/app/api/routes/shareRoutes.ts - sources/app/api/api.ts
Remove accessLevel field from PublicSessionShare model to enforce read-only access for all public links. This improves security by preventing unauthorized edits via public URLs. Files: - prisma/schema.prisma - prisma/migrations/20260109050001_remove_public_share_access_level/migration.sql - sources/app/share/accessControl.ts
Implement REST API endpoints for public session sharing including create, get, delete public links, user blocking, and access logs. Public shares are always view-only. Files: - sources/app/api/routes/publicShareRoutes.ts - sources/app/api/api.ts
Implement privacy-friendly access logging with explicit user consent. Public shares can require consent to view, enabling detailed IP/UA logging only when users agree. Files: - prisma/schema.prisma - prisma/migrations/20260109051716_add_log_access_to_public_share/migration.sql - prisma/migrations/20260109052146_rename_log_access_to_is_consent_required/migration.sql - sources/app/share/accessLogger.ts - sources/app/api/routes/publicShareRoutes.ts - sources/app/api/routes/shareRoutes.ts
Add common profile type definition and fix Buffer type casting issues. All type errors resolved. Files: - sources/app/share/types.ts - sources/app/api/routes/shareRoutes.ts - sources/app/api/routes/publicShareRoutes.ts - sources/app/share/accessControl.ts
Define new update event types for real-time sharing notifications. Includes session-shared, share-updated, share-revoked, and public share events with corresponding builder functions. - sources/app/events/eventRouter.ts
Broadcast Socket.io events when sessions are shared, updated, or revoked. Shared users receive instant notifications about their access changes. - sources/app/api/routes/shareRoutes.ts
Broadcast Socket.io events when public links are created, updated, or deleted. Session owners receive instant notifications about their public sharing status. - sources/app/api/routes/publicShareRoutes.ts
Add unit tests covering access control, logging, and event builders. Tests validate permission checks, IP extraction, consent-based logging, and Socket.io event payload construction. - sources/app/share/accessControl.spec.ts - sources/app/share/accessLogger.spec.ts - sources/app/events/sharingEvents.spec.ts - vitest.config.ts
Document new collaboration features including direct sharing with granular access control and public link sharing with consent-based logging. - README.md
Add friend relationship check before allowing session sharing. Users can only share sessions with friends to prevent spam and unauthorized sharing attempts. - sources/app/share/accessControl.ts - sources/app/api/routes/shareRoutes.ts - sources/app/share/accessControl.spec.ts
Use Prisma transaction to atomically check maxUses limit and increment useCount, preventing concurrent requests from exceeding the usage limit. - sources/app/api/routes/publicShareRoutes.ts
Wrap share deletion operations in transactions to ensure consistent state between database operations and real-time notifications. - sources/app/api/routes/shareRoutes.ts - sources/app/api/routes/publicShareRoutes.ts
Add rate limiting to prevent abuse of sharing functionality: - Public share access: 10 requests/minute - Share creation: 20 requests/minute - Public share creation: 10 requests/minute - sources/app/api/api.ts - sources/app/api/routes/shareRoutes.ts - sources/app/api/routes/publicShareRoutes.ts - package.json
Adds user publicKey to UserProfile type and API responses. Required for encrypting session data keys when sharing. - sources/app/social/type.ts - sources/app/api/routes/userRoutes.ts
Encrypt session data keys on the server using recipient public keys. Removes need for client to handle sensitive encryption keys. - sources/app/share/encryptDataKey.ts - sources/app/api/routes/shareRoutes.ts
Allow clients to generate tokens and encrypt data keys client-side for enhanced security. The server now accepts token parameter and uses it directly instead of generating its own. Files: - sources/app/api/routes/publicShareRoutes.ts
Include session owner profile in 403 response when consent is required. Allows client to display who is sharing before user accepts consent. - sources/app/api/routes/publicShareRoutes.ts
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Implements secure session sharing functionality enabling collaboration on Happy Coder sessions while maintaining end-to-end encryption. Supports both direct user-to-user sharing with granular access control and public link sharing with privacy-first design.
Features
Direct Session Sharing
Public Link Sharing
Security
Implementation Details
Database Schema
SessionShare: Direct user-to-user sharingPublicSessionShare: Public link sharingSessionShareAccessLog&PublicShareAccessLog: Audit trailsPublicShareBlockedUser: User blocking for public sharesAPI Endpoints
POST /api/sessions/:sessionId/shares- Create/update shareGET /api/sessions/:sessionId/shares- List sharesPATCH /api/sessions/:sessionId/shares/:shareId- Update access levelDELETE /api/sessions/:sessionId/shares/:shareId- Revoke accessGET /api/shares/shared-with-me- List sessions shared with userPOST /api/sessions/:sessionId/public-share- Create/update public linkGET /api/sessions/:sessionId/public-share- Get public share infoDELETE /api/sessions/:sessionId/public-share- Delete public linkPOST /api/public-shares/:token/access- Access via public linkReal-time Events
session-shared: Emitted when session is shared with usersession-share-updated: Access level changedsession-share-revoked: Access revokedpublic-share-created: Public link createdpublic-share-updated: Public link settings updatedpublic-share-deleted: Public link deletedTesting
Added comprehensive unit tests covering:
All tests passing (38 tests).
Commits
Migration Required
Run migrations before deploying: