Any artifact can now be made publicly viewable via a share link, no login required - opt-in per artifact, toggled from the feed UI next to Keep. - Artifact.share_token: nullable, unique, high-entropy (secrets.token_urlsafe(32)). NULL = not shared; SQL treats each NULL as distinct so uniqueness still holds for the many not-shared rows. - New public route GET /s/<token> (shared_artifact_view), completely unauthenticated, serving the same rendered/raw content as the owner route via a shared serve_artifact_file() helper. - toggle_artifact_share: generates/clears the token: mirrors toggle_artifact_keep's pattern. - Fixed a real gap this surfaced: embedded images in a shared artifact's content would otherwise break for an anonymous visitor, since asset_view was owner-only. It now also allows access when the asset's parent artifact is currently shared - unattached (orphaned) assets stay private regardless. - serialize_artifact now reports is_shared/share_url so the API reflects sharing status (read-only for now; toggling stays UI-only). - Feed UI: Share button (mirrors Keep's toggle interaction), a copyable share-link box that appears when shared, and a "shared" badge on the artifact row - distinct blue accent from Keep's green so both can be visible on the same row without confusion. Verified live end-to-end (toggle on/off, public access, fake-token 404, old-link-dies-on-unshare, embedded-asset access before/after sharing) before writing the 12 automated tests in tests/views/test_sharing.py. Also fixed two unrelated stale spots noticed in docs/api.md while adding the Sharing section: the example response was missing is_kept/size_bytes, and the raw-content table didn't list json/csv (added earlier this session but never documented there). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
117 lines
3.9 KiB
Python
117 lines
3.9 KiB
Python
from django.conf import settings
|
|
from django.db import models
|
|
|
|
|
|
class Artifact(models.Model):
|
|
HTML_FRAGMENT = "html_fragment"
|
|
HTML_FULL = "html_full"
|
|
MARKDOWN = "markdown"
|
|
DECK = "deck"
|
|
IMAGE = "image"
|
|
PDF = "pdf"
|
|
BINARY = "binary"
|
|
JSON = "json"
|
|
CSV = "csv"
|
|
|
|
AGENT = "agent"
|
|
PERSON = "person"
|
|
SYSTEM = "system"
|
|
|
|
KIND_CHOICES = [
|
|
(HTML_FRAGMENT, "HTML fragment"),
|
|
(HTML_FULL, "Full HTML"),
|
|
(MARKDOWN, "Markdown"),
|
|
(DECK, "Deck"),
|
|
(IMAGE, "Image"),
|
|
(PDF, "PDF"),
|
|
(BINARY, "Binary"),
|
|
(JSON, "JSON"),
|
|
(CSV, "CSV"),
|
|
]
|
|
|
|
SOURCE_TYPE_CHOICES = [
|
|
(AGENT, "Agent"),
|
|
(PERSON, "Person"),
|
|
(SYSTEM, "System"),
|
|
]
|
|
|
|
id = models.CharField(max_length=8, primary_key=True)
|
|
owner = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="artifacts")
|
|
source = models.CharField(max_length=80, db_index=True)
|
|
title = models.CharField(max_length=200)
|
|
kind = models.CharField(max_length=20, choices=KIND_CHOICES)
|
|
theme = models.CharField(max_length=40, blank=True)
|
|
day = models.DateField(db_index=True)
|
|
created_at = models.DateTimeField(auto_now_add=True)
|
|
path = models.CharField(max_length=500)
|
|
original_kind = models.CharField(max_length=20)
|
|
tags = models.JSONField(default=list, blank=True)
|
|
source_prompt = models.TextField(blank=True)
|
|
source_type = models.CharField(max_length=20, choices=SOURCE_TYPE_CHOICES, default=AGENT)
|
|
source_name = models.CharField(max_length=120, blank=True)
|
|
source_id = models.CharField(max_length=120, blank=True)
|
|
metadata = models.JSONField(default=dict, blank=True)
|
|
read_at = models.DateTimeField(null=True, blank=True)
|
|
is_kept = models.BooleanField(default=False)
|
|
size_bytes = models.BigIntegerField(default=0)
|
|
# NULL = not shared. Many rows share NULL (SQL treats each NULL as
|
|
# distinct, so `unique=True` still holds); a real value must be unique
|
|
# since it's the sole credential for the unauthenticated /s/<token> route.
|
|
share_token = models.CharField(max_length=64, null=True, blank=True, unique=True, default=None)
|
|
|
|
@property
|
|
def is_unread(self):
|
|
return self.read_at is None
|
|
|
|
@property
|
|
def is_shared(self):
|
|
return bool(self.share_token)
|
|
|
|
class Meta:
|
|
ordering = ["-created_at"]
|
|
|
|
def __str__(self):
|
|
return f"{self.title} ({self.source})"
|
|
|
|
|
|
class TagColor(models.Model):
|
|
name = models.CharField(max_length=40, primary_key=True)
|
|
color = models.CharField(max_length=20)
|
|
|
|
def __str__(self):
|
|
return f"{self.name} ({self.color})"
|
|
|
|
|
|
class UserProfile(models.Model):
|
|
DEFAULT_QUOTA_BYTES = 1024 * 1024 * 1024 # 1 GB
|
|
|
|
user = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="profile")
|
|
quota_bytes = models.BigIntegerField(default=DEFAULT_QUOTA_BYTES)
|
|
|
|
def __str__(self):
|
|
return f"{self.user} quota={self.quota_bytes}"
|
|
|
|
|
|
class Asset(models.Model):
|
|
"""An image uploaded for embedding inside an artifact's content.
|
|
|
|
Uploaded before the artifact exists, so `artifact` is null until the
|
|
artifact referencing its URL is created. Unattached assets are swept
|
|
after ASSET_ORPHAN_GRACE; attached ones die with their artifact.
|
|
"""
|
|
|
|
id = models.CharField(max_length=12, primary_key=True)
|
|
owner = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="assets")
|
|
artifact = models.ForeignKey(
|
|
Artifact, on_delete=models.CASCADE, related_name="assets", null=True, blank=True
|
|
)
|
|
path = models.CharField(max_length=500)
|
|
content_type = models.CharField(max_length=100)
|
|
size_bytes = models.BigIntegerField(default=0)
|
|
created_at = models.DateTimeField(auto_now_add=True)
|
|
|
|
class Meta:
|
|
ordering = ["-created_at"]
|
|
|
|
def __str__(self):
|
|
return f"{self.id} ({self.content_type})"
|