Strong shares phase 3: mode selector, docs, honest dependency line (#19) #116

Merged

Cordy merged 3 commits from feat/strong-shares-docs into main

2026-08-04 21:27:26 +00:00

Cordy commented

2026-08-04 21:26:07 +00:00

Owner

Final phase of #19.

Share dialog gains a Protection selector — "Key in the link (simplest)" vs "Password (sent separately)" — with a hint that swaps per mode. When the org policy requires passwords the selector is forced to password mode and disabled, matching the server-side enforcement rather than duplicating it. After creating a fragment-mode link the UI warns that the link contains the key and should be treated like the file itself. i18n en/de/fr/it.

docs/handbook/sharing.md (new) carries the claim boundary in the exact words we agreed:

the public share surface stores and serves only ciphertext; compromising the storage backend, the share database, or sniffing the download yields nothing without the key material in the recipient's hand;
not zero-knowledge, said plainly: a compromised server sees content, and the viewer's crypto page is served by that same server — "anyone claiming stronger guarantees for a system where the server serves the crypto page is overselling";
revocation stops future downloads but cannot recall an already-downloaded file;
the peering-vs-link table, the two modes with their trade-offs, upload links, the admin policy block, and operator notes (embedded typage, CPU-per-download, no ranged reads, browser-memory limit for very large files).

README dependency line corrected. It claimed "four third-party dependencies total"; that is now "four Go dependencies … plus exactly one vendored browser asset" naming typage and why it is embedded rather than CDN-loaded. The old line would have been quietly false the moment phase 2 merged.

Handbook index updated. JS syntax checked, Go suite green.

After merge: release + roll .249, then the dogfood pass — send yourself a link in each mode, confirm the raw payload in Garage is ciphertext, and confirm a revoked link dies.

Final phase of #19. **Share dialog** gains a Protection selector — "Key in the link (simplest)" vs "Password (sent separately)" — with a hint that swaps per mode. When the org policy requires passwords the selector is forced to password mode and disabled, matching the server-side enforcement rather than duplicating it. After creating a fragment-mode link the UI warns that the link contains the key and should be treated like the file itself. i18n en/de/fr/it. **`docs/handbook/sharing.md`** (new) carries the claim boundary in the exact words we agreed: - *the public share surface stores and serves only ciphertext; compromising the storage backend, the share database, or sniffing the download yields nothing without the key material in the recipient's hand;* - **not** zero-knowledge, said plainly: a compromised server sees content, and the viewer's crypto page is served by that same server — "anyone claiming stronger guarantees for a system where the server serves the crypto page is overselling"; - revocation stops future downloads but cannot recall an already-downloaded file; - the peering-vs-link table, the two modes with their trade-offs, upload links, the admin policy block, and operator notes (embedded typage, CPU-per-download, no ranged reads, browser-memory limit for very large files). **README dependency line corrected.** It claimed "four third-party dependencies total"; that is now "four Go dependencies … plus exactly one vendored browser asset" naming typage and why it is embedded rather than CDN-loaded. The old line would have been quietly false the moment phase 2 merged. Handbook index updated. JS syntax checked, Go suite green. After merge: release + roll `.249`, then the dogfood pass — send yourself a link in each mode, confirm the raw payload in Garage is ciphertext, and confirm a revoked link dies.

Cordy added 3 commits

2026-08-04 21:26:09 +00:00