Share-link policy enforcement (org ceiling, not just defaults) #62

New issue

Closed

opened 2026-07-29 23:19:45 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-29 23:19:45 +00:00

Owner

Derived from the public-sector analysis (#59, docs/PUBLIC-SECTOR.md). Share defaults shipped in v0.3.10/v0.3.12, but a default is a suggestion — for records handling the organization must be able to enforce link policy.

Scope (new settings-store panel, enforced server-side at share creation):

shareMaxExpiry — links may not outlive this ("Never" selectable only when unset).
shareRequirePassword — share creation without a password is rejected.
shareAllowUploads — org-level kill switch for upload (directory) links.

Enforcement lives in the share-creation API handler (single chokepoint), so web UI, REST, and anything else hitting the endpoint all obey it; the dialog additionally hides/limits options it knows are forbidden. Existing links are not retroactively modified (admin can already revoke via the admin API).

Acceptance: with a 7-day max set, creating a 30-day link via raw API returns 400; with require-password on, the dialog shows the password field as mandatory and the API rejects passwordless creation; settings panel round-trips.

Derived from the public-sector analysis (#59, docs/PUBLIC-SECTOR.md). Share *defaults* shipped in v0.3.10/v0.3.12, but a default is a suggestion — for records handling the organization must be able to **enforce** link policy. **Scope (new settings-store panel, enforced server-side at share creation):** - `shareMaxExpiry` — links may not outlive this ("Never" selectable only when unset). - `shareRequirePassword` — share creation without a password is rejected. - `shareAllowUploads` — org-level kill switch for upload (directory) links. Enforcement lives in the share-creation API handler (single chokepoint), so web UI, REST, and anything else hitting the endpoint all obey it; the dialog additionally hides/limits options it knows are forbidden. Existing links are not retroactively modified (admin can already revoke via the admin API). **Acceptance:** with a 7-day max set, creating a 30-day link via raw API returns 400; with require-password on, the dialog shows the password field as mandatory and the API rejects passwordless creation; settings panel round-trips.