From ea1d0023bfee55358ebb1a96f3d06e783a219c0d Mon Sep 17 00:00:00 2001
From: Mohamed Bassem <me@mbassem.com>
Date: Sun, 1 Jun 2025 20:46:41 +0100
Subject: feat: Add support for public lists (#1511)

* WIP: public lists

* Drop viewing modes

* Add the public endpoint for assets

* regen the openapi spec

* proper handling for different asset types

* Add num bookmarks and a no bookmark banner

* Correctly set page title

* Add a not-found page

* merge the RSS and public list endpoints

* Add e2e tests for the public endpoints

* Redesign the share list modal

* Make NEXTAUTH_SECRET not required

* propery render text bookmarks

* rebase migration

* fix public token tests

* Add more tests
---
 packages/api/routes/public.ts | 47 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 packages/api/routes/public.ts

(limited to 'packages/api/routes/public.ts')

diff --git a/packages/api/routes/public.ts b/packages/api/routes/public.ts
new file mode 100644
index 00000000..d17049c4
--- /dev/null
+++ b/packages/api/routes/public.ts
@@ -0,0 +1,47 @@
+import { zValidator } from "@hono/zod-validator";
+import { and, eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+
+import { assets } from "@karakeep/db/schema";
+import { verifySignedToken } from "@karakeep/shared/signedTokens";
+import { zAssetSignedTokenSchema } from "@karakeep/shared/types/assets";
+
+import { unauthedMiddleware } from "../middlewares/auth";
+import { serveAsset } from "../utils/assets";
+
+const app = new Hono().get(
+  "/assets/:assetId",
+  unauthedMiddleware,
+  zValidator(
+    "query",
+    z.object({
+      token: z.string(),
+    }),
+  ),
+  async (c) => {
+    const assetId = c.req.param("assetId");
+    const tokenPayload = verifySignedToken(
+      c.req.valid("query").token,
+      zAssetSignedTokenSchema,
+    );
+    if (!tokenPayload) {
+      return c.json({ error: "Invalid or expired token" }, { status: 403 });
+    }
+    if (tokenPayload.assetId !== assetId) {
+      return c.json({ error: "Invalid or expired token" }, { status: 403 });
+    }
+    const userId = tokenPayload.userId;
+
+    const assetDb = await c.var.ctx.db.query.assets.findFirst({
+      where: and(eq(assets.id, assetId), eq(assets.userId, userId)),
+    });
+
+    if (!assetDb) {
+      return c.json({ error: "Asset not found" }, { status: 404 });
+    }
+    return await serveAsset(c, assetId, userId);
+  },
+);
+
+export default app;
-- 
cgit v1.2.3-70-g09d2