feat(public-share): harden read-only links — expiry, password, hard-revoke, rate-limit

[parth0025]

S6-02 — Public read-only share links: security hardening

Hardens the existing public-sharing feature to a real-world, secure baseline. All backward-compatible — legacy shares (16-byte tokens, no expiry/password) keep working.

Backend (Modules/PublicShares/)

• Stronger tokens — new shares use 32-byte (64-hex) random tokens; the token pattern accepts both legacy 32-hex and new 64-hex.
• Expiry — optional expiresAt; resolveShare returns 404 for expired links.
• Password — optional bcrypt password; the public page renders a password gate (POST /share/:token unlock) and validates before showing the board. The hash is never returned (responses expose only hasPassword).
• Hard revoke — DELETE /api/v2/public-shares/:id removes the share doc and its GLOBAL token-index row → link dies immediately + permanently (vs the old soft enabled:false).
• Rate-limiting — express-rate-limit on /share/:token (60/min) and the intake POST (10/min).

Frontend

• PublicShareModal now offers expiry + password on create, shows a 🔒/expiry status row, and a Delete link (hard-revoke) button. + i18n keys.

Notes / scope

• Tokens kept retrievable (re-displayable links are the real-world norm for read-only public shares; hashing/show-once would break "copy link anytime").
• Sensitive-field stripping (only TaskKey/name/status/priority) and noindex were already present and retained.

Verified

• 209 backend tests pass (added a legacy-token backward-compat test); modal + en.js compile.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 93e455ba-94a1-40bd-af89-104b2edaace1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sprint6-share-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}