fix(files): suppress filename in share previews for email/sso, not just password

Author: TheodoreSpeaks

apps/sim/app/f/[token]/opengraph-image.tsx

@@ -11,18 +11,18 @@ export const size = {
 
 /**
  * Social-preview card for a shared file. Public shares show the file name +
- * provenance; password-protected (and unknown) shares stay generic so the
- * filename never leaks pre-auth.
+ * provenance; protected (password / email / SSO) and unknown shares stay generic
+ * so the filename never leaks pre-auth.
  */
 export default async function Image({ params }: { params: Promise<{ token: string }> }) {
   const { token } = await params
   const resolved = await resolveActiveShareByToken(token)
 
-  if (!resolved || resolved.share.authType === 'password') {
+  if (!resolved || resolved.share.authType !== 'public') {
     return createLandingOgImage({
       eyebrow: 'Shared file',
-      title: 'Password-protected file',
-      subtitle: 'Enter the password to view this file',
+      title: 'Protected file',
+      subtitle: 'Authentication is required to view this file',
     })
   }
 

apps/sim/app/f/[token]/page.tsx

@@ -30,8 +30,8 @@ interface PublicFilePageProps {
 
 /**
  * Social-preview metadata. Public shares unfurl with the file name + provenance;
- * password-protected shares stay deliberately generic so the filename never leaks
- * before the password is entered. Always `noindex`.
+ * any protected share (password / email / SSO) stays deliberately generic so the
+ * filename never leaks before the visitor authenticates. Always `noindex`.
  */
 export async function generateMetadata({ params }: PublicFilePageProps): Promise<Metadata> {
   const { token } = await params
@@ -42,9 +42,9 @@ export async function generateMetadata({ params }: PublicFilePageProps): Promise
 
   let title: string
   let description: string
-  if (resolved.share.authType === 'password') {
+  if (resolved.share.authType !== 'public') {
     title = 'Shared file'
-    description = 'This file is password-protected.'
+    description = 'Authentication is required to view this file.'
   } else {
     title = resolved.file.originalName
     description =

apps/sim/lib/core/security/deployment-auth.ts

@@ -53,8 +53,8 @@ export interface DeploymentAuthResult {
 /**
  * Shared password/email/SSO gate for deployed resources. The `cookiePrefix`
  * selects the auth cookie (`${cookiePrefix}_auth_${id}`) and the rate-limit
- * namespace so chat deployments and public file shares share one code path. File
- * shares only ever use `'public'` / `'password'`, a strict subset of chat's modes.
+ * namespace so chat deployments and public file shares share one code path. Both
+ * support all four modes: `'public'`, `'password'`, `'email'`, and `'sso'`.
  */
 export async function validateDeploymentAuth(
   requestId: string,