feat(files): share-link tokens are kept only hashed and encrypted, and every link change is audited

A /watch link's token is the credential, and it sat in the database as written. Migration 0107
replaces the column with the token's SHA-256 (the lookup) and a Fernet-encrypted copy (so the owner
can copy the same link again); every existing address keeps working, and the downgrade decrypts
them back. Without a copy this key can read, a link still opens but its address cannot be shown:
"Copy link" then takes the newest link that has one or makes a new one, and the Share dialog says
so in that row instead of a broken URL. Making, changing and revoking a link are audited, never
with its token or password.
This commit is contained in:
2026-10-15 01:02:29 +02:00
parent c31d7f9d65
commit 90567718b2
18 changed files with 480 additions and 60 deletions
@@ -33,5 +33,8 @@
"file_folder_retention": "Folder retention changed",
"file_folder_delete": "Folder deleted",
"api_token_create": "API token created",
"api_token_revoke": "API token revoked"
"api_token_revoke": "API token revoked",
"download_link_create": "Share link created",
"download_link_update": "Share link changed",
"download_link_revoke": "Share link revoked"
}
@@ -105,6 +105,7 @@
"password": "Password (optional)",
"copy": "Copy link",
"copyFailed": "Couldn’t copy",
"urlHidden": "This link still opens, but its address can no longer be shown. To share the file again, make a new link.",
"revoke": "Revoke",
"revokeConfirm": "This link will stop working immediately.",
"views_one": "{{count}} view",
@@ -33,5 +33,8 @@
"file_folder_retention": "Mappa megőrzési ideje módosítva",
"file_folder_delete": "Mappa törölve",
"api_token_create": "API-token létrehozva",
"api_token_revoke": "API-token visszavonva"
"api_token_revoke": "API-token visszavonva",
"download_link_create": "Megosztási link létrehozva",
"download_link_update": "Megosztási link módosítva",
"download_link_revoke": "Megosztási link visszavonva"
}
@@ -105,6 +105,7 @@
"password": "Jelszó (opcionális)",
"copy": "Link másolása",
"copyFailed": "Nem sikerült másolni",
"urlHidden": "Ez a link továbbra is működik, de a címe már nem jeleníthető meg. Ha újra meg akarod osztani a fájlt, készíts új linket.",
"revoke": "Visszavonás",
"revokeConfirm": "A link azonnal használhatatlanná válik.",
"views_one": "{{count}} megtekintés",