cheapnud/CheapClerk
Watch
1
0
Fork
You've already forked CheapClerk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Serve share links through an interstitial page #7

Merged
cheapnud merged 1 commit from d/share-interstitial into master 2026-08-15 20:03:51 +00:00
Conversation 1 Commits 1 Files changed 2 +60 -8
cheapnud commented 2026-08-15 20:01:10 +00:00
Owner
Copy link

The share token URL now shows a small page with the file one click deeper, so link-preview crawlers in chat apps fetch a harmless stub instead of the document. Adds noindex and no-referrer headers on both share endpoints.

The share token URL now shows a small page with the file one click deeper, so link-preview crawlers in chat apps fetch a harmless stub instead of the document. Adds noindex and no-referrer headers on both share endpoints.
Serve share links through an interstitial page
All checks were successful
Claude PR Review / AI Code Review (pull_request) Successful in 13s
Details
Build & Test / Build and Test (pull_request) Successful in 2m25s
Details
6f98913bee
forgejo-actions commented 2026-08-15 20:01:24 +00:00
Copy link

🤖 Claude AI Code Review

  1. Summary
    Splits the share endpoint into an interstitial HTML page plus a deeper file endpoint, adding noindex/no-referrer headers to keep link-preview crawlers away from documents.

  2. Code Quality ⭐⭐⭐⭐☆
    Clean refactor extracting shared validation logic; title is properly HTML-encoded.

  3. Issues

🟡 Program.cs — shareToken interpolated into href without URL-encoding. The token comes from the route so it's typically already URL-safe, but if a token could contain characters like " or > it would break out of the attribute. Since safeTitle is HTML-encoded but shareToken is not, use Uri.EscapeDataString(shareToken) in the href to be safe and consistent.

🟢 Program.cs — the interstitial does a GetDocumentAsync call the old flow didn't, doubling the round-trips to Paperless for a share view (interstitial + file). Acceptable, just noting the added cost.

  1. Verdict: APPROVE

The token-in-href concern is worth addressing but low-risk given the token format is HMAC/base64url-style. Not a blocker.

📊 Tokens: 3725 input + 409 output | 💰 Cost: ~$0.0289
Generated by Claude Opus 4.8 via Gitea Actions

## 🤖 Claude AI Code Review 1. **Summary** Splits the share endpoint into an interstitial HTML page plus a deeper file endpoint, adding noindex/no-referrer headers to keep link-preview crawlers away from documents. 2. **Code Quality** ⭐⭐⭐⭐☆ Clean refactor extracting shared validation logic; title is properly HTML-encoded. 3. **Issues** 🟡 Program.cs — `shareToken` interpolated into `href` without URL-encoding. The token comes from the route so it's typically already URL-safe, but if a token could contain characters like `"` or `>` it would break out of the attribute. Since `safeTitle` is HTML-encoded but `shareToken` is not, use `Uri.EscapeDataString(shareToken)` in the `href` to be safe and consistent. 🟢 Program.cs — the interstitial does a `GetDocumentAsync` call the old flow didn't, doubling the round-trips to Paperless for a share view (interstitial + file). Acceptable, just noting the added cost. 4. **Verdict**: **APPROVE** The token-in-href concern is worth addressing but low-risk given the token format is HMAC/base64url-style. Not a blocker. --- 📊 **Tokens**: 3725 input + 409 output | 💰 **Cost**: ~$0.0289 *Generated by Claude Opus 4.8 via Gitea Actions*
cheapnud merged commit 9f26c30256 into master 2026-08-15 20:03:51 +00:00
cheapnud deleted branch d/share-interstitial 2026-08-15 20:03:51 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
cheapnud/CheapClerk!7
No description provided.