feat(shopping-lists): Share a list by revocable link (version 1)

README.md

@@ -21,6 +21,7 @@ Under the hood it is a full production stack: a Next.js frontend that also acts
 - Product search across 29 Croatian retail chains (with barcode scanning)
 - Price comparison per store and price history charts ("is the discount real?")
 - Smart shopping lists with per-store basket totals
+- Shared shopping lists via a private link, with view, shop or edit access and a revocable token
 - Product watchlist
 - Installable PWA that works offline (IndexedDB reads, background-sync writes)
 - Google + email/password auth with account linking
@@ -31,7 +32,6 @@ Under the hood it is a full production stack: a Next.js frontend that also acts
 - Digital loyalty cards
 - Store map with working hours
 - Spending analysis and market statistics
-- Shopping list sharing
 
 ## Tech stack
 

backend/src/main/java/disscount/config/OptionalBearerAuthenticationFilter.java

@@ -0,0 +1,71 @@
+package disscount.config;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpHeaders;
+import org.springframework.lang.NonNull;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtException;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+/**
+ * Authenticates a bearer token when one is present and usable, and lets the request through
+ * anonymously when it is not.
+ *
+ * <p>This exists because a share link has to work for both. The standard
+ * {@code BearerTokenAuthenticationFilter} rejects an expired or malformed token with 401
+ * before authorization rules are consulted, so a permitAll endpoint is not actually reachable
+ * by a caller whose cached token has gone stale. Dropping the resource server from the shared
+ * chain instead would fix that but break the other half: a signed-in recipient would be seen
+ * as anonymous and capped at VIEW however generous the link is.
+ *
+ * <p>Validation itself is unchanged and is not hand-rolled. This injects the same
+ * {@code JwtDecoder} bean the resource server uses, so a token is still checked against the
+ * better-auth JWKS, pinned to ES256, and validated for issuer and expiry. Only the response to
+ * a failed check differs: continue anonymously instead of committing a 401. Spring's OAuth2
+ * resource-server DSL has no supported way to express that, because its entry point commits
+ * the response rather than continuing the chain.
+ */
+@Component
+@RequiredArgsConstructor
+public class OptionalBearerAuthenticationFilter extends OncePerRequestFilter {
+
+    private static final String BEARER_PREFIX = "Bearer ";
+
+    private final JwtDecoder jwtDecoder;
+    private final JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
+
+    @Override
+    protected void doFilterInternal(
+            @NonNull HttpServletRequest request,
+            @NonNull HttpServletResponse response,
+            @NonNull FilterChain chain
+    ) throws ServletException, IOException {
+        String header = request.getHeader(HttpHeaders.AUTHORIZATION);
+
+        // RFC 7235 makes the scheme name case-insensitive. Our own client always sends
+        // "Bearer", but a recipient arriving from anything else should not be silently
+        // demoted to anonymous over capitalisation.
+        if (header != null
+                && header.regionMatches(true, 0, BEARER_PREFIX, 0, BEARER_PREFIX.length())) {
+            try {
+                Jwt jwt = jwtDecoder.decode(header.substring(BEARER_PREFIX.length()));
+                SecurityContextHolder.getContext().setAuthentication(converter.convert(jwt));
+            } catch (JwtException ignored) {
+                // Expired, malformed or issued elsewhere. The caller keeps whatever the link
+                // grants an anonymous visitor, which the access resolver caps at VIEW.
+            }
+        }
+
+        chain.doFilter(request, response);
+    }
+}

backend/src/main/java/disscount/config/SecurityConfig.java

@@ -3,8 +3,10 @@
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -16,6 +18,7 @@
 import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
 
 @Configuration
 @EnableWebSecurity
@@ -39,7 +42,65 @@ public JwtDecoder jwtDecoder(
         return decoder;
     }
 
+    /**
+     * Spring Boot auto-registers every {@code Filter} bean into the servlet chain, so a
+     * {@code @Component} filter meant only for a security chain runs twice: once where it was
+     * placed and once for every request that never reaches that chain. Both of these extend
+     * {@code OncePerRequestFilter}, whose already-filtered attribute makes the second run a
+     * no-op only when the first one happened, so on any path outside {@code /api/shared/**}
+     * the optional bearer filter would decode the token again after the real chain had
+     * finished with it. These beans turn the servlet registration off and leave the security
+     * chains as the only place either filter runs.
+     */
     @Bean
+    public FilterRegistrationBean<UserProvisioningFilter> userProvisioningFilterRegistration(
+            UserProvisioningFilter filter
+    ) {
+        FilterRegistrationBean<UserProvisioningFilter> registration = new FilterRegistrationBean<>(filter);
+        registration.setEnabled(false);
+        return registration;
+    }
+
+    @Bean
+    public FilterRegistrationBean<OptionalBearerAuthenticationFilter> optionalBearerFilterRegistration(
+            OptionalBearerAuthenticationFilter filter
+    ) {
+        FilterRegistrationBean<OptionalBearerAuthenticationFilter> registration = new FilterRegistrationBean<>(filter);
+        registration.setEnabled(false);
+        return registration;
+    }
+
+    /**
+     * Shared lists get their own chain because they are the one place where a bearer token is
+     * optional. Authorization happens on the share token plus ShoppingListAccessService, and
+     * the caller may legitimately be anonymous, so a token that fails to decode must degrade
+     * to anonymous rather than 401. permitAll on the main chain cannot express that: its
+     * bearer filter rejects a stale token before authorization is ever consulted.
+     */
+    @Bean
+    @Order(1)
+    public SecurityFilterChain sharedShoppingListChain(
+            HttpSecurity http,
+            OptionalBearerAuthenticationFilter optionalBearerAuthenticationFilter
+    ) throws Exception {
+        http
+            .securityMatcher("/api/shared/**")
+            .csrf(csrf -> csrf.disable())
+            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(authz -> authz.anyRequest().permitAll())
+            // Provisioning is anchored on the bearer filter rather than sharing the
+            // anonymous anchor with it. Two addFilterBefore calls against one anchor get the
+            // same order and only stay in sequence because the sort happens to be stable,
+            // which is not something to depend on: provisioning has to see the
+            // authentication the bearer filter produced.
+            .addFilterBefore(optionalBearerAuthenticationFilter, AnonymousAuthenticationFilter.class)
+            .addFilterAfter(userProvisioningFilter, OptionalBearerAuthenticationFilter.class);
+
+        return http.build();
+    }
+
+    @Bean
+    @Order(2)
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
             .csrf(csrf -> csrf.disable())

backend/src/main/java/disscount/shoppingList/dao/ShoppingListRepository.java

@@ -36,4 +36,7 @@ public interface ShoppingListRepository extends JpaRepository<ShoppingList, UUID
 
     @Query("SELECT sl FROM ShoppingList sl WHERE sl.id = :id AND sl.owner = :owner AND sl.deletedAt IS NULL")
     Optional<ShoppingList> findActiveByIdAndOwner(UUID id, User owner);
+
+    @Query("SELECT sl FROM ShoppingList sl WHERE sl.shareToken = :shareToken AND sl.deletedAt IS NULL")
+    Optional<ShoppingList> findActiveByShareToken(UUID shareToken);
 }

backend/src/main/java/disscount/shoppingList/domain/LinkAccess.java

@@ -0,0 +1,23 @@
+package disscount.shoppingList.domain;
+
+/**
+ * The levels a share link can actually be set to, which is every {@link ListAccess} value
+ * except OWNER.
+ *
+ * <p>This is a separate enum rather than a validated {@code ListAccess} so that OWNER is not
+ * expressible on the wire at all. Jackson rejects it during deserialization, before any
+ * service code runs, which means the guard in {@code ShoppingListService.applyLinkAccess} is
+ * no longer the only thing standing between a typo and a caller granting themselves the
+ * ability to manage sharing.
+ */
+public enum LinkAccess {
+
+    NONE,
+    VIEW,
+    SHOP,
+    EDIT;
+
+    public ListAccess toListAccess() {
+        return ListAccess.valueOf(name());
+    }
+}

backend/src/main/java/disscount/shoppingList/domain/ListAccess.java

@@ -0,0 +1,35 @@
+package disscount.shoppingList.domain;
+
+/**
+ * What a caller may do with a shopping list.
+ *
+ * <p>Only NONE, VIEW, SHOP and EDIT are ever stored in {@code shopping_list.link_access}.
+ * OWNER is produced by {@link disscount.shoppingList.service.ShoppingListAccessService}
+ * and never persisted.
+ */
+public enum ListAccess {
+
+    NONE,
+    VIEW,
+    SHOP,
+    EDIT,
+    OWNER;
+
+    public boolean canView() {
+        return this != NONE;
+    }
+
+    /** The in-the-shop level: tick an item off, switch its store, snapshot its price. */
+    public boolean canCheck() {
+        return this == SHOP || this == EDIT || this == OWNER;
+    }
+
+    /** Amount, removal and the list title. Adding items arrives with membership. */
+    public boolean canEditItems() {
+        return this == EDIT || this == OWNER;
+    }
+
+    public boolean canManageShare() {
+        return this == OWNER;
+    }
+}

backend/src/main/java/disscount/shoppingList/domain/ShoppingList.java

@@ -34,9 +34,16 @@ public class ShoppingList {
     @Column(nullable = false)
     private String title;
 
-    @Column(name = "is_public", nullable = false)
-    @Builder.Default
-    private Boolean isPublic = false;
+    // Nullable because ddl-auto=update cannot add a NOT NULL column to a populated table.
+    // Read it through resolvedLinkAccess(), never directly.
+    @Enumerated(EnumType.STRING)
+    @Column(name = "link_access", length = 16)
+    private ListAccess linkAccess;
+
+    // Deliberately not the list id: a token can be rotated, so turning sharing off and on
+    // again actually revokes instead of handing the same URL back to everyone who kept it.
+    @Column(name = "share_token", unique = true)
+    private UUID shareToken;
 
     @Column(name = "updated_at", nullable = false)
     private LocalDateTime updatedAt;
@@ -51,6 +58,11 @@ public class ShoppingList {
     @Builder.Default
     private List<ShoppingListItem> items = new ArrayList<>();
 
+    /** Null link access means the list is not shared at all. */
+    public ListAccess resolvedLinkAccess() {
+        return linkAccess != null ? linkAccess : ListAccess.NONE;
+    }
+
     @PrePersist
     protected void onCreate() {
         LocalDateTime now = Timestamps.nowUtc();

backend/src/main/java/disscount/shoppingList/dto/ShoppingListDto.java

@@ -7,6 +7,7 @@
 import java.util.List;
 import java.util.UUID;
 
+import disscount.shoppingList.domain.ListAccess;
 import disscount.shoppingListItem.dto.ShoppingListItemDto;
 
 @Data
@@ -16,7 +17,15 @@ public class ShoppingListDto {
     private UUID id;
     private UUID ownerId;
     private String title;
-    private Boolean isPublic;
+
+    // Both owner-only: a link visitor handed the token could reshare the list at a level
+    // its owner never granted.
+    private ListAccess linkAccess;
+    private UUID shareToken;
+
+    /** The caller's resolved access, echoed back so the frontend never re-derives the rule. */
+    private ListAccess myAccess;
+
     private LocalDateTime updatedAt;
     private LocalDateTime createdAt;
     private List<ShoppingListItemDto> items;

backend/src/main/java/disscount/shoppingList/dto/ShoppingListRequest.java

@@ -3,11 +3,16 @@
 import jakarta.validation.constraints.NotBlank;
 import lombok.Data;
 
+import disscount.shoppingList.domain.LinkAccess;
+
 @Data
 public class ShoppingListRequest {
 
     @NotBlank(message = "Title is required")
     private String title;
 
-    private Boolean isPublic = false;
+    // Owner-only, and ignored on create: sharing is turned on from an existing list,
+    // because there is no id to bind a token to until the list has been saved.
+    // LinkAccess rather than ListAccess, so OWNER cannot be sent at all.
+    private LinkAccess linkAccess;
 }

backend/src/main/java/disscount/shoppingList/rest/SharedShoppingListController.java

@@ -0,0 +1,80 @@
+package disscount.shoppingList.rest;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import disscount.shoppingList.dto.ShoppingListDto;
+import disscount.shoppingList.dto.ShoppingListRequest;
+import disscount.shoppingList.service.SharedShoppingListService;
+import disscount.shoppingListItem.dto.ShoppingListItemDto;
+import disscount.shoppingListItem.dto.ShoppingListItemRequest;
+import disscount.util.SecurityUtils;
+
+import java.util.UUID;
+
+/**
+ * Public entry point for shared lists. Permit-all at the filter chain; the real check is the
+ * token plus {@link disscount.shoppingList.service.ShoppingListAccessService}.
+ *
+ * <p>Callers may be anonymous, so every method reads the user through
+ * {@code getCurrentUserIdOptional()} and never {@code getCurrentUserId()}, which throws.
+ */
+@RestController
+@RequestMapping("/api/shared")
+@RequiredArgsConstructor
+@Tag(name = "Shared Shopping Lists", description = "Shopping lists reachable by share token")
+public class SharedShoppingListController {
+
+    private final SharedShoppingListService sharedShoppingListService;
+
+    @Operation(summary = "Get a shared shopping list by its share token")
+    @GetMapping("/{token}")
+    public ResponseEntity<ShoppingListDto> getSharedShoppingList(@PathVariable String token) {
+        UUID userId = currentUserId();
+        return sharedShoppingListService.getByToken(token, userId)
+                .map(ResponseEntity::ok)
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    @Operation(summary = "Rename a shared shopping list")
+    @PutMapping("/{token}")
+    public ResponseEntity<ShoppingListDto> updateSharedShoppingList(
+            @PathVariable String token,
+            @Valid @RequestBody ShoppingListRequest request) {
+        UUID userId = currentUserId();
+        return sharedShoppingListService.updateTitle(token, userId, request)
+                .map(ResponseEntity::ok)
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    @Operation(summary = "Update an item on a shared shopping list")
+    @PutMapping("/{token}/items/{itemId}")
+    public ResponseEntity<ShoppingListItemDto> updateSharedItem(
+            @PathVariable String token,
+            @PathVariable UUID itemId,
+            @Valid @RequestBody ShoppingListItemRequest request) {
+        UUID userId = currentUserId();
+        return sharedShoppingListService.updateItem(token, itemId, userId, request)
+                .map(ResponseEntity::ok)
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    @Operation(summary = "Delete an item from a shared shopping list")
+    @DeleteMapping("/{token}/items/{itemId}")
+    public ResponseEntity<Void> deleteSharedItem(
+            @PathVariable String token,
+            @PathVariable UUID itemId) {
+        UUID userId = currentUserId();
+        return sharedShoppingListService.deleteItem(token, itemId, userId)
+                ? ResponseEntity.noContent().build()
+                : ResponseEntity.notFound().build();
+    }
+
+    private UUID currentUserId() {
+        return SecurityUtils.getCurrentUserIdOptional().orElse(null);
+    }
+}