mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
11 lines
590 B
SQL
11 lines
590 B
SQL
-- Shared links gain a secret that rides in the URL fragment: /s/<token>#<key>.
|
|
-- Browsers never send a fragment to the origin, so a crawler that harvests the
|
|
-- link's path alone still cannot read the entry. The server keeps only the
|
|
-- key's hash; the plaintext exists once, in the link the author copied.
|
|
--
|
|
-- Links minted before this migration have no key, and there is no way to give
|
|
-- them one without leaving a permanent keyless bypass, so they are revoked.
|
|
ALTER TABLE entries ADD COLUMN share_key_hash TEXT;
|
|
|
|
UPDATE entries SET share_token = NULL WHERE share_token IS NOT NULL;
|