+ 
+
+);
+
+// Cover-less fallback (eng-review locked option A). Title becomes the visual
+// anchor at display size. No placeholder rectangle, no procedural pattern.
+const textOnlyCard = (title: string, author: string | null) => (
+
+
+
+ {clamp(title, 90)}
+
+ {author && (
+ {clamp(author, 60)}
+ )}
+
+
+
+ Shared via Readest
+ readest.com
+
+
+);
+
+const clamp = (s: string, max: number): string => (s.length > max ? `${s.slice(0, max - 1)}…` : s);
diff --git a/apps/readest-app/src/app/api/share/[token]/revoke/route.ts b/apps/readest-app/src/app/api/share/[token]/revoke/route.ts
new file mode 100644
index 00000000..dc80b3f4
--- /dev/null
+++ b/apps/readest-app/src/app/api/share/[token]/revoke/route.ts
@@ -0,0 +1,62 @@
+import { NextResponse } from 'next/server';
+import { createSupabaseAdminClient } from '@/utils/supabase';
+import { validateUserAndToken } from '@/utils/access';
+import { hashShareToken, isValidShareToken } from '@/libs/share-server';
+
+interface RouteParams {
+ params: Promise<{ token: string }>;
+}
+
+// POST /api/share/[token]/revoke — owner-only. Sets revoked_at = now() so
+// future landing-page visits and downloads return 410. Note: presigned URLs
+// already minted (max ~5 min TTL) cannot be canceled — this is a documented
+// soft-revocation grace, not a hard guarantee.
+export async function POST(request: Request, { params }: RouteParams) {
+ const { token } = await params;
+
+ if (!isValidShareToken(token)) {
+ return NextResponse.json({ error: 'Invalid share token' }, { status: 400 });
+ }
+
+ const { user, token: jwt } = await validateUserAndToken(request.headers.get('authorization'));
+ if (!user || !jwt) {
+ return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+ }
+
+ const supabase = createSupabaseAdminClient();
+ const tokenHash = await hashShareToken(token);
+
+ // RLS would suffice, but we use the admin client elsewhere; gate explicitly
+ // on user_id to keep the contract obvious to readers.
+ const { data: share, error: lookupError } = await supabase
+ .from('book_shares')
+ .select('id, user_id, revoked_at')
+ .eq('token_hash', tokenHash)
+ .maybeSingle();
+
+ if (lookupError) {
+ console.error('book_shares lookup failed:', lookupError);
+ return NextResponse.json({ error: 'Could not look up share' }, { status: 500 });
+ }
+ if (!share) {
+ return NextResponse.json({ error: 'Share not found' }, { status: 404 });
+ }
+ if (share.user_id !== user.id) {
+ return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+ }
+ // Idempotent: re-revoking returns success without churning the timestamp.
+ if (share.revoked_at) {
+ return new NextResponse(null, { status: 204 });
+ }
+
+ const { error: updateError } = await supabase
+ .from('book_shares')
+ .update({ revoked_at: new Date().toISOString() })
+ .eq('id', share.id);
+ if (updateError) {
+ console.error('book_shares revoke failed:', updateError);
+ return NextResponse.json({ error: 'Could not revoke share' }, { status: 500 });
+ }
+
+ return new NextResponse(null, { status: 204 });
+}
diff --git a/apps/readest-app/src/app/api/share/[token]/route.ts b/apps/readest-app/src/app/api/share/[token]/route.ts
new file mode 100644
index 00000000..20032019
--- /dev/null
+++ b/apps/readest-app/src/app/api/share/[token]/route.ts
@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server';
+import { rejectionToHttp, resolveActiveShare } from '@/libs/share-server';
+
+interface RouteParams {
+ params: Promise<{ token: string }>;
+}
+
+// GET /api/share/[token] — public metadata used by the /s landing page.
+// Returns 410 if the share is revoked, expired, or its source file no longer
+// exists. Never returns presigned URLs in this body — covers and downloads
+// are fetched from dedicated endpoints with their own caching semantics.
+export async function GET(_request: Request, { params }: RouteParams) {
+ const { token } = await params;
+
+ const result = await resolveActiveShare(token);
+ if (!result.ok) {
+ const { status, body } = rejectionToHttp(result.reason);
+ return NextResponse.json(body, { status });
+ }
+ const { share } = result;
+
+ return NextResponse.json(
+ {
+ title: share.bookTitle,
+ author: share.bookAuthor,
+ format: share.bookFormat,
+ size: share.bookSize,
+ expiresAt: share.expiresAt,
+ hasCover: !!share.coverFileKey,
+ hasCfi: !!share.cfi,
+ downloadCount: share.downloadCount,
+ },
+ { headers: { 'Cache-Control': 'private, no-store' } },
+ );
+}
diff --git a/apps/readest-app/src/app/api/share/create/route.ts b/apps/readest-app/src/app/api/share/create/route.ts
new file mode 100644
index 00000000..98d1077b
--- /dev/null
+++ b/apps/readest-app/src/app/api/share/create/route.ts
@@ -0,0 +1,178 @@
+import { NextResponse } from 'next/server';
+import { createSupabaseAdminClient } from '@/utils/supabase';
+import { validateUserAndToken } from '@/utils/access';
+import { generateShareToken } from '@/libs/share-server';
+import { objectExists } from '@/utils/object';
+import {
+ SHARE_BASE_URL,
+ SHARE_CFI_MAX_LENGTH,
+ SHARE_EXPIRATION_DAYS,
+ SHARE_MAX_PER_USER,
+} from '@/services/constants';
+
+interface CreateShareBody {
+ bookHash?: unknown;
+ expirationDays?: unknown;
+ title?: unknown;
+ author?: unknown;
+ format?: unknown;
+ cfi?: unknown;
+}
+
+const isAllowedExpiration = (value: unknown): value is number =>
+ typeof value === 'number' &&
+ Number.isInteger(value) &&
+ (SHARE_EXPIRATION_DAYS as readonly number[]).includes(value);
+
+// Bounds the snapshotted text fields the client can pass through. The metadata
+// is rendered on a public landing page and embedded in the OG image, so a
+// hostile client could try to abuse very long values for layout disruption.
+const trimText = (value: unknown, max: number): string | null => {
+ if (typeof value !== 'string') return null;
+ const trimmed = value.trim();
+ if (!trimmed) return null;
+ return trimmed.length > max ? trimmed.slice(0, max) : trimmed;
+};
+
+// Reject the C0 control range (U+0000-U+001F) and DEL (U+007F). The cfi
+// is round-tripped into URLs and rendered into HTML; a control byte in
+// either path would do bad things.
+const isControlChar = (s: string): boolean => /[\u0000-\u001f\u007f]/.test(s);
+
+export async function POST(request: Request) {
+ const { user, token } = await validateUserAndToken(request.headers.get('authorization'));
+ if (!user || !token) {
+ return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+ }
+
+ let body: CreateShareBody;
+ try {
+ body = (await request.json()) as CreateShareBody;
+ } catch {
+ return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
+ }
+
+ const bookHash = trimText(body.bookHash, 64);
+ if (!bookHash) {
+ return NextResponse.json({ error: 'Missing or invalid bookHash' }, { status: 400 });
+ }
+
+ if (!isAllowedExpiration(body.expirationDays)) {
+ return NextResponse.json(
+ {
+ error: `expirationDays must be one of ${SHARE_EXPIRATION_DAYS.join(', ')}`,
+ code: 'invalid_expiration',
+ },
+ { status: 400 },
+ );
+ }
+ const expirationDays = body.expirationDays;
+
+ const title = trimText(body.title, 512);
+ if (!title) {
+ return NextResponse.json({ error: 'Missing or invalid title' }, { status: 400 });
+ }
+ const author = trimText(body.author, 256);
+ const format = trimText(body.format, 16);
+ if (!format) {
+ return NextResponse.json({ error: 'Missing or invalid format' }, { status: 400 });
+ }
+
+ let cfi: string | null = null;
+ if (body.cfi != null) {
+ cfi = trimText(body.cfi, SHARE_CFI_MAX_LENGTH);
+ if (cfi && isControlChar(cfi)) {
+ return NextResponse.json({ error: 'cfi contains invalid characters' }, { status: 400 });
+ }
+ }
+
+ const supabase = createSupabaseAdminClient();
+
+ // Active-share cap — silently enforced. Counts only non-revoked, non-expired rows.
+ const { count: activeCount, error: countError } = await supabase
+ .from('book_shares')
+ .select('id', { count: 'exact', head: true })
+ .eq('user_id', user.id)
+ .is('revoked_at', null)
+ .gt('expires_at', new Date().toISOString());
+ if (countError) {
+ console.error('book_shares cap query failed:', countError);
+ return NextResponse.json({ error: 'Could not check share quota' }, { status: 500 });
+ }
+ if ((activeCount ?? 0) >= SHARE_MAX_PER_USER) {
+ return NextResponse.json(
+ {
+ error: `You have reached the maximum of ${SHARE_MAX_PER_USER} active shares.`,
+ code: 'share_limit_reached',
+ },
+ { status: 429 },
+ );
+ }
+
+ // Look up the live `files` row for this user's book. Re-uploads of the same
+ // hash follow the share automatically because we resolve at every access.
+ const { data: bookFiles, error: filesError } = await supabase
+ .from('files')
+ .select('file_key, file_size')
+ .eq('user_id', user.id)
+ .eq('book_hash', bookHash)
+ .is('deleted_at', null);
+ if (filesError) {
+ console.error('book_shares files lookup failed:', filesError);
+ return NextResponse.json({ error: 'Could not look up book' }, { status: 500 });
+ }
+ if (!bookFiles || bookFiles.length === 0) {
+ return NextResponse.json(
+ { error: 'Book is not uploaded yet', code: 'book_not_uploaded' },
+ { status: 409 },
+ );
+ }
+
+ // Pick the book file (not the cover) by extension. Covers are PNG/JPG;
+ // book files are EPUB/PDF/MOBI/etc. The widest filter is "is not an image".
+ const bookFile = bookFiles.find((f) => !/\.(png|jpe?g|webp|gif)$/i.test(f.file_key));
+ if (!bookFile) {
+ return NextResponse.json(
+ { error: 'Book file row not found', code: 'book_not_uploaded' },
+ { status: 409 },
+ );
+ }
+ const size = bookFile.file_size;
+
+ // The `files` row is inserted before bytes upload (storage/upload.ts:74), so
+ // a ghost row can exist if the client aborted. HEAD R2 to confirm bytes are
+ // really there before we make the share publicly resolvable.
+ const exists = await objectExists(bookFile.file_key);
+ if (!exists) {
+ return NextResponse.json(
+ { error: 'Book upload is incomplete; please retry', code: 'upload_incomplete' },
+ { status: 409 },
+ );
+ }
+
+ const { raw, hash } = await generateShareToken();
+ const expiresAt = new Date(Date.now() + expirationDays * 24 * 60 * 60 * 1000);
+
+ const { error: insertError } = await supabase.from('book_shares').insert({
+ token_hash: hash,
+ token: raw,
+ user_id: user.id,
+ book_hash: bookHash,
+ book_title: title,
+ book_author: author,
+ book_format: format,
+ book_size: size,
+ cfi,
+ expires_at: expiresAt.toISOString(),
+ });
+ if (insertError) {
+ console.error('book_shares insert failed:', insertError);
+ return NextResponse.json({ error: 'Could not create share' }, { status: 500 });
+ }
+
+ return NextResponse.json({
+ token: raw,
+ url: `${SHARE_BASE_URL}/${raw}`,
+ expiresAt: expiresAt.toISOString(),
+ });
+}
diff --git a/apps/readest-app/src/app/api/share/list/route.ts b/apps/readest-app/src/app/api/share/list/route.ts
new file mode 100644
index 00000000..300d094a
--- /dev/null
+++ b/apps/readest-app/src/app/api/share/list/route.ts
@@ -0,0 +1,81 @@
+import { NextResponse } from 'next/server';
+import { createSupabaseAdminClient } from '@/utils/supabase';
+import { validateUserAndToken } from '@/utils/access';
+import { SHARE_BASE_URL } from '@/services/constants';
+
+const PAGE_SIZE = 25;
+
+// GET /api/share/list?cursor=
+
+
+ {clamp(title, 80)}
+
+ {author && (
+ {clamp(author, 60)}
+ )}
+
+
+ Shared via Readest
+ readest.com
+
- {children}
-
-);
-
-const BrandHeader: React.FC<{ title: string; subtitle: string; alt: string }> = ({
- title,
- subtitle,
- alt,
-}) => (
-
-
-);
-
-const PageFooter: React.FC<{ tagline: string }> = ({ tagline }) => (
- {title}
-{subtitle}
-- - Readest - - · - {tagline} -
-); - const OpenAnnotationLanding = () => { const _ = useTranslation(); const router = useRouter(); diff --git a/apps/readest-app/src/app/reader/components/HeaderBar.tsx b/apps/readest-app/src/app/reader/components/HeaderBar.tsx index 8f714dd1..d5f4700a 100644 --- a/apps/readest-app/src/app/reader/components/HeaderBar.tsx +++ b/apps/readest-app/src/app/reader/components/HeaderBar.tsx @@ -26,6 +26,7 @@ import WindowButtons from '@/components/WindowButtons'; import QuickActionMenu from './annotator/QuickActionMenu'; import SidebarToggler from './SidebarToggler'; import BookmarkToggler from './BookmarkToggler'; +import ShareToggler from './ShareToggler'; import NotebookToggler from './NotebookToggler'; import SettingsToggler from './SettingsToggler'; import TranslationToggler from './TranslationToggler'; @@ -219,6 +220,7 @@ const HeaderBar: React.FC
+
+
+
+ {/* Branded header — small Readest mark + headline. Stays compact so
+ the card still fits on common viewports without scroll, but
+ gives the page identity at a glance. */}
+
+
+
+
+
+
+ {/* Cover: dominant visual anchor. aspect-[2/3] keeps the box the
+ right shape whether or not the image loaded — stable layout
+ while the cover fetches. */}
+
+
+ {coverSrc ? (
+ // Plain ![]()
: source is a presigned URL that varies per
+ // request, so next/image's loader gives no win.
+ // eslint-disable-next-line @next/next/no-img-element
+ 
+ ) : (
+
+
+ {/* Content column: title, author, meta line, then actions.
+ Centered on mobile, left-aligned on desktop where it sits to
+ the right of the cover. */}
+
+
+
+ )}
+
+
+ + {meta.title} +
+ {meta.author && ( +{meta.author}
+ )} ++ {meta.format.toUpperCase()} · {formatBytes(meta.size)} · {expiryLabel} +
+ +
+ {user ? (
+ <>
+
+ {/* Secondary actions side-by-side. flex-nowrap +
+ whitespace-nowrap override daisyUI's default
+ `flex-wrap: wrap` on .btn so the icon and label stay
+ on one line in narrow viewports. */}
+
+ {importError && (
+
+ + {importError} +
+ )} + + ) : ( + <> + {/* Anonymous flow: only 2 actions, so they sit side-by-side + on one row. The 3-action logged-in flow above keeps its + stacked design (primary + 2 secondary). Download stays + `btn-primary` to keep the "main thing" hierarchy clear, + Open in app is ghost. Labels match the logged-in flow's + shorter forms to avoid wrap in the tighter row layout. */} + ++ {_("Don't have Readest?")}{' '} + + {_('Download Readest')} + +
+ + )} +