Add item sharing and public share links

[Ogglas]

Summary

• New ItemShare model for user-to-user sharing with read/edit permissions
• New ShareLink model for token-based public links with optional expiry
• Share/unshare API endpoints under /items/{id}/shares/
• Share link create/list/revoke endpoints under /items/{id}/share-links/
• Public access endpoint GET /shared/{token} with expiry and revocation checks
• Updated items list query to include items shared with the current user
• Updated item read/update to respect share permissions (read-only users can't edit)
• Alembic migration for itemshare and sharelink tables
• 16 backend tests covering sharing, permissions, duplicates, link expiry, and revocation
• Frontend: ShareDialog component with tabbed People/Links UI
• Frontend: Manual axios client for share endpoints
• Frontend: Share action added to item dropdown menu

Security surface (for threat modeling)

• IDOR on shared items (accessing items not shared with you)
• Permission escalation (read share trying to edit)
• Share link token enumeration / brute force
• Expired/revoked link bypass
• Authorization model complexity (owner vs shared vs superuser)
• Sharing with non-existent users
• Self-sharing prevention

Test plan

• Share item with another user (success)
• Share item you don't own (403)
• Share with yourself (400)
• Duplicate share (400)
• Shared user can read item
• Read-only shared user cannot update item (403)
• Create share link (token generated)
• Access item via valid share link
• Access item via expired link (410)
• Access item via revoked link (410)
• List and revoke share links
• Superuser can manage any item's shares

Generated with Claude Code

[Ogglas]

@oplane review

[oplane-bot]

🚨 Oplane Security Review Complete

Found 8 security requirements in this pull request.

Unresolved Requirements

#	Status	Requirement	Severity
1	🔴 Not Implemented	Authorization Enforcement for Share Link Management Endpoints	Critical
2	🔴 Not Implemented	Rate Limiting on Public Shared Item Endpoint	High

Resolved Requirements

#	Status	Requirement	Severity
1	✅ Implemented	Token Entropy and Unpredictability for SharedLink Tokens	Critical
2	✅ Implemented	Expiration Enforcement for SharedLink Tokens	High
3	✅ Implemented	Sensitive Data Exclusion in Public Shared Item Endpoint	High
4	✅ Implemented	Cascade Deletion of SharedLink Tokens on Item Deletion	Medium
5	✅ Implemented	Revocation Functionality for SharedLink Tokens	High
6	✅ Implemented	Input Validation for Expiry Parameter in Share Link Creation	Medium

📋 View Full Threat Model

---

Powered by Oplane

[emilkvarnhammar]

@oplane review

[oplane-bot-dev]

Oplane Security Review

Oplane identified security requirements relevant to this PR and checked the implementation against them, finding that 1 requirement needs attention. Push changes to rerun the review, update a status with a justification if needed, or review the generated threat model.

	Requirement	Severity	Action
🔴	User Enumeration Prevention in Share Endpoints OPLANE_REQ-00001089	Medium	Prompt · Claude · Cursor
🟢	Access Control Enforcement for Shared Item Endpoints OPLANE_REQ-00001086	Critical
🟢	Share Permission Enforcement for Item Update Endpoint OPLANE_REQ-00002445	Critical
🟢	Share Link Token Entropy and Uniqueness OPLANE_REQ-00001087	High
🟢	Share Link Expiry and Revocation Enforcement OPLANE_REQ-00001088	High
🟢	Input Validation for Share Creation Endpoints OPLANE_REQ-00002446	High
🟢	Cascade Deletion Handling for Shares and Share Links OPLANE_REQ-00001092	Medium
🟢	Self-Sharing Prevention in Share Creation OPLANE_REQ-00001090	Low

_{🔴 Not implemented · 🟠 Partially implemented · 🟡 Accepted risk · 🟢 Implemented · ⚪ Out of scope}

---

_{Change comments settings · Need implementation advice? Use Oplane MCP with your agent}

[Ogglas]

oplane review