ci: add manual Gitea Actions deploy workflow

Rebuilds and rolls out the backend, then builds and syncs the
frontend to nginx. Triggered manually via workflow_dispatch so pushes
don't auto-deploy to production.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -0,0 +1,30 @@
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest   # hits the host runner (vps-runner) already on this box
+    env:
+      KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build backend image
+        run: docker build -t realtime-collab-backend:latest ./backend
+
+      - name: Roll out backend
+        run: |
+          kubectl rollout restart deployment/realtime-collab-backend
+          kubectl rollout status deployment/realtime-collab-backend --timeout=90s
+
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+      - name: Deploy frontend
+        run: rsync -a --delete frontend/dist/ /var/www/realtime-collab/

backend/internal/handlers/document.go

@@ -137,6 +137,15 @@ func (h *DocumentHandler) GetDocumentState(c *gin.Context) {
 			respondInternalError(c, "Failed to check permissions", err)
 			return
 		}
+		if !canView && shareToken != "" {
+			// Logged-in user without personal permission: fall back to share link
+			valid, err := h.store.ValidateShareToken(c.Request.Context(), id, shareToken)
+			if err != nil {
+				respondInternalError(c, "Failed to validate share token", err)
+				return
+			}
+			canView = valid
+		}
 		if !canView {
 			respondForbidden(c, "Access denied")
 			return
@@ -189,12 +198,28 @@ func (h *DocumentHandler) UpdateDocumentState(c *gin.Context) {
 		return
 	}
 
-	// Check edit permission
+	// Check edit permission (personal share OR edit-level share link)
+	shareToken := c.Query("share")
 	canEdit, err := h.store.CanEditDocument(c.Request.Context(), id, *userID)
 	if err != nil {
 		respondInternalError(c, "Failed to check permissions", err)
 		return
 	}
+	if !canEdit && shareToken != "" {
+		valid, err := h.store.ValidateShareToken(c.Request.Context(), id, shareToken)
+		if err != nil {
+			respondInternalError(c, "Failed to validate share token", err)
+			return
+		}
+		if valid {
+			perm, err := h.store.GetShareLinkPermission(c.Request.Context(), id)
+			if err != nil {
+				respondInternalError(c, "Failed to get token permission", err)
+				return
+			}
+			canEdit = perm == "edit"
+		}
+	}
 	if !canEdit {
 		respondForbidden(c, "Edit access denied")
 		return

backend/internal/handlers/document_test.go

@@ -381,8 +381,6 @@ func (s *DocumentHandlerSuite) TestGetDocumentState_Success() {
 	s.assertSuccessResponse(w, http.StatusOK)
 
 	s.Equal("application/octet-stream", w.Header().Get("Content-Type"))
-	// State should be empty bytes for new document
-	s.NotNil(w.Body.Bytes())
 }
 
 func (s *DocumentHandlerSuite) TestGetDocumentState_EmptyState() {
@@ -416,6 +414,17 @@ func (s *DocumentHandlerSuite) TestGetDocumentState_InvalidID() {
 	s.assertErrorResponse(w, http.StatusBadRequest, "bad_request", "Invalid document ID")
 }
 
+func (s *DocumentHandlerSuite) TestGetDocumentState_AuthenticatedWithShareToken() {
+	// Charlie (logged in, not owner/shared) reads Alice's public doc via share link
+	path := fmt.Sprintf("/api/documents/%s/state?share=%s", s.testData.AlicePublicDoc, s.testData.PublicShareToken)
+	w, httpReq, err := s.makeAuthRequest("GET", path, nil, s.testData.CharlieID)
+	s.Require().NoError(err)
+
+	s.router.ServeHTTP(w, httpReq)
+	s.assertSuccessResponse(w, http.StatusOK)
+	s.Equal("application/octet-stream", w.Header().Get("Content-Type"))
+}
+
 // ========================================
 // UpdateDocumentState Tests
 // ========================================
@@ -458,6 +467,32 @@ func (s *DocumentHandlerSuite) TestUpdateDocumentState_ViewOnlyDenied() {
 	s.router.ServeHTTP(w, httpReq)
 	s.assertErrorResponse(w, http.StatusForbidden, "forbidden", "Edit access denied")
 }
+func (s *DocumentHandlerSuite) TestUpdateDocumentState_AuthenticatedWithEditShareToken() {
+	// Give Alice's public doc an "edit" share link
+	ctx := context.Background()
+	editToken, err := s.store.GenerateShareToken(ctx, s.testData.AlicePublicDoc, "edit")
+	s.Require().NoError(err)
+
+	// Charlie (logged in, not owner/shared) edits via edit share link
+	req := models.UpdateStateRequest{State: []byte("shared edit")}
+	path := fmt.Sprintf("/api/documents/%s/state?share=%s", s.testData.AlicePublicDoc, editToken)
+	w, httpReq, err := s.makeAuthRequest("PUT", path, req, s.testData.CharlieID)
+	s.Require().NoError(err)
+
+	s.router.ServeHTTP(w, httpReq)
+	s.assertSuccessResponse(w, http.StatusOK)
+}
+func (s *DocumentHandlerSuite) TestUpdateDocumentState_AuthenticatedWithViewShareTokenDenied() {
+	// Alice's public doc has a "view" share link (from seed).
+	// Charlie (logged in) cannot write via a view-only share link.
+	req := models.UpdateStateRequest{State: []byte("attempt write")}
+	path := fmt.Sprintf("/api/documents/%s/state?share=%s", s.testData.AlicePublicDoc, s.testData.PublicShareToken)
+	w, httpReq, err := s.makeAuthRequest("PUT", path, req, s.testData.CharlieID)
+	s.Require().NoError(err)
+
+	s.router.ServeHTTP(w, httpReq)
+	s.assertErrorResponse(w, http.StatusForbidden, "forbidden", "Edit access denied")
+}
 
 func (s *DocumentHandlerSuite) TestUpdateDocumentState_Unauthorized() {
 	req := models.UpdateStateRequest{

frontend/src/api/document.ts

@@ -64,12 +64,16 @@ export const documentsApi = {
   },
 
   // Update document Yjs state
-  updateState: async (id: string, state: Uint8Array): Promise<void> => {
+  updateState: async (id: string, state: Uint8Array, shareToken?: string): Promise<void> => {
     // Create a new ArrayBuffer copy to ensure compatibility
     const buffer = new ArrayBuffer(state.byteLength);
     new Uint8Array(buffer).set(state);
 
-    const response = await authFetch(`${API_BASE_URL}/documents/${id}/state`, {
+    const url = shareToken
+      ? `${API_BASE_URL}/documents/${id}/state?share=${shareToken}`
+      : `${API_BASE_URL}/documents/${id}/state`;
+
+    const response = await authFetch(url, {
       method: "PUT",
       headers: { "Content-Type": "application/octet-stream" },
       body: buffer,

frontend/src/hooks/useAutoSave.ts

@@ -2,7 +2,7 @@ import { useEffect, useRef } from 'react';
 import * as Y from 'yjs';
 import { documentsApi } from '../api/document';
 
-export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
+export const useAutoSave = (documentId: string, ydoc: Y.Doc | null, shareToken?: string) => {
   const saveTimeoutRef = useRef<number | null>(null);
   const isSavingRef = useRef(false);
 
@@ -25,7 +25,7 @@ export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
         isSavingRef.current = true;
         try {
           const state = Y.encodeStateAsUpdate(ydoc);
-          await documentsApi.updateState(documentId, state);
+          await documentsApi.updateState(documentId, state, shareToken);
           console.log('✓ Document saved to database');
         } catch (error) {
           console.error('Failed to save document:', error);
@@ -44,5 +44,5 @@ export const useAutoSave = (documentId: string, ydoc: Y.Doc | null) => {
         clearTimeout(saveTimeoutRef.current);
       }
     };
-  }, [documentId, ydoc]);
+  }, [documentId, ydoc, shareToken]);
 };

frontend/src/hooks/useYjsDocument.ts

@@ -17,7 +17,7 @@ export const useYjsDocument = (documentId: string, shareToken?: string) => {
   const [role, setRole] = useState<string | null>(null);
 
   // Enable auto-save when providers are ready
-  useAutoSave(documentId, providers?.ydoc || null);
+  useAutoSave(documentId, providers?.ydoc || null, shareToken);
 
   // Fetch permission when component mounts
   useEffect(() => {

frontend/src/pages/LoginPage.tsx

@@ -15,9 +15,10 @@ function LoginPage() {
 
   useEffect(() => {
     if (!loading && user) {
-      navigate('/');
+      const redirect = searchParams.get('redirect');
+      navigate(redirect ? decodeURIComponent(redirect) : '/');
     }
-  }, [user, loading, navigate]);
+  }, [user, loading, navigate, searchParams]);
 
   const saveRedirectAndGo = (oauthUrl: string) => {
     const redirect = searchParams.get('redirect');
@@ -40,7 +41,8 @@ function LoginPage() {
       setGuestLoading(true);
       const token = await guestLogin();
       await login(token);
-      const redirect = searchParams.get('redirect');
+      const redirect = searchParams.get('redirect') || sessionStorage.getItem('oauth_redirect');
+      sessionStorage.removeItem('oauth_redirect');
       navigate(redirect ? decodeURIComponent(redirect) : '/');
     } catch (err) {
       console.error('Guest login failed:', err);

frontend/tsconfig.node.json

@@ -1,7 +1,6 @@
 {
   "compilerOptions": {
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
-    "target": "ES2023",
     "lib": ["ES2023"],
     "module": "ESNext",
     "types": ["node"],