Repository navigation
Add secure send link reactivation - #196
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The reactivation test can pass even if reactivate() omits save(), so it needs to verify that save occurs before resolve() performs another save.
1 open issue
What changed in this PR
Adds backend support for reactivating revoked, unexpired secure-send links so owners can restore sharing without creating a new URL.
Changes:
- Adds an owner-scoped
POST /api/secure-sends/{id}/reactivateendpoint returning no content. - Clears revocation while preserving link settings and access history; rejects ineligible links.
- Adds service and controller tests for reactivation and rejection behavior.
| File | Description |
|---|---|
backend/src/test/java/cloudpage/service/SecureSendServiceTest.java |
Tests restored access, preserved settings, and rejected reactivations. |
backend/src/test/java/cloudpage/controller/SecureSendControllerTest.java |
Tests current-owner delegation and the no-content response. |
backend/src/main/java/cloudpage/service/SecureSendService.java |
Implements owner-scoped validation and clears revocation. |
backend/src/main/java/cloudpage/controller/SecureSendController.java |
Exposes the reactivation endpoint. |
Review effort: Balanced
| assertThrows( | ||
| SecureSendUnavailableException.class, () -> service.resolve(created.token(), "secret", "")); | ||
|
|
||
| service.reactivate("owner-1", send.getId()); |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Agent review
Suggestion: approve. I did not find any high-confidence correctness, security, regression, or missing-test issues in this diff.
Generated by Pull Request Review for #196 · copilot · auto · 17.2 AIC · ⌖ 0.515 AIC · ⊞ 7.4K
0760276 to
d3749bb
Compare
There was a problem hiding this comment.
Agent review
Suggestion: approve. I did not find any high-confidence correctness, security, regression, or missing-test issues in this diff.
Generated by Pull Request Review for #196 · copilot · auto · 12.7 AIC · ⌖ 0.508 AIC · ⊞ 7.4K
Summary
Add
POST /api/secure-sends/{id}/reactivatefor the owner of a revoked, unexpired public share link. Reactivation clears only the revocation timestamp, preserving the original token, password, expiry, and access history. Active, expired, deleted, and other users' links cannot be reactivated.This backend change is required by Vault-Web/vault-web#416 (Vault-Web/vault-web#414). It should be merged before the frontend PR.
Verification