Add end-to-end encrypted artifact sharing

[cnjack]

What changed

• Add device-authenticated artifact share creation, upload completion, listing, and revocation APIs.
• Add an unauthenticated read-only viewer route and ciphertext content proxy.
• Encrypt artifact payloads client-side with AES-256-GCM; the decryption key remains in the URL fragment and is never sent to Cloud.
• Add PostgreSQL and in-memory persistence, upload leases, exact-size verification, quotas, expiry, revocation, and garbage collection.
• Add a cross-implementation crypto vector shared with JCode.
• Document the REST and device-relay contracts.

User impact

A logged-in JCode Desktop/Web user can publish an immutable encrypted artifact snapshot and copy a share link. Logged-out users do not see sharing controls. Recipients decrypt in their browser without an account.

Security notes

• 25 MiB encrypted payload cap.
• Strict AAD and SHA-256 verification.
• Public responses use no-store, no-referrer, and nosniff protections.
• Revoked or expired shares are unavailable and later garbage-collected.
• Database ownership uses restrictive deletion so object cleanup cannot be bypassed.

Validation

• go test ./... (orchestrator)
• go vet ./... (orchestrator)
• Console: 78 files / 637 tests
• Console TypeScript project check
• Design-token lint
• Kustomize render: base, default, and company overlays
• Cross-language AES-GCM test vector

Summary by CodeRabbit

• New Features

  • Added encrypted artifact sharing with public, unauthenticated viewing links.
  • Shared artifacts support Markdown, text, code, CSV, HTML, images, PDFs, and downloads.
  • Added device controls to create, list, complete, and revoke shares.
  • Added expiration handling and automatic cleanup of expired shares.
  • Added privacy-focused viewing protections, including sandboxing and secure response handling.

• Documentation

  • Documented artifact-share APIs and the end-to-end encryption protocol.

• Bug Fixes

  • Added validation for invalid, incomplete, revoked, expired, or corrupted shares.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 10294abd-31c8-4fe5-ae95-a9d44e4ad6ce

📥 Commits

Reviewing files that changed from the base of the PR and between ecf0675 and 4631321.

📒 Files selected for processing (25)

• console/nginx/default.conf.template
• console/src/App.tsx
• console/src/lib/artifactShareCrypto.ts
• console/src/lib/artifactShareCrypto.vector.test.ts
• console/src/nginxProxyConfig.test.ts
• console/src/pages/SharedArtifactPage.module.css
• console/src/pages/SharedArtifactPage.test.tsx
• console/src/pages/SharedArtifactPage.tsx
• console/src/test/setup.ts
• docs/11-api.md
• docs/17-jcode-device-relay.md
• orchestrator/internal/api/api.go
• orchestrator/internal/api/device_artifact_shares.go
• orchestrator/internal/api/device_artifact_shares_test.go
• orchestrator/internal/domain/artifact_share.go
• orchestrator/internal/reconciler/reconciler.go
• orchestrator/internal/reconciler/reconciler_test.go
• orchestrator/internal/store/artifact_shares_memory.go
• orchestrator/internal/store/artifact_shares_pg.go
• orchestrator/internal/store/artifact_shares_test.go
• orchestrator/internal/store/memory.go
• orchestrator/internal/store/migrate_test.go
• orchestrator/internal/store/migrations/0071_device_artifact_shares.sql
• orchestrator/internal/store/store.go
• shared/artifact-share-v1.json

---

📝 Walkthrough

Walkthrough

Adds end-to-end encrypted artifact sharing. Devices create and upload encrypted snapshots. Public endpoints serve ciphertext without authentication. The console decrypts content from a URL fragment and renders supported artifact types.

Changes

Encrypted artifact sharing

Layer / File(s)	Summary
Protocol and storage contracts orchestrator/internal/domain/artifact_share.go, orchestrator/internal/store/store.go, orchestrator/internal/store/migrations/*, docs/17-jcode-device-relay.md	Defines artifact-share states, encrypted metadata, persistence contracts, database constraints, object-generation keys, and the sharing protocol.
Share lifecycle persistence orchestrator/internal/store/artifact_shares_memory.go, orchestrator/internal/store/artifact_shares_pg.go, orchestrator/internal/store/artifact_shares_test.go	Implements quotas, upload leases, generation limits, digest binding, completion, listing, revocation, public retrieval, and PostgreSQL parity.
Device and public share APIs orchestrator/internal/api/api.go, orchestrator/internal/api/device_artifact_shares.go, orchestrator/internal/api/device_artifact_shares_test.go, docs/11-api.md	Adds authenticated device lifecycle endpoints and unauthenticated ciphertext retrieval. Validation, object-storage checks, cleanup, response headers, and route boundaries are tested.
Expired share cleanup orchestrator/internal/reconciler/reconciler.go, orchestrator/internal/reconciler/reconciler_test.go	Deletes all upload generations for expired or revoked shares and retains cleanup candidates after deletion failures.
Browser decryption and rendering console/src/lib/artifactShareCrypto.ts, console/src/pages/SharedArtifactPage.tsx, console/src/pages/SharedArtifactPage.test.tsx, console/nginx/default.conf.template, console/src/App.tsx, shared/artifact-share-v1.json	Adds fragment-key AES-GCM decryption, integrity validation, public routing, artifact viewers, sandboxed HTML rendering, security headers, browser tests, and a canonical encrypted vector.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Device
  participant API
  participant ObjectStorage
  participant PublicViewer
  participant BrowserCrypto
  Device->>API: Create encrypted-share intent
  API->>Device: Return upload details
  Device->>ObjectStorage: Upload encrypted metadata and content
  Device->>API: Complete share with digest
  PublicViewer->>API: Request public ciphertext
  API->>ObjectStorage: Read encrypted content
  API->>PublicViewer: Return encrypted metadata and content
  PublicViewer->>BrowserCrypto: Decrypt with fragment key
  BrowserCrypto->>PublicViewer: Return validated artifact

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/artifact-sharing

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cnjack]

K8s deployment verification completed successfully.

• Build/push run: https://github.com/cnjack/cloud/actions/runs/30710567283
• Namespace/context: jcode on wangwenhui@local
• Orchestrator + migrate image: registry.cn-shanghai.aliyuncs.com/jcode-cloud/jcloud-orchestrator:artifact-sharing-4631321
• Console image: registry.cn-shanghai.aliyuncs.com/jcode-cloud/jcloud-console:artifact-sharing-4631321
• Both Deployments rolled out to 1/1 Ready with zero restarts.
• The migrate init container logged migrations applied; PostgreSQL records migration 71 and device_artifact_shares exists.
• Public missing-share probe returns 404 with Cache-Control: no-store, Referrer-Policy: no-referrer, and X-Content-Type-Options: nosniff.
• The public /s/{shareID} viewer route serves successfully without authentication.