Managed public-link endpoints (create/list/revoke) + tracked serve

Shipped

July 8, 2026 at 7:06 PM UTC

Author

Kamo

Commit

e4682ca

Adds POST/GET /api/media/materials/links and DELETE /links/{id} backed by MaterialShareLink, and resolves managed tokens on the public GET first (checking revoked/expiry and bumping viewCount) before falling back to the legacy HMAC verifier. Random opaque tokens, org-scoped ownership checks, TTL clamped to <=1y.