- Shipped
- November 13, 2026 at 9:48 AM UTC
- Author
- Kamo
- Commit
- 13d349c
A chat message can carry docLinks (CONTRACT DocLinkSpec; at most ten, numeric imgIds only). The grant-based twin of attachableBySender: nothing of the doc is attached to the message — DocsService's internal /issue, acting as the SENDER, opens the doc through the sender's own reader (a doc they can't read is a plain 404 refusal), applies the org's sharing policy and rights, and only then mints the link (source CHAT, sourceRef chat:<message id>) and the grants. - Members' conversations (chat, a member's support ticket): VERIFIED links with a grant for every other person in the conversation; the client's link type is ignored. - A public web-chat visitor or a social contact: an ANYONE link (org policy + SHARE_DOCS_ANYONE_LINK decide), whose sign.<org> address is written into the message text, since that is all their side shows. Issued inside the send's transaction after the row exists; a refusal rolls the send back and answers with DocsService's code and plain words, Kamo Docs not answering is 503 DOC_LINKS_UNAVAILABLE, and any rollback (incl. a 40001 retry) revokes what was minted. The send response, the NATS frame and the STOMP relay (read off the raw frame — not a field of the shared DTO) carry docLinks; history pages carry docLinks per message from one indexed read of doc_share_links by source_ref (state OK/EXPIRED/REVOKED).