@stacksjs/defaults 0.75.89 → 0.75.91

package/app/Actions/Dashboard/Feedback/feedback-token.ts

@@ -0,0 +1,149 @@
+import { createHash, randomBytes } from 'node:crypto'
+
+/**
+ * Whether a feedback link may still file a card, and on which board.
+ *
+ * Kept pure and separate from the action: this is the whole security boundary
+ * for an unauthenticated write path, and a decision that can only be reached
+ * through an HTTP request is a decision that does not get tested properly.
+ * The action does the lookup and the writing; everything that decides *yes or
+ * no* is here.
+ *
+ * A feedback token is a capability, not an identity. It names a board, it is
+ * read only by the intake action, and it never resolves to a user, so it can
+ * authenticate nothing. See the `FeedbackToken` model for why a personal
+ * access token would have been an account in disguise.
+ */
+
+/** 256 bits. The raw token is the only secret, so it carries all the entropy. */
+export const FEEDBACK_TOKEN_BYTES = 32
+
+/**
+ * What a submission may carry, matching `cards.title` and
+ * `cards.description`.
+ *
+ * Here rather than in the action so the form can render the same limits it
+ * will be judged against. A `maxlength` the server disagrees with is the
+ * worst of both: the reviewer is either stopped from typing something that
+ * would have been accepted, or allowed to write a report that is refused on
+ * submit.
+ */
+export const FEEDBACK_MAX_TITLE = 300
+export const FEEDBACK_MAX_DESCRIPTION = 10_000
+
+/** A raw token as it appears in a link, and as the column stores it. */
+const RAW_TOKEN = /^[0-9a-f]{64}$/
+
+/**
+ * SHA-256 hex, which is what `feedback_tokens.token` holds.
+ *
+ * Deterministic on purpose: a submit is one indexed lookup. With 256 bits of
+ * entropy in the raw value an offline attack on a fast hash is irrelevant,
+ * which is the same reasoning `MagicLinkToken` records and deliberately not
+ * the bcrypt-and-scan of password resets.
+ *
+ * `@stacksjs/auth` defines this same one-liner privately three times over
+ * (`tokens.ts`, `authentication.ts`, `magic-link.ts`) and exports none of
+ * them, so this is a fourth rather than a refactor of a security module in
+ * passing.
+ */
+export function hashFeedbackToken(raw: string): string {
+  return createHash('sha256').update(raw).digest('hex')
+}
+
+/** A new link's raw token and the hash to store for it. */
+export function mintFeedbackToken(): { raw: string, hash: string } {
+  const raw = randomBytes(FEEDBACK_TOKEN_BYTES).toString('hex')
+  return { raw, hash: hashFeedbackToken(raw) }
+}
+
+/**
+ * Does this even have the shape of a token?
+ *
+ * Checked before the lookup so a submit carrying a sentence, a path, or a SQL
+ * fragment is refused without touching the database.
+ */
+export function looksLikeFeedbackToken(raw: unknown): raw is string {
+  return typeof raw === 'string' && RAW_TOKEN.test(raw)
+}
+
+export type FeedbackTokenRefusal = 'malformed' | 'unknown' | 'revoked' | 'expired' | 'unbound'
+
+export type FeedbackTokenVerdict =
+  | { ok: true, boardId: number }
+  | { ok: false, reason: FeedbackTokenRefusal }
+
+/**
+ * A `feedback_tokens` row, in either spelling.
+ *
+ * The ORM hands back camelCase or snake_case depending on the path taken, and
+ * the Kanban actions already read `boardId ?? board_id` for the same reason.
+ */
+export interface FeedbackTokenRow {
+  boardId?: unknown
+  board_id?: unknown
+  revokedAt?: unknown
+  revoked_at?: unknown
+  expiresAt?: unknown
+  expires_at?: unknown
+}
+
+function firstDefined(...values: unknown[]): unknown {
+  return values.find(value => value !== undefined && value !== null)
+}
+
+/**
+ * A stored timestamp as epoch milliseconds, read as UTC.
+ *
+ * Exported so the UTC reading can be pinned directly. Asserting it through a
+ * verdict cannot: both interpretations of a given row usually land on the
+ * same side of `now`, so such a test passes whether or not the normalisation
+ * below exists, and it did.
+ */
+export function parseTokenTime(value: unknown): number | null {
+  if (value === undefined || value === null) return null
+  if (value instanceof Date) return value.getTime()
+  // SQLite hands back `YYYY-MM-DD HH:MM:SS`, which `Date` parses as local
+  // time on some engines and UTC on others. Normalising to ISO keeps a token
+  // from appearing to expire an hour early or late depending on the dialect.
+  if (typeof value === 'string') {
+    const normalized = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(value) ? `${value.replace(' ', 'T')}Z` : value
+    const parsed = Date.parse(normalized)
+    return Number.isNaN(parsed) ? null : parsed
+  }
+  if (typeof value === 'number') return value
+  return null
+}
+
+/**
+ * The verdict for a row that has already been looked up by token hash.
+ *
+ * Revocation is checked before expiry, so a token that is both reports the
+ * reason an operator acted on. The verdict carries a board id and a reason
+ * and never the token, so it is safe to log.
+ */
+export function authorizeFeedbackToken(row: FeedbackTokenRow | null | undefined, now: Date = new Date()): FeedbackTokenVerdict {
+  if (!row) return { ok: false, reason: 'unknown' }
+
+  if (firstDefined(row.revokedAt, row.revoked_at) !== undefined)
+    return { ok: false, reason: 'revoked' }
+
+  const expiresAt = parseTokenTime(firstDefined(row.expiresAt, row.expires_at))
+  if (expiresAt !== null && expiresAt <= now.getTime())
+    return { ok: false, reason: 'expired' }
+
+  const boardId = Number(firstDefined(row.boardId, row.board_id))
+  if (!Number.isInteger(boardId) || boardId <= 0)
+    return { ok: false, reason: 'unbound' }
+
+  return { ok: true, boardId }
+}
+
+/** What to tell the submitter. Deliberately the same for every refusal. */
+export function refusalMessage(): string {
+  // One message for unknown, revoked and expired alike: distinguishing them
+  // tells a holder of a guessed token which half of the guess was right, and
+  // tells a revoked reviewer they were revoked rather than that the link is
+  // simply no longer valid.
+  return 'This feedback link is not valid.'
+}

package/app/Actions/Dashboard/Kanban/CardShowAction.ts

@@ -1,6 +1,7 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions/runtime'
 import { db, getDatabaseDialect, sqlHelpers } from '@stacksjs/database/runtime'
+import { cardAttachments } from './card-attachments'
 import { modelBoolean } from './kanban-model'
 import { kanbanActionError, kanbanError } from './kanban-response'
 
@@ -29,11 +30,12 @@ interface CardRow {
  * pivots) — this endpoint is for the case where the user lands
  * directly on a card URL or refreshes mid-modal.
  *
- * Three queries via `Promise.all`:
- *   1. The card itself.
- *   2. Labels via the card_labels pivot (with the label row).
- *   3. Assignees via the card_assignees pivot (with user.name/email).
- *   4. Comments (denormalised user name/email for display).
+ * The card itself, then four in parallel via `Promise.all`:
+ *   1. Labels via the card_labels pivot (with the label row).
+ *   2. Assignees via the card_assignees pivot (with user.name/email).
+ *   3. Comments (denormalised user name/email for display).
+ *   4. Attachments, each with a freshly signed, expiring URL. They live on a
+ *      private disk, so there is no path a browser could fetch.
  */
 export default new Action({
   name: 'Kanban Card Show',
@@ -59,7 +61,7 @@ export default new Action({
         return kanbanError('Card not found', 404)
       }
 
-      const [labels, assignees, comments] = await Promise.all([
+      const [labels, assignees, comments, attachments] = await Promise.all([
         db.unsafe(
           `SELECT l.id, l.name, l.color
           FROM card_labels cl
@@ -83,6 +85,9 @@ export default new Action({
           ORDER BY cc.created_at ASC, cc.id ASC`,
           [id],
         ).execute() as Promise<Array<{ id: number, uuid: string | null, user_id: number | null, body: string, created_at: string | null, updated_at: string | null, name: string | null, email: string | null }>>,
+        // Each one carries a freshly signed, expiring URL: the bytes are on a
+        // private disk, so there is no path the browser could fetch.
+        cardAttachments(id),
       ])
 
       return {
@@ -108,6 +113,7 @@ export default new Action({
           assignedByUserId: a.assigned_by_user_id,
           assignedAt: a.created_at,
         })),
+        attachments,
         comments: (comments ?? []).map(c => ({
           id: c.id,
           uuid: c.uuid,

package/app/Actions/Dashboard/Kanban/card-attachments.test.ts

@@ -0,0 +1,125 @@
+import { afterAll, afterEach, describe, expect, it, spyOn } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { CARD_ATTACHMENT_URL_TTL_SECONDS, shapeCardAttachment, signCardAttachmentUrl } from './card-attachments'
+
+const row = {
+  id: 7,
+  uuid: 'c0ffee00-0000-4000-8000-000000000000',
+  disk: 'local',
+  path: 'feedback/42/0190f3b4-7c21-4f0a-9a1e-3d5c7b8e9f00.png',
+  mime_type: 'image/png',
+  size_bytes: 120_000,
+  created_at: '2026-10-08 09:12:00',
+}
+
+describe('shapeCardAttachment', () => {
+  it('returns what the dialog renders and nothing else', () => {
+    expect(shapeCardAttachment(row, 'https://example.com/__storage/x?token=y')).toEqual({
+      id: 7,
+      uuid: 'c0ffee00-0000-4000-8000-000000000000',
+      mimeType: 'image/png',
+      sizeBytes: 120_000,
+      createdAt: '2026-10-08 09:12:00',
+      url: 'https://example.com/__storage/x?token=y',
+    })
+  })
+
+  it('never publishes the storage path or the disk', () => {
+    // The signed URL already carries the path it grants, so the bare path
+    // adds nothing a client can use and does invite trying it without a
+    // token.
+    const shaped = shapeCardAttachment(row, null) as Record<string, unknown>
+    expect(Object.keys(shaped).sort()).toEqual(['createdAt', 'id', 'mimeType', 'sizeBytes', 'url', 'uuid'])
+    expect(JSON.stringify(shaped)).not.toContain('feedback/42')
+    expect(JSON.stringify(shaped)).not.toContain('local')
+  })
+
+  it('lists an attachment whose URL could not be minted', () => {
+    // Null, not omitted and not thrown: "there is a screenshot nobody can
+    // open" is worth chasing and is a different problem from "there is no
+    // screenshot".
+    expect(shapeCardAttachment(row, null).url).toBeNull()
+  })
+
+  it('reads a row whose numbers arrive as strings', () => {
+    // SQLite and Postgres disagree about this often enough that the Kanban
+    // actions already normalise everywhere else.
+    const shaped = shapeCardAttachment({ ...row, id: '7' as never, size_bytes: '120000' as never }, null)
+    expect(shaped.id).toBe(7)
+    expect(shaped.sizeBytes).toBe(120_000)
+  })
+})
+
+describe('the signed URL lifetime', () => {
+  it('outlasts opening a card and not much more', () => {
+    // Long enough to look at a screenshot, short enough that a URL copied
+    // out of devtools is not a handout.
+    expect(CARD_ATTACHMENT_URL_TTL_SECONDS).toBeGreaterThanOrEqual(5 * 60)
+    expect(CARD_ATTACHMENT_URL_TTL_SECONDS).toBeLessThanOrEqual(60 * 60)
+  })
+})
+
+describe('signing one attachment', () => {
+  const warn = spyOn(console, 'warn').mockImplementation(() => {})
+  afterEach(() => warn.mockClear())
+  afterAll(() => warn.mockRestore())
+
+  it('asks the row\'s own disk, for the row\'s path, with the card lifetime', async () => {
+    const asked: unknown[] = []
+    const url = await signCardAttachmentUrl(row, (name) => {
+      asked.push(name)
+      return {
+        signedUrl: async (path, options) => {
+          asked.push(path, options)
+          return `https://app.test/__storage/${path}?token=t`
+        },
+      }
+    })
+    expect(url).toBe(`https://app.test/__storage/${row.path}?token=t`)
+    expect(asked).toEqual(['local', row.path, { expiresIn: CARD_ATTACHMENT_URL_TTL_SECONDS }])
+  })
+
+  it('is null, not a throw, for a disk with no signer', async () => {
+    expect(await signCardAttachmentUrl(row, () => ({}))).toBeNull()
+    expect(String(warn.mock.calls[0]?.[0])).toContain('does not support signedUrl')
+  })
+
+  it('is null, not a throw, for a disk that is no longer configured', async () => {
+    const url = await signCardAttachmentUrl(row, () => {
+      throw new Error('disk \'local\' is not configured')
+    })
+    expect(url).toBeNull()
+    expect(String(warn.mock.calls[0]?.[0])).toContain(`attachment ${row.id}`)
+  })
+
+  it('is null, not a throw, when the signer refuses', async () => {
+    const url = await signCardAttachmentUrl(row, () => ({
+      signedUrl: async () => { throw new Error('APP_KEY is too short to sign with') },
+    }))
+    expect(url).toBeNull()
+  })
+})
+
+describe('the card dialog', () => {
+  const dialog = readFileSync(
+    join(import.meta.dir, '../../../../resources/components/Dashboard/Kanban/KanbanCardDialog.stx'),
+    'utf8',
+  )
+
+  it('renders the attachments it is given', () => {
+    expect(dialog).toContain('openCard()?.attachments')
+    expect(dialog).toContain(':for="attachment in cardAttachments"')
+  })
+
+  it('opens a signed URL in a new tab, with the referrer withheld', () => {
+    // The URL is a bearer credential for one file. `noreferrer` keeps it out
+    // of the next page's `Referer` header.
+    expect(dialog).toContain('rel="noopener noreferrer"')
+    expect(dialog).toContain('target="_blank"')
+  })
+
+  it('shows a placeholder rather than a broken image when there is no URL', () => {
+    expect(dialog).toMatch(/:if="attachment\.url"[\s\S]*?:else/)
+  })
+})

package/app/Actions/Dashboard/Kanban/card-attachments.ts

@@ -0,0 +1,107 @@
+import type { StorageAdapter } from '@stacksjs/storage'
+import { db, getDatabaseDialect, sqlHelpers } from '@stacksjs/database/runtime'
+
+/**
+ * Reading a card's attachments back out.
+ *
+ * The bytes sit on a private disk, because the only thing that writes them
+ * today is the unauthenticated feedback intake and a stranger's upload does
+ * not belong in a web-served directory (stacksjs/stacks#2872). So the
+ * dashboard cannot link to a file path; it links to a short-lived signed URL,
+ * minted per request against `/__storage/{path}`, which verifies the HMAC
+ * against both the path and the expiry.
+ */
+
+export interface CardAttachmentRow {
+  id: number
+  uuid: string | null
+  disk: string
+  path: string
+  mime_type: string
+  size_bytes: number
+  created_at: string | null
+}
+
+export interface CardAttachmentView {
+  id: number
+  uuid: string | null
+  mimeType: string
+  sizeBytes: number
+  createdAt: string | null
+  /**
+   * A signed, expiring URL, or null when one could not be minted.
+   *
+   * Null rather than absent, and rather than throwing: a file whose URL
+   * cannot be signed is one the dashboard should still list, because "the
+   * card has a screenshot nobody can open" is a different problem from "the
+   * card has no screenshot" and only the first one is worth chasing.
+   */
+  url: string | null
+}
+
+/** How long a minted URL lasts. Long enough to open a card, short enough that a copied link is not a handout. */
+export const CARD_ATTACHMENT_URL_TTL_SECONDS = 15 * 60
+
+/**
+ * The response shape, with the storage path deliberately left out.
+ *
+ * The signed URL carries the path it grants, so publishing the bare path
+ * alongside adds nothing a client can use and does invite someone to try it
+ * without a token.
+ */
+export function shapeCardAttachment(row: CardAttachmentRow, url: string | null): CardAttachmentView {
+  return {
+    id: Number(row.id),
+    uuid: row.uuid ?? null,
+    mimeType: String(row.mime_type ?? ''),
+    sizeBytes: Number(row.size_bytes ?? 0),
+    createdAt: row.created_at ?? null,
+    url,
+  }
+}
+
+/** One card's attachments, oldest first, each with a freshly signed URL. */
+export async function cardAttachments(cardId: number): Promise<CardAttachmentView[]> {
+  const { param } = sqlHelpers(getDatabaseDialect())
+  const rows = await db.unsafe(
+    `SELECT id, uuid, disk, path, mime_type, size_bytes, created_at
+     FROM card_attachments
+     WHERE card_id = ${param(1)}
+     ORDER BY created_at ASC, id ASC`,
+    [cardId],
+  ).execute() as unknown as CardAttachmentRow[]
+
+  if (!rows?.length)
+    return []
+
+  const { Storage } = await import('@stacksjs/storage')
+
+  return Promise.all((rows ?? []).map(async row =>
+    shapeCardAttachment(row, await signCardAttachmentUrl(row, name => Storage.disk(name as never))),
+  ))
+}
+
+/**
+ * A signed URL for one attachment, or null when its disk cannot mint one.
+ *
+ * Per attachment, so one unreadable file does not take the card down with it.
+ */
+export async function signCardAttachmentUrl(
+  row: CardAttachmentRow,
+  openDisk: (name: string) => Pick<StorageAdapter, 'signedUrl'>,
+): Promise<string | null> {
+  try {
+    const disk = openDisk(row.disk)
+    // A disk with no signer at all (a driver that cannot mint one) is the
+    // same outcome as one that fails to: listed, but with nothing to open.
+    if (typeof disk.signedUrl !== 'function')
+      throw new Error(`disk '${row.disk}' does not support signedUrl`)
+    return await disk.signedUrl(row.path, { expiresIn: CARD_ATTACHMENT_URL_TTL_SECONDS })
+  }
+  catch (err) {
+    // A disk that is no longer configured or cannot sign, or an APP_KEY too
+    // short to sign with.
+    console.warn(`[card-attachments] could not sign attachment ${row.id}: ${err instanceof Error ? err.message : String(err)}`)
+    return null
+  }
+}

package/app/Models/CardAttachment.ts

@@ -0,0 +1,103 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation/runtime'
+
+/**
+ * A file attached to a card. Today that means one screenshot on a card filed
+ * through a feedback link (stacksjs/stacks#2872).
+ *
+ * The bytes live on a disk and this row is the only thing that knows they
+ * belong to a card: a disk knows a path and some bytes, not which card a
+ * screenshot illustrates. Same division as `StorageItem`, for the same
+ * reason, and deliberately a separate table from it - `storage_items` is
+ * advisory metadata keyed by `(disk, path)` for the file manager, while this
+ * is a card's own content and is authoritative about what is attached to
+ * what.
+ *
+ * ## The disk is chosen here, not by the uploader
+ *
+ * `disk` is recorded rather than assumed so a row written while an app used
+ * local storage still resolves after it moves to S3. It is written by the
+ * action from configuration; nothing a submitter sends reaches it, and
+ * neither does any part of `path`, which is generated. See
+ * `feedback-attachment.ts`, which holds the rules.
+ *
+ * A feedback attachment is written to a PRIVATE disk. An unauthenticated
+ * stranger's upload landing under `public/` would be world-readable at a
+ * path the dashboard also prints.
+ *
+ * ## Erasure removes the row, not yet the bytes
+ *
+ * The `gdpr` trait deletes this row, and a screenshot is likely to contain
+ * personal data - it is a picture of somebody's screen. Deleting the row
+ * leaves the file behind, because nothing here sweeps a disk. Stated rather
+ * than implied, and tracked separately: a half-done erasure that looks done
+ * is worse than one that says what it did.
+ *
+ * No `useApi`. These rows are written by the feedback intake action and read
+ * by the dashboard's own board actions; a REST surface over them would
+ * publish a list of every uploaded file.
+ */
+export default defineModel({
+  name: 'CardAttachment',
+  table: 'card_attachments',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  traits: {
+    gdpr: { erasure: 'delete', basis: 'legitimate_interests', purpose: 'A screenshot attached to a card, usually illustrating a bug report' },
+    useTimestamps: true,
+    useUuid: true,
+  },
+
+  // Cascade: an attachment to a card that no longer exists is a file nothing
+  // can reach and a row nothing can render. Declared, and not relied on -
+  // SQLite enforces it only with `foreign_keys = ON`, which the framework
+  // sets while renaming and not otherwise.
+  belongsTo: [{ model: 'Card', onDelete: 'cascade' }],
+
+  attributes: {
+    /** Which configured disk holds the bytes, e.g. `local`. */
+    disk: {
+      required: true,
+      order: 1,
+      fillable: true,
+      validation: { rule: schema.string().max(40) },
+      factory: () => 'local',
+    },
+
+    /**
+     * The path on that disk. Unique, so the same bytes cannot be claimed by
+     * two cards, and generated in full by `feedbackAttachmentPath`.
+     */
+    path: {
+      required: true,
+      order: 2,
+      fillable: true,
+      unique: true,
+      validation: { rule: schema.string().max(400) },
+      factory: faker => `feedback/1/${faker.string.uuid()}.png`,
+    },
+
+    /**
+     * What the bytes actually are, read from the file's own leading bytes
+     * rather than from the declared content type, which an uploader writes.
+     * The dashboard serves the file as this.
+     */
+    mimeType: {
+      required: true,
+      order: 3,
+      fillable: true,
+      validation: { rule: schema.string().max(80) },
+      factory: () => 'image/png',
+    },
+
+    /** Size as stored, so a listing does not have to stat every file. */
+    sizeBytes: {
+      required: true,
+      order: 4,
+      fillable: true,
+      validation: { rule: schema.number().min(0) },
+      factory: faker => faker.number.int({ min: 1000, max: 500_000 }),
+    },
+  },
+} as const)

package/app/Models/FeedbackToken.ts

@@ -0,0 +1,129 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation/runtime'
+
+/**
+ * A revocable capability to add one card to one board, and nothing else.
+ *
+ * Deliberately NOT a personal access token. `tokenCan()` and the `abilities`
+ * middleware are opt-in per route, and the dashboard's own actions authorize
+ * by calling `request.user()` rather than by checking scopes, so a
+ * user-owned bearer token authenticates as its owner across the whole
+ * dashboard API. Handing an external reviewer one of those to file feedback
+ * with would hand them an account (stacksjs/stacks#2872).
+ *
+ * This is a capability instead: the auth stack does not know it, so it can
+ * authenticate nothing. It names a board, it is checked only by the feedback
+ * intake action, and it never resolves to a user.
+ *
+ * `token` stores the SHA-256 of the raw value - deterministic, so a submit is
+ * one indexed lookup, and with 256 bits of entropy in the raw token an
+ * offline attack on a fast hash is irrelevant. Same reasoning as
+ * `MagicLinkToken`, and deliberately not the bcrypt-and-scan of password
+ * resets.
+ *
+ * No `useApi`: these rows are minted by a command and read by the intake
+ * action. Exposing them over REST would publish the thing they protect.
+ */
+export default defineModel({
+  name: 'FeedbackToken',
+  table: 'feedback_tokens',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  traits: {
+    gdpr: { erasure: 'delete', basis: 'legitimate_interests', purpose: 'Invites an external reviewer to file feedback on one board' },
+    useTimestamps: true,
+    useUuid: true,
+  },
+
+  // Cascade, so deleting a board takes its links with it: a token that
+  // outlives the board it names would be admitted carrying a board id that no
+  // longer resolves.
+  //
+  // Declared, not relied on. SQLite enforces this only with
+  // `foreign_keys = ON`, which the framework sets while renaming and not
+  // otherwise - `fk-audit.ts` exists because of exactly that. Verified with
+  // the pragma on (the row goes) and off (it stays), so the intake action
+  // checks the board resolves rather than trusting the constraint to have
+  // removed the token.
+  belongsTo: [{ model: 'Board', onDelete: 'cascade' }],
+
+  attributes: {
+    /** SHA-256 hex of the raw token. Never the raw value. */
+    token: {
+      required: true,
+      order: 1,
+      fillable: true,
+      unique: true,
+      validation: {
+        rule: schema.string().min(64).max(64),
+      },
+      factory: faker => faker.string.hexadecimal({ length: 64, prefix: '' }).toLowerCase(),
+    },
+
+    /**
+     * Who it was issued to, so an operator can tell two links apart and
+     * revoke the right one. Shown in `buddy feedback:tokens`, never sent to
+     * the submitter and never used to authenticate.
+     */
+    label: {
+      personal: true,
+      required: true,
+      order: 2,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(120),
+      },
+      factory: faker => faker.person.firstName(),
+    },
+
+    /**
+     * Revocation, which is the whole point of the design: flipping this stops
+     * the link without a deploy. Nullable rather than a boolean so the
+     * operator can also see *when* it was pulled.
+     */
+    revokedAt: {
+      required: false,
+      order: 3,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: () => null,
+    },
+
+    /** Unset means it does not expire on its own; revocation still applies. */
+    expiresAt: {
+      required: false,
+      order: 4,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: () => null,
+    },
+
+    /**
+     * Last accepted submission. Lets an operator retire a link nobody uses,
+     * and tells them whether a leaked token has been exercised.
+     */
+    lastUsedAt: {
+      required: false,
+      order: 5,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: () => null,
+    },
+
+    /** The user who minted it. Set server-side, surfaced in the listing. */
+    createdByUserId: {
+      required: false,
+      order: 6,
+      fillable: true,
+      validation: { rule: schema.number() },
+      factory: () => null,
+    },
+  },
+} as const)

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.89",
+  "version": "0.75.91",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",