feat: a public notes page per release, for clients

On the releases page, «Página pública» (owners and admins) opens a
secret link to a page with the release's notes, readable without an
account, also for private projects: the notes written, or the draft
from its finished tickets while there are none (without repeating the
title the page already shows). The link can be copied, renewed (the old
one stops working) or withdrawn. Stored in Mongo (`release_note_shares`).

API: shareReleaseNotes / unshareReleaseNotes / releaseNotesShare,
publicReleaseNotes(token); GET/PUT/DELETE /api/releases/{id}/public-notes,
GET /api/shared/release-notes/{token}. Web: /notes/:token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts

@@ -1481,3 +1481,27 @@ export class IssueReviewDto {
   @ApiProperty({ type: String, nullable: true, format: 'date-time' })
   answeredAt!: string | null;
 }
+
+export class ReleaseNotesShareDto {
+  @ApiProperty({ format: 'uuid' }) releaseId!: string;
+  @ApiProperty({ description: 'The secret of the link: /notes/{token}' })
+  token!: string;
+  @ApiProperty({ format: 'date-time' }) createdAt!: string;
+}
+
+export class PublicReleaseNotesDto {
+  @ApiProperty() projectName!: string;
+  @ApiProperty() projectKey!: string;
+  @ApiProperty() releaseName!: string;
+  @ApiProperty({ type: String, nullable: true }) description!: string | null;
+  @ApiProperty({ enum: ReleaseStatus, enumName: 'ReleaseStatus' })
+  status!: ReleaseStatus;
+  @ApiProperty({ type: String, nullable: true }) targetDate!: string | null;
+  @ApiProperty({ type: String, nullable: true, format: 'date-time' })
+  releasedAt!: string | null;
+  @ApiProperty({ description: 'Markdown' }) notes!: string;
+  @ApiProperty({
+    description: 'False: drawn from its finished tickets (none written yet)',
+  })
+  written!: boolean;
+}

libs/api/tracker/presenters/src/lib/http/sharing.controller.ts

@@ -7,6 +7,7 @@ import {
   NotFoundException,
   Param,
   Put,
+  Query,
   Res,
 } from '@nestjs/common';
 import {
@@ -29,7 +30,12 @@ import {
 import { SharingService } from '@task-stream/api/tracker/application';
 import type { Response } from 'express';
 import { ShareDashboardDto } from './dto/requests.dto';
-import { DashboardShareDto, SharedDashboardDto } from './dto/responses.dto';
+import {
+  DashboardShareDto,
+  PublicReleaseNotesDto,
+  ReleaseNotesShareDto,
+  SharedDashboardDto,
+} from './dto/responses.dto';
 import { Refs } from './refs';
 
 const PROJECT = ApiParam({
@@ -102,6 +108,68 @@ export class SharingController {
     await this.sharing.remove(me.id, await this.refs.projectId(me.id, project));
   }
 
+  @Get('releases/:release/public-notes')
+  @ApiPireonAuth()
+  @ApiParam({ name: 'release', format: 'uuid' })
+  @ApiOperation({
+    summary: "A release's public notes link, if any (owners and admins)",
+  })
+  @ApiOkResponse({ type: ReleaseNotesShareDto })
+  @ApiReadErrors()
+  async releaseNotesShare(
+    @CurrentUser() me: User,
+    @Param('release') release: string,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const share = await this.sharing.releaseNotesShare(me.id, release);
+    if (!share) res.status(204);
+    return share ?? undefined;
+  }
+
+  @Put('releases/:release/public-notes')
+  @ApiPireonAuth()
+  @ApiParam({ name: 'release', format: 'uuid' })
+  @ApiOperation({
+    summary: "Turn a release's public notes page on (owners and admins)",
+    description:
+      'The page shows the notes written, or the ones drawn from its finished tickets. ?renew=true makes a new link.',
+  })
+  @ApiOkResponse({ type: ReleaseNotesShareDto })
+  @ApiCommandErrors()
+  shareReleaseNotes(
+    @CurrentUser() me: User,
+    @Param('release') release: string,
+    @Query('renew') renew?: string,
+  ) {
+    return this.sharing.shareReleaseNotes(me.id, release, renew === 'true');
+  }
+
+  @Delete('releases/:release/public-notes')
+  @HttpCode(204)
+  @ApiPireonAuth()
+  @ApiParam({ name: 'release', format: 'uuid' })
+  @ApiOperation({ summary: "A release's public notes link stops working" })
+  @ApiNoContentResponse()
+  @ApiCommandErrors()
+  async unshareReleaseNotes(
+    @CurrentUser() me: User,
+    @Param('release') release: string,
+  ) {
+    await this.sharing.unshareReleaseNotes(me.id, release);
+  }
+
+  @Get('shared/release-notes/:token')
+  @Public()
+  @ApiOperation({ summary: "A release's notes, for anyone with its link" })
+  @ApiOkResponse({ type: PublicReleaseNotesDto })
+  async publicReleaseNotes(@Param('token') token: string) {
+    const notes = /^[\w-]{20,100}$/.test(token)
+      ? await this.sharing.publicReleaseNotes(token)
+      : null;
+    if (!notes) throw new NotFoundException('Unknown link');
+    return notes;
+  }
+
   @Get('shared/dashboards/:token')
   @Public()
   @ApiOperation({