feat: a dashboard for clients, behind a secret link

Owners and admins turn it on in Configuración → General, pick what it
shows (tickets per status, the sprint under way, release forecasts,
open epics and activity per day) and can renew or drop the link. Whoever
has it sees /share/{token} without an account: only those blocks, no
people nor single tickets but the epics, no links into the app, read
again every minute. A renewed or dropped link says it no longer works.

REST (GET/PUT/DELETE /api/projects/{project}/share and the public
GET /api/shared/dashboards/{token}) and GraphQL (dashboardShare,
shareDashboard, unshareDashboard, sharedDashboard). The token is kept
in dashboard_shares and goes with the project.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/sharing.controller.ts

@@ -0,0 +1,120 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  NotFoundException,
+  Param,
+  Put,
+  Res,
+} from '@nestjs/common';
+import {
+  ApiNoContentResponse,
+  ApiOkResponse,
+  ApiOperation,
+  ApiParam,
+  ApiTags,
+} from '@nestjs/swagger';
+import { User } from '@task-stream/api/identity/domain';
+import {
+  ApiPireonAuth,
+  CurrentUser,
+  Public,
+} from '@task-stream/api/identity/presenters';
+import {
+  ApiCommandErrors,
+  ApiReadErrors,
+} from '@task-stream/api/shared/presenters';
+import { SharingService } from '@task-stream/api/tracker/application';
+import type { Response } from 'express';
+import { ShareDashboardDto } from './dto/requests.dto';
+import { DashboardShareDto, SharedDashboardDto } from './dto/responses.dto';
+import { Refs } from './refs';
+
+const PROJECT = ApiParam({
+  name: 'project',
+  description: 'Project id or key',
+  example: 'WEB',
+});
+
+/**
+ * The project's dashboard for clients: a secret link (/share/{token}) that
+ * shows the blocks its owners and admins chose, without an account.
+ */
+@ApiTags('Projects')
+@Controller()
+export class SharingController {
+  constructor(
+    private readonly sharing: SharingService,
+    private readonly refs: Refs,
+  ) {}
+
+  @Get('projects/:project/share')
+  @ApiPireonAuth()
+  @PROJECT
+  @ApiOperation({ summary: "The project's link for clients, if any" })
+  @ApiOkResponse({ type: DashboardShareDto })
+  @ApiNoContentResponse({ description: 'It has none' })
+  @ApiReadErrors()
+  async share(
+    @CurrentUser() me: User,
+    @Param('project') project: string,
+    @Res({ passthrough: true }) response: Response,
+  ) {
+    const share = await this.sharing.share(
+      me.id,
+      await this.refs.projectId(me.id, project),
+    );
+    if (!share) response.status(204);
+    return share ?? undefined;
+  }
+
+  @Put('projects/:project/share')
+  @ApiPireonAuth()
+  @PROJECT
+  @ApiOperation({
+    summary: 'Turn the link on or change its blocks (renew: a new secret)',
+  })
+  @ApiOkResponse({ type: DashboardShareDto })
+  @ApiCommandErrors()
+  async save(
+    @CurrentUser() me: User,
+    @Param('project') project: string,
+    @Body() body: ShareDashboardDto,
+  ) {
+    return this.sharing.save(
+      me.id,
+      await this.refs.projectId(me.id, project),
+      body.blocks,
+      body.renew ?? false,
+    );
+  }
+
+  @Delete('projects/:project/share')
+  @HttpCode(204)
+  @ApiPireonAuth()
+  @PROJECT
+  @ApiOperation({ summary: 'The link stops working' })
+  @ApiNoContentResponse()
+  @ApiCommandErrors()
+  async remove(@CurrentUser() me: User, @Param('project') project: string) {
+    await this.sharing.remove(me.id, await this.refs.projectId(me.id, project));
+  }
+
+  @Get('shared/dashboards/:token')
+  @Public()
+  @ApiOperation({
+    summary: 'What a link for clients shows (no session)',
+    description:
+      'Only the chosen blocks: tickets per status, the sprint under way, release forecasts, open epics and activity per day. The others are null.',
+  })
+  @ApiOkResponse({ type: SharedDashboardDto })
+  async shared(@Param('token') token: string) {
+    const dashboard = /^[\w-]{20,100}$/.test(token)
+      ? await this.sharing.shared(token)
+      : null;
+    if (!dashboard) throw new NotFoundException('Unknown link');
+    return dashboard;
+  }
+}