fix(sharing): an access link no longer tells a stranger who wrote each note (#3859)

* feat(shares): a resolved case token carries the object's public timeline

A citizen following a track your case link came to find out what has
happened, and a status with no history answers half the question. The
resolve payload now carries the object's public entries.

The filter runs here, on the server, through the same service the
signed-in timeline reads: nothing marked internal crosses the boundary and
no caller can ask for a different filter. The projection is a whitelist of
five keys, so the author, the entry's own visibility and the raw source of
an intake mail stay behind, along with whatever is added to the entry next.

A timeline that cannot be read answers an empty list. The status page
shipped before the timeline did, and an instance whose tables are not
migrated yet must show the status rather than a 404 a citizen reads as a
revoked link.

* style(shares): the resolve docblock groups its param tags again

The new paragraph landed between the @PARAM and the @return, which phpcs
reads as a second parameter comment. It belongs above the tag block.

* fix(sharing): an access link no longer tells a stranger who wrote each note

The live anonymous surface is the access-link reader, and it handed every
public note to the link holder exactly as the note service shapes it: with
the author's Nextcloud user id and display name. Anyone with a link learned
who at the organisation wrote every line. It also read notes only, so a
kinded entry that exists as a record (a delivered decision, an announced
status, a portal message) never appeared on the page at all.

PublicTimeline is now the one anonymous timeline reader. It reads public
records and public notes, lets a record win over the note it projects so an
older note with no record is not dropped from view, sorts newest first by
parsed moment rather than by string, and lets five keys out. Each source
fails on its own. The access-link reader and the case-token resolve both
ask it, so the two surfaces cannot come to disagree about what leaves.

Mutation-checked: passing a note's fields through reddens the whitelist
assertion, and skipping the notes reddens the older-note guard.

Author: rubenvdlinde

lib/Service/CaseTokenService.php

@@ -45,6 +45,8 @@
 use InvalidArgumentException;
 use OCA\OpenRegister\Db\CaseToken;
 use OCA\OpenRegister\Db\CaseTokenMapper;
+use OCA\OpenRegister\Db\ObjectEntity;
+use OCA\OpenRegister\Service\Timeline\PublicTimeline;
 use OCP\IURLGenerator;
 use OCP\IUserSession;
 use OCP\Security\ISecureRandom;
@@ -70,6 +72,18 @@ class CaseTokenService {
 	 */
 	private const TOKEN_LENGTH = 43;
 
+	/**
+	 * How many public entries a resolved token carries at most.
+	 *
+	 * A public page is read on a phone and the newest entries are the ones
+	 * that answer "what is happening with my case". A case with a longer
+	 * history is not an error, it is a case that needs paging, and paging an
+	 * anonymous endpoint is a separate decision.
+	 *
+	 * @var int
+	 */
+	private const PUBLIC_TIMELINE_LIMIT = 50;
+
 	/**
 	 * Constructor.
 	 *
@@ -168,6 +182,13 @@ public function mint(
 	 * object missing, RBAC-denied) so the caller returns a uniform 404
 	 * and the endpoint is not an enumeration oracle.
 	 *
+	 * THE VIEW CARRIES THE OBJECT'S PUBLIC TIMELINE. A citizen following a
+	 * "track your case" link came to find out what has happened, and a status
+	 * with no history answers half the question. The entries are filtered on
+	 * `public` HERE, on the server, by the same service the signed-in timeline
+	 * reads: nothing that says `internal` crosses this boundary, and no caller
+	 * can ask this method for a different filter.
+	 *
 	 * @param string $token The opaque token.
 	 *
 	 * @return array<string,mixed>|null The public-safe object view, or
@@ -229,6 +250,7 @@ public function resolve(string $token): ?array {
 				'token' => $row->getToken(),
 				'label' => $row->getLabel(),
 				'object' => $rendered,
+				'timeline' => $this->publicTimeline(entity: $entity),
 			];
 		} catch (Throwable $e) {
 			// RBAC-denied / not-found / any read failure → 404 (null).
@@ -241,6 +263,44 @@ public function resolve(string $token): ?array {
 		}//end try
 	}//end resolve()
 
+	/**
+	 * The public entries on one object, as a stranger may read them.
+	 *
+	 * The read and the five-key projection are {@see PublicTimeline}'s, the
+	 * same class the access-link reader asks. Two anonymous surfaces that each
+	 * decided for themselves what leaves would come to disagree, and the
+	 * disagreement would be a handler's name on a citizen's screen.
+	 *
+	 * SOFT BY DESIGN. A timeline that cannot be read answers the empty list:
+	 * the status page shipped before the timeline did, and an instance that
+	 * cannot build the reader must still show the status rather than a uniform
+	 * 404 a citizen reads as a revoked link. `PublicTimeline` already softens a
+	 * failed read per source; this catch covers the container failing to build
+	 * it at all, and anything that is not an entity has no timeline to read.
+	 *
+	 * @param object $entity The object the timeline hangs on.
+	 *
+	 * @return array<int, array<string,mixed>> The public entries, newest first.
+	 *
+	 * @spec openspec/specs/integration-leaf-foundation/spec.md
+	 */
+	private function publicTimeline(object $entity): array {
+		if (($entity instanceof ObjectEntity) === false) {
+			return [];
+		}
+
+		try {
+			$reader = $this->container->get(PublicTimeline::class);
+		} catch (Throwable $e) {
+			$this->logger->warning(
+				'[CaseTokenService] the public timeline reader could not be built: ' . $e->getMessage()
+			);
+			return [];
+		}
+
+		return $reader->forObject(object: $entity, limit: self::PUBLIC_TIMELINE_LIMIT);
+	}//end publicTimeline()
+
 	/**
 	 * Revoke a token so it can no longer be resolved.
 	 *

lib/Service/Sharing/AccessLinkReader.php

@@ -47,9 +47,9 @@
 use OCA\OpenRegister\Db\AccessLink;
 use OCA\OpenRegister\Db\ObjectEntity;
 use OCA\OpenRegister\Db\SchemaMapper;
-use OCA\OpenRegister\Service\NoteService;
 use OCA\OpenRegister\Service\ObjectService;
 use OCA\OpenRegister\Service\PropertyRbacHandler;
+use OCA\OpenRegister\Service\Timeline\PublicTimeline;
 use OCA\OpenRegister\Service\TimelineVisibilityService;
 use Psr\Log\LoggerInterface;
 use Throwable;
@@ -104,15 +104,15 @@ class AccessLinkReader {
 	 * @param ObjectService $objects The object read path.
 	 * @param SchemaMapper $schemas Resolves the schema whose rules apply.
 	 * @param PropertyRbacHandler $properties Strips write-only and unreadable properties.
-	 * @param NoteService $notes Reads the timeline.
+	 * @param PublicTimeline $timeline Reads and projects the public half of the timeline.
 	 * @param AccessLinkSubject $subjects Reads which object a subject names.
 	 * @param LoggerInterface $logger PSR logger.
 	 */
 	public function __construct(
 		private readonly ObjectService $objects,
 		private readonly SchemaMapper $schemas,
 		private readonly PropertyRbacHandler $properties,
-		private readonly NoteService $notes,
+		private readonly PublicTimeline $timeline,
 		private readonly AccessLinkSubject $subjects,
 		private readonly LoggerInterface $logger,
 	) {
@@ -344,24 +344,21 @@ private function filteredProperties(ObjectEntity $object): array {
 	 * who may manage the object, and a link must publish the public half
 	 * whatever session happens to be around it.
 	 *
+	 * PROJECTED, NOT PASSED THROUGH. This used to hand the link holder each
+	 * public note exactly as the note service shapes it, which carries the
+	 * author's user id and display name: a stranger with a link learned who
+	 * at the organisation wrote every line. It also read notes only, so a
+	 * kinded entry that exists as a record and not as a comment never
+	 * appeared. {@see PublicTimeline} reads both and lets five keys out.
+	 *
 	 * @param ObjectEntity $object The object.
 	 *
-	 * @return array<int, mixed> The published timeline entries.
+	 * @return array<int, array<string, mixed>> The published timeline entries.
 	 *
 	 * @spec openspec/changes/access-by-link-not-by-account/specs/public-access-links/spec.md#requirement-a-link-never-sees-past-the-objects-own-rules-req-abl-004
 	 */
 	private function publicTimeline(ObjectEntity $object): array {
-		try {
-			return $this->notes->getNotesForObject(
-				objectUuid: (string)$object->getUuid(),
-				visibility: TimelineVisibilityService::PUBLIC_ENTRY
-			);
-		} catch (Throwable $failure) {
-			$this->logger->warning(
-				'[AccessLinkReader] Could not read the timeline for a link: ' . $failure->getMessage()
-			);
-			return [];
-		}
+		return $this->timeline->forObject(object: $object);
 	}//end publicTimeline()
 
 	/**

lib/Service/Timeline/PublicTimeline.php

@@ -0,0 +1,239 @@
+<?php
+
+/**
+ * The public half of an object's timeline, as a stranger may read it.
+ *
+ * ONE CLASS FOR EVERY ANONYMOUS READER. Two surfaces publish a timeline to
+ * somebody with no account: the access-link reader (`/api/public/links`) and
+ * the case-token resolve (`/api/public/case-tokens`). Each used to decide for
+ * itself what an entry looked like on the way out, and the access-link reader
+ * decided nothing: it handed every public note to the link holder as the note
+ * service shaped it, with the author's user id and display name on it. So the
+ * decision lives here, once, and both surfaces ask for it.
+ *
+ * THE PROJECTION IS A WHITELIST. Five keys leave: `id`, `kind`, `message`,
+ * `fields`, `occurredAt`. Naming the fields to drop would publish the next one
+ * somebody adds to an entry; naming the fields to keep cannot.
+ *
+ * RECORDS AND NOTES, NOT RECORDS ALONE. A kinded entry (a delivered decision,
+ * a status that was announced, a portal message) exists only as a timeline
+ * record. A note exists as a comment, and is projected into a record when it
+ * is written through the notes endpoint; a note written before records
+ * existed has no record at all. Reading only records would drop those notes
+ * from the public view without a word. Reading only notes, as the access-link
+ * reader did, never showed a kinded entry. So both are read, and a note whose
+ * record is present is dropped in favour of the record, which carries the kind.
+ *
+ * EACH SOURCE FAILS ON ITS OWN. A record table that cannot be read does not
+ * hide the notes, and the other way round. Every failure is logged at warning.
+ *
+ * @category Service
+ * @package  OCA\OpenRegister\Service\Timeline
+ *
+ * @author    Conduction Development Team <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @version GIT: <git-id>
+ *
+ * @link https://conduction.nl
+ *
+ * @spec openspec/changes/access-by-link-not-by-account/specs/public-access-links/spec.md#requirement-a-link-never-sees-past-the-objects-own-rules-req-abl-004
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\Service\Timeline;
+
+use OCA\OpenRegister\Db\ObjectEntity;
+use OCA\OpenRegister\Service\NoteService;
+use OCA\OpenRegister\Service\TimelineVisibilityService;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * Reads and projects the public timeline of one object.
+ *
+ * @spec openspec/changes/access-by-link-not-by-account/specs/public-access-links/spec.md#requirement-a-link-never-sees-past-the-objects-own-rules-req-abl-004
+ */
+class PublicTimeline {
+
+	/**
+	 * The only keys an entry carries out of the building.
+	 *
+	 * @var array<int, string>
+	 */
+	public const KEYS = ['id', 'kind', 'message', 'fields', 'occurredAt'];
+
+	/**
+	 * Constructor.
+	 *
+	 * @param TimelineEntryService $entries Reads the timeline records.
+	 * @param NoteService          $notes   Reads the notes a record may not exist for yet.
+	 * @param LoggerInterface      $logger  PSR logger.
+	 */
+	public function __construct(
+		private readonly TimelineEntryService $entries,
+		private readonly NoteService $notes,
+		private readonly LoggerInterface $logger,
+	) {
+	}//end __construct()
+
+	/**
+	 * The public entries on one object, newest first, projected.
+	 *
+	 * The filter is fixed at `public` and is not a parameter, so no caller can
+	 * ask this class for the internal half.
+	 *
+	 * @param ObjectEntity $object The object the timeline hangs on.
+	 * @param integer      $limit  How many entries at most.
+	 *
+	 * @return array<int, array<string, mixed>> The entries, each with exactly the keys in {@see self::KEYS}.
+	 *
+	 * @spec openspec/changes/access-by-link-not-by-account/specs/public-access-links/spec.md#requirement-a-link-never-sees-past-the-objects-own-rules-req-abl-004
+	 */
+	public function forObject(ObjectEntity $object, int $limit = 50): array {
+		$records = $this->records(object: $object, limit: $limit);
+
+		$projected = [];
+		$noteIdsWithARecord = [];
+		foreach ($records as $record) {
+			$commentId = $record['commentId'] ?? null;
+			if ($commentId !== null) {
+				$noteIdsWithARecord[(string)$commentId] = true;
+			}
+
+			$projected[] = $this->fromRecord(row: $record);
+		}
+
+		foreach ($this->notesOf(object: $object, limit: $limit) as $note) {
+			if (isset($noteIdsWithARecord[(string)($note['id'] ?? '')]) === true) {
+				continue;
+			}
+
+			$projected[] = $this->fromNote(note: $note);
+		}
+
+		usort(
+			$projected,
+			fn (array $left, array $right): int => $this->moment(entry: $right) <=> $this->moment(entry: $left)
+		);
+
+		return array_slice($projected, 0, $limit);
+	}//end forObject()
+
+	/**
+	 * When an entry happened, as a number that sorts.
+	 *
+	 * Both sources write ISO 8601 with an offset, but not always the same
+	 * offset, so comparing the strings would order a summer entry against a
+	 * winter one by the digits of their offsets. An entry with no readable
+	 * moment sorts last rather than first.
+	 *
+	 * @param array<string, mixed> $entry A projected entry.
+	 *
+	 * @return integer The Unix time, or 0 when the moment cannot be read.
+	 */
+	private function moment(array $entry): int {
+		$moment = strtotime((string)$entry['occurredAt']);
+		if ($moment === false) {
+			return 0;
+		}
+
+		return $moment;
+	}//end moment()
+
+	/**
+	 * The object's public timeline records, as plain rows.
+	 *
+	 * @param ObjectEntity $object The object.
+	 * @param integer      $limit  How many at most.
+	 *
+	 * @return array<int, array<string, mixed>> The rows, or none when the records cannot be read.
+	 */
+	private function records(ObjectEntity $object, int $limit): array {
+		try {
+			$entries = $this->entries->listForObject(
+				object: $object,
+				visibility: TimelineVisibilityService::PUBLIC_ENTRY,
+				limit: $limit
+			);
+		} catch (Throwable $failure) {
+			$this->logger->warning(
+				'[PublicTimeline] Could not read the public timeline records: ' . $failure->getMessage()
+			);
+			return [];
+		}
+
+		$rows = [];
+		foreach ($entries as $entry) {
+			$rows[] = $entry->jsonSerialize();
+		}
+
+		return $rows;
+	}//end records()
+
+	/**
+	 * The object's public notes.
+	 *
+	 * @param ObjectEntity $object The object.
+	 * @param integer      $limit  How many at most.
+	 *
+	 * @return array<int, array<string, mixed>> The notes, or none when they cannot be read.
+	 */
+	private function notesOf(ObjectEntity $object, int $limit): array {
+		try {
+			return $this->notes->getNotesForObject(
+				objectUuid: (string)$object->getUuid(),
+				limit: $limit,
+				offset: 0,
+				visibility: TimelineVisibilityService::PUBLIC_ENTRY
+			);
+		} catch (Throwable $failure) {
+			$this->logger->warning(
+				'[PublicTimeline] Could not read the public notes: ' . $failure->getMessage()
+			);
+			return [];
+		}
+	}//end notesOf()
+
+	/**
+	 * One record, cut down to the whitelist.
+	 *
+	 * @param array<string, mixed> $row The record as it serialises.
+	 *
+	 * @return array<string, mixed> The projection.
+	 */
+	private function fromRecord(array $row): array {
+		return [
+			'id' => (string)($row['id'] ?? ''),
+			'kind' => (string)($row['kind'] ?? ''),
+			'message' => (string)($row['message'] ?? ''),
+			'fields' => (array)($row['fields'] ?? []),
+			'occurredAt' => (string)($row['created'] ?? ''),
+		];
+	}//end fromRecord()
+
+	/**
+	 * One note, cut down to the same whitelist.
+	 *
+	 * A note has no kind and no fields, and says so with the empty values
+	 * rather than by leaving the keys out, so a reader sees one shape.
+	 *
+	 * @param array<string, mixed> $note The note as the note service shapes it.
+	 *
+	 * @return array<string, mixed> The projection.
+	 */
+	private function fromNote(array $note): array {
+		return [
+			'id' => (string)($note['id'] ?? ''),
+			'kind' => '',
+			'message' => (string)($note['message'] ?? ''),
+			'fields' => [],
+			'occurredAt' => (string)($note['createdAt'] ?? ''),
+		];
+	}//end fromNote()
+}//end class