feat: public read-only share links with permissions — closes #79

Share links:
- Generate a public link in the trip share modal
- Choose what to share: Map & Plan, Bookings, Packing, Budget, Chat
- Permissions enforced server-side
- Delete link to revoke access instantly

Shared trip page (/shared/:token):
- Read-only view with TREK logo, cover image, trip details
- Tabbed navigation with Lucide icons (responsive on mobile)
- Interactive map with auto-fit bounds per day
- Day plan, Bookings, Packing, Budget, Chat views
- Language picker, TREK branding footer

Technical:
- share_tokens DB table with per-field permissions
- Public GET /shared/:token endpoint (no auth)
- Two-column share modal (max-w-5xl)

server/src/db/migrations.ts

@@ -356,6 +356,29 @@ function runMigrations(db: Database.Database): void {
       try { db.exec('ALTER TABLE notification_preferences ADD COLUMN notify_collab_message INTEGER DEFAULT 1'); } catch {}
       try { db.exec('ALTER TABLE notification_preferences ADD COLUMN notify_packing_tagged INTEGER DEFAULT 1'); } catch {}
     },
+    () => {
+      // Public share links for read-only trip access
+      db.exec(`CREATE TABLE IF NOT EXISTS share_tokens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+        token TEXT NOT NULL UNIQUE,
+        created_by INTEGER NOT NULL REFERENCES users(id),
+        share_map INTEGER DEFAULT 1,
+        share_bookings INTEGER DEFAULT 1,
+        share_packing INTEGER DEFAULT 0,
+        share_budget INTEGER DEFAULT 0,
+        share_collab INTEGER DEFAULT 0,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+      )`);
+    },
+    () => {
+      // Add permission columns to share_tokens
+      try { db.exec('ALTER TABLE share_tokens ADD COLUMN share_map INTEGER DEFAULT 1'); } catch {}
+      try { db.exec('ALTER TABLE share_tokens ADD COLUMN share_bookings INTEGER DEFAULT 1'); } catch {}
+      try { db.exec('ALTER TABLE share_tokens ADD COLUMN share_packing INTEGER DEFAULT 0'); } catch {}
+      try { db.exec('ALTER TABLE share_tokens ADD COLUMN share_budget INTEGER DEFAULT 0'); } catch {}
+      try { db.exec('ALTER TABLE share_tokens ADD COLUMN share_collab INTEGER DEFAULT 0'); } catch {}
+    },
   ];
 
   if (currentVersion < migrations.length) {

server/src/index.ts

@@ -81,6 +81,7 @@ app.use(express.urlencoded({ extended: true }));
 
 // Avatars are public (shown on login, sharing screens)
 app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
+app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
 
 // All other uploads require authentication
 app.get('/uploads/:type/:filename', (req: Request, res: Response) => {
@@ -163,6 +164,9 @@ app.use('/api/backup', backupRoutes);
 import notificationRoutes from './routes/notifications';
 app.use('/api/notifications', notificationRoutes);
 
+import shareRoutes from './routes/share';
+app.use('/api', shareRoutes);
+
 // Serve static files in production
 if (process.env.NODE_ENV === 'production') {
   const publicPath = path.join(__dirname, '../public');

server/src/routes/share.ts

@@ -0,0 +1,165 @@
+import express, { Request, Response } from 'express';
+import crypto from 'crypto';
+import { db, canAccessTrip } from '../db/database';
+import { authenticate } from '../middleware/auth';
+import { AuthRequest } from '../types';
+import { loadTagsByPlaceIds } from '../services/queryHelpers';
+
+const router = express.Router();
+
+// Create a share link for a trip (owner/member only)
+router.post('/trips/:tripId/share-link', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+
+  const { share_map = true, share_bookings = true, share_packing = false, share_budget = false, share_collab = false } = req.body || {};
+
+  // Check if token already exists
+  const existing = db.prepare('SELECT token FROM share_tokens WHERE trip_id = ?').get(tripId) as { token: string } | undefined;
+  if (existing) {
+    // Update permissions
+    db.prepare('UPDATE share_tokens SET share_map = ?, share_bookings = ?, share_packing = ?, share_budget = ?, share_collab = ? WHERE trip_id = ?')
+      .run(share_map ? 1 : 0, share_bookings ? 1 : 0, share_packing ? 1 : 0, share_budget ? 1 : 0, share_collab ? 1 : 0, tripId);
+    return res.json({ token: existing.token });
+  }
+
+  const token = crypto.randomBytes(24).toString('base64url');
+  db.prepare('INSERT INTO share_tokens (trip_id, token, created_by, share_map, share_bookings, share_packing, share_budget, share_collab) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+    .run(tripId, token, authReq.user.id, share_map ? 1 : 0, share_bookings ? 1 : 0, share_packing ? 1 : 0, share_budget ? 1 : 0, share_collab ? 1 : 0);
+  res.status(201).json({ token });
+});
+
+// Get share link status
+router.get('/trips/:tripId/share-link', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+
+  const row = db.prepare('SELECT * FROM share_tokens WHERE trip_id = ?').get(tripId) as any;
+  res.json(row ? { token: row.token, created_at: row.created_at, share_map: !!row.share_map, share_bookings: !!row.share_bookings, share_packing: !!row.share_packing, share_budget: !!row.share_budget, share_collab: !!row.share_collab } : { token: null });
+});
+
+// Delete share link
+router.delete('/trips/:tripId/share-link', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+
+  db.prepare('DELETE FROM share_tokens WHERE trip_id = ?').run(tripId);
+  res.json({ success: true });
+});
+
+// Public read-only trip data (no auth required)
+router.get('/shared/:token', (req: Request, res: Response) => {
+  const { token } = req.params;
+  const shareRow = db.prepare('SELECT * FROM share_tokens WHERE token = ?').get(token) as any;
+  if (!shareRow) return res.status(404).json({ error: 'Invalid or expired link' });
+
+  const tripId = shareRow.trip_id;
+
+  // Trip
+  const trip = db.prepare('SELECT id, title, description, start_date, end_date, cover_image, currency FROM trips WHERE id = ?').get(tripId);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  // Days with assignments
+  const days = db.prepare('SELECT * FROM days WHERE trip_id = ? ORDER BY day_number ASC').all(tripId) as any[];
+  const dayIds = days.map(d => d.id);
+
+  let assignments = {};
+  let dayNotes = {};
+  if (dayIds.length > 0) {
+    const ph = dayIds.map(() => '?').join(',');
+    const allAssignments = db.prepare(`
+      SELECT da.*, p.id as place_id, p.name as place_name, p.description as place_description,
+        p.lat, p.lng, p.address, p.category_id, p.price, p.currency as place_currency,
+        COALESCE(da.assignment_time, p.place_time) as place_time,
+        COALESCE(da.assignment_end_time, p.end_time) as end_time,
+        p.duration_minutes, p.notes as place_notes, p.image_url, p.transport_mode,
+        c.name as category_name, c.color as category_color, c.icon as category_icon
+      FROM day_assignments da
+      JOIN places p ON da.place_id = p.id
+      LEFT JOIN categories c ON p.category_id = c.id
+      WHERE da.day_id IN (${ph})
+      ORDER BY da.order_index ASC
+    `).all(...dayIds);
+
+    const placeIds = [...new Set(allAssignments.map((a: any) => a.place_id))];
+    const tagsByPlace = loadTagsByPlaceIds(placeIds, { compact: true });
+
+    const byDay: Record<number, any[]> = {};
+    for (const a of allAssignments as any[]) {
+      if (!byDay[a.day_id]) byDay[a.day_id] = [];
+      byDay[a.day_id].push({
+        id: a.id, day_id: a.day_id, order_index: a.order_index, notes: a.notes,
+        place: {
+          id: a.place_id, name: a.place_name, description: a.place_description,
+          lat: a.lat, lng: a.lng, address: a.address, category_id: a.category_id,
+          price: a.price, place_time: a.place_time, end_time: a.end_time,
+          image_url: a.image_url, transport_mode: a.transport_mode,
+          category: a.category_id ? { id: a.category_id, name: a.category_name, color: a.category_color, icon: a.category_icon } : null,
+          tags: tagsByPlace[a.place_id] || [],
+        }
+      });
+    }
+    assignments = byDay;
+
+    const allNotes = db.prepare(`SELECT * FROM day_notes WHERE day_id IN (${ph}) ORDER BY sort_order ASC`).all(...dayIds);
+    const notesByDay: Record<number, any[]> = {};
+    for (const n of allNotes as any[]) {
+      if (!notesByDay[n.day_id]) notesByDay[n.day_id] = [];
+      notesByDay[n.day_id].push(n);
+    }
+    dayNotes = notesByDay;
+  }
+
+  // Places
+  const places = db.prepare(`
+    SELECT p.*, c.name as category_name, c.color as category_color, c.icon as category_icon
+    FROM places p LEFT JOIN categories c ON p.category_id = c.id
+    WHERE p.trip_id = ? ORDER BY p.created_at DESC
+  `).all(tripId);
+
+  // Reservations
+  const reservations = db.prepare('SELECT * FROM reservations WHERE trip_id = ? ORDER BY reservation_time ASC').all(tripId);
+
+  // Accommodations
+  const accommodations = db.prepare(`
+    SELECT a.*, p.name as place_name, p.address as place_address, p.lat as place_lat, p.lng as place_lng
+    FROM day_accommodations a JOIN places p ON a.place_id = p.id
+    WHERE a.trip_id = ?
+  `).all(tripId);
+
+  // Packing
+  const packing = db.prepare('SELECT * FROM packing_items WHERE trip_id = ? ORDER BY sort_order ASC').all(tripId);
+
+  // Budget
+  const budget = db.prepare('SELECT * FROM budget_items WHERE trip_id = ? ORDER BY category ASC').all(tripId);
+
+  // Categories
+  const categories = db.prepare('SELECT * FROM categories').all();
+
+  const permissions = {
+    share_map: !!shareRow.share_map,
+    share_bookings: !!shareRow.share_bookings,
+    share_packing: !!shareRow.share_packing,
+    share_budget: !!shareRow.share_budget,
+    share_collab: !!shareRow.share_collab,
+  };
+
+  // Only include data the owner chose to share
+  const collabMessages = permissions.share_collab
+    ? db.prepare('SELECT m.*, u.username, u.avatar FROM collab_messages m JOIN users u ON m.user_id = u.id WHERE m.trip_id = ? ORDER BY m.created_at ASC').all(tripId)
+    : [];
+
+  res.json({
+    trip, days, assignments, dayNotes, places, categories, permissions,
+    reservations: permissions.share_bookings ? reservations : [],
+    accommodations: permissions.share_bookings ? accommodations : [],
+    packing: permissions.share_packing ? packing : [],
+    budget: permissions.share_budget ? budget : [],
+    collab: collabMessages,
+  });
+});
+
+export default router;