Feature Request: Share link to guests with only password protection, no user.

[krth8]

Could this be possible?

[Elgokoo]

Share Link to Guests with Only Password Protection, No User
Conceptual Approach: You want a link that doesn’t require a user account, but is protected by a password. When a guest opens the link, they input the password and gain temporary access.

Integration Points:

Database:

Add a shared_links table with columns: id, media_file_id or folder_id, password_hash, expires_at, permissions.
Migrations in server/migrations to create shared_links.
Server Logic:

Add a gRPC or HTTP endpoint create_shared_link(media_file_id, password).
Add another endpoint open_shared_link(link_id, password) that checks password and returns a temporary session with restricted permissions.
Integrate with authz_user_action or directly create a special UserSessionData with is_guest = true.
Organizer:

For example, cmd_from_client("create_shared_link", {id: folder_id, password: ...}) => Organizer calls srv.DbUpsert(...) to store a row in shared_links table.
When a guest hits the link, no user_id required. Server checks password and returns a session. Organizer’s navigate_page might detect is_guest and show read-only view.
Client:

After receiving the special link (maybe clapshot.callOrganizer("create_shared_link", { ... }) returns a URL), the user shares this URL externally.
Guest opens URL, prompt password input (a small password form page in App.svelte checks password via new server endpoint).
On success, store a session cookie with minimal rights.