From a6ab35a95992368ae8ff278ef2e62f764f6ecee2 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 00:14:20 +0100
Subject: [PATCH 01/11] feat: add core security utilities for checksum-based
 share links
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add HMAC-SHA256 checksum generation and validation (shareChecksum.ts)
- Add PDF magic bytes validation to prevent file spoofing (pdfValidator.ts)
- Add IP-based rate limiting for upload abuse prevention (uploadRateLimiter.ts)
- Update BillingLocation interface with shareTTL and shareFirstVisitedAt fields
- Add environment variables for share link security and TTL configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .env                               | 13 +++++-
 app/lib/db-types.ts                |  4 ++
 app/lib/shareChecksum.ts           | 52 ++++++++++++++++++++++
 app/lib/uploadRateLimiter.ts       | 71 ++++++++++++++++++++++++++++++
 app/lib/validators/pdfValidator.ts | 46 +++++++++++++++++++
 5 files changed, 185 insertions(+), 1 deletion(-)
 create mode 100644 app/lib/shareChecksum.ts
 create mode 100644 app/lib/uploadRateLimiter.ts
 create mode 100644 app/lib/validators/pdfValidator.ts

diff --git a/.env b/.env
index 6364b54..49e90e0 100644
--- a/.env
+++ b/.env
@@ -9,4 +9,15 @@ LINKEDIN_SECRET=ugf61aJ2iyErLK40
 USE_MOCK_AUTH=true
 
 MAX_BILL_ATTACHMENT_UPLOAD_SIZE_KB=1024
-MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB=1024
\ No newline at end of file
+MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB=1024
+
+# Share link security
+SHARE_LINK_SECRET=fb831e43b5ab594106e093f86fa8cb2a2405c564a61c3a7681079ec416528654
+
+# Share link TTL configuration
+SHARE_TTL_INITIAL_DAYS=10
+SHARE_TTL_AFTER_VISIT_HOURS=1
+
+# Rate limiting for uploads
+UPLOAD_RATE_LIMIT_PER_IP=5
+UPLOAD_RATE_LIMIT_WINDOW_MS=3600000
\ No newline at end of file
diff --git a/app/lib/db-types.ts b/app/lib/db-types.ts
index 341ed62..87a93ef 100644
--- a/app/lib/db-types.ts
+++ b/app/lib/db-types.ts
@@ -81,6 +81,10 @@ export interface BillingLocation {
     utilBillsProofOfPayment?: FileAttachment|null;
     /** (optional) rent proof of payment attachment */
     rentProofOfPayment?: FileAttachment|null;
+    /** (optional) share link expiry timestamp */
+    shareTTL?: Date;
+    /** (optional) when tenant first visited the share link */
+    shareFirstVisitedAt?: Date | null;
 };
 
 export enum BilledTo {
diff --git a/app/lib/shareChecksum.ts b/app/lib/shareChecksum.ts
new file mode 100644
index 0000000..54c2eab
--- /dev/null
+++ b/app/lib/shareChecksum.ts
@@ -0,0 +1,52 @@
+import crypto from 'crypto';
+
+/**
+ * Generate share link checksum for location
+ * Uses HMAC-SHA256 for cryptographic integrity
+ *
+ * SECURITY: Prevents location ID enumeration while allowing stateless validation
+ */
+export function generateShareChecksum(locationId: string): string {
+  const secret = process.env.SHARE_LINK_SECRET;
+
+  if (!secret) {
+    throw new Error('SHARE_LINK_SECRET environment variable not configured');
+  }
+
+  return crypto
+    .createHmac('sha256', secret)
+    .update(locationId)
+    .digest('hex')
+    .substring(0, 16); // 64 bits of entropy (sufficient for share links)
+}
+
+/**
+ * Validate share link checksum
+ * Uses constant-time comparison to prevent timing attacks
+ *
+ * @param locationId - The location ID from URL
+ * @param providedChecksum - The checksum from URL
+ * @returns true if checksum is valid
+ */
+export function validateShareChecksum(
+  locationId: string,
+  providedChecksum: string
+): boolean {
+  try {
+    const expectedChecksum = generateShareChecksum(locationId);
+
+    // Convert to buffers for timing-safe comparison
+    const expected = Buffer.from(expectedChecksum);
+    const provided = Buffer.from(providedChecksum);
+
+    // Length check (prevents timing attack on different lengths)
+    if (expected.length !== provided.length) {
+      return false;
+    }
+
+    // Constant-time comparison (prevents timing attacks)
+    return crypto.timingSafeEqual(expected, provided);
+  } catch {
+    return false;
+  }
+}
diff --git a/app/lib/uploadRateLimiter.ts b/app/lib/uploadRateLimiter.ts
new file mode 100644
index 0000000..62b2ba1
--- /dev/null
+++ b/app/lib/uploadRateLimiter.ts
@@ -0,0 +1,71 @@
+/**
+ * Simple in-memory rate limiter for upload attempts
+ * Tracks by IP address
+ */
+
+interface RateLimitEntry {
+  count: number;
+  resetAt: number; // Unix timestamp
+}
+
+// In-memory store (use Redis for production multi-instance setups)
+const rateLimitStore = new Map<string, RateLimitEntry>();
+
+/**
+ * Check if IP address is rate limited
+ * @returns { allowed: boolean, remaining: number }
+ */
+export function checkUploadRateLimit(ipAddress: string): { allowed: boolean; remaining: number; resetIn: number } {
+
+  const maxUploads = parseInt(process.env.UPLOAD_RATE_LIMIT_PER_IP || '5', 10);
+  const windowMs = parseInt(process.env.UPLOAD_RATE_LIMIT_WINDOW_MS || '3600000', 10); // 1 hour
+
+  const now = Date.now();
+  const key = `upload:${ipAddress}`;
+
+  let entry = rateLimitStore.get(key);
+
+  // Clean up expired entry or create new one
+  if (!entry || now > entry.resetAt) {
+    entry = {
+      count: 0,
+      resetAt: now + windowMs
+    };
+    rateLimitStore.set(key, entry);
+  }
+
+  // Check if limit exceeded
+  if (entry.count >= maxUploads) {
+    return {
+      allowed: false,
+      remaining: 0,
+      resetIn: Math.ceil((entry.resetAt - now) / 1000) // seconds
+    };
+  }
+
+  // Increment counter
+  entry.count++;
+  rateLimitStore.set(key, entry);
+
+  return {
+    allowed: true,
+    remaining: maxUploads - entry.count,
+    resetIn: Math.ceil((entry.resetAt - now) / 1000)
+  };
+}
+
+/**
+ * Periodic cleanup of expired entries (prevent memory leak)
+ * Call this occasionally (e.g., every hour)
+ */
+export function cleanupRateLimitStore() {
+  const now = Date.now();
+  for (const [key, entry] of rateLimitStore.entries()) {
+    if (now > entry.resetAt) {
+      rateLimitStore.delete(key);
+    }
+  }
+}
+
+// Auto-cleanup every 10 minutes
+setInterval(cleanupRateLimitStore, 10 * 60 * 1000);
diff --git a/app/lib/validators/pdfValidator.ts b/app/lib/validators/pdfValidator.ts
new file mode 100644
index 0000000..8036c4c
--- /dev/null
+++ b/app/lib/validators/pdfValidator.ts
@@ -0,0 +1,46 @@
+/**
+ * Validate that uploaded file is a legitimate PDF
+ * Checks magic bytes, not just MIME type
+ */
+export async function validatePdfFile(file: File): Promise<{ valid: boolean; error?: string }> {
+
+  // Check file size first (quick rejection)
+  const maxFileSizeKB = parseInt(process.env.MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB || '1024', 10);
+  const maxFileSizeBytes = maxFileSizeKB * 1024;
+
+  if (file.size === 0) {
+    return { valid: false, error: 'File is empty' };
+  }
+
+  if (file.size > maxFileSizeBytes) {
+    return { valid: false, error: `File size exceeds ${maxFileSizeKB} KB limit` };
+  }
+
+  // Read file content
+  const arrayBuffer = await file.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+
+  // Check PDF magic bytes (header signature)
+  // PDF files must start with "%PDF-" (bytes: 25 50 44 46 2D)
+  const header = buffer.toString('utf-8', 0, 5);
+  if (!header.startsWith('%PDF-')) {
+    return { valid: false, error: 'Invalid PDF file format' };
+  }
+
+  // Optional: Check for PDF version (1.0 to 2.0)
+  const version = buffer.toString('utf-8', 5, 8); // e.g., "1.4", "1.7", "2.0"
+  const versionMatch = version.match(/^(\d+\.\d+)/);
+  if (!versionMatch) {
+    return { valid: false, error: 'Invalid PDF version' };
+  }
+
+  // Optional: Verify PDF EOF marker (should end with %%EOF)
+  // Note: Some PDFs have trailing data, so this is lenient
+  const endSection = buffer.toString('utf-8', Math.max(0, buffer.length - 1024));
+  if (!endSection.includes('%%EOF')) {
+    console.warn('PDF missing EOF marker - may be corrupted');
+    // Don't reject, just warn (some valid PDFs have non-standard endings)
+  }
+
+  return { valid: true };
+}

From 1cf1806955d47c3ce19c10639bd8336daa875de9 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 00:15:07 +0100
Subject: [PATCH 02/11] feat: add share link generation and validation
 functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add generateShareLink() for owners to create share URLs with checksums
- Add validateShareAccess() to validate checksum and TTL on tenant visits
- Implement automatic TTL reset (10 days → 1 hour after first visit)
- Include automatic cleanup of expired shares

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/lib/actions/locationActions.ts | 115 +++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

diff --git a/app/lib/actions/locationActions.ts b/app/lib/actions/locationActions.ts
index 88b7686..07d7a9e 100644
--- a/app/lib/actions/locationActions.ts
+++ b/app/lib/actions/locationActions.ts
@@ -10,6 +10,7 @@ import { gotoHomeWithMessage } from './navigationActions';
 import { unstable_noStore, revalidatePath } from 'next/cache';
 import { IntlTemplateFn } from '@/app/i18n';
 import { getTranslations, getLocale } from "next-intl/server";
+import { generateShareChecksum, validateShareChecksum } from '../shareChecksum';
 
 export type State = {
     errors?: {
@@ -698,4 +699,118 @@ export const uploadUtilBillsProofOfPayment = async (locationID: string, formData
         console.error('Error uploading util bills proof of payment:', error);
         return { success: false, error: error.message || 'Upload failed' };
     }
+}
+
+/**
+ * Generate/activate share link for location
+ * Called when owner clicks "Share" button
+ * Sets shareTTL to 10 days from now
+ */
+export const generateShareLink = withUser(
+  async (user: AuthenticatedUser, locationId: string) => {
+
+    const { id: userId } = user;
+    const dbClient = await getDbClient();
+
+    // Verify ownership
+    const location = await dbClient.collection<BillingLocation>("lokacije").findOne({
+      _id: locationId,
+      userId
+    });
+
+    if (!location) {
+      return { error: 'Location not found' };
+    }
+
+    // Calculate TTL (10 days from now, configurable)
+    const initialDays = parseInt(process.env.SHARE_TTL_INITIAL_DAYS || '10', 10);
+    const shareTTL = new Date(Date.now() + initialDays * 24 * 60 * 60 * 1000);
+
+    // Activate sharing by setting TTL
+    await dbClient.collection<BillingLocation>("lokacije").updateOne(
+      { _id: locationId },
+      {
+        $set: { shareTTL },
+        $unset: { shareFirstVisitedAt: "" } // Reset first visit tracking
+      }
+    );
+
+    // Generate checksum
+    const checksum = generateShareChecksum(locationId);
+
+    // Build share URL
+    const baseUrl = process.env.NEXTAUTH_URL || 'http://localhost:3000';
+    const shareUrl = `${baseUrl}/share/location/${locationId}/${checksum}`;
+
+    return { shareUrl };
+  }
+);
+
+/**
+ * Validate share link and update TTL on first visit
+ * Called when tenant visits share link
+ *
+ * SECURITY:
+ * 1. Validates checksum (stateless, prevents enumeration)
+ * 2. Checks TTL in database (time-based access control)
+ * 3. Marks first visit and resets TTL to 1 hour
+ */
+export async function validateShareAccess(
+  locationId: string,
+  checksum: string
+): Promise<{ valid: boolean; error?: string }> {
+
+  // 1. Validate checksum FIRST (before DB query - stateless validation)
+  if (!validateShareChecksum(locationId, checksum)) {
+    return { valid: false, error: 'Invalid share link' };
+  }
+
+  // 2. Check TTL in database
+  const dbClient = await getDbClient();
+  const location = await dbClient.collection<BillingLocation>("lokacije").findOne(
+    { _id: locationId },
+    { projection: { shareTTL: 1, shareFirstVisitedAt: 1 } }
+  );
+
+  if (!location) {
+    return { valid: false, error: 'Invalid share link' };
+  }
+
+  // 3. Check if sharing is enabled
+  if (!location.shareTTL) {
+    return { valid: false, error: 'This content is no longer shared' };
+  }
+
+  // 4. Check if TTL expired
+  const now = new Date();
+  if (now > location.shareTTL) {
+    // Clean up expired share
+    await dbClient.collection<BillingLocation>("lokacije").updateOne(
+      { _id: locationId },
+      { $unset: { shareTTL: "", shareFirstVisitedAt: "" } }
+    );
+
+    return { valid: false, error: 'This content is no longer shared' };
+  }
+
+  // 5. Mark first visit if applicable (resets TTL to 1 hour)
+  if (!location.shareFirstVisitedAt) {
+    const visitHours = parseInt(process.env.SHARE_TTL_AFTER_VISIT_HOURS || '1', 10);
+    const newTTL = new Date(Date.now() + visitHours * 60 * 60 * 1000);
+
+    await dbClient.collection<BillingLocation>("lokacije").updateOne(
+      {
+        _id: locationId,
+        shareFirstVisitedAt: null // Only update if not already set
+      },
+      {
+        $set: {
+          shareFirstVisitedAt: new Date(),
+          shareTTL: newTTL
+        }
+      }
+    );
+  }
+
+  return { valid: true };
 }
\ No newline at end of file

From e497ad1da6c6e4c5198f247bf217131615842781 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 00:17:10 +0100
Subject: [PATCH 03/11] feat: implement secure uploadProofOfPayment with
 multi-layer validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security improvements:
- Add checksum validation (prevents unauthorized access)
- Add IP-based rate limiting (prevents abuse)
- Replace MIME type check with PDF magic bytes validation
- Add shareTTL expiry validation
- Add automatic cleanup of expired shares
- Sanitize error messages (generic responses to clients)

Breaking change: Function signature now requires checksum parameter

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/lib/actions/billActions.ts | 199 +++++++++++++++++++--------------
 1 file changed, 113 insertions(+), 86 deletions(-)

diff --git a/app/lib/actions/billActions.ts b/app/lib/actions/billActions.ts
index dfb1d52..4211425 100644
--- a/app/lib/actions/billActions.ts
+++ b/app/lib/actions/billActions.ts
@@ -10,6 +10,9 @@ import { gotoHomeWithMessage } from './navigationActions';
 import { getTranslations, getLocale } from "next-intl/server";
 import { IntlTemplateFn } from '@/app/i18n';
 import { unstable_noStore, revalidatePath } from 'next/cache';
+import { validateShareChecksum } from '../shareChecksum';
+import { validatePdfFile } from '../validators/pdfValidator';
+import { checkUploadRateLimit } from '../uploadRateLimiter';
 
 export type State = {
     errors?: {
@@ -488,94 +491,118 @@ export const deleteBillById = withUser(async (user: AuthenticatedUser, locationI
 
 /**
  * Uploads proof of payment for the given bill
- * @param locationID - The ID of the location
- * @param formData - FormData containing the file
- * @returns Promise with success status
+ * SECURITY: Validates checksum, TTL, PDF content, and rate limits by IP
  */
-export const uploadProofOfPayment = async (locationID: string, billID: string, formData: FormData): Promise<{ success: boolean; error?: string }> => {
+export const uploadProofOfPayment = async (
+  locationID: string,
+  billID: string,
+  checksum: string,
+  formData: FormData,
+  ipAddress?: string
+): Promise<{ success: boolean; error?: string }> => {
 
-    unstable_noStore();
+  unstable_noStore();
 
-    try {
-        // First validate that the file is acceptable
-        const file = formData.get('proofOfPayment') as File;
-
-        // validate max file size from env variable
-        const maxFileSizeKB = parseInt(process.env.MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB || '1024', 10);
-        const maxFileSizeBytes = maxFileSizeKB * 1024;
-        
-        if (file && file.size > maxFileSizeBytes) {
-            return { success: false, error: `File size exceeds the maximum limit of ${maxFileSizeKB} KB` };
-        }
-
-        // Validate file type
-        if (file && file.size > 0 && file.type !== 'application/pdf') {
-            return { success: false, error: 'Only PDF files are accepted' };
-        }
-
-        // update the bill in the mongodb
-        const dbClient = await getDbClient();
-
-        const projection = {
-            // attachment is not required in this context - this will reduce data transfer
-            "bills.attachment": 0,
-            // ommit file content - not needed here - this will reduce data transfer
-            "bills.proofOfPayment.fileContentsBase64": 0,
-        };
-
-        // Checking if proof of payment already exists
-
-        // find a location with the given locationID
-        const billLocation = await dbClient.collection<BillingLocation>("lokacije").findOne(
-            {
-                _id: locationID,
-            },
-            {
-                projection
-            })
-
-        if (!billLocation) {
-            console.log(`Location ${locationID} not found - Proof of payment upload failed`);
-            return { success: false, error: "Location not found - Proof of payment upload failed" };
-        }
-
-        // find a bill with the given billID
-        const bill = billLocation?.bills.find(({ _id }) => _id.toString() === billID);
-
-
-        if (bill?.proofOfPayment?.uploadedAt) {
-            return { success: false, error: 'Proof payment already uploaded for this bill' };
-        }
-
-        const attachment = await serializeAttachment(file);
-
-        if (!attachment) {
-            return { success: false, error: 'Invalid file' };
-        }
-
-        // Add proof of payment to the bill
-        await dbClient.collection<BillingLocation>("lokacije").updateOne(
-            {
-                _id: locationID // find a location with the given locationID
-            },
-            {
-                $set: {
-                    "bills.$[elem].proofOfPayment": {
-                        ...attachment
-                    }
-                }
-            }, {
-            arrayFilters: [
-                { "elem._id": { $eq: billID } } // find a bill with the given billID
-            ]
-        });
-
-        // Invalidate the location view cache
-        revalidatePath(`/share/location/${locationID}`, 'page');
-
-        return { success: true };
-    } catch (error: any) {
-        console.error('Error uploading proof of payment for a bill:', error);
-        return { success: false, error: error.message || 'Upload failed' };
+  try {
+    // 1. VALIDATE CHECKSUM (stateless, fast)
+    if (!validateShareChecksum(locationID, checksum)) {
+      return { success: false, error: 'Invalid share link' };
     }
+
+    // 2. RATE LIMITING (per IP)
+    if (ipAddress) {
+      const rateLimit = checkUploadRateLimit(ipAddress);
+      if (!rateLimit.allowed) {
+        return {
+          success: false,
+          error: `Too many uploads. Try again in ${Math.ceil(rateLimit.resetIn / 60)} minutes.`
+        };
+      }
+    }
+
+    // 3. DATABASE VALIDATION
+    const dbClient = await getDbClient();
+
+    const location = await dbClient.collection<BillingLocation>("lokacije").findOne(
+      { _id: locationID },
+      { projection: { userId: 1, bills: 1, shareTTL: 1 } }
+    );
+
+    if (!location || !location.userId) {
+      return { success: false, error: 'Invalid request' };
+    }
+
+    // Check sharing is active and not expired
+    if (!location.shareTTL || new Date() > location.shareTTL) {
+      return { success: false, error: 'This content is no longer shared' };
+    }
+
+    // Verify bill exists in location
+    const bill = location.bills.find(b => b._id === billID);
+    if (!bill) {
+      return { success: false, error: 'Invalid request' };
+    }
+
+    // Check if proof of payment already uploaded
+    if (bill.proofOfPayment?.uploadedAt) {
+      return { success: false, error: 'Proof of payment already uploaded for this bill' };
+    }
+
+    // 4. FILE VALIDATION
+    const file = formData.get('proofOfPayment') as File;
+
+    if (!file || file.size === 0) {
+      return { success: false, error: 'No file provided' };
+    }
+
+    // Validate PDF content (magic bytes, not just MIME type)
+    const pdfValidation = await validatePdfFile(file);
+    if (!pdfValidation.valid) {
+      return { success: false, error: pdfValidation.error };
+    }
+
+    // 5. SERIALIZE & STORE FILE
+    const attachment = await serializeAttachment(file);
+    if (!attachment) {
+      return { success: false, error: 'Failed to process file' };
+    }
+
+    // 6. UPDATE DATABASE
+    await dbClient.collection<BillingLocation>("lokacije").updateOne(
+      { _id: locationID },
+      {
+        $set: {
+          "bills.$[elem].proofOfPayment": attachment
+        }
+      },
+      {
+        arrayFilters: [{ "elem._id": { $eq: billID } }]
+      }
+    );
+
+    // 7. CLEANUP EXPIRED SHARES (integrated, no cron needed)
+    await cleanupExpiredShares(dbClient);
+
+    // 8. REVALIDATE CACHE
+    revalidatePath(`/share/location/${locationID}/${checksum}`, 'page');
+
+    return { success: true };
+
+  } catch (error: any) {
+    console.error('Upload error:', error);
+    return { success: false, error: 'Upload failed. Please try again.' };
+  }
+};
+
+/**
+ * Clean up expired shares during upload processing
+ * Removes shareTTL and shareFirstVisitedAt from expired locations
+ */
+async function cleanupExpiredShares(dbClient: any) {
+  const now = new Date();
+
+  await dbClient.collection("lokacije").updateMany(
+    { shareTTL: { $lt: now } },
+    { $unset: { shareTTL: "", shareFirstVisitedAt: "" } }
+  );
 }
\ No newline at end of file

From 844e386e18c9a86a82064a33dd27f918833769b1 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 00:22:59 +0100
Subject: [PATCH 04/11] refactor: use combined shareId (locationId + checksum)
 in URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Add generateShareId() and extractShareId() helpers
- Share URLs now use single parameter: /share/location/{shareId}
- shareId = locationId (24 chars) + checksum (16 chars) = 40 chars total
- Update validateShareAccess() to extract locationId from shareId
- Update uploadProofOfPayment() to accept combined shareId
- Update LocationViewPage to validate and extract locationId from shareId

Benefits:
- Simpler URL structure (one parameter instead of two)
- Checksum extraction by length (deterministic, no parsing needed)
- Same security properties (HMAC-SHA256 validation)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .../share/location/[id]/LocationViewPage.tsx  | 28 ++++++++++--
 app/[locale]/share/location/[id]/page.tsx     |  5 +--
 app/lib/actions/billActions.ts                | 21 ++++++---
 app/lib/actions/locationActions.ts            | 43 ++++++++++++-------
 app/lib/shareChecksum.ts                      | 36 +++++++++++++++-
 5 files changed, 104 insertions(+), 29 deletions(-)

diff --git a/app/[locale]/share/location/[id]/LocationViewPage.tsx b/app/[locale]/share/location/[id]/LocationViewPage.tsx
index aacae50..5fb5245 100644
--- a/app/[locale]/share/location/[id]/LocationViewPage.tsx
+++ b/app/[locale]/share/location/[id]/LocationViewPage.tsx
@@ -1,14 +1,28 @@
 import { ViewLocationCard } from '@/app/ui/ViewLocationCard';
-import { fetchLocationById, setSeenByTenantAt } from '@/app/lib/actions/locationActions';
+import { fetchLocationById, setSeenByTenantAt, validateShareAccess } from '@/app/lib/actions/locationActions';
 import { getUserSettingsByUserId } from '@/app/lib/actions/userSettingsActions';
 import { notFound } from 'next/navigation';
 import { myAuth } from '@/app/lib/auth';
 
-export default async function LocationViewPage({ locationId }: { locationId:string }) {
+export default async function LocationViewPage({ shareId }: { shareId: string }) {
+    // Validate share access (checks checksum + TTL, extracts locationId)
+    const accessValidation = await validateShareAccess(shareId);
+
+    if (!accessValidation.valid || !accessValidation.locationId) {
+        return (
+            <div className="alert alert-error">
+                <p>{accessValidation.error || 'This content is no longer shared'}</p>
+            </div>
+        );
+    }
+
+    const locationId = accessValidation.locationId;
+
+    // Fetch location
     const location = await fetchLocationById(locationId);
 
     if (!location) {
-        return(notFound());
+        return notFound();
     }
 
     // Fetch user settings for the location owner
@@ -23,5 +37,11 @@ export default async function LocationViewPage({ locationId }: { locationId:stri
          await setSeenByTenantAt(locationId);
     }
 
-    return (<ViewLocationCard location={location} userSettings={userSettings} />);
+    return (
+        <ViewLocationCard
+            location={location}
+            userSettings={userSettings}
+            shareId={shareId}
+        />
+    );
 }
\ No newline at end of file
diff --git a/app/[locale]/share/location/[id]/page.tsx b/app/[locale]/share/location/[id]/page.tsx
index bdbf265..7c3ef86 100644
--- a/app/[locale]/share/location/[id]/page.tsx
+++ b/app/[locale]/share/location/[id]/page.tsx
@@ -3,12 +3,11 @@ import LocationViewPage from './LocationViewPage';
 import { Main } from '@/app/ui/Main';
 import { LocationEditFormSkeleton } from '@/app/ui/LocationEditForm';
 
-export default async function Page({ params:{ id } }: { params: { id:string } }) {
-
+export default async function Page({ params: { id } }: { params: { id: string } }) {
     return (
         <Main>
             <Suspense fallback={<LocationEditFormSkeleton />}>
-                <LocationViewPage  locationId={id} />
+                <LocationViewPage shareId={id} />
             </Suspense>
         </Main>
     );
diff --git a/app/lib/actions/billActions.ts b/app/lib/actions/billActions.ts
index 4211425..922cdaa 100644
--- a/app/lib/actions/billActions.ts
+++ b/app/lib/actions/billActions.ts
@@ -10,7 +10,7 @@ import { gotoHomeWithMessage } from './navigationActions';
 import { getTranslations, getLocale } from "next-intl/server";
 import { IntlTemplateFn } from '@/app/i18n';
 import { unstable_noStore, revalidatePath } from 'next/cache';
-import { validateShareChecksum } from '../shareChecksum';
+import { extractShareId, validateShareChecksum } from '../shareChecksum';
 import { validatePdfFile } from '../validators/pdfValidator';
 import { checkUploadRateLimit } from '../uploadRateLimiter';
 
@@ -492,11 +492,15 @@ export const deleteBillById = withUser(async (user: AuthenticatedUser, locationI
 /**
  * Uploads proof of payment for the given bill
  * SECURITY: Validates checksum, TTL, PDF content, and rate limits by IP
+ *
+ * @param shareId - Combined location ID + checksum (40 chars)
+ * @param billID - The bill ID to attach proof of payment to
+ * @param formData - Form data containing the PDF file
+ * @param ipAddress - Optional IP address for rate limiting
  */
 export const uploadProofOfPayment = async (
-  locationID: string,
+  shareId: string,
   billID: string,
-  checksum: string,
   formData: FormData,
   ipAddress?: string
 ): Promise<{ success: boolean; error?: string }> => {
@@ -504,7 +508,14 @@ export const uploadProofOfPayment = async (
   unstable_noStore();
 
   try {
-    // 1. VALIDATE CHECKSUM (stateless, fast)
+    // 1. EXTRACT AND VALIDATE CHECKSUM (stateless, fast)
+    const extracted = extractShareId(shareId);
+    if (!extracted) {
+      return { success: false, error: 'Invalid share link' };
+    }
+
+    const { locationId: locationID, checksum } = extracted;
+
     if (!validateShareChecksum(locationID, checksum)) {
       return { success: false, error: 'Invalid share link' };
     }
@@ -584,7 +595,7 @@ export const uploadProofOfPayment = async (
     await cleanupExpiredShares(dbClient);
 
     // 8. REVALIDATE CACHE
-    revalidatePath(`/share/location/${locationID}/${checksum}`, 'page');
+    revalidatePath(`/share/location/${shareId}`, 'page');
 
     return { success: true };
 
diff --git a/app/lib/actions/locationActions.ts b/app/lib/actions/locationActions.ts
index 07d7a9e..cab09c8 100644
--- a/app/lib/actions/locationActions.ts
+++ b/app/lib/actions/locationActions.ts
@@ -10,7 +10,7 @@ import { gotoHomeWithMessage } from './navigationActions';
 import { unstable_noStore, revalidatePath } from 'next/cache';
 import { IntlTemplateFn } from '@/app/i18n';
 import { getTranslations, getLocale } from "next-intl/server";
-import { generateShareChecksum, validateShareChecksum } from '../shareChecksum';
+import { generateShareId, extractShareId, validateShareChecksum } from '../shareChecksum';
 
 export type State = {
     errors?: {
@@ -735,12 +735,12 @@ export const generateShareLink = withUser(
       }
     );
 
-    // Generate checksum
-    const checksum = generateShareChecksum(locationId);
+    // Generate combined share ID (locationId + checksum)
+    const shareId = generateShareId(locationId);
 
     // Build share URL
     const baseUrl = process.env.NEXTAUTH_URL || 'http://localhost:3000';
-    const shareUrl = `${baseUrl}/share/location/${locationId}/${checksum}`;
+    const shareUrl = `${baseUrl}/share/location/${shareId}`;
 
     return { shareUrl };
   }
@@ -751,21 +751,32 @@ export const generateShareLink = withUser(
  * Called when tenant visits share link
  *
  * SECURITY:
- * 1. Validates checksum (stateless, prevents enumeration)
- * 2. Checks TTL in database (time-based access control)
- * 3. Marks first visit and resets TTL to 1 hour
+ * 1. Extracts locationId and checksum from combined shareId
+ * 2. Validates checksum (stateless, prevents enumeration)
+ * 3. Checks TTL in database (time-based access control)
+ * 4. Marks first visit and resets TTL to 1 hour
+ *
+ * @param shareId - Combined ID (locationId + checksum, 40 chars)
+ * @returns Object with validation result and extracted locationId
  */
 export async function validateShareAccess(
-  locationId: string,
-  checksum: string
-): Promise<{ valid: boolean; error?: string }> {
+  shareId: string
+): Promise<{ valid: boolean; locationId?: string; error?: string }> {
 
-  // 1. Validate checksum FIRST (before DB query - stateless validation)
+  // 1. Extract locationId and checksum from combined ID
+  const extracted = extractShareId(shareId);
+  if (!extracted) {
+    return { valid: false, error: 'Invalid share link' };
+  }
+
+  const { locationId, checksum } = extracted;
+
+  // 2. Validate checksum FIRST (before DB query - stateless validation)
   if (!validateShareChecksum(locationId, checksum)) {
     return { valid: false, error: 'Invalid share link' };
   }
 
-  // 2. Check TTL in database
+  // 3. Check TTL in database
   const dbClient = await getDbClient();
   const location = await dbClient.collection<BillingLocation>("lokacije").findOne(
     { _id: locationId },
@@ -776,12 +787,12 @@ export async function validateShareAccess(
     return { valid: false, error: 'Invalid share link' };
   }
 
-  // 3. Check if sharing is enabled
+  // 4. Check if sharing is enabled
   if (!location.shareTTL) {
     return { valid: false, error: 'This content is no longer shared' };
   }
 
-  // 4. Check if TTL expired
+  // 5. Check if TTL expired
   const now = new Date();
   if (now > location.shareTTL) {
     // Clean up expired share
@@ -793,7 +804,7 @@ export async function validateShareAccess(
     return { valid: false, error: 'This content is no longer shared' };
   }
 
-  // 5. Mark first visit if applicable (resets TTL to 1 hour)
+  // 6. Mark first visit if applicable (resets TTL to 1 hour)
   if (!location.shareFirstVisitedAt) {
     const visitHours = parseInt(process.env.SHARE_TTL_AFTER_VISIT_HOURS || '1', 10);
     const newTTL = new Date(Date.now() + visitHours * 60 * 60 * 1000);
@@ -812,5 +823,5 @@ export async function validateShareAccess(
     );
   }
 
-  return { valid: true };
+  return { valid: true, locationId };
 }
\ No newline at end of file
diff --git a/app/lib/shareChecksum.ts b/app/lib/shareChecksum.ts
index 54c2eab..aef9874 100644
--- a/app/lib/shareChecksum.ts
+++ b/app/lib/shareChecksum.ts
@@ -1,5 +1,10 @@
 import crypto from 'crypto';
 
+/**
+ * Checksum length in hex characters (16 chars = 64 bits of entropy)
+ */
+export const CHECKSUM_LENGTH = 16;
+
 /**
  * Generate share link checksum for location
  * Uses HMAC-SHA256 for cryptographic integrity
@@ -17,7 +22,7 @@ export function generateShareChecksum(locationId: string): string {
     .createHmac('sha256', secret)
     .update(locationId)
     .digest('hex')
-    .substring(0, 16); // 64 bits of entropy (sufficient for share links)
+    .substring(0, CHECKSUM_LENGTH);
 }
 
 /**
@@ -50,3 +55,32 @@ export function validateShareChecksum(
     return false;
   }
 }
+
+/**
+ * Generate combined location ID with checksum appended
+ * @param locationId - The MongoDB location ID (24 chars)
+ * @returns Combined ID: locationId + checksum (40 chars total)
+ */
+export function generateShareId(locationId: string): string {
+  const checksum = generateShareChecksum(locationId);
+  return locationId + checksum;
+}
+
+/**
+ * Extract location ID and checksum from combined share ID
+ * @param shareId - Combined ID (locationId + checksum)
+ * @returns Object with locationId and checksum, or null if invalid format
+ */
+export function extractShareId(shareId: string): { locationId: string; checksum: string } | null {
+  // MongoDB ObjectID is 24 chars, checksum is 16 chars = 40 total
+  const expectedLength = 24 + CHECKSUM_LENGTH;
+
+  if (shareId.length !== expectedLength) {
+    return null;
+  }
+
+  const locationId = shareId.substring(0, 24);
+  const checksum = shareId.substring(24);
+
+  return { locationId, checksum };
+}

From 81dddb526a3cdf4a5c1f644b5a3491fb6ebb4d3f Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 00:25:26 +0100
Subject: [PATCH 05/11] feat: secure combined uploads and update UI components
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Secure uploadUtilBillsProofOfPayment with checksum validation
- Update ViewLocationCard to accept and use shareId prop
- Update ViewBillCard to accept shareId and use it for uploads
- Update ViewBillBadge to pass shareId to bill detail pages
- Add client-side validation check for shareId before upload
- Update back button links to use shareId

Security improvements:
- Both per-bill and combined uploads now validate checksum and TTL
- IP-based rate limiting applied to both upload types
- PDF magic bytes validation for both upload types

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/lib/actions/locationActions.ts | 97 +++++++++++++++++++++---------
 app/ui/ViewBillBadge.tsx           | 12 ++--
 app/ui/ViewBillCard.tsx            | 28 +++++----
 app/ui/ViewLocationCard.tsx        | 14 +++--
 4 files changed, 102 insertions(+), 49 deletions(-)

diff --git a/app/lib/actions/locationActions.ts b/app/lib/actions/locationActions.ts
index cab09c8..28125e5 100644
--- a/app/lib/actions/locationActions.ts
+++ b/app/lib/actions/locationActions.ts
@@ -11,6 +11,8 @@ import { unstable_noStore, revalidatePath } from 'next/cache';
 import { IntlTemplateFn } from '@/app/i18n';
 import { getTranslations, getLocale } from "next-intl/server";
 import { generateShareId, extractShareId, validateShareChecksum } from '../shareChecksum';
+import { validatePdfFile } from '../validators/pdfValidator';
+import { checkUploadRateLimit } from '../uploadRateLimiter';
 
 export type State = {
     errors?: {
@@ -638,66 +640,101 @@ const serializeAttachment = async (file: File | null):Promise<FileAttachment | n
 
 /**
  * Uploads a single proof of payment for all utility bills in a location
- * @param locationID - The ID of the location
- * @param formData - FormData containing the file
+ * SECURITY: Validates checksum, TTL, PDF content, and rate limits by IP
+ *
+ * @param shareId - Combined location ID + checksum (40 chars)
+ * @param formData - FormData containing the PDF file
+ * @param ipAddress - Optional IP address for rate limiting
  * @returns Promise with success status
  */
-export const uploadUtilBillsProofOfPayment = async (locationID: string, formData: FormData): Promise<{ success: boolean; error?: string }> => {
+export const uploadUtilBillsProofOfPayment = async (
+    shareId: string,
+    formData: FormData,
+    ipAddress?: string
+): Promise<{ success: boolean; error?: string }> => {
 
     unstable_noStore();
 
     try {
-
-        // First validate that the file is acceptable
-        const file = formData.get('utilBillsProofOfPayment') as File;
-
-        // validate max file size from env variable
-        const maxFileSizeKB = parseInt(process.env.MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB || '1024', 10);
-        const maxFileSizeBytes = maxFileSizeKB * 1024;
-        
-        if (file && file.size > maxFileSizeBytes) {
-            return { success: false, error: `File size exceeds the maximum limit of ${maxFileSizeKB} KB` };
+        // 1. EXTRACT AND VALIDATE CHECKSUM (stateless, fast)
+        const extracted = extractShareId(shareId);
+        if (!extracted) {
+            return { success: false, error: 'Invalid share link' };
         }
 
-        // Validate file type
-        if (file && file.size > 0 && file.type !== 'application/pdf') {
-            return { success: false, error: 'Only PDF files are accepted' };
+        const { locationId: locationID, checksum } = extracted;
+
+        if (!validateShareChecksum(locationID, checksum)) {
+            return { success: false, error: 'Invalid share link' };
         }
 
-        // check if attachment already exists for the location
+        // 2. RATE LIMITING (per IP)
+        if (ipAddress) {
+            const rateLimit = checkUploadRateLimit(ipAddress);
+            if (!rateLimit.allowed) {
+                return {
+                    success: false,
+                    error: `Too many uploads. Try again in ${Math.ceil(rateLimit.resetIn / 60)} minutes.`
+                };
+            }
+        }
+
+        // 3. DATABASE VALIDATION
         const dbClient = await getDbClient();
 
-        const existingLocation = await dbClient.collection<BillingLocation>("lokacije")
-            .findOne({ _id: locationID }, { projection: { utilBillsProofOfPayment: 1 } });
+        const location = await dbClient.collection<BillingLocation>("lokacije")
+            .findOne({ _id: locationID }, { projection: { userId: 1, utilBillsProofOfPayment: 1, shareTTL: 1 } });
 
-        if (existingLocation?.utilBillsProofOfPayment) {
-            return { success: false, error: 'An attachment already exists for this location' };
+        if (!location || !location.userId) {
+            return { success: false, error: 'Invalid request' };
         }
 
+        // Check sharing is active and not expired
+        if (!location.shareTTL || new Date() > location.shareTTL) {
+            return { success: false, error: 'This content is no longer shared' };
+        }
+
+        // Check if proof of payment already uploaded
+        if (location.utilBillsProofOfPayment) {
+            return { success: false, error: 'Proof of payment already uploaded for this location' };
+        }
+
+        // 4. FILE VALIDATION
+        const file = formData.get('utilBillsProofOfPayment') as File;
+
+        if (!file || file.size === 0) {
+            return { success: false, error: 'No file provided' };
+        }
+
+        // Validate PDF content (magic bytes, not just MIME type)
+        const pdfValidation = await validatePdfFile(file);
+        if (!pdfValidation.valid) {
+            return { success: false, error: pdfValidation.error };
+        }
+
+        // 5. SERIALIZE & STORE FILE
         const attachment = await serializeAttachment(file);
 
         if (!attachment) {
-            return { success: false, error: 'Invalid file' };
+            return { success: false, error: 'Failed to process file' };
         }
 
-        // Update the location with the attachment
+        // 6. UPDATE DATABASE
         await dbClient.collection<BillingLocation>("lokacije")
             .updateOne(
                 { _id: locationID },
                 { $set: {
-                    utilBillsProofOfPayment: {
-                        ...attachment
-                    },
+                    utilBillsProofOfPayment: attachment
                 } }
             );
 
-        // Invalidate the location view cache
-        revalidatePath(`/share/location/${locationID}`, 'page');
+        // 7. REVALIDATE CACHE
+        revalidatePath(`/share/location/${shareId}`, 'page');
 
         return { success: true };
     } catch (error: any) {
-        console.error('Error uploading util bills proof of payment:', error);
-        return { success: false, error: error.message || 'Upload failed' };
+        console.error('Upload error:', error);
+        return { success: false, error: 'Upload failed. Please try again.' };
     }
 }
 
diff --git a/app/ui/ViewBillBadge.tsx b/app/ui/ViewBillBadge.tsx
index 47a2c2c..15bb9c0 100644
--- a/app/ui/ViewBillBadge.tsx
+++ b/app/ui/ViewBillBadge.tsx
@@ -5,18 +5,22 @@ import { TicketIcon } from "@heroicons/react/24/outline";
 import { useLocale } from "next-intl";
 
 export interface ViewBillBadgeProps {
-    locationId: string,
-    bill: Bill
+    locationId: string;
+    shareId?: string;
+    bill: Bill;
 };
 
-export const ViewBillBadge: FC<ViewBillBadgeProps> = ({ locationId, bill: { _id: billId, name, paid, attachment, proofOfPayment } }) => {
+export const ViewBillBadge: FC<ViewBillBadgeProps> = ({ locationId, shareId, bill: { _id: billId, name, paid, attachment, proofOfPayment } }) => {
 
     const currentLocale = useLocale();
 
     const className = `badge badge-lg p-[1em] ${paid ? "badge-success" : " badge-outline"} ${!paid && !!attachment ? "btn-outline btn-success" : ""}  cursor-pointer`;
 
+    // Use shareId if available (for shared views), otherwise use locationId (for owner views)
+    const billPageId = shareId || locationId;
+
     return (
-        <Link href={`/${currentLocale}//share/bill/${locationId}-${billId}`} className={className}>
+        <Link href={`/${currentLocale}//share/bill/${billPageId}-${billId}`} className={className}>
             {name}
             {
                 proofOfPayment?.uploadedAt ? 
diff --git a/app/ui/ViewBillCard.tsx b/app/ui/ViewBillCard.tsx
index 7cddd1e..0fbc822 100644
--- a/app/ui/ViewBillCard.tsx
+++ b/app/ui/ViewBillCard.tsx
@@ -11,11 +11,12 @@ import { Pdf417Barcode } from "./Pdf417Barcode";
 import { uploadProofOfPayment } from "../lib/actions/billActions";
 
 export interface ViewBillCardProps {
-    location: BillingLocation,
-    bill: Bill,
+    location: BillingLocation;
+    bill: Bill;
+    shareId?: string;
 }
 
-export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill }) => {
+export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill, shareId }) => {
 
     const router = useRouter();
     const t = useTranslations("bill-edit-form");
@@ -31,23 +32,28 @@ export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill }) => {
         const handleFileChange = async (e: React.ChangeEvent<HTMLInputElement>) => {
             const file = e.target.files?.[0];
             if (!file) return;
-    
-            // Validate file type
+
+            // Validate file type client-side (quick feedback)
             if (file.type !== 'application/pdf') {
                 setUploadError('Only PDF files are accepted');
                 e.target.value = ''; // Reset input
                 return;
             }
-    
+
+            if (!shareId) {
+                setUploadError('Invalid upload link');
+                return;
+            }
+
             setIsUploading(true);
             setUploadError(null);
-    
+
             try {
                 const formData = new FormData();
                 formData.append('proofOfPayment', file);
-    
-                const result = await uploadProofOfPayment(locationID, billID as string, formData);
-    
+
+                const result = await uploadProofOfPayment(shareId, billID as string, formData);
+
                 if (result.success) {
                     setProofOfPaymentFilename(file.name);
                     setProofOfPaymentUploadedAt(new Date());
@@ -161,7 +167,7 @@ export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill }) => {
                 }
 
                 <div className="text-right">
-                    <Link className="btn btn-neutral ml-3" href={`/share/location/${locationID}`}>{t("back-button")}</Link>
+                    <Link className="btn btn-neutral ml-3" href={`/share/location/${shareId || locationID}`}>{t("back-button")}</Link>
                 </div>
 
             </div>
diff --git a/app/ui/ViewLocationCard.tsx b/app/ui/ViewLocationCard.tsx
index b3c1cb8..c005a4b 100644
--- a/app/ui/ViewLocationCard.tsx
+++ b/app/ui/ViewLocationCard.tsx
@@ -17,9 +17,10 @@ import QRCode from "react-qr-code";
 export interface ViewLocationCardProps {
     location: BillingLocation;
     userSettings: UserSettings | null;
+    shareId?: string;
 }
 
-export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSettings }) => {
+export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSettings, shareId }) => {
 
     const {
         _id,
@@ -47,13 +48,18 @@ export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSett
         const file = e.target.files?.[0];
         if (!file) return;
 
-        // Validate file type
+        // Validate file type client-side (quick feedback)
         if (file.type !== 'application/pdf') {
             setUploadError('Only PDF files are accepted');
             e.target.value = ''; // Reset input
             return;
         }
 
+        if (!shareId) {
+            setUploadError('Invalid upload link');
+            return;
+        }
+
         setIsUploading(true);
         setUploadError(null);
 
@@ -61,7 +67,7 @@ export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSett
             const formData = new FormData();
             formData.append('utilBillsProofOfPayment', file);
 
-            const result = await uploadUtilBillsProofOfPayment(_id, formData);
+            const result = await uploadUtilBillsProofOfPayment(shareId, formData);
 
             if (result.success) {
                 setAttachmentFilename(file.name);
@@ -121,7 +127,7 @@ export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSett
                 <h2 className="card-title mr-[2em] text-[1.3rem]">{formatYearMonth(yearMonth)} {locationName}</h2>
                 <div className="card-actions mt-[1em] mb-[1em]">
                     {
-                        bills.filter(bill => (bill.billedTo ?? BilledTo.Tenant) === BilledTo.Tenant).map(bill => <ViewBillBadge key={`${_id}-${bill._id}`} locationId={_id} bill={bill} />)
+                        bills.filter(bill => (bill.billedTo ?? BilledTo.Tenant) === BilledTo.Tenant).map(bill => <ViewBillBadge key={`${_id}-${bill._id}`} locationId={_id} shareId={shareId} bill={bill} />)
                     }
                 </div>
                 {

From 669fb08582df6ab18d29b57513eaefabb9edc506 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:00:06 +0100
Subject: [PATCH 06/11] fix: update bill detail page to support combined
 shareId
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Extract shareId (40 chars) and billID from combined URL parameter
- Validate shareId using validateShareAccess before fetching bill
- Pass shareId to ViewBillCard for secure uploads
- Show error message if share link is invalid or expired

URL format: /share/bill/{shareId}-{billID}
  where shareId = locationId (24) + checksum (16) = 40 chars

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/[locale]/share/bill/[id]/page.tsx | 29 +++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/app/[locale]/share/bill/[id]/page.tsx b/app/[locale]/share/bill/[id]/page.tsx
index 7576a78..6cce06a 100644
--- a/app/[locale]/share/bill/[id]/page.tsx
+++ b/app/[locale]/share/bill/[id]/page.tsx
@@ -2,19 +2,40 @@ import { fetchBillById } from '@/app/lib/actions/billActions';
 import { ViewBillCard } from '@/app/ui/ViewBillCard';
 import { Main } from '@/app/ui/Main';
 import { notFound } from 'next/navigation';
+import { validateShareAccess } from '@/app/lib/actions/locationActions';
 
-export default async function Page({ params:{ id } }: { params: { id:string } }) {
+export default async function Page({ params: { id } }: { params: { id: string } }) {
 
-    const [locationID, billID] = id.split('-');
+    // Split combined ID: shareId (40 chars) + '-' + billID (24 chars)
+    // ShareId = locationId (24) + checksum (16) = 40 chars
+    const shareId = id.substring(0, 40);
+    const billID = id.substring(41); // Skip the '-' separator
 
+    // Validate share access (checks checksum + TTL, extracts locationId)
+    const accessValidation = await validateShareAccess(shareId);
+
+    if (!accessValidation.valid || !accessValidation.locationId) {
+        return (
+            <Main>
+                <div className="alert alert-error">
+                    <p>{accessValidation.error || 'This content is no longer shared'}</p>
+                </div>
+            </Main>
+        );
+    }
+
+    const locationID = accessValidation.locationId;
+
+    // Fetch bill data
     const [location, bill] = await fetchBillById(locationID, billID) ?? [];
 
     if (!bill || !location) {
-        return(notFound());
+        return notFound();
     }
+
     return (
         <Main>
-            <ViewBillCard location={location} bill={bill} />
+            <ViewBillCard location={location} bill={bill} shareId={shareId} />
         </Main>
     );
 }
\ No newline at end of file

From f19e1bc023b3a358142cbdf5e4ff41822796ea4b Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:01:38 +0100
Subject: [PATCH 07/11] feat: secure proof-of-payment download routes with
 shareId validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Update download links in UI to use shareId instead of locationID
- Add shareId validation to per-bill proof download route
- Add shareId validation to combined proof download route
- Validate TTL before allowing downloads
- Extract locationId from shareId using extractShareId helper

Security:
- Download routes now validate checksum and TTL
- Prevents unauthorized access to proof-of-payment files
- Returns 404 for invalid/expired share links

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .../proof-of-payment/combined/[id]/route.tsx  | 26 ++++++++++++--
 .../proof-of-payment/per-bill/[id]/route.tsx  | 34 +++++++++++++++----
 app/ui/LocationCard.tsx                       | 15 +++++---
 app/ui/ViewBillCard.tsx                       |  2 +-
 app/ui/ViewLocationCard.tsx                   |  2 +-
 5 files changed, 63 insertions(+), 16 deletions(-)

diff --git a/app/[locale]/share/proof-of-payment/combined/[id]/route.tsx b/app/[locale]/share/proof-of-payment/combined/[id]/route.tsx
index 820566c..bfa232d 100644
--- a/app/[locale]/share/proof-of-payment/combined/[id]/route.tsx
+++ b/app/[locale]/share/proof-of-payment/combined/[id]/route.tsx
@@ -1,19 +1,39 @@
 import { getDbClient } from '@/app/lib/dbClient';
 import { BillingLocation } from '@/app/lib/db-types';
 import { notFound } from 'next/navigation';
+import { extractShareId, validateShareChecksum } from '@/app/lib/shareChecksum';
 
-export async function GET(request: Request, { params:{ id } }: { params: { id:string } }) {
-    const locationID = id;
+export async function GET(request: Request, { params: { id } }: { params: { id: string } }) {
+    const shareId = id;
+
+    // Validate shareId and extract locationId
+    const extracted = extractShareId(shareId);
+    if (!extracted) {
+        notFound();
+    }
+
+    const { locationId: locationID, checksum } = extracted;
+
+    // Validate checksum
+    if (!validateShareChecksum(locationID, checksum)) {
+        notFound();
+    }
 
     const dbClient = await getDbClient();
     const location = await dbClient.collection<BillingLocation>("lokacije")
         .findOne({ _id: locationID }, {
             projection: {
                 utilBillsProofOfPayment: 1,
+                shareTTL: 1,
             }
         });
 
-    if(!location?.utilBillsProofOfPayment) {
+    if (!location?.utilBillsProofOfPayment) {
+        notFound();
+    }
+
+    // Check if sharing is active and not expired
+    if (!location.shareTTL || new Date() > location.shareTTL) {
         notFound();
     }
 
diff --git a/app/[locale]/share/proof-of-payment/per-bill/[id]/route.tsx b/app/[locale]/share/proof-of-payment/per-bill/[id]/route.tsx
index df1c1b4..7b82301 100644
--- a/app/[locale]/share/proof-of-payment/per-bill/[id]/route.tsx
+++ b/app/[locale]/share/proof-of-payment/per-bill/[id]/route.tsx
@@ -1,12 +1,28 @@
 import { getDbClient } from '@/app/lib/dbClient';
 import { BillingLocation } from '@/app/lib/db-types';
 import { notFound } from 'next/navigation';
+import { extractShareId, validateShareChecksum } from '@/app/lib/shareChecksum';
 
-export async function GET(_request: Request, { params:{ id } }: { params: { id:string } }) {
-    // Parse locationID-billID format
-    const [locationID, billID] = id.split('-');
+export async function GET(_request: Request, { params: { id } }: { params: { id: string } }) {
+    // Parse shareId-billID format
+    // shareId = 40 chars (locationId 24 + checksum 16)
+    const shareId = id.substring(0, 40);
+    const billID = id.substring(41); // Skip the '-' separator
 
-    if (!locationID || !billID) {
+    if (!shareId || !billID) {
+        notFound();
+    }
+
+    // Validate shareId and extract locationId
+    const extracted = extractShareId(shareId);
+    if (!extracted) {
+        notFound();
+    }
+
+    const { locationId: locationID, checksum } = extracted;
+
+    // Validate checksum
+    if (!validateShareChecksum(locationID, checksum)) {
         notFound();
     }
 
@@ -14,13 +30,19 @@ export async function GET(_request: Request, { params:{ id } }: { params: { id:s
     const location = await dbClient.collection<BillingLocation>("lokacije")
         .findOne({ _id: locationID }, {
             projection: {
-                // Don't load bill attachments, only proof of payment
+                // Don't load bill attachments, only proof of payment and shareTTL
                 "bills._id": 1,
                 "bills.proofOfPayment": 1,
+                "shareTTL": 1,
             }
         });
 
-    if(!location) {
+    if (!location) {
+        notFound();
+    }
+
+    // Check if sharing is active and not expired
+    if (!location.shareTTL || new Date() > location.shareTTL) {
         notFound();
     }
 
diff --git a/app/ui/LocationCard.tsx b/app/ui/LocationCard.tsx
index 2a6c4a8..c2e88d9 100644
--- a/app/ui/LocationCard.tsx
+++ b/app/ui/LocationCard.tsx
@@ -10,6 +10,7 @@ import Link from "next/link";
 import { useLocale, useTranslations } from "next-intl";
 import { toast } from "react-toastify";
 import { get } from "http";
+import { generateShareLink } from "../lib/actions/locationActions";
 
 export interface LocationCardProps {
     location: BillingLocation;
@@ -33,13 +34,17 @@ export const LocationCard: FC<LocationCardProps> = ({ location, currency }) => {
     // sum all the paid bill amounts (regardless of who pays)
     const monthlyExpense = bills.reduce((acc, bill) => bill.paid ? acc + (bill.payedAmount ?? 0) : acc, 0);
 
-    const handleCopyLinkClick = () => {
+    const handleCopyLinkClick = async () => {
         // copy URL to clipboard
-        const url = `${window.location.origin}/${currentLocale}/share/location/${_id}`;
-        navigator.clipboard.writeText(url);
+        const shareLink = await generateShareLink(_id);
+
+        if(shareLink.error) {
+            toast.error(shareLink.error, { theme: "dark" });
+        } else {
+            navigator.clipboard.writeText(shareLink.shareUrl as string);
+            toast.success(t("link-copy-message"), { theme: "dark" });
+        }
 
-        // use NextJS toast to notiy user that the link was copied
-        toast.success(t("link-copy-message"), { theme: "dark" });
     }
 
     return (
diff --git a/app/ui/ViewBillCard.tsx b/app/ui/ViewBillCard.tsx
index 0fbc822..bcfe862 100644
--- a/app/ui/ViewBillCard.tsx
+++ b/app/ui/ViewBillCard.tsx
@@ -130,7 +130,7 @@ export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill, shareId })
                                 proofOfPaymentFilename ? (
                                     <div className="mt-3 ml-[-.5rem]">
                                         <Link
-                                            href={`/share/proof-of-payment/per-bill/${locationID}-${billID}/`}
+                                            href={`/share/proof-of-payment/per-bill/${shareId || locationID}-${billID}/`}
                                             target="_blank"
                                             className='text-center w-full max-w-[20rem] text-nowrap truncate inline-block'
                                         >
diff --git a/app/ui/ViewLocationCard.tsx b/app/ui/ViewLocationCard.tsx
index c005a4b..6d1db4c 100644
--- a/app/ui/ViewLocationCard.tsx
+++ b/app/ui/ViewLocationCard.tsx
@@ -195,7 +195,7 @@ export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSett
                                 attachmentFilename ? (
                                     <div className="mt-3 ml-[-.5rem]">
                                         <Link
-                                            href={`/share/proof-of-payment/combined/${_id}/`}
+                                            href={`/share/proof-of-payment/combined/${shareId || _id}/`}
                                             target="_blank"
                                             className='text-center w-full max-w-[20rem] text-nowrap truncate inline-block'
                                         >

From bc336a9744705d59f8e91d1e24a5679babf14fdb Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:02:20 +0100
Subject: [PATCH 08/11] feat: secure attachment download route with shareId
 validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Update attachment download link in UI to use shareId
- Add shareId validation to attachment download route
- Validate TTL before allowing attachment downloads
- Extract locationId from shareId using extractShareId helper

Security:
- Attachment downloads now validate checksum and TTL
- Prevents unauthorized access to bill attachment files
- Returns 404 for invalid/expired share links

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/[locale]/share/attachment/[id]/route.tsx | 45 ++++++++++++++++++--
 app/ui/ViewBillCard.tsx                      |  2 +-
 2 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/app/[locale]/share/attachment/[id]/route.tsx b/app/[locale]/share/attachment/[id]/route.tsx
index b8099f8..a2e711c 100644
--- a/app/[locale]/share/attachment/[id]/route.tsx
+++ b/app/[locale]/share/attachment/[id]/route.tsx
@@ -1,12 +1,49 @@
 import { fetchBillById } from '@/app/lib/actions/billActions';
 import { notFound } from 'next/navigation';
+import { extractShareId, validateShareChecksum } from '@/app/lib/shareChecksum';
+import { getDbClient } from '@/app/lib/dbClient';
+import { BillingLocation } from '@/app/lib/db-types';
 
-export async function GET(request: Request, { params:{ id } }: { params: { id:string } }) {
-    const [locationID, billID] = id.split('-');
+export async function GET(request: Request, { params: { id } }: { params: { id: string } }) {
+    // Parse shareId-billID format
+    // shareId = 40 chars (locationId 24 + checksum 16)
+    const shareId = id.substring(0, 40);
+    const billID = id.substring(41); // Skip the '-' separator
 
-    const [location, bill] = await fetchBillById(locationID, billID, true) ?? [];
+    if (!shareId || !billID) {
+        notFound();
+    }
 
-    if(!bill?.attachment) {
+    // Validate shareId and extract locationId
+    const extracted = extractShareId(shareId);
+    if (!extracted) {
+        notFound();
+    }
+
+    const { locationId: locationID, checksum } = extracted;
+
+    // Validate checksum
+    if (!validateShareChecksum(locationID, checksum)) {
+        notFound();
+    }
+
+    // Check TTL before fetching bill
+    const dbClient = await getDbClient();
+    const location = await dbClient.collection<BillingLocation>("lokacije")
+        .findOne({ _id: locationID }, { projection: { shareTTL: 1 } });
+
+    if (!location) {
+        notFound();
+    }
+
+    // Check if sharing is active and not expired
+    if (!location.shareTTL || new Date() > location.shareTTL) {
+        notFound();
+    }
+
+    const [_, bill] = await fetchBillById(locationID, billID, true) ?? [];
+
+    if (!bill?.attachment) {
         notFound();
     }
 
diff --git a/app/ui/ViewBillCard.tsx b/app/ui/ViewBillCard.tsx
index bcfe862..cdaeab6 100644
--- a/app/ui/ViewBillCard.tsx
+++ b/app/ui/ViewBillCard.tsx
@@ -100,7 +100,7 @@ export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill, shareId })
                     attachment ?
                         <span className="textarea textarea-bordered max-w-[400px] w-full grow">
                             <p className="font-bold uppercase">{t("attachment")}</p>
-                            <Link href={`/share/attachment/${locationID}-${billID}/`} target="_blank" className='text-center w-full max-w-[20em] text-nowrap truncate inline-block mt-2'>
+                            <Link href={`/share/attachment/${shareId || locationID}-${billID}/`} target="_blank" className='text-center w-full max-w-[20em] text-nowrap truncate inline-block mt-2'>
                                 <DocumentIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1" />
                                 {decodeURIComponent(attachment.fileName)}
                             </Link>

From e978a5c2bf88ebeab4b000bf58e671fd54a21d5c Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:17:03 +0100
Subject: [PATCH 09/11] feat: add debug logging and improve proof-of-payment
 icon styling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Add console.log statements for shareId validation failures in locationActions
- Replace DocumentIcon with TicketIcon for proof-of-payment downloads (consistency)
- Add teal color to all proof-of-payment icons for visual distinction
- Adjust vertical alignment of icons for better visual alignment with text

Debug logging helps troubleshoot:
- shareId extraction failures
- Checksum validation failures
- Location not found errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/lib/actions/locationActions.ts | 5 +++++
 app/ui/BillEditForm.tsx            | 2 +-
 app/ui/ViewBillCard.tsx            | 2 +-
 app/ui/ViewLocationCard.tsx        | 5 +++--
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/lib/actions/locationActions.ts b/app/lib/actions/locationActions.ts
index 28125e5..489b787 100644
--- a/app/lib/actions/locationActions.ts
+++ b/app/lib/actions/locationActions.ts
@@ -659,12 +659,14 @@ export const uploadUtilBillsProofOfPayment = async (
         // 1. EXTRACT AND VALIDATE CHECKSUM (stateless, fast)
         const extracted = extractShareId(shareId);
         if (!extracted) {
+            console.log('shareID extraction failed');
             return { success: false, error: 'Invalid share link' };
         }
 
         const { locationId: locationID, checksum } = extracted;
 
         if (!validateShareChecksum(locationID, checksum)) {
+            console.log('shareID checksum validation failed');
             return { success: false, error: 'Invalid share link' };
         }
 
@@ -803,6 +805,7 @@ export async function validateShareAccess(
   // 1. Extract locationId and checksum from combined ID
   const extracted = extractShareId(shareId);
   if (!extracted) {
+    console.log('shareID extraction failed');
     return { valid: false, error: 'Invalid share link' };
   }
 
@@ -810,6 +813,7 @@ export async function validateShareAccess(
 
   // 2. Validate checksum FIRST (before DB query - stateless validation)
   if (!validateShareChecksum(locationId, checksum)) {
+    console.log('shareID checksum validation failed');
     return { valid: false, error: 'Invalid share link' };
   }
 
@@ -821,6 +825,7 @@ export async function validateShareAccess(
   );
 
   if (!location) {
+    console.log('Location not found for shareID');
     return { valid: false, error: 'Invalid share link' };
   }
 
diff --git a/app/ui/BillEditForm.tsx b/app/ui/BillEditForm.tsx
index ab68d3e..3ef6355 100644
--- a/app/ui/BillEditForm.tsx
+++ b/app/ui/BillEditForm.tsx
@@ -253,7 +253,7 @@ export const BillEditForm: FC<BillEditFormProps> = ({ location, bill }) => {
                                                 target="_blank"
                                                 className='text-center w-full max-w-[20rem] text-nowrap truncate inline-block'
                                             >
-                                                <TicketIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1 text-teal-500" />
+                                                <TicketIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1 mt-[-.2em] text-teal-500" />
                                                 {decodeURIComponent(proofOfPayment.fileName)}
                                             </Link>
                                         </div>
diff --git a/app/ui/ViewBillCard.tsx b/app/ui/ViewBillCard.tsx
index cdaeab6..8a6e1ef 100644
--- a/app/ui/ViewBillCard.tsx
+++ b/app/ui/ViewBillCard.tsx
@@ -134,7 +134,7 @@ export const ViewBillCard: FC<ViewBillCardProps> = ({ location, bill, shareId })
                                             target="_blank"
                                             className='text-center w-full max-w-[20rem] text-nowrap truncate inline-block'
                                         >
-                                            <TicketIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1" />
+                                            <TicketIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1 mt-[-.1em] text-teal-500" />
                                             { decodeURIComponent(proofOfPaymentFilename) }
                                         </Link>
                                     </div>
diff --git a/app/ui/ViewLocationCard.tsx b/app/ui/ViewLocationCard.tsx
index 6d1db4c..d7ed6cc 100644
--- a/app/ui/ViewLocationCard.tsx
+++ b/app/ui/ViewLocationCard.tsx
@@ -10,9 +10,10 @@ import { ViewBillBadge } from "./ViewBillBadge";
 import { Pdf417Barcode } from "./Pdf417Barcode";
 import { EncodePayment, PaymentParams } from "hub-3a-payment-encoder";
 import Link from "next/link";
-import { DocumentIcon, LinkIcon } from "@heroicons/react/24/outline";
+import { LinkIcon } from "@heroicons/react/24/outline";
 import { uploadUtilBillsProofOfPayment } from "../lib/actions/locationActions";
 import QRCode from "react-qr-code";
+import { TicketIcon } from "@heroicons/react/24/solid";
 
 export interface ViewLocationCardProps {
     location: BillingLocation;
@@ -199,7 +200,7 @@ export const ViewLocationCard: FC<ViewLocationCardProps> = ({ location, userSett
                                             target="_blank"
                                             className='text-center w-full max-w-[20rem] text-nowrap truncate inline-block'
                                         >
-                                            <DocumentIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1" />
+                                            <TicketIcon className="h-[1em] w-[1em] text-2xl inline-block mr-1 mt-[-.1em] text-teal-500" />
                                             {decodeURIComponent(attachmentFilename)}
                                         </Link>
                                     </div>

From 479df6e0a7888c75b90e67ed0b67d3870cfbe108 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:18:43 +0100
Subject: [PATCH 10/11] feat: add additional Bash commands to settings for
 enhanced functionality

---
 .claude/settings.local.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 67777e7..afef7dc 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -13,7 +13,10 @@
       "mcp__ide__getDiagnostics",
       "mcp__serena__execute_shell_command",
       "mcp__serena__check_onboarding_performed",
-      "Bash(npm run build:*)"
+      "Bash(npm run build:*)",
+      "Bash(openssl rand:*)",
+      "Bash(ls:*)",
+      "Bash(find:*)"
     ]
   },
   "enableAllProjectMcpServers": true,

From 927349e1d2a8e637ababf0dd7306196ce89a0b28 Mon Sep 17 00:00:00 2001
From: Knee Cola <kneecola@duck.com>
Date: Mon, 8 Dec 2025 01:20:55 +0100
Subject: [PATCH 11/11] feat: add share link security environment variables to
 Docker configs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Add SHARE_LINK_SECRET (production secret, 64-char hex)
- Add SHARE_TTL_INITIAL_DAYS=10 (days before first tenant visit)
- Add SHARE_TTL_AFTER_VISIT_HOURS=1 (hours after tenant visits)
- Add UPLOAD_RATE_LIMIT_PER_IP=5 (max uploads per IP)
- Add UPLOAD_RATE_LIMIT_WINDOW_MS=3600000 (1 hour rate limit window)

Updated both:
- docker-compose-standalone.yaml
- docker-compose-swarm.yml

Production SHARE_LINK_SECRET generated with: openssl rand -hex 32

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 docker-compose-standalone.yaml | 7 +++++++
 docker-compose-swarm.yml       | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/docker-compose-standalone.yaml b/docker-compose-standalone.yaml
index 3af0c4b..55bfd31 100644
--- a/docker-compose-standalone.yaml
+++ b/docker-compose-standalone.yaml
@@ -29,6 +29,13 @@ services:
       HOSTNAME: rezije.app # IP address at which the server will be listening (0.0.0.0 = listen on all addresses)
       NEXTAUTH_URL: https://rezije.app # URL next-auth will use while redirecting user during authentication (if not set - will use HOSTNAME)
       PORT: ${PORT:-80}
+      # Share link security
+      SHARE_LINK_SECRET: ef68362357315d5decb27d24ff9abdb4a02a3351cd2899f79bf238dce0fe08c5
+      SHARE_TTL_INITIAL_DAYS: 10
+      SHARE_TTL_AFTER_VISIT_HOURS: 1
+      # Upload rate limiting
+      UPLOAD_RATE_LIMIT_PER_IP: 5
+      UPLOAD_RATE_LIMIT_WINDOW_MS: 3600000
     container_name: evidencija-rezija__web-app
     restart: unless-stopped  # u slučaju rušenja containera pokušavaj ga pokrenuti dok ne uspije = BESKONAČNO
     depends_on:
diff --git a/docker-compose-swarm.yml b/docker-compose-swarm.yml
index 87decb0..bd6d34f 100644
--- a/docker-compose-swarm.yml
+++ b/docker-compose-swarm.yml
@@ -29,6 +29,13 @@ services:
       HOSTNAME: rezije.app # IP address at which the server will be listening (0.0.0.0 = listen on all addresses)
       NEXTAUTH_URL: https://rezije.app # URL next-auth will use while redirecting user during authentication (if not set - will use HOSTNAME)
       PORT: ${PORT:-80}
+      # Share link security
+      SHARE_LINK_SECRET: ef68362357315d5decb27d24ff9abdb4a02a3351cd2899f79bf238dce0fe08c5
+      SHARE_TTL_INITIAL_DAYS: 10
+      SHARE_TTL_AFTER_VISIT_HOURS: 1
+      # Upload rate limiting
+      UPLOAD_RATE_LIMIT_PER_IP: 5
+      UPLOAD_RATE_LIMIT_WINDOW_MS: 3600000
     deploy:
       # u slucaju rušenja kontejnera čekamo 5s i dižemo novi kontejner => ako se i on sruši opet ceka 5s i pokusava ponovno (tako 5 puta)
       restart_policy: