feat: public shopping list links can allow editing

Owner opts in per-list via a new "Allow editing" toggle next to the
existing public-link switch. Anonymous writes are scoped to that one
list only — the link id is the sole credential, enforced in
getShoppingListAccess and the item routes (no session required there
now), with an IP rate limit on genuinely anonymous requests. Turning
off the public link also revokes editing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

Arnaud

2026-07-13 12:53:52 +02:00

parent b1f4bba6dd

commit 2beb23b360

21 changed files with 5174 additions and 76 deletions

									
										apps/web/package.json
									
		+1
		-1
	
												View File
												
				@@ -1,6 +1,6 @@

				{

				  "name": "@epicure/web",

				  "version": "0.11.0",

				  "version": "0.12.0",

				  "private": true,

				  "scripts": {

				    "dev": "next dev",