feat(share): keep shares in dfo-apis and proxy cards and shares

.env.example

@@ -22,15 +22,6 @@ NEXT_PUBLIC_SEARCH_API_BASE=
 STUDIO_API_BASE=
 STUDIO_TOKEN=
 
-# Live Studio shares. LIVE_REFRESH_PRINCIPAL is the credential dfo-apis and
-# dfo-ai ask of a card refresh. It has the same value on all three services
-# and, when deployed, is mounted from Secret Manager by dfo-infra. Empty
-# means the Share dialog offers no Live Data and every Studio share is a
-# snapshot. LIVE_SHARE_WINDOW_S is how long a refreshed card's answer stands
-# before the next viewer asks again (default 300, at most 900).
-LIVE_REFRESH_PRINCIPAL=
-# LIVE_SHARE_WINDOW_S=300
-
 # Accounts and saved conversations (Postgres). Local development only --
 # run `just db-up && just db-migrate` first, then this connects as the
 # `website_runtime` role db/migrate-local.ts creates. Deployed services
@@ -121,10 +112,17 @@ SENTRY_AUTH_TOKEN=
 # attached by the proxy so outside MCP clients don't need it. Unset: the
 # caller's own Authorization header is passed through.
 MCP_API_TOKEN=
-# /mcp names each caller to dfo-ai as x-dfo-caller: ip:<digest>, an
-# HMAC-SHA-256 of the client IP keyed by this secret (e.g. openssl rand -hex
-# 32). If unset, no caller is sent and the site logs one warning.
+# /mcp names each caller to dfo-ai, and the dfo-apis proxy to dfo-apis, as
+# x-dfo-caller: ip:<digest>, an HMAC-SHA-256 of the client address (an IPv6
+# address as its /64) keyed by this secret (e.g. openssl rand -hex 32). It
+# must equal dfo-apis's DFO_CALLER_HMAC_KEY. If unset, no caller is sent and
+# the site logs one warning.
 CALLER_HMAC_KEY=
+# The secret dfo-apis checks before it trusts x-dfo-caller (its
+# DFO_CALLER_PRINCIPAL), sent as x-dfo-caller-principal on every dfo-apis
+# call. If unset, the site sends dfo-apis neither header and logs one warning,
+# and dfo-apis counts the whole site as one caller.
+DFO_CALLER_PRINCIPAL=
 # Which X-Forwarded-For entry is the client, counted from the right. 0 (the
 # default) is the rightmost, the one Cloud Run's front end appends; add one
 # for each load balancer in front of the service.

db/auth-schema.ts

@@ -12,6 +12,9 @@ export const user = pgTable('user', {
         .defaultNow()
         .$onUpdate(() => /* @__PURE__ */ new Date())
         .notNull(),
+    // Set when the account's deletion begins (`user.additionalFields` in
+    // src/lib/auth/auth.ts), so no share token is stored for it after.
+    deletingAt: timestamp('deleting_at', { withTimezone: true }),
 });
 
 export const session = pgTable(

db/migrations/0022_share_token.sql

@@ -0,0 +1,8 @@
+CREATE TABLE "share_token" (
+	"share_id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"write_token" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "share_token" ADD CONSTRAINT "share_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;

db/migrations/0023_share_cleanup_and_deleting_at.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "share_cleanup" (
+	"share_id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"write_token" text NOT NULL,
+	"reason" text NOT NULL,
+	"recorded_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "deleting_at" timestamp with time zone;