app.share_links
TableRow level security on
Links that open one version of a file without an account (Section 8.6): Public files may have a link without an expiry, Internal links need an expiry, Confidential links need an expiry, an access code and the recipient's email, and Restricted files never get one. The token and the code are returned once and stored only as hashes. Created through app.create_share_link, opened through api_public.open_share_link, revoked through app.revoke_share_link.
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Primary key, UUID v7. |
| org_id | uuid | No | Owning org, derived from app.attachments on insert; never accepted from the caller and never changed.References app.organizations.id |
| attachment_id | uuid | No | File the link shares.References app.attachments.id |
| attachment_version_id | uuid | Yes | Clean version the link opens, set by the database from the file's current version when the link is created.References app.attachment_versions.id |
| classification | app.data_classification | No | Classification of the file when the link was created, set by the database. An open is refused once the file is raised to Restricted, or to Confidential when the link has no code. |
| token_hash | bytea | No | SHA-256 of the link token, set by the database. The token is shown once and never stored. |
| access_code_required | boolean | No | True when the link asks for a 6-digit access code. Always true for a Confidential file. |
| access_code_hash | bytea | Yes | SHA-256 of the token, a colon and the access code, set by the database. Never readable by signed-in callers. |
| recipient_email | text | Yes | Who the link was made for, lowercased. Required for a Confidential file: the watermark names this address. |
| note | text | Yes | What the link is for, as its creator described it. |
| expires_at | timestamp with time zone | Yes | When the link stops opening: at most 90 days ahead, 30 for a Confidential file. NULL only for a Public file. |
| failed_attempts | smallint | No | Wrong access codes entered; the link locks at 5. |
| open_count | integer | No | How many times the link was opened successfully. |
| last_opened_at | timestamp with time zone | Yes | When the link was last opened successfully. |
| revoked_at | timestamp with time zone | Yes | When the link was revoked; a revoked link never opens again. |
| revoked_by | uuid | Yes | Person who revoked the link.References app.people.id |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |