Access and sharing

A fresh deploy is readable by its owner and nobody else. There are three states, and you move between them on purpose.

| State | Who can read it | | --- | --- | | Private, nobody named | The owner. | | Private, shared with addresses | The owner, and those addresses. | | Public | Anyone holding the URL, without signing in. |

Why enforcement is split

Neither half of the system can do this alone.

The platform is the only thing that can decide: the session cookie is on its origin and it can evaluate a share list against a person. It holds none of the artifact bytes.

The worker is the only thing that can serve: it has the storage binding and no database credential at all. It cannot ask who you are.

So the platform decides once and signs the decision, and the worker verifies that signature on every subsequent request. The signed decision is called a grant.

The gate

Ask for a private artifact without a grant and the worker redirects you to the platform. If you have no session you are sent to sign in; if you have one but no access you are shown who to ask; if you have access, a grant is minted and you are redirected back to the exact path you asked for — query string and all, because a visitor who followed a deep link and landed on the front page has no idea what they lost.

The hour

Grants are bound to one artifact and last one hour. Un-sharing therefore takes up to an hour to take effect for somebody already holding one.

That is a deliberate price, not an oversight: the alternative is a database round trip on every image, script and stylesheet an artifact requests. It is stated here rather than buried because it is the kind of thing you need to know before you rely on revocation being instant.

Sharing by email

Naming somebody sends them a message saying an artifact was shared with them and where it is. Before that existed, being granted access was completely silent — the grant was real and nobody knew.