improvements

src/auth/mod.rs

@@ -1299,6 +1299,8 @@ pub async fn update_resource(
     Json(req): Json<ResourceActionRequest>,
 ) -> Result<Json<serde_json::Value>, AuthError> {
     let user = require_user(&state, &headers).await?;
+    let kind = req.kind.trim();
+    let slug = req.slug.trim();
     let hash = match req
         .password
         .as_deref()
@@ -1311,15 +1313,16 @@ pub async fn update_resource(
         }
         None => None,
     };
-    ensure_owner(&state, user.id, &req.kind, &req.slug).await?;
-    let query = match req.kind.as_str() {
+    let password_enabled = hash.is_some();
+    ensure_owner(&state, user.id, kind, slug).await?;
+    let query = match kind {
         "workspace" => queries::USER_SET_WORKSPACE_PASSWORD,
         "pad" => queries::USER_SET_PAD_PASSWORD,
         _ => return Err(AuthError::bad_request("Unknown resource type.")),
     };
     sqlx::query(queries::get(state.db.kind(), query))
         .bind(hash)
-        .bind(req.slug.trim())
+        .bind(slug)
         .execute(state.db.pool())
         .await
         .map_err(AuthError::database)?;
@@ -1327,12 +1330,21 @@ pub async fn update_resource(
         state.db.kind(),
         queries::RESOURCE_ACCESS_TOKENS_DELETE_BY_RESOURCE,
     ))
-    .bind(req.kind.as_str())
-    .bind(req.slug.trim())
+    .bind(kind)
+    .bind(slug)
     .execute(state.db.pool())
     .await
     .map_err(AuthError::database)?;
-    Ok(Json(serde_json::json!({"ok":true})))
+    if password_enabled {
+        match kind {
+            "workspace" => state.notify_workspace_password_required(slug, None).await,
+            "pad" => state.notify_pad_password_required(slug, None).await,
+            _ => {}
+        }
+    }
+    Ok(Json(
+        serde_json::json!({"ok":true,"protected":password_enabled}),
+    ))
 }
 
 pub async fn delete_resource(
@@ -1826,7 +1838,9 @@ pub async fn create_share_link(
     .into_response();
     response.headers_mut().insert(
         header::CACHE_CONTROL,
-        "no-store, max-age=0".parse().expect("valid cache-control"),
+        "no-cache, no-store, max-age=0"
+            .parse()
+            .expect("valid cache-control"),
     );
     response
         .headers_mut()