big update in share links

src/api/access_tokens.rs

@@ -96,25 +96,6 @@ pub async fn create_resource_access_token(
     Ok(response)
 }
 
-pub async fn verify_resource_access_token(
-    state: &SharedState,
-    kind: &str,
-    slug: &str,
-    token: Option<&str>,
-) -> Result<bool, ApiError> {
-    let Some(token) = token.map(str::trim).filter(|value| !value.is_empty()) else {
-        return Ok(false);
-    };
-    if crate::auth::share_access_permission(state, kind, slug, Some(token))
-        .await
-        .map_err(|error| ApiError::forbidden(&error.message))?
-        .is_some()
-    {
-        return Ok(true);
-    }
-    verify_password_access_token(state, kind, slug, Some(token)).await
-}
-
 pub(crate) async fn verify_password_access_token(
     state: &SharedState,
     kind: &str,
@@ -134,7 +115,22 @@ pub(crate) async fn verify_password_access_token(
     .bind(Utc::now().to_rfc3339())
     .fetch_one(state.db.pool())
     .await?;
-    Ok(count > 0)
+    if count == 0 {
+        return Ok(false);
+    }
+
+    // Password-derived access must stop working when the resource no longer
+    // has a password. This also invalidates tokens created by older versions
+    // for private resources that never had a password configured.
+    match kind {
+        "workspace" => Ok(db::find_workspace(&state.db, slug)
+            .await?
+            .is_some_and(|workspace| workspace.password_hash.is_some())),
+        "pad" => Ok(db::find_pad(&state.db, slug)
+            .await?
+            .is_some_and(|pad| pad.password_hash.is_some())),
+        _ => Ok(false),
+    }
 }
 
 pub(super) fn hash_access_token(token: &str) -> String {