big update in share links

tests/share_session_sql_test.py

@@ -60,6 +60,7 @@ def main() -> None:
     migrations = sorted(MIGRATIONS.glob("*.sql"))
     before_sessions = [path for path in migrations if path.name < "0026_share_link_sessions.sql"]
     session_migration = MIGRATIONS / "0026_share_link_sessions.sql"
+    label_migration = MIGRATIONS / "0027_share_link_labels.sql"
 
     db = sqlite3.connect(":memory:")
     db.execute("PRAGMA foreign_keys = ON")
@@ -74,14 +75,15 @@ def main() -> None:
     share_hash = hashlib.sha256(raw_link.encode()).hexdigest()
     db.execute(
         "INSERT INTO resource_share_links "
-        "(token_hash, token, resource_kind, resource_slug, permission, expires_at, created_by) "
-        "VALUES (?, ?, 'workspace', 'private-space', 'ro', NULL, 1)",
-        (share_hash, raw_link),
+        "(token_hash, resource_kind, resource_slug, permission, expires_at, created_by) "
+        "VALUES (?, 'workspace', 'private-space', 'ro', NULL, 1)",
+        (share_hash,),
     )
     db.executescript(session_migration.read_text())
-    assert db.execute(
-        "SELECT token FROM resource_share_links WHERE token_hash = ?", (share_hash,)
-    ).fetchone() == (None,), "migration must erase persisted plaintext share tokens"
+    db.executescript(label_migration.read_text())
+    columns = {row[1] for row in db.execute("PRAGMA table_info(resource_share_links)")}
+    assert "token" not in columns, "fresh schema must not contain a plaintext token column"
+    assert "label" in columns, "share links must support labels"
 
     source_sql = query("SHARE_LINK_SESSION_SOURCE")
     insert_sql = query("SHARE_SESSION_INSERT")
@@ -162,23 +164,24 @@ def main() -> None:
     ).rowcount
     assert deleted == 1, "revoking a link must remove all derived sessions"
 
-    # Newly created links persist only the hash; the plaintext column stays NULL.
+    # Newly created links persist only the hash and an optional identifying label.
     second_raw = "one-time-returned-token"
     second_hash = hashlib.sha256(second_raw.encode()).hexdigest()
     db.execute(
         link_insert_sql,
-        (second_hash, "workspace", "second-space", "rw", None, 1),
+        (second_hash, "QA link", "workspace", "second-space", "rw", None, 1),
     )
     assert db.execute(
-        "SELECT token, permission FROM resource_share_links WHERE token_hash = ?", (second_hash,)
-    ).fetchone() == (None, "rw")
+        "SELECT label, permission FROM resource_share_links WHERE token_hash = ?", (second_hash,)
+    ).fetchone() == ("QA link", "rw")
     listed_link = db.execute(sharing_list_sql, ("workspace", "second-space")).fetchone()
     assert listed_link == (
         second_hash,
+        "QA link",
         "rw",
         None,
-        listed_link[3],
-    ), "management listing must never return the plaintext share token"
+        listed_link[4],
+    ), "management listing must return the label but never a plaintext share token"
 
     db.execute(
         insert_sql,