Shareable read-only report page, for showing a client results #43

What to build

A read-only, shareable page showing one rule's performance — sends, clicks, CTR, top keywords, a 7-day chart — reachable by an unguessable URL, with no login.

Why

Anyone running this for a client needs to show results without handing over admin access. Today the only options are a screenshot or giving away the admin URL, which is also the panel's first authentication factor.

Design

• report_slug TEXT UNIQUE and report_enabled INTEGER NOT NULL DEFAULT 0 on rules
• Public route GET /reports/:slug, outside the admin auth middleware
• Off by default. Enabling it is an explicit, per-rule action.

Security, which is the whole difficulty here

This is a deliberate hole in an otherwise closed application. Get these right:

• Never expose the admin URL, account tokens, or the ADMIN_URL_SECRET on the page or in any link on it.
• Consider whether commenter usernames belong there at all. They probably do not — aggregate counts tell the story without publishing your audience's handles to anyone with the link.
• Slugs must be unguessable (≥128 bits), not sequential.
• Set X-Robots-Tag: noindex and add Referrer-Policy: no-referrer, which the security headers middleware already applies globally — confirm it covers this route.
• Rate-limit or cache it. A public route on a free-tier Worker is a way to burn the request quota.

Acceptance criteria

• Per-rule toggle, off by default, with a clear warning about what becomes public
• Unguessable slug
• Public page shows aggregate performance only
• No admin URL, token, or commenter identity anywhere on it
• noindex, and confirmed no-referrer
• Regenerating the slug invalidates the old link
• Tests, including that the route is reachable without a session and exposes nothing sensitive

Where to look

• src/index.ts, src/headers.ts, src/routes/, migrations/

Read SECURITY.md before starting. This adds the only unauthenticated HTML route in the application.