add share-link password/expiry, journal touch-ups, ddns helper and audit docs

db/init.sql

@@ -37,9 +37,14 @@ CREATE TABLE IF NOT EXISTS share_links (
   student_name VARCHAR(150),
   date_from DATE,
   date_to DATE,
+  anonymize_names BOOLEAN DEFAULT false,
+  expires_at TIMESTAMPTZ,
+  access_password_hash VARCHAR(255),
   created_at TIMESTAMPTZ DEFAULT now()
 );
 
+CREATE INDEX IF NOT EXISTS idx_share_links_expires_at ON share_links(expires_at);
+
 INSERT INTO groups (name) VALUES
   ('Beginner'),
   ('Intermediate'),

db/migration_share_links.sql

@@ -0,0 +1,17 @@
+-- Migration: Add anonymize_names, expires_at, access_password_hash to share_links
+-- Run this on existing database
+
+-- 1. Add anonymize_names column (default false = show names)
+ALTER TABLE share_links ADD COLUMN IF NOT EXISTS anonymize_names BOOLEAN DEFAULT false;
+
+-- 2. Add expires_at column (default 7 days from creation, nullable for backward compat)
+ALTER TABLE share_links ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
+
+-- 3. Add access_password_hash column for bcrypt password protection
+ALTER TABLE share_links ADD COLUMN IF NOT EXISTS access_password_hash VARCHAR(255);
+
+-- 4. Update existing links to have expires_at = created_at + 7 days (optional, for existing links)
+-- UPDATE share_links SET expires_at = created_at + interval '7 days' WHERE expires_at IS NULL;
+
+-- 5. Add index for cleanup of expired links
+CREATE INDEX IF NOT EXISTS idx_share_links_expires_at ON share_links(expires_at);