feat: partage dirigé entre utilisateurs #196

- create_share/shared_with + validation des destinataires
- gate auth sur /s/{token} (+pdf, raw) : 404 opaque hors créateur/admin/destinataires
- GET /api/shares scopé (non-admin = créés + reçus), révocation créateur/admin
- UI : dialogue dirigé/public + destinataires, dashboard « partagé par X »
- i18n FR/EN, tests test_directed_shares.py (9), fiche feature

frontend/js/dashboard.js

@@ -1,5 +1,5 @@
 // dashboard.js — extracted from app.js (3414-3806) + DashboardBookmarkWidget (3810-3870)
-import { api } from './auth.js';
+import { api, AuthManager } from './auth.js';
 import { state } from './state.js';
 import { escapeHtml, safeCreateIcons, getFileIcon } from './utils.js';
 import { icon, openFile } from './viewer.js';
@@ -60,24 +60,29 @@ const DashboardSharedWidget = {
       const shares = await api("/api/shares");
       if (!shares.length) { if (empty) empty.style.display = ""; grid.innerHTML = ""; return; }
       if (empty) empty.style.display = "none";
-      grid.innerHTML = shares.map(s => `
-        <div class="shared-card" data-vault="${escapeHtml(s.vault)}" data-path="${escapeHtml(s.path)}">
+      const me = (AuthManager.getUser() || {}).username;
+      grid.innerHTML = shares.map(s => {
+        const received = me && s.created_by && s.created_by !== me;
+        const actions = received
+          ? `<button class="shared-open-btn">${t('dashboard.open_btn')}</button>`
+          : `<button class="shared-copy-btn" data-url="${window.location.origin}/s/${s.token}">${t('dashboard.copy_btn')}</button>
+             <button class="shared-open-btn">${t('dashboard.open_btn')}</button>
+             <button class="shared-revoke-btn" data-id="${s.id}">🗑</button>`;
+        return `
+        <div class="shared-card" data-vault="${escapeHtml(s.vault)}" data-path="${escapeHtml(s.path)}" data-token="${s.token}" data-received="${received ? "1" : ""}">
           <div class="shared-card-header">
             <i data-lucide="file-text" style="width:14px;height:14px"></i>
-            <span class="shared-card-title">${escapeHtml(s.path.split("/").pop().replace(/\.md$/i, ""))}</span>
+            <span class="shared-card-title">${escapeHtml(s.path.split("/").pop().replace(/\\.md$/i, ""))}</span>
             <span class="shared-card-vault">${escapeHtml(s.vault)}</span>
           </div>
           <div class="shared-card-meta">
+            ${received ? `<span>${t('dashboard.shared_by', { user: s.created_by })}</span>` : ""}
             <span>${s.access_count || 0} ${t('dashboard.views', {count: s.access_count || 0})}</span>
             ${s.expires_at ? `<span>${t('dashboard.expires', {date: new Date(s.expires_at).toLocaleDateString(getLocale() === 'fr' ? 'fr-FR' : 'en-US')})}</span>` : ""}
           </div>
-          <div class="shared-card-actions">
-            <button class="shared-copy-btn" data-url="${window.location.origin}/s/${s.token}">${t('dashboard.copy_btn')}</button>
-            <button class="shared-open-btn">${t('dashboard.open_btn')}</button>
-            <button class="shared-revoke-btn" data-id="${s.id}">🗑</button>
-          </div>
-        </div>
-      `).join("");
+          <div class="shared-card-actions">${actions}</div>
+        </div>`;
+      }).join("");
       lucide.createIcons();
       grid.querySelectorAll(".shared-copy-btn").forEach(b => b.addEventListener("click", async (e) => {
         e.stopPropagation();
@@ -88,6 +93,10 @@ const DashboardSharedWidget = {
       grid.querySelectorAll(".shared-open-btn").forEach(b => b.addEventListener("click", (e) => {
         e.stopPropagation();
         const card = b.closest(".shared-card");
+        if (card && card.dataset.received === "1" && card.dataset.token) {
+          window.open(`/s/${card.dataset.token}`, "_blank");
+          return;
+        }
         if (card) TabManager.openPreview(card.dataset.vault, card.dataset.path);
       }));
       grid.querySelectorAll(".shared-revoke-btn").forEach(b => b.addEventListener("click", async (e) => {
@@ -97,6 +106,10 @@ const DashboardSharedWidget = {
         this.load();
       }));
       grid.querySelectorAll(".shared-card").forEach(card => card.addEventListener("click", () => {
+        if (card.dataset.received === "1" && card.dataset.token) {
+          window.open(`/s/${card.dataset.token}`, "_blank");
+          return;
+        }
         TabManager.openPreview(card.dataset.vault, card.dataset.path);
       }));
     } catch (err) { if (empty) empty.style.display = ""; }