feat: integrate client and server sharing workflows

web/src/lib/channelLink.test.ts

@@ -29,6 +29,9 @@ describe('parseChannelLink', () => {
     ['路径不对', `https://x.example/other/${ID}`, 'bad_url'],
     ['id 长度不对', 'https://x.example/c/abc', 'bad_id'],
     ['密钥长度不对', `https://x.example/c/${ID}#k=short`, 'bad_key'],
+    ['密钥误放进查询串', `https://x.example/c/${ID}?k=${KEY}`, 'bad_key'],
+    ['管理密钥误放进查询串', `https://x.example/c/${ID}?a=${KEY}`, 'bad_key'],
+    ['写密钥误放进查询串', `https://x.example/c/${ID}?w=${KEY}`, 'bad_key'],
   ])('%s → %s', (_n, input, error) => {
     expect(parseChannelLink(input)).toEqual({ ok: false, error });
   });

web/src/lib/channelLink.ts

@@ -23,6 +23,7 @@ export function parseChannelLink(input: string): LinkResult {
   } catch {
     return { ok: false, error: 'bad_url' };
   }
+  if (['k', 'a', 'w'].some((name) => url.searchParams.has(name))) return { ok: false, error: 'bad_key' };
   const m = /^\/c\/([^/]+)\/?$/.exec(url.pathname);
   if (!m || !m[1] || !ID_RE.test(m[1])) return { ok: false, error: m ? 'bad_id' : 'bad_url' };
 

web/src/lib/shareLink.test.ts

@@ -19,6 +19,7 @@ describe('parseShareLink', () => {
     ['id 长度不对', `https://x.example/s/abc#k=${KEY}`, 'bad_id'],
     ['缺少密钥', `https://x.example/s/${ID}`, 'bad_key'],
     ['密钥长度不对', `https://x.example/s/${ID}#k=short`, 'bad_key'],
+    ['密钥误放进查询串', `https://x.example/s/${ID}?k=${KEY}`, 'bad_key'],
   ])('%s → %s', (_n, input, error) => {
     expect(parseShareLink(input)).toEqual({ ok: false, error });
   });

web/src/lib/shareLink.ts

@@ -19,6 +19,7 @@ export function parseShareLink(input: string): ShareLinkResult {
   } catch {
     return { ok: false, error: 'bad_url' };
   }
+  if (['k', 'a', 'w'].some((name) => url.searchParams.has(name))) return { ok: false, error: 'bad_key' };
   const m = /^\/s\/([^/]+)\/?$/.exec(url.pathname);
   if (!m?.[1]) return { ok: false, error: 'bad_url' };
   if (!ID_RE.test(m[1])) return { ok: false, error: 'bad_id' };