[builtbyrishabh]

Problem

The Copy link / Open button in the chat header handed out the game's physical R2 location:

https://cdn.lessonplay.space/games/user_3Ifvkk.../<threadId>/current/index.html

That path deliberately embeds the owner's Clerk user id (the bucket is public-by-key, so the random prefix is the access control) — which means every link a teacher shares with a classroom leaks their user id. The agent also pasted this same raw URL into chat after every publish.

Fix

Put a clean, public app route in front of the bucket. Share links are now:

https://www.lessonplay.space/play/<threadId>

The bucket layout is unchanged — the user id just never leaves the server.

Changes

• src/app/play/[threadId]/route.ts (new) — public route: validates the thread id, resolves the owner from the lessonplay_game_version index (no bucket listing, no sandbox boot), fetches current/index.html from R2 server-side, and streams it through. CDN-cached for 60s (s-maxage=60) so a class opening the link at once hits cache while a republish shows up within a minute; X-Robots-Tag: noindex keeps share links out of search.
• src/server/db/games.ts — new latestGameVersionByThread(threadId) read with no user filter, for the public route. The unguessable thread UUID is the capability, the same model the bucket already used, and the row is only used to locate the built game.
• src/middleware.ts — /play(.*) added to the public routes; students opening a share link hold no Clerk session.
• src/server/api/routers/games.ts — games.latest returns sharePath: /play/<threadId> instead of the bucket shareUrl. A path rather than an absolute URL so localhost and preview deploys hand out links on their own origin.
• src/components/chat/chat-header.tsx — builds the absolute URL from window.location.origin at copy time; the Open button uses the relative path directly.
• src/app/api/chat/route.ts — the agent's publishedUrl (what the model shares in chat after publish) is now the /play URL, derived from the request origin.

The preview pane still uses the direct versioned bucket URLs — those render only inside the owner's authenticated session, so nothing leaks there.

Notes

• Previously copied raw CDN links keep working (public-by-key is unchanged); they just still contain the id, so re-share the /play form where it matters.
• Verified with pnpm typecheck and pnpm test (52 passed).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lessonplay-mastra	Error		Aug 31, 2026 12:18pm