Access and sharing
Private by default. Sharing is a grant you make, never a URL that leaked.
A fresh deploy is readable by its owner and nobody else. There are four states, and you move between them on purpose on the artifact's Share tab.
- Private, nobody named. The owner, and the workspace's owners and admins.
- Private, shared with addresses. The same, plus those addresses.
- Anyone at the workspace. Everyone in the workspace, after signing in. Members can edit; viewers can comment.
- Public. Anyone holding the URL, without signing in.
In a workspace with several people, a member or viewer never sees a teammate's private artifact unless they are named on it. See Teams.
Why enforcement is split
Neither half of the system can do this alone.
The platform is the only thing that can decide: the session cookie is on its origin and it can evaluate a share list against a person. It holds none of the artifact bytes.
The worker is the only thing that can serve: it has the storage binding and no database credential at all. It cannot ask who you are.
So the platform decides once and signs the decision, and the worker verifies that signature on every subsequent request. The signed decision is called a grant.
The gate
Ask for a private artifact without a grant and the worker redirects you to the platform. If you have no session you are sent to sign in; if you have one but no access you are shown who to ask; if you have access, a grant is minted and you are redirected back to the exact path you asked for — query string and all, because a visitor who followed a deep link and landed on the front page has no idea what they lost.
How long access lasts
A grant is bound to one artifact. Removing a name stops new grants at once, but not one a browser already holds. A grant from being named lasts up to a year in that browser and renews while it is used, because the alternative is a database round trip on every image, script and stylesheet an artifact requests. It is stated here so you know it before you rely on removing someone being instant.
Access that comes only from workspace membership is shorter: that grant lasts 24 hours and is never renewed, so a person removed from the workspace loses it within a day.
Sharing by email
Naming somebody sends them a message saying an artifact was shared with them and where it is. Before that existed, being granted access was completely silent — the grant was real and nobody knew.