05/19 Enhance codes 2

app/routes/sharing.py

@@ -1,3 +1,5 @@
+from datetime import datetime, timezone
+
 from flask import Blueprint, request, jsonify, g
 from app import db, limiter, client_ip
 from app.models.user import User
@@ -126,6 +128,21 @@ def create_share():
     # Encrypted display name — encrypted with the ECDH shared secret client-side.
     enc_name = data.get('enc_name') or None
     iv_name = data.get('iv_name') or None
+    # Optional expiry: number of days until the share expires (None = never).
+    # Accepted values: 1, 7, 30, 90, None.
+    expires_days = data.get('expires_days')
+    expires_at = None
+    if expires_days is not None:
+        try:
+            expires_days = int(expires_days)
+            if expires_days > 0:
+                from datetime import timedelta
+                expires_at = (
+                    datetime.now(timezone.utc).replace(tzinfo=None)
+                    + timedelta(days=expires_days)
+                )
+        except (TypeError, ValueError):
+            pass
 
     if not all([item_id, recipient_email, enc_data, iv, item_name]):
         return jsonify({'error': 'item_id, recipient_email, enc_data, iv, item_name are required'}), 400
@@ -153,6 +170,7 @@ def create_share():
         iv=iv,
         enc_name=enc_name,
         iv_name=iv_name,
+        expires_at=expires_at,
     )
     db.session.add(share)
     db.session.flush()  # populate share.id before logging
@@ -201,15 +219,25 @@ def delete_share(share_id):
 @limiter.limit('60 per minute')
 @require_jwt
 def inbox():
-    """List all items shared with the current user."""
+    """List all items shared with the current user.
+    Expired unaccepted shares are excluded — they can no longer be acted on.
+    Expired accepted shares remain visible since the data was already accepted.
+    """
     user = db.session.get(User, g.current_user_id)
+    now = datetime.now(timezone.utc).replace(tzinfo=None)
     shares = (
         SharedItem.query
         .filter(
             db.or_(
                 SharedItem.recipient_email == user.email,
                 SharedItem.recipient_id == user.id,
-            )
+            ),
+            # Exclude expired unaccepted shares.
+            db.or_(
+                SharedItem.accepted == True,
+                SharedItem.expires_at == None,
+                SharedItem.expires_at > now,
+            ),
         )
         .order_by(SharedItem.created_at.desc())
         .all()