From 57f90a7242993f560be22ae0dcab3832327592ab Mon Sep 17 00:00:00 2001
From: Atef Bellaaj <bellaaj.atef@hotmail.fr>
Date: Fri, 15 May 2026 11:21:05 +0200
Subject: [PATCH] fix(share): resolve role before creating shared link
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Role lookup between create and grant left an orphaned link
without ACL entries if getRoleByName threw — retry then hit "Share already exists" with no recovery path.
---
 api/server/routes/share.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/server/routes/share.js b/api/server/routes/share.js
index b8ab1981f9..72ff0bb32f 100644
--- a/api/server/routes/share.js
+++ b/api/server/routes/share.js
@@ -111,11 +111,11 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
 router.post('/:conversationId', requireJwtAuth, checkSharedLinksAccess, async (req, res) => {
   try {
     const { targetMessageId } = req.body;
+    const role = await getRoleByName(req.user.role);
+    const sharedLinksPerms = role?.permissions?.[PermissionTypes.SHARED_LINKS] || {};
+    const grantPublic = sharedLinksPerms[Permissions.SHARE_PUBLIC] === true;
     const created = await createSharedLink(req.user.id, req.params.conversationId, targetMessageId);
     if (created) {
-      const role = await getRoleByName(req.user.role);
-      const sharedLinksPerms = role?.permissions?.[PermissionTypes.SHARED_LINKS] || {};
-      const grantPublic = sharedLinksPerms[Permissions.SHARE_PUBLIC] === true;
       await grantCreationPermissions(created._id, req.user.id, grantPublic);
       res.status(200).json(created);
     } else {