Skip to content

Sharing: public links, crew links, the public trip page

Rails
Status ✅
Code app/models/{trip_link,crew_membership}.rb, app/controllers/{trip_links,crew_memberships,public_trips,crew_invites}_controller.rb, app/controllers/concerns/{shared_trip_link,trip_page}.rb, app/views/trips/{_link_dialog_body,_crew,_link_field,_map}.html.erb, app/views/components/_link_dialog.html.erb, app/views/{public_trips,crew_invites}/, app/views/layouts/public_trip.html.erb, app/helpers/sharing_helper.rb, app/jobs/trip_link_cleanup_job.rb, app/javascript/controllers/{link_dialog,share_link,live_refresh}_controller.js, config/locales/sharing.{en,de}.yml

Verified against code: 2026-11-03

Purpose

Every trip is private. The owner can show it to anyone with a public link, and everyone on board can bring more crew in with a crew link: the crew then have the trip in their own logbook, read-only, and its miles count for them. Decisions and reasons: ADR 010.

Terms: trip, track, day as in glossary.md; public link, crew link, crew member are defined there too.

Rules

A third way to show a trip is the public skipper profile: a trip a user picked opens read-only through their profile, independent of links.

Rule Detail
Private by default Only the owner and the trip's crew open /my/trips/:id; anyone else gets 404. There are no visibility levels.
Links expire Every link, public or crew, works for 30 days from its creation (TripLink::LIFETIME), for everybody, the owner included.
Created by a click A link is only created by a click: a public link by the owner or the skipper, the crew link by anyone on board (owner, skipper, crew). Opening the Share or Invite crew dialog creates one when none of that kind works, and "New link" always does. Opening a page never creates one.
Public links add up The owner can have several working public links. "New link" adds one; "Stop sharing" ends all of them.
One crew link Creating a crew link ends every crew link of the trip that wasn't ended yet. A partial unique index (index_trip_links_one_crew_link) keeps it at one, even with two clicks at once. People who joined stay on the crew.
Tokens only A link is /t/<token> or /crew/<token>, the token 22 base58 characters (SecureRandom.base58(22)). The public page has no record ids in its HTML, URLs or JSON. A public token never opens a crew link and the other way round (each page looks up only its kind).
Roles Everyone on a trip has one role: the owner, the crew's skipper (at most one) or crew. Crew look, edit the description, invite more crew and can leave; the skipper has the owner's rights except deleting the trip, deleting tracks they didn't upload and moving tracks.
Never indexed Both pages send X-Robots-Tag: noindex, nofollow (the public page also as <meta name="robots">), and robots.txt disallows /t/ and /crew/ in every locale (public-site.md).
Rate limits Per IP: 120 requests a minute on /t/, 60 on /crew/.

Access

Action Owner Skipper Crew member Anyone else
Trip page /my/trips/:id ✅ ✅ ✅ read-only 404
Public page /t/<token> while the link works while the link works while the link works while the link works
Join via /crew/<token> goes to the trip goes to the trip goes to the trip while the link works, with an account
Trip replay /my/trips/:id/replay (trip-replay.md) ✅ ✅ ✅ 404; with a working public link /t/<token>/replay
All other actions see Roles see Roles see Roles 404

Roles

Everyone who sees a trip has one role on it (TripRole, app/models/trip_role.rb): the owner (the trip's account), from a crew membership skipper or crew (crew_memberships.role), or public on a public link. What each role may do is one table in code (TripRole::PERMISSIONS); controllers and views only ask for a permission (trip_can?), never for a role. Every trip lookup by id goes through Trip.with_permission(user, permission) (ADR 015); anything not allowed answers 404. A new role is one more value in CrewMembership::ROLES and one more row here.

Permission Owner Skipper Crew Public
view: trip page, Days, Tracks ✅ ✅ ✅ the public page
edit_trip: title, area, boat (from the owner's boats), time zone, bridge gaps, night override ✅ ✅ – –
edit_description: the trip's description ✅ ✅ ✅ –
edit_tracks: track editor (trims, states, names) ✅ ✅ – –
upload: upload into the trip ✅ ✅ – –
export: GPX ✅ ✅ – –
share: create and end public links ✅ ✅ – –
invite_crew: the Invite crew dialog, create a new crew link (ADR 020) ✅ ✅ ✅ –
manage_crew: remove crew, set or clear the skipper ✅ ✅ – –
delete_track every track only tracks they uploaded – –
move_track: to another of the owner's trips ✅ – – –
delete_trip ✅ – – –
leave – ✅ ✅ –
  • "I was the skipper" in Edit trip is the owner's own statement and only the owner sees it. It and a skipper in the crew exclude each other: setting one clears the other. At most one skipper per trip (index_crew_memberships_one_skipper).
  • Tracks belong to whoever recorded them: a trip only holds its owner's tracks (ADR 015). A track the skipper uploads becomes the trip owner's track; tracks.uploaded_by_id keeps who uploaded it, so the skipper can delete it. The owner can edit and delete it like any track. It stays in the trip when the skipper leaves or deletes their account (uploaded_by_id is cleared).
  • The skipper's own logbook counts the trip as skipper: the Skipper badge, the card band and the "As skipper" filter (logbook.md). For the owner the trip then counts as not skippered.

One reusable modal for both kinds (components/_link_dialog with link_dialog_controller.js; body trips/_link_dialog_body).

Opened by Title and (?) Opening
The Share icon button in the owner's page head (#share-trip) "SHARE THIS TRIP", (?) "Anyone with this link can see the trip, its map and its numbers, without an account. After 30 days the link shows that it has expired, for you too." POST /my/trips/:id/links/open?kind=public
The orange Invite crew button on the right of the crew card's headline (#invite-crew), for everyone on board "INVITE CREW", (?) "Your crew need a SailEver account. The trip then shows up in their logbook, read-only, and its miles count for them." POST /my/trips/:id/links/open?kind=crew

Opening shows the newest working link of the kind; when none works it creates one first, so one click gives a link to copy. An open dialog never replaces a link already sent. The body is loaded without leaving the page and is kept through the page's own refreshes (data-turbo-permanent).

Body Content
A working link Field "Public link" / "Crew link" (https://<host>/t/<token> or /crew/<token>, no locale prefix), "Works until .", Copy link (shows "Copied" for 2 s), Share… (the phone's share sheet, only where navigator.share exists), Open (public only, new tab). Public with more than one working: "1 older link also works, until ." / "N older links also work, the last until ." Then New link (crew asks first: "The current crew link stops working. People who already joined stay on the crew. Continue?") and, public only, Stop sharing (confirm "All public links of this trip stop working. Continue?").
No working link (after Stop sharing) "Your last link stopped working on ." and Create public link
Public footer "Your first name is shown on the page." when the owner's account setting is on and they have a first name; otherwise "Your name is not shown. Change in Profile" (link to /my/profile).
Loading failed "The link couldn't be loaded. Close and try again."

New link (POST /my/trips/:id/links?kind=…&dialog=1) and Stop sharing (DELETE /my/trips/:id/links/public?dialog=1) answer with the new body. Without dialog (no JavaScript) they go back to the trip page with a notice. Dates are in the trip's time zone, long format.

Crew section

A card "CREW" (crew icon) below Days | Tracks on the trip page (#crew).

Element Owner and skipper Crew member
First row The owner: "You" (or their first name + last initial for the skipper) · "Skipper" (if "I was the skipper" is set) or "Owner" The owner's first name + last initial ("Anna S.", or "Owner" without a name) · "Skipper" / "Owner"
One row per crew member (by joining) First name + last initial, or the masked email m•••@example.com without a name; "Skipper" for the skipper, otherwise "joined "; ✕ icon button "Remove from the crew" (confirm "Remove from the crew? The trip disappears from their logbook.", notice " is no longer on the crew."). While nobody is skipper (neither "I was the skipper" nor a crew skipper): Make skipper (boat icon, confirm "Make the skipper of this trip? The skipper can do everything you can, except delete the trip or tracks they didn't upload.", notice " is now the skipper."). On the skipper's row: Not skipper (notice " is no longer the skipper."). The viewer's own row is "You" with Leave this trip instead of ✕. Names only (first name + last initial, or "Crew member"), "Skipper" for the skipper; themselves as "You" with Leave this trip (confirm "Leave this trip? It disappears from your logbook and its miles no longer count for you."; then /my/trips with "You left .")</td> </tr> <tr> <td>Empty</td> <td>"No crew yet."</td> <td>—</td> </tr> <tr> <td>Headline</td> <td>"CREW" (crew icon); on the right the orange <strong>Invite crew</strong> button, which opens the <a href="#link-dialog">link dialog</a></td> <td>The same</td> </tr> </tbody> </table> <p>Removing and leaving: <code>DELETE /my/trips/:trip_id/crew_memberships/:id</code>; crew and skipper can delete their own membership, owner and skipper anyone's. Make skipper / Not skipper: <code>PATCH /my/trips/:trip_id/crew_memberships/:id/skipper?skipper=1|0</code> (owner and skipper).</p> <h2 id="public-trip-page">Public trip page<a class="headerlink" href="#public-trip-page" title="Permanent link">¶</a></h2> <p><code>GET /t/<token></code> (also with a locale prefix, <code>/de/t/<token></code>), <code>PublicTripsController</code>, layout <code>public_trip</code>: the public header (signed in: "My Logbook"), the trip, the site footer. Signed-out visitors get the page in the URL's language (English without a prefix); new texts exist in English and German.</p> <table> <thead> <tr> <th>Link</th> <th>Answer</th> </tr> </thead> <tbody> <tr> <td>Working public link</td> <td>200, the page below</td> </tr> <tr> <td>Ended (expired or stopped)</td> <td>410, "This link has expired" / "Shared trip links work for 30 days. Ask the person who sent it for a new one." and "Discover SailEver" → <code>/</code>. No trip details. The same for the owner.</td> </tr> <tr> <td>Unknown token, or a crew token</td> <td>404</td> </tr> </tbody> </table> <p><strong>Content.</strong> Title; the <a href="../trip/#description">description</a> with its "Last edited by" line (the editor's first name only if they show it publicly, else "a crew member" / "the skipper"); meta line: sailing area, "<dates> · N days", and the on-board line; the <a href="../trip/#page-head">boat line</a> (name, model, charter company or own boat, home port); the <a href="../trip/#map">trip map</a> (with the live position and the button that opens it big, the <a href="../trip-replay/">trip replay</a>'s map view, <code>/t/<token>/replay</code>: the same replay as signed in, by token, without Edit track); the three readouts and the split bar (no Edit track button); the Days table only, under the heading "DAYS" ("TAGE"; no Tracks tab, <code>?view=tracks</code> shows Days too); a footer line "Shared until <date> · Recorded with SailEver, the sailing logbook for your watch." (link to <code>/</code>). <code><title></code> is the trip title, the description (also Open Graph) "<area> · <distance> NM · <dates>" (<a href="#link-previews">link previews</a>).</p> <p><strong>Left out.</strong> Back link, every button and form, export, the crew section, night override, track edit and Move, processing / recalculating / sync badges, the Device column and "Recorded with <device>", the Skipper badge, record ids (<code>dom_id</code>s, event ids in the map JSON; the page has no Turbo stream, whose signed name holds the trip's id), emails and last names.</p> <p><strong>On board.</strong> People are the owner, then the crew by joining. Only those who turned on "Show my first name on public trip pages" and have a first name are named, the skipper as "Anna (skipper)" (the owner with "I was the skipper", or the crew's skipper); the rest are counted: "On board: Anna (skipper), Lena, and 1 more". Nobody named: "On board: 3 sailors" ("1 sailor").</p> <p><strong>Live.</strong> While a track is being sent (<a href="../trip/#map">trip.md § Map</a>, live position), the page refreshes itself every 60 s while the tab is visible (<code>live_refresh_controller.js</code>, Turbo morph; the map redraws). An unchanged page is a 304.</p> <p><strong>Cache.</strong> ETag over the link, the trip (its description included), boat, the description's last editor, days, bridges, tracks, owner, crew (their names and settings), the tab, the frame, the locale and the release; <code>Cache-Control: max-age=0, private, must-revalidate</code>, so an ended link answers 410 on the next request.</p> <h2 id="crew-link">Crew link<a class="headerlink" href="#crew-link" title="Permanent link">¶</a></h2> <p><code>/crew/<token></code> (<code>CrewInvitesController</code>, layout <code>auth</code>). The link is checked on every request, including "Join trip" and the return after signing in.</p> <table> <thead> <tr> <th>Who</th> <th>GET</th> <th>POST (Join trip)</th> </tr> </thead> <tbody> <tr> <td>Signed out</td> <td>Invitation page: like the confirm page, but the owner's first name only if they show it on public pages (otherwise "A friend"; German "Jemand"), and one button <strong>Sign in to join</strong> (a POST, without Turbo). This is also what messengers show as the <a href="#link-previews">link preview</a>.</td> <td>Redirect to the sign-in page with <code>redirect_to=/<locale>/crew/<token></code> and the notice "Sign in or create an account to join <title> as crew."</td> </tr> <tr> <td>Signed in, privacy or terms not current</td> <td>The <a href="../auth/#privacy-consent">consent page</a> first, then back here</td> <td>—</td> </tr> <tr> <td>Signed in</td> <td>Confirm page: eyebrow "CREW", "Join <title> as crew?", sailing area, dates, distance, "<owner's first name, or A friend> invited you. The trip then shows up in your logbook, read-only, and its miles count for you.", <strong>Join trip</strong> / <strong>Not now</strong> (→ <code>/my</code>)</td> <td>Creates the membership (once), then the trip page with "You're on the crew of <title>."</td> </tr> <tr> <td>Already crew</td> <td>Redirect to the trip</td> <td>Redirect to the trip</td> </tr> <tr> <td>The owner</td> <td>Redirect to the trip, "This is your trip. Send the link to your crew."</td> <td>Redirect to the trip, no membership</td> </tr> <tr> <td>Ended link</td> <td>410, "This crew link has expired" / "Crew links work for 30 days, and a new one replaces the old one. Ask the person who sent it for a new one."</td> <td>410</td> </tr> <tr> <td>Unknown token, or a public token</td> <td>404</td> <td>404</td> </tr> </tbody> </table> <p>Opening the link never joins by itself: messenger previews open URLs too.</p> <p><strong>New accounts and the beta.</strong> The sign-in page creates an account for an unknown email after the privacy and terms checkboxes (<a href="../auth/#requesting-one-post-authmagic_link">auth.md</a>). During the beta, unknown emails are normally sent to the beta form; when <code>redirect_to</code> is a working crew link (<code>TripLink.crew_invite_path?</code>), that counts as an approved beta invite: the account is created and has the full logbook (pairing, uploads), not only the crewed trip. A pending beta application with that email is set to <code>invited</code>. The magic link brings the new user back to the crew link.</p> <h2 id="link-previews">Link previews<a class="headerlink" href="#link-previews" title="Permanent link">¶</a></h2> <p>Messengers (WhatsApp, Signal, Telegram, iMessage, …) fetch a pasted link signed out and show its Open Graph tags. Both kinds of link set them with <code>share_meta</code> (<code>DesignHelper</code>):</p> <table> <thead> <tr> <th>Tag</th> <th>Public link</th> <th>Crew link</th> <th>Ended link (410)</th> </tr> </thead> <tbody> <tr> <td><code>og:title</code></td> <td>trip title</td> <td>trip title</td> <td>"This link has expired" / "This crew link has expired" · SailEver</td> </tr> <tr> <td><code>og:description</code></td> <td>"<area> · <distance> NM · <dates>" (<code>trip_summary</code>)</td> <td>the same + " · Crew invitation"</td> <td>the site description</td> </tr> <tr> <td><code>og:image</code></td> <td>the <a href="#preview-image">preview image</a> once it is made, else the default image</td> <td>the same</td> <td>the default image</td> </tr> </tbody> </table> <p>Every page also has <code>og:type</code> <code>website</code>, <code>og:url</code> (the URL without query), <code>og:image:width</code> / <code>height</code> / <code>alt</code> and <code>twitter:card</code> <code>summary_large_image</code>. The default image is <code>films/wa-poster.jpg</code> (1280 × 720 JPEG; messengers don't show WebP reliably).</p> <h3 id="preview-image">Preview image<a class="headerlink" href="#preview-image" title="Permanent link">¶</a></h3> <p>The trip card's map as a JPEG of <strong>1500 × 785 px</strong> (1.91:1, the shape messengers show best): the card's 300 px width at 5× resolution, 157 px high. Same base map, lines, colours and padding as the <a href="../logbook/#trip-card">trip card</a>; no live position, badges or skipper band. Under 300 kB (JPEG quality 80, else 65, else 50).</p> <table> <thead> <tr> <th>Step</th> <th></th> </tr> </thead> <tbody> <tr> <td>Made</td> <td><code>TripPreviewJob</code> (queue <code>background</code>, one at a time) when a link is created, and 10 minutes after the card's lines change while a link works. Skipped when the stored image shows the same lines (<code>TripPreview.digest</code>, in the file name) and when no preview host is configured.</td> </tr> <tr> <td>How</td> <td><code>TripPreview</code>: headless Chromium (Ferrum, in the jobs role, <a href="../../../adr/014-link-preview-images-with-headless-chromium/">ADR 014</a>) opens <code>/previews/<signed trip id></code> (valid 5 minutes, no session, <code>noindex</code>) at 300 × 157 CSS px and device pixel ratio 5, waits until the page sets <code><html data-preview-ready></code> (tiles loaded, at most 15 s) and takes the screenshot.</td> </tr> <tr> <td>Stored</td> <td><code>trips.preview_image</code> (Active Storage, private bucket).</td> </tr> <tr> <td>Served</td> <td><code>/t/<token>/preview.jpg</code> and <code>/crew/<token>/preview.jpg</code>, only while the link works (ended: 410, unknown: 404), <code>Cache-Control: public, max-age=3600</code>; before it is made, a redirect to the default image. <code>og:image</code> carries <code>?v=<digest></code>, so a changed image gets a new URL. The crew invitation page shows it above the trip summary.</td> </tr> <tr> <td>Deleted</td> <td>By <code>TripLinkCleanupJob</code> (daily) once no link of the trip works; with the trip or the account.</td> </tr> </tbody> </table> <h2 id="account-setting">Account setting<a class="headerlink" href="#account-setting" title="Permanent link">¶</a></h2> <p>"Show my first name on public trip pages" on <code>/my/profile</code> (<code>users.show_first_name_publicly</code>, default off): see <a href="../auth/#profile-card">auth.md</a>. Signed-in pages (trip page, crew section, confirm page) show first names regardless, because only owner and crew see them.</p> <h2 id="data">Data<a class="headerlink" href="#data" title="Permanent link">¶</a></h2> <p><code>trip_links</code> and <code>crew_memberships</code>, <code>users.show_first_name_publicly</code>: <a href="../data-model/">data-model.md</a>. Deleting the trip or the owner's account deletes its links and memberships; deleting a crew member's account deletes their memberships (<a href="../data-model/#deletion">data-model.md § Deletion</a>). <code>TripLinkCleanupJob</code> (daily 05:00) deletes links that ended more than 30 days ago (until then they answer 410 instead of 404) and the preview image of every trip without a working link.</p> <h3 id="totals">Totals<a class="headerlink" href="#totals" title="Permanent link">¶</a></h3> <p>Crewed trips count in the crew member's totals and year chart, each date once: <a href="../logbook/#counted-days">logbook.md § Counted days</a>.</p> <h2 id="known-deviations">Known deviations<a class="headerlink" href="#known-deviations" title="Permanent link">¶</a></h2> <ul> <li>The live position follows the watch's upload rhythm (first segment after about 15 s, then about hourly), not real time.</li> <li>The other five languages have no texts for the public page and the crew link yet; they show English.</li> <li>The crew invitation page names the trip's owner ("Anna invited you") also when a crew member created the link.</li> <li>The mobile apps' share sheet (<a href="../../mobile/trips/">../mobile/trips.md</a>) is not built.</li> </ul> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../public-site/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Public website"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> Public website </div> </div> </a> <a href="../track-editor/" class="md-footer__link md-footer__link--next" aria-label="Next: Track editor"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> Track editor </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> Made with <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener"> Material for MkDocs </a> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"annotate": null, "base": "../../..", "features": ["navigation.sections", "navigation.indexes", "navigation.top", "navigation.footer", "search.suggest", "search.highlight", "content.code.copy", "toc.follow"], "search": "../../../assets/javascripts/workers/search.a7633da7.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": null}</script> <script src="../../../assets/javascripts/bundle.c21346df.min.js"></script> </body> </html>