feat: add shareable answer links

backend/app/models.py

@@ -62,3 +62,15 @@ class ChatMessage(Base):
     # Relationships
     user = relationship("User", back_populates="messages")
     document = relationship("Document", back_populates="messages")
+    shared_message = relationship("SharedMessage", back_populates="message", uselist=False, cascade="all, delete-orphan")
+
+
+class SharedMessage(Base):
+    __tablename__ = "shared_messages"
+
+    id = Column(String, primary_key=True, default=generate_uuid)
+    message_id = Column(String, ForeignKey("chat_messages.id"), nullable=False, unique=True, index=True)
+    created_at = Column(DateTime, default=lambda: datetime.now(timezone.utc))
+
+    # Relationships
+    message = relationship("ChatMessage", back_populates="shared_message")

backend/app/routes/chat.py

@@ -17,8 +17,16 @@ from reportlab.platypus import Paragraph, SimpleDocTemplate, Spacer
 from sqlalchemy.orm import Session
 
 from app.database import get_db
-from app.models import User, ChatMessage, Document
-from app.schemas import ChatRequest, ChatResponse, ChatMessageResponse, ChatHistoryResponse, SourceChunk
+from app.models import User, ChatMessage, Document, SharedMessage
+from app.schemas import (
+    ChatRequest,
+    ChatResponse,
+    ChatMessageResponse,
+    ChatHistoryResponse,
+    ShareAnswerResponse,
+    ShareLinkResponse,
+    SourceChunk,
+)
 from app.auth import get_current_user
 from app.rag.agent import generate_answer, generate_answer_stream
 from app.rate_limit import limiter
@@ -28,6 +36,53 @@ logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/chat", tags=["Chat"])
 
 
+@router.get("/share/{message_id}", response_model=ShareAnswerResponse)
+def get_shared_answer(
+    message_id: str,
+    db: Session = Depends(get_db),
+):
+    """Fetch a single assistant answer for public sharing."""
+    message = db.query(ChatMessage).filter(
+        ChatMessage.id == message_id,
+        ChatMessage.role == "assistant",
+    ).first()
+
+    if not message or not db.query(SharedMessage).filter(SharedMessage.message_id == message.id).first():
+        raise HTTPException(status_code=404, detail="Shared answer not found")
+
+    return _share_answer_response(message)
+
+
+@router.post("/share/{message_id}", response_model=ShareLinkResponse)
+def create_share_link(
+    message_id: str,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    """Create a public share URL for a user's assistant answer."""
+    message = db.query(ChatMessage).filter(
+        ChatMessage.id == message_id,
+        ChatMessage.user_id == user.id,
+    ).first()
+
+    if not message:
+        raise HTTPException(status_code=404, detail="Message not found")
+
+    if message.role != "assistant":
+        raise HTTPException(status_code=400, detail="Only assistant messages can be shared")
+
+    shared_message = db.query(SharedMessage).filter(SharedMessage.message_id == message.id).first()
+    if not shared_message:
+        shared_message = SharedMessage(message_id=message.id)
+        db.add(shared_message)
+        db.commit()
+
+    return ShareLinkResponse(
+        message_id=message.id,
+        share_url=f"/share?message_id={message.id}",
+    )
+
+
 @router.post("/ask", response_model=ChatResponse)
 @limiter.limit("10/minute")
 def ask_question(
@@ -425,6 +480,23 @@ def _save_message(
     db.commit()
 
 
+def _share_answer_response(message: ChatMessage) -> ShareAnswerResponse:
+    """Format a shared assistant message with only safe public fields."""
+    sources = []
+    if message.sources_json:
+        try:
+            sources = [SourceChunk(**item) for item in json.loads(message.sources_json)]
+        except Exception:
+            sources = []
+
+    return ShareAnswerResponse(
+        id=message.id,
+        content=message.content,
+        created_at=message.created_at,
+        sources=sources,
+    )
+
+
 def _format_markdown(doc, messages) -> str:
     """Format chat history as a Markdown document.
 

backend/app/schemas.py

@@ -136,5 +136,17 @@ class ChatHistoryResponse(BaseModel):
     document_id: Optional[str] = None
 
 
+class ShareAnswerResponse(BaseModel):
+    id: str
+    content: str
+    sources: List[SourceChunk] = []
+    created_at: datetime
+
+
+class ShareLinkResponse(BaseModel):
+    message_id: str
+    share_url: str
+
+
 # Rebuild models for forward references
 TokenResponse.model_rebuild()

backend/tests/conftest.py

@@ -0,0 +1,197 @@
+import os
+import sys
+import types
+from contextlib import asynccontextmanager
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+ROOT = Path(__file__).resolve().parents[2]
+BACKEND_DIR = ROOT / "backend"
+
+if str(BACKEND_DIR) not in sys.path:
+    sys.path.insert(0, str(BACKEND_DIR))
+
+os.environ.setdefault("SECRET_KEY", "test-secret-key-that-is-long-enough")
+os.environ.setdefault("DATABASE_URL", "sqlite:///./test_share_bootstrap.db")
+os.environ.setdefault("HF_TOKEN", "test-hf-token")
+os.environ.setdefault("UPLOAD_DIR", str(ROOT / "backend" / "test_uploads"))
+os.environ.setdefault("CHROMA_PERSIST_DIR", str(ROOT / "backend" / "test_chroma"))
+
+fake_embeddings = types.ModuleType("app.rag.embeddings")
+fake_embeddings.get_embedding_model = lambda: object()
+fake_embeddings.embed_query = lambda query: [0.0]
+fake_embeddings.embed_texts = lambda texts: [[0.0] for _ in texts]
+sys.modules.setdefault("app.rag.embeddings", fake_embeddings)
+
+
+class _FakeChromaClient:
+    def heartbeat(self):
+        return "ok"
+
+
+fake_vectorstore = types.ModuleType("app.rag.vectorstore")
+fake_vectorstore.get_chroma_client = lambda: _FakeChromaClient()
+fake_vectorstore.store_chunks = lambda chunks, document_id, filename, user_id: len(chunks)
+fake_vectorstore.delete_document_chunks = lambda document_id, user_id: None
+fake_vectorstore.query_chunks = lambda query_embedding, user_id, document_id=None, top_k=10: []
+sys.modules.setdefault("app.rag.vectorstore", fake_vectorstore)
+
+slowapi_module = types.ModuleType("slowapi")
+slowapi_errors = types.ModuleType("slowapi.errors")
+slowapi_middleware = types.ModuleType("slowapi.middleware")
+slowapi_util = types.ModuleType("slowapi.util")
+
+
+class RateLimitExceeded(Exception):
+    pass
+
+
+class SlowAPIMiddleware:
+    def __init__(self, app, *args, **kwargs):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        await self.app(scope, receive, send)
+
+
+class Limiter:
+    def __init__(self, key_func=None, *args, **kwargs):
+        self.key_func = key_func
+
+    def limit(self, _value):
+        def decorator(fn):
+            return fn
+        return decorator
+
+
+slowapi_errors.RateLimitExceeded = RateLimitExceeded
+slowapi_middleware.SlowAPIMiddleware = SlowAPIMiddleware
+slowapi_util.get_remote_address = lambda request: "127.0.0.1"
+slowapi_module.Limiter = Limiter
+
+sys.modules.setdefault("slowapi", slowapi_module)
+sys.modules.setdefault("slowapi.errors", slowapi_errors)
+sys.modules.setdefault("slowapi.middleware", slowapi_middleware)
+sys.modules.setdefault("slowapi.util", slowapi_util)
+
+from app.auth import create_access_token, hash_password
+from app.database import Base, get_db
+from app.main import app
+from app.models import ChatMessage, User
+
+
+@pytest.fixture()
+def db_session(tmp_path):
+    db_file = tmp_path / "test.db"
+    engine = create_engine(
+        f"sqlite:///{db_file}",
+        connect_args={"check_same_thread": False},
+    )
+    TestingSessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+    Base.metadata.create_all(bind=engine)
+
+    session = TestingSessionLocal()
+    try:
+        yield session
+    finally:
+        session.close()
+        Base.metadata.drop_all(bind=engine)
+        engine.dispose()
+
+
+@pytest.fixture()
+def client(db_session, monkeypatch):
+    def override_get_db():
+        try:
+            yield db_session
+        finally:
+            pass
+
+    @asynccontextmanager
+    async def no_lifespan(_app):
+        yield
+
+    monkeypatch.setattr("app.database.SessionLocal", lambda: db_session)
+    app.dependency_overrides[get_db] = override_get_db
+    app.router.lifespan_context = no_lifespan
+
+    with TestClient(app) as test_client:
+        yield test_client
+
+    app.dependency_overrides.clear()
+
+
+@pytest.fixture()
+def user(db_session):
+    instance = User(
+        username="tester",
+        email="tester@example.com",
+        hashed_password=hash_password("password123"),
+    )
+    db_session.add(instance)
+    db_session.commit()
+    db_session.refresh(instance)
+    return instance
+
+
+@pytest.fixture()
+def other_user(db_session):
+    instance = User(
+        username="other",
+        email="other@example.com",
+        hashed_password=hash_password("password123"),
+    )
+    db_session.add(instance)
+    db_session.commit()
+    db_session.refresh(instance)
+    return instance
+
+
+@pytest.fixture()
+def auth_headers(user):
+    token = create_access_token(user.id)
+    return {"Authorization": f"Bearer {token}"}
+
+
+@pytest.fixture()
+def assistant_message(db_session, user):
+    instance = ChatMessage(
+        user_id=user.id,
+        role="assistant",
+        content="Shared assistant answer",
+        sources_json='[{"text":"Source text","filename":"file.txt","page":1,"score":0.9,"confidence":95.0}]',
+    )
+    db_session.add(instance)
+    db_session.commit()
+    db_session.refresh(instance)
+    return instance
+
+
+@pytest.fixture()
+def user_message(db_session, user):
+    instance = ChatMessage(
+        user_id=user.id,
+        role="user",
+        content="Private user prompt",
+    )
+    db_session.add(instance)
+    db_session.commit()
+    db_session.refresh(instance)
+    return instance
+
+
+@pytest.fixture()
+def other_user_assistant_message(db_session, other_user):
+    instance = ChatMessage(
+        user_id=other_user.id,
+        role="assistant",
+        content="Other user's answer",
+    )
+    db_session.add(instance)
+    db_session.commit()
+    db_session.refresh(instance)
+    return instance

backend/tests/test_share.py

@@ -0,0 +1,61 @@
+def test_share_link_creation_success(client, auth_headers, assistant_message):
+    response = client.post(
+        f"/api/v1/chat/share/{assistant_message.id}",
+        headers=auth_headers,
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["message_id"] == assistant_message.id
+    assert payload["share_url"] == f"/share?message_id={assistant_message.id}"
+
+
+def test_share_link_unauthorized_for_other_users_message(client, auth_headers, other_user_assistant_message):
+    response = client.post(
+        f"/api/v1/chat/share/{other_user_assistant_message.id}",
+        headers=auth_headers,
+    )
+
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Message not found"
+
+
+def test_cannot_share_user_message(client, auth_headers, user_message):
+    response = client.post(
+        f"/api/v1/chat/share/{user_message.id}",
+        headers=auth_headers,
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Only assistant messages can be shared"
+
+
+def test_public_fetch_fails_before_share(client, assistant_message):
+    response = client.get(f"/api/v1/chat/share/{assistant_message.id}")
+
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Shared answer not found"
+
+
+def test_public_fetch_shared_answer_success_after_share(client, auth_headers, assistant_message):
+    share_response = client.post(
+        f"/api/v1/chat/share/{assistant_message.id}",
+        headers=auth_headers,
+    )
+    assert share_response.status_code == 200
+
+    response = client.get(f"/api/v1/chat/share/{assistant_message.id}")
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["id"] == assistant_message.id
+    assert payload["content"] == "Shared assistant answer"
+    assert len(payload["sources"]) == 1
+    assert payload["sources"][0]["filename"] == "file.txt"
+
+
+def test_missing_message_returns_404(client):
+    response = client.get("/api/v1/chat/share/missing-message-id")
+
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Shared answer not found"

frontend/src/app/share/page.tsx

@@ -0,0 +1,188 @@
+"use client";
+
+import { Suspense, useEffect, useState } from "react";
+import { useSearchParams } from "next/navigation";
+import ReactMarkdown, { type Components } from "react-markdown";
+import rehypeHighlight from "rehype-highlight";
+import remarkGfm from "remark-gfm";
+import { Brain } from "lucide-react";
+import { api } from "@/lib/api";
+
+interface SharedSource {
+  text: string;
+  filename: string;
+  page: number;
+  score: number;
+  confidence: number;
+}
+
+interface SharedAnswer {
+  id: string;
+  content: string;
+  created_at: string;
+  sources: SharedSource[];
+}
+
+const markdownComponents: Components = {
+  table: ({ children }) => (
+    <div className="my-3 overflow-x-auto rounded-lg border border-border/70">
+      <table className="min-w-full border-collapse text-left text-sm">
+        {children}
+      </table>
+    </div>
+  ),
+  thead: ({ children }) => (
+    <thead className="bg-muted/60 text-foreground">{children}</thead>
+  ),
+  th: ({ children }) => (
+    <th className="border-b border-border/70 px-3 py-2 font-semibold">
+      {children}
+    </th>
+  ),
+  td: ({ children }) => (
+    <td className="border-b border-border/50 px-3 py-2 align-top">
+      {children}
+    </td>
+  ),
+  pre: ({ children }) => (
+    <pre className="not-prose my-3 overflow-x-auto rounded-lg border border-border/70 bg-zinc-950 p-3 text-sm text-zinc-100">
+      {children}
+    </pre>
+  ),
+  code: ({ className, children, ...props }) => {
+    const language = /language-(\w+)/.exec(className ?? "")?.[1];
+
+    return (
+      <code className={className} data-language={language} {...props}>
+        {children}
+      </code>
+    );
+  },
+};
+
+function ShareAnswerContent() {
+  const searchParams = useSearchParams();
+  const messageId = searchParams.get("message_id");
+  const missingMessageId = !messageId;
+  const [answer, setAnswer] = useState<SharedAnswer | null>(null);
+  const [error, setError] = useState("");
+  const loading = !error && !answer && !missingMessageId;
+
+  useEffect(() => {
+    if (missingMessageId) {
+      return;
+    }
+
+    let cancelled = false;
+
+    void api
+      .get<SharedAnswer>(`/api/v1/chat/share/${messageId}`)
+      .then((data) => {
+        if (cancelled) return;
+        setAnswer(data);
+        setError("");
+      })
+      .catch((err: unknown) => {
+        if (cancelled) return;
+        setAnswer(null);
+        setError(err instanceof Error ? err.message : "Shared answer not found");
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [messageId, missingMessageId]);
+
+  if (missingMessageId) {
+    return (
+      <div className="min-h-screen flex items-center justify-center px-4">
+        <div className="rounded-xl border border-border/50 bg-card/80 px-6 py-5 text-center">
+          <p className="text-lg font-semibold mb-1">Shared answer unavailable</p>
+          <p className="text-sm text-muted-foreground">This shared answer could not be found.</p>
+        </div>
+      </div>
+    );
+  }
+
+  if (loading) {
+    return (
+      <div className="min-h-screen flex items-center justify-center px-4">
+        <div className="text-sm text-muted-foreground">Loading shared answer...</div>
+      </div>
+    );
+  }
+
+  if (error || !answer) {
+    return (
+      <div className="min-h-screen flex items-center justify-center px-4">
+        <div className="rounded-xl border border-border/50 bg-card/80 px-6 py-5 text-center">
+          <p className="text-lg font-semibold mb-1">Shared answer unavailable</p>
+          <p className="text-sm text-muted-foreground">{error || "This shared answer could not be found."}</p>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen px-4 py-10 bg-background text-foreground">
+      <div className="max-w-3xl mx-auto">
+        <div className="rounded-2xl border border-border/50 bg-card/80 backdrop-blur-sm p-6">
+          <div className="flex items-center gap-3 mb-5">
+            <div className="w-10 h-10 rounded-xl bg-primary/15 flex items-center justify-center">
+              <Brain className="w-5 h-5 text-primary" />
+            </div>
+            <div>
+              <h1 className="text-xl font-semibold">Shared AI Answer</h1>
+              <p className="text-sm text-muted-foreground">
+                {new Date(answer.created_at).toLocaleString()}
+              </p>
+            </div>
+          </div>
+
+          <div className="prose-chat text-sm">
+            <ReactMarkdown
+              remarkPlugins={[remarkGfm]}
+              rehypePlugins={[rehypeHighlight]}
+              components={markdownComponents}
+            >
+              {answer.content}
+            </ReactMarkdown>
+          </div>
+
+          {answer.sources.length > 0 && (
+            <div className="mt-6 border-t border-border/50 pt-4">
+              <h2 className="text-sm font-semibold mb-3">Sources</h2>
+              <div className="space-y-2">
+                {answer.sources.map((source, index) => (
+                  <div
+                    key={`${answer.id}-${index}`}
+                    className="rounded-lg border border-border/50 bg-background/60 p-3"
+                  >
+                    <p className="text-xs font-medium mb-1">
+                      {source.filename} • Page {source.page}
+                    </p>
+                    <p className="text-xs text-muted-foreground">{source.text}</p>
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function ShareAnswerPage() {
+  return (
+    <Suspense
+      fallback={
+        <div className="min-h-screen flex items-center justify-center px-4">
+          <div className="text-sm text-muted-foreground">Loading shared answer...</div>
+        </div>
+      }
+    >
+      <ShareAnswerContent />
+    </Suspense>
+  );
+}

frontend/src/components/chat/MessageBubble.tsx

@@ -5,7 +5,8 @@ import ReactMarkdown, { type Components } from "react-markdown";
 import rehypeHighlight from "rehype-highlight";
 import remarkGfm from "remark-gfm";
 import type { ChatMsg } from "@/store/chat-store";
-import { Brain, User, Copy, Check } from "lucide-react";
+import { api } from "@/lib/api";
+import { Brain, User, Copy, Check, Share2, Link2, X } from "lucide-react";
 import { Button } from "@/components/ui/button";
 
 interface Props {
@@ -52,7 +53,10 @@ const markdownComponents: Components = {
 export default function MessageBubble({ message }: Props) {
   const isUser = message.role === "user";
   const [copied, setCopied] = useState(false);
+  const [shared, setShared] = useState(false);
+  const [shareFailed, setShareFailed] = useState(false);
   const copiedTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const sharedTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   const handleCopy = async () => {
     if (!message.content) return;
@@ -66,6 +70,31 @@ export default function MessageBubble({ message }: Props) {
     }
   };
 
+  const handleShare = async () => {
+    if (!message.content || message.isStreaming) return;
+
+    try {
+      const data = await api.post<{ message_id: string; share_url: string }>(
+        `/api/v1/chat/share/${message.id}`
+      );
+      await navigator.clipboard.writeText(`${window.location.origin}${data.share_url}`);
+      setShared(true);
+      setShareFailed(false);
+      if (sharedTimeoutRef.current) clearTimeout(sharedTimeoutRef.current);
+      sharedTimeoutRef.current = setTimeout(() => {
+        setShared(false);
+        setShareFailed(false);
+      }, 2000);
+    } catch {
+      setShareFailed(true);
+      setShared(false);
+      if (sharedTimeoutRef.current) clearTimeout(sharedTimeoutRef.current);
+      sharedTimeoutRef.current = setTimeout(() => {
+        setShareFailed(false);
+      }, 2000);
+    }
+  };
+
   return (
     <div
       className={`flex gap-3 py-3 animate-fade-in-up ${isUser ? "justify-end" : "justify-start"}`}
@@ -88,26 +117,50 @@ export default function MessageBubble({ message }: Props) {
         ) : (
           <>
             {message.content && (
-              <Button
-                type="button"
-                variant="ghost"
-                size="icon-xs"
-                className={`absolute top-2 right-2 text-muted-foreground hover:text-foreground transition-opacity ${
-                  copied
-                    ? "opacity-100"
-                    : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto"
-                }`}
-                onClick={handleCopy}
-                aria-label={copied ? "Copied" : "Copy response"}
-              >
-                {copied ? (
-                  <Check className="w-3.5 h-3.5 text-emerald-400" />
-                ) : (
-                  <Copy className="w-3.5 h-3.5" />
+              <>
+                {!message.isStreaming && (
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon-xs"
+                    className={`absolute top-2 right-2 text-muted-foreground hover:text-foreground transition-opacity ${
+                      shared || shareFailed
+                        ? "opacity-100"
+                        : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto"
+                    }`}
+                    onClick={handleShare}
+                    aria-label={shared ? "Link copied" : shareFailed ? "Share failed" : "Share response"}
+                  >
+                    {shared ? (
+                      <Link2 className="w-3.5 h-3.5 text-emerald-400" />
+                    ) : shareFailed ? (
+                      <X className="w-3.5 h-3.5 text-destructive" />
+                    ) : (
+                      <Share2 className="w-3.5 h-3.5" />
+                    )}
+                  </Button>
                 )}
-              </Button>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-xs"
+                  className={`absolute top-2 right-9 text-muted-foreground hover:text-foreground transition-opacity ${
+                    copied
+                      ? "opacity-100"
+                      : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto"
+                  }`}
+                  onClick={handleCopy}
+                  aria-label={copied ? "Copied" : "Copy response"}
+                >
+                  {copied ? (
+                    <Check className="w-3.5 h-3.5 text-emerald-400" />
+                  ) : (
+                    <Copy className="w-3.5 h-3.5" />
+                  )}
+                </Button>
+              </>
             )}
-            <div className={`prose-chat text-sm ${message.content ? "pr-7" : ""}`}>
+            <div className={`prose-chat text-sm ${message.content ? "pr-14" : ""}`}>
               {message.content ? (
                 <ReactMarkdown
                   remarkPlugins={[remarkGfm]}