OpenShock · ComputerElite · Jul 14, 2026
diff --git a/API/Controller/Shares/Links/AddShocker.cs b/API/Controller/Shares/Links/AddShocker.cs
@@ -2,6 +2,7 @@
 using Microsoft.EntityFrameworkCore;
 using OpenShock.Common.OpenShockDb;
 using System.Net.Mime;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Problems;
 using OpenShock.Common.Models;
@@ -19,6 +20,7 @@ public sealed partial class ShareLinksController
     /// <response code="404">Public share or shocker does not exist</response>
     /// <response code="409">Shocker already exists in public share</response>
     [HttpPost("{publicShareId}/{shockerId}")]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [ProducesResponseType<LegacyEmptyResponse>(StatusCodes.Status200OK, MediaTypeNames.Application.Json)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // PublicShareNotFound, ShockerNotFound
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status409Conflict, MediaTypeNames.Application.ProblemJson)] // ShockerAlreadyInPublicShare

diff --git a/API/Controller/Shares/Links/CreatePublicShare.cs b/API/Controller/Shares/Links/CreatePublicShare.cs
@@ -1,6 +1,7 @@
 using System.Net.Mime;
 using Microsoft.AspNetCore.Mvc;
 using OpenShock.API.Models.Requests;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Models;
 using OpenShock.Common.OpenShockDb;
@@ -14,6 +15,7 @@ public sealed partial class ShareLinksController
     /// </summary>
     /// <response code="200">The created public share</response>
     [HttpPost(Name = "CreatePublicShare")]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [Consumes(MediaTypeNames.Application.Json)]
     [ProducesResponseType<LegacyDataResponse<Guid>>(StatusCodes.Status200OK,  MediaTypeNames.Application.Json)]
     public async Task<IActionResult> CreatePublicShare([FromBody] PublicShareCreate body)

diff --git a/API/Controller/Shares/Links/DeletePublicShare.cs b/API/Controller/Shares/Links/DeletePublicShare.cs
@@ -1,10 +1,12 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using System.Net.Mime;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Problems;
 using OpenShock.Common.Models;
 using OpenShock.Common.Extensions;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Shares.Links;
 
@@ -17,6 +19,7 @@ public sealed partial class ShareLinksController
     /// <response code="200">Deleted public share</response>
     /// <response code="404">Public share not found or does not belong to you</response>
     [HttpDelete("{publicShareId}")]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [ProducesResponseType<LegacyEmptyResponse>(StatusCodes.Status200OK, MediaTypeNames.Application.Json)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // PublicShareNotFound
     public async Task<IActionResult> DeletePublicShare([FromRoute] Guid publicShareId)

diff --git a/API/Controller/Shares/Links/EditShocker.cs b/API/Controller/Shares/Links/EditShocker.cs
@@ -2,7 +2,9 @@
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Models.Requests;
 using System.Net.Mime;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
+using OpenShock.Common.OpenShockDb;
 using OpenShock.Common.Problems;
 
 namespace OpenShock.API.Controller.Shares.Links;
@@ -20,6 +22,7 @@ public sealed partial class ShareLinksController
     /// <response code="400">Shocker does not exist in public share</response>
     [HttpPatch("{publicShareId}/{shockerId}")]
     [Consumes(MediaTypeNames.Application.Json)]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [ProducesResponseType<string>(StatusCodes.Status200OK, MediaTypeNames.Text.Plain)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // PublicShareNotFound, ShockerNotInPublicShare
     public async Task<IActionResult> EditShocker([FromRoute] Guid publicShareId, [FromRoute] Guid shockerId, [FromBody] PublicShareEditShocker body)

diff --git a/API/Controller/Shares/Links/List.cs b/API/Controller/Shares/Links/List.cs
@@ -2,7 +2,9 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Models.Response;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Models;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Shares.Links;
 
@@ -13,6 +15,7 @@ public sealed partial class ShareLinksController
     /// </summary>
     /// <response code="200">All public shares for the current user</response>
     [HttpGet]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [ProducesResponseType<LegacyDataResponse<OwnPublicShareResponse[]>>(StatusCodes.Status200OK, MediaTypeNames.Application.Json)]
     public IActionResult List()
     {

diff --git a/API/Controller/Shares/Links/PauseShocker.cs b/API/Controller/Shares/Links/PauseShocker.cs
@@ -4,7 +4,9 @@
 using OpenShock.API.Utils;
 using OpenShock.Common.Models;
 using System.Net.Mime;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
+using OpenShock.Common.OpenShockDb;
 using OpenShock.Common.Problems;
 
 namespace OpenShock.API.Controller.Shares.Links;
@@ -22,6 +24,7 @@ public sealed partial class ShareLinksController
     /// <response code="400">Shocker does not exist in public share</response>
     [HttpPost("{publicShareId}/{shockerId}/pause")]
     [Consumes(MediaTypeNames.Application.Json)]
+    [TokenPermission(PermissionType.Publicshares_Pause)]
     [ProducesResponseType<LegacyDataResponse<PauseReason>>(StatusCodes.Status200OK, MediaTypeNames.Application.Json)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // PublicShareNotFound, ShockerNotInPublicShare
     public async Task<IActionResult> PauseShocker([FromRoute] Guid publicShareId, [FromRoute] Guid shockerId, [FromBody] PauseRequest body)

diff --git a/API/Controller/Shares/Links/RemoveShocker.cs b/API/Controller/Shares/Links/RemoveShocker.cs
@@ -1,10 +1,12 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using System.Net.Mime;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Problems;
 using OpenShock.Common.Models;
 using OpenShock.Common.Extensions;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Shares.Links;
 
@@ -19,6 +21,7 @@ public sealed partial class ShareLinksController
     /// <response code="404">Public share or shocker does not exist</response>
     /// <response code="400">Shocker does not exist in public share</response>
     [HttpDelete("{publicShareId}/{shockerId}")]
+    [TokenPermission(PermissionType.Publicshares_Edit)]
     [ProducesResponseType<LegacyEmptyResponse>(StatusCodes.Status200OK, MediaTypeNames.Application.Json)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // PublicShareNotFound, ShockerNotInPublicShare
     public async Task<IActionResult> RemoveShocker([FromRoute] Guid publicShareId, [FromRoute] Guid shockerId)

diff --git a/API/Controller/Shares/Links/_ApiController.cs b/API/Controller/Shares/Links/_ApiController.cs
@@ -12,7 +12,7 @@ namespace OpenShock.API.Controller.Shares.Links;
 [ApiController]
 [Tags("Public Shocker Shares")]
 [Route("/{version:apiVersion}/shares/links")]
-[Authorize(AuthenticationSchemes = OpenShockAuthSchemes.UserSessionCookie)]
+[Authorize(AuthenticationSchemes = OpenShockAuthSchemes.UserSessionApiTokenCombo)]
 public sealed partial class ShareLinksController : AuthenticatedSessionControllerBase
 {
     private readonly OpenShockContext _db;

diff --git a/API/Controller/Shares/UserShares/CreateShareInvite.cs b/API/Controller/Shares/UserShares/CreateShareInvite.cs
@@ -3,6 +3,7 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Models.Requests;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.OpenShockDb;
 using OpenShock.Common.Problems;
@@ -15,6 +16,7 @@ public sealed partial class UserSharesController
     [HttpPost("invites")]
     [Consumes(MediaTypeNames.Application.Json)]
     [ProducesResponseType<Guid>(StatusCodes.Status200OK, MediaTypeNames.Text.Plain)]
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // UserNotFound, ShareCreateShockerNotFound
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status400BadRequest, MediaTypeNames.Application.ProblemJson)] // ShareCreateCannotShareWithSelf
     [MapToApiVersion("2")]

diff --git a/API/Controller/Shares/UserShares/GetShares.cs b/API/Controller/Shares/UserShares/GetShares.cs
@@ -3,6 +3,8 @@
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Models.Response;
 using OpenShock.API.Utils;
+using OpenShock.Common.Authentication.Attributes;
+using OpenShock.Common.OpenShockDb;
 using OpenShock.Common.Utils;
 using Z.EntityFramework.Plus;
 
@@ -29,6 +31,7 @@ public sealed partial class UserSharesController
 {
     [HttpGet]
     [MapToApiVersion("2")]
+    [TokenPermission(PermissionType.Usershares_Edit)]
     public async Task<V2UserShares> GetSharesByUsers(CancellationToken cancellationToken)
     {
         var outgoingSharesFuture = _db.UserShares

diff --git a/API/Controller/Shares/UserShares/Invites.cs b/API/Controller/Shares/UserShares/Invites.cs
@@ -6,6 +6,7 @@
 using OpenShock.API.Models.Response;
 using OpenShock.API.Services.DeviceUpdate;
 using OpenShock.API.Utils;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Extensions;
 using OpenShock.Common.Models;
@@ -58,6 +59,7 @@ file static class QueryHelper
 public sealed partial class UserSharesController
 {
     [HttpGet("invites/outgoing")]
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [MapToApiVersion("2")]
     public IAsyncEnumerable<ShareInviteBaseDetails> GetOutgoingInvitesList()
     {
@@ -68,6 +70,7 @@ public IAsyncEnumerable<ShareInviteBaseDetails> GetOutgoingInvitesList()
     }
 
     [HttpGet("invites/incoming")]
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [MapToApiVersion("2")]
     public IAsyncEnumerable<ShareInviteBaseDetails> GetIncomingInvitesList()
     {
@@ -80,6 +83,7 @@ public IAsyncEnumerable<ShareInviteBaseDetails> GetIncomingInvitesList()
     [HttpDelete("invites/outgoing/{inviteId}")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // ShareRequestNotFound
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [MapToApiVersion("2")]
     public async Task<IActionResult> DeleteOutgoingInvite([FromRoute] Guid inviteId)
     {
@@ -94,6 +98,7 @@ public async Task<IActionResult> DeleteOutgoingInvite([FromRoute] Guid inviteId)
     [HttpDelete("invites/incoming/{inviteId}")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // ShareRequestNotFound
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [MapToApiVersion("2")]
     public async Task<IActionResult> DenyIncomingInvite([FromRoute] Guid inviteId)
     {
@@ -114,6 +119,7 @@ public async Task<IActionResult> DenyIncomingInvite([FromRoute] Guid inviteId)
     [HttpPost("invites/incoming/{inviteId}")]
     [ProducesResponseType<V2UserSharesListItem>(StatusCodes.Status200OK)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status404NotFound, MediaTypeNames.Application.ProblemJson)] // ShareRequestNotFound
+    [TokenPermission(PermissionType.Usershares_Edit)]
     [MapToApiVersion("2")]
     public async Task<IActionResult> RedeemInvite([FromRoute] Guid inviteId, [FromServices] IDeviceUpdateService deviceUpdateService)
     {

diff --git a/API/Controller/Shares/UserShares/PauseShockerShares.cs b/API/Controller/Shares/UserShares/PauseShockerShares.cs
@@ -4,14 +4,17 @@
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Services.DeviceUpdate;
 using OpenShock.API.Utils;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Models;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Shares.UserShares;
 
 public sealed partial class UserSharesController
 {
     [HttpPost("{userId:guid}/shockers/pause")]
+    [TokenPermission(PermissionType.Usershares_Pause)]
     [MapToApiVersion("2")]
     [ProducesResponseType<PauseUserShareShockersResponse>(StatusCodes.Status200OK)]
     public async Task<IActionResult> BulkPauseUserShareShockers(

diff --git a/API/Controller/Shares/UserShares/RemoveShockerShares.cs b/API/Controller/Shares/UserShares/RemoveShockerShares.cs
@@ -3,15 +3,18 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using OpenShock.API.Services.DeviceUpdate;
+using OpenShock.Common.Authentication.Attributes;
 using OpenShock.Common.Errors;
 using OpenShock.Common.Models;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Shares.UserShares;
 
 public sealed partial class UserSharesController
 {
     [HttpDelete("{userId:guid}/shockers")]
     [MapToApiVersion("2")]
+    [TokenPermission(PermissionType.Shockers_Edit)]
     [ProducesResponseType<RemoveUserSharesResponse>(StatusCodes.Status200OK)]
     public async Task<IActionResult> BulkRemoveUserShareShockers([FromRoute] Guid userId , [FromBody] [MinLength(1)] Guid[] shockerIds, [FromServices] IDeviceUpdateService deviceUpdateService)
     {

diff --git a/API/Controller/Shares/UserShares/_ApiController.cs b/API/Controller/Shares/UserShares/_ApiController.cs
@@ -14,7 +14,7 @@ namespace OpenShock.API.Controller.Shares.UserShares;
 [Tags("User Shocker Shares")]
 [ApiVersion("2")]
 [Route("/{version:apiVersion}/shares/user")]
-[Authorize(AuthenticationSchemes = OpenShockAuthSchemes.UserSessionCookie)]
+[Authorize(AuthenticationSchemes = OpenShockAuthSchemes.UserSessionApiTokenCombo)]
 public sealed partial class UserSharesController : AuthenticatedSessionControllerBase
 {
     private readonly OpenShockContext _db;