---
title: "Verify revoking a public share link removes anonymous access"
description: "Create a share link for a private fixture, prove anonymous access works, revoke it, and verify a fresh anonymous request no longer returns shared content."
canonical_url: "https://vostride.com/agent-library/authorization/share-link-revocation.md"
md_url: "https://vostride.com/agent-library/authorization/share-link-revocation.md"
content_kind: "recipe"
topic: "authorization"
---

# Verify revoking a public share link removes anonymous access

Create a share link for a private fixture, prove anonymous access works, revoke it, and verify a fresh anonymous request no longer returns shared content.

## Risk

Revocation must affect the link access path, not just remove a copied URL from the sharing dialog. Browser caches and already-open views need explicit treatment because they can retain previously delivered content without authorizing a new request.

## Fixtures

- A private test-owned document with a unique harmless content marker.
- A product-supported public sharing feature and a clean anonymous browser run.
- A share-record inspection hook and documented revocation propagation and caching rules.

## Steps

1. As the owner, enable public sharing and capture the generated URL; verify the sharing dialog identifies the document as shared.
2. In a signed-out run, open that link and verify the intended public document marker while private owner controls remain absent.
3. Revoke sharing as the owner and verify the dialog returns to its unshared state.
4. Open the revoked link through a fresh anonymous navigation after the documented propagation boundary; verify an unavailable or denied result without the document body.
5. Inspect share state through the registered hook and verify the link is disabled; separately record any already-open cached content according to policy.

## Expected results

- The enabled link exposes only the intended public document representation.
- Revocation prevents new anonymous access through the same link.
- The stored share record agrees with the owner interface revocation state.

## False-pass traps

- Testing only the sharing-dialog toggle misses a still-active public delivery route.
- Already delivered cached content should not be mistaken for a newly authorized server response.

## Cleanup

- Ensure public sharing is disabled and delete the run-owned document.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authorization and permission QA recipes](/agent-library/authorization.md)
- [Software factory QA library](/agent-library.md)