Create short links for credentials shared from the LCW web wallet #271

Request

Add a short ("pretty") option for the VerifierPlus link that the LCW web wallet offers when someone shares a credential. The existing long link stays, because it shows how wallet storage (WAS) works with V+.

Requested by Kerri Lemoie in a Slack thread with Sunny Lee and James.

Today

The LCW web wallet builds the link itself (lcw-front-end, src/components/ShareCredentialModal.tsx):

https://verifierplus.org/#verify?vc=https://was.lcw-sandbox.org/space/<space-id>/public/<file>

V+ fetches the WAS URL from the hash and verifies it. V+ stores nothing for this flow.

Decisions (agreed for MVP)

1. V+ creates the short links.
2. A short link works as long as the credential is shared. Short links point to the WAS URL, so once a credential is unshared, the short link stops working exactly like the long one. No expiry logic is needed.
3. Only our own storage can be shortened. The LCW web wallet only talks to one WAS (VITE_WAS_BASE_URL, currently https://was.lcw-sandbox.org). Keep the allowed hosts in config so more can be added later without a code change.
4. The wallet shows the short link in a new "Short link" box under the existing one. (Tracked in lcw-front-end.)
5. The wallet's QR code and "Add to LinkedIn" use the short link. (Tracked in lcw-front-end.)

Scope (V+)

• Create: POST /api/short-links with { "url": "<WAS public URL>" } returns { "id", "url": { "view": "/s/<id>" } }.
  • Reject non-https URLs and hosts that aren't in the allowed list (new env var, for example SHORT_LINK_ALLOWED_HOSTS, comma-separated).
  • The same URL returns the same short link (no duplicate rows).
  • Allow cross-origin calls from the LCW web wallet (see the CORS headers in app/api/proxy/route.ts).
• Open: GET /s/<id> redirects to /#verify?vc=<url>. An unknown ID shows a "link not found" message.
• Store: a new MongoDB collection that maps the short ID to the URL. Only the WAS URL is stored, not the credential.

Out of scope

• The LCW mobile app's public links (/credentials/<id>), which are unchanged.
• Storage providers other than our own WAS.

Acceptance criteria

• Creating a short link for an allowed WAS URL returns a short URL. Other hosts are rejected.
• Opening the short URL shows the same verification result as the long URL.
• After the credential is unshared in the wallet, the short URL behaves the same as the long URL.
• The existing long #verify?vc= link still works.

Note

Check whether the privacy policy (app/privacy/page.tsx) needs a line about storing short-link URLs.

A long #verify?vc= link whose credential can't be fetched (for example after Unshare) currently shows the home page with no error. Short links inherit this. It should get its own issue.