Shareable CRE URLs stay the full graph; filter is session-only

Parent: #1079 · Pair with CRE-page apply-view ticket · Project: https://github.com/orgs/OWASP/projects/60

What

Public and shared links must not inherit a logged-in user’s profile.

https://www.opencre.org/cre/663-200 is a canonical node. Copy-paste from a filtered session must not surprise the recipient with a truncated graph, and crawlers/API clients must keep seeing the full node unless they explicitly ask.

Contract

• Anonymous GET /rest/v1/id/{id} (and HTML /cre/{id} with no session) returns the full graph
• Filtering is session-scoped (logged-in default view) or an explicit query (applyFilters / include_only / all=true)
• “Copy link” / share from a filtered CRE page either copies the canonical unfiltered URL, or copies an explicit filtered URL — pick one and document it in the UI
• Tests: anonymous full; logged-in filtered does not change the unauthenticated response for the same path

Why a separate ticket

Easy to implement the CRE-page filter by rewriting every /cre/… navigation to ?filters=…, which then leaks into Slack, GitHub, and AIX reference sections. Call that out in the CRE-page PR; this ticket owns the contract and tests.

Success

A colleague opening a pasted /cre/663-200 sees the same full node whether or not the sender had a profile filter on.

Start with the anonymous GET /rest/v1/id/{id} and HTML /cre/{id} entry points, then compare them with the logged-in filtered behavior. Add or update tests for anonymous full results and for filtered sessions not changing the unauthenticated response. Done means shared canonical links show the full node, while explicit filtering remains scoped or documented in the copy-link UI.