> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drdj.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Collaboration Routes

> Teams, users, shares, and external sharing pathways.

Collaboration behavior spans:

* `/server/routes/teams.ts`
* `/server/routes/users.ts`
* `/server/routes/shares.ts`
* `/server/routes/external-shares.ts`

## Responsibilities

* team-level access controls
* user assignment and visibility boundaries
* internal and external share lifecycle
* permission checks for shared resources

## Security Model Notes

* collaboration routes are high sensitivity
* share tokens/IDs must not leak private metadata
* role checks should be explicit and test-backed
* contacts and influencers use explicit opt-in team visibility on the dashboard:
  `scope=mine-and-shared` can include team-shared rows plus mutual indicators,
  while default list calls remain owner-only for extension and agent
  compatibility
* team-shared contacts and influencers are read-only until their write routes
  explicitly support delegated editing; influencer revenue and shared deal
  amounts stay hidden from non-owners
* deal notes remain owner-private on list, detail, Team Deals, and influencer
  history responses; private note text is also excluded from teammate and agent
  `mine-and-shared` searches
* contact notes remain private to the contact owner even when the contact record
  is visible to a team
* message and deal templates are private by default and become team-visible only
  through explicit `team_entity_shares` rows; shared deal template prices stay
  hidden from non-owners
* Team Deals and team-shared influencer detail deal histories honor approved
  sensitive-access grants from the normal deal detail request flow

## Required Validation

* integration tests for permission boundaries
* negative tests for unauthorized access
* verification of external share expiration/revocation behavior
* docs update when permission or sharing semantics change