Let shared chats view message sources too

[avishek0769]

Summary:
Make the “View sources” action work for shared chats as well as private chats.

Why:
SharedChatPage reuses the same getMessageSources(messageId) call as the private chat page, but the backend route GET /message/sources/:messageId is protected by verifyStrictJWT. A public viewer can see the conversation history, yet the source panel stays empty or fails when they click “View sources”, which removes one of the main trust features of the app.

Files to change:

• backend/controllers/chatMessage.controller.js
• backend/routers/chatMessage.route.js
• src/pages/SharedChatPage.tsx
• src/lib/api.ts

Acceptance criteria:

• Shared chat viewers can fetch the sources for a message without signing in.
• Private chats still do not leak sources to unrelated users.
• The shared chat UI shows the same source cards/links as the private chat UI.

Implementation notes:

• Add a share-token-aware source path, or extend the controller to accept a public/shared context.
• Keep the response shape identical so the frontend can reuse the same rendering path.

[shineetejol9]

I'd like to work on this issue under ssoc 2026, Please assign this to me

[NouhanDoumbouya]

Hi @avishek0769, I’m an SSoC 2026 contributor and I’d like to work on this issue if it is still available.

I noticed there was earlier interest in this issue, but it currently appears unassigned. I recently had a PR merged in DocChat, and I’d like to continue contributing to the project. I’ll review the related files, understand the current flow, and submit a clean PR following the project guidelines.

Could you please assign this issue to me if it is available?

[avishek0769]

@NouhanDoumbouya Assigned