Shareable CRE URLs stay the full graph; filter is session-only

[northdpole]

Parent: #1079 · Pair with CRE-page apply-view ticket · Project: https://github.com/orgs/OWASP/projects/60

What

Public and shared links must not inherit a logged-in user’s profile.

https://www.opencre.org/cre/663-200 is a canonical node. Copy-paste from a filtered session must not surprise the recipient with a truncated graph, and crawlers/API clients must keep seeing the full node unless they explicitly ask.

Contract

• Anonymous GET /rest/v1/id/{id} (and HTML /cre/{id} with no session) returns the full graph
• Filtering is session-scoped (logged-in default view) or an explicit query (applyFilters / include_only / all=true)
• “Copy link” / share from a filtered CRE page either copies the canonical unfiltered URL, or copies an explicit filtered URL — pick one and document it in the UI
• Tests: anonymous full; logged-in filtered does not change the unauthenticated response for the same path

Why a separate ticket

Easy to implement the CRE-page filter by rewriting every /cre/… navigation to ?filters=…, which then leaks into Slack, GitHub, and AIX reference sections. Call that out in the CRE-page PR; this ticket owns the contract and tests.

Success

A colleague opening a pasted /cre/663-200 sees the same full node whether or not the sender had a profile filter on.