Secure send: the pages a person actually touches

plugins/tools/frontend/api.js

@@ -0,0 +1,23 @@
+// Tech Tools API client.
+//
+// Only secure send needs one - every other tool runs entirely in the browser
+// and talks to nothing.
+import api from '@/api'
+
+export const toolsApi = {
+  createSecret(payload) {
+    return api.post('/tools/secrets', payload)
+  },
+
+  // Is the link still live? Spends nothing, so it is safe for the read page to
+  // ask before anyone clicks.
+  peekSecret(token) {
+    return api.get(`/tools/secrets/${token}`)
+  },
+
+  // POST, not GET, and that is deliberate: chat and mail clients prefetch GET
+  // urls to build previews, and a preview must not consume a one-view secret.
+  redeemSecret(token) {
+    return api.post(`/tools/secrets/${token}`)
+  },
+}