Secure send: the pages a person actually touches

plugins/tools/frontend/routes.js

@@ -23,4 +23,26 @@ export default [
     component: () => import('./views/CodeGenerator.vue'),
     meta: { requiresAuth: true, plugin: 'tools' }
   },
+  {
+    path: 'tools/secure-send',
+    name: 'tools-secure-send',
+    component: () => import('./views/SecureSendCreate.vue'),
+    // Creating a secret needs a login AND tools.secrets. The route guard covers
+    // the login; the server enforces the permission, and the page surfaces its
+    // refusal rather than pretending the form worked.
+    meta: { requiresAuth: true, plugin: 'tools' }
+  },
+]
+
+// PUBLIC and OUTSIDE AppLayout. The recipient of a secret usually has no account
+// here, so this page carries no navigation and asks for no login - the
+// unguessable token in the path, and the key in the fragment, are what let them
+// read it. Short path because the whole link gets pasted into a chat message.
+export const toplevel = [
+  {
+    path: '/s/:token',
+    name: 'secure-send-read',
+    component: () => import('./views/SecureSendRead.vue'),
+    meta: { plugin: 'tools' }
+  },
 ]