Tech Tools reachable without a login

plugins/tools/frontend/routes.js

@@ -15,22 +15,28 @@ export default [
     path: 'tools',
     name: 'tools',
     component: () => import('./views/ToolsIndex.vue'),
-    meta: { requiresAuth: true, plugin: 'tools' }
+    // NO requiresAuth. Every tool here is usable without an account: the label
+    // generator runs entirely in the browser, and secure send decides for
+    // itself (a site can let guests create, and receiving never needs a login).
+    // Gating the index turned a public tool into one nobody could reach.
+    meta: { plugin: 'tools' }
   },
   {
     path: 'tools/codes',
     name: 'tools-codes',
     component: () => import('./views/CodeGenerator.vue'),
-    meta: { requiresAuth: true, plugin: 'tools' }
+    // Browser-only: no API, no data, nothing to protect.
+    meta: { plugin: 'tools' }
   },
   {
     path: 'tools/secure-send',
     name: 'tools-secure-send',
     component: () => import('./views/SecureSendCreate.vue'),
-    // Creating a secret needs a login AND tools.secrets. The route guard covers
-    // the login; the server enforces the permission, and the page surfaces its
-    // refusal rather than pretending the form worked.
-    meta: { requiresAuth: true, plugin: 'tools' }
+    // Reachable by anyone; the SERVER decides who may actually create. A signed
+    // in user needs tools.secrets, and a guest needs the site to have turned on
+    // securesend_allow_guests. The page reads that setting so a guest who
+    // cannot create is told so, instead of being handed a form that 401s.
+    meta: { plugin: 'tools' }
   },
 ]