Tech Tools reachable without a login

plugins/tools/frontend/views/SecureSendCreate.vue

@@ -17,13 +17,25 @@
       </p>
     </div>
 
+    <!-- A guest at a site that has not opened guest creation. Told here rather
+         than after typing a password into a form that was always going to be
+         refused. -->
+    <div v-if="supported && !mayCreate" class="card">
+      <p>Signing in is needed to create a secret link at this site.</p>
+      <p class="muted">
+        Receiving one never needs an account - if somebody sent you a link, open
+        that instead.
+      </p>
+      <router-link to="/login" class="btn btn-primary">Sign in</router-link>
+    </div>
+
     <div v-if="!supported" class="card control-note">
       This browser cannot encrypt in page (Web Crypto is unavailable, which
       usually means the site is not being served over HTTPS). Secure send needs
       it, because the whole point is that the server never sees your text.
     </div>
 
-    <template v-else-if="!link">
+    <template v-else-if="mayCreate && !link">
       <div class="card">
         <label class="field">
           <span class="field-label">Secret</span>
@@ -94,15 +106,29 @@
 </template>
 
 <script setup>
-import { ref, computed } from 'vue'
+import { ref, computed, onMounted } from 'vue'
 import { toolsApi } from '../api'
 import { withBase } from '@/utils/basePath'
-import { getSiteBaseUrl } from '@/utils/siteSettings'
+import { getSiteBaseUrl, getSetting } from '@/utils/siteSettings'
+import { useAuthStore } from '@/stores/auth'
 import {
   sealSecret, refuseReason, pasteCarriesFiles, cryptoAvailable, MAX_PLAINTEXT,
 } from '../securesend'
 
 const supported = cryptoAvailable()
+const auth = useAuthStore()
+
+// Whether THIS visitor can create one. A signed-in user always sees the form -
+// the server still enforces tools.secrets and says so if they lack it, which is
+// a different message from "sign in". A guest sees it only where the site has
+// opened guest creation.
+const mayCreate = ref(true)
+
+onMounted(async () => {
+  if (auth.isAuthenticated) return
+  const allowed = await getSetting('securesend_allow_guests', 'false')
+  mayCreate.value = String(allowed).toLowerCase() === 'true'
+})
 
 // Matches the server's ceiling. A free number rather than a dropdown because
 // "how many people need this password" is the sender's business - a shift