/**
 * Tech Tools plugin routes.
 *
 * `default` = AppLayout child routes; `toplevel` = full-screen routes.
 *
 * The generator sits INSIDE the app shell, unlike the label pages in core.
 * Those are toplevel because a print from inside AppLayout would put the
 * sidebar on the label stock - which is true unless the print stylesheet says
 * otherwise, and style.css now does: the shell is hidden at print time so only
 * the labels reach the page. A tool someone spends ten minutes in wants the
 * navigation; a one-shot print page does not.
 */
export default [
  {
    path: 'tools',
    name: 'tools',
    component: () => import('./views/ToolsIndex.vue'),
    // NO requiresAuth. Every tool here is usable without an account: the label
    // generator runs entirely in the browser, and secure send decides for
    // itself (a site can let guests create, and receiving never needs a login).
    // Gating the index turned a public tool into one nobody could reach.
    meta: { plugin: 'tools' }
  },
  {
    path: 'tools/codes',
    name: 'tools-codes',
    component: () => import('./views/CodeGenerator.vue'),
    // Browser-only: no API, no data, nothing to protect.
    meta: { plugin: 'tools' }
  },
  {
    path: 'settings/secure-send',
    name: 'secure-send-settings',
    component: () => import('./views/SecureSendSettings.vue'),
    // Admin, like every other settings page: this decides whether an
    // unauthenticated caller may write to the site.
    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'tools' }
  },
  {
    path: 'tools/secure-send',
    name: 'tools-secure-send',
    component: () => import('./views/SecureSendCreate.vue'),
    // Reachable by anyone; the SERVER decides who may actually create. A signed
    // in user needs tools.secrets, and a guest needs the site to have turned on
    // securesend_allow_guests. The page reads that setting so a guest who
    // cannot create is told so, instead of being handed a form that 401s.
    meta: { plugin: 'tools' }
  },
]

// PUBLIC and OUTSIDE AppLayout. The recipient of a secret usually has no account
// here, so this page carries no navigation and asks for no login - the
// unguessable token in the path, and the key in the fragment, are what let them
// read it. Short path because the whole link gets pasted into a chat message.
export const toplevel = [
  {
    path: '/s/:token',
    name: 'secure-send-read',
    component: () => import('./views/SecureSendRead.vue'),
    meta: { plugin: 'tools' }
  },
]