92cf1d71f0
/tools, /tools/codes and /tools/secure-send were all behind requiresAuth. None of them needed to be, and one of them actively contradicted a setting added an hour earlier: securesend_allow_guests lets somebody with no account create a link, and the page they would create it on was behind a login wall. The label generator runs entirely in the browser - no API, no data, nothing to protect - so gating it only ever cost a guest the use of it. THE SERVER STILL DECIDES who may create a secret. A signed-in user needs tools.secrets; a guest needs the site to have opened guest creation. Making the page reachable is not the same as making the action allowed, and the two were conflated. The page now reads the setting on load, so a guest at a site that has NOT opened guest creation is told to sign in instead of being handed a form that was always going to be refused - with a line saying that receiving a link never needs an account, because somebody who lands there confused usually has a link they should be opening instead. A signed-in user always sees the form, even without the permission: the server's "you do not have permission" is a different answer from "sign in", and collapsing them would send somebody to a login page they are already past.
55 lines
2.1 KiB
JavaScript
55 lines
2.1 KiB
JavaScript
/**
|
|
* Tech Tools plugin routes.
|
|
*
|
|
* `default` = AppLayout child routes; `toplevel` = full-screen routes.
|
|
*
|
|
* The generator sits INSIDE the app shell, unlike the label pages in core.
|
|
* Those are toplevel because a print from inside AppLayout would put the
|
|
* sidebar on the label stock - which is true unless the print stylesheet says
|
|
* otherwise, and style.css now does: the shell is hidden at print time so only
|
|
* the labels reach the page. A tool someone spends ten minutes in wants the
|
|
* navigation; a one-shot print page does not.
|
|
*/
|
|
export default [
|
|
{
|
|
path: 'tools',
|
|
name: 'tools',
|
|
component: () => import('./views/ToolsIndex.vue'),
|
|
// NO requiresAuth. Every tool here is usable without an account: the label
|
|
// generator runs entirely in the browser, and secure send decides for
|
|
// itself (a site can let guests create, and receiving never needs a login).
|
|
// Gating the index turned a public tool into one nobody could reach.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
{
|
|
path: 'tools/codes',
|
|
name: 'tools-codes',
|
|
component: () => import('./views/CodeGenerator.vue'),
|
|
// Browser-only: no API, no data, nothing to protect.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
{
|
|
path: 'tools/secure-send',
|
|
name: 'tools-secure-send',
|
|
component: () => import('./views/SecureSendCreate.vue'),
|
|
// Reachable by anyone; the SERVER decides who may actually create. A signed
|
|
// in user needs tools.secrets, and a guest needs the site to have turned on
|
|
// securesend_allow_guests. The page reads that setting so a guest who
|
|
// cannot create is told so, instead of being handed a form that 401s.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
]
|
|
|
|
// PUBLIC and OUTSIDE AppLayout. The recipient of a secret usually has no account
|
|
// here, so this page carries no navigation and asks for no login - the
|
|
// unguessable token in the path, and the key in the fragment, are what let them
|
|
// read it. Short path because the whole link gets pasted into a chat message.
|
|
export const toplevel = [
|
|
{
|
|
path: '/s/:token',
|
|
name: 'secure-send-read',
|
|
component: () => import('./views/SecureSendRead.vue'),
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
]
|