81575e46ca
Reported: no Tools section in Settings. The setting existed in the database and had no page, which from a person's side is indistinguishable from the feature not existing. get_settings_defaults SEEDS a setting. get_settings_cards (ADR-010) is what puts it in the rail. Declaring only the first is a silent half-feature: nothing fails, no test notices, and the switch is unreachable. The page states the cost where the DECISION is made rather than in a document nobody opens - turn it on and it says a guest-created link records no creator, so the audit trail can say when and from where but never who. Admin-only, like every other settings page, because this one decides whether an unauthenticated caller may write to the site. Also caught while wiring it: the card asked for a 'shield' icon, which is not in the settings iconMap, so it would have rendered the fallback puzzle piece - the glyph that reads as "nobody chose this". Uses wrench, matching Tech Tools. The row still comes from `flask plugin upgrade-all`; the card appears either way, and without the row the page loads empty.
63 lines
2.5 KiB
JavaScript
63 lines
2.5 KiB
JavaScript
/**
|
|
* Tech Tools plugin routes.
|
|
*
|
|
* `default` = AppLayout child routes; `toplevel` = full-screen routes.
|
|
*
|
|
* The generator sits INSIDE the app shell, unlike the label pages in core.
|
|
* Those are toplevel because a print from inside AppLayout would put the
|
|
* sidebar on the label stock - which is true unless the print stylesheet says
|
|
* otherwise, and style.css now does: the shell is hidden at print time so only
|
|
* the labels reach the page. A tool someone spends ten minutes in wants the
|
|
* navigation; a one-shot print page does not.
|
|
*/
|
|
export default [
|
|
{
|
|
path: 'tools',
|
|
name: 'tools',
|
|
component: () => import('./views/ToolsIndex.vue'),
|
|
// NO requiresAuth. Every tool here is usable without an account: the label
|
|
// generator runs entirely in the browser, and secure send decides for
|
|
// itself (a site can let guests create, and receiving never needs a login).
|
|
// Gating the index turned a public tool into one nobody could reach.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
{
|
|
path: 'tools/codes',
|
|
name: 'tools-codes',
|
|
component: () => import('./views/CodeGenerator.vue'),
|
|
// Browser-only: no API, no data, nothing to protect.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
{
|
|
path: 'settings/secure-send',
|
|
name: 'secure-send-settings',
|
|
component: () => import('./views/SecureSendSettings.vue'),
|
|
// Admin, like every other settings page: this decides whether an
|
|
// unauthenticated caller may write to the site.
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'tools' }
|
|
},
|
|
{
|
|
path: 'tools/secure-send',
|
|
name: 'tools-secure-send',
|
|
component: () => import('./views/SecureSendCreate.vue'),
|
|
// Reachable by anyone; the SERVER decides who may actually create. A signed
|
|
// in user needs tools.secrets, and a guest needs the site to have turned on
|
|
// securesend_allow_guests. The page reads that setting so a guest who
|
|
// cannot create is told so, instead of being handed a form that 401s.
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
]
|
|
|
|
// PUBLIC and OUTSIDE AppLayout. The recipient of a secret usually has no account
|
|
// here, so this page carries no navigation and asks for no login - the
|
|
// unguessable token in the path, and the key in the fragment, are what let them
|
|
// read it. Short path because the whole link gets pasted into a chat message.
|
|
export const toplevel = [
|
|
{
|
|
path: '/s/:token',
|
|
name: 'secure-send-read',
|
|
component: () => import('./views/SecureSendRead.vue'),
|
|
meta: { plugin: 'tools' }
|
|
},
|
|
]
|