Add option to disable anonymous pastes

.env.example

@@ -19,5 +19,6 @@ MAIL_FROM=YABin <[email protected]>
 
 PUBLIC_REGISTRATION_ENABLED=true
 PUBLIC_CUSTOM_PATHS_ENABLED=true
+PUBLIC_ANONYMOUS_PASTES_ENABLED=true
 PUBLIC_URL=http:https://localhost:5173
 ORIGIN=http:https://localhost:5173

README.md

@@ -68,6 +68,8 @@ You can disable or enable public registration by modifying the `PUBLIC_REGISTRAT
 
 You can enable custom paste paths for everyone with the variable `PUBLIC_CUSTOM_PATHS_ENABLED`. If it is `false`, only users who are logged in can use custom paths.
 
+You can disable anonymous pastes by setting `PUBLIC_ANONYMOUS_PASTES_ENABLED` to `false`.
+
 By default, if no e-mail services are configured, all user accounts will be marked as validated. To enable e-mail validation, please configure the `MAIL_*` variables.
 
 #### Locally

src/routes/(auth)/logout/+page.server.ts

@@ -2,13 +2,13 @@ import { redirect, type Actions } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 
 export const load: PageServerLoad = async ({ cookies }) => {
- /* @migration task: add path argument */ cookies.delete('token');
+ cookies.delete('token', { path: '/' });
  redirect(303, '/');
 };
 
 export const actions: Actions = {
  default({ cookies }) {
- cookies.delete('token');
+ cookies.delete('token', { path: '/' });
  redirect(303, '/');
  },
 };

src/routes/+page.svelte

@@ -14,6 +14,7 @@
  import { env } from '$env/dynamic/public';
  import type { PageData } from './$types';
  import { DHMToSeconds, secondsToDHM } from '$lib/utils/time';
+ import { PUBLIC_ANONYMOUS_PASTES_ENABLED } from '$env/static/public';
 
  export let data: PageData;
 
@@ -195,18 +196,22 @@
  spellcheck="false"
  bind:value={content}
  bind:this={inputRef}
+ disabled={env.PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' &&
+ !data.loggedIn}
  />
  <div
  class="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 text-center text-lg -z-10 opacity-40 hidden"
  class:hidden={content}
  bind:this={placeholderRef}
  >
- Type or paste anything here, and then {cmdKey}+S to save.
+ {#if PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !data.loggedIn}
+ Anonymous pastes are disabled on this server. <br />
+ You need to login to save pastes.
+ {:else}
+ Type or paste anything here, and then {cmdKey}+S to save.
+ {/if}
  <br /><br />
  Visit Info page to get the APIs and more.
- <br /><br />
- You can support this project and get a custom subdomain and custom styles
- (and text!) by going to the Info page.
  </div>
  </div>
  <div
@@ -217,13 +222,23 @@
  <div class="flex flex-col items-center gap-4">
  <h1 class="text-4xl mb-5 max-sm:hidden"><a href="/">YABin</a></h1>
 
- <button
- class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
- title="{cmdKey}+S"
- on:click={save}
- >
- Save
- </button>
+ {#if PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !data.loggedIn}
+ <button
+ class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
+ title="{cmdKey}+S"
+ on:click={() => goto('/login')}
+ >
+ Login
+ </button>
+ {:else}
+ <button
+ class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
+ title="{cmdKey}+S"
+ on:click={save}
+ >
+ Save
+ </button>
+ {/if}
 
  <div class="flex flex-row gap-4 justify-center">
  <button
@@ -242,29 +257,33 @@
  </button>
  </div>
 
- <div class="flex flex-row gap-4 mb-4 justify-center">
- {#if data.loggedIn}
- <a
- href="/dashboard/settings"
- class="underline underline-offset-4 py-1">Dashboard</a
- >
- <form action="/logout" method="post">
- <button class="underline underline-offset-4 py-1"
- >Logout</button
+ {#if env.PUBLIC_ANONYMOUS_PASTES_ENABLED !== 'false' || data.loggedIn}
+ <div class="flex flex-row gap-4 mb-4 justify-center">
+ {#if data.loggedIn}
+ <a
+ href="/dashboard/settings"
+ class="underline underline-offset-4 py-1"
+ >Dashboard</a
  >
- </form>
- {:else}
- <a class="underline underline-offset-4 py-1" href="/login"
- >Login</a
- >
- {#if env.PUBLIC_REGISTRATION_ENABLED == 'true'}
+  <form action="/logout" method="post">
+  <button class="underline underline-offset-4 py-1"
+  >Logout</button
+  >
+  </form>
+ {:else}
  <a
  class="underline underline-offset-4 py-1"
- href="/register">Register</a
+ href="/login">Login</a
  >
+ {#if env.PUBLIC_REGISTRATION_ENABLED == 'true'}
+ <a
+ class="underline underline-offset-4 py-1"
+ href="/register">Register</a
+ >
+ {/if}
  {/if}
- {/if}
- </div>
+ </div>
+ {/if}
 
  <Select
  class="px-1 py-1"

src/routes/api/paste/+server.ts

@@ -59,6 +59,18 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 
  const userId = await getUserIdFromCookie(cookies);
 
+ if (env.PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !userId) {
+ return json(
+ {
+ success: false,
+ error: 'Anonymous pastes are disabled',
+ } as PasteCreateResponse,
+ {
+ status: 403,
+ },
+ );
+ }
+
  let key: string | undefined = undefined;
  if (
  config?.customPath &&