From b9ec7d394e88052e45072b3de8ba788e72a18009 Mon Sep 17 00:00:00 2001
From: Soham Sen <contact@sohamsen.me>
Date: Fri, 29 Mar 2024 17:10:57 +0530
Subject: [PATCH] Add option to disable anonymous pastes

---
 .env.example                             |  1 +
 README.md                                |  2 +
 src/routes/(auth)/logout/+page.server.ts |  4 +-
 src/routes/+page.svelte                  | 77 +++++++++++++++---------
 src/routes/api/paste/+server.ts          | 12 ++++
 5 files changed, 65 insertions(+), 31 deletions(-)

diff --git a/.env.example b/.env.example
index 52936a9..bdb44a2 100644
--- a/.env.example
+++ b/.env.example
@@ -19,5 +19,6 @@ MAIL_FROM=YABin <yabin@sohamsen.me>
 
 PUBLIC_REGISTRATION_ENABLED=true
 PUBLIC_CUSTOM_PATHS_ENABLED=true
+PUBLIC_ANONYMOUS_PASTES_ENABLED=true
 PUBLIC_URL=http://localhost:5173
 ORIGIN=http://localhost:5173
diff --git a/README.md b/README.md
index 6fdc6d4..542149a 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,8 @@ You can disable or enable public registration by modifying the `PUBLIC_REGISTRAT
 
 You can enable custom paste paths for everyone with the variable `PUBLIC_CUSTOM_PATHS_ENABLED`. If it is `false`, only users who are logged in can use custom paths.
 
+You can disable anonymous pastes by setting `PUBLIC_ANONYMOUS_PASTES_ENABLED` to `false`.
+
 By default, if no e-mail services are configured, all user accounts will be marked as validated. To enable e-mail validation, please configure the `MAIL_*` variables.
 
 #### Locally
diff --git a/src/routes/(auth)/logout/+page.server.ts b/src/routes/(auth)/logout/+page.server.ts
index 515cd0d..e1be2c3 100644
--- a/src/routes/(auth)/logout/+page.server.ts
+++ b/src/routes/(auth)/logout/+page.server.ts
@@ -2,13 +2,13 @@ import { redirect, type Actions } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 
 export const load: PageServerLoad = async ({ cookies }) => {
-    /* @migration task: add path argument */ cookies.delete('token');
+    cookies.delete('token', { path: '/' });
     redirect(303, '/');
 };
 
 export const actions: Actions = {
     default({ cookies }) {
-        cookies.delete('token');
+        cookies.delete('token', { path: '/' });
         redirect(303, '/');
     },
 };
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index e25b3e5..06b6897 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -14,6 +14,7 @@
     import { env } from '$env/dynamic/public';
     import type { PageData } from './$types';
     import { DHMToSeconds, secondsToDHM } from '$lib/utils/time';
+    import { PUBLIC_ANONYMOUS_PASTES_ENABLED } from '$env/static/public';
 
     export let data: PageData;
 
@@ -195,18 +196,22 @@
             spellcheck="false"
             bind:value={content}
             bind:this={inputRef}
+            disabled={env.PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' &&
+                !data.loggedIn}
         />
         <div
             class="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 text-center text-lg -z-10 opacity-40 hidden"
             class:hidden={content}
             bind:this={placeholderRef}
         >
-            Type or paste anything here, and then {cmdKey}+S to save.
+            {#if PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !data.loggedIn}
+                Anonymous pastes are disabled on this server. <br />
+                You need to login to save pastes.
+            {:else}
+                Type or paste anything here, and then {cmdKey}+S to save.
+            {/if}
             <br /><br />
             Visit Info page to get the APIs and more.
-            <br /><br />
-            You can support this project and get a custom subdomain and custom styles
-            (and text!) by going to the Info page.
         </div>
     </div>
     <div
@@ -217,13 +222,23 @@
         <div class="flex flex-col items-center gap-4">
             <h1 class="text-4xl mb-5 max-sm:hidden"><a href="/">YABin</a></h1>
 
-            <button
-                class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
-                title="{cmdKey}+S"
-                on:click={save}
-            >
-                Save
-            </button>
+            {#if PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !data.loggedIn}
+                <button
+                    class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
+                    title="{cmdKey}+S"
+                    on:click={() => goto('/login')}
+                >
+                    Login
+                </button>
+            {:else}
+                <button
+                    class="bg-amber-500 text-black text-lg px-4 py-1 my-1 w-full max-sm:hidden"
+                    title="{cmdKey}+S"
+                    on:click={save}
+                >
+                    Save
+                </button>
+            {/if}
 
             <div class="flex flex-row gap-4 justify-center">
                 <button
@@ -242,29 +257,33 @@
                 </button>
             </div>
 
-            <div class="flex flex-row gap-4 mb-4 justify-center">
-                {#if data.loggedIn}
-                    <a
-                        href="/dashboard/settings"
-                        class="underline underline-offset-4 py-1">Dashboard</a
-                    >
-                    <form action="/logout" method="post">
-                        <button class="underline underline-offset-4 py-1"
-                            >Logout</button
+            {#if env.PUBLIC_ANONYMOUS_PASTES_ENABLED !== 'false' || data.loggedIn}
+                <div class="flex flex-row gap-4 mb-4 justify-center">
+                    {#if data.loggedIn}
+                        <a
+                            href="/dashboard/settings"
+                            class="underline underline-offset-4 py-1"
+                            >Dashboard</a
                         >
-                    </form>
-                {:else}
-                    <a class="underline underline-offset-4 py-1" href="/login"
-                        >Login</a
-                    >
-                    {#if env.PUBLIC_REGISTRATION_ENABLED == 'true'}
+                        <form action="/logout" method="post">
+                            <button class="underline underline-offset-4 py-1"
+                                >Logout</button
+                            >
+                        </form>
+                    {:else}
                         <a
                             class="underline underline-offset-4 py-1"
-                            href="/register">Register</a
+                            href="/login">Login</a
                         >
+                        {#if env.PUBLIC_REGISTRATION_ENABLED == 'true'}
+                            <a
+                                class="underline underline-offset-4 py-1"
+                                href="/register">Register</a
+                            >
+                        {/if}
                     {/if}
-                {/if}
-            </div>
+                </div>
+            {/if}
 
             <Select
                 class="px-1 py-1"
diff --git a/src/routes/api/paste/+server.ts b/src/routes/api/paste/+server.ts
index 01901a6..1a57b5a 100644
--- a/src/routes/api/paste/+server.ts
+++ b/src/routes/api/paste/+server.ts
@@ -59,6 +59,18 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 
     const userId = await getUserIdFromCookie(cookies);
 
+    if (env.PUBLIC_ANONYMOUS_PASTES_ENABLED === 'false' && !userId) {
+        return json(
+            {
+                success: false,
+                error: 'Anonymous pastes are disabled',
+            } as PasteCreateResponse,
+            {
+                status: 403,
+            },
+        );
+    }
+
     let key: string | undefined = undefined;
     if (
         config?.customPath &&