From b94b7bff01e6daab826ee923dd1dda17458e9a57 Mon Sep 17 00:00:00 2001
From: Thomas <28439359+thoda-dev@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:40:44 +0200
Subject: [PATCH] fix(create): prefill the form from the instance limits

---
 README.md                                     |  5 +++
 apps/app/app/app.vue                          | 17 +++++++---
 apps/app/app/composables/usePublicSettings.ts | 10 ++++++
 apps/app/app/pages/index.vue                  | 33 ++++++++++++++++---
 apps/app/i18n/locales/en.json                 |  3 ++
 apps/app/i18n/locales/fr.json                 |  3 ++
 apps/app/server/api/settings/public.get.ts    | 21 ++++++++++--
 7 files changed, 81 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index aba9c5f..470b76b 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,11 @@
 
 > Say it once. We'll forget.
 
+**[Try the demo](https://shhh.thoda.dev)** · **[Documentation](https://shhh-docs.thoda.dev)**
+
+The demo is a public instance with short retention and tight limits, reset without warning. Don't
+put anything in it you would mind losing.
+
 A self-hostable, zero-knowledge pastebin for sharing secrets — text and files — that expire on their
 own. The server stores ciphertext and nothing else: the decryption key lives in the URL fragment and
 is never sent to it.
diff --git a/apps/app/app/app.vue b/apps/app/app/app.vue
index d5411c8..e7ef9d1 100644
--- a/apps/app/app/app.vue
+++ b/apps/app/app/app.vue
@@ -1,10 +1,10 @@
 <template>
   <UApp>
     <NuxtRouteAnnouncer />
-    <!-- Upstream project, not the running instance: a fork is free to repoint it, but the link is
-         attribution. The URL and the "GitHub" label are deliberately kept out of i18n — a brand
-         name reads the same in every locale. -->
-    <div class="fixed top-4 left-4 z-50">
+    <!-- Upstream project and its documentation, not the running instance: a fork is free to repoint
+         both, but the links are attribution. "GitHub" stays out of i18n — a brand name reads the
+         same in every locale — while "Documentation" does not. -->
+    <div class="fixed top-4 left-4 z-50 flex items-center gap-1">
       <UButton
         variant="ghost"
         size="sm"
@@ -14,6 +14,15 @@
         target="_blank"
         rel="noopener noreferrer"
       />
+      <UButton
+        variant="ghost"
+        size="sm"
+        icon="i-lucide-book-open"
+        :label="$t('nav.documentation')"
+        href="https://shhh-docs.thoda.dev"
+        target="_blank"
+        rel="noopener noreferrer"
+      />
     </div>
     <div class="fixed top-4 right-4 z-50 flex items-center gap-2">
       <LanguageSwitcher />
diff --git a/apps/app/app/composables/usePublicSettings.ts b/apps/app/app/composables/usePublicSettings.ts
index 77effc1..f931ca0 100644
--- a/apps/app/app/composables/usePublicSettings.ts
+++ b/apps/app/app/composables/usePublicSettings.ts
@@ -4,6 +4,16 @@ export interface PublicSettings {
   require2fa: boolean
   mailEnabled: boolean
   maxEmailRecipients: number | null
+  limits: {
+    anonymous: TierLimits
+    authenticated: TierLimits
+  }
+}
+
+/** `null` means the instance sets no cap, which is the only case where "unlimited" may be offered. */
+export interface TierLimits {
+  maxRetentionDays: number | null
+  maxReads: number | null
 }
 
 // Same shape as `useAuth.ts`: one shared `useState` ref so the 2FA middleware and the creation form read the same value from a single request, loaded once per app lifecycle via `callOnce`.
diff --git a/apps/app/app/pages/index.vue b/apps/app/app/pages/index.vue
index 285039e..0acd2b8 100644
--- a/apps/app/app/pages/index.vue
+++ b/apps/app/app/pages/index.vue
@@ -24,10 +24,30 @@ const file = ref<File | null>(null)
 const passwordProtected = ref(false)
 const password = ref('')
 
+// The caps for the tier the visitor is actually in. Signing in mid-session changes them, hence the
+// computed rather than a value read once.
+const limits = computed(() =>
+  publicSettings.value?.limits[isAuthenticated.value ? 'authenticated' : 'anonymous']
+)
+
+// Prefilled with the instance's own cap rather than left blank behind a placeholder: it is both the
+// highest value the server accepts and exactly what it applies when the field is omitted, so what
+// the form shows is what the paste gets.
 const expiresInDaysInput = ref<number | null>(null)
 const unlimitedReads = ref(false)
 const maxReadsInput = ref<number | null>(null)
 
+// Offering "unlimited" where the instance caps reads only earns a 400 on submit — the server refuses
+// a null maxReads whenever a cap exists.
+const canChooseUnlimitedReads = computed(() => limits.value?.maxReads === null)
+
+watch(limits, (tier) => {
+  if (!tier) return
+  expiresInDaysInput.value = tier.maxRetentionDays
+  maxReadsInput.value = tier.maxReads
+  unlimitedReads.value = tier.maxReads === null
+}, { immediate: true })
+
 const turnstileToken = ref('')
 
 // Offered only at creation and only to authenticated users: it is the one moment the key may reach the server, and there is deliberately no way to share an existing paste.
@@ -145,9 +165,11 @@ function reset() {
   file.value = null
   passwordProtected.value = false
   password.value = ''
-  expiresInDaysInput.value = null
-  unlimitedReads.value = false
-  maxReadsInput.value = null
+  // Back to the instance's caps, not to blank: an empty field after the first paste would put the
+  // form right back in the state this prefill exists to avoid.
+  expiresInDaysInput.value = limits.value?.maxRetentionDays ?? null
+  maxReadsInput.value = limits.value?.maxReads ?? null
+  unlimitedReads.value = limits.value?.maxReads === null
   turnstileToken.value = ''
   shareByEmail.value = false
   recipientsInput.value = ''
@@ -304,7 +326,7 @@ function reset() {
               v-model.number="expiresInDaysInput"
               type="number"
               min="1"
-              :placeholder="t('create.instanceDefault')"
+              :max="limits?.maxRetentionDays ?? undefined"
               class="w-full"
             />
           </UFormField>
@@ -314,7 +336,7 @@ function reset() {
               v-model.number="maxReadsInput"
               type="number"
               min="1"
-              :placeholder="t('create.instanceDefault')"
+              :max="limits?.maxReads ?? undefined"
               class="w-full"
             />
             <UButton
@@ -327,6 +349,7 @@ function reset() {
           </UFormField>
         </div>
         <USwitch
+          v-if="canChooseUnlimitedReads"
           v-model="unlimitedReads"
           :label="t('create.unlimitedReads')"
         />
diff --git a/apps/app/i18n/locales/en.json b/apps/app/i18n/locales/en.json
index 1488d76..f2eb068 100644
--- a/apps/app/i18n/locales/en.json
+++ b/apps/app/i18n/locales/en.json
@@ -329,5 +329,8 @@
     "errors": {
       "generic": "Could not create the account."
     }
+  },
+  "nav": {
+    "documentation": "Documentation"
   }
 }
diff --git a/apps/app/i18n/locales/fr.json b/apps/app/i18n/locales/fr.json
index 9a7b574..95d0cf2 100644
--- a/apps/app/i18n/locales/fr.json
+++ b/apps/app/i18n/locales/fr.json
@@ -329,5 +329,8 @@
     "errors": {
       "generic": "Impossible de créer le compte."
     }
+  },
+  "nav": {
+    "documentation": "Documentation"
   }
 }
diff --git a/apps/app/server/api/settings/public.get.ts b/apps/app/server/api/settings/public.get.ts
index dd1ff81..53d619f 100644
--- a/apps/app/server/api/settings/public.get.ts
+++ b/apps/app/server/api/settings/public.get.ts
@@ -4,7 +4,11 @@ export default defineEventHandler(async () => {
     'public_paste_enabled',
     'registration_enabled',
     'require_2fa',
-    'max_email_recipients_per_paste'
+    'max_email_recipients_per_paste',
+    'max_retention_days_anonymous',
+    'max_retention_days_authenticated',
+    'max_reads_anonymous',
+    'max_reads_authenticated'
   ])
 
   return {
@@ -13,6 +17,19 @@ export default defineEventHandler(async () => {
     require2fa: settings.require_2fa,
     // Not an app_setting — derived from MAIL_PROVIDER. The form needs the flag; the provider's identity stays server-side.
     mailEnabled: isMailEnabled(),
-    maxEmailRecipients: settings.max_email_recipients_per_paste
+    maxEmailRecipients: settings.max_email_recipients_per_paste,
+    // The creation form needs the caps to prefill its fields and to stop offering "unlimited" where
+    // the instance refuses it. No secret either: a caller discovers the same numbers by tripping the
+    // 400 they produce. `null` means unlimited.
+    limits: {
+      anonymous: {
+        maxRetentionDays: settings.max_retention_days_anonymous,
+        maxReads: settings.max_reads_anonymous
+      },
+      authenticated: {
+        maxRetentionDays: settings.max_retention_days_authenticated,
+        maxReads: settings.max_reads_authenticated
+      }
+    }
   }
 })