fix: burn-after-read creator bypass — show share panel instead of navigating

When a paste is created with burn_after_read enabled, redirect to the
paste view was consuming the burn before the recipient could open it.

Fix: after creating a burn paste, the creator never navigates to the
view page. Instead, paste_create.js swaps the editor for a centered
'Burn link ready' share panel showing the full URL (with key fragment)
pre-selected in a monospace input and a Copy button. The editor and nav
controls are hidden. A 'Create another' link returns to a fresh editor.

The first person to actually open the URL is always the intended
recipient, who triggers the burn as designed.

static/css/style.css

@@ -629,3 +629,68 @@ pre[class*="language-"], code[class*="language-"] {
     to   { opacity: 1; transform: translateY(0); }
 }
 
+/* ── Burn share panel (shown after creating a burn paste) ─────────────── */
+.burn-share-panel {
+    flex: 1;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: var(--bg);
+    padding: 2rem 1rem;
+}
+.burn-share-inner {
+    width: 100%;
+    max-width: 520px;
+    text-align: center;
+}
+.burn-share-icon {
+    font-size: 2rem;
+    color: #d97706;
+    margin-bottom: 1rem;
+    line-height: 1;
+}
+[data-theme="dark"] .burn-share-icon {
+    color: #f59e0b;
+}
+.burn-share-title {
+    font-size: 1.25rem;
+    font-weight: 700;
+    margin-bottom: 0.5rem;
+    color: var(--text);
+}
+.burn-share-desc {
+    font-size: 0.85rem;
+    color: var(--text-sub);
+    margin-bottom: 1.5rem;
+    line-height: 1.6;
+}
+.burn-share-link-row {
+    display: flex;
+    gap: 0.5rem;
+    margin-bottom: 1.25rem;
+}
+.burn-share-url {
+    flex: 1;
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    color: var(--text);
+    font-family: var(--mono);
+    font-size: 0.8rem;
+    padding: 0.4rem 0.6rem;
+    outline: none;
+    min-width: 0;
+}
+.burn-share-url:focus {
+    border-color: #d97706;
+}
+[data-theme="dark"] .burn-share-url:focus {
+    border-color: #f59e0b;
+}
+.burn-share-actions {
+    display: flex;
+    justify-content: center;
+    gap: 0.75rem;
+}
+
+

static/js/paste_create.js

@@ -202,7 +202,16 @@ document.addEventListener('DOMContentLoaded', function () {
                 if (result.deletion_token) {
                     localStorage.setItem('del_' + result.paste_id, result.deletion_token);
                 }
-                window.location.href = result.url + (keyBase64 ? '#' + keyBase64 : '');
+
+                const shareUrl = window.location.origin + result.url + (keyBase64 ? '#' + keyBase64 : '');
+
+                if (burn_after_read) {
+                    // Don't navigate — creator must NOT open the paste or it burns.
+                    // Show a share panel so they can copy the link and hand it to the recipient.
+                    showBurnSharePanel(shareUrl);
+                } else {
+                    window.location.href = shareUrl;
+                }
             }
         } catch (err) {
             console.error(err);
@@ -211,4 +220,36 @@ document.addEventListener('DOMContentLoaded', function () {
             submitBtn.textContent = 'Save';
         }
     }
+
+    function showBurnSharePanel(url) {
+        // Hide the editor so the user can't accidentally re-submit
+        const editorEl = document.getElementById('content');
+        if (editorEl) editorEl.style.display = 'none';
+        // Hide nav controls (keep theme toggle visible)
+        document.querySelectorAll('.nav-links > *:not(.theme-toggle)').forEach(el => {
+            el.style.visibility = 'hidden';
+        });
+
+        // Populate and show the panel
+        const panel  = document.getElementById('burnSharePanel');
+        const urlEl  = document.getElementById('burnShareUrl');
+        const copyEl = document.getElementById('burnShareCopy');
+        if (!panel || !urlEl || !copyEl) return;
+
+        urlEl.value = url;
+        panel.style.display = 'flex';
+
+        // Auto-select the URL for easy manual copying
+        urlEl.focus();
+        urlEl.select();
+
+        copyEl.addEventListener('click', async () => {
+            const ok = typeof copyToClipboard === 'function'
+                ? await copyToClipboard(url)
+                : await navigator.clipboard?.writeText(url).then(() => true).catch(() => false);
+            const prev = copyEl.textContent;
+            copyEl.textContent = ok ? 'Copied!' : 'Failed';
+            setTimeout(() => { copyEl.textContent = prev; }, 1800);
+        });
+    }
 });

templates/index.html

@@ -56,6 +56,20 @@
     autocomplete="off"
     autocorrect="off"
     autocapitalize="off"></textarea>
+<div id="burnSharePanel" class="burn-share-panel" style="display:none" aria-live="polite">
+    <div class="burn-share-inner">
+        <div class="burn-share-icon">&#x25A0;</div>
+        <h2 class="burn-share-title">Burn link ready</h2>
+        <p class="burn-share-desc">This link can only be opened <strong>once</strong>. Share it with the intended recipient — do not open it yourself.</p>
+        <div class="burn-share-link-row">
+            <input type="text" id="burnShareUrl" class="burn-share-url" readonly>
+            <button id="burnShareCopy" class="nav-btn nav-btn-save">Copy</button>
+        </div>
+        <div class="burn-share-actions">
+            <a href="/" class="btn btn-primary">Create another</a>
+        </div>
+    </div>
+</div>
 {% endblock %}
 
 {% block scripts %}