[Feature Request]: ENABLED_SERVICES allow restricting individual note types (text/password/code/sshkey)

[CallMeLeon167]

SkySend Version

v2.12.0

Instance Type

Self-hosted instance

Component

Web UI

Bug Description

ENABLED_SERVICES is documented as controlling which services are active ("Set to file for file sharing only, note for notes only, or file,note for both"). I expected this to also let me restrict which note sub-types (Text, Password, Code, SSH Key) are offered in the upload UI — specifically, I only want to offer "File" and "Text", without the Password/Code/SSH Key tabs.

In practice, with ENABLED_SERVICES=file,note the web UI still shows all four note sub-types (Text, Password, Code, SSH Key). Looking at the source code, this is by design: in apps/web/src/pages/Upload.tsx the available tabs are hard-coded:

const availableTabs: Tab[] = [
  ...(fileEnabled ? ["file" as const] : []),
  ...(noteEnabled ? (["text", "password", "code", "sshkey"] as const) : []),
];

Steps to Reproduce

1. Self-host SkySend with ENABLED_SERVICES=file,note
2. Open the web UI
3. In the upload section, besides "File", all four note tabs are visible: Text, Password, Code, SSH Key
4. Expected a way to enable only specific note types (e.g. only Text)

Expected Behavior

Setting ENABLED_SERVICES (or a similar config option) should make the corresponding tabs disappear from the upload UI.

Logs / Error Output

-

Screenshots

Environment

[Skyfay]

Hey @CallMeLeon167

Thanks for the suggestion, and for explaining what you expected ENABLED_SERVICES to do.

I looked into what this would take. The short version: it is technically feasible, but I do not think it is worth adding, and I want to be transparent about why.

Why it is not really a restriction

All four note types are the same thing under the hood. A note is an encrypted blob plus a contentType label, and the label only selects which input mask the frontend renders. A "Password" note and a "Text" note are identical on the server and in the database.

That means hiding the Password tab does not prevent a single password from being shared through SkySend. It just gets typed into a Text note instead. The setting would look like a policy boundary to whoever configures it, but it would not be one, and I would rather not ship an option that reads as a guarantee it cannot give.

Why ENABLED_SERVICES is the wrong place for it

ENABLED_SERVICES is a service-level switch. It gates entire route groups on the server (a disabled service returns 403), and it is consumed as a plain yes/no question in about ten places across the web UI, the TUI client, and the CLI. Encoding note sub-types into it would force every one of those call sites to re-derive "is the note service enabled at all" from a more complex value. That is a lot of surface area to destabilise for a UI preference.

If this were built, it would have to be a separate variable such as NOTE_ENABLED_TYPES, defaulting to all types, leaving ENABLED_SERVICES untouched.

What I would suggest instead

If the goal is mainly to steer people toward the options you actually want them to use, DEFAULT_TAB already covers that today. It sets which tab opens first, and it accepts file, text, password, code, or sshkey. No code change needed.

I will leave this open for a while to see whether there is broader demand. If it turns out there is, the NOTE_ENABLED_TYPES route above is the one I would take, with enforcement on note creation only so that existing notes of a disabled type stay readable.