Fix title leak for unauthorized viewers

[chruffins]

Summary

generateMetadata was calling findBySlug and using the doc's title unconditionally, which meant the browser tab / <title> tag would show a private doc's real title even when the page itself rendered a 404. An unauthorized viewer (or a bot crawling the page) could infer the existence and name of a private doc.

Fix

The metadata function now runs the same authorization check (canViewSession) that ViewerPage uses before revealing the doc's title. If no doc is found or the viewer isn't authorized, the title defaults to the neutral "justhtml.sh".

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
justhtml	Ready	Preview, Comment	Jul 14, 2026 1:53pm

[chruffins]

Closing as superseded: this fix landed on main via #27 (Add rich previews for shared document links). generateMetadata now runs the same canViewSession authorization check as ViewerPage before revealing any metadata, so unauthorized viewers of a private doc get the neutral "justhtml.sh" title — plus the description, OG/twitter cards, and preview image are also gated the same way, and private docs get robots: noindex. Thanks for flagging the title leak.