From 00aaafeb3c84772b2eda065bb08110d26971051b Mon Sep 17 00:00:00 2001 From: fen Date: Thu, 10 Sep 2026 08:36:47 -0500 Subject: [PATCH] #143: set tok_ cookie in create handlers so the created banner can show the token (QA) --- internal/api/attachments.go | 1 + internal/api/cookie_set_test.go | 97 +++++++++++++++++++++++++++++++++ internal/api/server.go | 35 ++++++++---- 3 files changed, 121 insertions(+), 12 deletions(-) create mode 100644 internal/api/cookie_set_test.go diff --git a/internal/api/attachments.go b/internal/api/attachments.go index 04c4c56..862f544 100644 --- a/internal/api/attachments.go +++ b/internal/api/attachments.go @@ -242,6 +242,7 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re return } + setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143 resp := map[string]any{ "id": created.ID, "deletion_token": created.DeletionToken, diff --git a/internal/api/cookie_set_test.go b/internal/api/cookie_set_test.go new file mode 100644 index 0000000..7311560 --- /dev/null +++ b/internal/api/cookie_set_test.go @@ -0,0 +1,97 @@ +package api + +// #143: create responses must set the short-lived tok_ HttpOnly cookie +// that the paste view reads for the one-time created banner. + +import ( + "net/http" + "net/http/httptest" + "strings" + "testing" +) + +func TestCreateSetsDeletionTokenCookie(t *testing.T) { + s := testServer(t) + h := s.routes() + + // JSON create + body := `{"content":"hello #143 cookie"}` + req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body)) + rec := httptest.NewRecorder() + h.ServeHTTP(rec, req) + if rec.Code != 201 { + t.Fatalf("json create: got %d", rec.Code) + } + found := false + for _, c := range rec.Result().Cookies() { + if strings.HasPrefix(c.Name, "tok_") && c.Value != "" { + found = true + if !c.HttpOnly { + t.Error("tok_ cookie not HttpOnly") + } + if c.MaxAge != 60 { + t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge) + } + } + } + if !found { + t.Error("json create did not set tok_ cookie (#143)") + } + + // multipart create + var buf strings.Builder + boundary := "----qa143" + buf.WriteString("--" + boundary + "\r\n") + buf.WriteString("Content-Disposition: form-data; name=\"content\"\r\n\r\n") + buf.WriteString("multipart #143\r\n") + buf.WriteString("--" + boundary + "--\r\n") + req2 := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(buf.String())) + req2.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary) + rec2 := httptest.NewRecorder() + h.ServeHTTP(rec2, req2) + if rec2.Code != 201 { + t.Fatalf("multipart create: got %d body=%s", rec2.Code, rec2.Body.String()) + } + found = false + for _, c := range rec2.Result().Cookies() { + if strings.HasPrefix(c.Name, "tok_") && c.Value != "" { + found = true + } + } + if !found { + t.Error("multipart create did not set tok_ cookie (#143)") + } +} + +func TestCreatedBannerViaCookie(t *testing.T) { + s := testServer(t) + h := s.routes() + body := `{"content":"banner flow #143"}` + req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body)) + rec := httptest.NewRecorder() + h.ServeHTTP(rec, req) + if rec.Code != 201 { + t.Fatalf("create: got %d", rec.Code) + } + var id, tok string + for _, c := range rec.Result().Cookies() { + if strings.HasPrefix(c.Name, "tok_") { + id = strings.TrimPrefix(c.Name, "tok_") + tok = c.Value + } + } + if id == "" || tok == "" { + t.Fatal("no tok_ cookie from create") + } + // follow the redirect the browser would make: GET /?created=1 with the cookie + req2 := httptest.NewRequest("GET", "/"+id+"?created=1", nil) + req2.AddCookie(&http.Cookie{Name: "tok_" + id, Value: tok}) + rec2 := httptest.NewRecorder() + h.ServeHTTP(rec2, req2) + if rec2.Code != 200 { + t.Fatalf("paste view: got %d", rec2.Code) + } + if !strings.Contains(rec2.Body.String(), tok) { + t.Error("created banner does not show the deletion token (#143 cookie flow broken)") + } +} diff --git a/internal/api/server.go b/internal/api/server.go index 2913baf..fb2cd7c 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -174,6 +174,16 @@ func viewerSentCookie(r *http.Request) bool { return !minted } +// #143: hand the deletion token to the creator's browser via a short-lived +// HttpOnly cookie instead of the URL. The paste view reads it once to show +// the one-time created banner; it expires after 60s. +func setDeletionTokenCookie(w http.ResponseWriter, pasteID, token string) { + http.SetCookie(w, &http.Cookie{ + Name: "tok_" + pasteID, Value: token, Path: "/", + MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode, + }) +} + func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) { s := a.settings.get() setRateLimitHeaders(w, 1, 5) @@ -241,6 +251,7 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) { writeErrCode(w, 400, createErrCode(err), err.Error()) return } + setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143 writeJSON(w, 201, map[string]any{ "id": created.ID, "deletion_token": created.DeletionToken, @@ -554,19 +565,19 @@ func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) { cards = append(cards, ci) } h.RenderPage(w, "can.html", map[string]any{ - "Page": "can", - "ID": can.ID, - "Title": nullStrOr(can.Title, "Untitled can"), - "Description": can.Description.String, + "Page": "can", + "ID": can.ID, + "Title": nullStrOr(can.Title, "Untitled can"), + "Description": can.Description.String, "HasDescription": can.Description.Valid && can.Description.String != "", - "HasPassword": can.PasswordHash.Valid, - "Items": cards, - "ItemCount": len(cards), - "SizeHuman": web.HumanSize(totalSize), - "CreatedAgo": web.AgoString(can.CreatedAt), - "CreatedAtUnix": can.CreatedAt, - "ExpiresAt": can.ExpiresAt.Valid, - "ExpiresIn": expiryStringIfValid(can.ExpiresAt), + "HasPassword": can.PasswordHash.Valid, + "Items": cards, + "ItemCount": len(cards), + "SizeHuman": web.HumanSize(totalSize), + "CreatedAgo": web.AgoString(can.CreatedAt), + "CreatedAtUnix": can.CreatedAt, + "ExpiresAt": can.ExpiresAt.Valid, + "ExpiresIn": expiryStringIfValid(can.ExpiresAt), }) }