#143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)

internal/api/server.go

@@ -174,6 +174,16 @@ func viewerSentCookie(r *http.Request) bool {
 	return !minted
 }
 
+// #143: hand the deletion token to the creator's browser via a short-lived
+// HttpOnly cookie instead of the URL. The paste view reads it once to show
+// the one-time created banner; it expires after 60s.
+func setDeletionTokenCookie(w http.ResponseWriter, pasteID, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name: "tok_" + pasteID, Value: token, Path: "/",
+		MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+}
+
 func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	s := a.settings.get()
 	setRateLimitHeaders(w, 1, 5)
@@ -241,6 +251,7 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 		writeErrCode(w, 400, createErrCode(err), err.Error())
 		return
 	}
+	setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143
 	writeJSON(w, 201, map[string]any{
 		"id":             created.ID,
 		"deletion_token": created.DeletionToken,
@@ -554,19 +565,19 @@ func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
 		cards = append(cards, ci)
 	}
 	h.RenderPage(w, "can.html", map[string]any{
-		"Page":          "can",
-		"ID":            can.ID,
-		"Title":         nullStrOr(can.Title, "Untitled can"),
-		"Description":   can.Description.String,
+		"Page":           "can",
+		"ID":             can.ID,
+		"Title":          nullStrOr(can.Title, "Untitled can"),
+		"Description":    can.Description.String,
 		"HasDescription": can.Description.Valid && can.Description.String != "",
-		"HasPassword":   can.PasswordHash.Valid,
-		"Items":         cards,
-		"ItemCount":     len(cards),
-		"SizeHuman":     web.HumanSize(totalSize),
-		"CreatedAgo":    web.AgoString(can.CreatedAt),
-		"CreatedAtUnix": can.CreatedAt,
-		"ExpiresAt":     can.ExpiresAt.Valid,
-		"ExpiresIn":     expiryStringIfValid(can.ExpiresAt),
+		"HasPassword":    can.PasswordHash.Valid,
+		"Items":          cards,
+		"ItemCount":      len(cards),
+		"SizeHuman":      web.HumanSize(totalSize),
+		"CreatedAgo":     web.AgoString(can.CreatedAt),
+		"CreatedAtUnix":  can.CreatedAt,
+		"ExpiresAt":      can.ExpiresAt.Valid,
+		"ExpiresIn":      expiryStringIfValid(can.ExpiresAt),
 	})
 }