Merge origin/main: keep can listing rows with #65 password-metadata leak guard

2026-09-09 16:36:55 -05:00
parent 19804d47a3
commit 5b9be808ed
2 changed files with 19 additions and 6 deletions
@@ -1,11 +1,11 @@
 package api

 import (
-	"palette/internal/store"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"palette/internal/store"
 	"strings"
 	"time"

@@ -43,7 +43,8 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
-		// parity with pastes (#48): same expiry window is enforced
+		// #60/#48: clamp at the API boundary like the pastes API does -
+		// reject zero/negative and durations past the 1-year UI cap.
 		if !store.ValidExpiry(d) {
 			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
 			return
@@ -188,8 +189,6 @@ func detectContentType(name string, content []byte) string {
 	return "text/plain"
 }

-
-
 func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	can, err := a.store.GetCan(id)