#143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)

internal/api/attachments.go

@@ -242,6 +242,7 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 		return
 	}
 
+	setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143
 	resp := map[string]any{
 		"id":             created.ID,
 		"deletion_token": created.DeletionToken,

internal/api/cookie_set_test.go

@@ -0,0 +1,97 @@
+package api
+
+// #143: create responses must set the short-lived tok_<id> HttpOnly cookie
+// that the paste view reads for the one-time created banner.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestCreateSetsDeletionTokenCookie(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// JSON create
+	body := `{"content":"hello #143 cookie"}`
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("json create: got %d", rec.Code)
+	}
+	found := false
+	for _, c := range rec.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
+			found = true
+			if !c.HttpOnly {
+				t.Error("tok_ cookie not HttpOnly")
+			}
+			if c.MaxAge != 60 {
+				t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge)
+			}
+		}
+	}
+	if !found {
+		t.Error("json create did not set tok_<id> cookie (#143)")
+	}
+
+	// multipart create
+	var buf strings.Builder
+	boundary := "----qa143"
+	buf.WriteString("--" + boundary + "\r\n")
+	buf.WriteString("Content-Disposition: form-data; name=\"content\"\r\n\r\n")
+	buf.WriteString("multipart #143\r\n")
+	buf.WriteString("--" + boundary + "--\r\n")
+	req2 := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(buf.String()))
+	req2.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 201 {
+		t.Fatalf("multipart create: got %d body=%s", rec2.Code, rec2.Body.String())
+	}
+	found = false
+	for _, c := range rec2.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("multipart create did not set tok_<id> cookie (#143)")
+	}
+}
+
+func TestCreatedBannerViaCookie(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body := `{"content":"banner flow #143"}`
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d", rec.Code)
+	}
+	var id, tok string
+	for _, c := range rec.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") {
+			id = strings.TrimPrefix(c.Name, "tok_")
+			tok = c.Value
+		}
+	}
+	if id == "" || tok == "" {
+		t.Fatal("no tok_ cookie from create")
+	}
+	// follow the redirect the browser would make: GET /<id>?created=1 with the cookie
+	req2 := httptest.NewRequest("GET", "/"+id+"?created=1", nil)
+	req2.AddCookie(&http.Cookie{Name: "tok_" + id, Value: tok})
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 200 {
+		t.Fatalf("paste view: got %d", rec2.Code)
+	}
+	if !strings.Contains(rec2.Body.String(), tok) {
+		t.Error("created banner does not show the deletion token (#143 cookie flow broken)")
+	}
+}

internal/api/server.go

@@ -174,6 +174,16 @@ func viewerSentCookie(r *http.Request) bool {
 	return !minted
 }
 
+// #143: hand the deletion token to the creator's browser via a short-lived
+// HttpOnly cookie instead of the URL. The paste view reads it once to show
+// the one-time created banner; it expires after 60s.
+func setDeletionTokenCookie(w http.ResponseWriter, pasteID, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name: "tok_" + pasteID, Value: token, Path: "/",
+		MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+}
+
 func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	s := a.settings.get()
 	setRateLimitHeaders(w, 1, 5)
@@ -241,6 +251,7 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 		writeErrCode(w, 400, createErrCode(err), err.Error())
 		return
 	}
+	setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143
 	writeJSON(w, 201, map[string]any{
 		"id":             created.ID,
 		"deletion_token": created.DeletionToken,