#143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)

internal/api/attachments.go

@@ -242,6 +242,7 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 		return
 	}
 
+	setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143
 	resp := map[string]any{
 		"id":             created.ID,
 		"deletion_token": created.DeletionToken,

internal/api/cookie_set_test.go

@@ -0,0 +1,97 @@
+package api
+
+// #143: create responses must set the short-lived tok_<id> HttpOnly cookie
+// that the paste view reads for the one-time created banner.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestCreateSetsDeletionTokenCookie(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// JSON create
+	body := `{"content":"hello #143 cookie"}`
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("json create: got %d", rec.Code)
+	}
+	found := false
+	for _, c := range rec.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
+			found = true
+			if !c.HttpOnly {
+				t.Error("tok_ cookie not HttpOnly")
+			}
+			if c.MaxAge != 60 {
+				t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge)
+			}
+		}
+	}
+	if !found {
+		t.Error("json create did not set tok_<id> cookie (#143)")
+	}
+
+	// multipart create
+	var buf strings.Builder
+	boundary := "----qa143"
+	buf.WriteString("--" + boundary + "\r\n")
+	buf.WriteString("Content-Disposition: form-data; name=\"content\"\r\n\r\n")
+	buf.WriteString("multipart #143\r\n")
+	buf.WriteString("--" + boundary + "--\r\n")
+	req2 := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(buf.String()))
+	req2.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 201 {
+		t.Fatalf("multipart create: got %d body=%s", rec2.Code, rec2.Body.String())
+	}
+	found = false
+	for _, c := range rec2.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("multipart create did not set tok_<id> cookie (#143)")
+	}
+}
+
+func TestCreatedBannerViaCookie(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body := `{"content":"banner flow #143"}`
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d", rec.Code)
+	}
+	var id, tok string
+	for _, c := range rec.Result().Cookies() {
+		if strings.HasPrefix(c.Name, "tok_") {
+			id = strings.TrimPrefix(c.Name, "tok_")
+			tok = c.Value
+		}
+	}
+	if id == "" || tok == "" {
+		t.Fatal("no tok_ cookie from create")
+	}
+	// follow the redirect the browser would make: GET /<id>?created=1 with the cookie
+	req2 := httptest.NewRequest("GET", "/"+id+"?created=1", nil)
+	req2.AddCookie(&http.Cookie{Name: "tok_" + id, Value: tok})
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 200 {
+		t.Fatalf("paste view: got %d", rec2.Code)
+	}
+	if !strings.Contains(rec2.Body.String(), tok) {
+		t.Error("created banner does not show the deletion token (#143 cookie flow broken)")
+	}
+}

internal/api/server.go

@@ -174,6 +174,16 @@ func viewerSentCookie(r *http.Request) bool {
 	return !minted
 }
 
+// #143: hand the deletion token to the creator's browser via a short-lived
+// HttpOnly cookie instead of the URL. The paste view reads it once to show
+// the one-time created banner; it expires after 60s.
+func setDeletionTokenCookie(w http.ResponseWriter, pasteID, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name: "tok_" + pasteID, Value: token, Path: "/",
+		MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+}
+
 func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	s := a.settings.get()
 	setRateLimitHeaders(w, 1, 5)
@@ -241,6 +251,7 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 		writeErrCode(w, 400, createErrCode(err), err.Error())
 		return
 	}
+	setDeletionTokenCookie(w, created.ID, created.DeletionToken) // #143
 	writeJSON(w, 201, map[string]any{
 		"id":             created.ID,
 		"deletion_token": created.DeletionToken,
@@ -554,19 +565,19 @@ func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
 		cards = append(cards, ci)
 	}
 	h.RenderPage(w, "can.html", map[string]any{
-		"Page":          "can",
+		"Page":           "can",
-		"ID":            can.ID,
+		"ID":             can.ID,
-		"Title":         nullStrOr(can.Title, "Untitled can"),
+		"Title":          nullStrOr(can.Title, "Untitled can"),
-		"Description":   can.Description.String,
+		"Description":    can.Description.String,
 		"HasDescription": can.Description.Valid && can.Description.String != "",
-		"HasPassword":   can.PasswordHash.Valid,
+		"HasPassword":    can.PasswordHash.Valid,
-		"Items":         cards,
+		"Items":          cards,
-		"ItemCount":     len(cards),
+		"ItemCount":      len(cards),
-		"SizeHuman":     web.HumanSize(totalSize),
+		"SizeHuman":      web.HumanSize(totalSize),
-		"CreatedAgo":    web.AgoString(can.CreatedAt),
+		"CreatedAgo":     web.AgoString(can.CreatedAt),
-		"CreatedAtUnix": can.CreatedAt,
+		"CreatedAtUnix":  can.CreatedAt,
-		"ExpiresAt":     can.ExpiresAt.Valid,
+		"ExpiresAt":      can.ExpiresAt.Valid,
-		"ExpiresIn":     expiryStringIfValid(can.ExpiresAt),
+		"ExpiresIn":      expiryStringIfValid(can.ExpiresAt),
 	})
 }