Cans API: multipart create with mixed items, password-protected cans, item fetch inheriting can auth

2026-09-08 16:08:33 -05:00
parent 7375de249d
commit 6f6954395e
6 changed files with 434 additions and 0 deletions
@@ -302,8 +302,14 @@ func (a *apiServer) routes() http.Handler {
 		r.Get("/pastes/{id}", a.handleGetPaste)
 		r.Delete("/pastes/{id}", a.handleDeletePaste)
 		r.Get("/public", a.handleListPublic)
+		r.Post("/pastes/can", a.handleCreateCan)
+		r.Get("/cans/{id}", a.handleGetCan)
+		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
 	})

+	// can page
+	r.Get("/can/{id}", a.handleCanPage)
+
 	// raw
 	r.Get("/raw/{id}", a.handleRaw)

@@ -445,6 +451,29 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte(row.Content))
 }

+func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	can, err := a.store.GetCan(id)
+	if err != nil || can == nil {
+		http.NotFound(w, r)
+		return
+	}
+	items, _ := a.store.ListCanItems(can.ID)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
+	for _, it := range items {
+		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
+	}
+	fmt.Fprintf(w, "</ul></body></html>")
+}
+
+func nullStrOr(ns sql.NullString, def string) string {
+	if ns.Valid {
+		return ns.String
+	}
+	return def
+}
+
 func (a *apiServer) handleHome(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/plain")
 	w.Write([]byte("palette pastebin api\nPOST /api/pastes  {\"content\": \"...\", \"language\": \"go\", \"expires_in\": \"168h\", \"password\": \"...\", \"visibility\": \"public\"}\nGET  /api/pastes/{id}\nGET  /api/public?limit=25&offset=0\nGET  /raw/{id}\n"))