From bb5c4f0186042a428bdbe5f2b303e6f39c66a7bc Mon Sep 17 00:00:00 2001 From: fen Date: Wed, 9 Sep 2026 09:15:39 -0500 Subject: [PATCH] fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree) --- internal/api/cans.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/api/cans.go b/internal/api/cans.go index b609159..6b0488e 100644 --- a/internal/api/cans.go +++ b/internal/api/cans.go @@ -40,6 +40,12 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) { writeErr(w, 400, "invalid expires_in") return } + // #60: clamp at the API boundary like the pastes API does - + // reject zero/negative and durations past the 1-year UI cap. + if !store.ValidExpiry(d) { + writeErr(w, 400, "expires_in must be between 1 minute and 1 year") + return + } t := now + int64(d.Seconds()) expiresAt = &t }