Burn after N reads: reads_limit/reads_used, per-viewer 15min dedupe via paste_views, reads_remaining in API+stats pill, raw counts as read (#49)

main.go

@@ -44,12 +44,14 @@ type Paste struct {
 	Password    *string `json:"password,omitempty"`
 	ExpiresIn   *string `json:"expires_in,omitempty"`
 	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
+	BurnAfterReads *int `json:"burn_after_reads,omitempty"` // #49: readable N times (default 1)
 	Visibility  string  `json:"visibility"`
 	CanID       *string `json:"can_id,omitempty"`
 	CreatedAt   int64   `json:"created_at"`
 	DeletedAt   *int64  `json:"deleted_at,omitempty"`
 	ExpiresAt   *int64  `json:"expires_at,omitempty"`
 	ViewerID    string  `json:"-"` // set from vwr cookie server-side (#37)
+	readsLimit  *int64  // #49: resolved read budget, not serialized
 	ViewCount   int     `json:"view_count"`
 	DeletionToken string `json:"-"`
 }
@@ -64,6 +66,8 @@ type PasteRow struct {
 	PasswordHash  sql.NullString
 	ExpiresAt     sql.NullInt64
 	BurnAfterRead bool
+	ReadsLimit    sql.NullInt64
+	ReadsUsed     int
 	Visibility    string
 	CanID         sql.NullString
 	CreatedAt     int64
@@ -135,6 +139,14 @@ func (s *Store) migrate() error {
 	`)
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN deletion_token TEXT`) // ignore if exists
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
+	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
+		paste_id    TEXT NOT NULL,
+		viewer_id   TEXT NOT NULL,
+		last_viewed INTEGER NOT NULL,
+		PRIMARY KEY (paste_id, viewer_id)
+	)`) // #49: per-viewer read dedupe window
 	return err
 }
 
@@ -192,6 +204,15 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 		}
 	}
 
+	// #49: burn-after-read pastes carry a read budget (default 1 read)
+	if p.BurnAfterRead {
+		limit := int64(1)
+		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
+			limit = int64(*p.BurnAfterReads)
+		}
+		p.readsLimit = &limit
+	}
+
 	visibility := p.Visibility
 	if visibility == "" {
 		visibility = "public"
@@ -211,9 +232,9 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 	}
 	p.DeletionToken = genDeletionToken()
 	_, err := s.db.Exec(`INSERT INTO pastes
-		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id)
-		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`,
-		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID)
+		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id, reads_limit)
+		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID, p.readsLimit)
 	if err != nil {
 		return nil, err
 	}
@@ -225,10 +246,10 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 }
 
 func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
-	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id
+	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id, reads_limit, COALESCE(reads_used, 0)
 		FROM pastes WHERE (id = ? OR custom_slug = ?) AND deleted_at IS NULL`, idOrSlug, idOrSlug)
 	var r PasteRow
-	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID)
+	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID, &r.ReadsLimit, &r.ReadsUsed)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -521,6 +542,10 @@ func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 404, "paste expired")
 		return
 	}
+	if row.burned() { // #49: read budget exhausted
+		writeErr(w, 404, "paste not found")
+		return
+	}
 	if row.PasswordHash.Valid {
 		// require password via header or query
 		pw := r.Header.Get("X-Paste-Password")
@@ -538,11 +563,12 @@ func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
 		}
 		return nil
 	}
-	a.store.maybeBurn(row)
+	rem, _ := a.store.registerRead(row, currentViewerID(r)) // #49 (also covers legacy burn)
 	writeJSON(w, 200, map[string]any{
 		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
 		"language": nullPtr(row.Language), "title": nullPtr(row.Title), "created_at": row.CreatedAt,
 		"view_count": row.ViewCount, "visibility": row.Visibility,
+		"reads_remaining": rem,
 	})
 }
 
@@ -635,6 +661,13 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "password required", 401)
 		return
 	}
+	if row.burned() { // #49: read budget exhausted
+		http.Error(w, "not found", 404)
+		return
+	}
+	// #49 decision: raw reads count against the read budget too, with the
+	// same per-viewer 15-minute dedupe window as page views.
+	a.store.registerRead(row, currentViewerID(r))
 	w.Header().Set("Content-Type", row.ContentType)
 	a.store.IncrementViews(row.ID)
 	w.Write([]byte(row.Content))