Remove cans feature; add Secure flag to pw_/tok_ cookies

Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was
half-integrated and has zero prod usage; removing it eliminates four audit
findings by deletion.

Removed:
- internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*,
  /can/{id}) plus handleCanPage/renderCan
- is_can from /api/mine and /api/public responses
- store layer: CanRow, can store funcs, paste_cans UNION in listings,
  cans sweep; reserved slugs 'can'/'cans' released
- templates/can.html, can CSS, is_can badges in history.js/mine.js
- cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go,
  TestErrorCodeCanValidation)
- docs/api.md cans section, README/LICENSE/docker-compose mentions

Store migration: drops paste_cans only when empty (non-empty table is
kept and logged; prod verified clean 2026-10-16) and drops the dormant
pastes.can_id column. Covered by new TestMigrateDropsCansSchema.

Security hardening (audit findings): pw_<id> (unlock) and tok_<id>
(deletion-token) cookies now carry Secure: true in addition to
HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test
now asserts Secure.

go vet ./... and go test ./... pass.

internal/api/cans.go

@@ -1,273 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"palette/internal/store"
-	"strings"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-
-	"palette/internal/web"
-)
-
-// CreateCan makes a can with N items (multipart form).
-// Fields: title, description, visibility, expires_in, password, files (one or more), or json_items for text items.
-func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
-	if err := r.ParseMultipartForm(a.cfg.MaxItemBytes); err != nil {
-		writeErr(w, 400, "multipart form required")
-		return
-	}
-
-	title := r.FormValue("title")
-	visibility := r.FormValue("visibility")
-	if visibility == "" {
-		visibility = "public"
-	}
-	if visibility != "public" && visibility != "unlisted" {
-		writeErrCode(w, 400, "invalid_visibility", "visibility must be public or unlisted")
-		return
-	}
-	expiresIn := r.FormValue("expires_in")
-	password := r.FormValue("password")
-	customSlug := r.FormValue("custom_slug")
-
-	var expiresAt *int64
-	now := time.Now().Unix()
-	if expiresIn != "" {
-		d, err := time.ParseDuration(expiresIn)
-		if err != nil {
-			writeErrCode(w, 400, "expiry_invalid", "invalid expires_in")
-			return
-		}
-		// #60/#48: clamp at the API boundary like the pastes API does -
-		// reject zero/negative and durations past the 1-year UI cap.
-		if !store.ValidExpiry(d) {
-			writeErrCode(w, 400, "expiry_invalid", "expires_in must be between 1 minute and 1 year")
-			return
-		}
-		t := now + int64(d.Seconds())
-		expiresAt = &t
-	}
-	var pwHash *string
-	if password != "" {
-		h, err := store.Argon2IDHash(password)
-		if err != nil {
-			writeErr(w, 500, "hash error")
-			return
-		}
-		pwHash = &h
-	}
-
-	canID := store.GenSlug(8)
-	var slugPtr *string
-	if customSlug != "" {
-		slugPtr = &customSlug
-	}
-	err := a.store.CreateCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt, slugPtr)
-	if err != nil {
-		switch err {
-		case store.ErrSlugTaken, store.ErrInvalidSlug, store.ErrReservedSlug:
-			writeErrCode(w, 409, createErrCode(err), err.Error())
-		default:
-			writeErr(w, 500, "db error")
-		}
-		return
-	}
-	if slugPtr != nil {
-		canID = customSlug // #4: custom slug becomes the can id
-	}
-	// #4: remember the creating browser so /mine and viewer-scoped delete work
-	a.store.Exec(`UPDATE paste_cans SET viewer_id=? WHERE id=?`, currentViewerID(r), canID)
-
-	// text items passed as JSON array: [{"title":"notes.txt","content":"..."}]
-	itemCount := 0
-	if itemsJSON := r.FormValue("json_items"); itemsJSON != "" {
-		var items []map[string]string
-		if err := json.Unmarshal([]byte(itemsJSON), &items); err != nil {
-			writeErr(w, 400, "invalid json_items")
-			return
-		}
-		for _, it := range items {
-			content := it["content"]
-			if int64(len(content)) > a.cfg.MaxItemBytes {
-				writeErr(w, 413, fmt.Sprintf("item %q exceeds max", it["title"]))
-				return
-			}
-			lang := it["language"]
-			if err := a.store.InsertCanItem(canID, it["title"], content, "text/plain", &lang, nil, nil, now); err != nil {
-				writeErr(w, 500, "db error")
-				return
-			}
-			itemCount++
-		}
-	}
-
-	// uploaded files
-	if r.MultipartForm != nil {
-		for _, headers := range r.MultipartForm.File {
-			for _, fh := range headers {
-				f, err := fh.Open()
-				if err != nil {
-					writeErr(w, 400, "cannot read uploaded file")
-					return
-				}
-				content, err := io.ReadAll(f)
-				f.Close()
-				if err != nil {
-					writeErr(w, 400, "cannot read uploaded file")
-					return
-				}
-				if int64(len(content)) > a.cfg.MaxItemBytes {
-					writeErr(w, 413, fmt.Sprintf("file %q exceeds max %d bytes", fh.Filename, a.cfg.MaxItemBytes))
-					return
-				}
-				contentStr := string(content)
-				if err := a.store.InsertCanItem(canID, fh.Filename, contentStr, detectContentType(fh.Filename, content), nil, nil, &contentStr, now); err != nil {
-					writeErr(w, 500, "db error")
-					return
-				}
-				itemCount++
-			}
-		}
-	}
-
-	if itemCount == 0 {
-		a.store.DeleteCan(canID)
-		writeErrCode(w, 400, "content_empty", "can needs at least one item (files or json_items)")
-		return
-	}
-
-	writeJSON(w, 201, map[string]any{
-		"id": canID, "url": "/can/" + canID, "items": itemCount,
-	})
-}
-
-// handleDeleteCan soft-deletes a can (parity with paste deletion, #63):
-// requires the vwr viewer cookie matching the can's viewer (cans carry no
-// deletion token since they are built in the browser).
-func (a *apiServer) handleDeleteCan(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil || can == nil {
-		writeErr(w, 404, "can not found")
-		return
-	}
-	vid := currentViewerID(r)
-	if !(vid != "" && viewerSentCookie(r) && can.ViewerID.Valid &&
-		can.ViewerID.String != "" && can.ViewerID.String == vid) {
-		writeErr(w, 403, "deletion not authorized")
-		return
-	}
-	if _, err := a.store.SoftDeleteCan(can.ID); err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
-}
-
-func detectContentType(name string, content []byte) string {
-	lower := strings.ToLower(name)
-	switch {
-	case strings.HasSuffix(lower, ".png"):
-		return "image/png"
-	case strings.HasSuffix(lower, ".jpg"), strings.HasSuffix(lower, ".jpeg"):
-		return "image/jpeg"
-	case strings.HasSuffix(lower, ".gif"):
-		return "image/gif"
-	case strings.HasSuffix(lower, ".webp"):
-		return "image/webp"
-	case strings.HasSuffix(lower, ".pdf"):
-		return "application/pdf"
-	}
-	if len(content) > 8 && content[0] == 0x89 && content[1] == 'P' {
-		return "image/png"
-	}
-	return "text/plain"
-}
-
-func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	if can == nil {
-		writeErr(w, 404, "can not found")
-		return
-	}
-	if can.ExpiresAt.Valid && can.ExpiresAt.Int64 < time.Now().Unix() {
-		writeErr(w, 404, "can expired")
-		return
-	}
-	if can.PasswordHash.Valid {
-		pw := r.Header.Get("X-Paste-Password")
-		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
-			writeErr(w, 401, "password required")
-			return
-		}
-	}
-	items, err := a.store.ListCanItems(can.ID)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	type itemMeta struct {
-		ID          string  `json:"id"`
-		Title       *string `json:"title"`
-		ContentType string  `json:"content_type"`
-		Size        int     `json:"size"`
-		URL         string  `json:"url"`
-	}
-	metas := make([]itemMeta, 0, len(items))
-	for _, it := range items {
-		metas = append(metas, itemMeta{
-			ID: it.ID, Title: store.NullStrPtr(it.Title), ContentType: it.ContentType,
-			Size: len(it.Content), URL: "/api/pastes/" + it.ID,
-		})
-	}
-	writeJSON(w, 200, map[string]any{
-		"id": can.ID, "title": store.NullStrPtr(can.Title), "visibility": can.Visibility,
-		"created_at": can.CreatedAt, "items": metas,
-	})
-}
-
-func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "item")
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		writeErr(w, 404, "item not found")
-		return
-	}
-	// must belong to a can
-	if !row.CanID.Valid {
-		writeErr(w, 404, "not a can item")
-		return
-	}
-	// inherit can password protection: password via header/query, or the
-	// same pw_<can> unlock cookie the can page sets (#4 cookie parity).
-	can, _ := a.store.GetCan(row.CanID.String)
-	if can != nil && can.PasswordHash.Valid {
-		pw := r.Header.Get("X-Paste-Password")
-		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
-			// fall back to the browser's unlock cookie for this can
-			c, cerr := r.Cookie("pw_" + can.ID)
-			if cerr != nil || c.Value != web.UnlockToken(can.ID) {
-				writeErr(w, 401, "password required")
-				return
-			}
-		}
-	}
-	// #34: same content-type guard as /raw — never serve active content types.
-	ct := row.ContentType
-	if !safeRawContentType(ct) {
-		ct = "text/plain; charset=utf-8"
-	}
-	w.Header().Set("Content-Type", ct)
-	w.Header().Set("X-Content-Type-Options", "nosniff")
-	w.Write([]byte(row.Content))
-}

internal/api/cans_expiry_test.go

@@ -1,45 +0,0 @@
-package api
-
-import (
-	"net/http/httptest"
-	"testing"
-)
-
-// #60: the cans API must clamp expires_in at the boundary exactly like the
-// pastes API — reject zero/negative durations and anything over the 1-year
-// UI cap, accept the exact boundaries.
-func TestCreateCanExpiryBounds(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	cases := []struct {
-		expiresIn string
-		wantCode  int
-	}{
-		{"-1h", 400},    // negative
-		{"-0s", 400},    // negative zero
-		{"0s", 400},     // zero
-		{"1ns", 400},    // positive but below the 1-minute floor
-		{"59s", 400},    // just under the floor
-		{"1m", 201},     // exactly the floor
-		{"90s", 201},    // just over the floor
-		{"8760h", 201},  // exactly 1 year
-		{"8785h", 400},  // 1 year + 1 day: over the cap
-		{"87600h", 400}, // 10 years, the originally reported case
-	}
-	for _, c := range cases {
-		globalLimiter = newLimiter() // avoid create rate limit between cases
-		body, ct := multipartBody(t, map[string]string{
-			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-			"expires_in": c.expiresIn,
-		}, "files", "pic.txt", "file data")
-		req := httptest.NewRequest("POST", "/api/pastes/can", body)
-		req.Header.Set("Content-Type", ct)
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code != c.wantCode {
-			t.Errorf("expires_in %q: got %d want %d (%s)",
-				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
-		}
-	}
-}

internal/api/cans_flow_test.go

@@ -1,414 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"palette/internal/store"
-)
-
-// #4: cans appear in /api/public as normal rows with is_can=true.
-func TestCanInPublicListing(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	// a can and a regular paste
-	body, ct := multipartBody(t, map[string]string{
-		"title":      "Listed can",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create can: %d %s", rec.Code, rec.Body.String())
-	}
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	req = httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"plain"}`))
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("public: %d", rec.Code)
-	}
-	var got struct {
-		Total int `json:"total"`
-		Items []struct {
-			ID    string `json:"id"`
-			IsCan bool   `json:"is_can"`
-			Title any    `json:"title"`
-		} `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if got.Total != 2 {
-		t.Fatalf("expected total 2 (can + paste), got %d", got.Total)
-	}
-	foundCan := false
-	for _, it := range got.Items {
-		if it.ID == created.ID {
-			if !it.IsCan {
-				t.Fatalf("can row missing is_can flag")
-			}
-			foundCan = true
-		} else if it.IsCan {
-			t.Fatalf("plain paste flagged as can")
-		}
-	}
-	if !foundCan {
-		t.Fatalf("can not present in /api/public")
-	}
-
-	// #4: unlisted can must not be listed
-	body2, ct2 := multipartBody(t, map[string]string{
-		"title":       "Hidden can",
-		"visibility":  "unlisted",
-		"json_items":  `[{"title":"b.txt","content":"BBB"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body2)
-	req.Header.Set("Content-Type", ct2)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("unlisted can create: %d", rec.Code)
-	}
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "Hidden can") {
-		t.Fatalf("unlisted can leaked into /api/public")
-	}
-}
-
-// #4: custom slug support for cans + conflict with existing paste slug.
-func TestCanCustomSlug(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	body, ct := multipartBody(t, map[string]string{
-		"title":       "Slugged",
-		"custom_slug": "my-bundle",
-		"json_items":  `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create can with slug: %d %s", rec.Code, rec.Body.String())
-	}
-	var created struct{ ID, URL string }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-	if created.ID != "my-bundle" {
-		t.Fatalf("expected id my-bundle, got %q", created.ID)
-	}
-	// custom slug resolves on the can page route
-	req = httptest.NewRequest("GET", "/can/my-bundle", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Slugged") {
-		t.Fatalf("can page by slug: %d", rec.Code)
-	}
-	// duplicate slug rejected 409
-	body, ct = multipartBody(t, map[string]string{
-		"title": "Again", "custom_slug": "my-bundle",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 409 {
-		t.Fatalf("duplicate slug expected 409, got %d", rec.Code)
-	}
-	// reserved slug rejected
-	body, ct = multipartBody(t, map[string]string{
-		"title": "R", "custom_slug": "admin",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 409 {
-		t.Fatalf("reserved slug expected 409, got %d", rec.Code)
-	}
-}
-
-// #4: invalid expiry rejected on cans, mirroring paste behavior (#48).
-func TestCanExpiryValidation(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Bad expiry", "expires_in": "30s",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 400 {
-		t.Fatalf("expected 400 for 30s expiry, got %d", rec.Code)
-	}
-}
-
-// #4: expired cans 404 on the page and API.
-func TestCanExpiryAccess(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Dying", "expires_in": "1h",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// backdate expiry to force the expired path
-	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, created.ID)
-
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("expired can API expected 404, got %d", rec.Code)
-	}
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("expired can page expected 404, got %d", rec.Code)
-	}
-}
-
-// #4: password-protected can page uses the same unlock flow as pastes.
-func TestCanUnlockFlow(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Locked can", "password": "pw123",
-		"json_items": `[{"title":"secret.txt","content":"sec content"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// GET page without cookie -> unlock form
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "locked") {
-		t.Fatalf("expected unlock form, got %d", rec.Code)
-	}
-
-	// POST wrong password -> unlock form with error
-	fd := strings.NewReader("password=wrong")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "Wrong password") {
-		t.Fatalf("expected wrong-password message")
-	}
-
-	// POST correct password -> page renders, cookie set
-	fd = strings.NewReader("password=pw123")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("unlocked can page missing item content")
-	}
-	var pwCookie *http.Cookie
-	for _, c := range rec.Result().Cookies() {
-		if c.Name == "pw_"+created.ID {
-			pwCookie = c
-		}
-	}
-	if pwCookie == nil {
-		t.Fatalf("unlock cookie not set")
-	}
-
-	// GET with cookie -> unlocked
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	req.AddCookie(pwCookie)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("cookie unlock failed: %d", rec.Code)
-	}
-	// a forged cookie value must not unlock
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("forged cookie unlocked the can")
-	}
-}
-
-// #4: can item access inherits the can unlock cookie (not just query param).
-func TestCanItemCookieParity(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Cookie can", "password": "pw123",
-		"json_items": `[{"title":"s.txt","content":"sec"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// unlock via page to get the cookie
-	fd := strings.NewReader("password=pw123")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var pwCookie *http.Cookie
-	for _, c := range rec.Result().Cookies() {
-		if c.Name == "pw_"+created.ID {
-			pwCookie = c
-		}
-	}
-	if pwCookie == nil {
-		t.Fatalf("no unlock cookie")
-	}
-
-	// item id from API (with password query)
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	req.Header.Set("X-Paste-Password", "pw123")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var can struct {
-		Items []struct{ ID string `json:"id"` } `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &can)
-	itemID := can.Items[0].ID
-
-	// API item with the unlock cookie but no password -> 200
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	req.AddCookie(pwCookie)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("item via cookie expected 200, got %d", rec.Code)
-	}
-	// forged cookie -> 401
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 401 {
-		t.Fatalf("forged cookie on item expected 401, got %d", rec.Code)
-	}
-}
-
-// #4: viewer-scoped soft delete of cans.
-func TestCanDeleteParity(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Doomed", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// delete without matching viewer -> 403
-	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 403 {
-		t.Fatalf("unauthorized delete expected 403, got %d", rec.Code)
-	}
-	// creator's browser -> 200
-	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("creator delete expected 200, got %d", rec.Code)
-	}
-	// gone from API and page
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("deleted can expected 404, got %d", rec.Code)
-	}
-	// gone from listings
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "Doomed") {
-		t.Fatalf("deleted can still listed")
-	}
-}
-
-// #4: cans appear in /api/mine for the creating browser.
-func TestCanInMine(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Mine can", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create: %d", rec.Code)
-	}
-
-	req = httptest.NewRequest("GET", "/api/mine", nil)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var got struct {
-		Items []struct {
-			ID    string `json:"id"`
-			IsCan bool   `json:"is_can"`
-		} `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if len(got.Items) != 1 || !got.Items[0].IsCan {
-		t.Fatalf("can missing from /api/mine: %s", rec.Body.String())
-	}
-}
-
-// #4: sweep soft-deletes expired cans (parity with pastes).
-func TestCanSweepExpired(t *testing.T) {
-	s := testServer(t)
-	s.store.CreateCan("sweepcan", "sweep", "", "public", nil, 1, nil, nil)
-	s.store.InsertCanItem("sweepcan", "a.txt", "AAA", "text/plain", nil, nil, nil, 1)
-	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, "sweepcan")
-	s.store.SweepExpired()
-	if can, _ := s.store.GetCan("sweepcan"); can != nil {
-		t.Fatalf("expired can survived sweep")
-	}
-	_ = store.GenSlug(4) // keep import if store pkg shrinks
-}

internal/api/cans_test.go

@@ -1,144 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"encoding/json"
-	"mime/multipart"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func multipartBody(t *testing.T, fields map[string]string, fileField, fileName, fileContent string) (*bytes.Buffer, string) {
-	t.Helper()
-	var buf bytes.Buffer
-	w := multipart.NewWriter(&buf)
-	for k, v := range fields {
-		w.WriteField(k, v)
-	}
-	if fileField != "" {
-		fw, _ := w.CreateFormFile(fileField, fileName)
-		fw.Write([]byte(fileContent))
-	}
-	w.Close()
-	return &buf, w.FormDataContentType()
-}
-
-func TestCreateAndGetCan(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	body, ct := multipartBody(t, map[string]string{
-		"title":      "My can",
-		"json_items": `[{"title":"a.txt","content":"AAA"},{"title":"b.txt","content":"BBB"}]`,
-		"expires_in": "1h",
-	}, "files", "pic.txt", "file data")
-
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create can: got %d: %s", rec.Code, rec.Body.String())
-	}
-	var created struct {
-		ID    string `json:"id"`
-		Items int    `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &created)
-	if created.Items != 3 {
-		t.Fatalf("expected 3 items, got %d", created.Items)
-	}
-
-	// get can
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("get can: got %d", rec.Code)
-	}
-	var can struct {
-		Items []struct{ ID string `json:"id"` } `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &can)
-	if len(can.Items) != 3 {
-		t.Fatalf("expected 3 items in get, got %d", len(can.Items))
-	}
-
-	// fetch item
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+can.Items[0].ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("item fetch: got %d", rec.Code)
-	}
-}
-
-func TestEmptyCanRejected(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{"title": "empty"}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 400 {
-		t.Fatalf("expected 400 for empty can, got %d", rec.Code)
-	}
-}
-
-func TestCanPasswordInheritedByItems(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	body, ct := multipartBody(t, map[string]string{
-		"title":      "locked",
-		"password":   "pw123",
-		"json_items": `[{"title":"s.txt","content":"sec"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// can without pw -> 401
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 401 {
-		t.Fatalf("expected 401, got %d", rec.Code)
-	}
-
-	// get item id with pw
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	req.Header.Set("X-Paste-Password", "pw123")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var can struct {
-		Items []struct{ ID string `json:"id"` } `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &can)
-	itemID := can.Items[0].ID
-
-	// item without pw -> 401
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 401 {
-		t.Fatalf("item expected 401, got %d", rec.Code)
-	}
-
-	// item with pw -> 200
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	req.Header.Set("X-Paste-Password", "pw123")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("item expected 200, got %d", rec.Code)
-	}
-	if !strings.Contains(rec.Body.String(), "sec") {
-		t.Fatalf("item content mismatch: %s", rec.Body.String())
-	}
-}

internal/api/cookie_set_test.go

@@ -1,7 +1,7 @@
 package api
 
-// #143: create responses must set the short-lived tok_<id> HttpOnly cookie
-// that the paste view reads for the one-time created banner.
+// #143: create responses must set the short-lived tok_<id> HttpOnly+Secure
+// cookie that the paste view reads for the one-time created banner.
 
 import (
 	"net/http"
@@ -29,6 +29,9 @@ func TestCreateSetsDeletionTokenCookie(t *testing.T) {
 			if !c.HttpOnly {
 				t.Error("tok_ cookie not HttpOnly")
 			}
+			if !c.Secure {
+				t.Error("tok_ cookie not Secure")
+			}
 			if c.MaxAge != 60 {
 				t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge)
 			}

internal/api/issue105_errorcode_test.go

@@ -86,38 +86,3 @@ func TestErrorCodeRateLimited(t *testing.T) {
 	}
 	t.Fatalf("never got rate_limited, last code = %q", code)
 }
-
-func TestErrorCodeCanValidation(t *testing.T) {
-	h := testServer(t).routes()
-
-	post := func(fields map[string]string) *httptest.ResponseRecorder {
-		var b strings.Builder
-		for k, v := range fields {
-			b.WriteString("--B\r\nContent-Disposition: form-data; name=\"" + k + "\"\r\n\r\n" + v + "\r\n")
-		}
-		b.WriteString("--B--\r\n")
-		req := httptest.NewRequest("POST", "/api/pastes/can", strings.NewReader(b.String()))
-		req.Header.Set("Content-Type", "multipart/form-data; boundary=B")
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		return rec
-	}
-
-	// bad visibility
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "visibility": "nope"})); code != "invalid_visibility" {
-		t.Fatalf("visibility code = %q, want invalid_visibility", code)
-	}
-
-	// invalid expiry
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "expires_in": "1s"})); code != "expiry_invalid" {
-		t.Fatalf("expiry code = %q, want expiry_invalid", code)
-	}
-
-	// slug taken on can create
-	if rec := postCreate(h, `{"content":"a","custom_slug":"can-slug"}`); rec.Code != 201 {
-		t.Fatalf("seed create: %d", rec.Code)
-	}
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "custom_slug": "can-slug", "json_items": `[{"title":"a","content":"b"}]`})); code != "slug_taken" {
-		t.Fatalf("can slug code = %q, want slug_taken", code)
-	}
-}

internal/api/server.go

@@ -1,5 +1,5 @@
 // Package api implements palette's REST handlers and the HTTP router:
-// pastes, cans, guess-language, rate limiting middleware, and the admin API.
+// pastes, guess-language, rate limiting middleware, and the admin API.
 package api
 
 import (
@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html/template"
 	"net/http"
 	"os"
 	"strconv"
@@ -18,7 +17,6 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
-	langpkg "palette/internal/lang"
 	"palette/internal/store"
 	"palette/internal/web"
 )
@@ -59,8 +57,7 @@ func writeErrCode(w http.ResponseWriter, status int, code, msg string) {
 	writeJSON(w, status, map[string]string{"error": msg, "code": code})
 }
 
-// createErrCode maps a store.CreatePaste/CreateCan error to its UI error
-// code (#105).
+// createErrCode maps a store.CreatePaste error to its UI error code (#105).
 func createErrCode(err error) string {
 	switch {
 	case errors.Is(err, store.ErrSlugTaken):
@@ -103,16 +100,8 @@ func (a *apiServer) routes() http.Handler {
 		r.Delete("/pastes/{id}/redeem", a.handleRedeemDeletion)
 		r.Get("/public", a.handleListPublic)
 		r.Post("/guess-language", a.handleGuessLang)
-		r.Post("/pastes/can", a.handleCreateCan)
-		r.Get("/cans/{id}", a.handleGetCan)
-		r.Delete("/cans/{id}", a.handleDeleteCan)
-		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
 	})
 
-	// can page (#4): GET renders, POST unlocks (same flow as pastes)
-	r.Get("/can/{id}", a.handleCanPage)
-	r.Post("/can/{id}", a.handleCanPage)
-
 	// raw + #38 attachment serving
 	r.Get("/f/{aid}/{filename}", a.handleServeAttachment)
 	r.Get("/raw/{id}", a.handleRaw)
@@ -189,7 +178,7 @@ func viewerSentCookie(r *http.Request) bool {
 func setDeletionTokenCookie(w http.ResponseWriter, pasteID, token string) {
 	http.SetCookie(w, &http.Cookie{
 		Name: "tok_" + pasteID, Value: token, Path: "/",
-		MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+		MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode, Secure: true,
 	})
 }
 
@@ -442,7 +431,6 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 			"id": row.ID, "title": title, "language": lang, "type": displayType(lang, row.AttFilename),
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
 			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
-			"is_can": row.IsCan,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
@@ -462,8 +450,7 @@ func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
 		items = append(items, map[string]any{
 			"id": row.ID, "title": title, "language": lang, "type": displayType(lang, row.AttFilename),
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
-			"custom_slug": store.NullStrPtr(row.CustomSlug),
-			"is_can":      row.IsCan,
+			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
@@ -548,130 +535,6 @@ func safeRawContentType(ct string) bool {
 	return false
 }
 
-func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil || can == nil {
-		http.NotFound(w, r)
-		return
-	}
-	if can.ExpiresAt.Valid && can.ExpiresAt.Int64 < time.Now().Unix() {
-		http.NotFound(w, r)
-		return
-	}
-	// #4: password-protected cans go through the same unlock flow as pastes:
-	// the pw_<id> cookie carries an HMAC token bound to this can id. Items
-	// inherit the protection (handleCanItem checks the same cookie).
-	if can.PasswordHash.Valid {
-		h := a.webHandlers()
-		if r.Method == http.MethodPost {
-			if !rateLimitUnlock(can.ID, r) {
-				h.WriteRateLimited(w, 60)
-				return
-			}
-			r.ParseForm()
-			pw := r.FormValue("password")
-			if pw != "" && store.CheckPassword(can.PasswordHash.String, pw) {
-				http.SetCookie(w, &http.Cookie{
-					Name: "pw_" + can.ID, Value: web.UnlockToken(can.ID), Path: "/",
-					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-				})
-				a.renderCan(w, can)
-				return
-			}
-			h.RenderPage(w, "unlock.html", map[string]any{
-				"Page": "unlock", "ID": can.ID, "Wrong": true,
-				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
-			})
-			return
-		}
-		c, err := r.Cookie("pw_" + can.ID)
-		if err != nil || c.Value != web.UnlockToken(can.ID) {
-			h.RenderPage(w, "unlock.html", map[string]any{
-				"Page": "unlock", "ID": can.ID, "Wrong": false,
-				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
-			})
-			return
-		}
-	}
-	a.renderCan(w, can)
-}
-
-// renderCan renders the can view page: title/description and items as cards.
-// Text items expand inline; files link to download.
-func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
-	h := a.webHandlers()
-	items, err := a.store.ListCanItems(can.ID)
-	if err != nil {
-		http.Error(w, "db error", 500)
-		return
-	}
-	type canItem struct {
-		ID          string
-		Title       string
-		ContentType string
-		Size        string
-		IsFile      bool
-		Content     string
-		ContentHTML template.HTML
-		Language    string
-	}
-	cards := make([]canItem, 0, len(items))
-	totalSize := 0
-	for _, it := range items {
-		totalSize += len(it.Content)
-		isFile := it.ContentType != "text/plain" && !strings.HasPrefix(it.ContentType, "text/")
-		ci := canItem{
-			ID:          it.ID,
-			Title:       nullStrOr(it.Title, it.ID),
-			ContentType: it.ContentType,
-			Size:        web.HumanSize(len(it.Content)),
-			IsFile:      isFile,
-			Language:    it.Language.String,
-		}
-		if !isFile {
-			ci.ContentHTML = template.HTML(langpkg.HighlightCode(it.Content, it.Language.String))
-		}
-		cards = append(cards, ci)
-	}
-	h.RenderPage(w, "can.html", map[string]any{
-		"Page":           "can",
-		"ID":             can.ID,
-		"Title":          nullStrOr(can.Title, "Untitled can"),
-		"Description":    can.Description.String,
-		"HasDescription": can.Description.Valid && can.Description.String != "",
-		"HasPassword":    can.PasswordHash.Valid,
-		"Items":          cards,
-		"ItemCount":      len(cards),
-		"SizeHuman":      web.HumanSize(totalSize),
-		"CreatedAgo":     web.AgoString(can.CreatedAt),
-		"CreatedAtUnix":  can.CreatedAt,
-		"ExpiresAt":      can.ExpiresAt.Valid,
-		"ExpiresIn":      expiryStringIfValid(can.ExpiresAt),
-	})
-}
-
-// expiryStringIfValid formats remaining time for a valid expiry, "" otherwise.
-func expiryStringIfValid(ns sql.NullInt64) string {
-	if !ns.Valid {
-		return ""
-	}
-	remaining := ns.Int64 - time.Now().Unix()
-	s := remaining
-	switch {
-	case s < 3600:
-		return fmt.Sprintf("%dm", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh", s/3600)
-	default:
-		return fmt.Sprintf("%dd", s/86400)
-	}
-}
-
-func templateEsc(s string) string {
-	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
-	return r.Replace(s)
-}
 
 func (a *apiServer) handlePasteView(w http.ResponseWriter, r *http.Request) {
 	h := a.webHandlers()

internal/api/validate.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 )
 
-// #68 input-validation helpers. Paste/can payloads are size-capped and list
+// #68 input-validation helpers. Paste payloads are size-capped and list
 // endpoints get a single place where limit/offset are parsed and clamped.
 
 // maxRequestBody returns the HTTP body cap for JSON create endpoints: the