poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity
54 Commits 3 Branches 8 Tags
03600b2ed55733e01738f8109b0b9379b0f382ce
Commit Graph
9 Commits
Author SHA1 Message Date
poslop 03600b2ed5 sweep: fix missing view_count on HTML views, API expiry bounds, search ignoring custom slug (#33)
CI / test (push) Successful in 21s
Details
CI / docker (push) Skipped
Details
2026-09-09 00:34:24 -05:00
poslop cb23707125 pentest: bind unlock cookie to HMAC per-paste token; serve only safe content types on /raw and can items with nosniff (#34)
CI / test (push) Successful in 21s
Details
CI / docker (push) Skipped
Details
2026-09-09 00:14:01 -05:00
poslop d5a47b1a31 Burn after N reads: reads_limit/reads_used, per-viewer 15min dedupe via paste_views, reads_remaining in API+stats pill, raw counts as read (#49)
CI / test (push) Successful in 21s
Details
CI / docker (push) Skipped
Details
2026-09-08 23:54:03 -05:00
poslop 129934b645 My pastes page /mine with anonymous viewer cookie (#37)
CI / test (push) Successful in 21s
Details
CI / docker (push) Skipped
Details 
- vwr cookie middleware: random browser id set on first visit (reused by #49)
- pastes table gains viewer_id column, set server-side at creation from the cookie
- GET /api/mine lists pastes for the requesting browser (title/lang/size/created)
- DELETE enforcement: 403 when client-sent vwr doesn't match the paste's viewer_id
- /mine page reuses history table styling, delete buttons, empty state
- nav: 'Saved' item between Public and Git; Git gets external-link arrow (#56)
- tests: create-with-cookie appears in /mine, other cookie doesn't, delete enforcement

Closes #37
 2026-09-08 22:10:05 -05:00
poslop ebcf7eec80 Live relative-time counters via shared [data-ts] ticker in layout foot (#46)
CI / test (push) Successful in 20s
Details
CI / docker (push) Skipped
Details
2026-09-08 21:41:29 -05:00
poslop 5b7198fb3c Settings gear in topbar linking to placeholder /settings page (#36)
CI / test (push) Successful in 20s
Details
CI / docker (push) Skipped
Details 
- layout.html: inline SVG gear icon top-right, styled as .iconbtn.gear pill
- new settings.html template reusing standard layout with under-construction card
- register GET /settings route in main.go
 2026-09-08 21:27:02 -05:00
poslop 7410b5c9cf Paste view: collapsible stats pill under title (#17)
CI / test (push) Successful in 19s
Details
CI / docker (push) Skipped
Details
2026-09-08 21:14:44 -05:00
poslop 3facff3d1e Syntax highlighting, rate limiting, creator auto-unlock (#1, #2, #26)
CI / test (push) Successful in 19s
Details
CI / docker (push) Skipped
Details 
#1: server-side regex highlighter (highlight.go) for go/python/js/json/bash/sql;
token span classes styled in app.css; per-line so gutter stays aligned.
#2: in-memory token-bucket rate limiter (ratelimit.go) on POST /api/pastes,
/api/guess-language and unlock POST; 429 + Retry-After + X-RateLimit headers.
#26: new-page JS POSTs the password to /{id} with ?next= after creation; the
unlock handler honors same-origin ?next= redirect so the creator lands on the
unlocked paste. POST /{id} route added.

Tests: ratelimit_test.go (burst/429, refill, unlock limit, highlight, auto-
unlock e2e); existing tests updated for per-test limiter isolation.
 2026-09-08 21:09:25 -05:00
poslop c6233dbbec Real web UI: /new editor, /history with live pagination, paste view with gutter and deletion banner, /unlock page; size in public API 2026-09-08 16:50:44 -05:00