96 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
poslop	15f199b2fe	README: trim to brief front page + retake themed screenshots (#106) ... - Cut Admin walkthrough and API curl block to one-liners pointing at docs - Keep Configuration table, features, Get Started, doc links - Retake all screenshots against current UI, one theme each: /new midnight, /history pastel-lavender, paste view pastel-peach, /mine pastel-cloud; remove superseded stale previews	2026-09-09 17:30:54 -05:00
poslop	9df6224a27	Result box: color-code by status + friendly error messages from error codes (#105) ... - Backend create/can validation paths emit machine-readable error codes (slug_taken, slug_invalid, content_empty, content_too_large, expiry_invalid, rate_limited, ...) alongside the human message - new.html JS maps codes to plain-language guidance with generic fallback - Result card colored via --ok/--err/--warn left border (result-ok/err/warn) - docs/API.md error section documents the code field - Tests assert the code on every validation path	2026-09-09 17:28:25 -05:00
poslop	c35531e03e	Settings page: small muted Admin link (#102)	2026-09-09 17:17:00 -05:00
poslop	be2b4fb47f	Sort arrows: left of label, further spaced, vertically centered, no label shift (#101) ... Arrow is absolutely positioned at left:8px in the th, label padding-left 24px; translateY(-50%) keeps it centered regardless of row height, and being out of flow the label never moves between sorted/unsorted states.	2026-09-09 17:17:00 -05:00
poslop	064f05536a	Admin page: validate key before persisting to sessionStorage (#99) ... Panel was already display:none-gated until auth; tightened so a wrong submitted key is never stored in sessionStorage — the typed key is validated via the settings API first, and only persisted on 200.	2026-09-09 17:17:00 -05:00
poslop	4175ffef3e	CSS: inline sort arrow with uniform 8px gap (#103), full-pill slug roundness (#104)	2026-09-09 17:10:24 -05:00
poslop	ea9edc211a	UI: consistent sort arrow gap, uniform pill roundness (slug -> radius-sm)	2026-09-09 16:50:06 -05:00
poslop	6d467312af	Merge minor fixes: #92-#98, #100 theme switcher + cans work	2026-09-09 16:40:53 -05:00
poslop	b21be29daa	minor fixes: version label (#93), view dedupe tests (#95)	2026-09-09 16:40:53 -05:00
poslop	cd70dd0b0e	Merge origin/main (license, compose, #65 leak guard) into cans work	2026-09-09 16:39:14 -05:00
poslop	5b9be808ed	Merge origin/main: keep can listing rows with #65 password-metadata leak guard	2026-09-09 16:36:55 -05:00
poslop	19804d47a3	Cans UI + parity: unlock-cookie flow, /can page, listings badge, custom slug, delete, sweeper; #32 perf notes (#4, #32)	2026-09-09 16:34:51 -05:00
poslop	ffc10c2b86	README: link to docker-compose example	2026-09-09 16:16:28 +00:00
poslop	bf5a79878f	add example docker-compose.yml documenting all env vars	2026-09-09 16:16:15 +00:00
poslop	60200ac14b	README: license section with as-is / no-liability disclaimer	2026-09-09 16:12:41 +00:00
poslop	49f7b6e7a4	add AGPLv3 license with copyright and warranty disclaimer notice	2026-09-09 16:12:19 +00:00
poslop	959a83be1e	Merge pull request 'Bound title and language at create time (#86)' (#91) from fix-86-field-bounds into main	2026-09-09 15:59:32 +00:00
poslop	5b068faf8f	Merge pull request 'ratelimit: rightmost untrusted-hop-safe client IP (fixes #85)' (#89) from fix-85-xff into main	2026-09-09 15:59:29 +00:00
poslop	b0360af79c	Merge pull request 'Fix #83: create API ignores boolean public field' (#88) from fix-83-public-false into main	2026-09-09 15:59:26 +00:00
poslop	806798fae6	Merge pull request 'Rate-limit all password verification attempts (#81)' (#90) from fix-81-password-ratelimit into main	2026-09-09 15:59:24 +00:00
poslop	8977c05cda	Merge pull request 'fix #84: security headers were silently dropped (set pre-handler)' (#87) from fix-84-headers-prewrite into main	2026-09-09 15:59:21 +00:00
poslop	7ca1b58362	Merge pull request 'docs: attachments & storage backend design (#38, #31)' (#69) from issue-38-31-storage-design into main	2026-09-09 14:27:50 +00:00
poslop	8d0825ac09	Merge pull request 'docs: cookie-based preferences and access keys design (#30)' (#70) from issue-30-cookie-design into main	2026-09-09 14:27:14 +00:00
poslop	4cb8a3e127	Merge pull request 'Search: loading indicator and performance note (#32)' (#72) from issue-32-search-indicator into main	2026-09-09 14:26:25 +00:00
poslop	91dbf6f344	Merge pull request 'fix: input validation gaps (#68)' (#78) from issue-68-input-validation into main	2026-09-09 14:26:19 +00:00
poslop	b600cdf51a	Merge pull request 'Admin key endpoint: per-IP rate limiting and lockout (#66)' (#73) from issue-66-admin-ratelimit into main	2026-09-09 14:26:13 +00:00
poslop	47c9fa6386	Merge pull request 'Clamp expires_in at API boundary (#60)' (#74) from issue-60-expiry-clamp into main	2026-09-09 14:26:07 +00:00
poslop	b7d1119d6d	Merge pull request 'docs: design for optional client-side E2E encryption (issue #39)' (#75) from issue-39-e2e-design into main	2026-09-09 14:26:02 +00:00
poslop	44fe3c5772	Merge pull request 'Security headers middleware: CSP, Referrer-Policy, nosniff (#59)' (#76) from issue-59-security-headers into main	2026-09-09 14:26:01 +00:00
poslop	556d0fa2e1	Merge pull request 'fix #63: require deletion token on DELETE /api/pastes/{id}' (#79) from issue-63-delete-auth into main	2026-09-09 14:25:40 +00:00
poslop	bdd5235f2e	Merge pull request 'fix: atomic burn-after-read claim (#58)' (#77) from issue-58-burn-race into main	2026-09-09 14:25:06 +00:00
poslop	91568c0598	fix #63: require deletion token on DELETE /api/pastes/{id} ... - DELETE now demands the create-time deletion token (Authorization header: Bearer/Token/bare, or ?token= query param), compared with the constant-time store.DeletionTokenEqual. 403 otherwise. - Creator-browser deletes via the /mine button (matching vwr cookie, #37) remain allowed; other browsers and plain API clients get 403. - Regression tests: no token, wrong token (header+query), correct token (header+query), creator-cookie path, token extraction. - Adapted TestSoftDelete to pass the deletion token. - docs/API.md delete section updated. - Based on #58's SoftDelete (bool, error) signature.	2026-09-09 09:21:28 -05:00
poslop	5a2aa0f96d	docs: design note for cookie-based preferences and access keys (#30)	2026-09-09 09:14:25 -05:00
poslop	c288fc73a7	Search: spinner indicator + performance note on client-side filtering (#32) ... - Fix filter fetch to request limit=100 (API max) instead of 500, which the API silently clamped, so filtered results actually cover the fetch window. - Document client-side filtering behavior and limits in README Performance Notes.	2026-09-09 09:13:40 -05:00
poslop	f611cc3e9e	fix #60: clamp expires_in on cans API (400 on zero/negative, cap 1yr)	2026-09-09 09:13:21 -05:00
poslop	594b5f01aa	docs: attachments & storage backend design (#38, #31) ... - attachments: filesystem-on-PVC recommended, blob interface keeps MinIO as a later drop-in; size limits via admin setting; sniffed-mime + nosniff/sandbox serving rules - storage backend: stay SQLite-only (WAL, modernc); no Postgres/Redis and no backend abstraction until documented trigger conditions fire	2026-09-09 09:10:15 -05:00
poslop	03bf327f6b	fix: anchor gitignore binary pattern, track cmd/palette	2026-09-09 02:04:03 -05:00
poslop	a604c5906a	fix: track cmd/palette (was untracked after refactor), untrack committed binary	2026-09-09 02:02:57 -05:00
poslop	2c1b2818a8	CI: use static docker CLI download (no apt package in bookworm)	2026-09-09 01:53:30 -05:00
poslop	b1187e061f	CI: install docker CLI in docker job (debian image lacks it)	2026-09-09 01:45:53 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00
poslop	a3349b4a98	Admin endpoint: ENV/file admin key, --reset-admin-key, settings API wired into ratelimit/max-bytes/default-expiry/burn-window (#40)	2026-09-09 00:44:02 -05:00
poslop	03600b2ed5	sweep: fix missing view_count on HTML views, API expiry bounds, search ignoring custom slug (#33)	2026-09-09 00:34:24 -05:00
poslop	cb23707125	pentest: bind unlock cookie to HMAC per-paste token; serve only safe content types on /raw and can items with nosniff (#34)	2026-09-09 00:14:01 -05:00
poslop	15ce7ff011	Fix unclosed composeCustomExpiry brace that broke page JS (#48)	2026-09-08 23:58:54 -05:00
poslop	238dc96454	README rework: user-first structure, features, screenshots, config table; API detail moved to docs/API.md (#47)	2026-09-08 23:54:54 -05:00
poslop	d5a47b1a31	Burn after N reads: reads_limit/reads_used, per-viewer 15min dedupe via paste_views, reads_remaining in API+stats pill, raw counts as read (#49)	2026-09-08 23:54:03 -05:00
poslop	127c12c79a	Custom expiry: Custom radio with number+unit select, client-side validation 1min-1year, Go-duration composition (#48)	2026-09-08 23:54:03 -05:00
poslop	2e1ce508fa	Saved page: live search + sortable columns via shared table module (#57) ... - new web/static/table.js (PaletteTable): shared live search, client-side sort with indicators, pagination, row rendering + click-through - history.html and mine.html both consume it; data endpoint, columns, empty-state text and row extras (delete buttons) are page-supplied - verified in-browser: search, sort, delete on /mine; sort, pager on /history Closes #57	2026-09-08 22:39:41 -05:00
poslop	76d7ac12e7	Small fixes: gutter alignment, paste column, sort arrows, copy feedback, stats bar, title slug (#50-#55) ... - #50 gutter/code line misalignment: shared --code-lh/--code-fs tokens; .code .gutter drops its own vertical padding (was 14px vs 0, 14px offset) - #51 history Paste column shows only the paste name, or slug pill when untitled - #52 sort indicator arrow sits LEFT of the column label for all sortable columns - #53 copy buttons give in-place success feedback ('Success!' in --ok for 2s): paste view copy button and new-page result copy button - #54 collapsed stats summary bar: roomier padding (14px 18px) and item gap (16px); wraps gracefully on mobile - #55 paste view title bar: slug pill only shown for custom slugs, id not repeated Closes #50, closes #51, closes #52, closes #53, closes #54, closes #55	2026-09-08 22:35:43 -05:00
poslop	129934b645	My pastes page /mine with anonymous viewer cookie (#37) ... - vwr cookie middleware: random browser id set on first visit (reused by #49) - pastes table gains viewer_id column, set server-side at creation from the cookie - GET /api/mine lists pastes for the requesting browser (title/lang/size/created) - DELETE enforcement: 403 when client-sent vwr doesn't match the paste's viewer_id - /mine page reuses history table styling, delete buttons, empty state - nav: 'Saved' item between Public and Git; Git gets external-link arrow (#56) - tests: create-with-cookie appears in /mine, other cookie doesn't, delete enforcement Closes #37	2026-09-08 22:10:05 -05:00
poslop	e83303a428	Consistency audit: shared input/button/heading tokens across pages (#18) ... - One text-input treatment (size, color, placeholder) for .search input, .pw-field input, #title, #custom, .row text inputs - Icon-only buttons (.iconbtn, .btn-icon) share .btn radius + focus ring - Unified heading letter-spacing with .side-section h3 pattern - Normalized settings card padding to the 12/18px wide-card scale - Verified visually: before/after screenshots for new/history/settings/unlock Closes #18	2026-09-08 22:00:21 -05:00
poslop	acf71f7444	Palettes: pastel-lavender/peach/cloud presets + semantic status colors (#16) ... - Three new light [data-preset] blocks alongside midnight (default) and smooth - --ok/--warn/--err semantic tokens with 4.5:1 contrast per preset - .toast success/error variants wired in new.html - ?theme= query param preview hook in layout head (screenshots only) - Preview screenshots in docs/palette-previews/ Closes #16	2026-09-08 21:56:36 -05:00
poslop	9c4689e6de	Mobile responsiveness: media query for 375-640px across topbar, deck, history, paste view, unlock (#45)	2026-09-08 21:45:42 -05:00
poslop	ebcf7eec80	Live relative-time counters via shared [data-ts] ticker in layout foot (#46)	2026-09-08 21:41:29 -05:00
poslop	b3112d2a35	History: sortable column headers with client-side sort (#42)	2026-09-08 21:36:53 -05:00
poslop	6a6f4d1587	History: URL + ID columns at end, custom_slug in /api/public (#44)	2026-09-08 21:33:08 -05:00
poslop	e31aa44ecb	History: paste name under Paste column, drop Description column (#43)	2026-09-08 21:32:10 -05:00
poslop	5b7198fb3c	Settings gear in topbar linking to placeholder /settings page (#36) ... - layout.html: inline SVG gear icon top-right, styled as .iconbtn.gear pill - new settings.html template reusing standard layout with under-construction card - register GET /settings route in main.go	2026-09-08 21:27:02 -05:00
poslop	efa8c7145c	Language detection: switch to go-enry with hint-seeded classifier (#41) ... - Add github.com/go-enry/go-enry/v2 dependency to go.mod - guessLang: JSON fast path, then enry strategies (shebangs, XML, modelines, content heuristics), then enry's Linguist-trained Bayesian classifier over regex-hint candidate languages; curated dropdown expanded with typescript, html, css, xml, php, ruby, perl, lua, dockerfile, toml, ini, diff, csharp - enry display names normalized to lowercase stored ids (Dockerfile->dockerfile, Shell->bash, C#->csharp); unsupported languages render unhighlighted - Tests: existing languages, all new languages, magic markers (enry shebang/ DOCTYPE/FROM/diff handling), canonical mapping	2026-09-08 21:25:36 -05:00
poslop	7410b5c9cf	Paste view: collapsible stats pill under title (#17)	2026-09-08 21:14:44 -05:00
poslop	3facff3d1e	Syntax highlighting, rate limiting, creator auto-unlock (#1, #2, #26) ... #1: server-side regex highlighter (highlight.go) for go/python/js/json/bash/sql; token span classes styled in app.css; per-line so gutter stays aligned. #2: in-memory token-bucket rate limiter (ratelimit.go) on POST /api/pastes, /api/guess-language and unlock POST; 429 + Retry-After + X-RateLimit headers. #26: new-page JS POSTs the password to /{id} with ?next= after creation; the unlock handler honors same-origin ?next= redirect so the creator lands on the unlocked paste. POST /{id} route added. Tests: ratelimit_test.go (burst/429, refill, unlock limit, highlight, auto- unlock e2e); existing tests updated for per-test limiter isolation.	2026-09-08 21:09:25 -05:00
poslop	9d75d2f80d	password reveal: slash through eye icon while password hidden	2026-09-08 20:55:25 -05:00
poslop	6b21f997b5	gitignore: exclude binary and live SQLite WAL files	2026-09-08 20:53:26 -05:00
poslop	103a7a6af5	UI batch 1: copy toast, protection/custom-url spacing, pw reveal, SVG icons, unlock redesign, bfcache result reset, search spinner (#19-#25,#27,#28,#32)	2026-09-08 20:52:25 -05:00
poslop	1f162c4003	sweeper: release custom URLs on expiry and after 30-day reservation (#29)	2026-09-08 20:50:40 -05:00
poslop	0bbe65ce05	capitalization: fix placeholder casing (#12)	2026-09-08 20:29:37 -05:00
poslop	db17bd20b0	UI polish: radius tokens, layered shadows, pill selections, default filenames, live search, hidden result card, em dash removal ... Fixes #6 #7 #8 #9 #10 #11 #13 #14 #15	2026-09-08 20:28:13 -05:00
poslop	f542ce0407	new: split editor into title bar card, body card, standalone create button	2026-09-08 20:01:02 -05:00
poslop	c32a6e406d	UI: scale up another 1.5x, widen history page container to fit	2026-09-08 19:54:35 -05:00
poslop	ec8f75d80b	UI: scale everything up ~15% for readability on smaller devices	2026-09-08 19:51:31 -05:00
poslop	efa551c566	new: language auto-detect - /api/guess-language, refresh button, guess on paste	2026-09-08 19:41:11 -05:00
poslop	3e0e64dc4f	history: pager as its own floating pill below the list	2026-09-08 19:34:44 -05:00
poslop	4a467ca999	history: search box under title, Search placeholder	2026-09-08 19:32:41 -05:00
poslop	026d9b8c92	topbar: New/Public/Git labels, git opens in new tab	2026-09-08 19:28:40 -05:00
poslop	4d98a92b09	history: fix column alignment - scope .row flex rule to new page, colgroup widths, nowrap+ellipsis cells	2026-09-08 19:26:07 -05:00
poslop	603b807c51	history: entire row clickable, hover accent on slug	2026-09-08 19:17:20 -05:00
poslop	acafc13d20	test debian runner	2026-09-08 19:02:36 -05:00
poslop	176ef77737	CI: run jobs on debian-latest runner image	2026-09-08 18:57:27 -05:00
poslop	11b7fcaa8b	CI: use REGISTRY_TOKEN secret for registry login	2026-09-08 18:44:06 -05:00
poslop	518a4dc026	CI: point docker job at dind sidecar via tcp DOCKER_HOST	2026-09-08 18:39:36 -05:00
poslop	304c378a88	CI: trigger docker job on v* tag pushes	2026-09-08 18:35:51 -05:00
poslop	6a08034b4c	Dockerfile, Gitea Actions CI workflow, README with API docs	2026-09-08 17:00:36 -05:00
poslop	c6233dbbec	Real web UI: /new editor, /history with live pagination, paste view with gutter and deletion banner, /unlock page; size in public API	2026-09-08 16:50:44 -05:00
poslop	9ff4d158ad	History: fixed column widths so columns stop shifting between pages	2026-09-08 16:39:28 -05:00
poslop	80c9a4af86	History: working pagination over full 2431-row dataset, live filter	2026-09-08 16:36:45 -05:00
poslop	76aab13fcd	History: description as own column, accurate page count (348 pages @ 7/page)	2026-09-08 16:33:56 -05:00
poslop	3412cfa44c	Clean URLs: /new /history /paste /unlock; cans out of topbar; api link renamed to git	2026-09-08 16:27:26 -05:00
poslop	ca82b90b0f	Wire sketch navigation: working topbar links, root redirects to history, cross-links between screens	2026-09-08 16:23:01 -05:00
poslop	f66c0e777b	Burn after read + deletion tokens: single-read pastes, hard-delete via token redeem	2026-09-08 16:12:25 -05:00
poslop	7d158834fc	fix customslug test: use store receiver	2026-09-08 16:10:07 -05:00
poslop	faf768ad80	Custom URLs: validated slugs with reserved words, uniqueness across pastes and cans	2026-09-08 16:09:43 -05:00
poslop	6f6954395e	Cans API: multipart create with mixed items, password-protected cans, item fetch inheriting can auth	2026-09-08 16:08:33 -05:00
poslop	7375de249d	Phase 1 API: pastes CRUD, password lock (argon2id), expiry sweeper, soft delete with 7d grace, public list	2026-09-08 16:04:34 -05:00
poslop	9ffe68e314	Add paste view, public history, can gallery, password unlock sketches	2026-09-08 15:56:12 -05:00
poslop	3556cf45e0	Initial commit: design tokens and dense-tool UI sketches	2026-09-08 15:53:44 -05:00