poslop
4cb8a3e127
Merge pull request 'Search: loading indicator and performance note ( #32 )' ( #72 ) from issue-32-search-indicator into main
CI / test (push) Successful in 30s
CI / docker (push) Skipped
2026-09-09 14:26:25 +00:00
poslop
91dbf6f344
Merge pull request 'fix: input validation gaps ( #68 )' ( #78 ) from issue-68-input-validation into main
CI / test (push) Successful in 23s
CI / docker (push) Skipped
2026-09-09 14:26:19 +00:00
poslop
b600cdf51a
Merge pull request 'Admin key endpoint: per-IP rate limiting and lockout ( #66 )' ( #73 ) from issue-66-admin-ratelimit into main
CI / test (push) Successful in 24s
CI / docker (push) Skipped
2026-09-09 14:26:13 +00:00
poslop
47c9fa6386
Merge pull request 'Clamp expires_in at API boundary ( #60 )' ( #74 ) from issue-60-expiry-clamp into main
CI / test (push) Successful in 23s
CI / docker (push) Skipped
2026-09-09 14:26:07 +00:00
poslop
b7d1119d6d
Merge pull request 'docs: design for optional client-side E2E encryption (issue #39 )' ( #75 ) from issue-39-e2e-design into main
CI / test (push) Successful in 20s
CI / docker (push) Skipped
2026-09-09 14:26:02 +00:00
poslop
44fe3c5772
Merge pull request 'Security headers middleware: CSP, Referrer-Policy, nosniff ( #59 )' ( #76 ) from issue-59-security-headers into main
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 14:26:01 +00:00
poslop
556d0fa2e1
Merge pull request 'fix #63 : require deletion token on DELETE /api/pastes/{id}' ( #79 ) from issue-63-delete-auth into main
CI / test (push) Successful in 18s
CI / docker (push) Skipped
2026-09-09 14:25:40 +00:00
poslop
bdd5235f2e
Merge pull request 'fix: atomic burn-after-read claim ( #58 )' ( #77 ) from issue-58-burn-race into main
CI / test (push) Successful in 18s
CI / docker (push) Skipped
2026-09-09 14:25:06 +00:00
poslop
91568c0598
fix #63 : require deletion token on DELETE /api/pastes/{id}
...
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
- DELETE now demands the create-time deletion token (Authorization
header: Bearer/Token/bare, or ?token= query param), compared with
the constant-time store.DeletionTokenEqual. 403 otherwise.
- Creator-browser deletes via the /mine button (matching vwr cookie,
#37 ) remain allowed; other browsers and plain API clients get 403.
- Regression tests: no token, wrong token (header+query), correct
token (header+query), creator-cookie path, token extraction.
- Adapted TestSoftDelete to pass the deletion token.
- docs/API.md delete section updated.
- Based on #58 's SoftDelete (bool, error) signature.
2026-09-09 09:21:28 -05:00
poslop
c288fc73a7
Search: spinner indicator + performance note on client-side filtering ( #32 )
...
CI / test (pull_request) Successful in 19s
CI / docker (pull_request) Skipped
- Fix filter fetch to request limit=100 (API max) instead of 500, which
the API silently clamped, so filtered results actually cover the fetch window.
- Document client-side filtering behavior and limits in README Performance Notes.
2026-09-09 09:13:40 -05:00
poslop
f611cc3e9e
fix #60 : clamp expires_in on cans API (400 on zero/negative, cap 1yr)
2026-09-09 09:13:21 -05:00
poslop
03bf327f6b
fix: anchor gitignore binary pattern, track cmd/palette
CI / test (push) Successful in 22s
CI / docker (push) Successful in 44s
CI / test (pull_request) Successful in 21s
CI / docker (pull_request) Skipped
2026-09-09 02:04:03 -05:00
poslop
a604c5906a
fix: track cmd/palette (was untracked after refactor), untrack committed binary
CI / test (push) Successful in 17s
CI / docker (push) Failing after 22s
2026-09-09 02:02:57 -05:00
poslop
2c1b2818a8
CI: use static docker CLI download (no apt package in bookworm)
CI / test (push) Successful in 18s
CI / docker (push) Failing after 22s
2026-09-09 01:53:30 -05:00
poslop
b1187e061f
CI: install docker CLI in docker job (debian image lacks it)
CI / test (push) Successful in 19s
CI / docker (push) Failing after 30s
2026-09-09 01:45:53 -05:00
poslop
4f1e901f04
Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} ( #35 )
CI / test (push) Successful in 19s
CI / docker (push) Failing after 2m7s
2026-09-09 01:33:39 -05:00
poslop
a3349b4a98
Admin endpoint: ENV/file admin key, --reset-admin-key, settings API wired into ratelimit/max-bytes/default-expiry/burn-window ( #40 )
CI / test (push) Successful in 22s
CI / docker (push) Skipped
2026-09-09 00:44:02 -05:00
poslop
03600b2ed5
sweep: fix missing view_count on HTML views, API expiry bounds, search ignoring custom slug ( #33 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 00:34:24 -05:00
poslop
cb23707125
pentest: bind unlock cookie to HMAC per-paste token; serve only safe content types on /raw and can items with nosniff ( #34 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 00:14:01 -05:00
poslop
15ce7ff011
Fix unclosed composeCustomExpiry brace that broke page JS ( #48 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-08 23:58:54 -05:00
poslop
238dc96454
README rework: user-first structure, features, screenshots, config table; API detail moved to docs/API.md ( #47 )
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-08 23:54:54 -05:00
poslop
d5a47b1a31
Burn after N reads: reads_limit/reads_used, per-viewer 15min dedupe via paste_views, reads_remaining in API+stats pill, raw counts as read ( #49 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-08 23:54:03 -05:00
poslop
127c12c79a
Custom expiry: Custom radio with number+unit select, client-side validation 1min-1year, Go-duration composition ( #48 )
2026-09-08 23:54:03 -05:00
poslop
2e1ce508fa
Saved page: live search + sortable columns via shared table module ( #57 )
...
CI / test (push) Successful in 21s
CI / docker (push) Skipped
- new web/static/table.js (PaletteTable): shared live search, client-side
sort with indicators, pagination, row rendering + click-through
- history.html and mine.html both consume it; data endpoint, columns,
empty-state text and row extras (delete buttons) are page-supplied
- verified in-browser: search, sort, delete on /mine; sort, pager on /history
Closes #57
2026-09-08 22:39:41 -05:00
poslop
76d7ac12e7
Small fixes: gutter alignment, paste column, sort arrows, copy feedback, stats bar, title slug (#50-#55)
...
CI / test (push) Successful in 21s
CI / docker (push) Skipped
- #50 gutter/code line misalignment: shared --code-lh/--code-fs tokens;
.code .gutter drops its own vertical padding (was 14px vs 0, 14px offset)
- #51 history Paste column shows only the paste name, or slug pill when untitled
- #52 sort indicator arrow sits LEFT of the column label for all sortable columns
- #53 copy buttons give in-place success feedback ('Success!' in --ok for 2s):
paste view copy button and new-page result copy button
- #54 collapsed stats summary bar: roomier padding (14px 18px) and item gap (16px);
wraps gracefully on mobile
- #55 paste view title bar: slug pill only shown for custom slugs, id not repeated
Closes #50 , closes #51 , closes #52 , closes #53 , closes #54 , closes #55
2026-09-08 22:35:43 -05:00
poslop
129934b645
My pastes page /mine with anonymous viewer cookie ( #37 )
...
CI / test (push) Successful in 21s
CI / docker (push) Skipped
- vwr cookie middleware: random browser id set on first visit (reused by #49 )
- pastes table gains viewer_id column, set server-side at creation from the cookie
- GET /api/mine lists pastes for the requesting browser (title/lang/size/created)
- DELETE enforcement: 403 when client-sent vwr doesn't match the paste's viewer_id
- /mine page reuses history table styling, delete buttons, empty state
- nav: 'Saved' item between Public and Git; Git gets external-link arrow (#56 )
- tests: create-with-cookie appears in /mine, other cookie doesn't, delete enforcement
Closes #37
2026-09-08 22:10:05 -05:00
poslop
e83303a428
Consistency audit: shared input/button/heading tokens across pages ( #18 )
...
CI / test (push) Successful in 21s
CI / docker (push) Skipped
- One text-input treatment (size, color, placeholder) for .search input,
.pw-field input, #title, #custom, .row text inputs
- Icon-only buttons (.iconbtn, .btn-icon) share .btn radius + focus ring
- Unified heading letter-spacing with .side-section h3 pattern
- Normalized settings card padding to the 12/18px wide-card scale
- Verified visually: before/after screenshots for new/history/settings/unlock
Closes #18
2026-09-08 22:00:21 -05:00
poslop
acf71f7444
Palettes: pastel-lavender/peach/cloud presets + semantic status colors ( #16 )
...
CI / test (push) Successful in 21s
CI / docker (push) Skipped
- Three new light [data-preset] blocks alongside midnight (default) and smooth
- --ok/--warn/--err semantic tokens with 4.5:1 contrast per preset
- .toast success/error variants wired in new.html
- ?theme= query param preview hook in layout head (screenshots only)
- Preview screenshots in docs/palette-previews/
Closes #16
2026-09-08 21:56:36 -05:00
poslop
9c4689e6de
Mobile responsiveness: media query for 375-640px across topbar, deck, history, paste view, unlock ( #45 )
CI / test (push) Successful in 20s
CI / docker (push) Skipped
2026-09-08 21:45:42 -05:00
poslop
ebcf7eec80
Live relative-time counters via shared [data-ts] ticker in layout foot ( #46 )
CI / test (push) Successful in 20s
CI / docker (push) Skipped
2026-09-08 21:41:29 -05:00
poslop
b3112d2a35
History: sortable column headers with client-side sort ( #42 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-08 21:36:53 -05:00
poslop
6a6f4d1587
History: URL + ID columns at end, custom_slug in /api/public ( #44 )
CI / test (push) Successful in 20s
CI / docker (push) Skipped
2026-09-08 21:33:08 -05:00
poslop
e31aa44ecb
History: paste name under Paste column, drop Description column ( #43 )
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-08 21:32:10 -05:00
poslop
5b7198fb3c
Settings gear in topbar linking to placeholder /settings page ( #36 )
...
CI / test (push) Successful in 20s
CI / docker (push) Skipped
- layout.html: inline SVG gear icon top-right, styled as .iconbtn.gear pill
- new settings.html template reusing standard layout with under-construction card
- register GET /settings route in main.go
2026-09-08 21:27:02 -05:00
poslop
efa8c7145c
Language detection: switch to go-enry with hint-seeded classifier ( #41 )
...
CI / test (push) Successful in 35s
CI / docker (push) Skipped
- Add github.com/go-enry/go-enry/v2 dependency to go.mod
- guessLang: JSON fast path, then enry strategies (shebangs, XML, modelines,
content heuristics), then enry's Linguist-trained Bayesian classifier over
regex-hint candidate languages; curated dropdown expanded with typescript,
html, css, xml, php, ruby, perl, lua, dockerfile, toml, ini, diff, csharp
- enry display names normalized to lowercase stored ids (Dockerfile->dockerfile,
Shell->bash, C#->csharp); unsupported languages render unhighlighted
- Tests: existing languages, all new languages, magic markers (enry shebang/
DOCTYPE/FROM/diff handling), canonical mapping
2026-09-08 21:25:36 -05:00
poslop
7410b5c9cf
Paste view: collapsible stats pill under title ( #17 )
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-08 21:14:44 -05:00
poslop
3facff3d1e
Syntax highlighting, rate limiting, creator auto-unlock ( #1 , #2 , #26 )
...
CI / test (push) Successful in 19s
CI / docker (push) Skipped
#1 : server-side regex highlighter (highlight.go) for go/python/js/json/bash/sql;
token span classes styled in app.css; per-line so gutter stays aligned.
#2 : in-memory token-bucket rate limiter (ratelimit.go) on POST /api/pastes,
/api/guess-language and unlock POST; 429 + Retry-After + X-RateLimit headers.
#26 : new-page JS POSTs the password to /{id} with ?next= after creation; the
unlock handler honors same-origin ?next= redirect so the creator lands on the
unlocked paste. POST /{id} route added.
Tests: ratelimit_test.go (burst/429, refill, unlock limit, highlight, auto-
unlock e2e); existing tests updated for per-test limiter isolation.
2026-09-08 21:09:25 -05:00
poslop
9d75d2f80d
password reveal: slash through eye icon while password hidden
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 20:55:25 -05:00
poslop
6b21f997b5
gitignore: exclude binary and live SQLite WAL files
2026-09-08 20:53:26 -05:00
poslop
103a7a6af5
UI batch 1: copy toast, protection/custom-url spacing, pw reveal, SVG icons, unlock redesign, bfcache result reset, search spinner (#19-#25,#27,#28,#32)
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 20:52:25 -05:00
poslop
1f162c4003
sweeper: release custom URLs on expiry and after 30-day reservation ( #29 )
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 20:50:40 -05:00
poslop
0bbe65ce05
capitalization: fix placeholder casing ( #12 )
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-08 20:29:37 -05:00
poslop
db17bd20b0
UI polish: radius tokens, layered shadows, pill selections, default filenames, live search, hidden result card, em dash removal
...
CI / test (push) Successful in 17s
CI / docker (push) Skipped
Fixes #6 #7 #8 #9 #10 #11 #13 #14 #15
2026-09-08 20:28:13 -05:00
poslop
f542ce0407
new: split editor into title bar card, body card, standalone create button
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 20:01:02 -05:00
poslop
c32a6e406d
UI: scale up another 1.5x, widen history page container to fit
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:54:35 -05:00
poslop
ec8f75d80b
UI: scale everything up ~15% for readability on smaller devices
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:51:31 -05:00
poslop
efa551c566
new: language auto-detect - /api/guess-language, refresh button, guess on paste
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:41:11 -05:00
poslop
3e0e64dc4f
history: pager as its own floating pill below the list
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:34:44 -05:00
poslop
4a467ca999
history: search box under title, Search placeholder
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:32:41 -05:00
poslop
026d9b8c92
topbar: New/Public/Git labels, git opens in new tab
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:28:40 -05:00
poslop
4d98a92b09
history: fix column alignment - scope .row flex rule to new page, colgroup widths, nowrap+ellipsis cells
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:26:07 -05:00
poslop
603b807c51
history: entire row clickable, hover accent on slug
CI / test (push) Successful in 17s
CI / docker (push) Skipped
2026-09-08 19:17:20 -05:00
poslop
acafc13d20
test debian runner
CI / test (push) Successful in 1m12s
CI / docker (push) Skipped
2026-09-08 19:02:36 -05:00
poslop
176ef77737
CI: run jobs on debian-latest runner image
CI / test (push) Failing after 24s
CI / docker (push) Skipped
2026-09-08 18:57:27 -05:00
poslop
11b7fcaa8b
CI: use REGISTRY_TOKEN secret for registry login
CI / test (push) Successful in 7s
CI / docker (push) Successful in 36s
2026-09-08 18:44:06 -05:00
poslop
518a4dc026
CI: point docker job at dind sidecar via tcp DOCKER_HOST
CI / test (push) Successful in 6s
CI / docker (push) Failing after 11s
2026-09-08 18:39:36 -05:00
poslop
304c378a88
CI: trigger docker job on v* tag pushes
CI / test (push) Successful in 6s
CI / docker (push) Failing after 1m50s
2026-09-08 18:35:51 -05:00
poslop
6a08034b4c
Dockerfile, Gitea Actions CI workflow, README with API docs
CI / test (push) Successful in 1m14s
CI / docker (push) Skipped
2026-09-08 17:00:36 -05:00
poslop
c6233dbbec
Real web UI: /new editor, /history with live pagination, paste view with gutter and deletion banner, /unlock page; size in public API
2026-09-08 16:50:44 -05:00
poslop
9ff4d158ad
History: fixed column widths so columns stop shifting between pages
2026-09-08 16:39:28 -05:00
poslop
80c9a4af86
History: working pagination over full 2431-row dataset, live filter
2026-09-08 16:36:45 -05:00
poslop
76aab13fcd
History: description as own column, accurate page count (348 pages @ 7/page)
2026-09-08 16:33:56 -05:00
poslop
3412cfa44c
Clean URLs: /new /history /paste /unlock; cans out of topbar; api link renamed to git
2026-09-08 16:27:26 -05:00
poslop
ca82b90b0f
Wire sketch navigation: working topbar links, root redirects to history, cross-links between screens
2026-09-08 16:23:01 -05:00
poslop
f66c0e777b
Burn after read + deletion tokens: single-read pastes, hard-delete via token redeem
2026-09-08 16:12:25 -05:00
poslop
7d158834fc
fix customslug test: use store receiver
2026-09-08 16:10:07 -05:00
poslop
faf768ad80
Custom URLs: validated slugs with reserved words, uniqueness across pastes and cans
2026-09-08 16:09:43 -05:00
poslop
6f6954395e
Cans API: multipart create with mixed items, password-protected cans, item fetch inheriting can auth
2026-09-08 16:08:33 -05:00
poslop
7375de249d
Phase 1 API: pastes CRUD, password lock (argon2id), expiry sweeper, soft delete with 7d grace, public list
2026-09-08 16:04:34 -05:00
poslop
9ffe68e314
Add paste view, public history, can gallery, password unlock sketches
2026-09-08 15:56:12 -05:00
poslop
3556cf45e0
Initial commit: design tokens and dense-tool UI sketches
2026-09-08 15:53:44 -05:00
poslop