palette

8 Commits

Author	SHA1	Message	Date
agent	3d1d5ee1fd	ratelimit: key on rightmost X-Forwarded-For entry (fixes #85 ) CI / test (pull_request) Successful in 21s Details CI / docker (pull_request) Skipped Details	2026-09-09 10:57:59 -05:00
Hermes Agent	ccb22a2d28	#83 : accept boolean public field in create API (false->unlisted, true->public) CI / test (pull_request) Successful in 23s Details CI / docker (pull_request) Skipped Details	2026-09-09 10:57:56 -05:00
agent	94a4a3c2ec	fix: input validation gaps (#68 ) CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details - enforce server-side body cap via http.MaxBytesReader: oversized JSON bodies are rejected with 413 instead of being fully decoded first - negative burn_after_reads rejected with 400 (zero still = default 1) - limit=0 explicitly maps to default page size; shared parseLimit clamp for /api/public and /api/mine (huge/non-numeric values too) - negative/non-numeric offset clamped to 0 via parseOffset (was pass-through) - regression tests in issue68_validation_test.go expires_at/expires_in validation intentionally excluded: covered by #60.	2026-09-09 09:21:25 -05:00
agent	78374b2d49	fix: atomic burn-after-read claim (#58 ) CI / test (pull_request) Successful in 20s Details CI / docker (pull_request) Skipped Details SoftDelete now reports whether it performed the delete (conditional UPDATE ... WHERE deleted_at IS NULL checked via RowsAffected). RegisterRead returns an admitted flag: legacy burn pastes admit exactly one reader (the atomic soft-delete winner), and burn-after-N pastes increment reads_used via a conditional UPDATE guarded on reads_used < reads_limit, so concurrent readers cannot both consume the final read. API, HTML, and raw read paths return 404 when the reader loses the burn claim; content is never served twice. OpenStore pins the SQLite pool to one connection: concurrent writes on separate pooled connections surfaced SQLITE_BUSY as spurious 500s instead of serializing. Adds concurrency regression tests: 24 parallel readers of a burn paste (exactly one receives content, none of the others leak it) and 30 parallel readers vs a 3-read budget (exactly 3 admitted, then 404).	2026-09-09 09:18:42 -05:00
palette-agent	e08cafe9c8	security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59 ) CI / test (pull_request) Successful in 30s Details CI / docker (pull_request) Skipped Details - web.SecurityHeaders middleware wired into the chi router - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none' - Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff - Applied only to text/html responses; JSON API and /raw pass through unchanged - Regression test internal/web/securityheaders_test.go	2026-09-09 09:16:42 -05:00
Hermes Agent	2159982795	docs: design for optional client-side E2E encryption (issue #39 ) CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details	2026-09-09 09:16:13 -05:00
palette-agent	9811191648	admin: per-IP rate limit (5/min) on admin key attempts (#66 ) CI / test (pull_request) Successful in 23s Details CI / docker (pull_request) Skipped Details	2026-09-09 09:15:01 -05:00
Hermes Agent	f6c4342468	Exclude password-protected pastes from public listings (#65 ) CI / test (pull_request) Successful in 20s Details CI / docker (pull_request) Skipped Details ListPublic and its COUNT query now filter password_hash IS NULL, so /api/public (and any page backed by it) no longer leaks metadata (title, slug, existence) of password-protected pastes. Unlisted pastes were already excluded. Adds regression test covering both.	2026-09-09 09:13:26 -05:00