4 Commits

Include renames

Author	SHA1	Message	Date
fen	e54fbc36ef	Remove cans feature; add Secure flag to pw_/tok_ cookies ... Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was half-integrated and has zero prod usage; removing it eliminates four audit findings by deletion. Removed: - internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*, /can/{id}) plus handleCanPage/renderCan - is_can from /api/mine and /api/public responses - store layer: CanRow, can store funcs, paste_cans UNION in listings, cans sweep; reserved slugs 'can'/'cans' released - templates/can.html, can CSS, is_can badges in history.js/mine.js - cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go, TestErrorCodeCanValidation) - docs/api.md cans section, README/LICENSE/docker-compose mentions Store migration: drops paste_cans only when empty (non-empty table is kept and logged; prod verified clean 2026-10-16) and drops the dormant pastes.can_id column. Covered by new TestMigrateDropsCansSchema. Security hardening (audit findings): pw_<id> (unlock) and tok_<id> (deletion-token) cookies now carry Secure: true in addition to HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test now asserts Secure. go vet ./... and go test ./... pass.	2026-10-16 16:50:40 -05:00
fen	c91d0e53ca	#256: rename page URLs to match nav labels (/public, /saved)	2026-09-17 14:30:23 -05:00
fen	ed22579bed	#243 pentest follow-up: reserve mine/unlock/guess/f custom slugs	2026-09-17 10:31:06 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00