Merge dev: burn fix, version label, theme persistence, admin/settings UI, theme grid, CSP fix, docs

t.colors was removed by #113; rendering threw on first iteration and
the theme grid rendered empty. Use the colors returned by
presetColors(t.id) instead. Verified in headless chromium: 5
theme-card elements render on /settings.

.gitea/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     tags: ['v*']
   pull_request:
 
@@ -23,8 +23,8 @@ jobs:
         run: go test -v ./...
 
   docker:
-    # build & push image only on tags (releases)
+    # build & push image only on tags (releases) and dev branch (dev deploy)
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/dev'
     needs: test
     runs-on: [debian-latest]
     env:
@@ -36,6 +36,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install Docker CLI
+        run: |
+          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz -o /tmp/docker.tgz             && tar -xzf /tmp/docker.tgz -C /tmp && mv /tmp/docker/docker /usr/local/bin/docker && chmod +x /usr/local/bin/docker
+
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -51,8 +55,9 @@ jobs:
         with:
           context: .
           push: true
+          build-args: VERSION=${{ gitea.ref_name }}
           tags: |
             git.archfox.org/poslop/palette:${{ gitea.ref_name }}
-            git.archfox.org/poslop/palette:latest
+            ${{ startsWith(gitea.ref, 'refs/tags/') && 'git.archfox.org/poslop/palette:latest' || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.gitignore

@@ -1,4 +1,6 @@
-palette
+/palette
 palette.db
 palette.db-shm
 palette.db-wal
+admin-key
+settings.json

Dockerfile

@@ -9,7 +9,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /palette .
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X palette/internal/web.Version=${VERSION}" -o /palette ./cmd/palette
 
 # ---- runtime stage ----
 FROM alpine:3.20

LICENSE

@@ -0,0 +1,679 @@
+Palette - self-hosted pastebin with paste cans
+Copyright (C) 2026 poslop
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, version 3 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+SPDX-License-Identifier: AGPL-3.0-only
+
+--------------------------------------------------------------------------------
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,112 +1,97 @@
 # Palette
 
-Fast, self-hosted pastebin with paste cans, password lock, expiry, custom URLs, and an API-first design.
+Palette is a fast, self-hosted pastebin. One Go binary, a SQLite database, and
+a web UI for sharing text and small files
 
-## Quick start
+> [!NOTE]
+> <table><tr><td>
+> <sub>✨ This project was built by AI — <strong>GLM 5.3 Flash</strong> on the <strong>Hermes Agent</strong> harness, with a human in the loop.</sub>
+> </td></tr></table>
+
+## Features
+
+- Multiple files in one paste
+- Password protected pastes
+- Expir after a specified time
+- Burn after a number of views
+- Custom URLs
+- Syntax highlighting with language auto-detection (go-enry)
+- Local cookie based submission history
+- Cookie based settings
+- Themes!
+
+## Screenshots
+
+| | |
+|---|---|
+| ![Editor in midnight](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmidnight-new.png) | ![Paste view in pastel-peach](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-peach-paste.png) |
+| ![History in pastel-lavender](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-lavender-history.png) | ![Saved in pastel-cloud](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-cloud-mine.png) |
+
+## Get Started
+
+### Docker
 
 ```bash
-go build -o palette .
+docker run -p 8080:8080 -v palette-data:/data git.archfox.org/poslop/palette
+```
+
+The SQLite database lives in the `/data` volume inside the container.
+
+## Docker Compose
+
+See [docker-compose.yml](docker-compose.yml) for a ready-to-use example with
+every environment variable documented, including which are required (only the
+/data volume) and which are optional.
+
+### Build from source
+
+Requires Go 1.27+.
+
+```bash
+go build -o palette ./cmd/palette
 ./palette
-# UI at http://localhost:8080
+# open http://localhost:8080
 ```
 
-## Docker
-
-```bash
-docker build -t palette .
-docker run -p 8080:8080 -v palette-data:/data palette
-```
 
 ## Configuration
 
-| Env var | Default | Description |
+| Setting | Default | Description |
 |---|---|---|
 | `PALETTE_ADDR` | `:8080` | Listen address |
 | `PALETTE_DB` | `palette.db` | SQLite database path |
 | `PALETTE_MAX_TEXT` | `5242880` | Max paste size in bytes (5 MB) |
 | `PALETTE_MAX_ITEM` | `26214400` | Max can item size in bytes (25 MB) |
+| `PALETTE_ADMIN_KEY` | generated | Admin key; if unset a 32-char hex key is generated and persisted to `<db-dir>/admin-key` (0600) |
+
+An `/admin` page exists for runtime settings, protected by a key set at
+install (`PALETTE_ADMIN_KEY` env var) and resettable locally — see
+[API](https://git.archfox.org/poslop/palette/wiki/API) and the [design docs](https://git.archfox.org/poslop/palette/wiki/Home) in the wiki for details.
 
 ## API
 
-### Create paste
+Full REST API: [wiki/API](https://git.archfox.org/poslop/palette/wiki/API). One example:
+
 ```bash
-curl -X POST http://localhost:8080/api/pastes \
+curl -X POST http://localhost:8080/api/pastes -d '{"content":"hello"}'
-  -H "Content-Type: application/json" \
-  -d '{
-    "content": "print(hello)",
-    "title": "my snippet",
-    "language": "python",
-    "expires_in": "168h",
-    "password": "optional",
-    "custom_slug": "optional",
-    "burn_after_read": false,
-    "visibility": "public"
-  }'
 ```
 
-Response includes `id`, `url`, `raw_url`, `api_url`, and a one-time `deletion_token`.
+Design docs: [wiki/design](https://git.archfox.org/poslop/palette/wiki/design-attachments-storage) (e2e encryption, attachments & storage, cookie preferences).
 
-### Get paste
-```bash
-curl http://localhost:8080/api/pastes/{id}
-# password-protected pastes:
-curl "http://localhost:8080/api/pastes/{id}?password=secret"
-# or via header: X-Paste-Password: secret
-```
 
-### Raw content
-```bash
-curl http://localhost:8080/raw/{id}
-```
 
-### Soft delete
-```bash
-curl -X DELETE http://localhost:8080/api/pastes/{id}
-```
 
-### Hard delete (requires deletion token)
+## License
-```bash
-curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"
-```
 
-### Public history
+Palette is licensed under the GNU Affero General Public License v3.0
-```bash
+(AGPL-3.0-only). See [LICENSE](LICENSE).
-curl "http://localhost:8080/api/public?limit=25&offset=0"
-```
 
-### Create can (bundle of items)
+The software is provided AS IS, without warranty of any kind, express or
-```bash
+implied, including merchantability and fitness for a particular purpose.
-curl -X POST http://localhost:8080/api/pastes/can \
+In no event shall the authors be liable for any claim, damages, or other
-  -F "title=My bundle" \
+liability, including without limitation any security vulnerabilities,
-  -F "expires_in=48h" \
+data loss, or legal issues arising from use of the software. You use it
-  -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
+at your own risk.
-  -F "files=@screenshot.png" \
-  -F "files=@log.txt"
-```
 
-### Get can + items
+If you run a modified version of Palette as a network service, the AGPL
-```bash
+requires you to offer your modified source code to its users.
-curl http://localhost:8080/api/cans/{id}
-curl http://localhost:8080/api/cans/{id}/items/{item_id}
-```
-
-## Expiry and deletion
-
-- Expired pastes are soft-deleted by a background sweeper (runs every minute).
-- Soft-deleted pastes are hard-deleted after a 7-day grace period.
-- Deletion tokens allow immediate hard delete.
-- Burn-after-read pastes are soft-deleted on first read.
-
-## Web pages
-
-- `/new` — create a paste
-- `/history` — public paste history
-- `/{id}` — view a paste
-- `/unlock/{id}` — password gate for protected pastes
-- `/raw/{id}` — raw content with original content type
-
-## CI
-
-Gitea Actions workflow at `.gitea/workflows/ci.yml`:
-- On push to main: `go vet` + `go test`
-- On tags: build and push Docker image to `git.archfox.org/poslop/palette`

burn.go

@@ -1,54 +0,0 @@
-package main
-
-import (
-	"crypto/rand"
-	"crypto/subtle"
-	"encoding/base64"
-	"net/http"
-
-	"github.com/go-chi/chi/v5"
-)
-
-// genDeletionToken returns a 32-char url-safe random token
-func genDeletionToken() string {
-	b := make([]byte, 24)
-	rand.Read(b)
-	return base64.RawURLEncoding.EncodeToString(b)
-}
-
-// maybeBurn marks a paste soft-deleted if burn_after_read is set.
-// Returns true if this read consumed the paste.
-func (s *Store) maybeBurn(row *PasteRow) bool {
-	if !row.BurnAfterRead {
-		return false
-	}
-	s.SoftDelete(row.ID)
-	return true
-}
-
-func deletionTokenEqual(stored, given string) bool {
-	return subtle.ConstantTimeCompare([]byte(stored), []byte(given)) == 1
-}
-
-// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
-// DELETE /api/pastes/{id}/redeem?token=...
-func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	token := r.URL.Query().Get("token")
-	if token == "" {
-		writeErr(w, 400, "token required")
-		return
-	}
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	if row.DeletionToken.String == "" || !deletionTokenEqual(row.DeletionToken.String, token) {
-		writeErr(w, 403, "invalid token")
-		return
-	}
-	// hard delete: pastes table row goes away entirely
-	a.store.db.Exec(`DELETE FROM pastes WHERE id = ?`, row.ID)
-	writeJSON(w, 200, map[string]string{"status": "deleted"})
-}

cmd/palette/main.go

@@ -0,0 +1,48 @@
+// Command palette is the palette pastebin server entrypoint: flag parsing
+// and wiring of the store, API, and web packages.
+package main
+
+import (
+	"log"
+	"os"
+	"net/http"
+	"time"
+
+	"palette/internal/api"
+	"palette/internal/store"
+	"palette/internal/web"
+)
+
+func main() {
+	// #40: --reset-admin-key regenerates the admin key and exits.
+	if len(os.Args) > 1 && os.Args[1] == "--reset-admin-key" {
+		api.HandleResetAdminKey(api.EnvOr("PALETTE_DB", "palette.db"))
+		return
+	}
+	cfg := api.Config{
+		Addr:         api.EnvOr("PALETTE_ADDR", ":8080"),
+		DBPath:       api.EnvOr("PALETTE_DB", "palette.db"),
+		MaxTextBytes: int64(api.EnvIntOr("PALETTE_MAX_TEXT", 5*1024*1024)),
+		MaxItemBytes: int64(api.EnvIntOr("PALETTE_MAX_ITEM", 25*1024*1024)),
+	}
+	st, err := store.OpenStore(cfg.DBPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	adminKey, err := api.ResolveAdminKey(cfg.DBPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+	ss := api.LoadSettingsStore(cfg.DBPath, cfg)
+
+	st.StartSweeper(time.Minute, ss.Get().CustomSlugReservationDays)
+
+	ui, err := web.New()
+	if err != nil {
+		log.Fatal(err)
+	}
+	srv := api.NewServer(st, cfg, ui, ss, adminKey)
+	log.Printf("palette listening on %s", cfg.Addr)
+	log.Fatal(http.ListenAndServe(cfg.Addr, srv.Routes()))
+}

docker-compose.yml

@@ -0,0 +1,46 @@
+# Example docker-compose deployment for Palette.
+# All environment variables are optional; sensible defaults apply.
+# The only hard requirement is a volume on /data so the SQLite database
+# and the auto-generated admin key survive restarts.
+
+services:
+  palette:
+    image: git.archfox.org/poslop/palette:v0.2.2
+    # image: git.archfox.org/poslop/palette:latest   # tracks main, less stable
+    restart: unless-stopped
+    ports:
+      - "8080:8080"          # host:container; the app listens on :8080
+    volumes:
+      - palette-data:/data   # REQUIRED: SQLite db, admin key, attachments
+    environment:
+      # Address the server binds to inside the container.
+      # Default: ":8080". Only change if you also change the ports mapping.
+      PALETTE_ADDR: ":8080"
+
+      # Path to the SQLite database file.
+      # Default: "/data/palette.db". Keep it on the /data volume.
+      PALETTE_DB: "/data/palette.db"
+
+      # Admin API key for /admin/api/settings (rate limits, size caps, expiry).
+      # Default: random key generated on first start and persisted to
+      # /data/admin-key (mode 0600). Read it with:
+      #   docker compose exec palette cat /data/admin-key
+      # Set this only if you want a fixed key (e.g. for automation).
+      # PALETTE_ADMIN_KEY: "change-me"
+
+      # Max size in bytes of a single text paste. Oversized creates get 413.
+      # Default: 5242880 (5 MiB).
+      # PALETTE_MAX_TEXT: "5242880"
+
+      # Max size in bytes of a single can item (file/text inside a can).
+      # Default: 26214400 (25 MiB).
+      # PALETTE_MAX_ITEM: "26214400"
+
+      # HMAC secret for password-unlock cookies. Default: random per start,
+      # which logs out every unlocked browser session on restart. Set a fixed
+      # secret (any random string) to keep unlock sessions across restarts,
+      # or when running multiple replicas that must agree.
+      # PALETTE_UNLOCK_SECRET: "generate-with-openssl-rand-base64-32"
+
+volumes:
+  palette-data:

internal/api/admin.go

@@ -0,0 +1,208 @@
+package api
+
+import (
+	"palette/internal/store"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+// #40: admin endpoint with an install-time key. The key is read from
+// PALETTE_ADMIN_KEY when set; otherwise a 32-char random hex key is generated
+// and persisted to <db-dir>/admin-key (0600) so it survives restarts.
+
+// Settings holds the runtime-tunable values the admin API exposes. The list
+// is intentionally small and extensible: add a field + JSON tag, wire it into
+// the consumer, and it round-trips through GET/POST /admin/api/settings.
+type Settings struct {
+	RateLimitBurst             float64 `json:"rate_limit_burst"`
+	RateLimitPerMinute         float64 `json:"rate_limit_per_minute"`
+	MaxContentBytes            int64   `json:"max_content_bytes"`
+	DefaultExpiry              string  `json:"default_expiry"`
+	CustomSlugReservationDays  int     `json:"custom_slug_reservation_days"`
+	BurnViewerWindowMinutes    int     `json:"burn_viewer_window_minutes"`
+}
+
+func defaultSettings(cfg Config) Settings {
+	return Settings{
+		RateLimitBurst:             5,
+		RateLimitPerMinute:         60, // 1 req/sec refill
+		MaxContentBytes:            cfg.MaxTextBytes,
+		DefaultExpiry:              "", // no default: pastes are permanent unless expires_in given
+		CustomSlugReservationDays:  30,
+		BurnViewerWindowMinutes:    15,
+	}
+}
+
+// settingsStore keeps the current settings in memory (mutex-guarded) and
+// persists them as JSON to <db-dir>/settings.json.
+type settingsStore struct {
+	mu   sync.RWMutex
+	cur  Settings
+	path string
+}
+
+// LoadSettingsStore loads (or initializes) the settings store.
+func LoadSettingsStore(dbPath string, cfg Config) *settingsStore {
+	p := filepath.Join(filepath.Dir(dbPath), "settings.json")
+	ss := &settingsStore{cur: defaultSettings(cfg), path: p}
+	if b, err := os.ReadFile(p); err == nil {
+		var s Settings
+		if json.Unmarshal(b, &s) == nil {
+			// merge over defaults so newly added fields keep sane values
+			def := defaultSettings(cfg)
+			if s.RateLimitBurst > 0 {
+				def.RateLimitBurst = s.RateLimitBurst
+			}
+			if s.RateLimitPerMinute > 0 {
+				def.RateLimitPerMinute = s.RateLimitPerMinute
+			}
+			if s.MaxContentBytes > 0 {
+				def.MaxContentBytes = s.MaxContentBytes
+			}
+			if s.DefaultExpiry != "" {
+				def.DefaultExpiry = s.DefaultExpiry
+			}
+			if s.CustomSlugReservationDays > 0 {
+				def.CustomSlugReservationDays = s.CustomSlugReservationDays
+			}
+			if s.BurnViewerWindowMinutes > 0 {
+				def.BurnViewerWindowMinutes = s.BurnViewerWindowMinutes
+			}
+			ss.cur = def
+		}
+	}
+	return ss
+}
+
+func (ss *settingsStore) get() Settings {
+	ss.mu.RLock()
+	defer ss.mu.RUnlock()
+	return ss.cur
+}
+
+func (ss *settingsStore) set(s Settings) error {
+	if s.RateLimitBurst <= 0 || s.RateLimitPerMinute <= 0 || s.MaxContentBytes <= 0 ||
+		s.CustomSlugReservationDays <= 0 || s.BurnViewerWindowMinutes <= 0 {
+		return fmt.Errorf("all numeric settings must be positive")
+	}
+	if s.DefaultExpiry != "" {
+		d, err := time.ParseDuration(s.DefaultExpiry)
+		if err != nil || !store.ValidExpiry(d) {
+			return fmt.Errorf("default_expiry must be a duration between 1 minute and 1 year (or empty)")
+		}
+	}
+	ss.mu.Lock()
+	defer ss.mu.Unlock()
+	b, _ := json.Marshal(s)
+	if err := os.WriteFile(ss.path, b, 0600); err != nil {
+		return err
+	}
+	ss.cur = s
+	return nil
+}
+
+// resetAdminKeyFile deletes the persisted admin key file (if any) and returns
+// the path so callers can regenerate. Used by --reset-admin-key (#40).
+// ResetAdminKeyFile deletes the persisted admin key file (if any).
+func ResetAdminKeyFile(dbPath string) string {
+	p := filepath.Join(filepath.Dir(dbPath), "admin-key")
+	os.Remove(p)
+	return p
+}
+
+// resolveAdminKey returns the admin key: env PALETTE_ADMIN_KEY wins; else the
+// persisted key file is reused; else a new 32-char hex key is generated and
+// persisted with 0600 perms.
+// ResolveAdminKey returns the admin key: env PALETTE_ADMIN_KEY wins; else the
+// persisted key file is reused; else a new 32-char hex key is generated and
+// persisted with 0600 perms.
+func ResolveAdminKey(dbPath string) (string, error) {
+	if v := os.Getenv("PALETTE_ADMIN_KEY"); v != "" {
+		return v, nil
+	}
+	p := filepath.Join(filepath.Dir(dbPath), "admin-key")
+	if b, err := os.ReadFile(p); err == nil && len(strings.TrimSpace(string(b))) >= 16 {
+		return strings.TrimSpace(string(b)), nil
+	}
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	key := hex.EncodeToString(b)
+	if err := os.WriteFile(p, []byte(key+"\n"), 0600); err != nil {
+		return "", err
+	}
+	log.Printf("generated admin key, persisted to %s", p)
+	return key, nil
+}
+
+// handleResetAdminKey implements the --reset-admin-key flag: delete the key
+// file, generate a fresh key, print it.
+// HandleResetAdminKey implements the --reset-admin-key flag: delete the key
+// file, generate a fresh key, print it.
+func HandleResetAdminKey(dbPath string) {
+	p := ResetAdminKeyFile(dbPath)
+	key, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		log.Fatalf("reset admin key: %v", err)
+	}
+	fmt.Printf("admin key reset; new key written to %s:\n%s\n", p, key)
+}
+
+// adminKeyOK reports whether the request carries the correct admin key via
+// X-Admin-Key header or ?key=. Constant-time compare; failures and successes
+// are both logged (#40).
+func (a *apiServer) adminKeyOK(r *http.Request, key string) bool {
+	given := r.Header.Get("X-Admin-Key")
+	if given == "" {
+		given = r.URL.Query().Get("key")
+	}
+	return subtle.ConstantTimeCompare([]byte(given), []byte(key)) == 1
+}
+
+func (a *apiServer) adminAuth(next http.HandlerFunc, key string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !rateLimitAdmin(r) {
+			log.Printf("admin auth RATE LIMITED: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeRateLimited(w, 60)
+			return
+		}
+		if !a.adminKeyOK(r, key) {
+			log.Printf("admin auth FAILURE: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeErr(w, 401, "unauthorized")
+			return
+		}
+		log.Printf("admin auth OK: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+		next(w, r)
+	}
+}
+
+func (a *apiServer) handleAdminGetSettings(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, 200, a.settings.get())
+}
+
+func (a *apiServer) handleAdminPostSettings(w http.ResponseWriter, r *http.Request) {
+	var s Settings
+	if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
+		writeErr(w, 400, "invalid json body")
+		return
+	}
+	if err := a.settings.set(s); err != nil {
+		writeErr(w, 400, err.Error())
+		return
+	}
+	writeJSON(w, 200, a.settings.get())
+}
+
+// Get returns the current settings (exported for cmd wiring).
+func (ss *settingsStore) Get() Settings { return ss.get() }

internal/api/admin_test.go

@@ -0,0 +1,168 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// newTestSettingsStore builds an in-memory settings store with a temp file.
+func NewTestSettingsStore(t *testing.T, cfg Config) *settingsStore {
+	t.Helper()
+	dir := t.TempDir()
+	ss := LoadSettingsStore(filepath.Join(dir, "palette.db"), cfg)
+	// point persistence at a temp path (dir(dbPath) == dir)
+	return ss
+}
+
+func TestAdminAuth(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/admin/api/settings", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("no key: expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings", nil)
+	req.Header.Set("X-Admin-Key", "wrong-key")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("wrong key: expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings?key=test-admin-key", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("query key: expected 200, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings", nil)
+	req.Header.Set("X-Admin-Key", "test-admin-key")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("header key: expected 200, got %d", rec.Code)
+	}
+
+	// HTML page itself is open (key entered via form)
+	req = httptest.NewRequest("GET", "/admin", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("admin page: expected 200, got %d", rec.Code)
+	}
+}
+
+func TestAdminEnvKeyPrecedence(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "palette.db")
+	t.Setenv("PALETTE_ADMIN_KEY", "envkey1234567890abcdef")
+	key, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if key != "envkey1234567890abcdef" {
+		t.Fatalf("env key not used: %q", key)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "admin-key")); !os.IsNotExist(err) {
+		t.Fatal("env key should not create a key file")
+	}
+
+	// unset env: file takes over
+	os.Unsetenv("PALETTE_ADMIN_KEY")
+	key2, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(key2) != 32 {
+		t.Fatalf("generated key should be 32 hex chars, got %d", len(key2))
+	}
+	if fi, err := os.Stat(filepath.Join(dir, "admin-key")); err != nil || fi.Mode().Perm() != 0600 {
+		t.Fatalf("admin-key file perms: %v err %v", fi, err)
+	}
+	// reuse on subsequent boots
+	key3, _ := ResolveAdminKey(dbPath)
+	if key3 != key2 {
+		t.Fatal("persisted key not reused")
+	}
+}
+
+func TestAdminSettingsRoundTrip(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	post := func(body string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(body))
+		req.Header.Set("X-Admin-Key", "test-admin-key")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	rec := post(`{"rate_limit_burst": 9, "rate_limit_per_minute": 120, "max_content_bytes": 1024, "default_expiry": "1h", "custom_slug_reservation_days": 10, "burn_viewer_window_minutes": 7}`)
+	if rec.Code != 200 {
+		t.Fatalf("post settings: %d %s", rec.Code, rec.Body.String())
+	}
+	got := s.settings.get()
+	if got.RateLimitBurst != 9 || got.RateLimitPerMinute != 120 || got.MaxContentBytes != 1024 ||
+		got.DefaultExpiry != "1h" || got.CustomSlugReservationDays != 10 || got.BurnViewerWindowMinutes != 7 {
+		t.Fatalf("settings not applied: %+v", got)
+	}
+
+	// persisted to disk
+	b, err := os.ReadFile(s.settings.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var persisted Settings
+	if err := json.Unmarshal(b, &persisted); err != nil {
+		t.Fatal(err)
+	}
+	if persisted.BurnViewerWindowMinutes != 7 {
+		t.Fatalf("persisted settings wrong: %+v", persisted)
+	}
+
+	// invalid rejected
+	if rec := post(`{"rate_limit_burst": -1}`); rec.Code != 400 {
+		t.Fatalf("invalid settings: expected 400, got %d", rec.Code)
+	}
+	if rec := post(`{"rate_limit_burst": 5, "rate_limit_per_minute": 60, "max_content_bytes": 1024, "default_expiry": "bogus", "custom_slug_reservation_days": 10, "burn_viewer_window_minutes": 5}`); rec.Code != 400 {
+		t.Fatalf("bad expiry: expected 400, got %d", rec.Code)
+	}
+
+	// settings actually consumed: default expiry applied on create
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"x"}`))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ExpiresAt *int64 `json:"expires_at"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ExpiresAt == nil {
+		t.Fatal("default expiry not applied to new paste")
+	}
+}
+
+func TestAdminResetKey(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "palette.db")
+	os.Unsetenv("PALETTE_ADMIN_KEY")
+	key1, _ := ResolveAdminKey(dbPath)
+	// direct invocation of the reset behavior
+	ResetAdminKeyFile(dbPath)
+	key2, _ := ResolveAdminKey(dbPath)
+	if key1 == key2 {
+		t.Fatal("reset did not regenerate key")
+	}
+}

internal/api/adminratelimit_test.go

@@ -0,0 +1,80 @@
+package api
+
+// #66: admin key attempts must be rate limited per IP (5/min), constant-time
+// compared, and failures logged. Hammering bad keys must yield 429s.
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestAdminKeyRateLimited: burst of 5 bad-key attempts allowed (401), the 6th
+// gets 429, and even the correct key is blocked from that IP until refill.
+func TestAdminKeyRateLimited(t *testing.T) {
+	srv := newTestServer(t)
+	h := srv.routes()
+	reqIP := "10.7.7.1:1234"
+
+	var got429, retryAfter bool
+	var lastCode int
+	for i := 0; i < 10; i++ {
+		req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+		req.RemoteAddr = reqIP
+		req.Header.Set("X-Admin-Key", "wrong-key")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		lastCode = rec.Code
+		if rec.Code == 429 {
+			got429 = true
+			retryAfter = rec.Header().Get("Retry-After") != ""
+			break
+		}
+	}
+	if !got429 {
+		t.Fatalf("expected 429 after hammering bad keys, last status %d", lastCode)
+	}
+	if !retryAfter {
+		t.Error("429 missing Retry-After header")
+	}
+
+	// Correct key from the same IP is also locked out.
+	req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+	req.RemoteAddr = reqIP
+	req.Header.Set("X-Admin-Key", srv.adminKey)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 429 {
+		t.Errorf("correct key after lockout: got %d, want 429", rec.Code)
+	}
+
+	// A different IP is unaffected.
+	req2 := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(`{"rate_limit_burst":5,"rate_limit_per_minute":60,"max_content_bytes":1048576,"custom_slug_reservation_days":30,"burn_viewer_window_minutes":15}`))
+	req2.RemoteAddr = "203.0.113.9:1234"
+	req2.Header.Set("X-Admin-Key", srv.adminKey)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 200 {
+		t.Errorf("correct key from another IP: got %d, want 200", rec2.Code)
+	}
+}
+
+// TestAdminKeyConstantTimeCompare: sanity check that the comparison is
+// constant-time (uses subtle.ConstantTimeCompare, not ==).
+func TestAdminKeyConstantTimeCompare(t *testing.T) {
+	srv := newTestServer(t)
+	r := httptest.NewRequest("GET", "/", nil)
+	r.Header.Set("X-Admin-Key", "test-admin-key")
+	if !srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("correct key rejected")
+	}
+	r.Header.Set("X-Admin-Key", "wrong")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("wrong key accepted")
+	}
+	// differ in length: must not panic/mismatch unexpectedly
+	r.Header.Set("X-Admin-Key", "test-admin-key-longer")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("longer wrong key accepted")
+	}
+}

internal/api/burn.go

@@ -0,0 +1,43 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"palette/internal/store"
+)
+
+// burnViewerWindow returns the admin-tunable per-viewer dedupe window
+// (#40), falling back to the 15-minute default from #49.
+func (a *apiServer) burnViewerWindow() int {
+	if a.settings != nil {
+		if m := a.settings.get().BurnViewerWindowMinutes; m > 0 {
+			return m
+		}
+	}
+	return 15
+}
+
+// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
+// DELETE /api/pastes/{id}/redeem?token=...
+func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	token := r.URL.Query().Get("token")
+	if token == "" {
+		writeErr(w, 400, "token required")
+		return
+	}
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.DeletionToken.String == "" || !store.DeletionTokenEqual(row.DeletionToken.String, token) {
+		writeErr(w, 403, "invalid token")
+		return
+	}
+	// hard delete: pastes table row goes away entirely
+	a.store.HardDelete(row.ID)
+	writeJSON(w, 200, map[string]string{"status": "deleted"})
+}

internal/api/burn_test.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"encoding/json"
@@ -71,7 +71,7 @@ func TestDeletionTokenRedeem(t *testing.T) {
 
 	// gone for good: even soft-deleted lookup returns nothing, and row count is 0
 	var n int
-	s.store.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID).Scan(&n)
+	n = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
 	if n != 0 {
 		t.Fatal("row still exists after redeem")
 	}

internal/api/burnrace_test.go

@@ -0,0 +1,103 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// TestBurnAfterReadConcurrentRace is the #58 regression test: N concurrent
+// readers of a burn-after-read paste must receive exactly one success with
+// content; every other reader must get 404 and never any content.
+func TestBurnAfterReadConcurrentRace(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 1)
+
+	const readers = 24
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins, losses := 0, 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+				var got struct {
+					Content string `json:"content"`
+				}
+				if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil || got.Content != "limited" {
+					t.Errorf("winning read returned wrong content: %v %q", err, got.Content)
+				}
+			} else if rec.Code == 404 {
+				losses++
+				if strings.Contains(rec.Body.String(), "limited") {
+					t.Errorf("losing read leaked content: %s", rec.Body.String())
+				}
+			} else {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != 1 {
+		t.Fatalf("expected exactly 1 winning read of burn paste, got %d (losses=%d)", wins, losses)
+	}
+	if losses != readers-1 {
+		t.Fatalf("expected %d losing reads, got %d", readers-1, losses)
+	}
+}
+
+// TestBurnAfterNReadsConcurrentBudget hammers a burn-after-N paste with many
+// more concurrent distinct readers than the budget: total admissions must
+// equal exactly N, and no losing read may see content.
+func TestBurnAfterNReadsConcurrentBudget(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	const budget = 3
+	id := createBurnReads(t, h, budget)
+
+	const readers = 30
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins := 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+			} else if rec.Code != 404 {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != budget {
+		t.Fatalf("expected exactly %d admitted reads, got %d", budget, wins)
+	}
+
+	// After the race, the paste is burned for everyone.
+	if rec := getWithCookie(t, h, id, "after-the-fact"); rec.Code != 404 {
+		t.Fatalf("paste should be burned after budget exhausted, got %d", rec.Code)
+	}
+}

internal/api/burnreads_test.go

@@ -0,0 +1,201 @@
+package api
+
+import (
+	"palette/internal/store"
+
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+type anyHandler interface {
+	ServeHTTP(http.ResponseWriter, *http.Request)
+}
+
+// createBurnReads creates a burn-after-N-reads paste and returns its id.
+func createBurnReads(t *testing.T, h anyHandler, reads int) string {
+	t.Helper()
+	body, _ := json.Marshal(map[string]any{"content": "limited", "burn_after_read": true, "burn_after_reads": reads})
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(string(body)))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create burn_after_reads=%d: %d %s", reads, rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID == "" {
+		t.Fatal("no id in create response")
+	}
+	return created.ID
+}
+
+func getWithCookie(t *testing.T, h anyHandler, id, viewer string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	if viewer != "" {
+		req.AddCookie(&http.Cookie{Name: "vwr", Value: viewer})
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+// #82: burn_after_reads > 0 alone must enable burn-after-read
+// even without burn_after_read: true.
+func TestBurnReadsImpliedByBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"implied","burn_after_reads":2}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create burn_after_reads-only: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	if rec := getWithCookie(t, h, created.ID, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "bbb"); rec.Code != 200 {
+		t.Fatalf("read 2: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "ccc"); rec.Code != 404 {
+		t.Fatalf("read 3 expected 404 (burned), got %d", rec.Code)
+	}
+}
+
+func TestBurnAfterNReadsDistinctViewers(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 2)
+
+	// viewer A: ok (read 1)
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1 (viewer A): %d %s", rec.Code, rec.Body.String())
+	}
+	// viewer B: ok (read 2)
+	if rec := getWithCookie(t, h, id, "bbb"); rec.Code != 200 {
+		t.Fatalf("read 2 (viewer B): %d %s", rec.Code, rec.Body.String())
+	}
+	// viewer C: burned -> 404
+	if rec := getWithCookie(t, h, id, "ccc"); rec.Code != 404 {
+		t.Fatalf("read 3 expected 404, got %d", rec.Code)
+	}
+}
+
+func TestBurnReadsSameViewerWithinWindowNoDecrement(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 2)
+
+	// same viewer reads twice within the window: second is deduped
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("deduped re-read expected 200, got %d", rec.Code)
+	}
+	// another viewer still gets read 2 (budget not consumed by re-reads)
+	if rec := getWithCookie(t, h, id, "bbb"); rec.Code != 200 {
+		t.Fatalf("read 2: %d", rec.Code)
+	}
+}
+
+func TestBurnReadsWindowExpiryRecounts(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 2)
+
+	base := time.Now()
+	store.TimeNow = func() time.Time { return base }
+	t.Cleanup(func() { store.TimeNow = time.Now })
+
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	// 10 minutes later: still within window, deduped
+	store.TimeNow = func() time.Time { return base.Add(10 * time.Minute) }
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("re-read within window: %d", rec.Code)
+	}
+	// 20 minutes after first read: window expired, counts as read 2
+	store.TimeNow = func() time.Time { return base.Add(20 * time.Minute) }
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
+		t.Fatalf("re-read after window expected 200, got %d", rec.Code)
+	}
+	// budget exhausted -> 404 even for the same viewer
+	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 404 {
+		t.Fatalf("after budget expected 404, got %d", rec.Code)
+	}
+}
+
+func TestBurnReadsDefaultOne(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	// burn_after_read without burn_after_reads defaults to 1 read
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"one","burn_after_read":true}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	if rec := getWithCookie(t, h, created.ID, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "bbb"); rec.Code != 404 {
+		t.Fatalf("read 2 expected 404, got %d", rec.Code)
+	}
+}
+
+func TestBurnReadsPageViewCounts(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 2)
+
+	// HTML page view counts as a read too (documented decision)
+	req := httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "aaa"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("page view 1: %d", rec.Code)
+	}
+	// re-view within window: deduped
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "aaa"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("page re-view: %d", rec.Code)
+	}
+	// distinct viewer: read 2, page renders with reads remaining
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "bbb"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("page view 2: %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Reads left") {
+		t.Fatal("stats pill missing 'Reads left'")
+	}
+	// third viewer: burned
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "ccc"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("page view 3 expected 404, got %d", rec.Code)
+	}
+}

internal/api/cans.go

@@ -1,15 +1,17 @@
-package main
+package api
 
 import (
-	"database/sql"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"palette/internal/store"
 	"strings"
 	"time"
 
 	"github.com/go-chi/chi/v5"
+
+	"palette/internal/web"
 )
 
 // CreateCan makes a can with N items (multipart form).
@@ -26,18 +28,25 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 		visibility = "public"
 	}
 	if visibility != "public" && visibility != "unlisted" {
-		writeErr(w, 400, "visibility must be public or unlisted")
+		writeErrCode(w, 400, "invalid_visibility", "visibility must be public or unlisted")
 		return
 	}
 	expiresIn := r.FormValue("expires_in")
 	password := r.FormValue("password")
+	customSlug := r.FormValue("custom_slug")
 
 	var expiresAt *int64
 	now := time.Now().Unix()
 	if expiresIn != "" {
 		d, err := time.ParseDuration(expiresIn)
 		if err != nil {
-			writeErr(w, 400, "invalid expires_in")
+			writeErrCode(w, 400, "expiry_invalid", "invalid expires_in")
+			return
+		}
+		// #60/#48: clamp at the API boundary like the pastes API does -
+		// reject zero/negative and durations past the 1-year UI cap.
+		if !store.ValidExpiry(d) {
+			writeErrCode(w, 400, "expiry_invalid", "expires_in must be between 1 minute and 1 year")
 			return
 		}
 		t := now + int64(d.Seconds())
@@ -45,7 +54,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 	var pwHash *string
 	if password != "" {
-		h, err := hashPassword(password)
+		h, err := store.Argon2IDHash(password)
 		if err != nil {
 			writeErr(w, 500, "hash error")
 			return
@@ -53,13 +62,26 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 		pwHash = &h
 	}
 
-	canID := genSlug(8)
+	canID := store.GenSlug(8)
-	_, err := a.store.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
+	var slugPtr *string
-		VALUES (?,?,?,?,?,?,?)`, canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt)
+	if customSlug != "" {
+		slugPtr = &customSlug
+	}
+	err := a.store.CreateCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt, slugPtr)
 	if err != nil {
-		writeErr(w, 500, "db error")
+		switch err {
+		case store.ErrSlugTaken, store.ErrInvalidSlug, store.ErrReservedSlug:
+			writeErrCode(w, 409, createErrCode(err), err.Error())
+		default:
+			writeErr(w, 500, "db error")
+		}
 		return
 	}
+	if slugPtr != nil {
+		canID = customSlug // #4: custom slug becomes the can id
+	}
+	// #4: remember the creating browser so /mine and viewer-scoped delete work
+	a.store.Exec(`UPDATE paste_cans SET viewer_id=? WHERE id=?`, currentViewerID(r), canID)
 
 	// text items passed as JSON array: [{"title":"notes.txt","content":"..."}]
 	itemCount := 0
@@ -76,7 +98,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			lang := it["language"]
-			if err := a.store.insertCanItem(canID, it["title"], content, "text/plain", &lang, nil, nil, now); err != nil {
+			if err := a.store.InsertCanItem(canID, it["title"], content, "text/plain", &lang, nil, nil, now); err != nil {
 				writeErr(w, 500, "db error")
 				return
 			}
@@ -104,7 +126,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 					return
 				}
 				contentStr := string(content)
-				if err := a.store.insertCanItem(canID, fh.Filename, contentStr, detectContentType(fh.Filename, content), nil, nil, &contentStr, now); err != nil {
+				if err := a.store.InsertCanItem(canID, fh.Filename, contentStr, detectContentType(fh.Filename, content), nil, nil, &contentStr, now); err != nil {
 					writeErr(w, 500, "db error")
 					return
 				}
@@ -114,8 +136,8 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if itemCount == 0 {
-		a.store.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
+		a.store.DeleteCan(canID)
-		writeErr(w, 400, "can needs at least one item (files or json_items)")
+		writeErrCode(w, 400, "content_empty", "can needs at least one item (files or json_items)")
 		return
 	}
 
@@ -124,6 +146,29 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// handleDeleteCan soft-deletes a can (parity with paste deletion, #63):
+// requires the vwr viewer cookie matching the can's viewer (cans carry no
+// deletion token since they are built in the browser).
+func (a *apiServer) handleDeleteCan(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	can, err := a.store.GetCan(id)
+	if err != nil || can == nil {
+		writeErr(w, 404, "can not found")
+		return
+	}
+	vid := currentViewerID(r)
+	if !(vid != "" && viewerSentCookie(r) && can.ViewerID.Valid &&
+		can.ViewerID.String != "" && can.ViewerID.String == vid) {
+		writeErr(w, 403, "deletion not authorized")
+		return
+	}
+	if _, err := a.store.SoftDeleteCan(can.ID); err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
+}
+
 func detectContentType(name string, content []byte) string {
 	lower := strings.ToLower(name)
 	switch {
@@ -144,46 +189,6 @@ func detectContentType(name string, content []byte) string {
 	return "text/plain"
 }
 
-func (s *Store) insertCanItem(canID, title, content, contentType string, language, expiresAt *string, binary *string, now int64) error {
-	// language/expiresAt unused here for now; content stored as text (binary-safe in sqlite)
-	_, err := s.db.Exec(`INSERT INTO pastes
-		(id, content, content_type, language, title, visibility, can_id, created_at)
-		VALUES (?,?,?,?,?,?,?,?)`,
-		genSlug(6), content, contentType, language, &title, "unlisted", canID, now)
-	_ = expiresAt
-	_ = binary
-	return err
-}
-
-func (s *Store) GetCan(id string) (*CanRow, error) {
-	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at
-		FROM paste_cans WHERE id = ? AND deleted_at IS NULL`, id)
-	var c CanRow
-	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	return &c, err
-}
-
-func (s *Store) ListCanItems(canID string) ([]PasteRow, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count
-		FROM pastes WHERE can_id = ? AND deleted_at IS NULL ORDER BY created_at ASC`, canID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		if err := rows.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount); err != nil {
-			return nil, err
-		}
-		out = append(out, r)
-	}
-	return out, nil
-}
-
 func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	can, err := a.store.GetCan(id)
@@ -204,7 +209,7 @@ func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 		if pw == "" {
 			pw = r.URL.Query().Get("password")
 		}
-		if pw == "" || !checkPassword(can.PasswordHash.String, pw) {
+		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
 			writeErr(w, 401, "password required")
 			return
 		}
@@ -224,12 +229,12 @@ func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	metas := make([]itemMeta, 0, len(items))
 	for _, it := range items {
 		metas = append(metas, itemMeta{
-			ID: it.ID, Title: nullStrPtr(it.Title), ContentType: it.ContentType,
+			ID: it.ID, Title: store.NullStrPtr(it.Title), ContentType: it.ContentType,
 			Size: len(it.Content), URL: "/api/pastes/" + it.ID,
 		})
 	}
 	writeJSON(w, 200, map[string]any{
-		"id": can.ID, "title": nullStrPtr(can.Title), "visibility": can.Visibility,
+		"id": can.ID, "title": store.NullStrPtr(can.Title), "visibility": can.Visibility,
 		"created_at": can.CreatedAt, "items": metas,
 	})
 }
@@ -246,18 +251,29 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 404, "not a can item")
 		return
 	}
-	// inherit can password protection
+	// inherit can password protection: password via header/query, or the
+	// same pw_<can> unlock cookie the can page sets (#4 cookie parity).
 	can, _ := a.store.GetCan(row.CanID.String)
 	if can != nil && can.PasswordHash.Valid {
 		pw := r.Header.Get("X-Paste-Password")
 		if pw == "" {
 			pw = r.URL.Query().Get("password")
 		}
-		if pw == "" || !checkPassword(can.PasswordHash.String, pw) {
+		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
-			writeErr(w, 401, "password required")
+			// fall back to the browser's unlock cookie for this can
-			return
+			c, cerr := r.Cookie("pw_" + can.ID)
+			if cerr != nil || c.Value != web.UnlockToken(can.ID) {
+				writeErr(w, 401, "password required")
+				return
+			}
 		}
 	}
-	w.Header().Set("Content-Type", row.ContentType)
+	// #34: same content-type guard as /raw — never serve active content types.
+	ct := row.ContentType
+	if !safeRawContentType(ct) {
+		ct = "text/plain; charset=utf-8"
+	}
+	w.Header().Set("Content-Type", ct)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.Write([]byte(row.Content))
 }

internal/api/cans_expiry_test.go

@@ -0,0 +1,45 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+// #60: the cans API must clamp expires_in at the boundary exactly like the
+// pastes API — reject zero/negative durations and anything over the 1-year
+// UI cap, accept the exact boundaries.
+func TestCreateCanExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},    // negative
+		{"-0s", 400},    // negative zero
+		{"0s", 400},     // zero
+		{"1ns", 400},    // positive but below the 1-minute floor
+		{"59s", 400},    // just under the floor
+		{"1m", 201},     // exactly the floor
+		{"90s", 201},    // just over the floor
+		{"8760h", 201},  // exactly 1 year
+		{"8785h", 400},  // 1 year + 1 day: over the cap
+		{"87600h", 400}, // 10 years, the originally reported case
+	}
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		body, ct := multipartBody(t, map[string]string{
+			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+			"expires_in": c.expiresIn,
+		}, "files", "pic.txt", "file data")
+		req := httptest.NewRequest("POST", "/api/pastes/can", body)
+		req.Header.Set("Content-Type", ct)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}

internal/api/cans_flow_test.go

@@ -0,0 +1,413 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"palette/internal/store"
+)
+
+// #4: cans appear in /api/public as normal rows with is_can=true.
+func TestCanInPublicListing(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// a can and a regular paste
+	body, ct := multipartBody(t, map[string]string{
+		"title":      "Listed can",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create can: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	req = httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"plain"}`))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("public: %d", rec.Code)
+	}
+	var got struct {
+		Total int `json:"total"`
+		Items []struct {
+			ID    string `json:"id"`
+			IsCan bool   `json:"is_can"`
+			Title any    `json:"title"`
+		} `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Total != 2 {
+		t.Fatalf("expected total 2 (can + paste), got %d", got.Total)
+	}
+	foundCan := false
+	for _, it := range got.Items {
+		if it.ID == created.ID {
+			if !it.IsCan {
+				t.Fatalf("can row missing is_can flag")
+			}
+			foundCan = true
+		} else if it.IsCan {
+			t.Fatalf("plain paste flagged as can")
+		}
+	}
+	if !foundCan {
+		t.Fatalf("can not present in /api/public")
+	}
+
+	// #4: unlisted can must not be listed
+	body2, ct2 := multipartBody(t, map[string]string{
+		"title":       "Hidden can",
+		"visibility":  "unlisted",
+		"json_items":  `[{"title":"b.txt","content":"BBB"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body2)
+	req.Header.Set("Content-Type", ct2)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("unlisted can create: %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "Hidden can") {
+		t.Fatalf("unlisted can leaked into /api/public")
+	}
+}
+
+// #4: custom slug support for cans + conflict with existing paste slug.
+func TestCanCustomSlug(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	body, ct := multipartBody(t, map[string]string{
+		"title":       "Slugged",
+		"custom_slug": "my-bundle",
+		"json_items":  `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create can with slug: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct{ ID, URL string }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID != "my-bundle" {
+		t.Fatalf("expected id my-bundle, got %q", created.ID)
+	}
+	// custom slug resolves on the can page route
+	req = httptest.NewRequest("GET", "/can/my-bundle", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Slugged") {
+		t.Fatalf("can page by slug: %d", rec.Code)
+	}
+	// duplicate slug rejected 409
+	body, ct = multipartBody(t, map[string]string{
+		"title": "Again", "custom_slug": "my-bundle",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 409 {
+		t.Fatalf("duplicate slug expected 409, got %d", rec.Code)
+	}
+	// reserved slug rejected
+	body, ct = multipartBody(t, map[string]string{
+		"title": "R", "custom_slug": "admin",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 409 {
+		t.Fatalf("reserved slug expected 409, got %d", rec.Code)
+	}
+}
+
+// #4: invalid expiry rejected on cans, mirroring paste behavior (#48).
+func TestCanExpiryValidation(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Bad expiry", "expires_in": "30s",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 400 {
+		t.Fatalf("expected 400 for 30s expiry, got %d", rec.Code)
+	}
+}
+
+// #4: expired cans 404 on the page and API.
+func TestCanExpiryAccess(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Dying", "expires_in": "1h",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// backdate expiry to force the expired path
+	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, created.ID)
+
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("expired can API expected 404, got %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("expired can page expected 404, got %d", rec.Code)
+	}
+}
+
+// #4: password-protected can page uses the same unlock flow as pastes.
+func TestCanUnlockFlow(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Locked can", "password": "pw123",
+		"json_items": `[{"title":"secret.txt","content":"sec content"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// GET page without cookie -> unlock form
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "locked") {
+		t.Fatalf("expected unlock form, got %d", rec.Code)
+	}
+
+	// POST wrong password -> unlock form with error
+	fd := strings.NewReader("password=wrong")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "Wrong password") {
+		t.Fatalf("expected wrong-password message")
+	}
+
+	// POST correct password -> page renders, cookie set
+	fd = strings.NewReader("password=pw123")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("unlocked can page missing item content")
+	}
+	var pwCookie *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == "pw_"+created.ID {
+			pwCookie = c
+		}
+	}
+	if pwCookie == nil {
+		t.Fatalf("unlock cookie not set")
+	}
+
+	// GET with cookie -> unlocked
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	req.AddCookie(pwCookie)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("cookie unlock failed: %d", rec.Code)
+	}
+	// a forged cookie value must not unlock
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("forged cookie unlocked the can")
+	}
+}
+
+// #4: can item access inherits the can unlock cookie (not just query param).
+func TestCanItemCookieParity(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Cookie can", "password": "pw123",
+		"json_items": `[{"title":"s.txt","content":"sec"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// unlock via page to get the cookie
+	fd := strings.NewReader("password=pw123")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var pwCookie *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == "pw_"+created.ID {
+			pwCookie = c
+		}
+	}
+	if pwCookie == nil {
+		t.Fatalf("no unlock cookie")
+	}
+
+	// item id from API (with password query)
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"?password=pw123", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var can struct {
+		Items []struct{ ID string `json:"id"` } `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &can)
+	itemID := can.Items[0].ID
+
+	// API item with the unlock cookie but no password -> 200
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
+	req.AddCookie(pwCookie)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("item via cookie expected 200, got %d", rec.Code)
+	}
+	// forged cookie -> 401
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("forged cookie on item expected 401, got %d", rec.Code)
+	}
+}
+
+// #4: viewer-scoped soft delete of cans.
+func TestCanDeleteParity(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Doomed", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// delete without matching viewer -> 403
+	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 403 {
+		t.Fatalf("unauthorized delete expected 403, got %d", rec.Code)
+	}
+	// creator's browser -> 200
+	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("creator delete expected 200, got %d", rec.Code)
+	}
+	// gone from API and page
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("deleted can expected 404, got %d", rec.Code)
+	}
+	// gone from listings
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "Doomed") {
+		t.Fatalf("deleted can still listed")
+	}
+}
+
+// #4: cans appear in /api/mine for the creating browser.
+func TestCanInMine(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Mine can", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/api/mine", nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var got struct {
+		Items []struct {
+			ID    string `json:"id"`
+			IsCan bool   `json:"is_can"`
+		} `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if len(got.Items) != 1 || !got.Items[0].IsCan {
+		t.Fatalf("can missing from /api/mine: %s", rec.Body.String())
+	}
+}
+
+// #4: sweep soft-deletes expired cans (parity with pastes).
+func TestCanSweepExpired(t *testing.T) {
+	s := testServer(t)
+	s.store.CreateCan("sweepcan", "sweep", "", "public", nil, 1, nil, nil)
+	s.store.InsertCanItem("sweepcan", "a.txt", "AAA", "text/plain", nil, nil, nil, 1)
+	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, "sweepcan")
+	s.store.SweepExpired()
+	if can, _ := s.store.GetCan("sweepcan"); can != nil {
+		t.Fatalf("expired can survived sweep")
+	}
+	_ = store.GenSlug(4) // keep import if store pkg shrinks
+}

internal/api/cans_test.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"bytes"

internal/api/customslug_test.go

@@ -1,6 +1,8 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+
 	"encoding/json"
 	"net/http/httptest"
 	"strings"
@@ -61,7 +63,7 @@ func TestCustomSlugValidation(t *testing.T) {
 func TestSlugCollisionWithAutoID(t *testing.T) {
 	s := testServer(t)
 	// manually insert a paste, then try to claim its auto ID as a custom slug
-	p, err := s.store.CreatePaste(&Paste{Content: "auto"})
+	p, err := s.store.CreatePaste(&store.Paste{Content: "auto"})
 	if err != nil {
 		t.Fatal(err)
 	}

internal/api/delete_auth_test.go

@@ -0,0 +1,172 @@
+package api
+
+// Regression tests for #63: DELETE /api/pastes/{id} must require the
+// deletion token (Authorization header or ?token= query param, constant-time
+// compare). Without a token, or with a wrong token, the paste must survive
+// and the response must be 403.
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// createTestPaste creates a paste via the API and returns id + deletion token.
+func createTestPaste(t *testing.T, h http.Handler) (string, string) {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"delete me"}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID == "" || created.DeletionToken == "" {
+		t.Fatalf("create response missing id/deletion_token: %s", rec.Body.String())
+	}
+	return created.ID, created.DeletionToken
+}
+
+func pasteExists(t *testing.T, h http.Handler, id string) bool {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code == 200 {
+		return true
+	}
+	if rec.Code == 404 {
+		return false
+	}
+	t.Fatalf("get after delete: got %d", rec.Code)
+	return false
+}
+
+func TestDeleteWithoutTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id, "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete without token: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted without a token")
+	}
+}
+
+func TestDeleteWithWrongTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	// query param
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id+"?token=wrong-token", "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (query): got %d want 403", rec.Code)
+	}
+	// header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer wrong-token")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (header): got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted with a wrong token")
+	}
+}
+
+func TestDeleteWithCorrectToken(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, tok := createTestPaste(t, h)
+
+	// via Authorization header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer "+tok)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (header): got %d want 200: %s", rec.Code, rec.Body.String())
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete")
+	}
+
+	// via query param
+	id, tok = createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id+"?token="+tok, "", "")
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (query): got %d want 200", rec.Code)
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete (query)")
+	}
+}
+
+func TestDeleteByCreatorViewerCookieStillAllowed(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	// create from a specific browser
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"mine"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator-abc"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// creator browser deletes without a token: allowed (#37 /mine delete button)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+created.ID, "creator-abc", "")
+	if rec.Code != 200 {
+		t.Fatalf("creator delete: got %d want 200", rec.Code)
+	}
+
+	// a different browser is still forbidden
+	id, _ := createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id, "someone-else", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("other browser delete: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste deleted by unrelated browser")
+	}
+}
+
+func TestDeletionAuthorizationExtract(t *testing.T) {
+	mk := func(hdr, q string) *http.Request {
+		req := httptest.NewRequest("DELETE", "/api/pastes/x"+q, nil)
+		if hdr != "" {
+			req.Header.Set("Authorization", hdr)
+		}
+		return req
+	}
+	cases := []struct {
+		hdr, q, want string
+	}{
+		{"", "", ""},
+		{"Bearer tok", "", "tok"},
+		{"bearer tok", "", "tok"},
+		{"Token tok", "", "tok"},
+		{"tok", "", "tok"},
+		{"", "?token=q", "q"},
+		{"Bearer hdr", "?token=q", "hdr"}, // header wins
+	}
+	for _, c := range cases {
+		if got := deletionAuthorization(mk(c.hdr, c.q)); got != c.want {
+			t.Errorf("deletionAuthorization(hdr=%q q=%q) = %q want %q", c.hdr, c.q, got, c.want)
+		}
+	}
+}

internal/api/guess.go

@@ -0,0 +1,26 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"palette/internal/lang"
+)
+
+// handleGuessLang serves POST /api/guess-language.
+func (a *apiServer) handleGuessLang(w http.ResponseWriter, r *http.Request) {
+	setRateLimitHeaders(w, 1, 5)
+	if !rateLimitGuess(r) {
+		writeRateLimited(w, 1)
+		return
+	}
+	var req struct {
+		Content string `json:"content"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, http.StatusBadRequest, "invalid json body")
+		return
+	}
+	l := lang.GuessLang(req.Content)
+	writeJSON(w, http.StatusOK, map[string]any{"language": l})
+}

internal/api/issue105_errorcode_test.go

@@ -0,0 +1,123 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #105: every validation path on create returns a machine-readable `code`
+// alongside the human `error` message, so the new-page JS can map known
+// codes to plain-language guidance.
+
+func decodeErr(t *testing.T, rec *httptest.ResponseRecorder) (status int, errMsg, code string) {
+	t.Helper()
+	var got struct {
+		Error string `json:"error"`
+		Code  string `json:"code"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+		t.Fatalf("bad json: %v (%s)", err, rec.Body.String())
+	}
+	return rec.Code, got.Error, got.Code
+}
+
+func postCreate(h http.Handler, body string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestErrorCodeContentEmpty(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"   "}`))
+	if code != "content_empty" {
+		t.Fatalf("code = %q, want content_empty", code)
+	}
+}
+
+func TestErrorCodeContentTooLarge(t *testing.T) {
+	h := testServer(t).routes()
+	big := strings.Repeat("x", 6*1024*1024) // over the 5MB test cap
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"`+big+`"}`))
+	if code != "content_too_large" {
+		t.Fatalf("code = %q, want content_too_large", code)
+	}
+}
+
+func TestErrorCodeSlugTaken(t *testing.T) {
+	h := testServer(t).routes()
+	if rec := postCreate(h, `{"content":"a","custom_slug":"taken-slug"}`); rec.Code != 201 {
+		t.Fatalf("seed create: %d %s", rec.Code, rec.Body.String())
+	}
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"b","custom_slug":"taken-slug"}`))
+	if code != "slug_taken" {
+		t.Fatalf("code = %q, want slug_taken", code)
+	}
+}
+
+func TestErrorCodeSlugInvalid(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"a","custom_slug":"bad slug!"}`))
+	if code != "slug_invalid" {
+		t.Fatalf("code = %q, want slug_invalid", code)
+	}
+}
+
+func TestErrorCodeExpiryInvalid(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"a","expires_in":"2s"}`))
+	if code != "expiry_invalid" {
+		t.Fatalf("code = %q, want expiry_invalid", code)
+	}
+}
+
+func TestErrorCodeRateLimited(t *testing.T) {
+	h := testServer(t).routes()
+	var code string
+	for i := 0; i < 20; i++ {
+		_, _, code = decodeErr(t, postCreate(h, `{"content":"a"}`))
+		if code == "rate_limited" {
+			return
+		}
+	}
+	t.Fatalf("never got rate_limited, last code = %q", code)
+}
+
+func TestErrorCodeCanValidation(t *testing.T) {
+	h := testServer(t).routes()
+
+	post := func(fields map[string]string) *httptest.ResponseRecorder {
+		var b strings.Builder
+		for k, v := range fields {
+			b.WriteString("--B\r\nContent-Disposition: form-data; name=\"" + k + "\"\r\n\r\n" + v + "\r\n")
+		}
+		b.WriteString("--B--\r\n")
+		req := httptest.NewRequest("POST", "/api/pastes/can", strings.NewReader(b.String()))
+		req.Header.Set("Content-Type", "multipart/form-data; boundary=B")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	// bad visibility
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "visibility": "nope"})); code != "invalid_visibility" {
+		t.Fatalf("visibility code = %q, want invalid_visibility", code)
+	}
+
+	// invalid expiry
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "expires_in": "1s"})); code != "expiry_invalid" {
+		t.Fatalf("expiry code = %q, want expiry_invalid", code)
+	}
+
+	// slug taken on can create
+	if rec := postCreate(h, `{"content":"a","custom_slug":"can-slug"}`); rec.Code != 201 {
+		t.Fatalf("seed create: %d", rec.Code)
+	}
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "custom_slug": "can-slug", "json_items": `[{"title":"a","content":"b"}]`})); code != "slug_taken" {
+		t.Fatalf("can slug code = %q, want slug_taken", code)
+	}
+}

internal/api/issue68_validation_test.go

@@ -0,0 +1,198 @@
+package api
+
+// Regression tests for #68 input-validation gaps: negative/oversized content
+// lengths (413), limit=0 → default page size, unchecked query params
+// (negative offset), and negative burn_after_reads.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func createPasteRaw(t *testing.T, h http.Handler, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+// A request whose decoded content exceeds the admin-tunable cap is rejected
+// with 413 and a clear message (content under the body cap, over the
+// content cap).
+func TestCreatePasteContentOverCap413(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// content over MaxContentBytes (5MiB) but under body cap (+4KiB): send
+	// just over the content cap so the per-field check fires first.
+	content := strings.Repeat("a", 5*1024*1024+10)
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "content exceeds max") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+}
+
+// A request whose entire body is larger than the server-side body cap is cut
+// off by http.MaxBytesReader and answered with 413, not decoded into memory
+// (#68: previously a giant body was fully buffered, then rejected only at
+// the per-field check — actually the decode happened before any check).
+func TestCreatePasteBodyOverCap413(t *testing.T) {
+	s := testServer(t)
+	// shrink the content cap so the body cap is small too
+	ss := s.settings.get()
+	ss.MaxContentBytes = 64 * 1024
+	if err := s.settings.set(ss); err != nil {
+		t.Fatal(err)
+	}
+	h := s.routes()
+
+	content := strings.Repeat("a", 200*1024) // 200KiB > 64KiB+4KiB body cap
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s","title":"x"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// Negative content lengths cannot be expressed via JSON, but a negative
+// expires-style numeric payload must not crash; more importantly the
+// burn_after_reads field: negative values are rejected with a clear message.
+func TestCreatePasteNegativeBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	rec := createPasteRaw(t, h, `{"content":"hi","burn_after_reads":-5}`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "burn_after_reads") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+
+	// 0 and positive values still work (0 = default single read, per #49)
+	rec = createPasteRaw(t, h, `{"content":"hi","burn_after_reads":0,"burn_after_read":true}`)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("zero burn_after_reads: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// limit=0 on list endpoints returns the default page size (existing clamp
+// treats <=0 as default; #68 asks this be explicit and tested).
+func TestListLimitZeroUsesDefault(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// seed 3 public pastes
+	for i := 0; i < 3; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d: %s", rec.Code, rec.Body.String())
+		}
+	}
+
+	for _, q := range []string{"/api/public?limit=0", "/api/public"} {
+		req := httptest.NewRequest("GET", q, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("%s: got %d", q, rec.Code)
+		}
+		var got struct {
+			Limit int                   `json:"limit"`
+			Total int                   `json:"total"`
+			Items []struct{ ID string } `json:"items"`
+		}
+		json.Unmarshal(rec.Body.Bytes(), &got)
+		if got.Limit != 25 || len(got.Items) != 3 {
+			t.Fatalf("%s: limit=%d items=%d, want limit 25 and all 3 items", q, got.Limit, len(got.Items))
+		}
+	}
+}
+
+// Huge limit values are clamped to the max page size (already the behavior;
+// regression-tested here per #68 "validate unchecked params").
+func TestListLimitHugeClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=999999999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var got struct {
+		Limit int `json:"limit"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 {
+		t.Fatalf("limit=%d, want clamped to 25", got.Limit)
+	}
+}
+
+// Negative offset previously passed through unchecked to SQL (harmless in
+// SQLite, but invalid); it must be clamped to 0 (#68).
+func TestListNegativeOffsetClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	for i := 0; i < 2; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d", rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public?offset=-999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Offset int `json:"offset"`
+		Total  int `json:"total"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Offset != 0 || got.Total != 2 {
+		t.Fatalf("offset=%d total=%d, want offset 0 and total 2", got.Offset, got.Total)
+	}
+
+	// /api/mine too (needs the viewer cookie)
+	req = httptest.NewRequest("GET", "/api/mine?offset=-5", nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "offclamp"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var mine struct {
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &mine)
+	if mine.Offset != 0 {
+		t.Fatalf("mine offset=%d, want 0", mine.Offset)
+	}
+}
+
+// Non-numeric limit/offset fall back to defaults instead of 500s.
+func TestListGarbageParams(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=abc&offset=xyz", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Limit  int `json:"limit"`
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 || got.Offset != 0 {
+		t.Fatalf("limit=%d offset=%d, want 25/0", got.Limit, got.Offset)
+	}
+}

internal/api/issue81_password_ratelimit_test.go

@@ -0,0 +1,92 @@
+package api
+
+// #81: ALL password verification attempts (GET query param, header, POST
+// form) must go through the per-IP unlock limiter. Regression: N wrong
+// passwords via GET ?password= must eventually yield 429.
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func createPasswordPaste(t *testing.T, s *apiServer, pw string) string {
+	t.Helper()
+	h := s.routes()
+	body := `{"content":"secret","password":"` + pw + `"}`
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	return created.ID
+}
+
+// TestRateLimitGetPasswordQuery: repeated wrong passwords via GET
+// ?password= must eventually return 429 (unlock limiter: burst 5).
+func TestRateLimitGetPasswordQuery(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createPasswordPaste(t, s, "hunter2")
+
+	var saw429 bool
+	// more attempts than the unlock burst (5)
+	for i := 0; i < 10; i++ {
+		req := httptest.NewRequest("GET", "/api/pastes/"+id+"?password=wrong"+string(rune('a'+i)), nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code == 429 {
+			saw429 = true
+			break
+		}
+		if rec.Code != 401 {
+			t.Fatalf("attempt %d: expected 401 before limit, got %d", i, rec.Code)
+		}
+	}
+	if !saw429 {
+		t.Fatal("expected 429 after repeated wrong ?password= attempts, never got one")
+	}
+}
+
+// TestRateLimitGetPasswordHeader: same guarantee for the X-Paste-Password header path.
+func TestRateLimitGetPasswordHeader(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createPasswordPaste(t, s, "hunter2")
+
+	var saw429 bool
+	for i := 0; i < 10; i++ {
+		req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+		req.Header.Set("X-Paste-Password", "wrong"+string(rune('a'+i)))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code == 429 {
+			saw429 = true
+			break
+		}
+		if rec.Code != 401 {
+			t.Fatalf("attempt %d: expected 401 before limit, got %d", i, rec.Code)
+		}
+	}
+	if !saw429 {
+		t.Fatal("expected 429 after repeated wrong header password attempts, never got one")
+	}
+}
+
+// TestRateLimitGetPasswordCorrectStillAllowed: a correct password must still
+// work within the burst (the limiter gates attempts, not correctness).
+func TestRateLimitGetPasswordCorrectStillAllowed(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createPasswordPaste(t, s, "hunter2")
+
+	req := httptest.NewRequest("GET", "/api/pastes/"+id+"?password=hunter2", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("expected 200 for correct password within burst, got %d", rec.Code)
+	}
+}

internal/api/issue86_field_bounds_test.go

@@ -0,0 +1,152 @@
+package api
+
+// Regression tests for #86: title and language are bounded at create time.
+// Titles over 200 chars are truncated; language must match
+// ^[a-zA-Z0-9+#-]{1,40}$ or the create is rejected with a clear 400.
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// pasteMeta fetches a created paste's stored metadata via the API.
+func pasteMeta(t *testing.T, h http.Handler, id string) map[string]any {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/api/pastes/"+id, nil))
+	if rec.Code != 200 {
+		t.Fatalf("get paste %s: got %d: %s", id, rec.Code, rec.Body.String())
+	}
+	var m map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+// A 5000-char title is truncated to 200 characters at create time (#86).
+func TestCreatePasteTitleTruncated(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	title := strings.Repeat("t", 5000)
+	body, _ := json.Marshal(map[string]any{"content": "hi", "title": title})
+	rec := createPasteRaw(t, h, string(body))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+	var resp struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	meta := pasteMeta(t, h, resp.ID)
+	got, _ := meta["title"].(string)
+	if got != strings.Repeat("t", 200) {
+		t.Fatalf("title not truncated to 200 chars: len=%d", len(got))
+	}
+}
+
+// A title within the 200-char bound is stored verbatim (minus surrounding
+// whitespace, which is trimmed).
+func TestCreatePasteTitleWithinBoundKept(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	title := "  " + strings.Repeat("x", 200) + "  "
+	body, _ := json.Marshal(map[string]any{"content": "hi", "title": title})
+	rec := createPasteRaw(t, h, string(body))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+	var resp struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	meta := pasteMeta(t, h, resp.ID)
+	if got, _ := meta["title"].(string); got != strings.Repeat("x", 200) {
+		t.Fatalf("title changed unexpectedly: len=%d", len(got))
+	}
+}
+
+// A language longer than 40 chars is rejected with a clear 400 (#86).
+func TestCreatePasteLanguageTooLong400(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	body, _ := json.Marshal(map[string]any{"content": "hi", "language": strings.Repeat("a", 41)})
+	rec := createPasteRaw(t, h, string(body))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "language") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+}
+
+// Language strings outside ^[a-zA-Z0-9+#-]{1,40}$ are rejected with 400.
+func TestCreatePasteLanguageBadFormat400(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	for _, bad := range []string{
+		"<img src=x onerror=alert(1)>",
+		"java script",
+		"c++ extra!",
+		"py_thon",
+		"go.lang",
+	} {
+		body, _ := json.Marshal(map[string]any{"content": "hi", "language": bad})
+		rec := createPasteRaw(t, h, string(body))
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("language %q: got %d want 400: %s", bad, rec.Code, rec.Body.String())
+			continue
+		}
+		if !strings.Contains(rec.Body.String(), "language must match") {
+			t.Errorf("language %q: unclear error: %s", bad, rec.Body.String())
+		}
+	}
+}
+
+// Valid languages (letters, digits, #, +, -) within 40 chars are accepted.
+func TestCreatePasteLanguageValidAccepted(t *testing.T) {
+	for _, ok := range []string{"go", "c#", "f#", "c++", "objective-c", "ECMAScript-2023", strings.Repeat("a", 40)} {
+		s2 := testServer(t) // fresh rate limiter per case
+		h2 := s2.routes()
+		body, _ := json.Marshal(map[string]any{"content": "hi", "language": ok})
+		rec := createPasteRaw(t, h2, string(body))
+		if rec.Code != http.StatusCreated {
+			t.Errorf("language %q: got %d want 201: %s", ok, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+// An absent or blank language still creates fine and stores NULL, and a
+// blank title is stored NULL rather than an empty string.
+func TestCreatePasteBlankMetadataOK(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	for _, body := range []string{
+		`{"content":"hi"}`,
+		`{"content":"hi","language":"","title":"  "}`,
+	} {
+		rec := createPasteRaw(t, h, body)
+		if rec.Code != http.StatusCreated {
+			t.Fatalf("body %s: got %d want 201: %s", body, rec.Code, rec.Body.String())
+		}
+		var resp struct {
+			ID string `json:"id"`
+		}
+		json.Unmarshal(rec.Body.Bytes(), &resp)
+		meta := pasteMeta(t, h, resp.ID)
+		if lang, ok := meta["language"]; ok && lang != nil && lang != "" {
+			t.Fatalf("body %s: language not null: %v", body, lang)
+		}
+		if title, ok := meta["title"]; ok && title != nil && title != "" {
+			t.Fatalf("body %s: title not null: %v", body, title)
+		}
+	}
+}

internal/api/main_test.go

@@ -1,6 +1,9 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -12,11 +15,19 @@ import (
 func testServer(t *testing.T) *apiServer {
 	t.Helper()
 	globalLimiter = newLimiter() // fresh buckets per test
-	store, err := OpenStore(":memory:")
+	ui, err := web.New()
 	if err != nil {
 		t.Fatal(err)
 	}
-	return &apiServer{store: store, cfg: Config{MaxTextBytes: 5 * 1024 * 1024, MaxItemBytes: 25 * 1024 * 1024}}
+	st, err := store.OpenStore(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := Config{MaxTextBytes: 5 * 1024 * 1024, MaxItemBytes: 25 * 1024 * 1024}
+	ss := NewTestSettingsStore(t, cfg)
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 }
 
 func TestCreateAndGetPaste(t *testing.T) {
@@ -31,7 +42,9 @@ func TestCreateAndGetPaste(t *testing.T) {
 	if rec.Code != 201 {
 		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
 	}
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 	if len(created.ID) != 6 {
 		t.Fatalf("unexpected id: %q", created.ID)
@@ -62,7 +75,9 @@ func TestPasswordProtection(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// without password -> 401
@@ -122,10 +137,14 @@ func TestSoftDelete(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"bye"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID, nil)
+	req.Header.Set("Authorization", "Bearer "+created.DeletionToken)
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != 200 {
@@ -155,7 +174,7 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	var resp struct {
-		Total int `json:"total"`
+		Total int              `json:"total"`
 		Items []map[string]any `json:"items"`
 	}
 	json.Unmarshal(rec.Body.Bytes(), &resp)
@@ -164,6 +183,46 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	}
 }
 
+func TestListPublicExcludesPasswordAndUnlisted(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	bodies := []string{
+		`{"content":"open","visibility":"public"}`,
+		`{"content":"locked","visibility":"public","password":"hunter2"}`,
+		`{"content":"hidden","visibility":"unlisted"}`,
+	}
+	for _, body := range bodies {
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("create %s: got %d", body, rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("list public: got %d", rec.Code)
+	}
+	var resp struct {
+		Total int              `json:"total"`
+		Items []map[string]any `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Total != 1 || len(resp.Items) != 1 {
+		t.Fatalf("expected only the 1 public paste, got total=%d items=%d", resp.Total, len(resp.Items))
+	}
+	// password-protected and unlisted pastes must not appear (no metadata leak)
+	for _, secret := range []string{"hunter2", "locked", "hidden"} {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Fatalf("leaked %q in /api/public response", secret)
+		}
+	}
+}
+
 func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()
@@ -171,19 +230,21 @@ func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"gone soon"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	s.store.SoftDelete(created.ID)
 
 	// simulate grace elapsed
-	past := time.Now().Unix() - (softDeleteGraceDays+1)*86400
+	past := time.Now().Unix() - (store.SoftDeleteGraceDays+1)*86400
-	s.store.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=?`, past, created.ID)
+	s.store.Exec(`UPDATE pastes SET deleted_at=? WHERE id=?`, past, created.ID)
 
 	s.store.SweepExpired()
 
 	var count int
-	s.store.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID).Scan(&count)
+	count = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
 	if count != 0 {
 		t.Fatal("expected hard delete after grace period")
 	}
@@ -191,9 +252,9 @@ func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 
 func TestSlugCharset(t *testing.T) {
 	for i := 0; i < 100; i++ {
-		s := genSlug(6)
+		s := store.GenSlug(6)
 		for _, c := range s {
-			if !strings.ContainsRune(slugAlphabet, c) {
+			if !strings.ContainsRune(store.SlugAlphabet, c) {
 				t.Fatalf("bad char %q in slug %q", c, s)
 			}
 		}
@@ -207,7 +268,9 @@ func TestRawEndpoint(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"raw content here"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("GET", "/raw/"+created.ID, nil)

internal/api/mine_test.go

@@ -1,6 +1,9 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -40,16 +43,19 @@ func viewerCookieFor(t *testing.T, h http.Handler, path string) string {
 
 func TestMineCreateListDelete(t *testing.T) {
 	globalLimiter = newLimiter() // fresh rate-limit buckets
-	webUI, err := NewWebUI()
+	st, err := store.OpenStore(":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
-	webUIInstance = webUI
+	ui, err := web.New()
-	store, err := OpenStore(":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
-	a := &apiServer{store: store, cfg: Config{MaxTextBytes: 5 * 1024 * 1024}}
+	cfg := Config{MaxTextBytes: 5 * 1024 * 1024}
+	ss := NewTestSettingsStore(t, cfg)
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	a := &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 	h := a.routes()
 
 	alice := viewerCookieFor(t, h, "/history")

internal/api/pentest_cookie_test.go

@@ -0,0 +1,42 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #34: the unlock cookie must be bound to the paste it unlocks, not a
+// forgeable static value. A forged 'pw_<id>=1' cookie must not bypass the
+// password check on the paste page.
+func TestForgedUnlockCookieDoesNotBypassPassword(t *testing.T) {
+	globalLimiter = newLimiter()
+	s := testServer(t)
+	h := s.routes()
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"SECRETPASTECONTENT","password":"hunter2"}`))
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d", rec.Code)
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	id := created.ID
+
+	// request the page with a forged unlock cookie in the old format
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + id, Value: "1"})
+	h.ServeHTTP(rec, req)
+	if rec.Code == 200 && strings.Contains(rec.Body.String(), "SECRETPASTECONTENT") {
+		t.Fatal("forged pw_<id>=1 cookie bypassed password protection")
+	}
+	if rec.Code != 200 {
+		t.Logf("forged-cookie request returned %d (page still locked) — good", rec.Code)
+	}
+}

internal/api/pentest_helpers_test.go

@@ -0,0 +1,16 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// test helpers for pentest tests (#34)
+func jsonField(tb testing.TB, body, field string) string {
+	var m map[string]any
+	if err := json.Unmarshal([]byte(body), &m); err != nil {
+		tb.Fatalf("bad json: %v", err)
+	}
+	v, _ := m[field].(string)
+	return v
+}

internal/api/pentest_rawct_test.go

@@ -0,0 +1,65 @@
+package api
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #34: attacker-controlled content_type must not let a paste be served as
+// HTML/SVG/XML from /raw (stored XSS). Only a fixed safe set passes through.
+func TestRawRejectsHTMLContentType(t *testing.T) {
+	globalLimiter = newLimiter() // fresh rate-limit buckets
+	s := testServer(t)
+	h := s.routes()
+
+	for _, ct := range []string{
+		"text/html", "TEXT/HTML", "text/html;charset=utf-8", "text/html;x=1",
+		"application/xhtml+xml", "image/svg+xml", "text/html,",
+	} {
+		globalLimiter = newLimiter() // burst 5, loop makes 7 creates
+		body := `{"content":"<script>alert(1)</script>","content_type":"` + ct + `"}`
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("ct %q: create got %d: %s", ct, rec.Code, rec.Body.String())
+		}
+		id := jsonField(t, rec.Body.String(), "id")
+
+		rec = httptest.NewRecorder()
+		req = httptest.NewRequest("GET", "/raw/"+id, nil)
+		h.ServeHTTP(rec, req)
+		if got := rec.Header().Get("Content-Type"); got == ct {
+			t.Errorf("ct %q was served verbatim from /raw (stored XSS vector)", ct)
+		}
+		if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+			t.Errorf("ct %q: /raw missing X-Content-Type-Options: nosniff", ct)
+		}
+	}
+}
+
+func TestRawAllowsSafeContentType(t *testing.T) {
+	globalLimiter = newLimiter()
+	s := testServer(t)
+	h := s.routes()
+
+	for _, ct := range []string{"text/plain", "image/png", "application/pdf", "application/octet-stream"} {
+		globalLimiter = newLimiter()
+		body := `{"content":"hi","content_type":"` + ct + `"}`
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("ct %q: create got %d", ct, rec.Code)
+		}
+		id := jsonField(t, rec.Body.String(), "id")
+
+		rec = httptest.NewRecorder()
+		req = httptest.NewRequest("GET", "/raw/"+id, nil)
+		h.ServeHTTP(rec, req)
+		if got := rec.Header().Get("Content-Type"); got != ct {
+			t.Errorf("ct %q: got %q", ct, got)
+		}
+	}
+}

internal/api/publicbool_test.go

@@ -0,0 +1,97 @@
+package api
+
+// #83 regression tests: `public` boolean in the create payload must map to
+// visibility (false -> unlisted, true -> public); string `visibility` still works.
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func createPasteBody(t *testing.T, h *apiServer, body string) map[string]any {
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.routes().ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("bad json: %v", err)
+	}
+	return resp
+}
+
+func getVis(t *testing.T, h *apiServer, id string) string {
+	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec := httptest.NewRecorder()
+	h.routes().ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("get %s: got %d", id, rec.Code)
+	}
+	var resp struct {
+		Visibility string `json:"visibility"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("bad json: %v", err)
+	}
+	return resp.Visibility
+}
+
+// TestPublicBooleanFalseMapsToUnlisted: {"public": false} must create an unlisted paste.
+func TestPublicBooleanFalseMapsToUnlisted(t *testing.T) {
+	s := testServer(t)
+	resp := createPasteBody(t, s, `{"content":"x","public":false}`)
+	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
+		t.Fatalf("public:false -> got visibility %q, want unlisted", v)
+	}
+}
+
+// TestPublicBooleanTrueMapsToPublic: {"public": true} must create a public paste.
+func TestPublicBooleanTrueMapsToPublic(t *testing.T) {
+	s := testServer(t)
+	resp := createPasteBody(t, s, `{"content":"x","public":true}`)
+	if v := getVis(t, s, resp["id"].(string)); v != "public" {
+		t.Fatalf("public:true -> got visibility %q, want public", v)
+	}
+}
+
+// TestPublicBooleanOverridesString: boolean wins when both fields are sent.
+func TestPublicBooleanOverridesString(t *testing.T) {
+	s := testServer(t)
+	resp := createPasteBody(t, s, `{"content":"x","visibility":"public","public":false}`)
+	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
+		t.Fatalf("boolean override -> got %q, want unlisted", v)
+	}
+}
+
+// TestVisibilityStringStillWorks: existing string contract unchanged.
+func TestVisibilityStringStillWorks(t *testing.T) {
+	s := testServer(t)
+	resp := createPasteBody(t, s, `{"content":"x","visibility":"unlisted"}`)
+	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
+		t.Fatalf("string field -> got %q, want unlisted", v)
+	}
+	resp = createPasteBody(t, s, `{"content":"y","visibility":"public"}`)
+	if v := getVis(t, s, resp["id"].(string)); v != "public" {
+		t.Fatalf("string field -> got %q, want public", v)
+	}
+}
+
+// TestPublicListExcludesPublicFalse: {"public":false} pastes stay out of /api/public.
+func TestPublicListExcludesPublicFalse(t *testing.T) {
+	s := testServer(t)
+	createPasteBody(t, s, `{"content":"hidden","public":false}`)
+	req := httptest.NewRequest("GET", "/api/public", nil)
+	rec := httptest.NewRecorder()
+	s.routes().ServeHTTP(rec, req)
+	var resp struct {
+		Total int `json:"total"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Total != 0 {
+		t.Fatalf("public:false paste leaked into /api/public: total=%d", resp.Total)
+	}
+}

internal/api/ratelimit.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"net/http"
@@ -48,8 +48,28 @@ func (l *limiter) allow(key string, rate, burst float64) bool {
 	return true
 }
 
-// clientIP extracts the request IP (no reverse proxy header by default).
+// clientIP extracts the client IP for rate-limit keying (#85).
+//
+// Trust boundary: palette runs behind exactly ONE trusted reverse proxy
+// (Traefik in the k3s pod network). Traefik APPENDS the real client IP to
+// X-Forwarded-For, so the RIGHTMOST entry is the last value the trusted
+// proxy observed and is unspoofable by the client (a client-supplied fake
+// entry only lands on the LEFT and is ignored). This matches chi's
+// middleware.RealIP semantics for a single trusted proxy hop.
+//
+// Direct connections (no XFF header) fall back to RemoteAddr. Directly
+// reachable deployments must NOT expose the app to untrusted networks
+// without a proxy in front, or attackers could forge the rightmost entry.
 func clientIP(r *http.Request) string {
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		if i := strings.LastIndex(xff, ","); i >= 0 {
+			return strings.TrimSpace(xff[i+1:])
+		}
+		return strings.TrimSpace(xff)
+	}
+	if xr := r.Header.Get("X-Real-Ip"); xr != "" {
+		return strings.TrimSpace(xr)
+	}
 	host := r.RemoteAddr
 	if i := strings.LastIndex(host, ":"); i > 0 {
 		host = host[:i]
@@ -59,9 +79,19 @@ func clientIP(r *http.Request) string {
 
 var globalLimiter = newLimiter()
 
-// rateLimitCreate: 1 req/sec refill, burst 5, per IP.
+// globalSettingsFn is set at startup; tests can point it at fixed settings.
-func rateLimitCreate(r *http.Request) bool {
+var globalSettingsFn func() Settings
-	return globalLimiter.allow("create:"+clientIP(r), 1, 5)
+
+func globalSettings() Settings {
+	if globalSettingsFn != nil {
+		return globalSettingsFn()
+	}
+	return defaultSettings(Config{})
+}
+
+// rateLimitCreate uses the admin-tunable burst and per-minute refill (#40).
+func rateLimitCreate(r *http.Request, s Settings) bool {
+	return globalLimiter.allow("create:"+clientIP(r), s.RateLimitPerMinute/60.0, s.RateLimitBurst)
 }
 
 // rateLimitGuess: 1 req/sec refill, burst 5, per IP.
@@ -74,10 +104,16 @@ func rateLimitUnlock(id string, r *http.Request) bool {
 	return globalLimiter.allow("unlock:"+id+":"+clientIP(r), 5.0/60.0, 5)
 }
 
+// rateLimitAdmin: 5 attempts per minute per IP on the admin key check (#66),
+// same pattern as the unlock limiter (#34).
+func rateLimitAdmin(r *http.Request) bool {
+	return globalLimiter.allow("admin:"+clientIP(r), 5.0/60.0, 5)
+}
+
 // writeRateLimited responds 429 with Retry-After based on refill rate.
 func writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
 	w.Header().Set("Retry-After", strconv.Itoa(retryAfterSecs))
-	writeErr(w, 429, "rate limit exceeded")
+	writeErrCode(w, 429, "rate_limited", "rate limit exceeded")
 }
 
 // setRateLimitHeaders sets informational X-RateLimit headers for create/guess.

internal/api/ratelimit_test.go

@@ -1,6 +1,10 @@
-package main
+package api
 
 import (
+	"palette/internal/lang"
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"bytes"
 	"encoding/json"
 	"net/http"
@@ -12,18 +16,19 @@ import (
 func newTestServer(t *testing.T) *apiServer {
 	t.Helper()
 	globalLimiter = newLimiter() // fresh buckets per test
-	store, err := OpenStore(t.TempDir() + "/test.db")
+	st, err := store.OpenStore(t.TempDir() + "/test.db")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if webUIInstance == nil {
+	ui, err := web.New()
-		ui, err := NewWebUI()
+	if err != nil {
-		if err != nil {
+		t.Fatal(err)
-			t.Fatal(err)
-		}
-		webUIInstance = ui
 	}
-	return &apiServer{store: store, cfg: Config{MaxTextBytes: 1024 * 1024}}
+	cfg := Config{MaxTextBytes: 1024 * 1024}
+	ss := NewTestSettingsStore(t, cfg)
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 }
 
 func postJSON(t *testing.T, h http.Handler, path string, body any) *httptest.ResponseRecorder {
@@ -146,7 +151,7 @@ func TestRateLimitUnlock(t *testing.T) {
 // TestHighlightCode basic expectations.
 func TestHighlightCode(t *testing.T) {
 	in := "func main() {\n\t// comment\n\tfmt.Println(\"hello\")\n}\n"
-	out := highlightCode(in, "go")
+	out := lang.HighlightCode(in, "go")
 	if !bytes.Contains([]byte(out), []byte(`<span class="tok-kw">func</span>`)) {
 		t.Fatalf("no keyword span: %s", out)
 	}
@@ -157,12 +162,12 @@ func TestHighlightCode(t *testing.T) {
 		t.Fatalf("no string span: %s", out)
 	}
 	// unsupported language returns escaped plain text
-	plain := highlightCode("<b>x</b>", "text")
+	plain := lang.HighlightCode("<b>x</b>", "text")
 	if plain != "&lt;b&gt;x&lt;/b&gt;" {
 		t.Fatalf("plain escaping wrong: %q", plain)
 	}
 	// line count preserved (gutter alignment)
-	if got := len(splitLines(highlightCode("a\nb\nc", "go"))); got != 3 {
+	if got := len(splitLines(lang.HighlightCode("a\nb\nc", "go"))); got != 3 {
 		t.Fatalf("want 3 lines, got %d", got)
 	}
 }

internal/api/ratelimit_xff_test.go

@@ -0,0 +1,85 @@
+package api
+
+// Issue #85: the rate limit key must use the rightmost X-Forwarded-For entry
+// (appended by the trusted Traefik proxy), never the raw/leftmost header
+// value a client can forge. A spoofed FIRST XFF entry must not bypass the
+// limit or rotate buckets.
+
+import (
+	"bytes"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestClientIPTakesRightmostXFF(t *testing.T) {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.42.0.7:51000" // trusted Traefik pod
+	r.Header.Set("X-Forwarded-For", "1.2.3.4, 1.2.3.5, 203.0.113.9")
+	if got := clientIP(r); got != "203.0.113.9" {
+		t.Fatalf("clientIP = %q, want rightmost 203.0.113.9", got)
+	}
+}
+
+func TestClientIPXRealIPFallback(t *testing.T) {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.42.0.7:51000"
+	r.Header.Set("X-Real-Ip", "203.0.113.10")
+	if got := clientIP(r); got != "203.0.113.10" {
+		t.Fatalf("clientIP = %q, want 203.0.113.10", got)
+	}
+}
+
+func TestClientIPDirectFallback(t *testing.T) {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "198.51.100.5:51000"
+	if got := clientIP(r); got != "198.51.100.5" {
+		t.Fatalf("clientIP = %q, want 198.51.100.5", got)
+	}
+}
+
+// TestRateLimitSpoofedFirstXFFDoesNotBypass: an attacker rotating a fake
+// leftmost XFF entry stays limited on their real (rightmost) IP.
+func TestRateLimitSpoofedFirstXFFDoesNotBypass(t *testing.T) {
+	srv := newTestServer(t)
+	h := srv.routes()
+	for i := 0; i < 5; i++ {
+		req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
+		req.RemoteAddr = "10.42.0.7:51000"
+		// each request spoofs a DIFFERENT leftmost entry
+		req.Header.Set("X-Forwarded-For", spoofN(i)+", 203.0.113.9")
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+		if rr.Code != 201 {
+			t.Fatalf("req %d: want 201, got %d", i, rr.Code)
+		}
+	}
+	// 6th request, still the same real IP, new spoofed prefix: must 429
+	req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
+	req.RemoteAddr = "10.42.0.7:51000"
+	req.Header.Set("X-Forwarded-For", "9.9.9.9, 203.0.113.9")
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != 429 {
+		t.Fatalf("spoofed 6th req: want 429, got %d", rr.Code)
+	}
+}
+
+func spoofN(i int) string {
+	return "1.2.3." + string(rune('0'+i))
+}
+
+// Distinct real IPs must still get distinct buckets (no over-limiting).
+func TestRateLimitDistinctRightmostIPsIndependent(t *testing.T) {
+	srv := newTestServer(t)
+	h := srv.routes()
+	for _, ip := range []string{"203.0.113.20", "203.0.113.21"} {
+		req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
+		req.RemoteAddr = "10.42.0.7:51000"
+		req.Header.Set("X-Forwarded-For", "6.6.6.6, "+ip)
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+		if rr.Code != 201 {
+			t.Fatalf("ip %s: want 201, got %d", ip, rr.Code)
+		}
+	}
+}

internal/api/server.go

@@ -0,0 +1,630 @@
+// Package api implements palette's REST handlers and the HTTP router:
+// pastes, cans, guess-language, rate limiting middleware, and the admin API.
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"html/template"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+
+	langpkg "palette/internal/lang"
+	"palette/internal/store"
+	"palette/internal/web"
+)
+
+type Config struct {
+	Addr         string
+	DBPath       string
+	MaxTextBytes int64
+	MaxItemBytes int64
+}
+
+type apiServer struct {
+	store    *store.Store
+	cfg      Config
+	ui       *web.UI
+	settings *settingsStore
+	adminKey string
+}
+
+func NewServer(st *store.Store, cfg Config, ui *web.UI, ss *settingsStore, adminKey string) *apiServer {
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: adminKey}
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v)
+}
+
+func writeErr(w http.ResponseWriter, status int, msg string) {
+	writeJSON(w, status, map[string]string{"error": msg})
+}
+
+// writeErrCode emits a JSON error with a machine-readable code (#105): the
+// new-page JS maps known codes to plain-language messages, API consumers get
+// the stable `code` field alongside the human `error` text.
+func writeErrCode(w http.ResponseWriter, status int, code, msg string) {
+	writeJSON(w, status, map[string]string{"error": msg, "code": code})
+}
+
+// createErrCode maps a store.CreatePaste/CreateCan error to its UI error
+// code (#105).
+func createErrCode(err error) string {
+	switch {
+	case errors.Is(err, store.ErrSlugTaken):
+		return "slug_taken"
+	case errors.Is(err, store.ErrReservedSlug):
+		return "slug_reserved"
+	case errors.Is(err, store.ErrInvalidSlug):
+		return "slug_invalid"
+	case strings.Contains(err.Error(), "expires_in"):
+		return "expiry_invalid"
+	default:
+		return "invalid_request"
+	}
+}
+
+// Routes returns the HTTP handler for the server.
+func (a *apiServer) Routes() http.Handler {
+	return a.routes()
+}
+
+func (a *apiServer) routes() http.Handler {
+	r := chi.NewRouter()
+	r.Use(middleware.Recoverer)
+	r.Use(middleware.Timeout(30 * time.Second))
+	r.Use(a.limitRequestBody) // #68: hard server-side body cap -> 413
+	r.Use(viewerCookieMiddleware)
+	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
+
+	// admin (#40): HTML page is open (key entry via form); API is key-guarded
+	r.Get("/admin", a.ui.Handlers().HandleAdminPage)
+	r.Get("/admin/api/settings", a.adminAuth(a.handleAdminGetSettings, a.adminKey))
+	r.Post("/admin/api/settings", a.adminAuth(a.handleAdminPostSettings, a.adminKey))
+
+	// API
+	r.Route("/api", func(r chi.Router) {
+		r.Post("/pastes", a.handleCreatePaste)
+		r.Get("/pastes/{id}", a.handleGetPaste)
+		r.Delete("/pastes/{id}", a.handleDeletePaste)
+		r.Get("/mine", a.handleListMine)
+		r.Delete("/pastes/{id}/redeem", a.handleRedeemDeletion)
+		r.Get("/public", a.handleListPublic)
+		r.Post("/guess-language", a.handleGuessLang)
+		r.Post("/pastes/can", a.handleCreateCan)
+		r.Get("/cans/{id}", a.handleGetCan)
+		r.Delete("/cans/{id}", a.handleDeleteCan)
+		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
+	})
+
+	// can page (#4): GET renders, POST unlocks (same flow as pastes)
+	r.Get("/can/{id}", a.handleCanPage)
+	r.Post("/can/{id}", a.handleCanPage)
+
+	// raw
+	r.Get("/raw/{id}", a.handleRaw)
+
+	// web pages
+	r.Get("/", http.RedirectHandler("/history", http.StatusFound).ServeHTTP)
+	r.Get("/new", a.ui.Handlers().HandleNewPage)
+	r.Get("/history", a.ui.Handlers().HandleHistoryPage)
+	r.Get("/settings", a.ui.Handlers().HandleSettingsPage)
+	r.Get("/mine", a.ui.Handlers().HandleMinePage)
+	r.Handle("/static/*", a.ui.StaticHandler())
+	r.Get("/unlock/{id}", a.handlePasteView)
+	r.Post("/unlock/{id}", a.handlePasteView)
+	r.Get("/{id}", a.handlePasteView)
+	r.Post("/{id}", a.handlePasteView)
+
+	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		writeErr(w, 404, "not found")
+	})
+	return r
+}
+
+// viewerCookieMiddleware ensures every request carries an anonymous browser id
+// cookie ("vwr"); sets one on the response if absent. Used by /mine (#37, #49).
+func viewerCookieMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if c, err := r.Cookie("vwr"); err != nil || c.Value == "" {
+			id := store.GenSlug(16)
+			http.SetCookie(w, &http.Cookie{
+				Name: "vwr", Value: id, Path: "/",
+				MaxAge: 31536000, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+			})
+			r.AddCookie(&http.Cookie{Name: "vwr", Value: id})
+			// remember that this cookie was minted here, not sent by the client
+			r = r.WithContext(context.WithValue(r.Context(), vwrMintedKey, true))
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+type vwrMintedKeyType struct{}
+
+var vwrMintedKey vwrMintedKeyType
+
+func currentViewerID(r *http.Request) string {
+	if c, err := r.Cookie("vwr"); err == nil {
+		return c.Value
+	}
+	return ""
+}
+
+// viewerSentCookie reports whether the client itself sent a vwr cookie
+// (as opposed to the middleware minting one for this request).
+func viewerSentCookie(r *http.Request) bool {
+	if _, err := r.Cookie("vwr"); err != nil {
+		return false
+	}
+	_, minted := r.Context().Value(vwrMintedKey).(bool)
+	return !minted
+}
+
+func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
+	s := a.settings.get()
+	setRateLimitHeaders(w, 1, 5)
+	if !rateLimitCreate(r, s) {
+		writeRateLimited(w, 1)
+		return
+	}
+	var p store.Paste
+	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
+		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
+			writeErrCode(w, http.StatusRequestEntityTooLarge, "content_too_large", "request body too large")
+			return
+		}
+		writeErr(w, 400, "invalid json body")
+		return
+	}
+	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
+		if status == http.StatusRequestEntityTooLarge {
+			writeErrCode(w, status, "content_too_large", msg)
+		} else {
+			writeErrCode(w, status, "content_empty", msg)
+		}
+		return
+	}
+	// #86: bound free-form metadata at create time
+	if p.Title != nil {
+		t, err := checkTitle(*p.Title)
+		if err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
+		p.Title = &t
+	}
+	if p.Language != nil {
+		l, err := checkLanguage(*p.Language)
+		if err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
+		if l == "" {
+			p.Language = nil
+		} else {
+			p.Language = &l
+		}
+	}
+	if p.BurnAfterReads != nil { // #68: reject negative read budgets
+		if err := parseBurnAfterReads(*p.BurnAfterReads); err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
+	}
+	// #40: admin-configurable default expiry
+	if (p.ExpiresIn == nil || *p.ExpiresIn == "") && s.DefaultExpiry != "" {
+		def := s.DefaultExpiry
+		p.ExpiresIn = &def
+	}
+	p.ViewerID = currentViewerID(r)
+	created, err := a.store.CreatePaste(&p)
+	if err != nil {
+		writeErrCode(w, 400, createErrCode(err), err.Error())
+		return
+	}
+	writeJSON(w, 201, map[string]any{
+		"id":             created.ID,
+		"deletion_token": created.DeletionToken,
+		"url":            "/" + created.ID,
+		"raw_url":        "/raw/" + created.ID,
+		"api_url":        "/api/pastes/" + created.ID,
+		"expires_at":     created.ExpiresAt,
+		"created_at":     created.CreatedAt,
+		"rate_limit":     map[string]int{"create_per_sec": 1, "burst": 5},
+	})
+}
+
+func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	if row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		writeErr(w, 404, "paste expired")
+		return
+	}
+	if row.Burned() { // #49: read budget exhausted
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.PasswordHash.Valid {
+		// #81: every password verification (header, query param, or empty)
+		// goes through the same per-IP+paste unlock limiter as the POST form
+		// path, so brute-force via GET ?password= or X-Paste-Password gets 429.
+		if !rateLimitUnlock(row.ID, r) {
+			writeRateLimited(w, 60)
+			return
+		}
+		// require password via header or query
+		pw := r.Header.Get("X-Paste-Password")
+		if pw == "" {
+			pw = r.URL.Query().Get("password")
+		}
+		if pw == "" || !store.CheckPassword(row.PasswordHash.String, pw) {
+			writeErr(w, 401, "password required")
+			return
+		}
+	}
+	// #58: only the reader that wins the atomic burn claim may see content.
+	rem, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	writeJSON(w, 200, map[string]any{
+		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
+		"language": store.NullStrPtr(row.Language), "title": store.NullStrPtr(row.Title), "created_at": row.CreatedAt,
+		"view_count": row.ViewCount, "visibility": row.Visibility,
+		"reads_remaining": rem,
+	})
+}
+
+func (a *apiServer) handleDeletePaste(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	// #63: deletion requires authorization. Either the deletion token issued
+	// at create time (Authorization header or ?token= query param, matching
+	// the create response's "deletion_token" field), or the creator browser
+	// itself (client-sent vwr cookie matching the paste's viewer, #37).
+	if !a.deletionAuthorized(r, row) {
+		writeErr(w, 403, "deletion token required")
+		return
+	}
+	if _, err := a.store.SoftDelete(row.ID); err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
+}
+
+// deletionAuthorization extracts the deletion token from the request: the
+// Authorization header ("Bearer <t>", "Token <t>", or a bare token) or the
+// token query parameter. Returns "" when absent.
+func deletionAuthorization(r *http.Request) string {
+	if h := r.Header.Get("Authorization"); h != "" {
+		for _, prefix := range []string{"Bearer ", "Token "} {
+			if len(h) > len(prefix) && strings.EqualFold(h[:len(prefix)], prefix) {
+				return strings.TrimSpace(h[len(prefix):])
+			}
+		}
+		return strings.TrimSpace(h)
+	}
+	return r.URL.Query().Get("token")
+}
+
+// deletionAuthorized reports whether the request may soft-delete the paste:
+// a valid constant-time-matched deletion token, or the creator browser's
+// viewer cookie (#37). Plain API clients with no token get false.
+func (a *apiServer) deletionAuthorized(r *http.Request, row *store.PasteRow) bool {
+	if tok := deletionAuthorization(r); tok != "" {
+		return row.DeletionToken.Valid && row.DeletionToken.String != "" &&
+			store.DeletionTokenEqual(row.DeletionToken.String, tok)
+	}
+	// viewer-cookie delete enforcement (#37): only the browser that created
+	// the paste (matching vwr) may delete it via this endpoint. Requests with
+	// no client-sent vwr cookie (plain API clients) are unaffected.
+	vid := currentViewerID(r)
+	return vid != "" && viewerSentCookie(r) && row.ViewerID.Valid &&
+		row.ViewerID.String != "" && row.ViewerID.String == vid
+}
+
+// handleListMine serves /api/mine: pastes created from this browser (#37).
+func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
+	vid := currentViewerID(r)
+	if vid == "" {
+		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
+		return
+	}
+	limit := parseLimit(r, 50, 100)
+	offset := parseOffset(r)
+	rows, total, err := a.store.ListMine(vid, limit, offset)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	items := make([]map[string]any, 0, len(rows))
+	for _, row := range rows {
+		lang, title := store.NullStrPtr(row.Language), store.NullStrPtr(row.Title)
+		items = append(items, map[string]any{
+			"id": row.ID, "title": title, "language": lang,
+			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
+			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
+			"is_can": row.IsCan,
+		})
+	}
+	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
+}
+
+func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
+	limit := parseLimit(r, 25, 100)
+	offset := parseOffset(r)
+	rows, total, err := a.store.ListPublic(limit, offset)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	items := make([]map[string]any, 0, len(rows))
+	for _, row := range rows {
+		lang, title := store.NullStrPtr(row.Language), store.NullStrPtr(row.Title)
+		items = append(items, map[string]any{
+			"id": row.ID, "title": title, "language": lang,
+			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
+			"custom_slug": store.NullStrPtr(row.CustomSlug),
+			"is_can":      row.IsCan,
+		})
+	}
+	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
+}
+
+func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		http.Error(w, "not found", 404)
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		http.Error(w, "paste expired", 404)
+		return
+	}
+	if row.PasswordHash.Valid {
+		http.Error(w, "password required", 401)
+		return
+	}
+	if row.Burned() { // #49: read budget exhausted
+		http.Error(w, "not found", 404)
+		return
+	}
+	// #49 decision: raw reads count against the read budget too, with the
+	// same per-viewer dedupe window as page views. #58: a reader that loses
+	// the burn claim must not receive the content.
+	_, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		http.Error(w, "not found", 404)
+		return
+	}
+	// #34: content_type is attacker-controlled via the create API. Serving it
+	// verbatim let a paste be stored with text/html (or image/svg+xml) and
+	// render as active content on this origin when fetched from /raw —
+	// stored XSS. Only pass through a fixed safe set; anything else is
+	// served as plain text with nosniff.
+	ct := row.ContentType
+	if !safeRawContentType(ct) {
+		ct = "text/plain; charset=utf-8"
+	}
+	w.Header().Set("Content-Type", ct)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	a.store.IncrementViews(row.ID, "", 0) // raw views always count (#49/#95)
+	w.Write([]byte(row.Content))
+}
+
+// safeRawContentType reports whether ct is in the fixed set of types that are
+// safe to serve verbatim on /raw (no active-content execution contexts).
+func safeRawContentType(ct string) bool {
+	base := ct
+	if i := strings.IndexByte(ct, ';'); i >= 0 {
+		base = ct[:i]
+	}
+	base = strings.ToLower(strings.TrimSpace(base))
+	switch base {
+	case "text/plain", "text/markdown", "text/x-markdown",
+		"application/json", "application/pdf",
+		"image/png", "image/jpeg", "image/gif", "image/webp",
+		"application/octet-stream":
+		return true
+	}
+	return false
+}
+
+func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	can, err := a.store.GetCan(id)
+	if err != nil || can == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if can.ExpiresAt.Valid && can.ExpiresAt.Int64 < time.Now().Unix() {
+		http.NotFound(w, r)
+		return
+	}
+	// #4: password-protected cans go through the same unlock flow as pastes:
+	// the pw_<id> cookie carries an HMAC token bound to this can id. Items
+	// inherit the protection (handleCanItem checks the same cookie).
+	if can.PasswordHash.Valid {
+		h := a.webHandlers()
+		if r.Method == http.MethodPost {
+			if !rateLimitUnlock(can.ID, r) {
+				h.WriteRateLimited(w, 60)
+				return
+			}
+			r.ParseForm()
+			pw := r.FormValue("password")
+			if pw != "" && store.CheckPassword(can.PasswordHash.String, pw) {
+				http.SetCookie(w, &http.Cookie{
+					Name: "pw_" + can.ID, Value: web.UnlockToken(can.ID), Path: "/",
+					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+				})
+				a.renderCan(w, can)
+				return
+			}
+			h.RenderPage(w, "unlock.html", map[string]any{
+				"Page": "unlock", "ID": can.ID, "Wrong": true,
+				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
+			})
+			return
+		}
+		c, err := r.Cookie("pw_" + can.ID)
+		if err != nil || c.Value != web.UnlockToken(can.ID) {
+			h.RenderPage(w, "unlock.html", map[string]any{
+				"Page": "unlock", "ID": can.ID, "Wrong": false,
+				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
+			})
+			return
+		}
+	}
+	a.renderCan(w, can)
+}
+
+// renderCan renders the can view page: title/description and items as cards.
+// Text items expand inline; files link to download.
+func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
+	h := a.webHandlers()
+	items, err := a.store.ListCanItems(can.ID)
+	if err != nil {
+		http.Error(w, "db error", 500)
+		return
+	}
+	type canItem struct {
+		ID          string
+		Title       string
+		ContentType string
+		Size        string
+		IsFile      bool
+		Content     string
+		ContentHTML template.HTML
+		Language    string
+	}
+	cards := make([]canItem, 0, len(items))
+	totalSize := 0
+	for _, it := range items {
+		totalSize += len(it.Content)
+		isFile := it.ContentType != "text/plain" && !strings.HasPrefix(it.ContentType, "text/")
+		ci := canItem{
+			ID:          it.ID,
+			Title:       nullStrOr(it.Title, it.ID),
+			ContentType: it.ContentType,
+			Size:        web.HumanSize(len(it.Content)),
+			IsFile:      isFile,
+			Language:    it.Language.String,
+		}
+		if !isFile {
+			ci.ContentHTML = template.HTML(langpkg.HighlightCode(it.Content, it.Language.String))
+		}
+		cards = append(cards, ci)
+	}
+	h.RenderPage(w, "can.html", map[string]any{
+		"Page":          "can",
+		"ID":            can.ID,
+		"Title":         nullStrOr(can.Title, "Untitled can"),
+		"Description":   can.Description.String,
+		"HasDescription": can.Description.Valid && can.Description.String != "",
+		"HasPassword":   can.PasswordHash.Valid,
+		"Items":         cards,
+		"ItemCount":     len(cards),
+		"SizeHuman":     web.HumanSize(totalSize),
+		"CreatedAgo":    web.AgoString(can.CreatedAt),
+		"CreatedAtUnix": can.CreatedAt,
+		"ExpiresAt":     can.ExpiresAt.Valid,
+		"ExpiresIn":     expiryStringIfValid(can.ExpiresAt),
+	})
+}
+
+// expiryStringIfValid formats remaining time for a valid expiry, "" otherwise.
+func expiryStringIfValid(ns sql.NullInt64) string {
+	if !ns.Valid {
+		return ""
+	}
+	remaining := ns.Int64 - time.Now().Unix()
+	s := remaining
+	switch {
+	case s < 3600:
+		return fmt.Sprintf("%dm", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh", s/3600)
+	default:
+		return fmt.Sprintf("%dd", s/86400)
+	}
+}
+
+func templateEsc(s string) string {
+	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
+	return r.Replace(s)
+}
+
+func (a *apiServer) handlePasteView(w http.ResponseWriter, r *http.Request) {
+	h := a.webHandlers()
+	// unlock POST rate limiting is wired through h.RateLimitOK
+	h.HandlePasteView(w, r)
+}
+
+func (a *apiServer) webHandlers() *web.Handlers {
+	return &web.Handlers{
+		UI:            a.ui,
+		Store:         a.store,
+		ViewerID:      currentViewerID,
+		BurnWindowMin: a.burnViewerWindow,
+		RateLimitOK:   func(id string, r *http.Request) bool { return rateLimitUnlock(id, r) },
+	}
+}
+
+func envOr(k, d string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return d
+}
+
+func envIntOr(k string, d int) int {
+	if v := os.Getenv(k); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return d
+}
+
+func nullStrOr(ns sql.NullString, def string) string {
+	if ns.Valid {
+		return ns.String
+	}
+	return def
+}
+
+// EnvOr returns the env var value or default.
+func EnvOr(k, d string) string { return envOr(k, d) }
+
+// EnvIntOr returns the env int value or default.
+func EnvIntOr(k string, d int) int { return envIntOr(k, d) }

internal/api/slugrelease_test.go

@@ -1,18 +1,19 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+
 	"testing"
 	"time"
 )
 
 // insertPasteWithSlug creates a paste directly with a custom slug and controlled
 // created_at/expires_at, bypassing the API's timestamp handling.
-func insertPasteWithSlug(t *testing.T, s *Store, slug string, createdAt, expiresAt int64) string {
+func insertPasteWithSlug(t *testing.T, s *store.Store, slug string, createdAt, expiresAt int64) string {
 	t.Helper()
-	id := genSlug(6)
+	id := store.GenSlug(6)
-	_, err := s.db.Exec(`INSERT INTO pastes (id, custom_slug, content, content_type, created_at, expires_at)
+	if _, err := s.Exec(`INSERT INTO pastes (id, custom_slug, content, content_type, created_at, expires_at)
-		VALUES (?, ?, ?, ?, ?, ?)`, id, slug, "x", "text/plain", createdAt, expiresAt)
+		VALUES (?, ?, ?, ?, ?, ?)`, id, slug, "x", "text/plain", createdAt, expiresAt); err != nil {
-	if err != nil {
 		t.Fatal(err)
 	}
 	return id
@@ -24,14 +25,14 @@ func TestReleaseSlugOnExpiredPaste(t *testing.T) {
 	s := testServer(t)
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "release-notes", now-3600, now-60)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 1 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 1 {
 		t.Fatalf("released %d err %v, want 1", n, err)
 	}
 	if taken, _ := s.store.SlugTaken("release-notes"); taken {
 		t.Fatal("slug should be released after expiry")
 	}
 	// slug must be reusable by a new paste
-	p, err := s.store.CreatePaste(&Paste{Content: "new", CustomSlug: strPtr("release-notes")})
+	p, err := s.store.CreatePaste(&store.Paste{Content: "new", CustomSlug: strPtr("release-notes")})
 	if err != nil {
 		t.Fatalf("reuse slug: %v", err)
 	}
@@ -45,7 +46,7 @@ func TestReleaseSlugOnOldPaste(t *testing.T) {
 	now := time.Now().Unix()
 	// created 31 days ago, no expiry -> released by 30-day reservation rule
 	insertPasteWithSlug(t, s.store, "old-url", now-31*86400, 0)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 1 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 1 {
 		t.Fatalf("released %d err %v, want 1", n, err)
 	}
 	if taken, _ := s.store.SlugTaken("old-url"); taken {
@@ -58,7 +59,7 @@ func TestKeepSlugOnRecentUnexpiredPaste(t *testing.T) {
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "fresh-url", now-3600, now+86400)
 	insertPasteWithSlug(t, s.store, "fresh-url2", now-3600, 0)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 0 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 0 {
 		t.Fatalf("released %d err %v, want 0", n, err)
 	}
 	for _, slug := range []string{"fresh-url", "fresh-url2"} {
@@ -72,7 +73,7 @@ func TestSweeperTickerReleasesSlugs(t *testing.T) {
 	s := testServer(t)
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "ticker-url", now-7200, now-3600)
-	s.store.StartSweeper(10 * time.Millisecond)
+	s.store.StartSweeper(10*time.Millisecond, store.SlugReservationDays)
 	deadline := time.Now().Add(2 * time.Second)
 	for time.Now().Before(deadline) {
 		if taken, _ := s.store.SlugTaken("ticker-url"); !taken {

internal/api/sweep33_test.go

@@ -0,0 +1,100 @@
+package api
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #33 sweep: the create API must enforce the same expiry window as the UI
+// (1 minute .. 1 year). Previously -1h, 0s, 1ns and 30000h were all accepted,
+// producing pastes that were born expired or effectively permanent.
+func TestCreatePasteExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},
+		{"-0s", 400},
+		{"0s", 400},
+		{"1ns", 400},
+		{"59s", 400},
+		{"1m", 201},
+		{"90s", 201},
+		{"8760h", 201}, // exactly 1 year
+		{"8785h", 400}, // 1 year + 1 day: over the max
+		{"30000h", 400}, // ~3.4 years, over the max
+	}
+	globalLimiter = newLimiter() // one fresh bucket for the whole table
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		req := httptest.NewRequest("POST", "/api/pastes",
+			strings.NewReader(`{"content":"x","expires_in":"`+c.expiresIn+`"}`))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}
+
+// #33 sweep: HTML paste views must increment view_count. The increment was
+// missing from handlePasteView, so the counter only moved on /raw.
+func TestPasteViewIncrementsViewCount(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"vc"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	// first render counts (no ?created=1 here: that's the just-created banner case)
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("view: got %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("api get: got %d", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, `"view_count":2`) {
+		t.Fatalf("expected view_count 2 after two HTML views, got: %s", body)
+	}
+}
+
+// #33 sweep: the just-created banner render (?created=1) must NOT count as a
+// view for the creator.
+func TestJustCreatedViewDoesNotCount(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"jc"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	req = httptest.NewRequest("GET", "/"+id+"?created=1&token=t", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), `"view_count":1`) {
+		t.Fatalf("just-created render counted as a view: %s", rec.Body.String())
+	}
+}

internal/api/validate.go

@@ -0,0 +1,136 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// #68 input-validation helpers. Paste/can payloads are size-capped and list
+// endpoints get a single place where limit/offset are parsed and clamped.
+
+// maxRequestBody returns the HTTP body cap for JSON create endpoints: the
+// admin-tunable content cap plus headroom for JSON field overhead, floored
+// at 64KiB so a tiny admin-configured cap can't break small requests.
+func (a *apiServer) maxRequestBody() int64 {
+	s := a.settings.get()
+	max := s.MaxContentBytes + 4096
+	if max < 64*1024 {
+		max = 64 * 1024
+	}
+	return max
+}
+
+// limitRequestBody wraps the request body with http.MaxBytesReader so
+// oversized payloads are cut off server-side instead of being fully decoded
+// into memory before the per-field size check runs (#68). A read over the
+// cap surfaces as *http.MaxBytesError, which handlers map to 413.
+func (a *apiServer) limitRequestBody(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil {
+			r.Body = http.MaxBytesReader(w, r.Body, a.maxRequestBody())
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// writeBodyTooLarge emits the 413 response for a body rejected by
+// MaxBytesReader.
+func writeBodyTooLarge(w http.ResponseWriter) {
+	writeErr(w, http.StatusRequestEntityTooLarge, "request body too large")
+}
+
+// isBodyTooLarge reports whether err came from http.MaxBytesReader.
+func isBodyTooLarge(err error) bool {
+	var mbe *http.MaxBytesError
+	return errors.As(err, &mbe)
+}
+
+// checkContent validates paste content: rejects whitespace-only content
+// (400) and content over the byte cap (413). Returns (0, "") when valid.
+func checkContent(content string, maxBytes int64) (int, string) {
+	if strings.TrimSpace(content) == "" {
+		return http.StatusBadRequest, "content is required"
+	}
+	if int64(len(content)) > maxBytes { // #40/#68: admin-tunable cap
+		return http.StatusRequestEntityTooLarge,
+			fmt.Sprintf("content exceeds max %d bytes", maxBytes)
+	}
+	return 0, ""
+}
+
+// parseLimit clamps the ?limit query param: missing/non-numeric/zero/negative
+// or over-max values fall back to def. Zero intentionally maps to the default
+// page size, matching the pre-existing `<= 0` clamp (#68).
+func parseLimit(r *http.Request, def, max int) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("limit"))
+	if err != nil || n <= 0 || n > max {
+		return def
+	}
+	return n
+}
+
+// parseOffset clamps the ?offset query param: missing/non-numeric or negative
+// values become 0 (#68: negative offsets previously passed through to SQL).
+func parseOffset(r *http.Request) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("offset"))
+	if err != nil || n < 0 {
+		return 0
+	}
+	return n
+}
+
+// parseBurnAfterReads validates the burn_after_reads field (#68): negative
+// values are rejected; zero/absent mean the default single read.
+func parseBurnAfterReads(n int) error {
+	if n < 0 {
+		return errors.New("burn_after_reads must be a positive number")
+	}
+	return nil
+}
+
+// #86: bounds for free-form metadata fields on create.
+const (
+	maxTitleLen    = 200
+	maxLanguageLen = 40
+)
+
+// languageRe restricts language to identifiers like go, c#, f#, c++, objc.
+var languageRe = regexp.MustCompile(`^[a-zA-Z0-9+#-]{1,40}$`)
+
+// checkTitle validates the paste title (#86): over-max titles are truncated
+// to 200 characters so a bloated listing entry can't be stored; whitespace
+// is trimmed first.
+func checkTitle(title string) (string, error) {
+	title = strings.TrimSpace(title)
+	if len(title) > maxTitleLen {
+		return truncateRunes(title, maxTitleLen), nil
+	}
+	return title, nil
+}
+
+// checkLanguage validates the language field (#86): optional, max 40 chars,
+// and must match ^[a-zA-Z0-9+#-]{1,40}$. Returns "" for absent/blank values.
+// Anything else malformed is a 400.
+func checkLanguage(lang string) (string, error) {
+	lang = strings.TrimSpace(lang)
+	if lang == "" {
+		return "", nil
+	}
+	if len(lang) > maxLanguageLen || !languageRe.MatchString(lang) {
+		return "", fmt.Errorf("language must match ^[a-zA-Z0-9+#-]{1,40}$ (max %d chars)", maxLanguageLen)
+	}
+	return lang, nil
+}
+
+// truncateRunes cuts s to at most max runes, keeping the prefix intact.
+func truncateRunes(s string, max int) string {
+	runes := []rune(s)
+	if len(runes) <= max {
+		return s
+	}
+	return string(runes[:max])
+}

internal/api/viewdedupe_test.go

@@ -0,0 +1,121 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"palette/internal/store"
+)
+
+// #95: HTML paste views dedupe per viewer (vwr cookie) within the burn viewer
+// window, reusing the paste_views table. Repeated views by the same viewer do
+// not inflate view_count; a different viewer counts.
+func TestHTMLViewsDedupedPerViewer(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"vd"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	view := func(vwr string) {
+		req := httptest.NewRequest("GET", "/"+id, nil)
+		if vwr != "" {
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: vwr})
+		}
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("view: got %d", rec.Code)
+		}
+	}
+	count := func() string {
+		req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec.Body.String()
+	}
+
+	// same viewer (same cookie) renders twice: still 1 view
+	view("v-a")
+	view("v-a")
+	if got := count(); !strings.Contains(got, `"view_count":1`) {
+		t.Fatalf("expected view_count 1 after duplicate viewer views, got: %s", got)
+	}
+	// a different viewer counts
+	view("v-b")
+	if got := count(); !strings.Contains(got, `"view_count":2`) {
+		t.Fatalf("expected view_count 2 after second viewer, got: %s", got)
+	}
+	// viewer without cookie counts every time (plain API clients, #49 decision)
+	view("")
+	view("")
+	if got := count(); !strings.Contains(got, `"view_count":4`) {
+		t.Fatalf("expected view_count 4 after uncoookied views, got: %s", got)
+	}
+}
+
+// #95: raw views always count, even from a cookie-holding viewer (#49 decision).
+func TestRawViewsAlwaysCount(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"rv"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	for i := 0; i < 3; i++ {
+		req := httptest.NewRequest("GET", "/raw/"+id, nil)
+		req.AddCookie(&http.Cookie{Name: "vwr", Value: "same-viewer"})
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("raw view: got %d", rec.Code)
+		}
+	}
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if got := rec.Body.String(); !strings.Contains(got, `"view_count":3`) {
+		t.Fatalf("expected view_count 3 after 3 raw views by one viewer, got: %s", got)
+	}
+}
+
+// #95: after the dedupe window passes, the same viewer counts again.
+func TestViewDedupeWindowExpires(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"we"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	view := func() {
+		req := httptest.NewRequest("GET", "/"+id, nil)
+		req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-w"})
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("view: got %d", rec.Code)
+		}
+	}
+	view()
+	view()
+	// jump past the 15-minute window
+	realNow := store.TimeNow
+	store.TimeNow = func() time.Time { return realNow().Add(16 * time.Minute) }
+	defer func() { store.TimeNow = realNow }()
+	view()
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if got := rec.Body.String(); !strings.Contains(got, `"view_count":2`) {
+		t.Fatalf("expected view_count 2 after window expiry, got: %s", got)
+	}
+}

internal/lang/guess.go

@@ -1,8 +1,7 @@
-package main
+package lang
 
 import (
 	"encoding/json"
-	"net/http"
 	"regexp"
 	"strings"
 
@@ -58,7 +57,8 @@ var canonical = map[string]string{
 // paths (empty, JSON, unambiguous markers enry can't see without a filename),
 // then enry strategies (shebangs, XML decl, modelines, content heuristics),
 // then enry's classifier seeded by our regex hints.
-func guessLang(s string) string {
+// GuessLang detects a language from pasted content.
+func GuessLang(s string) string {
 	src := strings.TrimSpace(s)
 	if src == "" {
 		return ""
@@ -108,19 +108,3 @@ func normalizeLang(lang string) string {
 	return strings.ToLower(lang)
 }
 
-func (a *apiServer) handleGuessLang(w http.ResponseWriter, r *http.Request) {
-	setRateLimitHeaders(w, 1, 5)
-	if !rateLimitGuess(r) {
-		writeRateLimited(w, 1)
-		return
-	}
-	var req struct {
-		Content string `json:"content"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeErr(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-	lang := guessLang(req.Content)
-	writeJSON(w, http.StatusOK, map[string]any{"language": lang})
-}

internal/lang/guess_test.go

@@ -1,4 +1,4 @@
-package main
+package lang
 
 import (
 	"strings"
@@ -23,8 +23,8 @@ func TestGuessLangExisting(t *testing.T) {
 		"#!/bin/bash\nset -euo pipefail\necho hi\n":                           "bash",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -47,8 +47,8 @@ func TestGuessLangNewLanguages(t *testing.T) {
 		"diff --git a/main.go b/main.go\n--- a/main.go\n+++ b/main.go\n@@ -1 +1 @@\n": "diff",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -70,8 +70,8 @@ func TestGuessLangMagicMarkers(t *testing.T) {
 		"--- a/config.yml\n+++ b/config.yml\n@@ -1,2 +1,3 @@\n": "diff",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -79,14 +79,14 @@ func TestGuessLangMagicMarkers(t *testing.T) {
 // TestGuessLangCanonical verifies enry display names are mapped/lowercased to
 // our stored ids.
 func TestGuessLangCanonical(t *testing.T) {
-	if got := guessLang("FROM debian:12\nCMD [\"sh\"]\n"); got != "dockerfile" {
+	if got := GuessLang("FROM debian:12\nCMD [\"sh\"]\n"); got != "dockerfile" {
 		t.Errorf("Dockerfile canonical mapping failed: got %q", got)
 	}
-	if got := guessLang("#!/bin/sh\necho hi\n"); got != "bash" {
+	if got := GuessLang("#!/bin/sh\necho hi\n"); got != "bash" {
 		t.Errorf("Shell canonical mapping failed: got %q", got)
 	}
 	// uncurated languages still come back lowercase
-	if got := guessLang("<h1>{{.Name}}</h1>\n"); got != strings.ToLower(got) {
+	if got := GuessLang("<h1>{{.Name}}</h1>\n"); got != strings.ToLower(got) {
 		t.Errorf("expected lowercase output, got %q", got)
 	}
 }

internal/lang/highlight.go

@@ -1,4 +1,4 @@
-package main
+package lang
 
 import (
 	"html"
@@ -135,8 +135,8 @@ func containsStr(list []string, s string) bool {
 
 // highlightCode returns HTML with highlighting spans; safe because all
 // non-token text is html-escaped.
-func highlightCode(content, lang string) string {
+func HighlightCode(content, langID string) string {
-	l, h, ok := resolveLang(lang)
+	l, h, ok := resolveLang(langID)
 	_ = l
 	if !ok {
 		return html.EscapeString(content)
@@ -144,7 +144,7 @@ func highlightCode(content, lang string) string {
 	lines := strings.Split(content, "\n")
 	out := make([]string, len(lines))
 	for i, line := range lines {
-		out[i] = highlightLine(line, h, lang)
+		out[i] = highlightLine(line, h, langID)
 	}
 	return strings.Join(out, "\n")
 }

internal/store/burn.go

@@ -0,0 +1,96 @@
+package store
+
+import (
+	"crypto/subtle"
+	"database/sql"
+	"encoding/base64"
+	"time"
+)
+
+// genDeletionToken returns a 32-char url-safe random token
+func genDeletionToken() string {
+	b := make([]byte, 24)
+	cryptoRead(b)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// TimeNow is overridable in tests to inject the clock.
+var TimeNow = time.Now
+
+// RegisterRead applies the burn-after-read budget for one view (#49).
+// For pastes with reads_limit set: the viewer's paste_views row is checked;
+// a view within the burn viewer window of the viewer's last view is deduped
+// (count=false). Otherwise reads_used is incremented, and the paste is
+// soft-deleted (burned) once reads_used reaches reads_limit. Viewers without
+// a cookie (plain API clients) count as their own viewer id "".
+// For legacy plain burn_after_read pastes (no reads_limit), any read burns.
+// #58: admission is atomic. Returns (remaining, admitted). admitted is true
+// only when this caller may serve the content: for legacy burn pastes the
+// caller wins exactly when its conditional soft delete flipped deleted_at
+// (RowsAffected), and for read-budget pastes the caller wins exactly when its
+// conditional UPDATE (reads_used < reads_limit) incremented the counter - so
+// concurrent readers can never both consume the last read. Losing callers
+// must treat the paste as gone. view_count is tracked separately and
+// unaffected.
+func (s *Store) RegisterRead(row *PasteRow, viewerID string, burnWindowMinutes int) (remaining *int, admitted bool) {
+	if !row.ReadsLimit.Valid {
+		if row.BurnAfterRead {
+			// #58: atomic claim - only the caller whose UPDATE actually
+			// flips deleted_at from NULL may serve the content.
+			ok, err := s.SoftDelete(row.ID)
+			r := 0
+			if err != nil || !ok {
+				return &r, false
+			}
+			return &r, true
+		}
+		return nil, true
+	}
+	now := TimeNow().Unix()
+	var last sql.NullInt64
+	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
+		row.ID, viewerID).Scan(&last)
+	if last.Valid && now-last.Int64 < int64(burnWindowMinutes)*60 {
+		r := int(row.ReadsLimit.Int64) - row.ReadsUsed
+		if r < 0 {
+			r = 0
+		}
+		return &r, true
+	}
+	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
+		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
+		row.ID, viewerID, now)
+	// #58: conditional increment - only succeeds while budget remains, so
+	// concurrent readers cannot both consume the final read.
+	res, err := s.db.Exec(`UPDATE pastes SET reads_used = reads_used + 1
+		WHERE id = ? AND deleted_at IS NULL AND reads_used < ?`, row.ID, row.ReadsLimit.Int64)
+	if err != nil {
+		r := 0
+		return &r, false
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		// Lost the race: budget exhausted (or paste already burned).
+		r := 0
+		return &r, false
+	}
+	var used int64
+	s.db.QueryRow(`SELECT reads_used FROM pastes WHERE id = ?`, row.ID).Scan(&used)
+	if used >= row.ReadsLimit.Int64 {
+		// Atomic burn; either way the paste is gone for future readers.
+		s.SoftDelete(row.ID)
+	}
+	r := int(row.ReadsLimit.Int64) - int(used)
+	if r < 0 {
+		r = 0
+	}
+	return &r, true
+}
+
+// Burned reports whether a read-limited paste has exhausted its budget.
+func (row *PasteRow) Burned() bool {
+	return row.ReadsLimit.Valid && int64(row.ReadsUsed) >= row.ReadsLimit.Int64
+}
+
+func DeletionTokenEqual(stored, given string) bool {
+	return subtle.ConstantTimeCompare([]byte(stored), []byte(given)) == 1
+}

internal/store/customslug.go

@@ -1,8 +1,7 @@
-package main
+package store
 
 import (
 	"errors"
-	"fmt"
 	"regexp"
 	"strings"
 )
@@ -16,16 +15,16 @@ var reservedSlugs = map[string]bool{
 	"new": true, "login": true, "logout": true, "admin": true, "settings": true,
 }
 
-var errInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")
+var ErrInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")
-var errReservedSlug = errors.New("that slug is reserved")
+var ErrReservedSlug = errors.New("that slug is reserved")
-var errSlugTaken = errors.New("that slug is already taken")
+var ErrSlugTaken = errors.New("that slug is already taken")
 
 func ValidateCustomSlug(slug string) error {
 	if !slugRE.MatchString(slug) {
-		return errInvalidSlug
+		return ErrInvalidSlug
 	}
 	if reservedSlugs[strings.ToLower(slug)] {
-		return errReservedSlug
+		return ErrReservedSlug
 	}
 	return nil
 }
@@ -45,5 +44,3 @@ func (s *Store) SlugTaken(slug string) (bool, error) {
 	}
 	return n > 0, nil
 }
-
-var _ = fmt.Sprintf // keep fmt if unused later

internal/store/password.go

@@ -1,4 +1,4 @@
-package main
+package store
 
 import (
 	"crypto/rand"
@@ -19,7 +19,8 @@ const (
 	argonSaltLen = 16
 )
 
-func argon2idHash(pw string) (string, error) {
+// Argon2IDHash hashes a password with argon2id.
+func Argon2IDHash(pw string) (string, error) {
 	salt := make([]byte, argonSaltLen)
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
@@ -27,11 +28,10 @@ func argon2idHash(pw string) (string, error) {
 	key := argon2.IDKey([]byte(pw), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
 	return fmt.Sprintf("$argon2id$v=19$m=%d,t=%d,p=%d$%s$%s",
 		argonMemory, argonTime, argonThreads,
-		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(salt), base64.RawStdEncoding.EncodeToString(key)), nil
-		base64.RawStdEncoding.EncodeToString(key)), nil
 }
 
-func checkPassword(hash, pw string) bool {
+func CheckPassword(hash, pw string) bool {
 	parts := strings.Split(hash, "$")
 	if len(parts) != 6 || parts[1] != "argon2id" {
 		return false

internal/store/store.go

@@ -0,0 +1,570 @@
+// Package store provides the SQLite persistence layer for palette: schema
+// migrations, the Store type and all queries, and the background sweeper.
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+// SlugReservationDays is the default custom-URL reservation window (admin-tunable via settings, #40).
+const SlugReservationDays = 30
+
+// SoftDeleteGraceDays is how long soft-deleted pastes linger before hard delete.
+const SoftDeleteGraceDays = 7
+
+type Paste struct {
+	ID          string  `json:"id"`
+	CustomSlug  *string `json:"custom_slug,omitempty"`
+	Content     string  `json:"content"`
+	ContentType string  `json:"content_type"`
+	Language    *string `json:"language,omitempty"`
+	Title       *string `json:"title,omitempty"`
+	Password    *string `json:"password,omitempty"`
+	ExpiresIn   *string `json:"expires_in,omitempty"`
+	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
+	BurnAfterReads *int `json:"burn_after_reads,omitempty"` // #49: readable N times (default 1)
+	Visibility  string  `json:"visibility"`
+	// #83: accept "public": true/false as an alias for visibility.
+	Public *bool `json:"public,omitempty"`
+	CanID       *string `json:"can_id,omitempty"`
+	CreatedAt   int64   `json:"created_at"`
+	DeletedAt   *int64  `json:"deleted_at,omitempty"`
+	ExpiresAt   *int64  `json:"expires_at,omitempty"`
+	ViewerID    string  `json:"-"` // set from vwr cookie server-side (#37)
+	readsLimit  *int64  // #49: resolved read budget, not serialized
+	ViewCount   int     `json:"view_count"`
+	DeletionToken string `json:"-"`
+}
+
+type PasteRow struct {
+	ID            string
+	CustomSlug    sql.NullString
+	Content       string
+	ContentType   string
+	Language      sql.NullString
+	Title         sql.NullString
+	PasswordHash  sql.NullString
+	ExpiresAt     sql.NullInt64
+	BurnAfterRead bool
+	ReadsLimit    sql.NullInt64
+	ReadsUsed     int
+	Visibility    string
+	CanID         sql.NullString
+	CreatedAt     int64
+	DeletedAt     sql.NullInt64
+	ViewCount     int
+	Size          int
+	DeletionToken sql.NullString
+	ViewerID      sql.NullString
+	IsCan         bool // set on list rows that are cans (#4)
+}
+
+type CanRow struct {
+	ID           string
+	Title        sql.NullString
+	Visibility   string
+	PasswordHash sql.NullString
+	CreatedAt    int64
+	DeletedAt    sql.NullInt64
+	ExpiresAt    sql.NullInt64
+	Description  sql.NullString
+	ViewerID     sql.NullString
+}
+
+type Store struct {
+	db *sql.DB
+}
+
+func OpenStore(path string) (*Store, error) {
+	db, err := sql.Open("sqlite", path+"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)")
+	if err != nil {
+		return nil, err
+	}
+	// #58: a single write connection. SQLite allows only one writer at a
+	// time; with multiple pooled connections concurrent writes surface as
+	// SQLITE_BUSY errors ("database is locked") instead of serializing, and
+	// the burn-after-read race tests saw spurious 500s under parallel reads.
+	db.SetMaxOpenConns(1)
+	s := &Store{db: db}
+	if err := s.migrate(); err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+func (s *Store) migrate() error {
+	_, err := s.db.Exec(`
+	CREATE TABLE IF NOT EXISTS pastes (
+		id            TEXT PRIMARY KEY,
+		custom_slug   TEXT UNIQUE,
+		content       TEXT NOT NULL,
+		content_type  TEXT NOT NULL DEFAULT 'text/plain',
+		language      TEXT,
+		title         TEXT,
+		password_hash TEXT,
+		expires_at    INTEGER,
+		burn_after_read INTEGER DEFAULT 0,
+		visibility    TEXT NOT NULL DEFAULT 'public',
+		can_id        TEXT,
+		created_at    INTEGER NOT NULL,
+		deleted_at    INTEGER,
+		view_count    INTEGER NOT NULL DEFAULT 0,
+deletion_token TEXT
+	);
+	CREATE INDEX IF NOT EXISTS idx_pastes_visibility_created ON pastes(visibility, created_at DESC);
+	CREATE INDEX IF NOT EXISTS idx_pastes_expires ON pastes(expires_at) WHERE expires_at IS NOT NULL;
+	CREATE INDEX IF NOT EXISTS idx_pastes_deleted ON pastes(deleted_at) WHERE deleted_at IS NOT NULL;
+	CREATE TABLE IF NOT EXISTS paste_cans (
+		id            TEXT PRIMARY KEY,
+		title         TEXT,
+		description   TEXT,
+		visibility    TEXT NOT NULL DEFAULT 'public',
+		password_hash TEXT,
+		created_at    INTEGER NOT NULL,
+		deleted_at    INTEGER,
+		expires_at    INTEGER
+	);
+	`)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN deletion_token TEXT`) // ignore if exists
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
+	s.db.Exec(`ALTER TABLE paste_cans ADD COLUMN viewer_id TEXT`) // ignore if exists (#4)
+	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
+		paste_id    TEXT NOT NULL,
+		viewer_id   TEXT NOT NULL,
+		last_viewed INTEGER NOT NULL,
+		PRIMARY KEY (paste_id, viewer_id)
+	)`) // #49: per-viewer read dedupe window
+	return err
+}
+
+// SlugAlphabet is the paste-id charset (no ambiguous chars).
+var SlugAlphabet = "23456789abcdefghjkmnpqrstuvwxyz"
+
+// genSlug generates a random slug of length n.
+func genSlug(n int) string {
+	b := make([]byte, n)
+	_, _ = cryptoRead(b)
+	for i := range b {
+		b[i] = SlugAlphabet[int(b[i])%len(SlugAlphabet)]
+	}
+	return string(b)
+}
+
+// validExpiry reports whether an expires_in duration is in the accepted
+// window. The UI restricts presets to 1 minute - 1 year (#48); the API must
+// enforce the same bounds, otherwise negative/zero/absurd durations create
+// pastes that are born expired (or effectively permanent).
+const (
+	minExpiry = time.Minute
+	maxExpiry = 366 * 24 * time.Hour // 1 year (+ leap day headroom)
+)
+
+func ValidExpiry(d time.Duration) bool {
+	return d >= minExpiry && d <= maxExpiry
+}
+
+func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
+	id := genSlug(6)
+	now := time.Now().Unix()
+
+	var expiresAt *int64
+	if p.ExpiresIn != nil && *p.ExpiresIn != "" {
+		d, err := time.ParseDuration(*p.ExpiresIn)
+		if err != nil {
+			return nil, fmt.Errorf("invalid expires_in: %w", err)
+		}
+		if !ValidExpiry(d) {
+			return nil, fmt.Errorf("expires_in must be between 1 minute and 1 year")
+		}
+		t := now + int64(d.Seconds())
+		expiresAt = &t
+	}
+
+	var pwHash *string
+	if p.Password != nil && *p.Password != "" {
+		h, err := Argon2IDHash(*p.Password)
+		if err != nil {
+			return nil, err
+		}
+		pwHash = &h
+	}
+
+	if p.CustomSlug != nil && *p.CustomSlug != "" {
+		slug := *p.CustomSlug
+		if err := ValidateCustomSlug(slug); err != nil {
+			return nil, err
+		}
+		taken, err := s.SlugTaken(slug)
+		if err != nil {
+			return nil, err
+		}
+		if taken {
+			return nil, ErrSlugTaken
+		}
+	}
+
+	// #49/#82: burn-after-read pastes carry a read budget (default 1 read).
+	// burn_after_reads > 0 alone implies burn mode even without burn_after_read.
+	if p.BurnAfterRead || (p.BurnAfterReads != nil && *p.BurnAfterReads > 0) {
+		limit := int64(1)
+		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
+			limit = int64(*p.BurnAfterReads)
+		}
+		p.readsLimit = &limit
+		if !p.BurnAfterRead {
+			p.BurnAfterRead = true
+		}
+	}
+
+	visibility := p.Visibility
+	// #83: "public": false -> unlisted, true -> public; overrides string field
+	if p.Public != nil {
+		if *p.Public {
+			visibility = "public"
+		} else {
+			visibility = "unlisted"
+		}
+	}
+	if visibility == "" {
+		visibility = "public"
+	}
+	if visibility != "public" && visibility != "unlisted" {
+		return nil, errors.New("visibility must be public or unlisted")
+	}
+
+	contentType := p.ContentType
+	if contentType == "" {
+		contentType = "text/plain"
+	}
+
+	var slugVal *string
+	if p.CustomSlug != nil && *p.CustomSlug != "" {
+		slugVal = p.CustomSlug
+	}
+	p.DeletionToken = genDeletionToken()
+	_, err := s.db.Exec(`INSERT INTO pastes
+		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id, reads_limit)
+		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID, p.readsLimit)
+	if err != nil {
+		return nil, err
+	}
+	p.ID = id
+	p.CreatedAt = now
+	p.ExpiresAt = expiresAt
+	p.Visibility = visibility
+	return p, nil
+}
+
+func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
+	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id, reads_limit, COALESCE(reads_used, 0)
+		FROM pastes WHERE (id = ? OR custom_slug = ?) AND deleted_at IS NULL`, idOrSlug, idOrSlug)
+	var r PasteRow
+	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID, &r.ReadsLimit, &r.ReadsUsed)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	return &r, err
+}
+
+// ListPublic backs /api/public and the public listing page. Visibility rules
+// mirror the history page: only non-deleted, non-expired, non-can pastes are
+// listed, and password-protected pastes are excluded at the query level
+// (#65) so their metadata (title, slug, existence) never leaks.
+func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content), 0
+		FROM pastes
+		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		UNION ALL
+		SELECT id, NULL, 'text/plain', NULL, title, visibility, created_at, 0, 0, 1
+		FROM paste_cans
+		WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), time.Now().Unix(), limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		var cs, lang, title sql.NullString
+		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
+			return nil, 0, err
+		}
+		r.CustomSlug = cs
+		r.Language = lang
+		r.Title = title
+		r.IsCan = isCan == 1
+		out = append(out, r)
+	}
+	var total int
+	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?))
+		+ (SELECT COUNT(*) FROM paste_cans WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
+		time.Now().Unix(), time.Now().Unix()).Scan(&total)
+	return out, total, nil
+}
+
+// ListMine lists pastes created from the given viewer id (browser cookie), newest first.
+func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content), 0
+		FROM pastes
+		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		UNION ALL
+		SELECT id, NULL, NULL, title, visibility, created_at, 0, 0, 1
+		FROM paste_cans
+		WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), viewerID, time.Now().Unix(), limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		var cs, lang, title sql.NullString
+		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
+			return nil, 0, err
+		}
+		r.CustomSlug, r.Language, r.Title = cs, lang, title
+		r.IsCan = isCan == 1
+		out = append(out, r)
+	}
+	var total int
+	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?))
+		+ (SELECT COUNT(*) FROM paste_cans WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
+		viewerID, time.Now().Unix(), viewerID, time.Now().Unix()).Scan(&total)
+	return out, total, nil
+}
+
+// MineOwner returns the stored viewer_id for a paste, or "" if none.
+func (s *Store) MineOwner(id string) (string, error) {
+	var vid sql.NullString
+	err := s.db.QueryRow(`SELECT viewer_id FROM pastes WHERE id = ? AND deleted_at IS NULL`, id).Scan(&vid)
+	if err == sql.ErrNoRows {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if !vid.Valid {
+		return "", nil
+	}
+	return vid.String, nil
+}
+
+// SoftDelete marks a paste deleted (burned) atomically (#58): the deleted_at
+// IS NULL guard means only the first caller flips the row. Returns true when
+// this call performed the delete (RowsAffected > 0), false when the paste was
+// already deleted - callers use this to decide read admission atomically.
+func (s *Store) SoftDelete(id string) (bool, error) {
+	res, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
+}
+
+// IncrementViews counts one view. With a viewerID (#95): views are deduped
+// per-viewer within burnViewerWindow minutes using the paste_views table,
+// namespaced with a "views/" viewer prefix so these rows never collide with
+// RegisterRead's burn-after-read dedupe rows (which key on the raw viewer id).
+// Raw views always count (#49 decision) — call with viewerID="" for those.
+// Returns true when the view was counted.
+func (s *Store) IncrementViews(id, viewerID string, burnWindowMinutes int) bool {
+	if viewerID == "" {
+		s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
+		return true
+	}
+	now := TimeNow().Unix()
+	vkey := "views/" + viewerID
+	var last sql.NullInt64
+	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
+		id, vkey).Scan(&last)
+	if last.Valid && now-last.Int64 < int64(burnWindowMinutes)*60 {
+		return false
+	}
+	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
+		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
+		id, vkey, now)
+	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
+	return true
+}
+
+// SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
+func (s *Store) SweepExpired() {
+	now := time.Now().Unix()
+	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
+	// #4: cans expire too — mirror paste behavior
+	s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
+	grace := now - SoftDeleteGraceDays*86400
+	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
+}
+
+// ReleaseCustomSlugs frees custom URLs so they can be reused:
+//   - pastes whose expires_at has passed (expired or soft-deleted/expired),
+//   - pastes created more than reservationDays days ago (custom URLs are a
+//     reservation, not permanent).
+//
+// It returns the number of pastes whose custom_slug was released.
+func (s *Store) ReleaseCustomSlugs(reservationDays int) (int64, error) {
+	now := time.Now().Unix()
+	res, err := s.db.Exec(`UPDATE pastes SET custom_slug = NULL
+		WHERE custom_slug IS NOT NULL
+		  AND (expires_at IS NOT NULL AND expires_at > 0 AND expires_at < ?
+		   OR created_at < ?)`,
+		now, now-int64(reservationDays)*86400)
+	if err != nil {
+		return 0, err
+	}
+	n, _ := res.RowsAffected()
+	if n > 0 {
+		log.Printf("released %d custom slug(s)", n)
+	}
+	return n, nil
+}
+
+func (s *Store) StartSweeper(every time.Duration, reservationDays int) {
+	go func() {
+		t := time.NewTicker(every)
+		for range t.C {
+			s.SweepExpired()
+			s.ReleaseCustomSlugs(reservationDays)
+		}
+	}()
+}
+
+func boolToInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func NullStrPtr(ns sql.NullString) *string {
+	if ns.Valid {
+		return &ns.String
+	}
+	return nil
+}
+
+// HardDelete removes a paste row entirely (deletion-token redeem).
+func (s *Store) HardDelete(id string) {
+	s.db.Exec(`DELETE FROM pastes WHERE id = ?`, id)
+}
+
+// CreateCan inserts a paste_can row with optional custom slug (parity with
+// pastes: validated by the same rules, checked against both tables).
+// Returns ErrSlugTaken / ErrInvalidSlug / ErrReservedSlug on conflict.
+func (s *Store) CreateCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64, customSlug *string) error {
+	if customSlug != nil && *customSlug != "" {
+		slug := *customSlug
+		if err := ValidateCustomSlug(slug); err != nil {
+			return err
+		}
+		taken, err := s.SlugTaken(slug)
+		if err != nil {
+			return err
+		}
+		if taken {
+			return ErrSlugTaken
+		}
+		canID = slug
+	}
+	if visibility == "" {
+		visibility = "public"
+	}
+	if visibility != "public" && visibility != "unlisted" {
+		return errors.New("visibility must be public or unlisted")
+	}
+	_, err := s.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
+		VALUES (?,?,?,?,?,?,?)`, canID, title, description, visibility, pwHash, createdAt, expiresAt)
+	return err
+}
+
+// SoftDeleteCan marks a can deleted (its items stay; they are unlisted and
+// hidden from listings by can_id and disappear with the can's page).
+func (s *Store) SoftDeleteCan(canID string) (bool, error) {
+	res, err := s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), canID)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
+}
+
+// DeleteCan removes an (empty/aborted) can row.
+func (s *Store) DeleteCan(canID string) {
+	s.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
+}
+
+// InsertCanItem adds an item paste belonging to a can.
+func (s *Store) InsertCanItem(canID, title, content, contentType string, language *string, expiresAt, binary *string, now int64) error {
+	// language/expiresAt unused here for now; content stored as text (binary-safe in sqlite)
+	_, err := s.db.Exec(`INSERT INTO pastes
+		(id, content, content_type, language, title, visibility, can_id, created_at)
+		VALUES (?,?,?,?,?,?,?,?)`,
+		genSlug(6), content, contentType, language, &title, "unlisted", canID, now)
+	_ = expiresAt
+	_ = binary
+	return err
+}
+
+func (s *Store) GetCan(id string) (*CanRow, error) {
+	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at, description, viewer_id
+		FROM paste_cans WHERE (id = ?) AND deleted_at IS NULL`, id)
+	var c CanRow
+	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt, &c.Description, &c.ViewerID)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	return &c, err
+}
+
+func (s *Store) ListCanItems(canID string) ([]PasteRow, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count
+		FROM pastes WHERE can_id = ? AND deleted_at IS NULL ORDER BY created_at ASC`, canID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		if err := rows.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount); err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, nil
+}
+
+// GenSlug is the exported slug generator.
+func GenSlug(n int) string { return genSlug(n) }
+
+// Exec runs a raw statement (test helper).
+func (s *Store) Exec(query string, args ...any) (int64, error) {
+	res, err := s.db.Exec(query, args...)
+	if err != nil {
+		return 0, err
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
+// QueryInt runs a query returning a single integer (test helper).
+func (s *Store) QueryInt(query string, args ...any) int {
+	var n int
+	s.db.QueryRow(query, args...).Scan(&n)
+	return n
+}

internal/web/securityheaders_test.go

@@ -0,0 +1,46 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// #59: SecurityHeaders must add the CSP and hardening headers to rendered
+// HTML responses only; JSON and /raw responses pass through untouched.
+func TestSecurityHeaders(t *testing.T) {
+	pages := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Write([]byte("<html><body>ok</body></html>"))
+	})
+	h := SecurityHeaders(pages)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
+		t.Errorf("CSP = %q, want %q", got, wantCSP)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
+		t.Errorf("Referrer-Policy = %q, want no-referrer", got)
+	}
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+
+	// JSON/raw responses: headers are now set unconditionally BEFORE the handler
+	// runs. The previous post-handler approach was silently dropped once a page
+	// handler flushed its template output (headers must be set before WriteHeader).
+	// CSP/nosniff/referrer on non-HTML bodies is harmless and desirable.
+	jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	rec = httptest.NewRecorder()
+	jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
+		t.Errorf("CSP missing on JSON response: got %q", got)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
+		t.Errorf("Referrer-Policy missing on JSON response: got %q", got)
+	}
+}

internal/web/static/app.css

@@ -143,7 +143,7 @@ body {
 /* paste view */
 .meta-bar { display: flex; align-items: center; gap: 12px; padding: 12px 18px; flex-wrap: wrap; }
 .meta-bar h1 { font-size: 29.2px; font-weight: 600; }
-.slug { font-family: var(--font-mono); font-size: 21.6px; color: var(--muted-fg); background: var(--surface-2); padding: 3px 9px; border-radius: var(--radius); }
+.slug { font-family: var(--font-mono); font-size: 21.6px; color: var(--muted-fg); background: var(--surface-2); padding: 3px 9px; border-radius: var(--radius-sm); }
 .tag { font-size: 19.8px; color: var(--muted-fg); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 2px 9px; }
 .paste-title-bar { display: flex; align-items: center; gap: 12px; padding: 12px 18px; flex-wrap: wrap; }
 .paste-title-bar h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
@@ -165,6 +165,20 @@ body {
 .settings-head { padding: 12px 18px; border-bottom: 1px solid var(--border); }
 .settings-head h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
 .settings-body { padding: 16px 18px; color: var(--muted-fg); font-size: 21.6px; }
+.settings-section-title { color: var(--fg); font-size: 24px; margin-bottom: 6px; }
+/* theme switcher cards (#100) */
+.theme-grid { display: flex; flex-wrap: wrap; gap: 14px; margin-top: 14px; }
+.theme-card {
+  display: flex; flex-direction: column; gap: 10px; align-items: flex-start;
+  padding: 14px 16px; min-width: 180px;
+  background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius);
+  color: var(--fg); font: inherit; font-size: 20px; cursor: pointer;
+}
+.theme-card:hover { border-color: var(--muted); }
+.theme-card[aria-pressed="true"] { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
+.theme-card .swatches { display: flex; gap: 4px; }
+.theme-card .swatch { width: 26px; height: 26px; border-radius: 6px; border: 1px solid rgba(255,255,255,.15); }
+.theme-name { font-weight: 600; }
 .iconbtn:hover { color: var(--fg); border-color: var(--muted); }
 .iconbtn.danger:hover { color: #ff8fa3; border-color: #ff8fa3; }
 .code-head {
@@ -201,7 +215,8 @@ th {
   text-align: left; font-size: 18.9px; text-transform: uppercase; letter-spacing: .08em;
   color: var(--muted-fg); padding: 10px 16px; border-bottom: 1px solid var(--border); font-weight: 600;
 }
-td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: clip; text-overflow: ellipsis; white-space: nowrap; }
+td:has(> a.slug), td:has(> .slug) { overflow: visible; }
 tr:last-child td { border-bottom: none; }
 tr.row { cursor: pointer; }
 tr.row:hover td { background: var(--surface-2); }
@@ -281,6 +296,13 @@ td a.slug:hover { color: var(--accent); }
 .toast.success { border-color: var(--ok); color: var(--ok); }
 .toast.error { border-color: var(--err); color: var(--err); }
 
+/* result box color-coding (#105): colored left border + text tint per status */
+.result-ok, .result-err, .result-warn { border-left: 4px solid transparent; padding-left: 10px; }
+.result-ok { border-left-color: var(--ok); color: var(--ok); }
+.result-err { border-left-color: var(--err); color: var(--err); }
+.result-warn { border-left-color: var(--warn); color: var(--warn); }
+.result-ok a { color: var(--ok); }
+
 /* protection section rhythm (#20) */
 .protect { display: flex; flex-direction: column; gap: 2px; }
 .protect .pw-row { padding: 2px 8px 4px; }
@@ -333,17 +355,29 @@ td a.slug:hover { color: var(--accent); }
 /* paste name under slug pill in Paste column (#43) */
 .paste-sub { font-size: 19.8px; color: var(--muted-fg); margin-top: 2px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .paste-sub.dim { color: var(--muted); }
-td .url-link { font-size: 19.8px; }
+td a.slug.url-link { max-width: 100%; display: inline-block; vertical-align: middle; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; box-sizing: border-box; }
 td .id-link { color: var(--muted-fg); text-decoration: none; font-family: var(--font-mono); font-size: 19.8px; }
 td .id-link:hover { color: var(--accent); }
 
 /* sortable column headers (#42) */
 th.sortable { cursor: pointer; user-select: none; }
 th.sortable:hover { color: var(--fg); }
-.sort-ind { display: inline-block; width: 0; height: 0; margin-left: 6px; vertical-align: middle; border-left: 5px solid transparent; border-right: 5px solid transparent; }
+th.sortable { cursor: pointer; user-select: none; white-space: nowrap; }
+/* #101: arrow sits LEFT of the label, further spaced, vertically centered,
+   and absolutely positioned so it never shifts the label text. */
+th.sortable { position: relative; padding-left: 24px; }
+th.sortable .sort-ind {
+  position: absolute; left: 8px; top: 50%; transform: translateY(-50%);
+  display: inline-block; width: 0; height: 0;
+  border-left: 5px solid transparent; border-right: 5px solid transparent;
+}
 th.sorted.asc .sort-ind { border-bottom: 6px solid var(--accent); }
 th.sorted.desc .sort-ind { border-top: 6px solid var(--accent); }
 
+/* #102: small unobtrusive admin link on the settings page */
+a.admin-link { color: var(--muted-fg); font-size: 15px; text-decoration: none; }
+a.admin-link:hover { color: var(--fg); text-decoration: underline; }
+
 /* ============================================================
    Consistency audit (#18) — shared tokens across inputs, buttons,
    headings. Visual-only, no behavior change.
@@ -456,3 +490,16 @@ th.sorted.desc .sort-ind { border-top: 6px solid var(--accent); }
   .unlock-err { font-size: 13px; }
   .center .foot { font-size: 13px; }
 }
+
+/* #4: can view page + can builder */
+.can-page h1 { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.can-items { display: flex; flex-direction: column; gap: 12px; margin-top: 14px; }
+.can-item { padding: 12px 14px; }
+.can-item-head { display: flex; align-items: center; gap: 10px; }
+.can-item-head strong { flex: 1; word-break: break-all; }
+.can-item-body { margin-top: 8px; }
+.can-item-body summary { cursor: pointer; font-size: 19px; color: var(--muted, #888); }
+.can-item-body pre.code { margin: 8px 0 0; overflow-x: auto; }
+.can-item-row { margin-top: 8px; }
+.can-item-row .can-item-title { width: 100%; margin-bottom: 6px; }
+.can-item-row .can-item-content { width: 100%; font-family: var(--mono, monospace); resize: vertical; }

internal/web/static/table.js

@@ -44,7 +44,8 @@ const PaletteTable = (() => {
     function matches(it) {
       if (!state.filter) return true;
       const f = state.filter.toLowerCase();
-      return (it.title || '').toLowerCase().includes(f) || (it.id || '').toLowerCase().includes(f);
+      return (it.title || '').toLowerCase().includes(f) || (it.id || '').toLowerCase().includes(f) ||
+        (it.custom_slug || '').toLowerCase().includes(f);
     }
 
     function renderSortIndicators() {
@@ -62,7 +63,7 @@ const PaletteTable = (() => {
         const filtered = state.filter.length > 0;
         const off = (state.page - 1) * opts.perPage;
         const url = (filtered || state.sortKey)
-          ? opts.endpoint + '?limit=500&offset=0'
+          ? opts.endpoint + '?limit=' + (opts.fetchLimit || 100) + '&offset=0'
           : opts.endpoint + '?limit=' + opts.perPage + '&offset=' + off;
         const res = await fetch(url);
         const data = await res.json();

internal/web/templates/admin.html

@@ -0,0 +1,111 @@
+{{template "head" .}}
+{{template "topbar" .}}
+<div class="page">
+  <div class="float">
+    <div class="settings-head">
+      <h1>Admin</h1>
+    </div>
+    <div class="settings-body">
+      <p>Enter the admin key to manage server settings. The key is kept in
+      sessionStorage for this tab only and is sent as a request header — it is
+      never stored in a cookie, so it will not accompany normal paste requests.</p>
+      <form id="admin-key-form">
+        <label for="admin-key">Admin key</label><br>
+        <input type="password" id="admin-key" autocomplete="off" style="width:100%">
+        <button type="submit">Unlock</button>
+        <span id="admin-key-status"></span>
+      </form>
+      <div id="admin-panel" style="display:none">
+        <h2>Settings</h2>
+        <form id="admin-settings-form">
+          <table>
+            <tr><td>Rate-limit burst</td><td><input type="number" id="rl-burst" min="1" step="1"></td></tr>
+            <tr><td>Rate-limit refill per minute</td><td><input type="number" id="rl-refill" min="0.1" step="0.1"></td></tr>
+            <tr><td>Max content bytes</td><td><input type="number" id="max-content" min="1" step="1"></td></tr>
+            <tr><td>Default expiry</td><td><input type="text" id="default-expiry" placeholder="e.g. 168h, 30m, 0 = never"></td></tr>
+            <tr><td>Custom URL reservation days</td><td><input type="number" id="slug-days" min="1" step="1"></td></tr>
+            <tr><td>Burn viewer window (minutes)</td><td><input type="number" id="burn-window" min="1" step="1"></td></tr>
+          </table>
+          <button type="submit">Save</button>
+          <span id="admin-save-status"></span>
+        </form>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+(function () {
+  var KEY = 'palette_admin_key';
+  var keyInput = document.getElementById('admin-key');
+  var status = document.getElementById('admin-key-status');
+  var panel = document.getElementById('admin-panel');
+
+  function key() { return sessionStorage.getItem(KEY) || ''; }
+
+  function api(path, opts) {
+    opts = opts || {};
+    // allow callers to override the key header (e.g. validating a typed key, #99)
+    opts.headers = Object.assign({ 'X-Admin-Key': key() }, opts.headers || {});
+    if (opts.body) opts.headers['Content-Type'] = 'application/json';
+    return fetch(path, opts);
+  }
+
+  function loadSettings() {
+    api('/admin/api/settings').then(function (r) {
+      if (r.status !== 200) { showLock(); return; }
+      return r.json();
+    }).then(function (s) {
+      if (!s) return;
+      document.getElementById('rl-burst').value = s.rate_limit_burst;
+      document.getElementById('rl-refill').value = s.rate_limit_per_minute;
+      document.getElementById('max-content').value = s.max_content_bytes;
+      document.getElementById('default-expiry').value = s.default_expiry;
+      document.getElementById('slug-days').value = s.custom_slug_reservation_days;
+      document.getElementById('burn-window').value = s.burn_viewer_window_minutes;
+      panel.style.display = '';
+    });
+  }
+
+  function showLock() {
+    panel.style.display = 'none';
+    sessionStorage.removeItem(KEY);
+  }
+
+  document.getElementById('admin-key-form').addEventListener('submit', function (e) {
+    e.preventDefault();
+    // #99: don't persist the key until the server accepts it
+    api('/admin/api/settings', { headers: { 'X-Admin-Key': keyInput.value } }).then(function (r) {
+      if (r.status === 200) {
+        sessionStorage.setItem(KEY, keyInput.value);
+        status.textContent = '✓';
+        keyInput.value = '';
+        loadSettings();
+      } else {
+        status.textContent = 'invalid key';
+        showLock();
+      }
+    });
+  });
+
+  document.getElementById('admin-settings-form').addEventListener('submit', function (e) {
+    e.preventDefault();
+    var body = {
+      rate_limit_burst: parseFloat(document.getElementById('rl-burst').value),
+      rate_limit_per_minute: parseFloat(document.getElementById('rl-refill').value),
+      max_content_bytes: parseInt(document.getElementById('max-content').value, 10),
+      default_expiry: document.getElementById('default-expiry').value,
+      custom_slug_reservation_days: parseInt(document.getElementById('slug-days').value, 10),
+      burn_viewer_window_minutes: parseInt(document.getElementById('burn-window').value, 10)
+    };
+    api('/admin/api/settings', { method: 'POST', body: JSON.stringify(body) }).then(function (r) {
+      document.getElementById('admin-save-status').textContent = r.status === 200 ? 'saved' : 'error';
+      if (r.status !== 200) showLock();
+    });
+  });
+
+  // #112: always show the lock on fresh load — do not auto-restore the
+  // panel from a stale sessionStorage key. The key is only written after a
+  // successful unlock (above) so in-page actions still work within this visit.
+})();
+</script>
+{{template "foot" .}}

internal/web/templates/can.html

@@ -0,0 +1,36 @@
+{{template "head" .}}
+{{template "topbar" .}}
+<div class="center">
+  <div class="float can-page" style="max-width:900px; width:100%;">
+    <div class="inner">
+      <h1>{{.Title}} <span class="badge" title="This is a can — a bundle of pastes">can</span></h1>
+      {{if .HasDescription}}<p class="sub">{{.Description}}</p>{{end}}
+      <p class="hint">{{.ItemCount}} item{{if ne .ItemCount 1}}s{{end}} · {{.SizeHuman}} · created <span data-ts="{{.CreatedAtUnix}}">{{.CreatedAgo}}</span>{{if .ExpiresAt}} · expires in {{.ExpiresIn}}{{end}}{{if .HasPassword}} · password protected{{end}}</p>
+
+      <div class="can-items">
+        {{range .Items}}
+        <div class="can-item float">
+          <div class="can-item-head">
+            <strong>{{.Title}}</strong>
+            <span class="dim">{{.Size}}</span>
+            {{if .IsFile}}
+              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" download="{{.Title}}" title="Download file" aria-label="Download {{.Title}}">↓</a>
+            {{else}}
+              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" title="Raw item" aria-label="Raw {{.Title}}">⧉</a>
+            {{end}}
+          </div>
+          {{if not .IsFile}}
+          <details class="can-item-body">
+            <summary>Show content</summary>
+            <pre class="code"><code>{{.ContentHTML}}</code></pre>
+          </details>
+          {{else}}
+          <div class="hint">Attached file — use the download button above.</div>
+          {{end}}
+        </div>
+        {{end}}
+      </div>
+    </div>
+  </div>
+</div>
+{{template "foot" .}}

internal/web/templates/history.html

@@ -36,8 +36,8 @@ const t = PaletteTable.init({
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}`
+      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim">${it.view_count}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/layout.html

@@ -3,9 +3,10 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <link rel="stylesheet" href="/static/app.css">
 <script>
-// preset preview hook (#16): ?theme=<name> sets data-preset for screenshots only
+// preset hook (#16): ?theme= wins; else persisted choice (#100)
 (function () {
   var t = new URLSearchParams(location.search).get('theme');
+  if (!t) try { t = localStorage.getItem('palette-theme'); } catch (e) {}
   if (t) document.documentElement.dataset.preset = t;
 })();
 </script>
@@ -13,7 +14,7 @@
 
 {{define "topbar"}}
   <div class="topbar">
-    <a class="logo" href="/history">Palette <em>/ beta</em></a>
+    <a class="logo" href="/history">Palette <em>/ {{ version }}</em></a>
     <nav>
       <a href="/new" {{if eq .Page "new"}}class="on"{{end}}>New</a>
       <a href="/history" {{if eq .Page "history"}}class="on"{{end}}>Public</a>

internal/web/templates/mine.html

@@ -21,6 +21,10 @@
     </table>
     <div class="empty" id="empty" style="display:none">No pastes from this browser yet.</div>
   </div>
+  <div class="pager float">
+    <span id="showing"></span>
+    <div class="pg" id="pg"></div>
+  </div>
 </div>
 <script src="/static/table.js"></script>
 <script>
@@ -38,13 +42,13 @@ function toast(msg, kind) {
 
 const t = PaletteTable.init({
   endpoint: '/api/mine',
-  perPage: 50,
+  perPage: 25,
-  hasPager: false,
+  hasPager: true,
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}`
+      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/new.html

@@ -39,6 +39,18 @@
         <label><input type="radio" name="exp" value="24h"> 1 day</label>
         <label><input type="radio" name="exp" value="168h" checked> 1 week</label>
         <label><input type="radio" name="exp" value="720h"> 30 days</label>
+        <label><input type="radio" name="exp" value="custom"> Custom</label>
+      </div>
+      <div class="pw-row" id="customexp-row" style="display:none">
+        <input type="number" id="expnum" min="1" style="width:80px" placeholder="90"> 
+        <select id="expunit">
+          <option value="m">minutes</option>
+          <option value="h" selected>hours</option>
+          <option value="d">days</option>
+          <option value="w">weeks</option>
+          <option value="mo">months</option>
+        </select>
+        <div class="hint" id="customexp-err" style="display:none; color:var(--danger, #c0392b); margin-top:6px;"></div>
       </div>
     </div>
     <div class="float side-section">
@@ -47,6 +59,7 @@
         <label class="toggle"><input type="checkbox" id="haspw"> Password lock</label>
         <div class="pw-row" id="pwrow" style="display:none"><div class="pw-field"><input type="password" id="password" placeholder="Password" autocomplete="new-password"><button type="button" class="reveal" id="pwreveal" title="Show password" tabindex="-1"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M1 12s4-7 11-7 11 7 11 7-4 7-11 7-11-7-11-7z"/><circle cx="12" cy="12" r="3"/><line class="eye-slash" x1="4" y1="4" x2="20" y2="20"/></svg></button></div></div>
         <label class="toggle"><input type="checkbox" id="burn"> Burn after read</label>
+        <div class="pw-row" id="burnrow" style="display:none"><label class="hint" style="font-size:19px;">Readable <input type="number" id="burnreads" min="1" value="1" style="width:64px"> times</label></div>
         <label class="toggle"><input type="checkbox" id="unlisted"> Unlisted</label>
       </div>
     </div>
@@ -55,6 +68,15 @@
       <input type="text" id="custom" class="custom-input" placeholder="/my-snippet">
       <div class="hint" style="margin-top:6px; font-size:19px;">Stays reserved while the paste exists</div>
     </div>
+    <div class="float side-section">
+      <h3>Can contents</h3>
+      <label class="toggle"><input type="checkbox" id="iscan"> Bundle as a can (multiple text items)</label>
+      <div class="pw-row" id="canrow" style="display:none">
+        <div id="can-items"></div>
+        <button class="btn btn-icon" id="can-add" type="button" title="Add item" style="margin-top:6px">+ Add item</button>
+        <div class="hint" style="margin-top:6px; font-size:19px;">Each item gets its own card on the can page. File uploads in cans come later.</div>
+      </div>
+    </div>
     <div class="float side-section" id="result-card" style="display:none">
       <h3>Result</h3>
       <div class="hint" id="result" style="word-break:break-all">empty</div>
@@ -86,6 +108,44 @@ function toast(msg, kind) {
   t._h = setTimeout(() => t.classList.remove('show'), 2000);
 }
 $('haspw').addEventListener('change', e => { $('pwrow').style.display = e.target.checked ? 'block' : 'none'; });
+$('burn').addEventListener('change', e => { $('burnrow').style.display = e.target.checked ? 'block' : 'none'; });
+document.querySelectorAll('input[name="exp"]').forEach(r => r.addEventListener('change', () => {
+  $('customexp-row').style.display = document.querySelector('input[name="exp"]:checked').value === 'custom' ? 'block' : 'none';
+  $('customexp-err').style.display = 'none';
+}));
+
+// compose the expires_in Go-duration string when Custom is checked (#48).
+// Returns the string, or null with an inline error shown.
+function composeCustomExpiry() {
+  const n = parseInt($('expnum').value, 10);
+  const unit = $('expunit').value;
+  let mins = NaN;
+  if (n > 0) {
+    if (unit === 'm') mins = n;
+    else if (unit === 'h') mins = n * 60;
+    else if (unit === 'd') mins = n * 1440;
+    else if (unit === 'w') mins = n * 10080;
+    else if (unit === 'mo') mins = n * 43200; // months counted as 30 days
+  }
+  const err = $('customexp-err');
+  if (!(mins >= 1)) {
+    err.textContent = 'Enter a duration of at least 1 minute.';
+    err.style.display = 'block';
+    return null;
+  }
+  if (mins > 525600) { // more than 1 year
+    err.textContent = 'Custom expiry cannot exceed 1 year.';
+    err.style.display = 'block';
+    return null;
+  }
+  err.style.display = 'none';
+  // compose as h (+d/m remainders); Go parses '336h', '90m', '6h30m' fine
+  const hours = Math.floor(mins / 60), rem = mins % 60;
+  if (rem === 0) return hours + 'h';
+  if (hours === 0) return rem + 'm';
+  return hours + 'h' + rem + 'm';
+}
+
 $('pwreveal').addEventListener('click', () => {
   const pw = $('password');
   const show = pw.type === 'password';
@@ -94,12 +154,54 @@ $('pwreveal').addEventListener('click', () => {
   $('pwreveal').title = show ? 'Hide password' : 'Show password';
 });
 
+// #4: can builder — multiple text items bundled into one shareable page.
+// The main editor becomes the first item; extra items are added below.
+$('iscan').addEventListener('change', e => {
+  $('canrow').style.display = e.target.checked ? 'block' : 'none';
+  if (e.target.checked && !$('can-items').children.length) addCanItem();
+});
+function addCanItem() {
+  const row = document.createElement('div');
+  row.className = 'can-item-row';
+  row.innerHTML = '<input class="can-item-title" placeholder="Item title">' +
+    '<textarea class="can-item-content" placeholder="Item content" rows="3" spellcheck="false"></textarea>';
+  $('can-items').appendChild(row);
+}
+$('can-add').addEventListener('click', addCanItem);
+
 let guessed = ''; // last auto-detected language, '' = user override
 
-function showResult(html, isError) {
+// #105: map backend machine-readable error codes to plain-language guidance.
+// Unknown codes fall back to a generic message; the technical detail stays
+// in the API response for API consumers.
+const ERROR_MESSAGES = {
+  slug_taken: 'That Custom URL is already taken. Try another.',
+  slug_reserved: 'That Custom URL is reserved. Try another.',
+  slug_invalid: 'Please keep the Custom URL under 64 characters, using only letters, numbers, dashes, or underscores.',
+  content_empty: 'Write or paste something first.',
+  content_too_large: 'This paste is too large. The limit is 5 MB.',
+  expiry_invalid: 'Please pick an expiry between 1 minute and 1 year.',
+  rate_limited: 'Too many tries. Wait a minute and try again.',
+};
+const GENERIC_ERROR = 'Something went wrong. Please try again.';
+
+function friendlyError(data) {
+  return ERROR_MESSAGES[data && data.code] || GENERIC_ERROR;
+}
+
+// #105: color the result box by outcome — success (ok), error (err),
+// warning (warn) — with a colored left border (CSS .result-ok/.result-err).
+function setResultKind(kind) {
+  const card = $('result-card');
+  card.classList.remove('result-ok', 'result-err', 'result-warn');
+  if (kind) card.classList.add('result-' + kind);
+}
+
+function showResult(html, kind) {
   $('result').innerHTML = html;
-  $('result').dataset.token = isError ? '' : ($('result').dataset.token || '');
+  $('result').dataset.token = kind === 'ok' ? ($('result').dataset.token || '') : ($('result').dataset.token || '');
   $('result-card').style.display = 'block';
+  setResultKind(kind === 'ok' ? 'ok' : (kind === 'warn' ? 'warn' : 'err'));
 }
 function defaultFilename(lang) {
   const names = {
@@ -146,6 +248,9 @@ $('reguess').addEventListener('click', guessLang);
 content.addEventListener('paste', () => setTimeout(guessLang, 0));
 
 async function create() {
+  // #4: can mode — bundle the editor + extra items into a can via multipart
+  if ($('iscan').checked) return createCan();
+
   const body = {
     content: content.value,
     title: $('title').value || null,
@@ -153,9 +258,16 @@ async function create() {
     custom_slug: $('custom').value || null,
     burn_after_read: $('burn').checked,
   };
+  if ($('burn').checked) body.burn_after_reads = parseInt($('burnreads').value, 10) || 1;
   if ($('haspw').checked) body.password = $('password').value;
   const exp = document.querySelector('input[name="exp"]:checked').value;
-  if (exp) body.expires_in = exp;
+  if (exp === 'custom') {
+    const dur = composeCustomExpiry();
+    if (dur === null) { toast('Check the custom expiry', 'error'); return; }
+    body.expires_in = dur;
+  } else if (exp) {
+    body.expires_in = exp;
+  }
 
   const res = await fetch('/api/pastes', {
     method: 'POST',
@@ -164,12 +276,12 @@ async function create() {
   });
   const data = await res.json();
   if (!res.ok) {
-    showResult('Error: ' + (data.error || res.status), true);
+    showResult(friendlyError(data), 'err');
     toast('Create failed', 'error');
     return;
   }
   const url = location.origin + '/' + (data.custom_slug || data.id);
-  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', false);
+  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', 'ok');
   $('result').dataset.token = data.deletion_token || '';
   const copyBtn = document.getElementById('result-copy');
   copyBtn.addEventListener('click', () => {
@@ -194,6 +306,62 @@ async function create() {
   location.href = dest;
 }
 $('create').addEventListener('click', create);
+
+// #4: can creation — POST multipart to /api/pastes/can. The main editor is
+// the first item; each extra can-item row is another text item.
+async function createCan() {
+  const items = [];
+  if (content.value.trim()) {
+    items.push({title: $('title').value || 'main', content: content.value, language: $('language').value || ''});
+  }
+  document.querySelectorAll('#can-items .can-item-row').forEach(row => {
+    const t = row.querySelector('.can-item-title').value.trim();
+    const c = row.querySelector('.can-item-content').value;
+    if (c.trim()) items.push({title: t || ('item-' + (items.length + 1)), content: c});
+  });
+  if (!items.length) { toast('Nothing to put in the can', 'error'); return; }
+
+  const fd = new FormData();
+  fd.append('title', $('title').value || 'Untitled can');
+  fd.append('json_items', JSON.stringify(items));
+  if ($('haspw').checked) fd.append('password', $('password').value);
+  if ($('unlisted').checked) fd.append('visibility', 'unlisted');
+  const exp = document.querySelector('input[name="exp"]:checked').value;
+  if (exp === 'custom') {
+    const dur = composeCustomExpiry();
+    if (dur === null) { toast('Check the custom expiry', 'error'); return; }
+    if (dur) fd.append('expires_in', dur);
+  } else if (exp) {
+    fd.append('expires_in', exp);
+  }
+  if ($('custom').value.trim()) fd.append('custom_slug', $('custom').value.trim());
+
+  const res = await fetch('/api/pastes/can', {method: 'POST', body: fd});
+  const data = await res.json();
+  if (!res.ok) {
+    showResult(friendlyError(data), 'err');
+    toast('Can create failed', 'error');
+    return;
+  }
+  const url = location.origin + data.url;
+  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', 'ok');
+  const copyBtn = document.getElementById('result-copy');
+  copyBtn.addEventListener('click', () => {
+    try {
+      navigator.clipboard.writeText(url);
+      copyBtn.classList.add('ok');
+      copyBtn.textContent = 'Success!';
+      setTimeout(() => { copyBtn.classList.remove('ok'); copyBtn.textContent = '⧉'; }, 2000);
+    } catch(e) { toast('Copy failed', 'error'); }
+  });
+  // password-protected can: unlock now with the password we already have (#26 parity)
+  if ($('haspw').checked && data.id) {
+    const pd = new FormData();
+    pd.append('password', $('password').value);
+    try { await fetch('/can/' + data.id, {method: 'POST', body: pd}); } catch(e) {}
+  }
+  location.href = data.url;
+}
 // reset stale result state when returning via Back (bfcache) (#28)
 window.addEventListener('pageshow', e => {
   if (!e.persisted) return;

internal/web/templates/paste.html

@@ -25,7 +25,7 @@
           <span class="stats-k">Created</span><span class="stats-v" data-ts="{{.CreatedAtUnix}}">{{.CreatedAgo}}</span>
           {{if .ExpiresAt}}<span class="stats-k">Expires</span><span class="stats-v">in {{.ExpiresIn}}</span>{{end}}
           <span class="stats-k">Password</span><span class="stats-v">{{if .HasPassword}}protected{{else}}none{{end}}</span>
-          {{if .BurnAfterRead}}<span class="stats-k">Burn</span><span class="stats-v">burn after read</span>{{end}}
+          {{if .BurnAfterRead}}{{if .ReadsLimit}}{{with .ReadsLeftN}}<span class="stats-k">Reads left</span><span class="stats-v">{{.}} of {{$.ReadsTotal}}</span>{{end}}{{else}}<span class="stats-k">Burn</span><span class="stats-v">burn after read</span>{{end}}{{end}}
           {{if .CustomSlug}}<span class="stats-k">Custom URL</span><span class="stats-v">/{{.CustomSlug}}</span>{{end}}
           <span class="stats-k">Visibility</span><span class="stats-v">{{.Visibility}}</span>
         </div>

internal/web/templates/settings.html

@@ -0,0 +1,60 @@
+{{template "head" .}}
+{{template "topbar" .}}
+<div class="page">
+  <div class="float">
+    <div class="settings-head">
+      <h1>Settings</h1>
+    </div>
+    <div class="settings-body">
+      <h3>Theme</h3>
+      <div class="theme-grid" id="theme-grid"></div>
+      <p class="admin-link-row"><a class="admin-link" href="/admin">Admin</a></p>
+    </div>
+  </div>
+</div>
+<script>
+(function () {
+  // #112: derive each preset's swatches from the real CSS variables in
+  // app.css by temporarily applying data-preset, so they can never drift.
+  var themeNames = [
+    { id: 'midnight',        name: 'Midnight' },
+    { id: 'smooth',          name: 'Smooth' },
+    { id: 'pastel-lavender', name: 'Pastel Lavender' },
+    { id: 'pastel-peach',    name: 'Pastel Peach' },
+    { id: 'pastel-cloud',    name: 'Pastel Cloud' }
+  ];
+  var SWATCH_VARS = ['--bg', '--surface', '--surface-2', '--muted', '--accent'];
+
+  function presetColors(id) {
+    var root = document.documentElement;
+    var prev = root.getAttribute('data-preset');
+    root.setAttribute('data-preset', id);
+    var cs = getComputedStyle(root);
+    var colors = SWATCH_VARS.map(function (v) { return cs.getPropertyValue(v).trim(); });
+    if (prev === null) root.removeAttribute('data-preset'); else root.setAttribute('data-preset', prev);
+    return colors;
+  }
+
+  var grid = document.getElementById('theme-grid');
+  var current = document.documentElement.dataset.preset || 'midnight';
+  themeNames.forEach(function (t) {
+    var colors = presetColors(t.id);
+    var btn = document.createElement('button');
+    btn.type = 'button';
+    btn.className = 'theme-card';
+    btn.setAttribute('aria-pressed', current === t.id ? 'true' : 'false');
+    btn.innerHTML = '<strong>' + t.name + '</strong>' +
+      '<span class="swatches">' + colors.map(function (c) {
+        return '<span class="swatch" style="background:' + c + '"></span>';
+      }).join('') + '</span>';
+    btn.addEventListener('click', function () {
+      document.documentElement.dataset.preset = t.id;
+      try { localStorage.setItem('palette-theme', t.id); } catch (e) {}
+      grid.querySelectorAll('.theme-card').forEach(function (c) { c.setAttribute('aria-pressed', 'false'); });
+      btn.setAttribute('aria-pressed', 'true');
+    });
+    grid.appendChild(btn);
+  });
+})();
+</script>
+{{template "foot" .}}

internal/web/version.go

@@ -0,0 +1,6 @@
+package web
+
+// Version is the display version, set at build time via
+// -ldflags "-X palette/internal/web.Version=v0.2.1" (#93). Falls back to
+// "dev" for bare `go build` runs.
+var Version = "dev"

internal/web/web.go

@@ -0,0 +1,352 @@
+// Package web serves palette's HTML routes: paste pages, cans, unlock, and
+// the admin page. Templates and static assets are embedded in this package.
+package web
+
+import (
+	"crypto/hmac"
+	cryptorand "crypto/rand"
+	"crypto/sha256"
+	"embed"
+	"encoding/hex"
+	"fmt"
+	"html/template"
+	"io/fs"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	langpkg "palette/internal/lang"
+	"palette/internal/store"
+)
+
+//go:embed templates/*.html
+var tmplFS embed.FS
+
+//go:embed static
+var staticFS embed.FS
+
+type UI struct {
+	tmpl *template.Template
+}
+
+func New() (*UI, error) {
+	funcs := template.FuncMap{
+		"humanSize": humanSize,
+		"version":   func() string { return Version }, // #93: topbar version label
+	}
+	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "templates/*.html")
+	if err != nil {
+		return nil, err
+	}
+	return &UI{tmpl: t}, nil
+}
+
+func humanSize(n int) string {
+	if n < 1024 {
+		return fmt.Sprintf("%d B", n)
+	}
+	if n < 1024*1024 {
+		return fmt.Sprintf("%.1f KB", float64(n)/1024)
+	}
+	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
+}
+
+func (u *UI) StaticHandler() http.Handler {
+	sub, _ := fs.Sub(staticFS, "static")
+	return http.StripPrefix("/static/", http.FileServer(http.FS(sub)))
+}
+
+func (h *Handlers) renderPage(w http.ResponseWriter, name string, data any) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := h.UI.tmpl.ExecuteTemplate(w, name, data); err != nil {
+		http.Error(w, "template error: "+err.Error(), 500)
+	}
+}
+
+// RenderPage is the exported wrapper used by the api package (#4 can pages).
+func (h *Handlers) RenderPage(w http.ResponseWriter, name string, data any) {
+	h.renderPage(w, name, data)
+}
+
+// WriteRateLimited is the exported rate-limit response used by the api package (#4).
+func (h *Handlers) WriteRateLimited(w http.ResponseWriter, retryAfterSecs int) {
+	h.writeRateLimited(w, retryAfterSecs)
+}
+
+// UnlockToken returns the per-id HMAC unlock token (cookie value, #34).
+// Exported for the api package so can pages share paste cookie semantics (#4).
+func UnlockToken(id string) string { return unlockToken(id) }
+
+// AgoString formats a relative "N ago" string (exported for the api package, #4).
+func AgoString(ts int64) string { return agoString(ts) }
+
+// HumanSize formats a byte count as a human string (exported for the api package, #4).
+func HumanSize(n int) string { return humanSize(n) }
+
+// ExpiryString formats remaining time until an epoch seconds expiry (#4).
+func ExpiryString(expiresAt int64) string { return expiryString(expiresAt) }
+
+// #34: per-paste unlock tokens. unlockSecret is generated once at startup
+// (also derivable from PALETTE_UNLOCK_SECRET for multi-instance deploys) and
+// used to HMAC paste ids, so a client can only hold a valid pw_<id> cookie by
+// actually submitting the correct password for that paste.
+var unlockSecret = resolveUnlockSecret()
+
+func resolveUnlockSecret() []byte {
+	if v := os.Getenv("PALETTE_UNLOCK_SECRET"); v != "" {
+		return []byte(v)
+	}
+	b := make([]byte, 32)
+	if _, err := cryptorand.Read(b); err != nil {
+		log.Fatal("cannot generate unlock secret: ", err)
+	}
+	return b
+}
+
+func unlockToken(id string) string {
+	mac := hmac.New(sha256.New, unlockSecret)
+	mac.Write([]byte("unlock:" + id))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+
+func agoString(ts int64) string {
+	s := time.Now().Unix() - ts
+	switch {
+	case s < 60:
+		return fmt.Sprintf("%ds ago", s)
+	case s < 3600:
+		return fmt.Sprintf("%dm ago", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh ago", s/3600)
+	default:
+		return fmt.Sprintf("%dd ago", s/86400)
+	}
+}
+
+func expiryString(expiresAt int64) string {
+	s := expiresAt - time.Now().Unix()
+	switch {
+	case s < 3600:
+		return fmt.Sprintf("%dm", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh", s/3600)
+	default:
+		return fmt.Sprintf("%dd", s/86400)
+	}
+}
+
+// Handlers is the set of store callbacks the web pages need. The web package
+// renders HTML; all queries go through the store.
+type Handlers struct {
+	UI            *UI
+	Store         *store.Store
+	ViewerID      func(r *http.Request) string
+	BurnWindowMin func() int
+	RateLimitOK   func(id string, r *http.Request) bool // per-paste unlock limiter
+}
+
+func (h *Handlers) rateLimitUnlock(id string, r *http.Request) bool {
+	if h.RateLimitOK != nil {
+		return h.RateLimitOK(id, r)
+	}
+	return true
+}
+
+func (h *Handlers) writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
+	w.Header().Set("Retry-After", fmt.Sprintf("%d", retryAfterSecs))
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(429)
+	w.Write([]byte(`{"error":"rate limit exceeded"}`))
+}
+
+func (h *Handlers) renderPaste(w http.ResponseWriter, row *store.PasteRow, justCreated bool, deletionToken string, readsRemaining *int) {
+	lines := strings.Count(row.Content, "\n") + 1
+	gutter := ""
+	for i := 1; i <= lines; i++ {
+		gutter += fmt.Sprintf("%d\n", i)
+	}
+	expIn := ""
+	if row.ExpiresAt.Valid {
+		expIn = expiryString(row.ExpiresAt.Int64)
+	}
+	lang := row.Language.String
+	if lang == "" {
+		lang = "text"
+	}
+	summary := fmt.Sprintf("%s · %s · %d views · %s", lang, humanSize(len(row.Content)), row.ViewCount, agoString(row.CreatedAt))
+	data := map[string]any{
+		"Page":          "paste",
+		"ID":            row.ID,
+		"Title":         row.Title.String,
+		"Language":      row.Language.String,
+		"StatsSummary":  summary,
+		"SizeHuman":     humanSize(len(row.Content)),
+		"HasPassword":   row.PasswordHash.Valid,
+		"BurnAfterRead": row.BurnAfterRead,
+		"CustomSlug":    row.CustomSlug.String,
+		"ContentHTML":   template.HTML(langpkg.HighlightCode(row.Content, row.Language.String)), // safe: HighlightCode escapes all non-span text
+		"ContentAttr":   row.Content,
+		"Gutter":        strings.TrimSuffix(gutter, "\n"),
+		"LineCount":     lines,
+		"SizeBytes":     len(row.Content),
+		"CreatedAgo":    agoString(row.CreatedAt),
+		"CreatedAtUnix": row.CreatedAt,
+		"ViewCount":     row.ViewCount,
+		"Visibility":    row.Visibility,
+		"ExpiresAt":     row.ExpiresAt.Valid,
+		"ExpiresIn":     expIn,
+		"DeletionToken": deletionToken,
+		"ReadsLimit":    row.ReadsLimit.Valid,
+		"ReadsLeftN":    readsRemaining, // *int: reads remaining after this view
+		"ReadsTotal":    int(row.ReadsLimit.Int64),
+		"JustCreated":   justCreated,
+		"Host":          "this host",
+	}
+	h.renderPage(w, "paste.html", data)
+}
+
+// HandlePasteView renders the paste view; supports both ID and custom slug.
+func (h *Handlers) HandlePasteView(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	row, err := h.Store.GetPaste(id)
+	if err != nil {
+		http.Error(w, "db error", 500)
+		return
+	}
+	if row == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		http.Error(w, "paste expired", 404)
+		return
+	}
+	if row.PasswordHash.Valid {
+		// if a password was submitted via unlock form, verify and set cookie for this paste
+		if r.Method == http.MethodPost {
+			if !h.rateLimitUnlock(row.ID, r) {
+				h.writeRateLimited(w, 60)
+				return
+			}
+			r.ParseForm()
+			pw := r.FormValue("password")
+			if pw != "" && store.CheckPassword(row.PasswordHash.String, pw) {
+				// #34: the unlock cookie must be bound to this specific paste and
+				// unforgable. A static value ("1") let anyone bypass the password
+				// by setting pw_<id>=1 for any paste id. The token is an HMAC of
+				// the paste id under the server's random secret.
+				http.SetCookie(w, &http.Cookie{
+					Name: "pw_" + row.ID, Value: unlockToken(row.ID), Path: "/",
+					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+				})
+				// re-render without lock, or redirect if ?next= was given (#26)
+				if next := r.FormValue("next"); next != "" {
+					// only allow same-origin relative paths
+					if len(next) > 0 && next[0] == '/' && !strings.HasPrefix(next, "//") {
+						http.Redirect(w, r, next, http.StatusSeeOther)
+						return
+					}
+				}
+				h.renderPaste(w, row, false, "", nil)
+				return
+			}
+			h.renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": true, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
+			return
+		}
+		// check cookie — must carry the valid per-paste unlock token (#34)
+		c, err := r.Cookie("pw_" + row.ID)
+		if err != nil || c.Value != unlockToken(row.ID) {
+			h.renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": false, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
+			return
+		}
+	}
+
+	justCreated := r.URL.Query().Get("created") == "1"
+	token := r.URL.Query().Get("token")
+	if justCreated && token != "" {
+		// one-time display of the deletion token via the created banner
+		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
+	}
+	// Count the view for real page renders, deduped per-viewer within the
+	// burn window (#95): a reload by the same vwr cookie doesn't inflate
+	// view_count. Raw views increment unconditionally in handleRaw (#49); the
+	// HTML path was missing its increment originally (#33). The just-created
+	// banner render does not count as a view.
+	if !justCreated {
+		h.Store.IncrementViews(row.ID, h.ViewerID(r), h.BurnWindowMin())
+	}
+	// #49: burn-after-N-reads budget (per-viewer dedupe window).
+	// Just-created first render does not count as a read for the creator.
+	if !justCreated {
+		rem, admitted := h.Store.RegisterRead(row, h.ViewerID(r), h.BurnWindowMin())
+		if !admitted { // #58: lost the burn claim; do not render content
+			http.NotFound(w, r)
+			return
+		}
+		h.renderPaste(w, row, false, "", rem)
+		return
+	}
+	// only pass the token to the template right after creation
+	h.renderPaste(w, row, true, token, nil)
+}
+
+// HandleNewPage serves /new.
+func (h *Handlers) HandleNewPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "new.html", map[string]any{"Page": "new"})
+}
+
+// HandleHistoryPage serves /history.
+func (h *Handlers) HandleHistoryPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "history.html", map[string]any{"Page": "history"})
+}
+
+// HandleSettingsPage serves /settings.
+func (h *Handlers) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
+	// #100: theme presets. Midnight is the default (no data-preset attribute),
+	// so its swatches are hardcoded here; the CSS defines the token values.
+	themes := []map[string]any{
+		{"Name": "midnight", "Label": "Midnight", "Swatches": []string{"#241B30", "#2D2340", "#3A2D52", "#C4A8F0", "#F2EDF8"}},
+		{"Name": "smooth", "Label": "Smooth", "Swatches": []string{"#F6F5FA", "#FFFFFF", "#DAD7E6", "#7A7796", "#2A2A36"}},
+		{"Name": "pastel-lavender", "Label": "Pastel Lavender", "Swatches": []string{"#e6e0f5", "#f1edfa", "#cbb8e7", "#806bb8", "#3E3059"}},
+		{"Name": "pastel-peach", "Label": "Pastel Peach", "Swatches": []string{"#ffe0d6", "#fff0ea", "#ffc4a8", "#f9826c", "#4F2318"}},
+		{"Name": "pastel-cloud", "Label": "Pastel Cloud", "Swatches": []string{"#fff0f6", "#fff7fb", "#ffc8dd", "#a2d2ff", "#4A3355"}},
+	}
+	h.renderPage(w, "settings.html", map[string]any{"Page": "settings", "Themes": themes})
+}
+
+// HandleMinePage serves /mine.
+func (h *Handlers) HandleMinePage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "mine.html", map[string]any{"Page": "mine"})
+}
+
+// HandleAdminPage serves /admin.
+func (h *Handlers) HandleAdminPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "admin.html", map[string]any{"Page": "admin"})
+}
+
+// Handlers builds a web.Handlers bound to this UI.
+func (u *UI) Handlers() *Handlers { return &Handlers{UI: u} }
+
+// #59: security headers for rendered HTML pages. Applied wherever the
+// response is text/html (page templates and the inline can page); JSON API
+// responses and /raw content pass through untouched. script-src allows
+// 'unsafe-inline' because the page templates carry inline scripts; CSP
+// default-src 'self' still blocks external content and object/frame embeds,
+// and frame-ancestors 'none' closes the clickjacking gap flagged in the #34
+// pentest. Runs after the handler so the Content-Type is already set.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Set before the handler runs: once a handler writes (template render
+		// flushes), header mutations are silently dropped. Setting the headers
+		// unconditionally is safe: CSP/nosniff/referrer on JSON or /raw bodies
+		// is harmless and arguably desirable.
+		h := w.Header()
+		h.Set("Content-Security-Policy",
+			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+		h.Set("Referrer-Policy", "no-referrer")
+		h.Set("X-Content-Type-Options", "nosniff")
+		next.ServeHTTP(w, r)
+	})
+}

main.go

@@ -1,732 +0,0 @@
-package main
-
-import (
-	"context"
-	"database/sql"
-	"embed"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	_ "modernc.org/sqlite"
-)
-
-//go:embed web/templates/* web/static/*
-var webFS embed.FS
-
-const (
-	softDeleteGraceDays = 7
-	customSlugReservationDays = 30
-)
-
-type Config struct {
-	Addr            string
-	DBPath          string
-	MaxTextBytes    int64
-	MaxItemBytes    int64
-}
-
-type Paste struct {
-	ID          string  `json:"id"`
-	CustomSlug  *string `json:"custom_slug,omitempty"`
-	Content     string  `json:"content"`
-	ContentType string  `json:"content_type"`
-	Language    *string `json:"language,omitempty"`
-	Title       *string `json:"title,omitempty"`
-	Password    *string `json:"password,omitempty"`
-	ExpiresIn   *string `json:"expires_in,omitempty"`
-	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
-	Visibility  string  `json:"visibility"`
-	CanID       *string `json:"can_id,omitempty"`
-	CreatedAt   int64   `json:"created_at"`
-	DeletedAt   *int64  `json:"deleted_at,omitempty"`
-	ExpiresAt   *int64  `json:"expires_at,omitempty"`
-	ViewerID    string  `json:"-"` // set from vwr cookie server-side (#37)
-	ViewCount   int     `json:"view_count"`
-	DeletionToken string `json:"-"`
-}
-
-type PasteRow struct {
-	ID            string
-	CustomSlug    sql.NullString
-	Content       string
-	ContentType   string
-	Language      sql.NullString
-	Title         sql.NullString
-	PasswordHash  sql.NullString
-	ExpiresAt     sql.NullInt64
-	BurnAfterRead bool
-	Visibility    string
-	CanID         sql.NullString
-	CreatedAt     int64
-	DeletedAt     sql.NullInt64
-	ViewCount     int
-	Size          int
-	DeletionToken sql.NullString
-	ViewerID      sql.NullString
-}
-
-type CanRow struct {
-	ID           string
-	Title        sql.NullString
-	Visibility   string
-	PasswordHash sql.NullString
-	CreatedAt    int64
-	DeletedAt    sql.NullInt64
-	ExpiresAt    sql.NullInt64
-}
-
-type Store struct {
-	db *sql.DB
-}
-
-func OpenStore(path string) (*Store, error) {
-	db, err := sql.Open("sqlite", path+"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)")
-	if err != nil {
-		return nil, err
-	}
-	s := &Store{db: db}
-	if err := s.migrate(); err != nil {
-		return nil, err
-	}
-	return s, nil
-}
-
-func (s *Store) migrate() error {
-	_, err := s.db.Exec(`
-	CREATE TABLE IF NOT EXISTS pastes (
-		id            TEXT PRIMARY KEY,
-		custom_slug   TEXT UNIQUE,
-		content       TEXT NOT NULL,
-		content_type  TEXT NOT NULL DEFAULT 'text/plain',
-		language      TEXT,
-		title         TEXT,
-		password_hash TEXT,
-		expires_at    INTEGER,
-		burn_after_read INTEGER DEFAULT 0,
-		visibility    TEXT NOT NULL DEFAULT 'public',
-		can_id        TEXT,
-		created_at    INTEGER NOT NULL,
-		deleted_at    INTEGER,
-		view_count    INTEGER NOT NULL DEFAULT 0,
-	deletion_token TEXT
-	);
-	CREATE INDEX IF NOT EXISTS idx_pastes_visibility_created ON pastes(visibility, created_at DESC);
-	CREATE INDEX IF NOT EXISTS idx_pastes_expires ON pastes(expires_at) WHERE expires_at IS NOT NULL;
-	CREATE INDEX IF NOT EXISTS idx_pastes_deleted ON pastes(deleted_at) WHERE deleted_at IS NOT NULL;
-	CREATE TABLE IF NOT EXISTS paste_cans (
-		id            TEXT PRIMARY KEY,
-		title         TEXT,
-		description   TEXT,
-		visibility    TEXT NOT NULL DEFAULT 'public',
-		password_hash TEXT,
-		created_at    INTEGER NOT NULL,
-		deleted_at    INTEGER,
-		expires_at    INTEGER
-	);
-	`)
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN deletion_token TEXT`) // ignore if exists
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
-	return err
-}
-
-var slugAlphabet = "23456789abcdefghjkmnpqrstuvwxyz"
-var httpClient = &http.Client{}
-
-func genSlug(n int) string {
-	b := make([]byte, n)
-	_, _ = cryptorandRead(b)
-	for i := range b {
-		b[i] = slugAlphabet[int(b[i])%len(slugAlphabet)]
-	}
-	return string(b)
-}
-
-// cryptorandRead wraps crypto/rand
-func cryptorandRead(b []byte) (int, error) {
-	return cryptoRead(b)
-}
-
-func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
-	id := genSlug(6)
-	now := time.Now().Unix()
-
-	var expiresAt *int64
-	if p.ExpiresIn != nil && *p.ExpiresIn != "" {
-		d, err := time.ParseDuration(*p.ExpiresIn)
-		if err != nil {
-			return nil, fmt.Errorf("invalid expires_in: %w", err)
-		}
-		t := now + int64(d.Seconds())
-		expiresAt = &t
-	}
-
-	var pwHash *string
-	if p.Password != nil && *p.Password != "" {
-		h, err := hashPassword(*p.Password)
-		if err != nil {
-			return nil, err
-		}
-		pwHash = &h
-	}
-
-	if p.CustomSlug != nil && *p.CustomSlug != "" {
-		slug := *p.CustomSlug
-		if err := ValidateCustomSlug(slug); err != nil {
-			return nil, err
-		}
-		taken, err := s.SlugTaken(slug)
-		if err != nil {
-			return nil, err
-		}
-		if taken {
-			return nil, errSlugTaken
-		}
-	}
-
-	visibility := p.Visibility
-	if visibility == "" {
-		visibility = "public"
-	}
-	if visibility != "public" && visibility != "unlisted" {
-		return nil, errors.New("visibility must be public or unlisted")
-	}
-
-	contentType := p.ContentType
-	if contentType == "" {
-		contentType = "text/plain"
-	}
-
-	var slugVal *string
-	if p.CustomSlug != nil && *p.CustomSlug != "" {
-		slugVal = p.CustomSlug
-	}
-	p.DeletionToken = genDeletionToken()
-	_, err := s.db.Exec(`INSERT INTO pastes
-		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id)
-		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`,
-		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID)
-	if err != nil {
-		return nil, err
-	}
-	p.ID = id
-	p.CreatedAt = now
-	p.ExpiresAt = expiresAt
-	p.Visibility = visibility
-	return p, nil
-}
-
-func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
-	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id
-		FROM pastes WHERE (id = ? OR custom_slug = ?) AND deleted_at IS NULL`, idOrSlug, idOrSlug)
-	var r PasteRow
-	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	return &r, err
-}
-
-func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
-		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-			return nil, 0, err
-		}
-		r.CustomSlug = cs
-		r.Language = lang
-		r.Title = title
-		out = append(out, r)
-	}
-	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
-	return out, total, nil
-}
-
-// ListMine lists pastes created from the given viewer id (browser cookie), newest first.
-func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content)
-		FROM pastes
-		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), limit, offset)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-			return nil, 0, err
-		}
-		r.CustomSlug, r.Language, r.Title = cs, lang, title
-		out = append(out, r)
-	}
-	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes
-		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`,
-		viewerID, time.Now().Unix()).Scan(&total)
-	return out, total, nil
-}
-
-// MineOwner returns the stored viewer_id for a paste, or "" if none.
-func (s *Store) MineOwner(id string) (string, error) {
-	var vid sql.NullString
-	err := s.db.QueryRow(`SELECT viewer_id FROM pastes WHERE id = ? AND deleted_at IS NULL`, id).Scan(&vid)
-	if err == sql.ErrNoRows {
-		return "", nil
-	}
-	if err != nil {
-		return "", err
-	}
-	if !vid.Valid {
-		return "", nil
-	}
-	return vid.String, nil
-}
-
-func (s *Store) SoftDelete(id string) error {
-	_, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
-	return err
-}
-
-func (s *Store) IncrementViews(id string) {
-	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
-}
-
-// SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
-func (s *Store) SweepExpired() {
-	now := time.Now().Unix()
-	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
-	grace := now - softDeleteGraceDays*86400
-	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
-}
-
-// ReleaseCustomSlugs frees custom URLs so they can be reused:
-//   - pastes whose expires_at has passed (expired or soft-deleted/expired),
-//   - pastes created more than 30 days ago (custom URLs are a reservation, not permanent).
-//
-// It returns the number of pastes whose custom_slug was released.
-func (s *Store) ReleaseCustomSlugs() (int64, error) {
-	now := time.Now().Unix()
-	res, err := s.db.Exec(`UPDATE pastes SET custom_slug = NULL
-		WHERE custom_slug IS NOT NULL
-		  AND (expires_at IS NOT NULL AND expires_at > 0 AND expires_at < ?
-		   OR created_at < ?)`,
-		now, now-customSlugReservationDays*86400)
-	if err != nil {
-		return 0, err
-	}
-	n, _ := res.RowsAffected()
-	if n > 0 {
-		log.Printf("released %d custom slug(s)", n)
-	}
-	return n, nil
-}
-
-func (s *Store) StartSweeper(every time.Duration) {
-	go func() {
-		t := time.NewTicker(every)
-		for range t.C {
-			s.SweepExpired()
-			s.ReleaseCustomSlugs()
-		}
-	}()
-}
-
-func hashPassword(pw string) (string, error) {
-	// argon2id
-	return argon2idHash(pw)
-}
-
-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
-func nullStrPtr(ns sql.NullString) *string {
-	if ns.Valid {
-		return &ns.String
-	}
-	return nil
-}
-
-func writeJSON(w http.ResponseWriter, status int, v any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(v)
-}
-
-func writeErr(w http.ResponseWriter, status int, msg string) {
-	writeJSON(w, status, map[string]string{"error": msg})
-}
-
-type apiServer struct {
-	store *Store
-	cfg   Config
-}
-
-func (a *apiServer) routes() http.Handler {
-	r := chi.NewRouter()
-	r.Use(middleware.Recoverer)
-	r.Use(middleware.Timeout(30 * time.Second))
-	r.Use(viewerCookieMiddleware)
-
-	// API
-	r.Route("/api", func(r chi.Router) {
-		r.Post("/pastes", a.handleCreatePaste)
-		r.Get("/pastes/{id}", a.handleGetPaste)
-		r.Delete("/pastes/{id}", a.handleDeletePaste)
-		r.Get("/mine", a.handleListMine)
-		r.Delete("/pastes/{id}/redeem", a.handleRedeemDeletion)
-		r.Get("/public", a.handleListPublic)
-		r.Post("/guess-language", a.handleGuessLang)
-		r.Post("/pastes/can", a.handleCreateCan)
-		r.Get("/cans/{id}", a.handleGetCan)
-		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
-	})
-
-	// can page
-	r.Get("/can/{id}", a.handleCanPage)
-
-	// raw
-	r.Get("/raw/{id}", a.handleRaw)
-
-	// web pages
-	r.Get("/", http.RedirectHandler("/history", http.StatusFound).ServeHTTP)
-	r.Get("/new", a.handleNewPage)
-	r.Get("/history", a.handleHistoryPage)
-	r.Get("/settings", a.handleSettingsPage)
-	r.Get("/mine", a.handleMinePage)
-	r.Handle("/static/*", staticHandler())
-	r.Get("/unlock/{id}", a.handlePasteView)
-	r.Post("/unlock/{id}", a.handlePasteView)
-	r.Get("/{id}", a.handlePasteView)
-	r.Post("/{id}", a.handlePasteView)
-
-	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
-		writeErr(w, 404, "not found")
-	})
-	return r
-}
-
-// viewerCookieMiddleware ensures every request carries an anonymous browser id
-// cookie ("vwr"); sets one on the response if absent. Used by /mine (#37, #49).
-func viewerCookieMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if c, err := r.Cookie("vwr"); err != nil || c.Value == "" {
-			id := genSlug(16)
-			http.SetCookie(w, &http.Cookie{
-				Name: "vwr", Value: id, Path: "/",
-				MaxAge: 31536000, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-			})
-			r.AddCookie(&http.Cookie{Name: "vwr", Value: id})
-			// remember that this cookie was minted here, not sent by the client
-			r = r.WithContext(context.WithValue(r.Context(), vwrMintedKey, true))
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-type vwrMintedKeyType struct{}
-
-var vwrMintedKey vwrMintedKeyType
-
-func currentViewerID(r *http.Request) string {
-	if c, err := r.Cookie("vwr"); err == nil {
-		return c.Value
-	}
-	return ""
-}
-
-// viewerSentCookie reports whether the client itself sent a vwr cookie
-// (as opposed to the middleware minting one for this request).
-func viewerSentCookie(r *http.Request) bool {
-	if _, err := r.Cookie("vwr"); err != nil {
-		return false
-	}
-	_, minted := r.Context().Value(vwrMintedKey).(bool)
-	return !minted
-}
-
-func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
-	setRateLimitHeaders(w, 1, 5)
-	if !rateLimitCreate(r) {
-		writeRateLimited(w, 1)
-		return
-	}
-	var p Paste
-	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
-		writeErr(w, 400, "invalid json body")
-		return
-	}
-	if strings.TrimSpace(p.Content) == "" {
-		writeErr(w, 400, "content is required")
-		return
-	}
-	if int64(len(p.Content)) > a.cfg.MaxTextBytes {
-		writeErr(w, 413, fmt.Sprintf("content exceeds max %d bytes", a.cfg.MaxTextBytes))
-		return
-	}
-	p.ViewerID = currentViewerID(r)
-	created, err := a.store.CreatePaste(&p)
-	if err != nil {
-		writeErr(w, 400, err.Error())
-		return
-	}
-	writeJSON(w, 201, map[string]any{
-		"id":        created.ID,
-		"deletion_token": created.DeletionToken,
-		"url":       "/" + created.ID,
-		"raw_url":   "/raw/" + created.ID,
-		"api_url":   "/api/pastes/" + created.ID,
-		"expires_at": created.ExpiresAt,
-		"created_at": created.CreatedAt,
-		"rate_limit": map[string]int{"create_per_sec": 1, "burst": 5},
-	})
-}
-
-func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	if row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		writeErr(w, 404, "paste expired")
-		return
-	}
-	if row.PasswordHash.Valid {
-		// require password via header or query
-		pw := r.Header.Get("X-Paste-Password")
-		if pw == "" {
-			pw = r.URL.Query().Get("password")
-		}
-		if pw == "" || !checkPassword(row.PasswordHash.String, pw) {
-			writeErr(w, 401, "password required")
-			return
-		}
-	}
-	nullPtr := func(ns sql.NullString) *string {
-		if ns.Valid {
-			return &ns.String
-		}
-		return nil
-	}
-	a.store.maybeBurn(row)
-	writeJSON(w, 200, map[string]any{
-		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
-		"language": nullPtr(row.Language), "title": nullPtr(row.Title), "created_at": row.CreatedAt,
-		"view_count": row.ViewCount, "visibility": row.Visibility,
-	})
-}
-
-func (a *apiServer) handleDeletePaste(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	// viewer-cookie delete enforcement (#37): only the browser that created
-	// the paste (matching vwr) may delete it via this endpoint. Requests with
-	// no client-sent vwr cookie (plain API clients) are unaffected.
-	vid := currentViewerID(r)
-	if vid != "" && viewerSentCookie(r) && row.ViewerID.Valid && row.ViewerID.String != "" && row.ViewerID.String != vid {
-		writeErr(w, 403, "not your paste")
-		return
-	}
-	if err := a.store.SoftDelete(row.ID); err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
-}
-
-// handleListMine serves /api/mine: pastes created from this browser (#37).
-func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
-	vid := currentViewerID(r)
-	if vid == "" {
-		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
-		return
-	}
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 50
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
-	rows, total, err := a.store.ListMine(vid, limit, offset)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	items := make([]map[string]any, 0, len(rows))
-	for _, row := range rows {
-		lang, title := nullStrPtr(row.Language), nullStrPtr(row.Title)
-		items = append(items, map[string]any{
-			"id": row.ID, "title": title, "language": lang,
-			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
-			"custom_slug": nullStrPtr(row.CustomSlug), "visibility": row.Visibility,
-		})
-	}
-	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
-}
-
-func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 25
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
-	rows, total, err := a.store.ListPublic(limit, offset)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	items := make([]map[string]any, 0, len(rows))
-	for _, row := range rows {
-		lang, title := nullStrPtr(row.Language), nullStrPtr(row.Title)
-		items = append(items, map[string]any{
-			"id": row.ID, "title": title, "language": lang,
-			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
-			"custom_slug": nullStrPtr(row.CustomSlug),
-		})
-	}
-	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
-}
-
-func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		http.Error(w, "not found", 404)
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		http.Error(w, "paste expired", 404)
-		return
-	}
-	if row.PasswordHash.Valid {
-		http.Error(w, "password required", 401)
-		return
-	}
-	w.Header().Set("Content-Type", row.ContentType)
-	a.store.IncrementViews(row.ID)
-	w.Write([]byte(row.Content))
-}
-
-func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil || can == nil {
-		http.NotFound(w, r)
-		return
-	}
-	items, _ := a.store.ListCanItems(can.ID)
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
-	for _, it := range items {
-		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
-	}
-	fmt.Fprintf(w, "</ul></body></html>")
-}
-
-func nullStrOr(ns sql.NullString, def string) string {
-	if ns.Valid {
-		return ns.String
-	}
-	return def
-}
-
-func (a *apiServer) handleHome(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/plain")
-	w.Write([]byte("palette pastebin api\nPOST /api/pastes  {\"content\": \"...\", \"language\": \"go\", \"expires_in\": \"168h\", \"password\": \"...\", \"visibility\": \"public\"}\nGET  /api/pastes/{id}\nGET  /api/public?limit=25&offset=0\nGET  /raw/{id}\n"))
-}
-
-func (a *apiServer) handlePastePage(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	// if it looks like an asset request, 404
-	if strings.Contains(id, ".") {
-		http.NotFound(w, r)
-		return
-	}
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		http.NotFound(w, r)
-		return
-	}
-	a.store.IncrementViews(row.ID)
-	// render basic view; full templates come later with frontend work
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	fmt.Fprintf(w, "<!doctype html><html><head><title>%s — palette</title></head><body><pre>%s</pre></body></html>",
-		row.ID, templateEsc(row.Content))
-}
-
-func templateEsc(s string) string {
-	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
-	return r.Replace(s)
-}
-
-func main() {
-	cfg := Config{
-		Addr:         envOr("PALETTE_ADDR", ":8080"),
-		DBPath:       envOr("PALETTE_DB", "palette.db"),
-		MaxTextBytes: int64(envIntOr("PALETTE_MAX_TEXT", 5*1024*1024)),
-		MaxItemBytes: int64(envIntOr("PALETTE_MAX_ITEM", 25*1024*1024)),
-	}
-	store, err := OpenStore(cfg.DBPath)
-	if err != nil {
-		log.Fatal(err)
-	}
-	store.StartSweeper(time.Minute)
-
-	ui, err := NewWebUI()
-	if err != nil {
-		log.Fatal(err)
-	}
-	webUIInstance = ui
-	srv := &apiServer{store: store, cfg: cfg}
-	log.Printf("palette listening on %s", cfg.Addr)
-	log.Fatal(http.ListenAndServe(cfg.Addr, srv.routes()))
-}
-
-func envOr(k, d string) string {
-	if v := os.Getenv(k); v != "" {
-		return v
-	}
-	return d
-}
-
-func envIntOr(k string, d int) int {
-	if v := os.Getenv(k); v != "" {
-		if n, err := strconv.Atoi(v); err == nil {
-			return n
-		}
-	}
-	return d
-}

web.go

@@ -1,213 +0,0 @@
-package main
-
-import (
-	"embed"
-	"fmt"
-	"html/template"
-	"io/fs"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-)
-
-//go:embed web/templates/*.html
-var tmplFS embed.FS
-
-//go:embed web/static
-var staticFS embed.FS
-
-type webUI struct {
-	tmpl *template.Template
-}
-
-func NewWebUI() (*webUI, error) {
-	funcs := template.FuncMap{
-		"humanSize": humanSize,
-	}
-	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "web/templates/*.html")
-	if err != nil {
-		return nil, err
-	}
-	return &webUI{tmpl: t}, nil
-}
-
-func humanSize(n int) string {
-	if n < 1024 {
-		return fmt.Sprintf("%d B", n)
-	}
-	if n < 1024*1024 {
-		return fmt.Sprintf("%.1f KB", float64(n)/1024)
-	}
-	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
-}
-
-func staticHandler() http.Handler {
-	sub, _ := fs.Sub(staticFS, "web/static")
-	return http.StripPrefix("/static/", http.FileServer(http.FS(sub)))
-}
-
-func renderPage(w http.ResponseWriter, name string, data any) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := webUIInstance.tmpl.ExecuteTemplate(w, name, data); err != nil {
-		http.Error(w, "template error: "+err.Error(), 500)
-	}
-}
-
-var webUIInstance *webUI
-
-func (a *apiServer) handleNewPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "new.html", map[string]any{"Page": "new"})
-}
-
-func (a *apiServer) handleHistoryPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "history.html", map[string]any{"Page": "history"})
-}
-
-func (a *apiServer) handleSettingsPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "settings.html", map[string]any{"Page": "settings"})
-}
-
-func (a *apiServer) handleMinePage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "mine.html", map[string]any{"Page": "mine"})
-}
-
-func agoString(ts int64) string {
-	s := time.Now().Unix() - ts
-	switch {
-	case s < 60:
-		return fmt.Sprintf("%ds ago", s)
-	case s < 3600:
-		return fmt.Sprintf("%dm ago", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh ago", s/3600)
-	default:
-		return fmt.Sprintf("%dd ago", s/86400)
-	}
-}
-
-func expiryString(expiresAt int64) string {
-	s := expiresAt - time.Now().Unix()
-	switch {
-	case s < 3600:
-		return fmt.Sprintf("%dm", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh", s/3600)
-	default:
-		return fmt.Sprintf("%dd", s/86400)
-	}
-}
-
-func (a *apiServer) renderPaste(w http.ResponseWriter, row *PasteRow, justCreated bool, deletionToken string) {
-	lines := strings.Count(row.Content, "\n") + 1
-	gutter := ""
-	for i := 1; i <= lines; i++ {
-		gutter += fmt.Sprintf("%d\n", i)
-	}
-	expIn := ""
-	if row.ExpiresAt.Valid {
-		expIn = expiryString(row.ExpiresAt.Int64)
-	}
-	lang := row.Language.String
-	if lang == "" {
-		lang = "text"
-	}
-	summary := fmt.Sprintf("%s · %s · %d views · %s", lang, humanSize(len(row.Content)), row.ViewCount, agoString(row.CreatedAt))
-	data := map[string]any{
-		"Page":          "paste",
-		"ID":            row.ID,
-		"Title":         row.Title.String,
-		"Language":      row.Language.String,
-		"StatsSummary":  summary,
-		"SizeHuman":     humanSize(len(row.Content)),
-		"HasPassword":   row.PasswordHash.Valid,
-		"BurnAfterRead": row.BurnAfterRead,
-		"CustomSlug":    row.CustomSlug.String,
-		"ContentHTML":   template.HTML(highlightCode(row.Content, row.Language.String)), // safe: highlightCode escapes all non-span text
-		"ContentAttr":   row.Content,
-		"Gutter":        strings.TrimSuffix(gutter, "\n"),
-		"LineCount":     lines,
-		"SizeBytes":     len(row.Content),
-		"CreatedAgo":    agoString(row.CreatedAt),
-		"CreatedAtUnix": row.CreatedAt,
-		"ViewCount":     row.ViewCount,
-		"Visibility":    row.Visibility,
-		"ExpiresAt":     row.ExpiresAt.Valid,
-		"ExpiresIn":     expIn,
-		"DeletionToken": deletionToken,
-		"JustCreated":   justCreated,
-		"Host":          "this host",
-	}
-	renderPage(w, "paste.html", data)
-}
-
-// handlePastePage renders the paste view; supports both ID and custom slug.
-func (a *apiServer) handlePasteView(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil {
-		http.Error(w, "db error", 500)
-		return
-	}
-	if row == nil {
-		http.NotFound(w, r)
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		http.Error(w, "paste expired", 404)
-		return
-	}
-	if row.PasswordHash.Valid {
-		// if a password was submitted via unlock form, verify and set cookie for this paste
-		if r.Method == http.MethodPost {
-			if !rateLimitUnlock(row.ID, r) {
-				writeRateLimited(w, 60)
-				return
-			}
-			r.ParseForm()
-			pw := r.FormValue("password")
-			if pw != "" && checkPassword(row.PasswordHash.String, pw) {
-				http.SetCookie(w, &http.Cookie{
-					Name: "pw_" + row.ID, Value: "1", Path: "/",
-					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-				})
-				// re-render without lock, or redirect if ?next= was given (#26)
-				if next := r.FormValue("next"); next != "" {
-					// only allow same-origin relative paths
-					if len(next) > 0 && next[0] == '/' && !strings.HasPrefix(next, "//") {
-						http.Redirect(w, r, next, http.StatusSeeOther)
-						return
-					}
-				}
-				a.renderPaste(w, row, false, "")
-				return
-			}
-			renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": true, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
-			return
-		}
-		// check cookie
-		c, err := r.Cookie("pw_" + row.ID)
-		if err != nil || c.Value != "1" {
-			renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": false, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
-			return
-		}
-	}
-
-	a.store.IncrementViews(row.ID)
-	justCreated := r.URL.Query().Get("created") == "1"
-	token := r.URL.Query().Get("token")
-	if justCreated && token != "" {
-		// one-time display of the deletion token via the created banner
-		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
-	}
-	// only pass the token to the template right after creation
-	if justCreated {
-		a.renderPaste(w, row, true, token)
-		return
-	}
-	a.renderPaste(w, row, false, "")
-}
-
-var _ = strconv.Itoa

web/templates/settings.html

@@ -1,13 +0,0 @@
-{{template "head" .}}
-{{template "topbar" .}}
-<div class="page">
-  <div class="float">
-    <div class="settings-head">
-      <h1>Settings</h1>
-    </div>
-    <div class="settings-body">
-      <p>Settings are under construction.</p>
-    </div>
-  </div>
-</div>
-{{template "foot" .}}