Merge pull request 'docs: attachments & storage backend design (#38, #31)' (#69) from issue-38-31-storage-design into main

- enforce server-side body cap via http.MaxBytesReader: oversized JSON
  bodies are rejected with 413 instead of being fully decoded first
- negative burn_after_reads rejected with 400 (zero still = default 1)
- limit=0 explicitly maps to default page size; shared parseLimit clamp
  for /api/public and /api/mine (huge/non-numeric values too)
- negative/non-numeric offset clamped to 0 via parseOffset (was
  pass-through)
- regression tests in issue68_validation_test.go

expires_at/expires_in validation intentionally excluded: covered by #60.

README.md

@@ -5,7 +5,7 @@ a web UI for sharing code and text with links that expire on your terms.
 
 ## Features
 
-- Paste cans — bundle notes, text, and files into one shareable page, with password/expiry/custom-slug parity and a `can` badge in listings
+- Paste cans — bundle notes, text, and files into one shareable page
 - Password lock — protect individual pastes with a password
 - Custom expiry — from 1 minute up to 1 year, or never
 - Burn after N reads — a paste that vanishes after a chosen number of reads
@@ -77,7 +77,17 @@ curl -X POST http://localhost:8080/api/pastes \
   -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
 ```
 
-Full API docs: [docs/API.md](docs/API.md).
+Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
+
+## Performance Notes
+
+The history and Saved pages use client-side filtering: when you type in the
+search box, the UI fetches the most recent 100 pastes (`limit=100`, the API
+maximum) once per query and filters/sorts them in the browser. Pastes beyond
+the newest 100 are not searched; a match count against the full total is still
+shown. This keeps search instant without a server-side query. If large
+instances need full search later, it will be a server-side endpoint (see
+issue #32).
 
 ## CI
 

docs/API.md

@@ -80,29 +80,18 @@ curl -X POST http://localhost:8080/api/guess-language \
 
 ## Cans (bundles of items)
 
-A can bundles multiple text items (and files) into one shareable page at
-`/can/{id}`. Password, expiry, visibility, custom slug, and viewer-scoped
-deletion work exactly like pastes; cans appear as normal rows (with a `can`
-badge) in `/api/public` and `/api/mine`.
-
 ```bash
 curl -X POST http://localhost:8080/api/pastes/can \
   -F "title=My bundle" \
   -F "expires_in=48h" \
-  -F "custom_slug=my-bundle" \
   -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
   -F "files=@screenshot.png" \
   -F "files=@log.txt"
 
 curl http://localhost:8080/api/cans/{id}
 curl http://localhost:8080/api/cans/{id}/items/{item_id}
-curl -X DELETE http://localhost:8080/api/cans/{id}   # creator browser only (vwr cookie)
 ```
 
-Password-protected cans use the same unlock flow as pastes: `POST /can/{id}`
-with the password sets an HMAC-bound cookie; item fetches accept the cookie as
-well as the `X-Paste-Password` header / `?password=` query param.
-
 ## Web pages
 
 - `/new` — create a paste

docs/design/attachments-storage.md

@@ -0,0 +1,78 @@
+# Attachments & Storage Backend Design (#38, #31)
+
+Status: research/design, no implementation. Consumers: paste cans (#4).
+
+## Part A — Attachments: S3/MinIO vs filesystem-on-volume (#38)
+
+### Options
+
+**Option 1: Filesystem on the k3s PVC (current 5Gi volume).**
+Store blobs under `<data-dir>/attachments/<paste-id>/<n>-<sha256-8>`, metadata in SQLite (paste_id, filename, size, sha256, mime, created_at).
+
+- Pros: zero new infra, zero new credentials, trivial backup (the volume backup job already covers the DB), atomic rename on write, works in dev and prod identically.
+- Cons: volume is size-capped (5Gi today; resizable but bounded); serving large files passes through the app process (no ranged-GET offload); multi-replica later would need RWX volume.
+
+**Option 2: MinIO via S3 API.**
+MinIO is already proven in this homelab (Outline). Store at key `<paste-id>/<n>`; same SQLite metadata row.
+
+- Pros: effectively unbounded capacity, presigned URLs (direct browser download, offloads serving from palette pods), ranged requests free, lifecycle rules could auto-expire orphaned objects.
+- Cons: another credential/secret to manage, another failure mode, MultipartForm still terminates at the palette pod (MinIO only helps *serving*, not *uploading*, unless we do presigned uploads — which breaks the cans multipart flow and the auth/unlock checks), backup now spans two systems.
+
+### Key considerations
+
+- **Upload path is the same either way.** Palette receives `multipart/form-data` (cans need text items + file drops in one request), must enforce auth/password/burn rules server-side. A filesystem backend adds no upload complexity; S3 adds an extra hop (buffer → PUT to MinIO). Streaming straight from `multipart.Reader` to the sink works for both (`io.Copy` to a temp file, or to an S3 PUT with `Content-Length` known or multipart buffering).
+- **Size limits.** Everything is admin-tunable via the settings API (#40 pattern) — add `max_attachment_bytes` (default 10 MiB, hard server-side cap checked *before* reading the body via `Content-Length`, plus a counted reader during copy so chunked uploads can't lie). SQLite itself is not a constraint either way; the PVC is the real cap for Option 1.
+- **MIME handling.** Security-critical (pentest #34 already fixed a content-type XSS on `/raw`). Rules:
+  - Never trust the client-declared Content-Type. Sniff the first 512 bytes (`http.DetectContentType`), intersect with an allowlist.
+  - Serve from a dedicated route (`/{id}/a/{n}`) with `Content-Type` from the stored *sniffed* type, `X-Content-Type-Options: nosniff`, `Content-Security-Policy: sandbox`, `Content-Disposition: attachment` unless the type is on a safe-inline allowlist (text/plain, images, PDF at user opt-in).
+  - Never render user HTML/SVG inline (`image/svg+xml` is XSS-capable — serve as `attachment` always, or store sanitized).
+- **Streaming & serving.**
+  - Filesystem: `http.ServeContent` on the opened file gives ranged GETs, ETag, Last-Modified for free.
+  - MinIO: proxy via `GetObject` + `io.Copy` (simple, keeps auth checks in palette) or presigned GET (faster, but URL embeds credentials-temporarily and bypasses palette's per-request auth — wrong for pastes with passwords/burn semantics). Given cans inherit password/burn parity (#4), **proxying is required, which erodes MinIO's main serving advantage**.
+- **Lifecycle parity.** Attachments must honor soft-delete grace and sweep: sweeper hard-delete also removes blobs (files: `os.Remove`; S3: `DeleteObject`), best-effort with logging; orphan sweep job compares DB rows to store contents.
+
+### Recommendation
+
+**Filesystem-on-volume first.** At current scale (single replica, PVC-based deploy, one user + homelab traffic) it is simpler end-to-end and keeps serving/auth/lifecycle in one place. The internal API should be a narrow blob interface (`Put(ctx, key, r io.Reader, size int64) / Open(key) / Delete(key)`) — about 60 lines per backend — so **MinIO becomes a drop-in later** if attachments outgrow the volume. That's the honest middle path: filesystem default, S3-ready seam, no MinIO dependency until it pays for itself.
+
+## Part B — SQLite vs Postgres vs Redis (#31)
+
+### Assessment of SQLite at pastebin scale
+
+- **Driver**: modernc.org/sqlite (pure Go, no cgo) — slightly slower than mattn/go-sqlite3 but fine; single-writer semantics are the real constraint, not driver speed.
+- **Access pattern**: paste-heavy, write-rare/read-often; primary keys and small set of indexes (visibility+created, expires, deleted); no joins beyond can items. This is SQLite's best case.
+- **WAL mode** is already on (`journal_mode(WAL), busy_timeout(5000)`) — concurrent readers don't block the single writer.
+- **Numbers**: SQLite comfortably handles millions of rows and hundreds of reads/sec; WAL write throughput is thousands of small inserts/sec. A pastebin doing even 100k pastes (avg 10 KB = ~1 GB DB) is trivial. Reads: prepared `WHERE id=?` lookups at this size are sub-millisecond.
+- **Weak points to watch** (document, none urgent):
+  1. Single writer — heavy concurrent create traffic serializes. Mitigation: already rate-limited (#2); fine until that's the bottleneck (unlikely).
+  2. `LENGTH(content)` on every list row — fine now; if it shows up in profiling, store `size` as a column (schema already has a `Size` field; list queries could use it).
+  3. Sweeper runs a table-wide `UPDATE`+`DELETE` on tick — indexed, fine.
+  4. No network access to the DB file — locks palette to single-replica. Acceptable: current deploy is one replica.
+- **Redis is the wrong tool** here: it's a cache/queue, not a system of record. Pastes are durable data with expiry semantics already implemented in SQLite. Redis would only add an optional read-cache layer for hot pastes — pure complexity for zero measured need.
+
+### Should we build a backend abstraction (SQLite default, optional Postgres)?
+
+Arguments for: multi-replica scaling later; "docker image env choice" sounds nice; Postgres gives real concurrency and network access.
+Arguments against: a `Store` interface covering the current query surface is a real refactor (sqlite-flavored SQL: `INSERT OR IGNORE`-style upserts, partial indexes, `?` placeholders are compatible but behaviors differ — e.g. `sqlite` driver pragmas, transaction isolation, `AUTOINCREMENT` semantics); two backends means two test matrices and two migration paths forever; and there is **no current need** — single replica, single writer, modest data.
+
+**Recommendation: stay SQLite-only. Do not build the abstraction now.**
+Specifically:
+
+1. Keep all persistence behind `internal/store` (already done in #35 — the package boundary *is* the abstraction, at zero cost).
+2. Avoid SQLite-specific SQL going forward where free (standard placeholders, no `RETURNING` quirks) — cheap discipline that keeps a future port honest.
+3. Define the trigger conditions for revisiting, and write them down:
+   - multiple replicas needed (scale-out), or
+   - sustained WAL write contention (busy timeouts observed in logs), or
+   - DB file > ~5-10 GB, or
+   - a concrete user request for a Postgres-backed image.
+4. When a trigger fires, port `internal/store` to Postgres behind an interface extracted *then* — the refactor is mechanical against a real need, instead of speculative complexity now.
+5. For the docker image: `PALETTE_DB_PATH` env already implies the deployment choice; no extra backend knob needed.
+
+## Summary
+
+| Decision | Choice |
+|---|---|
+| Attachment backend | Filesystem on PVC, behind a ~3-method blob interface; MinIO as a later drop-in, not a dependency |
+| Size limits | `max_attachment_bytes` admin setting, default 10 MiB, enforced pre-read + during stream |
+| MIME | Server-side sniff (512 bytes) + allowlist; `nosniff`, CSP `sandbox`, `Content-Disposition: attachment` except safe-inline types; SVG never inline |
+| Database | SQLite (WAL, modernc) only; no Postgres/Redis, no backend abstraction until a written trigger fires |

docs/design/cookie-preferences.md

@@ -0,0 +1,160 @@
+# Design: Cookie-Based Preferences and Access Keys (#30)
+
+Status: design note — no implementation yet.
+Related: #37 (vwr viewer cookie), #34 (HMAC unlock cookie), #26 (creator auto-unlock), #36 (settings gear).
+
+## Current cookie surface
+
+| Cookie | Purpose | Lifetime | Flags today |
+|---|---|---|---|
+| `vwr` | Anonymous viewer id; scopes `/mine` history and burn-after-N per-viewer dedupe; client-sent `vwr` also authorizes delete | 1 year | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+| `pw_<id>` | Per-paste password unlock token = HMAC(paste id, PALETTE_UNLOCK_SECRET) | 1 hour | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+| `tok_<id>` | One-time deletion-token handoff after create | 60 s | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+
+The access-key feature is an extension of the `pw_<id>` pattern, not a new mechanism.
+
+## Part 1: Preference storage
+
+### What settings
+
+Only settings the *creator* sets when writing a paste, so the "new paste" form
+can pre-fill them:
+
+- Default language (`lang`)
+- Default expiry (`expires_in` / custom expiry)
+- Burn-after-N-reads default
+- Password-protect-by-default toggle (checkbox pre-checked; the password itself is never stored)
+- Default visibility of the "raw" link, if such a toggle exists
+- Collapsed/expanded state of the settings gear panel itself
+
+Never stored in cookies: passwords, access keys for pastes the user hasn't
+unlocked, deletion tokens (beyond the existing 60 s `tok_` handoff), anything
+typed into the paste body or title fields (existing rule: auto-detect must not
+overwrite user-typed content).
+
+### One cookie, not many
+
+A single `prefs` cookie holding a compact JSON object:
+
+```
+prefs={"lang":"go","exp":"1h","burn":0,"pw":1}
+```
+
+- One cookie avoids the browser per-domain cookie count (typically 50+ per
+  domain; Chrome 180) eating the budget that per-paste access-key cookies need.
+- Per-paste cookies (`pw_<id>`) are inherently name-per-paste and cannot be
+  consolidated — that's the constraint that makes a single `prefs` cookie
+  mandatory rather than stylistic.
+
+### Size limits
+
+- RFC 6265: user agents SHOULD support at least 4096 bytes per cookie. Keep
+  `prefs` under 256 bytes of JSON — it holds a handful of short enum values.
+- Server behavior: if the cookie is present but oversized/invalid JSON, ignore
+  it silently and serve defaults. Never reject a request over a bad preference
+  cookie.
+- Validate on the server (allowlist of known values); a cookie is untrusted
+  input like any header.
+
+### Flags
+
+`HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000; Secure` (Secure once the
+prod instance serves HTTPS — it will, behind the letsencrypt IngressRoute;
+dev on plain HTTP needs the flag conditional on config).
+
+Preferences are not sensitive, but `HttpOnly` costs nothing and keeps script
+from mutating them; `SameSite=Lax` matches the existing cookies.
+
+## Part 2: Access-key cookies
+
+### Goal
+
+"Remember unlocked pastes on this browser" — after entering a password (or
+after creating a private paste), subsequent visits skip the unlock form. This
+extends `pw_<id>` from a 1-hour session convenience to a durable capability.
+
+### Design: extend `pw_<id>`, don't invent a new scheme
+
+The token is already HMAC(paste id, PALETTE_UNLOCK_SECRET) — unforgeable and
+per-paste (fix for the #34 bypass). Changes:
+
+1. **Opt-in checkbox on the unlock form** ("remember on this browser") and a
+   matching checkbox/note at creation time. Default OFF. Non-consenting
+   visitors keep the current 1-hour cookie.
+2. **Extended lifetime** when opted in: `Max-Age = min(paste expiry, 90 days)`.
+   The cookie must never outlive the paste — derive the cap from the paste's
+   `ExpiresAt` at unlock time. Burn-after-N pastes: cap short (e.g. 24 h),
+   since the paste may burn at any read.
+3. **Name collision**: paste ids are fixed-length server-generated, so
+   `pw_<id>` names stay bounded (~40 bytes each). With the 50-cookies-per-
+   domain budget, cap remembered pastes at ~30: when minting the 31st, drop
+   the oldest expired-paste cookies server-side (server knows which ids are
+   expired/deleted; send expired `Set-Cookie` with `Max-Age=0` to reclaim).
+4. **Delete authorization interplay**: today a client-sent `vwr` matching the
+   paste's ViewerID authorizes delete. Access-key cookies grant *read*
+   capability only. Do not let a `pw_<id>` cookie authorize deletion — that
+   would mean cookie theft escalates from "read a paste" to "destroy it".
+   Delete stays bound to `vwr` or the deletion token.
+
+### Scoping
+
+- Keep `Path=/` (paste URLs are `/{id}` at the root; per-paste `Path=/{id}`
+  would work but saves nothing and complicates cleanup).
+- Per-paste scope via the cookie *name* is the existing, tested pattern —
+  no shared "access key ring" cookie. A consolidated `keys` cookie would
+  mean one stolen cookie exposes every remembered paste at once.
+
+## Part 3: Security considerations (honest accounting)
+
+- **XSS exfiltration**: `HttpOnly` prevents JS from *reading* the cookies, but
+  not from *using* them — an XSS payload can simply `fetch('/<paste-id>')` and
+  exfiltrate the content through the page the cookie unlocks. HttpOnly raises
+  the bar (drive-by script can't dump the jar to an attacker server in one
+  request), it does not make access-key cookies safe. This is a real
+  limitation, not a solved problem. Mitigations in order of value:
+  1. Fix the stored-XSS class at the source — #34 already allowlisted
+     content-types on `/raw`; the standing debt items (CSP, X-Frame-Options,
+     Referrer-Policy) directly reduce cookie-use exfiltration and should land
+     before or with this feature.
+  2. Keep access-key cookies opt-in, so the blast radius is bounded to users
+     who accepted the tradeoff.
+- **Cookie theft = paste access**: anyone holding `pw_<id>` can read that
+  paste until the cookie or paste expires, from any machine. That is inherent
+  to capability cookies. Consequences accepted deliberately: pastes here are
+  ephemeral (1 min–1 yr expiry), passwords are low-stakes share convenience,
+  and there are no user accounts to compromise. Document this in the UI copy
+  ("stores unlock access on this browser").
+- **Shared machines**: a remembered cookie defeats the password for the next
+  user of the browser. The opt-in checkbox with plain-language copy is the
+  mitigation; do not default it on.
+- **Cookie tossing / fixation**: a subdomain attacker could try to force
+  cookies; palette is a single host, no untrusted subdomains. `SameSite=Lax`
+  blocks cross-site attachment of the cookies on form posts to unlock
+  endpoints.
+- **Multi-instance / secret rotation**: tokens are HMACs under
+  `PALETTE_UNLOCK_SECRET`; rotating the secret silently invalidates all
+  remembered cookies (acceptable — next visit re-prompts). Both dev and prod
+  k3s instances need the same secret only if sharing a domain, which they do
+  not.
+- **Preferences cookie**: not security-sensitive, but still validate/allowlist
+  server-side to avoid it becoming an injection sink into templates.
+
+## Recommendation
+
+Implement in two small, separately reviewable pieces:
+
+1. **`prefs` cookie** (do first, low risk): single JSON cookie < 256 bytes,
+   server-validated allowlist, `HttpOnly; SameSite=Lax; Max-Age=1y`, drives
+   only form pre-fill. Ship with #36's settings gear.
+2. **Extended `pw_<id>` opt-in** (second, security-sensitive): opt-in checkbox,
+   Max-Age capped by paste expiry (90-day ceiling, 24 h for burn pastes),
+   oldest-cookie eviction at ~30 pastes, no delete authorization from access
+   cookies, and land the CSP/X-Frame-Options hardening debt from #34 in the
+   same or preceding change. UI copy must disclose that the cookie preserves
+   paste access on the browser.
+
+Rejected alternatives: single consolidated access-key cookie (aggregate theft
+risk, and the per-domain cookie-count argument cuts the other way for keys —
+consolidation maximizes what one stolen cookie unlocks); localStorage for
+preferences (XSS-readable, no benefit over HttpOnly cookies here); server-side
+accounts/session table (out of scope — Palette is deliberately anonymous).

docs/design/e2e-encryption.md

@@ -0,0 +1,223 @@
+# Design: Optional client-side E2E encryption for pastes and files
+
+- **Issue:** #39
+- **Status:** Design (no implementation in this PR)
+- **Related docs:** [docs/API.md](../API.md)
+
+## 1. Goals and non-goals
+
+**Goals**
+
+- Let any paste (or can item) be stored server-side as ciphertext only.
+- Zero plaintext knowledge by the server: storage, logs, backups, DB dumps contain no readable content.
+- Pure browser implementation using WebCrypto; no new server dependencies.
+- Encrypted pastes must still work with expiry, hard/soft delete, deletion tokens, visibility, slugs, rate limits.
+
+**Non-goals (v1)**
+
+- Anonymous, account-less E2E; Palette stays server-trusting with browser cookies.
+- Sharing via link fragments (`#key`) is optional sugar, not a required transport.
+- Search *of encrypted content*, server-side language detection, or server-side highlighting on encrypted pastes — these are structurally impossible and out of scope (see §5).
+- Signing, deniability, forward secrecy across pastes, PFS, post-quantum crypto.
+
+**Threat model (explicit).** This protects against a *passive server compromise* — a DB dump, backup leak, or disk image of the server's SQLite file. It does **not** protect against:
+
+- A fully malicious / compromised Palette server serving backdoored JavaScript: any JS-delivered crypto can be backdoored (key exfiltration via JS) regardless of primitives. This is the fundamental limit of a JS-in-browser E2E scheme.
+- Malware on the viewer's device, or shoulder-surfing of the password.
+- Traffic analysis, timing, or metadata (title, size, expiry, IP, viewer cookie).
+- A attacker who compromises the server *while the creator's browser is open* and alters JS before encrypt.
+
+Be explicit in user-facing copy: "encrypted at rest; the server cannot read your paste" is accurate — "the server can never see your paste" is not.
+
+## 2. Crypto primitives and flow
+
+### 2.1 Recommended parameters
+
+| Parameter | Recommendation | Notes |
+|---|---|---|
+| Cipher | **AES-256-GCM** | `AES-GCM` with a 256-bit key, per-paste random 96-bit IV/nonce. WebCrypto built-in, hardware-accelerated, authenticated. |
+| KDF | **PBKDF2-HMAC-SHA-256** | 600,000 iterations (OWASP 2023+ recommendation), 16-byte random salt. |
+| Argon2id | **Not in v1** | WebCrypto has no Argon2id; a JS/WASM Argon2 implementation is an extra supply-chain dependency and is an asymmetric liability: a script the server could swap can't be load-bearing for security anyway. Add later via `argon2id` WASM with SRI pinning + CSP (`script-src 'self'`) if needed. |
+| Salt | 16 random bytes per paste, stored in the clear alongside ciphertext | Unique per paste, never reused. |
+| IV | 12 random bytes per encryption | With ~2^32 encryptions per key this is negligible; each paste has its own key anyway. |
+| Key check value | See §2.2 | Catches wrong passwords without a server round-trip and prevents trash writes. |
+
+### 2.2 Flow (create)
+
+1. User checks "Encrypt" and enters an encryption passphrase (distinct from any access password) in `/new`.
+2. Browser generates `salt` (16 B) and `iv` (12 B) via `crypto.getRandomValues`.
+3. `crypto.subtle.importKey("raw", passphrase, "PBKDF2", false, ["deriveKey"])` →
+   `crypto.subtle.deriveKey(PBKDF2-SHA-256, 600k iterations, salt, {name:"AES-GCM", length:256}, false, ["encrypt","decrypt"])`.
+4. Generate a 32-byte random **DEK** (`crypto.getRandomValues(32)`).
+5. Content encryption key check: `iv_ckv`, `encrypted_content = AES-GCM-256(DEK, iv, content)`.
+6. **Key check value (KCV):** compute `AES-GCM-DEK(random 16 bytes)` — a small token encrypted *under the DEK*, stored as `key_check` blob. This is decrypted with the derived key; on wrong password GCM auth fails and the client can show "wrong key" without asking the server to burn a read.
+7. Wrap the DEK with the KEK: `wrapped_dek = AES-GCM(KEK, iv_wrap, dek)`.
+8. The stored envelope format:
+   ```
+   {
+     v: 1, kdf: "PBKDF2-SHA256", iterations: 600000, salt_b64, iv_b64,
+     kdf_salt_b64, wrap_iv_b64, wrapped_dek_b64, key_check_b64, ciphertext_b64
+   ```
+   The `v` field allows migrating to Argon2id later without a breaking change.
+8. POST the envelope (base64) as `content`, with an `encryption` metadata object alongside (see §3.1).
+
+### 2.3 Flow (view)
+
+1. User provides the passphrase via form field, or the key arrives in the URL `#fragment`. The encryption passphrase is a separate field from any access password.
+2. Fetch `/api/pastes/{id}` (with access password in the usual field if the paste is also password-gated).
+3. Derive KEK from passphrase+salt, unwrap DEK via key_check / unwrap step.
+4. Decrypt content with the DEK; on `OperationError` → "wrong passphrase" UI state (retries are client-side only; no re-fetch, so no extra burn-after-read charge).
+5. Language detection happens client-side (e.g. highlight.js auto-detect) on the decrypted plaintext.
+
+### §2.4 File and can items
+
+Files in cans: encrypt each file with its own DEK and store the same envelope. Cans' `json_items` content fields each carry their own envelope. Files keep their mime type in cleartext metadata; only the bytes are encrypted. The can's title stays plaintext (unless the whole can is encrypted, v2).
+
+## 3. API shapes
+
+### 3.1 Create request
+
+Existing fields unchanged. New optional `encryption` object:
+
+```json
+POST /api/pastes
+{
+  "content": "<base64 envelope>",
+  "encryption": {"v": 1, "kdf": "PBKDF2-SHA256", "iterations": 600000,
+                 "salt": "b64", "iv": "b64", "key_check": "b64"}
+}
+```
+
+`encryption` is non-secret KDF metadata for UI display; the server treats `content` as opaque bytes and MUST NOT inspect it for encrypted pastes (no detection, no highlighting prep, no search indexing) — enforced where content is written, not per-handler.
+
+The full envelope can also just live inside `content` (server-opaque); the `encryption` object carries only non-secret KDF metadata the list views need (e.g. to show a 🔒 icon).
+
+### 3.2 Create response
+
+Unchanged shape: `id`, `url`, `raw_url`, `api_url`, and the one-time `deletion_token` documented in docs/API.md.
+
+### 3.3 Get response
+
+`GET /api/pastes/{id}` response gains:
+
+```json
+{
+  "id": "abc123",
+  "content": "BASE64_ENVELOPE",
+  "encryption": {"v":1, "kdf": "PBKDF2-SHA256", "iterations": 601570, "salt": "b64", "iv": "base64", "key_check": "b64"},
+  "reads_remaining": null
+}
+```
+
+`language` is `"encrypted"` or `null` so clients don't run detection on ciphertext. `raw_url` also serves the envelope; the `/{id}` page ships it to the browser, which decrypts in place.
+
+### 3.4 Raw endpoint
+
+`GET /raw/{id}` returns the envelope as `application/octet-stream` with a suggested filename like `{id}.e2e.txt` and `Content-Disposition: attachment`. This is deliberate: a "download encrypted blob" is what a non-browser client can do with it anyway.
+
+### 3.5 List views / mine / public
+
+List endpoints return `has_encryption: true` instead of content; show a lock icon. Do not include ciphertext in list responses (size, and no reason to ship ciphertext to every viewer's list view) — `GET /api/pastes/{id}` remains the only endpoint that returns the envelope.
+
+`/api/mine` (creator's own browser) may include the envelope for convenience; `/api/public` returns metadata only.
+
+`/api/guess-language` rejects encrypted content with `400 "content is client-encrypted"` — detection needs plaintext; clients detect after decrypting.
+
+Delete, redeem, rate limits, expiry, sweeper, deletion tokens, visibility, slugs, and can CRUD are unchanged — the server never inspects content for these, so opaque content is a no-op path.
+
+## 4. Interplay with existing features
+
+| Feature | Impact | Mitigation |
+| Burn-after-read | Budget is charged on fetch, exactly as today; the server cannot know whether decryption succeeded, so a viewer fetching with the wrong key burns a read they can't use. | Decrypt retries are client-side, so only the first fetch charges the budget. Clear UX copy. |
+| Password-protected + encrypted | Both can coexist and are independent: the access password is an HTTP 401 gate; the encryption passphrase never leaves the browser. If both are set, all three secrets are needed (URL + access password + passphrase). Warn if the user enters the same value in both fields. |
+| Encryption-only pastes | Supported with no access password: URL + passphrase (or fragment key). Default is passphrase; fragment key is opt-in with a warning. |
+| Search | Structurally impossible over ciphertext. Server search just skips encrypted pastes; client-side search within a single decrypted paste works fine. No global encrypted-content search — accept the loss, document it. |
+| Language detection / highlighting | Server-side detection/highlighting impossible; returns `language: null`. Client-side detection via highlight.js auto-detect on decrypted plaintext (client already loads it for password gate pages). |
+| Cans/files | Per-item envelopes (own DEK each), per §2.4. | Consider a can-level KEK (one passphrase unlocks all items). |
+| Expiry/sweeper/delete/redeem | Unchanged — server never inspects content for these. |
+| List views (`/api/public`, `/api/mine`) | Additive `has_encryption: true` flag; list responses do not include ciphertext (`/api/mine` may include the envelope for the creator's own convenience). |
+| guess-language endpoint | Reject with 400. |
+| Fork / edit | Re-encryption needs the passphrase in the browser; v1 disables forking encrypted pastes. | Document the limitation. |
+
+## 5. What breaks, stated plainly
+
+- **Search across encrypted pastes: impossible.** Accept the loss. (If ever needed, client-side index in IndexedDB for the creator's own pastes — v2+.)
+ IndexedDB only helps the creator, not other viewers; still not global search. Accept the loss.
+- **Server-side language detection and highlighting: impossible.** Client-side detection on decrypted plaintext. Server returns `language: null` and the client detects.
+- **Burn-after-read is weakened in one specific way:** the budget is counted on fetch, not on successful decryption. A viewer who fetches but can't decrypt (wrong/lost key) burns a read they can't use. Mitigations documented in §4 table. The server can still count fetches (which is what burn-after-read actually is, even today: it counts fetches, not "reads" in any content-aware sense). So burn-after-read still works — it counts fetches — it's just that a failed decryption still consumes budget. This is acceptable and just needs UX copy. Optionally: don't decrement on failed decryption is *not possible* the server can't tell, so it's fetch-based, period. (It already is today.)
+- **Raw endpoint semantics change:** `/raw/{id}` can no longer serve readable raw text. It serves the ciphertext envelope. Scripts that curl raw pastes will get base64 envelope instead of text. Document as a breaking-ish change for encrypted pastes only; unencrypted pastes unchanged.
+- **Existing /api/mine, /api/public list shapes gain a flag** (additive, non-breaking).
+- **Copy-to-clipboard of decrypted text stays client-side**, fine. "Copy raw" on an encrypted paste copies the envelope — label it clearly.
+
+## 5. UX for key sharing
+### 5.1 Three sharing modes
+
+| Mode | What's shared | Security level | Use case |
+|---|---| malformed JSON / wrong key | | |
+| Mode | What's shared | Strength | Use case |
+|---|---|---|---|
+| **Passphrase** (default) | URL + passphrase out-of-band (Signal etc.) | Good — two channels | Team snippets, sensitive configs |
+| **Passphrase + access password** | URL + access password (401 gate) + passphrase | Strong — two secrets, two channels | Highest sensitivity |
+| **Random key in `#fragment`** | URL containing `#key=<b64>` | Weak — single channel; anyone with the full URL has both parts. Copy/paste into chat defeats it entirely. | One-click convenience sharing |
+
+Browsers never transmit `#` fragments to servers; still set `Referrer-Policy: no-referrer` site-wide and offer separate copy buttons for URL and key. Key-in-fragment ships with a warning and stays opt-in.
+
+### 5.2 Create page (`/new`) UX
+
+- "Encrypt content" toggle → reveals passphrase field + strength meter + generate-random-key button.
+- When encrypting, hide the server-side language dropdown; the client detects language after decryption.
+- Two separate inputs with distinct labels: "Access password (checked by the server, 401 gate)" and "Encryption passphrase (never leaves your browser)". If both hold the same value, warn.
+
+### 6.2 View page (`/{id}`) UX
+
+- If `encryption.kdf` is present → show key entry UI (after the access-password 401 gate, if that also applies).
+- After decrypt: normal render pipeline, language detected client-side.
+- "Wrong passphrase" retries never re-fetch, so they never burn extra reads.
+
+## 7. Backwards compatibility and migration
+
+- Additive JSON fields only; unencrypted pastes behave identically. No schema changes (envelope is stored in the existing content column/TEXT; verify column size allows envelope overhead (~2× base64 + ~200 B header).
+- Server-side validation of encrypted pastes: only structural checks (base64 decodes, size ≤ max bytes). No crypto in the server.
+
+**Server implementation cost is genuinely small** (est. 2-4 days): pass through content untouched, add `encryption` metadata column or embed in content, skip detection/indexing when `encryption` is present, list flag. The server never does crypto. All crypto is client-side JS (~150-300 lines, no build-step change if using WebCrypto alone).
+
+**Argon2id later:** add `kdf: "argon2id"` to the envelope `v: 1` (m=64 MiB, t=3, p=1) via a SRI-pinned WASM module, with CSP `script-src 'self'` + SRI on the script tag. Envelope `v` field already allows this.
+
+## 8. Recommendation
+
+**Build it, as an opt-in checkbox, passphrase mode only in v1.**
+
+- Server cost is small (pass-through + skip detection/indexing + list flag), client cost moderate (WebCrypto only, no new deps).
+- It closes the biggest real-world risk for a public pastebin: a DB/backup leak exposing every paste ever written.
+- Skip Argon2id in v1; envelope `v` field provides a migration path.
+- Key-in-fragment mode: build the plumbing (fragment parsing) but hide behind "advanced"; default remains passphrase.
+
+**Do not build:** server-side search over encrypted content, server-side highlighting of encrypted content, decrypt-on-server "preview" mode, or any server-side crypto.
+
+## 9. Open questions
+
+1. Size limits: base64 expansion (~4/3×) plus ~200 B envelope overhead; the existing max-bytes / 413 limit applies to the envelope bytes the server stores. Do not compress before encrypting (CRIME-style weaknesses).
+2. Fork/edit of encrypted pastes: disabled in v1, revisit.
+3. Should `/api/mine` include the full envelope in list view? Leaning yes (creator's own browser can decrypt); note the larger payload.
+4. Should there be a "verify passphrase" second field at create time (type-twice), or rely on the KCV check at view time? KCV at view time suffices; type-twice adds friction at create. Rely on KCV, skip type-twice.
+5. CSP/Referrer-Policy hardening: `Referrer-Policy: no-referrer` site-wide is worth doing regardless of this feature (it also benefits unencrypted pastes).
+6. Cans: per-item DEKs wrapped by a single can-level KEK (one passphrase unlocks all items) — better UX, slightly more envelope design work. Defer detail to implementation.
+
+## 10. Alternatives considered
+
+| Alternative | Why not in v1 |
+|---|---|
+| Argon2id via WASM in v1 | Extra JS dependency the server could swap → can't be load-bearing; PBKDF2-600k is adequate for a pastebin. Defer. |
+| Server holds half a key (2-of-2 with server-held share) | Re-introduces server trust; defeats the purpose. |
+| age-format envelopes | Nice CLI interop but no WebCrypto-native support; adds a JS dependency. Defer. |
+| PGP / S-MIME | Poor browser UX; heavy dependencies. |
+| Server-side encryption with server-held keys | Not E2E; that's "encrypted at rest", already covered by disk-level encryption. |
+| PrivateBin-style fragment key only | Single-channel sharing is a footgun; keep passphrase as default. |
+| libsodium / tweetnacl | Solid but unnecessary; WebCrypto covers AES-GCM + PBKDF2 natively. |
+
+## 11. References
+
+- OWASP Password Storage Cheat Sheet (PBKDF2 guidance): https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+- MDN WebCrypto: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
+- PrivateBin (prior art for fragment-key sharing): https://privatebin.info
+- 0bin, Hemmelig — other pastebin/secret E2E prior art.

docs/performance-notes.md

@@ -1,60 +0,0 @@
-# Performance notes (#32)
-
-Background: history and saved pages filter client-side. Each load fetches the
-most recent rows from the list endpoint (`limit=500` per query is the current
-client cap in `static/table.js`) and filters/sorts in the browser. This note
-records current behavior, measured latency, and the design for a future
-server-side search endpoint. Measurements only — no implementation in #4/#32.
-
-## Current behavior
-
-- `/api/public?limit=500&offset=0` and `/api/mine?limit=500&offset=0` return up
-  to 500 rows (id, title, language, created_at, view_count, size,
-  custom_slug, is_can). Content is NOT included — only `LENGTH(content)`.
-- The browser applies the search-box filter (title/language/id substring) and
-  column sorting locally over the fetched window.
-- Consequence: search only covers the fetched window (500 most recent rows).
-  Older rows are invisible to search until paginated through, and each query
-  ships ~4 KB of row metadata regardless of how few rows the user will look at.
-
-## Measured latency (synthetic rows, scratch SQLite DB)
-
-Rows are synthetic pastes (~200 B content each, indexed like production:
-`idx_pastes_visibility_created`). Queried `GET /api/public?limit=500`
-(modernc.org/sqlite, WAL, single connection — same as production).
-
-| Rows in table | Bulk insert | First query | Avg query (10 runs) | Payload |
-|---|---|---|---|---|
-| 1,000 | 19 ms | 1.0 ms | 0.44 ms | ~4.1 KB |
-| 5,000 | 95 ms | 1.0 ms | 0.98 ms | ~4.1 KB |
-| 10,000 | 189 ms | 2.0 ms | 1.78 ms | ~4.1 KB |
-
-Interpretation:
-
-- The list query itself is cheap (< 2 ms at 10k rows); latency users perceive
-  comes from network + browser rendering of 500 rows, not SQL.
-- The current design scales fine to ~10k pastes. Beyond that, shipping 500
-  rows per keystroke-refresh cycle is wasteful and search coverage stays
-  capped at the window.
-
-## Future design: server-side `/api/search?q=` (#32 remainder)
-
-- Endpoint: `GET /api/search?q=<term>&limit=25&offset=0`.
-- SQL: `SELECT ... FROM pastes WHERE deleted_at IS NULL AND (expires_at IS NULL
-  OR expires_at > ?) AND (title LIKE ? OR content LIKE ?) ORDER BY created_at
-  DESC LIMIT ? OFFSET ?` — term wrapped as `%term%`, escaped (`%`, `_`).
-  Visibility scoping mirrors ListPublic/ListMine (`public` + `viewer_id` for
-  the saved-page variant).
-- Indexing: LIKE with a leading wildcard cannot use a B-tree index. Options,
-  in order of effort:
-  1. Accept a table scan — fine at ≤ ~50k rows (10k rows scanned in ~2 ms).
-  2. Add an index on `title` for prefix search (`q*`) and keep `%q%` scan only
-     as a fallback.
-  3. SQLite FTS5 virtual table (`CREATE VIRTUAL TABLE pastes_fts USING
-     fts5(title, content)`) for token search — best relevance, needs sync on
-     insert/delete and a migration.
-- Cans: search should cover can titles/descriptions too (UNION ALL with
-  `paste_cans`, `is_can=1`), matching the #4 listing integration.
-- Response shape: same row objects as `/api/public` (plus `is_can`) so
-  `table.js` can render results without a second code path; the client filter
-  becomes a server query when `q` is non-empty.

internal/api/admin.go

@@ -172,6 +172,11 @@ func (a *apiServer) adminKeyOK(r *http.Request, key string) bool {
 
 func (a *apiServer) adminAuth(next http.HandlerFunc, key string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		if !rateLimitAdmin(r) {
+			log.Printf("admin auth RATE LIMITED: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeRateLimited(w, 60)
+			return
+		}
 		if !a.adminKeyOK(r, key) {
 			log.Printf("admin auth FAILURE: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
 			writeErr(w, 401, "unauthorized")

internal/api/adminratelimit_test.go

@@ -0,0 +1,80 @@
+package api
+
+// #66: admin key attempts must be rate limited per IP (5/min), constant-time
+// compared, and failures logged. Hammering bad keys must yield 429s.
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestAdminKeyRateLimited: burst of 5 bad-key attempts allowed (401), the 6th
+// gets 429, and even the correct key is blocked from that IP until refill.
+func TestAdminKeyRateLimited(t *testing.T) {
+	srv := newTestServer(t)
+	h := srv.routes()
+	reqIP := "10.7.7.1:1234"
+
+	var got429, retryAfter bool
+	var lastCode int
+	for i := 0; i < 10; i++ {
+		req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+		req.RemoteAddr = reqIP
+		req.Header.Set("X-Admin-Key", "wrong-key")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		lastCode = rec.Code
+		if rec.Code == 429 {
+			got429 = true
+			retryAfter = rec.Header().Get("Retry-After") != ""
+			break
+		}
+	}
+	if !got429 {
+		t.Fatalf("expected 429 after hammering bad keys, last status %d", lastCode)
+	}
+	if !retryAfter {
+		t.Error("429 missing Retry-After header")
+	}
+
+	// Correct key from the same IP is also locked out.
+	req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+	req.RemoteAddr = reqIP
+	req.Header.Set("X-Admin-Key", srv.adminKey)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 429 {
+		t.Errorf("correct key after lockout: got %d, want 429", rec.Code)
+	}
+
+	// A different IP is unaffected.
+	req2 := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(`{"rate_limit_burst":5,"rate_limit_per_minute":60,"max_content_bytes":1048576,"custom_slug_reservation_days":30,"burn_viewer_window_minutes":15}`))
+	req2.RemoteAddr = "203.0.113.9:1234"
+	req2.Header.Set("X-Admin-Key", srv.adminKey)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 200 {
+		t.Errorf("correct key from another IP: got %d, want 200", rec2.Code)
+	}
+}
+
+// TestAdminKeyConstantTimeCompare: sanity check that the comparison is
+// constant-time (uses subtle.ConstantTimeCompare, not ==).
+func TestAdminKeyConstantTimeCompare(t *testing.T) {
+	srv := newTestServer(t)
+	r := httptest.NewRequest("GET", "/", nil)
+	r.Header.Set("X-Admin-Key", "test-admin-key")
+	if !srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("correct key rejected")
+	}
+	r.Header.Set("X-Admin-Key", "wrong")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("wrong key accepted")
+	}
+	// differ in length: must not panic/mismatch unexpectedly
+	r.Header.Set("X-Admin-Key", "test-admin-key-longer")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("longer wrong key accepted")
+	}
+}

internal/api/cans.go

@@ -10,8 +10,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-
-	"palette/internal/web"
 )
 
 // CreateCan makes a can with N items (multipart form).
@@ -33,7 +31,6 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 	expiresIn := r.FormValue("expires_in")
 	password := r.FormValue("password")
-	customSlug := r.FormValue("custom_slug")
 
 	var expiresAt *int64
 	now := time.Now().Unix()
@@ -43,7 +40,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
-		// #60/#48: clamp at the API boundary like the pastes API does -
+		// #60: clamp at the API boundary like the pastes API does -
 		// reject zero/negative and durations past the 1-year UI cap.
 		if !store.ValidExpiry(d) {
 			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
@@ -63,25 +60,11 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 
 	canID := store.GenSlug(8)
-	var slugPtr *string
+	err := a.store.InsertCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt)
-	if customSlug != "" {
-		slugPtr = &customSlug
-	}
-	err := a.store.CreateCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt, slugPtr)
 	if err != nil {
-		switch err {
+		writeErr(w, 500, "db error")
-		case store.ErrSlugTaken, store.ErrInvalidSlug, store.ErrReservedSlug:
-			writeErr(w, 409, err.Error())
-		default:
-			writeErr(w, 500, "db error")
-		}
 		return
 	}
-	if slugPtr != nil {
-		canID = customSlug // #4: custom slug becomes the can id
-	}
-	// #4: remember the creating browser so /mine and viewer-scoped delete work
-	a.store.Exec(`UPDATE paste_cans SET viewer_id=? WHERE id=?`, currentViewerID(r), canID)
 
 	// text items passed as JSON array: [{"title":"notes.txt","content":"..."}]
 	itemCount := 0
@@ -146,29 +129,6 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// handleDeleteCan soft-deletes a can (parity with paste deletion, #63):
-// requires the vwr viewer cookie matching the can's viewer (cans carry no
-// deletion token since they are built in the browser).
-func (a *apiServer) handleDeleteCan(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil || can == nil {
-		writeErr(w, 404, "can not found")
-		return
-	}
-	vid := currentViewerID(r)
-	if !(vid != "" && viewerSentCookie(r) && can.ViewerID.Valid &&
-		can.ViewerID.String != "" && can.ViewerID.String == vid) {
-		writeErr(w, 403, "deletion not authorized")
-		return
-	}
-	if _, err := a.store.SoftDeleteCan(can.ID); err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
-}
-
 func detectContentType(name string, content []byte) string {
 	lower := strings.ToLower(name)
 	switch {
@@ -251,8 +211,7 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 404, "not a can item")
 		return
 	}
-	// inherit can password protection: password via header/query, or the
+	// inherit can password protection
-	// same pw_<can> unlock cookie the can page sets (#4 cookie parity).
 	can, _ := a.store.GetCan(row.CanID.String)
 	if can != nil && can.PasswordHash.Valid {
 		pw := r.Header.Get("X-Paste-Password")
@@ -260,12 +219,8 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 			pw = r.URL.Query().Get("password")
 		}
 		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
-			// fall back to the browser's unlock cookie for this can
+			writeErr(w, 401, "password required")
-			c, cerr := r.Cookie("pw_" + can.ID)
+			return
-			if cerr != nil || c.Value != web.UnlockToken(can.ID) {
-				writeErr(w, 401, "password required")
-				return
-			}
 		}
 	}
 	// #34: same content-type guard as /raw — never serve active content types.

internal/api/cans_expiry_test.go

@@ -0,0 +1,45 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+// #60: the cans API must clamp expires_in at the boundary exactly like the
+// pastes API — reject zero/negative durations and anything over the 1-year
+// UI cap, accept the exact boundaries.
+func TestCreateCanExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},    // negative
+		{"-0s", 400},    // negative zero
+		{"0s", 400},     // zero
+		{"1ns", 400},    // positive but below the 1-minute floor
+		{"59s", 400},    // just under the floor
+		{"1m", 201},     // exactly the floor
+		{"90s", 201},    // just over the floor
+		{"8760h", 201},  // exactly 1 year
+		{"8785h", 400},  // 1 year + 1 day: over the cap
+		{"87600h", 400}, // 10 years, the originally reported case
+	}
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		body, ct := multipartBody(t, map[string]string{
+			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+			"expires_in": c.expiresIn,
+		}, "files", "pic.txt", "file data")
+		req := httptest.NewRequest("POST", "/api/pastes/can", body)
+		req.Header.Set("Content-Type", ct)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}

internal/api/cans_flow_test.go

@@ -1,413 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"palette/internal/store"
-)
-
-// #4: cans appear in /api/public as normal rows with is_can=true.
-func TestCanInPublicListing(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	// a can and a regular paste
-	body, ct := multipartBody(t, map[string]string{
-		"title":      "Listed can",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create can: %d %s", rec.Code, rec.Body.String())
-	}
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	req = httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"plain"}`))
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("public: %d", rec.Code)
-	}
-	var got struct {
-		Total int `json:"total"`
-		Items []struct {
-			ID    string `json:"id"`
-			IsCan bool   `json:"is_can"`
-			Title any    `json:"title"`
-		} `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if got.Total != 2 {
-		t.Fatalf("expected total 2 (can + paste), got %d", got.Total)
-	}
-	foundCan := false
-	for _, it := range got.Items {
-		if it.ID == created.ID {
-			if !it.IsCan {
-				t.Fatalf("can row missing is_can flag")
-			}
-			foundCan = true
-		} else if it.IsCan {
-			t.Fatalf("plain paste flagged as can")
-		}
-	}
-	if !foundCan {
-		t.Fatalf("can not present in /api/public")
-	}
-
-	// #4: unlisted can must not be listed
-	body2, ct2 := multipartBody(t, map[string]string{
-		"title":       "Hidden can",
-		"visibility":  "unlisted",
-		"json_items":  `[{"title":"b.txt","content":"BBB"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body2)
-	req.Header.Set("Content-Type", ct2)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("unlisted can create: %d", rec.Code)
-	}
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "Hidden can") {
-		t.Fatalf("unlisted can leaked into /api/public")
-	}
-}
-
-// #4: custom slug support for cans + conflict with existing paste slug.
-func TestCanCustomSlug(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	body, ct := multipartBody(t, map[string]string{
-		"title":       "Slugged",
-		"custom_slug": "my-bundle",
-		"json_items":  `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create can with slug: %d %s", rec.Code, rec.Body.String())
-	}
-	var created struct{ ID, URL string }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-	if created.ID != "my-bundle" {
-		t.Fatalf("expected id my-bundle, got %q", created.ID)
-	}
-	// custom slug resolves on the can page route
-	req = httptest.NewRequest("GET", "/can/my-bundle", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Slugged") {
-		t.Fatalf("can page by slug: %d", rec.Code)
-	}
-	// duplicate slug rejected 409
-	body, ct = multipartBody(t, map[string]string{
-		"title": "Again", "custom_slug": "my-bundle",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 409 {
-		t.Fatalf("duplicate slug expected 409, got %d", rec.Code)
-	}
-	// reserved slug rejected
-	body, ct = multipartBody(t, map[string]string{
-		"title": "R", "custom_slug": "admin",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req = httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 409 {
-		t.Fatalf("reserved slug expected 409, got %d", rec.Code)
-	}
-}
-
-// #4: invalid expiry rejected on cans, mirroring paste behavior (#48).
-func TestCanExpiryValidation(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Bad expiry", "expires_in": "30s",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 400 {
-		t.Fatalf("expected 400 for 30s expiry, got %d", rec.Code)
-	}
-}
-
-// #4: expired cans 404 on the page and API.
-func TestCanExpiryAccess(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Dying", "expires_in": "1h",
-		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// backdate expiry to force the expired path
-	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, created.ID)
-
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("expired can API expected 404, got %d", rec.Code)
-	}
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("expired can page expected 404, got %d", rec.Code)
-	}
-}
-
-// #4: password-protected can page uses the same unlock flow as pastes.
-func TestCanUnlockFlow(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Locked can", "password": "pw123",
-		"json_items": `[{"title":"secret.txt","content":"sec content"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// GET page without cookie -> unlock form
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "locked") {
-		t.Fatalf("expected unlock form, got %d", rec.Code)
-	}
-
-	// POST wrong password -> unlock form with error
-	fd := strings.NewReader("password=wrong")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "Wrong password") {
-		t.Fatalf("expected wrong-password message")
-	}
-
-	// POST correct password -> page renders, cookie set
-	fd = strings.NewReader("password=pw123")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("unlocked can page missing item content")
-	}
-	var pwCookie *http.Cookie
-	for _, c := range rec.Result().Cookies() {
-		if c.Name == "pw_"+created.ID {
-			pwCookie = c
-		}
-	}
-	if pwCookie == nil {
-		t.Fatalf("unlock cookie not set")
-	}
-
-	// GET with cookie -> unlocked
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	req.AddCookie(pwCookie)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if !strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("cookie unlock failed: %d", rec.Code)
-	}
-	// a forged cookie value must not unlock
-	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
-	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "sec content") {
-		t.Fatalf("forged cookie unlocked the can")
-	}
-}
-
-// #4: can item access inherits the can unlock cookie (not just query param).
-func TestCanItemCookieParity(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Cookie can", "password": "pw123",
-		"json_items": `[{"title":"s.txt","content":"sec"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// unlock via page to get the cookie
-	fd := strings.NewReader("password=pw123")
-	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var pwCookie *http.Cookie
-	for _, c := range rec.Result().Cookies() {
-		if c.Name == "pw_"+created.ID {
-			pwCookie = c
-		}
-	}
-	if pwCookie == nil {
-		t.Fatalf("no unlock cookie")
-	}
-
-	// item id from API (with password query)
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"?password=pw123", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var can struct {
-		Items []struct{ ID string `json:"id"` } `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &can)
-	itemID := can.Items[0].ID
-
-	// API item with the unlock cookie but no password -> 200
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	req.AddCookie(pwCookie)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("item via cookie expected 200, got %d", rec.Code)
-	}
-	// forged cookie -> 401
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
-	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 401 {
-		t.Fatalf("forged cookie on item expected 401, got %d", rec.Code)
-	}
-}
-
-// #4: viewer-scoped soft delete of cans.
-func TestCanDeleteParity(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Doomed", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
-	json.Unmarshal(rec.Body.Bytes(), &created)
-
-	// delete without matching viewer -> 403
-	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 403 {
-		t.Fatalf("unauthorized delete expected 403, got %d", rec.Code)
-	}
-	// creator's browser -> 200
-	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("creator delete expected 200, got %d", rec.Code)
-	}
-	// gone from API and page
-	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 404 {
-		t.Fatalf("deleted can expected 404, got %d", rec.Code)
-	}
-	// gone from listings
-	req = httptest.NewRequest("GET", "/api/public", nil)
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if strings.Contains(rec.Body.String(), "Doomed") {
-		t.Fatalf("deleted can still listed")
-	}
-}
-
-// #4: cans appear in /api/mine for the creating browser.
-func TestCanInMine(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	body, ct := multipartBody(t, map[string]string{
-		"title": "Mine can", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
-	}, "", "", "")
-	req := httptest.NewRequest("POST", "/api/pastes/can", body)
-	req.Header.Set("Content-Type", ct)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create: %d", rec.Code)
-	}
-
-	req = httptest.NewRequest("GET", "/api/mine", nil)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var got struct {
-		Items []struct {
-			ID    string `json:"id"`
-			IsCan bool   `json:"is_can"`
-		} `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if len(got.Items) != 1 || !got.Items[0].IsCan {
-		t.Fatalf("can missing from /api/mine: %s", rec.Body.String())
-	}
-}
-
-// #4: sweep soft-deletes expired cans (parity with pastes).
-func TestCanSweepExpired(t *testing.T) {
-	s := testServer(t)
-	s.store.CreateCan("sweepcan", "sweep", "", "public", nil, 1, nil, nil)
-	s.store.InsertCanItem("sweepcan", "a.txt", "AAA", "text/plain", nil, nil, nil, 1)
-	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, "sweepcan")
-	s.store.SweepExpired()
-	if can, _ := s.store.GetCan("sweepcan"); can != nil {
-		t.Fatalf("expired can survived sweep")
-	}
-	_ = store.GenSlug(4) // keep import if store pkg shrinks
-}

internal/api/issue68_validation_test.go

@@ -0,0 +1,198 @@
+package api
+
+// Regression tests for #68 input-validation gaps: negative/oversized content
+// lengths (413), limit=0 → default page size, unchecked query params
+// (negative offset), and negative burn_after_reads.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func createPasteRaw(t *testing.T, h http.Handler, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+// A request whose decoded content exceeds the admin-tunable cap is rejected
+// with 413 and a clear message (content under the body cap, over the
+// content cap).
+func TestCreatePasteContentOverCap413(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// content over MaxContentBytes (5MiB) but under body cap (+4KiB): send
+	// just over the content cap so the per-field check fires first.
+	content := strings.Repeat("a", 5*1024*1024+10)
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "content exceeds max") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+}
+
+// A request whose entire body is larger than the server-side body cap is cut
+// off by http.MaxBytesReader and answered with 413, not decoded into memory
+// (#68: previously a giant body was fully buffered, then rejected only at
+// the per-field check — actually the decode happened before any check).
+func TestCreatePasteBodyOverCap413(t *testing.T) {
+	s := testServer(t)
+	// shrink the content cap so the body cap is small too
+	ss := s.settings.get()
+	ss.MaxContentBytes = 64 * 1024
+	if err := s.settings.set(ss); err != nil {
+		t.Fatal(err)
+	}
+	h := s.routes()
+
+	content := strings.Repeat("a", 200*1024) // 200KiB > 64KiB+4KiB body cap
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s","title":"x"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// Negative content lengths cannot be expressed via JSON, but a negative
+// expires-style numeric payload must not crash; more importantly the
+// burn_after_reads field: negative values are rejected with a clear message.
+func TestCreatePasteNegativeBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	rec := createPasteRaw(t, h, `{"content":"hi","burn_after_reads":-5}`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "burn_after_reads") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+
+	// 0 and positive values still work (0 = default single read, per #49)
+	rec = createPasteRaw(t, h, `{"content":"hi","burn_after_reads":0,"burn_after_read":true}`)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("zero burn_after_reads: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// limit=0 on list endpoints returns the default page size (existing clamp
+// treats <=0 as default; #68 asks this be explicit and tested).
+func TestListLimitZeroUsesDefault(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// seed 3 public pastes
+	for i := 0; i < 3; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d: %s", rec.Code, rec.Body.String())
+		}
+	}
+
+	for _, q := range []string{"/api/public?limit=0", "/api/public"} {
+		req := httptest.NewRequest("GET", q, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("%s: got %d", q, rec.Code)
+		}
+		var got struct {
+			Limit int                   `json:"limit"`
+			Total int                   `json:"total"`
+			Items []struct{ ID string } `json:"items"`
+		}
+		json.Unmarshal(rec.Body.Bytes(), &got)
+		if got.Limit != 25 || len(got.Items) != 3 {
+			t.Fatalf("%s: limit=%d items=%d, want limit 25 and all 3 items", q, got.Limit, len(got.Items))
+		}
+	}
+}
+
+// Huge limit values are clamped to the max page size (already the behavior;
+// regression-tested here per #68 "validate unchecked params").
+func TestListLimitHugeClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=999999999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var got struct {
+		Limit int `json:"limit"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 {
+		t.Fatalf("limit=%d, want clamped to 25", got.Limit)
+	}
+}
+
+// Negative offset previously passed through unchecked to SQL (harmless in
+// SQLite, but invalid); it must be clamped to 0 (#68).
+func TestListNegativeOffsetClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	for i := 0; i < 2; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d", rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public?offset=-999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Offset int `json:"offset"`
+		Total  int `json:"total"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Offset != 0 || got.Total != 2 {
+		t.Fatalf("offset=%d total=%d, want offset 0 and total 2", got.Offset, got.Total)
+	}
+
+	// /api/mine too (needs the viewer cookie)
+	req = httptest.NewRequest("GET", "/api/mine?offset=-5", nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "offclamp"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var mine struct {
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &mine)
+	if mine.Offset != 0 {
+		t.Fatalf("mine offset=%d, want 0", mine.Offset)
+	}
+}
+
+// Non-numeric limit/offset fall back to defaults instead of 500s.
+func TestListGarbageParams(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=abc&offset=xyz", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Limit  int `json:"limit"`
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 || got.Offset != 0 {
+		t.Fatalf("limit=%d offset=%d, want 25/0", got.Limit, got.Offset)
+	}
+}

internal/api/main_test.go

@@ -183,6 +183,46 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	}
 }
 
+func TestListPublicExcludesPasswordAndUnlisted(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	bodies := []string{
+		`{"content":"open","visibility":"public"}`,
+		`{"content":"locked","visibility":"public","password":"hunter2"}`,
+		`{"content":"hidden","visibility":"unlisted"}`,
+	}
+	for _, body := range bodies {
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("create %s: got %d", body, rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("list public: got %d", rec.Code)
+	}
+	var resp struct {
+		Total int              `json:"total"`
+		Items []map[string]any `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Total != 1 || len(resp.Items) != 1 {
+		t.Fatalf("expected only the 1 public paste, got total=%d items=%d", resp.Total, len(resp.Items))
+	}
+	// password-protected and unlisted pastes must not appear (no metadata leak)
+	for _, secret := range []string{"hunter2", "locked", "hidden"} {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Fatalf("leaked %q in /api/public response", secret)
+		}
+	}
+}
+
 func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()

internal/api/ratelimit.go

@@ -84,6 +84,12 @@ func rateLimitUnlock(id string, r *http.Request) bool {
 	return globalLimiter.allow("unlock:"+id+":"+clientIP(r), 5.0/60.0, 5)
 }
 
+// rateLimitAdmin: 5 attempts per minute per IP on the admin key check (#66),
+// same pattern as the unlock limiter (#34).
+func rateLimitAdmin(r *http.Request) bool {
+	return globalLimiter.allow("admin:"+clientIP(r), 5.0/60.0, 5)
+}
+
 // writeRateLimited responds 429 with Retry-After based on refill rate.
 func writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
 	w.Header().Set("Retry-After", strconv.Itoa(retryAfterSecs))

internal/api/server.go

@@ -4,10 +4,8 @@ package api
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
 	"fmt"
-	"html/template"
 	"net/http"
 	"os"
 	"strconv"
@@ -17,7 +15,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
-	langpkg "palette/internal/lang"
+	"database/sql"
+
 	"palette/internal/store"
 	"palette/internal/web"
 )
@@ -60,7 +59,9 @@ func (a *apiServer) routes() http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
+	r.Use(a.limitRequestBody) // #68: hard server-side body cap -> 413
 	r.Use(viewerCookieMiddleware)
+	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
 
 	// admin (#40): HTML page is open (key entry via form); API is key-guarded
 	r.Get("/admin", a.ui.Handlers().HandleAdminPage)
@@ -78,13 +79,11 @@ func (a *apiServer) routes() http.Handler {
 		r.Post("/guess-language", a.handleGuessLang)
 		r.Post("/pastes/can", a.handleCreateCan)
 		r.Get("/cans/{id}", a.handleGetCan)
-		r.Delete("/cans/{id}", a.handleDeleteCan)
 		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
 	})
 
-	// can page (#4): GET renders, POST unlocks (same flow as pastes)
+	// can page
 	r.Get("/can/{id}", a.handleCanPage)
-	r.Post("/can/{id}", a.handleCanPage)
 
 	// raw
 	r.Get("/raw/{id}", a.handleRaw)
@@ -155,16 +154,22 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	}
 	var p store.Paste
 	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
+		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
+			writeBodyTooLarge(w)
+			return
+		}
 		writeErr(w, 400, "invalid json body")
 		return
 	}
-	if strings.TrimSpace(p.Content) == "" {
+	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
-		writeErr(w, 400, "content is required")
+		writeErr(w, status, msg)
 		return
 	}
-	if int64(len(p.Content)) > s.MaxContentBytes { // #40: admin-tunable
+	if p.BurnAfterReads != nil { // #68: reject negative read budgets
-		writeErr(w, 413, fmt.Sprintf("content exceeds max %d bytes", s.MaxContentBytes))
+		if err := parseBurnAfterReads(*p.BurnAfterReads); err != nil {
-		return
+			writeErr(w, 400, err.Error())
+			return
+		}
 	}
 	// #40: admin-configurable default expiry
 	if (p.ExpiresIn == nil || *p.ExpiresIn == "") && s.DefaultExpiry != "" {
@@ -293,11 +298,8 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
 		return
 	}
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	limit := parseLimit(r, 50, 100)
-	if limit <= 0 || limit > 100 {
+	offset := parseOffset(r)
-		limit = 50
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	rows, total, err := a.store.ListMine(vid, limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")
@@ -310,18 +312,14 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 			"id": row.ID, "title": title, "language": lang,
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
 			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
-			"is_can": row.IsCan,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
 }
 
 func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	limit := parseLimit(r, 25, 100)
-	if limit <= 0 || limit > 100 {
+	offset := parseOffset(r)
-		limit = 25
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	rows, total, err := a.store.ListPublic(limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")
@@ -334,7 +332,6 @@ func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
 			"id": row.ID, "title": title, "language": lang,
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
 			"custom_slug": store.NullStrPtr(row.CustomSlug),
-			"is_can":      row.IsCan,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
@@ -378,7 +375,7 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", ct)
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	a.store.IncrementViews(row.ID, "", 0) // raw views always count (#49/#95)
+	a.store.IncrementViews(row.ID)
 	w.Write([]byte(row.Content))
 }
 
@@ -407,117 +404,13 @@ func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	if can.ExpiresAt.Valid && can.ExpiresAt.Int64 < time.Now().Unix() {
+	items, _ := a.store.ListCanItems(can.ID)
-		http.NotFound(w, r)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		return
+	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
-	}
-	// #4: password-protected cans go through the same unlock flow as pastes:
-	// the pw_<id> cookie carries an HMAC token bound to this can id. Items
-	// inherit the protection (handleCanItem checks the same cookie).
-	if can.PasswordHash.Valid {
-		h := a.webHandlers()
-		if r.Method == http.MethodPost {
-			if !rateLimitUnlock(can.ID, r) {
-				h.WriteRateLimited(w, 60)
-				return
-			}
-			r.ParseForm()
-			pw := r.FormValue("password")
-			if pw != "" && store.CheckPassword(can.PasswordHash.String, pw) {
-				http.SetCookie(w, &http.Cookie{
-					Name: "pw_" + can.ID, Value: web.UnlockToken(can.ID), Path: "/",
-					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-				})
-				a.renderCan(w, can)
-				return
-			}
-			h.RenderPage(w, "unlock.html", map[string]any{
-				"Page": "unlock", "ID": can.ID, "Wrong": true,
-				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
-			})
-			return
-		}
-		c, err := r.Cookie("pw_" + can.ID)
-		if err != nil || c.Value != web.UnlockToken(can.ID) {
-			h.RenderPage(w, "unlock.html", map[string]any{
-				"Page": "unlock", "ID": can.ID, "Wrong": false,
-				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
-			})
-			return
-		}
-	}
-	a.renderCan(w, can)
-}
-
-// renderCan renders the can view page: title/description and items as cards.
-// Text items expand inline; files link to download.
-func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
-	h := a.webHandlers()
-	items, err := a.store.ListCanItems(can.ID)
-	if err != nil {
-		http.Error(w, "db error", 500)
-		return
-	}
-	type canItem struct {
-		ID          string
-		Title       string
-		ContentType string
-		Size        string
-		IsFile      bool
-		Content     string
-		ContentHTML template.HTML
-		Language    string
-	}
-	cards := make([]canItem, 0, len(items))
-	totalSize := 0
 	for _, it := range items {
-		totalSize += len(it.Content)
+		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
-		isFile := it.ContentType != "text/plain" && !strings.HasPrefix(it.ContentType, "text/")
-		ci := canItem{
-			ID:          it.ID,
-			Title:       nullStrOr(it.Title, it.ID),
-			ContentType: it.ContentType,
-			Size:        web.HumanSize(len(it.Content)),
-			IsFile:      isFile,
-			Language:    it.Language.String,
-		}
-		if !isFile {
-			ci.ContentHTML = template.HTML(langpkg.HighlightCode(it.Content, it.Language.String))
-		}
-		cards = append(cards, ci)
-	}
-	h.RenderPage(w, "can.html", map[string]any{
-		"Page":          "can",
-		"ID":            can.ID,
-		"Title":         nullStrOr(can.Title, "Untitled can"),
-		"Description":   can.Description.String,
-		"HasDescription": can.Description.Valid && can.Description.String != "",
-		"HasPassword":   can.PasswordHash.Valid,
-		"Items":         cards,
-		"ItemCount":     len(cards),
-		"SizeHuman":     web.HumanSize(totalSize),
-		"CreatedAgo":    web.AgoString(can.CreatedAt),
-		"CreatedAtUnix": can.CreatedAt,
-		"ExpiresAt":     can.ExpiresAt.Valid,
-		"ExpiresIn":     expiryStringIfValid(can.ExpiresAt),
-	})
-}
-
-// expiryStringIfValid formats remaining time for a valid expiry, "" otherwise.
-func expiryStringIfValid(ns sql.NullInt64) string {
-	if !ns.Valid {
-		return ""
-	}
-	remaining := ns.Int64 - time.Now().Unix()
-	s := remaining
-	switch {
-	case s < 3600:
-		return fmt.Sprintf("%dm", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh", s/3600)
-	default:
-		return fmt.Sprintf("%dd", s/86400)
 	}
+	fmt.Fprintf(w, "</ul></body></html>")
 }
 
 func templateEsc(s string) string {

internal/api/validate.go

@@ -0,0 +1,92 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// #68 input-validation helpers. Paste/can payloads are size-capped and list
+// endpoints get a single place where limit/offset are parsed and clamped.
+
+// maxRequestBody returns the HTTP body cap for JSON create endpoints: the
+// admin-tunable content cap plus headroom for JSON field overhead, floored
+// at 64KiB so a tiny admin-configured cap can't break small requests.
+func (a *apiServer) maxRequestBody() int64 {
+	s := a.settings.get()
+	max := s.MaxContentBytes + 4096
+	if max < 64*1024 {
+		max = 64 * 1024
+	}
+	return max
+}
+
+// limitRequestBody wraps the request body with http.MaxBytesReader so
+// oversized payloads are cut off server-side instead of being fully decoded
+// into memory before the per-field size check runs (#68). A read over the
+// cap surfaces as *http.MaxBytesError, which handlers map to 413.
+func (a *apiServer) limitRequestBody(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil {
+			r.Body = http.MaxBytesReader(w, r.Body, a.maxRequestBody())
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// writeBodyTooLarge emits the 413 response for a body rejected by
+// MaxBytesReader.
+func writeBodyTooLarge(w http.ResponseWriter) {
+	writeErr(w, http.StatusRequestEntityTooLarge, "request body too large")
+}
+
+// isBodyTooLarge reports whether err came from http.MaxBytesReader.
+func isBodyTooLarge(err error) bool {
+	var mbe *http.MaxBytesError
+	return errors.As(err, &mbe)
+}
+
+// checkContent validates paste content: rejects whitespace-only content
+// (400) and content over the byte cap (413). Returns (0, "") when valid.
+func checkContent(content string, maxBytes int64) (int, string) {
+	if strings.TrimSpace(content) == "" {
+		return http.StatusBadRequest, "content is required"
+	}
+	if int64(len(content)) > maxBytes { // #40/#68: admin-tunable cap
+		return http.StatusRequestEntityTooLarge,
+			fmt.Sprintf("content exceeds max %d bytes", maxBytes)
+	}
+	return 0, ""
+}
+
+// parseLimit clamps the ?limit query param: missing/non-numeric/zero/negative
+// or over-max values fall back to def. Zero intentionally maps to the default
+// page size, matching the pre-existing `<= 0` clamp (#68).
+func parseLimit(r *http.Request, def, max int) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("limit"))
+	if err != nil || n <= 0 || n > max {
+		return def
+	}
+	return n
+}
+
+// parseOffset clamps the ?offset query param: missing/non-numeric or negative
+// values become 0 (#68: negative offsets previously passed through to SQL).
+func parseOffset(r *http.Request) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("offset"))
+	if err != nil || n < 0 {
+		return 0
+	}
+	return n
+}
+
+// parseBurnAfterReads validates the burn_after_reads field (#68): negative
+// values are rejected; zero/absent mean the default single read.
+func parseBurnAfterReads(n int) error {
+	if n < 0 {
+		return errors.New("burn_after_reads must be a positive number")
+	}
+	return nil
+}

internal/store/store.go

@@ -30,8 +30,6 @@ type Paste struct {
 	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
 	BurnAfterReads *int `json:"burn_after_reads,omitempty"` // #49: readable N times (default 1)
 	Visibility  string  `json:"visibility"`
-	// #83: accept "public": true/false as an alias for visibility.
-	Public *bool `json:"public,omitempty"`
 	CanID       *string `json:"can_id,omitempty"`
 	CreatedAt   int64   `json:"created_at"`
 	DeletedAt   *int64  `json:"deleted_at,omitempty"`
@@ -62,7 +60,6 @@ type PasteRow struct {
 	Size          int
 	DeletionToken sql.NullString
 	ViewerID      sql.NullString
-	IsCan         bool // set on list rows that are cans (#4)
 }
 
 type CanRow struct {
@@ -73,8 +70,6 @@ type CanRow struct {
 	CreatedAt    int64
 	DeletedAt    sql.NullInt64
 	ExpiresAt    sql.NullInt64
-	Description  sql.NullString
-	ViewerID     sql.NullString
 }
 
 type Store struct {
@@ -135,7 +130,6 @@ deletion_token TEXT
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
-	s.db.Exec(`ALTER TABLE paste_cans ADD COLUMN viewer_id TEXT`) // ignore if exists (#4)
 	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
 		paste_id    TEXT NOT NULL,
 		viewer_id   TEXT NOT NULL,
@@ -221,14 +215,6 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 	}
 
 	visibility := p.Visibility
-	// #83: "public": false -> unlisted, true -> public; overrides string field
-	if p.Public != nil {
-		if *p.Public {
-			visibility = "public"
-		} else {
-			visibility = "unlisted"
-		}
-	}
 	if visibility == "" {
 		visibility = "public"
 	}
@@ -276,14 +262,9 @@ func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
 // listed, and password-protected pastes are excluded at the query level
 // (#65) so their metadata (title, slug, existence) never leaks.
 func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content), 0
+	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
-		FROM pastes
 		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		UNION ALL
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
-		SELECT id, NULL, 'text/plain', NULL, title, visibility, created_at, 0, 0, 1
-		FROM paste_cans
-		WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), time.Now().Unix(), limit, offset)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -292,33 +273,25 @@ func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
 	for rows.Next() {
 		var r PasteRow
 		var cs, lang, title sql.NullString
-		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
 			return nil, 0, err
 		}
 		r.CustomSlug = cs
 		r.Language = lang
 		r.Title = title
-		r.IsCan = isCan == 1
 		out = append(out, r)
 	}
 	var total int
-	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?))
+	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
-		+ (SELECT COUNT(*) FROM paste_cans WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
-		time.Now().Unix(), time.Now().Unix()).Scan(&total)
 	return out, total, nil
 }
 
 // ListMine lists pastes created from the given viewer id (browser cookie), newest first.
 func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content), 0
+	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content)
 		FROM pastes
 		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		UNION ALL
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), limit, offset)
-		SELECT id, NULL, NULL, title, visibility, created_at, 0, 0, 1
-		FROM paste_cans
-		WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), viewerID, time.Now().Unix(), limit, offset)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -327,18 +300,16 @@ func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, e
 	for rows.Next() {
 		var r PasteRow
 		var cs, lang, title sql.NullString
-		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
 			return nil, 0, err
 		}
 		r.CustomSlug, r.Language, r.Title = cs, lang, title
-		r.IsCan = isCan == 1
 		out = append(out, r)
 	}
 	var total int
-	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?))
+	s.db.QueryRow(`SELECT COUNT(*) FROM pastes
-		+ (SELECT COUNT(*) FROM paste_cans WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
+		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`,
-		viewerID, time.Now().Unix(), viewerID, time.Now().Unix()).Scan(&total)
+		viewerID, time.Now().Unix()).Scan(&total)
 	return out, total, nil
 }
 
@@ -371,38 +342,14 @@ func (s *Store) SoftDelete(id string) (bool, error) {
 	return n > 0, err
 }
 
-// IncrementViews counts one view. With a viewerID (#95): views are deduped
+func (s *Store) IncrementViews(id string) {
-// per-viewer within burnViewerWindow minutes using the paste_views table,
-// namespaced with a "views/" viewer prefix so these rows never collide with
-// RegisterRead's burn-after-read dedupe rows (which key on the raw viewer id).
-// Raw views always count (#49 decision) — call with viewerID="" for those.
-// Returns true when the view was counted.
-func (s *Store) IncrementViews(id, viewerID string, burnWindowMinutes int) bool {
-	if viewerID == "" {
-		s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
-		return true
-	}
-	now := TimeNow().Unix()
-	vkey := "views/" + viewerID
-	var last sql.NullInt64
-	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
-		id, vkey).Scan(&last)
-	if last.Valid && now-last.Int64 < int64(burnWindowMinutes)*60 {
-		return false
-	}
-	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
-		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
-		id, vkey, now)
 	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
-	return true
 }
 
 // SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
 func (s *Store) SweepExpired() {
 	now := time.Now().Unix()
 	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
-	// #4: cans expire too — mirror paste behavior
-	s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
 	grace := now - SoftDeleteGraceDays*86400
 	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
 }
@@ -459,46 +406,13 @@ func (s *Store) HardDelete(id string) {
 	s.db.Exec(`DELETE FROM pastes WHERE id = ?`, id)
 }
 
-// CreateCan inserts a paste_can row with optional custom slug (parity with
+// InsertCan creates a paste_can row.
-// pastes: validated by the same rules, checked against both tables).
+func (s *Store) InsertCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64) error {
-// Returns ErrSlugTaken / ErrInvalidSlug / ErrReservedSlug on conflict.
-func (s *Store) CreateCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64, customSlug *string) error {
-	if customSlug != nil && *customSlug != "" {
-		slug := *customSlug
-		if err := ValidateCustomSlug(slug); err != nil {
-			return err
-		}
-		taken, err := s.SlugTaken(slug)
-		if err != nil {
-			return err
-		}
-		if taken {
-			return ErrSlugTaken
-		}
-		canID = slug
-	}
-	if visibility == "" {
-		visibility = "public"
-	}
-	if visibility != "public" && visibility != "unlisted" {
-		return errors.New("visibility must be public or unlisted")
-	}
 	_, err := s.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
 		VALUES (?,?,?,?,?,?,?)`, canID, title, description, visibility, pwHash, createdAt, expiresAt)
 	return err
 }
 
-// SoftDeleteCan marks a can deleted (its items stay; they are unlisted and
-// hidden from listings by can_id and disappear with the can's page).
-func (s *Store) SoftDeleteCan(canID string) (bool, error) {
-	res, err := s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), canID)
-	if err != nil {
-		return false, err
-	}
-	n, err := res.RowsAffected()
-	return n > 0, err
-}
-
 // DeleteCan removes an (empty/aborted) can row.
 func (s *Store) DeleteCan(canID string) {
 	s.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
@@ -517,10 +431,10 @@ func (s *Store) InsertCanItem(canID, title, content, contentType string, languag
 }
 
 func (s *Store) GetCan(id string) (*CanRow, error) {
-	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at, description, viewer_id
+	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at
-		FROM paste_cans WHERE (id = ?) AND deleted_at IS NULL`, id)
+		FROM paste_cans WHERE id = ? AND deleted_at IS NULL`, id)
 	var c CanRow
-	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt, &c.Description, &c.ViewerID)
+	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}

internal/web/securityheaders_test.go

@@ -0,0 +1,56 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #59: SecurityHeaders must add the CSP and hardening headers to rendered
+// HTML responses only; JSON and /raw responses pass through untouched.
+func TestSecurityHeaders(t *testing.T) {
+	pages := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Write([]byte("<html><body>ok</body></html>"))
+	})
+	h := SecurityHeaders(pages)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
+		t.Errorf("CSP = %q, want %q", got, wantCSP)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
+		t.Errorf("Referrer-Policy = %q, want no-referrer", got)
+	}
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+
+	// JSON response: no security headers.
+	jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	rec = httptest.NewRecorder()
+	jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); got != "" {
+		t.Errorf("unexpected CSP %q on JSON response", got)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "" {
+		t.Errorf("unexpected Referrer-Policy %q on JSON response", got)
+	}
+
+	// Content type set after the first Write (as the inline can page does) is
+	// still picked up because headers are inspected post-handler.
+	lateh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("<html></html>"))
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	}))
+	rec = httptest.NewRecorder()
+	lateh.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "frame-ancestors 'none'") {
+		t.Errorf("CSP = %q, want frame-ancestors 'none'", got)
+	}
+}

internal/web/static/app.css

@@ -165,20 +165,6 @@ body {
 .settings-head { padding: 12px 18px; border-bottom: 1px solid var(--border); }
 .settings-head h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
 .settings-body { padding: 16px 18px; color: var(--muted-fg); font-size: 21.6px; }
-.settings-section-title { color: var(--fg); font-size: 24px; margin-bottom: 6px; }
-/* theme switcher cards (#100) */
-.theme-grid { display: flex; flex-wrap: wrap; gap: 14px; margin-top: 14px; }
-.theme-card {
-  display: flex; flex-direction: column; gap: 10px; align-items: flex-start;
-  padding: 14px 16px; min-width: 180px;
-  background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius);
-  color: var(--fg); font: inherit; font-size: 20px; cursor: pointer;
-}
-.theme-card:hover { border-color: var(--muted); }
-.theme-card[aria-pressed="true"] { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
-.theme-card .swatches { display: flex; gap: 4px; }
-.theme-card .swatch { width: 26px; height: 26px; border-radius: 6px; border: 1px solid rgba(255,255,255,.15); }
-.theme-name { font-weight: 600; }
 .iconbtn:hover { color: var(--fg); border-color: var(--muted); }
 .iconbtn.danger:hover { color: #ff8fa3; border-color: #ff8fa3; }
 .code-head {
@@ -215,10 +201,6 @@ th {
   text-align: left; font-size: 18.9px; text-transform: uppercase; letter-spacing: .08em;
   color: var(--muted-fg); padding: 10px 16px; border-bottom: 1px solid var(--border); font-weight: 600;
 }
-/* #92: the sort-ind span is absolutely positioned in the cell's right gutter,
-   so it can't shift the header label right of the data cells. */
-th.sortable { cursor: pointer; user-select: none; position: relative; padding-right: 34px; }
-th.sortable .sort-ind { position: absolute; right: 12px; top: 50%; transform: translateY(-50%); margin-left: 0; }
 td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 tr:last-child td { border-bottom: none; }
 tr.row { cursor: pointer; }
@@ -474,16 +456,3 @@ th.sorted.desc .sort-ind { border-top: 6px solid var(--accent); }
   .unlock-err { font-size: 13px; }
   .center .foot { font-size: 13px; }
 }
-
-/* #4: can view page + can builder */
-.can-page h1 { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
-.can-items { display: flex; flex-direction: column; gap: 12px; margin-top: 14px; }
-.can-item { padding: 12px 14px; }
-.can-item-head { display: flex; align-items: center; gap: 10px; }
-.can-item-head strong { flex: 1; word-break: break-all; }
-.can-item-body { margin-top: 8px; }
-.can-item-body summary { cursor: pointer; font-size: 19px; color: var(--muted, #888); }
-.can-item-body pre.code { margin: 8px 0 0; overflow-x: auto; }
-.can-item-row { margin-top: 8px; }
-.can-item-row .can-item-title { width: 100%; margin-bottom: 6px; }
-.can-item-row .can-item-content { width: 100%; font-family: var(--mono, monospace); resize: vertical; }

internal/web/static/table.js

@@ -63,7 +63,7 @@ const PaletteTable = (() => {
         const filtered = state.filter.length > 0;
         const off = (state.page - 1) * opts.perPage;
         const url = (filtered || state.sortKey)
-          ? opts.endpoint + '?limit=500&offset=0'
+          ? opts.endpoint + '?limit=' + (opts.fetchLimit || 100) + '&offset=0'
           : opts.endpoint + '?limit=' + opts.perPage + '&offset=' + off;
         const res = await fetch(url);
         const data = await res.json();

internal/web/templates/can.html

@@ -1,36 +0,0 @@
-{{template "head" .}}
-{{template "topbar" .}}
-<div class="center">
-  <div class="float can-page" style="max-width:900px; width:100%;">
-    <div class="inner">
-      <h1>{{.Title}} <span class="badge" title="This is a can — a bundle of pastes">can</span></h1>
-      {{if .HasDescription}}<p class="sub">{{.Description}}</p>{{end}}
-      <p class="hint">{{.ItemCount}} item{{if ne .ItemCount 1}}s{{end}} · {{.SizeHuman}} · created <span data-ts="{{.CreatedAtUnix}}">{{.CreatedAgo}}</span>{{if .ExpiresAt}} · expires in {{.ExpiresIn}}{{end}}{{if .HasPassword}} · password protected{{end}}</p>
-
-      <div class="can-items">
-        {{range .Items}}
-        <div class="can-item float">
-          <div class="can-item-head">
-            <strong>{{.Title}}</strong>
-            <span class="dim">{{.Size}}</span>
-            {{if .IsFile}}
-              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" download="{{.Title}}" title="Download file" aria-label="Download {{.Title}}">↓</a>
-            {{else}}
-              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" title="Raw item" aria-label="Raw {{.Title}}">⧉</a>
-            {{end}}
-          </div>
-          {{if not .IsFile}}
-          <details class="can-item-body">
-            <summary>Show content</summary>
-            <pre class="code"><code>{{.ContentHTML}}</code></pre>
-          </details>
-          {{else}}
-          <div class="hint">Attached file — use the download button above.</div>
-          {{end}}
-        </div>
-        {{end}}
-      </div>
-    </div>
-  </div>
-</div>
-{{template "foot" .}}

internal/web/templates/history.html

@@ -36,8 +36,8 @@ const t = PaletteTable.init({
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
+      ? `${t.esc(it.title)}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim">${it.view_count}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/mine.html

@@ -21,10 +21,6 @@
     </table>
     <div class="empty" id="empty" style="display:none">No pastes from this browser yet.</div>
   </div>
-  <div class="pager float">
-    <span id="showing"></span>
-    <div class="pg" id="pg"></div>
-  </div>
 </div>
 <script src="/static/table.js"></script>
 <script>
@@ -42,13 +38,13 @@ function toast(msg, kind) {
 
 const t = PaletteTable.init({
   endpoint: '/api/mine',
-  perPage: 25,
+  perPage: 50,
-  hasPager: true,
+  hasPager: false,
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
+      ? `${t.esc(it.title)}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/new.html

@@ -68,15 +68,6 @@
       <input type="text" id="custom" class="custom-input" placeholder="/my-snippet">
       <div class="hint" style="margin-top:6px; font-size:19px;">Stays reserved while the paste exists</div>
     </div>
-    <div class="float side-section">
-      <h3>Can contents</h3>
-      <label class="toggle"><input type="checkbox" id="iscan"> Bundle as a can (multiple text items)</label>
-      <div class="pw-row" id="canrow" style="display:none">
-        <div id="can-items"></div>
-        <button class="btn btn-icon" id="can-add" type="button" title="Add item" style="margin-top:6px">+ Add item</button>
-        <div class="hint" style="margin-top:6px; font-size:19px;">Each item gets its own card on the can page. File uploads in cans come later.</div>
-      </div>
-    </div>
     <div class="float side-section" id="result-card" style="display:none">
       <h3>Result</h3>
       <div class="hint" id="result" style="word-break:break-all">empty</div>
@@ -154,21 +145,6 @@ $('pwreveal').addEventListener('click', () => {
   $('pwreveal').title = show ? 'Hide password' : 'Show password';
 });
 
-// #4: can builder — multiple text items bundled into one shareable page.
-// The main editor becomes the first item; extra items are added below.
-$('iscan').addEventListener('change', e => {
-  $('canrow').style.display = e.target.checked ? 'block' : 'none';
-  if (e.target.checked && !$('can-items').children.length) addCanItem();
-});
-function addCanItem() {
-  const row = document.createElement('div');
-  row.className = 'can-item-row';
-  row.innerHTML = '<input class="can-item-title" placeholder="Item title">' +
-    '<textarea class="can-item-content" placeholder="Item content" rows="3" spellcheck="false"></textarea>';
-  $('can-items').appendChild(row);
-}
-$('can-add').addEventListener('click', addCanItem);
-
 let guessed = ''; // last auto-detected language, '' = user override
 
 function showResult(html, isError) {
@@ -221,9 +197,6 @@ $('reguess').addEventListener('click', guessLang);
 content.addEventListener('paste', () => setTimeout(guessLang, 0));
 
 async function create() {
-  // #4: can mode — bundle the editor + extra items into a can via multipart
-  if ($('iscan').checked) return createCan();
-
   const body = {
     content: content.value,
     title: $('title').value || null,
@@ -279,62 +252,6 @@ async function create() {
   location.href = dest;
 }
 $('create').addEventListener('click', create);
-
-// #4: can creation — POST multipart to /api/pastes/can. The main editor is
-// the first item; each extra can-item row is another text item.
-async function createCan() {
-  const items = [];
-  if (content.value.trim()) {
-    items.push({title: $('title').value || 'main', content: content.value, language: $('language').value || ''});
-  }
-  document.querySelectorAll('#can-items .can-item-row').forEach(row => {
-    const t = row.querySelector('.can-item-title').value.trim();
-    const c = row.querySelector('.can-item-content').value;
-    if (c.trim()) items.push({title: t || ('item-' + (items.length + 1)), content: c});
-  });
-  if (!items.length) { toast('Nothing to put in the can', 'error'); return; }
-
-  const fd = new FormData();
-  fd.append('title', $('title').value || 'Untitled can');
-  fd.append('json_items', JSON.stringify(items));
-  if ($('haspw').checked) fd.append('password', $('password').value);
-  if ($('unlisted').checked) fd.append('visibility', 'unlisted');
-  const exp = document.querySelector('input[name="exp"]:checked').value;
-  if (exp === 'custom') {
-    const dur = composeCustomExpiry();
-    if (dur === null) { toast('Check the custom expiry', 'error'); return; }
-    if (dur) fd.append('expires_in', dur);
-  } else if (exp) {
-    fd.append('expires_in', exp);
-  }
-  if ($('custom').value.trim()) fd.append('custom_slug', $('custom').value.trim());
-
-  const res = await fetch('/api/pastes/can', {method: 'POST', body: fd});
-  const data = await res.json();
-  if (!res.ok) {
-    showResult('Error: ' + (data.error || res.status), true);
-    toast('Can create failed', 'error');
-    return;
-  }
-  const url = location.origin + data.url;
-  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', false);
-  const copyBtn = document.getElementById('result-copy');
-  copyBtn.addEventListener('click', () => {
-    try {
-      navigator.clipboard.writeText(url);
-      copyBtn.classList.add('ok');
-      copyBtn.textContent = 'Success!';
-      setTimeout(() => { copyBtn.classList.remove('ok'); copyBtn.textContent = '⧉'; }, 2000);
-    } catch(e) { toast('Copy failed', 'error'); }
-  });
-  // password-protected can: unlock now with the password we already have (#26 parity)
-  if ($('haspw').checked && data.id) {
-    const pd = new FormData();
-    pd.append('password', $('password').value);
-    try { await fetch('/can/' + data.id, {method: 'POST', body: pd}); } catch(e) {}
-  }
-  location.href = data.url;
-}
 // reset stale result state when returning via Back (bfcache) (#28)
 window.addEventListener('pageshow', e => {
   if (!e.persisted) return;

internal/web/web.go

@@ -34,7 +34,6 @@ type UI struct {
 func New() (*UI, error) {
 	funcs := template.FuncMap{
 		"humanSize": humanSize,
-		"version":   func() string { return Version }, // #93: topbar version label
 	}
 	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "templates/*.html")
 	if err != nil {
@@ -65,29 +64,6 @@ func (h *Handlers) renderPage(w http.ResponseWriter, name string, data any) {
 	}
 }
 
-// RenderPage is the exported wrapper used by the api package (#4 can pages).
-func (h *Handlers) RenderPage(w http.ResponseWriter, name string, data any) {
-	h.renderPage(w, name, data)
-}
-
-// WriteRateLimited is the exported rate-limit response used by the api package (#4).
-func (h *Handlers) WriteRateLimited(w http.ResponseWriter, retryAfterSecs int) {
-	h.writeRateLimited(w, retryAfterSecs)
-}
-
-// UnlockToken returns the per-id HMAC unlock token (cookie value, #34).
-// Exported for the api package so can pages share paste cookie semantics (#4).
-func UnlockToken(id string) string { return unlockToken(id) }
-
-// AgoString formats a relative "N ago" string (exported for the api package, #4).
-func AgoString(ts int64) string { return agoString(ts) }
-
-// HumanSize formats a byte count as a human string (exported for the api package, #4).
-func HumanSize(n int) string { return humanSize(n) }
-
-// ExpiryString formats remaining time until an epoch seconds expiry (#4).
-func ExpiryString(expiresAt int64) string { return expiryString(expiresAt) }
-
 // #34: per-paste unlock tokens. unlockSecret is generated once at startup
 // (also derivable from PALETTE_UNLOCK_SECRET for multi-instance deploys) and
 // used to HMAC paste ids, so a client can only hold a valid pw_<id> cookie by
@@ -269,13 +245,12 @@ func (h *Handlers) HandlePasteView(w http.ResponseWriter, r *http.Request) {
 		// one-time display of the deletion token via the created banner
 		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
 	}
-	// Count the view for real page renders, deduped per-viewer within the
+	// Count the view for every real page render. Raw views increment in
-	// burn window (#95): a reload by the same vwr cookie doesn't inflate
+	// handleRaw; the HTML path was missing its increment, so view_count only
-	// view_count. Raw views increment unconditionally in handleRaw (#49); the
+	// ever moved via /raw and the API-stored count stayed at 0 (#33).
-	// HTML path was missing its increment originally (#33). The just-created
+	// The just-created banner render does not count as a view.
-	// banner render does not count as a view.
 	if !justCreated {
-		h.Store.IncrementViews(row.ID, h.ViewerID(r), h.BurnWindowMin())
+		h.Store.IncrementViews(row.ID)
 	}
 	// #49: burn-after-N-reads budget (per-viewer dedupe window).
 	// Just-created first render does not count as a read for the creator.
@@ -304,16 +279,7 @@ func (h *Handlers) HandleHistoryPage(w http.ResponseWriter, r *http.Request) {
 
 // HandleSettingsPage serves /settings.
 func (h *Handlers) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
-	// #100: theme presets. Midnight is the default (no data-preset attribute),
+	h.renderPage(w, "settings.html", map[string]any{"Page": "settings"})
-	// so its swatches are hardcoded here; the CSS defines the token values.
-	themes := []map[string]any{
-		{"Name": "midnight", "Label": "Midnight", "Swatches": []string{"#241B30", "#2D2340", "#3A2D52", "#C4A8F0", "#F2EDF8"}},
-		{"Name": "smooth", "Label": "Smooth", "Swatches": []string{"#F6F5FA", "#FFFFFF", "#DAD7E6", "#7A7796", "#2A2A36"}},
-		{"Name": "pastel-lavender", "Label": "Pastel Lavender", "Swatches": []string{"#e6e0f5", "#f1edfa", "#cbb8e7", "#806bb8", "#3E3059"}},
-		{"Name": "pastel-peach", "Label": "Pastel Peach", "Swatches": []string{"#ffe0d6", "#fff0ea", "#ffc4a8", "#f9826c", "#4F2318"}},
-		{"Name": "pastel-cloud", "Label": "Pastel Cloud", "Swatches": []string{"#fff0f6", "#fff7fb", "#ffc8dd", "#a2d2ff", "#4A3355"}},
-	}
-	h.renderPage(w, "settings.html", map[string]any{"Page": "settings", "Themes": themes})
 }
 
 // HandleMinePage serves /mine.
@@ -328,3 +294,23 @@ func (h *Handlers) HandleAdminPage(w http.ResponseWriter, r *http.Request) {
 
 // Handlers builds a web.Handlers bound to this UI.
 func (u *UI) Handlers() *Handlers { return &Handlers{UI: u} }
+
+// #59: security headers for rendered HTML pages. Applied wherever the
+// response is text/html (page templates and the inline can page); JSON API
+// responses and /raw content pass through untouched. script-src allows
+// 'unsafe-inline' because the page templates carry inline scripts; CSP
+// default-src 'self' still blocks external content and object/frame embeds,
+// and frame-ancestors 'none' closes the clickjacking gap flagged in the #34
+// pentest. Runs after the handler so the Content-Type is already set.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+		h := w.Header()
+		if strings.HasPrefix(h.Get("Content-Type"), "text/html") {
+			h.Set("Content-Security-Policy",
+				"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			h.Set("Referrer-Policy", "no-referrer")
+			h.Set("X-Content-Type-Options", "nosniff")
+		}
+	})
+}