Merge pull request 'Release v0.5.0: dev -> main' (#288 ) from dev into main

Merge pull request 'Sync main into dev (owner README edit #279 )' (#290 ) from dev-main-sync into dev
2026-09-18 01:49:23 +00:00 · 2026-09-18 01:48:43 +00:00 · 2026-09-17 20:46:42 -05:00 · 2026-09-18 01:35:15 +00:00 · 2026-09-18 01:33:45 +00:00 · 2026-09-17 20:31:57 -05:00
5 changed files with 79 additions and 17 deletions
@@ -31,7 +31,6 @@ a web UI for sharing text and small files.
 | ![Public pastes list](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fdesktop-public.png) | ![Settings and theme picker](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fdesktop-settings-themes.png) |


-Mobile previews (375x812): [editor](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmobile-editor-new.png), [paste view (dark)](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmobile-paste-midnight-dark.png), [paste view (light)](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmobile-paste-pastel-peach-light.png), [public list](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmobile-public.png), [settings](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmobile-settings.png).

 ## Get Started

@@ -91,17 +91,6 @@ func (l *limitReader) Read(p []byte) (int, error) {
 	return n, err
 }

-// isImageMime reports whether the sniffed mime is a raster image the viewer
-// can render inline (#221). SVG is excluded: it is forced to text/plain on
-// serving by the active-content rule and must never render as an image.
-func isImageMime(mime string) bool {
-	switch mime {
-	case "image/png", "image/jpeg", "image/gif", "image/webp":
-		return true
-	}
-	return false
-}
-
 // handleCreatePasteMultipart implements POST /api/pastes with
 // multipart/form-data (#38). Fields mirror the JSON create path; a 'file'
 // part makes the paste a file paste (1 file = 1 paste: if text content is
@@ -306,3 +306,64 @@ func TestMultipartPasswordFieldAccepted(t *testing.T) {
 		t.Fatalf("paste should require password, got %d", rec2.Code)
 	}
 }
+
+// #281: /raw/{id} must stream the attachment blob for ALL attachment mimes,
+// not just raster images (the old isImageMime gate left non-image
+// attachments serving an empty body from row.Content).
+func TestRawStreamsNonImageAttachment(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	body := []byte("hello, this is a plain text attachment body")
+	rec, resp := multipartCreate(t, h, "notes.txt", body, nil)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body.String())
+	}
+	if resp["attachment"] == nil {
+		t.Fatalf("no attachment in response: %v", resp)
+	}
+	id, _ := resp["id"].(string)
+
+	req := httptest.NewRequest("GET", "/raw/"+id, nil)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req)
+	if rec2.Code != 200 {
+		t.Fatalf("raw: %d %s", rec2.Code, rec2.Body.String())
+	}
+	if got := rec2.Header().Get("Content-Type"); got != "text/plain; charset=utf-8" {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	if got := rec2.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Fatalf("nosniff = %q", got)
+	}
+	if !bytes.Equal(rec2.Body.Bytes(), body) {
+		t.Fatalf("raw bytes differ: got %d bytes want %d", rec2.Body.Len(), len(body))
+	}
+}
+
+// #281: active-content attachment types still get forced to text/plain on
+// /raw, same rule as the /f/ serving path (#34).
+func TestRawHtmlAttachmentServesAsPlainText(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	html := []byte("<html><body><script>alert(1)</script></body></html>")
+	rec, resp := multipartCreate(t, h, "page.html", html, nil)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body.String())
+	}
+	id, _ := resp["id"].(string)
+
+	req := httptest.NewRequest("GET", "/raw/"+id, nil)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req)
+	if rec2.Code != 200 {
+		t.Fatalf("raw: %d %s", rec2.Code, rec2.Body.String())
+	}
+	if got := rec2.Header().Get("Content-Type"); got != "text/plain; charset=utf-8" {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	if !bytes.Equal(rec2.Body.Bytes(), html) {
+		t.Fatal("raw bytes differ from upload")
+	}
+}
@@ -501,15 +501,18 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "not found", 404)
 		return
 	}
-	// #221: raw view of an image paste serves the image bytes themselves as
-	// an image, not the (empty) text content.
-	if att, err := a.store.GetAttachmentForPaste(row.ID); err == nil && att != nil && isImageMime(att.Mime) {
+	// #221: raw view of a paste backed by an attachment serves the stored
+	// blob bytes with the sniffed mime, not the (empty) text content — for
+	// ALL attachment mimes (#281); /raw/{id} is the raw fetch for the file
+	// too. serveContentType still forces active-content types (html, svg,
+	// xml) to text/plain per the #34 rule below.
+	if att, err := a.store.GetAttachmentForPaste(row.ID); err == nil && att != nil {
 		blobs := a.store.Blobs()
 		if blobs != nil {
 			if blob, err := blobs.Get(row.ID + "/" + att.SHA256); err == nil {
 				defer blob.Close()
 				a.store.IncrementViews(row.ID, "", 0) // raw views always count (#49/#95)
-				w.Header().Set("Content-Type", att.Mime)
+				w.Header().Set("Content-Type", serveContentType(att.Mime))
 				w.Header().Set("X-Content-Type-Options", "nosniff")
 				w.Header().Set("Content-Length", fmt.Sprintf("%d", att.Size))
 				http.ServeContent(w, r, "", time.Unix(att.CreatedAt, 0), blob)
@@ -38,4 +38,14 @@
  window.addEventListener('resize', refresh);
  if (scroller !== window && scroller) scroller.addEventListener('input', refresh);
  refresh();
+  /* #282: the first evaluation can run before the layout settles (media
+     queries, web fonts, async highlighting) and under-measure the content,
+     leaving the nav hidden on long pages. Re-check once a real layout exists
+     and after load; the ResizeObserver also catches late content growth. */
+  requestAnimationFrame(function () { requestAnimationFrame(refresh); });
+  window.addEventListener('load', refresh);
+  window.setTimeout(refresh, 300);
+  if (window.ResizeObserver && scroller === window && document.body) {
+    new ResizeObserver(refresh).observe(document.body);
+  }
 })();
Author	SHA1	Message	Date
fen	cb1b16ae41	Merge pull request 'Release v0.5.0: dev -> main' (#288 ) from dev into main CI / test (push) Successful in 26s Details CI / docker (push) Successful in 46s Details	2026-09-18 01:49:23 +00:00
fen	880f3cd958	Merge pull request 'Sync main into dev (owner README edit #279 )' (#290 ) from dev-main-sync into dev CI / test (push) Successful in 26s Details CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details CI / docker (push) Successful in 46s Details	2026-09-18 01:48:43 +00:00
fen	1149989d07	Merge pull request 'Release v0.5.0: dev -> main' (#288 ) from dev into main CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details # Conflicts: # README.md	2026-09-17 20:46:42 -05:00
fen	ed435c5e13	Merge pull request 'Fix #282 : jumpnav visible on mobile initial load' (#285 ) from fix-282 into dev CI / test (push) Successful in 28s Details CI / docker (push) Successful in 46s Details CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details	2026-09-18 01:35:15 +00:00
fen	c190dd9ea6	Merge pull request '#281 : /raw/{id} returns empty body for non-image attachment pastes (Fix attempt 1)' (#286 ) from fix-281 into dev CI / test (push) Successful in 32s Details CI / docker (push) Successful in 43s Details	2026-09-18 01:33:45 +00:00
fen	8901a3c82c	#281 : /raw streams attachment blob for all attachment mimes CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details handleRaw only streamed the blob behind an isImageMime gate (#221), so non-image attachment pastes fell through to empty row.Content and /raw served 0 bytes. Serve the blob for every attachment mime, passing the sniffed mime through serveContentType so active-content types (html, svg, xml) still serve as text/plain per the #34 rule. Regression tests cover text and html attachments (size, Content-Type, byte equality).	2026-09-17 20:31:57 -05:00
fen	3460d54fce	Fix #282 : re-evaluate jumpnav visibility after layout settles on load CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details The initial refresh() ran before the mobile layout settled (media queries, fonts, async highlighting) and under-measured the content, leaving #jumpnav hidden on long pastes at 375x812 until a resize event. Re-check after a double rAF, on window load, after 300ms, and via a ResizeObserver on document.body for late content growth. Editor textarea scroller unchanged.	2026-09-17 20:30:04 -05:00
poslop	bc52f0a608	Merge pull request 'Update README.md' (#279 ) from poslop-patch-1 into main CI / test (push) Successful in 24s Details CI / docker (push) Skipped Details Reviewed-on: #279	2026-09-18 01:21:36 +00:00
poslop	84d19556fc	Update README.md CI / test (pull_request) Successful in 27s Details CI / docker (pull_request) Skipped Details	2026-09-18 01:21:27 +00:00