Merge pull request 'docs: attachments & storage backend design (#38, #31)' (#69) from issue-38-31-storage-design into main

- DELETE now demands the create-time deletion token (Authorization
  header: Bearer/Token/bare, or ?token= query param), compared with
  the constant-time store.DeletionTokenEqual. 403 otherwise.
- Creator-browser deletes via the /mine button (matching vwr cookie,
  #37) remain allowed; other browsers and plain API clients get 403.
- Regression tests: no token, wrong token (header+query), correct
  token (header+query), creator-cookie path, token extraction.
- Adapted TestSoftDelete to pass the deletion token.
- docs/API.md delete section updated.
- Based on #58's SoftDelete (bool, error) signature.

.gitea/workflows/ci.yml

@@ -36,6 +36,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install Docker CLI
+        run: |
+          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz -o /tmp/docker.tgz             && tar -xzf /tmp/docker.tgz -C /tmp && mv /tmp/docker/docker /usr/local/bin/docker && chmod +x /usr/local/bin/docker
+
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
 

.gitignore

@@ -1,4 +1,6 @@
-palette
+/palette
 palette.db
 palette.db-shm
 palette.db-wal
+admin-key
+settings.json

Dockerfile

@@ -9,7 +9,7 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /palette .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /palette ./cmd/palette
 
 # ---- runtime stage ----
 FROM alpine:3.20

README.md

@@ -1,109 +1,93 @@
 # Palette
 
-Fast, self-hosted pastebin with paste cans, password lock, expiry, custom URLs, and an API-first design.
+Palette is a fast, self-hosted pastebin. One Go binary, a SQLite database, and
+a web UI for sharing code and text with links that expire on your terms.
 
-## Quick start
+## Features
+
+- Paste cans — bundle notes, text, and files into one shareable page
+- Password lock — protect individual pastes with a password
+- Custom expiry — from 1 minute up to 1 year, or never
+- Burn after N reads — a paste that vanishes after a chosen number of reads
+- Custom URLs — reserve `/my-snippet` instead of a random slug
+- Syntax highlighting with language auto-detection (go-enry)
+- Rate limiting on create and unlock
+- Saved page — see and manage everything created from your browser
+- API-first — every UI action is also a plain HTTP call
+- Single binary — templates and assets are embedded; no external deps
+
+## Get Started
+
+### Build from source
+
+Requires Go 1.21+.
 
 ```bash
 go build -o palette .
 ./palette
-# UI at http://localhost:8080
+# open http://localhost:8080
 ```
 
-## Docker
+### Docker
 
 ```bash
-docker build -t palette .
+docker run -p 8080:8080 -v palette-data:/data git.archfox.org/poslop/palette
-docker run -p 8080:8080 -v palette-data:/data palette
 ```
 
+The SQLite database lives in the `/data` volume inside the container.
+
+## Screenshots
+
+| | |
+|---|---|
+| ![Editor](docs/palette-previews/pastel-lavender-new.png) | ![Paste view](docs/palette-previews/pastel-lavender-paste.png) |
+| ![History](docs/palette-previews/midnight-history.png) | |
+
 ## Configuration
 
-| Env var | Default | Description |
+| Setting | Default | Description |
 |---|---|---|
 | `PALETTE_ADDR` | `:8080` | Listen address |
 | `PALETTE_DB` | `palette.db` | SQLite database path |
 | `PALETTE_MAX_TEXT` | `5242880` | Max paste size in bytes (5 MB) |
 | `PALETTE_MAX_ITEM` | `26214400` | Max can item size in bytes (25 MB) |
+| `PALETTE_ADMIN_KEY` | generated | Admin key; if unset a 32-char hex key is generated and persisted to `<db-dir>/admin-key` (0600) |
+
+### Admin
+
+`GET /admin` serves the admin page. Enter the admin key there — it is stored in
+`sessionStorage` (never a cookie) and sent as the `X-Admin-Key` header on
+`GET`/`POST /admin/api/settings`.
+
+The admin API reads/sets: rate-limit burst, rate-limit refill per minute, max
+content bytes, default expiry, custom URL reservation days, and the burn
+viewer window (minutes). All admin access attempts are logged.
+
+```bash
+./palette --reset-admin-key   # regenerate the admin key and print it
+```
 
 ## API
 
-### Create paste
+Create a paste with one call:
+
 ```bash
 curl -X POST http://localhost:8080/api/pastes \
   -H "Content-Type: application/json" \
-  -d '{
+  -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
-    "content": "print(hello)",
-    "title": "my snippet",
-    "language": "python",
-    "expires_in": "168h",
-    "password": "optional",
-    "custom_slug": "optional",
-    "burn_after_read": false,
-    "visibility": "public"
-  }'
 ```
 
-Response includes `id`, `url`, `raw_url`, `api_url`, and a one-time `deletion_token`.
+Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
 
-### Get paste
+## Performance Notes
-```bash
-curl http://localhost:8080/api/pastes/{id}
-# password-protected pastes:
-curl "http://localhost:8080/api/pastes/{id}?password=secret"
-# or via header: X-Paste-Password: secret
-```
 
-### Raw content
+The history and Saved pages use client-side filtering: when you type in the
-```bash
+search box, the UI fetches the most recent 100 pastes (`limit=100`, the API
-curl http://localhost:8080/raw/{id}
+maximum) once per query and filters/sorts them in the browser. Pastes beyond
-```
+the newest 100 are not searched; a match count against the full total is still
-
+shown. This keeps search instant without a server-side query. If large
-### Soft delete
+instances need full search later, it will be a server-side endpoint (see
-```bash
+issue #32).
-curl -X DELETE http://localhost:8080/api/pastes/{id}
-```
-
-### Hard delete (requires deletion token)
-```bash
-curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"
-```
-
-### Public history
-```bash
-curl "http://localhost:8080/api/public?limit=25&offset=0"
-```
-
-### Create can (bundle of items)
-```bash
-curl -X POST http://localhost:8080/api/pastes/can \
-  -F "title=My bundle" \
-  -F "expires_in=48h" \
-  -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
-  -F "files=@screenshot.png" \
-  -F "files=@log.txt"
-```
-
-### Get can + items
-```bash
-curl http://localhost:8080/api/cans/{id}
-curl http://localhost:8080/api/cans/{id}/items/{item_id}
-```
-
-## Expiry and deletion
-
-- Expired pastes are soft-deleted by a background sweeper (runs every minute).
-- Soft-deleted pastes are hard-deleted after a 7-day grace period.
-- Deletion tokens allow immediate hard delete.
-- Burn-after-read pastes are soft-deleted on first read.
-
-## Web pages
-
-- `/new` — create a paste
-- `/history` — public paste history
-- `/{id}` — view a paste
-- `/unlock/{id}` — password gate for protected pastes
-- `/raw/{id}` — raw content with original content type
 
 ## CI
 

burn.go

@@ -1,103 +0,0 @@
-package main
-
-import (
-	"crypto/rand"
-	"crypto/subtle"
-	"database/sql"
-	"encoding/base64"
-	"net/http"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-)
-
-// genDeletionToken returns a 32-char url-safe random token
-func genDeletionToken() string {
-	b := make([]byte, 24)
-	rand.Read(b)
-	return base64.RawURLEncoding.EncodeToString(b)
-}
-
-// readWindowMinutes is the per-viewer dedupe window for burn-after-N-reads
-// (#49): the same viewer cookie returning within 15 minutes does not count
-// as a new read. See the decision comment on issue #49.
-const readWindowMinutes = 15
-
-// timeNow is overridable in tests to inject the clock.
-var timeNow = time.Now
-
-// registerRead applies the burn-after-read budget for one view (#49).
-// For pastes with reads_limit set: the viewer's paste_views row is checked;
-// a view within readWindowMinutes of the viewer's last view is deduped
-// (count=false). Otherwise reads_used is incremented, and the paste is
-// soft-deleted (burned) once reads_used reaches reads_limit. Viewers without
-// a cookie (plain API clients) count as their own viewer id "".
-// For legacy plain burn_after_read pastes (no reads_limit), any read burns.
-// Returns the number of reads remaining (0 when burned), or nil when no
-// budget is set. view_count is tracked separately and unaffected.
-func (s *Store) registerRead(row *PasteRow, viewerID string) (remaining *int, count bool) {
-	if !row.ReadsLimit.Valid {
-		if row.BurnAfterRead {
-			s.SoftDelete(row.ID)
-			r := 0
-			return &r, true
-		}
-		return nil, false
-	}
-	now := timeNow().Unix()
-	var last sql.NullInt64
-	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
-		row.ID, viewerID).Scan(&last)
-	if last.Valid && now-last.Int64 < readWindowMinutes*60 {
-		r := int(row.ReadsLimit.Int64) - row.ReadsUsed
-		if r < 0 {
-			r = 0
-		}
-		return &r, false
-	}
-	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
-		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
-		row.ID, viewerID, now)
-	used := row.ReadsUsed + 1
-	s.db.Exec(`UPDATE pastes SET reads_used=? WHERE id=?`, used, row.ID)
-	if int64(used) >= row.ReadsLimit.Int64 {
-		s.SoftDelete(row.ID)
-	}
-	r := int(row.ReadsLimit.Int64) - int(used)
-	if r < 0 {
-		r = 0
-	}
-	return &r, true
-}
-
-// burned reports whether a read-limited paste has exhausted its budget.
-func (row *PasteRow) burned() bool {
-	return row.ReadsLimit.Valid && int64(row.ReadsUsed) >= row.ReadsLimit.Int64
-}
-
-func deletionTokenEqual(stored, given string) bool {
-	return subtle.ConstantTimeCompare([]byte(stored), []byte(given)) == 1
-}
-
-// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
-// DELETE /api/pastes/{id}/redeem?token=...
-func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	token := r.URL.Query().Get("token")
-	if token == "" {
-		writeErr(w, 400, "token required")
-		return
-	}
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	if row.DeletionToken.String == "" || !deletionTokenEqual(row.DeletionToken.String, token) {
-		writeErr(w, 403, "invalid token")
-		return
-	}
-	// hard delete: pastes table row goes away entirely
-	a.store.db.Exec(`DELETE FROM pastes WHERE id = ?`, row.ID)
-	writeJSON(w, 200, map[string]string{"status": "deleted"})
-}

cmd/palette/main.go

@@ -0,0 +1,48 @@
+// Command palette is the palette pastebin server entrypoint: flag parsing
+// and wiring of the store, API, and web packages.
+package main
+
+import (
+	"log"
+	"os"
+	"net/http"
+	"time"
+
+	"palette/internal/api"
+	"palette/internal/store"
+	"palette/internal/web"
+)
+
+func main() {
+	// #40: --reset-admin-key regenerates the admin key and exits.
+	if len(os.Args) > 1 && os.Args[1] == "--reset-admin-key" {
+		api.HandleResetAdminKey(api.EnvOr("PALETTE_DB", "palette.db"))
+		return
+	}
+	cfg := api.Config{
+		Addr:         api.EnvOr("PALETTE_ADDR", ":8080"),
+		DBPath:       api.EnvOr("PALETTE_DB", "palette.db"),
+		MaxTextBytes: int64(api.EnvIntOr("PALETTE_MAX_TEXT", 5*1024*1024)),
+		MaxItemBytes: int64(api.EnvIntOr("PALETTE_MAX_ITEM", 25*1024*1024)),
+	}
+	st, err := store.OpenStore(cfg.DBPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	adminKey, err := api.ResolveAdminKey(cfg.DBPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+	ss := api.LoadSettingsStore(cfg.DBPath, cfg)
+
+	st.StartSweeper(time.Minute, ss.Get().CustomSlugReservationDays)
+
+	ui, err := web.New()
+	if err != nil {
+		log.Fatal(err)
+	}
+	srv := api.NewServer(st, cfg, ui, ss, adminKey)
+	log.Printf("palette listening on %s", cfg.Addr)
+	log.Fatal(http.ListenAndServe(cfg.Addr, srv.Routes()))
+}

docs/API.md

@@ -0,0 +1,109 @@
+# Palette API
+
+All endpoints are JSON unless noted. The web UI is served from the same port.
+
+## Create paste
+
+```bash
+curl -X POST http://localhost:8080/api/pastes \
+  -H "Content-Type: application/json" \
+  -d '{
+    "content": "print(hello)",
+    "title": "my snippet",
+    "language": "python",
+    "expires_in": "168h",
+    "password": "optional",
+    "custom_slug": "optional",
+    "burn_after_read": false,
+    "burn_after_reads": 1,
+    "visibility": "public"
+  }'
+```
+
+- `expires_in` is a Go duration string (`90m`, `6h`, `336h`). Omit for no expiry.
+- `visibility` is `public` or `unlisted`.
+- `burn_after_reads` sets how many reads the paste survives (default 1 when
+  `burn_after_read` is true). A read is counted per unique viewer session;
+  the same viewer returning within 15 minutes does not count again.
+- Response includes `id`, `url`, `raw_url`, `api_url`, `expires_at`,
+  `created_at`, and a one-time `deletion_token`.
+
+Errors: `400` invalid body/content too large/duplicate slug, `401` password
+required, `404` paste expired/burned/gone, `413` content exceeds max bytes,
+`429` rate limited.
+
+## Get paste
+
+```bash
+curl http://localhost:8080/api/pastes/{id}
+# password-protected pastes:
+curl "http://localhost:8080/api/pastes/{id}?password=secret"
+# or via header: X-Paste-Password: secret
+```
+
+The response includes `reads_remaining` (`null` when no read budget is set).
+
+## Raw content
+
+```bash
+curl http://localhost:8080/raw/{id}
+```
+
+Raw reads count against a burn-after-read budget, same as page views.
+
+## Delete
+
+```bash
+# soft delete (requires the deletion token from the create response)
+curl -X DELETE -H "Authorization: Bearer TOKEN" http://localhost:8080/api/pastes/{id}
+# ...or via query param; the creator browser (viewer cookie) may also delete without a token
+curl -X DELETE "http://localhost:8080/api/pastes/{id}?token=TOKEN"
+
+# hard delete immediately (requires the one-time deletion token)
+curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"
+```
+
+## Lists
+
+```bash
+curl "http://localhost:8080/api/public?limit=25&offset=0"   # public history
+curl http://localhost:8080/api/mine                          # this browser's pastes (viewer cookie)
+```
+
+## Language detection
+
+```bash
+curl -X POST http://localhost:8080/api/guess-language \
+  -H "Content-Type: application/json" \
+  -d '{"content": "package main"}'
+```
+
+## Cans (bundles of items)
+
+```bash
+curl -X POST http://localhost:8080/api/pastes/can \
+  -F "title=My bundle" \
+  -F "expires_in=48h" \
+  -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
+  -F "files=@screenshot.png" \
+  -F "files=@log.txt"
+
+curl http://localhost:8080/api/cans/{id}
+curl http://localhost:8080/api/cans/{id}/items/{item_id}
+```
+
+## Web pages
+
+- `/new` — create a paste
+- `/history` — public paste history
+- `/mine` — pastes created from this browser
+- `/{id}` — view a paste
+- `/unlock/{id}` — password gate for protected pastes
+- `/raw/{id}` — raw content with original content type
+
+## Expiry and deletion
+
+- Expired pastes are soft-deleted by a background sweeper (runs every minute).
+- Soft-deleted pastes are hard-deleted after a 7-day grace period.
+- Deletion tokens allow immediate hard delete.
+- Burn-after-read pastes are soft-deleted once the read budget is exhausted.

docs/design/attachments-storage.md

@@ -0,0 +1,78 @@
+# Attachments & Storage Backend Design (#38, #31)
+
+Status: research/design, no implementation. Consumers: paste cans (#4).
+
+## Part A — Attachments: S3/MinIO vs filesystem-on-volume (#38)
+
+### Options
+
+**Option 1: Filesystem on the k3s PVC (current 5Gi volume).**
+Store blobs under `<data-dir>/attachments/<paste-id>/<n>-<sha256-8>`, metadata in SQLite (paste_id, filename, size, sha256, mime, created_at).
+
+- Pros: zero new infra, zero new credentials, trivial backup (the volume backup job already covers the DB), atomic rename on write, works in dev and prod identically.
+- Cons: volume is size-capped (5Gi today; resizable but bounded); serving large files passes through the app process (no ranged-GET offload); multi-replica later would need RWX volume.
+
+**Option 2: MinIO via S3 API.**
+MinIO is already proven in this homelab (Outline). Store at key `<paste-id>/<n>`; same SQLite metadata row.
+
+- Pros: effectively unbounded capacity, presigned URLs (direct browser download, offloads serving from palette pods), ranged requests free, lifecycle rules could auto-expire orphaned objects.
+- Cons: another credential/secret to manage, another failure mode, MultipartForm still terminates at the palette pod (MinIO only helps *serving*, not *uploading*, unless we do presigned uploads — which breaks the cans multipart flow and the auth/unlock checks), backup now spans two systems.
+
+### Key considerations
+
+- **Upload path is the same either way.** Palette receives `multipart/form-data` (cans need text items + file drops in one request), must enforce auth/password/burn rules server-side. A filesystem backend adds no upload complexity; S3 adds an extra hop (buffer → PUT to MinIO). Streaming straight from `multipart.Reader` to the sink works for both (`io.Copy` to a temp file, or to an S3 PUT with `Content-Length` known or multipart buffering).
+- **Size limits.** Everything is admin-tunable via the settings API (#40 pattern) — add `max_attachment_bytes` (default 10 MiB, hard server-side cap checked *before* reading the body via `Content-Length`, plus a counted reader during copy so chunked uploads can't lie). SQLite itself is not a constraint either way; the PVC is the real cap for Option 1.
+- **MIME handling.** Security-critical (pentest #34 already fixed a content-type XSS on `/raw`). Rules:
+  - Never trust the client-declared Content-Type. Sniff the first 512 bytes (`http.DetectContentType`), intersect with an allowlist.
+  - Serve from a dedicated route (`/{id}/a/{n}`) with `Content-Type` from the stored *sniffed* type, `X-Content-Type-Options: nosniff`, `Content-Security-Policy: sandbox`, `Content-Disposition: attachment` unless the type is on a safe-inline allowlist (text/plain, images, PDF at user opt-in).
+  - Never render user HTML/SVG inline (`image/svg+xml` is XSS-capable — serve as `attachment` always, or store sanitized).
+- **Streaming & serving.**
+  - Filesystem: `http.ServeContent` on the opened file gives ranged GETs, ETag, Last-Modified for free.
+  - MinIO: proxy via `GetObject` + `io.Copy` (simple, keeps auth checks in palette) or presigned GET (faster, but URL embeds credentials-temporarily and bypasses palette's per-request auth — wrong for pastes with passwords/burn semantics). Given cans inherit password/burn parity (#4), **proxying is required, which erodes MinIO's main serving advantage**.
+- **Lifecycle parity.** Attachments must honor soft-delete grace and sweep: sweeper hard-delete also removes blobs (files: `os.Remove`; S3: `DeleteObject`), best-effort with logging; orphan sweep job compares DB rows to store contents.
+
+### Recommendation
+
+**Filesystem-on-volume first.** At current scale (single replica, PVC-based deploy, one user + homelab traffic) it is simpler end-to-end and keeps serving/auth/lifecycle in one place. The internal API should be a narrow blob interface (`Put(ctx, key, r io.Reader, size int64) / Open(key) / Delete(key)`) — about 60 lines per backend — so **MinIO becomes a drop-in later** if attachments outgrow the volume. That's the honest middle path: filesystem default, S3-ready seam, no MinIO dependency until it pays for itself.
+
+## Part B — SQLite vs Postgres vs Redis (#31)
+
+### Assessment of SQLite at pastebin scale
+
+- **Driver**: modernc.org/sqlite (pure Go, no cgo) — slightly slower than mattn/go-sqlite3 but fine; single-writer semantics are the real constraint, not driver speed.
+- **Access pattern**: paste-heavy, write-rare/read-often; primary keys and small set of indexes (visibility+created, expires, deleted); no joins beyond can items. This is SQLite's best case.
+- **WAL mode** is already on (`journal_mode(WAL), busy_timeout(5000)`) — concurrent readers don't block the single writer.
+- **Numbers**: SQLite comfortably handles millions of rows and hundreds of reads/sec; WAL write throughput is thousands of small inserts/sec. A pastebin doing even 100k pastes (avg 10 KB = ~1 GB DB) is trivial. Reads: prepared `WHERE id=?` lookups at this size are sub-millisecond.
+- **Weak points to watch** (document, none urgent):
+  1. Single writer — heavy concurrent create traffic serializes. Mitigation: already rate-limited (#2); fine until that's the bottleneck (unlikely).
+  2. `LENGTH(content)` on every list row — fine now; if it shows up in profiling, store `size` as a column (schema already has a `Size` field; list queries could use it).
+  3. Sweeper runs a table-wide `UPDATE`+`DELETE` on tick — indexed, fine.
+  4. No network access to the DB file — locks palette to single-replica. Acceptable: current deploy is one replica.
+- **Redis is the wrong tool** here: it's a cache/queue, not a system of record. Pastes are durable data with expiry semantics already implemented in SQLite. Redis would only add an optional read-cache layer for hot pastes — pure complexity for zero measured need.
+
+### Should we build a backend abstraction (SQLite default, optional Postgres)?
+
+Arguments for: multi-replica scaling later; "docker image env choice" sounds nice; Postgres gives real concurrency and network access.
+Arguments against: a `Store` interface covering the current query surface is a real refactor (sqlite-flavored SQL: `INSERT OR IGNORE`-style upserts, partial indexes, `?` placeholders are compatible but behaviors differ — e.g. `sqlite` driver pragmas, transaction isolation, `AUTOINCREMENT` semantics); two backends means two test matrices and two migration paths forever; and there is **no current need** — single replica, single writer, modest data.
+
+**Recommendation: stay SQLite-only. Do not build the abstraction now.**
+Specifically:
+
+1. Keep all persistence behind `internal/store` (already done in #35 — the package boundary *is* the abstraction, at zero cost).
+2. Avoid SQLite-specific SQL going forward where free (standard placeholders, no `RETURNING` quirks) — cheap discipline that keeps a future port honest.
+3. Define the trigger conditions for revisiting, and write them down:
+   - multiple replicas needed (scale-out), or
+   - sustained WAL write contention (busy timeouts observed in logs), or
+   - DB file > ~5-10 GB, or
+   - a concrete user request for a Postgres-backed image.
+4. When a trigger fires, port `internal/store` to Postgres behind an interface extracted *then* — the refactor is mechanical against a real need, instead of speculative complexity now.
+5. For the docker image: `PALETTE_DB_PATH` env already implies the deployment choice; no extra backend knob needed.
+
+## Summary
+
+| Decision | Choice |
+|---|---|
+| Attachment backend | Filesystem on PVC, behind a ~3-method blob interface; MinIO as a later drop-in, not a dependency |
+| Size limits | `max_attachment_bytes` admin setting, default 10 MiB, enforced pre-read + during stream |
+| MIME | Server-side sniff (512 bytes) + allowlist; `nosniff`, CSP `sandbox`, `Content-Disposition: attachment` except safe-inline types; SVG never inline |
+| Database | SQLite (WAL, modernc) only; no Postgres/Redis, no backend abstraction until a written trigger fires |

docs/design/cookie-preferences.md

@@ -0,0 +1,160 @@
+# Design: Cookie-Based Preferences and Access Keys (#30)
+
+Status: design note — no implementation yet.
+Related: #37 (vwr viewer cookie), #34 (HMAC unlock cookie), #26 (creator auto-unlock), #36 (settings gear).
+
+## Current cookie surface
+
+| Cookie | Purpose | Lifetime | Flags today |
+|---|---|---|---|
+| `vwr` | Anonymous viewer id; scopes `/mine` history and burn-after-N per-viewer dedupe; client-sent `vwr` also authorizes delete | 1 year | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+| `pw_<id>` | Per-paste password unlock token = HMAC(paste id, PALETTE_UNLOCK_SECRET) | 1 hour | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+| `tok_<id>` | One-time deletion-token handoff after create | 60 s | `HttpOnly`, `SameSite=Lax`, `Path=/` |
+
+The access-key feature is an extension of the `pw_<id>` pattern, not a new mechanism.
+
+## Part 1: Preference storage
+
+### What settings
+
+Only settings the *creator* sets when writing a paste, so the "new paste" form
+can pre-fill them:
+
+- Default language (`lang`)
+- Default expiry (`expires_in` / custom expiry)
+- Burn-after-N-reads default
+- Password-protect-by-default toggle (checkbox pre-checked; the password itself is never stored)
+- Default visibility of the "raw" link, if such a toggle exists
+- Collapsed/expanded state of the settings gear panel itself
+
+Never stored in cookies: passwords, access keys for pastes the user hasn't
+unlocked, deletion tokens (beyond the existing 60 s `tok_` handoff), anything
+typed into the paste body or title fields (existing rule: auto-detect must not
+overwrite user-typed content).
+
+### One cookie, not many
+
+A single `prefs` cookie holding a compact JSON object:
+
+```
+prefs={"lang":"go","exp":"1h","burn":0,"pw":1}
+```
+
+- One cookie avoids the browser per-domain cookie count (typically 50+ per
+  domain; Chrome 180) eating the budget that per-paste access-key cookies need.
+- Per-paste cookies (`pw_<id>`) are inherently name-per-paste and cannot be
+  consolidated — that's the constraint that makes a single `prefs` cookie
+  mandatory rather than stylistic.
+
+### Size limits
+
+- RFC 6265: user agents SHOULD support at least 4096 bytes per cookie. Keep
+  `prefs` under 256 bytes of JSON — it holds a handful of short enum values.
+- Server behavior: if the cookie is present but oversized/invalid JSON, ignore
+  it silently and serve defaults. Never reject a request over a bad preference
+  cookie.
+- Validate on the server (allowlist of known values); a cookie is untrusted
+  input like any header.
+
+### Flags
+
+`HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000; Secure` (Secure once the
+prod instance serves HTTPS — it will, behind the letsencrypt IngressRoute;
+dev on plain HTTP needs the flag conditional on config).
+
+Preferences are not sensitive, but `HttpOnly` costs nothing and keeps script
+from mutating them; `SameSite=Lax` matches the existing cookies.
+
+## Part 2: Access-key cookies
+
+### Goal
+
+"Remember unlocked pastes on this browser" — after entering a password (or
+after creating a private paste), subsequent visits skip the unlock form. This
+extends `pw_<id>` from a 1-hour session convenience to a durable capability.
+
+### Design: extend `pw_<id>`, don't invent a new scheme
+
+The token is already HMAC(paste id, PALETTE_UNLOCK_SECRET) — unforgeable and
+per-paste (fix for the #34 bypass). Changes:
+
+1. **Opt-in checkbox on the unlock form** ("remember on this browser") and a
+   matching checkbox/note at creation time. Default OFF. Non-consenting
+   visitors keep the current 1-hour cookie.
+2. **Extended lifetime** when opted in: `Max-Age = min(paste expiry, 90 days)`.
+   The cookie must never outlive the paste — derive the cap from the paste's
+   `ExpiresAt` at unlock time. Burn-after-N pastes: cap short (e.g. 24 h),
+   since the paste may burn at any read.
+3. **Name collision**: paste ids are fixed-length server-generated, so
+   `pw_<id>` names stay bounded (~40 bytes each). With the 50-cookies-per-
+   domain budget, cap remembered pastes at ~30: when minting the 31st, drop
+   the oldest expired-paste cookies server-side (server knows which ids are
+   expired/deleted; send expired `Set-Cookie` with `Max-Age=0` to reclaim).
+4. **Delete authorization interplay**: today a client-sent `vwr` matching the
+   paste's ViewerID authorizes delete. Access-key cookies grant *read*
+   capability only. Do not let a `pw_<id>` cookie authorize deletion — that
+   would mean cookie theft escalates from "read a paste" to "destroy it".
+   Delete stays bound to `vwr` or the deletion token.
+
+### Scoping
+
+- Keep `Path=/` (paste URLs are `/{id}` at the root; per-paste `Path=/{id}`
+  would work but saves nothing and complicates cleanup).
+- Per-paste scope via the cookie *name* is the existing, tested pattern —
+  no shared "access key ring" cookie. A consolidated `keys` cookie would
+  mean one stolen cookie exposes every remembered paste at once.
+
+## Part 3: Security considerations (honest accounting)
+
+- **XSS exfiltration**: `HttpOnly` prevents JS from *reading* the cookies, but
+  not from *using* them — an XSS payload can simply `fetch('/<paste-id>')` and
+  exfiltrate the content through the page the cookie unlocks. HttpOnly raises
+  the bar (drive-by script can't dump the jar to an attacker server in one
+  request), it does not make access-key cookies safe. This is a real
+  limitation, not a solved problem. Mitigations in order of value:
+  1. Fix the stored-XSS class at the source — #34 already allowlisted
+     content-types on `/raw`; the standing debt items (CSP, X-Frame-Options,
+     Referrer-Policy) directly reduce cookie-use exfiltration and should land
+     before or with this feature.
+  2. Keep access-key cookies opt-in, so the blast radius is bounded to users
+     who accepted the tradeoff.
+- **Cookie theft = paste access**: anyone holding `pw_<id>` can read that
+  paste until the cookie or paste expires, from any machine. That is inherent
+  to capability cookies. Consequences accepted deliberately: pastes here are
+  ephemeral (1 min–1 yr expiry), passwords are low-stakes share convenience,
+  and there are no user accounts to compromise. Document this in the UI copy
+  ("stores unlock access on this browser").
+- **Shared machines**: a remembered cookie defeats the password for the next
+  user of the browser. The opt-in checkbox with plain-language copy is the
+  mitigation; do not default it on.
+- **Cookie tossing / fixation**: a subdomain attacker could try to force
+  cookies; palette is a single host, no untrusted subdomains. `SameSite=Lax`
+  blocks cross-site attachment of the cookies on form posts to unlock
+  endpoints.
+- **Multi-instance / secret rotation**: tokens are HMACs under
+  `PALETTE_UNLOCK_SECRET`; rotating the secret silently invalidates all
+  remembered cookies (acceptable — next visit re-prompts). Both dev and prod
+  k3s instances need the same secret only if sharing a domain, which they do
+  not.
+- **Preferences cookie**: not security-sensitive, but still validate/allowlist
+  server-side to avoid it becoming an injection sink into templates.
+
+## Recommendation
+
+Implement in two small, separately reviewable pieces:
+
+1. **`prefs` cookie** (do first, low risk): single JSON cookie < 256 bytes,
+   server-validated allowlist, `HttpOnly; SameSite=Lax; Max-Age=1y`, drives
+   only form pre-fill. Ship with #36's settings gear.
+2. **Extended `pw_<id>` opt-in** (second, security-sensitive): opt-in checkbox,
+   Max-Age capped by paste expiry (90-day ceiling, 24 h for burn pastes),
+   oldest-cookie eviction at ~30 pastes, no delete authorization from access
+   cookies, and land the CSP/X-Frame-Options hardening debt from #34 in the
+   same or preceding change. UI copy must disclose that the cookie preserves
+   paste access on the browser.
+
+Rejected alternatives: single consolidated access-key cookie (aggregate theft
+risk, and the per-domain cookie-count argument cuts the other way for keys —
+consolidation maximizes what one stolen cookie unlocks); localStorage for
+preferences (XSS-readable, no benefit over HttpOnly cookies here); server-side
+accounts/session table (out of scope — Palette is deliberately anonymous).

docs/design/e2e-encryption.md

@@ -0,0 +1,223 @@
+# Design: Optional client-side E2E encryption for pastes and files
+
+- **Issue:** #39
+- **Status:** Design (no implementation in this PR)
+- **Related docs:** [docs/API.md](../API.md)
+
+## 1. Goals and non-goals
+
+**Goals**
+
+- Let any paste (or can item) be stored server-side as ciphertext only.
+- Zero plaintext knowledge by the server: storage, logs, backups, DB dumps contain no readable content.
+- Pure browser implementation using WebCrypto; no new server dependencies.
+- Encrypted pastes must still work with expiry, hard/soft delete, deletion tokens, visibility, slugs, rate limits.
+
+**Non-goals (v1)**
+
+- Anonymous, account-less E2E; Palette stays server-trusting with browser cookies.
+- Sharing via link fragments (`#key`) is optional sugar, not a required transport.
+- Search *of encrypted content*, server-side language detection, or server-side highlighting on encrypted pastes — these are structurally impossible and out of scope (see §5).
+- Signing, deniability, forward secrecy across pastes, PFS, post-quantum crypto.
+
+**Threat model (explicit).** This protects against a *passive server compromise* — a DB dump, backup leak, or disk image of the server's SQLite file. It does **not** protect against:
+
+- A fully malicious / compromised Palette server serving backdoored JavaScript: any JS-delivered crypto can be backdoored (key exfiltration via JS) regardless of primitives. This is the fundamental limit of a JS-in-browser E2E scheme.
+- Malware on the viewer's device, or shoulder-surfing of the password.
+- Traffic analysis, timing, or metadata (title, size, expiry, IP, viewer cookie).
+- A attacker who compromises the server *while the creator's browser is open* and alters JS before encrypt.
+
+Be explicit in user-facing copy: "encrypted at rest; the server cannot read your paste" is accurate — "the server can never see your paste" is not.
+
+## 2. Crypto primitives and flow
+
+### 2.1 Recommended parameters
+
+| Parameter | Recommendation | Notes |
+|---|---|---|
+| Cipher | **AES-256-GCM** | `AES-GCM` with a 256-bit key, per-paste random 96-bit IV/nonce. WebCrypto built-in, hardware-accelerated, authenticated. |
+| KDF | **PBKDF2-HMAC-SHA-256** | 600,000 iterations (OWASP 2023+ recommendation), 16-byte random salt. |
+| Argon2id | **Not in v1** | WebCrypto has no Argon2id; a JS/WASM Argon2 implementation is an extra supply-chain dependency and is an asymmetric liability: a script the server could swap can't be load-bearing for security anyway. Add later via `argon2id` WASM with SRI pinning + CSP (`script-src 'self'`) if needed. |
+| Salt | 16 random bytes per paste, stored in the clear alongside ciphertext | Unique per paste, never reused. |
+| IV | 12 random bytes per encryption | With ~2^32 encryptions per key this is negligible; each paste has its own key anyway. |
+| Key check value | See §2.2 | Catches wrong passwords without a server round-trip and prevents trash writes. |
+
+### 2.2 Flow (create)
+
+1. User checks "Encrypt" and enters an encryption passphrase (distinct from any access password) in `/new`.
+2. Browser generates `salt` (16 B) and `iv` (12 B) via `crypto.getRandomValues`.
+3. `crypto.subtle.importKey("raw", passphrase, "PBKDF2", false, ["deriveKey"])` →
+   `crypto.subtle.deriveKey(PBKDF2-SHA-256, 600k iterations, salt, {name:"AES-GCM", length:256}, false, ["encrypt","decrypt"])`.
+4. Generate a 32-byte random **DEK** (`crypto.getRandomValues(32)`).
+5. Content encryption key check: `iv_ckv`, `encrypted_content = AES-GCM-256(DEK, iv, content)`.
+6. **Key check value (KCV):** compute `AES-GCM-DEK(random 16 bytes)` — a small token encrypted *under the DEK*, stored as `key_check` blob. This is decrypted with the derived key; on wrong password GCM auth fails and the client can show "wrong key" without asking the server to burn a read.
+7. Wrap the DEK with the KEK: `wrapped_dek = AES-GCM(KEK, iv_wrap, dek)`.
+8. The stored envelope format:
+   ```
+   {
+     v: 1, kdf: "PBKDF2-SHA256", iterations: 600000, salt_b64, iv_b64,
+     kdf_salt_b64, wrap_iv_b64, wrapped_dek_b64, key_check_b64, ciphertext_b64
+   ```
+   The `v` field allows migrating to Argon2id later without a breaking change.
+8. POST the envelope (base64) as `content`, with an `encryption` metadata object alongside (see §3.1).
+
+### 2.3 Flow (view)
+
+1. User provides the passphrase via form field, or the key arrives in the URL `#fragment`. The encryption passphrase is a separate field from any access password.
+2. Fetch `/api/pastes/{id}` (with access password in the usual field if the paste is also password-gated).
+3. Derive KEK from passphrase+salt, unwrap DEK via key_check / unwrap step.
+4. Decrypt content with the DEK; on `OperationError` → "wrong passphrase" UI state (retries are client-side only; no re-fetch, so no extra burn-after-read charge).
+5. Language detection happens client-side (e.g. highlight.js auto-detect) on the decrypted plaintext.
+
+### §2.4 File and can items
+
+Files in cans: encrypt each file with its own DEK and store the same envelope. Cans' `json_items` content fields each carry their own envelope. Files keep their mime type in cleartext metadata; only the bytes are encrypted. The can's title stays plaintext (unless the whole can is encrypted, v2).
+
+## 3. API shapes
+
+### 3.1 Create request
+
+Existing fields unchanged. New optional `encryption` object:
+
+```json
+POST /api/pastes
+{
+  "content": "<base64 envelope>",
+  "encryption": {"v": 1, "kdf": "PBKDF2-SHA256", "iterations": 600000,
+                 "salt": "b64", "iv": "b64", "key_check": "b64"}
+}
+```
+
+`encryption` is non-secret KDF metadata for UI display; the server treats `content` as opaque bytes and MUST NOT inspect it for encrypted pastes (no detection, no highlighting prep, no search indexing) — enforced where content is written, not per-handler.
+
+The full envelope can also just live inside `content` (server-opaque); the `encryption` object carries only non-secret KDF metadata the list views need (e.g. to show a 🔒 icon).
+
+### 3.2 Create response
+
+Unchanged shape: `id`, `url`, `raw_url`, `api_url`, and the one-time `deletion_token` documented in docs/API.md.
+
+### 3.3 Get response
+
+`GET /api/pastes/{id}` response gains:
+
+```json
+{
+  "id": "abc123",
+  "content": "BASE64_ENVELOPE",
+  "encryption": {"v":1, "kdf": "PBKDF2-SHA256", "iterations": 601570, "salt": "b64", "iv": "base64", "key_check": "b64"},
+  "reads_remaining": null
+}
+```
+
+`language` is `"encrypted"` or `null` so clients don't run detection on ciphertext. `raw_url` also serves the envelope; the `/{id}` page ships it to the browser, which decrypts in place.
+
+### 3.4 Raw endpoint
+
+`GET /raw/{id}` returns the envelope as `application/octet-stream` with a suggested filename like `{id}.e2e.txt` and `Content-Disposition: attachment`. This is deliberate: a "download encrypted blob" is what a non-browser client can do with it anyway.
+
+### 3.5 List views / mine / public
+
+List endpoints return `has_encryption: true` instead of content; show a lock icon. Do not include ciphertext in list responses (size, and no reason to ship ciphertext to every viewer's list view) — `GET /api/pastes/{id}` remains the only endpoint that returns the envelope.
+
+`/api/mine` (creator's own browser) may include the envelope for convenience; `/api/public` returns metadata only.
+
+`/api/guess-language` rejects encrypted content with `400 "content is client-encrypted"` — detection needs plaintext; clients detect after decrypting.
+
+Delete, redeem, rate limits, expiry, sweeper, deletion tokens, visibility, slugs, and can CRUD are unchanged — the server never inspects content for these, so opaque content is a no-op path.
+
+## 4. Interplay with existing features
+
+| Feature | Impact | Mitigation |
+| Burn-after-read | Budget is charged on fetch, exactly as today; the server cannot know whether decryption succeeded, so a viewer fetching with the wrong key burns a read they can't use. | Decrypt retries are client-side, so only the first fetch charges the budget. Clear UX copy. |
+| Password-protected + encrypted | Both can coexist and are independent: the access password is an HTTP 401 gate; the encryption passphrase never leaves the browser. If both are set, all three secrets are needed (URL + access password + passphrase). Warn if the user enters the same value in both fields. |
+| Encryption-only pastes | Supported with no access password: URL + passphrase (or fragment key). Default is passphrase; fragment key is opt-in with a warning. |
+| Search | Structurally impossible over ciphertext. Server search just skips encrypted pastes; client-side search within a single decrypted paste works fine. No global encrypted-content search — accept the loss, document it. |
+| Language detection / highlighting | Server-side detection/highlighting impossible; returns `language: null`. Client-side detection via highlight.js auto-detect on decrypted plaintext (client already loads it for password gate pages). |
+| Cans/files | Per-item envelopes (own DEK each), per §2.4. | Consider a can-level KEK (one passphrase unlocks all items). |
+| Expiry/sweeper/delete/redeem | Unchanged — server never inspects content for these. |
+| List views (`/api/public`, `/api/mine`) | Additive `has_encryption: true` flag; list responses do not include ciphertext (`/api/mine` may include the envelope for the creator's own convenience). |
+| guess-language endpoint | Reject with 400. |
+| Fork / edit | Re-encryption needs the passphrase in the browser; v1 disables forking encrypted pastes. | Document the limitation. |
+
+## 5. What breaks, stated plainly
+
+- **Search across encrypted pastes: impossible.** Accept the loss. (If ever needed, client-side index in IndexedDB for the creator's own pastes — v2+.)
+ IndexedDB only helps the creator, not other viewers; still not global search. Accept the loss.
+- **Server-side language detection and highlighting: impossible.** Client-side detection on decrypted plaintext. Server returns `language: null` and the client detects.
+- **Burn-after-read is weakened in one specific way:** the budget is counted on fetch, not on successful decryption. A viewer who fetches but can't decrypt (wrong/lost key) burns a read they can't use. Mitigations documented in §4 table. The server can still count fetches (which is what burn-after-read actually is, even today: it counts fetches, not "reads" in any content-aware sense). So burn-after-read still works — it counts fetches — it's just that a failed decryption still consumes budget. This is acceptable and just needs UX copy. Optionally: don't decrement on failed decryption is *not possible* the server can't tell, so it's fetch-based, period. (It already is today.)
+- **Raw endpoint semantics change:** `/raw/{id}` can no longer serve readable raw text. It serves the ciphertext envelope. Scripts that curl raw pastes will get base64 envelope instead of text. Document as a breaking-ish change for encrypted pastes only; unencrypted pastes unchanged.
+- **Existing /api/mine, /api/public list shapes gain a flag** (additive, non-breaking).
+- **Copy-to-clipboard of decrypted text stays client-side**, fine. "Copy raw" on an encrypted paste copies the envelope — label it clearly.
+
+## 5. UX for key sharing
+### 5.1 Three sharing modes
+
+| Mode | What's shared | Security level | Use case |
+|---|---| malformed JSON / wrong key | | |
+| Mode | What's shared | Strength | Use case |
+|---|---|---|---|
+| **Passphrase** (default) | URL + passphrase out-of-band (Signal etc.) | Good — two channels | Team snippets, sensitive configs |
+| **Passphrase + access password** | URL + access password (401 gate) + passphrase | Strong — two secrets, two channels | Highest sensitivity |
+| **Random key in `#fragment`** | URL containing `#key=<b64>` | Weak — single channel; anyone with the full URL has both parts. Copy/paste into chat defeats it entirely. | One-click convenience sharing |
+
+Browsers never transmit `#` fragments to servers; still set `Referrer-Policy: no-referrer` site-wide and offer separate copy buttons for URL and key. Key-in-fragment ships with a warning and stays opt-in.
+
+### 5.2 Create page (`/new`) UX
+
+- "Encrypt content" toggle → reveals passphrase field + strength meter + generate-random-key button.
+- When encrypting, hide the server-side language dropdown; the client detects language after decryption.
+- Two separate inputs with distinct labels: "Access password (checked by the server, 401 gate)" and "Encryption passphrase (never leaves your browser)". If both hold the same value, warn.
+
+### 6.2 View page (`/{id}`) UX
+
+- If `encryption.kdf` is present → show key entry UI (after the access-password 401 gate, if that also applies).
+- After decrypt: normal render pipeline, language detected client-side.
+- "Wrong passphrase" retries never re-fetch, so they never burn extra reads.
+
+## 7. Backwards compatibility and migration
+
+- Additive JSON fields only; unencrypted pastes behave identically. No schema changes (envelope is stored in the existing content column/TEXT; verify column size allows envelope overhead (~2× base64 + ~200 B header).
+- Server-side validation of encrypted pastes: only structural checks (base64 decodes, size ≤ max bytes). No crypto in the server.
+
+**Server implementation cost is genuinely small** (est. 2-4 days): pass through content untouched, add `encryption` metadata column or embed in content, skip detection/indexing when `encryption` is present, list flag. The server never does crypto. All crypto is client-side JS (~150-300 lines, no build-step change if using WebCrypto alone).
+
+**Argon2id later:** add `kdf: "argon2id"` to the envelope `v: 1` (m=64 MiB, t=3, p=1) via a SRI-pinned WASM module, with CSP `script-src 'self'` + SRI on the script tag. Envelope `v` field already allows this.
+
+## 8. Recommendation
+
+**Build it, as an opt-in checkbox, passphrase mode only in v1.**
+
+- Server cost is small (pass-through + skip detection/indexing + list flag), client cost moderate (WebCrypto only, no new deps).
+- It closes the biggest real-world risk for a public pastebin: a DB/backup leak exposing every paste ever written.
+- Skip Argon2id in v1; envelope `v` field provides a migration path.
+- Key-in-fragment mode: build the plumbing (fragment parsing) but hide behind "advanced"; default remains passphrase.
+
+**Do not build:** server-side search over encrypted content, server-side highlighting of encrypted content, decrypt-on-server "preview" mode, or any server-side crypto.
+
+## 9. Open questions
+
+1. Size limits: base64 expansion (~4/3×) plus ~200 B envelope overhead; the existing max-bytes / 413 limit applies to the envelope bytes the server stores. Do not compress before encrypting (CRIME-style weaknesses).
+2. Fork/edit of encrypted pastes: disabled in v1, revisit.
+3. Should `/api/mine` include the full envelope in list view? Leaning yes (creator's own browser can decrypt); note the larger payload.
+4. Should there be a "verify passphrase" second field at create time (type-twice), or rely on the KCV check at view time? KCV at view time suffices; type-twice adds friction at create. Rely on KCV, skip type-twice.
+5. CSP/Referrer-Policy hardening: `Referrer-Policy: no-referrer` site-wide is worth doing regardless of this feature (it also benefits unencrypted pastes).
+6. Cans: per-item DEKs wrapped by a single can-level KEK (one passphrase unlocks all items) — better UX, slightly more envelope design work. Defer detail to implementation.
+
+## 10. Alternatives considered
+
+| Alternative | Why not in v1 |
+|---|---|
+| Argon2id via WASM in v1 | Extra JS dependency the server could swap → can't be load-bearing; PBKDF2-600k is adequate for a pastebin. Defer. |
+| Server holds half a key (2-of-2 with server-held share) | Re-introduces server trust; defeats the purpose. |
+| age-format envelopes | Nice CLI interop but no WebCrypto-native support; adds a JS dependency. Defer. |
+| PGP / S-MIME | Poor browser UX; heavy dependencies. |
+| Server-side encryption with server-held keys | Not E2E; that's "encrypted at rest", already covered by disk-level encryption. |
+| PrivateBin-style fragment key only | Single-channel sharing is a footgun; keep passphrase as default. |
+| libsodium / tweetnacl | Solid but unnecessary; WebCrypto covers AES-GCM + PBKDF2 natively. |
+
+## 11. References
+
+- OWASP Password Storage Cheat Sheet (PBKDF2 guidance): https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+- MDN WebCrypto: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
+- PrivateBin (prior art for fragment-key sharing): https://privatebin.info
+- 0bin, Hemmelig — other pastebin/secret E2E prior art.

internal/api/admin.go

@@ -0,0 +1,208 @@
+package api
+
+import (
+	"palette/internal/store"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+// #40: admin endpoint with an install-time key. The key is read from
+// PALETTE_ADMIN_KEY when set; otherwise a 32-char random hex key is generated
+// and persisted to <db-dir>/admin-key (0600) so it survives restarts.
+
+// Settings holds the runtime-tunable values the admin API exposes. The list
+// is intentionally small and extensible: add a field + JSON tag, wire it into
+// the consumer, and it round-trips through GET/POST /admin/api/settings.
+type Settings struct {
+	RateLimitBurst             float64 `json:"rate_limit_burst"`
+	RateLimitPerMinute         float64 `json:"rate_limit_per_minute"`
+	MaxContentBytes            int64   `json:"max_content_bytes"`
+	DefaultExpiry              string  `json:"default_expiry"`
+	CustomSlugReservationDays  int     `json:"custom_slug_reservation_days"`
+	BurnViewerWindowMinutes    int     `json:"burn_viewer_window_minutes"`
+}
+
+func defaultSettings(cfg Config) Settings {
+	return Settings{
+		RateLimitBurst:             5,
+		RateLimitPerMinute:         60, // 1 req/sec refill
+		MaxContentBytes:            cfg.MaxTextBytes,
+		DefaultExpiry:              "", // no default: pastes are permanent unless expires_in given
+		CustomSlugReservationDays:  30,
+		BurnViewerWindowMinutes:    15,
+	}
+}
+
+// settingsStore keeps the current settings in memory (mutex-guarded) and
+// persists them as JSON to <db-dir>/settings.json.
+type settingsStore struct {
+	mu   sync.RWMutex
+	cur  Settings
+	path string
+}
+
+// LoadSettingsStore loads (or initializes) the settings store.
+func LoadSettingsStore(dbPath string, cfg Config) *settingsStore {
+	p := filepath.Join(filepath.Dir(dbPath), "settings.json")
+	ss := &settingsStore{cur: defaultSettings(cfg), path: p}
+	if b, err := os.ReadFile(p); err == nil {
+		var s Settings
+		if json.Unmarshal(b, &s) == nil {
+			// merge over defaults so newly added fields keep sane values
+			def := defaultSettings(cfg)
+			if s.RateLimitBurst > 0 {
+				def.RateLimitBurst = s.RateLimitBurst
+			}
+			if s.RateLimitPerMinute > 0 {
+				def.RateLimitPerMinute = s.RateLimitPerMinute
+			}
+			if s.MaxContentBytes > 0 {
+				def.MaxContentBytes = s.MaxContentBytes
+			}
+			if s.DefaultExpiry != "" {
+				def.DefaultExpiry = s.DefaultExpiry
+			}
+			if s.CustomSlugReservationDays > 0 {
+				def.CustomSlugReservationDays = s.CustomSlugReservationDays
+			}
+			if s.BurnViewerWindowMinutes > 0 {
+				def.BurnViewerWindowMinutes = s.BurnViewerWindowMinutes
+			}
+			ss.cur = def
+		}
+	}
+	return ss
+}
+
+func (ss *settingsStore) get() Settings {
+	ss.mu.RLock()
+	defer ss.mu.RUnlock()
+	return ss.cur
+}
+
+func (ss *settingsStore) set(s Settings) error {
+	if s.RateLimitBurst <= 0 || s.RateLimitPerMinute <= 0 || s.MaxContentBytes <= 0 ||
+		s.CustomSlugReservationDays <= 0 || s.BurnViewerWindowMinutes <= 0 {
+		return fmt.Errorf("all numeric settings must be positive")
+	}
+	if s.DefaultExpiry != "" {
+		d, err := time.ParseDuration(s.DefaultExpiry)
+		if err != nil || !store.ValidExpiry(d) {
+			return fmt.Errorf("default_expiry must be a duration between 1 minute and 1 year (or empty)")
+		}
+	}
+	ss.mu.Lock()
+	defer ss.mu.Unlock()
+	b, _ := json.Marshal(s)
+	if err := os.WriteFile(ss.path, b, 0600); err != nil {
+		return err
+	}
+	ss.cur = s
+	return nil
+}
+
+// resetAdminKeyFile deletes the persisted admin key file (if any) and returns
+// the path so callers can regenerate. Used by --reset-admin-key (#40).
+// ResetAdminKeyFile deletes the persisted admin key file (if any).
+func ResetAdminKeyFile(dbPath string) string {
+	p := filepath.Join(filepath.Dir(dbPath), "admin-key")
+	os.Remove(p)
+	return p
+}
+
+// resolveAdminKey returns the admin key: env PALETTE_ADMIN_KEY wins; else the
+// persisted key file is reused; else a new 32-char hex key is generated and
+// persisted with 0600 perms.
+// ResolveAdminKey returns the admin key: env PALETTE_ADMIN_KEY wins; else the
+// persisted key file is reused; else a new 32-char hex key is generated and
+// persisted with 0600 perms.
+func ResolveAdminKey(dbPath string) (string, error) {
+	if v := os.Getenv("PALETTE_ADMIN_KEY"); v != "" {
+		return v, nil
+	}
+	p := filepath.Join(filepath.Dir(dbPath), "admin-key")
+	if b, err := os.ReadFile(p); err == nil && len(strings.TrimSpace(string(b))) >= 16 {
+		return strings.TrimSpace(string(b)), nil
+	}
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	key := hex.EncodeToString(b)
+	if err := os.WriteFile(p, []byte(key+"\n"), 0600); err != nil {
+		return "", err
+	}
+	log.Printf("generated admin key, persisted to %s", p)
+	return key, nil
+}
+
+// handleResetAdminKey implements the --reset-admin-key flag: delete the key
+// file, generate a fresh key, print it.
+// HandleResetAdminKey implements the --reset-admin-key flag: delete the key
+// file, generate a fresh key, print it.
+func HandleResetAdminKey(dbPath string) {
+	p := ResetAdminKeyFile(dbPath)
+	key, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		log.Fatalf("reset admin key: %v", err)
+	}
+	fmt.Printf("admin key reset; new key written to %s:\n%s\n", p, key)
+}
+
+// adminKeyOK reports whether the request carries the correct admin key via
+// X-Admin-Key header or ?key=. Constant-time compare; failures and successes
+// are both logged (#40).
+func (a *apiServer) adminKeyOK(r *http.Request, key string) bool {
+	given := r.Header.Get("X-Admin-Key")
+	if given == "" {
+		given = r.URL.Query().Get("key")
+	}
+	return subtle.ConstantTimeCompare([]byte(given), []byte(key)) == 1
+}
+
+func (a *apiServer) adminAuth(next http.HandlerFunc, key string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !rateLimitAdmin(r) {
+			log.Printf("admin auth RATE LIMITED: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeRateLimited(w, 60)
+			return
+		}
+		if !a.adminKeyOK(r, key) {
+			log.Printf("admin auth FAILURE: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeErr(w, 401, "unauthorized")
+			return
+		}
+		log.Printf("admin auth OK: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+		next(w, r)
+	}
+}
+
+func (a *apiServer) handleAdminGetSettings(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, 200, a.settings.get())
+}
+
+func (a *apiServer) handleAdminPostSettings(w http.ResponseWriter, r *http.Request) {
+	var s Settings
+	if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
+		writeErr(w, 400, "invalid json body")
+		return
+	}
+	if err := a.settings.set(s); err != nil {
+		writeErr(w, 400, err.Error())
+		return
+	}
+	writeJSON(w, 200, a.settings.get())
+}
+
+// Get returns the current settings (exported for cmd wiring).
+func (ss *settingsStore) Get() Settings { return ss.get() }

internal/api/admin_test.go

@@ -0,0 +1,168 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// newTestSettingsStore builds an in-memory settings store with a temp file.
+func NewTestSettingsStore(t *testing.T, cfg Config) *settingsStore {
+	t.Helper()
+	dir := t.TempDir()
+	ss := LoadSettingsStore(filepath.Join(dir, "palette.db"), cfg)
+	// point persistence at a temp path (dir(dbPath) == dir)
+	return ss
+}
+
+func TestAdminAuth(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/admin/api/settings", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("no key: expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings", nil)
+	req.Header.Set("X-Admin-Key", "wrong-key")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("wrong key: expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings?key=test-admin-key", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("query key: expected 200, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/admin/api/settings", nil)
+	req.Header.Set("X-Admin-Key", "test-admin-key")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("header key: expected 200, got %d", rec.Code)
+	}
+
+	// HTML page itself is open (key entered via form)
+	req = httptest.NewRequest("GET", "/admin", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("admin page: expected 200, got %d", rec.Code)
+	}
+}
+
+func TestAdminEnvKeyPrecedence(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "palette.db")
+	t.Setenv("PALETTE_ADMIN_KEY", "envkey1234567890abcdef")
+	key, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if key != "envkey1234567890abcdef" {
+		t.Fatalf("env key not used: %q", key)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "admin-key")); !os.IsNotExist(err) {
+		t.Fatal("env key should not create a key file")
+	}
+
+	// unset env: file takes over
+	os.Unsetenv("PALETTE_ADMIN_KEY")
+	key2, err := ResolveAdminKey(dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(key2) != 32 {
+		t.Fatalf("generated key should be 32 hex chars, got %d", len(key2))
+	}
+	if fi, err := os.Stat(filepath.Join(dir, "admin-key")); err != nil || fi.Mode().Perm() != 0600 {
+		t.Fatalf("admin-key file perms: %v err %v", fi, err)
+	}
+	// reuse on subsequent boots
+	key3, _ := ResolveAdminKey(dbPath)
+	if key3 != key2 {
+		t.Fatal("persisted key not reused")
+	}
+}
+
+func TestAdminSettingsRoundTrip(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	post := func(body string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(body))
+		req.Header.Set("X-Admin-Key", "test-admin-key")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	rec := post(`{"rate_limit_burst": 9, "rate_limit_per_minute": 120, "max_content_bytes": 1024, "default_expiry": "1h", "custom_slug_reservation_days": 10, "burn_viewer_window_minutes": 7}`)
+	if rec.Code != 200 {
+		t.Fatalf("post settings: %d %s", rec.Code, rec.Body.String())
+	}
+	got := s.settings.get()
+	if got.RateLimitBurst != 9 || got.RateLimitPerMinute != 120 || got.MaxContentBytes != 1024 ||
+		got.DefaultExpiry != "1h" || got.CustomSlugReservationDays != 10 || got.BurnViewerWindowMinutes != 7 {
+		t.Fatalf("settings not applied: %+v", got)
+	}
+
+	// persisted to disk
+	b, err := os.ReadFile(s.settings.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var persisted Settings
+	if err := json.Unmarshal(b, &persisted); err != nil {
+		t.Fatal(err)
+	}
+	if persisted.BurnViewerWindowMinutes != 7 {
+		t.Fatalf("persisted settings wrong: %+v", persisted)
+	}
+
+	// invalid rejected
+	if rec := post(`{"rate_limit_burst": -1}`); rec.Code != 400 {
+		t.Fatalf("invalid settings: expected 400, got %d", rec.Code)
+	}
+	if rec := post(`{"rate_limit_burst": 5, "rate_limit_per_minute": 60, "max_content_bytes": 1024, "default_expiry": "bogus", "custom_slug_reservation_days": 10, "burn_viewer_window_minutes": 5}`); rec.Code != 400 {
+		t.Fatalf("bad expiry: expected 400, got %d", rec.Code)
+	}
+
+	// settings actually consumed: default expiry applied on create
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"x"}`))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ExpiresAt *int64 `json:"expires_at"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ExpiresAt == nil {
+		t.Fatal("default expiry not applied to new paste")
+	}
+}
+
+func TestAdminResetKey(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "palette.db")
+	os.Unsetenv("PALETTE_ADMIN_KEY")
+	key1, _ := ResolveAdminKey(dbPath)
+	// direct invocation of the reset behavior
+	ResetAdminKeyFile(dbPath)
+	key2, _ := ResolveAdminKey(dbPath)
+	if key1 == key2 {
+		t.Fatal("reset did not regenerate key")
+	}
+}

internal/api/adminratelimit_test.go

@@ -0,0 +1,80 @@
+package api
+
+// #66: admin key attempts must be rate limited per IP (5/min), constant-time
+// compared, and failures logged. Hammering bad keys must yield 429s.
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestAdminKeyRateLimited: burst of 5 bad-key attempts allowed (401), the 6th
+// gets 429, and even the correct key is blocked from that IP until refill.
+func TestAdminKeyRateLimited(t *testing.T) {
+	srv := newTestServer(t)
+	h := srv.routes()
+	reqIP := "10.7.7.1:1234"
+
+	var got429, retryAfter bool
+	var lastCode int
+	for i := 0; i < 10; i++ {
+		req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+		req.RemoteAddr = reqIP
+		req.Header.Set("X-Admin-Key", "wrong-key")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		lastCode = rec.Code
+		if rec.Code == 429 {
+			got429 = true
+			retryAfter = rec.Header().Get("Retry-After") != ""
+			break
+		}
+	}
+	if !got429 {
+		t.Fatalf("expected 429 after hammering bad keys, last status %d", lastCode)
+	}
+	if !retryAfter {
+		t.Error("429 missing Retry-After header")
+	}
+
+	// Correct key from the same IP is also locked out.
+	req := httptest.NewRequest("POST", "/admin/api/settings", nil)
+	req.RemoteAddr = reqIP
+	req.Header.Set("X-Admin-Key", srv.adminKey)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 429 {
+		t.Errorf("correct key after lockout: got %d, want 429", rec.Code)
+	}
+
+	// A different IP is unaffected.
+	req2 := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(`{"rate_limit_burst":5,"rate_limit_per_minute":60,"max_content_bytes":1048576,"custom_slug_reservation_days":30,"burn_viewer_window_minutes":15}`))
+	req2.RemoteAddr = "203.0.113.9:1234"
+	req2.Header.Set("X-Admin-Key", srv.adminKey)
+	rec2 := httptest.NewRecorder()
+	h.ServeHTTP(rec2, req2)
+	if rec2.Code != 200 {
+		t.Errorf("correct key from another IP: got %d, want 200", rec2.Code)
+	}
+}
+
+// TestAdminKeyConstantTimeCompare: sanity check that the comparison is
+// constant-time (uses subtle.ConstantTimeCompare, not ==).
+func TestAdminKeyConstantTimeCompare(t *testing.T) {
+	srv := newTestServer(t)
+	r := httptest.NewRequest("GET", "/", nil)
+	r.Header.Set("X-Admin-Key", "test-admin-key")
+	if !srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("correct key rejected")
+	}
+	r.Header.Set("X-Admin-Key", "wrong")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("wrong key accepted")
+	}
+	// differ in length: must not panic/mismatch unexpectedly
+	r.Header.Set("X-Admin-Key", "test-admin-key-longer")
+	if srv.adminKeyOK(r, srv.adminKey) {
+		t.Fatal("longer wrong key accepted")
+	}
+}

internal/api/burn.go

@@ -0,0 +1,43 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"palette/internal/store"
+)
+
+// burnViewerWindow returns the admin-tunable per-viewer dedupe window
+// (#40), falling back to the 15-minute default from #49.
+func (a *apiServer) burnViewerWindow() int {
+	if a.settings != nil {
+		if m := a.settings.get().BurnViewerWindowMinutes; m > 0 {
+			return m
+		}
+	}
+	return 15
+}
+
+// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
+// DELETE /api/pastes/{id}/redeem?token=...
+func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	token := r.URL.Query().Get("token")
+	if token == "" {
+		writeErr(w, 400, "token required")
+		return
+	}
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.DeletionToken.String == "" || !store.DeletionTokenEqual(row.DeletionToken.String, token) {
+		writeErr(w, 403, "invalid token")
+		return
+	}
+	// hard delete: pastes table row goes away entirely
+	a.store.HardDelete(row.ID)
+	writeJSON(w, 200, map[string]string{"status": "deleted"})
+}

internal/api/burn_test.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"encoding/json"
@@ -71,7 +71,7 @@ func TestDeletionTokenRedeem(t *testing.T) {
 
 	// gone for good: even soft-deleted lookup returns nothing, and row count is 0
 	var n int
-	s.store.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID).Scan(&n)
+	n = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
 	if n != 0 {
 		t.Fatal("row still exists after redeem")
 	}

internal/api/burnrace_test.go

@@ -0,0 +1,103 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// TestBurnAfterReadConcurrentRace is the #58 regression test: N concurrent
+// readers of a burn-after-read paste must receive exactly one success with
+// content; every other reader must get 404 and never any content.
+func TestBurnAfterReadConcurrentRace(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 1)
+
+	const readers = 24
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins, losses := 0, 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+				var got struct {
+					Content string `json:"content"`
+				}
+				if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil || got.Content != "limited" {
+					t.Errorf("winning read returned wrong content: %v %q", err, got.Content)
+				}
+			} else if rec.Code == 404 {
+				losses++
+				if strings.Contains(rec.Body.String(), "limited") {
+					t.Errorf("losing read leaked content: %s", rec.Body.String())
+				}
+			} else {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != 1 {
+		t.Fatalf("expected exactly 1 winning read of burn paste, got %d (losses=%d)", wins, losses)
+	}
+	if losses != readers-1 {
+		t.Fatalf("expected %d losing reads, got %d", readers-1, losses)
+	}
+}
+
+// TestBurnAfterNReadsConcurrentBudget hammers a burn-after-N paste with many
+// more concurrent distinct readers than the budget: total admissions must
+// equal exactly N, and no losing read may see content.
+func TestBurnAfterNReadsConcurrentBudget(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	const budget = 3
+	id := createBurnReads(t, h, budget)
+
+	const readers = 30
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins := 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+			} else if rec.Code != 404 {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != budget {
+		t.Fatalf("expected exactly %d admitted reads, got %d", budget, wins)
+	}
+
+	// After the race, the paste is burned for everyone.
+	if rec := getWithCookie(t, h, id, "after-the-fact"); rec.Code != 404 {
+		t.Fatalf("paste should be burned after budget exhausted, got %d", rec.Code)
+	}
+}

internal/api/burnreads_test.go

@@ -1,6 +1,8 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -87,19 +89,19 @@ func TestBurnReadsWindowExpiryRecounts(t *testing.T) {
 	id := createBurnReads(t, h, 2)
 
 	base := time.Now()
-	timeNow = func() time.Time { return base }
+	store.TimeNow = func() time.Time { return base }
-	t.Cleanup(func() { timeNow = time.Now })
+	t.Cleanup(func() { store.TimeNow = time.Now })
 
 	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
 		t.Fatalf("read 1: %d", rec.Code)
 	}
 	// 10 minutes later: still within window, deduped
-	timeNow = func() time.Time { return base.Add(10 * time.Minute) }
+	store.TimeNow = func() time.Time { return base.Add(10 * time.Minute) }
 	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
 		t.Fatalf("re-read within window: %d", rec.Code)
 	}
 	// 20 minutes after first read: window expired, counts as read 2
-	timeNow = func() time.Time { return base.Add(20 * time.Minute) }
+	store.TimeNow = func() time.Time { return base.Add(20 * time.Minute) }
 	if rec := getWithCookie(t, h, id, "aaa"); rec.Code != 200 {
 		t.Fatalf("re-read after window expected 200, got %d", rec.Code)
 	}
@@ -130,13 +132,6 @@ func TestBurnReadsDefaultOne(t *testing.T) {
 }
 
 func TestBurnReadsPageViewCounts(t *testing.T) {
-	if webUIInstance == nil {
-		ui, err := NewWebUI()
-		if err != nil {
-			t.Fatal(err)
-		}
-		webUIInstance = ui
-	}
 	s := testServer(t)
 	h := s.routes()
 	id := createBurnReads(t, h, 2)

internal/api/cans.go

@@ -1,11 +1,11 @@
-package main
+package api
 
 import (
-	"database/sql"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"palette/internal/store"
 	"strings"
 	"time"
 
@@ -40,12 +40,18 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
+		// #60: clamp at the API boundary like the pastes API does -
+		// reject zero/negative and durations past the 1-year UI cap.
+		if !store.ValidExpiry(d) {
+			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
+			return
+		}
 		t := now + int64(d.Seconds())
 		expiresAt = &t
 	}
 	var pwHash *string
 	if password != "" {
-		h, err := hashPassword(password)
+		h, err := store.Argon2IDHash(password)
 		if err != nil {
 			writeErr(w, 500, "hash error")
 			return
@@ -53,9 +59,8 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 		pwHash = &h
 	}
 
-	canID := genSlug(8)
+	canID := store.GenSlug(8)
-	_, err := a.store.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
+	err := a.store.InsertCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt)
-		VALUES (?,?,?,?,?,?,?)`, canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt)
 	if err != nil {
 		writeErr(w, 500, "db error")
 		return
@@ -76,7 +81,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			lang := it["language"]
-			if err := a.store.insertCanItem(canID, it["title"], content, "text/plain", &lang, nil, nil, now); err != nil {
+			if err := a.store.InsertCanItem(canID, it["title"], content, "text/plain", &lang, nil, nil, now); err != nil {
 				writeErr(w, 500, "db error")
 				return
 			}
@@ -104,7 +109,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 					return
 				}
 				contentStr := string(content)
-				if err := a.store.insertCanItem(canID, fh.Filename, contentStr, detectContentType(fh.Filename, content), nil, nil, &contentStr, now); err != nil {
+				if err := a.store.InsertCanItem(canID, fh.Filename, contentStr, detectContentType(fh.Filename, content), nil, nil, &contentStr, now); err != nil {
 					writeErr(w, 500, "db error")
 					return
 				}
@@ -114,7 +119,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if itemCount == 0 {
-		a.store.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
+		a.store.DeleteCan(canID)
 		writeErr(w, 400, "can needs at least one item (files or json_items)")
 		return
 	}
@@ -144,46 +149,6 @@ func detectContentType(name string, content []byte) string {
 	return "text/plain"
 }
 
-func (s *Store) insertCanItem(canID, title, content, contentType string, language, expiresAt *string, binary *string, now int64) error {
-	// language/expiresAt unused here for now; content stored as text (binary-safe in sqlite)
-	_, err := s.db.Exec(`INSERT INTO pastes
-		(id, content, content_type, language, title, visibility, can_id, created_at)
-		VALUES (?,?,?,?,?,?,?,?)`,
-		genSlug(6), content, contentType, language, &title, "unlisted", canID, now)
-	_ = expiresAt
-	_ = binary
-	return err
-}
-
-func (s *Store) GetCan(id string) (*CanRow, error) {
-	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at
-		FROM paste_cans WHERE id = ? AND deleted_at IS NULL`, id)
-	var c CanRow
-	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	return &c, err
-}
-
-func (s *Store) ListCanItems(canID string) ([]PasteRow, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count
-		FROM pastes WHERE can_id = ? AND deleted_at IS NULL ORDER BY created_at ASC`, canID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		if err := rows.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount); err != nil {
-			return nil, err
-		}
-		out = append(out, r)
-	}
-	return out, nil
-}
-
 func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	can, err := a.store.GetCan(id)
@@ -204,7 +169,7 @@ func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 		if pw == "" {
 			pw = r.URL.Query().Get("password")
 		}
-		if pw == "" || !checkPassword(can.PasswordHash.String, pw) {
+		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
 			writeErr(w, 401, "password required")
 			return
 		}
@@ -224,12 +189,12 @@ func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	metas := make([]itemMeta, 0, len(items))
 	for _, it := range items {
 		metas = append(metas, itemMeta{
-			ID: it.ID, Title: nullStrPtr(it.Title), ContentType: it.ContentType,
+			ID: it.ID, Title: store.NullStrPtr(it.Title), ContentType: it.ContentType,
 			Size: len(it.Content), URL: "/api/pastes/" + it.ID,
 		})
 	}
 	writeJSON(w, 200, map[string]any{
-		"id": can.ID, "title": nullStrPtr(can.Title), "visibility": can.Visibility,
+		"id": can.ID, "title": store.NullStrPtr(can.Title), "visibility": can.Visibility,
 		"created_at": can.CreatedAt, "items": metas,
 	})
 }
@@ -253,11 +218,17 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 		if pw == "" {
 			pw = r.URL.Query().Get("password")
 		}
-		if pw == "" || !checkPassword(can.PasswordHash.String, pw) {
+		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
 			writeErr(w, 401, "password required")
 			return
 		}
 	}
-	w.Header().Set("Content-Type", row.ContentType)
+	// #34: same content-type guard as /raw — never serve active content types.
+	ct := row.ContentType
+	if !safeRawContentType(ct) {
+		ct = "text/plain; charset=utf-8"
+	}
+	w.Header().Set("Content-Type", ct)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.Write([]byte(row.Content))
 }

internal/api/cans_expiry_test.go

@@ -0,0 +1,45 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+// #60: the cans API must clamp expires_in at the boundary exactly like the
+// pastes API — reject zero/negative durations and anything over the 1-year
+// UI cap, accept the exact boundaries.
+func TestCreateCanExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},    // negative
+		{"-0s", 400},    // negative zero
+		{"0s", 400},     // zero
+		{"1ns", 400},    // positive but below the 1-minute floor
+		{"59s", 400},    // just under the floor
+		{"1m", 201},     // exactly the floor
+		{"90s", 201},    // just over the floor
+		{"8760h", 201},  // exactly 1 year
+		{"8785h", 400},  // 1 year + 1 day: over the cap
+		{"87600h", 400}, // 10 years, the originally reported case
+	}
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		body, ct := multipartBody(t, map[string]string{
+			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+			"expires_in": c.expiresIn,
+		}, "files", "pic.txt", "file data")
+		req := httptest.NewRequest("POST", "/api/pastes/can", body)
+		req.Header.Set("Content-Type", ct)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}

internal/api/cans_test.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"bytes"

internal/api/customslug_test.go

@@ -1,6 +1,8 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+
 	"encoding/json"
 	"net/http/httptest"
 	"strings"
@@ -61,7 +63,7 @@ func TestCustomSlugValidation(t *testing.T) {
 func TestSlugCollisionWithAutoID(t *testing.T) {
 	s := testServer(t)
 	// manually insert a paste, then try to claim its auto ID as a custom slug
-	p, err := s.store.CreatePaste(&Paste{Content: "auto"})
+	p, err := s.store.CreatePaste(&store.Paste{Content: "auto"})
 	if err != nil {
 		t.Fatal(err)
 	}

internal/api/delete_auth_test.go

@@ -0,0 +1,172 @@
+package api
+
+// Regression tests for #63: DELETE /api/pastes/{id} must require the
+// deletion token (Authorization header or ?token= query param, constant-time
+// compare). Without a token, or with a wrong token, the paste must survive
+// and the response must be 403.
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// createTestPaste creates a paste via the API and returns id + deletion token.
+func createTestPaste(t *testing.T, h http.Handler) (string, string) {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"delete me"}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID == "" || created.DeletionToken == "" {
+		t.Fatalf("create response missing id/deletion_token: %s", rec.Body.String())
+	}
+	return created.ID, created.DeletionToken
+}
+
+func pasteExists(t *testing.T, h http.Handler, id string) bool {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code == 200 {
+		return true
+	}
+	if rec.Code == 404 {
+		return false
+	}
+	t.Fatalf("get after delete: got %d", rec.Code)
+	return false
+}
+
+func TestDeleteWithoutTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id, "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete without token: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted without a token")
+	}
+}
+
+func TestDeleteWithWrongTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	// query param
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id+"?token=wrong-token", "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (query): got %d want 403", rec.Code)
+	}
+	// header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer wrong-token")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (header): got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted with a wrong token")
+	}
+}
+
+func TestDeleteWithCorrectToken(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, tok := createTestPaste(t, h)
+
+	// via Authorization header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer "+tok)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (header): got %d want 200: %s", rec.Code, rec.Body.String())
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete")
+	}
+
+	// via query param
+	id, tok = createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id+"?token="+tok, "", "")
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (query): got %d want 200", rec.Code)
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete (query)")
+	}
+}
+
+func TestDeleteByCreatorViewerCookieStillAllowed(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	// create from a specific browser
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"mine"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator-abc"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// creator browser deletes without a token: allowed (#37 /mine delete button)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+created.ID, "creator-abc", "")
+	if rec.Code != 200 {
+		t.Fatalf("creator delete: got %d want 200", rec.Code)
+	}
+
+	// a different browser is still forbidden
+	id, _ := createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id, "someone-else", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("other browser delete: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste deleted by unrelated browser")
+	}
+}
+
+func TestDeletionAuthorizationExtract(t *testing.T) {
+	mk := func(hdr, q string) *http.Request {
+		req := httptest.NewRequest("DELETE", "/api/pastes/x"+q, nil)
+		if hdr != "" {
+			req.Header.Set("Authorization", hdr)
+		}
+		return req
+	}
+	cases := []struct {
+		hdr, q, want string
+	}{
+		{"", "", ""},
+		{"Bearer tok", "", "tok"},
+		{"bearer tok", "", "tok"},
+		{"Token tok", "", "tok"},
+		{"tok", "", "tok"},
+		{"", "?token=q", "q"},
+		{"Bearer hdr", "?token=q", "hdr"}, // header wins
+	}
+	for _, c := range cases {
+		if got := deletionAuthorization(mk(c.hdr, c.q)); got != c.want {
+			t.Errorf("deletionAuthorization(hdr=%q q=%q) = %q want %q", c.hdr, c.q, got, c.want)
+		}
+	}
+}

internal/api/guess.go

@@ -0,0 +1,26 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"palette/internal/lang"
+)
+
+// handleGuessLang serves POST /api/guess-language.
+func (a *apiServer) handleGuessLang(w http.ResponseWriter, r *http.Request) {
+	setRateLimitHeaders(w, 1, 5)
+	if !rateLimitGuess(r) {
+		writeRateLimited(w, 1)
+		return
+	}
+	var req struct {
+		Content string `json:"content"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, http.StatusBadRequest, "invalid json body")
+		return
+	}
+	l := lang.GuessLang(req.Content)
+	writeJSON(w, http.StatusOK, map[string]any{"language": l})
+}

internal/api/issue68_validation_test.go

@@ -0,0 +1,198 @@
+package api
+
+// Regression tests for #68 input-validation gaps: negative/oversized content
+// lengths (413), limit=0 → default page size, unchecked query params
+// (negative offset), and negative burn_after_reads.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func createPasteRaw(t *testing.T, h http.Handler, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+// A request whose decoded content exceeds the admin-tunable cap is rejected
+// with 413 and a clear message (content under the body cap, over the
+// content cap).
+func TestCreatePasteContentOverCap413(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// content over MaxContentBytes (5MiB) but under body cap (+4KiB): send
+	// just over the content cap so the per-field check fires first.
+	content := strings.Repeat("a", 5*1024*1024+10)
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "content exceeds max") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+}
+
+// A request whose entire body is larger than the server-side body cap is cut
+// off by http.MaxBytesReader and answered with 413, not decoded into memory
+// (#68: previously a giant body was fully buffered, then rejected only at
+// the per-field check — actually the decode happened before any check).
+func TestCreatePasteBodyOverCap413(t *testing.T) {
+	s := testServer(t)
+	// shrink the content cap so the body cap is small too
+	ss := s.settings.get()
+	ss.MaxContentBytes = 64 * 1024
+	if err := s.settings.set(ss); err != nil {
+		t.Fatal(err)
+	}
+	h := s.routes()
+
+	content := strings.Repeat("a", 200*1024) // 200KiB > 64KiB+4KiB body cap
+	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s","title":"x"}`, content))
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// Negative content lengths cannot be expressed via JSON, but a negative
+// expires-style numeric payload must not crash; more importantly the
+// burn_after_reads field: negative values are rejected with a clear message.
+func TestCreatePasteNegativeBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	rec := createPasteRaw(t, h, `{"content":"hi","burn_after_reads":-5}`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "burn_after_reads") {
+		t.Fatalf("unclear error message: %s", rec.Body.String())
+	}
+
+	// 0 and positive values still work (0 = default single read, per #49)
+	rec = createPasteRaw(t, h, `{"content":"hi","burn_after_reads":0,"burn_after_read":true}`)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("zero burn_after_reads: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// limit=0 on list endpoints returns the default page size (existing clamp
+// treats <=0 as default; #68 asks this be explicit and tested).
+func TestListLimitZeroUsesDefault(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// seed 3 public pastes
+	for i := 0; i < 3; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d: %s", rec.Code, rec.Body.String())
+		}
+	}
+
+	for _, q := range []string{"/api/public?limit=0", "/api/public"} {
+		req := httptest.NewRequest("GET", q, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 200 {
+			t.Fatalf("%s: got %d", q, rec.Code)
+		}
+		var got struct {
+			Limit int                   `json:"limit"`
+			Total int                   `json:"total"`
+			Items []struct{ ID string } `json:"items"`
+		}
+		json.Unmarshal(rec.Body.Bytes(), &got)
+		if got.Limit != 25 || len(got.Items) != 3 {
+			t.Fatalf("%s: limit=%d items=%d, want limit 25 and all 3 items", q, got.Limit, len(got.Items))
+		}
+	}
+}
+
+// Huge limit values are clamped to the max page size (already the behavior;
+// regression-tested here per #68 "validate unchecked params").
+func TestListLimitHugeClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=999999999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var got struct {
+		Limit int `json:"limit"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 {
+		t.Fatalf("limit=%d, want clamped to 25", got.Limit)
+	}
+}
+
+// Negative offset previously passed through unchecked to SQL (harmless in
+// SQLite, but invalid); it must be clamped to 0 (#68).
+func TestListNegativeOffsetClamped(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	for i := 0; i < 2; i++ {
+		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
+		if rec.Code != 201 {
+			t.Fatalf("seed: got %d", rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public?offset=-999", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Offset int `json:"offset"`
+		Total  int `json:"total"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Offset != 0 || got.Total != 2 {
+		t.Fatalf("offset=%d total=%d, want offset 0 and total 2", got.Offset, got.Total)
+	}
+
+	// /api/mine too (needs the viewer cookie)
+	req = httptest.NewRequest("GET", "/api/mine?offset=-5", nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "offclamp"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var mine struct {
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &mine)
+	if mine.Offset != 0 {
+		t.Fatalf("mine offset=%d, want 0", mine.Offset)
+	}
+}
+
+// Non-numeric limit/offset fall back to defaults instead of 500s.
+func TestListGarbageParams(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("GET", "/api/public?limit=abc&offset=xyz", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("got %d", rec.Code)
+	}
+	var got struct {
+		Limit  int `json:"limit"`
+		Offset int `json:"offset"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Limit != 25 || got.Offset != 0 {
+		t.Fatalf("limit=%d offset=%d, want 25/0", got.Limit, got.Offset)
+	}
+}

internal/api/main_test.go

@@ -1,6 +1,9 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -12,11 +15,19 @@ import (
 func testServer(t *testing.T) *apiServer {
 	t.Helper()
 	globalLimiter = newLimiter() // fresh buckets per test
-	store, err := OpenStore(":memory:")
+	ui, err := web.New()
 	if err != nil {
 		t.Fatal(err)
 	}
-	return &apiServer{store: store, cfg: Config{MaxTextBytes: 5 * 1024 * 1024, MaxItemBytes: 25 * 1024 * 1024}}
+	st, err := store.OpenStore(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := Config{MaxTextBytes: 5 * 1024 * 1024, MaxItemBytes: 25 * 1024 * 1024}
+	ss := NewTestSettingsStore(t, cfg)
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 }
 
 func TestCreateAndGetPaste(t *testing.T) {
@@ -31,7 +42,9 @@ func TestCreateAndGetPaste(t *testing.T) {
 	if rec.Code != 201 {
 		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
 	}
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 	if len(created.ID) != 6 {
 		t.Fatalf("unexpected id: %q", created.ID)
@@ -62,7 +75,9 @@ func TestPasswordProtection(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// without password -> 401
@@ -122,10 +137,14 @@ func TestSoftDelete(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"bye"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID, nil)
+	req.Header.Set("Authorization", "Bearer "+created.DeletionToken)
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != 200 {
@@ -164,6 +183,46 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	}
 }
 
+func TestListPublicExcludesPasswordAndUnlisted(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	bodies := []string{
+		`{"content":"open","visibility":"public"}`,
+		`{"content":"locked","visibility":"public","password":"hunter2"}`,
+		`{"content":"hidden","visibility":"unlisted"}`,
+	}
+	for _, body := range bodies {
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("create %s: got %d", body, rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("list public: got %d", rec.Code)
+	}
+	var resp struct {
+		Total int              `json:"total"`
+		Items []map[string]any `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Total != 1 || len(resp.Items) != 1 {
+		t.Fatalf("expected only the 1 public paste, got total=%d items=%d", resp.Total, len(resp.Items))
+	}
+	// password-protected and unlisted pastes must not appear (no metadata leak)
+	for _, secret := range []string{"hunter2", "locked", "hidden"} {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Fatalf("leaked %q in /api/public response", secret)
+		}
+	}
+}
+
 func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()
@@ -171,19 +230,21 @@ func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"gone soon"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	s.store.SoftDelete(created.ID)
 
 	// simulate grace elapsed
-	past := time.Now().Unix() - (softDeleteGraceDays+1)*86400
+	past := time.Now().Unix() - (store.SoftDeleteGraceDays+1)*86400
-	s.store.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=?`, past, created.ID)
+	s.store.Exec(`UPDATE pastes SET deleted_at=? WHERE id=?`, past, created.ID)
 
 	s.store.SweepExpired()
 
 	var count int
-	s.store.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID).Scan(&count)
+	count = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
 	if count != 0 {
 		t.Fatal("expected hard delete after grace period")
 	}
@@ -191,9 +252,9 @@ func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 
 func TestSlugCharset(t *testing.T) {
 	for i := 0; i < 100; i++ {
-		s := genSlug(6)
+		s := store.GenSlug(6)
 		for _, c := range s {
-			if !strings.ContainsRune(slugAlphabet, c) {
+			if !strings.ContainsRune(store.SlugAlphabet, c) {
 				t.Fatalf("bad char %q in slug %q", c, s)
 			}
 		}
@@ -207,7 +268,9 @@ func TestRawEndpoint(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"raw content here"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("GET", "/raw/"+created.ID, nil)

internal/api/mine_test.go

@@ -1,6 +1,9 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -40,16 +43,19 @@ func viewerCookieFor(t *testing.T, h http.Handler, path string) string {
 
 func TestMineCreateListDelete(t *testing.T) {
 	globalLimiter = newLimiter() // fresh rate-limit buckets
-	webUI, err := NewWebUI()
+	st, err := store.OpenStore(":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
-	webUIInstance = webUI
+	ui, err := web.New()
-	store, err := OpenStore(":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
-	a := &apiServer{store: store, cfg: Config{MaxTextBytes: 5 * 1024 * 1024}}
+	cfg := Config{MaxTextBytes: 5 * 1024 * 1024}
+	ss := NewTestSettingsStore(t, cfg)
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	a := &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 	h := a.routes()
 
 	alice := viewerCookieFor(t, h, "/history")

internal/api/pentest_cookie_test.go

@@ -0,0 +1,42 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #34: the unlock cookie must be bound to the paste it unlocks, not a
+// forgeable static value. A forged 'pw_<id>=1' cookie must not bypass the
+// password check on the paste page.
+func TestForgedUnlockCookieDoesNotBypassPassword(t *testing.T) {
+	globalLimiter = newLimiter()
+	s := testServer(t)
+	h := s.routes()
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"SECRETPASTECONTENT","password":"hunter2"}`))
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d", rec.Code)
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	id := created.ID
+
+	// request the page with a forged unlock cookie in the old format
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + id, Value: "1"})
+	h.ServeHTTP(rec, req)
+	if rec.Code == 200 && strings.Contains(rec.Body.String(), "SECRETPASTECONTENT") {
+		t.Fatal("forged pw_<id>=1 cookie bypassed password protection")
+	}
+	if rec.Code != 200 {
+		t.Logf("forged-cookie request returned %d (page still locked) — good", rec.Code)
+	}
+}

internal/api/pentest_helpers_test.go

@@ -0,0 +1,16 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// test helpers for pentest tests (#34)
+func jsonField(tb testing.TB, body, field string) string {
+	var m map[string]any
+	if err := json.Unmarshal([]byte(body), &m); err != nil {
+		tb.Fatalf("bad json: %v", err)
+	}
+	v, _ := m[field].(string)
+	return v
+}

internal/api/pentest_rawct_test.go

@@ -0,0 +1,65 @@
+package api
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #34: attacker-controlled content_type must not let a paste be served as
+// HTML/SVG/XML from /raw (stored XSS). Only a fixed safe set passes through.
+func TestRawRejectsHTMLContentType(t *testing.T) {
+	globalLimiter = newLimiter() // fresh rate-limit buckets
+	s := testServer(t)
+	h := s.routes()
+
+	for _, ct := range []string{
+		"text/html", "TEXT/HTML", "text/html;charset=utf-8", "text/html;x=1",
+		"application/xhtml+xml", "image/svg+xml", "text/html,",
+	} {
+		globalLimiter = newLimiter() // burst 5, loop makes 7 creates
+		body := `{"content":"<script>alert(1)</script>","content_type":"` + ct + `"}`
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("ct %q: create got %d: %s", ct, rec.Code, rec.Body.String())
+		}
+		id := jsonField(t, rec.Body.String(), "id")
+
+		rec = httptest.NewRecorder()
+		req = httptest.NewRequest("GET", "/raw/"+id, nil)
+		h.ServeHTTP(rec, req)
+		if got := rec.Header().Get("Content-Type"); got == ct {
+			t.Errorf("ct %q was served verbatim from /raw (stored XSS vector)", ct)
+		}
+		if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+			t.Errorf("ct %q: /raw missing X-Content-Type-Options: nosniff", ct)
+		}
+	}
+}
+
+func TestRawAllowsSafeContentType(t *testing.T) {
+	globalLimiter = newLimiter()
+	s := testServer(t)
+	h := s.routes()
+
+	for _, ct := range []string{"text/plain", "image/png", "application/pdf", "application/octet-stream"} {
+		globalLimiter = newLimiter()
+		body := `{"content":"hi","content_type":"` + ct + `"}`
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("ct %q: create got %d", ct, rec.Code)
+		}
+		id := jsonField(t, rec.Body.String(), "id")
+
+		rec = httptest.NewRecorder()
+		req = httptest.NewRequest("GET", "/raw/"+id, nil)
+		h.ServeHTTP(rec, req)
+		if got := rec.Header().Get("Content-Type"); got != ct {
+			t.Errorf("ct %q: got %q", ct, got)
+		}
+	}
+}

internal/api/ratelimit.go

@@ -1,4 +1,4 @@
-package main
+package api
 
 import (
 	"net/http"
@@ -59,9 +59,19 @@ func clientIP(r *http.Request) string {
 
 var globalLimiter = newLimiter()
 
-// rateLimitCreate: 1 req/sec refill, burst 5, per IP.
+// globalSettingsFn is set at startup; tests can point it at fixed settings.
-func rateLimitCreate(r *http.Request) bool {
+var globalSettingsFn func() Settings
-	return globalLimiter.allow("create:"+clientIP(r), 1, 5)
+
+func globalSettings() Settings {
+	if globalSettingsFn != nil {
+		return globalSettingsFn()
+	}
+	return defaultSettings(Config{})
+}
+
+// rateLimitCreate uses the admin-tunable burst and per-minute refill (#40).
+func rateLimitCreate(r *http.Request, s Settings) bool {
+	return globalLimiter.allow("create:"+clientIP(r), s.RateLimitPerMinute/60.0, s.RateLimitBurst)
 }
 
 // rateLimitGuess: 1 req/sec refill, burst 5, per IP.
@@ -74,6 +84,12 @@ func rateLimitUnlock(id string, r *http.Request) bool {
 	return globalLimiter.allow("unlock:"+id+":"+clientIP(r), 5.0/60.0, 5)
 }
 
+// rateLimitAdmin: 5 attempts per minute per IP on the admin key check (#66),
+// same pattern as the unlock limiter (#34).
+func rateLimitAdmin(r *http.Request) bool {
+	return globalLimiter.allow("admin:"+clientIP(r), 5.0/60.0, 5)
+}
+
 // writeRateLimited responds 429 with Retry-After based on refill rate.
 func writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
 	w.Header().Set("Retry-After", strconv.Itoa(retryAfterSecs))

internal/api/ratelimit_test.go

@@ -1,6 +1,10 @@
-package main
+package api
 
 import (
+	"palette/internal/lang"
+	"palette/internal/store"
+	"palette/internal/web"
+
 	"bytes"
 	"encoding/json"
 	"net/http"
@@ -12,18 +16,19 @@ import (
 func newTestServer(t *testing.T) *apiServer {
 	t.Helper()
 	globalLimiter = newLimiter() // fresh buckets per test
-	store, err := OpenStore(t.TempDir() + "/test.db")
+	st, err := store.OpenStore(t.TempDir() + "/test.db")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if webUIInstance == nil {
+	ui, err := web.New()
-		ui, err := NewWebUI()
 	if err != nil {
 		t.Fatal(err)
 	}
-		webUIInstance = ui
+	cfg := Config{MaxTextBytes: 1024 * 1024}
-	}
+	ss := NewTestSettingsStore(t, cfg)
-	return &apiServer{store: store, cfg: Config{MaxTextBytes: 1024 * 1024}}
+	globalSettingsFn = ss.get
+	t.Cleanup(func() { globalSettingsFn = nil })
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: "test-admin-key"}
 }
 
 func postJSON(t *testing.T, h http.Handler, path string, body any) *httptest.ResponseRecorder {
@@ -146,7 +151,7 @@ func TestRateLimitUnlock(t *testing.T) {
 // TestHighlightCode basic expectations.
 func TestHighlightCode(t *testing.T) {
 	in := "func main() {\n\t// comment\n\tfmt.Println(\"hello\")\n}\n"
-	out := highlightCode(in, "go")
+	out := lang.HighlightCode(in, "go")
 	if !bytes.Contains([]byte(out), []byte(`<span class="tok-kw">func</span>`)) {
 		t.Fatalf("no keyword span: %s", out)
 	}
@@ -157,12 +162,12 @@ func TestHighlightCode(t *testing.T) {
 		t.Fatalf("no string span: %s", out)
 	}
 	// unsupported language returns escaped plain text
-	plain := highlightCode("<b>x</b>", "text")
+	plain := lang.HighlightCode("<b>x</b>", "text")
 	if plain != "&lt;b&gt;x&lt;/b&gt;" {
 		t.Fatalf("plain escaping wrong: %q", plain)
 	}
 	// line count preserved (gutter alignment)
-	if got := len(splitLines(highlightCode("a\nb\nc", "go"))); got != 3 {
+	if got := len(splitLines(lang.HighlightCode("a\nb\nc", "go"))); got != 3 {
 		t.Fatalf("want 3 lines, got %d", got)
 	}
 }

internal/api/server.go

@@ -0,0 +1,464 @@
+// Package api implements palette's REST handlers and the HTTP router:
+// pastes, cans, guess-language, rate limiting middleware, and the admin API.
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+
+	"database/sql"
+
+	"palette/internal/store"
+	"palette/internal/web"
+)
+
+type Config struct {
+	Addr         string
+	DBPath       string
+	MaxTextBytes int64
+	MaxItemBytes int64
+}
+
+type apiServer struct {
+	store    *store.Store
+	cfg      Config
+	ui       *web.UI
+	settings *settingsStore
+	adminKey string
+}
+
+func NewServer(st *store.Store, cfg Config, ui *web.UI, ss *settingsStore, adminKey string) *apiServer {
+	return &apiServer{store: st, cfg: cfg, ui: ui, settings: ss, adminKey: adminKey}
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v)
+}
+
+func writeErr(w http.ResponseWriter, status int, msg string) {
+	writeJSON(w, status, map[string]string{"error": msg})
+}
+
+// Routes returns the HTTP handler for the server.
+func (a *apiServer) Routes() http.Handler {
+	return a.routes()
+}
+
+func (a *apiServer) routes() http.Handler {
+	r := chi.NewRouter()
+	r.Use(middleware.Recoverer)
+	r.Use(middleware.Timeout(30 * time.Second))
+	r.Use(a.limitRequestBody) // #68: hard server-side body cap -> 413
+	r.Use(viewerCookieMiddleware)
+	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
+
+	// admin (#40): HTML page is open (key entry via form); API is key-guarded
+	r.Get("/admin", a.ui.Handlers().HandleAdminPage)
+	r.Get("/admin/api/settings", a.adminAuth(a.handleAdminGetSettings, a.adminKey))
+	r.Post("/admin/api/settings", a.adminAuth(a.handleAdminPostSettings, a.adminKey))
+
+	// API
+	r.Route("/api", func(r chi.Router) {
+		r.Post("/pastes", a.handleCreatePaste)
+		r.Get("/pastes/{id}", a.handleGetPaste)
+		r.Delete("/pastes/{id}", a.handleDeletePaste)
+		r.Get("/mine", a.handleListMine)
+		r.Delete("/pastes/{id}/redeem", a.handleRedeemDeletion)
+		r.Get("/public", a.handleListPublic)
+		r.Post("/guess-language", a.handleGuessLang)
+		r.Post("/pastes/can", a.handleCreateCan)
+		r.Get("/cans/{id}", a.handleGetCan)
+		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
+	})
+
+	// can page
+	r.Get("/can/{id}", a.handleCanPage)
+
+	// raw
+	r.Get("/raw/{id}", a.handleRaw)
+
+	// web pages
+	r.Get("/", http.RedirectHandler("/history", http.StatusFound).ServeHTTP)
+	r.Get("/new", a.ui.Handlers().HandleNewPage)
+	r.Get("/history", a.ui.Handlers().HandleHistoryPage)
+	r.Get("/settings", a.ui.Handlers().HandleSettingsPage)
+	r.Get("/mine", a.ui.Handlers().HandleMinePage)
+	r.Handle("/static/*", a.ui.StaticHandler())
+	r.Get("/unlock/{id}", a.handlePasteView)
+	r.Post("/unlock/{id}", a.handlePasteView)
+	r.Get("/{id}", a.handlePasteView)
+	r.Post("/{id}", a.handlePasteView)
+
+	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		writeErr(w, 404, "not found")
+	})
+	return r
+}
+
+// viewerCookieMiddleware ensures every request carries an anonymous browser id
+// cookie ("vwr"); sets one on the response if absent. Used by /mine (#37, #49).
+func viewerCookieMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if c, err := r.Cookie("vwr"); err != nil || c.Value == "" {
+			id := store.GenSlug(16)
+			http.SetCookie(w, &http.Cookie{
+				Name: "vwr", Value: id, Path: "/",
+				MaxAge: 31536000, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+			})
+			r.AddCookie(&http.Cookie{Name: "vwr", Value: id})
+			// remember that this cookie was minted here, not sent by the client
+			r = r.WithContext(context.WithValue(r.Context(), vwrMintedKey, true))
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+type vwrMintedKeyType struct{}
+
+var vwrMintedKey vwrMintedKeyType
+
+func currentViewerID(r *http.Request) string {
+	if c, err := r.Cookie("vwr"); err == nil {
+		return c.Value
+	}
+	return ""
+}
+
+// viewerSentCookie reports whether the client itself sent a vwr cookie
+// (as opposed to the middleware minting one for this request).
+func viewerSentCookie(r *http.Request) bool {
+	if _, err := r.Cookie("vwr"); err != nil {
+		return false
+	}
+	_, minted := r.Context().Value(vwrMintedKey).(bool)
+	return !minted
+}
+
+func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
+	s := a.settings.get()
+	setRateLimitHeaders(w, 1, 5)
+	if !rateLimitCreate(r, s) {
+		writeRateLimited(w, 1)
+		return
+	}
+	var p store.Paste
+	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
+		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
+			writeBodyTooLarge(w)
+			return
+		}
+		writeErr(w, 400, "invalid json body")
+		return
+	}
+	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
+		writeErr(w, status, msg)
+		return
+	}
+	if p.BurnAfterReads != nil { // #68: reject negative read budgets
+		if err := parseBurnAfterReads(*p.BurnAfterReads); err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
+	}
+	// #40: admin-configurable default expiry
+	if (p.ExpiresIn == nil || *p.ExpiresIn == "") && s.DefaultExpiry != "" {
+		def := s.DefaultExpiry
+		p.ExpiresIn = &def
+	}
+	p.ViewerID = currentViewerID(r)
+	created, err := a.store.CreatePaste(&p)
+	if err != nil {
+		writeErr(w, 400, err.Error())
+		return
+	}
+	writeJSON(w, 201, map[string]any{
+		"id":             created.ID,
+		"deletion_token": created.DeletionToken,
+		"url":            "/" + created.ID,
+		"raw_url":        "/raw/" + created.ID,
+		"api_url":        "/api/pastes/" + created.ID,
+		"expires_at":     created.ExpiresAt,
+		"created_at":     created.CreatedAt,
+		"rate_limit":     map[string]int{"create_per_sec": 1, "burst": 5},
+	})
+}
+
+func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	if row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		writeErr(w, 404, "paste expired")
+		return
+	}
+	if row.Burned() { // #49: read budget exhausted
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	if row.PasswordHash.Valid {
+		// require password via header or query
+		pw := r.Header.Get("X-Paste-Password")
+		if pw == "" {
+			pw = r.URL.Query().Get("password")
+		}
+		if pw == "" || !store.CheckPassword(row.PasswordHash.String, pw) {
+			writeErr(w, 401, "password required")
+			return
+		}
+	}
+	// #58: only the reader that wins the atomic burn claim may see content.
+	rem, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	writeJSON(w, 200, map[string]any{
+		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
+		"language": store.NullStrPtr(row.Language), "title": store.NullStrPtr(row.Title), "created_at": row.CreatedAt,
+		"view_count": row.ViewCount, "visibility": row.Visibility,
+		"reads_remaining": rem,
+	})
+}
+
+func (a *apiServer) handleDeletePaste(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		writeErr(w, 404, "paste not found")
+		return
+	}
+	// #63: deletion requires authorization. Either the deletion token issued
+	// at create time (Authorization header or ?token= query param, matching
+	// the create response's "deletion_token" field), or the creator browser
+	// itself (client-sent vwr cookie matching the paste's viewer, #37).
+	if !a.deletionAuthorized(r, row) {
+		writeErr(w, 403, "deletion token required")
+		return
+	}
+	if _, err := a.store.SoftDelete(row.ID); err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
+}
+
+// deletionAuthorization extracts the deletion token from the request: the
+// Authorization header ("Bearer <t>", "Token <t>", or a bare token) or the
+// token query parameter. Returns "" when absent.
+func deletionAuthorization(r *http.Request) string {
+	if h := r.Header.Get("Authorization"); h != "" {
+		for _, prefix := range []string{"Bearer ", "Token "} {
+			if len(h) > len(prefix) && strings.EqualFold(h[:len(prefix)], prefix) {
+				return strings.TrimSpace(h[len(prefix):])
+			}
+		}
+		return strings.TrimSpace(h)
+	}
+	return r.URL.Query().Get("token")
+}
+
+// deletionAuthorized reports whether the request may soft-delete the paste:
+// a valid constant-time-matched deletion token, or the creator browser's
+// viewer cookie (#37). Plain API clients with no token get false.
+func (a *apiServer) deletionAuthorized(r *http.Request, row *store.PasteRow) bool {
+	if tok := deletionAuthorization(r); tok != "" {
+		return row.DeletionToken.Valid && row.DeletionToken.String != "" &&
+			store.DeletionTokenEqual(row.DeletionToken.String, tok)
+	}
+	// viewer-cookie delete enforcement (#37): only the browser that created
+	// the paste (matching vwr) may delete it via this endpoint. Requests with
+	// no client-sent vwr cookie (plain API clients) are unaffected.
+	vid := currentViewerID(r)
+	return vid != "" && viewerSentCookie(r) && row.ViewerID.Valid &&
+		row.ViewerID.String != "" && row.ViewerID.String == vid
+}
+
+// handleListMine serves /api/mine: pastes created from this browser (#37).
+func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
+	vid := currentViewerID(r)
+	if vid == "" {
+		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
+		return
+	}
+	limit := parseLimit(r, 50, 100)
+	offset := parseOffset(r)
+	rows, total, err := a.store.ListMine(vid, limit, offset)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	items := make([]map[string]any, 0, len(rows))
+	for _, row := range rows {
+		lang, title := store.NullStrPtr(row.Language), store.NullStrPtr(row.Title)
+		items = append(items, map[string]any{
+			"id": row.ID, "title": title, "language": lang,
+			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
+			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
+		})
+	}
+	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
+}
+
+func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
+	limit := parseLimit(r, 25, 100)
+	offset := parseOffset(r)
+	rows, total, err := a.store.ListPublic(limit, offset)
+	if err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	items := make([]map[string]any, 0, len(rows))
+	for _, row := range rows {
+		lang, title := store.NullStrPtr(row.Language), store.NullStrPtr(row.Title)
+		items = append(items, map[string]any{
+			"id": row.ID, "title": title, "language": lang,
+			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
+			"custom_slug": store.NullStrPtr(row.CustomSlug),
+		})
+	}
+	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
+}
+
+func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	row, err := a.store.GetPaste(id)
+	if err != nil || row == nil {
+		http.Error(w, "not found", 404)
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		http.Error(w, "paste expired", 404)
+		return
+	}
+	if row.PasswordHash.Valid {
+		http.Error(w, "password required", 401)
+		return
+	}
+	if row.Burned() { // #49: read budget exhausted
+		http.Error(w, "not found", 404)
+		return
+	}
+	// #49 decision: raw reads count against the read budget too, with the
+	// same per-viewer dedupe window as page views. #58: a reader that loses
+	// the burn claim must not receive the content.
+	_, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		http.Error(w, "not found", 404)
+		return
+	}
+	// #34: content_type is attacker-controlled via the create API. Serving it
+	// verbatim let a paste be stored with text/html (or image/svg+xml) and
+	// render as active content on this origin when fetched from /raw —
+	// stored XSS. Only pass through a fixed safe set; anything else is
+	// served as plain text with nosniff.
+	ct := row.ContentType
+	if !safeRawContentType(ct) {
+		ct = "text/plain; charset=utf-8"
+	}
+	w.Header().Set("Content-Type", ct)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	a.store.IncrementViews(row.ID)
+	w.Write([]byte(row.Content))
+}
+
+// safeRawContentType reports whether ct is in the fixed set of types that are
+// safe to serve verbatim on /raw (no active-content execution contexts).
+func safeRawContentType(ct string) bool {
+	base := ct
+	if i := strings.IndexByte(ct, ';'); i >= 0 {
+		base = ct[:i]
+	}
+	base = strings.ToLower(strings.TrimSpace(base))
+	switch base {
+	case "text/plain", "text/markdown", "text/x-markdown",
+		"application/json", "application/pdf",
+		"image/png", "image/jpeg", "image/gif", "image/webp",
+		"application/octet-stream":
+		return true
+	}
+	return false
+}
+
+func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	can, err := a.store.GetCan(id)
+	if err != nil || can == nil {
+		http.NotFound(w, r)
+		return
+	}
+	items, _ := a.store.ListCanItems(can.ID)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
+	for _, it := range items {
+		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
+	}
+	fmt.Fprintf(w, "</ul></body></html>")
+}
+
+func templateEsc(s string) string {
+	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
+	return r.Replace(s)
+}
+
+func (a *apiServer) handlePasteView(w http.ResponseWriter, r *http.Request) {
+	h := a.webHandlers()
+	// unlock POST rate limiting is wired through h.RateLimitOK
+	h.HandlePasteView(w, r)
+}
+
+func (a *apiServer) webHandlers() *web.Handlers {
+	return &web.Handlers{
+		UI:            a.ui,
+		Store:         a.store,
+		ViewerID:      currentViewerID,
+		BurnWindowMin: a.burnViewerWindow,
+		RateLimitOK:   func(id string, r *http.Request) bool { return rateLimitUnlock(id, r) },
+	}
+}
+
+func envOr(k, d string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return d
+}
+
+func envIntOr(k string, d int) int {
+	if v := os.Getenv(k); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return d
+}
+
+func nullStrOr(ns sql.NullString, def string) string {
+	if ns.Valid {
+		return ns.String
+	}
+	return def
+}
+
+// EnvOr returns the env var value or default.
+func EnvOr(k, d string) string { return envOr(k, d) }
+
+// EnvIntOr returns the env int value or default.
+func EnvIntOr(k string, d int) int { return envIntOr(k, d) }

internal/api/slugrelease_test.go

@@ -1,18 +1,19 @@
-package main
+package api
 
 import (
+	"palette/internal/store"
+
 	"testing"
 	"time"
 )
 
 // insertPasteWithSlug creates a paste directly with a custom slug and controlled
 // created_at/expires_at, bypassing the API's timestamp handling.
-func insertPasteWithSlug(t *testing.T, s *Store, slug string, createdAt, expiresAt int64) string {
+func insertPasteWithSlug(t *testing.T, s *store.Store, slug string, createdAt, expiresAt int64) string {
 	t.Helper()
-	id := genSlug(6)
+	id := store.GenSlug(6)
-	_, err := s.db.Exec(`INSERT INTO pastes (id, custom_slug, content, content_type, created_at, expires_at)
+	if _, err := s.Exec(`INSERT INTO pastes (id, custom_slug, content, content_type, created_at, expires_at)
-		VALUES (?, ?, ?, ?, ?, ?)`, id, slug, "x", "text/plain", createdAt, expiresAt)
+		VALUES (?, ?, ?, ?, ?, ?)`, id, slug, "x", "text/plain", createdAt, expiresAt); err != nil {
-	if err != nil {
 		t.Fatal(err)
 	}
 	return id
@@ -24,14 +25,14 @@ func TestReleaseSlugOnExpiredPaste(t *testing.T) {
 	s := testServer(t)
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "release-notes", now-3600, now-60)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 1 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 1 {
 		t.Fatalf("released %d err %v, want 1", n, err)
 	}
 	if taken, _ := s.store.SlugTaken("release-notes"); taken {
 		t.Fatal("slug should be released after expiry")
 	}
 	// slug must be reusable by a new paste
-	p, err := s.store.CreatePaste(&Paste{Content: "new", CustomSlug: strPtr("release-notes")})
+	p, err := s.store.CreatePaste(&store.Paste{Content: "new", CustomSlug: strPtr("release-notes")})
 	if err != nil {
 		t.Fatalf("reuse slug: %v", err)
 	}
@@ -45,7 +46,7 @@ func TestReleaseSlugOnOldPaste(t *testing.T) {
 	now := time.Now().Unix()
 	// created 31 days ago, no expiry -> released by 30-day reservation rule
 	insertPasteWithSlug(t, s.store, "old-url", now-31*86400, 0)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 1 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 1 {
 		t.Fatalf("released %d err %v, want 1", n, err)
 	}
 	if taken, _ := s.store.SlugTaken("old-url"); taken {
@@ -58,7 +59,7 @@ func TestKeepSlugOnRecentUnexpiredPaste(t *testing.T) {
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "fresh-url", now-3600, now+86400)
 	insertPasteWithSlug(t, s.store, "fresh-url2", now-3600, 0)
-	if n, err := s.store.ReleaseCustomSlugs(); err != nil || n != 0 {
+	if n, err := s.store.ReleaseCustomSlugs(store.SlugReservationDays); err != nil || n != 0 {
 		t.Fatalf("released %d err %v, want 0", n, err)
 	}
 	for _, slug := range []string{"fresh-url", "fresh-url2"} {
@@ -72,7 +73,7 @@ func TestSweeperTickerReleasesSlugs(t *testing.T) {
 	s := testServer(t)
 	now := time.Now().Unix()
 	insertPasteWithSlug(t, s.store, "ticker-url", now-7200, now-3600)
-	s.store.StartSweeper(10 * time.Millisecond)
+	s.store.StartSweeper(10*time.Millisecond, store.SlugReservationDays)
 	deadline := time.Now().Add(2 * time.Second)
 	for time.Now().Before(deadline) {
 		if taken, _ := s.store.SlugTaken("ticker-url"); !taken {

internal/api/sweep33_test.go

@@ -0,0 +1,100 @@
+package api
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #33 sweep: the create API must enforce the same expiry window as the UI
+// (1 minute .. 1 year). Previously -1h, 0s, 1ns and 30000h were all accepted,
+// producing pastes that were born expired or effectively permanent.
+func TestCreatePasteExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},
+		{"-0s", 400},
+		{"0s", 400},
+		{"1ns", 400},
+		{"59s", 400},
+		{"1m", 201},
+		{"90s", 201},
+		{"8760h", 201}, // exactly 1 year
+		{"8785h", 400}, // 1 year + 1 day: over the max
+		{"30000h", 400}, // ~3.4 years, over the max
+	}
+	globalLimiter = newLimiter() // one fresh bucket for the whole table
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		req := httptest.NewRequest("POST", "/api/pastes",
+			strings.NewReader(`{"content":"x","expires_in":"`+c.expiresIn+`"}`))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}
+
+// #33 sweep: HTML paste views must increment view_count. The increment was
+// missing from handlePasteView, so the counter only moved on /raw.
+func TestPasteViewIncrementsViewCount(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"vc"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	// first render counts (no ?created=1 here: that's the just-created banner case)
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("view: got %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("api get: got %d", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, `"view_count":2`) {
+		t.Fatalf("expected view_count 2 after two HTML views, got: %s", body)
+	}
+}
+
+// #33 sweep: the just-created banner render (?created=1) must NOT count as a
+// view for the creator.
+func TestJustCreatedViewDoesNotCount(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"jc"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	id := jsonField(t, rec.Body.String(), "id")
+
+	req = httptest.NewRequest("GET", "/"+id+"?created=1&token=t", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), `"view_count":1`) {
+		t.Fatalf("just-created render counted as a view: %s", rec.Body.String())
+	}
+}

internal/api/validate.go

@@ -0,0 +1,92 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// #68 input-validation helpers. Paste/can payloads are size-capped and list
+// endpoints get a single place where limit/offset are parsed and clamped.
+
+// maxRequestBody returns the HTTP body cap for JSON create endpoints: the
+// admin-tunable content cap plus headroom for JSON field overhead, floored
+// at 64KiB so a tiny admin-configured cap can't break small requests.
+func (a *apiServer) maxRequestBody() int64 {
+	s := a.settings.get()
+	max := s.MaxContentBytes + 4096
+	if max < 64*1024 {
+		max = 64 * 1024
+	}
+	return max
+}
+
+// limitRequestBody wraps the request body with http.MaxBytesReader so
+// oversized payloads are cut off server-side instead of being fully decoded
+// into memory before the per-field size check runs (#68). A read over the
+// cap surfaces as *http.MaxBytesError, which handlers map to 413.
+func (a *apiServer) limitRequestBody(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil {
+			r.Body = http.MaxBytesReader(w, r.Body, a.maxRequestBody())
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// writeBodyTooLarge emits the 413 response for a body rejected by
+// MaxBytesReader.
+func writeBodyTooLarge(w http.ResponseWriter) {
+	writeErr(w, http.StatusRequestEntityTooLarge, "request body too large")
+}
+
+// isBodyTooLarge reports whether err came from http.MaxBytesReader.
+func isBodyTooLarge(err error) bool {
+	var mbe *http.MaxBytesError
+	return errors.As(err, &mbe)
+}
+
+// checkContent validates paste content: rejects whitespace-only content
+// (400) and content over the byte cap (413). Returns (0, "") when valid.
+func checkContent(content string, maxBytes int64) (int, string) {
+	if strings.TrimSpace(content) == "" {
+		return http.StatusBadRequest, "content is required"
+	}
+	if int64(len(content)) > maxBytes { // #40/#68: admin-tunable cap
+		return http.StatusRequestEntityTooLarge,
+			fmt.Sprintf("content exceeds max %d bytes", maxBytes)
+	}
+	return 0, ""
+}
+
+// parseLimit clamps the ?limit query param: missing/non-numeric/zero/negative
+// or over-max values fall back to def. Zero intentionally maps to the default
+// page size, matching the pre-existing `<= 0` clamp (#68).
+func parseLimit(r *http.Request, def, max int) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("limit"))
+	if err != nil || n <= 0 || n > max {
+		return def
+	}
+	return n
+}
+
+// parseOffset clamps the ?offset query param: missing/non-numeric or negative
+// values become 0 (#68: negative offsets previously passed through to SQL).
+func parseOffset(r *http.Request) int {
+	n, err := strconv.Atoi(r.URL.Query().Get("offset"))
+	if err != nil || n < 0 {
+		return 0
+	}
+	return n
+}
+
+// parseBurnAfterReads validates the burn_after_reads field (#68): negative
+// values are rejected; zero/absent mean the default single read.
+func parseBurnAfterReads(n int) error {
+	if n < 0 {
+		return errors.New("burn_after_reads must be a positive number")
+	}
+	return nil
+}

internal/lang/guess.go

@@ -1,8 +1,7 @@
-package main
+package lang
 
 import (
 	"encoding/json"
-	"net/http"
 	"regexp"
 	"strings"
 
@@ -58,7 +57,8 @@ var canonical = map[string]string{
 // paths (empty, JSON, unambiguous markers enry can't see without a filename),
 // then enry strategies (shebangs, XML decl, modelines, content heuristics),
 // then enry's classifier seeded by our regex hints.
-func guessLang(s string) string {
+// GuessLang detects a language from pasted content.
+func GuessLang(s string) string {
 	src := strings.TrimSpace(s)
 	if src == "" {
 		return ""
@@ -108,19 +108,3 @@ func normalizeLang(lang string) string {
 	return strings.ToLower(lang)
 }
 
-func (a *apiServer) handleGuessLang(w http.ResponseWriter, r *http.Request) {
-	setRateLimitHeaders(w, 1, 5)
-	if !rateLimitGuess(r) {
-		writeRateLimited(w, 1)
-		return
-	}
-	var req struct {
-		Content string `json:"content"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeErr(w, http.StatusBadRequest, "invalid json body")
-		return
-	}
-	lang := guessLang(req.Content)
-	writeJSON(w, http.StatusOK, map[string]any{"language": lang})
-}

internal/lang/guess_test.go

@@ -1,4 +1,4 @@
-package main
+package lang
 
 import (
 	"strings"
@@ -23,8 +23,8 @@ func TestGuessLangExisting(t *testing.T) {
 		"#!/bin/bash\nset -euo pipefail\necho hi\n":                           "bash",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -47,8 +47,8 @@ func TestGuessLangNewLanguages(t *testing.T) {
 		"diff --git a/main.go b/main.go\n--- a/main.go\n+++ b/main.go\n@@ -1 +1 @@\n": "diff",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -70,8 +70,8 @@ func TestGuessLangMagicMarkers(t *testing.T) {
 		"--- a/config.yml\n+++ b/config.yml\n@@ -1,2 +1,3 @@\n": "diff",
 	}
 	for src, want := range cases {
-		if got := guessLang(src); got != want {
+		if got := GuessLang(src); got != want {
-			t.Errorf("guessLang(%q) = %q, want %q", src, got, want)
+			t.Errorf("GuessLang(%q) = %q, want %q", src, got, want)
 		}
 	}
 }
@@ -79,14 +79,14 @@ func TestGuessLangMagicMarkers(t *testing.T) {
 // TestGuessLangCanonical verifies enry display names are mapped/lowercased to
 // our stored ids.
 func TestGuessLangCanonical(t *testing.T) {
-	if got := guessLang("FROM debian:12\nCMD [\"sh\"]\n"); got != "dockerfile" {
+	if got := GuessLang("FROM debian:12\nCMD [\"sh\"]\n"); got != "dockerfile" {
 		t.Errorf("Dockerfile canonical mapping failed: got %q", got)
 	}
-	if got := guessLang("#!/bin/sh\necho hi\n"); got != "bash" {
+	if got := GuessLang("#!/bin/sh\necho hi\n"); got != "bash" {
 		t.Errorf("Shell canonical mapping failed: got %q", got)
 	}
 	// uncurated languages still come back lowercase
-	if got := guessLang("<h1>{{.Name}}</h1>\n"); got != strings.ToLower(got) {
+	if got := GuessLang("<h1>{{.Name}}</h1>\n"); got != strings.ToLower(got) {
 		t.Errorf("expected lowercase output, got %q", got)
 	}
 }

internal/lang/highlight.go

@@ -1,4 +1,4 @@
-package main
+package lang
 
 import (
 	"html"
@@ -135,8 +135,8 @@ func containsStr(list []string, s string) bool {
 
 // highlightCode returns HTML with highlighting spans; safe because all
 // non-token text is html-escaped.
-func highlightCode(content, lang string) string {
+func HighlightCode(content, langID string) string {
-	l, h, ok := resolveLang(lang)
+	l, h, ok := resolveLang(langID)
 	_ = l
 	if !ok {
 		return html.EscapeString(content)
@@ -144,7 +144,7 @@ func highlightCode(content, lang string) string {
 	lines := strings.Split(content, "\n")
 	out := make([]string, len(lines))
 	for i, line := range lines {
-		out[i] = highlightLine(line, h, lang)
+		out[i] = highlightLine(line, h, langID)
 	}
 	return strings.Join(out, "\n")
 }

internal/store/burn.go

@@ -0,0 +1,96 @@
+package store
+
+import (
+	"crypto/subtle"
+	"database/sql"
+	"encoding/base64"
+	"time"
+)
+
+// genDeletionToken returns a 32-char url-safe random token
+func genDeletionToken() string {
+	b := make([]byte, 24)
+	cryptoRead(b)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// TimeNow is overridable in tests to inject the clock.
+var TimeNow = time.Now
+
+// RegisterRead applies the burn-after-read budget for one view (#49).
+// For pastes with reads_limit set: the viewer's paste_views row is checked;
+// a view within the burn viewer window of the viewer's last view is deduped
+// (count=false). Otherwise reads_used is incremented, and the paste is
+// soft-deleted (burned) once reads_used reaches reads_limit. Viewers without
+// a cookie (plain API clients) count as their own viewer id "".
+// For legacy plain burn_after_read pastes (no reads_limit), any read burns.
+// #58: admission is atomic. Returns (remaining, admitted). admitted is true
+// only when this caller may serve the content: for legacy burn pastes the
+// caller wins exactly when its conditional soft delete flipped deleted_at
+// (RowsAffected), and for read-budget pastes the caller wins exactly when its
+// conditional UPDATE (reads_used < reads_limit) incremented the counter - so
+// concurrent readers can never both consume the last read. Losing callers
+// must treat the paste as gone. view_count is tracked separately and
+// unaffected.
+func (s *Store) RegisterRead(row *PasteRow, viewerID string, burnWindowMinutes int) (remaining *int, admitted bool) {
+	if !row.ReadsLimit.Valid {
+		if row.BurnAfterRead {
+			// #58: atomic claim - only the caller whose UPDATE actually
+			// flips deleted_at from NULL may serve the content.
+			ok, err := s.SoftDelete(row.ID)
+			r := 0
+			if err != nil || !ok {
+				return &r, false
+			}
+			return &r, true
+		}
+		return nil, true
+	}
+	now := TimeNow().Unix()
+	var last sql.NullInt64
+	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
+		row.ID, viewerID).Scan(&last)
+	if last.Valid && now-last.Int64 < int64(burnWindowMinutes)*60 {
+		r := int(row.ReadsLimit.Int64) - row.ReadsUsed
+		if r < 0 {
+			r = 0
+		}
+		return &r, true
+	}
+	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
+		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
+		row.ID, viewerID, now)
+	// #58: conditional increment - only succeeds while budget remains, so
+	// concurrent readers cannot both consume the final read.
+	res, err := s.db.Exec(`UPDATE pastes SET reads_used = reads_used + 1
+		WHERE id = ? AND deleted_at IS NULL AND reads_used < ?`, row.ID, row.ReadsLimit.Int64)
+	if err != nil {
+		r := 0
+		return &r, false
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		// Lost the race: budget exhausted (or paste already burned).
+		r := 0
+		return &r, false
+	}
+	var used int64
+	s.db.QueryRow(`SELECT reads_used FROM pastes WHERE id = ?`, row.ID).Scan(&used)
+	if used >= row.ReadsLimit.Int64 {
+		// Atomic burn; either way the paste is gone for future readers.
+		s.SoftDelete(row.ID)
+	}
+	r := int(row.ReadsLimit.Int64) - int(used)
+	if r < 0 {
+		r = 0
+	}
+	return &r, true
+}
+
+// Burned reports whether a read-limited paste has exhausted its budget.
+func (row *PasteRow) Burned() bool {
+	return row.ReadsLimit.Valid && int64(row.ReadsUsed) >= row.ReadsLimit.Int64
+}
+
+func DeletionTokenEqual(stored, given string) bool {
+	return subtle.ConstantTimeCompare([]byte(stored), []byte(given)) == 1
+}

internal/store/customslug.go

@@ -1,8 +1,7 @@
-package main
+package store
 
 import (
 	"errors"
-	"fmt"
 	"regexp"
 	"strings"
 )
@@ -16,16 +15,16 @@ var reservedSlugs = map[string]bool{
 	"new": true, "login": true, "logout": true, "admin": true, "settings": true,
 }
 
-var errInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")
+var ErrInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")
-var errReservedSlug = errors.New("that slug is reserved")
+var ErrReservedSlug = errors.New("that slug is reserved")
-var errSlugTaken = errors.New("that slug is already taken")
+var ErrSlugTaken = errors.New("that slug is already taken")
 
 func ValidateCustomSlug(slug string) error {
 	if !slugRE.MatchString(slug) {
-		return errInvalidSlug
+		return ErrInvalidSlug
 	}
 	if reservedSlugs[strings.ToLower(slug)] {
-		return errReservedSlug
+		return ErrReservedSlug
 	}
 	return nil
 }
@@ -45,5 +44,3 @@ func (s *Store) SlugTaken(slug string) (bool, error) {
 	}
 	return n > 0, nil
 }
-
-var _ = fmt.Sprintf // keep fmt if unused later

internal/store/password.go

@@ -1,4 +1,4 @@
-package main
+package store
 
 import (
 	"crypto/rand"
@@ -19,7 +19,8 @@ const (
 	argonSaltLen = 16
 )
 
-func argon2idHash(pw string) (string, error) {
+// Argon2IDHash hashes a password with argon2id.
+func Argon2IDHash(pw string) (string, error) {
 	salt := make([]byte, argonSaltLen)
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
@@ -27,11 +28,10 @@ func argon2idHash(pw string) (string, error) {
 	key := argon2.IDKey([]byte(pw), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
 	return fmt.Sprintf("$argon2id$v=19$m=%d,t=%d,p=%d$%s$%s",
 		argonMemory, argonTime, argonThreads,
-		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(salt), base64.RawStdEncoding.EncodeToString(key)), nil
-		base64.RawStdEncoding.EncodeToString(key)), nil
 }
 
-func checkPassword(hash, pw string) bool {
+func CheckPassword(hash, pw string) bool {
 	parts := strings.Split(hash, "$")
 	if len(parts) != 6 || parts[1] != "argon2id" {
 		return false

internal/store/store.go

@@ -0,0 +1,480 @@
+// Package store provides the SQLite persistence layer for palette: schema
+// migrations, the Store type and all queries, and the background sweeper.
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+// SlugReservationDays is the default custom-URL reservation window (admin-tunable via settings, #40).
+const SlugReservationDays = 30
+
+// SoftDeleteGraceDays is how long soft-deleted pastes linger before hard delete.
+const SoftDeleteGraceDays = 7
+
+type Paste struct {
+	ID          string  `json:"id"`
+	CustomSlug  *string `json:"custom_slug,omitempty"`
+	Content     string  `json:"content"`
+	ContentType string  `json:"content_type"`
+	Language    *string `json:"language,omitempty"`
+	Title       *string `json:"title,omitempty"`
+	Password    *string `json:"password,omitempty"`
+	ExpiresIn   *string `json:"expires_in,omitempty"`
+	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
+	BurnAfterReads *int `json:"burn_after_reads,omitempty"` // #49: readable N times (default 1)
+	Visibility  string  `json:"visibility"`
+	CanID       *string `json:"can_id,omitempty"`
+	CreatedAt   int64   `json:"created_at"`
+	DeletedAt   *int64  `json:"deleted_at,omitempty"`
+	ExpiresAt   *int64  `json:"expires_at,omitempty"`
+	ViewerID    string  `json:"-"` // set from vwr cookie server-side (#37)
+	readsLimit  *int64  // #49: resolved read budget, not serialized
+	ViewCount   int     `json:"view_count"`
+	DeletionToken string `json:"-"`
+}
+
+type PasteRow struct {
+	ID            string
+	CustomSlug    sql.NullString
+	Content       string
+	ContentType   string
+	Language      sql.NullString
+	Title         sql.NullString
+	PasswordHash  sql.NullString
+	ExpiresAt     sql.NullInt64
+	BurnAfterRead bool
+	ReadsLimit    sql.NullInt64
+	ReadsUsed     int
+	Visibility    string
+	CanID         sql.NullString
+	CreatedAt     int64
+	DeletedAt     sql.NullInt64
+	ViewCount     int
+	Size          int
+	DeletionToken sql.NullString
+	ViewerID      sql.NullString
+}
+
+type CanRow struct {
+	ID           string
+	Title        sql.NullString
+	Visibility   string
+	PasswordHash sql.NullString
+	CreatedAt    int64
+	DeletedAt    sql.NullInt64
+	ExpiresAt    sql.NullInt64
+}
+
+type Store struct {
+	db *sql.DB
+}
+
+func OpenStore(path string) (*Store, error) {
+	db, err := sql.Open("sqlite", path+"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)")
+	if err != nil {
+		return nil, err
+	}
+	// #58: a single write connection. SQLite allows only one writer at a
+	// time; with multiple pooled connections concurrent writes surface as
+	// SQLITE_BUSY errors ("database is locked") instead of serializing, and
+	// the burn-after-read race tests saw spurious 500s under parallel reads.
+	db.SetMaxOpenConns(1)
+	s := &Store{db: db}
+	if err := s.migrate(); err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+func (s *Store) migrate() error {
+	_, err := s.db.Exec(`
+	CREATE TABLE IF NOT EXISTS pastes (
+		id            TEXT PRIMARY KEY,
+		custom_slug   TEXT UNIQUE,
+		content       TEXT NOT NULL,
+		content_type  TEXT NOT NULL DEFAULT 'text/plain',
+		language      TEXT,
+		title         TEXT,
+		password_hash TEXT,
+		expires_at    INTEGER,
+		burn_after_read INTEGER DEFAULT 0,
+		visibility    TEXT NOT NULL DEFAULT 'public',
+		can_id        TEXT,
+		created_at    INTEGER NOT NULL,
+		deleted_at    INTEGER,
+		view_count    INTEGER NOT NULL DEFAULT 0,
+deletion_token TEXT
+	);
+	CREATE INDEX IF NOT EXISTS idx_pastes_visibility_created ON pastes(visibility, created_at DESC);
+	CREATE INDEX IF NOT EXISTS idx_pastes_expires ON pastes(expires_at) WHERE expires_at IS NOT NULL;
+	CREATE INDEX IF NOT EXISTS idx_pastes_deleted ON pastes(deleted_at) WHERE deleted_at IS NOT NULL;
+	CREATE TABLE IF NOT EXISTS paste_cans (
+		id            TEXT PRIMARY KEY,
+		title         TEXT,
+		description   TEXT,
+		visibility    TEXT NOT NULL DEFAULT 'public',
+		password_hash TEXT,
+		created_at    INTEGER NOT NULL,
+		deleted_at    INTEGER,
+		expires_at    INTEGER
+	);
+	`)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN deletion_token TEXT`) // ignore if exists
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
+	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
+	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
+		paste_id    TEXT NOT NULL,
+		viewer_id   TEXT NOT NULL,
+		last_viewed INTEGER NOT NULL,
+		PRIMARY KEY (paste_id, viewer_id)
+	)`) // #49: per-viewer read dedupe window
+	return err
+}
+
+// SlugAlphabet is the paste-id charset (no ambiguous chars).
+var SlugAlphabet = "23456789abcdefghjkmnpqrstuvwxyz"
+
+// genSlug generates a random slug of length n.
+func genSlug(n int) string {
+	b := make([]byte, n)
+	_, _ = cryptoRead(b)
+	for i := range b {
+		b[i] = SlugAlphabet[int(b[i])%len(SlugAlphabet)]
+	}
+	return string(b)
+}
+
+// validExpiry reports whether an expires_in duration is in the accepted
+// window. The UI restricts presets to 1 minute - 1 year (#48); the API must
+// enforce the same bounds, otherwise negative/zero/absurd durations create
+// pastes that are born expired (or effectively permanent).
+const (
+	minExpiry = time.Minute
+	maxExpiry = 366 * 24 * time.Hour // 1 year (+ leap day headroom)
+)
+
+func ValidExpiry(d time.Duration) bool {
+	return d >= minExpiry && d <= maxExpiry
+}
+
+func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
+	id := genSlug(6)
+	now := time.Now().Unix()
+
+	var expiresAt *int64
+	if p.ExpiresIn != nil && *p.ExpiresIn != "" {
+		d, err := time.ParseDuration(*p.ExpiresIn)
+		if err != nil {
+			return nil, fmt.Errorf("invalid expires_in: %w", err)
+		}
+		if !ValidExpiry(d) {
+			return nil, fmt.Errorf("expires_in must be between 1 minute and 1 year")
+		}
+		t := now + int64(d.Seconds())
+		expiresAt = &t
+	}
+
+	var pwHash *string
+	if p.Password != nil && *p.Password != "" {
+		h, err := Argon2IDHash(*p.Password)
+		if err != nil {
+			return nil, err
+		}
+		pwHash = &h
+	}
+
+	if p.CustomSlug != nil && *p.CustomSlug != "" {
+		slug := *p.CustomSlug
+		if err := ValidateCustomSlug(slug); err != nil {
+			return nil, err
+		}
+		taken, err := s.SlugTaken(slug)
+		if err != nil {
+			return nil, err
+		}
+		if taken {
+			return nil, ErrSlugTaken
+		}
+	}
+
+	// #49: burn-after-read pastes carry a read budget (default 1 read)
+	if p.BurnAfterRead {
+		limit := int64(1)
+		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
+			limit = int64(*p.BurnAfterReads)
+		}
+		p.readsLimit = &limit
+	}
+
+	visibility := p.Visibility
+	if visibility == "" {
+		visibility = "public"
+	}
+	if visibility != "public" && visibility != "unlisted" {
+		return nil, errors.New("visibility must be public or unlisted")
+	}
+
+	contentType := p.ContentType
+	if contentType == "" {
+		contentType = "text/plain"
+	}
+
+	var slugVal *string
+	if p.CustomSlug != nil && *p.CustomSlug != "" {
+		slugVal = p.CustomSlug
+	}
+	p.DeletionToken = genDeletionToken()
+	_, err := s.db.Exec(`INSERT INTO pastes
+		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id, reads_limit)
+		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID, p.readsLimit)
+	if err != nil {
+		return nil, err
+	}
+	p.ID = id
+	p.CreatedAt = now
+	p.ExpiresAt = expiresAt
+	p.Visibility = visibility
+	return p, nil
+}
+
+func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
+	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id, reads_limit, COALESCE(reads_used, 0)
+		FROM pastes WHERE (id = ? OR custom_slug = ?) AND deleted_at IS NULL`, idOrSlug, idOrSlug)
+	var r PasteRow
+	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID, &r.ReadsLimit, &r.ReadsUsed)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	return &r, err
+}
+
+// ListPublic backs /api/public and the public listing page. Visibility rules
+// mirror the history page: only non-deleted, non-expired, non-can pastes are
+// listed, and password-protected pastes are excluded at the query level
+// (#65) so their metadata (title, slug, existence) never leaks.
+func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
+		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		var cs, lang, title sql.NullString
+		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
+			return nil, 0, err
+		}
+		r.CustomSlug = cs
+		r.Language = lang
+		r.Title = title
+		out = append(out, r)
+	}
+	var total int
+	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
+	return out, total, nil
+}
+
+// ListMine lists pastes created from the given viewer id (browser cookie), newest first.
+func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content)
+		FROM pastes
+		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		var cs, lang, title sql.NullString
+		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
+			return nil, 0, err
+		}
+		r.CustomSlug, r.Language, r.Title = cs, lang, title
+		out = append(out, r)
+	}
+	var total int
+	s.db.QueryRow(`SELECT COUNT(*) FROM pastes
+		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`,
+		viewerID, time.Now().Unix()).Scan(&total)
+	return out, total, nil
+}
+
+// MineOwner returns the stored viewer_id for a paste, or "" if none.
+func (s *Store) MineOwner(id string) (string, error) {
+	var vid sql.NullString
+	err := s.db.QueryRow(`SELECT viewer_id FROM pastes WHERE id = ? AND deleted_at IS NULL`, id).Scan(&vid)
+	if err == sql.ErrNoRows {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	if !vid.Valid {
+		return "", nil
+	}
+	return vid.String, nil
+}
+
+// SoftDelete marks a paste deleted (burned) atomically (#58): the deleted_at
+// IS NULL guard means only the first caller flips the row. Returns true when
+// this call performed the delete (RowsAffected > 0), false when the paste was
+// already deleted - callers use this to decide read admission atomically.
+func (s *Store) SoftDelete(id string) (bool, error) {
+	res, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
+}
+
+func (s *Store) IncrementViews(id string) {
+	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
+}
+
+// SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
+func (s *Store) SweepExpired() {
+	now := time.Now().Unix()
+	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
+	grace := now - SoftDeleteGraceDays*86400
+	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
+}
+
+// ReleaseCustomSlugs frees custom URLs so they can be reused:
+//   - pastes whose expires_at has passed (expired or soft-deleted/expired),
+//   - pastes created more than reservationDays days ago (custom URLs are a
+//     reservation, not permanent).
+//
+// It returns the number of pastes whose custom_slug was released.
+func (s *Store) ReleaseCustomSlugs(reservationDays int) (int64, error) {
+	now := time.Now().Unix()
+	res, err := s.db.Exec(`UPDATE pastes SET custom_slug = NULL
+		WHERE custom_slug IS NOT NULL
+		  AND (expires_at IS NOT NULL AND expires_at > 0 AND expires_at < ?
+		   OR created_at < ?)`,
+		now, now-int64(reservationDays)*86400)
+	if err != nil {
+		return 0, err
+	}
+	n, _ := res.RowsAffected()
+	if n > 0 {
+		log.Printf("released %d custom slug(s)", n)
+	}
+	return n, nil
+}
+
+func (s *Store) StartSweeper(every time.Duration, reservationDays int) {
+	go func() {
+		t := time.NewTicker(every)
+		for range t.C {
+			s.SweepExpired()
+			s.ReleaseCustomSlugs(reservationDays)
+		}
+	}()
+}
+
+func boolToInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func NullStrPtr(ns sql.NullString) *string {
+	if ns.Valid {
+		return &ns.String
+	}
+	return nil
+}
+
+// HardDelete removes a paste row entirely (deletion-token redeem).
+func (s *Store) HardDelete(id string) {
+	s.db.Exec(`DELETE FROM pastes WHERE id = ?`, id)
+}
+
+// InsertCan creates a paste_can row.
+func (s *Store) InsertCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64) error {
+	_, err := s.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
+		VALUES (?,?,?,?,?,?,?)`, canID, title, description, visibility, pwHash, createdAt, expiresAt)
+	return err
+}
+
+// DeleteCan removes an (empty/aborted) can row.
+func (s *Store) DeleteCan(canID string) {
+	s.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
+}
+
+// InsertCanItem adds an item paste belonging to a can.
+func (s *Store) InsertCanItem(canID, title, content, contentType string, language *string, expiresAt, binary *string, now int64) error {
+	// language/expiresAt unused here for now; content stored as text (binary-safe in sqlite)
+	_, err := s.db.Exec(`INSERT INTO pastes
+		(id, content, content_type, language, title, visibility, can_id, created_at)
+		VALUES (?,?,?,?,?,?,?,?)`,
+		genSlug(6), content, contentType, language, &title, "unlisted", canID, now)
+	_ = expiresAt
+	_ = binary
+	return err
+}
+
+func (s *Store) GetCan(id string) (*CanRow, error) {
+	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at
+		FROM paste_cans WHERE id = ? AND deleted_at IS NULL`, id)
+	var c CanRow
+	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	return &c, err
+}
+
+func (s *Store) ListCanItems(canID string) ([]PasteRow, error) {
+	rows, err := s.db.Query(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count
+		FROM pastes WHERE can_id = ? AND deleted_at IS NULL ORDER BY created_at ASC`, canID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []PasteRow
+	for rows.Next() {
+		var r PasteRow
+		if err := rows.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount); err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, nil
+}
+
+// GenSlug is the exported slug generator.
+func GenSlug(n int) string { return genSlug(n) }
+
+// Exec runs a raw statement (test helper).
+func (s *Store) Exec(query string, args ...any) (int64, error) {
+	res, err := s.db.Exec(query, args...)
+	if err != nil {
+		return 0, err
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
+// QueryInt runs a query returning a single integer (test helper).
+func (s *Store) QueryInt(query string, args ...any) int {
+	var n int
+	s.db.QueryRow(query, args...).Scan(&n)
+	return n
+}

internal/web/securityheaders_test.go

@@ -0,0 +1,56 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #59: SecurityHeaders must add the CSP and hardening headers to rendered
+// HTML responses only; JSON and /raw responses pass through untouched.
+func TestSecurityHeaders(t *testing.T) {
+	pages := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Write([]byte("<html><body>ok</body></html>"))
+	})
+	h := SecurityHeaders(pages)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
+		t.Errorf("CSP = %q, want %q", got, wantCSP)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
+		t.Errorf("Referrer-Policy = %q, want no-referrer", got)
+	}
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+
+	// JSON response: no security headers.
+	jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	rec = httptest.NewRecorder()
+	jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); got != "" {
+		t.Errorf("unexpected CSP %q on JSON response", got)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "" {
+		t.Errorf("unexpected Referrer-Policy %q on JSON response", got)
+	}
+
+	// Content type set after the first Write (as the inline can page does) is
+	// still picked up because headers are inspected post-handler.
+	lateh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("<html></html>"))
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	}))
+	rec = httptest.NewRecorder()
+	lateh.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "frame-ancestors 'none'") {
+		t.Errorf("CSP = %q, want frame-ancestors 'none'", got)
+	}
+}

internal/web/static/table.js

@@ -44,7 +44,8 @@ const PaletteTable = (() => {
     function matches(it) {
       if (!state.filter) return true;
       const f = state.filter.toLowerCase();
-      return (it.title || '').toLowerCase().includes(f) || (it.id || '').toLowerCase().includes(f);
+      return (it.title || '').toLowerCase().includes(f) || (it.id || '').toLowerCase().includes(f) ||
+        (it.custom_slug || '').toLowerCase().includes(f);
     }
 
     function renderSortIndicators() {
@@ -62,7 +63,7 @@ const PaletteTable = (() => {
         const filtered = state.filter.length > 0;
         const off = (state.page - 1) * opts.perPage;
         const url = (filtered || state.sortKey)
-          ? opts.endpoint + '?limit=500&offset=0'
+          ? opts.endpoint + '?limit=' + (opts.fetchLimit || 100) + '&offset=0'
           : opts.endpoint + '?limit=' + opts.perPage + '&offset=' + off;
         const res = await fetch(url);
         const data = await res.json();

internal/web/templates/admin.html

@@ -0,0 +1,107 @@
+{{template "head" .}}
+{{template "topbar" .}}
+<div class="page">
+  <div class="float">
+    <div class="settings-head">
+      <h1>Admin</h1>
+    </div>
+    <div class="settings-body">
+      <p>Enter the admin key to manage server settings. The key is kept in
+      sessionStorage for this tab only and is sent as a request header — it is
+      never stored in a cookie, so it will not accompany normal paste requests.</p>
+      <form id="admin-key-form">
+        <label for="admin-key">Admin key</label><br>
+        <input type="password" id="admin-key" autocomplete="off" style="width:100%">
+        <button type="submit">Unlock</button>
+        <span id="admin-key-status"></span>
+      </form>
+      <div id="admin-panel" style="display:none">
+        <h2>Settings</h2>
+        <form id="admin-settings-form">
+          <table>
+            <tr><td>Rate-limit burst</td><td><input type="number" id="rl-burst" min="1" step="1"></td></tr>
+            <tr><td>Rate-limit refill per minute</td><td><input type="number" id="rl-refill" min="0.1" step="0.1"></td></tr>
+            <tr><td>Max content bytes</td><td><input type="number" id="max-content" min="1" step="1"></td></tr>
+            <tr><td>Default expiry</td><td><input type="text" id="default-expiry" placeholder="e.g. 168h, 30m, 0 = never"></td></tr>
+            <tr><td>Custom URL reservation days</td><td><input type="number" id="slug-days" min="1" step="1"></td></tr>
+            <tr><td>Burn viewer window (minutes)</td><td><input type="number" id="burn-window" min="1" step="1"></td></tr>
+          </table>
+          <button type="submit">Save</button>
+          <span id="admin-save-status"></span>
+        </form>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+(function () {
+  var KEY = 'palette_admin_key';
+  var keyInput = document.getElementById('admin-key');
+  var status = document.getElementById('admin-key-status');
+  var panel = document.getElementById('admin-panel');
+
+  function key() { return sessionStorage.getItem(KEY) || ''; }
+
+  function api(path, opts) {
+    opts = opts || {};
+    opts.headers = { 'X-Admin-Key': key() };
+    if (opts.body) opts.headers['Content-Type'] = 'application/json';
+    return fetch(path, opts);
+  }
+
+  function loadSettings() {
+    api('/admin/api/settings').then(function (r) {
+      if (r.status !== 200) { showLock(); return; }
+      return r.json();
+    }).then(function (s) {
+      if (!s) return;
+      document.getElementById('rl-burst').value = s.rate_limit_burst;
+      document.getElementById('rl-refill').value = s.rate_limit_per_minute;
+      document.getElementById('max-content').value = s.max_content_bytes;
+      document.getElementById('default-expiry').value = s.default_expiry;
+      document.getElementById('slug-days').value = s.custom_slug_reservation_days;
+      document.getElementById('burn-window').value = s.burn_viewer_window_minutes;
+      panel.style.display = '';
+    });
+  }
+
+  function showLock() {
+    panel.style.display = 'none';
+    sessionStorage.removeItem(KEY);
+  }
+
+  document.getElementById('admin-key-form').addEventListener('submit', function (e) {
+    e.preventDefault();
+    sessionStorage.setItem(KEY, keyInput.value);
+    api('/admin/api/settings').then(function (r) {
+      if (r.status === 200) {
+        status.textContent = '✓';
+        keyInput.value = '';
+        loadSettings();
+      } else {
+        status.textContent = 'invalid key';
+        showLock();
+      }
+    });
+  });
+
+  document.getElementById('admin-settings-form').addEventListener('submit', function (e) {
+    e.preventDefault();
+    var body = {
+      rate_limit_burst: parseFloat(document.getElementById('rl-burst').value),
+      rate_limit_per_minute: parseFloat(document.getElementById('rl-refill').value),
+      max_content_bytes: parseInt(document.getElementById('max-content').value, 10),
+      default_expiry: document.getElementById('default-expiry').value,
+      custom_slug_reservation_days: parseInt(document.getElementById('slug-days').value, 10),
+      burn_viewer_window_minutes: parseInt(document.getElementById('burn-window').value, 10)
+    };
+    api('/admin/api/settings', { method: 'POST', body: JSON.stringify(body) }).then(function (r) {
+      document.getElementById('admin-save-status').textContent = r.status === 200 ? 'saved' : 'error';
+      if (r.status !== 200) showLock();
+    });
+  });
+
+  if (key()) loadSettings();
+})();
+</script>
+{{template "foot" .}}

internal/web/templates/new.html

@@ -135,6 +135,7 @@ function composeCustomExpiry() {
   if (rem === 0) return hours + 'h';
   if (hours === 0) return rem + 'm';
   return hours + 'h' + rem + 'm';
+}
 
 $('pwreveal').addEventListener('click', () => {
   const pw = $('password');

internal/web/web.go

@@ -0,0 +1,316 @@
+// Package web serves palette's HTML routes: paste pages, cans, unlock, and
+// the admin page. Templates and static assets are embedded in this package.
+package web
+
+import (
+	"crypto/hmac"
+	cryptorand "crypto/rand"
+	"crypto/sha256"
+	"embed"
+	"encoding/hex"
+	"fmt"
+	"html/template"
+	"io/fs"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	langpkg "palette/internal/lang"
+	"palette/internal/store"
+)
+
+//go:embed templates/*.html
+var tmplFS embed.FS
+
+//go:embed static
+var staticFS embed.FS
+
+type UI struct {
+	tmpl *template.Template
+}
+
+func New() (*UI, error) {
+	funcs := template.FuncMap{
+		"humanSize": humanSize,
+	}
+	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "templates/*.html")
+	if err != nil {
+		return nil, err
+	}
+	return &UI{tmpl: t}, nil
+}
+
+func humanSize(n int) string {
+	if n < 1024 {
+		return fmt.Sprintf("%d B", n)
+	}
+	if n < 1024*1024 {
+		return fmt.Sprintf("%.1f KB", float64(n)/1024)
+	}
+	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
+}
+
+func (u *UI) StaticHandler() http.Handler {
+	sub, _ := fs.Sub(staticFS, "static")
+	return http.StripPrefix("/static/", http.FileServer(http.FS(sub)))
+}
+
+func (h *Handlers) renderPage(w http.ResponseWriter, name string, data any) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := h.UI.tmpl.ExecuteTemplate(w, name, data); err != nil {
+		http.Error(w, "template error: "+err.Error(), 500)
+	}
+}
+
+// #34: per-paste unlock tokens. unlockSecret is generated once at startup
+// (also derivable from PALETTE_UNLOCK_SECRET for multi-instance deploys) and
+// used to HMAC paste ids, so a client can only hold a valid pw_<id> cookie by
+// actually submitting the correct password for that paste.
+var unlockSecret = resolveUnlockSecret()
+
+func resolveUnlockSecret() []byte {
+	if v := os.Getenv("PALETTE_UNLOCK_SECRET"); v != "" {
+		return []byte(v)
+	}
+	b := make([]byte, 32)
+	if _, err := cryptorand.Read(b); err != nil {
+		log.Fatal("cannot generate unlock secret: ", err)
+	}
+	return b
+}
+
+func unlockToken(id string) string {
+	mac := hmac.New(sha256.New, unlockSecret)
+	mac.Write([]byte("unlock:" + id))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+
+func agoString(ts int64) string {
+	s := time.Now().Unix() - ts
+	switch {
+	case s < 60:
+		return fmt.Sprintf("%ds ago", s)
+	case s < 3600:
+		return fmt.Sprintf("%dm ago", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh ago", s/3600)
+	default:
+		return fmt.Sprintf("%dd ago", s/86400)
+	}
+}
+
+func expiryString(expiresAt int64) string {
+	s := expiresAt - time.Now().Unix()
+	switch {
+	case s < 3600:
+		return fmt.Sprintf("%dm", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh", s/3600)
+	default:
+		return fmt.Sprintf("%dd", s/86400)
+	}
+}
+
+// Handlers is the set of store callbacks the web pages need. The web package
+// renders HTML; all queries go through the store.
+type Handlers struct {
+	UI            *UI
+	Store         *store.Store
+	ViewerID      func(r *http.Request) string
+	BurnWindowMin func() int
+	RateLimitOK   func(id string, r *http.Request) bool // per-paste unlock limiter
+}
+
+func (h *Handlers) rateLimitUnlock(id string, r *http.Request) bool {
+	if h.RateLimitOK != nil {
+		return h.RateLimitOK(id, r)
+	}
+	return true
+}
+
+func (h *Handlers) writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
+	w.Header().Set("Retry-After", fmt.Sprintf("%d", retryAfterSecs))
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(429)
+	w.Write([]byte(`{"error":"rate limit exceeded"}`))
+}
+
+func (h *Handlers) renderPaste(w http.ResponseWriter, row *store.PasteRow, justCreated bool, deletionToken string, readsRemaining *int) {
+	lines := strings.Count(row.Content, "\n") + 1
+	gutter := ""
+	for i := 1; i <= lines; i++ {
+		gutter += fmt.Sprintf("%d\n", i)
+	}
+	expIn := ""
+	if row.ExpiresAt.Valid {
+		expIn = expiryString(row.ExpiresAt.Int64)
+	}
+	lang := row.Language.String
+	if lang == "" {
+		lang = "text"
+	}
+	summary := fmt.Sprintf("%s · %s · %d views · %s", lang, humanSize(len(row.Content)), row.ViewCount, agoString(row.CreatedAt))
+	data := map[string]any{
+		"Page":          "paste",
+		"ID":            row.ID,
+		"Title":         row.Title.String,
+		"Language":      row.Language.String,
+		"StatsSummary":  summary,
+		"SizeHuman":     humanSize(len(row.Content)),
+		"HasPassword":   row.PasswordHash.Valid,
+		"BurnAfterRead": row.BurnAfterRead,
+		"CustomSlug":    row.CustomSlug.String,
+		"ContentHTML":   template.HTML(langpkg.HighlightCode(row.Content, row.Language.String)), // safe: HighlightCode escapes all non-span text
+		"ContentAttr":   row.Content,
+		"Gutter":        strings.TrimSuffix(gutter, "\n"),
+		"LineCount":     lines,
+		"SizeBytes":     len(row.Content),
+		"CreatedAgo":    agoString(row.CreatedAt),
+		"CreatedAtUnix": row.CreatedAt,
+		"ViewCount":     row.ViewCount,
+		"Visibility":    row.Visibility,
+		"ExpiresAt":     row.ExpiresAt.Valid,
+		"ExpiresIn":     expIn,
+		"DeletionToken": deletionToken,
+		"ReadsLimit":    row.ReadsLimit.Valid,
+		"ReadsLeftN":    readsRemaining, // *int: reads remaining after this view
+		"ReadsTotal":    int(row.ReadsLimit.Int64),
+		"JustCreated":   justCreated,
+		"Host":          "this host",
+	}
+	h.renderPage(w, "paste.html", data)
+}
+
+// HandlePasteView renders the paste view; supports both ID and custom slug.
+func (h *Handlers) HandlePasteView(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	row, err := h.Store.GetPaste(id)
+	if err != nil {
+		http.Error(w, "db error", 500)
+		return
+	}
+	if row == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
+		http.Error(w, "paste expired", 404)
+		return
+	}
+	if row.PasswordHash.Valid {
+		// if a password was submitted via unlock form, verify and set cookie for this paste
+		if r.Method == http.MethodPost {
+			if !h.rateLimitUnlock(row.ID, r) {
+				h.writeRateLimited(w, 60)
+				return
+			}
+			r.ParseForm()
+			pw := r.FormValue("password")
+			if pw != "" && store.CheckPassword(row.PasswordHash.String, pw) {
+				// #34: the unlock cookie must be bound to this specific paste and
+				// unforgable. A static value ("1") let anyone bypass the password
+				// by setting pw_<id>=1 for any paste id. The token is an HMAC of
+				// the paste id under the server's random secret.
+				http.SetCookie(w, &http.Cookie{
+					Name: "pw_" + row.ID, Value: unlockToken(row.ID), Path: "/",
+					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+				})
+				// re-render without lock, or redirect if ?next= was given (#26)
+				if next := r.FormValue("next"); next != "" {
+					// only allow same-origin relative paths
+					if len(next) > 0 && next[0] == '/' && !strings.HasPrefix(next, "//") {
+						http.Redirect(w, r, next, http.StatusSeeOther)
+						return
+					}
+				}
+				h.renderPaste(w, row, false, "", nil)
+				return
+			}
+			h.renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": true, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
+			return
+		}
+		// check cookie — must carry the valid per-paste unlock token (#34)
+		c, err := r.Cookie("pw_" + row.ID)
+		if err != nil || c.Value != unlockToken(row.ID) {
+			h.renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": false, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
+			return
+		}
+	}
+
+	justCreated := r.URL.Query().Get("created") == "1"
+	token := r.URL.Query().Get("token")
+	if justCreated && token != "" {
+		// one-time display of the deletion token via the created banner
+		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
+	}
+	// Count the view for every real page render. Raw views increment in
+	// handleRaw; the HTML path was missing its increment, so view_count only
+	// ever moved via /raw and the API-stored count stayed at 0 (#33).
+	// The just-created banner render does not count as a view.
+	if !justCreated {
+		h.Store.IncrementViews(row.ID)
+	}
+	// #49: burn-after-N-reads budget (per-viewer dedupe window).
+	// Just-created first render does not count as a read for the creator.
+	if !justCreated {
+		rem, admitted := h.Store.RegisterRead(row, h.ViewerID(r), h.BurnWindowMin())
+		if !admitted { // #58: lost the burn claim; do not render content
+			http.NotFound(w, r)
+			return
+		}
+		h.renderPaste(w, row, false, "", rem)
+		return
+	}
+	// only pass the token to the template right after creation
+	h.renderPaste(w, row, true, token, nil)
+}
+
+// HandleNewPage serves /new.
+func (h *Handlers) HandleNewPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "new.html", map[string]any{"Page": "new"})
+}
+
+// HandleHistoryPage serves /history.
+func (h *Handlers) HandleHistoryPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "history.html", map[string]any{"Page": "history"})
+}
+
+// HandleSettingsPage serves /settings.
+func (h *Handlers) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "settings.html", map[string]any{"Page": "settings"})
+}
+
+// HandleMinePage serves /mine.
+func (h *Handlers) HandleMinePage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "mine.html", map[string]any{"Page": "mine"})
+}
+
+// HandleAdminPage serves /admin.
+func (h *Handlers) HandleAdminPage(w http.ResponseWriter, r *http.Request) {
+	h.renderPage(w, "admin.html", map[string]any{"Page": "admin"})
+}
+
+// Handlers builds a web.Handlers bound to this UI.
+func (u *UI) Handlers() *Handlers { return &Handlers{UI: u} }
+
+// #59: security headers for rendered HTML pages. Applied wherever the
+// response is text/html (page templates and the inline can page); JSON API
+// responses and /raw content pass through untouched. script-src allows
+// 'unsafe-inline' because the page templates carry inline scripts; CSP
+// default-src 'self' still blocks external content and object/frame embeds,
+// and frame-ancestors 'none' closes the clickjacking gap flagged in the #34
+// pentest. Runs after the handler so the Content-Type is already set.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+		h := w.Header()
+		if strings.HasPrefix(h.Get("Content-Type"), "text/html") {
+			h.Set("Content-Security-Policy",
+				"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			h.Set("Referrer-Policy", "no-referrer")
+			h.Set("X-Content-Type-Options", "nosniff")
+		}
+	})
+}

main.go

@@ -1,765 +0,0 @@
-package main
-
-import (
-	"context"
-	"database/sql"
-	"embed"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	_ "modernc.org/sqlite"
-)
-
-//go:embed web/templates/* web/static/*
-var webFS embed.FS
-
-const (
-	softDeleteGraceDays = 7
-	customSlugReservationDays = 30
-)
-
-type Config struct {
-	Addr            string
-	DBPath          string
-	MaxTextBytes    int64
-	MaxItemBytes    int64
-}
-
-type Paste struct {
-	ID          string  `json:"id"`
-	CustomSlug  *string `json:"custom_slug,omitempty"`
-	Content     string  `json:"content"`
-	ContentType string  `json:"content_type"`
-	Language    *string `json:"language,omitempty"`
-	Title       *string `json:"title,omitempty"`
-	Password    *string `json:"password,omitempty"`
-	ExpiresIn   *string `json:"expires_in,omitempty"`
-	BurnAfterRead bool  `json:"burn_after_read,omitempty"`
-	BurnAfterReads *int `json:"burn_after_reads,omitempty"` // #49: readable N times (default 1)
-	Visibility  string  `json:"visibility"`
-	CanID       *string `json:"can_id,omitempty"`
-	CreatedAt   int64   `json:"created_at"`
-	DeletedAt   *int64  `json:"deleted_at,omitempty"`
-	ExpiresAt   *int64  `json:"expires_at,omitempty"`
-	ViewerID    string  `json:"-"` // set from vwr cookie server-side (#37)
-	readsLimit  *int64  // #49: resolved read budget, not serialized
-	ViewCount   int     `json:"view_count"`
-	DeletionToken string `json:"-"`
-}
-
-type PasteRow struct {
-	ID            string
-	CustomSlug    sql.NullString
-	Content       string
-	ContentType   string
-	Language      sql.NullString
-	Title         sql.NullString
-	PasswordHash  sql.NullString
-	ExpiresAt     sql.NullInt64
-	BurnAfterRead bool
-	ReadsLimit    sql.NullInt64
-	ReadsUsed     int
-	Visibility    string
-	CanID         sql.NullString
-	CreatedAt     int64
-	DeletedAt     sql.NullInt64
-	ViewCount     int
-	Size          int
-	DeletionToken sql.NullString
-	ViewerID      sql.NullString
-}
-
-type CanRow struct {
-	ID           string
-	Title        sql.NullString
-	Visibility   string
-	PasswordHash sql.NullString
-	CreatedAt    int64
-	DeletedAt    sql.NullInt64
-	ExpiresAt    sql.NullInt64
-}
-
-type Store struct {
-	db *sql.DB
-}
-
-func OpenStore(path string) (*Store, error) {
-	db, err := sql.Open("sqlite", path+"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)")
-	if err != nil {
-		return nil, err
-	}
-	s := &Store{db: db}
-	if err := s.migrate(); err != nil {
-		return nil, err
-	}
-	return s, nil
-}
-
-func (s *Store) migrate() error {
-	_, err := s.db.Exec(`
-	CREATE TABLE IF NOT EXISTS pastes (
-		id            TEXT PRIMARY KEY,
-		custom_slug   TEXT UNIQUE,
-		content       TEXT NOT NULL,
-		content_type  TEXT NOT NULL DEFAULT 'text/plain',
-		language      TEXT,
-		title         TEXT,
-		password_hash TEXT,
-		expires_at    INTEGER,
-		burn_after_read INTEGER DEFAULT 0,
-		visibility    TEXT NOT NULL DEFAULT 'public',
-		can_id        TEXT,
-		created_at    INTEGER NOT NULL,
-		deleted_at    INTEGER,
-		view_count    INTEGER NOT NULL DEFAULT 0,
-	deletion_token TEXT
-	);
-	CREATE INDEX IF NOT EXISTS idx_pastes_visibility_created ON pastes(visibility, created_at DESC);
-	CREATE INDEX IF NOT EXISTS idx_pastes_expires ON pastes(expires_at) WHERE expires_at IS NOT NULL;
-	CREATE INDEX IF NOT EXISTS idx_pastes_deleted ON pastes(deleted_at) WHERE deleted_at IS NOT NULL;
-	CREATE TABLE IF NOT EXISTS paste_cans (
-		id            TEXT PRIMARY KEY,
-		title         TEXT,
-		description   TEXT,
-		visibility    TEXT NOT NULL DEFAULT 'public',
-		password_hash TEXT,
-		created_at    INTEGER NOT NULL,
-		deleted_at    INTEGER,
-		expires_at    INTEGER
-	);
-	`)
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN deletion_token TEXT`) // ignore if exists
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
-	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
-	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
-		paste_id    TEXT NOT NULL,
-		viewer_id   TEXT NOT NULL,
-		last_viewed INTEGER NOT NULL,
-		PRIMARY KEY (paste_id, viewer_id)
-	)`) // #49: per-viewer read dedupe window
-	return err
-}
-
-var slugAlphabet = "23456789abcdefghjkmnpqrstuvwxyz"
-var httpClient = &http.Client{}
-
-func genSlug(n int) string {
-	b := make([]byte, n)
-	_, _ = cryptorandRead(b)
-	for i := range b {
-		b[i] = slugAlphabet[int(b[i])%len(slugAlphabet)]
-	}
-	return string(b)
-}
-
-// cryptorandRead wraps crypto/rand
-func cryptorandRead(b []byte) (int, error) {
-	return cryptoRead(b)
-}
-
-func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
-	id := genSlug(6)
-	now := time.Now().Unix()
-
-	var expiresAt *int64
-	if p.ExpiresIn != nil && *p.ExpiresIn != "" {
-		d, err := time.ParseDuration(*p.ExpiresIn)
-		if err != nil {
-			return nil, fmt.Errorf("invalid expires_in: %w", err)
-		}
-		t := now + int64(d.Seconds())
-		expiresAt = &t
-	}
-
-	var pwHash *string
-	if p.Password != nil && *p.Password != "" {
-		h, err := hashPassword(*p.Password)
-		if err != nil {
-			return nil, err
-		}
-		pwHash = &h
-	}
-
-	if p.CustomSlug != nil && *p.CustomSlug != "" {
-		slug := *p.CustomSlug
-		if err := ValidateCustomSlug(slug); err != nil {
-			return nil, err
-		}
-		taken, err := s.SlugTaken(slug)
-		if err != nil {
-			return nil, err
-		}
-		if taken {
-			return nil, errSlugTaken
-		}
-	}
-
-	// #49: burn-after-read pastes carry a read budget (default 1 read)
-	if p.BurnAfterRead {
-		limit := int64(1)
-		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
-			limit = int64(*p.BurnAfterReads)
-		}
-		p.readsLimit = &limit
-	}
-
-	visibility := p.Visibility
-	if visibility == "" {
-		visibility = "public"
-	}
-	if visibility != "public" && visibility != "unlisted" {
-		return nil, errors.New("visibility must be public or unlisted")
-	}
-
-	contentType := p.ContentType
-	if contentType == "" {
-		contentType = "text/plain"
-	}
-
-	var slugVal *string
-	if p.CustomSlug != nil && *p.CustomSlug != "" {
-		slugVal = p.CustomSlug
-	}
-	p.DeletionToken = genDeletionToken()
-	_, err := s.db.Exec(`INSERT INTO pastes
-		(id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, created_at, deletion_token, viewer_id, reads_limit)
-		VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
-		id, slugVal, p.Content, contentType, p.Language, p.Title, pwHash, expiresAt, boolToInt(p.BurnAfterRead), visibility, now, p.DeletionToken, p.ViewerID, p.readsLimit)
-	if err != nil {
-		return nil, err
-	}
-	p.ID = id
-	p.CreatedAt = now
-	p.ExpiresAt = expiresAt
-	p.Visibility = visibility
-	return p, nil
-}
-
-func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
-	row := s.db.QueryRow(`SELECT id, custom_slug, content, content_type, language, title, password_hash, expires_at, burn_after_read, visibility, can_id, created_at, deleted_at, view_count, deletion_token, viewer_id, reads_limit, COALESCE(reads_used, 0)
-		FROM pastes WHERE (id = ? OR custom_slug = ?) AND deleted_at IS NULL`, idOrSlug, idOrSlug)
-	var r PasteRow
-	err := row.Scan(&r.ID, &r.CustomSlug, &r.Content, &r.ContentType, &r.Language, &r.Title, &r.PasswordHash, &r.ExpiresAt, &r.BurnAfterRead, &r.Visibility, &r.CanID, &r.CreatedAt, &r.DeletedAt, &r.ViewCount, &r.DeletionToken, &r.ViewerID, &r.ReadsLimit, &r.ReadsUsed)
-	if err == sql.ErrNoRows {
-		return nil, nil
-	}
-	return &r, err
-}
-
-func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
-		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-			return nil, 0, err
-		}
-		r.CustomSlug = cs
-		r.Language = lang
-		r.Title = title
-		out = append(out, r)
-	}
-	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
-	return out, total, nil
-}
-
-// ListMine lists pastes created from the given viewer id (browser cookie), newest first.
-func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content)
-		FROM pastes
-		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), limit, offset)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer rows.Close()
-	var out []PasteRow
-	for rows.Next() {
-		var r PasteRow
-		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
-			return nil, 0, err
-		}
-		r.CustomSlug, r.Language, r.Title = cs, lang, title
-		out = append(out, r)
-	}
-	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes
-		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`,
-		viewerID, time.Now().Unix()).Scan(&total)
-	return out, total, nil
-}
-
-// MineOwner returns the stored viewer_id for a paste, or "" if none.
-func (s *Store) MineOwner(id string) (string, error) {
-	var vid sql.NullString
-	err := s.db.QueryRow(`SELECT viewer_id FROM pastes WHERE id = ? AND deleted_at IS NULL`, id).Scan(&vid)
-	if err == sql.ErrNoRows {
-		return "", nil
-	}
-	if err != nil {
-		return "", err
-	}
-	if !vid.Valid {
-		return "", nil
-	}
-	return vid.String, nil
-}
-
-func (s *Store) SoftDelete(id string) error {
-	_, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
-	return err
-}
-
-func (s *Store) IncrementViews(id string) {
-	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
-}
-
-// SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
-func (s *Store) SweepExpired() {
-	now := time.Now().Unix()
-	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
-	grace := now - softDeleteGraceDays*86400
-	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
-}
-
-// ReleaseCustomSlugs frees custom URLs so they can be reused:
-//   - pastes whose expires_at has passed (expired or soft-deleted/expired),
-//   - pastes created more than 30 days ago (custom URLs are a reservation, not permanent).
-//
-// It returns the number of pastes whose custom_slug was released.
-func (s *Store) ReleaseCustomSlugs() (int64, error) {
-	now := time.Now().Unix()
-	res, err := s.db.Exec(`UPDATE pastes SET custom_slug = NULL
-		WHERE custom_slug IS NOT NULL
-		  AND (expires_at IS NOT NULL AND expires_at > 0 AND expires_at < ?
-		   OR created_at < ?)`,
-		now, now-customSlugReservationDays*86400)
-	if err != nil {
-		return 0, err
-	}
-	n, _ := res.RowsAffected()
-	if n > 0 {
-		log.Printf("released %d custom slug(s)", n)
-	}
-	return n, nil
-}
-
-func (s *Store) StartSweeper(every time.Duration) {
-	go func() {
-		t := time.NewTicker(every)
-		for range t.C {
-			s.SweepExpired()
-			s.ReleaseCustomSlugs()
-		}
-	}()
-}
-
-func hashPassword(pw string) (string, error) {
-	// argon2id
-	return argon2idHash(pw)
-}
-
-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
-func nullStrPtr(ns sql.NullString) *string {
-	if ns.Valid {
-		return &ns.String
-	}
-	return nil
-}
-
-func writeJSON(w http.ResponseWriter, status int, v any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(v)
-}
-
-func writeErr(w http.ResponseWriter, status int, msg string) {
-	writeJSON(w, status, map[string]string{"error": msg})
-}
-
-type apiServer struct {
-	store *Store
-	cfg   Config
-}
-
-func (a *apiServer) routes() http.Handler {
-	r := chi.NewRouter()
-	r.Use(middleware.Recoverer)
-	r.Use(middleware.Timeout(30 * time.Second))
-	r.Use(viewerCookieMiddleware)
-
-	// API
-	r.Route("/api", func(r chi.Router) {
-		r.Post("/pastes", a.handleCreatePaste)
-		r.Get("/pastes/{id}", a.handleGetPaste)
-		r.Delete("/pastes/{id}", a.handleDeletePaste)
-		r.Get("/mine", a.handleListMine)
-		r.Delete("/pastes/{id}/redeem", a.handleRedeemDeletion)
-		r.Get("/public", a.handleListPublic)
-		r.Post("/guess-language", a.handleGuessLang)
-		r.Post("/pastes/can", a.handleCreateCan)
-		r.Get("/cans/{id}", a.handleGetCan)
-		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
-	})
-
-	// can page
-	r.Get("/can/{id}", a.handleCanPage)
-
-	// raw
-	r.Get("/raw/{id}", a.handleRaw)
-
-	// web pages
-	r.Get("/", http.RedirectHandler("/history", http.StatusFound).ServeHTTP)
-	r.Get("/new", a.handleNewPage)
-	r.Get("/history", a.handleHistoryPage)
-	r.Get("/settings", a.handleSettingsPage)
-	r.Get("/mine", a.handleMinePage)
-	r.Handle("/static/*", staticHandler())
-	r.Get("/unlock/{id}", a.handlePasteView)
-	r.Post("/unlock/{id}", a.handlePasteView)
-	r.Get("/{id}", a.handlePasteView)
-	r.Post("/{id}", a.handlePasteView)
-
-	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
-		writeErr(w, 404, "not found")
-	})
-	return r
-}
-
-// viewerCookieMiddleware ensures every request carries an anonymous browser id
-// cookie ("vwr"); sets one on the response if absent. Used by /mine (#37, #49).
-func viewerCookieMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if c, err := r.Cookie("vwr"); err != nil || c.Value == "" {
-			id := genSlug(16)
-			http.SetCookie(w, &http.Cookie{
-				Name: "vwr", Value: id, Path: "/",
-				MaxAge: 31536000, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-			})
-			r.AddCookie(&http.Cookie{Name: "vwr", Value: id})
-			// remember that this cookie was minted here, not sent by the client
-			r = r.WithContext(context.WithValue(r.Context(), vwrMintedKey, true))
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-type vwrMintedKeyType struct{}
-
-var vwrMintedKey vwrMintedKeyType
-
-func currentViewerID(r *http.Request) string {
-	if c, err := r.Cookie("vwr"); err == nil {
-		return c.Value
-	}
-	return ""
-}
-
-// viewerSentCookie reports whether the client itself sent a vwr cookie
-// (as opposed to the middleware minting one for this request).
-func viewerSentCookie(r *http.Request) bool {
-	if _, err := r.Cookie("vwr"); err != nil {
-		return false
-	}
-	_, minted := r.Context().Value(vwrMintedKey).(bool)
-	return !minted
-}
-
-func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
-	setRateLimitHeaders(w, 1, 5)
-	if !rateLimitCreate(r) {
-		writeRateLimited(w, 1)
-		return
-	}
-	var p Paste
-	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
-		writeErr(w, 400, "invalid json body")
-		return
-	}
-	if strings.TrimSpace(p.Content) == "" {
-		writeErr(w, 400, "content is required")
-		return
-	}
-	if int64(len(p.Content)) > a.cfg.MaxTextBytes {
-		writeErr(w, 413, fmt.Sprintf("content exceeds max %d bytes", a.cfg.MaxTextBytes))
-		return
-	}
-	p.ViewerID = currentViewerID(r)
-	created, err := a.store.CreatePaste(&p)
-	if err != nil {
-		writeErr(w, 400, err.Error())
-		return
-	}
-	writeJSON(w, 201, map[string]any{
-		"id":        created.ID,
-		"deletion_token": created.DeletionToken,
-		"url":       "/" + created.ID,
-		"raw_url":   "/raw/" + created.ID,
-		"api_url":   "/api/pastes/" + created.ID,
-		"expires_at": created.ExpiresAt,
-		"created_at": created.CreatedAt,
-		"rate_limit": map[string]int{"create_per_sec": 1, "burst": 5},
-	})
-}
-
-func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	if row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		writeErr(w, 404, "paste expired")
-		return
-	}
-	if row.burned() { // #49: read budget exhausted
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	if row.PasswordHash.Valid {
-		// require password via header or query
-		pw := r.Header.Get("X-Paste-Password")
-		if pw == "" {
-			pw = r.URL.Query().Get("password")
-		}
-		if pw == "" || !checkPassword(row.PasswordHash.String, pw) {
-			writeErr(w, 401, "password required")
-			return
-		}
-	}
-	nullPtr := func(ns sql.NullString) *string {
-		if ns.Valid {
-			return &ns.String
-		}
-		return nil
-	}
-	rem, _ := a.store.registerRead(row, currentViewerID(r)) // #49 (also covers legacy burn)
-	writeJSON(w, 200, map[string]any{
-		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
-		"language": nullPtr(row.Language), "title": nullPtr(row.Title), "created_at": row.CreatedAt,
-		"view_count": row.ViewCount, "visibility": row.Visibility,
-		"reads_remaining": rem,
-	})
-}
-
-func (a *apiServer) handleDeletePaste(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		writeErr(w, 404, "paste not found")
-		return
-	}
-	// viewer-cookie delete enforcement (#37): only the browser that created
-	// the paste (matching vwr) may delete it via this endpoint. Requests with
-	// no client-sent vwr cookie (plain API clients) are unaffected.
-	vid := currentViewerID(r)
-	if vid != "" && viewerSentCookie(r) && row.ViewerID.Valid && row.ViewerID.String != "" && row.ViewerID.String != vid {
-		writeErr(w, 403, "not your paste")
-		return
-	}
-	if err := a.store.SoftDelete(row.ID); err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
-}
-
-// handleListMine serves /api/mine: pastes created from this browser (#37).
-func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
-	vid := currentViewerID(r)
-	if vid == "" {
-		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
-		return
-	}
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 50
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
-	rows, total, err := a.store.ListMine(vid, limit, offset)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	items := make([]map[string]any, 0, len(rows))
-	for _, row := range rows {
-		lang, title := nullStrPtr(row.Language), nullStrPtr(row.Title)
-		items = append(items, map[string]any{
-			"id": row.ID, "title": title, "language": lang,
-			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
-			"custom_slug": nullStrPtr(row.CustomSlug), "visibility": row.Visibility,
-		})
-	}
-	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
-}
-
-func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 25
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
-	rows, total, err := a.store.ListPublic(limit, offset)
-	if err != nil {
-		writeErr(w, 500, "db error")
-		return
-	}
-	items := make([]map[string]any, 0, len(rows))
-	for _, row := range rows {
-		lang, title := nullStrPtr(row.Language), nullStrPtr(row.Title)
-		items = append(items, map[string]any{
-			"id": row.ID, "title": title, "language": lang,
-			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
-			"custom_slug": nullStrPtr(row.CustomSlug),
-		})
-	}
-	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
-}
-
-func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		http.Error(w, "not found", 404)
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		http.Error(w, "paste expired", 404)
-		return
-	}
-	if row.PasswordHash.Valid {
-		http.Error(w, "password required", 401)
-		return
-	}
-	if row.burned() { // #49: read budget exhausted
-		http.Error(w, "not found", 404)
-		return
-	}
-	// #49 decision: raw reads count against the read budget too, with the
-	// same per-viewer 15-minute dedupe window as page views.
-	a.store.registerRead(row, currentViewerID(r))
-	w.Header().Set("Content-Type", row.ContentType)
-	a.store.IncrementViews(row.ID)
-	w.Write([]byte(row.Content))
-}
-
-func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	can, err := a.store.GetCan(id)
-	if err != nil || can == nil {
-		http.NotFound(w, r)
-		return
-	}
-	items, _ := a.store.ListCanItems(can.ID)
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
-	for _, it := range items {
-		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
-	}
-	fmt.Fprintf(w, "</ul></body></html>")
-}
-
-func nullStrOr(ns sql.NullString, def string) string {
-	if ns.Valid {
-		return ns.String
-	}
-	return def
-}
-
-func (a *apiServer) handleHome(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/plain")
-	w.Write([]byte("palette pastebin api\nPOST /api/pastes  {\"content\": \"...\", \"language\": \"go\", \"expires_in\": \"168h\", \"password\": \"...\", \"visibility\": \"public\"}\nGET  /api/pastes/{id}\nGET  /api/public?limit=25&offset=0\nGET  /raw/{id}\n"))
-}
-
-func (a *apiServer) handlePastePage(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	// if it looks like an asset request, 404
-	if strings.Contains(id, ".") {
-		http.NotFound(w, r)
-		return
-	}
-	row, err := a.store.GetPaste(id)
-	if err != nil || row == nil {
-		http.NotFound(w, r)
-		return
-	}
-	a.store.IncrementViews(row.ID)
-	// render basic view; full templates come later with frontend work
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	fmt.Fprintf(w, "<!doctype html><html><head><title>%s — palette</title></head><body><pre>%s</pre></body></html>",
-		row.ID, templateEsc(row.Content))
-}
-
-func templateEsc(s string) string {
-	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
-	return r.Replace(s)
-}
-
-func main() {
-	cfg := Config{
-		Addr:         envOr("PALETTE_ADDR", ":8080"),
-		DBPath:       envOr("PALETTE_DB", "palette.db"),
-		MaxTextBytes: int64(envIntOr("PALETTE_MAX_TEXT", 5*1024*1024)),
-		MaxItemBytes: int64(envIntOr("PALETTE_MAX_ITEM", 25*1024*1024)),
-	}
-	store, err := OpenStore(cfg.DBPath)
-	if err != nil {
-		log.Fatal(err)
-	}
-	store.StartSweeper(time.Minute)
-
-	ui, err := NewWebUI()
-	if err != nil {
-		log.Fatal(err)
-	}
-	webUIInstance = ui
-	srv := &apiServer{store: store, cfg: cfg}
-	log.Printf("palette listening on %s", cfg.Addr)
-	log.Fatal(http.ListenAndServe(cfg.Addr, srv.routes()))
-}
-
-func envOr(k, d string) string {
-	if v := os.Getenv(k); v != "" {
-		return v
-	}
-	return d
-}
-
-func envIntOr(k string, d int) int {
-	if v := os.Getenv(k); v != "" {
-		if n, err := strconv.Atoi(v); err == nil {
-			return n
-		}
-	}
-	return d
-}

web.go

@@ -1,218 +0,0 @@
-package main
-
-import (
-	"embed"
-	"fmt"
-	"html/template"
-	"io/fs"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-)
-
-//go:embed web/templates/*.html
-var tmplFS embed.FS
-
-//go:embed web/static
-var staticFS embed.FS
-
-type webUI struct {
-	tmpl *template.Template
-}
-
-func NewWebUI() (*webUI, error) {
-	funcs := template.FuncMap{
-		"humanSize": humanSize,
-	}
-	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "web/templates/*.html")
-	if err != nil {
-		return nil, err
-	}
-	return &webUI{tmpl: t}, nil
-}
-
-func humanSize(n int) string {
-	if n < 1024 {
-		return fmt.Sprintf("%d B", n)
-	}
-	if n < 1024*1024 {
-		return fmt.Sprintf("%.1f KB", float64(n)/1024)
-	}
-	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
-}
-
-func staticHandler() http.Handler {
-	sub, _ := fs.Sub(staticFS, "web/static")
-	return http.StripPrefix("/static/", http.FileServer(http.FS(sub)))
-}
-
-func renderPage(w http.ResponseWriter, name string, data any) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := webUIInstance.tmpl.ExecuteTemplate(w, name, data); err != nil {
-		http.Error(w, "template error: "+err.Error(), 500)
-	}
-}
-
-var webUIInstance *webUI
-
-func (a *apiServer) handleNewPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "new.html", map[string]any{"Page": "new"})
-}
-
-func (a *apiServer) handleHistoryPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "history.html", map[string]any{"Page": "history"})
-}
-
-func (a *apiServer) handleSettingsPage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "settings.html", map[string]any{"Page": "settings"})
-}
-
-func (a *apiServer) handleMinePage(w http.ResponseWriter, r *http.Request) {
-	renderPage(w, "mine.html", map[string]any{"Page": "mine"})
-}
-
-func agoString(ts int64) string {
-	s := time.Now().Unix() - ts
-	switch {
-	case s < 60:
-		return fmt.Sprintf("%ds ago", s)
-	case s < 3600:
-		return fmt.Sprintf("%dm ago", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh ago", s/3600)
-	default:
-		return fmt.Sprintf("%dd ago", s/86400)
-	}
-}
-
-func expiryString(expiresAt int64) string {
-	s := expiresAt - time.Now().Unix()
-	switch {
-	case s < 3600:
-		return fmt.Sprintf("%dm", s/60)
-	case s < 86400:
-		return fmt.Sprintf("%dh", s/3600)
-	default:
-		return fmt.Sprintf("%dd", s/86400)
-	}
-}
-
-func (a *apiServer) renderPaste(w http.ResponseWriter, row *PasteRow, justCreated bool, deletionToken string, readsRemaining *int) {
-	lines := strings.Count(row.Content, "\n") + 1
-	gutter := ""
-	for i := 1; i <= lines; i++ {
-		gutter += fmt.Sprintf("%d\n", i)
-	}
-	expIn := ""
-	if row.ExpiresAt.Valid {
-		expIn = expiryString(row.ExpiresAt.Int64)
-	}
-	lang := row.Language.String
-	if lang == "" {
-		lang = "text"
-	}
-	summary := fmt.Sprintf("%s · %s · %d views · %s", lang, humanSize(len(row.Content)), row.ViewCount, agoString(row.CreatedAt))
-	data := map[string]any{
-		"Page":          "paste",
-		"ID":            row.ID,
-		"Title":         row.Title.String,
-		"Language":      row.Language.String,
-		"StatsSummary":  summary,
-		"SizeHuman":     humanSize(len(row.Content)),
-		"HasPassword":   row.PasswordHash.Valid,
-		"BurnAfterRead": row.BurnAfterRead,
-		"CustomSlug":    row.CustomSlug.String,
-		"ContentHTML":   template.HTML(highlightCode(row.Content, row.Language.String)), // safe: highlightCode escapes all non-span text
-		"ContentAttr":   row.Content,
-		"Gutter":        strings.TrimSuffix(gutter, "\n"),
-		"LineCount":     lines,
-		"SizeBytes":     len(row.Content),
-		"CreatedAgo":    agoString(row.CreatedAt),
-		"CreatedAtUnix": row.CreatedAt,
-		"ViewCount":     row.ViewCount,
-		"Visibility":    row.Visibility,
-		"ExpiresAt":     row.ExpiresAt.Valid,
-		"ExpiresIn":     expIn,
-		"DeletionToken": deletionToken,
-		"ReadsLimit":    row.ReadsLimit.Valid,
-		"ReadsLeftN":    readsRemaining,   // *int: reads remaining after this view
-		"ReadsTotal":    int(row.ReadsLimit.Int64),
-		"JustCreated":   justCreated,
-		"Host":          "this host",
-	}
-	renderPage(w, "paste.html", data)
-}
-
-// handlePastePage renders the paste view; supports both ID and custom slug.
-func (a *apiServer) handlePasteView(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
-	row, err := a.store.GetPaste(id)
-	if err != nil {
-		http.Error(w, "db error", 500)
-		return
-	}
-	if row == nil {
-		http.NotFound(w, r)
-		return
-	}
-	if row.ExpiresAt.Valid && row.ExpiresAt.Int64 < time.Now().Unix() {
-		http.Error(w, "paste expired", 404)
-		return
-	}
-	if row.PasswordHash.Valid {
-		// if a password was submitted via unlock form, verify and set cookie for this paste
-		if r.Method == http.MethodPost {
-			if !rateLimitUnlock(row.ID, r) {
-				writeRateLimited(w, 60)
-				return
-			}
-			r.ParseForm()
-			pw := r.FormValue("password")
-			if pw != "" && checkPassword(row.PasswordHash.String, pw) {
-				http.SetCookie(w, &http.Cookie{
-					Name: "pw_" + row.ID, Value: "1", Path: "/",
-					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-				})
-				// re-render without lock, or redirect if ?next= was given (#26)
-				if next := r.FormValue("next"); next != "" {
-					// only allow same-origin relative paths
-					if len(next) > 0 && next[0] == '/' && !strings.HasPrefix(next, "//") {
-						http.Redirect(w, r, next, http.StatusSeeOther)
-						return
-					}
-				}
-				a.renderPaste(w, row, false, "", nil)
-				return
-			}
-			renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": true, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
-			return
-		}
-		// check cookie
-		c, err := r.Cookie("pw_" + row.ID)
-		if err != nil || c.Value != "1" {
-			renderPage(w, "unlock.html", map[string]any{"Page": "unlock", "ID": row.ID, "Wrong": false, "CreatedAgo": agoString(row.CreatedAt), "CreatedAtUnix": row.CreatedAt})
-			return
-		}
-	}
-
-	justCreated := r.URL.Query().Get("created") == "1"
-	token := r.URL.Query().Get("token")
-	if justCreated && token != "" {
-		// one-time display of the deletion token via the created banner
-		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
-	}
-	// #49: burn-after-N-reads budget (per-viewer, 15-minute dedupe window).
-	// Just-created first render does not count as a read for the creator.
-	if !justCreated {
-		rem, _ := a.store.registerRead(row, currentViewerID(r))
-		a.renderPaste(w, row, false, "", rem)
-		return
-	}
-	// only pass the token to the template right after creation
-	a.renderPaste(w, row, true, token, nil)
-}
-
-var _ = strconv.Itoa