Merge pull request 'Clamp expires_in at API boundary (#60)' (#74) from issue-60-expiry-clamp into main

- DELETE now demands the create-time deletion token (Authorization
  header: Bearer/Token/bare, or ?token= query param), compared with
  the constant-time store.DeletionTokenEqual. 403 otherwise.
- Creator-browser deletes via the /mine button (matching vwr cookie,
  #37) remain allowed; other browsers and plain API clients get 403.
- Regression tests: no token, wrong token (header+query), correct
  token (header+query), creator-cookie path, token extraction.
- Adapted TestSoftDelete to pass the deletion token.
- docs/API.md delete section updated.
- Based on #58's SoftDelete (bool, error) signature.

README.md

@@ -77,7 +77,7 @@ curl -X POST http://localhost:8080/api/pastes \
   -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
 ```
 
-Full API docs: [docs/API.md](docs/API.md).
+Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
 
 ## CI
 

docs/API.md

@@ -54,8 +54,10 @@ Raw reads count against a burn-after-read budget, same as page views.
 ## Delete
 
 ```bash
-# soft delete (creator browser only; plain API clients unaffected)
+# soft delete (requires the deletion token from the create response)
-curl -X DELETE http://localhost:8080/api/pastes/{id}
+curl -X DELETE -H "Authorization: Bearer TOKEN" http://localhost:8080/api/pastes/{id}
+# ...or via query param; the creator browser (viewer cookie) may also delete without a token
+curl -X DELETE "http://localhost:8080/api/pastes/{id}?token=TOKEN"
 
 # hard delete immediately (requires the one-time deletion token)
 curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"

docs/design/e2e-encryption.md

@@ -0,0 +1,223 @@
+# Design: Optional client-side E2E encryption for pastes and files
+
+- **Issue:** #39
+- **Status:** Design (no implementation in this PR)
+- **Related docs:** [docs/API.md](../API.md)
+
+## 1. Goals and non-goals
+
+**Goals**
+
+- Let any paste (or can item) be stored server-side as ciphertext only.
+- Zero plaintext knowledge by the server: storage, logs, backups, DB dumps contain no readable content.
+- Pure browser implementation using WebCrypto; no new server dependencies.
+- Encrypted pastes must still work with expiry, hard/soft delete, deletion tokens, visibility, slugs, rate limits.
+
+**Non-goals (v1)**
+
+- Anonymous, account-less E2E; Palette stays server-trusting with browser cookies.
+- Sharing via link fragments (`#key`) is optional sugar, not a required transport.
+- Search *of encrypted content*, server-side language detection, or server-side highlighting on encrypted pastes — these are structurally impossible and out of scope (see §5).
+- Signing, deniability, forward secrecy across pastes, PFS, post-quantum crypto.
+
+**Threat model (explicit).** This protects against a *passive server compromise* — a DB dump, backup leak, or disk image of the server's SQLite file. It does **not** protect against:
+
+- A fully malicious / compromised Palette server serving backdoored JavaScript: any JS-delivered crypto can be backdoored (key exfiltration via JS) regardless of primitives. This is the fundamental limit of a JS-in-browser E2E scheme.
+- Malware on the viewer's device, or shoulder-surfing of the password.
+- Traffic analysis, timing, or metadata (title, size, expiry, IP, viewer cookie).
+- A attacker who compromises the server *while the creator's browser is open* and alters JS before encrypt.
+
+Be explicit in user-facing copy: "encrypted at rest; the server cannot read your paste" is accurate — "the server can never see your paste" is not.
+
+## 2. Crypto primitives and flow
+
+### 2.1 Recommended parameters
+
+| Parameter | Recommendation | Notes |
+|---|---|---|
+| Cipher | **AES-256-GCM** | `AES-GCM` with a 256-bit key, per-paste random 96-bit IV/nonce. WebCrypto built-in, hardware-accelerated, authenticated. |
+| KDF | **PBKDF2-HMAC-SHA-256** | 600,000 iterations (OWASP 2023+ recommendation), 16-byte random salt. |
+| Argon2id | **Not in v1** | WebCrypto has no Argon2id; a JS/WASM Argon2 implementation is an extra supply-chain dependency and is an asymmetric liability: a script the server could swap can't be load-bearing for security anyway. Add later via `argon2id` WASM with SRI pinning + CSP (`script-src 'self'`) if needed. |
+| Salt | 16 random bytes per paste, stored in the clear alongside ciphertext | Unique per paste, never reused. |
+| IV | 12 random bytes per encryption | With ~2^32 encryptions per key this is negligible; each paste has its own key anyway. |
+| Key check value | See §2.2 | Catches wrong passwords without a server round-trip and prevents trash writes. |
+
+### 2.2 Flow (create)
+
+1. User checks "Encrypt" and enters an encryption passphrase (distinct from any access password) in `/new`.
+2. Browser generates `salt` (16 B) and `iv` (12 B) via `crypto.getRandomValues`.
+3. `crypto.subtle.importKey("raw", passphrase, "PBKDF2", false, ["deriveKey"])` →
+   `crypto.subtle.deriveKey(PBKDF2-SHA-256, 600k iterations, salt, {name:"AES-GCM", length:256}, false, ["encrypt","decrypt"])`.
+4. Generate a 32-byte random **DEK** (`crypto.getRandomValues(32)`).
+5. Content encryption key check: `iv_ckv`, `encrypted_content = AES-GCM-256(DEK, iv, content)`.
+6. **Key check value (KCV):** compute `AES-GCM-DEK(random 16 bytes)` — a small token encrypted *under the DEK*, stored as `key_check` blob. This is decrypted with the derived key; on wrong password GCM auth fails and the client can show "wrong key" without asking the server to burn a read.
+7. Wrap the DEK with the KEK: `wrapped_dek = AES-GCM(KEK, iv_wrap, dek)`.
+8. The stored envelope format:
+   ```
+   {
+     v: 1, kdf: "PBKDF2-SHA256", iterations: 600000, salt_b64, iv_b64,
+     kdf_salt_b64, wrap_iv_b64, wrapped_dek_b64, key_check_b64, ciphertext_b64
+   ```
+   The `v` field allows migrating to Argon2id later without a breaking change.
+8. POST the envelope (base64) as `content`, with an `encryption` metadata object alongside (see §3.1).
+
+### 2.3 Flow (view)
+
+1. User provides the passphrase via form field, or the key arrives in the URL `#fragment`. The encryption passphrase is a separate field from any access password.
+2. Fetch `/api/pastes/{id}` (with access password in the usual field if the paste is also password-gated).
+3. Derive KEK from passphrase+salt, unwrap DEK via key_check / unwrap step.
+4. Decrypt content with the DEK; on `OperationError` → "wrong passphrase" UI state (retries are client-side only; no re-fetch, so no extra burn-after-read charge).
+5. Language detection happens client-side (e.g. highlight.js auto-detect) on the decrypted plaintext.
+
+### §2.4 File and can items
+
+Files in cans: encrypt each file with its own DEK and store the same envelope. Cans' `json_items` content fields each carry their own envelope. Files keep their mime type in cleartext metadata; only the bytes are encrypted. The can's title stays plaintext (unless the whole can is encrypted, v2).
+
+## 3. API shapes
+
+### 3.1 Create request
+
+Existing fields unchanged. New optional `encryption` object:
+
+```json
+POST /api/pastes
+{
+  "content": "<base64 envelope>",
+  "encryption": {"v": 1, "kdf": "PBKDF2-SHA256", "iterations": 600000,
+                 "salt": "b64", "iv": "b64", "key_check": "b64"}
+}
+```
+
+`encryption` is non-secret KDF metadata for UI display; the server treats `content` as opaque bytes and MUST NOT inspect it for encrypted pastes (no detection, no highlighting prep, no search indexing) — enforced where content is written, not per-handler.
+
+The full envelope can also just live inside `content` (server-opaque); the `encryption` object carries only non-secret KDF metadata the list views need (e.g. to show a 🔒 icon).
+
+### 3.2 Create response
+
+Unchanged shape: `id`, `url`, `raw_url`, `api_url`, and the one-time `deletion_token` documented in docs/API.md.
+
+### 3.3 Get response
+
+`GET /api/pastes/{id}` response gains:
+
+```json
+{
+  "id": "abc123",
+  "content": "BASE64_ENVELOPE",
+  "encryption": {"v":1, "kdf": "PBKDF2-SHA256", "iterations": 601570, "salt": "b64", "iv": "base64", "key_check": "b64"},
+  "reads_remaining": null
+}
+```
+
+`language` is `"encrypted"` or `null` so clients don't run detection on ciphertext. `raw_url` also serves the envelope; the `/{id}` page ships it to the browser, which decrypts in place.
+
+### 3.4 Raw endpoint
+
+`GET /raw/{id}` returns the envelope as `application/octet-stream` with a suggested filename like `{id}.e2e.txt` and `Content-Disposition: attachment`. This is deliberate: a "download encrypted blob" is what a non-browser client can do with it anyway.
+
+### 3.5 List views / mine / public
+
+List endpoints return `has_encryption: true` instead of content; show a lock icon. Do not include ciphertext in list responses (size, and no reason to ship ciphertext to every viewer's list view) — `GET /api/pastes/{id}` remains the only endpoint that returns the envelope.
+
+`/api/mine` (creator's own browser) may include the envelope for convenience; `/api/public` returns metadata only.
+
+`/api/guess-language` rejects encrypted content with `400 "content is client-encrypted"` — detection needs plaintext; clients detect after decrypting.
+
+Delete, redeem, rate limits, expiry, sweeper, deletion tokens, visibility, slugs, and can CRUD are unchanged — the server never inspects content for these, so opaque content is a no-op path.
+
+## 4. Interplay with existing features
+
+| Feature | Impact | Mitigation |
+| Burn-after-read | Budget is charged on fetch, exactly as today; the server cannot know whether decryption succeeded, so a viewer fetching with the wrong key burns a read they can't use. | Decrypt retries are client-side, so only the first fetch charges the budget. Clear UX copy. |
+| Password-protected + encrypted | Both can coexist and are independent: the access password is an HTTP 401 gate; the encryption passphrase never leaves the browser. If both are set, all three secrets are needed (URL + access password + passphrase). Warn if the user enters the same value in both fields. |
+| Encryption-only pastes | Supported with no access password: URL + passphrase (or fragment key). Default is passphrase; fragment key is opt-in with a warning. |
+| Search | Structurally impossible over ciphertext. Server search just skips encrypted pastes; client-side search within a single decrypted paste works fine. No global encrypted-content search — accept the loss, document it. |
+| Language detection / highlighting | Server-side detection/highlighting impossible; returns `language: null`. Client-side detection via highlight.js auto-detect on decrypted plaintext (client already loads it for password gate pages). |
+| Cans/files | Per-item envelopes (own DEK each), per §2.4. | Consider a can-level KEK (one passphrase unlocks all items). |
+| Expiry/sweeper/delete/redeem | Unchanged — server never inspects content for these. |
+| List views (`/api/public`, `/api/mine`) | Additive `has_encryption: true` flag; list responses do not include ciphertext (`/api/mine` may include the envelope for the creator's own convenience). |
+| guess-language endpoint | Reject with 400. |
+| Fork / edit | Re-encryption needs the passphrase in the browser; v1 disables forking encrypted pastes. | Document the limitation. |
+
+## 5. What breaks, stated plainly
+
+- **Search across encrypted pastes: impossible.** Accept the loss. (If ever needed, client-side index in IndexedDB for the creator's own pastes — v2+.)
+ IndexedDB only helps the creator, not other viewers; still not global search. Accept the loss.
+- **Server-side language detection and highlighting: impossible.** Client-side detection on decrypted plaintext. Server returns `language: null` and the client detects.
+- **Burn-after-read is weakened in one specific way:** the budget is counted on fetch, not on successful decryption. A viewer who fetches but can't decrypt (wrong/lost key) burns a read they can't use. Mitigations documented in §4 table. The server can still count fetches (which is what burn-after-read actually is, even today: it counts fetches, not "reads" in any content-aware sense). So burn-after-read still works — it counts fetches — it's just that a failed decryption still consumes budget. This is acceptable and just needs UX copy. Optionally: don't decrement on failed decryption is *not possible* the server can't tell, so it's fetch-based, period. (It already is today.)
+- **Raw endpoint semantics change:** `/raw/{id}` can no longer serve readable raw text. It serves the ciphertext envelope. Scripts that curl raw pastes will get base64 envelope instead of text. Document as a breaking-ish change for encrypted pastes only; unencrypted pastes unchanged.
+- **Existing /api/mine, /api/public list shapes gain a flag** (additive, non-breaking).
+- **Copy-to-clipboard of decrypted text stays client-side**, fine. "Copy raw" on an encrypted paste copies the envelope — label it clearly.
+
+## 5. UX for key sharing
+### 5.1 Three sharing modes
+
+| Mode | What's shared | Security level | Use case |
+|---|---| malformed JSON / wrong key | | |
+| Mode | What's shared | Strength | Use case |
+|---|---|---|---|
+| **Passphrase** (default) | URL + passphrase out-of-band (Signal etc.) | Good — two channels | Team snippets, sensitive configs |
+| **Passphrase + access password** | URL + access password (401 gate) + passphrase | Strong — two secrets, two channels | Highest sensitivity |
+| **Random key in `#fragment`** | URL containing `#key=<b64>` | Weak — single channel; anyone with the full URL has both parts. Copy/paste into chat defeats it entirely. | One-click convenience sharing |
+
+Browsers never transmit `#` fragments to servers; still set `Referrer-Policy: no-referrer` site-wide and offer separate copy buttons for URL and key. Key-in-fragment ships with a warning and stays opt-in.
+
+### 5.2 Create page (`/new`) UX
+
+- "Encrypt content" toggle → reveals passphrase field + strength meter + generate-random-key button.
+- When encrypting, hide the server-side language dropdown; the client detects language after decryption.
+- Two separate inputs with distinct labels: "Access password (checked by the server, 401 gate)" and "Encryption passphrase (never leaves your browser)". If both hold the same value, warn.
+
+### 6.2 View page (`/{id}`) UX
+
+- If `encryption.kdf` is present → show key entry UI (after the access-password 401 gate, if that also applies).
+- After decrypt: normal render pipeline, language detected client-side.
+- "Wrong passphrase" retries never re-fetch, so they never burn extra reads.
+
+## 7. Backwards compatibility and migration
+
+- Additive JSON fields only; unencrypted pastes behave identically. No schema changes (envelope is stored in the existing content column/TEXT; verify column size allows envelope overhead (~2× base64 + ~200 B header).
+- Server-side validation of encrypted pastes: only structural checks (base64 decodes, size ≤ max bytes). No crypto in the server.
+
+**Server implementation cost is genuinely small** (est. 2-4 days): pass through content untouched, add `encryption` metadata column or embed in content, skip detection/indexing when `encryption` is present, list flag. The server never does crypto. All crypto is client-side JS (~150-300 lines, no build-step change if using WebCrypto alone).
+
+**Argon2id later:** add `kdf: "argon2id"` to the envelope `v: 1` (m=64 MiB, t=3, p=1) via a SRI-pinned WASM module, with CSP `script-src 'self'` + SRI on the script tag. Envelope `v` field already allows this.
+
+## 8. Recommendation
+
+**Build it, as an opt-in checkbox, passphrase mode only in v1.**
+
+- Server cost is small (pass-through + skip detection/indexing + list flag), client cost moderate (WebCrypto only, no new deps).
+- It closes the biggest real-world risk for a public pastebin: a DB/backup leak exposing every paste ever written.
+- Skip Argon2id in v1; envelope `v` field provides a migration path.
+- Key-in-fragment mode: build the plumbing (fragment parsing) but hide behind "advanced"; default remains passphrase.
+
+**Do not build:** server-side search over encrypted content, server-side highlighting of encrypted content, decrypt-on-server "preview" mode, or any server-side crypto.
+
+## 9. Open questions
+
+1. Size limits: base64 expansion (~4/3×) plus ~200 B envelope overhead; the existing max-bytes / 413 limit applies to the envelope bytes the server stores. Do not compress before encrypting (CRIME-style weaknesses).
+2. Fork/edit of encrypted pastes: disabled in v1, revisit.
+3. Should `/api/mine` include the full envelope in list view? Leaning yes (creator's own browser can decrypt); note the larger payload.
+4. Should there be a "verify passphrase" second field at create time (type-twice), or rely on the KCV check at view time? KCV at view time suffices; type-twice adds friction at create. Rely on KCV, skip type-twice.
+5. CSP/Referrer-Policy hardening: `Referrer-Policy: no-referrer` site-wide is worth doing regardless of this feature (it also benefits unencrypted pastes).
+6. Cans: per-item DEKs wrapped by a single can-level KEK (one passphrase unlocks all items) — better UX, slightly more envelope design work. Defer detail to implementation.
+
+## 10. Alternatives considered
+
+| Alternative | Why not in v1 |
+|---|---|
+| Argon2id via WASM in v1 | Extra JS dependency the server could swap → can't be load-bearing; PBKDF2-600k is adequate for a pastebin. Defer. |
+| Server holds half a key (2-of-2 with server-held share) | Re-introduces server trust; defeats the purpose. |
+| age-format envelopes | Nice CLI interop but no WebCrypto-native support; adds a JS dependency. Defer. |
+| PGP / S-MIME | Poor browser UX; heavy dependencies. |
+| Server-side encryption with server-held keys | Not E2E; that's "encrypted at rest", already covered by disk-level encryption. |
+| PrivateBin-style fragment key only | Single-channel sharing is a footgun; keep passphrase as default. |
+| libsodium / tweetnacl | Solid but unnecessary; WebCrypto covers AES-GCM + PBKDF2 natively. |
+
+## 11. References
+
+- OWASP Password Storage Cheat Sheet (PBKDF2 guidance): https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+- MDN WebCrypto: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
+- PrivateBin (prior art for fragment-key sharing): https://privatebin.info
+- 0bin, Hemmelig — other pastebin/secret E2E prior art.

internal/api/burnrace_test.go

@@ -0,0 +1,103 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// TestBurnAfterReadConcurrentRace is the #58 regression test: N concurrent
+// readers of a burn-after-read paste must receive exactly one success with
+// content; every other reader must get 404 and never any content.
+func TestBurnAfterReadConcurrentRace(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id := createBurnReads(t, h, 1)
+
+	const readers = 24
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins, losses := 0, 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+				var got struct {
+					Content string `json:"content"`
+				}
+				if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil || got.Content != "limited" {
+					t.Errorf("winning read returned wrong content: %v %q", err, got.Content)
+				}
+			} else if rec.Code == 404 {
+				losses++
+				if strings.Contains(rec.Body.String(), "limited") {
+					t.Errorf("losing read leaked content: %s", rec.Body.String())
+				}
+			} else {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != 1 {
+		t.Fatalf("expected exactly 1 winning read of burn paste, got %d (losses=%d)", wins, losses)
+	}
+	if losses != readers-1 {
+		t.Fatalf("expected %d losing reads, got %d", readers-1, losses)
+	}
+}
+
+// TestBurnAfterNReadsConcurrentBudget hammers a burn-after-N paste with many
+// more concurrent distinct readers than the budget: total admissions must
+// equal exactly N, and no losing read may see content.
+func TestBurnAfterNReadsConcurrentBudget(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	const budget = 3
+	id := createBurnReads(t, h, budget)
+
+	const readers = 30
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	wins := 0
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+			req.AddCookie(&http.Cookie{Name: "vwr", Value: fmt.Sprintf("racer-%d", i)})
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			mu.Lock()
+			defer mu.Unlock()
+			if rec.Code == 200 {
+				wins++
+			} else if rec.Code != 404 {
+				t.Errorf("unexpected status %d: %s", rec.Code, rec.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	if wins != budget {
+		t.Fatalf("expected exactly %d admitted reads, got %d", budget, wins)
+	}
+
+	// After the race, the paste is burned for everyone.
+	if rec := getWithCookie(t, h, id, "after-the-fact"); rec.Code != 404 {
+		t.Fatalf("paste should be burned after budget exhausted, got %d", rec.Code)
+	}
+}

internal/api/cans.go

@@ -1,11 +1,11 @@
 package api
 
 import (
-	"palette/internal/store"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"palette/internal/store"
 	"strings"
 	"time"
 
@@ -40,6 +40,12 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
+		// #60: clamp at the API boundary like the pastes API does -
+		// reject zero/negative and durations past the 1-year UI cap.
+		if !store.ValidExpiry(d) {
+			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
+			return
+		}
 		t := now + int64(d.Seconds())
 		expiresAt = &t
 	}
@@ -143,8 +149,6 @@ func detectContentType(name string, content []byte) string {
 	return "text/plain"
 }
 
-
-
 func (a *apiServer) handleGetCan(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	can, err := a.store.GetCan(id)

internal/api/cans_expiry_test.go

@@ -0,0 +1,45 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+// #60: the cans API must clamp expires_in at the boundary exactly like the
+// pastes API — reject zero/negative durations and anything over the 1-year
+// UI cap, accept the exact boundaries.
+func TestCreateCanExpiryBounds(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	cases := []struct {
+		expiresIn string
+		wantCode  int
+	}{
+		{"-1h", 400},    // negative
+		{"-0s", 400},    // negative zero
+		{"0s", 400},     // zero
+		{"1ns", 400},    // positive but below the 1-minute floor
+		{"59s", 400},    // just under the floor
+		{"1m", 201},     // exactly the floor
+		{"90s", 201},    // just over the floor
+		{"8760h", 201},  // exactly 1 year
+		{"8785h", 400},  // 1 year + 1 day: over the cap
+		{"87600h", 400}, // 10 years, the originally reported case
+	}
+	for _, c := range cases {
+		globalLimiter = newLimiter() // avoid create rate limit between cases
+		body, ct := multipartBody(t, map[string]string{
+			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+			"expires_in": c.expiresIn,
+		}, "files", "pic.txt", "file data")
+		req := httptest.NewRequest("POST", "/api/pastes/can", body)
+		req.Header.Set("Content-Type", ct)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.wantCode {
+			t.Errorf("expires_in %q: got %d want %d (%s)",
+				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
+		}
+	}
+}

internal/api/delete_auth_test.go

@@ -0,0 +1,172 @@
+package api
+
+// Regression tests for #63: DELETE /api/pastes/{id} must require the
+// deletion token (Authorization header or ?token= query param, constant-time
+// compare). Without a token, or with a wrong token, the paste must survive
+// and the response must be 403.
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// createTestPaste creates a paste via the API and returns id + deletion token.
+func createTestPaste(t *testing.T, h http.Handler) (string, string) {
+	t.Helper()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"delete me"}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID == "" || created.DeletionToken == "" {
+		t.Fatalf("create response missing id/deletion_token: %s", rec.Body.String())
+	}
+	return created.ID, created.DeletionToken
+}
+
+func pasteExists(t *testing.T, h http.Handler, id string) bool {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code == 200 {
+		return true
+	}
+	if rec.Code == 404 {
+		return false
+	}
+	t.Fatalf("get after delete: got %d", rec.Code)
+	return false
+}
+
+func TestDeleteWithoutTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id, "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete without token: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted without a token")
+	}
+}
+
+func TestDeleteWithWrongTokenForbidden(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, _ := createTestPaste(t, h)
+
+	// query param
+	rec := doReq(t, h, "DELETE", "/api/pastes/"+id+"?token=wrong-token", "", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (query): got %d want 403", rec.Code)
+	}
+	// header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer wrong-token")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("delete with wrong token (header): got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste was deleted with a wrong token")
+	}
+}
+
+func TestDeleteWithCorrectToken(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	id, tok := createTestPaste(t, h)
+
+	// via Authorization header
+	req := httptest.NewRequest("DELETE", "/api/pastes/"+id, nil)
+	req.Header.Set("Authorization", "Bearer "+tok)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (header): got %d want 200: %s", rec.Code, rec.Body.String())
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete")
+	}
+
+	// via query param
+	id, tok = createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id+"?token="+tok, "", "")
+	if rec.Code != 200 {
+		t.Fatalf("delete with correct token (query): got %d want 200", rec.Code)
+	}
+	if pasteExists(t, h, id) {
+		t.Fatal("paste still exists after authorized delete (query)")
+	}
+}
+
+func TestDeleteByCreatorViewerCookieStillAllowed(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	// create from a specific browser
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"mine"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator-abc"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// creator browser deletes without a token: allowed (#37 /mine delete button)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+created.ID, "creator-abc", "")
+	if rec.Code != 200 {
+		t.Fatalf("creator delete: got %d want 200", rec.Code)
+	}
+
+	// a different browser is still forbidden
+	id, _ := createTestPaste(t, h)
+	rec = doReq(t, h, "DELETE", "/api/pastes/"+id, "someone-else", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("other browser delete: got %d want 403", rec.Code)
+	}
+	if !pasteExists(t, h, id) {
+		t.Fatal("paste deleted by unrelated browser")
+	}
+}
+
+func TestDeletionAuthorizationExtract(t *testing.T) {
+	mk := func(hdr, q string) *http.Request {
+		req := httptest.NewRequest("DELETE", "/api/pastes/x"+q, nil)
+		if hdr != "" {
+			req.Header.Set("Authorization", hdr)
+		}
+		return req
+	}
+	cases := []struct {
+		hdr, q, want string
+	}{
+		{"", "", ""},
+		{"Bearer tok", "", "tok"},
+		{"bearer tok", "", "tok"},
+		{"Token tok", "", "tok"},
+		{"tok", "", "tok"},
+		{"", "?token=q", "q"},
+		{"Bearer hdr", "?token=q", "hdr"}, // header wins
+	}
+	for _, c := range cases {
+		if got := deletionAuthorization(mk(c.hdr, c.q)); got != c.want {
+			t.Errorf("deletionAuthorization(hdr=%q q=%q) = %q want %q", c.hdr, c.q, got, c.want)
+		}
+	}
+}

internal/api/main_test.go

@@ -42,7 +42,9 @@ func TestCreateAndGetPaste(t *testing.T) {
 	if rec.Code != 201 {
 		t.Fatalf("create: got %d want 201: %s", rec.Code, rec.Body.String())
 	}
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 	if len(created.ID) != 6 {
 		t.Fatalf("unexpected id: %q", created.ID)
@@ -73,7 +75,9 @@ func TestPasswordProtection(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// without password -> 401
@@ -133,10 +137,14 @@ func TestSoftDelete(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"bye"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID            string `json:"id"`
+		DeletionToken string `json:"deletion_token"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID, nil)
+	req.Header.Set("Authorization", "Bearer "+created.DeletionToken)
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != 200 {
@@ -175,6 +183,46 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	}
 }
 
+func TestListPublicExcludesPasswordAndUnlisted(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	bodies := []string{
+		`{"content":"open","visibility":"public"}`,
+		`{"content":"locked","visibility":"public","password":"hunter2"}`,
+		`{"content":"hidden","visibility":"unlisted"}`,
+	}
+	for _, body := range bodies {
+		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != 201 {
+			t.Fatalf("create %s: got %d", body, rec.Code)
+		}
+	}
+
+	req := httptest.NewRequest("GET", "/api/public", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("list public: got %d", rec.Code)
+	}
+	var resp struct {
+		Total int              `json:"total"`
+		Items []map[string]any `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Total != 1 || len(resp.Items) != 1 {
+		t.Fatalf("expected only the 1 public paste, got total=%d items=%d", resp.Total, len(resp.Items))
+	}
+	// password-protected and unlisted pastes must not appear (no metadata leak)
+	for _, secret := range []string{"hunter2", "locked", "hidden"} {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Fatalf("leaked %q in /api/public response", secret)
+		}
+	}
+}
+
 func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()
@@ -182,7 +230,9 @@ func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"gone soon"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	s.store.SoftDelete(created.ID)
@@ -218,7 +268,9 @@ func TestRawEndpoint(t *testing.T) {
 	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"raw content here"}`))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	var created struct{ ID string `json:"id"` }
+	var created struct {
+		ID string `json:"id"`
+	}
 	json.Unmarshal(rec.Body.Bytes(), &created)
 
 	req = httptest.NewRequest("GET", "/raw/"+created.ID, nil)

internal/api/server.go

@@ -60,6 +60,7 @@ func (a *apiServer) routes() http.Handler {
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
 	r.Use(viewerCookieMiddleware)
+	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
 
 	// admin (#40): HTML page is open (key entry via form); API is key-guarded
 	r.Get("/admin", a.ui.Handlers().HandleAdminPage)
@@ -216,7 +217,12 @@ func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	rem, _ := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow()) // #49 (also covers legacy burn)
+	// #58: only the reader that wins the atomic burn claim may see content.
+	rem, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		writeErr(w, 404, "paste not found")
+		return
+	}
 	writeJSON(w, 200, map[string]any{
 		"id": row.ID, "content": row.Content, "content_type": row.ContentType,
 		"language": store.NullStrPtr(row.Language), "title": store.NullStrPtr(row.Title), "created_at": row.CreatedAt,
@@ -232,21 +238,52 @@ func (a *apiServer) handleDeletePaste(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 404, "paste not found")
 		return
 	}
-	// viewer-cookie delete enforcement (#37): only the browser that created
+	// #63: deletion requires authorization. Either the deletion token issued
-	// the paste (matching vwr) may delete it via this endpoint. Requests with
+	// at create time (Authorization header or ?token= query param, matching
-	// no client-sent vwr cookie (plain API clients) are unaffected.
+	// the create response's "deletion_token" field), or the creator browser
-	vid := currentViewerID(r)
+	// itself (client-sent vwr cookie matching the paste's viewer, #37).
-	if vid != "" && viewerSentCookie(r) && row.ViewerID.Valid && row.ViewerID.String != "" && row.ViewerID.String != vid {
+	if !a.deletionAuthorized(r, row) {
-		writeErr(w, 403, "not your paste")
+		writeErr(w, 403, "deletion token required")
 		return
 	}
-	if err := a.store.SoftDelete(row.ID); err != nil {
+	if _, err := a.store.SoftDelete(row.ID); err != nil {
 		writeErr(w, 500, "db error")
 		return
 	}
 	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
 }
 
+// deletionAuthorization extracts the deletion token from the request: the
+// Authorization header ("Bearer <t>", "Token <t>", or a bare token) or the
+// token query parameter. Returns "" when absent.
+func deletionAuthorization(r *http.Request) string {
+	if h := r.Header.Get("Authorization"); h != "" {
+		for _, prefix := range []string{"Bearer ", "Token "} {
+			if len(h) > len(prefix) && strings.EqualFold(h[:len(prefix)], prefix) {
+				return strings.TrimSpace(h[len(prefix):])
+			}
+		}
+		return strings.TrimSpace(h)
+	}
+	return r.URL.Query().Get("token")
+}
+
+// deletionAuthorized reports whether the request may soft-delete the paste:
+// a valid constant-time-matched deletion token, or the creator browser's
+// viewer cookie (#37). Plain API clients with no token get false.
+func (a *apiServer) deletionAuthorized(r *http.Request, row *store.PasteRow) bool {
+	if tok := deletionAuthorization(r); tok != "" {
+		return row.DeletionToken.Valid && row.DeletionToken.String != "" &&
+			store.DeletionTokenEqual(row.DeletionToken.String, tok)
+	}
+	// viewer-cookie delete enforcement (#37): only the browser that created
+	// the paste (matching vwr) may delete it via this endpoint. Requests with
+	// no client-sent vwr cookie (plain API clients) are unaffected.
+	vid := currentViewerID(r)
+	return vid != "" && viewerSentCookie(r) && row.ViewerID.Valid &&
+		row.ViewerID.String != "" && row.ViewerID.String == vid
+}
+
 // handleListMine serves /api/mine: pastes created from this browser (#37).
 func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 	vid := currentViewerID(r)
@@ -319,8 +356,13 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// #49 decision: raw reads count against the read budget too, with the
-	// same per-viewer dedupe window as page views.
+	// same per-viewer dedupe window as page views. #58: a reader that loses
-	a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	// the burn claim must not receive the content.
+	_, admitted := a.store.RegisterRead(row, currentViewerID(r), a.burnViewerWindow())
+	if !admitted {
+		http.Error(w, "not found", 404)
+		return
+	}
 	// #34: content_type is attacker-controlled via the create API. Serving it
 	// verbatim let a paste be stored with text/html (or image/svg+xml) and
 	// render as active content on this origin when fetched from /raw —

internal/store/burn.go

@@ -17,23 +17,34 @@ func genDeletionToken() string {
 // TimeNow is overridable in tests to inject the clock.
 var TimeNow = time.Now
 
-// registerRead applies the burn-after-read budget for one view (#49).
+// RegisterRead applies the burn-after-read budget for one view (#49).
 // For pastes with reads_limit set: the viewer's paste_views row is checked;
 // a view within the burn viewer window of the viewer's last view is deduped
 // (count=false). Otherwise reads_used is incremented, and the paste is
 // soft-deleted (burned) once reads_used reaches reads_limit. Viewers without
 // a cookie (plain API clients) count as their own viewer id "".
 // For legacy plain burn_after_read pastes (no reads_limit), any read burns.
-// Returns the number of reads remaining (0 when burned), or nil when no
+// #58: admission is atomic. Returns (remaining, admitted). admitted is true
-// budget is set. view_count is tracked separately and unaffected.
+// only when this caller may serve the content: for legacy burn pastes the
-func (s *Store) RegisterRead(row *PasteRow, viewerID string, burnWindowMinutes int) (remaining *int, count bool) {
+// caller wins exactly when its conditional soft delete flipped deleted_at
+// (RowsAffected), and for read-budget pastes the caller wins exactly when its
+// conditional UPDATE (reads_used < reads_limit) incremented the counter - so
+// concurrent readers can never both consume the last read. Losing callers
+// must treat the paste as gone. view_count is tracked separately and
+// unaffected.
+func (s *Store) RegisterRead(row *PasteRow, viewerID string, burnWindowMinutes int) (remaining *int, admitted bool) {
 	if !row.ReadsLimit.Valid {
 		if row.BurnAfterRead {
-			s.SoftDelete(row.ID)
+			// #58: atomic claim - only the caller whose UPDATE actually
+			// flips deleted_at from NULL may serve the content.
+			ok, err := s.SoftDelete(row.ID)
 			r := 0
+			if err != nil || !ok {
+				return &r, false
+			}
 			return &r, true
 		}
-		return nil, false
+		return nil, true
 	}
 	now := TimeNow().Unix()
 	var last sql.NullInt64
@@ -44,14 +55,28 @@ func (s *Store) RegisterRead(row *PasteRow, viewerID string, burnWindowMinutes i
 		if r < 0 {
 			r = 0
 		}
-		return &r, false
+		return &r, true
 	}
 	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
 		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
 		row.ID, viewerID, now)
-	used := row.ReadsUsed + 1
+	// #58: conditional increment - only succeeds while budget remains, so
-	s.db.Exec(`UPDATE pastes SET reads_used=? WHERE id=?`, used, row.ID)
+	// concurrent readers cannot both consume the final read.
-	if int64(used) >= row.ReadsLimit.Int64 {
+	res, err := s.db.Exec(`UPDATE pastes SET reads_used = reads_used + 1
+		WHERE id = ? AND deleted_at IS NULL AND reads_used < ?`, row.ID, row.ReadsLimit.Int64)
+	if err != nil {
+		r := 0
+		return &r, false
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		// Lost the race: budget exhausted (or paste already burned).
+		r := 0
+		return &r, false
+	}
+	var used int64
+	s.db.QueryRow(`SELECT reads_used FROM pastes WHERE id = ?`, row.ID).Scan(&used)
+	if used >= row.ReadsLimit.Int64 {
+		// Atomic burn; either way the paste is gone for future readers.
 		s.SoftDelete(row.ID)
 	}
 	r := int(row.ReadsLimit.Int64) - int(used)

internal/store/store.go

@@ -81,6 +81,11 @@ func OpenStore(path string) (*Store, error) {
 	if err != nil {
 		return nil, err
 	}
+	// #58: a single write connection. SQLite allows only one writer at a
+	// time; with multiple pooled connections concurrent writes surface as
+	// SQLITE_BUSY errors ("database is locked") instead of serializing, and
+	// the burn-after-read race tests saw spurious 500s under parallel reads.
+	db.SetMaxOpenConns(1)
 	s := &Store{db: db}
 	if err := s.migrate(); err != nil {
 		return nil, err
@@ -252,9 +257,13 @@ func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
 	return &r, err
 }
 
+// ListPublic backs /api/public and the public listing page. Visibility rules
+// mirror the history page: only non-deleted, non-expired, non-can pastes are
+// listed, and password-protected pastes are excluded at the query level
+// (#65) so their metadata (title, slug, existence) never leaks.
 func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
 	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
-		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)
 		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
 	if err != nil {
 		return nil, 0, err
@@ -273,7 +282,7 @@ func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
 		out = append(out, r)
 	}
 	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
+	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
 	return out, total, nil
 }
 
@@ -320,9 +329,17 @@ func (s *Store) MineOwner(id string) (string, error) {
 	return vid.String, nil
 }
 
-func (s *Store) SoftDelete(id string) error {
+// SoftDelete marks a paste deleted (burned) atomically (#58): the deleted_at
-	_, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
+// IS NULL guard means only the first caller flips the row. Returns true when
-	return err
+// this call performed the delete (RowsAffected > 0), false when the paste was
+// already deleted - callers use this to decide read admission atomically.
+func (s *Store) SoftDelete(id string) (bool, error) {
+	res, err := s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), id)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
 }
 
 func (s *Store) IncrementViews(id string) {

internal/web/securityheaders_test.go

@@ -0,0 +1,56 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #59: SecurityHeaders must add the CSP and hardening headers to rendered
+// HTML responses only; JSON and /raw responses pass through untouched.
+func TestSecurityHeaders(t *testing.T) {
+	pages := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Write([]byte("<html><body>ok</body></html>"))
+	})
+	h := SecurityHeaders(pages)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
+		t.Errorf("CSP = %q, want %q", got, wantCSP)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
+		t.Errorf("Referrer-Policy = %q, want no-referrer", got)
+	}
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+
+	// JSON response: no security headers.
+	jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	rec = httptest.NewRecorder()
+	jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); got != "" {
+		t.Errorf("unexpected CSP %q on JSON response", got)
+	}
+	if got := rec.Header().Get("Referrer-Policy"); got != "" {
+		t.Errorf("unexpected Referrer-Policy %q on JSON response", got)
+	}
+
+	// Content type set after the first Write (as the inline can page does) is
+	// still picked up because headers are inspected post-handler.
+	lateh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("<html></html>"))
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	}))
+	rec = httptest.NewRecorder()
+	lateh.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
+	if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "frame-ancestors 'none'") {
+		t.Errorf("CSP = %q, want frame-ancestors 'none'", got)
+	}
+}

internal/web/web.go

@@ -255,7 +255,11 @@ func (h *Handlers) HandlePasteView(w http.ResponseWriter, r *http.Request) {
 	// #49: burn-after-N-reads budget (per-viewer dedupe window).
 	// Just-created first render does not count as a read for the creator.
 	if !justCreated {
-		rem, _ := h.Store.RegisterRead(row, h.ViewerID(r), h.BurnWindowMin())
+		rem, admitted := h.Store.RegisterRead(row, h.ViewerID(r), h.BurnWindowMin())
+		if !admitted { // #58: lost the burn claim; do not render content
+			http.NotFound(w, r)
+			return
+		}
 		h.renderPaste(w, row, false, "", rem)
 		return
 	}
@@ -290,3 +294,23 @@ func (h *Handlers) HandleAdminPage(w http.ResponseWriter, r *http.Request) {
 
 // Handlers builds a web.Handlers bound to this UI.
 func (u *UI) Handlers() *Handlers { return &Handlers{UI: u} }
+
+// #59: security headers for rendered HTML pages. Applied wherever the
+// response is text/html (page templates and the inline can page); JSON API
+// responses and /raw content pass through untouched. script-src allows
+// 'unsafe-inline' because the page templates carry inline scripts; CSP
+// default-src 'self' still blocks external content and object/frame embeds,
+// and frame-ancestors 'none' closes the clickjacking gap flagged in the #34
+// pentest. Runs after the handler so the Content-Type is already set.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+		h := w.Header()
+		if strings.HasPrefix(h.Get("Content-Type"), "text/html") {
+			h.Set("Content-Security-Policy",
+				"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			h.Set("Referrer-Policy", "no-referrer")
+			h.Set("X-Content-Type-Options", "nosniff")
+		}
+	})
+}