Merge origin/main: keep can listing rows with #65 password-metadata leak guard

README.md

@@ -5,7 +5,7 @@ a web UI for sharing code and text with links that expire on your terms.
 
 ## Features
 
-- Paste cans — bundle notes, text, and files into one shareable page
+- Paste cans — bundle notes, text, and files into one shareable page, with password/expiry/custom-slug parity and a `can` badge in listings
 - Password lock — protect individual pastes with a password
 - Custom expiry — from 1 minute up to 1 year, or never
 - Burn after N reads — a paste that vanishes after a chosen number of reads
@@ -77,17 +77,7 @@ curl -X POST http://localhost:8080/api/pastes \
   -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
 ```
 
-Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
+Full API docs: [docs/API.md](docs/API.md).
-
-## Performance Notes
-
-The history and Saved pages use client-side filtering: when you type in the
-search box, the UI fetches the most recent 100 pastes (`limit=100`, the API
-maximum) once per query and filters/sorts them in the browser. Pastes beyond
-the newest 100 are not searched; a match count against the full total is still
-shown. This keeps search instant without a server-side query. If large
-instances need full search later, it will be a server-side endpoint (see
-issue #32).
 
 ## CI
 

docs/API.md

@@ -22,10 +22,6 @@ curl -X POST http://localhost:8080/api/pastes \
 
 - `expires_in` is a Go duration string (`90m`, `6h`, `336h`). Omit for no expiry.
 - `visibility` is `public` or `unlisted`.
-- Alternatively (or additionally), `public` may be sent as a boolean (#83):
-  `false` maps to `unlisted` and `true` maps to `public`. When both fields are
-  present, the boolean `public` takes precedence over the string `visibility`.
-  Omitting both defaults to `public`.
 - `burn_after_reads` sets how many reads the paste survives (default 1 when
   `burn_after_read` is true). A read is counted per unique viewer session;
   the same viewer returning within 15 minutes does not count again.
@@ -84,18 +80,29 @@ curl -X POST http://localhost:8080/api/guess-language \
 
 ## Cans (bundles of items)
 
+A can bundles multiple text items (and files) into one shareable page at
+`/can/{id}`. Password, expiry, visibility, custom slug, and viewer-scoped
+deletion work exactly like pastes; cans appear as normal rows (with a `can`
+badge) in `/api/public` and `/api/mine`.
+
 ```bash
 curl -X POST http://localhost:8080/api/pastes/can \
   -F "title=My bundle" \
   -F "expires_in=48h" \
+  -F "custom_slug=my-bundle" \
   -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
   -F "files=@screenshot.png" \
   -F "files=@log.txt"
 
 curl http://localhost:8080/api/cans/{id}
 curl http://localhost:8080/api/cans/{id}/items/{item_id}
+curl -X DELETE http://localhost:8080/api/cans/{id}   # creator browser only (vwr cookie)
 ```
 
+Password-protected cans use the same unlock flow as pastes: `POST /can/{id}`
+with the password sets an HMAC-bound cookie; item fetches accept the cookie as
+well as the `X-Paste-Password` header / `?password=` query param.
+
 ## Web pages
 
 - `/new` — create a paste

docs/design/attachments-storage.md

@@ -1,78 +0,0 @@
-# Attachments & Storage Backend Design (#38, #31)
-
-Status: research/design, no implementation. Consumers: paste cans (#4).
-
-## Part A — Attachments: S3/MinIO vs filesystem-on-volume (#38)
-
-### Options
-
-**Option 1: Filesystem on the k3s PVC (current 5Gi volume).**
-Store blobs under `<data-dir>/attachments/<paste-id>/<n>-<sha256-8>`, metadata in SQLite (paste_id, filename, size, sha256, mime, created_at).
-
-- Pros: zero new infra, zero new credentials, trivial backup (the volume backup job already covers the DB), atomic rename on write, works in dev and prod identically.
-- Cons: volume is size-capped (5Gi today; resizable but bounded); serving large files passes through the app process (no ranged-GET offload); multi-replica later would need RWX volume.
-
-**Option 2: MinIO via S3 API.**
-MinIO is already proven in this homelab (Outline). Store at key `<paste-id>/<n>`; same SQLite metadata row.
-
-- Pros: effectively unbounded capacity, presigned URLs (direct browser download, offloads serving from palette pods), ranged requests free, lifecycle rules could auto-expire orphaned objects.
-- Cons: another credential/secret to manage, another failure mode, MultipartForm still terminates at the palette pod (MinIO only helps *serving*, not *uploading*, unless we do presigned uploads — which breaks the cans multipart flow and the auth/unlock checks), backup now spans two systems.
-
-### Key considerations
-
-- **Upload path is the same either way.** Palette receives `multipart/form-data` (cans need text items + file drops in one request), must enforce auth/password/burn rules server-side. A filesystem backend adds no upload complexity; S3 adds an extra hop (buffer → PUT to MinIO). Streaming straight from `multipart.Reader` to the sink works for both (`io.Copy` to a temp file, or to an S3 PUT with `Content-Length` known or multipart buffering).
-- **Size limits.** Everything is admin-tunable via the settings API (#40 pattern) — add `max_attachment_bytes` (default 10 MiB, hard server-side cap checked *before* reading the body via `Content-Length`, plus a counted reader during copy so chunked uploads can't lie). SQLite itself is not a constraint either way; the PVC is the real cap for Option 1.
-- **MIME handling.** Security-critical (pentest #34 already fixed a content-type XSS on `/raw`). Rules:
-  - Never trust the client-declared Content-Type. Sniff the first 512 bytes (`http.DetectContentType`), intersect with an allowlist.
-  - Serve from a dedicated route (`/{id}/a/{n}`) with `Content-Type` from the stored *sniffed* type, `X-Content-Type-Options: nosniff`, `Content-Security-Policy: sandbox`, `Content-Disposition: attachment` unless the type is on a safe-inline allowlist (text/plain, images, PDF at user opt-in).
-  - Never render user HTML/SVG inline (`image/svg+xml` is XSS-capable — serve as `attachment` always, or store sanitized).
-- **Streaming & serving.**
-  - Filesystem: `http.ServeContent` on the opened file gives ranged GETs, ETag, Last-Modified for free.
-  - MinIO: proxy via `GetObject` + `io.Copy` (simple, keeps auth checks in palette) or presigned GET (faster, but URL embeds credentials-temporarily and bypasses palette's per-request auth — wrong for pastes with passwords/burn semantics). Given cans inherit password/burn parity (#4), **proxying is required, which erodes MinIO's main serving advantage**.
-- **Lifecycle parity.** Attachments must honor soft-delete grace and sweep: sweeper hard-delete also removes blobs (files: `os.Remove`; S3: `DeleteObject`), best-effort with logging; orphan sweep job compares DB rows to store contents.
-
-### Recommendation
-
-**Filesystem-on-volume first.** At current scale (single replica, PVC-based deploy, one user + homelab traffic) it is simpler end-to-end and keeps serving/auth/lifecycle in one place. The internal API should be a narrow blob interface (`Put(ctx, key, r io.Reader, size int64) / Open(key) / Delete(key)`) — about 60 lines per backend — so **MinIO becomes a drop-in later** if attachments outgrow the volume. That's the honest middle path: filesystem default, S3-ready seam, no MinIO dependency until it pays for itself.
-
-## Part B — SQLite vs Postgres vs Redis (#31)
-
-### Assessment of SQLite at pastebin scale
-
-- **Driver**: modernc.org/sqlite (pure Go, no cgo) — slightly slower than mattn/go-sqlite3 but fine; single-writer semantics are the real constraint, not driver speed.
-- **Access pattern**: paste-heavy, write-rare/read-often; primary keys and small set of indexes (visibility+created, expires, deleted); no joins beyond can items. This is SQLite's best case.
-- **WAL mode** is already on (`journal_mode(WAL), busy_timeout(5000)`) — concurrent readers don't block the single writer.
-- **Numbers**: SQLite comfortably handles millions of rows and hundreds of reads/sec; WAL write throughput is thousands of small inserts/sec. A pastebin doing even 100k pastes (avg 10 KB = ~1 GB DB) is trivial. Reads: prepared `WHERE id=?` lookups at this size are sub-millisecond.
-- **Weak points to watch** (document, none urgent):
-  1. Single writer — heavy concurrent create traffic serializes. Mitigation: already rate-limited (#2); fine until that's the bottleneck (unlikely).
-  2. `LENGTH(content)` on every list row — fine now; if it shows up in profiling, store `size` as a column (schema already has a `Size` field; list queries could use it).
-  3. Sweeper runs a table-wide `UPDATE`+`DELETE` on tick — indexed, fine.
-  4. No network access to the DB file — locks palette to single-replica. Acceptable: current deploy is one replica.
-- **Redis is the wrong tool** here: it's a cache/queue, not a system of record. Pastes are durable data with expiry semantics already implemented in SQLite. Redis would only add an optional read-cache layer for hot pastes — pure complexity for zero measured need.
-
-### Should we build a backend abstraction (SQLite default, optional Postgres)?
-
-Arguments for: multi-replica scaling later; "docker image env choice" sounds nice; Postgres gives real concurrency and network access.
-Arguments against: a `Store` interface covering the current query surface is a real refactor (sqlite-flavored SQL: `INSERT OR IGNORE`-style upserts, partial indexes, `?` placeholders are compatible but behaviors differ — e.g. `sqlite` driver pragmas, transaction isolation, `AUTOINCREMENT` semantics); two backends means two test matrices and two migration paths forever; and there is **no current need** — single replica, single writer, modest data.
-
-**Recommendation: stay SQLite-only. Do not build the abstraction now.**
-Specifically:
-
-1. Keep all persistence behind `internal/store` (already done in #35 — the package boundary *is* the abstraction, at zero cost).
-2. Avoid SQLite-specific SQL going forward where free (standard placeholders, no `RETURNING` quirks) — cheap discipline that keeps a future port honest.
-3. Define the trigger conditions for revisiting, and write them down:
-   - multiple replicas needed (scale-out), or
-   - sustained WAL write contention (busy timeouts observed in logs), or
-   - DB file > ~5-10 GB, or
-   - a concrete user request for a Postgres-backed image.
-4. When a trigger fires, port `internal/store` to Postgres behind an interface extracted *then* — the refactor is mechanical against a real need, instead of speculative complexity now.
-5. For the docker image: `PALETTE_DB_PATH` env already implies the deployment choice; no extra backend knob needed.
-
-## Summary
-
-| Decision | Choice |
-|---|---|
-| Attachment backend | Filesystem on PVC, behind a ~3-method blob interface; MinIO as a later drop-in, not a dependency |
-| Size limits | `max_attachment_bytes` admin setting, default 10 MiB, enforced pre-read + during stream |
-| MIME | Server-side sniff (512 bytes) + allowlist; `nosniff`, CSP `sandbox`, `Content-Disposition: attachment` except safe-inline types; SVG never inline |
-| Database | SQLite (WAL, modernc) only; no Postgres/Redis, no backend abstraction until a written trigger fires |

docs/design/cookie-preferences.md

@@ -1,160 +0,0 @@
-# Design: Cookie-Based Preferences and Access Keys (#30)
-
-Status: design note — no implementation yet.
-Related: #37 (vwr viewer cookie), #34 (HMAC unlock cookie), #26 (creator auto-unlock), #36 (settings gear).
-
-## Current cookie surface
-
-| Cookie | Purpose | Lifetime | Flags today |
-|---|---|---|---|
-| `vwr` | Anonymous viewer id; scopes `/mine` history and burn-after-N per-viewer dedupe; client-sent `vwr` also authorizes delete | 1 year | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-| `pw_<id>` | Per-paste password unlock token = HMAC(paste id, PALETTE_UNLOCK_SECRET) | 1 hour | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-| `tok_<id>` | One-time deletion-token handoff after create | 60 s | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-
-The access-key feature is an extension of the `pw_<id>` pattern, not a new mechanism.
-
-## Part 1: Preference storage
-
-### What settings
-
-Only settings the *creator* sets when writing a paste, so the "new paste" form
-can pre-fill them:
-
-- Default language (`lang`)
-- Default expiry (`expires_in` / custom expiry)
-- Burn-after-N-reads default
-- Password-protect-by-default toggle (checkbox pre-checked; the password itself is never stored)
-- Default visibility of the "raw" link, if such a toggle exists
-- Collapsed/expanded state of the settings gear panel itself
-
-Never stored in cookies: passwords, access keys for pastes the user hasn't
-unlocked, deletion tokens (beyond the existing 60 s `tok_` handoff), anything
-typed into the paste body or title fields (existing rule: auto-detect must not
-overwrite user-typed content).
-
-### One cookie, not many
-
-A single `prefs` cookie holding a compact JSON object:
-
-```
-prefs={"lang":"go","exp":"1h","burn":0,"pw":1}
-```
-
-- One cookie avoids the browser per-domain cookie count (typically 50+ per
-  domain; Chrome 180) eating the budget that per-paste access-key cookies need.
-- Per-paste cookies (`pw_<id>`) are inherently name-per-paste and cannot be
-  consolidated — that's the constraint that makes a single `prefs` cookie
-  mandatory rather than stylistic.
-
-### Size limits
-
-- RFC 6265: user agents SHOULD support at least 4096 bytes per cookie. Keep
-  `prefs` under 256 bytes of JSON — it holds a handful of short enum values.
-- Server behavior: if the cookie is present but oversized/invalid JSON, ignore
-  it silently and serve defaults. Never reject a request over a bad preference
-  cookie.
-- Validate on the server (allowlist of known values); a cookie is untrusted
-  input like any header.
-
-### Flags
-
-`HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000; Secure` (Secure once the
-prod instance serves HTTPS — it will, behind the letsencrypt IngressRoute;
-dev on plain HTTP needs the flag conditional on config).
-
-Preferences are not sensitive, but `HttpOnly` costs nothing and keeps script
-from mutating them; `SameSite=Lax` matches the existing cookies.
-
-## Part 2: Access-key cookies
-
-### Goal
-
-"Remember unlocked pastes on this browser" — after entering a password (or
-after creating a private paste), subsequent visits skip the unlock form. This
-extends `pw_<id>` from a 1-hour session convenience to a durable capability.
-
-### Design: extend `pw_<id>`, don't invent a new scheme
-
-The token is already HMAC(paste id, PALETTE_UNLOCK_SECRET) — unforgeable and
-per-paste (fix for the #34 bypass). Changes:
-
-1. **Opt-in checkbox on the unlock form** ("remember on this browser") and a
-   matching checkbox/note at creation time. Default OFF. Non-consenting
-   visitors keep the current 1-hour cookie.
-2. **Extended lifetime** when opted in: `Max-Age = min(paste expiry, 90 days)`.
-   The cookie must never outlive the paste — derive the cap from the paste's
-   `ExpiresAt` at unlock time. Burn-after-N pastes: cap short (e.g. 24 h),
-   since the paste may burn at any read.
-3. **Name collision**: paste ids are fixed-length server-generated, so
-   `pw_<id>` names stay bounded (~40 bytes each). With the 50-cookies-per-
-   domain budget, cap remembered pastes at ~30: when minting the 31st, drop
-   the oldest expired-paste cookies server-side (server knows which ids are
-   expired/deleted; send expired `Set-Cookie` with `Max-Age=0` to reclaim).
-4. **Delete authorization interplay**: today a client-sent `vwr` matching the
-   paste's ViewerID authorizes delete. Access-key cookies grant *read*
-   capability only. Do not let a `pw_<id>` cookie authorize deletion — that
-   would mean cookie theft escalates from "read a paste" to "destroy it".
-   Delete stays bound to `vwr` or the deletion token.
-
-### Scoping
-
-- Keep `Path=/` (paste URLs are `/{id}` at the root; per-paste `Path=/{id}`
-  would work but saves nothing and complicates cleanup).
-- Per-paste scope via the cookie *name* is the existing, tested pattern —
-  no shared "access key ring" cookie. A consolidated `keys` cookie would
-  mean one stolen cookie exposes every remembered paste at once.
-
-## Part 3: Security considerations (honest accounting)
-
-- **XSS exfiltration**: `HttpOnly` prevents JS from *reading* the cookies, but
-  not from *using* them — an XSS payload can simply `fetch('/<paste-id>')` and
-  exfiltrate the content through the page the cookie unlocks. HttpOnly raises
-  the bar (drive-by script can't dump the jar to an attacker server in one
-  request), it does not make access-key cookies safe. This is a real
-  limitation, not a solved problem. Mitigations in order of value:
-  1. Fix the stored-XSS class at the source — #34 already allowlisted
-     content-types on `/raw`; the standing debt items (CSP, X-Frame-Options,
-     Referrer-Policy) directly reduce cookie-use exfiltration and should land
-     before or with this feature.
-  2. Keep access-key cookies opt-in, so the blast radius is bounded to users
-     who accepted the tradeoff.
-- **Cookie theft = paste access**: anyone holding `pw_<id>` can read that
-  paste until the cookie or paste expires, from any machine. That is inherent
-  to capability cookies. Consequences accepted deliberately: pastes here are
-  ephemeral (1 min–1 yr expiry), passwords are low-stakes share convenience,
-  and there are no user accounts to compromise. Document this in the UI copy
-  ("stores unlock access on this browser").
-- **Shared machines**: a remembered cookie defeats the password for the next
-  user of the browser. The opt-in checkbox with plain-language copy is the
-  mitigation; do not default it on.
-- **Cookie tossing / fixation**: a subdomain attacker could try to force
-  cookies; palette is a single host, no untrusted subdomains. `SameSite=Lax`
-  blocks cross-site attachment of the cookies on form posts to unlock
-  endpoints.
-- **Multi-instance / secret rotation**: tokens are HMACs under
-  `PALETTE_UNLOCK_SECRET`; rotating the secret silently invalidates all
-  remembered cookies (acceptable — next visit re-prompts). Both dev and prod
-  k3s instances need the same secret only if sharing a domain, which they do
-  not.
-- **Preferences cookie**: not security-sensitive, but still validate/allowlist
-  server-side to avoid it becoming an injection sink into templates.
-
-## Recommendation
-
-Implement in two small, separately reviewable pieces:
-
-1. **`prefs` cookie** (do first, low risk): single JSON cookie < 256 bytes,
-   server-validated allowlist, `HttpOnly; SameSite=Lax; Max-Age=1y`, drives
-   only form pre-fill. Ship with #36's settings gear.
-2. **Extended `pw_<id>` opt-in** (second, security-sensitive): opt-in checkbox,
-   Max-Age capped by paste expiry (90-day ceiling, 24 h for burn pastes),
-   oldest-cookie eviction at ~30 pastes, no delete authorization from access
-   cookies, and land the CSP/X-Frame-Options hardening debt from #34 in the
-   same or preceding change. UI copy must disclose that the cookie preserves
-   paste access on the browser.
-
-Rejected alternatives: single consolidated access-key cookie (aggregate theft
-risk, and the per-domain cookie-count argument cuts the other way for keys —
-consolidation maximizes what one stolen cookie unlocks); localStorage for
-preferences (XSS-readable, no benefit over HttpOnly cookies here); server-side
-accounts/session table (out of scope — Palette is deliberately anonymous).

docs/design/e2e-encryption.md

@@ -1,223 +0,0 @@
-# Design: Optional client-side E2E encryption for pastes and files
-
-- **Issue:** #39
-- **Status:** Design (no implementation in this PR)
-- **Related docs:** [docs/API.md](../API.md)
-
-## 1. Goals and non-goals
-
-**Goals**
-
-- Let any paste (or can item) be stored server-side as ciphertext only.
-- Zero plaintext knowledge by the server: storage, logs, backups, DB dumps contain no readable content.
-- Pure browser implementation using WebCrypto; no new server dependencies.
-- Encrypted pastes must still work with expiry, hard/soft delete, deletion tokens, visibility, slugs, rate limits.
-
-**Non-goals (v1)**
-
-- Anonymous, account-less E2E; Palette stays server-trusting with browser cookies.
-- Sharing via link fragments (`#key`) is optional sugar, not a required transport.
-- Search *of encrypted content*, server-side language detection, or server-side highlighting on encrypted pastes — these are structurally impossible and out of scope (see §5).
-- Signing, deniability, forward secrecy across pastes, PFS, post-quantum crypto.
-
-**Threat model (explicit).** This protects against a *passive server compromise* — a DB dump, backup leak, or disk image of the server's SQLite file. It does **not** protect against:
-
-- A fully malicious / compromised Palette server serving backdoored JavaScript: any JS-delivered crypto can be backdoored (key exfiltration via JS) regardless of primitives. This is the fundamental limit of a JS-in-browser E2E scheme.
-- Malware on the viewer's device, or shoulder-surfing of the password.
-- Traffic analysis, timing, or metadata (title, size, expiry, IP, viewer cookie).
-- A attacker who compromises the server *while the creator's browser is open* and alters JS before encrypt.
-
-Be explicit in user-facing copy: "encrypted at rest; the server cannot read your paste" is accurate — "the server can never see your paste" is not.
-
-## 2. Crypto primitives and flow
-
-### 2.1 Recommended parameters
-
-| Parameter | Recommendation | Notes |
-|---|---|---|
-| Cipher | **AES-256-GCM** | `AES-GCM` with a 256-bit key, per-paste random 96-bit IV/nonce. WebCrypto built-in, hardware-accelerated, authenticated. |
-| KDF | **PBKDF2-HMAC-SHA-256** | 600,000 iterations (OWASP 2023+ recommendation), 16-byte random salt. |
-| Argon2id | **Not in v1** | WebCrypto has no Argon2id; a JS/WASM Argon2 implementation is an extra supply-chain dependency and is an asymmetric liability: a script the server could swap can't be load-bearing for security anyway. Add later via `argon2id` WASM with SRI pinning + CSP (`script-src 'self'`) if needed. |
-| Salt | 16 random bytes per paste, stored in the clear alongside ciphertext | Unique per paste, never reused. |
-| IV | 12 random bytes per encryption | With ~2^32 encryptions per key this is negligible; each paste has its own key anyway. |
-| Key check value | See §2.2 | Catches wrong passwords without a server round-trip and prevents trash writes. |
-
-### 2.2 Flow (create)
-
-1. User checks "Encrypt" and enters an encryption passphrase (distinct from any access password) in `/new`.
-2. Browser generates `salt` (16 B) and `iv` (12 B) via `crypto.getRandomValues`.
-3. `crypto.subtle.importKey("raw", passphrase, "PBKDF2", false, ["deriveKey"])` →
-   `crypto.subtle.deriveKey(PBKDF2-SHA-256, 600k iterations, salt, {name:"AES-GCM", length:256}, false, ["encrypt","decrypt"])`.
-4. Generate a 32-byte random **DEK** (`crypto.getRandomValues(32)`).
-5. Content encryption key check: `iv_ckv`, `encrypted_content = AES-GCM-256(DEK, iv, content)`.
-6. **Key check value (KCV):** compute `AES-GCM-DEK(random 16 bytes)` — a small token encrypted *under the DEK*, stored as `key_check` blob. This is decrypted with the derived key; on wrong password GCM auth fails and the client can show "wrong key" without asking the server to burn a read.
-7. Wrap the DEK with the KEK: `wrapped_dek = AES-GCM(KEK, iv_wrap, dek)`.
-8. The stored envelope format:
-   ```
-   {
-     v: 1, kdf: "PBKDF2-SHA256", iterations: 600000, salt_b64, iv_b64,
-     kdf_salt_b64, wrap_iv_b64, wrapped_dek_b64, key_check_b64, ciphertext_b64
-   ```
-   The `v` field allows migrating to Argon2id later without a breaking change.
-8. POST the envelope (base64) as `content`, with an `encryption` metadata object alongside (see §3.1).
-
-### 2.3 Flow (view)
-
-1. User provides the passphrase via form field, or the key arrives in the URL `#fragment`. The encryption passphrase is a separate field from any access password.
-2. Fetch `/api/pastes/{id}` (with access password in the usual field if the paste is also password-gated).
-3. Derive KEK from passphrase+salt, unwrap DEK via key_check / unwrap step.
-4. Decrypt content with the DEK; on `OperationError` → "wrong passphrase" UI state (retries are client-side only; no re-fetch, so no extra burn-after-read charge).
-5. Language detection happens client-side (e.g. highlight.js auto-detect) on the decrypted plaintext.
-
-### §2.4 File and can items
-
-Files in cans: encrypt each file with its own DEK and store the same envelope. Cans' `json_items` content fields each carry their own envelope. Files keep their mime type in cleartext metadata; only the bytes are encrypted. The can's title stays plaintext (unless the whole can is encrypted, v2).
-
-## 3. API shapes
-
-### 3.1 Create request
-
-Existing fields unchanged. New optional `encryption` object:
-
-```json
-POST /api/pastes
-{
-  "content": "<base64 envelope>",
-  "encryption": {"v": 1, "kdf": "PBKDF2-SHA256", "iterations": 600000,
-                 "salt": "b64", "iv": "b64", "key_check": "b64"}
-}
-```
-
-`encryption` is non-secret KDF metadata for UI display; the server treats `content` as opaque bytes and MUST NOT inspect it for encrypted pastes (no detection, no highlighting prep, no search indexing) — enforced where content is written, not per-handler.
-
-The full envelope can also just live inside `content` (server-opaque); the `encryption` object carries only non-secret KDF metadata the list views need (e.g. to show a 🔒 icon).
-
-### 3.2 Create response
-
-Unchanged shape: `id`, `url`, `raw_url`, `api_url`, and the one-time `deletion_token` documented in docs/API.md.
-
-### 3.3 Get response
-
-`GET /api/pastes/{id}` response gains:
-
-```json
-{
-  "id": "abc123",
-  "content": "BASE64_ENVELOPE",
-  "encryption": {"v":1, "kdf": "PBKDF2-SHA256", "iterations": 601570, "salt": "b64", "iv": "base64", "key_check": "b64"},
-  "reads_remaining": null
-}
-```
-
-`language` is `"encrypted"` or `null` so clients don't run detection on ciphertext. `raw_url` also serves the envelope; the `/{id}` page ships it to the browser, which decrypts in place.
-
-### 3.4 Raw endpoint
-
-`GET /raw/{id}` returns the envelope as `application/octet-stream` with a suggested filename like `{id}.e2e.txt` and `Content-Disposition: attachment`. This is deliberate: a "download encrypted blob" is what a non-browser client can do with it anyway.
-
-### 3.5 List views / mine / public
-
-List endpoints return `has_encryption: true` instead of content; show a lock icon. Do not include ciphertext in list responses (size, and no reason to ship ciphertext to every viewer's list view) — `GET /api/pastes/{id}` remains the only endpoint that returns the envelope.
-
-`/api/mine` (creator's own browser) may include the envelope for convenience; `/api/public` returns metadata only.
-
-`/api/guess-language` rejects encrypted content with `400 "content is client-encrypted"` — detection needs plaintext; clients detect after decrypting.
-
-Delete, redeem, rate limits, expiry, sweeper, deletion tokens, visibility, slugs, and can CRUD are unchanged — the server never inspects content for these, so opaque content is a no-op path.
-
-## 4. Interplay with existing features
-
-| Feature | Impact | Mitigation |
-| Burn-after-read | Budget is charged on fetch, exactly as today; the server cannot know whether decryption succeeded, so a viewer fetching with the wrong key burns a read they can't use. | Decrypt retries are client-side, so only the first fetch charges the budget. Clear UX copy. |
-| Password-protected + encrypted | Both can coexist and are independent: the access password is an HTTP 401 gate; the encryption passphrase never leaves the browser. If both are set, all three secrets are needed (URL + access password + passphrase). Warn if the user enters the same value in both fields. |
-| Encryption-only pastes | Supported with no access password: URL + passphrase (or fragment key). Default is passphrase; fragment key is opt-in with a warning. |
-| Search | Structurally impossible over ciphertext. Server search just skips encrypted pastes; client-side search within a single decrypted paste works fine. No global encrypted-content search — accept the loss, document it. |
-| Language detection / highlighting | Server-side detection/highlighting impossible; returns `language: null`. Client-side detection via highlight.js auto-detect on decrypted plaintext (client already loads it for password gate pages). |
-| Cans/files | Per-item envelopes (own DEK each), per §2.4. | Consider a can-level KEK (one passphrase unlocks all items). |
-| Expiry/sweeper/delete/redeem | Unchanged — server never inspects content for these. |
-| List views (`/api/public`, `/api/mine`) | Additive `has_encryption: true` flag; list responses do not include ciphertext (`/api/mine` may include the envelope for the creator's own convenience). |
-| guess-language endpoint | Reject with 400. |
-| Fork / edit | Re-encryption needs the passphrase in the browser; v1 disables forking encrypted pastes. | Document the limitation. |
-
-## 5. What breaks, stated plainly
-
-- **Search across encrypted pastes: impossible.** Accept the loss. (If ever needed, client-side index in IndexedDB for the creator's own pastes — v2+.)
- IndexedDB only helps the creator, not other viewers; still not global search. Accept the loss.
-- **Server-side language detection and highlighting: impossible.** Client-side detection on decrypted plaintext. Server returns `language: null` and the client detects.
-- **Burn-after-read is weakened in one specific way:** the budget is counted on fetch, not on successful decryption. A viewer who fetches but can't decrypt (wrong/lost key) burns a read they can't use. Mitigations documented in §4 table. The server can still count fetches (which is what burn-after-read actually is, even today: it counts fetches, not "reads" in any content-aware sense). So burn-after-read still works — it counts fetches — it's just that a failed decryption still consumes budget. This is acceptable and just needs UX copy. Optionally: don't decrement on failed decryption is *not possible* the server can't tell, so it's fetch-based, period. (It already is today.)
-- **Raw endpoint semantics change:** `/raw/{id}` can no longer serve readable raw text. It serves the ciphertext envelope. Scripts that curl raw pastes will get base64 envelope instead of text. Document as a breaking-ish change for encrypted pastes only; unencrypted pastes unchanged.
-- **Existing /api/mine, /api/public list shapes gain a flag** (additive, non-breaking).
-- **Copy-to-clipboard of decrypted text stays client-side**, fine. "Copy raw" on an encrypted paste copies the envelope — label it clearly.
-
-## 5. UX for key sharing
-### 5.1 Three sharing modes
-
-| Mode | What's shared | Security level | Use case |
-|---|---| malformed JSON / wrong key | | |
-| Mode | What's shared | Strength | Use case |
-|---|---|---|---|
-| **Passphrase** (default) | URL + passphrase out-of-band (Signal etc.) | Good — two channels | Team snippets, sensitive configs |
-| **Passphrase + access password** | URL + access password (401 gate) + passphrase | Strong — two secrets, two channels | Highest sensitivity |
-| **Random key in `#fragment`** | URL containing `#key=<b64>` | Weak — single channel; anyone with the full URL has both parts. Copy/paste into chat defeats it entirely. | One-click convenience sharing |
-
-Browsers never transmit `#` fragments to servers; still set `Referrer-Policy: no-referrer` site-wide and offer separate copy buttons for URL and key. Key-in-fragment ships with a warning and stays opt-in.
-
-### 5.2 Create page (`/new`) UX
-
-- "Encrypt content" toggle → reveals passphrase field + strength meter + generate-random-key button.
-- When encrypting, hide the server-side language dropdown; the client detects language after decryption.
-- Two separate inputs with distinct labels: "Access password (checked by the server, 401 gate)" and "Encryption passphrase (never leaves your browser)". If both hold the same value, warn.
-
-### 6.2 View page (`/{id}`) UX
-
-- If `encryption.kdf` is present → show key entry UI (after the access-password 401 gate, if that also applies).
-- After decrypt: normal render pipeline, language detected client-side.
-- "Wrong passphrase" retries never re-fetch, so they never burn extra reads.
-
-## 7. Backwards compatibility and migration
-
-- Additive JSON fields only; unencrypted pastes behave identically. No schema changes (envelope is stored in the existing content column/TEXT; verify column size allows envelope overhead (~2× base64 + ~200 B header).
-- Server-side validation of encrypted pastes: only structural checks (base64 decodes, size ≤ max bytes). No crypto in the server.
-
-**Server implementation cost is genuinely small** (est. 2-4 days): pass through content untouched, add `encryption` metadata column or embed in content, skip detection/indexing when `encryption` is present, list flag. The server never does crypto. All crypto is client-side JS (~150-300 lines, no build-step change if using WebCrypto alone).
-
-**Argon2id later:** add `kdf: "argon2id"` to the envelope `v: 1` (m=64 MiB, t=3, p=1) via a SRI-pinned WASM module, with CSP `script-src 'self'` + SRI on the script tag. Envelope `v` field already allows this.
-
-## 8. Recommendation
-
-**Build it, as an opt-in checkbox, passphrase mode only in v1.**
-
-- Server cost is small (pass-through + skip detection/indexing + list flag), client cost moderate (WebCrypto only, no new deps).
-- It closes the biggest real-world risk for a public pastebin: a DB/backup leak exposing every paste ever written.
-- Skip Argon2id in v1; envelope `v` field provides a migration path.
-- Key-in-fragment mode: build the plumbing (fragment parsing) but hide behind "advanced"; default remains passphrase.
-
-**Do not build:** server-side search over encrypted content, server-side highlighting of encrypted content, decrypt-on-server "preview" mode, or any server-side crypto.
-
-## 9. Open questions
-
-1. Size limits: base64 expansion (~4/3×) plus ~200 B envelope overhead; the existing max-bytes / 413 limit applies to the envelope bytes the server stores. Do not compress before encrypting (CRIME-style weaknesses).
-2. Fork/edit of encrypted pastes: disabled in v1, revisit.
-3. Should `/api/mine` include the full envelope in list view? Leaning yes (creator's own browser can decrypt); note the larger payload.
-4. Should there be a "verify passphrase" second field at create time (type-twice), or rely on the KCV check at view time? KCV at view time suffices; type-twice adds friction at create. Rely on KCV, skip type-twice.
-5. CSP/Referrer-Policy hardening: `Referrer-Policy: no-referrer` site-wide is worth doing regardless of this feature (it also benefits unencrypted pastes).
-6. Cans: per-item DEKs wrapped by a single can-level KEK (one passphrase unlocks all items) — better UX, slightly more envelope design work. Defer detail to implementation.
-
-## 10. Alternatives considered
-
-| Alternative | Why not in v1 |
-|---|---|
-| Argon2id via WASM in v1 | Extra JS dependency the server could swap → can't be load-bearing; PBKDF2-600k is adequate for a pastebin. Defer. |
-| Server holds half a key (2-of-2 with server-held share) | Re-introduces server trust; defeats the purpose. |
-| age-format envelopes | Nice CLI interop but no WebCrypto-native support; adds a JS dependency. Defer. |
-| PGP / S-MIME | Poor browser UX; heavy dependencies. |
-| Server-side encryption with server-held keys | Not E2E; that's "encrypted at rest", already covered by disk-level encryption. |
-| PrivateBin-style fragment key only | Single-channel sharing is a footgun; keep passphrase as default. |
-| libsodium / tweetnacl | Solid but unnecessary; WebCrypto covers AES-GCM + PBKDF2 natively. |
-
-## 11. References
-
-- OWASP Password Storage Cheat Sheet (PBKDF2 guidance): https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
-- MDN WebCrypto: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
-- PrivateBin (prior art for fragment-key sharing): https://privatebin.info
-- 0bin, Hemmelig — other pastebin/secret E2E prior art.

docs/performance-notes.md

@@ -0,0 +1,60 @@
+# Performance notes (#32)
+
+Background: history and saved pages filter client-side. Each load fetches the
+most recent rows from the list endpoint (`limit=500` per query is the current
+client cap in `static/table.js`) and filters/sorts in the browser. This note
+records current behavior, measured latency, and the design for a future
+server-side search endpoint. Measurements only — no implementation in #4/#32.
+
+## Current behavior
+
+- `/api/public?limit=500&offset=0` and `/api/mine?limit=500&offset=0` return up
+  to 500 rows (id, title, language, created_at, view_count, size,
+  custom_slug, is_can). Content is NOT included — only `LENGTH(content)`.
+- The browser applies the search-box filter (title/language/id substring) and
+  column sorting locally over the fetched window.
+- Consequence: search only covers the fetched window (500 most recent rows).
+  Older rows are invisible to search until paginated through, and each query
+  ships ~4 KB of row metadata regardless of how few rows the user will look at.
+
+## Measured latency (synthetic rows, scratch SQLite DB)
+
+Rows are synthetic pastes (~200 B content each, indexed like production:
+`idx_pastes_visibility_created`). Queried `GET /api/public?limit=500`
+(modernc.org/sqlite, WAL, single connection — same as production).
+
+| Rows in table | Bulk insert | First query | Avg query (10 runs) | Payload |
+|---|---|---|---|---|
+| 1,000 | 19 ms | 1.0 ms | 0.44 ms | ~4.1 KB |
+| 5,000 | 95 ms | 1.0 ms | 0.98 ms | ~4.1 KB |
+| 10,000 | 189 ms | 2.0 ms | 1.78 ms | ~4.1 KB |
+
+Interpretation:
+
+- The list query itself is cheap (< 2 ms at 10k rows); latency users perceive
+  comes from network + browser rendering of 500 rows, not SQL.
+- The current design scales fine to ~10k pastes. Beyond that, shipping 500
+  rows per keystroke-refresh cycle is wasteful and search coverage stays
+  capped at the window.
+
+## Future design: server-side `/api/search?q=` (#32 remainder)
+
+- Endpoint: `GET /api/search?q=<term>&limit=25&offset=0`.
+- SQL: `SELECT ... FROM pastes WHERE deleted_at IS NULL AND (expires_at IS NULL
+  OR expires_at > ?) AND (title LIKE ? OR content LIKE ?) ORDER BY created_at
+  DESC LIMIT ? OFFSET ?` — term wrapped as `%term%`, escaped (`%`, `_`).
+  Visibility scoping mirrors ListPublic/ListMine (`public` + `viewer_id` for
+  the saved-page variant).
+- Indexing: LIKE with a leading wildcard cannot use a B-tree index. Options,
+  in order of effort:
+  1. Accept a table scan — fine at ≤ ~50k rows (10k rows scanned in ~2 ms).
+  2. Add an index on `title` for prefix search (`q*`) and keep `%q%` scan only
+     as a fallback.
+  3. SQLite FTS5 virtual table (`CREATE VIRTUAL TABLE pastes_fts USING
+     fts5(title, content)`) for token search — best relevance, needs sync on
+     insert/delete and a migration.
+- Cans: search should cover can titles/descriptions too (UNION ALL with
+  `paste_cans`, `is_can=1`), matching the #4 listing integration.
+- Response shape: same row objects as `/api/public` (plus `is_can`) so
+  `table.js` can render results without a second code path; the client filter
+  becomes a server query when `q` is non-empty.

internal/api/admin.go

@@ -172,11 +172,6 @@ func (a *apiServer) adminKeyOK(r *http.Request, key string) bool {
 
 func (a *apiServer) adminAuth(next http.HandlerFunc, key string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if !rateLimitAdmin(r) {
-			log.Printf("admin auth RATE LIMITED: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
-			writeRateLimited(w, 60)
-			return
-		}
 		if !a.adminKeyOK(r, key) {
 			log.Printf("admin auth FAILURE: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
 			writeErr(w, 401, "unauthorized")

internal/api/adminratelimit_test.go

@@ -1,80 +0,0 @@
-package api
-
-// #66: admin key attempts must be rate limited per IP (5/min), constant-time
-// compared, and failures logged. Hammering bad keys must yield 429s.
-
-import (
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// TestAdminKeyRateLimited: burst of 5 bad-key attempts allowed (401), the 6th
-// gets 429, and even the correct key is blocked from that IP until refill.
-func TestAdminKeyRateLimited(t *testing.T) {
-	srv := newTestServer(t)
-	h := srv.routes()
-	reqIP := "10.7.7.1:1234"
-
-	var got429, retryAfter bool
-	var lastCode int
-	for i := 0; i < 10; i++ {
-		req := httptest.NewRequest("POST", "/admin/api/settings", nil)
-		req.RemoteAddr = reqIP
-		req.Header.Set("X-Admin-Key", "wrong-key")
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		lastCode = rec.Code
-		if rec.Code == 429 {
-			got429 = true
-			retryAfter = rec.Header().Get("Retry-After") != ""
-			break
-		}
-	}
-	if !got429 {
-		t.Fatalf("expected 429 after hammering bad keys, last status %d", lastCode)
-	}
-	if !retryAfter {
-		t.Error("429 missing Retry-After header")
-	}
-
-	// Correct key from the same IP is also locked out.
-	req := httptest.NewRequest("POST", "/admin/api/settings", nil)
-	req.RemoteAddr = reqIP
-	req.Header.Set("X-Admin-Key", srv.adminKey)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 429 {
-		t.Errorf("correct key after lockout: got %d, want 429", rec.Code)
-	}
-
-	// A different IP is unaffected.
-	req2 := httptest.NewRequest("POST", "/admin/api/settings", strings.NewReader(`{"rate_limit_burst":5,"rate_limit_per_minute":60,"max_content_bytes":1048576,"custom_slug_reservation_days":30,"burn_viewer_window_minutes":15}`))
-	req2.RemoteAddr = "203.0.113.9:1234"
-	req2.Header.Set("X-Admin-Key", srv.adminKey)
-	rec2 := httptest.NewRecorder()
-	h.ServeHTTP(rec2, req2)
-	if rec2.Code != 200 {
-		t.Errorf("correct key from another IP: got %d, want 200", rec2.Code)
-	}
-}
-
-// TestAdminKeyConstantTimeCompare: sanity check that the comparison is
-// constant-time (uses subtle.ConstantTimeCompare, not ==).
-func TestAdminKeyConstantTimeCompare(t *testing.T) {
-	srv := newTestServer(t)
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Admin-Key", "test-admin-key")
-	if !srv.adminKeyOK(r, srv.adminKey) {
-		t.Fatal("correct key rejected")
-	}
-	r.Header.Set("X-Admin-Key", "wrong")
-	if srv.adminKeyOK(r, srv.adminKey) {
-		t.Fatal("wrong key accepted")
-	}
-	// differ in length: must not panic/mismatch unexpectedly
-	r.Header.Set("X-Admin-Key", "test-admin-key-longer")
-	if srv.adminKeyOK(r, srv.adminKey) {
-		t.Fatal("longer wrong key accepted")
-	}
-}

internal/api/cans.go

@@ -10,6 +10,8 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
+
+	"palette/internal/web"
 )
 
 // CreateCan makes a can with N items (multipart form).
@@ -31,6 +33,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 	expiresIn := r.FormValue("expires_in")
 	password := r.FormValue("password")
+	customSlug := r.FormValue("custom_slug")
 
 	var expiresAt *int64
 	now := time.Now().Unix()
@@ -40,7 +43,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 			writeErr(w, 400, "invalid expires_in")
 			return
 		}
-		// #60: clamp at the API boundary like the pastes API does -
+		// #60/#48: clamp at the API boundary like the pastes API does -
 		// reject zero/negative and durations past the 1-year UI cap.
 		if !store.ValidExpiry(d) {
 			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
@@ -60,11 +63,25 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	}
 
 	canID := store.GenSlug(8)
-	err := a.store.InsertCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt)
+	var slugPtr *string
+	if customSlug != "" {
+		slugPtr = &customSlug
+	}
+	err := a.store.CreateCan(canID, title, r.FormValue("description"), visibility, pwHash, now, expiresAt, slugPtr)
 	if err != nil {
-		writeErr(w, 500, "db error")
+		switch err {
+		case store.ErrSlugTaken, store.ErrInvalidSlug, store.ErrReservedSlug:
+			writeErr(w, 409, err.Error())
+		default:
+			writeErr(w, 500, "db error")
+		}
 		return
 	}
+	if slugPtr != nil {
+		canID = customSlug // #4: custom slug becomes the can id
+	}
+	// #4: remember the creating browser so /mine and viewer-scoped delete work
+	a.store.Exec(`UPDATE paste_cans SET viewer_id=? WHERE id=?`, currentViewerID(r), canID)
 
 	// text items passed as JSON array: [{"title":"notes.txt","content":"..."}]
 	itemCount := 0
@@ -129,6 +146,29 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// handleDeleteCan soft-deletes a can (parity with paste deletion, #63):
+// requires the vwr viewer cookie matching the can's viewer (cans carry no
+// deletion token since they are built in the browser).
+func (a *apiServer) handleDeleteCan(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	can, err := a.store.GetCan(id)
+	if err != nil || can == nil {
+		writeErr(w, 404, "can not found")
+		return
+	}
+	vid := currentViewerID(r)
+	if !(vid != "" && viewerSentCookie(r) && can.ViewerID.Valid &&
+		can.ViewerID.String != "" && can.ViewerID.String == vid) {
+		writeErr(w, 403, "deletion not authorized")
+		return
+	}
+	if _, err := a.store.SoftDeleteCan(can.ID); err != nil {
+		writeErr(w, 500, "db error")
+		return
+	}
+	writeJSON(w, 200, map[string]string{"status": "soft-deleted"})
+}
+
 func detectContentType(name string, content []byte) string {
 	lower := strings.ToLower(name)
 	switch {
@@ -211,7 +251,8 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 404, "not a can item")
 		return
 	}
-	// inherit can password protection
+	// inherit can password protection: password via header/query, or the
+	// same pw_<can> unlock cookie the can page sets (#4 cookie parity).
 	can, _ := a.store.GetCan(row.CanID.String)
 	if can != nil && can.PasswordHash.Valid {
 		pw := r.Header.Get("X-Paste-Password")
@@ -219,8 +260,12 @@ func (a *apiServer) handleCanItem(w http.ResponseWriter, r *http.Request) {
 			pw = r.URL.Query().Get("password")
 		}
 		if pw == "" || !store.CheckPassword(can.PasswordHash.String, pw) {
-			writeErr(w, 401, "password required")
+			// fall back to the browser's unlock cookie for this can
-			return
+			c, cerr := r.Cookie("pw_" + can.ID)
+			if cerr != nil || c.Value != web.UnlockToken(can.ID) {
+				writeErr(w, 401, "password required")
+				return
+			}
 		}
 	}
 	// #34: same content-type guard as /raw — never serve active content types.

internal/api/cans_expiry_test.go

@@ -1,45 +0,0 @@
-package api
-
-import (
-	"net/http/httptest"
-	"testing"
-)
-
-// #60: the cans API must clamp expires_in at the boundary exactly like the
-// pastes API — reject zero/negative durations and anything over the 1-year
-// UI cap, accept the exact boundaries.
-func TestCreateCanExpiryBounds(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	cases := []struct {
-		expiresIn string
-		wantCode  int
-	}{
-		{"-1h", 400},    // negative
-		{"-0s", 400},    // negative zero
-		{"0s", 400},     // zero
-		{"1ns", 400},    // positive but below the 1-minute floor
-		{"59s", 400},    // just under the floor
-		{"1m", 201},     // exactly the floor
-		{"90s", 201},    // just over the floor
-		{"8760h", 201},  // exactly 1 year
-		{"8785h", 400},  // 1 year + 1 day: over the cap
-		{"87600h", 400}, // 10 years, the originally reported case
-	}
-	for _, c := range cases {
-		globalLimiter = newLimiter() // avoid create rate limit between cases
-		body, ct := multipartBody(t, map[string]string{
-			"json_items": `[{"title":"a.txt","content":"AAA"}]`,
-			"expires_in": c.expiresIn,
-		}, "files", "pic.txt", "file data")
-		req := httptest.NewRequest("POST", "/api/pastes/can", body)
-		req.Header.Set("Content-Type", ct)
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code != c.wantCode {
-			t.Errorf("expires_in %q: got %d want %d (%s)",
-				c.expiresIn, rec.Code, c.wantCode, rec.Body.String())
-		}
-	}
-}

internal/api/cans_flow_test.go

@@ -0,0 +1,413 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"palette/internal/store"
+)
+
+// #4: cans appear in /api/public as normal rows with is_can=true.
+func TestCanInPublicListing(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	// a can and a regular paste
+	body, ct := multipartBody(t, map[string]string{
+		"title":      "Listed can",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create can: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	req = httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"plain"}`))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("public: %d", rec.Code)
+	}
+	var got struct {
+		Total int `json:"total"`
+		Items []struct {
+			ID    string `json:"id"`
+			IsCan bool   `json:"is_can"`
+			Title any    `json:"title"`
+		} `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if got.Total != 2 {
+		t.Fatalf("expected total 2 (can + paste), got %d", got.Total)
+	}
+	foundCan := false
+	for _, it := range got.Items {
+		if it.ID == created.ID {
+			if !it.IsCan {
+				t.Fatalf("can row missing is_can flag")
+			}
+			foundCan = true
+		} else if it.IsCan {
+			t.Fatalf("plain paste flagged as can")
+		}
+	}
+	if !foundCan {
+		t.Fatalf("can not present in /api/public")
+	}
+
+	// #4: unlisted can must not be listed
+	body2, ct2 := multipartBody(t, map[string]string{
+		"title":       "Hidden can",
+		"visibility":  "unlisted",
+		"json_items":  `[{"title":"b.txt","content":"BBB"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body2)
+	req.Header.Set("Content-Type", ct2)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("unlisted can create: %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "Hidden can") {
+		t.Fatalf("unlisted can leaked into /api/public")
+	}
+}
+
+// #4: custom slug support for cans + conflict with existing paste slug.
+func TestCanCustomSlug(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+
+	body, ct := multipartBody(t, map[string]string{
+		"title":       "Slugged",
+		"custom_slug": "my-bundle",
+		"json_items":  `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create can with slug: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct{ ID, URL string }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+	if created.ID != "my-bundle" {
+		t.Fatalf("expected id my-bundle, got %q", created.ID)
+	}
+	// custom slug resolves on the can page route
+	req = httptest.NewRequest("GET", "/can/my-bundle", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Slugged") {
+		t.Fatalf("can page by slug: %d", rec.Code)
+	}
+	// duplicate slug rejected 409
+	body, ct = multipartBody(t, map[string]string{
+		"title": "Again", "custom_slug": "my-bundle",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 409 {
+		t.Fatalf("duplicate slug expected 409, got %d", rec.Code)
+	}
+	// reserved slug rejected
+	body, ct = multipartBody(t, map[string]string{
+		"title": "R", "custom_slug": "admin",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req = httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 409 {
+		t.Fatalf("reserved slug expected 409, got %d", rec.Code)
+	}
+}
+
+// #4: invalid expiry rejected on cans, mirroring paste behavior (#48).
+func TestCanExpiryValidation(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Bad expiry", "expires_in": "30s",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 400 {
+		t.Fatalf("expected 400 for 30s expiry, got %d", rec.Code)
+	}
+}
+
+// #4: expired cans 404 on the page and API.
+func TestCanExpiryAccess(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Dying", "expires_in": "1h",
+		"json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// backdate expiry to force the expired path
+	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, created.ID)
+
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("expired can API expected 404, got %d", rec.Code)
+	}
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("expired can page expected 404, got %d", rec.Code)
+	}
+}
+
+// #4: password-protected can page uses the same unlock flow as pastes.
+func TestCanUnlockFlow(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Locked can", "password": "pw123",
+		"json_items": `[{"title":"secret.txt","content":"sec content"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// GET page without cookie -> unlock form
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "locked") {
+		t.Fatalf("expected unlock form, got %d", rec.Code)
+	}
+
+	// POST wrong password -> unlock form with error
+	fd := strings.NewReader("password=wrong")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "Wrong password") {
+		t.Fatalf("expected wrong-password message")
+	}
+
+	// POST correct password -> page renders, cookie set
+	fd = strings.NewReader("password=pw123")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("unlocked can page missing item content")
+	}
+	var pwCookie *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == "pw_"+created.ID {
+			pwCookie = c
+		}
+	}
+	if pwCookie == nil {
+		t.Fatalf("unlock cookie not set")
+	}
+
+	// GET with cookie -> unlocked
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	req.AddCookie(pwCookie)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("cookie unlock failed: %d", rec.Code)
+	}
+	// a forged cookie value must not unlock
+	req = httptest.NewRequest("GET", "/can/"+created.ID, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "sec content") {
+		t.Fatalf("forged cookie unlocked the can")
+	}
+}
+
+// #4: can item access inherits the can unlock cookie (not just query param).
+func TestCanItemCookieParity(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Cookie can", "password": "pw123",
+		"json_items": `[{"title":"s.txt","content":"sec"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// unlock via page to get the cookie
+	fd := strings.NewReader("password=pw123")
+	req = httptest.NewRequest("POST", "/can/"+created.ID, fd)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var pwCookie *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == "pw_"+created.ID {
+			pwCookie = c
+		}
+	}
+	if pwCookie == nil {
+		t.Fatalf("no unlock cookie")
+	}
+
+	// item id from API (with password query)
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"?password=pw123", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var can struct {
+		Items []struct{ ID string `json:"id"` } `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &can)
+	itemID := can.Items[0].ID
+
+	// API item with the unlock cookie but no password -> 200
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
+	req.AddCookie(pwCookie)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("item via cookie expected 200, got %d", rec.Code)
+	}
+	// forged cookie -> 401
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID+"/items/"+itemID, nil)
+	req.AddCookie(&http.Cookie{Name: "pw_" + created.ID, Value: "forged"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 401 {
+		t.Fatalf("forged cookie on item expected 401, got %d", rec.Code)
+	}
+}
+
+// #4: viewer-scoped soft delete of cans.
+func TestCanDeleteParity(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Doomed", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var created struct{ ID string `json:"id"` }
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// delete without matching viewer -> 403
+	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 403 {
+		t.Fatalf("unauthorized delete expected 403, got %d", rec.Code)
+	}
+	// creator's browser -> 200
+	req = httptest.NewRequest("DELETE", "/api/cans/"+created.ID, nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "creator"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("creator delete expected 200, got %d", rec.Code)
+	}
+	// gone from API and page
+	req = httptest.NewRequest("GET", "/api/cans/"+created.ID, nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 404 {
+		t.Fatalf("deleted can expected 404, got %d", rec.Code)
+	}
+	// gone from listings
+	req = httptest.NewRequest("GET", "/api/public", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if strings.Contains(rec.Body.String(), "Doomed") {
+		t.Fatalf("deleted can still listed")
+	}
+}
+
+// #4: cans appear in /api/mine for the creating browser.
+func TestCanInMine(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	body, ct := multipartBody(t, map[string]string{
+		"title": "Mine can", "json_items": `[{"title":"a.txt","content":"AAA"}]`,
+	}, "", "", "")
+	req := httptest.NewRequest("POST", "/api/pastes/can", body)
+	req.Header.Set("Content-Type", ct)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create: %d", rec.Code)
+	}
+
+	req = httptest.NewRequest("GET", "/api/mine", nil)
+	req.AddCookie(&http.Cookie{Name: "vwr", Value: "v-mine"})
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var got struct {
+		Items []struct {
+			ID    string `json:"id"`
+			IsCan bool   `json:"is_can"`
+		} `json:"items"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &got)
+	if len(got.Items) != 1 || !got.Items[0].IsCan {
+		t.Fatalf("can missing from /api/mine: %s", rec.Body.String())
+	}
+}
+
+// #4: sweep soft-deletes expired cans (parity with pastes).
+func TestCanSweepExpired(t *testing.T) {
+	s := testServer(t)
+	s.store.CreateCan("sweepcan", "sweep", "", "public", nil, 1, nil, nil)
+	s.store.InsertCanItem("sweepcan", "a.txt", "AAA", "text/plain", nil, nil, nil, 1)
+	s.store.Exec(`UPDATE paste_cans SET expires_at=? WHERE id=?`, 100, "sweepcan")
+	s.store.SweepExpired()
+	if can, _ := s.store.GetCan("sweepcan"); can != nil {
+		t.Fatalf("expired can survived sweep")
+	}
+	_ = store.GenSlug(4) // keep import if store pkg shrinks
+}

internal/api/issue68_validation_test.go

@@ -1,198 +0,0 @@
-package api
-
-// Regression tests for #68 input-validation gaps: negative/oversized content
-// lengths (413), limit=0 → default page size, unchecked query params
-// (negative offset), and negative burn_after_reads.
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func createPasteRaw(t *testing.T, h http.Handler, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	return rec
-}
-
-// A request whose decoded content exceeds the admin-tunable cap is rejected
-// with 413 and a clear message (content under the body cap, over the
-// content cap).
-func TestCreatePasteContentOverCap413(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	// content over MaxContentBytes (5MiB) but under body cap (+4KiB): send
-	// just over the content cap so the per-field check fires first.
-	content := strings.Repeat("a", 5*1024*1024+10)
-	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s"}`, content))
-	if rec.Code != http.StatusRequestEntityTooLarge {
-		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "content exceeds max") {
-		t.Fatalf("unclear error message: %s", rec.Body.String())
-	}
-}
-
-// A request whose entire body is larger than the server-side body cap is cut
-// off by http.MaxBytesReader and answered with 413, not decoded into memory
-// (#68: previously a giant body was fully buffered, then rejected only at
-// the per-field check — actually the decode happened before any check).
-func TestCreatePasteBodyOverCap413(t *testing.T) {
-	s := testServer(t)
-	// shrink the content cap so the body cap is small too
-	ss := s.settings.get()
-	ss.MaxContentBytes = 64 * 1024
-	if err := s.settings.set(ss); err != nil {
-		t.Fatal(err)
-	}
-	h := s.routes()
-
-	content := strings.Repeat("a", 200*1024) // 200KiB > 64KiB+4KiB body cap
-	rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"%s","title":"x"}`, content))
-	if rec.Code != http.StatusRequestEntityTooLarge {
-		t.Fatalf("got %d want 413: %s", rec.Code, rec.Body.String())
-	}
-}
-
-// Negative content lengths cannot be expressed via JSON, but a negative
-// expires-style numeric payload must not crash; more importantly the
-// burn_after_reads field: negative values are rejected with a clear message.
-func TestCreatePasteNegativeBurnAfterReads(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	rec := createPasteRaw(t, h, `{"content":"hi","burn_after_reads":-5}`)
-	if rec.Code != http.StatusBadRequest {
-		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "burn_after_reads") {
-		t.Fatalf("unclear error message: %s", rec.Body.String())
-	}
-
-	// 0 and positive values still work (0 = default single read, per #49)
-	rec = createPasteRaw(t, h, `{"content":"hi","burn_after_reads":0,"burn_after_read":true}`)
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("zero burn_after_reads: got %d want 201: %s", rec.Code, rec.Body.String())
-	}
-}
-
-// limit=0 on list endpoints returns the default page size (existing clamp
-// treats <=0 as default; #68 asks this be explicit and tested).
-func TestListLimitZeroUsesDefault(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	// seed 3 public pastes
-	for i := 0; i < 3; i++ {
-		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
-		if rec.Code != 201 {
-			t.Fatalf("seed: got %d: %s", rec.Code, rec.Body.String())
-		}
-	}
-
-	for _, q := range []string{"/api/public?limit=0", "/api/public"} {
-		req := httptest.NewRequest("GET", q, nil)
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code != 200 {
-			t.Fatalf("%s: got %d", q, rec.Code)
-		}
-		var got struct {
-			Limit int                   `json:"limit"`
-			Total int                   `json:"total"`
-			Items []struct{ ID string } `json:"items"`
-		}
-		json.Unmarshal(rec.Body.Bytes(), &got)
-		if got.Limit != 25 || len(got.Items) != 3 {
-			t.Fatalf("%s: limit=%d items=%d, want limit 25 and all 3 items", q, got.Limit, len(got.Items))
-		}
-	}
-}
-
-// Huge limit values are clamped to the max page size (already the behavior;
-// regression-tested here per #68 "validate unchecked params").
-func TestListLimitHugeClamped(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	req := httptest.NewRequest("GET", "/api/public?limit=999999999", nil)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var got struct {
-		Limit int `json:"limit"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if got.Limit != 25 {
-		t.Fatalf("limit=%d, want clamped to 25", got.Limit)
-	}
-}
-
-// Negative offset previously passed through unchecked to SQL (harmless in
-// SQLite, but invalid); it must be clamped to 0 (#68).
-func TestListNegativeOffsetClamped(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	for i := 0; i < 2; i++ {
-		rec := createPasteRaw(t, h, fmt.Sprintf(`{"content":"p%d"}`, i))
-		if rec.Code != 201 {
-			t.Fatalf("seed: got %d", rec.Code)
-		}
-	}
-
-	req := httptest.NewRequest("GET", "/api/public?offset=-999", nil)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("got %d", rec.Code)
-	}
-	var got struct {
-		Offset int `json:"offset"`
-		Total  int `json:"total"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if got.Offset != 0 || got.Total != 2 {
-		t.Fatalf("offset=%d total=%d, want offset 0 and total 2", got.Offset, got.Total)
-	}
-
-	// /api/mine too (needs the viewer cookie)
-	req = httptest.NewRequest("GET", "/api/mine?offset=-5", nil)
-	req.AddCookie(&http.Cookie{Name: "vwr", Value: "offclamp"})
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var mine struct {
-		Offset int `json:"offset"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &mine)
-	if mine.Offset != 0 {
-		t.Fatalf("mine offset=%d, want 0", mine.Offset)
-	}
-}
-
-// Non-numeric limit/offset fall back to defaults instead of 500s.
-func TestListGarbageParams(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	req := httptest.NewRequest("GET", "/api/public?limit=abc&offset=xyz", nil)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("got %d", rec.Code)
-	}
-	var got struct {
-		Limit  int `json:"limit"`
-		Offset int `json:"offset"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &got)
-	if got.Limit != 25 || got.Offset != 0 {
-		t.Fatalf("limit=%d offset=%d, want 25/0", got.Limit, got.Offset)
-	}
-}

internal/api/issue81_password_ratelimit_test.go

@@ -1,92 +0,0 @@
-package api
-
-// #81: ALL password verification attempts (GET query param, header, POST
-// form) must go through the per-IP unlock limiter. Regression: N wrong
-// passwords via GET ?password= must eventually yield 429.
-
-import (
-	"encoding/json"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func createPasswordPaste(t *testing.T, s *apiServer, pw string) string {
-	t.Helper()
-	h := s.routes()
-	body := `{"content":"secret","password":"` + pw + `"}`
-	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	var created struct {
-		ID string `json:"id"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &created)
-	return created.ID
-}
-
-// TestRateLimitGetPasswordQuery: repeated wrong passwords via GET
-// ?password= must eventually return 429 (unlock limiter: burst 5).
-func TestRateLimitGetPasswordQuery(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	id := createPasswordPaste(t, s, "hunter2")
-
-	var saw429 bool
-	// more attempts than the unlock burst (5)
-	for i := 0; i < 10; i++ {
-		req := httptest.NewRequest("GET", "/api/pastes/"+id+"?password=wrong"+string(rune('a'+i)), nil)
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code == 429 {
-			saw429 = true
-			break
-		}
-		if rec.Code != 401 {
-			t.Fatalf("attempt %d: expected 401 before limit, got %d", i, rec.Code)
-		}
-	}
-	if !saw429 {
-		t.Fatal("expected 429 after repeated wrong ?password= attempts, never got one")
-	}
-}
-
-// TestRateLimitGetPasswordHeader: same guarantee for the X-Paste-Password header path.
-func TestRateLimitGetPasswordHeader(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	id := createPasswordPaste(t, s, "hunter2")
-
-	var saw429 bool
-	for i := 0; i < 10; i++ {
-		req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
-		req.Header.Set("X-Paste-Password", "wrong"+string(rune('a'+i)))
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code == 429 {
-			saw429 = true
-			break
-		}
-		if rec.Code != 401 {
-			t.Fatalf("attempt %d: expected 401 before limit, got %d", i, rec.Code)
-		}
-	}
-	if !saw429 {
-		t.Fatal("expected 429 after repeated wrong header password attempts, never got one")
-	}
-}
-
-// TestRateLimitGetPasswordCorrectStillAllowed: a correct password must still
-// work within the burst (the limiter gates attempts, not correctness).
-func TestRateLimitGetPasswordCorrectStillAllowed(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-	id := createPasswordPaste(t, s, "hunter2")
-
-	req := httptest.NewRequest("GET", "/api/pastes/"+id+"?password=hunter2", nil)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("expected 200 for correct password within burst, got %d", rec.Code)
-	}
-}

internal/api/issue86_field_bounds_test.go

@@ -1,152 +0,0 @@
-package api
-
-// Regression tests for #86: title and language are bounded at create time.
-// Titles over 200 chars are truncated; language must match
-// ^[a-zA-Z0-9+#-]{1,40}$ or the create is rejected with a clear 400.
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// pasteMeta fetches a created paste's stored metadata via the API.
-func pasteMeta(t *testing.T, h http.Handler, id string) map[string]any {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, httptest.NewRequest("GET", "/api/pastes/"+id, nil))
-	if rec.Code != 200 {
-		t.Fatalf("get paste %s: got %d: %s", id, rec.Code, rec.Body.String())
-	}
-	var m map[string]any
-	if err := json.Unmarshal(rec.Body.Bytes(), &m); err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-// A 5000-char title is truncated to 200 characters at create time (#86).
-func TestCreatePasteTitleTruncated(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	title := strings.Repeat("t", 5000)
-	body, _ := json.Marshal(map[string]any{"content": "hi", "title": title})
-	rec := createPasteRaw(t, h, string(body))
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("got %d want 201: %s", rec.Code, rec.Body.String())
-	}
-	var resp struct {
-		ID string `json:"id"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &resp)
-	meta := pasteMeta(t, h, resp.ID)
-	got, _ := meta["title"].(string)
-	if got != strings.Repeat("t", 200) {
-		t.Fatalf("title not truncated to 200 chars: len=%d", len(got))
-	}
-}
-
-// A title within the 200-char bound is stored verbatim (minus surrounding
-// whitespace, which is trimmed).
-func TestCreatePasteTitleWithinBoundKept(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	title := "  " + strings.Repeat("x", 200) + "  "
-	body, _ := json.Marshal(map[string]any{"content": "hi", "title": title})
-	rec := createPasteRaw(t, h, string(body))
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("got %d want 201: %s", rec.Code, rec.Body.String())
-	}
-	var resp struct {
-		ID string `json:"id"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &resp)
-	meta := pasteMeta(t, h, resp.ID)
-	if got, _ := meta["title"].(string); got != strings.Repeat("x", 200) {
-		t.Fatalf("title changed unexpectedly: len=%d", len(got))
-	}
-}
-
-// A language longer than 40 chars is rejected with a clear 400 (#86).
-func TestCreatePasteLanguageTooLong400(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	body, _ := json.Marshal(map[string]any{"content": "hi", "language": strings.Repeat("a", 41)})
-	rec := createPasteRaw(t, h, string(body))
-	if rec.Code != http.StatusBadRequest {
-		t.Fatalf("got %d want 400: %s", rec.Code, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "language") {
-		t.Fatalf("unclear error message: %s", rec.Body.String())
-	}
-}
-
-// Language strings outside ^[a-zA-Z0-9+#-]{1,40}$ are rejected with 400.
-func TestCreatePasteLanguageBadFormat400(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	for _, bad := range []string{
-		"<img src=x onerror=alert(1)>",
-		"java script",
-		"c++ extra!",
-		"py_thon",
-		"go.lang",
-	} {
-		body, _ := json.Marshal(map[string]any{"content": "hi", "language": bad})
-		rec := createPasteRaw(t, h, string(body))
-		if rec.Code != http.StatusBadRequest {
-			t.Errorf("language %q: got %d want 400: %s", bad, rec.Code, rec.Body.String())
-			continue
-		}
-		if !strings.Contains(rec.Body.String(), "language must match") {
-			t.Errorf("language %q: unclear error: %s", bad, rec.Body.String())
-		}
-	}
-}
-
-// Valid languages (letters, digits, #, +, -) within 40 chars are accepted.
-func TestCreatePasteLanguageValidAccepted(t *testing.T) {
-	for _, ok := range []string{"go", "c#", "f#", "c++", "objective-c", "ECMAScript-2023", strings.Repeat("a", 40)} {
-		s2 := testServer(t) // fresh rate limiter per case
-		h2 := s2.routes()
-		body, _ := json.Marshal(map[string]any{"content": "hi", "language": ok})
-		rec := createPasteRaw(t, h2, string(body))
-		if rec.Code != http.StatusCreated {
-			t.Errorf("language %q: got %d want 201: %s", ok, rec.Code, rec.Body.String())
-		}
-	}
-}
-
-// An absent or blank language still creates fine and stores NULL, and a
-// blank title is stored NULL rather than an empty string.
-func TestCreatePasteBlankMetadataOK(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	for _, body := range []string{
-		`{"content":"hi"}`,
-		`{"content":"hi","language":"","title":"  "}`,
-	} {
-		rec := createPasteRaw(t, h, body)
-		if rec.Code != http.StatusCreated {
-			t.Fatalf("body %s: got %d want 201: %s", body, rec.Code, rec.Body.String())
-		}
-		var resp struct {
-			ID string `json:"id"`
-		}
-		json.Unmarshal(rec.Body.Bytes(), &resp)
-		meta := pasteMeta(t, h, resp.ID)
-		if lang, ok := meta["language"]; ok && lang != nil && lang != "" {
-			t.Fatalf("body %s: language not null: %v", body, lang)
-		}
-		if title, ok := meta["title"]; ok && title != nil && title != "" {
-			t.Fatalf("body %s: title not null: %v", body, title)
-		}
-	}
-}

internal/api/main_test.go

@@ -183,46 +183,6 @@ func TestListPublicExcludesUnlisted(t *testing.T) {
 	}
 }
 
-func TestListPublicExcludesPasswordAndUnlisted(t *testing.T) {
-	s := testServer(t)
-	h := s.routes()
-
-	bodies := []string{
-		`{"content":"open","visibility":"public"}`,
-		`{"content":"locked","visibility":"public","password":"hunter2"}`,
-		`{"content":"hidden","visibility":"unlisted"}`,
-	}
-	for _, body := range bodies {
-		req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		if rec.Code != 201 {
-			t.Fatalf("create %s: got %d", body, rec.Code)
-		}
-	}
-
-	req := httptest.NewRequest("GET", "/api/public", nil)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("list public: got %d", rec.Code)
-	}
-	var resp struct {
-		Total int              `json:"total"`
-		Items []map[string]any `json:"items"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &resp)
-	if resp.Total != 1 || len(resp.Items) != 1 {
-		t.Fatalf("expected only the 1 public paste, got total=%d items=%d", resp.Total, len(resp.Items))
-	}
-	// password-protected and unlisted pastes must not appear (no metadata leak)
-	for _, secret := range []string{"hunter2", "locked", "hidden"} {
-		if strings.Contains(rec.Body.String(), secret) {
-			t.Fatalf("leaked %q in /api/public response", secret)
-		}
-	}
-}
-
 func TestSweepSoftDeletesAfterGrace(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()

internal/api/publicbool_test.go

@@ -1,97 +0,0 @@
-package api
-
-// #83 regression tests: `public` boolean in the create payload must map to
-// visibility (false -> unlisted, true -> public); string `visibility` still works.
-
-import (
-	"encoding/json"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func createPasteBody(t *testing.T, h *apiServer, body string) map[string]any {
-	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
-	rec := httptest.NewRecorder()
-	h.routes().ServeHTTP(rec, req)
-	if rec.Code != 201 {
-		t.Fatalf("create: got %d: %s", rec.Code, rec.Body.String())
-	}
-	var resp map[string]any
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("bad json: %v", err)
-	}
-	return resp
-}
-
-func getVis(t *testing.T, h *apiServer, id string) string {
-	req := httptest.NewRequest("GET", "/api/pastes/"+id, nil)
-	rec := httptest.NewRecorder()
-	h.routes().ServeHTTP(rec, req)
-	if rec.Code != 200 {
-		t.Fatalf("get %s: got %d", id, rec.Code)
-	}
-	var resp struct {
-		Visibility string `json:"visibility"`
-	}
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("bad json: %v", err)
-	}
-	return resp.Visibility
-}
-
-// TestPublicBooleanFalseMapsToUnlisted: {"public": false} must create an unlisted paste.
-func TestPublicBooleanFalseMapsToUnlisted(t *testing.T) {
-	s := testServer(t)
-	resp := createPasteBody(t, s, `{"content":"x","public":false}`)
-	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
-		t.Fatalf("public:false -> got visibility %q, want unlisted", v)
-	}
-}
-
-// TestPublicBooleanTrueMapsToPublic: {"public": true} must create a public paste.
-func TestPublicBooleanTrueMapsToPublic(t *testing.T) {
-	s := testServer(t)
-	resp := createPasteBody(t, s, `{"content":"x","public":true}`)
-	if v := getVis(t, s, resp["id"].(string)); v != "public" {
-		t.Fatalf("public:true -> got visibility %q, want public", v)
-	}
-}
-
-// TestPublicBooleanOverridesString: boolean wins when both fields are sent.
-func TestPublicBooleanOverridesString(t *testing.T) {
-	s := testServer(t)
-	resp := createPasteBody(t, s, `{"content":"x","visibility":"public","public":false}`)
-	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
-		t.Fatalf("boolean override -> got %q, want unlisted", v)
-	}
-}
-
-// TestVisibilityStringStillWorks: existing string contract unchanged.
-func TestVisibilityStringStillWorks(t *testing.T) {
-	s := testServer(t)
-	resp := createPasteBody(t, s, `{"content":"x","visibility":"unlisted"}`)
-	if v := getVis(t, s, resp["id"].(string)); v != "unlisted" {
-		t.Fatalf("string field -> got %q, want unlisted", v)
-	}
-	resp = createPasteBody(t, s, `{"content":"y","visibility":"public"}`)
-	if v := getVis(t, s, resp["id"].(string)); v != "public" {
-		t.Fatalf("string field -> got %q, want public", v)
-	}
-}
-
-// TestPublicListExcludesPublicFalse: {"public":false} pastes stay out of /api/public.
-func TestPublicListExcludesPublicFalse(t *testing.T) {
-	s := testServer(t)
-	createPasteBody(t, s, `{"content":"hidden","public":false}`)
-	req := httptest.NewRequest("GET", "/api/public", nil)
-	rec := httptest.NewRecorder()
-	s.routes().ServeHTTP(rec, req)
-	var resp struct {
-		Total int `json:"total"`
-	}
-	json.Unmarshal(rec.Body.Bytes(), &resp)
-	if resp.Total != 0 {
-		t.Fatalf("public:false paste leaked into /api/public: total=%d", resp.Total)
-	}
-}

internal/api/ratelimit.go

@@ -48,28 +48,8 @@ func (l *limiter) allow(key string, rate, burst float64) bool {
 	return true
 }
 
-// clientIP extracts the client IP for rate-limit keying (#85).
+// clientIP extracts the request IP (no reverse proxy header by default).
-//
-// Trust boundary: palette runs behind exactly ONE trusted reverse proxy
-// (Traefik in the k3s pod network). Traefik APPENDS the real client IP to
-// X-Forwarded-For, so the RIGHTMOST entry is the last value the trusted
-// proxy observed and is unspoofable by the client (a client-supplied fake
-// entry only lands on the LEFT and is ignored). This matches chi's
-// middleware.RealIP semantics for a single trusted proxy hop.
-//
-// Direct connections (no XFF header) fall back to RemoteAddr. Directly
-// reachable deployments must NOT expose the app to untrusted networks
-// without a proxy in front, or attackers could forge the rightmost entry.
 func clientIP(r *http.Request) string {
-	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-		if i := strings.LastIndex(xff, ","); i >= 0 {
-			return strings.TrimSpace(xff[i+1:])
-		}
-		return strings.TrimSpace(xff)
-	}
-	if xr := r.Header.Get("X-Real-Ip"); xr != "" {
-		return strings.TrimSpace(xr)
-	}
 	host := r.RemoteAddr
 	if i := strings.LastIndex(host, ":"); i > 0 {
 		host = host[:i]
@@ -104,12 +84,6 @@ func rateLimitUnlock(id string, r *http.Request) bool {
 	return globalLimiter.allow("unlock:"+id+":"+clientIP(r), 5.0/60.0, 5)
 }
 
-// rateLimitAdmin: 5 attempts per minute per IP on the admin key check (#66),
-// same pattern as the unlock limiter (#34).
-func rateLimitAdmin(r *http.Request) bool {
-	return globalLimiter.allow("admin:"+clientIP(r), 5.0/60.0, 5)
-}
-
 // writeRateLimited responds 429 with Retry-After based on refill rate.
 func writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
 	w.Header().Set("Retry-After", strconv.Itoa(retryAfterSecs))

internal/api/ratelimit_xff_test.go

@@ -1,85 +0,0 @@
-package api
-
-// Issue #85: the rate limit key must use the rightmost X-Forwarded-For entry
-// (appended by the trusted Traefik proxy), never the raw/leftmost header
-// value a client can forge. A spoofed FIRST XFF entry must not bypass the
-// limit or rotate buckets.
-
-import (
-	"bytes"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestClientIPTakesRightmostXFF(t *testing.T) {
-	r := httptest.NewRequest("POST", "/", nil)
-	r.RemoteAddr = "10.42.0.7:51000" // trusted Traefik pod
-	r.Header.Set("X-Forwarded-For", "1.2.3.4, 1.2.3.5, 203.0.113.9")
-	if got := clientIP(r); got != "203.0.113.9" {
-		t.Fatalf("clientIP = %q, want rightmost 203.0.113.9", got)
-	}
-}
-
-func TestClientIPXRealIPFallback(t *testing.T) {
-	r := httptest.NewRequest("POST", "/", nil)
-	r.RemoteAddr = "10.42.0.7:51000"
-	r.Header.Set("X-Real-Ip", "203.0.113.10")
-	if got := clientIP(r); got != "203.0.113.10" {
-		t.Fatalf("clientIP = %q, want 203.0.113.10", got)
-	}
-}
-
-func TestClientIPDirectFallback(t *testing.T) {
-	r := httptest.NewRequest("POST", "/", nil)
-	r.RemoteAddr = "198.51.100.5:51000"
-	if got := clientIP(r); got != "198.51.100.5" {
-		t.Fatalf("clientIP = %q, want 198.51.100.5", got)
-	}
-}
-
-// TestRateLimitSpoofedFirstXFFDoesNotBypass: an attacker rotating a fake
-// leftmost XFF entry stays limited on their real (rightmost) IP.
-func TestRateLimitSpoofedFirstXFFDoesNotBypass(t *testing.T) {
-	srv := newTestServer(t)
-	h := srv.routes()
-	for i := 0; i < 5; i++ {
-		req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
-		req.RemoteAddr = "10.42.0.7:51000"
-		// each request spoofs a DIFFERENT leftmost entry
-		req.Header.Set("X-Forwarded-For", spoofN(i)+", 203.0.113.9")
-		rr := httptest.NewRecorder()
-		h.ServeHTTP(rr, req)
-		if rr.Code != 201 {
-			t.Fatalf("req %d: want 201, got %d", i, rr.Code)
-		}
-	}
-	// 6th request, still the same real IP, new spoofed prefix: must 429
-	req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
-	req.RemoteAddr = "10.42.0.7:51000"
-	req.Header.Set("X-Forwarded-For", "9.9.9.9, 203.0.113.9")
-	rr := httptest.NewRecorder()
-	h.ServeHTTP(rr, req)
-	if rr.Code != 429 {
-		t.Fatalf("spoofed 6th req: want 429, got %d", rr.Code)
-	}
-}
-
-func spoofN(i int) string {
-	return "1.2.3." + string(rune('0'+i))
-}
-
-// Distinct real IPs must still get distinct buckets (no over-limiting).
-func TestRateLimitDistinctRightmostIPsIndependent(t *testing.T) {
-	srv := newTestServer(t)
-	h := srv.routes()
-	for _, ip := range []string{"203.0.113.20", "203.0.113.21"} {
-		req := httptest.NewRequest("POST", "/api/pastes", bytes.NewReader([]byte(`{"content":"hi"}`)))
-		req.RemoteAddr = "10.42.0.7:51000"
-		req.Header.Set("X-Forwarded-For", "6.6.6.6, "+ip)
-		rr := httptest.NewRecorder()
-		h.ServeHTTP(rr, req)
-		if rr.Code != 201 {
-			t.Fatalf("ip %s: want 201, got %d", ip, rr.Code)
-		}
-	}
-}

internal/api/server.go

@@ -4,8 +4,10 @@ package api
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
+	"html/template"
 	"net/http"
 	"os"
 	"strconv"
@@ -15,8 +17,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
-	"database/sql"
+	langpkg "palette/internal/lang"
-
 	"palette/internal/store"
 	"palette/internal/web"
 )
@@ -59,9 +60,7 @@ func (a *apiServer) routes() http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
-	r.Use(a.limitRequestBody) // #68: hard server-side body cap -> 413
 	r.Use(viewerCookieMiddleware)
-	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
 
 	// admin (#40): HTML page is open (key entry via form); API is key-guarded
 	r.Get("/admin", a.ui.Handlers().HandleAdminPage)
@@ -79,11 +78,13 @@ func (a *apiServer) routes() http.Handler {
 		r.Post("/guess-language", a.handleGuessLang)
 		r.Post("/pastes/can", a.handleCreateCan)
 		r.Get("/cans/{id}", a.handleGetCan)
+		r.Delete("/cans/{id}", a.handleDeleteCan)
 		r.Get("/cans/{id}/items/{item}", a.handleCanItem)
 	})
 
-	// can page
+	// can page (#4): GET renders, POST unlocks (same flow as pastes)
 	r.Get("/can/{id}", a.handleCanPage)
+	r.Post("/can/{id}", a.handleCanPage)
 
 	// raw
 	r.Get("/raw/{id}", a.handleRaw)
@@ -154,43 +155,16 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	}
 	var p store.Paste
 	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
-		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
-			writeBodyTooLarge(w)
-			return
-		}
 		writeErr(w, 400, "invalid json body")
 		return
 	}
-	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
+	if strings.TrimSpace(p.Content) == "" {
-		writeErr(w, status, msg)
+		writeErr(w, 400, "content is required")
 		return
 	}
-	// #86: bound free-form metadata at create time
+	if int64(len(p.Content)) > s.MaxContentBytes { // #40: admin-tunable
-	if p.Title != nil {
+		writeErr(w, 413, fmt.Sprintf("content exceeds max %d bytes", s.MaxContentBytes))
-		t, err := checkTitle(*p.Title)
+		return
-		if err != nil {
-			writeErr(w, 400, err.Error())
-			return
-		}
-		p.Title = &t
-	}
-	if p.Language != nil {
-		l, err := checkLanguage(*p.Language)
-		if err != nil {
-			writeErr(w, 400, err.Error())
-			return
-		}
-		if l == "" {
-			p.Language = nil
-		} else {
-			p.Language = &l
-		}
-	}
-	if p.BurnAfterReads != nil { // #68: reject negative read budgets
-		if err := parseBurnAfterReads(*p.BurnAfterReads); err != nil {
-			writeErr(w, 400, err.Error())
-			return
-		}
 	}
 	// #40: admin-configurable default expiry
 	if (p.ExpiresIn == nil || *p.ExpiresIn == "") && s.DefaultExpiry != "" {
@@ -235,13 +209,6 @@ func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if row.PasswordHash.Valid {
-		// #81: every password verification (header, query param, or empty)
-		// goes through the same per-IP+paste unlock limiter as the POST form
-		// path, so brute-force via GET ?password= or X-Paste-Password gets 429.
-		if !rateLimitUnlock(row.ID, r) {
-			writeRateLimited(w, 60)
-			return
-		}
 		// require password via header or query
 		pw := r.Header.Get("X-Paste-Password")
 		if pw == "" {
@@ -326,8 +293,11 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
 		return
 	}
-	limit := parseLimit(r, 50, 100)
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	offset := parseOffset(r)
+	if limit <= 0 || limit > 100 {
+		limit = 50
+	}
+	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	rows, total, err := a.store.ListMine(vid, limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")
@@ -340,14 +310,18 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 			"id": row.ID, "title": title, "language": lang,
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
 			"custom_slug": store.NullStrPtr(row.CustomSlug), "visibility": row.Visibility,
+			"is_can": row.IsCan,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
 }
 
 func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
-	limit := parseLimit(r, 25, 100)
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	offset := parseOffset(r)
+	if limit <= 0 || limit > 100 {
+		limit = 25
+	}
+	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	rows, total, err := a.store.ListPublic(limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")
@@ -360,6 +334,7 @@ func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
 			"id": row.ID, "title": title, "language": lang,
 			"created_at": row.CreatedAt, "view_count": row.ViewCount, "size": row.Size,
 			"custom_slug": store.NullStrPtr(row.CustomSlug),
+			"is_can":      row.IsCan,
 		})
 	}
 	writeJSON(w, 200, map[string]any{"total": total, "limit": limit, "offset": offset, "items": items})
@@ -403,7 +378,7 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", ct)
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	a.store.IncrementViews(row.ID)
+	a.store.IncrementViews(row.ID, "", 0) // raw views always count (#49/#95)
 	w.Write([]byte(row.Content))
 }
 
@@ -432,13 +407,117 @@ func (a *apiServer) handleCanPage(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	items, _ := a.store.ListCanItems(can.ID)
+	if can.ExpiresAt.Valid && can.ExpiresAt.Int64 < time.Now().Unix() {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		http.NotFound(w, r)
-	fmt.Fprintf(w, "<!doctype html><html><head><title>can/%s — palette</title></head><body><h1>can/%s</h1><ul>", can.ID, can.ID)
+		return
+	}
+	// #4: password-protected cans go through the same unlock flow as pastes:
+	// the pw_<id> cookie carries an HMAC token bound to this can id. Items
+	// inherit the protection (handleCanItem checks the same cookie).
+	if can.PasswordHash.Valid {
+		h := a.webHandlers()
+		if r.Method == http.MethodPost {
+			if !rateLimitUnlock(can.ID, r) {
+				h.WriteRateLimited(w, 60)
+				return
+			}
+			r.ParseForm()
+			pw := r.FormValue("password")
+			if pw != "" && store.CheckPassword(can.PasswordHash.String, pw) {
+				http.SetCookie(w, &http.Cookie{
+					Name: "pw_" + can.ID, Value: web.UnlockToken(can.ID), Path: "/",
+					MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+				})
+				a.renderCan(w, can)
+				return
+			}
+			h.RenderPage(w, "unlock.html", map[string]any{
+				"Page": "unlock", "ID": can.ID, "Wrong": true,
+				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
+			})
+			return
+		}
+		c, err := r.Cookie("pw_" + can.ID)
+		if err != nil || c.Value != web.UnlockToken(can.ID) {
+			h.RenderPage(w, "unlock.html", map[string]any{
+				"Page": "unlock", "ID": can.ID, "Wrong": false,
+				"CreatedAgo": web.AgoString(can.CreatedAt), "CreatedAtUnix": can.CreatedAt,
+			})
+			return
+		}
+	}
+	a.renderCan(w, can)
+}
+
+// renderCan renders the can view page: title/description and items as cards.
+// Text items expand inline; files link to download.
+func (a *apiServer) renderCan(w http.ResponseWriter, can *store.CanRow) {
+	h := a.webHandlers()
+	items, err := a.store.ListCanItems(can.ID)
+	if err != nil {
+		http.Error(w, "db error", 500)
+		return
+	}
+	type canItem struct {
+		ID          string
+		Title       string
+		ContentType string
+		Size        string
+		IsFile      bool
+		Content     string
+		ContentHTML template.HTML
+		Language    string
+	}
+	cards := make([]canItem, 0, len(items))
+	totalSize := 0
 	for _, it := range items {
-		fmt.Fprintf(w, `<li><a href="/api/cans/%s/items/%s">%s</a> (%s)</li>`, can.ID, it.ID, templateEsc(nullStrOr(it.Title, it.ID)), it.ContentType)
+		totalSize += len(it.Content)
+		isFile := it.ContentType != "text/plain" && !strings.HasPrefix(it.ContentType, "text/")
+		ci := canItem{
+			ID:          it.ID,
+			Title:       nullStrOr(it.Title, it.ID),
+			ContentType: it.ContentType,
+			Size:        web.HumanSize(len(it.Content)),
+			IsFile:      isFile,
+			Language:    it.Language.String,
+		}
+		if !isFile {
+			ci.ContentHTML = template.HTML(langpkg.HighlightCode(it.Content, it.Language.String))
+		}
+		cards = append(cards, ci)
+	}
+	h.RenderPage(w, "can.html", map[string]any{
+		"Page":          "can",
+		"ID":            can.ID,
+		"Title":         nullStrOr(can.Title, "Untitled can"),
+		"Description":   can.Description.String,
+		"HasDescription": can.Description.Valid && can.Description.String != "",
+		"HasPassword":   can.PasswordHash.Valid,
+		"Items":         cards,
+		"ItemCount":     len(cards),
+		"SizeHuman":     web.HumanSize(totalSize),
+		"CreatedAgo":    web.AgoString(can.CreatedAt),
+		"CreatedAtUnix": can.CreatedAt,
+		"ExpiresAt":     can.ExpiresAt.Valid,
+		"ExpiresIn":     expiryStringIfValid(can.ExpiresAt),
+	})
+}
+
+// expiryStringIfValid formats remaining time for a valid expiry, "" otherwise.
+func expiryStringIfValid(ns sql.NullInt64) string {
+	if !ns.Valid {
+		return ""
+	}
+	remaining := ns.Int64 - time.Now().Unix()
+	s := remaining
+	switch {
+	case s < 3600:
+		return fmt.Sprintf("%dm", s/60)
+	case s < 86400:
+		return fmt.Sprintf("%dh", s/3600)
+	default:
+		return fmt.Sprintf("%dd", s/86400)
 	}
-	fmt.Fprintf(w, "</ul></body></html>")
 }
 
 func templateEsc(s string) string {

internal/api/validate.go

@@ -1,136 +0,0 @@
-package api
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-// #68 input-validation helpers. Paste/can payloads are size-capped and list
-// endpoints get a single place where limit/offset are parsed and clamped.
-
-// maxRequestBody returns the HTTP body cap for JSON create endpoints: the
-// admin-tunable content cap plus headroom for JSON field overhead, floored
-// at 64KiB so a tiny admin-configured cap can't break small requests.
-func (a *apiServer) maxRequestBody() int64 {
-	s := a.settings.get()
-	max := s.MaxContentBytes + 4096
-	if max < 64*1024 {
-		max = 64 * 1024
-	}
-	return max
-}
-
-// limitRequestBody wraps the request body with http.MaxBytesReader so
-// oversized payloads are cut off server-side instead of being fully decoded
-// into memory before the per-field size check runs (#68). A read over the
-// cap surfaces as *http.MaxBytesError, which handlers map to 413.
-func (a *apiServer) limitRequestBody(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Body != nil {
-			r.Body = http.MaxBytesReader(w, r.Body, a.maxRequestBody())
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-// writeBodyTooLarge emits the 413 response for a body rejected by
-// MaxBytesReader.
-func writeBodyTooLarge(w http.ResponseWriter) {
-	writeErr(w, http.StatusRequestEntityTooLarge, "request body too large")
-}
-
-// isBodyTooLarge reports whether err came from http.MaxBytesReader.
-func isBodyTooLarge(err error) bool {
-	var mbe *http.MaxBytesError
-	return errors.As(err, &mbe)
-}
-
-// checkContent validates paste content: rejects whitespace-only content
-// (400) and content over the byte cap (413). Returns (0, "") when valid.
-func checkContent(content string, maxBytes int64) (int, string) {
-	if strings.TrimSpace(content) == "" {
-		return http.StatusBadRequest, "content is required"
-	}
-	if int64(len(content)) > maxBytes { // #40/#68: admin-tunable cap
-		return http.StatusRequestEntityTooLarge,
-			fmt.Sprintf("content exceeds max %d bytes", maxBytes)
-	}
-	return 0, ""
-}
-
-// parseLimit clamps the ?limit query param: missing/non-numeric/zero/negative
-// or over-max values fall back to def. Zero intentionally maps to the default
-// page size, matching the pre-existing `<= 0` clamp (#68).
-func parseLimit(r *http.Request, def, max int) int {
-	n, err := strconv.Atoi(r.URL.Query().Get("limit"))
-	if err != nil || n <= 0 || n > max {
-		return def
-	}
-	return n
-}
-
-// parseOffset clamps the ?offset query param: missing/non-numeric or negative
-// values become 0 (#68: negative offsets previously passed through to SQL).
-func parseOffset(r *http.Request) int {
-	n, err := strconv.Atoi(r.URL.Query().Get("offset"))
-	if err != nil || n < 0 {
-		return 0
-	}
-	return n
-}
-
-// parseBurnAfterReads validates the burn_after_reads field (#68): negative
-// values are rejected; zero/absent mean the default single read.
-func parseBurnAfterReads(n int) error {
-	if n < 0 {
-		return errors.New("burn_after_reads must be a positive number")
-	}
-	return nil
-}
-
-// #86: bounds for free-form metadata fields on create.
-const (
-	maxTitleLen    = 200
-	maxLanguageLen = 40
-)
-
-// languageRe restricts language to identifiers like go, c#, f#, c++, objc.
-var languageRe = regexp.MustCompile(`^[a-zA-Z0-9+#-]{1,40}$`)
-
-// checkTitle validates the paste title (#86): over-max titles are truncated
-// to 200 characters so a bloated listing entry can't be stored; whitespace
-// is trimmed first.
-func checkTitle(title string) (string, error) {
-	title = strings.TrimSpace(title)
-	if len(title) > maxTitleLen {
-		return truncateRunes(title, maxTitleLen), nil
-	}
-	return title, nil
-}
-
-// checkLanguage validates the language field (#86): optional, max 40 chars,
-// and must match ^[a-zA-Z0-9+#-]{1,40}$. Returns "" for absent/blank values.
-// Anything else malformed is a 400.
-func checkLanguage(lang string) (string, error) {
-	lang = strings.TrimSpace(lang)
-	if lang == "" {
-		return "", nil
-	}
-	if len(lang) > maxLanguageLen || !languageRe.MatchString(lang) {
-		return "", fmt.Errorf("language must match ^[a-zA-Z0-9+#-]{1,40}$ (max %d chars)", maxLanguageLen)
-	}
-	return lang, nil
-}
-
-// truncateRunes cuts s to at most max runes, keeping the prefix intact.
-func truncateRunes(s string, max int) string {
-	runes := []rune(s)
-	if len(runes) <= max {
-		return s
-	}
-	return string(runes[:max])
-}

internal/store/store.go

@@ -62,6 +62,7 @@ type PasteRow struct {
 	Size          int
 	DeletionToken sql.NullString
 	ViewerID      sql.NullString
+	IsCan         bool // set on list rows that are cans (#4)
 }
 
 type CanRow struct {
@@ -72,6 +73,8 @@ type CanRow struct {
 	CreatedAt    int64
 	DeletedAt    sql.NullInt64
 	ExpiresAt    sql.NullInt64
+	Description  sql.NullString
+	ViewerID     sql.NullString
 }
 
 type Store struct {
@@ -132,6 +135,7 @@ deletion_token TEXT
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN viewer_id TEXT`)     // ignore if exists (#37)
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_limit INTEGER`)          // ignore if exists (#49)
 	s.db.Exec(`ALTER TABLE pastes ADD COLUMN reads_used INTEGER DEFAULT 0`) // ignore if exists (#49)
+	s.db.Exec(`ALTER TABLE paste_cans ADD COLUMN viewer_id TEXT`) // ignore if exists (#4)
 	s.db.Exec(`CREATE TABLE IF NOT EXISTS paste_views (
 		paste_id    TEXT NOT NULL,
 		viewer_id   TEXT NOT NULL,
@@ -272,9 +276,14 @@ func (s *Store) GetPaste(idOrSlug string) (*PasteRow, error) {
 // listed, and password-protected pastes are excluded at the query level
 // (#65) so their metadata (title, slug, existence) never leaks.
 func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content) FROM pastes
+	rows, err := s.db.Query(`SELECT id, custom_slug, content_type, language, title, visibility, created_at, view_count, LENGTH(content), 0
+		FROM pastes
 		WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), limit, offset)
+		UNION ALL
+		SELECT id, NULL, 'text/plain', NULL, title, visibility, created_at, 0, 0, 1
+		FROM paste_cans
+		WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, time.Now().Unix(), time.Now().Unix(), limit, offset)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -283,25 +292,33 @@ func (s *Store) ListPublic(limit, offset int) ([]PasteRow, int, error) {
 	for rows.Next() {
 		var r PasteRow
 		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
+		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &r.ContentType, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
 			return nil, 0, err
 		}
 		r.CustomSlug = cs
 		r.Language = lang
 		r.Title = title
+		r.IsCan = isCan == 1
 		out = append(out, r)
 	}
 	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?)`, time.Now().Unix()).Scan(&total)
+	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE visibility='public' AND deleted_at IS NULL AND can_id IS NULL AND password_hash IS NULL AND (expires_at IS NULL OR expires_at > ?))
+		+ (SELECT COUNT(*) FROM paste_cans WHERE visibility='public' AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
+		time.Now().Unix(), time.Now().Unix()).Scan(&total)
 	return out, total, nil
 }
 
 // ListMine lists pastes created from the given viewer id (browser cookie), newest first.
 func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, error) {
-	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content)
+	rows, err := s.db.Query(`SELECT id, custom_slug, language, title, visibility, created_at, view_count, LENGTH(content), 0
 		FROM pastes
 		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)
-		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), limit, offset)
+		UNION ALL
+		SELECT id, NULL, NULL, title, visibility, created_at, 0, 0, 1
+		FROM paste_cans
+		WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
+		ORDER BY created_at DESC LIMIT ? OFFSET ?`, viewerID, time.Now().Unix(), viewerID, time.Now().Unix(), limit, offset)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -310,16 +327,18 @@ func (s *Store) ListMine(viewerID string, limit, offset int) ([]PasteRow, int, e
 	for rows.Next() {
 		var r PasteRow
 		var cs, lang, title sql.NullString
-		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size); err != nil {
+		var isCan int
+		if err := rows.Scan(&r.ID, &cs, &lang, &title, &r.Visibility, &r.CreatedAt, &r.ViewCount, &r.Size, &isCan); err != nil {
 			return nil, 0, err
 		}
 		r.CustomSlug, r.Language, r.Title = cs, lang, title
+		r.IsCan = isCan == 1
 		out = append(out, r)
 	}
 	var total int
-	s.db.QueryRow(`SELECT COUNT(*) FROM pastes
+	s.db.QueryRow(`SELECT (SELECT COUNT(*) FROM pastes WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?))
-		WHERE viewer_id = ? AND deleted_at IS NULL AND can_id IS NULL AND (expires_at IS NULL OR expires_at > ?)`,
+		+ (SELECT COUNT(*) FROM paste_cans WHERE viewer_id = ? AND deleted_at IS NULL AND (expires_at IS NULL OR expires_at > ?))`,
-		viewerID, time.Now().Unix()).Scan(&total)
+		viewerID, time.Now().Unix(), viewerID, time.Now().Unix()).Scan(&total)
 	return out, total, nil
 }
 
@@ -352,14 +371,38 @@ func (s *Store) SoftDelete(id string) (bool, error) {
 	return n > 0, err
 }
 
-func (s *Store) IncrementViews(id string) {
+// IncrementViews counts one view. With a viewerID (#95): views are deduped
+// per-viewer within burnViewerWindow minutes using the paste_views table,
+// namespaced with a "views/" viewer prefix so these rows never collide with
+// RegisterRead's burn-after-read dedupe rows (which key on the raw viewer id).
+// Raw views always count (#49 decision) — call with viewerID="" for those.
+// Returns true when the view was counted.
+func (s *Store) IncrementViews(id, viewerID string, burnWindowMinutes int) bool {
+	if viewerID == "" {
+		s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
+		return true
+	}
+	now := TimeNow().Unix()
+	vkey := "views/" + viewerID
+	var last sql.NullInt64
+	s.db.QueryRow(`SELECT last_viewed FROM paste_views WHERE paste_id=? AND viewer_id=?`,
+		id, vkey).Scan(&last)
+	if last.Valid && now-last.Int64 < int64(burnWindowMinutes)*60 {
+		return false
+	}
+	s.db.Exec(`INSERT INTO paste_views (paste_id, viewer_id, last_viewed) VALUES (?,?,?)
+		ON CONFLICT(paste_id, viewer_id) DO UPDATE SET last_viewed = excluded.last_viewed`,
+		id, vkey, now)
 	s.db.Exec(`UPDATE pastes SET view_count = view_count + 1 WHERE id = ?`, id)
+	return true
 }
 
 // SweepExpired soft-deletes expired pastes and hard-deletes soft-deleted pastes past grace.
 func (s *Store) SweepExpired() {
 	now := time.Now().Unix()
 	s.db.Exec(`UPDATE pastes SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
+	// #4: cans expire too — mirror paste behavior
+	s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE expires_at IS NOT NULL AND expires_at < ? AND deleted_at IS NULL`, now, now)
 	grace := now - SoftDeleteGraceDays*86400
 	s.db.Exec(`DELETE FROM pastes WHERE deleted_at IS NOT NULL AND deleted_at < ?`, grace)
 }
@@ -416,13 +459,46 @@ func (s *Store) HardDelete(id string) {
 	s.db.Exec(`DELETE FROM pastes WHERE id = ?`, id)
 }
 
-// InsertCan creates a paste_can row.
+// CreateCan inserts a paste_can row with optional custom slug (parity with
-func (s *Store) InsertCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64) error {
+// pastes: validated by the same rules, checked against both tables).
+// Returns ErrSlugTaken / ErrInvalidSlug / ErrReservedSlug on conflict.
+func (s *Store) CreateCan(canID, title, description, visibility string, pwHash *string, createdAt int64, expiresAt *int64, customSlug *string) error {
+	if customSlug != nil && *customSlug != "" {
+		slug := *customSlug
+		if err := ValidateCustomSlug(slug); err != nil {
+			return err
+		}
+		taken, err := s.SlugTaken(slug)
+		if err != nil {
+			return err
+		}
+		if taken {
+			return ErrSlugTaken
+		}
+		canID = slug
+	}
+	if visibility == "" {
+		visibility = "public"
+	}
+	if visibility != "public" && visibility != "unlisted" {
+		return errors.New("visibility must be public or unlisted")
+	}
 	_, err := s.db.Exec(`INSERT INTO paste_cans (id, title, description, visibility, password_hash, created_at, expires_at)
 		VALUES (?,?,?,?,?,?,?)`, canID, title, description, visibility, pwHash, createdAt, expiresAt)
 	return err
 }
 
+// SoftDeleteCan marks a can deleted (its items stay; they are unlisted and
+// hidden from listings by can_id and disappear with the can's page).
+func (s *Store) SoftDeleteCan(canID string) (bool, error) {
+	res, err := s.db.Exec(`UPDATE paste_cans SET deleted_at=? WHERE id=? AND deleted_at IS NULL`, time.Now().Unix(), canID)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
+}
+
 // DeleteCan removes an (empty/aborted) can row.
 func (s *Store) DeleteCan(canID string) {
 	s.db.Exec(`DELETE FROM paste_cans WHERE id=?`, canID)
@@ -441,10 +517,10 @@ func (s *Store) InsertCanItem(canID, title, content, contentType string, languag
 }
 
 func (s *Store) GetCan(id string) (*CanRow, error) {
-	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at
+	row := s.db.QueryRow(`SELECT id, title, visibility, password_hash, created_at, deleted_at, expires_at, description, viewer_id
-		FROM paste_cans WHERE id = ? AND deleted_at IS NULL`, id)
+		FROM paste_cans WHERE (id = ?) AND deleted_at IS NULL`, id)
 	var c CanRow
-	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt)
+	err := row.Scan(&c.ID, &c.Title, &c.Visibility, &c.PasswordHash, &c.CreatedAt, &c.DeletedAt, &c.ExpiresAt, &c.Description, &c.ViewerID)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}

internal/web/securityheaders_test.go

@@ -1,46 +0,0 @@
-package web
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// #59: SecurityHeaders must add the CSP and hardening headers to rendered
-// HTML responses only; JSON and /raw responses pass through untouched.
-func TestSecurityHeaders(t *testing.T) {
-	pages := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte("<html><body>ok</body></html>"))
-	})
-	h := SecurityHeaders(pages)
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
-	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
-	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
-		t.Errorf("CSP = %q, want %q", got, wantCSP)
-	}
-	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
-		t.Errorf("Referrer-Policy = %q, want no-referrer", got)
-	}
-	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
-		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
-	}
-
-	// JSON/raw responses: headers are now set unconditionally BEFORE the handler
-	// runs. The previous post-handler approach was silently dropped once a page
-	// handler flushed its template output (headers must be set before WriteHeader).
-	// CSP/nosniff/referrer on non-HTML bodies is harmless and desirable.
-	jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.Write([]byte(`{"ok":true}`))
-	}))
-	rec = httptest.NewRecorder()
-	jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
-	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
-		t.Errorf("CSP missing on JSON response: got %q", got)
-	}
-	if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
-		t.Errorf("Referrer-Policy missing on JSON response: got %q", got)
-	}
-}

internal/web/static/app.css

@@ -165,6 +165,20 @@ body {
 .settings-head { padding: 12px 18px; border-bottom: 1px solid var(--border); }
 .settings-head h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
 .settings-body { padding: 16px 18px; color: var(--muted-fg); font-size: 21.6px; }
+.settings-section-title { color: var(--fg); font-size: 24px; margin-bottom: 6px; }
+/* theme switcher cards (#100) */
+.theme-grid { display: flex; flex-wrap: wrap; gap: 14px; margin-top: 14px; }
+.theme-card {
+  display: flex; flex-direction: column; gap: 10px; align-items: flex-start;
+  padding: 14px 16px; min-width: 180px;
+  background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius);
+  color: var(--fg); font: inherit; font-size: 20px; cursor: pointer;
+}
+.theme-card:hover { border-color: var(--muted); }
+.theme-card[aria-pressed="true"] { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
+.theme-card .swatches { display: flex; gap: 4px; }
+.theme-card .swatch { width: 26px; height: 26px; border-radius: 6px; border: 1px solid rgba(255,255,255,.15); }
+.theme-name { font-weight: 600; }
 .iconbtn:hover { color: var(--fg); border-color: var(--muted); }
 .iconbtn.danger:hover { color: #ff8fa3; border-color: #ff8fa3; }
 .code-head {
@@ -201,6 +215,10 @@ th {
   text-align: left; font-size: 18.9px; text-transform: uppercase; letter-spacing: .08em;
   color: var(--muted-fg); padding: 10px 16px; border-bottom: 1px solid var(--border); font-weight: 600;
 }
+/* #92: the sort-ind span is absolutely positioned in the cell's right gutter,
+   so it can't shift the header label right of the data cells. */
+th.sortable { cursor: pointer; user-select: none; position: relative; padding-right: 34px; }
+th.sortable .sort-ind { position: absolute; right: 12px; top: 50%; transform: translateY(-50%); margin-left: 0; }
 td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 tr:last-child td { border-bottom: none; }
 tr.row { cursor: pointer; }
@@ -456,3 +474,16 @@ th.sorted.desc .sort-ind { border-top: 6px solid var(--accent); }
   .unlock-err { font-size: 13px; }
   .center .foot { font-size: 13px; }
 }
+
+/* #4: can view page + can builder */
+.can-page h1 { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.can-items { display: flex; flex-direction: column; gap: 12px; margin-top: 14px; }
+.can-item { padding: 12px 14px; }
+.can-item-head { display: flex; align-items: center; gap: 10px; }
+.can-item-head strong { flex: 1; word-break: break-all; }
+.can-item-body { margin-top: 8px; }
+.can-item-body summary { cursor: pointer; font-size: 19px; color: var(--muted, #888); }
+.can-item-body pre.code { margin: 8px 0 0; overflow-x: auto; }
+.can-item-row { margin-top: 8px; }
+.can-item-row .can-item-title { width: 100%; margin-bottom: 6px; }
+.can-item-row .can-item-content { width: 100%; font-family: var(--mono, monospace); resize: vertical; }

internal/web/static/table.js

@@ -63,7 +63,7 @@ const PaletteTable = (() => {
         const filtered = state.filter.length > 0;
         const off = (state.page - 1) * opts.perPage;
         const url = (filtered || state.sortKey)
-          ? opts.endpoint + '?limit=' + (opts.fetchLimit || 100) + '&offset=0'
+          ? opts.endpoint + '?limit=500&offset=0'
           : opts.endpoint + '?limit=' + opts.perPage + '&offset=' + off;
         const res = await fetch(url);
         const data = await res.json();

internal/web/templates/can.html

@@ -0,0 +1,36 @@
+{{template "head" .}}
+{{template "topbar" .}}
+<div class="center">
+  <div class="float can-page" style="max-width:900px; width:100%;">
+    <div class="inner">
+      <h1>{{.Title}} <span class="badge" title="This is a can — a bundle of pastes">can</span></h1>
+      {{if .HasDescription}}<p class="sub">{{.Description}}</p>{{end}}
+      <p class="hint">{{.ItemCount}} item{{if ne .ItemCount 1}}s{{end}} · {{.SizeHuman}} · created <span data-ts="{{.CreatedAtUnix}}">{{.CreatedAgo}}</span>{{if .ExpiresAt}} · expires in {{.ExpiresIn}}{{end}}{{if .HasPassword}} · password protected{{end}}</p>
+
+      <div class="can-items">
+        {{range .Items}}
+        <div class="can-item float">
+          <div class="can-item-head">
+            <strong>{{.Title}}</strong>
+            <span class="dim">{{.Size}}</span>
+            {{if .IsFile}}
+              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" download="{{.Title}}" title="Download file" aria-label="Download {{.Title}}">↓</a>
+            {{else}}
+              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" title="Raw item" aria-label="Raw {{.Title}}">⧉</a>
+            {{end}}
+          </div>
+          {{if not .IsFile}}
+          <details class="can-item-body">
+            <summary>Show content</summary>
+            <pre class="code"><code>{{.ContentHTML}}</code></pre>
+          </details>
+          {{else}}
+          <div class="hint">Attached file — use the download button above.</div>
+          {{end}}
+        </div>
+        {{end}}
+      </div>
+    </div>
+  </div>
+</div>
+{{template "foot" .}}

internal/web/templates/history.html

@@ -36,8 +36,8 @@ const t = PaletteTable.init({
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}`
+      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim">${it.view_count}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/mine.html

@@ -21,6 +21,10 @@
     </table>
     <div class="empty" id="empty" style="display:none">No pastes from this browser yet.</div>
   </div>
+  <div class="pager float">
+    <span id="showing"></span>
+    <div class="pg" id="pg"></div>
+  </div>
 </div>
 <script src="/static/table.js"></script>
 <script>
@@ -38,13 +42,13 @@ function toast(msg, kind) {
 
 const t = PaletteTable.init({
   endpoint: '/api/mine',
-  perPage: 50,
+  perPage: 25,
-  hasPager: false,
+  hasPager: true,
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `${t.esc(it.title)}`
+      ? `${t.esc(it.title)}${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
+      : `<a class="slug" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/templates/new.html

@@ -68,6 +68,15 @@
       <input type="text" id="custom" class="custom-input" placeholder="/my-snippet">
       <div class="hint" style="margin-top:6px; font-size:19px;">Stays reserved while the paste exists</div>
     </div>
+    <div class="float side-section">
+      <h3>Can contents</h3>
+      <label class="toggle"><input type="checkbox" id="iscan"> Bundle as a can (multiple text items)</label>
+      <div class="pw-row" id="canrow" style="display:none">
+        <div id="can-items"></div>
+        <button class="btn btn-icon" id="can-add" type="button" title="Add item" style="margin-top:6px">+ Add item</button>
+        <div class="hint" style="margin-top:6px; font-size:19px;">Each item gets its own card on the can page. File uploads in cans come later.</div>
+      </div>
+    </div>
     <div class="float side-section" id="result-card" style="display:none">
       <h3>Result</h3>
       <div class="hint" id="result" style="word-break:break-all">empty</div>
@@ -145,6 +154,21 @@ $('pwreveal').addEventListener('click', () => {
   $('pwreveal').title = show ? 'Hide password' : 'Show password';
 });
 
+// #4: can builder — multiple text items bundled into one shareable page.
+// The main editor becomes the first item; extra items are added below.
+$('iscan').addEventListener('change', e => {
+  $('canrow').style.display = e.target.checked ? 'block' : 'none';
+  if (e.target.checked && !$('can-items').children.length) addCanItem();
+});
+function addCanItem() {
+  const row = document.createElement('div');
+  row.className = 'can-item-row';
+  row.innerHTML = '<input class="can-item-title" placeholder="Item title">' +
+    '<textarea class="can-item-content" placeholder="Item content" rows="3" spellcheck="false"></textarea>';
+  $('can-items').appendChild(row);
+}
+$('can-add').addEventListener('click', addCanItem);
+
 let guessed = ''; // last auto-detected language, '' = user override
 
 function showResult(html, isError) {
@@ -197,6 +221,9 @@ $('reguess').addEventListener('click', guessLang);
 content.addEventListener('paste', () => setTimeout(guessLang, 0));
 
 async function create() {
+  // #4: can mode — bundle the editor + extra items into a can via multipart
+  if ($('iscan').checked) return createCan();
+
   const body = {
     content: content.value,
     title: $('title').value || null,
@@ -252,6 +279,62 @@ async function create() {
   location.href = dest;
 }
 $('create').addEventListener('click', create);
+
+// #4: can creation — POST multipart to /api/pastes/can. The main editor is
+// the first item; each extra can-item row is another text item.
+async function createCan() {
+  const items = [];
+  if (content.value.trim()) {
+    items.push({title: $('title').value || 'main', content: content.value, language: $('language').value || ''});
+  }
+  document.querySelectorAll('#can-items .can-item-row').forEach(row => {
+    const t = row.querySelector('.can-item-title').value.trim();
+    const c = row.querySelector('.can-item-content').value;
+    if (c.trim()) items.push({title: t || ('item-' + (items.length + 1)), content: c});
+  });
+  if (!items.length) { toast('Nothing to put in the can', 'error'); return; }
+
+  const fd = new FormData();
+  fd.append('title', $('title').value || 'Untitled can');
+  fd.append('json_items', JSON.stringify(items));
+  if ($('haspw').checked) fd.append('password', $('password').value);
+  if ($('unlisted').checked) fd.append('visibility', 'unlisted');
+  const exp = document.querySelector('input[name="exp"]:checked').value;
+  if (exp === 'custom') {
+    const dur = composeCustomExpiry();
+    if (dur === null) { toast('Check the custom expiry', 'error'); return; }
+    if (dur) fd.append('expires_in', dur);
+  } else if (exp) {
+    fd.append('expires_in', exp);
+  }
+  if ($('custom').value.trim()) fd.append('custom_slug', $('custom').value.trim());
+
+  const res = await fetch('/api/pastes/can', {method: 'POST', body: fd});
+  const data = await res.json();
+  if (!res.ok) {
+    showResult('Error: ' + (data.error || res.status), true);
+    toast('Can create failed', 'error');
+    return;
+  }
+  const url = location.origin + data.url;
+  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', false);
+  const copyBtn = document.getElementById('result-copy');
+  copyBtn.addEventListener('click', () => {
+    try {
+      navigator.clipboard.writeText(url);
+      copyBtn.classList.add('ok');
+      copyBtn.textContent = 'Success!';
+      setTimeout(() => { copyBtn.classList.remove('ok'); copyBtn.textContent = '⧉'; }, 2000);
+    } catch(e) { toast('Copy failed', 'error'); }
+  });
+  // password-protected can: unlock now with the password we already have (#26 parity)
+  if ($('haspw').checked && data.id) {
+    const pd = new FormData();
+    pd.append('password', $('password').value);
+    try { await fetch('/can/' + data.id, {method: 'POST', body: pd}); } catch(e) {}
+  }
+  location.href = data.url;
+}
 // reset stale result state when returning via Back (bfcache) (#28)
 window.addEventListener('pageshow', e => {
   if (!e.persisted) return;

internal/web/web.go

@@ -34,6 +34,7 @@ type UI struct {
 func New() (*UI, error) {
 	funcs := template.FuncMap{
 		"humanSize": humanSize,
+		"version":   func() string { return Version }, // #93: topbar version label
 	}
 	t, err := template.New("").Funcs(funcs).ParseFS(tmplFS, "templates/*.html")
 	if err != nil {
@@ -64,6 +65,29 @@ func (h *Handlers) renderPage(w http.ResponseWriter, name string, data any) {
 	}
 }
 
+// RenderPage is the exported wrapper used by the api package (#4 can pages).
+func (h *Handlers) RenderPage(w http.ResponseWriter, name string, data any) {
+	h.renderPage(w, name, data)
+}
+
+// WriteRateLimited is the exported rate-limit response used by the api package (#4).
+func (h *Handlers) WriteRateLimited(w http.ResponseWriter, retryAfterSecs int) {
+	h.writeRateLimited(w, retryAfterSecs)
+}
+
+// UnlockToken returns the per-id HMAC unlock token (cookie value, #34).
+// Exported for the api package so can pages share paste cookie semantics (#4).
+func UnlockToken(id string) string { return unlockToken(id) }
+
+// AgoString formats a relative "N ago" string (exported for the api package, #4).
+func AgoString(ts int64) string { return agoString(ts) }
+
+// HumanSize formats a byte count as a human string (exported for the api package, #4).
+func HumanSize(n int) string { return humanSize(n) }
+
+// ExpiryString formats remaining time until an epoch seconds expiry (#4).
+func ExpiryString(expiresAt int64) string { return expiryString(expiresAt) }
+
 // #34: per-paste unlock tokens. unlockSecret is generated once at startup
 // (also derivable from PALETTE_UNLOCK_SECRET for multi-instance deploys) and
 // used to HMAC paste ids, so a client can only hold a valid pw_<id> cookie by
@@ -245,12 +269,13 @@ func (h *Handlers) HandlePasteView(w http.ResponseWriter, r *http.Request) {
 		// one-time display of the deletion token via the created banner
 		http.SetCookie(w, &http.Cookie{Name: "tok_" + row.ID, Value: token, Path: "/", MaxAge: 60, HttpOnly: true, SameSite: http.SameSiteLaxMode})
 	}
-	// Count the view for every real page render. Raw views increment in
+	// Count the view for real page renders, deduped per-viewer within the
-	// handleRaw; the HTML path was missing its increment, so view_count only
+	// burn window (#95): a reload by the same vwr cookie doesn't inflate
-	// ever moved via /raw and the API-stored count stayed at 0 (#33).
+	// view_count. Raw views increment unconditionally in handleRaw (#49); the
-	// The just-created banner render does not count as a view.
+	// HTML path was missing its increment originally (#33). The just-created
+	// banner render does not count as a view.
 	if !justCreated {
-		h.Store.IncrementViews(row.ID)
+		h.Store.IncrementViews(row.ID, h.ViewerID(r), h.BurnWindowMin())
 	}
 	// #49: burn-after-N-reads budget (per-viewer dedupe window).
 	// Just-created first render does not count as a read for the creator.
@@ -279,7 +304,16 @@ func (h *Handlers) HandleHistoryPage(w http.ResponseWriter, r *http.Request) {
 
 // HandleSettingsPage serves /settings.
 func (h *Handlers) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
-	h.renderPage(w, "settings.html", map[string]any{"Page": "settings"})
+	// #100: theme presets. Midnight is the default (no data-preset attribute),
+	// so its swatches are hardcoded here; the CSS defines the token values.
+	themes := []map[string]any{
+		{"Name": "midnight", "Label": "Midnight", "Swatches": []string{"#241B30", "#2D2340", "#3A2D52", "#C4A8F0", "#F2EDF8"}},
+		{"Name": "smooth", "Label": "Smooth", "Swatches": []string{"#F6F5FA", "#FFFFFF", "#DAD7E6", "#7A7796", "#2A2A36"}},
+		{"Name": "pastel-lavender", "Label": "Pastel Lavender", "Swatches": []string{"#e6e0f5", "#f1edfa", "#cbb8e7", "#806bb8", "#3E3059"}},
+		{"Name": "pastel-peach", "Label": "Pastel Peach", "Swatches": []string{"#ffe0d6", "#fff0ea", "#ffc4a8", "#f9826c", "#4F2318"}},
+		{"Name": "pastel-cloud", "Label": "Pastel Cloud", "Swatches": []string{"#fff0f6", "#fff7fb", "#ffc8dd", "#a2d2ff", "#4A3355"}},
+	}
+	h.renderPage(w, "settings.html", map[string]any{"Page": "settings", "Themes": themes})
 }
 
 // HandleMinePage serves /mine.
@@ -294,25 +328,3 @@ func (h *Handlers) HandleAdminPage(w http.ResponseWriter, r *http.Request) {
 
 // Handlers builds a web.Handlers bound to this UI.
 func (u *UI) Handlers() *Handlers { return &Handlers{UI: u} }
-
-// #59: security headers for rendered HTML pages. Applied wherever the
-// response is text/html (page templates and the inline can page); JSON API
-// responses and /raw content pass through untouched. script-src allows
-// 'unsafe-inline' because the page templates carry inline scripts; CSP
-// default-src 'self' still blocks external content and object/frame embeds,
-// and frame-ancestors 'none' closes the clickjacking gap flagged in the #34
-// pentest. Runs after the handler so the Content-Type is already set.
-func SecurityHeaders(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Set before the handler runs: once a handler writes (template render
-		// flushes), header mutations are silently dropped. Setting the headers
-		// unconditionally is safe: CSP/nosniff/referrer on JSON or /raw bodies
-		// is harmless and arguably desirable.
-		h := w.Header()
-		h.Set("Content-Security-Policy",
-			"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
-		h.Set("Referrer-Policy", "no-referrer")
-		h.Set("X-Content-Type-Options", "nosniff")
-		next.ServeHTTP(w, r)
-	})
-}