The pastes API already clamped expires_in (1min-1yr via store.ValidExpiry, from sweep #33), but the cans API (POST /api/pastes/can) parsed the duration and accepted anything - including 0s, negatives (born-expired cans), and 87600h (10 years, the case reported on #60).
This PR applies the same store.ValidExpiry clamp to the cans create handler: zero/negative and out-of-window durations now return 400 expires_in must be between 1 minute and 1 year.
## What
The pastes API already clamped `expires_in` (1min-1yr via `store.ValidExpiry`, from sweep #33), but the **cans API** (`POST /api/pastes/can`) parsed the duration and accepted anything - including `0s`, negatives (born-expired cans), and `87600h` (10 years, the case reported on #60).
This PR applies the same `store.ValidExpiry` clamp to the cans create handler: zero/negative and out-of-window durations now return `400 expires_in must be between 1 minute and 1 year`.
## Tests
`TestCreateCanExpiryBounds` covers the boundary cases: `-1h`, `-0s`, `0s`, `1ns`, `59s` -> 400; `1m`, `90s`, `8760h` -> 201; `8785h`, `87600h` -> 400.
Closes #60
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
The pastes API already clamped
expires_in(1min-1yr viastore.ValidExpiry, from sweep #33), but the cans API (POST /api/pastes/can) parsed the duration and accepted anything - including0s, negatives (born-expired cans), and87600h(10 years, the case reported on #60).This PR applies the same
store.ValidExpiryclamp to the cans create handler: zero/negative and out-of-window durations now return400 expires_in must be between 1 minute and 1 year.Tests
TestCreateCanExpiryBoundscovers the boundary cases:-1h,-0s,0s,1ns,59s-> 400;1m,90s,8760h-> 201;8785h,87600h-> 400.Closes #60