fen
e54fbc36ef
Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was half-integrated and has zero prod usage; removing it eliminates four audit findings by deletion. Removed: - internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*, /can/{id}) plus handleCanPage/renderCan - is_can from /api/mine and /api/public responses - store layer: CanRow, can store funcs, paste_cans UNION in listings, cans sweep; reserved slugs 'can'/'cans' released - templates/can.html, can CSS, is_can badges in history.js/mine.js - cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go, TestErrorCodeCanValidation) - docs/api.md cans section, README/LICENSE/docker-compose mentions Store migration: drops paste_cans only when empty (non-empty table is kept and logged; prod verified clean 2026-10-16) and drops the dormant pastes.can_id column. Covered by new TestMigrateDropsCansSchema. Security hardening (audit findings): pw_<id> (unlock) and tok_<id> (deletion-token) cookies now carry Secure: true in addition to HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test now asserts Secure. go vet ./... and go test ./... pass.
109 lines
3.0 KiB
Go
109 lines
3.0 KiB
Go
package api
|
|
|
|
// #143: create responses must set the short-lived tok_<id> HttpOnly+Secure
|
|
// cookie that the paste view reads for the one-time created banner.
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestCreateSetsDeletionTokenCookie(t *testing.T) {
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
|
|
// JSON create
|
|
body := `{"content":"hello #143 cookie"}`
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 201 {
|
|
t.Fatalf("json create: got %d", rec.Code)
|
|
}
|
|
found := false
|
|
for _, c := range rec.Result().Cookies() {
|
|
if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
|
|
found = true
|
|
if !c.HttpOnly {
|
|
t.Error("tok_ cookie not HttpOnly")
|
|
}
|
|
if !c.Secure {
|
|
t.Error("tok_ cookie not Secure")
|
|
}
|
|
if c.MaxAge != 60 {
|
|
t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge)
|
|
}
|
|
}
|
|
}
|
|
if !found {
|
|
t.Error("json create did not set tok_<id> cookie (#143)")
|
|
}
|
|
|
|
// multipart create
|
|
var buf strings.Builder
|
|
boundary := "----qa143"
|
|
buf.WriteString("--" + boundary + "\r\n")
|
|
buf.WriteString("Content-Disposition: form-data; name=\"content\"\r\n\r\n")
|
|
buf.WriteString("multipart #143\r\n")
|
|
buf.WriteString("--" + boundary + "--\r\n")
|
|
req2 := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(buf.String()))
|
|
req2.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary)
|
|
rec2 := httptest.NewRecorder()
|
|
h.ServeHTTP(rec2, req2)
|
|
if rec2.Code != 201 {
|
|
t.Fatalf("multipart create: got %d body=%s", rec2.Code, rec2.Body.String())
|
|
}
|
|
found = false
|
|
for _, c := range rec2.Result().Cookies() {
|
|
if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Error("multipart create did not set tok_<id> cookie (#143)")
|
|
}
|
|
}
|
|
|
|
func TestCreatedBannerViaCookie(t *testing.T) {
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
body := `{"content":"banner flow #143"}`
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 201 {
|
|
t.Fatalf("create: got %d", rec.Code)
|
|
}
|
|
var id, tok string
|
|
for _, c := range rec.Result().Cookies() {
|
|
if strings.HasPrefix(c.Name, "tok_") {
|
|
id = strings.TrimPrefix(c.Name, "tok_")
|
|
tok = c.Value
|
|
}
|
|
}
|
|
if id == "" || tok == "" {
|
|
t.Fatal("no tok_ cookie from create")
|
|
}
|
|
// follow the redirect the browser would make: GET /<id>?created=1 with the cookie
|
|
req2 := httptest.NewRequest("GET", "/"+id+"?created=1", nil)
|
|
req2.AddCookie(&http.Cookie{Name: "tok_" + id, Value: tok})
|
|
rec2 := httptest.NewRecorder()
|
|
h.ServeHTTP(rec2, req2)
|
|
if rec2.Code != 200 {
|
|
t.Fatalf("paste view: got %d", rec2.Code)
|
|
}
|
|
// #168: the created pill no longer prints the deletion token; the token
|
|
// still arrives via the one-time cookie flow (re-set on the view response).
|
|
var got bool
|
|
for _, c := range rec2.Result().Cookies() {
|
|
if c.Name == "tok_"+id && c.Value == tok {
|
|
got = true
|
|
}
|
|
}
|
|
if !got {
|
|
t.Error("created view did not re-set the deletion token cookie (#143 cookie flow broken)")
|
|
}
|
|
}
|