fen
e54fbc36ef
Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was half-integrated and has zero prod usage; removing it eliminates four audit findings by deletion. Removed: - internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*, /can/{id}) plus handleCanPage/renderCan - is_can from /api/mine and /api/public responses - store layer: CanRow, can store funcs, paste_cans UNION in listings, cans sweep; reserved slugs 'can'/'cans' released - templates/can.html, can CSS, is_can badges in history.js/mine.js - cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go, TestErrorCodeCanValidation) - docs/api.md cans section, README/LICENSE/docker-compose mentions Store migration: drops paste_cans only when empty (non-empty table is kept and logged; prod verified clean 2026-10-16) and drops the dormant pastes.can_id column. Covered by new TestMigrateDropsCansSchema. Security hardening (audit findings): pw_<id> (unlock) and tok_<id> (deletion-token) cookies now carry Secure: true in addition to HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test now asserts Secure. go vet ./... and go test ./... pass.
41 lines
1.1 KiB
Go
41 lines
1.1 KiB
Go
package store
|
|
|
|
import (
|
|
"errors"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
var slugRE = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9-_]{0,63}$`)
|
|
|
|
// reserved words that would collide with routes
|
|
var reservedSlugs = map[string]bool{
|
|
"api": true, "raw": true, "public": true,
|
|
"history": true, "static": true, "assets": true, "favicon.ico": true,
|
|
"new": true, "login": true, "logout": true, "admin": true, "settings": true,
|
|
"mine": true, "saved": true, "unlock": true, "guess": true, "f": true,
|
|
}
|
|
|
|
var ErrInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")
|
|
var ErrReservedSlug = errors.New("that slug is reserved")
|
|
var ErrSlugTaken = errors.New("that slug is already taken")
|
|
|
|
func ValidateCustomSlug(slug string) error {
|
|
if !slugRE.MatchString(slug) {
|
|
return ErrInvalidSlug
|
|
}
|
|
if reservedSlugs[strings.ToLower(slug)] {
|
|
return ErrReservedSlug
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) SlugTaken(slug string) (bool, error) {
|
|
var n int
|
|
err := s.db.QueryRow(`SELECT COUNT(*) FROM pastes WHERE custom_slug = ? OR id = ?`, slug, slug).Scan(&n)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
return n > 0, nil
|
|
}
|