poslop 91568c0598 fix #63: require deletion token on DELETE /api/pastes/{id} ...

- DELETE now demands the create-time deletion token (Authorization
  header: Bearer/Token/bare, or ?token= query param), compared with
  the constant-time store.DeletionTokenEqual. 403 otherwise.
- Creator-browser deletes via the /mine button (matching vwr cookie,
  #37) remain allowed; other browsers and plain API clients get 403.
- Regression tests: no token, wrong token (header+query), correct
  token (header+query), creator-cookie path, token extraction.
- Adapted TestSoftDelete to pass the deletion token.
- docs/API.md delete section updated.
- Based on #58's SoftDelete (bool, error) signature.

2026-09-09 09:21:28 -05:00

..

palette-previews

Palettes: pastel-lavender/peach/cloud presets + semantic status colors (#16)

2026-09-08 21:56:36 -05:00

API.md

fix #63: require deletion token on DELETE /api/pastes/{id}

2026-09-09 09:21:28 -05:00