Spacebin v1.1.0 - Reader mode, accounts system

[lukewhrit]

Spacebin v1.1.0 will include:

• Reader mode for Markdown documents
• Account system to update or delete pastes

Originally, we planned to include a QR code generator in this release but it was decided that this was out of scope of the project and we do not plan to include it.

Additionally, we wanted to include a feature to create password-protected pastes but this was pushed to Spacebin v1.2.0, to get this release out sooner.

Spacebin v1.1.0 will also include fixes for the following bugs:

• bug: Can't create document via curl #443

Track progress here (✅ are also completed features). If you notice anything you'd like to help with, please do! I would deeply appreciate any help in implementing these features!

[codecov]

Codecov Report

❌ Patch coverage is 76.15894% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.56%. Comparing base (6786184) to head (7f929ef).

Files with missing lines	Patch %	Lines
internal/server/fetch.go	53.48%	15 Missing and 5 partials ⚠️
internal/util/helpers.go	82.22%	16 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #453       +/-   ##
===========================================
+ Coverage   49.88%   81.56%   +31.68%     
===========================================
  Files           9        9               
  Lines         425      537      +112     
===========================================
+ Hits          212      438      +226     
+ Misses        188       82      -106     
+ Partials       25       17        -8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lukewhrit]

Accounts to-do list:

• Add username and password validation rules (client-side and server-side)
• Ratelimiting
• Render authentication errors
• Expire old sessions, by adding created_at and updated_at timestamps to each session
• Associate post with a user when logged in
• List all posts that a user owns, as well as delete buttons (and eventually edit + password protect buttons)

In general, to fix this kind of issue you must ensure that any cookie involved in session or authentication handling sets Secure: true so that it is only transmitted over HTTPS. This applies both when creating the session cookie and when clearing/deleting it.

In this file, buildSessionCookie already sets Secure based on the request and configuration. The problem is clearSessionCookie, which constructs a new http.Cookie without the Secure field, so it defaults to false. The best fix, without changing existing functionality, is to add Secure: true to the cookie literal in clearSessionCookie. This ensures that the deletion cookie is sent only over secure connections, matching the expectations for a session cookie. No new imports or helpers are required, and no other lines need to change.

Concretely:

• In internal/server/authentication.go, in the clearSessionCookie(w http.ResponseWriter) function (lines 438–447), update the cookie literal passed to http.SetCookie to include Secure: true, along with the existing fields.