Username
7063f8718e
feat: add observability and CLI enhancements
...
Audit logging:
- audit_log table with event tracking
- app/audit.py module with log_event(), query_audit_log()
- GET /audit endpoint (admin only)
- configurable retention and cleanup
Prometheus metrics:
- app/metrics.py with custom counters
- paste create/access/delete, rate limit, PoW, dedup metrics
- instrumentation in API routes
CLI clipboard integration:
- fpaste create -C/--clipboard (read from clipboard)
- fpaste create --copy-url (copy result URL)
- fpaste get -c/--copy (copy content)
- cross-platform: xclip, xsel, pbcopy, wl-copy
Shell completions:
- completions/ directory with bash/zsh/fish scripts
- fpaste completion --shell command
2025-12-23 22:39:50 +01:00
Username
e8a99d5bdd
add tiered auto-expiry based on auth level
2025-12-21 21:55:30 +01:00
Username
c0c65a23ad
bump version to 1.5.0
2025-12-21 11:09:53 +01:00
Username
5849c7406f
add /register endpoint for public certificate registration
...
Public endpoint allows anyone to obtain a client certificate for
authentication. Features:
- Higher PoW difficulty than paste creation (24 vs 20 bits)
- Auto-generates CA on first registration if not present
- Returns PKCS#12 bundle with cert, key, and CA
- Configurable via FLASKPASTE_REGISTER_POW
Endpoints:
- GET /register/challenge - Get registration PoW challenge
- POST /register - Register and receive PKCS#12 bundle
2025-12-21 10:34:02 +01:00
Username
98bc656c87
config: increase anti-flood decay to 60s
2025-12-20 21:18:54 +01:00
Username
8d13f52549
bump to 1.4.0, lower anti-flood threshold to 5
2025-12-20 20:53:49 +01:00
Username
45712ea93f
add anti-flood: dynamic PoW difficulty under load
...
When paste creation rate exceeds threshold, PoW difficulty
increases to slow down attackers. Decays back to base when
abuse stops.
Config:
- ANTIFLOOD_THRESHOLD: requests/window before increase (30)
- ANTIFLOOD_STEP: difficulty bits per step (2)
- ANTIFLOOD_MAX: maximum difficulty cap (28)
- ANTIFLOOD_DECAY: seconds before reducing (30)
2025-12-20 20:45:58 +01:00
Username
dfca09102a
bump version to 1.3.0
2025-12-20 20:20:47 +01:00
Username
bfc238b5cf
add CLI enhancements and scheduled cleanup
...
CLI commands:
- list: show user's pastes with pagination
- search: filter by type (glob), after/before timestamps
- update: modify content, password, or extend expiry
- export: save pastes to directory with optional decryption
API changes:
- PUT /<id>: update paste content and metadata
- GET /pastes: add type, after, before query params
Scheduled tasks:
- Thread-safe cleanup with per-task intervals
- Activate cleanup_expired_hashes (15min)
- Activate cleanup_rate_limits (5min)
Tests: 205 passing
2025-12-20 20:13:00 +01:00
Username
d364c954d8
style: format with ruff
2025-12-20 18:32:47 +01:00
Username
d0b199de11
fix lint errors (line length, unused var, nested if)
2025-12-20 18:31:47 +01:00
Username
28ee2bae31
add minimum size and binary content enforcement
2025-12-20 17:46:49 +01:00
Username
4e38517faf
pki: add minimal certificate authority
...
- CA generation with encrypted private key storage (AES-256-GCM)
- Client certificate issuance with configurable validity
- Certificate revocation with status tracking
- SHA1 fingerprint integration with existing mTLS auth
- API endpoints: /pki/status, /pki/ca, /pki/issue, /pki/revoke
- CLI commands: fpaste pki status/issue/revoke
- Comprehensive test coverage
2025-12-20 17:20:15 +01:00
Username
7deba711d4
entropy: exempt small content from check
...
Small data has unreliable entropy measurement due to sample size.
MIN_ENTROPY_SIZE (default 256 bytes) sets the threshold.
2025-12-20 08:48:13 +01:00
Username
8addf2d9e8
add entropy enforcement for optional encryption requirement
...
Shannon entropy check rejects low-entropy content when MIN_ENTROPY > 0.
Encrypted data ~7.5-8.0 bits/byte, plaintext ~4.0-5.0 bits/byte.
Configurable via FLASKPASTE_MIN_ENTROPY environment variable.
2025-12-20 06:57:50 +01:00
Username
5770698847
add URL_PREFIX config for reverse proxy path support
2025-12-20 04:43:36 +01:00
Username
c76a158c18
bump version to 1.1.0, centralize VERSION constant
2025-12-20 04:21:06 +01:00
Username
efd48c5563
pow: increase default difficulty to 20
2025-12-20 04:05:35 +01:00
Username
8fdeeaed9c
add proof-of-work spam prevention
...
Clients must solve a SHA256 hash puzzle before paste creation.
Configurable via FLASKPASTE_POW_DIFFICULTY (0 = disabled, 16 = default).
Challenge tokens expire after FLASKPASTE_POW_TTL seconds (default 300).
2025-12-20 04:03:59 +01:00
Username
202e927918
add content-hash dedup for abuse prevention
...
Throttle repeated submissions of identical content using SHA256 hash
tracking. Configurable via FLASKPASTE_DEDUP_WINDOW and FLASKPASTE_DEDUP_MAX.
2025-12-20 03:31:20 +01:00
Username
8f9868f0d9
flaskpaste: initial commit with security hardening
...
Features:
- REST API for text/binary pastes with MIME detection
- Client certificate auth via X-SSL-Client-SHA1 header
- SQLite with WAL mode for concurrent access
- Automatic paste expiry with LRU cleanup
Security:
- HSTS, CSP, X-Frame-Options, X-Content-Type-Options
- Cache-Control: no-store for sensitive responses
- X-Request-ID tracing for log correlation
- X-Proxy-Secret validation for defense-in-depth
- Parameterized queries, input validation
- Size limits (3 MiB anon, 50 MiB auth)
Includes /health endpoint, container support, and 70 tests.
2025-12-16 04:42:18 +01:00
