get_pow_secret() generated a random secret per process, so challenges
signed by worker A failed verification on worker B (~90% failure rate
with 2 workers). Persist a file-backed secret to data/.pow_secret
using O_EXCL for atomic creation. FLASKPASTE_POW_SECRET env var
still takes priority when configured.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Public endpoint allows anyone to obtain a client certificate for
authentication. Features:
- Higher PoW difficulty than paste creation (24 vs 20 bits)
- Auto-generates CA on first registration if not present
- Returns PKCS#12 bundle with cert, key, and CA
- Configurable via FLASKPASTE_REGISTER_POW
Endpoints:
- GET /register/challenge - Get registration PoW challenge
- POST /register - Register and receive PKCS#12 bundle
