# Pasty

> Pasty (pasty.youlidao.ai) is a no-login share board. Post text, a file, or (with a token) an HTML page; get a 6-character share code; anyone with the code can read it until it expires, then it is deleted. There is no edit, delete, or search, and no public listing. A separate, more tightly held token can also publish a page that never expires at a URL of the creator's choosing — see "Permanent pages" below; that one feature does have a private listing, visible only to whoever holds its token.

Share codes use the 31-character alphabet `23456789ABCDEFGHJKMNPQRSTUVWXYZ` (no 0/O/1/I/L) and are case-insensitive. Expiry options: 5m, 30m, 1h, 1d, 7d (default 1d). Anyone holding a code or link can read the content: never post secrets, credentials, keys, .env files or personal data.

## Which feature to use

- Send text (notes, logs, code): `POST /api/pastes` with JSON. Up to 50,000 characters.
- Send a file (PDF, image, zip, docx…), optionally with a note: `POST /api/pastes` as multipart. Up to 100MB, one file; zip several files first.
- Give a person a web page that opens in the browser (a report, dashboard, prototype you generated): `POST /api/pages` with a bearer token. Up to 5MB, one self-contained HTML document. Without a token, upload the .html as a file instead — it will be a download, not a page.
- Host a page that should never expire, at a URL the operator chooses (an about page, a tool, long-lived docs): `POST /api/pp` with a separate bearer token and a slug. Not for ad hoc sharing — use `/api/pages` for anything that should eventually disappear.

## Text and files (no auth)

```bash
# Text
curl -s -X POST https://pasty.youlidao.ai/api/pastes -H 'Content-Type: application/json' \
  -d '{"content":"hello","expiresIn":"1h"}'
# → {"code":"7FZEN4","expiresAt":"2026-09-09T16:56:23.246Z"}

# File (+ optional note)
curl -s -X POST https://pasty.youlidao.ai/api/pastes -F "file=@report.pdf" -F "content=Q3 report" -F "expiresIn=1d"
# → {"code":"KTCK33","expiresAt":"…","hasFile":true}
```

- JSON request bodies are capped at 100KB before the character check; for long non-ASCII text use the multipart `content` field.
- The server decides a file's MIME type from its bytes, then the declared type, then the extension.
- Rate limits per IP: text 10/min, files 5/min (separate counters). 429 responses carry `ratelimit-reset` (seconds).

### Reading

- `GET /api/pastes/{code}` → `{ content, type: "text"|"file"|"mixed"|"page", fileMetadata?, createdAt, expiresAt }`
- `GET /api/pastes/{code}/file` → the file bytes. Images and PDF are `inline`; everything else, including HTML, is `attachment`.
- Human view: `https://pasty.youlidao.ai/{code}`. There is no `/raw` endpoint; `GET /{code}` returns the web app's HTML.

## HTML pages (token required)

Host one HTML document and get a URL a person can open: `https://pasty.youlidao.ai/p/{code}`.

```bash
# multipart (preferred for large pages)
curl -s -X POST https://pasty.youlidao.ai/api/pages \
  -H "Authorization: Bearer $PASTY_PAGE_TOKEN" \
  -F "file=@report.html" -F "expiresIn=7d"
# → {"code":"MN3W2R","expiresAt":"…","url":"https://pasty.youlidao.ai/p/MN3W2R"}

# JSON
jq -n --rawfile h report.html '{html:$h, expiresIn:"1d"}' \
  | curl -s -X POST https://pasty.youlidao.ai/api/pages -H "Authorization: Bearer $PASTY_PAGE_TOKEN" \
      -H 'Content-Type: application/json' --data @-
```

- Auth: `Authorization: Bearer <token>`. Missing or wrong token → 401 `PAGE_AUTH_REQUIRED`. If the server has no tokens configured the feature is off → 501 `PAGE_HOSTING_DISABLED`. Keep the token in an environment variable; never put it in the page, a log or a reply.
- Limits: HTML ≤ 5MB (413 `PAGE_TOO_LARGE`); JSON body ≤ 10MB; 10 creations/min per IP.
- Reply to the user with the returned `url`, the expiry, and the fact that anyone with the link can view it.
- `https://pasty.youlidao.ai/{code}` shows a card linking to the page; `/p/{code}` for a code that is missing, expired, or not a page redirects (302) to `/{code}`.

### Export a page to PDF

`GET https://pasty.youlidao.ai/p/{code}/pdf` returns the page as an A4 PDF (`inline`, with a file name). The server renders `/p/{code}` in Chromium under the same sandbox, light mode, backgrounds kept; the first export takes a few seconds, later ones are cached until the page expires. Every hosted page also shows a floating Export PDF button that links here. 10 exports/min per IP; a failed render → 503 `PDF_EXPORT_UNAVAILABLE` (retry). No token needed — anyone who can view the page can export it.

### How a hosted page runs

The page is served with a sandbox CSP and no `allow-same-origin`, so it runs in an opaque origin.

- Allowed: inline scripts and styles; scripts/styles/fonts from https://cdnjs.cloudflare.com, https://cdn.jsdelivr.net, https://unpkg.com, https://cdn.tailwindcss.com; styles/fonts from https://fonts.googleapis.com, https://fonts.gstatic.com; images and media from https:, data:, blob:; pop-ups and links opening in a new tab.
- Blocked: fetch/XHR/WebSocket (`connect-src 'none'`), form submission (`form-action 'none'`), iframes and objects, localStorage and cookies (accessing them throws).

### Checklist for writing a page

1. One self-contained file: inline CSS/JS, images as data: URIs or https URLs, libraries only from the CDNs above with a pinned version.
2. Put the data in the page; do not fetch it.
3. Do not rely on localStorage; wrap any use in try/catch.
4. Include `<meta charset="utf-8">` and a viewport meta. Google Fonts is unreliable from mainland China — always declare system font fallbacks.
5. Default expiry 1d; 7d for a report meant for people.

## Permanent pages ("pp"; token required)

Unlike `/api/pages`, a pp never expires and renders at a slug the creator chooses: `https://pasty.youlidao.ai/{slug}`, not under `/p/`.

```bash
curl -s -X POST https://pasty.youlidao.ai/api/pp \
  -H "Authorization: Bearer $PASTY_PP_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"slug":"abacus","html":"<!doctype html>…"}'
# → {"slug":"abacus","url":"https://pasty.youlidao.ai/abacus"}
```

- Auth: `Authorization: Bearer <token>`, a token separate from the `/api/pages` one (`PP_API_TOKENS`, not `PAGE_API_TOKENS`) — a pp can't be revoked by waiting out a TTL, so this token is kept tighter and rotated on its own. Missing or wrong → 401 `PP_AUTH_REQUIRED`; no tokens configured → 501 `PP_HOSTING_DISABLED`.
- Slug: 3-32 lowercase letters, digits or hyphens; first and last character alphanumeric; no consecutive hyphens; not a reserved path (p, pp, api, admin, guide, assets, fonts, en, ja, ko). Bad shape → 400 `PP_SLUG_INVALID`; already in use → 409 `PP_SLUG_TAKEN`.
- Same HTML size limit, same sandbox CSP and the same checklist above as `/api/pages` — this is the same kind of document, just permanent and at a chosen path. 10 creations/min per IP.
- No edit, no delete, no PDF export. The full list of every pp (there is no public listing) is at `https://pasty.youlidao.ai/admin/pp`, gated by HTTP Basic auth using the same token as the password — for the operator only, not for agents acting on someone else's behalf.
- Reply to the user with the returned `url` and the fact that, unlike every other feature here, this content does not expire.

## Errors

Every error body is `{ "error": "<English prose>", "code": "<CODE>" }`. Branch on `code`; the prose may change.

- `400` `CONTENT_EMPTY`
- `400` `INVALID_EXPIRY`
- `400` `INVALID_CODE_FORMAT`
- `400` `NO_CONTENT_PROVIDED`
- `400` `FILENAME_TOO_LONG`
- `400` `FILENAME_INVALID`
- `400` `VALIDATION_ERROR`
- `400` `PP_SLUG_INVALID`
- `401` `PAGE_AUTH_REQUIRED`
- `401` `PP_AUTH_REQUIRED`
- `404` `PASTE_NOT_FOUND`
- `404` `NO_FILE_IN_PASTE`
- `404` `FILE_NOT_FOUND`
- `413` `CONTENT_TOO_LARGE`
- `413` `FILE_TOO_LARGE`
- `413` `PAGE_TOO_LARGE`
- `409` `PP_SLUG_TAKEN`
- `429` `RATE_LIMITED`
- `429` `FILE_RATE_LIMITED`
- `501` `FILE_UPLOAD_DISABLED`
- `501` `PAGE_HOSTING_DISABLED`
- `501` `PP_HOSTING_DISABLED`
- `503` `SERVICE_UNAVAILABLE`
- `503` `SERVICE_BUSY`
- `503` `STORAGE_UNAVAILABLE`
- `503` `FILE_UPLOAD_FAILED`
- `503` `PDF_EXPORT_UNAVAILABLE`
- `500` `INTERNAL`

## Docs

- [Guide (中文)](https://pasty.youlidao.ai/guide): full usage guide with web, CLI and API sections
- [Guide (English)](https://pasty.youlidao.ai/guide/en)
- [Guide (日本語)](https://pasty.youlidao.ai/guide/ja)
- [Guide (한국어)](https://pasty.youlidao.ai/guide/ko)