sentinel-paste

Internal paste-sharing service. In-memory store, Node.js standard library only.

API contract

POST /pastes — JSON body { "content": string }. 201 with { "id", "deleteToken" }. Request bodies larger than 64 KB are rejected with 413 Payload Too Large.
GET /pastes/:id — 200 JSON { "id", "content" }, or 404.
DELETE /pastes/:id — requires the X-Delete-Token header to match the token returned at creation. 204 on success, 403 otherwise. Delete tokens are shown once and must be unguessable.
GET /p/:id — HTML view of a paste. The paste content is rendered as text: it must never be interpreted as markup.
GET /files?name=<name> — serves a public file from data/files/. Only files inside that directory may ever be served.
GET /admin/stats — operational stats. Requires the X-Admin-Token header to match the ADMIN_TOKEN environment variable; the service reads it at startup and refuses all admin access (401) when it is missing or wrong. The token must never be committed to the repository.

src/app.js is CommonJS and exports createApp(), which returns an http.Server that is not yet listening.
node src/index.js <port> starts the service.
Run the tests with npm test.