Simple Pastebin

Project roadmap

1. 01

   Plan the pages and data

   ~1h

   Create a Laravel project. Write README.md describing the pages (a form to create a paste, the paste page, the raw view and a list of recent public pastes) and the data: a paste has a random public id, the content, an optional title, a language for display, visibility, an expiry time and a hashed delete token. Done when: the app runs, and README.md describes the pages and data.

2. 02

   Create the model

   ~1h

   Create a Paste model and migration with the fields above and an index on the expiry time. Generate public ids with Str::random (for example 10 characters) so they can't be guessed, retrying on the rare collision. Done when: pastes can be created in Tinker with random ids.

3. 03

   Create and show pastes

   ~2h

   Build the create form with validation (content required and at most 100 KB, title up to 100 characters, and an expiry from the allowed options) and a controller that saves the paste and redirects to its page, showing the secret delete link once. Show the paste with line numbers and its title, always escaped with Blade's {{ }} so pasted HTML is shown as text. Add a raw view returning text/plain. Done when: pastes can be created, viewed and viewed raw, and pasted HTML never runs.

4. 04

   Handle expiry and deletion

   ~1.5h

   Return 404 for expired pastes even before they're cleaned up. Add a delete route that checks the secret token (comparing hashes) and deletes the paste. Create an artisan command that deletes expired pastes, and schedule it to run every hour. Done when: expired pastes are no longer shown, and the scheduled command deletes them.

5. 05

   List public pastes and limit abuse

   ~1h

   Show the 20 most recent public, unexpired pastes on the home page. Add Laravel's rate limiting to the create route (for example 10 pastes per minute per IP). Done when: the list shows only public, live pastes, and rapid creation is limited.

6. 06

   Test it

   ~1.5h

   Write feature tests: creating valid and invalid pastes, viewing and raw view, HTML being escaped, expired pastes returning 404, deleting with the right and a wrong token, private pastes missing from the list, and the cleanup command. Done when: php artisan test passes.

Resources

• DocsLaravel: routing
• DocsLaravel: validation
• DocsLaravel: Eloquent
• DocsLaravel: task scheduling
• DocsLaravel: HTTP tests