# Snippets: implementation plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** A snippet a user owns, shares by URL, and edits in place: one or more named text files, a description, and a visibility. Closes #195.

**Architecture:** Two new tables (migration 0054) hold snippets and their files; content sits in SQLite as a BLOB. Eight `snippet` control commands in `internal/control/snippet.go` are the only write path; the CLI, the JSON API and the web forms dispatch into them. Read rules live in `internal/policy/snippets.go`. The web renders under `/{owner}/-/snippets`, the pattern `/{owner}/-/labels` set.

**Tech Stack:** Go, SQLite via modernc (hand-written SQL, no ORM), Go `html/template`, chroma through the existing `highlight`, the control registry in `internal/control`, the e2e harness in `e2e/`.

**Spec:** `docs/specs/2026-09-11-snippets-design.md`

## Global Constraints

- Every capability lands as a control command first; the CLI, web and API dispatch into it. New commands need a `pass()` row in `cmd/gitbay/main.go` (`TestCLI` in `e2e/cli_test.go` enforces this) and, if `ReadOnly`, a row in `readArgs` in `e2e/readonly_test.go` (`TestReadOnlyCommandsWriteNothing` enforces that).
- A command that reads stdin sets `ReadsStdin: true`, or `control.go` swaps in an empty reader and `--file -` stores nothing without an error.
- Hand-written SQL only. Migrations are `internal/store/migrations/NNNN_name.up.sql` and `.down.sql`, embedded, run one per transaction; `TestMigrateUpDown` runs both directions.
- Private things return not-found (exit 3, HTTP 404), never a denial that confirms they exist.
- Every `<input>` and `<textarea>` a person types into carries an `aria-label` (`internal/httpd/inputlabels_test.go`). One `<h1>` per page.
- Never mention an assistant or model anywhere: commit messages, comments, docs.
- Commit messages reference the issue: `Ref #195` on each task, `Closes #195` on the last.
- Run locally: `go build ./... && go vet ./...` and the unit tests of the touched packages. Run at most the one e2e test you write (`go test ./e2e -run 'TestSnippets$'`); CI on bay1 runs the full suite.
- Style: plain sentences in comments, no dramatic framing. Match the surrounding code. Comments in stores and handlers are one or two lines saying why, as the neighbours do.
- Work on branch `snippets` in the worktree `../gitbay-snippets`, which already holds the spec.

Names used across tasks, fixed here so the tasks agree:

- Store: `store.Snippet`, `store.SnippetFile`, `CreateSnippet`, `SnippetByPublicID`, `SnippetFiles`, `SnippetFile`, `ListSnippets`, `CountSnippets`, `UpdateSnippet`, `DeleteSnippet`, `SetSnippetFile`, `RemoveSnippetFile`.
- Policy: `policy.CanReadSnippet`, `policy.CanWriteSnippet`.
- Config: `Limits.MaxSnippetBytes` (`max_snippet_bytes`, default `1 << 20`).
- Control: exported `control.SnippetOut`, `control.SnippetFileOut`; the constant `maxSnippetFiles = 64`.
- Web: handlers `snippetsPage`, `snippetPage`, `snippetRaw`, `snippetNewForm`, `snippetNewSubmit`, `snippetEditSubmit`, `snippetDeleteSubmit`, `snippetFileSubmit`, `snippetFileRemoveSubmit`; templates `snippets.html`, `snippet.html`, `snippetnew.html`.

---

### Task 1: Migration 0054 and the store

**Files:**
- Create: `internal/store/migrations/0054_snippets.up.sql`
- Create: `internal/store/migrations/0054_snippets.down.sql`
- Create: `internal/store/snippets.go`
- Test: `internal/store/snippets_test.go`

**Interfaces:**
- Produces the tables `snippets` and `snippet_files` as in the spec.
- Produces:

```go
type Snippet struct {
	ID          int64
	PublicID    string
	OwnerID     int64
	OwnerName   string
	Description string
	Visibility  string // public | unlisted | private
	CreatedAt   string
	UpdatedAt   string
	Files       []SnippetFile // names and sizes; Content is filled by SnippetFiles and SnippetFile only
}
type SnippetFile struct {
	Name    string
	Size    int64
	Content []byte
}
func (s *Store) CreateSnippet(ownerID int64, publicID, description, visibility, name string, content []byte) (int64, error) // ErrExists on a public_id collision
func (s *Store) SnippetByPublicID(publicID string) (Snippet, error)                 // ErrNotFound; Files carry Name and Size
func (s *Store) SnippetFiles(id int64) ([]SnippetFile, error)                       // with Content, by name
func (s *Store) SnippetFile(id int64, name string) (SnippetFile, error)             // ErrNotFound
func (s *Store) ListSnippets(ownerID int64, all bool, limit int, afterID int64) ([]Snippet, error) // newest first; all=false is public only; afterID=0 from the start
func (s *Store) CountSnippets(ownerID int64, all bool) (int, error)
func (s *Store) UpdateSnippet(id int64, description, visibility string) error
func (s *Store) DeleteSnippet(id int64) error
func (s *Store) SetSnippetFile(id int64, name string, content []byte) error         // insert or replace; touches updated_at
func (s *Store) RemoveSnippetFile(id int64, name string) error                      // ErrNotFound when absent; touches updated_at
```

- [ ] **Step 1: Write the failing store test**

Create `internal/store/snippets_test.go`:

```go
package store

import (
	"errors"
	"testing"
)

func TestSnippets(t *testing.T) {
	s := open(t)
	alice, err := s.CreateUser("alice", false)
	if err != nil {
		t.Fatal(err)
	}
	id, err := s.CreateSnippet(alice, "abcdef012345", "a log", "unlisted", "build.log", []byte("ok\n"))
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.CreateSnippet(alice, "abcdef012345", "", "public", "x", []byte("x")); !errors.Is(err, ErrExists) {
		t.Fatalf("duplicate public id: %v", err)
	}
	sn, err := s.SnippetByPublicID("abcdef012345")
	if err != nil {
		t.Fatal(err)
	}
	if sn.ID != id || sn.OwnerName != "alice" || sn.Visibility != "unlisted" || sn.Description != "a log" {
		t.Fatalf("snippet: %+v", sn)
	}
	if len(sn.Files) != 1 || sn.Files[0].Name != "build.log" || sn.Files[0].Size != 3 || sn.Files[0].Content != nil {
		t.Fatalf("files on lookup: %+v", sn.Files)
	}

	// Set adds, then replaces; remove drops; the file read carries content.
	if err := s.SetSnippetFile(id, "notes.txt", []byte("one\n")); err != nil {
		t.Fatal(err)
	}
	if err := s.SetSnippetFile(id, "notes.txt", []byte("two\n")); err != nil {
		t.Fatal(err)
	}
	f, err := s.SnippetFile(id, "notes.txt")
	if err != nil || string(f.Content) != "two\n" || f.Size != 4 {
		t.Fatalf("file after replace: %+v %v", f, err)
	}
	files, err := s.SnippetFiles(id)
	if err != nil || len(files) != 2 || files[0].Name != "build.log" || string(files[1].Content) != "two\n" {
		t.Fatalf("files: %+v %v", files, err)
	}
	if err := s.RemoveSnippetFile(id, "notes.txt"); err != nil {
		t.Fatal(err)
	}
	if err := s.RemoveSnippetFile(id, "notes.txt"); !errors.Is(err, ErrNotFound) {
		t.Fatalf("remove missing file: %v", err)
	}
	if _, err := s.SnippetFile(id, "notes.txt"); !errors.Is(err, ErrNotFound) {
		t.Fatalf("read removed file: %v", err)
	}

	// Listing: public only unless all; newest first; keyset by id.
	pub, err := s.CreateSnippet(alice, "000000000001", "", "public", "a", []byte("a"))
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.CreateSnippet(alice, "000000000002", "", "private", "b", []byte("b")); err != nil {
		t.Fatal(err)
	}
	got, err := s.ListSnippets(alice, false, 0, 0)
	if err != nil || len(got) != 1 || got[0].ID != pub {
		t.Fatalf("public list: %+v %v", got, err)
	}
	got, err = s.ListSnippets(alice, true, 0, 0)
	if err != nil || len(got) != 3 || got[0].PublicID != "000000000002" || got[2].ID != id {
		t.Fatalf("all list: %+v %v", got, err)
	}
	got, err = s.ListSnippets(alice, true, 2, got[0].ID)
	if err != nil || len(got) != 2 || got[0].ID != pub {
		t.Fatalf("paged list: %+v %v", got, err)
	}
	if n, err := s.CountSnippets(alice, false); err != nil || n != 1 {
		t.Fatalf("public count: %d %v", n, err)
	}
	if n, err := s.CountSnippets(alice, true); err != nil || n != 3 {
		t.Fatalf("all count: %d %v", n, err)
	}

	// Update, delete, and the owner cascade.
	if err := s.UpdateSnippet(id, "renamed", "public"); err != nil {
		t.Fatal(err)
	}
	sn, _ = s.SnippetByPublicID("abcdef012345")
	if sn.Description != "renamed" || sn.Visibility != "public" {
		t.Fatalf("after update: %+v", sn)
	}
	if err := s.DeleteSnippet(id); err != nil {
		t.Fatal(err)
	}
	if _, err := s.SnippetByPublicID("abcdef012345"); !errors.Is(err, ErrNotFound) {
		t.Fatalf("after delete: %v", err)
	}
	if err := s.DeleteUser(alice); err != nil {
		t.Fatal(err)
	}
	var n int
	if err := s.DB.QueryRow("SELECT COUNT(*) FROM snippet_files").Scan(&n); err != nil || n != 0 {
		t.Fatalf("files after user delete: %d %v", n, err)
	}
}
```

- [ ] **Step 2: Run it to see it fail**

Run: `go test ./internal/store -run TestSnippets`
Expected: compile error, `s.CreateSnippet undefined`.

- [ ] **Step 3: Write the migration**

`internal/store/migrations/0054_snippets.up.sql`:

```sql
-- Snippets: named text files a user owns and shares by URL, outside any
-- repository. public_id is the opaque id in URLs and commands.
CREATE TABLE snippets (
    id          INTEGER PRIMARY KEY,
    public_id   TEXT NOT NULL UNIQUE,
    owner_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    description TEXT NOT NULL DEFAULT '',
    visibility  TEXT NOT NULL CHECK (visibility IN ('public','unlisted','private')),
    created_at  TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
    updated_at  TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
);
CREATE INDEX snippets_owner ON snippets(owner_id, id);

CREATE TABLE snippet_files (
    snippet_id INTEGER NOT NULL REFERENCES snippets(id) ON DELETE CASCADE,
    name       TEXT NOT NULL,
    content    BLOB NOT NULL,
    size       INTEGER NOT NULL,
    PRIMARY KEY (snippet_id, name)
);
```

`internal/store/migrations/0054_snippets.down.sql`:

```sql
DROP TABLE snippet_files;
DROP TABLE snippets;
```

- [ ] **Step 4: Write the store**

Create `internal/store/snippets.go`:

```go
package store

import (
	"database/sql"
	"errors"
)

type Snippet struct {
	ID          int64
	PublicID    string
	OwnerID     int64
	OwnerName   string
	Description string
	Visibility  string // public | unlisted | private
	CreatedAt   string
	UpdatedAt   string
	// Files carries names and sizes. Content is filled by SnippetFiles and
	// SnippetFile only, so a listing does not read every body.
	Files []SnippetFile
}

type SnippetFile struct {
	Name    string
	Size    int64
	Content []byte
}

const snippetSelect = `
	SELECT s.id, s.public_id, s.owner_id, u.username, s.description, s.visibility, s.created_at, s.updated_at
	FROM snippets s JOIN users u ON u.id = s.owner_id`

func scanSnippet(row interface{ Scan(...any) error }) (Snippet, error) {
	var sn Snippet
	err := row.Scan(&sn.ID, &sn.PublicID, &sn.OwnerID, &sn.OwnerName, &sn.Description, &sn.Visibility, &sn.CreatedAt, &sn.UpdatedAt)
	return sn, err
}

// CreateSnippet inserts the snippet and its first file in one transaction.
// A public_id collision is ErrExists so the caller can draw another.
func (s *Store) CreateSnippet(ownerID int64, publicID, description, visibility, name string, content []byte) (int64, error) {
	tx, err := s.DB.Begin()
	if err != nil {
		return 0, err
	}
	defer tx.Rollback()
	res, err := tx.Exec(
		"INSERT INTO snippets (public_id, owner_id, description, visibility) VALUES (?, ?, ?, ?)",
		publicID, ownerID, description, visibility)
	if err != nil {
		if isUniqueErr(err) {
			return 0, ErrExists
		}
		return 0, err
	}
	id, err := res.LastInsertId()
	if err != nil {
		return 0, err
	}
	if _, err := tx.Exec("INSERT INTO snippet_files (snippet_id, name, content, size) VALUES (?, ?, ?, ?)",
		id, name, content, len(content)); err != nil {
		return 0, err
	}
	return id, tx.Commit()
}

func (s *Store) SnippetByPublicID(publicID string) (Snippet, error) {
	sn, err := scanSnippet(s.DB.QueryRow(snippetSelect+" WHERE s.public_id = ?", publicID))
	if errors.Is(err, sql.ErrNoRows) {
		return sn, ErrNotFound
	}
	if err != nil {
		return sn, err
	}
	sn.Files, err = s.snippetFileNames(sn.ID)
	return sn, err
}

func (s *Store) snippetFileNames(id int64) ([]SnippetFile, error) {
	rows, err := s.DB.Query("SELECT name, size FROM snippet_files WHERE snippet_id = ? ORDER BY name", id)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []SnippetFile
	for rows.Next() {
		var f SnippetFile
		if err := rows.Scan(&f.Name, &f.Size); err != nil {
			return nil, err
		}
		out = append(out, f)
	}
	return out, rows.Err()
}

// SnippetFiles returns every file with its content, by name.
func (s *Store) SnippetFiles(id int64) ([]SnippetFile, error) {
	rows, err := s.DB.Query("SELECT name, size, content FROM snippet_files WHERE snippet_id = ? ORDER BY name", id)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []SnippetFile
	for rows.Next() {
		var f SnippetFile
		if err := rows.Scan(&f.Name, &f.Size, &f.Content); err != nil {
			return nil, err
		}
		out = append(out, f)
	}
	return out, rows.Err()
}

func (s *Store) SnippetFile(id int64, name string) (SnippetFile, error) {
	var f SnippetFile
	err := s.DB.QueryRow("SELECT name, size, content FROM snippet_files WHERE snippet_id = ? AND name = ?", id, name).
		Scan(&f.Name, &f.Size, &f.Content)
	if errors.Is(err, sql.ErrNoRows) {
		return f, ErrNotFound
	}
	return f, err
}

// ListSnippets lists an owner's snippets newest first. all=false keeps
// public ones only. afterID is the keyset cursor: rows older than it.
// Ids grow with creation, so ordering by id is creation order.
func (s *Store) ListSnippets(ownerID int64, all bool, limit int, afterID int64) ([]Snippet, error) {
	q := snippetSelect + " WHERE s.owner_id = ?"
	args := []any{ownerID}
	if !all {
		q += " AND s.visibility = 'public'"
	}
	if afterID > 0 {
		q += " AND s.id < ?"
		args = append(args, afterID)
	}
	q += " ORDER BY s.id DESC"
	if limit > 0 {
		q += " LIMIT ?"
		args = append(args, limit)
	}
	rows, err := s.DB.Query(q, args...)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []Snippet
	for rows.Next() {
		sn, err := scanSnippet(rows)
		if err != nil {
			return nil, err
		}
		out = append(out, sn)
	}
	if err := rows.Err(); err != nil {
		return nil, err
	}
	// One query per row for the names; pages are at most 200 rows.
	for i := range out {
		if out[i].Files, err = s.snippetFileNames(out[i].ID); err != nil {
			return nil, err
		}
	}
	return out, nil
}

func (s *Store) CountSnippets(ownerID int64, all bool) (int, error) {
	q := "SELECT COUNT(*) FROM snippets WHERE owner_id = ?"
	if !all {
		q += " AND visibility = 'public'"
	}
	var n int
	err := s.DB.QueryRow(q, ownerID).Scan(&n)
	return n, err
}

func (s *Store) UpdateSnippet(id int64, description, visibility string) error {
	_, err := s.DB.Exec(
		"UPDATE snippets SET description = ?, visibility = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?",
		description, visibility, id)
	return err
}

func (s *Store) DeleteSnippet(id int64) error {
	_, err := s.DB.Exec("DELETE FROM snippets WHERE id = ?", id)
	return err
}

// SetSnippetFile adds the file or replaces one of the same name.
func (s *Store) SetSnippetFile(id int64, name string, content []byte) error {
	tx, err := s.DB.Begin()
	if err != nil {
		return err
	}
	defer tx.Rollback()
	if _, err := tx.Exec(`INSERT INTO snippet_files (snippet_id, name, content, size) VALUES (?, ?, ?, ?)
		ON CONFLICT (snippet_id, name) DO UPDATE SET content = excluded.content, size = excluded.size`,
		id, name, content, len(content)); err != nil {
		return err
	}
	if _, err := tx.Exec("UPDATE snippets SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?", id); err != nil {
		return err
	}
	return tx.Commit()
}

func (s *Store) RemoveSnippetFile(id int64, name string) error {
	tx, err := s.DB.Begin()
	if err != nil {
		return err
	}
	defer tx.Rollback()
	res, err := tx.Exec("DELETE FROM snippet_files WHERE snippet_id = ? AND name = ?", id, name)
	if err != nil {
		return err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return ErrNotFound
	}
	if _, err := tx.Exec("UPDATE snippets SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?", id); err != nil {
		return err
	}
	return tx.Commit()
}
```

- [ ] **Step 5: Run the store tests**

Run: `go test ./internal/store`
Expected: PASS, including `TestMigrateUpDown` (the down file drops both tables) and `TestSnippets`.

- [ ] **Step 6: Commit**

```bash
git add internal/store/migrations/0054_snippets.up.sql internal/store/migrations/0054_snippets.down.sql internal/store/snippets.go internal/store/snippets_test.go
git commit -m "store: snippets and snippet_files (migration 0054)

Ref #195"
```

---

### Task 2: Policy, config limit, and the snippet commands

**Files:**
- Create: `internal/policy/snippets.go`
- Modify: `internal/config/config.go:175-193` (the `Limits` struct) and the defaults near line 217
- Create: `internal/control/snippet.go`
- Modify: `cmd/gitbay/main.go:74-77` (after the `wiki` group)
- Modify: `e2e/readonly_test.go:72-73` (fixtures) and `:146-158` (`readArgs`)
- Test: `e2e/snippet_test.go`

**Interfaces:**
- Consumes the store API from Task 1.
- Produces:

```go
// internal/policy/snippets.go
func CanReadSnippet(user store.User, sn store.Snippet) bool
func CanWriteSnippet(user store.User, sn store.Snippet) bool

// internal/config/config.go
Limits.MaxSnippetBytes int64 `toml:"max_snippet_bytes"` // default 1 << 20

// internal/control/snippet.go
type SnippetFileOut struct {
	Name    string `json:"name"`
	Size    int64  `json:"size"`
	Content string `json:"content,omitempty"`
}
type SnippetOut struct {
	ID          string           `json:"id"`
	URL         string           `json:"url"`
	Owner       string           `json:"owner"`
	Description string           `json:"description"`
	Visibility  string           `json:"visibility"`
	CreatedAt   string           `json:"created_at"`
	UpdatedAt   string           `json:"updated_at"`
	Files       []SnippetFileOut `json:"files"`
}
```

Commands registered: `snippet create`, `snippet show`, `snippet list`, `snippet edit`, `snippet delete`, `snippet file set`, `snippet file get`, `snippet file remove`.

- [ ] **Step 1: Write the failing e2e test**

Create `e2e/snippet_test.go`:

```go
package e2e

import (
	"encoding/json"
	"regexp"
	"strings"
	"testing"
)

// Snippets over SSH: create from stdin, read back, list by visibility,
// edit files and metadata, and the not-found rule for private ones.
func TestSnippets(t *testing.T) {
	inst := startInstance(t)
	aliceKey := inst.newKey(t, "alice")
	bobKey := inst.newKey(t, "bob")
	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub", "--email", "bob@example.test", "--verified")
	must := func(key, stdin string, args ...string) string {
		t.Helper()
		out, errOut, code := inst.ssh(t, key, stdin, args...)
		if code != 0 {
			t.Fatalf("%v: exit %d %s", args, code, errOut)
		}
		return out
	}
	fails := func(key, stdin string, want int, args ...string) string {
		t.Helper()
		_, errOut, code := inst.ssh(t, key, stdin, args...)
		if code != want {
			t.Fatalf("%v: exit %d, want %d: %s", args, code, want, errOut)
		}
		return errOut
	}
	idOf := func(out string) string {
		t.Helper()
		var env struct {
			Data struct {
				ID  string `json:"id"`
				URL string `json:"url"`
			} `json:"data"`
		}
		if err := json.Unmarshal([]byte(out), &env); err != nil || !regexp.MustCompile(`^[0-9a-f]{12}$`).MatchString(env.Data.ID) {
			t.Fatalf("create output: %s", out)
		}
		if !strings.HasSuffix(env.Data.URL, "/alice/-/snippets/"+env.Data.ID) {
			t.Fatalf("url: %s", env.Data.URL)
		}
		return env.Data.ID
	}

	// Create with the default visibility, read back byte for byte.
	body := "line one\nline two\n"
	unlisted := idOf(must(aliceKey, body, "snippet", "create", "build.log", "--description", "'a log'", "--json"))
	if got := must(aliceKey, "", "snippet", "file", "get", unlisted, "build.log"); got != body {
		t.Fatalf("file get: %q", got)
	}
	out := must(aliceKey, "", "snippet", "show", unlisted, "--json")
	if !strings.Contains(out, `"visibility":"unlisted"`) || !strings.Contains(out, `"content":"line one\nline two\n"`) {
		t.Fatalf("show: %s", out)
	}
	public := idOf(must(aliceKey, "pub\n", "snippet", "create", "a.txt", "--visibility", "public", "--json"))
	private := idOf(must(aliceKey, "sec\n", "snippet", "create", "b.txt", "--visibility", "private", "--json"))

	// Refusals on create: empty, not text, over the limit, bad name.
	fails(aliceKey, "", 2, "snippet", "create", "x.txt")
	fails(aliceKey, "\xff\xfe\n", 2, "snippet", "create", "x.bin")
	fails(aliceKey, strings.Repeat("x", 1<<20+1), 2, "snippet", "create", "big.txt")
	fails(aliceKey, "x\n", 2, "snippet", "create", "../x")
	fails(aliceKey, "x\n", 2, "snippet", "create", "x.txt", "--visibility", "secret")

	// Visibility from the other side. Private is not-found, never denied.
	fails(bobKey, "", 3, "snippet", "show", private)
	fails(bobKey, "", 3, "snippet", "file", "get", private, "b.txt")
	must(bobKey, "", "snippet", "show", unlisted)
	out = must(bobKey, "", "snippet", "list", "alice", "--json")
	if !strings.Contains(out, public) || strings.Contains(out, unlisted) || strings.Contains(out, private) {
		t.Fatalf("bob's view of alice's list: %s", out)
	}
	out = must(aliceKey, "", "snippet", "list", "--json")
	for _, id := range []string{public, unlisted, private} {
		if !strings.Contains(out, id) {
			t.Fatalf("alice's own list lacks %s: %s", id, out)
		}
	}
	fails(bobKey, "", 3, "snippet", "list", "nobody")

	// Paging: two pages of one, the second reached by cursor.
	out = must(aliceKey, "", "snippet", "list", "--limit", "1", "--json")
	var page struct {
		Data struct {
			Items []struct{ ID string `json:"id"` } `json:"items"`
			Next  string                            `json:"next"`
		} `json:"data"`
	}
	json.Unmarshal([]byte(out), &page)
	if len(page.Data.Items) != 1 || page.Data.Items[0].ID != private || page.Data.Next == "" {
		t.Fatalf("first page: %s", out)
	}
	out = must(aliceKey, "", "snippet", "list", "--limit", "1", "--cursor", page.Data.Next, "--json")
	if !strings.Contains(out, public) {
		t.Fatalf("second page: %s", out)
	}

	// Files: set adds, set replaces, remove drops, the last one stays.
	must(aliceKey, "notes\n", "snippet", "file", "set", unlisted, "notes.txt")
	must(aliceKey, "changed\n", "snippet", "file", "set", unlisted, "build.log")
	if got := must(aliceKey, "", "snippet", "file", "get", unlisted, "build.log"); got != "changed\n" {
		t.Fatalf("after replace: %q", got)
	}
	must(aliceKey, "", "snippet", "file", "remove", unlisted, "notes.txt")
	fails(aliceKey, "", 3, "snippet", "file", "remove", unlisted, "notes.txt")
	if msg := fails(aliceKey, "", 2, "snippet", "file", "remove", unlisted, "build.log"); !strings.Contains(msg, "at least one file") {
		t.Fatalf("last file removal: %s", msg)
	}

	// Only the owner writes: denied on a readable one, not-found on a private one.
	fails(bobKey, "x\n", 4, "snippet", "file", "set", unlisted, "x.txt")
	fails(bobKey, "", 4, "snippet", "edit", unlisted, "--description", "mine")
	fails(bobKey, "", 4, "snippet", "delete", unlisted)
	fails(bobKey, "", 3, "snippet", "delete", private)

	// Edit moves visibility and the listing follows.
	fails(aliceKey, "", 2, "snippet", "edit", unlisted)
	must(aliceKey, "", "snippet", "edit", unlisted, "--visibility", "public", "--description", "shared")
	out = must(bobKey, "", "snippet", "list", "alice", "--json")
	if !strings.Contains(out, unlisted) || !strings.Contains(out, `"description":"shared"`) {
		t.Fatalf("list after edit: %s", out)
	}

	// Delete, then gone; deleting the user takes the rest.
	must(aliceKey, "", "snippet", "delete", unlisted)
	fails(aliceKey, "", 3, "snippet", "show", unlisted)
	inst.admin(t, "admin", "user", "delete", "alice", "--yes")
	fails(bobKey, "", 3, "snippet", "show", public)
}
```

- [ ] **Step 2: Run it to see it fail**

Run: `go test ./e2e -run 'TestSnippets$'`
Expected: FAIL at the first `must`: `unknown command "snippet"` (or similar) with exit 2.

- [ ] **Step 3: Policy**

Create `internal/policy/snippets.go`:

```go
package policy

import "gitbay.org/gitbay/internal/store"

// CanReadSnippet: anyone for public and unlisted, the owner and admins
// for private. Anonymous readers have user.ID 0.
func CanReadSnippet(user store.User, sn store.Snippet) bool {
	if sn.Visibility != "private" {
		return true
	}
	return user.ID != 0 && (user.ID == sn.OwnerID || user.IsAdmin)
}

// CanWriteSnippet: the owner and admins.
func CanWriteSnippet(user store.User, sn store.Snippet) bool {
	return user.ID != 0 && (user.ID == sn.OwnerID || user.IsAdmin)
}
```

- [ ] **Step 4: Config limit**

In `internal/config/config.go`, add to `Limits` after `MaxAssetBytes`:

```go
	MaxSnippetBytes int64 `toml:"max_snippet_bytes"` // per snippet file
```

and in the defaults block that sets `MaxAssetBytes: 512 << 20`, add:

```go
			MaxSnippetBytes: 1 << 20,
```

- [ ] **Step 5: The commands**

Create `internal/control/snippet.go`:

```go
package control

import (
	"crypto/rand"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"strconv"
	"unicode/utf8"

	"gitbay.org/gitbay/internal/policy"
	"gitbay.org/gitbay/internal/protocol"
	"gitbay.org/gitbay/internal/store"
)

// A snippet keeps at most this many files; a paste is not a repository.
const maxSnippetFiles = 64

func init() {
	register(Command{Path: []string{"snippet", "create"},
		Summary:    "create a snippet from one file on stdin",
		Usage:      "snippet create <filename> [--description <d>] [--visibility public|unlisted|private] < file",
		ReadsStdin: true, Run: runSnippetCreate})
	register(Command{Path: []string{"snippet", "show"},
		Summary: "show a snippet's metadata and files",
		Usage:   "snippet show <id>", ReadOnly: true, Run: runSnippetShow})
	register(Command{Path: []string{"snippet", "list"},
		Summary: "list your snippets, or an owner's public ones",
		Usage:   "snippet list [<owner>] [--limit n] [--cursor c]", ReadOnly: true, Run: runSnippetList})
	register(Command{Path: []string{"snippet", "edit"},
		Summary: "change a snippet's description or visibility",
		Usage:   "snippet edit <id> [--description <d>] [--visibility public|unlisted|private]", Run: runSnippetEdit})
	register(Command{Path: []string{"snippet", "delete"},
		Summary: "delete a snippet and its files",
		Usage:   "snippet delete <id>", Run: runSnippetDelete})
	register(Command{Path: []string{"snippet", "file", "set"},
		Summary:    "add a file to a snippet, or replace one, from stdin",
		Usage:      "snippet file set <id> <filename> < file",
		ReadsStdin: true, Run: runSnippetFileSet})
	register(Command{Path: []string{"snippet", "file", "get"},
		Summary:  "write a snippet file to stdout",
		Usage:    "snippet file get <id> <filename> > file", ReadOnly: true, Run: runSnippetFileGet})
	register(Command{Path: []string{"snippet", "file", "remove"},
		Summary: "remove a file from a snippet",
		Usage:   "snippet file remove <id> <filename>", Run: runSnippetFileRemove})
}

type SnippetFileOut struct {
	Name    string `json:"name"`
	Size    int64  `json:"size"`
	Content string `json:"content,omitempty"`
}

type SnippetOut struct {
	ID          string           `json:"id"`
	URL         string           `json:"url"`
	Owner       string           `json:"owner"`
	Description string           `json:"description"`
	Visibility  string           `json:"visibility"`
	CreatedAt   string           `json:"created_at"`
	UpdatedAt   string           `json:"updated_at"`
	Files       []SnippetFileOut `json:"files"`
}

func snippetURL(c *Ctx, sn store.Snippet) string {
	return c.Cfg.Server.SiteURL + "/" + sn.OwnerName + "/-/snippets/" + sn.PublicID
}

func snippetOut(c *Ctx, sn store.Snippet) SnippetOut {
	o := SnippetOut{ID: sn.PublicID, URL: snippetURL(c, sn), Owner: sn.OwnerName,
		Description: sn.Description, Visibility: sn.Visibility,
		CreatedAt: sn.CreatedAt, UpdatedAt: sn.UpdatedAt, Files: []SnippetFileOut{}}
	for _, f := range sn.Files {
		o.Files = append(o.Files, SnippetFileOut{Name: f.Name, Size: f.Size, Content: string(f.Content)})
	}
	return o
}

func validSnippetVisibility(v string) bool {
	return v == "public" || v == "unlisted" || v == "private"
}

// snippetRef loads a snippet the caller may read; with write, one they
// may change. Unreadable and missing are the same not-found, so a
// private id cannot be confirmed by probing.
func snippetRef(c *Ctx, id string, write bool) (store.Snippet, int) {
	sn, err := c.Store.SnippetByPublicID(id)
	if err != nil && !errors.Is(err, store.ErrNotFound) {
		return sn, c.fail(protocol.ExitFailure, "%v", err)
	}
	if err != nil || !policy.CanReadSnippet(c.User, sn) {
		return sn, c.fail(protocol.ExitNotFound, "no snippet %q", id)
	}
	if write && !policy.CanWriteSnippet(c.User, sn) {
		return sn, c.fail(protocol.ExitDenied, "snippet %s belongs to %s", id, sn.OwnerName)
	}
	return sn, -1
}

// readSnippetBody reads one file from stdin under the limit, and insists
// on text: the page highlights it and the raw route serves text/plain.
func readSnippetBody(c *Ctx) ([]byte, int) {
	limit := c.Cfg.Limits.MaxSnippetBytes
	data, err := io.ReadAll(io.LimitReader(c.Stdin, limit+1))
	if err != nil {
		return nil, c.fail(protocol.ExitFailure, "reading stdin: %v", err)
	}
	if int64(len(data)) > limit {
		return nil, c.fail(protocol.ExitUsage, "file exceeds max_snippet_bytes (%d)", limit)
	}
	if len(data) == 0 {
		return nil, c.fail(protocol.ExitUsage, "empty file: pipe it on stdin")
	}
	if !utf8.Valid(data) {
		return nil, c.fail(protocol.ExitUsage, "snippets hold text: the file is not valid UTF-8")
	}
	return data, -1
}

func checkSnippetFileName(c *Ctx, name string) int {
	if !assetNamePat.MatchString(name) {
		return c.fail(protocol.ExitUsage, "invalid file name %q: letters, digits, '._+-'; must not start with '.'", name)
	}
	return -1
}

func newSnippetID() string {
	buf := make([]byte, 6)
	rand.Read(buf)
	return hex.EncodeToString(buf)
}

func runSnippetCreate(c *Ctx, args []string) int {
	const usage = "usage: snippet create <filename> [--description <d>] [--visibility public|unlisted|private] < file"
	f, err := parseFlags(args, flagSpec{Values: []string{"--description", "--visibility"}, MaxPos: 1, Usage: usage})
	if err != nil {
		return c.fail(protocol.ExitUsage, "%v", err)
	}
	name := f.pos(0)
	if name == "" {
		return c.fail(protocol.ExitUsage, usage)
	}
	if code := checkSnippetFileName(c, name); code >= 0 {
		return code
	}
	visibility := f.Value("--visibility")
	if visibility == "" {
		visibility = "unlisted"
	}
	if !validSnippetVisibility(visibility) {
		return c.fail(protocol.ExitUsage, "visibility is public, unlisted or private")
	}
	data, code := readSnippetBody(c)
	if code >= 0 {
		return code
	}
	var pid string
	for try := 0; ; try++ {
		pid = newSnippetID()
		_, err = c.Store.CreateSnippet(c.User.ID, pid, f.Value("--description"), visibility, name, data)
		if !errors.Is(err, store.ErrExists) || try == 4 {
			break
		}
	}
	if err != nil {
		return c.failErr(err)
	}
	sn, err := c.Store.SnippetByPublicID(pid)
	if err != nil {
		return c.fail(protocol.ExitFailure, "%v", err)
	}
	return c.emit(snippetOut(c, sn), func(w io.Writer) {
		fmt.Fprintf(w, "created snippet %s\n%s\n", sn.PublicID, snippetURL(c, sn))
	})
}

func runSnippetShow(c *Ctx, args []string) int {
	if len(args) != 1 {
		return c.fail(protocol.ExitUsage, "usage: snippet show <id>")
	}
	sn, code := snippetRef(c, args[0], false)
	if code >= 0 {
		return code
	}
	files, err := c.Store.SnippetFiles(sn.ID)
	if err != nil {
		return c.fail(protocol.ExitFailure, "%v", err)
	}
	sn.Files = files
	return c.emit(snippetOut(c, sn), func(w io.Writer) {
		fmt.Fprintf(w, "snippet %s by %s (%s)\n", sn.PublicID, sn.OwnerName, sn.Visibility)
		if sn.Description != "" {
			fmt.Fprintf(w, "%s\n", sn.Description)
		}
		fmt.Fprintf(w, "%s\nupdated %s\n", snippetURL(c, sn), sn.UpdatedAt)
		for _, f := range files {
			fmt.Fprintf(w, "  %s\t%d bytes\n", f.Name, f.Size)
		}
	})
}

func runSnippetList(c *Ctx, args []string) int {
	rest, p, code := parsePageFlags(c, args, "snippet", true)
	if code >= 0 {
		return code
	}
	if len(rest) > 1 {
		return c.fail(protocol.ExitUsage, "usage: snippet list [<owner>] [--limit n] [--cursor c]")
	}
	owner := c.User
	if len(rest) == 1 {
		u, err := c.Store.UserByUsername(rest[0])
		if errors.Is(err, store.ErrNotFound) {
			return c.fail(protocol.ExitNotFound, "no user %q", rest[0])
		}
		if err != nil {
			return c.fail(protocol.ExitFailure, "%v", err)
		}
		owner = u
	}
	all := owner.ID == c.User.ID || c.User.IsAdmin
	rows, err := c.Store.ListSnippets(owner.ID, all, p.queryLimit(), p.keyInt())
	if err != nil {
		return c.fail(protocol.ExitFailure, "%v", err)
	}
	rows, next := trimPage(p, rows, "snippet", func(sn store.Snippet) string { return strconv.FormatInt(sn.ID, 10) })
	items := make([]SnippetOut, 0, len(rows))
	for _, sn := range rows {
		items = append(items, snippetOut(c, sn))
	}
	return c.emitPage(p, items, next, func(w io.Writer) {
		for _, sn := range rows {
			names := ""
			for i, f := range sn.Files {
				if i > 0 {
					names += ", "
				}
				names += f.Name
			}
			fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", sn.PublicID, sn.Visibility, names, sn.Description)
		}
	})
}

func runSnippetEdit(c *Ctx, args []string) int {
	const usage = "usage: snippet edit <id> [--description <d>] [--visibility public|unlisted|private]"
	f, err := parseFlags(args, flagSpec{Values: []string{"--description", "--visibility"}, MaxPos: 1, Usage: usage})
	if err != nil {
		return c.fail(protocol.ExitUsage, "%v", err)
	}
	if f.pos(0) == "" || (!f.Has("--description") && !f.Has("--visibility")) {
		return c.fail(protocol.ExitUsage, usage)
	}
	sn, code := snippetRef(c, f.pos(0), true)
	if code >= 0 {
		return code
	}
	description, visibility := sn.Description, sn.Visibility
	if f.Has("--description") {
		description = f.Value("--description")
	}
	if f.Has("--visibility") {
		visibility = f.Value("--visibility")
		if !validSnippetVisibility(visibility) {
			return c.fail(protocol.ExitUsage, "visibility is public, unlisted or private")
		}
	}
	if err := c.Store.UpdateSnippet(sn.ID, description, visibility); err != nil {
		return c.failErr(err)
	}
	sn, err = c.Store.SnippetByPublicID(sn.PublicID)
	if err != nil {
		return c.fail(protocol.ExitFailure, "%v", err)
	}
	return c.emit(snippetOut(c, sn), func(w io.Writer) {
		fmt.Fprintf(w, "updated snippet %s (%s)\n", sn.PublicID, sn.Visibility)
	})
}

func runSnippetDelete(c *Ctx, args []string) int {
	if len(args) != 1 {
		return c.fail(protocol.ExitUsage, "usage: snippet delete <id>")
	}
	sn, code := snippetRef(c, args[0], true)
	if code >= 0 {
		return code
	}
	if err := c.Store.DeleteSnippet(sn.ID); err != nil {
		return c.failErr(err)
	}
	return c.emit(map[string]string{"id": sn.PublicID}, func(w io.Writer) {
		fmt.Fprintf(w, "deleted snippet %s\n", sn.PublicID)
	})
}

func runSnippetFileSet(c *Ctx, args []string) int {
	if len(args) != 2 {
		return c.fail(protocol.ExitUsage, "usage: snippet file set <id> <filename> < file")
	}
	sn, code := snippetRef(c, args[0], true)
	if code >= 0 {
		return code
	}
	name := args[1]
	if code := checkSnippetFileName(c, name); code >= 0 {
		return code
	}
	exists := false
	for _, f := range sn.Files {
		exists = exists || f.Name == name
	}
	if !exists && len(sn.Files) >= maxSnippetFiles {
		return c.fail(protocol.ExitUsage, "a snippet holds at most %d files", maxSnippetFiles)
	}
	data, code := readSnippetBody(c)
	if code >= 0 {
		return code
	}
	if err := c.Store.SetSnippetFile(sn.ID, name, data); err != nil {
		return c.failErr(err)
	}
	return c.emit(SnippetFileOut{Name: name, Size: int64(len(data))}, func(w io.Writer) {
		fmt.Fprintf(w, "set %s (%d bytes) on snippet %s\n", name, len(data), sn.PublicID)
	})
}

func runSnippetFileGet(c *Ctx, args []string) int {
	if len(args) != 2 {
		return c.fail(protocol.ExitUsage, "usage: snippet file get <id> <filename> > file")
	}
	sn, code := snippetRef(c, args[0], false)
	if code >= 0 {
		return code
	}
	f, err := c.Store.SnippetFile(sn.ID, args[1])
	if errors.Is(err, store.ErrNotFound) {
		return c.fail(protocol.ExitNotFound, "no file %q in snippet %s", args[1], sn.PublicID)
	}
	if err != nil {
		return c.fail(protocol.ExitFailure, "%v", err)
	}
	if c.JSON {
		return c.emit(SnippetFileOut{Name: f.Name, Size: f.Size, Content: string(f.Content)}, nil)
	}
	if _, err := c.Stdout.Write(f.Content); err != nil {
		return protocol.ExitFailure
	}
	return protocol.ExitOK
}

func runSnippetFileRemove(c *Ctx, args []string) int {
	if len(args) != 2 {
		return c.fail(protocol.ExitUsage, "usage: snippet file remove <id> <filename>")
	}
	sn, code := snippetRef(c, args[0], true)
	if code >= 0 {
		return code
	}
	if len(sn.Files) == 1 && sn.Files[0].Name == args[1] {
		return c.fail(protocol.ExitUsage, "a snippet keeps at least one file; delete the snippet instead")
	}
	err := c.Store.RemoveSnippetFile(sn.ID, args[1])
	if errors.Is(err, store.ErrNotFound) {
		return c.fail(protocol.ExitNotFound, "no file %q in snippet %s", args[1], sn.PublicID)
	}
	if err != nil {
		return c.failErr(err)
	}
	return c.emit(map[string]string{"id": sn.PublicID, "name": args[1]}, func(w io.Writer) {
		fmt.Fprintf(w, "removed %s from snippet %s\n", args[1], sn.PublicID)
	})
}
```

One note for the implementer: `c.emit(..., nil)` in `runSnippetFileGet` is only reached under `c.JSON`, where `emit` never calls the plain function; keep the `if c.JSON` guard.

- [ ] **Step 6: CLI rows**

In `cmd/gitbay/main.go`, directly after the `group("wiki", ...)` entry (around line 77), add:

```go
		group("snippet", "shared text files, outside any repository",
			pass("create", "create from one file on stdin: <filename> [--description d] [--visibility public|unlisted|private] < file",
				passOpts{server: []string{"snippet", "create"}, alwaysStdin: true, stdinWhat: "the file's text"}),
			pass("show", "metadata and files: <id>", passOpts{server: []string{"snippet", "show"}}),
			pass("list", "your snippets, or an owner's public ones: [<owner>] [--limit n] [--cursor c]",
				passOpts{server: []string{"snippet", "list"}}),
			pass("edit", "change description or visibility: <id> [--description d] [--visibility v]",
				passOpts{server: []string{"snippet", "edit"}}),
			pass("delete", "delete a snippet: <id>", passOpts{server: []string{"snippet", "delete"}}),
			group("file", "the files in a snippet",
				pass("set", "add or replace a file from stdin: <id> <filename> < file",
					passOpts{server: []string{"snippet", "file", "set"}, alwaysStdin: true, stdinWhat: "the file's text"}),
				pass("get", "print a file: <id> <filename> > file", passOpts{server: []string{"snippet", "file", "get"}}),
				pass("remove", "remove a file: <id> <filename>", passOpts{server: []string{"snippet", "file", "remove"}}),
			),
		),
```

- [ ] **Step 7: Read-only coverage entries**

In `e2e/readonly_test.go`, after the line `must("data\n", "release", "asset", "add", "alice/app", "v1", "a.txt")` add:

```go
	snippetOut := must("hello\n", "snippet", "create", "a.txt", "--json")
	snippetID := regexp.MustCompile(`"id":"([0-9a-f]{12})"`).FindStringSubmatch(snippetOut)[1]
```

Add `"regexp"` to the file's imports if it is not there. In the `readArgs` map add, beside the `release` rows:

```go
		"snippet show":                {snippetID},
		"snippet list":                {},
		"snippet file get":            {snippetID, "a.txt"},
```

- [ ] **Step 8: Build, vet, run the tests**

Run: `go build ./... && go vet ./... && go test ./internal/control ./internal/policy ./internal/config && go test ./e2e -run 'TestSnippets$|TestCLI$|TestReadOnlyCommandsWriteNothing$'`
Expected: all PASS. `TestCLI` proves every `snippet` command has a CLI row with a `stdinWhat`; `TestReadOnlyCommandsWriteNothing` proves the three reads write nothing.

If `TestSnippets` fails on the paged `next` cursor, check that `parsePageFlags` was called with `numeric=true` and that `trimPage` keys on `sn.ID`, not `sn.PublicID`.

- [ ] **Step 9: Commit**

```bash
git add internal/policy/snippets.go internal/config/config.go internal/control/snippet.go cmd/gitbay/main.go e2e/readonly_test.go e2e/snippet_test.go
git commit -m "control: snippet commands

create, show, list, edit, delete, and file set|get|remove. Content is
UTF-8 under limits.max_snippet_bytes per file, 64 files per snippet.
Private snippets are not-found to everyone but the owner and admins.

Ref #195"
```

---

### Task 3: Web read pages and the owner-page link

**Files:**
- Create: `internal/httpd/snippets.go`
- Create: `internal/web/templates/snippets.html`
- Create: `internal/web/templates/snippet.html`
- Modify: `internal/httpd/routes.go:74-75` (beside the `/{owner}/-/labels` routes)
- Modify: `internal/control/profile.go:165-185` (`ProfileOut`) and the `profile show` body near line 296
- Modify: `internal/httpd/web.go:436-466` (the `owner.html` page struct and its literal)
- Modify: `internal/web/templates/owner.html:21-25`
- Test: `e2e/snippetweb_test.go`

**Interfaces:**
- Consumes `store.SnippetByPublicID`, `store.SnippetFiles`, `store.SnippetFile`, `store.ListSnippets`, `store.CountSnippets`, `policy.CanReadSnippet`, `policy.CanWriteSnippet`, `highlight(path string, data []byte) template.HTML` in `internal/httpd/web.go`.
- Produces `ProfileOut.Snippets int` (`json:"snippets"`): the owner's snippets the caller may list (public, or all for the owner and admins). Produces the handlers `snippetsPage`, `snippetPage`, `snippetRaw` and the helper `snippetScope`, which Task 4's write handlers reuse.

- [ ] **Step 1: Write the failing e2e test (read half)**

Create `e2e/snippetweb_test.go`:

```go
package e2e

import (
	"encoding/json"
	"net/http"
	"net/url"
	"strings"
	"testing"
)

func snippetIDFrom(t *testing.T, out string) string {
	t.Helper()
	var env struct {
		Data struct {
			ID string `json:"id"`
		} `json:"data"`
	}
	if err := json.Unmarshal([]byte(out), &env); err != nil || env.Data.ID == "" {
		t.Fatalf("snippet create: %s", out)
	}
	return env.Data.ID
}

// Snippet pages: the owner's list, one snippet with highlighted files, the
// raw route, the owner-page link, and 404 for what the viewer may not see.
func TestSnippetsWeb(t *testing.T) {
	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
	aliceKey := inst.newKey(t, "alice")
	bobKey := inst.newKey(t, "bob")
	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub", "--email", "bob@example.test", "--verified")
	must := func(key, stdin string, args ...string) string {
		t.Helper()
		out, errOut, code := inst.ssh(t, key, stdin, args...)
		if code != 0 {
			t.Fatalf("%v: exit %d %s", args, code, errOut)
		}
		return out
	}
	public := snippetIDFrom(t, must(aliceKey, "package main\n", "snippet", "create", "main.go", "--visibility", "public", "--description", "'hello world'", "--json"))
	unlisted := snippetIDFrom(t, must(aliceKey, "quiet\n", "snippet", "create", "q.txt", "--json"))
	private := snippetIDFrom(t, must(aliceKey, "secret\n", "snippet", "create", "s.txt", "--visibility", "private", "--json"))

	// Anonymous: the public list, the unlisted page by URL, 404 for private.
	status, body := inst.get(t, "/alice/-/snippets")
	if status != 200 || !strings.Contains(body, public) || strings.Contains(body, unlisted) || strings.Contains(body, private) {
		t.Fatalf("anonymous list: %d\n%s", status, body)
	}
	status, body = inst.get(t, "/alice/-/snippets/"+public)
	if status != 200 || !strings.Contains(body, "hello world") || !strings.Contains(body, `class="chroma"`) || !strings.Contains(body, "/raw/main.go") {
		t.Fatalf("public page: %d\n%s", status, body)
	}
	if status, _ := inst.get(t, "/alice/-/snippets/"+unlisted); status != 200 {
		t.Fatalf("unlisted page: %d", status)
	}
	if status, _ := inst.get(t, "/alice/-/snippets/"+private); status != 404 {
		t.Fatalf("private page for anonymous: %d", status)
	}
	if status, _ := inst.get(t, "/bob/-/snippets/"+public); status != 404 {
		t.Fatalf("id under the wrong owner: %d", status)
	}
	if status, _ := inst.get(t, "/nobody/-/snippets"); status != 404 {
		t.Fatalf("list for a missing owner: %d", status)
	}

	// Raw is text/plain with nosniff, whatever the extension.
	resp, err := http.Get(inst.base() + "/alice/-/snippets/" + public + "/raw/main.go")
	if err != nil {
		t.Fatal(err)
	}
	resp.Body.Close()
	if resp.StatusCode != 200 || !strings.HasPrefix(resp.Header.Get("Content-Type"), "text/plain") || resp.Header.Get("X-Content-Type-Options") != "nosniff" {
		t.Fatalf("raw headers: %d %v", resp.StatusCode, resp.Header)
	}
	if status, _ := inst.get(t, "/alice/-/snippets/" + public + "/raw/other.go"); status != 404 {
		t.Fatalf("raw for a missing file: %d", status)
	}

	// The owner sees everything with visibility marks; the owner page links.
	alice := inst.login(t, aliceKey)
	status, body = browserGet(t, alice, inst.base()+"/alice/-/snippets")
	if status != 200 || !strings.Contains(body, private) || !strings.Contains(body, ">private<") {
		t.Fatalf("owner list: %d\n%s", status, body)
	}
	if status, body := browserGet(t, alice, inst.base()+"/alice/-/snippets/"+private); status != 200 || !strings.Contains(body, "secret") {
		t.Fatalf("owner's private page: %d", status)
	}
	if status, body := inst.get(t, "/alice"); status != 200 || !strings.Contains(body, `href="/alice/-/snippets"`) {
		t.Fatalf("owner page lacks the snippets link: %d", status)
	}
	// bob has no public snippets and is not the viewer: no link.
	if status, body := inst.get(t, "/bob"); status != 200 || strings.Contains(body, `href="/bob/-/snippets"`) {
		t.Fatalf("bob's page shows a snippets link with nothing to list: %d", status)
	}

	_ = url.Values{}
	_ = bobKey
}
```

The last two lines keep the imports and `bobKey` used until Task 4 extends the test; Task 4 removes them.

- [ ] **Step 2: Run it to see it fail**

Run: `go test ./e2e -run 'TestSnippetsWeb$'`
Expected: FAIL at "anonymous list", status 404.

- [ ] **Step 3: Profile count**

In `internal/control/profile.go`, add to `ProfileOut` after `Repos`:

```go
	// Snippets counts the owner's snippets the caller may list: public
	// ones, or all of them for the owner and admins. Orgs own none.
	Snippets int `json:"snippets"`
```

In the `profile show` body, after the loop that fills `d.Repos` and before the activity counts, add:

```go
	if kind == "user" {
		all := id == c.User.ID || c.User.IsAdmin
		if d.Snippets, err = c.Store.CountSnippets(id, all); err != nil {
			return c.fail(protocol.ExitFailure, "%v", err)
		}
	}
```

(`kind` and `id` are the variables the surrounding code already uses for the owner's kind and row id; read the function and use its names.)

- [ ] **Step 4: Routes**

In `internal/httpd/routes.go`, after the `/{owner}/-/milestones` route add:

```go
		Route{Method: "GET", Pattern: "/{owner}/-/snippets", Handler: s.snippetsPage},
		Route{Method: "GET", Pattern: "/{owner}/-/snippets/{id}", Handler: s.snippetPage},
		Route{Method: "GET", Pattern: "/{owner}/-/snippets/{id}/raw/{name}", Handler: s.snippetRaw},
```

These are read routes, registered in every web mode; the literal `-` and `snippets` segments keep them from overlapping any `/{owner}/{repo}/...` pattern.

- [ ] **Step 5: Handlers**

Create `internal/httpd/snippets.go`:

```go
package httpd

import (
	"bytes"
	"html/template"
	"net/http"

	"gitbay.org/gitbay/internal/policy"
	"gitbay.org/gitbay/internal/store"
)

// snippetScope resolves the owner and id in the URL for the viewer. A
// missing owner, an id under another owner, and a private snippet the
// viewer may not read are all the same 404.
func (s *Server) snippetScope(w http.ResponseWriter, r *http.Request) (store.Snippet, store.User, bool) {
	viewer := s.viewer(r)
	sn, err := s.st.SnippetByPublicID(r.PathValue("id"))
	if err != nil || sn.OwnerName != r.PathValue("owner") || !policy.CanReadSnippet(viewer, sn) {
		s.notFound(w, r)
		return sn, viewer, false
	}
	return sn, viewer, true
}

type snippetRow struct {
	store.Snippet
	Names string
}

func (s *Server) snippetsPage(w http.ResponseWriter, r *http.Request) {
	viewer := s.viewer(r)
	owner, err := s.st.UserByUsername(r.PathValue("owner"))
	if err != nil {
		s.notFound(w, r)
		return
	}
	self := viewer.ID != 0 && viewer.ID == owner.ID
	all := self || viewer.IsAdmin
	list, err := s.st.ListSnippets(owner.ID, all, 0, 0)
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	rows := make([]snippetRow, 0, len(list))
	for _, sn := range list {
		var names bytes.Buffer
		for i, f := range sn.Files {
			if i > 0 {
				names.WriteString(", ")
			}
			names.WriteString(f.Name)
		}
		rows = append(rows, snippetRow{sn, names.String()})
	}
	s.render(w, "snippets.html", struct {
		basePage
		Owner    string
		Self     bool
		All      bool
		Snippets []snippetRow
		Notice   string
	}{s.baseFor(viewer), owner.Username, self, all, rows, s.takeFlash(w, r)})
}

type snippetFileView struct {
	Name    string
	Size    int64
	Lines   int
	Content string
	HTML    template.HTML
}

func (s *Server) snippetPage(w http.ResponseWriter, r *http.Request) {
	sn, viewer, ok := s.snippetScope(w, r)
	if !ok {
		return
	}
	files, err := s.st.SnippetFiles(sn.ID)
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	views := make([]snippetFileView, 0, len(files))
	for _, f := range files {
		lines := bytes.Count(f.Content, []byte("\n"))
		if len(f.Content) > 0 && f.Content[len(f.Content)-1] != '\n' {
			lines++
		}
		views = append(views, snippetFileView{f.Name, f.Size, lines, string(f.Content), highlight(f.Name, f.Content)})
	}
	s.render(w, "snippet.html", struct {
		basePage
		Owner    string
		Snippet  store.Snippet
		Files    []snippetFileView
		CanWrite bool
		Notice   string
	}{s.baseFor(viewer), sn.OwnerName, sn, views, policy.CanWriteSnippet(viewer, sn), s.takeFlash(w, r)})
}

// snippetRaw serves one file as text, inert on the forge's origin.
func (s *Server) snippetRaw(w http.ResponseWriter, r *http.Request) {
	sn, _, ok := s.snippetScope(w, r)
	if !ok {
		return
	}
	f, err := s.st.SnippetFile(sn.ID, r.PathValue("name"))
	if err != nil {
		s.notFound(w, r)
		return
	}
	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
	w.Header().Set("X-Content-Type-Options", "nosniff")
	w.Write(f.Content)
}
```

`s.viewer` reads the session cookie; in `view_only` mode there is never one, so the viewer is anonymous there without a mode check.

- [ ] **Step 6: Templates**

Create `internal/web/templates/snippets.html`:

```html
{{define "title"}}snippets · {{.Owner}}{{end}}
{{define "content"}}
<h1><a href="/{{.Owner}}">{{.Owner}}</a> snippets</h1>
{{if .Notice}}<p class="error" role="alert">{{.Notice}}</p>{{end}}
{{if .Self}}<p class="meta"><a href="/{{.Owner}}/-/snippets/new">new snippet</a> · or <code>gitbay snippet create &lt;file&gt; &lt; file</code></p>{{end}}
{{if .Snippets}}<div class="tablewrap"><table class="keys">
<tr class="cols"><th scope="col">snippet</th><th scope="col">files</th>{{if .All}}<th scope="col">visibility</th>{{end}}<th scope="col">updated</th></tr>
{{range .Snippets}}<tr>
  <td><a href="/{{$.Owner}}/-/snippets/{{.PublicID}}">{{if .Description}}{{.Description}}{{else}}{{.PublicID}}{{end}}</a></td>
  <td><span class="mono">{{.Names}}</span></td>
  {{if $.All}}<td><span class="chip chip-neutral">{{.Visibility}}</span></td>{{end}}
  <td>{{.UpdatedAt}}</td>
</tr>
{{end}}</table></div>
{{else}}<p class="none">No snippets yet.</p>{{end}}
{{end}}
```

Create `internal/web/templates/snippet.html` (the write forms come in Task 4; leave the `{{if .CanWrite}}` block out for now):

```html
{{define "title"}}{{if .Snippet.Description}}{{.Snippet.Description}}{{else}}{{.Snippet.PublicID}}{{end}} · {{.Owner}}{{end}}
{{define "content"}}
<h1><a href="/{{.Owner}}">{{.Owner}}</a> / <a href="/{{.Owner}}/-/snippets">snippets</a> / {{.Snippet.PublicID}}</h1>
{{if .Snippet.Description}}<p class="desc lede">{{.Snippet.Description}}</p>{{end}}
<p class="meta"><span class="chip chip-neutral">{{.Snippet.Visibility}}</span> · updated {{.Snippet.UpdatedAt}} · <code>gitbay snippet show {{.Snippet.PublicID}}</code></p>
{{if .Notice}}<p class="error" role="alert">{{.Notice}}</p>{{end}}
{{range .Files}}
<section class="snippetfile" id="file-{{.Name}}">
<div class="pathbar">
  <span class="crumbs"><strong>{{.Name}}</strong></span>
  <span class="spacer"></span>
  <span class="actions"><a href="/{{$.Owner}}/-/snippets/{{$.Snippet.PublicID}}/raw/{{.Name}}">raw</a></span>
</div>
<p class="filefacts">{{.Lines}} lines · {{.Size}} bytes</p>
<div class="code">{{.HTML}}</div>
</section>
{{end}}
{{end}}
```

- [ ] **Step 7: Owner page link**

In `internal/httpd/web.go`, in the `owner.html` page struct add `Snippets int` after `Self bool`, and in the literal pass `d.Snippets` after the `Self` expression (the `d.Kind == "user" && ...` line). In `internal/web/templates/owner.html`, after the `</ul>` that closes the repository list, add:

```html
{{if or .Snippets .Self}}<p class="meta"><a href="/{{.Owner}}/-/snippets">snippets{{if .Snippets}} <span class="count">{{.Snippets}}</span>{{end}}</a></p>{{end}}
```

- [ ] **Step 8: Build and run the tests**

Run: `go build ./... && go vet ./... && go test ./internal/httpd && go test ./e2e -run 'TestSnippetsWeb$'`
Expected: PASS. `internal/httpd`'s template tests check the new templates for unlabeled inputs (none yet) and route/reserved-name agreement (nothing new at the top level).

- [ ] **Step 9: Commit**

```bash
git add internal/httpd/snippets.go internal/httpd/routes.go internal/httpd/web.go internal/control/profile.go internal/web/templates/snippets.html internal/web/templates/snippet.html internal/web/templates/owner.html e2e/snippetweb_test.go
git commit -m "web: snippet pages

The owner's list, one snippet with highlighted files, and a raw route
under /{owner}/-/snippets. The owner page links when there is
something to list.

Ref #195"
```

---

### Task 4: Web writes

**Files:**
- Modify: `internal/httpd/snippets.go` (append the write handlers)
- Modify: `internal/httpd/routes.go` (the account-mode block, beside the `/bookmarks` routes)
- Modify: `internal/web/templates/snippet.html` (the `{{if .CanWrite}}` forms)
- Create: `internal/web/templates/snippetnew.html`
- Test: `e2e/snippetweb_test.go` (extend)

**Interfaces:**
- Consumes `snippetScope`, `control.SnippetOut`, `s.dispatchIntoStdin`, `s.runControlCode`, `s.runControlStdinCode`, `s.done`, `s.setFlash`, `statusForExit`.
- Produces the five POST handlers and the GET form named in the constraints.

- [ ] **Step 1: Extend the e2e test**

In `e2e/snippetweb_test.go`, replace the two placeholder lines (`_ = url.Values{}` and `_ = bobKey`) with:

```go
	// The create form makes a snippet through snippet create.
	status, body = browserPost(t, alice, inst.base()+"/alice/-/snippets/new", url.Values{
		"name": {"notes.md"}, "description": {"from the browser"}, "visibility": {"public"}, "content": {"# notes\n"}})
	if status != 200 || !strings.Contains(body, "from the browser") || !strings.Contains(body, "notes.md") {
		t.Fatalf("create form: %d\n%s", status, body)
	}
	var listed struct {
		Data []struct {
			ID          string `json:"id"`
			Description string `json:"description"`
		} `json:"data"`
	}
	json.Unmarshal([]byte(must(aliceKey, "", "snippet", "list", "--json")), &listed)
	created := ""
	for _, sn := range listed.Data {
		if sn.Description == "from the browser" {
			created = sn.ID
		}
	}
	if created == "" {
		t.Fatalf("created from the web, not listed: %+v", listed.Data)
	}
	if status, _ := browserGet(t, alice, inst.base()+"/bob/-/snippets/new"); status != 404 {
		t.Fatalf("new form under another owner: %d", status)
	}

	// The file form replaces a file and adds one; remove drops it.
	page := inst.base() + "/alice/-/snippets/" + created
	if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"notes.md"}, "content": {"# changed\n"}}); status != 200 {
		t.Fatal("file replace failed")
	}
	if got := must(aliceKey, "", "snippet", "file", "get", created, "notes.md"); got != "# changed\n" {
		t.Fatalf("after web replace: %q", got)
	}
	if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"b.txt"}, "content": {"b\n"}}); status != 200 {
		t.Fatal("file add failed")
	}
	if status, _ := browserPost(t, alice, page+"/file/remove", url.Values{"name": {"b.txt"}}); status != 200 {
		t.Fatal("file remove failed")
	}
	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "file", "get", created, "b.txt"); code != 3 {
		t.Fatalf("b.txt after web remove: exit %d", code)
	}
	// A refusal comes back on the page as a message, not a bare error.
	_, body = browserPost(t, alice, page+"/file/remove", url.Values{"name": {"notes.md"}})
	if !strings.Contains(body, `class="error"`) || !strings.Contains(body, "at least one file") {
		t.Fatalf("last-file refusal on the page:\n%s", body)
	}

	// Edit changes visibility; delete removes.
	if status, _ := browserPost(t, alice, page+"/edit", url.Values{"description": {"renamed"}, "visibility": {"private"}}); status != 200 {
		t.Fatal("edit failed")
	}
	if status, _ := inst.get(t, "/alice/-/snippets/"+created); status != 404 {
		t.Fatalf("private after web edit, anonymous: %d", status)
	}
	// bob cannot write alice's snippet from the browser either.
	bob := inst.login(t, bobKey)
	if status, _ := browserPost(t, bob, inst.base()+"/alice/-/snippets/"+public+"/edit", url.Values{"description": {"x"}, "visibility": {"public"}}); status != 403 {
		t.Fatalf("bob editing alice's snippet: %d", status)
	}
	if status, _ := browserPost(t, alice, page+"/delete", nil); status != 200 {
		t.Fatal("delete failed")
	}
	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "show", created); code != 3 {
		t.Fatalf("after web delete: exit %d", code)
	}
```

`browserPost` follows redirects, so a successful form lands on the page it redirects to with status 200 and the page's body. The id of the snippet the form made comes from `snippet list --json`, matched by its description.

- [ ] **Step 2: Run it to see it fail**

Run: `go test ./e2e -run 'TestSnippetsWeb$'`
Expected: FAIL at "create form" with 404 or 405.

- [ ] **Step 3: Routes**

In `internal/httpd/routes.go`, inside the `web.mode == "accounts"` block, after the `/bookmarks` GET route add:

```go
			Route{Method: "GET", Pattern: "/{owner}/-/snippets/new", Handler: s.requireUser(s.snippetNewForm)},
			Route{Method: "POST", Pattern: "/{owner}/-/snippets/new", Mutating: true,
				Handler: s.checkOrigin(s.requireUser(s.snippetNewSubmit))},
			Route{Method: "POST", Pattern: "/{owner}/-/snippets/{id}/edit", Mutating: true,
				Handler: s.checkOrigin(s.requireUser(s.snippetEditSubmit))},
			Route{Method: "POST", Pattern: "/{owner}/-/snippets/{id}/delete", Mutating: true,
				Handler: s.checkOrigin(s.requireUser(s.snippetDeleteSubmit))},
			Route{Method: "POST", Pattern: "/{owner}/-/snippets/{id}/file", Mutating: true,
				Handler: s.checkOrigin(s.requireUser(s.snippetFileSubmit))},
			Route{Method: "POST", Pattern: "/{owner}/-/snippets/{id}/file/remove", Mutating: true,
				Handler: s.checkOrigin(s.requireUser(s.snippetFileRemoveSubmit))},
```

`GET /{owner}/-/snippets/new` and `GET /{owner}/-/snippets/{id}` both match `/x/-/snippets/new`; the literal segment is more specific, so the mux picks the form.

- [ ] **Step 4: Handlers**

Append to `internal/httpd/snippets.go` (add `"strings"`, `"gitbay.org/gitbay/internal/control"` and `"gitbay.org/gitbay/internal/protocol"` to its imports):

```go
// snippetNewForm is the owner's own page only: the URL names the owner
// and a snippet cannot be created for someone else.
func (s *Server) snippetNewForm(w http.ResponseWriter, r *http.Request, u store.User) {
	if r.PathValue("owner") != u.Username {
		s.notFound(w, r)
		return
	}
	s.render(w, "snippetnew.html", struct {
		basePage
		Owner string
	}{s.baseFor(u), u.Username})
}

func (s *Server) snippetNewSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
	if r.PathValue("owner") != u.Username {
		s.notFound(w, r)
		return
	}
	argv := []string{"snippet", "create", strings.TrimSpace(r.FormValue("name")),
		"--description", strings.TrimSpace(r.FormValue("description")),
		"--visibility", r.FormValue("visibility")}
	var out control.SnippetOut
	code, msg := s.dispatchIntoStdin(u, argv, r.FormValue("content"), &out)
	if code != protocol.ExitOK {
		http.Error(w, msg, statusForExit(code))
		return
	}
	http.Redirect(w, r, "/"+u.Username+"/-/snippets/"+out.ID, http.StatusSeeOther)
}

// snippetAction runs a write on the snippet in the URL and returns to
// its page with the message, or to the list after a delete. A snippet
// the viewer may not read is the 404 page, as on every read.
func (s *Server) snippetAction(w http.ResponseWriter, r *http.Request, u store.User, argv []string, stdin string, dest string) {
	sn, _, ok := s.snippetScope(w, r)
	if !ok {
		return
	}
	if dest == "" {
		dest = "/" + sn.OwnerName + "/-/snippets/" + sn.PublicID
	}
	back := func(w http.ResponseWriter, r *http.Request, msg string) {
		s.setFlash(w, msg)
		http.Redirect(w, r, dest, http.StatusSeeOther)
	}
	var msg string
	var code int
	if stdin == "" {
		_, msg, code = s.runControlCode(u, argv)
	} else {
		msg, code = s.runControlStdinCode(u, argv, stdin)
	}
	if code == protocol.ExitDenied {
		http.Error(w, msg, http.StatusForbidden)
		return
	}
	s.done(w, r, code, msg, back)
}

func (s *Server) snippetEditSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
	s.snippetAction(w, r, u, []string{"snippet", "edit", r.PathValue("id"),
		"--description", strings.TrimSpace(r.FormValue("description")),
		"--visibility", r.FormValue("visibility")}, "", "")
}

func (s *Server) snippetDeleteSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
	s.snippetAction(w, r, u, []string{"snippet", "delete", r.PathValue("id")}, "",
		"/"+r.PathValue("owner")+"/-/snippets")
}

// An empty textarea reaches the command as empty stdin, which it refuses;
// the message lands on the page like any other.
func (s *Server) snippetFileSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
	s.snippetAction(w, r, u, []string{"snippet", "file", "set", r.PathValue("id"), strings.TrimSpace(r.FormValue("name"))},
		r.FormValue("content"), "")
}

func (s *Server) snippetFileRemoveSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
	s.snippetAction(w, r, u, []string{"snippet", "file", "remove", r.PathValue("id"), strings.TrimSpace(r.FormValue("name"))}, "", "")
}
```

The denied branch answers 403 rather than a redirect because the viewer can read the page but not change it; the e2e test asserts it. Browsers send `\r\n` from a textarea; the command stores what it receives, which is what the raw route serves back. Do not normalise.

- [ ] **Step 5: Templates**

Create `internal/web/templates/snippetnew.html`:

```html
{{define "title"}}new snippet · {{.Owner}}{{end}}
{{define "content"}}
<h1>New snippet</h1>
<form method="post" action="/{{.Owner}}/-/snippets/new" class="commentform">
<p><input type="text" name="name" aria-label="File name" placeholder="filename" required></p>
<p><input type="text" name="description" aria-label="Description" placeholder="description"></p>
<p><select name="visibility" aria-label="Visibility"><option value="unlisted">unlisted</option><option value="public">public</option><option value="private">private</option></select></p>
<p><textarea name="content" aria-label="Content" rows="16" required></textarea></p>
<p><button type="submit">Create snippet</button></p>
</form>
{{end}}
```

In `internal/web/templates/snippet.html`, inside the `{{range .Files}}` section after `<div class="code">{{.HTML}}</div>`, add:

```html
{{if $.CanWrite}}<details class="editbox"><summary>edit {{.Name}}</summary>
<form method="post" action="/{{$.Owner}}/-/snippets/{{$.Snippet.PublicID}}/file" class="commentform">
<input type="hidden" name="name" value="{{.Name}}">
<p><textarea name="content" aria-label="Content of {{.Name}}" rows="12">{{.Content}}</textarea></p>
<p><button type="submit">Save</button></p>
</form>
<form method="post" action="/{{$.Owner}}/-/snippets/{{$.Snippet.PublicID}}/file/remove">
<input type="hidden" name="name" value="{{.Name}}">
<p><button type="submit">Remove {{.Name}}</button></p>
</form>
</details>{{end}}
```

and after the `{{end}}` that closes the range, before the final `{{end}}`:

```html
{{if .CanWrite}}
<details class="editbox"><summary>add a file</summary>
<form method="post" action="/{{.Owner}}/-/snippets/{{.Snippet.PublicID}}/file" class="commentform">
<p><input type="text" name="name" aria-label="File name" placeholder="filename" required></p>
<p><textarea name="content" aria-label="Content" rows="12" required></textarea></p>
<p><button type="submit">Add file</button></p>
</form></details>
<details class="editbox"><summary>settings</summary>
<form method="post" action="/{{.Owner}}/-/snippets/{{.Snippet.PublicID}}/edit">
<p><input type="text" name="description" aria-label="Description" value="{{.Snippet.Description}}" placeholder="description"></p>
<p><select name="visibility" aria-label="Visibility">
<option value="public"{{if eq .Snippet.Visibility "public"}} selected{{end}}>public</option>
<option value="unlisted"{{if eq .Snippet.Visibility "unlisted"}} selected{{end}}>unlisted</option>
<option value="private"{{if eq .Snippet.Visibility "private"}} selected{{end}}>private</option>
</select></p>
<p><button type="submit">Save</button></p>
</form>
<form method="post" action="/{{.Owner}}/-/snippets/{{.Snippet.PublicID}}/delete">
<p><button type="submit">Delete snippet</button></p>
</form>
</details>
{{end}}
```

If `.editbox` or `.commentform` render poorly beside `.code`, add a `.snippetfile { margin-bottom: 1.5rem }` rule to `internal/web/static/style.css`; nothing more.

- [ ] **Step 6: Build and run the tests**

Run: `go build ./... && go vet ./... && go test ./internal/httpd && go test ./e2e -run 'TestSnippetsWeb$'`
Expected: PASS. `internal/httpd` carries the structural checks: `TestMutatingRoutesRequireCheckOrigin` (every `Mutating` route is wrapped in `checkOrigin`), `TestViewOnlyHasNoMutatingRoutes` (the POST routes sit inside the accounts block), and the input-label test on `snippetnew.html` and the new forms.

- [ ] **Step 7: Commit**

```bash
git add internal/httpd/snippets.go internal/httpd/routes.go internal/web/templates/snippet.html internal/web/templates/snippetnew.html e2e/snippetweb_test.go
git commit -m "web: create, edit and delete snippets

Every form dispatches the snippet command the CLI runs.

Ref #195"
```

---

### Task 5: Documentation and changelog

**Files:**
- Modify: `.gitbay/wiki/Users.org` (a `* Snippets` section after `* Pages`, before `* Browser sessions`)
- Modify: `.gitbay/wiki/Parity.org` (rows after `release asset remove`)
- Modify: `.gitbay/wiki/Admin.org:116` (the `[limits]` list)
- Modify: `CHANGELOG.org` (a new top entry)

- [ ] **Step 1: Users.org**

Insert before `* Browser sessions`:

```org
* Snippets

A snippet is one or more named text files you own outside any
repository, for a log or a fragment shared by URL. Create one from a
file on stdin; the reply is the id and the URL:

#+begin_src sh
gitbay snippet create build.log --description "failing build" < build.log
gitbay snippet file set <id> notes.txt < notes.txt   # add or replace a file
gitbay snippet file get <id> build.log > build.log
gitbay snippet edit <id> --visibility public
gitbay snippet list                                  # yours
gitbay snippet list <owner>                          # their public ones
gitbay snippet delete <id>
#+end_src

Visibility is =public= (listed on your page), =unlisted= (anyone with
the URL, listed nowhere; the default) or =private= (you alone; not
found to everyone else). Files are text, valid UTF-8, each under the
instance's =max_snippet_bytes=, at most 64 per snippet. A snippet keeps
at least one file. There is no history: setting a file replaces it.

On the web, =/<you>/-/snippets= lists yours, each snippet page renders
its files with a raw link per file, and the same page creates, edits
and deletes through the commands above.
```

- [ ] **Step 2: Parity.org**

After the `release asset remove` row add:

```org
| snippet create, edit, delete | yes | yes | no  |
| snippet show, list          | yes | yes | no  |
| snippet file set, get, remove | yes | yes | no  |
```

Match the table's column alignment by hand; org tables tolerate ragged cells but the page is read raw too.

- [ ] **Step 3: Admin.org**

After the `max_asset_bytes` line in `** [limits]` add:

```org
- =max_snippet_bytes= (1MB) — cap per snippet file.
```

- [ ] **Step 4: CHANGELOG.org**

Before `* v1.19.0 — 2026-09-11` add:

```org
* v1.20.0 — unreleased

Snippets (#195): named text files a user owns outside any repository,
shared by URL and edited in place.

- Migration 0054: =snippets= and =snippet_files=.
- =snippet create|show|list|edit|delete= and =snippet file
  set|get|remove=. Files are UTF-8 under =limits.max_snippet_bytes=
  (1MB), at most 64 per snippet; a snippet keeps at least one.
  Visibility =public=, =unlisted= (default) or =private=; a private
  snippet is not found to everyone but its owner and admins.
- Web: =/<owner>/-/snippets= lists, each snippet page renders its
  files with a raw route per file, and the owner creates, edits and
  deletes from the page through the same commands. The owner page
  links to the list.
```

- [ ] **Step 5: Commit**

```bash
git add .gitbay/wiki/Users.org .gitbay/wiki/Parity.org .gitbay/wiki/Admin.org CHANGELOG.org
git commit -m "wiki, CHANGELOG: snippets

Closes #195"
```

---

### Task 6: Merge request

- [ ] **Step 1: Push and open the MR**

```bash
git push -u origin snippets
gitbay mr create --source snippets --target main --title "Snippets (#195)" --file - <<'EOF'
Named text files a user owns outside any repository, shared by URL and
edited in place. Spec: docs/specs/2026-09-11-snippets-design.md.

Migration 0054. Commands snippet create|show|list|edit|delete and
snippet file set|get|remove; web under /{owner}/-/snippets with forms
dispatching the same commands. New limit max_snippet_bytes (1MB).

Closes #195
EOF
```

- [ ] **Step 2: Wait for CI, then merge**

Check `gitbay build list --json` until the build for the branch head succeeds; read `gitbay build log <n>` on failure and fix on the branch. Then:

```bash
gitbay mr merge <n> --strategy ff
git push origin --delete snippets
```

and remove the worktree and branch locally after the merge lands.