Take the signature, the expiry and the URL scheme off the image request (closes #314)

The image request now holds only its source and its transform, exactly what
the variant key covers. The /v1/image/ handler checks the allowlist and
verifies the signature itself with Signer.Verify(req, sig, expires). Both
image handlers keep the URL's expiry as a local value for Cache-Control. The
image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is
gone. The fetcher takes the source and builds its URL with Source.URL from its
own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat
returns the format it chooses instead of writing into the request. The signed
URL format and every route's answers are unchanged.

Model: opus-5-5

internal/encurl/encurl.go

@@ -59,12 +59,14 @@ func NewGenerator(signingKey string) (*Generator, error) {
 	return &Generator{key: key}, nil
 }
 
-// Generate creates an encrypted URL token from the request's source,
-// transform and expiry, each as the request holds it; an empty format, a
-// quality of 0 or an empty fit mode is left out of the token, and a zero
-// Expires makes a token that never expires. The token is CBOR-encoded,
+// Generate creates an encrypted URL token from the request's source and
+// transform, each as the request holds it, and from expires; an empty format,
+// a quality of 0 or an empty fit mode is left out of the token, and a zero
+// expires makes a token that never expires. The token is CBOR-encoded,
 // encrypted with NaCl secretbox, and base64url-encoded.
-func (g *Generator) Generate(req *imagerequest.Request) (string, error) {
+func (g *Generator) Generate(
+	req *imagerequest.Request, expires time.Time,
+) (string, error) {
 	p := &payload{
 		SourceHost:  req.Source.Host,
 		SourcePath:  req.Source.Path,
@@ -76,8 +78,8 @@ func (g *Generator) Generate(req *imagerequest.Request) (string, error) {
 		FitMode:     req.Transform.FitMode,
 	}
 
-	if !req.Expires.IsZero() {
-		p.ExpiresAt = req.Expires.Unix()
+	if !expires.IsZero() {
+		p.ExpiresAt = expires.Unix()
 	}
 
 	// CBOR encode the payload
@@ -91,19 +93,19 @@ func (g *Generator) Generate(req *imagerequest.Request) (string, error) {
 }
 
 // Parse decrypts and validates an encrypted URL token and returns the
-// request it holds, with default values for omitted optional fields. A token
-// that never expires gives the zero Expires.
+// request it holds, with default values for omitted optional fields, and its
+// expiry. A token that never expires gives the zero time.
 // Returns ErrExpired if the token has expired, or other errors for invalid tokens.
-func (g *Generator) Parse(token string) (*imagerequest.Request, error) {
+func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error) {
 	// Decrypt
 	data, err := seal.Decrypt(g.key, token)
 	if err != nil {
 		if errors.Is(err, seal.ErrDecryptionFailed) ||
 			errors.Is(err, seal.ErrInvalidPayload) {
-			return nil, ErrDecryptFailed
+			return nil, time.Time{}, ErrDecryptFailed
 		}
 
-		return nil, err
+		return nil, time.Time{}, err
 	}
 
 	// CBOR decode
@@ -111,12 +113,12 @@ func (g *Generator) Parse(token string) (*imagerequest.Request, error) {
 
 	err = cbor.Unmarshal(data, &p)
 	if err != nil {
-		return nil, ErrInvalidFormat
+		return nil, time.Time{}, ErrInvalidFormat
 	}
 
 	// Check expiration (0 = never expires)
 	if p.ExpiresAt != 0 && time.Now().Unix() > p.ExpiresAt {
-		return nil, ErrExpired
+		return nil, time.Time{}, ErrExpired
 	}
 
 	format := p.Format
@@ -151,6 +153,5 @@ func (g *Generator) Parse(token string) (*imagerequest.Request, error) {
 			Quality: quality,
 			FitMode: fitMode,
 		},
-		Expires: expires,
-	}, nil
+	}, expires, nil
 }

internal/encurl/encurl_test.go

@@ -36,10 +36,10 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 			Quality: 90,
 			FitMode: imagerequest.FitContain,
 		},
-		Expires: time.Now().Add(time.Hour),
 	}
+	expires := time.Now().Add(time.Hour)
 
-	token, err := gen.Generate(req)
+	token, err := gen.Generate(req, expires)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -48,7 +48,7 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 		t.Fatal("Generate() returned empty token")
 	}
 
-	parsed, err := gen.Parse(token)
+	parsed, parsedExpires, err := gen.Parse(token)
 	if err != nil {
 		t.Fatalf("Parse() error = %v", err)
 	}
@@ -91,8 +91,8 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 			parsed.Transform.FitMode, req.Transform.FitMode)
 	}
 
-	if parsed.Expires.Unix() != req.Expires.Unix() {
-		t.Errorf("ExpiresAt = %d, want %d", parsed.Expires.Unix(), req.Expires.Unix())
+	if parsedExpires.Unix() != expires.Unix() {
+		t.Errorf("ExpiresAt = %d, want %d", parsedExpires.Unix(), expires.Unix())
 	}
 }
 
@@ -106,15 +106,14 @@ func TestGenerator_Parse_Expired(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-		Expires: time.Now().Add(-time.Hour), // Already expired
 	}
 
-	token, err := gen.Generate(req)
+	token, err := gen.Generate(req, time.Now().Add(-time.Hour)) // Already expired
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	_, err = gen.Parse(token)
+	_, _, err = gen.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail for expired token")
 	}
@@ -129,7 +128,7 @@ func TestGenerator_Parse_InvalidToken(t *testing.T) {
 
 	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	_, err := gen.Parse("not-a-valid-token")
+	_, _, err := gen.Parse("not-a-valid-token")
 	if err == nil {
 		t.Error("Parse() should fail for invalid token")
 	}
@@ -145,10 +144,9 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen.Generate(req)
+	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
 
 	// Tamper with the token
 	tampered := []byte(token)
@@ -156,7 +154,7 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 		tampered[10] ^= 0x01
 	}
 
-	_, err := gen.Parse(string(tampered))
+	_, _, err := gen.Parse(string(tampered))
 	if err == nil {
 		t.Error("Parse() should fail for tampered token")
 	}
@@ -173,12 +171,11 @@ func TestGenerator_Parse_WrongKey(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen1.Generate(req)
+	token, _ := gen1.Generate(req, time.Now().Add(time.Hour))
 
-	_, err := gen2.Parse(token)
+	_, _, err := gen2.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail with different signing key")
 	}
@@ -195,13 +192,12 @@ func TestGenerator_Parse_Defaults(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-		Expires: time.Now().Add(time.Hour),
-	})
+	}, time.Now().Add(time.Hour))
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	req, err := gen.Parse(token)
+	req, _, err := gen.Parse(token)
 	if err != nil {
 		t.Fatalf("Parse() error = %v", err)
 	}
@@ -232,10 +228,9 @@ func TestGenerator_TokenIsURLSafe(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen.Generate(req)
+	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
 
 	// Check that token only contains URL-safe characters
 	for _, c := range token {