Take the signature, the expiry and the URL scheme off the image request (closes #314)

The image request now holds only its source and its transform, exactly what
the variant key covers. The /v1/image/ handler checks the allowlist and
verifies the signature itself with Signer.Verify(req, sig, expires). Both
image handlers keep the URL's expiry as a local value for Cache-Control. The
image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is
gone. The fetcher takes the source and builds its URL with Source.URL from its
own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat
returns the format it chooses instead of writing into the request. The signed
URL format and every route's answers are unchanged.

Model: opus-5-5

internal/httpfetcher/httpfetcher.go

@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
+	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // Fetcher configuration constants.
@@ -91,8 +92,8 @@ var (
 
 // Fetcher retrieves content from upstream origins.
 type Fetcher interface {
-	// Fetch retrieves content from the given URL.
-	Fetch(ctx context.Context, url string) (*FetchResult, error)
+	// Fetch retrieves the content of the source image.
+	Fetch(ctx context.Context, source imagerequest.Source) (*FetchResult, error)
 }
 
 // FetchResult contains the result of fetching from upstream.
@@ -139,7 +140,8 @@ type Config struct {
 	Timeout time.Duration
 	// MaxResponseSize is the maximum allowed response body size.
 	MaxResponseSize int64
-	// AllowHTTP allows non-TLS connections (for testing only).
+	// AllowHTTP makes the fetcher fetch sources over http instead of https,
+	// and follow redirects to http (for testing only).
 	AllowHTTP bool
 	// MaxConnectionsPerHost limits concurrent connections to each upstream host.
 	MaxConnectionsPerHost int
@@ -211,7 +213,7 @@ func New(config *Config) *HTTPFetcher {
 			}
 
 			// Validate the redirect target
-			err := validateURL(req.Context(), req.URL.String(), config.AllowHTTP)
+			err := validateURL(req.Context(), req.URL, config.AllowHTTP)
 			if err != nil {
 				return fmt.Errorf("redirect blocked: %w", err)
 			}
@@ -229,18 +231,22 @@ func New(config *Config) *HTTPFetcher {
 	}
 }
 
-// Fetch retrieves content from the given URL with SSRF protection. When
-// MaxConnections fetches are already in progress, it waits up to
-// ConnectionWaitTimeout for one to finish, then fails with
-// ErrTooManyConnections.
-func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, error) {
+// Fetch retrieves the source image with SSRF protection, over https, or over
+// http when AllowHTTP is set. When MaxConnections fetches are already in
+// progress, it waits up to ConnectionWaitTimeout for one to finish, then
+// fails with ErrTooManyConnections.
+func (f *HTTPFetcher) Fetch(
+	ctx context.Context, source imagerequest.Source,
+) (*FetchResult, error) {
+	sourceURL := source.URL(f.config.AllowHTTP)
+
 	// Validate URL before making request
-	err := validateURL(ctx, url, f.config.AllowHTTP)
+	err := validateURL(ctx, sourceURL, f.config.AllowHTTP)
 	if err != nil {
 		return nil, err
 	}
 
-	release, err := f.acquireConnection(ctx, extractHost(url))
+	release, err := f.acquireConnection(ctx, source.Host)
 	if err != nil {
 		return nil, err
 	}
@@ -254,14 +260,9 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 		}
 	}()
 
-	parsedURL, err := neturl.Parse(url)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse URL: %w", err)
-	}
-
 	req := &http.Request{
 		Method: http.MethodGet,
-		URL:    parsedURL,
+		URL:    sourceURL,
 		Header: make(http.Header),
 	}
 
@@ -455,19 +456,14 @@ func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 }
 
 // validateURL checks if a URL is safe to fetch (not internal/private).
-func validateURL(ctx context.Context, rawURL string, allowHTTP bool) error {
-	if !allowHTTP && !strings.HasPrefix(rawURL, "https://") {
+func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) error {
+	if !allowHTTP && fetchURL.Scheme != "https" {
 		return ErrUnsupportedScheme
 	}
 
-	parsedURL, err := neturl.Parse(rawURL)
-	if err != nil {
-		return fmt.Errorf("%w: %w", ErrInvalidHost, err)
-	}
-
 	// Hostname drops any port, and the brackets of an IPv6 address whether
 	// or not a port follows them
-	host := parsedURL.Hostname()
+	host := fetchURL.Hostname()
 	if host == "" {
 		return ErrInvalidHost
 	}
@@ -493,25 +489,6 @@ func validateURL(ctx context.Context, rawURL string, allowHTTP bool) error {
 	return nil
 }
 
-// extractHost extracts the host from a URL string.
-func extractHost(rawURL string) string {
-	// Simple extraction without full URL parsing
-	url := rawURL
-	if idx := strings.Index(url, "://"); idx != -1 {
-		url = url[idx+3:]
-	}
-
-	if idx := strings.Index(url, "/"); idx != -1 {
-		url = url[:idx]
-	}
-
-	if idx := strings.Index(url, "?"); idx != -1 {
-		url = url[:idx]
-	}
-
-	return url
-}
-
 // isLocalhost checks if the host is localhost.
 func isLocalhost(host string) bool {
 	host = strings.ToLower(host)