Take the signature, the expiry and the URL scheme off the image request (closes #314)

The image request now holds only its source and its transform, exactly what
the variant key covers. The /v1/image/ handler checks the allowlist and
verifies the signature itself with Signer.Verify(req, sig, expires). Both
image handlers keep the URL's expiry as a local value for Cache-Control. The
image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is
gone. The fetcher takes the source and builds its URL with Source.URL from its
own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat
returns the format it chooses instead of writing into the request. The signed
URL format and every route's answers are unchanged.

Model: opus-5-5

internal/imagerequest/imagerequest.go

@@ -1,13 +1,12 @@
 // Package imagerequest holds the image request type, its parts, its checks,
-// the parsing of the /v1/image/ path, the variant key and the source key. It
-// imports no other package of this repo, so every package that handles an
-// image request can import it.
+// the parsing of the /v1/image/ path, the variant key, the source key and the
+// source's upstream URL. It imports no other package of this repo, so every
+// package that handles an image request can import it.
 package imagerequest
 
 import (
 	"errors"
 	"net/url"
-	"time"
 )
 
 // ErrInvalidFitMode is returned when an invalid fit mode is provided.
@@ -85,19 +84,13 @@ func ValidateImageRequest(req *Request) error {
 }
 
 // Request represents a request for a processed image: the source to fetch
-// and the transform to apply to it.
+// and the transform to apply to it. It holds exactly what the variant key
+// covers.
 type Request struct {
 	// Source is what to fetch
 	Source Source
 	// Transform is what to do to it
 	Transform Transform
-	// Signature is the HMAC signature for non-allowlisted hosts
-	Signature string
-	// Expires is when the URL expires: the exp of a signed URL, or the expiry
-	// of an encrypted URL; the zero time if it has none
-	Expires time.Time
-	// AllowHTTP indicates whether HTTP (non-TLS) is allowed for this request
-	AllowHTTP bool
 }
 
 // Source is the image a request fetches from the origin.
@@ -125,23 +118,20 @@ type Transform struct {
 	FitMode Fit
 }
 
-// SourceURL returns the full upstream URL to fetch: the source path
-// percent-encoded again, as net/url writes a path, so each source path is one
-// upstream path, and the source query as it is, with the characters
-// escapeQuery encodes percent-encoded. Uses http:// scheme when AllowHTTP is
-// true, otherwise https://.
-func (r *Request) SourceURL() string {
+// URL returns the source's upstream URL, with the scheme http when allowHTTP
+// is true and https otherwise. net/url writes its path percent-encoded again,
+// so each source path is one upstream path. Its query is the source query as
+// it is, with the characters escapeQuery encodes percent-encoded.
+func (s Source) URL(allowHTTP bool) *url.URL {
 	scheme := "https"
-	if r.AllowHTTP {
+	if allowHTTP {
 		scheme = "http"
 	}
 
-	sourceURL := url.URL{
+	return &url.URL{
 		Scheme:   scheme,
-		Host:     r.Source.Host,
-		Path:     r.Source.Path,
-		RawQuery: escapeQuery(r.Source.Query),
+		Host:     s.Host,
+		Path:     s.Path,
+		RawQuery: escapeQuery(s.Query),
 	}
-
-	return sourceURL.String()
 }

internal/imagerequest/sourceurl_internal_test.go

@@ -2,57 +2,49 @@ package imagerequest
 
 import "testing"
 
-func TestRequest_SourceURL_DefaultHTTPS(t *testing.T) {
+func TestSource_URL_DefaultHTTPS(t *testing.T) {
 	t.Parallel()
 
-	req := &Request{
-		Source: Source{
-			Host:  testHostCDN,
-			Path:  testPathCat,
-			Query: "v=2",
-		},
+	source := Source{
+		Host:  testHostCDN,
+		Path:  testPathCat,
+		Query: "v=2",
 	}
 
-	got := req.SourceURL()
+	got := source.URL(false).String()
 
 	want := "https://cdn.example.com/photos/cat.jpg?v=2"
 	if got != want {
-		t.Errorf("SourceURL() = %q, want %q", got, want)
+		t.Errorf("URL() = %q, want %q", got, want)
 	}
 }
 
-func TestRequest_SourceURL_AllowHTTP(t *testing.T) {
+func TestSource_URL_AllowHTTP(t *testing.T) {
 	t.Parallel()
 
-	req := &Request{
-		Source: Source{
-			Host: "localhost:8080",
-			Path: testPathCat,
-		},
-		AllowHTTP: true,
+	source := Source{
+		Host: "localhost:8080",
+		Path: testPathCat,
 	}
 
-	got := req.SourceURL()
+	got := source.URL(true).String()
 
 	want := "http://localhost:8080/photos/cat.jpg"
 	if got != want {
-		t.Errorf("SourceURL() = %q, want %q", got, want)
+		t.Errorf("URL() = %q, want %q", got, want)
 	}
 }
 
-func TestRequest_SourceURL_AllowHTTPFalse(t *testing.T) {
+func TestSource_URL_AllowHTTPFalse(t *testing.T) {
 	t.Parallel()
 
-	req := &Request{
-		Source: Source{
-			Host: testHostCDN,
-			Path: "/img.jpg",
-		},
-		AllowHTTP: false,
+	source := Source{
+		Host: testHostCDN,
+		Path: "/img.jpg",
 	}
 
-	got := req.SourceURL()
+	got := source.URL(false).String()
 	if got != "https://cdn.example.com/img.jpg" {
-		t.Errorf("SourceURL() = %q, want https scheme", got)
+		t.Errorf("URL() = %q, want https scheme", got)
 	}
 }

internal/imagerequest/urlparser.go

@@ -126,15 +126,15 @@ func parseImageComponents(remainder string) (*Request, error) {
 		return nil, ErrMissingHost
 	}
 
-	// Only the forms hostRegex describes are accepted. A "?", "#" or "@" in
-	// the host would make Go's URL parser, which the allowlist check and the
-	// fetcher use, read a different host from the one allowlisted and cached
+	// Later steps put the host unparsed into the allowlist check, the cache key
+	// and the upstream URL, so only the forms hostRegex describes are accepted
 	hostMatch := hostRegex.FindStringSubmatch(host)
 	if hostMatch == nil {
 		return nil, fmt.Errorf("%w: %q", ErrInvalidHost, host)
 	}
 
-	// Go's URL parser refuses brackets around anything but an IPv6 address
+	// The allowlist check and the fetcher drop the brackets, so brackets
+	// around anything but an IPv6 address would give a host a second spelling
 	if inBrackets := hostMatch[1]; inBrackets != "" {
 		addr, err := netip.ParseAddr(inBrackets)
 		if err != nil || !addr.Is6() {
@@ -147,9 +147,8 @@ func parseImageComponents(remainder string) (*Request, error) {
 	// host
 	host = strings.ToLower(host)
 
-	// Go's URL parser, which the fetcher uses, reads a "#" as the start of a
-	// fragment and drops the rest, so each text after it would be another
-	// spelling, cached under its own keys, of one upstream request
+	// A "#" starts a URL's fragment, so neither the source path nor the source
+	// query may hold one
 	if strings.Contains(path, "#") {
 		return nil, fmt.Errorf(
 			`%w: the source path or query holds a "#"`, ErrInvalidPath)