Remove the code nothing in production calls (closes #312)

Service.Warm, the ImageCache interface, both GenerateSignedURL methods,
signature.ParseParams, three functions of internal/magic, the image
processor's lists of supported formats, IsEmpty and Count of the
allowlist, ssrfSafeDialer, CacheStale, ErrCacheMiss, ErrNegativeCache,
ImageResponse.LastModified and VariantStorage.Load had no caller outside
tests. They are gone, with the tests that tested only them.

The handlers tests sign their image URLs with generateSignedURL, a test
helper that builds the URL as the removed generator did. The SSRF dialer
tests call dialSSRFSafe with no operator blocklist, which is all
ssrfSafeDialer did. ParseImageURL, MIMEToImageFormat, ContentStorage.Store
and CleanExpired stay, as pixa calls them.

Model: opus-5-5

internal/signature/signature.go

@@ -8,8 +8,6 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"net/url"
-	"strconv"
 	"strings"
 	"time"
 
@@ -79,44 +77,6 @@ func (s *Signer) Verify(req *imagerequest.Request) error {
 	return nil
 }
 
-// GenerateSignedURL creates a complete URL with signature and expiration.
-// Returns the path portion that should be appended to the base URL.
-func (s *Signer) GenerateSignedURL(
-	req *imagerequest.Request, ttl time.Duration,
-) (string, string, int64) {
-	// Set expiration
-	req.Expires = time.Now().Add(ttl)
-	exp := req.Expires.Unix()
-
-	// Generate signature
-	sig := s.Sign(req)
-	req.Signature = sig
-
-	// Build the size component
-	var sizeStr string
-	if req.Transform.Size.Width == 0 && req.Transform.Size.Height == 0 {
-		sizeStr = "orig"
-	} else {
-		sizeStr = fmt.Sprintf("%dx%d",
-			req.Transform.Size.Width, req.Transform.Size.Height)
-	}
-
-	// Build the path. A source query follows the source path after a "?".
-	// The image route reads the path decoded once, so the whole path is
-	// written in Go's own percent-encoding of a URL path, which writes "?"
-	// as %3F and "%" as %25, and leaves "/", ";", ",", "=" and "&" as they
-	// are.
-	sourcePathAndQuery := req.Source.Path
-	if req.Source.Query != "" {
-		sourcePathAndQuery += "?" + req.Source.Query
-	}
-
-	unescapedPath := fmt.Sprintf("/v1/image/%s%s/%s.%s",
-		req.Source.Host, sourcePathAndQuery, sizeStr, req.Transform.Format)
-
-	return (&url.URL{Path: unescapedPath}).EscapedPath(), sig, exp
-}
-
 // buildSignatureData creates the string to be signed.
 // Format: "host:path:query:width:height:format:expiration:quality:fit"
 // The path and query go through escapePercentAndColon, so that a ":" in
@@ -146,17 +106,3 @@ func escapePercentAndColon(s string) string {
 
 	return strings.ReplaceAll(s, ":", "%3A")
 }
-
-// ParseParams extracts signature and expiration from query parameters.
-func ParseParams(sig, expStr string) (string, time.Time, error) {
-	if expStr == "" {
-		return sig, time.Time{}, nil
-	}
-
-	expUnix, err := strconv.ParseInt(expStr, 10, 64)
-	if err != nil {
-		return "", time.Time{}, fmt.Errorf("invalid expiration: %w", err)
-	}
-
-	return sig, time.Unix(expUnix, 0), nil
-}