3 Commits

Include renames

Author	SHA1	Message	Date
sneak	27493568fd	Build the image pipeline in pixad's fx graph (closes #313) ... internal/app now provides the cache, the fetcher, the processor, the image service, the session manager and the encrypted URL generator, and handlers.New receives them built. database.New opens the database, so these parts can read it while fx builds them; the cache's stop hook still runs before the database's. Each setting's default is declared in internal/config, the default cache_max_bytes included, which internal/app works out before it builds the cache. The cache's MaxBytes is the one value for the disk cache limit, and 0 turns the disk cache off. The fetcher and the processor take explicit values. The server tests build the pipeline themselves, as they cannot import internal/app. Model: opus-5-5	2026-10-26 10:31:44 +00:00
clawbot	b49d0068df	Count hits, misses, fetches and transforms as Prometheus counters (closes #311) ... The five counts the cache_stats table held are now Prometheus counters in memory, as fields of the cache. NewCache makes them and registers them on the registry it is given. pixad gives it Prometheus' default registry, which /metrics serves; each test gives it a new one. The Increment methods add to their cache's counters, so counting makes no database call. cache_stats, Cache.Stats, Service.Stats, CacheStats and the pending counts are gone, with their tests. The background goroutine now writes only access times, and its names say so: StartPendingAccessTimeWrites, StopPendingAccessTimeWrites and pendingaccesstimes.go. The two stop tests whose write under way was a count now use access times. Model: opus-5-5	2026-10-26 10:20:42 +01:00
clawbot	742db9ceb1	Logging out ends every login session (closes #256) ... A login session was a cookie with nothing kept on the server, so logging out removed it from one browser and a copy kept working for 30 days. The session manager now keeps a random value in the database, made when it has none and replaced by each logout; a session carries the value current at its login and is refused once it has changed. The logout check compares no time, so the host's clock cannot block a login, and losing the state directory ends every login session. Logging out is now a POST with the CSRF token, sent by a form on the generator page. Model: opus-5-5	2026-10-15 20:44:44 +02:00