4 Commits

Include renames

Author	SHA1	Message	Date
sneak	46ee9fa1ca	Test that the image route refuses brackets around no IPv6 address ... An IPv4 address in brackets, such as [203.0.113.5], and brackets around no address at all, such as [abc], must be refused with 400. They now pass the host check, and Go's URL parser refuses them later, so the route answers 401. The new rows fail until the fix lands. Model: opus-5-5	2026-10-15 22:53:42 +00:00
sneak	bb25e306a3	Test that the image route refuses a host no URL host can be ... A host written with a percent-encoded ?, #, %, \ or space, and an IPv6 address without brackets, must be refused with 400; a host name, an IPv4 address, an IPv6 address in brackets and a host with a port, or a : and no port, must still be served. The first test fails until the fix for #275 lands. Model: opus-5-5	2026-10-15 22:25:02 +00:00
clawbot	ca512fdb4f	Remove the unused cache lifetime setting (closes #69) ... CacheConfig.CacheTTL was set to DefaultCacheTTL (24 hours) and never read, so cached images never expired. Remove the field, the constant and the line that set it. Cached source and transformed images stay until eviction removes them to keep the cache within cache_max_bytes. A new test caches a source and a transformed image, sets every time pixa stores for them two days back (database rows, metadata files and file times), and checks that both are still served from the cache without a new upstream fetch. Existing tests lose only the CacheTTL line of their cache config. Model: opus-5-5	2026-10-13 07:58:55 +02:00
clawbot	ba5a716223	Test the image route's signature check and error answers (closes #76) ... New tests in internal/handlers, with no network: the status and JSON error body the image route answers for a missing, wrong, unpadded, upper-case or expired signature on a host not on the allowlist, or a valid one sent for its parent domain, a sibling host, a subdomain or the host with another domain appended; an unparseable path, localhost as the upstream host, and an upstream error; that an allowlisted host is served without a signature and another host only with a valid one; and the answers of /robots.txt and the health check. An expired signature is answered 401, as the code and README.md say, where the issue body expected 410. No code changes. Model: opus-5-5	2026-10-04 13:58:29 +02:00