4 Commits

Include renames

Author	SHA1	Message	Date
sneak	534b453a81	Derive every key from the signing key in one place (closes #315) ... seal.DeriveKeys derives the session hash and block keys, the encrypted URL key and the CSRF key from the signing key, with their salts declared beside it, and returns them as one seal.Keys. internal/providers calls it once at startup and provides the value to the fx graph. The session manager, the encrypted URL generator and the CSRF protection each take their own key. session.NewManager, encurl.NewGenerator, newCSRFProtect and handlers.New return no error, as nothing in them can fail now. Each key is derived as before, with seal.DeriveKey and the same salt. The signing key itself stays the HMAC key of signed URLs and the login password. README.md says under signing_key what it protects. Model: opus-5-5	2026-10-26 13:01:57 +00:00
clawbot	7b6712538e	Take the signature, the expiry and the URL scheme off the image request (closes #314) ... The image request now holds only its source and its transform, exactly what the variant key covers. The /v1/image/ handler checks the allowlist and verifies the signature itself with Signer.Verify(req, sig, expires). Both image handlers keep the URL's expiry as a local value for Cache-Control. The image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is gone. The fetcher takes the source and builds its URL with Source.URL from its own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat returns the format it chooses instead of writing into the request. The signed URL format and every route's answers are unchanged. Model: opus-5-5	2026-10-26 13:49:12 +01:00
clawbot	00d8ba26c5	One image request type instead of five (closes #307) ... The new package internal/imagerequest holds the request type, its two parts Source and Transform, the Format and Fit types, the dimension and fit checks, the /v1/image/ path parsing and the variant key; it imports no other package of pixa. imgcache.ParsedURL, imgcache.ImageRequest, signature.Request, imageprocessor.Request, the second Size, format and fit types and the conversions between them are gone. The image processor takes a Transform only. encurl keeps a private struct with the token's short CBOR field names. VariantKey moves with the function that makes it. Tests follow the moved and renamed code; the tests of the removed conversions go with them. Model: opus-5-5	2026-10-21 14:41:07 +02:00
clawbot	afb5dc5d0d	Refuse a fit=outside size whose output exceeds the maximum (closes #257) ... fit=outside scales the source to cover the requested size, and the side scaled past it was held to no maximum: 1x8192?fit=outside of a 3000x600 source was resized to 40960x8192 and encoded. resize now refuses such an output with ErrOutputTooLarge before resizing, so both image routes answer it 400 with the error a size with one side 0 already gets. The other fit modes make the requested size or one within it. README.md and TODO.md say so. Model: opus-5-5	2026-10-13 10:44:45 +02:00