4 Commits

Include renames

Author	SHA1	Message	Date
sneak	534b453a81	Derive every key from the signing key in one place (closes #315) ... seal.DeriveKeys derives the session hash and block keys, the encrypted URL key and the CSRF key from the signing key, with their salts declared beside it, and returns them as one seal.Keys. internal/providers calls it once at startup and provides the value to the fx graph. The session manager, the encrypted URL generator and the CSRF protection each take their own key. session.NewManager, encurl.NewGenerator, newCSRFProtect and handlers.New return no error, as nothing in them can fail now. Each key is derived as before, with seal.DeriveKey and the same salt. The signing key itself stays the HMAC key of signed URLs and the login password. README.md says under signing_key what it protects. Model: opus-5-5	2026-10-26 13:01:57 +00:00
clawbot	7b6712538e	Take the signature, the expiry and the URL scheme off the image request (closes #314) ... The image request now holds only its source and its transform, exactly what the variant key covers. The /v1/image/ handler checks the allowlist and verifies the signature itself with Signer.Verify(req, sig, expires). Both image handlers keep the URL's expiry as a local value for Cache-Control. The image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is gone. The fetcher takes the source and builds its URL with Source.URL from its own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat returns the format it chooses instead of writing into the request. The signed URL format and every route's answers are unchanged. Model: opus-5-5	2026-10-26 13:49:12 +01:00
clawbot	00d8ba26c5	One image request type instead of five (closes #307) ... The new package internal/imagerequest holds the request type, its two parts Source and Transform, the Format and Fit types, the dimension and fit checks, the /v1/image/ path parsing and the variant key; it imports no other package of pixa. imgcache.ParsedURL, imgcache.ImageRequest, signature.Request, imageprocessor.Request, the second Size, format and fit types and the conversions between them are gone. The image processor takes a Transform only. encurl keeps a private struct with the token's short CBOR field names. VariantKey moves with the function that makes it. Tests follow the moved and renamed code; the tests of the removed conversions go with them. Model: opus-5-5	2026-10-21 14:41:07 +02:00
clawbot	52f69d3082	Refuse SVG sources and never save an unknown input as JPEG (closes #68) ... The upstream fetch no longer accepts image/svg+xml, and both image routes answer 415, not 500, for any upstream Content-Type outside the source formats. Before decoding, the image processor names the input's format from govips' DetermineImageType and refuses, with 415, input whose first bytes libvips reads as anything but the six source formats, so an SVG passing the first-bytes check for AVIF never reaches librsvg. orig of such an input is refused instead of being saved as JPEG. README.md drops SVG from the source formats. SVG detection stays in internal/magic, unused on the request path, for #168. An AVIF image sequence (brand avis) answers 415. Model: opus-5-5	2026-10-13 07:13:17 +02:00