7 Commits

Include renames

Author	SHA1	Message	Date
clawbot	f8d40b89a7	Validate dimensions and fit mode on encrypted URLs (closes #62) ... The encrypted /v1/e/ route used the decrypted payload unchecked, so a token could request an over-limit size or an unknown fit mode; the generator turned unparseable numbers into 0. imgcache.ValidateDimension alone holds the MaxDimension bound and is used by the path parser, by the new ValidateImageRequest (which adds ValidateFitMode) and by the generator. Both image routes call ValidateImageRequest, so each answers 400. The generator answers 400 naming the field for a width or height that is not a number or fails that check, a quality that is not a number from 1 to 100, a ttl that is not a number from 0 to the largest the expiry calculation can hold, or an unknown fit. Empty quality is 85; empty ttl never expires. The form's size inputs stop at 8192. Model: opus-4-8 (implementation); opus-5-5 (rework)	2026-09-28 15:24:32 +02:00
clawbot	a96eba8083	CSRF protection on the login and URL-generator forms (closes #93) ... Adds CSRF protection to the two cookie-authenticated form posts, POST / (login) and POST /generate, using github.com/gorilla/csrf, the recorded default for this job. The token key is derived from signing_key with its own HKDF salt, so it needs no new config and survives restarts. The token cookie is separate from the session cookie, which also covers login CSRF, where no session exists yet. Both templates carry the hidden token field. What a reader would trip over: outside debug mode the library enforces its https Referer origin check, so the TLS-terminating proxy must preserve the Host and Referer headers from the browser or form posts are rejected. Disclosure: one nolint:gosec on a test constant holding the library field name (G101 false positive). Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 19:26:18 +02:00
sneak	467237c849	Add AVIF option to URL generator	2026-01-08 13:12:51 -08:00
sneak	e5135b3697	Add 1-minute expiration option and quality presets to URL generator ... Quality is now a dropdown with named presets: - Potato (25), Low (50), Medium (70), High (85), Ultra (100) Added 1-minute TTL option for testing short-lived URLs.	2026-01-08 12:52:14 -08:00
sneak	70d55977c0	Add WebP encoding support ... Uses github.com/gen2brain/webp - a CGO-free library that uses WASM via wazero runtime for encoding. WebP decoding was already supported. - Add gen2brain/webp dependency for encoding - Implement WebP encoding in processor.go - Add FormatWebP to SupportedOutputFormats - Re-enable WebP option in generator form dropdown - Mark WebP encoding as complete in TODO.md	2026-01-08 11:55:45 -08:00
sneak	37af10cc2b	Update generator form for supported formats and Never expiry ... - Remove WebP and AVIF options (encoding not supported) - Add GIF option (encoding is supported) - Add 'Never' TTL option as default	2026-01-08 11:08:28 -08:00
sneak	aad5e59d23	Add static files and HTML templates for web UI ... Embedded Tailwind CSS and login/generator templates. Self-contained with no external dependencies.	2026-01-08 07:38:09 -08:00