sneak/pixa
1
0
Fork 0
Code Issues 55 Pull Requests 4 Actions Packages Projects Releases Wiki Activity
168 Commits 12 Branches 0 Tags
6a753f14c4c28ee1c7a19c3c11002fa497f7045a
Commit Graph
6 Commits
Author SHA1 Message Date
sneak 6a753f14c4 feat: CSRF protection on the login and URL-generator forms (closes #93)
check / check (push) Failing after 0s
Details 
Both cookie-authenticated HTML form posts (POST / and POST /generate)
now require a CSRF token via gorilla/csrf, the recorded default in
GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session
cookie, so it also covers the login POST, where no session exists yet
(login CSRF). The token key is derived from the signing key with its own
HKDF salt, so tokens survive restarts and reuse no other key material;
gorilla/csrf supplies crypto/rand generation and constant-time compare.

The form routes sit in a chi group behind the middleware; the hidden
token field is rendered into login.html and generator.html. In local
plaintext HTTP mode (debug) requests are marked plaintext so the library
does not demand an https Referer or set a Secure cookie the browser
would withhold; in production, behind the TLS-terminating proxy, it
enforces its https Referer origin check.

model: claude-opus-4-8
 2026-09-21 12:57:23 +00:00
sneak 467237c849 Add AVIF option to URL generator 2026-01-08 13:12:51 -08:00
sneak e5135b3697 Add 1-minute expiration option and quality presets to URL generator 
Quality is now a dropdown with named presets:
- Potato (25), Low (50), Medium (70), High (85), Ultra (100)

Added 1-minute TTL option for testing short-lived URLs.
 2026-01-08 12:52:14 -08:00
sneak 70d55977c0 Add WebP encoding support 
Uses github.com/gen2brain/webp - a CGO-free library that uses WASM via
wazero runtime for encoding. WebP decoding was already supported.

- Add gen2brain/webp dependency for encoding
- Implement WebP encoding in processor.go
- Add FormatWebP to SupportedOutputFormats
- Re-enable WebP option in generator form dropdown
- Mark WebP encoding as complete in TODO.md
 2026-01-08 11:55:45 -08:00
sneak 37af10cc2b Update generator form for supported formats and Never expiry 
- Remove WebP and AVIF options (encoding not supported)
- Add GIF option (encoding is supported)
- Add 'Never' TTL option as default
 2026-01-08 11:08:28 -08:00
sneak aad5e59d23 Add static files and HTML templates for web UI 
Embedded Tailwind CSS and login/generator templates.
Self-contained with no external dependencies.
 2026-01-08 07:38:09 -08:00