4 Commits

Include renames

Author	SHA1	Message	Date
sneak	9119667c31	Test that a # in the source path or query is refused with 400 ... The image route serves these today: the source URL ends at the #, so each text after it fetches the same upstream image and caches it under keys of its own. Model: opus-5-5	2026-10-15 23:19:03 +00:00
clawbot	62b4f4791e	Refuse an image URL whose host is not a host name or IP address (closes #275) ... A ? written into the host segment as %3F reached the parser decoded, so cdn.example.com?x=1 passed the allowlist as cdn.example.com, fetched the host's root path with that query, and was cached under its own keys: another unsigned spelling of one upstream request. The host segment is now accepted only as a host name, an IPv4 address or a bracketed IPv6 address, with an optional port, and anything else is refused with 400. An IPv6 address without brackets is now refused instead of needing a signature; a host name outside ASCII is refused, its punycode accepted. Model: opus-5-5	2026-10-16 01:14:51 +02:00
clawbot	ca512fdb4f	Remove the unused cache lifetime setting (closes #69) ... CacheConfig.CacheTTL was set to DefaultCacheTTL (24 hours) and never read, so cached images never expired. Remove the field, the constant and the line that set it. Cached source and transformed images stay until eviction removes them to keep the cache within cache_max_bytes. A new test caches a source and a transformed image, sets every time pixa stores for them two days back (database rows, metadata files and file times), and checks that both are still served from the cache without a new upstream fetch. Existing tests lose only the CacheTTL line of their cache config. Model: opus-5-5	2026-10-13 07:58:55 +02:00
clawbot	ba5a716223	Test the image route's signature check and error answers (closes #76) ... New tests in internal/handlers, with no network: the status and JSON error body the image route answers for a missing, wrong, unpadded, upper-case or expired signature on a host not on the allowlist, or a valid one sent for its parent domain, a sibling host, a subdomain or the host with another domain appended; an unparseable path, localhost as the upstream host, and an upstream error; that an allowlisted host is served without a signature and another host only with a valid one; and the answers of /robots.txt and the health check. An expired signature is answered 401, as the code and README.md say, where the issue body expected 410. No code changes. Model: opus-5-5	2026-10-04 13:58:29 +02:00