4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	00d8ba26c5	One image request type instead of five (closes #307) ... The new package internal/imagerequest holds the request type, its two parts Source and Transform, the Format and Fit types, the dimension and fit checks, the /v1/image/ path parsing and the variant key; it imports no other package of pixa. imgcache.ParsedURL, imgcache.ImageRequest, signature.Request, imageprocessor.Request, the second Size, format and fit types and the conversions between them are gone. The image processor takes a Transform only. encurl keeps a private struct with the token's short CBOR field names. VariantKey moves with the function that makes it. Tests follow the moved and renamed code; the tests of the removed conversions go with them. Model: opus-5-5	2026-10-21 14:41:07 +02:00
clawbot	742db9ceb1	Logging out ends every login session (closes #256) ... A login session was a cookie with nothing kept on the server, so logging out removed it from one browser and a copy kept working for 30 days. The session manager now keeps a random value in the database, made when it has none and replaced by each logout; a session carries the value current at its login and is refused once it has changed. The logout check compares no time, so the host's clock cannot block a login, and losing the state directory ends every login session. Logging out is now a POST with the CSRF token, sent by a form on the generator page. Model: opus-5-5	2026-10-15 20:44:44 +02:00
clawbot	708a9bec20	Test that a URL made on the generator page with a ttl expires (closes #199) ... A new handler test makes a URL on the generator page with a ttl of one second, checks that /v1/e/ serves it at once, waits two seconds and checks that it then answers 410. The expiry is kept in whole seconds, so two seconds is the longest a one-second ttl can take to pass. Test only. Model: opus-5-5	2026-10-04 22:42:03 +02:00
clawbot	233a9c05ad	Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77) ... New handler tests in internal/handlers, with no network: GET / shows the login form without a session; a wrong key shows it again with an error and sets no session cookie; the right key answers 303 with a session cookie marked Secure, HttpOnly and SameSite=Strict, with which GET / shows the generator page; GET /logout empties the cookie with Max-Age=0; POST /generate without a session answers 303 to /; /v1/e/ serves a valid token's image, answers 410 for an expired token and 400 for one changed, cut short or made with another signing key; a URL made on the generator page is served by /v1/e/. No code changes. Model: opus-5-5	2026-10-04 19:24:39 +02:00