CacheConfig.CacheTTL was set to DefaultCacheTTL (24 hours) and never
read, so cached images never expired. Remove the field, the constant
and the line that set it. Cached source and transformed images stay
until eviction removes them to keep the cache within cache_max_bytes.
A new test caches a source and a transformed image, sets back two days
fetched_at in source_metadata, fetched_at and last_accessed_at in
source_content, created_at and last_accessed_at in variant_content, the
fetched_at in the source's metadata file, the created_at in the .meta
file, and the access and modification times of those two files and of
the two image files, and checks that both are still served from the
cache without a new upstream fetch.
Existing tests lose only the CacheTTL line of their cache config.
Model: opus-5-5
New tests in internal/handlers, with no network: the status and JSON
error body the image route answers for a missing, wrong, unpadded,
upper-case or expired signature on a host not on the allowlist, or a
valid one sent for its parent domain, a sibling host, a subdomain or
the host with another domain appended; an unparseable path, localhost
as the upstream host, and an upstream error; that an allowlisted host
is served without a signature and another host only with a valid one;
and the answers of /robots.txt and the health check. An expired
signature is answered 401, as the code and README.md say, where the
issue body expected 410. No code changes.
Model: opus-5-5
clawbot