Build the image pipeline in pixad's fx graph (closes #313)

The new package internal/providers builds the cache, the fetcher, the
processor, the image service, the session manager and the encrypted URL
generator from the config. pixad's fx graph provides them with
providers.Constructors(), and handlers.New receives them built. The
server tests build the same graph, with only the fetcher's dial function
replaced. database.New opens the database, so these parts can read it
while fx builds them; the cache's stop hook still runs before the
database's.

Each setting's default is declared in internal/config, and
internal/providers works out the default cache_max_bytes. The cache's
MaxBytes is the one value for the disk cache limit, and 0 turns the disk
cache off. The fetcher and the processor take explicit values.

Model: opus-5-5

TODO.md

@@ -36,8 +36,8 @@ P2: security: per-origin rate limiting
   `MaxBytes` is the one value for the disk cache limit, and 0 turns the disk
   cache off. For an omitted `cache_max_bytes`, `internal/providers` works out
   `config.DefaultCacheMaxBytes` before it builds the cache. `internal/app` and
-  the server tests build the parts below with `providers.Option`; the image
+  the server tests build the parts below with `providers.Constructors()`; the
-  proxy test replaces only the fetcher's dial function.
+  image proxy test replaces only the fetcher's dial function.
     - Built by the providers in `internal/providers`, and given to
       `handlers.New`:
         - the cache

internal/app/app.go

@@ -66,7 +66,7 @@ func run(_ *cobra.Command, _ []string) {
 			// The registry /metrics serves
 			func() prometheus.Registerer { return prometheus.DefaultRegisterer },
 		),
-		providers.Option,
+		fx.Provide(providers.Constructors()...),
 		fx.Invoke(
 			func(log *logger.Logger) { log.Identify() },
 			func(*server.Server) {},

internal/providers/fetcher_internal_test.go

@@ -1,4 +1,4 @@
-package app
+package providers
 
 import (
 	"encoding/json"
@@ -20,20 +20,16 @@ import (
 	"sneak.berlin/go/pixa/internal/handlers"
 	"sneak.berlin/go/pixa/internal/healthcheck"
 	"sneak.berlin/go/pixa/internal/logger"
-	"sneak.berlin/go/pixa/internal/providers"
 )
 
-// testSigningKey is a throwaway signing key.
-const testSigningKey = "test-signing-key-0123456789abcdef"
-
 // TestFetcherFromConfigRefusesBlockedNetworks builds the handlers as pixad
 // does, in an fx app with the providers of pixad's fx app, and requests an
 // image from 192.0.2.10, which is on the allowlist and in blocked_networks.
 // The URL check accepts that address; only the dialer that refuses internal
 // addresses checks blocked_networks, so the answer is 403 only if the
-// fetcher providers.Option builds from the config connects with that
+// fetcher this package builds from the config connects with that dialer.
-// dialer. Any other dialer would try to connect until the upstream fetch
+// Any other dialer would try to connect until the upstream fetch timeout,
-// timeout, which is short so that the test then fails quickly.
+// which is short so that the test then fails quickly.
 func TestFetcherFromConfigRefusesBlockedNetworks(t *testing.T) {
 	t.Parallel()
 
@@ -61,7 +57,7 @@ func TestFetcherFromConfigRefusesBlockedNetworks(t *testing.T) {
 		fx.Provide(globals.New, logger.New, database.New, healthcheck.New,
 			handlers.New,
 			func() prometheus.Registerer { return prometheus.NewRegistry() }),
-		providers.Option,
+		fx.Provide(Constructors()...),
 		fx.Populate(&h),
 	)
 	app.RequireStart()

internal/providers/providers.go

@@ -30,19 +30,20 @@ import (
 	"sneak.berlin/go/pixa/internal/session"
 )
 
-// Option provides the parts this package builds. The fx graph must also
+// Constructors returns the constructors of the parts this package builds,
-// provide the prometheus.Registerer the cache registers its counters on.
+// for fx.Provide. The fx graph must also provide the prometheus.Registerer
-//
+// the cache registers its counters on.
-//nolint:gochecknoglobals // an fx option, built once and never changed
+func Constructors() []any {
-var Option = fx.Provide(
+	return []any{
-	newCache,
+		newCache,
-	newFetcherConfig,
+		newFetcherConfig,
-	httpfetcher.New,
+		httpfetcher.New,
-	newProcessor,
+		newProcessor,
-	newImageService,
+		newImageService,
-	newSessionManager,
+		newSessionManager,
-	newEncryptedURLGenerator,
+		newEncryptedURLGenerator,
-)
+	}
+}
 
 // cacheParams defines dependencies for newCache.
 type cacheParams struct {

internal/server/image_proxy_internal_test.go

@@ -172,7 +172,7 @@ func startImageProxy(
 			middleware.New,
 			func() prometheus.Registerer { return prometheus.NewRegistry() },
 		),
-		providers.Option,
+		fx.Provide(providers.Constructors()...),
 		fx.Decorate(func(fetcherConfig *httpfetcher.Config) *httpfetcher.Config {
 			fetcherConfig.DialContext = dialUpstream
 
@@ -233,7 +233,7 @@ func startImageProxyWithBlockedNetworks(
 			middleware.New,
 			func() prometheus.Registerer { return prometheus.NewRegistry() },
 		),
-		providers.Option,
+		fx.Provide(providers.Constructors()...),
 		fx.Populate(&h, &mw),
 	)
 	app.RequireStart()

internal/server/logout_internal_test.go

@@ -50,7 +50,7 @@ func startPixa(t *testing.T, cfg *config.Config) *Server {
 			middleware.New,
 			func() prometheus.Registerer { return prometheus.NewRegistry() },
 		),
-		providers.Option,
+		fx.Provide(providers.Constructors()...),
 		fx.Populate(&h, &mw),
 	)
 	app.RequireStart()