Read a cached source only once a processing slot is taken (closes #64)

A request whose source was in the disk cache read the whole file into
memory, then waited for a processing slot, so a burst of new sizes for
one large cached image held one copy per waiting request, with no
ceiling. The service now opens the cached file and hands it to the image
processor, which reads it only after taking its slot. The file's size,
now returned by GetSourceContent, still sends an empty or oversized
cached source to upstream instead. A cached file that fails while being
read now fails the request instead of being fetched again.

Model: opus-5-5

TODO.md

@@ -39,13 +39,6 @@ P2: security: referer blacklist
   10 seconds for a free one, then gets 503 `server busy, try again later`;
   libvips runs one worker thread per image with its operation cache off;
   documented in `README.md` and `config.example.yml`.
-- 2026-09-29 migrations at the path `REPO_POLICIES.md` sets (closes #96): the
-  migration files moved, contents unchanged, from `internal/database/schema/`
-  to `internal/db/migrations/` as `000_migration.sql` and `001_schema.sql`; the
-  `internal/db/migrations` package embeds them and `internal/database` reads
-  them through its `FS()`; the `internal/database` package itself stays; the
-  version still comes from the filename prefix, so a database that has recorded
-  versions 0 and 1 runs neither again.
 - 2026-09-29 `trusted_proxies` advice and signature padding in `README.md`
   (closes #150): the login-limit paragraph, the `trusted_proxies` entry and
   `config.example.yml` say to set `trusted_proxies` to the address pixa sees for

internal/database/database.go

@@ -4,9 +4,9 @@ package database
 import (
 	"context"
 	"database/sql"
+	"embed"
 	"errors"
 	"fmt"
-	"io/fs"
 	"log/slog"
 	"path/filepath"
 	"sort"
@@ -15,12 +15,14 @@ import (
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/db/migrations"
 	"sneak.berlin/go/pixa/internal/logger"
 
 	_ "modernc.org/sqlite" // SQLite driver registration
 )
 
+//go:embed schema/*.sql
+var schemaFS embed.FS
+
 // bootstrapVersion is the migration that creates the schema_migrations
 // table itself. It is applied before the normal migration loop.
 const bootstrapVersion = 0
@@ -111,29 +113,29 @@ func New(lc fx.Lifecycle, params Params) (*Database, error) {
 	return s, nil
 }
 
-// collectMigrations reads the embedded migrations directory and returns
+// collectMigrations reads the embedded schema directory and returns
 // migration filenames sorted lexicographically.
 func collectMigrations() ([]string, error) {
-	entries, err := fs.ReadDir(migrations.FS(), ".")
+	entries, err := schemaFS.ReadDir("schema")
 	if err != nil {
-		return nil, fmt.Errorf("failed to read migrations directory: %w", err)
+		return nil, fmt.Errorf("failed to read schema directory: %w", err)
 	}
 
-	var filenames []string
+	var migrations []string
 
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
-			filenames = append(filenames, entry.Name())
+			migrations = append(migrations, entry.Name())
 		}
 	}
 
-	sort.Strings(filenames)
+	sort.Strings(migrations)
 
-	return filenames, nil
+	return migrations, nil
 }
 
 // bootstrapMigrationsTable ensures the schema_migrations table exists
-// by applying 000_migration.sql if the table is missing.
+// by applying 000.sql if the table is missing.
 func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 	var tableExists int
 
@@ -148,9 +150,9 @@ func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger)
 		return nil
 	}
 
-	content, err := fs.ReadFile(migrations.FS(), "000_migration.sql")
+	content, err := schemaFS.ReadFile("schema/000.sql")
 	if err != nil {
-		return fmt.Errorf("failed to read bootstrap migration 000_migration.sql: %w", err)
+		return fmt.Errorf("failed to read bootstrap migration 000.sql: %w", err)
 	}
 
 	if log != nil {
@@ -175,12 +177,12 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 		return err
 	}
 
-	filenames, err := collectMigrations()
+	migrations, err := collectMigrations()
 	if err != nil {
 		return err
 	}
 
-	for _, migration := range filenames {
+	for _, migration := range migrations {
 		version, parseErr := ParseMigrationVersion(migration)
 		if parseErr != nil {
 			return parseErr
@@ -206,7 +208,7 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 		}
 
 		// Read and apply migration.
-		content, readErr := fs.ReadFile(migrations.FS(), migration)
+		content, readErr := schemaFS.ReadFile(filepath.Join("schema", migration))
 		if readErr != nil {
 			return fmt.Errorf("failed to read migration %s: %w", migration, readErr)
 		}

internal/database/migrations_internal_test.go

@@ -1,54 +0,0 @@
-package database
-
-import (
-	"bytes"
-	"database/sql"
-	"log/slog"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	_ "modernc.org/sqlite" // SQLite driver registration
-)
-
-// TestApplyMigrations_SecondRunAppliesNothing applies the migrations twice
-// to one database file, as happens when pixad starts again on the database
-// it created, and checks that the second run applies none of them.
-// ApplyMigrations logs a message starting with "applying" before it runs
-// any migration, the bootstrap one included.
-func TestApplyMigrations_SecondRunAppliesNothing(t *testing.T) {
-	t.Parallel()
-
-	ctx := t.Context()
-
-	db, err := sql.Open("sqlite", filepath.Join(t.TempDir(), "state.sqlite3"))
-	if err != nil {
-		t.Fatalf("failed to open test db: %v", err)
-	}
-
-	t.Cleanup(func() { _ = db.Close() })
-
-	var firstLog bytes.Buffer
-
-	err = ApplyMigrations(ctx, db, slog.New(slog.NewTextHandler(&firstLog, nil)))
-	if err != nil {
-		t.Fatalf("first ApplyMigrations failed: %v", err)
-	}
-
-	if !strings.Contains(firstLog.String(), "applying") {
-		t.Fatalf("first ApplyMigrations logged no applied migration:\n%s",
-			firstLog.String())
-	}
-
-	var secondLog bytes.Buffer
-
-	err = ApplyMigrations(ctx, db, slog.New(slog.NewTextHandler(&secondLog, nil)))
-	if err != nil {
-		t.Fatalf("second ApplyMigrations failed: %v", err)
-	}
-
-	if strings.Contains(secondLog.String(), "applying") {
-		t.Errorf("second ApplyMigrations ran a migration again:\n%s",
-			secondLog.String())
-	}
-}

internal/db/migrations/migrations.go

@@ -1,15 +0,0 @@
-// Package migrations provides the embedded SQL migration files.
-package migrations
-
-import (
-	"embed"
-	"io/fs"
-)
-
-//go:embed *.sql
-var files embed.FS
-
-// FS returns the embedded filesystem containing the migration files.
-func FS() fs.FS {
-	return files
-}