Refuse a q outside 1-100 on /v1/image/ with 400 (closes #134)

The route ignored a q that was not a number or was outside 1-100 and
used 85, so q=banana or q=500 was served as if q were absent and
verified against a signature made for 85.

It now reads q with the check the URL generator uses for its quality
field (parseFormInt with minQuality and maxQuality, default
encurl.DefaultQuality) and answers anything else with a 400 naming q
and the value. That check takes an empty value as missing, so an empty
q in the URL is refused before it. The query string is read with
url.ParseQuery, since r.URL.Query() drops a pair it cannot decode, such
as q=80%; one that cannot be decoded is a 400 showing it. Only a q
missing from the URL is 85. README.md states the range.

Model: opus-5-5

README.md

@@ -94,9 +94,6 @@ In-process caching of request-to-output mappings targets 1-5k r/s.
 
 Images are only fetched from origins using TLS with valid certificates.
 
-A request whose query string cannot be decoded, or gives any parameter more
-than once, is refused with 400.
-
 - `<format>`: one of `orig`, `png`, `jpeg`, `webp`
 - `<size>`: `orig` or `<width>x<height>` (e.g. `800x600`)
 

TODO.md

@@ -36,10 +36,7 @@ exhaustion
   85; the route reads `q` with the generator's quality check
   (`parseFormInt` with `minQuality` and `maxQuality`); only a `q` missing
   from the URL is still 85; a query string that cannot be decoded, such
-  as `q=80%`, is a 400 showing it; any query parameter given more than
-  once (`q`, `fit`, `sig`, `exp` alike) is a 400 naming it, so none is
-  read from its first value only; `README.md` states the range and both
-  query-string rules.
+  as `q=80%`, is a 400 showing it; `README.md` states the range.
 - 2026-09-28 unknown `PIXA_` environment variables abort startup (closes
   #133): a variable whose name starts with `PIXA_` but is neither a
   setting's variable nor `PIXA_CONFIG_PATH` aborts startup naming it, as

internal/handlers/handlers_internal_test.go

@@ -293,13 +293,12 @@ func TestHandleImage_InvalidFitMode_Returns400(t *testing.T) {
 	}
 }
 
-// TestHandleImage_InvalidQuery_Returns400 verifies that the plain image route
-// answers a q that is not a whole number from 1 to 100, an empty one
-// included, with 400 naming q and the value, a parameter given more than once
-// with 400 naming it, and a query string that cannot be decoded with 400
-// showing it, instead of serving the image at the default quality 85 or at
-// the first value given.
-func TestHandleImage_InvalidQuery_Returns400(t *testing.T) {
+// TestHandleImage_InvalidQuality_Returns400 verifies that the plain image
+// route answers a q that is not a whole number from 1 to 100, an empty one
+// included, with 400 naming q and the value, and a query string that cannot
+// be decoded with 400 showing it, instead of serving the image at the default
+// quality 85.
+func TestHandleImage_InvalidQuality_Returns400(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -309,10 +308,7 @@ func TestHandleImage_InvalidQuery_Returns400(t *testing.T) {
 		{"q=0", `invalid q: must be from 1 to 100, got "0"`},
 		{"q=101", `invalid q: must be from 1 to 100, got "101"`},
 		{"q=", `invalid q: not a number, got ""`},
-		{"q=&q=500", `invalid q: given more than once`},
-		{"q=80&q=500", `invalid q: given more than once`},
-		{"q=80&q=", `invalid q: given more than once`},
-		{"fit=cover&fit=contain", `invalid fit: given more than once`},
+		{"q=&q=500", `invalid q: not a number, got ""`},
 		{"q=80%", `invalid query string "q=80%": invalid URL escape "%"`},
 		{
 			"q=50;fit=contain",

internal/handlers/image.go

@@ -94,9 +94,7 @@ func (s *Handlers) parseImageRequest(
 
 	// Parse signature params from query string. r.URL.Query() would silently
 	// drop a pair it cannot decode, such as q=80%, so that q would be served
-	// at 85; a query string that cannot be decoded is refused instead. A
-	// parameter given more than once is refused too, as only its first value
-	// would be read.
+	// at 85; a query string that cannot be decoded is refused instead.
 	query, err := url.ParseQuery(r.URL.RawQuery)
 	if err != nil {
 		s.respondError(w, fmt.Sprintf("invalid query string %q: %v",
@@ -105,15 +103,6 @@ func (s *Handlers) parseImageRequest(
 		return nil, false
 	}
 
-	for name, values := range query {
-		if len(values) > 1 {
-			s.respondError(w, fmt.Sprintf("invalid %s: given more than once",
-				name), http.StatusBadRequest)
-
-			return nil, false
-		}
-	}
-
 	req.Signature = query.Get("sig")
 
 	if expStr := query.Get("exp"); expStr != "" {