Refuse a fit=outside size whose output exceeds the maximum (closes #257)

fit=outside scales the source to cover the requested size, and the side
scaled past it was held to no maximum: 1x8192?fit=outside of a 3000x600
source was resized to 40960x8192 and encoded. resize now refuses such an
output with ErrOutputTooLarge before resizing, so both image routes answer
it 400 with the error a size with one side 0 already gets. The other fit
modes make the requested size or one within it. README.md and TODO.md
say so.

Model: opus-5-5

README.md

@@ -190,9 +190,12 @@ path under `/v1/` answers 200, in maintenance mode too.
   the cache and the upstream fetch; 403 when the upstream host, or a host it
   redirects to, is `localhost`, ends in `.localhost` or `.local`, or has an
   address in a blocked network (see `blocked_networks`); 429 over
-  `image_requests_per_minute` (below); 502 when the upstream answered with an
+  `image_requests_per_minute` (below); 415 when the upstream answers with a
-  error status, and for 5 minutes after that for the same source URL; 503 when
+  `Content-Type` that is not one of the source formats (below), or with an image
-  pixa is busy or in maintenance mode; 500 for any other failure.
+  whose first bytes libvips reads as another format; 502 when the upstream
+  answered with an error status, and for 5 minutes after that for the same
+  source URL; 503 when pixa is busy or in maintenance mode; 500 for any other
+  failure.
 - `GET` or `HEAD` `/v1/e/<token>/<name>` — an image through an encrypted URL
   (see Encrypted URLs). Needs: nothing but the URL. Answers: 200; 304 when
   `If-None-Match` matches the image's `ETag`; 400 for a token that does not
@@ -200,7 +203,7 @@ path under `/v1/` answers 200, in maintenance mode too.
   expired; 504 when the upstream has not sent its response headers within
   `upstream_fetch_timeout`, but 500 when that time runs out while the image
   itself is still arriving; 400 for an `Accept` header that is not valid, and
-  406, 403, 429, 502, 503 and 500, as for `/v1/image/`.
+  406, 403, 415, 429, 502, 503 and 500, as for `/v1/image/`.
 - `GET /robots.txt` — asks every crawler to stay away (`Disallow: /`). Needs:
   nothing. Answers: 200.
 - `GET /.well-known/healthcheck.json` — JSON with `status` (`ok`), `now`,
@@ -260,9 +263,17 @@ once, is refused with 400.
   both optional (values under Signature Specification). Both are part of what is
   cached, so each value of either is a separate cached image.
 
-The source image may be JPEG, PNG, GIF, WebP, AVIF, JPEG XL or SVG. The
+A size with one side `0` has that side scaled to keep the source's proportions,
-upstream's `Content-Type` must name its format, and the image's first bytes must
+and is refused with 400 when that side would come out above 8192, the most
-match it.
+either side may be; so is a size with `fit=outside`, which scales the image to
+cover the size and so past it on one side, when that side would come out
+above 8192.
+
+The source image may be JPEG, PNG, GIF, WebP, AVIF or JPEG XL. The upstream's
+`Content-Type` must name its format, and the image's first bytes must match it.
+An upstream answering with any other `Content-Type`, SVG included, is refused
+with 415, and so is an image whose first bytes libvips reads as another format,
+such as an SVG whose first bytes pass the check for AVIF.
 
 With the format `auto`, pixa chooses the format for each request from its
 `Accept` header, in this order:
@@ -340,7 +351,8 @@ nor change what it asks for.
    (`POST /generate`). The format is JPEG XL unless another is chosen; a form
    sent with an empty format, or none, also makes a JPEG XL URL. Width and
    height both empty or `0` keep the original size; if only one of them is empty
-   or `0`, that side is scaled to keep the image's proportions.
+   or `0`, that side is scaled to keep the image's proportions. A URL whose
+   scaled side would come out above 8192 answers 400.
 3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
    it expires. `<host>` is the host the page was opened on, and the URL starts
    with `http` instead while `debug` is on. The name after the token is ignored

TODO.md

@@ -30,6 +30,43 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-13 `fit=outside` no longer makes an output above 8192 on a side
+  (closes #257): it scales the image to cover the requested size, and the side
+  scaled past that size was held to no maximum, so `1x8192?fit=outside` of a
+  3000x600 source was resized to 40960x8192 and encoded. The image processor now
+  refuses such a size with `ErrOutputTooLarge` before resizing, and both image
+  routes answer it 400, as for a size with one side `0`. The other fit modes
+  make the requested size or one within it, so none can go above 8192.
+- 2026-10-13 a size with one side `0` no longer makes an output above 8192 on a
+  side (closes #241): that side is computed from the source's proportions, and
+  nothing held it to the 8192 a requested side is held to, so `0x8192` of a
+  3000x600 source was resized to 40960x8192 and encoded. The image processor now
+  refuses such a size with `ErrOutputTooLarge` once it knows the source's
+  dimensions, before resizing, and both image routes answer it 400 with the JSON
+  error body. The refusal is not cached as a failed fetch, so the same source is
+  still served at other sizes. `imgcache.MaxDimension` is now the image
+  processor's `MaxOutputDimension`, so the two cannot differ.
+- 2026-10-13 the unused cache lifetime is removed (closes #69):
+  `CacheConfig.CacheTTL`, which pixad set to `DefaultCacheTTL` (24 hours), was
+  never read, so cached images never expired. The field and the constant are
+  removed. Cached source and transformed images stay until eviction removes them
+  to keep the cache within `cache_max_bytes`.
+- 2026-10-13 SVG sources are refused, and `orig` is never saved as JPEG in place
+  of the source's own format (closes #68): the upstream fetch no longer accepts
+  `image/svg+xml`, which libvips would render. Both image routes answer 415 for
+  an upstream `Content-Type` that is not one of the source formats, SVG
+  included, where they answered 500. Before decoding, the image processor
+  refuses with `ErrUnsupportedInputFormat`, also answered 415, any input that
+  govips' `DetermineImageType`, which picks the libvips loader from the first
+  bytes, does not name as a source format. That catches an SVG whose first bytes
+  pass the first-bytes check for another type, as an XML comment can make them
+  do for AVIF; an SVG whose first bytes do not pass that check answers 500, as
+  before, and so does a damaged image in a source format, whose first bytes
+  `DetermineImageType` names. `orig` is always the source's own format, where a
+  source the processor could not name was saved as JPEG. `README.md` no longer
+  lists SVG. The SVG detection in `internal/magic` stays: the request path does
+  not call it, and it goes with the unused code of
+  https://git.eeqj.de/sneak/pixa/issues/168.
 - 2026-10-12 per-client limit on the image routes (closes #236): the new setting
   `image_requests_per_minute` (`PIXA_IMAGE_REQUESTS_PER_MINUTE`), default 600,
   is how many `GET` and `HEAD` requests one client may send to `/v1/image/` and

internal/handlers/handlers.go

@@ -106,7 +106,6 @@ func (s *Handlers) WaitForProcessing(ctx context.Context) int {
 func newCacheConfig(cfg *config.Config, log *slog.Logger) imgcache.CacheConfig {
 	return imgcache.CacheConfig{
 		StateDir:           cfg.StateDir,
-		CacheTTL:           imgcache.DefaultCacheTTL,
 		NegativeTTL:        imgcache.DefaultNegativeTTL,
 		MaxBytes:           cfg.CacheMaxBytes,
 		UseDefaultMaxBytes: !cfg.CacheMaxBytesExplicit,

internal/handlers/handlers_internal_test.go

@@ -47,7 +47,6 @@ func setupTestHandler(t *testing.T) *testFixtures {
 
 	cache, err := imgcache.NewCache(db, imgcache.CacheConfig{
 		StateDir:    tmpDir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {

internal/handlers/image.go

@@ -247,6 +247,22 @@ func (s *Handlers) respondImageError(
 		return
 	}
 
+	if errors.Is(err, httpfetcher.ErrInvalidContentType) ||
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat) {
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+
+		return
+	}
+
+	if errors.Is(err, imageprocessor.ErrOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+
+		return
+	}
+
 	s.respondError(w, "internal error", http.StatusInternalServerError)
 }
 

internal/handlers/image_cache_control_internal_test.go

@@ -31,7 +31,6 @@ func newSignedHostServer(
 
 	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {

internal/handlers/image_errors_internal_test.go

@@ -29,7 +29,6 @@ func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
 
 	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {

internal/handlers/imageenc.go

@@ -161,6 +161,14 @@ func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 		errors.Is(err, imageprocessor.ErrTooManyImages):
 		s.respondError(w, "server busy, try again later",
 			http.StatusServiceUnavailable)
+	case errors.Is(err, httpfetcher.ErrInvalidContentType),
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat):
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
 	default:
 		s.log.Error("image request failed", "error", err)
 		s.respondError(w, "internal error", http.StatusInternalServerError)

internal/handlers/referer_blocklist_internal_test.go

@@ -49,7 +49,6 @@ func newRefererRoutes(t *testing.T) (http.Handler, *Handlers, *countingFetcher)
 
 	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {

internal/handlers/unsupported_source_internal_test.go

@@ -0,0 +1,54 @@
+package handlers
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/pixa/internal/httpfetcher"
+	"sneak.berlin/go/pixa/internal/imageprocessor"
+	"sneak.berlin/go/pixa/internal/imgcache"
+)
+
+// TestUnsupportedSourceFormatAnswers415 checks that both image routes answer
+// 415 with a clear error when the upstream answers with a content type pixa
+// does not accept, such as SVG, and when orig is asked of a source in a
+// format the processor cannot name, wrapped as the service wraps them.
+func TestUnsupportedSourceFormatAnswers415(t *testing.T) {
+	t.Parallel()
+
+	h := &Handlers{log: slog.New(slog.DiscardHandler)}
+	req := &imgcache.ImageRequest{SourceHost: "img.example.com", SourcePath: "/a.svg"}
+
+	for _, err := range []error{
+		fmt.Errorf("upstream fetch failed: %w: image/svg+xml",
+			httpfetcher.ErrInvalidContentType),
+		fmt.Errorf("image processing failed: %w: unknown",
+			imageprocessor.ErrUnsupportedInputFormat),
+	} {
+		plain := httptest.NewRecorder()
+		h.respondImageError(plain, req, err)
+
+		encrypted := httptest.NewRecorder()
+		h.handleImageError(encrypted, err)
+
+		for route, rec := range map[string]*httptest.ResponseRecorder{
+			"HandleImage": plain, "HandleImageEnc": encrypted,
+		} {
+			t.Logf("%s for %v: %d %s", route, err, rec.Code, rec.Body.String())
+
+			if rec.Code != http.StatusUnsupportedMediaType {
+				t.Errorf("%s for %v: status = %d, want %d",
+					route, err, rec.Code, http.StatusUnsupportedMediaType)
+			}
+
+			if !strings.Contains(rec.Body.String(), "unsupported source format") {
+				t.Errorf("%s for %v: body = %q, want the unsupported source format error",
+					route, err, rec.Body.String())
+			}
+		}
+	}
+}

internal/httpfetcher/httpfetcher.go

@@ -158,7 +158,6 @@ func DefaultConfig() *Config {
 			contentTypeWebP,
 			contentTypeAVIF,
 			contentTypeJXL,
-			contentTypeSVG,
 		},
 		AllowHTTP:             false,
 		MaxConnectionsPerHost: DefaultMaxConnectionsPerHost,

internal/imageprocessor/computed_side_internal_test.go

@@ -0,0 +1,52 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+)
+
+// TestImageProcessor_RefusesComputedSideAboveMaximum verifies that a size
+// with one side 0, which Process computes from the input's proportions, is
+// served when that side comes out at MaxOutputDimension and refused with
+// ErrOutputTooLarge when it would be above. A 4096x1 or 1x4096 input given
+// 2 for its short side has 8192 for its long side.
+func TestImageProcessor_RefusesComputedSideAboveMaximum(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+		size                    Size
+		wantErr                 error
+	}{
+		{"width at the maximum", 4096, 1, Size{Height: 2}, nil},
+		{"width above the maximum", 4096, 1, Size{Height: 3}, ErrOutputTooLarge},
+		{"height at the maximum", 1, 4096, Size{Width: 2}, nil},
+		{"height above the maximum", 1, 4096, Size{Width: 3}, ErrOutputTooLarge},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitCover})
+			if result != nil {
+				t.Logf("Process() made %dx%d", result.Width, result.Height)
+
+				if max(result.Width, result.Height) != MaxOutputDimension {
+					t.Errorf("Process() made %dx%d, want a side of %d",
+						result.Width, result.Height, MaxOutputDimension)
+				}
+			}
+
+			if !errors.Is(err, tt.wantErr) {
+				t.Errorf("Process() error = %v, want %v", err, tt.wantErr)
+			}
+		})
+	}
+}

internal/imageprocessor/fit_outside_internal_test.go

@@ -0,0 +1,62 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+)
+
+// TestImageProcessor_RefusesFitOutsideAboveMaximum verifies that FitOutside,
+// which scales the input to cover the requested size and so past it on one
+// side, is refused with ErrOutputTooLarge when that side would come out above
+// MaxOutputDimension, and otherwise makes the scaled size. A 1024x256 or
+// 256x1024 input scaled by 8 has 8192 for its long side.
+func TestImageProcessor_RefusesFitOutsideAboveMaximum(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+		size                    Size
+		// wantWidth and wantHeight are the output's, 0 for a refusal
+		wantWidth, wantHeight int
+	}{
+		{"width above the maximum", 3000, 600, Size{Width: 1, Height: 8192}, 0, 0},
+		{"height above the maximum", 600, 3000, Size{Width: 8192, Height: 1}, 0, 0},
+		{"width at the maximum", 1024, 256, Size{Width: 1, Height: 2048}, 8192, 2048},
+		{"height at the maximum", 256, 1024, Size{Width: 2048, Height: 1}, 2048, 8192},
+		{"within the maximum", 3000, 600, Size{Width: 1, Height: 1200}, 6000, 1200},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitOutside})
+			if result != nil {
+				t.Logf("Process() made %dx%d", result.Width, result.Height)
+			}
+
+			if tt.wantWidth == 0 {
+				if !errors.Is(err, ErrOutputTooLarge) {
+					t.Errorf("Process() error = %v, want %v", err, ErrOutputTooLarge)
+				}
+
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			if result.Width != tt.wantWidth || result.Height != tt.wantHeight {
+				t.Errorf("Process() made %dx%d, want %dx%d",
+					result.Width, result.Height, tt.wantWidth, tt.wantHeight)
+			}
+		})
+	}
+}

internal/imageprocessor/imageprocessor.go

@@ -133,10 +133,26 @@ var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 // configured byte limit.
 var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
 
+// MaxOutputDimension is the maximum width or height of an output image, and
+// so of a requested size (imgcache.MaxDimension).
+const MaxOutputDimension = 8192
+
+// ErrOutputTooLarge is returned, before resizing, when the output would have a
+// side above MaxOutputDimension: the side of a size with one side 0, computed
+// from the input's proportions, or with FitOutside, the side scaled past the
+// requested size.
+var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")
+
 // ErrUnsupportedOutputFormat is returned when the requested output format is
 // not supported.
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
 
+// ErrUnsupportedInputFormat is returned, before the input is decoded, when
+// libvips reads the input's first bytes as another format than the source
+// formats, or as none: for example an SVG whose first bytes pass the
+// first-bytes check for AVIF.
+var ErrUnsupportedInputFormat = errors.New("unsupported input format")
+
 // ErrTooManyImages is returned when MaxConcurrentProcessing images are being
 // processed and none finishes within ProcessingWaitTimeout.
 var ErrTooManyImages = errors.New("too many images being processed at once")
@@ -219,6 +235,17 @@ func (p *ImageProcessor) Process(
 		return nil, ErrInputDataTooLarge
 	}
 
+	// govips picks the libvips loader from the input's first bytes with
+	// DetermineImageType. Input whose first bytes it reads as no source
+	// format, such as SVG, which librsvg would render, is refused before
+	// libvips reads it.
+	inputFormat := p.detectFormat(vips.DetermineImageType(data))
+
+	sourceFormat, err := p.formatFromString(inputFormat)
+	if err != nil {
+		return nil, err
+	}
+
 	// Decode image
 	img, err := vips.NewImageFromBuffer(data)
 	if err != nil {
@@ -237,16 +264,16 @@ func (p *ImageProcessor) Process(
 	origWidth := img.Width()
 	origHeight := img.Height()
 
-	// Detect input format
-	inputFormat := p.detectFormat(img)
-
 	// Validate input dimensions to prevent DoS via decompression bombs
 	if origWidth > MaxInputDimension || origHeight > MaxInputDimension {
 		return nil, ErrInputTooLarge
 	}
 
-	// Determine target dimensions
+	// Determine target dimensions; too large ones are refused before resizing
-	targetWidth, targetHeight := targetDimensions(req.Size, origWidth, origHeight)
+	targetWidth, targetHeight, err := targetDimensions(req.Size, origWidth, origHeight)
+	if err != nil {
+		return nil, err
+	}
 
 	// Resize if needed
 	if targetWidth != origWidth || targetHeight != origHeight {
@@ -259,7 +286,7 @@ func (p *ImageProcessor) Process(
 	// orig is the source's own format; encode refuses an empty format
 	outputFormat := req.Format
 	if outputFormat == FormatOriginal {
-		outputFormat = p.formatFromString(inputFormat)
+		outputFormat = sourceFormat
 	}
 
 	// Encode to target format
@@ -282,21 +309,29 @@ func (p *ImageProcessor) Process(
 
 // targetDimensions calculates the output dimensions for a requested size,
 // scaling proportionally when only one dimension is given and keeping the
-// original dimensions when both are zero.
+// original dimensions when both are zero. A side scaled proportionally can
-func targetDimensions(size Size, origWidth, origHeight int) (int, int) {
+// come out above MaxOutputDimension, which is ErrOutputTooLarge.
+func targetDimensions(size Size, origWidth, origHeight int) (int, int, error) {
+	width, height := size.Width, size.Height
+
 	switch {
-	case size.Width == 0 && size.Height == 0:
+	case width == 0 && height == 0:
 		// Both are 0: keep original size
-		return origWidth, origHeight
+		return origWidth, origHeight, nil
-	case size.Width == 0:
+	case width == 0:
 		// Only height specified: calculate width proportionally
-		return origWidth * size.Height / origHeight, size.Height
+		width = origWidth * height / origHeight
-	case size.Height == 0:
+	case height == 0:
 		// Only width specified: calculate height proportionally
-		return size.Width, origHeight * size.Width / origWidth
+		height = origHeight * width / origWidth
-	default:
-		return size.Width, size.Height
 	}
+
+	if width > MaxOutputDimension || height > MaxOutputDimension {
+		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+			width, height, MaxOutputDimension)
+	}
+
+	return width, height, nil
 }
 
 // MIME types for the supported image formats.
@@ -403,10 +438,9 @@ func (p *ImageProcessor) acquireSlot(ctx context.Context) (func(), error) {
 	}
 }
 
-// detectFormat returns the format string from a vips image.
+// detectFormat returns the format string for a govips image type.
-func (p *ImageProcessor) detectFormat(img *vips.ImageRef) string {
+func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
-	format := img.Format()
+	switch imageType {
-	switch format {
 	case vips.ImageTypeJPEG:
 		return "jpeg"
 	case vips.ImageTypePNG:
@@ -428,7 +462,9 @@ func (p *ImageProcessor) detectFormat(img *vips.ImageRef) string {
 	}
 }
 
-// resize resizes the image according to the fit mode.
+// resize resizes the image according to the fit mode. With FitOutside one
+// side can come out larger than requested; when it would be above
+// MaxOutputDimension, resize returns ErrOutputTooLarge without resizing.
 func (p *ImageProcessor) resize(
 	img *vips.ImageRef, width, height int, fit FitMode,
 ) error {
@@ -476,6 +512,12 @@ func (p *ImageProcessor) resize(
 		newW := int(float64(imgW) * scale)
 		newH := int(float64(imgH) * scale)
 
+		// The dimension that exceeds the target is held to the maximum too
+		if newW > MaxOutputDimension || newH > MaxOutputDimension {
+			return fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+				newW, newH, MaxOutputDimension)
+		}
+
 		return img.Thumbnail(newW, newH, vips.InterestingNone)
 
 	default:
@@ -687,22 +729,23 @@ func jxlDistance(quality int) float64 {
 	return 53.0/3000.0*q*q - 23.0/20.0*q + 25.0
 }
 
-// formatFromString converts a format string to Format.
+// formatFromString converts a format string from detectFormat to Format. A
-func (p *ImageProcessor) formatFromString(format string) Format {
+// format detectFormat could not name is ErrUnsupportedInputFormat.
+func (p *ImageProcessor) formatFromString(format string) (Format, error) {
 	switch format {
 	case "jpeg":
-		return FormatJPEG
+		return FormatJPEG, nil
 	case "png":
-		return FormatPNG
+		return FormatPNG, nil
 	case "gif":
-		return FormatGIF
+		return FormatGIF, nil
 	case "webp":
-		return FormatWebP
+		return FormatWebP, nil
 	case string(FormatAVIF):
-		return FormatAVIF
+		return FormatAVIF, nil
 	case string(FormatJXL):
-		return FormatJXL
+		return FormatJXL, nil
 	default:
-		return FormatJPEG
+		return "", fmt.Errorf("%w: %s", ErrUnsupportedInputFormat, format)
 	}
 }

internal/imageprocessor/orig_format_internal_test.go

@@ -0,0 +1,39 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+
+	"github.com/davidbyttow/govips/v2/vips"
+)
+
+// TestImageProcessor_OrigOfUnnamedFormatRefused verifies that orig of a TIFF
+// input, which is not a source format, is refused with
+// ErrUnsupportedInputFormat before it is decoded, and not saved as JPEG.
+func TestImageProcessor_OrigOfUnnamedFormatRefused(t *testing.T) {
+	t.Parallel()
+
+	img, err := vips.NewImageFromBuffer(createTestPNG(t, 20, 20))
+	if err != nil {
+		t.Fatalf("failed to decode test PNG: %v", err)
+	}
+
+	t.Cleanup(img.Close)
+
+	tiff, _, err := img.ExportTiff(vips.NewTiffExportParams())
+	if err != nil {
+		t.Fatalf("failed to save test TIFF: %v", err)
+	}
+
+	result, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(tiff), &Request{Format: FormatOriginal},
+	)
+	if result != nil {
+		t.Logf("Process() returned %s", result.ContentType)
+	}
+
+	if !errors.Is(err, ErrUnsupportedInputFormat) {
+		t.Errorf("Process() error = %v, want %v", err, ErrUnsupportedInputFormat)
+	}
+}

internal/imageprocessor/source_formats_internal_test.go

@@ -0,0 +1,46 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"io"
+	"testing"
+)
+
+// TestImageProcessor_LoadsEachSourceFormat verifies that an image in each of
+// the six source formats, saved by the processor itself, is loaded and saved
+// again in its own format (orig).
+func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
+	t.Parallel()
+
+	proc := New(Params{})
+
+	for _, format := range []Format{
+		FormatJPEG, FormatPNG, FormatGIF, FormatWebP, FormatAVIF, FormatJXL,
+	} {
+		saved, err := proc.Process(t.Context(),
+			bytes.NewReader(createTestPNG(t, 20, 20)), &Request{Format: format})
+		if err != nil {
+			t.Fatalf("saving the test image as %s: %v", format, err)
+		}
+
+		source, err := io.ReadAll(saved.Content)
+		if err != nil {
+			t.Fatalf("reading the %s image: %v", format, err)
+		}
+
+		result, err := proc.Process(t.Context(), bytes.NewReader(source),
+			&Request{Format: FormatOriginal})
+		if err != nil {
+			t.Errorf("orig of the %s image: %v", format, err)
+
+			continue
+		}
+
+		t.Logf("orig of the %s image: %s", format, result.ContentType)
+
+		if result.ContentType != FormatToMIME(format) {
+			t.Errorf("orig of the %s image is %s, want %s",
+				format, result.ContentType, FormatToMIME(format))
+		}
+	}
+}

internal/imgcache/cache.go

@@ -35,7 +35,6 @@ const metaCacheSize = 10000
 // CacheConfig holds cache configuration.
 type CacheConfig struct {
 	StateDir    string
-	CacheTTL    time.Duration
 	NegativeTTL time.Duration
 
 	// MaxBytes is the disk cache size limit in bytes that eviction

internal/imgcache/cache_internal_test.go

@@ -102,7 +102,6 @@ func setupTestCache(t *testing.T) *Cache {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    tmpDir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {
@@ -241,7 +240,6 @@ func TestCache_NegativeCacheExpiry(t *testing.T) {
 	// Very short negative TTL for testing
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    tmpDir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 1 * time.Millisecond,
 	})
 	if err != nil {

internal/imgcache/eviction_internal_test.go

@@ -70,7 +70,6 @@ func newEvictionTestCache(t *testing.T, maxBytes int64) (*Cache, string) {
 	// backwards compatibility with existing fixtures.
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:         tmpDir,
-		CacheTTL:         time.Hour,
 		NegativeTTL:      5 * time.Minute,
 		MaxBytes:         maxBytes,
 		DisableDiskCache: maxBytes == 0,

internal/imgcache/module.go

@@ -4,6 +4,5 @@ import "time"
 
 // CacheConfig defaults.
 const (
-	DefaultCacheTTL    = 24 * time.Hour
 	DefaultNegativeTTL = 5 * time.Minute
 )

internal/imgcache/negative_cache_internal_test.go

@@ -15,7 +15,6 @@ func TestNegativeCache_StoreAndCheck(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {
@@ -63,7 +62,6 @@ func TestNegativeCache_Expired(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 1 * time.Millisecond, // very short TTL
 	})
 	if err != nil {

internal/imgcache/service_internal_test.go

@@ -2,7 +2,9 @@ package imgcache
 
 import (
 	"context"
+	"encoding/json"
 	"io"
+	"os"
 	"testing"
 	"time"
 
@@ -430,6 +432,172 @@ func TestService_Get_Caching(t *testing.T) {
 	}
 }
 
+// TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo caches a source and
+// a variant of it and sets back two days every time pixa stored for them.
+// For the source: fetched_at in source_metadata, fetched_at and
+// last_accessed_at in source_content, the fetched_at in its metadata file,
+// and the access and modification times of its file and of its metadata
+// file. For the variant: created_at and last_accessed_at in variant_content,
+// the created_at in its .meta file, and the access and modification times of
+// its file and of its .meta file. It then checks that the variant is still
+// served from the cache and that a new variant is made from the cached source
+// without fetching it again.
+//
+// Left at the present: the files' status change and birth times, which a
+// program cannot set, and the times of the directories holding the files,
+// which other entries share. The source's stored response headers are empty,
+// as the mock fetcher sends none. expires_at, etag and last_modified in
+// source_metadata and in the metadata file are never written, nor are the
+// request_cache and output_content tables.
+func TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
+	variant := photoVariant(fixtures, 85, FitCover)
+
+	resp, err := svc.Get(t.Context(), variant)
+	if err != nil {
+		t.Fatalf("Get() first request error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	twoDaysAgo := time.Now().AddDate(0, 0, -2)
+	backdateSource(t, svc.cache, variant, twoDaysAgo)
+	backdateVariant(t, svc.cache, variant, twoDaysAgo)
+
+	resp, err = svc.Get(t.Context(), variant)
+	if err != nil {
+		t.Fatalf("Get() of the cached variant error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	if resp.CacheStatus != CacheHit {
+		t.Errorf("cached variant CacheStatus = %q, want %q",
+			resp.CacheStatus, CacheHit)
+	}
+
+	// Another quality is a new variant, made from the cached source
+	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 40, FitCover))
+	if err != nil {
+		t.Fatalf("Get() of a new variant error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	fetches := readCacheStatsCounters(t, svc.cache).upstreamFetchCount
+	if fetches != 1 {
+		t.Errorf("upstream fetches = %d, want 1", fetches)
+	}
+}
+
+// backdateSource sets every time pixa stored for req's cached source to when,
+// as listed on TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo.
+func backdateSource(
+	t *testing.T, cache *Cache, req *ImageRequest, when time.Time,
+) {
+	t.Helper()
+
+	pathHash := HashPath(req.SourcePath + "?" + req.SourceQuery)
+
+	meta, err := cache.srcMetadata.Load(req.SourceHost, pathHash)
+	if err != nil {
+		t.Fatalf("reading the source's metadata file: %v", err)
+	}
+
+	meta.FetchedAt = when.Unix()
+
+	err = cache.srcMetadata.Store(req.SourceHost, pathHash, meta)
+	if err != nil {
+		t.Fatalf("writing the source's metadata file: %v", err)
+	}
+
+	dbTime := when.UTC().Format(sqliteTimestampFormat)
+
+	updateOneRow(t, cache, `
+		UPDATE source_metadata SET fetched_at = ?
+		WHERE source_host = ? AND source_path = ? AND source_query = ?
+	`, dbTime, req.SourceHost, req.SourcePath, req.SourceQuery)
+	updateOneRow(t, cache,
+		`UPDATE source_content SET fetched_at = ? WHERE content_hash = ?`,
+		dbTime, meta.ContentHash)
+	setSourceLastAccessed(t, cache, ContentHash(meta.ContentHash), when)
+
+	for _, path := range []string{
+		cache.srcContent.hashToPath(ContentHash(meta.ContentHash)),
+		cache.srcMetadata.metaPath(req.SourceHost, pathHash),
+	} {
+		err = os.Chtimes(path, when, when)
+		if err != nil {
+			t.Fatalf("setting back the times of %s: %v", path, err)
+		}
+	}
+}
+
+// backdateVariant sets every time pixa stored for the cached variant req asks
+// for to when, as listed on
+// TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo.
+func backdateVariant(
+	t *testing.T, cache *Cache, req *ImageRequest, when time.Time,
+) {
+	t.Helper()
+
+	key := CacheKey(req)
+
+	content, size, contentType, err := cache.variants.LoadWithMeta(key)
+	if err != nil || contentType == "" {
+		t.Fatalf("reading the variant's .meta file: content type %q, error %v",
+			contentType, err)
+	}
+
+	_ = content.Close()
+
+	meta, err := json.Marshal(VariantMeta{
+		ContentType: contentType,
+		Size:        size,
+		CreatedAt:   when.Unix(),
+	})
+	if err != nil {
+		t.Fatalf("encoding the variant's .meta file: %v", err)
+	}
+
+	path := cache.variants.keyToPath(key)
+
+	err = os.WriteFile(path+variantMetaSuffix, meta, StorageFilePerm)
+	if err != nil {
+		t.Fatalf("writing the variant's .meta file: %v", err)
+	}
+
+	updateOneRow(t, cache,
+		`UPDATE variant_content SET created_at = ? WHERE cache_key = ?`,
+		when.UTC().Format(sqliteTimestampFormat), string(key))
+	setVariantLastAccessed(t, cache, key, when)
+
+	for _, file := range []string{path, path + variantMetaSuffix} {
+		err = os.Chtimes(file, when, when)
+		if err != nil {
+			t.Fatalf("setting back the times of %s: %v", file, err)
+		}
+	}
+}
+
+// updateOneRow runs the UPDATE statement query and fails the test unless it
+// changed exactly one row.
+func updateOneRow(t *testing.T, cache *Cache, query string, args ...any) {
+	t.Helper()
+
+	result, err := cache.db.ExecContext(t.Context(), query, args...)
+	if err != nil {
+		t.Fatalf("%s: %v", query, err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil || rows != 1 {
+		t.Fatalf("%s: rows = %d, error = %v, want 1 row", query, rows, err)
+	}
+}
+
 func TestService_Get_DifferentSizes(t *testing.T) {
 	t.Parallel()
 

internal/imgcache/stats_internal_test.go

@@ -43,7 +43,6 @@ func TestStats_HitRateIsRatio(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {
@@ -91,7 +90,6 @@ func TestStats_ZeroCounts(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {
@@ -120,7 +118,6 @@ func TestStats_LogsFailedCountQueries(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 		Logger:      slog.New(slog.NewJSONHandler(&logBuf, nil)),
 	})
@@ -162,7 +159,6 @@ func TestIncrementStats_LogsFailedUpdates(t *testing.T) {
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 		Logger:      slog.New(slog.NewJSONHandler(&logBuf, nil)),
 	})
@@ -232,7 +228,6 @@ func TestStats_DisabledCacheReportsNoItems(t *testing.T) {
 
 	disabled, err := NewCache(enabled.db, CacheConfig{
 		StateDir:         t.TempDir(),
-		CacheTTL:         time.Hour,
 		NegativeTTL:      5 * time.Minute,
 		DisableDiskCache: true,
 	})

internal/imgcache/testutil_internal_test.go

@@ -185,7 +185,6 @@ func SetupTestService(
 
 	cache, err := NewCache(db, CacheConfig{
 		StateDir:    tmpDir,
-		CacheTTL:    time.Hour,
 		NegativeTTL: 5 * time.Minute,
 	})
 	if err != nil {

internal/imgcache/urlparser.go

@@ -7,6 +7,8 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+
+	"sneak.berlin/go/pixa/internal/imageprocessor"
 )
 
 // URL parsing errors.
@@ -20,8 +22,9 @@ var (
 	ErrPathTraversal     = errors.New("path traversal detected")
 )
 
-// MaxDimension is the maximum allowed width or height.
+// MaxDimension is the maximum allowed width or height, the same as the image
-const MaxDimension = 8192
+// processor's maximum for an output image.
+const MaxDimension = imageprocessor.MaxOutputDimension
 
 // ValidateDimension checks one requested width or height; name ("width" or
 // "height") appears in the error. 0 means "original size" and is valid.

internal/server/computed_side_internal_test.go

@@ -0,0 +1,153 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"image/jpeg"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/imgcache"
+)
+
+// TestImageProxyRefusesComputedSideAboveMaximum requests sizes of a 3000x600
+// and a 600x3000 PNG through both image routes. A size with one side 0, whose
+// side computed from the source's proportions would be above 8192, is refused
+// with 400 and the JSON error body. The sizes after those refusals are served
+// as before, which also shows that a refusal is not cached as a failed fetch of
+// the source: orig, a size with both sides given, and a size with one side 0
+// whose computed side stays within 8192.
+func TestImageProxyRefusesComputedSideAboveMaximum(t *testing.T) {
+	t.Parallel()
+
+	// The upstream paths of the two sources
+	const (
+		widePath = "/wide.png"
+		tallPath = "/tall.png"
+	)
+
+	wide := encodeTestPNG(t, 3000, 600)
+	tall := encodeTestPNG(t, 600, 3000)
+
+	upstream := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "image/png")
+
+			if r.URL.Path == tallPath {
+				_, _ = w.Write(tall)
+
+				return
+			}
+
+			_, _ = w.Write(wide)
+		}))
+	t.Cleanup(upstream.Close)
+
+	s, _, _ := startImageProxy(t, upstream)
+
+	generator, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator: %v", err)
+	}
+
+	tests := []struct {
+		path string
+		// size is the size of the /v1/image/ URL, and width and height are
+		// those of the encrypted URL
+		size          string
+		width, height int
+		// wantWidth and wantHeight are the served image's, 0 for a refusal
+		wantWidth, wantHeight int
+	}{
+		{widePath, "0x8192", 0, 8192, 0, 0},
+		{tallPath, "8192x0", 8192, 0, 0, 0},
+		{widePath, "orig", 0, 0, 3000, 600},
+		{widePath, "300x200", 300, 200, 300, 200},
+		{widePath, "0x300", 0, 300, 1500, 300},
+		{tallPath, "300x0", 300, 0, 300, 1500},
+	}
+
+	for _, tt := range tests {
+		token, err := generator.Generate(&encurl.Payload{
+			SourceHost: upstreamHost, SourcePath: tt.path,
+			Width: tt.width, Height: tt.height, Format: imgcache.FormatJPEG,
+		})
+		if err != nil {
+			t.Fatalf("encurl Generate: %v", err)
+		}
+
+		for _, target := range []string{
+			"/v1/image/" + upstreamHost + tt.path + "/" + tt.size + ".jpeg",
+			"/v1/e/" + token + "/img.jpg",
+		} {
+			rec := httptest.NewRecorder()
+			s.ServeHTTP(rec, httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, target, nil))
+			t.Logf("GET %s: %d, Content-Type %s",
+				target, rec.Code, rec.Header().Get("Content-Type"))
+
+			if tt.wantWidth == 0 {
+				checkSizeRefused(t, rec)
+			} else {
+				checkServedSize(t, rec, tt.wantWidth, tt.wantHeight)
+			}
+		}
+	}
+}
+
+// checkSizeRefused checks that rec answers 400 with the JSON error body that
+// refuses a size whose side computed from the source's proportions is above
+// 8192.
+func checkSizeRefused(t *testing.T, rec *httptest.ResponseRecorder) {
+	t.Helper()
+
+	const wantError = "size too large for the source: " +
+		"the side computed from its proportions is above 8192"
+
+	var body struct {
+		Error  string `json:"error"`
+		Status int    `json:"status"`
+	}
+
+	err := json.Unmarshal(rec.Body.Bytes(), &body)
+	if err != nil {
+		t.Errorf("status %d, body is not JSON: %v", rec.Code, err)
+
+		return
+	}
+
+	if rec.Code != http.StatusBadRequest || body.Status != http.StatusBadRequest ||
+		body.Error != wantError {
+		t.Errorf("status %d, body %+v, want %d and the error %q",
+			rec.Code, body, http.StatusBadRequest, wantError)
+	}
+}
+
+// checkServedSize checks that rec answers 200 with a JPEG of wantWidth by
+// wantHeight.
+func checkServedSize(
+	t *testing.T, rec *httptest.ResponseRecorder, wantWidth, wantHeight int,
+) {
+	t.Helper()
+
+	if rec.Code != http.StatusOK {
+		t.Errorf("status %d, want %d; body %s",
+			rec.Code, http.StatusOK, rec.Body.String())
+
+		return
+	}
+
+	served, err := jpeg.DecodeConfig(bytes.NewReader(rec.Body.Bytes()))
+	if err != nil {
+		t.Errorf("decoding the served JPEG: %v", err)
+
+		return
+	}
+
+	if served.Width != wantWidth || served.Height != wantHeight {
+		t.Errorf("served %dx%d, want %dx%d",
+			served.Width, served.Height, wantWidth, wantHeight)
+	}
+}

internal/server/fit_outside_internal_test.go

@@ -0,0 +1,91 @@
+package server
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/imgcache"
+)
+
+// TestImageProxyRefusesFitOutsideAboveMaximum requests sizes with fit=outside
+// through both image routes. fit=outside scales the source to cover the size,
+// and so past it on one side: a size for which that side would be above 8192
+// is refused with 400 and the JSON error body, whether it is the width or the
+// height, and a size for which it stays within 8192 is served at the scaled
+// size.
+func TestImageProxyRefusesFitOutsideAboveMaximum(t *testing.T) {
+	t.Parallel()
+
+	// The upstream paths of the sources
+	const (
+		widePath   = "/wide.png"
+		rowPath    = "/row.png"
+		columnPath = "/column.png"
+	)
+
+	sources := map[string][]byte{
+		widePath:   encodeTestPNG(t, 3000, 600),
+		rowPath:    encodeTestPNG(t, 8192, 1),
+		columnPath: encodeTestPNG(t, 1, 8192),
+	}
+
+	upstream := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "image/png")
+			_, _ = w.Write(sources[r.URL.Path])
+		}))
+	t.Cleanup(upstream.Close)
+
+	s, _, _ := startImageProxy(t, upstream)
+
+	generator, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator: %v", err)
+	}
+
+	tests := []struct {
+		path          string
+		width, height int
+		// wantWidth and wantHeight are the served image's, 0 for a refusal
+		wantWidth, wantHeight int
+	}{
+		{widePath, 1, 8192, 0, 0},
+		{rowPath, 1, 8192, 0, 0},
+		{columnPath, 8192, 1, 0, 0},
+		{widePath, 1, 1200, 6000, 1200},
+	}
+
+	for _, tt := range tests {
+		token, err := generator.Generate(&encurl.Payload{
+			SourceHost: upstreamHost, SourcePath: tt.path,
+			Width: tt.width, Height: tt.height, Format: imgcache.FormatJPEG,
+			FitMode: imgcache.FitOutside,
+		})
+		if err != nil {
+			t.Fatalf("encurl Generate: %v", err)
+		}
+
+		size := fmt.Sprintf("%dx%d", tt.width, tt.height)
+
+		for _, target := range []string{
+			"/v1/image/" + upstreamHost + tt.path + "/" + size +
+				".jpeg?fit=outside",
+			"/v1/e/" + token + "/img.jpg",
+		} {
+			rec := httptest.NewRecorder()
+			s.ServeHTTP(rec, httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, target, nil))
+			t.Logf("GET %s: %d, Content-Type %s",
+				target, rec.Code, rec.Header().Get("Content-Type"))
+
+			if tt.wantWidth == 0 {
+				checkSizeRefused(t, rec)
+			} else {
+				checkServedSize(t, rec, tt.wantWidth, tt.wantHeight)
+			}
+		}
+	}
+}

internal/server/svg_as_avif_internal_test.go

@@ -0,0 +1,71 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/imgcache"
+)
+
+// svgServedAsAVIF is an SVG whose first bytes pass the first-bytes check for
+// AVIF: its XML comment puts "ftypavis" at bytes 4 to 11, where an AVIF file
+// has its ftyp box and brand. libvips would load it as SVG.
+const svgServedAsAVIF = `<!--ftypavis--><svg xmlns="http://www.w3.org/2000/svg" ` +
+	`width="64" height="48"><rect width="64" height="48"/></svg>`
+
+// TestImageProxyRefusesSVGServedAsAVIF requests svgServedAsAVIF, which the
+// upstream answers as image/avif, through both image routes, resized as PNG
+// and in its own format (orig). Each request is answered 415, as for an SVG
+// source, never with an image.
+func TestImageProxyRefusesSVGServedAsAVIF(t *testing.T) {
+	t.Parallel()
+
+	upstream := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "image/avif")
+			_, _ = io.WriteString(w, svgServedAsAVIF)
+		}))
+	t.Cleanup(upstream.Close)
+
+	s, _, _ := startImageProxy(t, upstream)
+
+	generator, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator: %v", err)
+	}
+
+	encryptedURL := func(format imgcache.ImageFormat) string {
+		token, err := generator.Generate(&encurl.Payload{
+			SourceHost: upstreamHost, SourcePath: "/drawing.avif",
+			Width: 32, Height: 24, Format: format,
+		})
+		if err != nil {
+			t.Fatalf("encurl Generate: %v", err)
+		}
+
+		return "/v1/e/" + token + "/drawing." + string(format)
+	}
+
+	for _, target := range []string{
+		"/v1/image/" + upstreamHost + "/drawing.avif/32x24.png",
+		"/v1/image/" + upstreamHost + "/drawing.avif/64x48.orig",
+		encryptedURL(imgcache.FormatPNG),
+		encryptedURL(imgcache.FormatOriginal),
+	} {
+		rec := httptest.NewRecorder()
+		s.ServeHTTP(rec, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, target, nil))
+		t.Logf("GET %s: %d, Content-Type %s, body %q",
+			target, rec.Code, rec.Header().Get("Content-Type"), rec.Body.String())
+
+		if rec.Code != http.StatusUnsupportedMediaType ||
+			!strings.Contains(rec.Body.String(), "unsupported source format") {
+			t.Errorf("GET %s: %d %q, want %d unsupported source format",
+				target, rec.Code, rec.Body.String(), http.StatusUnsupportedMediaType)
+		}
+	}
+}

internal/server/svg_internal_test.go

@@ -0,0 +1,41 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestImageProxyRefusesSVG requests an image the upstream answers as SVG,
+// in its own format (orig) and resized as PNG, through pixa's router,
+// upstream fetcher and image processor. pixa does not accept SVG as a
+// source, so each request is answered 415, never with an image.
+func TestImageProxyRefusesSVG(t *testing.T) {
+	t.Parallel()
+
+	upstream := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "image/svg+xml")
+			_, _ = io.WriteString(w, `<svg xmlns="http://www.w3.org/2000/svg" `+
+				`width="64" height="48"><rect width="64" height="48"/></svg>`)
+		}))
+	t.Cleanup(upstream.Close)
+
+	s, _, _ := startImageProxy(t, upstream)
+
+	for _, sizeFormat := range []string{"64x48.orig", "32x24.png"} {
+		target := "/v1/image/" + upstreamHost + "/drawing.svg/" + sizeFormat
+
+		rec := httptest.NewRecorder()
+		s.ServeHTTP(rec, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, target, nil))
+		t.Logf("GET %s: %d, Content-Type %s, body %s",
+			target, rec.Code, rec.Header().Get("Content-Type"), rec.Body.String())
+
+		if rec.Code != http.StatusUnsupportedMediaType {
+			t.Errorf("GET %s status = %d, want %d",
+				target, rec.Code, http.StatusUnsupportedMediaType)
+		}
+	}
+}