Refuse a q outside 1-100 on /v1/image/ with 400 (closes #134)

The route ignored a q that was not a number or was outside 1-100 and
used 85, so q=banana or q=500 was served as if q were absent and
verified against a signature made for 85.

It now reads q with the check the URL generator uses for its quality
field (parseFormInt with minQuality and maxQuality, default
encurl.DefaultQuality) and answers anything else with a 400 naming q
and the value. That check takes an empty value as missing, so an empty
q in the URL is refused before it. Only a q missing from the URL is
85. README.md states the range.

Model: opus-5-5

TODO.md

@@ -31,11 +31,11 @@ exhaustion
 # Completed Steps
 
 - 2026-09-28 refuse an invalid `q` on `/v1/image/` (closes #134): a `q`
-  that is not a whole number from 1 to 100 is a 400 naming `q` and the
-  value, instead of being served at the default 85; the route reads `q`
-  with the generator's quality check (`parseFormInt` with `minQuality`
-  and `maxQuality`); an absent or empty `q` is still 85; `README.md`
-  states the range.
+  that is not a whole number from 1 to 100, an empty `q` included, is a
+  400 naming `q` and the value, instead of being served at the default
+  85; the route reads `q` with the generator's quality check
+  (`parseFormInt` with `minQuality` and `maxQuality`); only a `q` missing
+  from the URL is still 85; `README.md` states the range.
 - 2026-09-28 unknown `PIXA_` environment variables abort startup (closes
   #133): a variable whose name starts with `PIXA_` but is neither a
   setting's variable nor `PIXA_CONFIG_PATH` aborts startup naming it, as

internal/handlers/auth.go

@@ -18,9 +18,9 @@ import (
 	"sneak.berlin/go/pixa/internal/templates"
 )
 
-// errInvalidFormField reports a generator form field whose value is
-// non-numeric or out of range. The offending field name is wrapped in so the
-// response can name it.
+// errInvalidFormField reports a generator form field, or the q parameter of
+// /v1/image/, whose value is non-numeric or out of range. The offending field
+// name is wrapped in so the response can name it.
 var errInvalidFormField = errors.New("invalid")
 
 // Bounds for the generator's quality and ttl fields; the quality bounds also

internal/handlers/handlers_internal_test.go

@@ -294,21 +294,24 @@ func TestHandleImage_InvalidFitMode_Returns400(t *testing.T) {
 }
 
 // TestHandleImage_InvalidQuality_Returns400 verifies that the plain image
-// route answers a q that is not a whole number from 1 to 100 with 400 naming
-// q and the value, instead of serving the image at the default quality 85.
+// route answers a q that is not a whole number from 1 to 100, an empty one
+// included, with 400 naming q and the value, instead of serving the image at
+// the default quality 85.
 func TestHandleImage_InvalidQuality_Returns400(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		q, wantError string
+		query, wantError string
 	}{
-		{"banana", `invalid q: not a number, got "banana"`},
-		{"0", `invalid q: must be from 1 to 100, got "0"`},
-		{"101", `invalid q: must be from 1 to 100, got "101"`},
+		{"q=banana", `invalid q: not a number, got "banana"`},
+		{"q=0", `invalid q: must be from 1 to 100, got "0"`},
+		{"q=101", `invalid q: must be from 1 to 100, got "101"`},
+		{"q=", `invalid q: not a number, got ""`},
+		{"q=&q=500", `invalid q: not a number, got ""`},
 	}
 
 	for _, tt := range tests {
-		t.Run("q="+tt.q, func(t *testing.T) {
+		t.Run(tt.query, func(t *testing.T) {
 			t.Parallel()
 
 			fix := setupTestHandler(t)
@@ -317,7 +320,7 @@ func TestHandleImage_InvalidQuality_Returns400(t *testing.T) {
 			r.Get("/v1/image/*", fix.handler.HandleImage())
 
 			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-				"/v1/image/"+fix.goodHost+"/images/photo.jpg/50x50.jpeg?q="+tt.q, nil)
+				"/v1/image/"+fix.goodHost+"/images/photo.jpg/50x50.jpeg?"+tt.query, nil)
 			rec := httptest.NewRecorder()
 
 			r.ServeHTTP(rec, req)

internal/handlers/image.go

@@ -102,13 +102,22 @@ func (s *Handlers) parseImageRequest(
 		}
 	}
 
-	// Parse optional quality and fit params. An absent q is 85; a q that is
-	// not a whole number from 1 to 100 is refused, checked as the generator
-	// checks its quality field.
+	// Parse optional quality and fit params. Only a q missing from the URL is
+	// 85. A q in the URL that is not a whole number from 1 to 100, an empty
+	// one included, is refused, checked as the generator checks its quality
+	// field; that check alone would take an empty q as missing.
+	qStr := query.Get("q")
+	if query.Has("q") && qStr == "" {
+		s.respondError(w, `invalid q: not a number, got ""`,
+			http.StatusBadRequest)
+
+		return nil, false
+	}
+
 	req.Quality, err = parseFormInt(query, "q",
 		encurl.DefaultQuality, minQuality, maxQuality)
 	if err != nil {
-		s.respondError(w, fmt.Sprintf("%v, got %q", err, query.Get("q")),
+		s.respondError(w, fmt.Sprintf("%v, got %q", err, qStr),
 			http.StatusBadRequest)
 
 		return nil, false