Count hits, misses, fetches and transforms as Prometheus counters (closes #311)

The five counts the cache_stats table held are now Prometheus counters in
memory, as fields of the cache. NewCache makes them and registers them on
the registry it is given. pixad gives it Prometheus' default registry,
which /metrics serves; each test gives it a new one. The Increment methods
add to their cache's counters, so counting makes no database call.

cache_stats, Cache.Stats, Service.Stats, CacheStats and the pending counts
are gone, with their tests. The background goroutine now writes only access
times, and its names say so: StartPendingAccessTimeWrites,
StopPendingAccessTimeWrites and pendingaccesstimes.go. The two stop tests
whose write under way was a count now use access times.

Model: opus-5-5

TODO.md

@@ -30,240 +30,6 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
-- 2026-10-27 the reconciliation pass skips a directory it cannot list and a file
-  whose info it cannot read, and goes on (closes #343). It stopped before its
-  later checks at a directory it could not list, or at a source or variant file
-  whose info it could not read.
-    - It logs the warning "skipped unreadable entry in cache directory", with
-      the path and the error.
-    - A file renamed or removed after its directory was listed gets no warning.
-    - `reconcileFiles` reads each file's info once, before the temp-file check,
-      and hands it to `sweepStaleTempFile`, `reconcileVariantFile` or
-      `reconcileSourceFile`.
-    - A cancelled context still stops the walk with its error.
-- 2026-10-26 the reconciliation pass drops a variant's accounting row only when
-  its file is missing (closes #340). Any other error reading the file's size
-  keeps the row. It dropped the row on any error and logged the file as missing.
-    - The kept row gets the warning "kept accounting row for unreadable variant
-      file", with the variant key and the error.
-    - The pass checks for `ErrNotFound`, which `FileStore.Size` returns for a
-      missing file.
-- 2026-10-26 on both image routes, a request is answered 499 and logged at info
-  level when its client goes away before its image is ready, unless it is the
-  request making the image (closes #339). It was answered 500 and logged at
-  error level, as pixa's own failure.
-    - The line is "client went away before the image was ready". It carries the
-      `request_id`, the host and the path.
-    - The 499 has no body, since nobody reads it.
-    - `serveImage` answers it before calling `respondImageError`, which cannot
-      see the request's context.
-    - An error wrapping `context.Canceled` while the request's context is live
-      is still answered 500 and logged at error level.
-- 2026-10-26 `README.md`'s Design section starts with a Concepts list (closes
-  #321). Each concept gets one sentence, under the name the code gives it.
-    - Storage calls the transformed images variants, in shorter sentences.
-    - Storage's paths end in the source key and the variant key.
-    - Storage lists the image cache's tables in the database.
-    - Architecture names `internal/providers`, and lists the packages that work
-      with the concepts.
-- 2026-10-26 one table in `internal/config` lists every setting once (closes
-  #320). `Config.settings` gives each setting's key, its environment variable
-  and the function that loads it.
-    - Most rows load through `field`, whose arguments give the setting's type,
-      its default and its check.
-    - `db_url` and `cache_max_bytes` have their own load functions. The default
-      of `db_url` comes from `state_dir`, and `cache_max_bytes` records whether
-      it is set.
-    - Loading, the unknown-key check, the unknown-variable check and the names
-      in error messages all read the table.
-    - `allowlist_hosts` loads as `referer_blocklist` does, through
-      `parseHostList`.
-    - The metrics username and password are checked together once the table has
-      loaded.
-    - When a config holds more than one invalid value, the error names the one
-      that comes first in the table.
-    - `README.md` lists the settings one item each, where it had a table. A test
-      checks that this list and `configs/config.example.yml` name exactly the
-      keys of the table.
-    - The key constants moved to the tests, their only users.
-    - Removed:
-        - `isKnownConfigKey`, `envVarNames`, `strictLoader` and `validate`
-        - `validateAllowlistHostsValue` and `getStringSlice`, with the three
-          tests of `getStringSlice`
-- 2026-10-26 a fetched image's format is detected from its bytes once, as an
-  `imagerequest.Format` (closes #319). The upstream `Content-Type` check in the
-  fetcher stays as the filter before downloading.
-    - `magic.DetectFormat` returns an `imagerequest.Format`, and
-      `magic.ValidateMagicBytes` returns the format it checked against the
-      `Content-Type`.
-    - `Format.MIMEType` gives each format's MIME type. The fetcher, the mock
-      fetcher, the cache's read of a variant's type and the handler's `Accept`
-      matching use it.
-    - `Cache.Source` returns a source's format, read from its file's first bytes
-      as `Cache.Variant` reads a variant's. A file in no source format is an
-      error, and the proxy fetches the source again.
-    - The proxy hands the format to `ImageProcessor.Process`. The processor
-      refuses input that libvips would load as another format, as before, with
-      `ErrUnsupportedInputFormat`. It refuses a format that is not one of the
-      six source formats the same way.
-    - `internal/magic` no longer detects SVG, which pixa does not read. SVG data
-      is `ErrUnknownFormat`.
-    - Removed:
-        - `magic.MIMEType`, `magic.ImageFormat` and `magic.MIMEToImageFormat`
-        - `detectFormat`, `formatFromString`, `FormatToMIME` and
-          `Result.InputFormat` of the processor
-        - the fetcher's MIME constants of the six formats
-        - `errNotAnOutputFormat` of the cache
-- 2026-10-26 the cache keeps its source images in one `imgcache.FileStore` and
-  its variants in another (closes #318). A `FileStore` is a directory of files,
-  each named by a hex key, at `<ab>/<cd>/<key>`.
-    - `ContentStorage` and `VariantStorage` are gone.
-    - `FileStore` has these methods:
-        - `Write`, which writes a file under a temp name, syncs it and renames
-          it into place
-        - `Open`, which returns the file and its size
-        - `Size`
-        - `Delete`
-    - `FileStore` has no `Exists`. The reconciliation pass checks that a
-      variant's file is there with `Size`. The tests look for the file on disk.
-    - `Cache.Variant` reads the content type from the variant file's first
-      bytes, as `VariantStorage.LoadWithContentType` did. A cache hit still
-      makes no database call.
-    - `storage.go` is now `filestore.go`. `internal/imgcache/testdata/red.avif`,
-      which no test used, is gone.
-- 2026-10-26 `internal/imgcache` holds the cache only (closes #317). The new
-  package `internal/imageproxy` fetches, transforms, caches and serves images.
-  It imports `imgcache`, and `imgcache` does not import it.
-    - `imgcache.Service` is `imageproxy.Proxy`, built by `imageproxy.New` from
-      an `imageproxy.Config`.
-    - `ImageResponse`, `CacheStatus`, `ErrNegativeCached` and
-      `ErrProcessingTimedOut` moved with it, under their names.
-    - `imgcache.CacheConfig` is `imgcache.Config`.
-    - The cache has one read and one write for each kind it keeps. Each takes
-      the place of an earlier method:
-        - `Variant`, of `GetVariant`
-        - `PutVariant`, of `StoreVariant`
-        - `Source`, of `LookupSource` followed by `GetSourceContent`
-        - `PutSource`, of `StoreSource`
-        - `Failure`, of `checkNegativeCache`
-        - `PutFailure`, of `StoreNegative`
-    - `Variant` and `Source` each open the file and hand its access time to the
-      background writer. A cache hit still makes no database call.
-    - `imgcache.go` and `module.go` are gone.
-    - `imageproxy.New` makes the counters of upstream fetches and transforms,
-      and registers them on the registry it is given. The cache keeps only the
-      hit and miss counters.
-    - A cached source whose row cannot be read is logged as "failed to load
-      cached source, fetching". It was logged as "source lookup failed".
-    - The proxy's tests moved to `internal/imageproxy`. They reach the cache
-      through its database, its state directory and its metrics registry.
-    - The tests of an empty or cut cached file are split in two:
-        - `internal/imgcache` checks that the reconciliation pass removes the
-          file and its row, with a warning naming the file.
-        - `internal/imageproxy` removes the file and its row as the pass does,
-          and checks that `Get` fetches or converts again.
-- 2026-10-26 both image routes serve an image with one function, `serveImage`,
-  and answer its errors with one, `respondImageError` (closes #316).
-  `HandleImage` parses the path and verifies the signature, and `HandleImageEnc`
-  decrypts the token. Each then calls `serveImage`.
-    - `handleImageError`, the encrypted route's own mapping, is gone.
-    - `/v1/image/` answers 504 when the upstream has not sent its response
-      headers within `upstream_fetch_timeout`, as `/v1/e/` did. It answered 500.
-    - `respondImageError` logs the image service's errors as "failed to get
-      image". Each answer gets the same level on `/v1/image/` and on `/v1/e/`:
-        - 500: error, as pixa's own failure
-        - 400: warn
-        - 403: warn
-        - 415: warn
-        - 502: warn
-        - 503: warn
-        - 504: warn
-    - Before, `/v1/image/` logged all of these answers at error level. `/v1/e/`
-      logged only its 500, as "image request failed", without the host and the
-      path.
-    - `respondImageError` does not log the 415 for a body refused for its first
-      bytes, on either route. The image service logs it as "source refused", at
-      warn level.
-    - The "image served" line carries the host, the path and `fetched_bytes` on
-      both routes. The debug line "encrypted image request" is gone.
-    - The debug line "failed to decrypt URL" is now "invalid encrypted URL". A
-      token that decrypts to a payload that does not decode also gets it.
-    - A failed write is logged once, as "failed to write response" at warn
-      level, since most often the client has gone away. It carries the
-      `request_id`, the host, the path, `served_bytes` and the error, and is not
-      also logged as "image served".
-- 2026-10-26 every key derived from the signing key is derived in one place
-  (closes #315): `seal.DeriveKeys` returns them as one `seal.Keys`, with their
-  salts declared beside it. `internal/providers` calls it once at startup. Each
-  key is derived as before, with `seal.DeriveKey` and the same salt.
-    - The session manager, the encrypted URL generator and the CSRF protection
-      each take their own key instead of the signing key.
-    - `session.NewManager`, `encurl.NewGenerator`, `newCSRFProtect` and
-      `handlers.New` return no error, as nothing in them can fail now.
-    - The signing key itself stays the HMAC key of signed URLs and the login
-      password.
-    - `README.md` says under `signing_key` what it protects.
-- 2026-10-26 the image request holds only what names the cached object (closes
-  #314): its source and its transform, which the variant key covers. The signed
-  URL format, the signing algorithm and every route's answers are unchanged.
-    - The `/v1/image/` handler checks `allowlist_hosts` and verifies the
-      signature itself, with `Signer.Verify(req, sig, expires)`.
-    - Each image handler keeps its URL's expiry as a value of its own, for
-      `Cache-Control`. `encurl`'s `Generate` takes the expiry and its `Parse`
-      returns it.
-    - The fetcher takes the source and builds its URL with `Source.URL`, over
-      http only when the fetcher's own `AllowHTTP` is set. `validateURL` takes
-      that URL, so no URL string is built and parsed again.
-    - `chooseAutoFormat` returns the format it chooses, and the handler puts it
-      into the request it parsed.
-    - The image service serves images through `Get`, and has `WaitForProcessing`
-      for shutdown.
-    - Removed:
-        - `Signature`, `Expires`, `AllowHTTP` and `SourceURL` of the image
-          request
-        - `Service.ValidateRequest`, and the service's signer, allowlist and
-          `AllowHTTP`
-        - `extractHost` of the fetcher and `urlToFSPath` of the mock fetcher
-- 2026-10-26 pixad's fx graph builds the image pipeline (closes #313).
-  `database.New` now opens the database, so the parts below can read it while
-  they are built; its stop hook still runs after the cache's. The cache's
-  `MaxBytes` is the one value for the disk cache limit, and 0 turns the disk
-  cache off. For an omitted `cache_max_bytes`, `internal/providers` works out
-  `config.DefaultCacheMaxBytes` before it builds the cache. `internal/app` and
-  the server tests build the parts below with `providers.Constructors()`; the
-  image proxy test replaces only the fetcher's dial function.
-    - Built by the providers in `internal/providers`, and given to
-      `handlers.New`:
-        - the cache
-        - the fetcher
-        - the processor
-        - the image service
-        - the session manager
-        - the encrypted URL generator
-    - Removed:
-        - `initImageService` and `handlers.Params.Fetcher`
-        - `CacheConfig.UseDefaultMaxBytes`, `CacheConfig.DisableDiskCache` and
-          `Cache.disabled`
-        - `httpfetcher.DefaultConfig()` and the fetcher's copies of setting
-          defaults
-        - `imageprocessor.DefaultMaxInputBytes`, and the processor's defaults
-          for a zero `MaxInputBytes` or `MaxConcurrentProcessing`
-- 2026-10-26 the code nothing in production called is gone (closes #312). The
-  handlers tests sign their image URLs with `generateSignedURL`, a test helper
-  that writes them as the removed generator did. Removed:
-    - `Service.Warm` and the `ImageCache` interface
-    - `Service.GenerateSignedURL` and `Signer.GenerateSignedURL`
-    - `signature.ParseParams`
-    - `imagerequest.ParseImagePath`
-    - `PeekAndValidate`, `IsSupportedMIMEType`, `ImageFormatToMIME` and
-      `FormatOriginal` of `internal/magic`
-    - `SupportedInputFormats` and `SupportedOutputFormats` of the image
-      processor
-    - `IsEmpty` and `Count` of the allowlist
-    - `ssrfSafeDialer`
-    - `CacheStale`, `ErrCacheMiss`, `ErrNegativeCache` and
-      `ImageResponse.LastModified`
-    - `ContentStorage.Load` and `VariantStorage.Load`
 - 2026-10-26 cache hits, misses, upstream fetches, the bytes those fetches read
   and transforms are counted as Prometheus counters in memory (closes #311).
   They are `pixa_cache_hits_total`, `pixa_cache_misses_total`,

internal/allowlist/allowlist.go

@@ -72,3 +72,13 @@ func (w *HostAllowList) IsAllowed(u *url.URL) bool {
 
 	return false
 }
+
+// IsEmpty returns true if the allow list has no entries.
+func (w *HostAllowList) IsEmpty() bool {
+	return len(w.exactHosts) == 0 && len(w.suffixHosts) == 0
+}
+
+// Count returns the total number of allow list entries.
+func (w *HostAllowList) Count() int {
+	return len(w.exactHosts) + len(w.suffixHosts)
+}

internal/allowlist/allowlist_test.go

@@ -139,3 +139,87 @@ func TestHostAllowList_IsAllowed_SuffixMatch(t *testing.T) {
 		},
 	})
 }
+
+func TestHostAllowList_IsEmpty(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		patterns []string
+		want     bool
+	}{
+		{
+			name:     "empty",
+			patterns: []string{},
+			want:     true,
+		},
+		{
+			name:     "nil",
+			patterns: nil,
+			want:     true,
+		},
+		{
+			name:     "whitespace only",
+			patterns: []string{"  ", ""},
+			want:     true,
+		},
+		{
+			name:     "has entries",
+			patterns: []string{"example.com"},
+			want:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			w := allowlist.New(tt.patterns)
+			if got := w.IsEmpty(); got != tt.want {
+				t.Errorf("IsEmpty() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHostAllowList_Count(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		patterns []string
+		want     int
+	}{
+		{
+			name:     "empty",
+			patterns: []string{},
+			want:     0,
+		},
+		{
+			name:     "exact hosts only",
+			patterns: []string{"a.com", "b.com", "c.com"},
+			want:     3,
+		},
+		{
+			name:     "suffix hosts only",
+			patterns: []string{".a.com", ".b.com"},
+			want:     2,
+		},
+		{
+			name:     "mixed",
+			patterns: []string{"exact.com", ".suffix.com"},
+			want:     2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			w := allowlist.New(tt.patterns)
+			if got := w.Count(); got != tt.want {
+				t.Errorf("Count() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

internal/app/app.go

@@ -17,7 +17,6 @@ import (
 	"sneak.berlin/go/pixa/internal/healthcheck"
 	"sneak.berlin/go/pixa/internal/logger"
 	"sneak.berlin/go/pixa/internal/middleware"
-	"sneak.berlin/go/pixa/internal/providers"
 	"sneak.berlin/go/pixa/internal/server"
 )
 
@@ -66,7 +65,6 @@ func run(_ *cobra.Command, _ []string) {
 			// The registry /metrics serves
 			func() prometheus.Registerer { return prometheus.DefaultRegisterer },
 		),
-		fx.Provide(providers.Constructors()...),
 		fx.Invoke(
 			func(log *logger.Logger) { log.Identify() },
 			func(*server.Server) {},

internal/config/cache_max_bytes_internal_test.go

@@ -135,38 +135,10 @@ func TestCacheMaxBytesInvalidValuesAbortStartup(t *testing.T) {
 	}
 }
 
-// TestDefaultCacheMaxBytesAppliesFloor verifies that when 75% of the
-// free space plus what the cache holds is below 500 MiB, the default is
-// floored at DefaultCacheMaxBytesFloor.
-func TestDefaultCacheMaxBytesAppliesFloor(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name      string
-		freeBytes uint64
-	}{
-		{name: "100 MiB free", freeBytes: 104857600},
-		{name: "zero free", freeBytes: 0},
-		{name: "just below floor threshold", freeBytes: 699050665},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := DefaultCacheMaxBytes(tc.freeBytes, 0)
-			if got != DefaultCacheMaxBytesFloor {
-				t.Errorf("DefaultCacheMaxBytes = %d, want floor %d",
-					got, DefaultCacheMaxBytesFloor)
-			}
-		})
-	}
-}
-
 // TestCacheMaxBytesExplicitIsRecorded verifies that an omitted
-// cache_max_bytes is recorded as not explicit, so pixad works out the
-// default when it builds the cache, and that an explicit zero is recorded
-// as explicit, so it disables the disk cache instead.
+// cache_max_bytes is recorded as not explicit, so the cache works out
+// the default when it opens, and that an explicit zero is recorded as
+// explicit, so it disables the disk cache instead.
 func TestCacheMaxBytesExplicitIsRecorded(t *testing.T) {
 	t.Parallel()
 

internal/config/config_internal_test.go

@@ -1,12 +1,97 @@
 package config
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
 	"git.eeqj.de/sneak/smartconfig"
 )
 
+// writeTestConfig writes yamlContent to a temp config file and returns
+// the file path.
+func writeTestConfig(t *testing.T, yamlContent string) string {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "config.yml")
+
+	err := os.WriteFile(configPath, []byte(yamlContent), 0o600)
+	if err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	return configPath
+}
+
+// checkAllowlistHosts loads the config at configPath and asserts that
+// getStringSlice returns the three expected hosts.
+func checkAllowlistHosts(t *testing.T, configPath string) {
+	t.Helper()
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+
+	if len(hosts) != 3 {
+		t.Errorf("expected 3 hosts, got %d: %v", len(hosts), hosts)
+	}
+
+	expected := []string{"static.sneak.cloud", "sneak.berlin", testHostS3}
+	for i, want := range expected {
+		if i >= len(hosts) {
+			t.Errorf("missing host at index %d: want %q", i, want)
+
+			continue
+		}
+
+		if hosts[i] != want {
+			t.Errorf("host[%d] = %q, want %q", i, hosts[i], want)
+		}
+	}
+}
+
+func TestGetStringSlice_YAMLList(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := `
+allowlist_hosts:
+  - static.sneak.cloud
+  - sneak.berlin
+  - s3.sneak.cloud
+`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_CommaSeparated(t *testing.T) {
+	t.Parallel()
+
+	// Backwards compatibility with comma-separated string values.
+	yamlContent := `allowlist_hosts: "static.sneak.cloud, sneak.berlin, s3.sneak.cloud"`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_Empty(t *testing.T) {
+	t.Parallel()
+
+	configPath := writeTestConfig(t, `port: 8080`)
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+	if len(hosts) != 0 {
+		t.Errorf("expected nil or empty slice, got %v", hosts)
+	}
+}
+
 // TestExampleConfigAllowlistsNoHost loads configs/config.example.yml
 // with a real signing key, as Getting Started in README.md has it copied
 // and edited, and checks that it allowlists no host: every image on an

internal/config/config_validation_internal_test.go

@@ -15,36 +15,8 @@ import (
 	_ "modernc.org/sqlite" // SQLite driver registration
 )
 
-// The config keys the tests name in the errors they expect.
-const (
-	keyDebug                      = "debug"
-	keyMaintenanceMode            = "maintenance_mode"
-	keyPort                       = "port"
-	keyStateDir                   = "state_dir"
-	keySentryDSN                  = "sentry_dsn"
-	keyDBURL                      = "db_url"
-	keyMetrics                    = "metrics"
-	keyMetricsUsername            = "metrics.username"
-	keyMetricsPassword            = "metrics.password"
-	keySigningKey                 = "signing_key"
-	keyAllowlistHosts             = "allowlist_hosts"
-	keyRefererBlocklist           = "referer_blocklist"
-	keyAllowHTTP                  = "allow_http"
-	keyUpstreamConnectionsPerHost = "upstream_connections_per_host"
-	keyUpstreamConnections        = "upstream_connections"
-	keyMaxConcurrentProcessing    = "max_concurrent_processing"
-	keyCacheMaxBytes              = "cache_max_bytes"
-	keyBlockedNetworks            = "blocked_networks"
-	keyTrustedProxies             = "trusted_proxies"
-	keyAccessControlAllowOrigin   = "access_control_allow_origin"
-	keyUpstreamFetchTimeout       = "upstream_fetch_timeout"
-	keyUpstreamMaxResponseSize    = "upstream_max_response_size"
-	keyDownstreamTimeout          = "downstream_timeout"
-	keyImageRequestsPerMinute     = "image_requests_per_minute"
-)
-
 // validTestSigningKey is a 32-character signing key that satisfies the
-// minimum length requirement in validateSigningKey.
+// minimum length requirement in validate().
 const validTestSigningKey = "0123456789abcdef0123456789abcdef"
 
 // signingKeyLine is a valid signing_key config line used as the base of

internal/config/documented_settings_internal_test.go

@@ -1,127 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// TestReadmeNamesEverySetting checks that the list of settings in
-// README.md names exactly the keys of the settings table, one item each.
-// The list is the first one in the Configuration section, and it ends at
-// the first blank line. Each item starts with its key in backticks.
-func TestReadmeNamesEverySetting(t *testing.T) {
-	t.Parallel()
-
-	readme, err := os.ReadFile(filepath.Join("..", "..", "README.md"))
-	if err != nil {
-		t.Fatalf("failed to read README.md: %v", err)
-	}
-
-	_, section, found := strings.Cut(string(readme), "\n### Configuration\n")
-	if !found {
-		t.Fatal("README.md has no Configuration section")
-	}
-
-	// The section ends at the next heading of its level or above.
-	section, _, _ = strings.Cut(section, "\n## ")
-	section, _, _ = strings.Cut(section, "\n### ")
-
-	_, list, found := strings.Cut(section, "\n- ")
-	if !found {
-		t.Fatal("README.md's Configuration section has no list")
-	}
-
-	list, _, _ = strings.Cut("- "+list, "\n\n")
-
-	itemKey := regexp.MustCompile("^- `([^`]+)`")
-	named := map[string]bool{}
-
-	for line := range strings.SplitSeq(list, "\n") {
-		// A line that does not start with "- " goes on with the item above.
-		if !strings.HasPrefix(line, "- ") {
-			continue
-		}
-
-		match := itemKey.FindStringSubmatch(line)
-		if match == nil {
-			t.Errorf("README.md's list of settings has an item "+
-				"that does not start with a key in backticks: %s", line)
-
-			continue
-		}
-
-		if named[match[1]] {
-			t.Errorf("README.md's list of settings names %s twice", match[1])
-		}
-
-		named[match[1]] = true
-	}
-
-	for _, s := range new(Config).settings() {
-		if !named[s.key] {
-			t.Errorf("README.md's list of settings does not name %s", s.key)
-		}
-
-		delete(named, s.key)
-	}
-
-	for key := range named {
-		t.Errorf("README.md's list of settings names %s, "+
-			"which is not a setting", key)
-	}
-}
-
-// TestExampleConfigNamesEverySetting checks that
-// configs/config.example.yml names exactly the keys of the settings
-// table, each one set or commented out with "# ". A key line holds the
-// key, a colon and at most a one-word value, which tells it from a
-// comment line that starts with a word and a colon. An indented key is
-// inside the map of the key above it, as username is inside metrics.
-func TestExampleConfigNamesEverySetting(t *testing.T) {
-	t.Parallel()
-
-	const examplePath = "configs/config.example.yml"
-
-	example, err := os.ReadFile(filepath.Join("..", "..", examplePath))
-	if err != nil {
-		t.Fatalf("failed to read %s: %v", examplePath, err)
-	}
-
-	keyLine := regexp.MustCompile(`(?m)^(?:# )?( *)([a-z_]+):(?: \S+)?$`)
-	named := map[string]bool{}
-
-	var mapKey string
-
-	for _, match := range keyLine.FindAllStringSubmatch(string(example), -1) {
-		indent, key := match[1], match[2]
-		if indent == "" {
-			mapKey = key
-			named[key] = true
-
-			continue
-		}
-
-		// The key holding the map is not itself a setting.
-		delete(named, mapKey)
-
-		named[mapKey+"."+key] = true
-	}
-
-	// The env section sets environment variables; it is not a setting.
-	delete(named, "env")
-
-	for _, s := range new(Config).settings() {
-		if !named[s.key] {
-			t.Errorf("%s does not name %s", examplePath, s.key)
-		}
-
-		delete(named, s.key)
-	}
-
-	for key := range named {
-		t.Errorf("%s names %s, which is not a setting", examplePath, key)
-	}
-}

internal/config/env_internal_test.go

@@ -138,8 +138,7 @@ func TestPixaPortAbortsStartupPointingToPort(t *testing.T) {
 
 // TestSettingVariablesAndConfigPathAreAccepted checks that every
 // setting's variable and PIXA_CONFIG_PATH pass the check for unknown
-// PIXA_ variables. TestEnvironmentSetsEveryKey pins the names in the
-// settings table.
+// PIXA_ variables. TestEnvironmentSetsEveryKey pins the names in the list.
 func TestSettingVariablesAndConfigPathAreAccepted(t *testing.T) {
 	// A config file's env section loaded by another test can leave a
 	// PIXA_ variable set for the whole process, so every one is unset
@@ -160,8 +159,8 @@ func TestSettingVariablesAndConfigPathAreAccepted(t *testing.T) {
 
 	t.Setenv("PIXA_CONFIG_PATH", "/etc/pixa/config.yml")
 
-	for _, s := range new(Config).settings() {
-		t.Setenv(s.envVar, "")
+	for _, name := range envVarNames() {
+		t.Setenv(name, "")
 	}
 
 	err := validateKnownEnvVars()

internal/database/database.go

@@ -82,11 +82,7 @@ func ParseMigrationVersion(filename string) (int, error) {
 	return version, nil
 }
 
-// New opens the database and applies the migrations, so that the parts
-// fx builds after it can read the database while they are built. Its
-// stop hook closes the database. fx runs stop hooks in the reverse of the
-// order it built their parts in, so the stop hooks of those parts run
-// before this one.
+// New creates a new Database instance.
 func New(lc fx.Lifecycle, params Params) (*Database, error) {
 	s := &Database{
 		log:    params.Logger.Get(),
@@ -95,16 +91,20 @@ func New(lc fx.Lifecycle, params Params) (*Database, error) {
 
 	s.log.Info("Database instantiated")
 
-	err := s.connect(context.Background())
-	if err != nil {
-		return nil, err
-	}
-
 	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			s.log.Info("Database OnStart Hook")
+
+			return s.connect(ctx)
+		},
 		OnStop: func(_ context.Context) error {
 			s.log.Info("Database OnStop Hook")
 
-			return s.db.Close()
+			if s.db != nil {
+				return s.db.Close()
+			}
+
+			return nil
 		},
 	})
 

internal/encurl/encurl.go

@@ -16,6 +16,9 @@ const (
 	DefaultQuality = 85
 	DefaultFormat  = imagerequest.FormatJXL
 	DefaultFitMode = imagerequest.FitCover
+
+	// HKDF salt for URL encryption key derivation
+	urlKeySalt = "pixa-urlenc-v1"
 )
 
 // Errors returned by encurl operations.
@@ -45,20 +48,23 @@ type Generator struct {
 	key [seal.KeySize]byte
 }
 
-// NewGenerator creates an encrypted URL generator that encrypts its tokens
-// with key.
-func NewGenerator(key [seal.KeySize]byte) *Generator {
-	return &Generator{key: key}
+// NewGenerator creates an encrypted URL generator with a key derived
+// from the signing key.
+func NewGenerator(signingKey string) (*Generator, error) {
+	key, err := seal.DeriveKey([]byte(signingKey), urlKeySalt)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Generator{key: key}, nil
 }
 
-// Generate creates an encrypted URL token from the request's source and
-// transform, each as the request holds it, and from expires; an empty format,
-// a quality of 0 or an empty fit mode is left out of the token, and a zero
-// expires makes a token that never expires. The token is CBOR-encoded,
+// Generate creates an encrypted URL token from the request's source,
+// transform and expiry, each as the request holds it; an empty format, a
+// quality of 0 or an empty fit mode is left out of the token, and a zero
+// Expires makes a token that never expires. The token is CBOR-encoded,
 // encrypted with NaCl secretbox, and base64url-encoded.
-func (g *Generator) Generate(
-	req *imagerequest.Request, expires time.Time,
-) (string, error) {
+func (g *Generator) Generate(req *imagerequest.Request) (string, error) {
 	p := &payload{
 		SourceHost:  req.Source.Host,
 		SourcePath:  req.Source.Path,
@@ -70,8 +76,8 @@ func (g *Generator) Generate(
 		FitMode:     req.Transform.FitMode,
 	}
 
-	if !expires.IsZero() {
-		p.ExpiresAt = expires.Unix()
+	if !req.Expires.IsZero() {
+		p.ExpiresAt = req.Expires.Unix()
 	}
 
 	// CBOR encode the payload
@@ -85,19 +91,19 @@ func (g *Generator) Generate(
 }
 
 // Parse decrypts and validates an encrypted URL token and returns the
-// request it holds, with default values for omitted optional fields, and its
-// expiry. A token that never expires gives the zero time.
+// request it holds, with default values for omitted optional fields. A token
+// that never expires gives the zero Expires.
 // Returns ErrExpired if the token has expired, or other errors for invalid tokens.
-func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error) {
+func (g *Generator) Parse(token string) (*imagerequest.Request, error) {
 	// Decrypt
 	data, err := seal.Decrypt(g.key, token)
 	if err != nil {
 		if errors.Is(err, seal.ErrDecryptionFailed) ||
 			errors.Is(err, seal.ErrInvalidPayload) {
-			return nil, time.Time{}, ErrDecryptFailed
+			return nil, ErrDecryptFailed
 		}
 
-		return nil, time.Time{}, err
+		return nil, err
 	}
 
 	// CBOR decode
@@ -105,12 +111,12 @@ func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error
 
 	err = cbor.Unmarshal(data, &p)
 	if err != nil {
-		return nil, time.Time{}, ErrInvalidFormat
+		return nil, ErrInvalidFormat
 	}
 
 	// Check expiration (0 = never expires)
 	if p.ExpiresAt != 0 && time.Now().Unix() > p.ExpiresAt {
-		return nil, time.Time{}, ErrExpired
+		return nil, ErrExpired
 	}
 
 	format := p.Format
@@ -145,5 +151,6 @@ func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error
 			Quality: quality,
 			FitMode: fitMode,
 		},
-	}, expires, nil
+		Expires: expires,
+	}, nil
 }

internal/encurl/encurl_test.go

@@ -7,7 +7,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
 )
 
 // Shared test fixture strings.
@@ -20,13 +19,11 @@ const (
 func TestGenerator_GenerateAndParse(t *testing.T) {
 	t.Parallel()
 
-	keys, err := seal.DeriveKeys("test-signing-key-12345")
+	gen, err := encurl.NewGenerator("test-signing-key-12345")
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("NewGenerator() error = %v", err)
 	}
 
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host:  testSourceHost,
@@ -39,10 +36,10 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 			Quality: 90,
 			FitMode: imagerequest.FitContain,
 		},
+		Expires: time.Now().Add(time.Hour),
 	}
-	expires := time.Now().Add(time.Hour)
 
-	token, err := gen.Generate(req, expires)
+	token, err := gen.Generate(req)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -51,7 +48,7 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 		t.Fatal("Generate() returned empty token")
 	}
 
-	parsed, parsedExpires, err := gen.Parse(token)
+	parsed, err := gen.Parse(token)
 	if err != nil {
 		t.Fatalf("Parse() error = %v", err)
 	}
@@ -94,30 +91,30 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 			parsed.Transform.FitMode, req.Transform.FitMode)
 	}
 
-	if parsedExpires.Unix() != expires.Unix() {
-		t.Errorf("ExpiresAt = %d, want %d", parsedExpires.Unix(), expires.Unix())
+	if parsed.Expires.Unix() != req.Expires.Unix() {
+		t.Errorf("ExpiresAt = %d, want %d", parsed.Expires.Unix(), req.Expires.Unix())
 	}
 }
 
 func TestGenerator_Parse_Expired(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
+		Expires: time.Now().Add(-time.Hour), // Already expired
 	}
 
-	token, err := gen.Generate(req, time.Now().Add(-time.Hour)) // Already expired
+	token, err := gen.Generate(req)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	_, _, err = gen.Parse(token)
+	_, err = gen.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail for expired token")
 	}
@@ -130,10 +127,9 @@ func TestGenerator_Parse_Expired(t *testing.T) {
 func TestGenerator_Parse_InvalidToken(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	_, _, err := gen.Parse("not-a-valid-token")
+	_, err := gen.Parse("not-a-valid-token")
 	if err == nil {
 		t.Error("Parse() should fail for invalid token")
 	}
@@ -142,17 +138,17 @@ func TestGenerator_Parse_InvalidToken(t *testing.T) {
 func TestGenerator_Parse_TamperedToken(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
+		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen.Generate(req)
 
 	// Tamper with the token
 	tampered := []byte(token)
@@ -160,7 +156,7 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 		tampered[10] ^= 0x01
 	}
 
-	_, _, err := gen.Parse(string(tampered))
+	_, err := gen.Parse(string(tampered))
 	if err == nil {
 		t.Error("Parse() should fail for tampered token")
 	}
@@ -169,21 +165,20 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 func TestGenerator_Parse_WrongKey(t *testing.T) {
 	t.Parallel()
 
-	keys1, _ := seal.DeriveKeys("signing-key-1")
-	keys2, _ := seal.DeriveKeys("signing-key-2")
-	gen1 := encurl.NewGenerator(keys1.EncryptedURLKey)
-	gen2 := encurl.NewGenerator(keys2.EncryptedURLKey)
+	gen1, _ := encurl.NewGenerator("signing-key-1")
+	gen2, _ := encurl.NewGenerator("signing-key-2")
 
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
+		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen1.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen1.Generate(req)
 
-	_, _, err := gen2.Parse(token)
+	_, err := gen2.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail with different signing key")
 	}
@@ -192,8 +187,7 @@ func TestGenerator_Parse_WrongKey(t *testing.T) {
 func TestGenerator_Parse_Defaults(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
 	// Request with only required fields - should get defaults
 	token, err := gen.Generate(&imagerequest.Request{
@@ -201,12 +195,13 @@ func TestGenerator_Parse_Defaults(t *testing.T) {
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
-	}, time.Now().Add(time.Hour))
+		Expires: time.Now().Add(time.Hour),
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	req, _, err := gen.Parse(token)
+	req, err := gen.Parse(token)
 	if err != nil {
 		t.Fatalf("Parse() error = %v", err)
 	}
@@ -230,17 +225,17 @@ func TestGenerator_Parse_Defaults(t *testing.T) {
 func TestGenerator_TokenIsURLSafe(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: testSourceHost,
 			Path: testSourcePath,
 		},
+		Expires: time.Now().Add(time.Hour),
 	}
 
-	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen.Generate(req)
 
 	// Check that token only contains URL-safe characters
 	for _, c := range token {

internal/handlers/auth.go

@@ -153,20 +153,20 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			return
 		}
 
-		// The image URL must fetch the source URL as it was written. The
-		// fetcher fetches over http only when allow_http is set.
-		fetchURL := req.Source.URL(s.config.AllowHTTP)
+		// The image URL must fetch the source URL as it was written
+		req.AllowHTTP = s.config.AllowHTTP
+		fetchURL := req.SourceURL()
 
 		if !fetchedAsWritten(parsed, fetchURL) {
 			s.renderGeneratorWithForm(w, r, "Source URL cannot be fetched as "+
-				"written: pixa would fetch "+fetchURL.String(),
+				"written: pixa would fetch "+fetchURL,
 				r.Form, http.StatusBadRequest)
 
 			return
 		}
 
 		// Generate encrypted token
-		token, err := s.encGen.Generate(req, expiresAt)
+		token, err := s.encGen.Generate(req)
 		if err != nil {
 			s.log.Error("failed to generate encrypted URL", "error", err)
 			s.renderGeneratorWithForm(w, r, "Failed to generate URL", r.Form,
@@ -226,23 +226,25 @@ func parseSourceURL(sourceURL string) (*url.URL, error) {
 // in RawPath when it is not the decoded path percent-encoded again.
 // EscapedPath ignores RawPath when it also holds a character net/url encodes,
 // such as a space, so RawPath is compared itself.
-func fetchedAsWritten(source, fetchURL *url.URL) bool {
+func fetchedAsWritten(source *url.URL, fetchURL string) bool {
 	writtenPath := source.RawPath
 	if writtenPath == "" {
 		writtenPath = source.EscapedPath()
 	}
 
-	return source.User == nil && !source.ForceQuery &&
-		fetchURL.EscapedPath() == writtenPath &&
-		fetchURL.RawQuery == source.RawQuery
+	fetched, err := url.Parse(fetchURL)
+
+	return err == nil && source.User == nil && !source.ForceQuery &&
+		fetched.EscapedPath() == writtenPath &&
+		fetched.RawQuery == source.RawQuery
 }
 
 // buildGenerateRequest parses the numeric form fields and assembles the
-// image request the encrypted URL's token is made from, and its expiry.
-// ttl=0 means never expires (the expiry is the zero time). A non-numeric or
-// out-of-range width, height, quality or ttl, or an unrecognized fit mode, is
-// a client error naming the offending field. The format field is passed
-// through unchecked.
+// image request the encrypted URL's token is made from. ttl=0 means never
+// expires (Expires stays the zero time). A non-numeric or out-of-range
+// width, height, quality or ttl, or an unrecognized fit mode, is a client
+// error naming the offending field. The format field is passed through
+// unchecked.
 func buildGenerateRequest(
 	parsed *url.URL, form url.Values,
 ) (*imagerequest.Request, time.Time, int, error) {
@@ -292,6 +294,7 @@ func buildGenerateRequest(
 			Quality: quality,
 			FitMode: fitMode,
 		},
+		Expires: expiresAt,
 	}
 
 	return req, expiresAt, ttl, nil

internal/handlers/auth_csrf_internal_test.go

@@ -14,7 +14,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -45,17 +44,27 @@ func newCSRFTestRouter(t *testing.T) (*Handlers, http.Handler) {
 
 	cfg := &config.Config{SigningKey: testSigningKey, Debug: true}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
+	}
+
+	encGen, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
+	}
+
+	protect, err := newCSRFProtect(testSigningKey, cfg.Debug)
+	if err != nil {
+		t.Fatalf("newCSRFProtect() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:         slog.New(slog.DiscardHandler),
 		config:      cfg,
-		sessMgr:     session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
-		encGen:      encurl.NewGenerator(keys.EncryptedURLKey),
-		csrfProtect: newCSRFProtect(keys.CSRFKey, cfg.Debug),
+		sessMgr:     sessMgr,
+		encGen:      encGen,
+		csrfProtect: protect,
 	}
 
 	r := chi.NewRouter()

internal/handlers/auth_login_log_internal_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 
 	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -23,15 +22,15 @@ func TestLoginLogLeavesOutSubmittedKey(t *testing.T) {
 
 	var buf bytes.Buffer
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:     slog.New(slog.NewJSONHandler(&buf, nil)),
 		config:  &config.Config{SigningKey: testSigningKey},
-		sessMgr: session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
+		sessMgr: sessMgr,
 	}
 
 	submittedKeys := []string{wrongKey, testSigningKey}

internal/handlers/auth_session_internal_test.go

@@ -11,7 +11,6 @@ import (
 	"time"
 
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -233,13 +232,8 @@ func TestHandleLogout_SaveFails_Answers500(t *testing.T) {
 
 	db := setupTestDB(t)
 
-	keys, err := seal.DeriveKeys(testSigningKey)
-	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
-	}
-
 	sessMgr, err := session.NewManagerWithDatabase(
-		t.Context(), keys.SessionHashKey, keys.SessionBlockKey, db)
+		t.Context(), testSigningKey, db)
 	if err != nil {
 		t.Fatalf("session.NewManagerWithDatabase() error = %v", err)
 	}

internal/handlers/avif_too_large_internal_test.go

@@ -12,11 +12,11 @@ import (
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// TestAVIFOutputTooLargeAnswers400 checks that respondImageError, which
-// answers the errors of both image routes, answers 400 naming the AVIF pixel
-// limit when the image processor refuses an AVIF output above it, wrapped as
-// the service wraps it. The request's source only goes into a log line, so it
-// is left empty.
+// TestAVIFOutputTooLargeAnswers400 checks that respondImageError and
+// handleImageError, which answer the errors of the two image routes, answer
+// 400 naming the AVIF pixel limit when the image processor refuses an AVIF
+// output above it, wrapped as the service wraps it. The request's source only
+// goes into a log line, so it is left empty.
 func TestAVIFOutputTooLargeAnswers400(t *testing.T) {
 	t.Parallel()
 
@@ -25,15 +25,25 @@ func TestAVIFOutputTooLargeAnswers400(t *testing.T) {
 		imageprocessor.ErrAVIFOutputTooLarge)
 	wantBody := fmt.Sprintf("above %d pixels", imageprocessor.MaxAVIFOutputPixels)
 
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("status = %d, body = %q", rec.Code, rec.Body.String())
+	plain := httptest.NewRecorder()
+	h.respondImageError(plain, &imagerequest.Request{}, err)
 
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusBadRequest)
-	}
+	encrypted := httptest.NewRecorder()
+	h.handleImageError(encrypted, err)
 
-	if !strings.Contains(rec.Body.String(), wantBody) {
-		t.Errorf("body = %q, want it to say %q", rec.Body.String(), wantBody)
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"respondImageError": plain, "handleImageError": encrypted,
+	} {
+		t.Logf("%s: status = %d, body = %q", name, rec.Code, rec.Body.String())
+
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("%s: status = %d, want %d",
+				name, rec.Code, http.StatusBadRequest)
+		}
+
+		if !strings.Contains(rec.Body.String(), wantBody) {
+			t.Errorf("%s: body = %q, want it to say %q",
+				name, rec.Body.String(), wantBody)
+		}
 	}
 }

internal/handlers/bodylimit_internal_test.go

@@ -11,7 +11,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -33,17 +32,27 @@ func newBodyLimitTestRouter(
 
 	cfg := &config.Config{SigningKey: testSigningKey, Debug: true}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
+	}
+
+	encGen, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
+	}
+
+	protect, err := newCSRFProtect(testSigningKey, cfg.Debug)
+	if err != nil {
+		t.Fatalf("newCSRFProtect() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:         slog.New(slog.DiscardHandler),
 		config:      cfg,
-		sessMgr:     session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
-		encGen:      encurl.NewGenerator(keys.EncryptedURLKey),
-		csrfProtect: newCSRFProtect(keys.CSRFKey, cfg.Debug),
+		sessMgr:     sessMgr,
+		encGen:      encGen,
+		csrfProtect: protect,
 	}
 
 	r := chi.NewRouter()

internal/handlers/cache_hit_internal_test.go

@@ -19,15 +19,10 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus"
 
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // countingHost is the allowlisted host whose photoPath the server of
@@ -123,38 +118,32 @@ func newCountingDatabaseServer(
 		tb.Fatalf("encoding the photo: %v", err)
 	}
 
-	cache, err := imgcache.NewCache(db, imgcache.Config{
+	cache, err := imgcache.NewCache(db, imgcache.CacheConfig{
 		StateDir:    tb.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		tb.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
 		Cache: cache,
 		Fetcher: newMockFetcher(fstest.MapFS{
 			countingHost + photoPath: &fstest.MapFile{Data: photo.Bytes()},
 		}),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          slog.New(slog.DiscardHandler),
-	}, prometheus.NewRegistry())
+		SigningKey: testSigningKey,
+		Allowlist:  []string{countingHost},
+		Logger:     slog.New(slog.DiscardHandler),
+	})
 	if err != nil {
-		tb.Fatalf("imageproxy.New() error = %v", err)
+		tb.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		tb.Fatalf("seal.DeriveKeys() error = %v", err)
+		tb.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	token, err := encGen.Generate(&imagerequest.Request{
 		Source: imagerequest.Source{Host: countingHost, Path: photoPath},
 		Transform: imagerequest.Transform{
@@ -163,17 +152,15 @@ func newCountingDatabaseServer(
 			Quality: 85,
 			FitMode: imagerequest.FitCover,
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		tb.Fatalf("encGen.Generate() error = %v", err)
 	}
 
 	h := &Handlers{
-		log:       slog.New(slog.DiscardHandler),
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{countingHost}),
+		log:    slog.New(slog.DiscardHandler),
+		imgSvc: svc,
+		encGen: encGen,
 	}
 
 	r := chi.NewRouter()
@@ -229,9 +216,9 @@ func TestImageRoutes_CacheHitsMakeNoDatabaseCall(t *testing.T) {
 			rec := serveImage(t, srv, target)
 
 			cacheStatus := rec.Header().Get("X-Pixa-Cache")
-			if cacheStatus != string(imageproxy.CacheHit) {
+			if cacheStatus != string(imgcache.CacheHit) {
 				t.Errorf("GET %s: X-Pixa-Cache = %q, want %s",
-					target, cacheStatus, imageproxy.CacheHit)
+					target, cacheStatus, imgcache.CacheHit)
 			}
 		}
 
@@ -261,9 +248,9 @@ func BenchmarkHandleImage_CacheHits(b *testing.B) {
 			rec := serveImage(b, srv, target)
 
 			cacheStatus := rec.Header().Get("X-Pixa-Cache")
-			if cacheStatus != string(imageproxy.CacheHit) {
+			if cacheStatus != string(imgcache.CacheHit) {
 				b.Errorf("GET %s: X-Pixa-Cache = %q, want %s",
-					target, cacheStatus, imageproxy.CacheHit)
+					target, cacheStatus, imgcache.CacheHit)
 
 				return
 			}

internal/handlers/cache_max_bytes_internal_test.go

@@ -0,0 +1,151 @@
+package handlers
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/fx/fxtest"
+
+	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
+	"sneak.berlin/go/pixa/internal/globals"
+	"sneak.berlin/go/pixa/internal/logger"
+)
+
+// TestNewCacheConfigFromCacheMaxBytes checks the cache configuration
+// built from cache_max_bytes: omitted, the cache works out the default
+// limit; 0 turns the disk cache off; a positive value is the limit,
+// unchanged.
+func TestNewCacheConfigFromCacheMaxBytes(t *testing.T) {
+	t.Parallel()
+
+	const oneGiB = 1 << 30
+
+	cases := []struct {
+		name                   string
+		cacheMaxBytes          int64
+		cacheMaxBytesExplicit  bool
+		wantMaxBytes           int64
+		wantUseDefaultMaxBytes bool
+		wantDisableDiskCache   bool
+	}{
+		{
+			name:                   "cache_max_bytes omitted",
+			cacheMaxBytes:          0,
+			cacheMaxBytesExplicit:  false,
+			wantMaxBytes:           0,
+			wantUseDefaultMaxBytes: true,
+			wantDisableDiskCache:   false,
+		},
+		{
+			name:                   "cache_max_bytes: 0",
+			cacheMaxBytes:          0,
+			cacheMaxBytesExplicit:  true,
+			wantMaxBytes:           0,
+			wantUseDefaultMaxBytes: false,
+			wantDisableDiskCache:   true,
+		},
+		{
+			name:                   "cache_max_bytes: 1 GiB",
+			cacheMaxBytes:          oneGiB,
+			cacheMaxBytesExplicit:  true,
+			wantMaxBytes:           oneGiB,
+			wantUseDefaultMaxBytes: false,
+			wantDisableDiskCache:   false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &config.Config{
+				CacheMaxBytes:         tc.cacheMaxBytes,
+				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
+			}
+
+			got := newCacheConfig(cfg, nil)
+			t.Logf("MaxBytes = %d, UseDefaultMaxBytes = %v, DisableDiskCache = %v",
+				got.MaxBytes, got.UseDefaultMaxBytes, got.DisableDiskCache)
+
+			if got.MaxBytes != tc.wantMaxBytes {
+				t.Errorf("MaxBytes = %d, want %d", got.MaxBytes, tc.wantMaxBytes)
+			}
+
+			if got.UseDefaultMaxBytes != tc.wantUseDefaultMaxBytes {
+				t.Errorf("UseDefaultMaxBytes = %v, want %v",
+					got.UseDefaultMaxBytes, tc.wantUseDefaultMaxBytes)
+			}
+
+			if got.DisableDiskCache != tc.wantDisableDiskCache {
+				t.Errorf("DisableDiskCache = %v, want %v",
+					got.DisableDiskCache, tc.wantDisableDiskCache)
+			}
+		})
+	}
+}
+
+// TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes starts the handlers
+// once with cache_max_bytes omitted and once with cache_max_bytes: 0,
+// and checks by whether the cache directories were created that the
+// disk cache is on in the first case and off in the second.
+func TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name                  string
+		cacheMaxBytesExplicit bool
+		wantDiskCache         bool
+	}{
+		{name: "cache_max_bytes omitted", cacheMaxBytesExplicit: false, wantDiskCache: true},
+		{name: "cache_max_bytes: 0", cacheMaxBytesExplicit: true, wantDiskCache: false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			stateDir := t.TempDir()
+			cfg := &config.Config{
+				SigningKey:            testSigningKey,
+				StateDir:              stateDir,
+				DBURL:                 "file:" + filepath.Join(stateDir, "state.sqlite3"),
+				CacheMaxBytes:         0,
+				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
+			}
+
+			lc := fxtest.NewLifecycle(t)
+
+			log, err := logger.New(lc, logger.Params{Globals: &globals.Globals{}})
+			if err != nil {
+				t.Fatalf("logger.New() error = %v", err)
+			}
+
+			db, err := database.New(lc, database.Params{Logger: log, Config: cfg})
+			if err != nil {
+				t.Fatalf("database.New() error = %v", err)
+			}
+
+			_, err = New(lc, Params{
+				Logger: log, Database: db, Config: cfg,
+				MetricsRegistry: prometheus.NewRegistry(),
+			})
+			if err != nil {
+				t.Fatalf("New() error = %v", err)
+			}
+
+			lc.RequireStart()
+			t.Cleanup(lc.RequireStop)
+
+			_, err = os.Stat(filepath.Join(stateDir, "cache", "variants"))
+			gotDiskCache := err == nil
+
+			if gotDiskCache != tc.wantDiskCache {
+				t.Errorf("cache directories created = %v, want %v",
+					gotDiskCache, tc.wantDiskCache)
+			}
+		})
+	}
+}

internal/handlers/client_gone_internal_test.go

@@ -1,177 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// heldFetcher sends on started when a fetch begins, and holds the fetch until
-// release is closed. It then fails the fetch as an upstream error.
-type heldFetcher struct {
-	started chan struct{}
-	release chan struct{}
-}
-
-// Fetch sends on f.started, waits for f.release to be closed, and returns
-// httpfetcher.ErrUpstreamError.
-func (f heldFetcher) Fetch(
-	context.Context, imagerequest.Source,
-) (*httpfetcher.FetchResult, error) {
-	f.started <- struct{}{}
-
-	<-f.release
-
-	return nil, httpfetcher.ErrUpstreamError
-}
-
-// readLogLines decodes the JSON log lines in logs.
-func readLogLines(t *testing.T, logs *bytes.Buffer) []map[string]any {
-	t.Helper()
-
-	t.Logf("logged:\n%s", logs.String())
-
-	var lines []map[string]any
-
-	dec := json.NewDecoder(logs)
-	for dec.More() {
-		var line map[string]any
-
-		err := dec.Decode(&line)
-		if err != nil {
-			t.Fatalf("decoding log line: %v", err)
-		}
-
-		lines = append(lines, line)
-	}
-
-	return lines
-}
-
-// TestImageRoutes_ClientGoneWhileWaitingAnswers499 checks that both image
-// routes answer 499 to a request whose client goes away while it waits for an
-// image another request is making. A first request's fetch is held, so the
-// image is being made, and a second request for the same image waits for it
-// until its client goes away. The second request must be logged once at info
-// level with its request ID and the source host and path. Nothing may be
-// logged at error level.
-func TestImageRoutes_ClientGoneWhileWaitingAnswers499(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			fetcher := heldFetcher{started: make(chan struct{}), release: make(chan struct{})}
-			h, routes := newRoutesFetchingThrough(t, fetcher,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-			target := imageURL(t, h)
-
-			firstDone := make(chan struct{})
-
-			go func() {
-				defer close(firstDone)
-
-				sendGet(t, routes, target)
-			}()
-
-			<-fetcher.started
-
-			ctx, cancel := context.WithCancel(context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID))
-			rec := httptest.NewRecorder()
-			secondDone := make(chan struct{})
-
-			go func() {
-				defer close(secondDone)
-
-				routes.ServeHTTP(rec, httptest.NewRequestWithContext(
-					ctx, http.MethodGet, target, nil))
-			}()
-
-			// Give the second request time to start waiting for the first
-			// request's image. The fetch is still held, so the second request
-			// can end only because its client went away
-			time.Sleep(100 * time.Millisecond)
-			cancel()
-			<-secondDone
-
-			close(fetcher.release)
-			<-firstDone
-
-			if rec.Code != 499 {
-				t.Errorf("status = %d, want 499", rec.Code)
-			}
-
-			var clientGoneLines int
-
-			for _, line := range readLogLines(t, &logs) {
-				if line["level"] == slog.LevelError.String() {
-					t.Errorf("logged at error level: %v", line["msg"])
-				}
-
-				if line["level"] == slog.LevelInfo.String() &&
-					line["msg"] == "client went away before the image was ready" &&
-					line["request_id"] == requestID &&
-					line["host"] == signedHost &&
-					line["path"] == photoPath {
-					clientGoneLines++
-				}
-			}
-
-			if clientGoneLines != 1 {
-				t.Errorf("info line naming the request logged %d times, want 1",
-					clientGoneLines)
-			}
-		})
-	}
-}
-
-// TestImageRoutes_CanceledWithLiveRequestAnswers500 checks that both image
-// routes answer 500, logged as "failed to get image" at error level, for an
-// image service error that wraps context.Canceled while the request's own
-// context is live. Its client has not gone away, so the cancellation is
-// pixa's own failure.
-func TestImageRoutes_CanceledWithLiveRequestAnswers500(t *testing.T) {
-	t.Parallel()
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, routes := newRoutesFetchingThrough(t,
-				failingFetcher{err: context.Canceled},
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			rec := sendGet(t, routes, imageURL(t, h))
-			if rec.Code != http.StatusInternalServerError {
-				t.Errorf("status = %d, want %d",
-					rec.Code, http.StatusInternalServerError)
-			}
-
-			if !slices.ContainsFunc(readLogLines(t, &logs),
-				func(line map[string]any) bool {
-					return line["level"] == slog.LevelError.String() &&
-						line["msg"] == "failed to get image"
-				}) {
-				t.Error(`no "failed to get image" line logged at error level`)
-			}
-		})
-	}
-}

internal/handlers/csrf.go

@@ -9,10 +9,15 @@ import (
 	"sneak.berlin/go/pixa/internal/seal"
 )
 
+// csrfKeySalt provides domain separation for the CSRF authentication key,
+// derived from the signing key so tokens survive restarts without extra
+// configuration and never reuse the session or encrypted-URL key material.
+const csrfKeySalt = "pixa-csrf-v1"
+
 // newCSRFProtect builds the CSRF-protection middleware for the
 // state-mutating HTML form routes. The token lives in its own cookie,
 // independent of the session cookie, so it also protects the login POST
-// where no session exists yet (login CSRF). key signs that cookie.
+// where no session exists yet (login CSRF).
 //
 // When plaintext is true (local HTTP development), requests are marked
 // plaintext so the library neither demands an https Referer nor sets a
@@ -20,8 +25,13 @@ import (
 // service runs behind a TLS-terminating proxy, so plaintext is false and
 // the library enforces its https Referer origin check.
 func newCSRFProtect(
-	key [seal.KeySize]byte, plaintext bool,
-) func(http.Handler) http.Handler {
+	signingKey string, plaintext bool,
+) (func(http.Handler) http.Handler, error) {
+	key, err := seal.DeriveKey([]byte(signingKey), csrfKeySalt)
+	if err != nil {
+		return nil, err
+	}
+
 	protect := csrf.Protect(
 		key[:],
 		csrf.Path("/"),
@@ -30,7 +40,7 @@ func newCSRFProtect(
 	)
 
 	if !plaintext {
-		return protect
+		return protect, nil
 	}
 
 	return func(next http.Handler) http.Handler {
@@ -39,7 +49,7 @@ func newCSRFProtect(
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			protected.ServeHTTP(w, csrf.PlaintextHTTPRequest(r))
 		})
-	}
+	}, nil
 }
 
 // CSRF returns the CSRF-protection middleware for the login and generator

internal/handlers/fetcher_internal_test.go

@@ -0,0 +1,63 @@
+package handlers
+
+import (
+	"net/http"
+	"net/netip"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxtest"
+
+	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
+	"sneak.berlin/go/pixa/internal/globals"
+	"sneak.berlin/go/pixa/internal/healthcheck"
+	"sneak.berlin/go/pixa/internal/logger"
+)
+
+// TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided builds the handlers as
+// pixad does, in an fx app that provides no fetcher, and requests an image
+// from 192.0.2.10, which is on the allowlist and in blocked_networks. The URL
+// check accepts that address; only the dialer that refuses internal
+// addresses checks blocked_networks, so the answer is 403 only if the
+// fetcher the handlers build from the config connects with that dialer. Any
+// other dialer would try to connect until the upstream fetch timeout, which
+// is short so that the test then fails quickly.
+func TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided(t *testing.T) {
+	t.Parallel()
+
+	const host = "192.0.2.10"
+
+	stateDir := t.TempDir()
+	cfg := &config.Config{
+		SigningKey:           testSigningKey,
+		StateDir:             stateDir,
+		DBURL:                "file:" + filepath.Join(stateDir, "state.sqlite3"),
+		AllowlistHosts:       []string{host},
+		BlockedNetworks:      []netip.Prefix{netip.MustParsePrefix("192.0.2.0/24")},
+		UpstreamFetchTimeout: 2 * time.Second,
+		// With no connection slots, the fetch would fail before dialing.
+		UpstreamConnections: config.DefaultUpstreamConnections,
+	}
+
+	var h *Handlers
+
+	app := fxtest.New(t,
+		fx.Supply(cfg),
+		fx.Provide(globals.New, logger.New, database.New, healthcheck.New, New,
+			func() prometheus.Registerer { return prometheus.NewRegistry() }),
+		fx.Populate(&h),
+	)
+	app.RequireStart()
+	t.Cleanup(app.RequireStop)
+
+	r := chi.NewRouter()
+	r.Get("/v1/image/*", h.HandleImage())
+
+	rec := sendGet(t, r, photoURL(host))
+	checkErrorBody(t, rec, http.StatusForbidden, "forbidden")
+}

internal/handlers/first_bytes_internal_test.go

@@ -13,15 +13,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // mismatchedSourcePath is the path of the source that
@@ -31,51 +26,38 @@ import (
 const mismatchedSourcePath = "/images/source.png"
 
 // newRoutesFetchingThrough returns both image routes, and the Handlers behind
-// them, whose image service fetches through fetcher, and which have
-// allowlistedHost on their allowlist. The handlers and the image service log
-// to log.
+// them, whose image service fetches through fetcher and has allowlistedHost on
+// its allowlist. The handlers and the image service log to log.
 func newRoutesFetchingThrough(
 	t *testing.T, fetcher httpfetcher.Fetcher, log *slog.Logger,
 ) (*Handlers, http.Handler) {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          log,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+		Logger:     log,
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	h := &Handlers{
-		log:       log,
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
-	}
+	h := &Handlers{log: log, imgSvc: svc, encGen: encGen}
 
 	r := chi.NewRouter()
 	r.Get("/v1/image/*", h.HandleImage())
@@ -104,7 +86,7 @@ func mismatchedSourceEncURL(t *testing.T, h *Handlers) string {
 			Size:   imagerequest.Size{Width: 50, Height: 50},
 			Format: imagerequest.FormatJPEG,
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/format_auto.go

@@ -18,17 +18,16 @@ var (
 		"image/jxl, image/avif, image/webp or image/jpeg")
 )
 
-// chooseAutoFormat returns the format to serve for the requested format: for
-// the format auto, the format formatForAccept chooses from r's Accept header,
-// and any other format as it is. For auto it adds Vary: Accept to the
+// chooseAutoFormat replaces the format auto in req with the format
+// formatForAccept chooses from r's Accept header, and adds Vary: Accept to the
 // response, which then depends on that header. It answers 400 for an Accept
 // header that is not valid and 406 for one that allows none of the formats,
-// and reports whether the image can be served.
+// and reports whether req can be served. Any other format is left as it is.
 func (s *Handlers) chooseAutoFormat(
-	w http.ResponseWriter, r *http.Request, requested imagerequest.Format,
-) (imagerequest.Format, bool) {
-	if requested != imagerequest.FormatAuto {
-		return requested, true
+	w http.ResponseWriter, r *http.Request, req *imagerequest.Request,
+) bool {
+	if req.Transform.Format != imagerequest.FormatAuto {
+		return true
 	}
 
 	w.Header().Add("Vary", "Accept")
@@ -37,16 +36,18 @@ func (s *Handlers) chooseAutoFormat(
 	if errors.Is(err, errNotAcceptable) {
 		s.respondError(w, err.Error(), http.StatusNotAcceptable)
 
-		return "", false
+		return false
 	}
 
 	if err != nil {
 		s.respondError(w, err.Error(), http.StatusBadRequest)
 
-		return "", false
+		return false
 	}
 
-	return format, true
+	req.Transform.Format = format
+
+	return true
 }
 
 // formatForAccept returns the format an auto URL is served in for the Accept
@@ -65,20 +66,20 @@ func formatForAccept(accept string) (imagerequest.Format, error) {
 		return imagerequest.FormatJPEG, nil
 	}
 
-	if qualities[imagerequest.FormatJXL.MIMEType()] > 0 {
+	if qualities["image/jxl"] > 0 {
 		return imagerequest.FormatJXL, nil
 	}
 
-	if qualities[imagerequest.FormatAVIF.MIMEType()] > 0 {
+	if qualities["image/avif"] > 0 {
 		return imagerequest.FormatAVIF, nil
 	}
 
-	if qualities[imagerequest.FormatWebP.MIMEType()] > 0 {
+	if qualities["image/webp"] > 0 {
 		return imagerequest.FormatWebP, nil
 	}
 
 	// For JPEG, the most specific entry the header has decides
-	quality, named := qualities[imagerequest.FormatJPEG.MIMEType()]
+	quality, named := qualities["image/jpeg"]
 	if !named {
 		quality, named = qualities["image/*"]
 	}

internal/handlers/format_auto_internal_test.go

@@ -75,13 +75,11 @@ func TestFormatForAccept(t *testing.T) {
 
 // autoPhotoURLs returns a signed /v1/image/ URL and an encrypted /v1/e/ URL,
 // both valid for a minute, for the JPEG at photoPath on signedHost at 50x50 in
-// the format auto. The first is signed with testSigningKey, the key the
-// handlers that newSignedHostServer builds check signatures with. The second
-// is made with h's generator.
+// the format auto, made with h's image service and generator.
 func autoPhotoURLs(t *testing.T, h *Handlers) (string, string) {
 	t.Helper()
 
-	signedURL := generateSignedURL(testSigningKey, &imagerequest.Request{
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: signedHost,
 			Path: photoPath,
@@ -91,6 +89,9 @@ func autoPhotoURLs(t *testing.T, h *Handlers) (string, string) {
 			Format: imagerequest.FormatAuto,
 		},
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
 	token, err := h.encGen.Generate(&imagerequest.Request{
 		Source: imagerequest.Source{
@@ -101,7 +102,8 @@ func autoPhotoURLs(t *testing.T, h *Handlers) (string, string) {
 			Size:   imagerequest.Size{Width: 50, Height: 50},
 			Format: imagerequest.FormatAuto,
 		},
-	}, time.Now().Add(time.Minute))
+		Expires: time.Now().Add(time.Minute),
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -186,9 +188,9 @@ func TestFormatAuto_ChosenFromAccept(t *testing.T) {
 func TestFormatAuto_SignatureCoversAuto(t *testing.T) {
 	t.Parallel()
 
-	_, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	signedForAVIF := generateSignedURL(testSigningKey, &imagerequest.Request{
+	signedForAVIF, err := h.imgSvc.GenerateSignedURL("", &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: signedHost,
 			Path: photoPath,
@@ -198,6 +200,9 @@ func TestFormatAuto_SignatureCoversAuto(t *testing.T) {
 			Format: imagerequest.FormatAVIF,
 		},
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
 	target := strings.Replace(signedForAVIF, "/50x50.avif?", "/50x50.auto?", 1)
 	if target == signedForAVIF {

internal/handlers/handlers.go

@@ -4,20 +4,22 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/imageproxy"
+	"sneak.berlin/go/pixa/internal/httpfetcher"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/logger"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // Params defines dependencies for Handlers.
@@ -26,48 +28,80 @@ type Params struct {
 
 	Logger      *logger.Logger
 	Healthcheck *healthcheck.Healthcheck
+	Database    *database.Database
 	Config      *config.Config
-	Keys        seal.Keys
 
-	ImageService          *imageproxy.Proxy
-	SessionManager        *session.Manager
-	EncryptedURLGenerator *encurl.Generator
+	// MetricsRegistry is the registry the image cache registers its
+	// counters on. pixad provides Prometheus' default registry, the one
+	// /metrics serves.
+	MetricsRegistry prometheus.Registerer
+
+	// Fetcher, when provided, fetches upstream images in place of the
+	// fetcher the handlers build from the config. Only tests provide one;
+	// pixad does not.
+	Fetcher httpfetcher.Fetcher `optional:"true"`
 }
 
 // Handlers provides HTTP request handlers.
 type Handlers struct {
 	log         *slog.Logger
 	hc          *healthcheck.Healthcheck
+	db          *database.Database
 	config      *config.Config
-	imgSvc      *imageproxy.Proxy
+	fetcher     httpfetcher.Fetcher
+	imgSvc      *imgcache.Service
+	imgCache    *imgcache.Cache
 	sessMgr     *session.Manager
 	encGen      *encurl.Generator
 	csrfProtect func(http.Handler) http.Handler
 
-	// signer checks the signature of a /v1/image/ URL with signing_key.
-	signer *signature.Signer
-	// allowlist matches the hosts of allowlist_hosts, which a /v1/image/
-	// URL may name without a signature.
-	allowlist *allowlist.HostAllowList
 	// refererBlocklist matches the hosts of referer_blocklist; its IsAllowed
 	// reports whether a URL's host is on that list.
 	refererBlocklist *allowlist.HostAllowList
+
+	// metricsRegistry is the registry the image cache registers its
+	// counters on.
+	metricsRegistry prometheus.Registerer
 }
 
 // New creates a new Handlers instance.
-func New(_ fx.Lifecycle, params Params) *Handlers {
-	return &Handlers{
+func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
+	csrfProtect, err := newCSRFProtect(params.Config.SigningKey, params.Config.Debug)
+	if err != nil {
+		return nil, err
+	}
+
+	s := &Handlers{
 		log:              params.Logger.Get(),
 		hc:               params.Healthcheck,
+		db:               params.Database,
 		config:           params.Config,
-		imgSvc:           params.ImageService,
-		sessMgr:          params.SessionManager,
-		encGen:           params.EncryptedURLGenerator,
-		csrfProtect:      newCSRFProtect(params.Keys.CSRFKey, params.Config.Debug),
-		signer:           signature.New(params.Config.SigningKey),
-		allowlist:        allowlist.New(params.Config.AllowlistHosts),
+		fetcher:          params.Fetcher,
+		csrfProtect:      csrfProtect,
 		refererBlocklist: allowlist.New(params.Config.RefererBlocklist),
+		metricsRegistry:  params.MetricsRegistry,
 	}
+
+	lc.Append(fx.Hook{
+		//nolint:contextcheck // the cache's goroutines outlive OnStart; OnStop stops them
+		OnStart: func(_ context.Context) error {
+			return s.initImageService()
+		},
+		// The pending access times are written here, before the database's
+		// stop hook closes it.
+		OnStop: func(ctx context.Context) error {
+			if s.imgCache == nil {
+				return nil
+			}
+
+			return errors.Join(
+				s.imgCache.StopEviction(ctx),
+				s.imgCache.StopPendingAccessTimeWrites(ctx),
+			)
+		},
+	})
+
+	return s, nil
 }
 
 // WaitForProcessing waits until no image is being processed, or until ctx
@@ -76,6 +110,96 @@ func (s *Handlers) WaitForProcessing(ctx context.Context) int {
 	return s.imgSvc.WaitForProcessing(ctx)
 }
 
+// newCacheConfig builds the image cache's configuration from cfg.
+// cache_max_bytes: 0 disables the disk cache entirely; any other value
+// is the eviction limit in bytes; when it is omitted, the cache works
+// out the default limit itself.
+func newCacheConfig(cfg *config.Config, log *slog.Logger) imgcache.CacheConfig {
+	return imgcache.CacheConfig{
+		StateDir:           cfg.StateDir,
+		NegativeTTL:        imgcache.DefaultNegativeTTL,
+		MaxBytes:           cfg.CacheMaxBytes,
+		UseDefaultMaxBytes: !cfg.CacheMaxBytesExplicit,
+		DisableDiskCache:   cfg.CacheMaxBytesExplicit && cfg.CacheMaxBytes == 0,
+		Logger:             log,
+	}
+}
+
+// initImageService initializes the image cache and service.
+func (s *Handlers) initImageService() error {
+	cache, err := imgcache.NewCache(
+		s.db.DB(), newCacheConfig(s.config, s.log), s.metricsRegistry)
+	if err != nil {
+		return err
+	}
+
+	s.imgCache = cache
+
+	// Background eviction: startup reconciliation, then periodic and
+	// write-pressure passes, and the removal of expired negative cache
+	// rows, which is all it does when the disk cache is disabled.
+	cache.StartEviction(imgcache.DefaultEvictionInterval)
+
+	// Writes the access times that requests hand over, so that no request
+	// waits for the database to record them
+	cache.StartPendingAccessTimeWrites()
+
+	// Create the fetcher config
+	fetcherCfg := httpfetcher.DefaultConfig()
+	fetcherCfg.AllowHTTP = s.config.AllowHTTP
+	fetcherCfg.Timeout = s.config.UpstreamFetchTimeout
+	fetcherCfg.MaxResponseSize = s.config.UpstreamMaxResponseSize
+
+	if s.config.UpstreamConnectionsPerHost > 0 {
+		fetcherCfg.MaxConnectionsPerHost = s.config.UpstreamConnectionsPerHost
+	}
+
+	fetcherCfg.MaxConnections = s.config.UpstreamConnections
+	fetcherCfg.BlockedNetworks = s.config.BlockedNetworks
+
+	// Create the service. With no fetcher provided, it builds its own from
+	// fetcherCfg.
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:                   cache,
+		FetcherConfig:           fetcherCfg,
+		Fetcher:                 s.fetcher,
+		SigningKey:              s.config.SigningKey,
+		Allowlist:               s.config.AllowlistHosts,
+		MaxConcurrentProcessing: s.config.MaxConcurrentProcessing,
+		Logger:                  s.log,
+	})
+	if err != nil {
+		return err
+	}
+
+	s.imgSvc = svc
+	s.log.Info("image service initialized")
+
+	// Initialize session manager (signing key is validated at config load
+	// time). Session cookies are always Secure/HttpOnly/SameSite=Strict.
+	// The random value that each logout replaces is saved in the database,
+	// so it outlasts a restart.
+	sessMgr, err := session.NewManagerWithDatabase(
+		context.Background(), s.config.SigningKey, s.db.DB())
+	if err != nil {
+		return err
+	}
+
+	s.sessMgr = sessMgr
+
+	// Initialize encrypted URL generator
+	encGen, err := encurl.NewGenerator(s.config.SigningKey)
+	if err != nil {
+		return err
+	}
+
+	s.encGen = encGen
+
+	s.log.Info("session manager and URL generator initialized")
+
+	return nil
+}
+
 func (s *Handlers) respondJSON(w http.ResponseWriter, data any, status int) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)

internal/handlers/handlers_internal_test.go

@@ -19,19 +19,15 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // testFixtures contains test data.
 type testFixtures struct {
 	handler  *Handlers
+	service  *imgcache.Service
 	goodHost string
 }
 
@@ -50,37 +46,32 @@ func setupTestHandler(t *testing.T) *testFixtures {
 	tmpDir := t.TempDir()
 	db := setupTestDB(t)
 
-	cache, err := imgcache.NewCache(db, imgcache.Config{
+	cache, err := imgcache.NewCache(db, imgcache.CacheConfig{
 		StateDir:    tmpDir,
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: newMockFetcher(mockFS),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    newMockFetcher(mockFS),
+		SigningKey: "test-signing-key-must-be-32-chars",
+		Allowlist:  []string{goodHost},
+	})
 	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
+		t.Fatalf("failed to create service: %v", err)
 	}
 
 	h := &Handlers{
-		imgSvc:    svc,
-		log:       slog.Default(),
-		signer:    signature.New("test-signing-key-must-be-32-chars"),
-		allowlist: allowlist.New([]string{goodHost}),
+		imgSvc: svc,
+		log:    slog.Default(),
 	}
 
 	return &testFixtures{
 		handler:  h,
+		service:  svc,
 		goodHost: goodHost,
 	}
 }
@@ -131,9 +122,10 @@ func newMockFetcher(fs fs.FS) *mockFetcher {
 }
 
 func (f *mockFetcher) Fetch(
-	_ context.Context, source imagerequest.Source,
+	_ context.Context, url string,
 ) (*httpfetcher.FetchResult, error) {
-	path := source.Host + source.Path
+	// Remove https:// prefix
+	path := url[8:] // Remove "https://"
 
 	data, err := fs.ReadFile(f.fs, path)
 	if err != nil {

internal/handlers/image.go

@@ -1,31 +1,23 @@
 package handlers
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/magic"
 )
 
-// statusClientClosedRequest is the status nginx calls "client closed
-// request". The image routes answer it when the client goes away before its
-// image is ready, unless its request is the one making the image. Nobody reads
-// it; it is for logs and metrics.
-const statusClientClosedRequest = 499
-
 // HandleImage handles the main image proxy route:
 // /v1/image/<host>/<path>/<width>x<height>.<format>, or with no format
 // /v1/image/<host>/<path>/<width>x<height>
@@ -35,13 +27,13 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 			return
 		}
 
-		req, sig, expires, ok := s.parseImageRequest(w, r)
+		req, ok := s.parseImageRequest(w, r)
 		if !ok {
 			return
 		}
 
 		// Validate signature if required
-		err := s.validateSignature(req, sig, expires)
+		err := s.imgSvc.ValidateRequest(req)
 		if err != nil {
 			s.log.Warn("signature validation failed",
 				"host", req.Source.Host,
@@ -53,7 +45,27 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 			return
 		}
 
-		s.serveImage(w, r, req, expires)
+		// The signature covers the format auto, not the format chosen
+		if !s.chooseAutoFormat(w, r, req) {
+			return
+		}
+
+		// Get cache key for logging
+		cacheKey := imagerequest.CacheKey(req)
+
+		// Get the image (from cache or fetch/process)
+		startTime := time.Now()
+
+		resp, err := s.imgSvc.Get(r.Context(), req)
+		if err != nil {
+			s.respondImageError(w, req, err)
+
+			return
+		}
+
+		defer func() { _ = resp.Content.Close() }()
+
+		s.writeImageResponse(w, r, req, resp, cacheKey, startTime)
 	}
 }
 
@@ -70,11 +82,11 @@ func (s *Handlers) HandleRobotsTxt() http.HandlerFunc {
 }
 
 // parseImageRequest parses the image URL's path and query parameters into
-// an image request, and returns it with the URL's signature and expiry. On
-// invalid input it writes an error response and returns false.
+// an image request. On invalid input it writes an error response and
+// returns false.
 func (s *Handlers) parseImageRequest(
 	w http.ResponseWriter, r *http.Request,
-) (*imagerequest.Request, string, time.Time, bool) {
+) (*imagerequest.Request, bool) {
 	// The path is parsed decoded once, as r.URL.Path holds it, and not from
 	// chi's wildcard: chi routes on the path as the client wrote it whenever
 	// that is not Go's own encoding of it, so its wildcard would still hold
@@ -88,7 +100,7 @@ func (s *Handlers) parseImageRequest(
 		)
 		s.respondError(w, "invalid image URL: "+err.Error(), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Parse signature params from query string. r.URL.Query() would silently
@@ -101,7 +113,7 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, fmt.Sprintf("invalid query string %q: %v",
 			r.URL.RawQuery, err), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	for name, values := range query {
@@ -109,15 +121,17 @@ func (s *Handlers) parseImageRequest(
 			s.respondError(w, fmt.Sprintf("invalid %s: given more than once",
 				name), http.StatusBadRequest)
 
-			return nil, "", time.Time{}, false
+			return nil, false
 		}
 	}
 
-	expires, err := parseExpires(query)
+	req.Signature = query.Get("sig")
+
+	req.Expires, err = parseExpires(query)
 	if err != nil {
 		s.respondError(w, err.Error(), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Parse optional quality and fit params. Only a q missing from the URL is
@@ -129,7 +143,7 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, `invalid q: not a number, got ""`,
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	req.Transform.Quality, err = parseFormInt(query, "q",
@@ -138,7 +152,7 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, fmt.Sprintf("%v, got %q", err, qStr),
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Only a fit missing from the URL is cover. A fit in the URL that is not a
@@ -148,7 +162,7 @@ func (s *Handlers) parseImageRequest(
 	if query.Has("fit") && req.Transform.FitMode == "" {
 		s.respondError(w, `invalid fit: not a fit mode, got ""`, http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Default fit mode if not set
@@ -165,40 +179,15 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, "invalid image request: "+err.Error(),
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
-	return req, query.Get("sig"), expires, true
-}
-
-// validateSignature returns nil when the source host of req is on
-// allowlist_hosts and names no port. Otherwise it verifies sig, the URL's
-// signature of req, and expires, the URL's expiry.
-func (s *Handlers) validateSignature(
-	req *imagerequest.Request, sig string, expires time.Time,
-) error {
-	// An allowlist entry names no port, so a host followed by ":", with or
-	// without a port, needs a signature. Go's URL type reads the port as the
-	// fetcher does: in an IPv6 address written without brackets, such as
-	// 2001:db8::1:8443, it is what follows the last ":". This is checked here
-	// and not in allowlist.IsAllowed, which also matches referer_blocklist,
-	// where a Referer must be blocked whatever its port. Port and IsAllowed
-	// read only the host of a URL.
-	sourceURL := &url.URL{Host: req.Source.Host}
-	hostHasPort := sourceURL.Port() != "" ||
-		strings.HasSuffix(sourceURL.Host, ":")
-
-	if !hostHasPort && s.allowlist.IsAllowed(sourceURL) {
-		return nil
-	}
-
-	// Signature required for non-allowed hosts
-	return s.signer.Verify(req, sig, expires)
+	return req, true
 }
 
 // parseExpires reads the exp query parameter, a Unix time in seconds. An exp
-// missing from the URL gives the zero time, which the signature check refuses
-// as a missing exp. An exp in the URL that is not a whole number, an empty
+// missing from the URL gives the zero time, which the signature check takes
+// as no expiration. An exp in the URL that is not a whole number, an empty
 // one included, is an error naming exp and the value.
 func parseExpires(query url.Values) (time.Time, error) {
 	if !query.Has("exp") {
@@ -226,11 +215,7 @@ func (s *Handlers) HandleTooManyRequests() http.HandlerFunc {
 	}
 }
 
-// respondImageError answers err, the image service's error for req, on both
-// image routes. It logs a 500 at error level, as pixa's own failure. It logs
-// the other answers at warn level, since the client, the upstream or a full
-// limit caused them. The 415 for a source refused for its first bytes is not
-// logged here, because the image service logs it.
+// respondImageError maps image retrieval errors to HTTP responses.
 func (s *Handlers) respondImageError(
 	w http.ResponseWriter, req *imagerequest.Request, err error,
 ) {
@@ -246,53 +231,59 @@ func (s *Handlers) respondImageError(
 		return
 	}
 
-	var (
-		status  int
-		message string
-	)
-
-	switch {
-	case errors.Is(err, httpfetcher.ErrSSRFBlocked):
-		status, message = http.StatusForbidden, "forbidden"
-	case errors.Is(err, httpfetcher.ErrUpstreamError):
-		status, message = http.StatusBadGateway, "upstream error"
-	case errors.Is(err, httpfetcher.ErrUpstreamTimeout):
-		status, message = http.StatusGatewayTimeout, "upstream timeout"
-	case errors.Is(err, httpfetcher.ErrTooManyConnections),
-		errors.Is(err, imageprocessor.ErrTooManyImages),
-		errors.Is(err, imageproxy.ErrProcessingTimedOut):
-		status = http.StatusServiceUnavailable
-		message = "server busy, try again later"
-	case errors.Is(err, httpfetcher.ErrInvalidContentType),
-		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat):
-		status = http.StatusUnsupportedMediaType
-		message = "unsupported source format"
-	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
-		status = http.StatusBadRequest
-		message = fmt.Sprintf("size too large for the source: the side "+
-			"computed from its proportions is above %d",
-			imageprocessor.MaxOutputDimension)
-	case errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge):
-		status = http.StatusBadRequest
-		message = fmt.Sprintf("size too large for AVIF: the output "+
-			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels)
-	default:
-		s.log.Error("failed to get image",
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-			"error", err,
-		)
-		s.respondError(w, "internal error", http.StatusInternalServerError)
-
-		return
-	}
-
-	s.log.Warn("failed to get image",
+	s.log.Error("failed to get image",
 		"host", req.Source.Host,
 		"path", req.Source.Path,
 		"error", err,
 	)
-	s.respondError(w, message, status)
+
+	// Check for specific error types
+	if errors.Is(err, httpfetcher.ErrSSRFBlocked) {
+		s.respondError(w, "forbidden", http.StatusForbidden)
+
+		return
+	}
+
+	if errors.Is(err, httpfetcher.ErrUpstreamError) {
+		s.respondError(w, "upstream error", http.StatusBadGateway)
+
+		return
+	}
+
+	if errors.Is(err, httpfetcher.ErrTooManyConnections) ||
+		errors.Is(err, imageprocessor.ErrTooManyImages) ||
+		errors.Is(err, imgcache.ErrProcessingTimedOut) {
+		s.respondError(w, "server busy, try again later",
+			http.StatusServiceUnavailable)
+
+		return
+	}
+
+	if errors.Is(err, httpfetcher.ErrInvalidContentType) ||
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat) {
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+
+		return
+	}
+
+	if errors.Is(err, imageprocessor.ErrOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+
+		return
+	}
+
+	if errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
+			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
+			http.StatusBadRequest)
+
+		return
+	}
+
+	s.respondError(w, "internal error", http.StatusInternalServerError)
 }
 
 // cacheControl returns the Cache-Control header for an image served through a
@@ -349,50 +340,13 @@ func notModified(w http.ResponseWriter, r *http.Request, etag string) bool {
 	return true
 }
 
-// serveImage serves the image that req asks for. Both image routes call it
-// once they have the request and its URL's expiry, which ends the
-// Cache-Control max-age. It chooses the format for the format auto, answers
-// If-None-Match with 304 and HEAD with the headers only. It answers 499 when
-// the image service stopped because the client went away, and any other error
-// of the image service with respondImageError.
-func (s *Handlers) serveImage(
+// writeImageResponse writes headers and streams the image content,
+// handling conditional and HEAD requests.
+func (s *Handlers) writeImageResponse(
 	w http.ResponseWriter, r *http.Request,
-	req *imagerequest.Request, expires time.Time,
+	req *imagerequest.Request, resp *imgcache.ImageResponse,
+	cacheKey imagerequest.VariantKey, startTime time.Time,
 ) {
-	// The signature or the token covers the format auto, not the format chosen
-	format, ok := s.chooseAutoFormat(w, r, req.Transform.Format)
-	if !ok {
-		return
-	}
-
-	req.Transform.Format = format
-
-	startTime := time.Now()
-
-	resp, err := s.imgSvc.Get(r.Context(), req)
-
-	// The client went away before its image was ready, which is not pixa's
-	// failure. A cancellation while the request's context is live is pixa's,
-	// and respondImageError answers it 500.
-	if errors.Is(err, context.Canceled) && r.Context().Err() != nil {
-		s.log.Info("client went away before the image was ready",
-			"request_id", middleware.GetReqID(r.Context()),
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-		)
-		w.WriteHeader(statusClientClosedRequest)
-
-		return
-	}
-
-	if err != nil {
-		s.respondImageError(w, req, err)
-
-		return
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
 	// Set response headers
 	w.Header().Set("Content-Type", resp.ContentType)
 
@@ -401,7 +355,7 @@ func (s *Handlers) serveImage(
 	}
 
 	// Cache control headers
-	w.Header().Set("Cache-Control", cacheControl(expires))
+	w.Header().Set("Cache-Control", cacheControl(req.Expires))
 	w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
 	if notModified(w, r, resp.ETag) {
@@ -418,28 +372,18 @@ func (s *Handlers) serveImage(
 	// Stream the response
 	w.WriteHeader(http.StatusOK)
 
-	// A failed write is most often a client that has gone away, not pixa's
-	// failure, so it is logged at warn level
 	servedBytes, err := io.Copy(w, resp.Content)
 	if err != nil {
-		s.log.Warn("failed to write response",
-			"request_id", middleware.GetReqID(r.Context()),
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-			"served_bytes", servedBytes,
+		s.log.Error("failed to write response",
 			"error", err,
 		)
-
-		return
 	}
 
 	// Log cache status and timing after serving
 	duration := time.Since(startTime)
 	s.log.Info("image served",
 		"request_id", middleware.GetReqID(r.Context()),
-		"cache_key", imagerequest.CacheKey(req),
-		"host", req.Source.Host,
-		"path", req.Source.Path,
+		"cache_key", cacheKey,
 		"cache_status", resp.CacheStatus,
 		"duration_ms", duration.Milliseconds(),
 		"format", req.Transform.Format,

internal/handlers/image_cache_control_internal_test.go

@@ -14,14 +14,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus"
 
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // photoPath is the path of the JPEG that newSignedHostServer serves.
@@ -36,10 +31,9 @@ func newSignedHostServer(
 ) (*Handlers, http.Handler) {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
@@ -47,35 +41,27 @@ func newSignedHostServer(
 
 	jpegData := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
 
-	svc, err := imageproxy.New(&imageproxy.Config{
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
 		Cache: cache,
 		Fetcher: newMockFetcher(fstest.MapFS{
 			signedHost + photoPath: &fstest.MapFile{Data: jpegData},
 		}),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          log,
-	}, prometheus.NewRegistry())
+		SigningKey: testSigningKey,
+		Logger:     log,
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
-		log:       log,
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New(nil),
+		log:    log,
+		imgSvc: svc,
+		encGen: encGen,
 	}
 
 	r := chi.NewRouter()
@@ -121,9 +107,9 @@ func getMaxAge(t *testing.T, srv http.Handler, target string) int {
 func TestHandleImage_SignedURL_MaxAgeEndsAtExp(t *testing.T) {
 	t.Parallel()
 
-	_, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	signedURL := generateSignedURL(testSigningKey, &imagerequest.Request{
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: signedHost,
 			Path: photoPath,
@@ -133,6 +119,9 @@ func TestHandleImage_SignedURL_MaxAgeEndsAtExp(t *testing.T) {
 			Format: imagerequest.FormatJPEG,
 		},
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
 	maxAge := getMaxAge(t, srv, signedURL)
 	if maxAge < 50 || maxAge > 60 {
@@ -209,7 +198,8 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 					Size:   imagerequest.Size{Width: 50, Height: 50},
 					Format: imagerequest.FormatJPEG,
 				},
-			}, tt.expires)
+				Expires: tt.expires,
+			})
 			if err != nil {
 				t.Fatalf("Generate() error = %v", err)
 			}

internal/handlers/image_errors_internal_test.go

@@ -1,28 +1,20 @@
 package handlers
 
 import (
-	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"image/color"
-	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"slices"
 	"strings"
 	"testing"
 	"testing/fstest"
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/signature"
@@ -33,38 +25,29 @@ import (
 const allowlistedHost = "allowed.example.com"
 
 // newImageRoute returns the image route of a Handlers whose service fetches
-// with fetcher, and which checks signatures with testSigningKey.
+// with fetcher and checks signatures with testSigningKey.
 func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+	})
 	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
+		t.Fatalf("failed to create service: %v", err)
 	}
 
-	h := &Handlers{
-		imgSvc:    svc,
-		log:       slog.New(slog.DiscardHandler),
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
-	}
+	h := &Handlers{imgSvc: svc, log: slog.New(slog.DiscardHandler)}
 
 	r := chi.NewRouter()
 	r.Get("/v1/image/*", h.HandleImage())
@@ -73,7 +56,7 @@ func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
 }
 
 // newPhotoFetcher returns a mock fetcher that serves a JPEG at photoPath on
-// each of hosts, and answers any other source with an upstream error.
+// each of hosts, and answers any other URL with an upstream error.
 func newPhotoFetcher(t *testing.T, hosts ...string) *httpfetcher.MockFetcher {
 	t.Helper()
 
@@ -100,10 +83,10 @@ func photoURLWithSig(host, sig string, expires time.Time) string {
 	return fmt.Sprintf("%s?sig=%s&exp=%d", photoURL(host), sig, expires.Unix())
 }
 
-// photoRequest returns the image request of photoURL(host) at the default
-// quality and fit.
-func photoRequest(host string) *imagerequest.Request {
-	return &imagerequest.Request{
+// photoSignature returns the signature of photoURL(host) at the default
+// quality and fit, made with key and expiring at expires.
+func photoSignature(key, host string, expires time.Time) string {
+	return signature.New(key).Sign(&imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: host,
 			Path: photoPath,
@@ -114,13 +97,8 @@ func photoRequest(host string) *imagerequest.Request {
 			Quality: 85,
 			FitMode: imagerequest.FitCover,
 		},
-	}
-}
-
-// photoSignature returns the signature of photoURL(host) at the default
-// quality and fit, made with key and expiring at expires.
-func photoSignature(key, host string, expires time.Time) string {
-	return signature.New(key).Sign(photoRequest(host), expires)
+		Expires: expires,
+	})
 }
 
 // sendGet sends a GET for target to route and returns the response.
@@ -191,12 +169,7 @@ func TestHandleImage_ErrorAnswers(t *testing.T) {
 	photos := newPhotoFetcher(t,
 		signedHost, parentHost, siblingHost, subdomainHost, appendedHost)
 	// The real fetcher refuses localhost before any lookup or connection.
-	realFetcher := httpfetcher.New(&httpfetcher.Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
+	realFetcher := httpfetcher.New(httpfetcher.DefaultConfig())
 
 	exp := time.Now().Add(time.Hour)
 	expired := time.Now().Add(-time.Hour)
@@ -301,9 +274,10 @@ func TestHandleImage_AllowlistOrSignature(t *testing.T) {
 // host can be, and checks that each is refused with 400 naming the host as
 // decoded: allowlistedHost with a character after it that a URL host cannot
 // hold, percent-encoded, an IPv6 address without brackets, and brackets
-// around something that is not an IPv6 address. Later steps put the host
-// unparsed into the allowlist check, the cache key and the upstream URL, so
-// such a host is refused first.
+// around something that is not an IPv6 address. A "?" or "#" after
+// allowlistedHost would otherwise end the host when the source URL is read,
+// so the request would pass the allowlist and be fetched and cached under a
+// host that is not the one fetched.
 func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -374,9 +348,10 @@ func TestHandleImage_HostForms_Served(t *testing.T) {
 
 // TestHandleImage_HashInSourcePathOrQuery_Returns400 sends image URLs whose
 // source path or source query holds a "#", written as %23, and checks that
-// each is refused with 400, the one signed for that source path included.
-// A "#" starts a URL's fragment, so neither the source path nor the source
-// query may hold one.
+// each is refused with 400, the one signed for that source path included. The
+// source URL would otherwise end at the "#" when it is fetched, so each text
+// after it would fetch the image at photoPath and cache it under keys of its
+// own.
 func TestHandleImage_HashInSourcePathOrQuery_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -394,7 +369,8 @@ func TestHandleImage_HashInSourcePathOrQuery_Returns400(t *testing.T) {
 			Quality: 85,
 			FitMode: imagerequest.FitCover,
 		},
-	}, exp)
+		Expires: exp,
+	})
 
 	tests := []struct {
 		name   string
@@ -420,168 +396,3 @@ func TestHandleImage_HashInSourcePathOrQuery_Returns400(t *testing.T) {
 		})
 	}
 }
-
-// failingFetcher answers every fetch with its error.
-type failingFetcher struct {
-	err error
-}
-
-// Fetch returns f's error.
-func (f failingFetcher) Fetch(
-	context.Context, imagerequest.Source,
-) (*httpfetcher.FetchResult, error) {
-	return nil, f.err
-}
-
-// photoURLsByRoute returns, for each image route, the function that makes the
-// URL of the JPEG at photoPath on signedHost on that route.
-func photoURLsByRoute() map[string]func(*testing.T, *Handlers) string {
-	return map[string]func(*testing.T, *Handlers) string{
-		"/v1/image/": signedPhotoURL,
-		"/v1/e/":     encPhotoURL,
-	}
-}
-
-// TestImageRoutes_SameErrorAnswers checks that both image routes answer each
-// upstream fetch error below with the same status. They log it as "failed to
-// get image" at the same level: error for the 500 and warn for the others.
-// Each request gets routes of its own, so no request finds another's failed
-// fetch in the negative cache.
-func TestImageRoutes_SameErrorAnswers(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		err        error
-		wantStatus int
-		wantLevel  slog.Level
-	}{
-		{"blocked upstream address", httpfetcher.ErrSSRFBlocked,
-			http.StatusForbidden, slog.LevelWarn},
-		{"upstream error status",
-			fmt.Errorf("%w: status 404", httpfetcher.ErrUpstreamError),
-			http.StatusBadGateway, slog.LevelWarn},
-		{"no response headers within the fetch timeout",
-			httpfetcher.ErrUpstreamTimeout, http.StatusGatewayTimeout,
-			slog.LevelWarn},
-		{"no free upstream connection", httpfetcher.ErrTooManyConnections,
-			http.StatusServiceUnavailable, slog.LevelWarn},
-		{"Content-Type not a source format",
-			fmt.Errorf("%w: image/svg+xml", httpfetcher.ErrInvalidContentType),
-			http.StatusUnsupportedMediaType, slog.LevelWarn},
-		{"any other failure", io.ErrUnexpectedEOF,
-			http.StatusInternalServerError, slog.LevelError},
-	}
-
-	for _, tt := range tests {
-		for route, imageURL := range photoURLsByRoute() {
-			t.Run(route+" "+tt.name, func(t *testing.T) {
-				t.Parallel()
-
-				var logs bytes.Buffer
-
-				h, routes := newRoutesFetchingThrough(t,
-					failingFetcher{err: tt.err},
-					slog.New(slog.NewJSONHandler(&logs, nil)))
-
-				rec := sendGet(t, routes, imageURL(t, h))
-				if rec.Code != tt.wantStatus {
-					t.Errorf("status = %d, want %d: %s",
-						rec.Code, tt.wantStatus, rec.Body)
-				}
-
-				levels := loggedLevels(t, &logs)
-				if !slices.Contains(levels[tt.wantLevel.String()],
-					"failed to get image") {
-					t.Errorf(`no "failed to get image" line logged at level %s`,
-						tt.wantLevel)
-				}
-
-				if tt.wantLevel != slog.LevelError &&
-					len(levels[slog.LevelError.String()]) != 0 {
-					t.Errorf("logged at error level: %q",
-						levels[slog.LevelError.String()])
-				}
-			})
-		}
-	}
-}
-
-// failingResponseWriter is a response writer whose Write always fails, as when
-// the client has gone away.
-type failingResponseWriter struct {
-	*httptest.ResponseRecorder
-}
-
-// Write writes nothing and returns io.ErrClosedPipe.
-func (failingResponseWriter) Write([]byte) (int, error) {
-	return 0, io.ErrClosedPipe
-}
-
-// TestImageRoutes_FailedWriteLoggedOnce checks that both image routes log a
-// failed write of the image once, at warn level, with the request's ID, the
-// source host and path, the bytes served and the error. Neither may also log
-// the image as served.
-func TestImageRoutes_FailedWriteLoggedOnce(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, srv := newSignedHostServer(t,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			ctx := context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID)
-			srv.ServeHTTP(failingResponseWriter{httptest.NewRecorder()},
-				httptest.NewRequestWithContext(
-					ctx, http.MethodGet, imageURL(t, h), nil))
-
-			t.Logf("logged:\n%s", logs.String())
-
-			var failedWrites []map[string]any
-
-			dec := json.NewDecoder(&logs)
-			for dec.More() {
-				var line map[string]any
-
-				err := dec.Decode(&line)
-				if err != nil {
-					t.Fatalf("decoding log line: %v", err)
-				}
-
-				switch line["msg"] {
-				case "image served":
-					t.Error(`"image served" logged after a failed write`)
-				case "failed to write response":
-					failedWrites = append(failedWrites, line)
-				}
-			}
-
-			if len(failedWrites) != 1 {
-				t.Fatalf(`"failed to write response" logged %d times, want 1`,
-					len(failedWrites))
-			}
-
-			want := map[string]any{
-				"level":        slog.LevelWarn.String(),
-				"request_id":   requestID,
-				"host":         signedHost,
-				"path":         photoPath,
-				"served_bytes": float64(0),
-				"error":        io.ErrClosedPipe.Error(),
-			}
-
-			for key, wantValue := range want {
-				if got := failedWrites[0][key]; got != wantValue {
-					t.Errorf("%s = %v, want %v", key, got, wantValue)
-				}
-			}
-		})
-	}
-}

internal/handlers/image_signature_internal_test.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"testing"
 	"time"
 
@@ -37,47 +36,6 @@ func getImage(t *testing.T, fix *testFixtures, target string) int {
 	return rec.Code
 }
 
-// generateSignedURL returns the /v1/image/ URL of req, signed with key and
-// expiring after ttl. It signs a copy of req, so req itself is not changed.
-// An unset quality or fit in the copy is set to 85 or cover, the values the
-// route uses when a URL has no q or fit. The URL carries q and fit next to sig
-// and exp, so the route verifies it for the quality and fit it was signed
-// with.
-func generateSignedURL(
-	key string, req *imagerequest.Request, ttl time.Duration,
-) string {
-	signed := *req
-
-	if signed.Transform.Quality == 0 {
-		signed.Transform.Quality = 85
-	}
-
-	if signed.Transform.FitMode == "" {
-		signed.Transform.FitMode = imagerequest.FitCover
-	}
-
-	expires := time.Now().Add(ttl)
-	sig := signature.New(key).Sign(&signed, expires)
-
-	// A source query follows the source path after a "?". The image route
-	// reads the path decoded once, so the whole path is written in Go's own
-	// percent-encoding of a URL path, which writes "?" as %3F and "%" as %25,
-	// and leaves "/", ";", ",", "=" and "&" as they are.
-	sourcePathAndQuery := signed.Source.Path
-	if signed.Source.Query != "" {
-		sourcePathAndQuery += "?" + signed.Source.Query
-	}
-
-	unescapedPath := fmt.Sprintf("/v1/image/%s%s/%dx%d.%s",
-		signed.Source.Host, sourcePathAndQuery,
-		signed.Transform.Size.Width, signed.Transform.Size.Height,
-		signed.Transform.Format)
-
-	return fmt.Sprintf("%s?sig=%s&exp=%d&q=%d&fit=%s",
-		(&url.URL{Path: unescapedPath}).EscapedPath(), sig, expires.Unix(),
-		signed.Transform.Quality, signed.Transform.FitMode)
-}
-
 // TestHandleImage_SignatureCoversQualityAndFit signs a URL for quality 85
 // and fit cover, the values the route uses when a URL has no q or fit, and
 // sends that signature with each q and fit below.
@@ -97,7 +55,8 @@ func TestHandleImage_SignatureCoversQualityAndFit(t *testing.T) {
 			Quality: 85,
 			FitMode: imagerequest.FitCover,
 		},
-	}, expires)
+		Expires: expires,
+	})
 	signedURL := fmt.Sprintf("/v1/image/%s/images/photo.jpg/50x50.jpeg?sig=%s&exp=%d",
 		signedHost, sig, expires.Unix())
 
@@ -124,8 +83,8 @@ func TestHandleImage_SignatureCoversQualityAndFit(t *testing.T) {
 	}
 }
 
-// TestHandleImage_GeneratedSignedURLVerifies sends URLs built by
-// generateSignedURL to the route.
+// TestHandleImage_GeneratedSignedURLVerifies sends URLs built by the
+// service's signed-URL generator to the route.
 func TestHandleImage_GeneratedSignedURLVerifies(t *testing.T) {
 	t.Parallel()
 
@@ -142,21 +101,25 @@ func TestHandleImage_GeneratedSignedURLVerifies(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host: signedHost,
-						Path: "/images/photo.jpg",
-					},
-					Transform: imagerequest.Transform{
-						Size:    imagerequest.Size{Width: 50, Height: 50},
-						Format:  imagerequest.FormatJPEG,
-						Quality: tt.quality,
-						FitMode: tt.fitMode,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host: signedHost,
+					Path: "/images/photo.jpg",
+				},
+				Transform: imagerequest.Transform{
+					Size:    imagerequest.Size{Width: 50, Height: 50},
+					Format:  imagerequest.FormatJPEG,
+					Quality: tt.quality,
+					FitMode: tt.fitMode,
+				},
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}
@@ -215,10 +178,10 @@ func TestHandleImage_InvalidExp_Returns400(t *testing.T) {
 }
 
 // TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies sends URLs built
-// by generateSignedURL for source URLs with a query to the route, through a
-// chi router: chi routes on the path as the client wrote it whenever that is
-// not Go's own encoding of it. A 502 means the signature passed, so the route
-// read the source path and query that were signed.
+// by the service's signed-URL generator for source URLs with a query to the
+// route, through a chi router: chi routes on the path as the client wrote it
+// whenever that is not Go's own encoding of it. A 502 means the signature
+// passed, so the route read the source path and query that were signed.
 func TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies(t *testing.T) {
 	t.Parallel()
 
@@ -238,20 +201,24 @@ func TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host:  signedHost,
-						Path:  photoPath,
-						Query: tt.query,
-					},
-					Transform: imagerequest.Transform{
-						Size:   imagerequest.Size{Width: 50, Height: 50},
-						Format: imagerequest.FormatJPEG,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host:  signedHost,
+					Path:  photoPath,
+					Query: tt.query,
+				},
+				Transform: imagerequest.Transform{
+					Size:   imagerequest.Size{Width: 50, Height: 50},
+					Format: imagerequest.FormatJPEG,
+				},
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}
@@ -280,7 +247,8 @@ func TestHandleImage_SourceQueryEncodedAnyWay(t *testing.T) {
 			Quality: 85,
 			FitMode: imagerequest.FitCover,
 		},
-	}, expires)
+		Expires: expires,
+	})
 
 	tests := []struct {
 		name         string
@@ -312,7 +280,7 @@ func TestHandleImage_SourceQueryEncodedAnyWay(t *testing.T) {
 // TestHandleImage_SourceURLHoldingPercent25Verifies signs a source path and a
 // source query that each hold %25, the percent-escape of a literal "%", and
 // sends each to the route written as the README says, with that "%" written as
-// %25, and as generateSignedURL writes it. A 502 means the signature passed.
+// %25, and as GenerateSignedURL writes it. A 502 means the signature passed.
 func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 	t.Parallel()
 
@@ -346,7 +314,8 @@ func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 					Quality: 85,
 					FitMode: imagerequest.FitCover,
 				},
-			}, expires)
+				Expires: expires,
+			})
 
 			target := fmt.Sprintf("/v1/image/%s%s/50x50.jpeg?sig=%s&exp=%d",
 				signedHost, tt.writtenPathAndQuery, sig, expires.Unix())
@@ -357,23 +326,27 @@ func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 			}
 		})
 
-		t.Run(tt.name+" written by generateSignedURL", func(t *testing.T) {
+		t.Run(tt.name+" written by GenerateSignedURL", func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host:  signedHost,
-						Path:  tt.sourcePath,
-						Query: tt.sourceQuery,
-					},
-					Transform: imagerequest.Transform{
-						Size:   imagerequest.Size{Width: 50, Height: 50},
-						Format: imagerequest.FormatJPEG,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host:  signedHost,
+					Path:  tt.sourcePath,
+					Query: tt.sourceQuery,
+				},
+				Transform: imagerequest.Transform{
+					Size:   imagerequest.Size{Width: 50, Height: 50},
+					Format: imagerequest.FormatJPEG,
+				},
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}

internal/handlers/imageenc.go

@@ -2,13 +2,21 @@ package handlers
 
 import (
 	"errors"
+	"fmt"
+	"io"
 	"net/http"
+	"strconv"
 	"time"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
 
 	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/httpfetcher"
+	"sneak.berlin/go/pixa/internal/imageprocessor"
 	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
+	"sneak.berlin/go/pixa/internal/magic"
 )
 
 // HandleImageEnc handles requests to /v1/e/{token}/* for encrypted
@@ -20,59 +28,157 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 			return
 		}
 
-		req, expires, ok := s.parseImageEncRequest(w, r)
-		if !ok {
+		ctx := r.Context()
+		start := time.Now()
+
+		req, ok := s.parseImageEncRequest(w, r)
+		if !ok || !s.chooseAutoFormat(w, r, req) {
 			return
 		}
 
-		s.serveImage(w, r, req, expires)
+		// Log the request
+		s.log.Debug("encrypted image request",
+			"host", req.Source.Host,
+			"path", req.Source.Path,
+			"dimensions", fmt.Sprintf("%dx%d",
+				req.Transform.Size.Width, req.Transform.Size.Height),
+			"format", req.Transform.Format,
+		)
+
+		// Fetch and process the image (no signature validation
+		// needed - encrypted URL is trusted)
+		resp, err := s.imgSvc.Get(ctx, req)
+		if err != nil {
+			s.handleImageError(w, err)
+
+			return
+		}
+
+		defer func() { _ = resp.Content.Close() }()
+
+		// Set response headers
+		w.Header().Set("Content-Type", resp.ContentType)
+
+		if resp.ContentLength > 0 {
+			w.Header().Set("Content-Length", strconv.FormatInt(resp.ContentLength, 10))
+		}
+
+		// Cache headers: max-age ends at the URL's expiry
+		w.Header().Set("Cache-Control", cacheControl(req.Expires))
+		w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
+
+		if notModified(w, r, resp.ETag) {
+			return
+		}
+
+		// A HEAD request gets the headers only
+		if r.Method == http.MethodHead {
+			w.WriteHeader(http.StatusOK)
+
+			return
+		}
+
+		// Stream the response
+		written, err := io.Copy(w, resp.Content)
+		if err != nil {
+			s.log.Error("failed to write response", "error", err)
+
+			return
+		}
+
+		// Log completion
+		duration := time.Since(start)
+		s.log.Info("image served",
+			"request_id", middleware.GetReqID(ctx),
+			"cache_key", imagerequest.CacheKey(req),
+			"host", req.Source.Host,
+			"path", req.Source.Path,
+			"format", req.Transform.Format,
+			"cache_status", resp.CacheStatus,
+			"served_bytes", written,
+			"duration_ms", duration.Milliseconds(),
+		)
 	}
 }
 
 // parseImageEncRequest decrypts the token of an encrypted image URL into an
-// image request and checks it, and returns it with the token's expiry. On a
-// token that is missing, does not decrypt, has expired or asks for something
-// not valid, it writes an error response and returns false.
+// image request and checks it. On a token that is missing, does not decrypt,
+// has expired or asks for something not valid, it writes an error response
+// and returns false.
 func (s *Handlers) parseImageEncRequest(
 	w http.ResponseWriter, r *http.Request,
-) (*imagerequest.Request, time.Time, bool) {
+) (*imagerequest.Request, bool) {
 	// Extract token from URL
 	token := chi.URLParam(r, "token")
 	if token == "" {
 		s.respondError(w, "missing token", http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
 	// Decrypt and validate the payload
-	req, expires, err := s.encGen.Parse(token)
+	req, err := s.encGen.Parse(token)
 	if err != nil {
 		if errors.Is(err, encurl.ErrExpired) {
 			s.log.Debug("encrypted URL expired", "error", err)
 			s.respondError(w, "URL has expired", http.StatusGone)
 
-			return nil, time.Time{}, false
+			return nil, false
 		}
 
-		s.log.Debug("invalid encrypted URL", "error", err)
+		s.log.Debug("failed to decrypt URL", "error", err)
 		s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
 	// Apply the same dimension and fit-mode bounds as the plain image
 	// route: a sealed payload is trusted for its origin, not for staying
-	// within limits. This refuses an over-limit size before the source is
-	// fetched. An unknown fit mode is a 400 here rather than a 500 from the
-	// processor.
+	// within limits, so an over-limit size or unknown fit mode is a 400
+	// here rather than an out-of-memory or a 500 from the processor.
 	err = imagerequest.ValidateImageRequest(req)
 	if err != nil {
 		s.log.Debug("encrypted URL failed validation", "error", err)
 		s.respondError(w, "invalid encrypted URL: "+err.Error(),
 			http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
-	return req, expires, true
+	return req, true
+}
+
+// handleImageError converts image service errors to HTTP responses.
+func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, httpfetcher.ErrSSRFBlocked):
+		s.respondError(w, "forbidden", http.StatusForbidden)
+	case errors.Is(err, httpfetcher.ErrUpstreamError):
+		s.respondError(w, "upstream error", http.StatusBadGateway)
+	case errors.Is(err, httpfetcher.ErrUpstreamTimeout):
+		s.respondError(w, "upstream timeout", http.StatusGatewayTimeout)
+	case errors.Is(err, httpfetcher.ErrTooManyConnections),
+		errors.Is(err, imageprocessor.ErrTooManyImages),
+		errors.Is(err, imgcache.ErrProcessingTimedOut):
+		s.respondError(w, "server busy, try again later",
+			http.StatusServiceUnavailable)
+	case errors.Is(err, httpfetcher.ErrInvalidContentType),
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat),
+		errors.Is(err, magic.ErrMagicByteMismatch),
+		errors.Is(err, magic.ErrUnknownFormat),
+		errors.Is(err, magic.ErrNotEnoughData):
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+	case errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
+			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
+			http.StatusBadRequest)
+	default:
+		s.log.Error("image request failed", "error", err)
+		s.respondError(w, "internal error", http.StatusInternalServerError)
+	}
 }

internal/handlers/imageenc_internal_test.go

@@ -6,13 +6,11 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
-	"time"
 
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
 )
 
 // newEncTestServer builds a router serving the encrypted-URL route with a
@@ -22,13 +20,11 @@ import (
 func newEncTestServer(t *testing.T) (*encurl.Generator, http.Handler) {
 	t.Helper()
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
 		log:    slog.New(slog.DiscardHandler),
 		encGen: encGen,
@@ -66,7 +62,7 @@ func TestHandleImageEnc_OverLimitDimension_Returns400(t *testing.T) {
 		Transform: imagerequest.Transform{
 			Size: imagerequest.Size{Width: 100000, Height: 100000},
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -95,7 +91,7 @@ func TestHandleImageEnc_InvalidFitMode_Returns400(t *testing.T) {
 			Size:    imagerequest.Size{Width: 800, Height: 600},
 			FitMode: imagerequest.Fit("bogus"),
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/imageenc_token_internal_test.go

@@ -10,7 +10,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
 )
 
 // requireServedPhoto requires that rec answers 200 with the JPEG at photoPath
@@ -71,24 +70,25 @@ func TestHandleImageEnc_RejectedToken(t *testing.T) {
 		},
 	}
 
-	valid, err := h.encGen.Generate(&photo, time.Time{})
+	valid, err := h.encGen.Generate(&photo)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	expired, err := h.encGen.Generate(&photo, time.Now().Add(-time.Minute))
+	expiredPhoto := photo
+	expiredPhoto.Expires = time.Now().Add(-time.Minute)
+
+	expired, err := h.encGen.Generate(&expiredPhoto)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys("another-signing-key-fedcba9876543210")
+	otherGen, err := encurl.NewGenerator("another-signing-key-fedcba9876543210")
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	otherGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	otherKey, err := otherGen.Generate(&photo, time.Time{})
+	otherKey, err := otherGen.Generate(&photo)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/jpegxl_default_internal_test.go

@@ -69,7 +69,8 @@ func TestImageWithoutFormat_SignedAsJXL(t *testing.T) {
 			Quality: encurl.DefaultQuality,
 			FitMode: imagerequest.FitCover,
 		},
-	}, expires)
+		Expires: expires,
+	})
 	query := fmt.Sprintf("?sig=%s&exp=%d", sig, expires.Unix())
 
 	for _, size := range []string{"50x50.jxl", "50x50"} {
@@ -93,7 +94,7 @@ func TestImageEncWithoutFormat_ServesJPEGXL(t *testing.T) {
 		Transform: imagerequest.Transform{
 			Size: imagerequest.Size{Width: 50, Height: 50},
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/referer_blocklist_internal_test.go

@@ -14,12 +14,7 @@ import (
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // blockedReferer is a page on leech.example, which newRefererRoutes puts on
@@ -35,11 +30,11 @@ type countingFetcher struct {
 
 // Fetch counts the fetch and passes it on.
 func (f *countingFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
+	ctx context.Context, url string,
 ) (*httpfetcher.FetchResult, error) {
 	f.fetches.Add(1)
 
-	return f.Fetcher.Fetch(ctx, source)
+	return f.Fetcher.Fetch(ctx, url)
 }
 
 // newRefererRoutes returns both image routes of a Handlers whose
@@ -53,41 +48,33 @@ func newRefererRoutes(t *testing.T) (http.Handler, *Handlers, *countingFetcher)
 		Fetcher: newPhotoFetcher(t, allowlistedHost, signedHost),
 	}
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
-		log:       slog.New(slog.DiscardHandler),
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
+		log:    slog.New(slog.DiscardHandler),
+		imgSvc: svc,
+		encGen: encGen,
 		refererBlocklist: allowlist.New(
 			[]string{"leech.example", ".hotlinker.example"}),
 	}

internal/handlers/request_id_internal_test.go

@@ -17,13 +17,11 @@ import (
 )
 
 // signedPhotoURL returns a signed /v1/image/ URL, valid for a minute, for the
-// JPEG at photoPath on signedHost at 50x50. It is signed with testSigningKey,
-// the key the handlers that newSignedHostServer builds check signatures with.
-// It takes a Handlers it does not use, so that it has the type of encPhotoURL.
-func signedPhotoURL(t *testing.T, _ *Handlers) string {
+// JPEG at photoPath on signedHost at 50x50, made with h's image service.
+func signedPhotoURL(t *testing.T, h *Handlers) string {
 	t.Helper()
 
-	return generateSignedURL(testSigningKey, &imagerequest.Request{
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imagerequest.Request{
 		Source: imagerequest.Source{
 			Host: signedHost,
 			Path: photoPath,
@@ -33,6 +31,11 @@ func signedPhotoURL(t *testing.T, _ *Handlers) string {
 			Format: imagerequest.FormatJPEG,
 		},
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
+
+	return signedURL
 }
 
 // encPhotoURL returns an encrypted /v1/e/ URL, which never expires, for the
@@ -49,7 +52,7 @@ func encPhotoURL(t *testing.T, h *Handlers) string {
 			Size:   imagerequest.Size{Width: 50, Height: 50},
 			Format: imagerequest.FormatJPEG,
 		},
-	}, time.Time{})
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/server_busy_internal_test.go

@@ -11,14 +11,13 @@ import (
 
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
 	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// TestServerBusyAnswers503 checks that respondImageError, which answers the
-// errors of both image routes, answers 503 with a clear error when the image
-// service gives up waiting for a free upstream connection or processing slot,
-// wrapped as the service wraps them.
+// TestServerBusyAnswers503 checks that both image routes answer 503 with
+// a clear error when the image service gives up waiting for a free upstream
+// connection or processing slot, wrapped as the service wraps them.
 func TestServerBusyAnswers503(t *testing.T) {
 	t.Parallel()
 
@@ -31,44 +30,61 @@ func TestServerBusyAnswers503(t *testing.T) {
 		fmt.Errorf("upstream fetch failed: %w", httpfetcher.ErrTooManyConnections),
 		fmt.Errorf("image processing failed: %w", imageprocessor.ErrTooManyImages),
 	} {
-		rec := httptest.NewRecorder()
-		h.respondImageError(rec, req, err)
+		plain := httptest.NewRecorder()
+		h.respondImageError(plain, req, err)
 
-		if rec.Code != http.StatusServiceUnavailable {
-			t.Errorf("for %v: status = %d, want %d",
-				err, rec.Code, http.StatusServiceUnavailable)
-		}
+		encrypted := httptest.NewRecorder()
+		h.handleImageError(encrypted, err)
 
-		if !strings.Contains(rec.Body.String(), "server busy, try again later") {
-			t.Errorf("for %v: body = %q, want the server busy error",
-				err, rec.Body.String())
+		for route, rec := range map[string]*httptest.ResponseRecorder{
+			"/v1/image/": plain, "/v1/e/": encrypted,
+		} {
+			if rec.Code != http.StatusServiceUnavailable {
+				t.Errorf("%s for %v: status = %d, want %d",
+					route, err, rec.Code, http.StatusServiceUnavailable)
+			}
+
+			if !strings.Contains(rec.Body.String(), "server busy, try again later") {
+				t.Errorf("%s for %v: body = %q, want the server busy error",
+					route, err, rec.Body.String())
+			}
 		}
 	}
 }
 
-// TestProcessingTimedOutAnswers503 checks that respondImageError, which
-// answers the errors of both image routes, answers 503 with the server busy
-// error when the image service reports that processing stopped at the
-// deadline of the request doing it, wrapped as the service wraps it. A request
-// that waited for that processing gets this error while its own deadline may
-// have time left. The request's source only goes into a log line, so it is
-// left empty.
+// TestProcessingTimedOutAnswers503 checks that respondImageError and
+// handleImageError, which answer the errors of the two image routes, answer
+// 503 with the server busy error when the image service reports that
+// processing stopped at the deadline of the request doing it, wrapped as the
+// service wraps it. A request that waited for that processing gets this error
+// while its own deadline may have time left. The request's source only goes
+// into a log line, so it is left empty.
 func TestProcessingTimedOutAnswers503(t *testing.T) {
 	t.Parallel()
 
 	h := &Handlers{log: slog.New(slog.DiscardHandler)}
 	err := fmt.Errorf("%w: failed to encode: %w",
-		imageproxy.ErrProcessingTimedOut, context.DeadlineExceeded)
+		imgcache.ErrProcessingTimedOut, context.DeadlineExceeded)
 
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("status = %d, body = %q", rec.Code, rec.Body.String())
+	plain := httptest.NewRecorder()
+	h.respondImageError(plain, &imagerequest.Request{}, err)
 
-	if rec.Code != http.StatusServiceUnavailable {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusServiceUnavailable)
-	}
+	encrypted := httptest.NewRecorder()
+	h.handleImageError(encrypted, err)
 
-	if !strings.Contains(rec.Body.String(), "server busy, try again later") {
-		t.Errorf("body = %q, want the server busy error", rec.Body.String())
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"respondImageError": plain, "handleImageError": encrypted,
+	} {
+		t.Logf("%s: status = %d, body = %q", name, rec.Code, rec.Body.String())
+
+		if rec.Code != http.StatusServiceUnavailable {
+			t.Errorf("%s: status = %d, want %d",
+				name, rec.Code, http.StatusServiceUnavailable)
+		}
+
+		if !strings.Contains(rec.Body.String(), "server busy, try again later") {
+			t.Errorf("%s: body = %q, want the server busy error",
+				name, rec.Body.String())
+		}
 	}
 }

internal/handlers/unsupported_source_internal_test.go

@@ -13,11 +13,10 @@ import (
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// TestUnsupportedSourceFormatAnswers415 checks that respondImageError, which
-// answers the errors of both image routes, answers 415 with a clear error when
-// the upstream answers with a content type pixa does not accept, such as SVG,
-// and when libvips does not read a source as the format its first bytes
-// show, wrapped as the service wraps them.
+// TestUnsupportedSourceFormatAnswers415 checks that both image routes answer
+// 415 with a clear error when the upstream answers with a content type pixa
+// does not accept, such as SVG, and when orig is asked of a source in a
+// format the processor cannot name, wrapped as the service wraps them.
 func TestUnsupportedSourceFormatAnswers415(t *testing.T) {
 	t.Parallel()
 
@@ -29,21 +28,29 @@ func TestUnsupportedSourceFormatAnswers415(t *testing.T) {
 	for _, err := range []error{
 		fmt.Errorf("upstream fetch failed: %w: image/svg+xml",
 			httpfetcher.ErrInvalidContentType),
-		fmt.Errorf("image processing failed: %w: libvips does not read the input as avif",
+		fmt.Errorf("image processing failed: %w: unknown",
 			imageprocessor.ErrUnsupportedInputFormat),
 	} {
-		rec := httptest.NewRecorder()
-		h.respondImageError(rec, req, err)
-		t.Logf("for %v: %d %s", err, rec.Code, rec.Body.String())
+		plain := httptest.NewRecorder()
+		h.respondImageError(plain, req, err)
 
-		if rec.Code != http.StatusUnsupportedMediaType {
-			t.Errorf("for %v: status = %d, want %d",
-				err, rec.Code, http.StatusUnsupportedMediaType)
-		}
+		encrypted := httptest.NewRecorder()
+		h.handleImageError(encrypted, err)
 
-		if !strings.Contains(rec.Body.String(), "unsupported source format") {
-			t.Errorf("for %v: body = %q, want the unsupported source format error",
-				err, rec.Body.String())
+		for route, rec := range map[string]*httptest.ResponseRecorder{
+			"HandleImage": plain, "HandleImageEnc": encrypted,
+		} {
+			t.Logf("%s for %v: %d %s", route, err, rec.Code, rec.Body.String())
+
+			if rec.Code != http.StatusUnsupportedMediaType {
+				t.Errorf("%s for %v: status = %d, want %d",
+					route, err, rec.Code, http.StatusUnsupportedMediaType)
+			}
+
+			if !strings.Contains(rec.Body.String(), "unsupported source format") {
+				t.Errorf("%s for %v: body = %q, want the unsupported source format error",
+					route, err, rec.Body.String())
+			}
 		}
 	}
 }

internal/handlers/validate_signature_internal_test.go

@@ -1,211 +0,0 @@
-package handlers
-
-import (
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/signature"
-)
-
-// Addresses the port tests below put on the allowlist.
-const (
-	allowlistedIPv4 = "203.0.113.5"
-	allowlistedIPv6 = "2001:db8::1"
-)
-
-// newSignatureChecker returns Handlers that check signatures with
-// testSigningKey and have allowlistHosts on their allowlist, as New builds
-// them from signing_key and allowlist_hosts.
-func newSignatureChecker(allowlistHosts ...string) *Handlers {
-	return &Handlers{
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New(allowlistHosts),
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_NoSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-
-	// Should fail validation - not allowlisted and no signature
-	err := h.validateSignature(photoRequest(signedHost), "", time.Time{})
-	if err == nil {
-		t.Error("validateSignature() expected error for non-allowlisted " +
-			"host without signature")
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_ValidSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-	req := photoRequest(signedHost)
-
-	// Generate a valid signature
-	expires := time.Now().Add(time.Hour)
-	sig := signature.New(testSigningKey).Sign(req, expires)
-
-	// Should pass validation
-	err := h.validateSignature(req, sig, expires)
-	if err != nil {
-		t.Errorf("validateSignature() error = %v", err)
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_ExpiredSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-	req := photoRequest(signedHost)
-
-	// Generate an expired signature
-	expires := time.Now().Add(-time.Hour)
-	sig := signature.New(testSigningKey).Sign(req, expires)
-
-	// Should fail validation
-	err := h.validateSignature(req, sig, expires)
-	if err == nil {
-		t.Error("validateSignature() expected error for expired signature")
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_InvalidSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-
-	// Should fail validation
-	err := h.validateSignature(photoRequest(signedHost), "invalid-signature",
-		time.Now().Add(time.Hour))
-	if err == nil {
-		t.Error("validateSignature() expected error for invalid signature")
-	}
-}
-
-// TestValidateSignature_NoAllowlist checks that with no host on the
-// allowlist, a request without a signature fails validation.
-func TestValidateSignature_NoAllowlist(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker()
-
-	err := h.validateSignature(photoRequest(signedHost), "", time.Time{})
-	if err == nil {
-		t.Error("validateSignature() expected error when no host is allowlisted")
-	}
-}
-
-// TestValidateSignature_SignatureExactHostMatch verifies that
-// validateSignature enforces exact host matching for signatures. A
-// signature for one host must not verify for a different host, even
-// if they share a domain suffix.
-func TestValidateSignature_SignatureExactHostMatch(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker()
-
-	// Sign a request for signedHost
-	signedReq := photoRequest(signedHost)
-	expires := time.Now().Add(time.Hour)
-	sig := signature.New(testSigningKey).Sign(signedReq, expires)
-
-	// The original request should pass validation
-	t.Run("exact host passes", func(t *testing.T) {
-		t.Parallel()
-
-		err := h.validateSignature(signedReq, sig, expires)
-		if err != nil {
-			t.Errorf("validateSignature() exact host failed: %v", err)
-		}
-	})
-
-	// Try to reuse the signature with different hosts
-	tests := []struct {
-		name string
-		host string
-	}{
-		{"parent domain", "example.com"},
-		{"sibling subdomain", "images.example.com"},
-		{"deeper subdomain", "a." + signedHost},
-		{"evil suffix domain", signedHost + ".evil.com"},
-		{"prefixed host", "evil" + signedHost},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name+" rejected", func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(tt.host), sig, expires)
-			if err == nil {
-				t.Errorf("validateSignature() should reject signature for "+
-					"host %q (signed for %q)", tt.host, signedHost)
-			}
-		})
-	}
-}
-
-// TestValidateSignature_HostWithPortNeedsSignature verifies that a host
-// followed by a port, or by a colon with no port, matches no allowlist entry,
-// so that a request for it without a signature is refused, while the same
-// host with no port is allowlisted.
-func TestValidateSignature_HostWithPortNeedsSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost, allowlistedIPv4, allowlistedIPv6)
-
-	tests := []struct {
-		host        string
-		allowlisted bool
-	}{
-		{allowlistedHost, true},
-		{allowlistedHost + ":8443", false},
-		{allowlistedHost + ":443", false},
-		{allowlistedHost + ":", false},
-		{allowlistedIPv4, true},
-		{allowlistedIPv4 + ":8080", false},
-		{"[" + allowlistedIPv6 + "]", true},
-		{"[" + allowlistedIPv6 + "]:8443", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(tt.host), "", time.Time{})
-			t.Logf("validateSignature() for host %q with no signature: %v",
-				tt.host, err)
-
-			if allowlisted := err == nil; allowlisted != tt.allowlisted {
-				t.Errorf("host %q served without a signature = %v, want %v",
-					tt.host, allowlisted, tt.allowlisted)
-			}
-		})
-	}
-}
-
-// TestValidateSignature_UnbracketedIPv6PortNeedsSignature verifies that an
-// allowlisted IPv6 address written without brackets and followed by a port,
-// or by a colon with no port, needs a signature. Go's URL type reads
-// 2001:db8::1:8443 as the host 2001:db8::1 with the port 8443.
-func TestValidateSignature_UnbracketedIPv6PortNeedsSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedIPv6)
-
-	for _, host := range []string{allowlistedIPv6 + ":8443", allowlistedIPv6 + ":"} {
-		t.Run(host, func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(host), "", time.Time{})
-			t.Logf("validateSignature() for host %q with no signature: %v",
-				host, err)
-
-			if err == nil {
-				t.Errorf("host %q served without a signature, want refused",
-					host)
-			}
-		})
-	}
-}

internal/httpfetcher/blocked_networks_internal_test.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/netip"
 	"testing"
-	"time"
 )
 
 // TestIsPrivateIPBlocksSpecialRanges covers the internal and special-use
@@ -71,15 +70,12 @@ func transportOf(t *testing.T, f *HTTPFetcher) *http.Transport {
 func TestDialerEnforcesBlockedNetworks(t *testing.T) {
 	t.Parallel()
 
-	transport := transportOf(t, New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-		// TEST-NET-2 (198.51.100.0/24) is public to the built-in check, so
-		// blocking it can only come from the operator-supplied list.
-		BlockedNetworks: []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")},
-	}))
+	cfg := DefaultConfig()
+	// TEST-NET-2 (198.51.100.0/24) is public to the built-in check, so
+	// blocking it can only come from the operator-supplied list.
+	cfg.BlockedNetworks = []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")}
+
+	transport := transportOf(t, New(cfg))
 
 	blocked := []string{
 		"198.51.100.5:80", // operator-supplied range

internal/httpfetcher/dial_context_internal_test.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net"
 	"testing"
-	"time"
 )
 
 // TestNewUsesCheckedDialerWithoutDialContext checks that a fetcher built
@@ -14,12 +13,7 @@ func TestNewUsesCheckedDialerWithoutDialContext(t *testing.T) {
 	t.Parallel()
 
 	srv := startUpstream(t)
-	transport := transportOf(t, New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}))
+	transport := transportOf(t, New(DefaultConfig()))
 
 	addr := srv.Listener.Addr().String()
 
@@ -38,25 +32,21 @@ func TestDialContextReplacesOnlyTheDialer(t *testing.T) {
 	srv := startUpstream(t)
 	dialer := &recordingDialer{target: srv.Listener.Addr().String()}
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		AllowHTTP:             true,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-		DialContext:           dialer.dialContext,
-	})
+	cfg := DefaultConfig()
+	cfg.AllowHTTP = true
+	cfg.DialContext = dialer.dialContext
+	f := New(cfg)
 
 	if body := fetchBody(t, f, "/image"); body != imagePayload {
 		t.Errorf("body = %q, want %q", body, imagePayload)
 	}
 
-	_, err := f.Fetch(testContext(t), imageSourceOn("127.0.0.1"))
+	_, err := f.Fetch(testContext(t), "http://127.0.0.1/image")
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("Fetch(loopback URL) error = %v, want ErrSSRFBlocked", err)
 	}
 
-	_, err = f.Fetch(testContext(t), upstreamSource("/redirect/private"))
+	_, err = f.Fetch(testContext(t), upstreamURL("/redirect/private"))
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("Fetch(/redirect/private) error = %v, want ErrSSRFBlocked", err)
 	}

internal/httpfetcher/fetch_internal_test.go

@@ -14,8 +14,6 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // testPublicHost is a TEST-NET-1 (RFC 5737) literal. isPrivateIP treats it as
@@ -31,9 +29,9 @@ const imagePayload = "fake-jpeg-bytes"
 // would mean SSRF protection let a forbidden target reach the transport.
 var errUnexpectedDial = errors.New("unexpected dial target")
 
-// upstreamSource returns the source at path on the fake public host.
-func upstreamSource(path string) imagerequest.Source {
-	return imagerequest.Source{Host: testPublicHost, Path: path}
+// upstreamURL builds a fetch URL on the fake public host for the given path.
+func upstreamURL(path string) string {
+	return "http://" + testPublicHost + path
 }
 
 // recordingDialer records every address the transport asks it to dial and
@@ -83,7 +81,7 @@ func startUpstream(t *testing.T) *httptest.Server {
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/image", func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+		w.Header().Set("Content-Type", contentTypeJPEG)
 		_, _ = io.WriteString(w, imagePayload)
 	})
 	mux.HandleFunc("/status/500", func(w http.ResponseWriter, _ *http.Request) {
@@ -122,12 +120,7 @@ func newServerFetcher(
 	t.Helper()
 
 	if cfg == nil {
-		cfg = &Config{
-			Timeout:               30 * time.Second,
-			MaxResponseSize:       50 << 20,
-			MaxConnectionsPerHost: 20,
-			MaxConnections:        64,
-		}
+		cfg = DefaultConfig()
 	}
 
 	cfg.AllowHTTP = true
@@ -160,7 +153,7 @@ func testContext(t *testing.T) context.Context {
 func fetchImage(t *testing.T, f *HTTPFetcher, path string) *FetchResult {
 	t.Helper()
 
-	res, err := f.Fetch(testContext(t), upstreamSource(path))
+	res, err := f.Fetch(testContext(t), upstreamURL(path))
 	if err != nil {
 		t.Fatalf("Fetch(%s) error = %v", path, err)
 	}
@@ -172,7 +165,7 @@ func fetchImage(t *testing.T, f *HTTPFetcher, path string) *FetchResult {
 func fetchExpectError(t *testing.T, f *HTTPFetcher, path string) error {
 	t.Helper()
 
-	res, err := f.Fetch(testContext(t), upstreamSource(path))
+	res, err := f.Fetch(testContext(t), upstreamURL(path))
 	if err == nil {
 		_ = res.Content.Close()
 
@@ -224,7 +217,7 @@ func TestFetchRedirectToPrivateIPBlocked(t *testing.T) {
 	srv := startUpstream(t)
 	f, dialer := newServerFetcher(t, srv, nil)
 
-	_, err := f.Fetch(testContext(t), upstreamSource("/redirect/private"))
+	_, err := f.Fetch(testContext(t), upstreamURL("/redirect/private"))
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Fatalf("Fetch() error = %v, want ErrSSRFBlocked", err)
 	}
@@ -287,12 +280,8 @@ func TestFetchMaxResponseSizeEnforced(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       8,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxResponseSize = 8
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -321,12 +310,8 @@ func fetchWithMaxResponseSize(
 	srv := httptest.NewServer(handler)
 	t.Cleanup(srv.Close)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       maxResponseSize,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxResponseSize = maxResponseSize
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -358,7 +343,7 @@ func TestFetchContentLengthBodyAtMaxResponseSize(t *testing.T) {
 
 			res := fetchWithMaxResponseSize(t, maxResponseSize,
 				func(w http.ResponseWriter, _ *http.Request) {
-					w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+					w.Header().Set("Content-Type", contentTypeJPEG)
 					w.Header().Set("Content-Length", strconv.Itoa(tc.size))
 					_, _ = io.WriteString(w, body)
 				})
@@ -406,7 +391,7 @@ func TestFetchChunkedBodyAtMaxResponseSize(t *testing.T) {
 
 			res := fetchWithMaxResponseSize(t, maxResponseSize,
 				func(w http.ResponseWriter, r *http.Request) {
-					w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+					w.Header().Set("Content-Type", contentTypeJPEG)
 					_, _ = io.WriteString(w, body)
 					// With no Content-Length, flushing sends the body
 					// chunked; its end is sent when the handler returns.
@@ -451,12 +436,8 @@ func TestFetchSemaphoreReleasedOnError(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -485,12 +466,8 @@ func assertSlotReleasedByClose(
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -547,7 +524,7 @@ func TestFetchSemaphoreReleasedOnPartialReadClose(t *testing.T) {
 	})
 }
 
-// The dial-time re-resolution in dialSSRFSafe is what closes the DNS
+// The dial-time re-resolution in ssrfSafeDialer is what closes the DNS
 // rebinding window: even if validateURL saw a public answer earlier, the
 // dialer independently re-checks the address it is about to connect to. A full
 // rebinding simulation (a resolver returning public, then private) would mean
@@ -567,9 +544,9 @@ func TestSSRFSafeDialerBlocksPrivateTarget(t *testing.T) {
 		t.Run(addr, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := dialSSRFSafe(context.Background(), "tcp", addr, nil)
+			_, err := ssrfSafeDialer(context.Background(), "tcp", addr)
 			if !errors.Is(err, ErrSSRFBlocked) {
-				t.Errorf("dialSSRFSafe(%q) = %v, want ErrSSRFBlocked", addr, err)
+				t.Errorf("ssrfSafeDialer(%q) = %v, want ErrSSRFBlocked", addr, err)
 			}
 		})
 	}
@@ -583,7 +560,7 @@ func TestSSRFSafeDialerAllowsPublicTarget(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	_, err := dialSSRFSafe(ctx, "tcp", testPublicHost+":80", nil)
+	_, err := ssrfSafeDialer(ctx, "tcp", testPublicHost+":80")
 	if err == nil {
 		t.Fatal("expected a dial error for an unreachable public target")
 	}
@@ -592,53 +569,3 @@ func TestSSRFSafeDialerAllowsPublicTarget(t *testing.T) {
 		t.Errorf("public target was SSRF-blocked: %v", err)
 	}
 }
-
-// TestFetchSchemeFollowsAllowHTTP checks that the fetcher fetches a source
-// over https, on port 443, unless AllowHTTP is set, and then over http, on
-// port 80. The test server speaks plain HTTP, so only the fetch over http
-// succeeds.
-func TestFetchSchemeFollowsAllowHTTP(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		allowHTTP bool
-		wantAddr  string
-	}{
-		{false, net.JoinHostPort(testPublicHost, "443")},
-		{true, net.JoinHostPort(testPublicHost, "80")},
-	}
-
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("AllowHTTP %v", tt.allowHTTP), func(t *testing.T) {
-			t.Parallel()
-
-			srv := startUpstream(t)
-			dialer := &recordingDialer{target: srv.Listener.Addr().String()}
-
-			f := New(&Config{
-				Timeout:               30 * time.Second,
-				MaxResponseSize:       50 << 20,
-				AllowHTTP:             tt.allowHTTP,
-				MaxConnectionsPerHost: 20,
-				MaxConnections:        64,
-				DialContext:           dialer.dialContext,
-			})
-
-			res, err := f.Fetch(testContext(t), upstreamSource("/image"))
-			if err == nil {
-				_ = res.Content.Close()
-			}
-
-			dialed := dialer.dialedAddrs()
-			t.Logf("Fetch(): error %v, dialed %v", err, dialed)
-
-			if served := err == nil; served != tt.allowHTTP {
-				t.Errorf("served = %v, want %v", served, tt.allowHTTP)
-			}
-
-			if len(dialed) != 1 || dialed[0] != tt.wantAddr {
-				t.Errorf("dialed %v, want only %s", dialed, tt.wantAddr)
-			}
-		})
-	}
-}

internal/httpfetcher/httpfetcher.go

@@ -20,24 +20,36 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // Fetcher configuration constants.
 const (
-	DefaultTLSTimeout      = 10 * time.Second
-	DefaultMaxIdleConns    = 100
-	DefaultIdleConnTimeout = 90 * time.Second
-	DefaultMaxRedirects    = 10
+	DefaultFetchTimeout          = 30 * time.Second
+	DefaultMaxResponseSize       = 50 << 20 // 50MB
+	DefaultTLSTimeout            = 10 * time.Second
+	DefaultMaxIdleConns          = 100
+	DefaultIdleConnTimeout       = 90 * time.Second
+	DefaultMaxRedirects          = 10
+	DefaultMaxConnectionsPerHost = 20
+	DefaultMaxConnections        = 64
 )
 
-// userAgent is the User-Agent header sent to upstream servers.
-const userAgent = "pixa/1.0"
-
 // ConnectionWaitTimeout is how long Fetch waits for a free connection when
 // MaxConnections fetches are already in progress.
 const ConnectionWaitTimeout = 10 * time.Second
 
+// MIME content types.
+const (
+	contentTypeJPEG        = "image/jpeg"
+	contentTypePNG         = "image/png"
+	contentTypeGIF         = "image/gif"
+	contentTypeWebP        = "image/webp"
+	contentTypeAVIF        = "image/avif"
+	contentTypeJXL         = "image/jxl"
+	contentTypeSVG         = "image/svg+xml"
+	contentTypeOctetStream = "application/octet-stream"
+)
+
 // Loopback addresses blocked by SSRF protection.
 const (
 	localhostIPv4 = "127.0.0.1"
@@ -80,8 +92,8 @@ var (
 
 // Fetcher retrieves content from upstream origins.
 type Fetcher interface {
-	// Fetch retrieves the content of the source image.
-	Fetch(ctx context.Context, source imagerequest.Source) (*FetchResult, error)
+	// Fetch retrieves content from the given URL.
+	Fetch(ctx context.Context, url string) (*FetchResult, error)
 }
 
 // FetchResult contains the result of fetching from upstream.
@@ -108,29 +120,17 @@ type FetchResult struct {
 	TLSCipherSuite string
 }
 
-// allowedContentTypes returns the content types an upstream response may
-// have, which Fetch also sends as its Accept header: the MIME types of the
-// formats pixa reads.
-func allowedContentTypes() []string {
-	return []string{
-		imagerequest.FormatJPEG.MIMEType(),
-		imagerequest.FormatPNG.MIMEType(),
-		imagerequest.FormatGIF.MIMEType(),
-		imagerequest.FormatWebP.MIMEType(),
-		imagerequest.FormatAVIF.MIMEType(),
-		imagerequest.FormatJXL.MIMEType(),
-	}
-}
-
-// Config holds configuration for the upstream fetcher. Every field but
-// AllowHTTP, BlockedNetworks and DialContext must be set.
+// Config holds configuration for the upstream fetcher.
 type Config struct {
 	// Timeout for upstream requests.
 	Timeout time.Duration
 	// MaxResponseSize is the maximum allowed response body size.
 	MaxResponseSize int64
-	// AllowHTTP makes the fetcher fetch sources over http instead of https,
-	// and follow redirects to http (for testing only).
+	// UserAgent to send to upstream servers.
+	UserAgent string
+	// AllowedContentTypes is an allow list of MIME types to accept.
+	AllowedContentTypes []string
+	// AllowHTTP allows non-TLS connections (for testing only).
 	AllowHTTP bool
 	// MaxConnectionsPerHost limits concurrent connections to each upstream host.
 	MaxConnectionsPerHost int
@@ -147,6 +147,26 @@ type Config struct {
 	DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
 }
 
+// DefaultConfig returns a Config with sensible defaults.
+func DefaultConfig() *Config {
+	return &Config{
+		Timeout:         DefaultFetchTimeout,
+		MaxResponseSize: DefaultMaxResponseSize,
+		UserAgent:       "pixa/1.0",
+		AllowedContentTypes: []string{
+			contentTypeJPEG,
+			contentTypePNG,
+			contentTypeGIF,
+			contentTypeWebP,
+			contentTypeAVIF,
+			contentTypeJXL,
+		},
+		AllowHTTP:             false,
+		MaxConnectionsPerHost: DefaultMaxConnectionsPerHost,
+		MaxConnections:        DefaultMaxConnections,
+	}
+}
+
 // HTTPFetcher implements Fetcher with SSRF protection and connection limits
 // per host and for all hosts together.
 type HTTPFetcher struct {
@@ -174,6 +194,10 @@ type hostSemaphore struct {
 
 // New creates a new HTTPFetcher with SSRF protection.
 func New(config *Config) *HTTPFetcher {
+	if config == nil {
+		config = DefaultConfig()
+	}
+
 	// Unless config.DialContext replaces it, the transport connects with
 	// the SSRF-safe dialer, which re-resolves and re-checks at connect time
 	// (closing the DNS-rebinding window) against both the built-in ranges
@@ -202,7 +226,7 @@ func New(config *Config) *HTTPFetcher {
 			}
 
 			// Validate the redirect target
-			err := validateURL(req.Context(), req.URL, config.AllowHTTP)
+			err := validateURL(req.Context(), req.URL.String(), config.AllowHTTP)
 			if err != nil {
 				return fmt.Errorf("redirect blocked: %w", err)
 			}
@@ -220,22 +244,18 @@ func New(config *Config) *HTTPFetcher {
 	}
 }
 
-// Fetch retrieves the source image with SSRF protection, over https, or over
-// http when AllowHTTP is set. When MaxConnections fetches are already in
-// progress, it waits up to ConnectionWaitTimeout for one to finish, then
-// fails with ErrTooManyConnections.
-func (f *HTTPFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
-) (*FetchResult, error) {
-	sourceURL := source.URL(f.config.AllowHTTP)
-
+// Fetch retrieves content from the given URL with SSRF protection. When
+// MaxConnections fetches are already in progress, it waits up to
+// ConnectionWaitTimeout for one to finish, then fails with
+// ErrTooManyConnections.
+func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, error) {
 	// Validate URL before making request
-	err := validateURL(ctx, sourceURL, f.config.AllowHTTP)
+	err := validateURL(ctx, url, f.config.AllowHTTP)
 	if err != nil {
 		return nil, err
 	}
 
-	release, err := f.acquireConnection(ctx, source.Host)
+	release, err := f.acquireConnection(ctx, extractHost(url))
 	if err != nil {
 		return nil, err
 	}
@@ -249,14 +269,19 @@ func (f *HTTPFetcher) Fetch(
 		}
 	}()
 
+	parsedURL, err := neturl.Parse(url)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse URL: %w", err)
+	}
+
 	req := &http.Request{
 		Method: http.MethodGet,
-		URL:    sourceURL,
+		URL:    parsedURL,
 		Header: make(http.Header),
 	}
 
-	req.Header.Set("User-Agent", userAgent)
-	req.Header.Set("Accept", strings.Join(allowedContentTypes(), ", "))
+	req.Header.Set("User-Agent", f.config.UserAgent)
+	req.Header.Set("Accept", strings.Join(f.config.AllowedContentTypes, ", "))
 
 	// The ID of the request this fetch serves, so the fetch can be found in
 	// the upstream host's logs
@@ -435,7 +460,7 @@ func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 	// Extract the MIME type without parameters
 	mediaType := strings.TrimSpace(strings.Split(contentType, ";")[0])
 
-	for _, allowed := range allowedContentTypes() {
+	for _, allowed := range f.config.AllowedContentTypes {
 		if strings.EqualFold(mediaType, allowed) {
 			return true
 		}
@@ -445,14 +470,19 @@ func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 }
 
 // validateURL checks if a URL is safe to fetch (not internal/private).
-func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) error {
-	if !allowHTTP && fetchURL.Scheme != "https" {
+func validateURL(ctx context.Context, rawURL string, allowHTTP bool) error {
+	if !allowHTTP && !strings.HasPrefix(rawURL, "https://") {
 		return ErrUnsupportedScheme
 	}
 
+	parsedURL, err := neturl.Parse(rawURL)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidHost, err)
+	}
+
 	// Hostname drops any port, and the brackets of an IPv6 address whether
 	// or not a port follows them
-	host := fetchURL.Hostname()
+	host := parsedURL.Hostname()
 	if host == "" {
 		return ErrInvalidHost
 	}
@@ -478,6 +508,25 @@ func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) erro
 	return nil
 }
 
+// extractHost extracts the host from a URL string.
+func extractHost(rawURL string) string {
+	// Simple extraction without full URL parsing
+	url := rawURL
+	if idx := strings.Index(url, "://"); idx != -1 {
+		url = url[idx+3:]
+	}
+
+	if idx := strings.Index(url, "/"); idx != -1 {
+		url = url[:idx]
+	}
+
+	if idx := strings.Index(url, "?"); idx != -1 {
+		url = url[:idx]
+	}
+
+	return url
+}
+
 // isLocalhost checks if the host is localhost.
 func isLocalhost(host string) bool {
 	host = strings.ToLower(host)
@@ -590,6 +639,13 @@ func ipv4CompatibleToIPv4(ip net.IP) net.IP {
 	return ip
 }
 
+// ssrfSafeDialer validates IP addresses against the built-in blocked ranges
+// before connecting. New wraps dialSSRFSafe with the operator-supplied
+// blocklist; this entry point enforces the built-in ranges alone.
+func ssrfSafeDialer(ctx context.Context, network, addr string) (net.Conn, error) {
+	return dialSSRFSafe(ctx, network, addr, nil)
+}
+
 // dialSSRFSafe re-resolves addr and refuses to connect to any built-in
 // internal range or operator-supplied blocked prefix, closing the
 // DNS-rebinding window at connect time.

internal/httpfetcher/httpfetcher_internal_test.go

@@ -5,34 +5,70 @@ import (
 	"errors"
 	"io"
 	"net"
-	"net/url"
 	"testing"
 	"testing/fstest"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // testHost is the hostname used by mock fetch tests.
 const testHost = "example.com"
 
+func TestDefaultConfig(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+
+	if cfg.Timeout != DefaultFetchTimeout {
+		t.Errorf("Timeout = %v, want %v", cfg.Timeout, DefaultFetchTimeout)
+	}
+
+	if cfg.MaxResponseSize != DefaultMaxResponseSize {
+		t.Errorf("MaxResponseSize = %d, want %d", cfg.MaxResponseSize, DefaultMaxResponseSize)
+	}
+
+	if cfg.MaxConnectionsPerHost != DefaultMaxConnectionsPerHost {
+		t.Errorf("MaxConnectionsPerHost = %d, want %d",
+			cfg.MaxConnectionsPerHost, DefaultMaxConnectionsPerHost)
+	}
+
+	if cfg.AllowHTTP {
+		t.Error("AllowHTTP should default to false")
+	}
+
+	if len(cfg.AllowedContentTypes) == 0 {
+		t.Error("AllowedContentTypes should not be empty")
+	}
+}
+
+func TestNewWithNilConfigUsesDefaults(t *testing.T) {
+	t.Parallel()
+
+	f := New(nil)
+
+	if f == nil {
+		t.Fatal("New(nil) returned nil")
+	}
+
+	if f.config == nil {
+		t.Fatal("config should be populated from DefaultConfig")
+	}
+
+	if f.config.Timeout != DefaultFetchTimeout {
+		t.Errorf("Timeout = %v, want %v", f.config.Timeout, DefaultFetchTimeout)
+	}
+}
+
 func TestIsAllowedContentType(t *testing.T) {
 	t.Parallel()
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
+	f := New(DefaultConfig())
 
 	tests := []struct {
 		contentType string
 		want        bool
 	}{
-		{imagerequest.FormatJPEG.MIMEType(), true},
-		{imagerequest.FormatPNG.MIMEType(), true},
-		{imagerequest.FormatWebP.MIMEType(), true},
+		{contentTypeJPEG, true},
+		{contentTypePNG, true},
+		{contentTypeWebP, true},
 		{"image/jpeg; charset=utf-8", true},
 		{"IMAGE/JPEG", true},
 		{"text/html", false},
@@ -52,6 +88,33 @@ func TestIsAllowedContentType(t *testing.T) {
 	}
 }
 
+func TestExtractHost(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		url  string
+		want string
+	}{
+		{"https://example.com/path", testHost},
+		{"http://example.com:8080/path", "example.com:8080"},
+		{"https://example.com", testHost},
+		{"https://example.com?q=1", testHost},
+		{"example.com/path", testHost},
+		{"", ""},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.url, func(t *testing.T) {
+			t.Parallel()
+
+			got := extractHost(tc.url)
+			if got != tc.want {
+				t.Errorf("extractHost(%q) = %q, want %q", tc.url, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestIsLocalhost(t *testing.T) {
 	t.Parallel()
 
@@ -164,7 +227,7 @@ func TestIsPrivateIPJudgesEmbeddedIPv4Address(t *testing.T) {
 func TestValidateURL_RejectsNonHTTPS(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "http", Host: testHost}, false)
+	err := validateURL(t.Context(), "http://example.com/path", false)
 	if !errors.Is(err, ErrUnsupportedScheme) {
 		t.Errorf("validateURL http = %v, want ErrUnsupportedScheme", err)
 	}
@@ -174,8 +237,7 @@ func TestValidateURL_AllowsHTTPWhenConfigured(t *testing.T) {
 	t.Parallel()
 
 	// Use a host that won't resolve (explicit .invalid TLD) so we don't hit DNS.
-	err := validateURL(t.Context(),
-		&url.URL{Scheme: "http", Host: "nonexistent.invalid"}, true)
+	err := validateURL(t.Context(), "http://nonexistent.invalid/path", true)
 	// We expect a host resolution error, not ErrUnsupportedScheme.
 	if errors.Is(err, ErrUnsupportedScheme) {
 		t.Error("validateURL with AllowHTTP should not return ErrUnsupportedScheme")
@@ -185,7 +247,7 @@ func TestValidateURL_AllowsHTTPWhenConfigured(t *testing.T) {
 func TestValidateURL_RejectsLocalhost(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "https", Host: "localhost"}, false)
+	err := validateURL(t.Context(), "https://localhost/path", false)
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("validateURL localhost = %v, want ErrSSRFBlocked", err)
 	}
@@ -194,7 +256,7 @@ func TestValidateURL_RejectsLocalhost(t *testing.T) {
 func TestValidateURL_EmptyHost(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "https"}, false)
+	err := validateURL(t.Context(), "https:///path", false)
 	if !errors.Is(err, ErrInvalidHost) {
 		t.Errorf("validateURL empty host = %v, want ErrInvalidHost", err)
 	}
@@ -209,15 +271,14 @@ func TestMockFetcher_FetchesFile(t *testing.T) {
 
 	m := NewMock(mockFS)
 
-	result, err := m.Fetch(context.Background(),
-		imagerequest.Source{Host: testHost, Path: "/images/photo.jpg"})
+	result, err := m.Fetch(context.Background(), "https://example.com/images/photo.jpg")
 	if err != nil {
 		t.Fatalf("Fetch() error = %v", err)
 	}
 
 	defer func() { _ = result.Content.Close() }()
 
-	if result.ContentType != imagerequest.FormatJPEG.MIMEType() {
+	if result.ContentType != contentTypeJPEG {
 		t.Errorf("ContentType = %q, want image/jpeg", result.ContentType)
 	}
 
@@ -241,8 +302,7 @@ func TestMockFetcher_MissingFileReturnsUpstreamError(t *testing.T) {
 	mockFS := fstest.MapFS{}
 	m := NewMock(mockFS)
 
-	_, err := m.Fetch(context.Background(),
-		imagerequest.Source{Host: testHost, Path: "/missing.jpg"})
+	_, err := m.Fetch(context.Background(), "https://example.com/missing.jpg")
 	if !errors.Is(err, ErrUpstreamError) {
 		t.Errorf("Fetch() error = %v, want ErrUpstreamError", err)
 	}
@@ -259,7 +319,7 @@ func TestMockFetcher_RespectsContextCancellation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	_, err := m.Fetch(ctx, imagerequest.Source{Host: testHost, Path: "/photo.jpg"})
+	_, err := m.Fetch(ctx, "https://example.com/photo.jpg")
 	if !errors.Is(err, context.Canceled) {
 		t.Errorf("Fetch() error = %v, want context.Canceled", err)
 	}
@@ -272,13 +332,13 @@ func TestDetectContentTypeFromPath(t *testing.T) {
 		path string
 		want string
 	}{
-		{"foo/bar.jpg", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.JPG", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.jpeg", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.png", imagerequest.FormatPNG.MIMEType()},
-		{"foo/bar.gif", imagerequest.FormatGIF.MIMEType()},
-		{"foo/bar.webp", imagerequest.FormatWebP.MIMEType()},
-		{"foo/bar.avif", imagerequest.FormatAVIF.MIMEType()},
+		{"foo/bar.jpg", contentTypeJPEG},
+		{"foo/bar.JPG", contentTypeJPEG},
+		{"foo/bar.jpeg", contentTypeJPEG},
+		{"foo/bar.png", contentTypePNG},
+		{"foo/bar.gif", contentTypeGIF},
+		{"foo/bar.webp", contentTypeWebP},
+		{"foo/bar.avif", contentTypeAVIF},
 		{"foo/bar.svg", contentTypeSVG},
 		{"foo/bar.bin", contentTypeOctetStream},
 		{"foo/bar", contentTypeOctetStream},

internal/httpfetcher/jpegxl_internal_test.go

@@ -1,26 +1,16 @@
 package httpfetcher
 
-import (
-	"testing"
-	"time"
-)
+import "testing"
 
 // TestJPEGXLContentType verifies that the fetcher accepts an upstream answer
-// of type image/jxl, and that the mock fetcher serves a .jxl file as
-// image/jxl.
+// of type image/jxl by default, and that the mock fetcher serves a .jxl file
+// as image/jxl.
 func TestJPEGXLContentType(t *testing.T) {
 	t.Parallel()
 
 	const jxlType = "image/jxl"
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
-
-	if !f.isAllowedContentType(jxlType) {
+	if !New(DefaultConfig()).isAllowedContentType(jxlType) {
 		t.Errorf("isAllowedContentType(%q) = false, want true", jxlType)
 	}
 

internal/httpfetcher/max_connections_internal_test.go

@@ -8,20 +8,22 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// imageSourceOn is the fake upstream's image route on host.
-func imageSourceOn(host string) imagerequest.Source {
-	return imagerequest.Source{Host: host, Path: "/image"}
-}
-
-// imageSourceOnPort is the fake upstream's image route on testPublicHost at
+// imageURLOnPort is the fake upstream's image route on testPublicHost at
 // port. Each port is a different host to the per-host limit, while the test
 // dialer sends every port to the one test server.
-func imageSourceOnPort(port int) imagerequest.Source {
-	return imageSourceOn(net.JoinHostPort(testPublicHost, strconv.Itoa(port)))
+func imageURLOnPort(port int) string {
+	return "http://" + net.JoinHostPort(testPublicHost, strconv.Itoa(port)) +
+		"/image"
+}
+
+func TestDefaultConfigMaxConnections(t *testing.T) {
+	t.Parallel()
+
+	if got := DefaultConfig().MaxConnections; got != DefaultMaxConnections {
+		t.Errorf("MaxConnections = %d, want %d", got, DefaultMaxConnections)
+	}
 }
 
 // TestFetchLimitsConnectionsToAllHostsTogether checks that MaxConnections
@@ -35,22 +37,18 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        2,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 2
 
 	f, _ := newServerFetcher(t, srv, cfg)
 	f.connectionWaitTimeout = 100 * time.Millisecond
 
-	first, err := f.Fetch(testContext(t), imageSourceOnPort(81))
+	first, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
 
-	second, err := f.Fetch(testContext(t), imageSourceOnPort(82))
+	second, err := f.Fetch(testContext(t), imageURLOnPort(82))
 	if err != nil {
 		t.Fatalf("second Fetch() error = %v", err)
 	}
@@ -59,7 +57,7 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 
 	start := time.Now()
 
-	_, err = f.Fetch(testContext(t), imageSourceOnPort(83))
+	_, err = f.Fetch(testContext(t), imageURLOnPort(83))
 	if !errors.Is(err, ErrTooManyConnections) {
 		t.Fatalf("third Fetch() error = %v, want ErrTooManyConnections", err)
 	}
@@ -78,7 +76,7 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 		t.Fatalf("close first body: %v", err)
 	}
 
-	third, err := f.Fetch(testContext(t), imageSourceOnPort(83))
+	third, err := f.Fetch(testContext(t), imageURLOnPort(83))
 	if err != nil {
 		t.Fatalf("Fetch() after a response was closed: error = %v", err)
 	}
@@ -96,16 +94,12 @@ func TestFetchFreesHostSlotWhenContextEndsWaitingForConnection(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        1,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
-	first, err := f.Fetch(testContext(t), imageSourceOnPort(81))
+	first, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
@@ -115,7 +109,7 @@ func TestFetchFreesHostSlotWhenContextEndsWaitingForConnection(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(82))
+	_, err = f.Fetch(ctx, imageURLOnPort(82))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("second Fetch() error = %v, want context.DeadlineExceeded", err)
 	}
@@ -140,7 +134,7 @@ func TestFetchRemovesIdleHostSemaphores(t *testing.T) {
 
 	for i := range 100 {
 		wg.Go(func() {
-			res, err := f.Fetch(ctx, imageSourceOnPort(1+i%50))
+			res, err := f.Fetch(ctx, imageURLOnPort(1+i%50))
 			if err != nil {
 				t.Errorf("Fetch() error = %v", err)
 
@@ -169,22 +163,19 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        1,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 1
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 	f.connectionWaitTimeout = 100 * time.Millisecond
 
-	open, err := f.Fetch(testContext(t), imageSourceOnPort(81))
+	open, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
 
-	_, err = f.Fetch(testContext(t), imageSourceOnPort(82))
+	_, err = f.Fetch(testContext(t), imageURLOnPort(82))
 	if !errors.Is(err, ErrTooManyConnections) {
 		t.Fatalf("Fetch() from another host: error = %v, "+
 			"want ErrTooManyConnections", err)
@@ -193,7 +184,7 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(81))
+	_, err = f.Fetch(ctx, imageURLOnPort(81))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("Fetch() from the busy host: error = %v, "+
 			"want context.DeadlineExceeded", err)
@@ -205,7 +196,7 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 	ctx, cancel = context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(83))
+	_, err = f.Fetch(ctx, imageURLOnPort(83))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("Fetch() from a host with nothing open: error = %v, "+
 			"want context.DeadlineExceeded", err)
@@ -228,15 +219,15 @@ func TestFetchReleasesConnectionOnError(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name   string
-		source imagerequest.Source
-		want   error
+		name string
+		url  string
+		want error
 	}{
-		{"upstream answers 500", upstreamSource("/status/500"), ErrUpstreamError},
-		{"upstream sends HTML", upstreamSource("/html"), ErrInvalidContentType},
+		{"upstream answers 500", upstreamURL("/status/500"), ErrUpstreamError},
+		{"upstream sends HTML", upstreamURL("/html"), ErrInvalidContentType},
 		// 198.51.100.7 (TEST-NET-2) passes the SSRF checks, and the test
 		// dialer refuses every host but testPublicHost.
-		{"connecting fails", imageSourceOn("198.51.100.7"), errUnexpectedDial},
+		{"connecting fails", "http://198.51.100.7/image", errUnexpectedDial},
 	}
 
 	for _, tc := range cases {
@@ -245,17 +236,13 @@ func TestFetchReleasesConnectionOnError(t *testing.T) {
 
 			srv := startUpstream(t)
 
-			cfg := &Config{
-				Timeout:               30 * time.Second,
-				MaxResponseSize:       50 << 20,
-				MaxConnectionsPerHost: 20,
-				MaxConnections:        1,
-			}
+			cfg := DefaultConfig()
+			cfg.MaxConnections = 1
 
 			f, _ := newServerFetcher(t, srv, cfg)
 			f.connectionWaitTimeout = 100 * time.Millisecond
 
-			_, err := f.Fetch(testContext(t), tc.source)
+			_, err := f.Fetch(testContext(t), tc.url)
 			if !errors.Is(err, tc.want) {
 				t.Fatalf("Fetch() error = %v, want %v", err, tc.want)
 			}

internal/httpfetcher/mock.go

@@ -7,14 +7,14 @@ import (
 	"io/fs"
 	"net/http"
 	"strings"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
+// errEmptyURLPath is returned when a mock URL has no usable path.
+var errEmptyURLPath = errors.New("empty URL path")
+
 // MockFetcher implements Fetcher using an embedded filesystem.
 // Files are organized as: hostname/path/to/file.ext
-// The source with host example.com and path /images/photo.jpg maps to
-// example.com/images/photo.jpg; the source query is ignored.
+// URLs like https://example.com/images/photo.jpg map to example.com/images/photo.jpg.
 type MockFetcher struct {
 	fs fs.FS
 }
@@ -24,10 +24,8 @@ func NewMock(fsys fs.FS) *MockFetcher {
 	return &MockFetcher{fs: fsys}
 }
 
-// Fetch retrieves the source's content from the mock filesystem.
-func (m *MockFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
-) (*FetchResult, error) {
+// Fetch retrieves content from the mock filesystem.
+func (m *MockFetcher) Fetch(ctx context.Context, url string) (*FetchResult, error) {
 	// Check context cancellation
 	select {
 	case <-ctx.Done():
@@ -35,7 +33,11 @@ func (m *MockFetcher) Fetch(
 	default:
 	}
 
-	path := source.Host + source.Path
+	// Parse URL to get filesystem path
+	path, err := urlToFSPath(url)
+	if err != nil {
+		return nil, err
+	}
 
 	// Open the file
 	f, err := m.fs.Open(path)
@@ -66,11 +68,31 @@ func (m *MockFetcher) Fetch(
 	}, nil
 }
 
-// The content types the mock fetcher gives files in no format pixa reads.
-const (
-	contentTypeSVG         = "image/svg+xml"
-	contentTypeOctetStream = "application/octet-stream"
-)
+// urlToFSPath converts a URL to a filesystem path.
+// https://example.com/images/photo.jpg -> example.com/images/photo.jpg
+func urlToFSPath(rawURL string) (string, error) {
+	// Strip scheme
+	url := rawURL
+	if idx := strings.Index(url, "://"); idx != -1 {
+		url = url[idx+3:]
+	}
+
+	// Remove query string
+	if idx := strings.Index(url, "?"); idx != -1 {
+		url = url[:idx]
+	}
+
+	// Remove fragment
+	if idx := strings.Index(url, "#"); idx != -1 {
+		url = url[:idx]
+	}
+
+	if url == "" {
+		return "", errEmptyURLPath
+	}
+
+	return url, nil
+}
 
 // detectContentTypeFromPath returns the MIME type based on file extension.
 func detectContentTypeFromPath(path string) string {
@@ -78,17 +100,17 @@ func detectContentTypeFromPath(path string) string {
 
 	switch {
 	case strings.HasSuffix(path, ".jpg"), strings.HasSuffix(path, ".jpeg"):
-		return imagerequest.FormatJPEG.MIMEType()
+		return contentTypeJPEG
 	case strings.HasSuffix(path, ".png"):
-		return imagerequest.FormatPNG.MIMEType()
+		return contentTypePNG
 	case strings.HasSuffix(path, ".gif"):
-		return imagerequest.FormatGIF.MIMEType()
+		return contentTypeGIF
 	case strings.HasSuffix(path, ".webp"):
-		return imagerequest.FormatWebP.MIMEType()
+		return contentTypeWebP
 	case strings.HasSuffix(path, ".avif"):
-		return imagerequest.FormatAVIF.MIMEType()
+		return contentTypeAVIF
 	case strings.HasSuffix(path, ".jxl"):
-		return imagerequest.FormatJXL.MIMEType()
+		return contentTypeJXL
 	case strings.HasSuffix(path, ".svg"):
 		return contentTypeSVG
 	default:

internal/httpfetcher/request_id_internal_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestFetchSendsRequestID verifies that a fetch sends the ID of the request
@@ -26,7 +25,7 @@ func TestFetchSendsRequestID(t *testing.T) {
 		func(w http.ResponseWriter, r *http.Request) {
 			received <- r.Header.Get("X-Request-Id")
 
-			w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+			w.Header().Set("Content-Type", contentTypeJPEG)
 			_, _ = io.WriteString(w, imagePayload)
 		}))
 	t.Cleanup(srv.Close)
@@ -35,7 +34,7 @@ func TestFetchSendsRequestID(t *testing.T) {
 
 	ctx := context.WithValue(testContext(t), middleware.RequestIDKey, requestID)
 
-	res, err := f.Fetch(ctx, upstreamSource("/image"))
+	res, err := f.Fetch(ctx, upstreamURL("/image"))
 	if err != nil {
 		t.Fatalf("Fetch() error = %v", err)
 	}

internal/imageprocessor/avif_too_large_internal_test.go

@@ -39,41 +39,37 @@ func TestImageProcessor_RefusesAVIFAboveMaxPixels(t *testing.T) {
 	tests := []struct {
 		name          string
 		input         []byte
-		sourceFormat  imagerequest.Format
 		format        imagerequest.Format
 		width, height int
 		fit           imagerequest.Fit
 		refused       bool
 	}{
-		{"AVIF at the limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 4096, 4096, imagerequest.FitCover, false},
-		{"AVIF above the limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 4096, 4097, imagerequest.FitCover, true},
-		{"WebP above the AVIF limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatWebP, 4096, 4097, imagerequest.FitCover, false},
+		{"AVIF at the limit", cutOff, imagerequest.FormatAVIF,
+			4096, 4096, imagerequest.FitCover, false},
+		{"AVIF above the limit", cutOff, imagerequest.FormatAVIF,
+			4096, 4097, imagerequest.FitCover, true},
+		{"WebP above the AVIF limit", cutOff, imagerequest.FormatWebP,
+			4096, 4097, imagerequest.FitCover, false},
 		// FitInside does not enlarge, so the output stays 64x32
-		{"AVIF inside a larger size", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 8192, 8192, imagerequest.FitInside, false},
+		{"AVIF inside a larger size", cutOff, imagerequest.FormatAVIF,
+			8192, 8192, imagerequest.FitInside, false},
 		// FitOutside scales 64x32 by 128 to cover 8192x1: 8192x4096
-		{"AVIF outside a smaller size", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 8192, 1, imagerequest.FitOutside, true},
+		{"AVIF outside a smaller size", cutOff, imagerequest.FormatAVIF,
+			8192, 1, imagerequest.FitOutside, true},
 		// With no size, the output keeps the source's 4097x4096
 		{"AVIF of the source's size", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatAVIF, 0, 0, imagerequest.FitCover, true},
-		{"orig of an AVIF source", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatOriginal, 0, 0, imagerequest.FitCover, true},
-		{"JPEG of the source's size", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatJPEG, 0, 0, imagerequest.FitCover, false},
+			0, 0, imagerequest.FitCover, true},
+		{"orig of an AVIF source", largeAVIF, imagerequest.FormatOriginal,
+			0, 0, imagerequest.FitCover, true},
+		{"JPEG of the source's size", largeAVIF, imagerequest.FormatJPEG,
+			0, 0, imagerequest.FitCover, false},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(), bytes.NewReader(tt.input), tt.sourceFormat,
+			_, err := New(Params{}).Process(t.Context(), bytes.NewReader(tt.input),
 				&imagerequest.Transform{
 					Size:    imagerequest.Size{Width: tt.width, Height: tt.height},
 					Format:  tt.format,

internal/imageprocessor/computed_side_internal_test.go

@@ -38,11 +38,8 @@ func TestImageProcessor_RefusesComputedSideAboveMaximum(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    tt.size,
 					Format:  imagerequest.FormatJPEG,
@@ -107,11 +104,8 @@ func TestImageProcessor_ComputedSideIsAtLeastOne(t *testing.T) {
 
 				input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-				result, err := New(Params{
-					MaxInputBytes:           50 << 20,
-					MaxConcurrentProcessing: 1,
-				}).Process(t.Context(),
-					bytes.NewReader(input), imagerequest.FormatJPEG,
+				result, err := New(Params{}).Process(t.Context(),
+					bytes.NewReader(input),
 					&imagerequest.Transform{
 						Size:    tt.size,
 						Format:  imagerequest.FormatJPEG,

internal/imageprocessor/deadline_internal_test.go

@@ -7,8 +7,6 @@ import (
 	"io"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // readerAfterDeadline is a Process input whose first Read waits until done
@@ -86,10 +84,9 @@ func checkProcessStopsAtDeadline(
 ) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxConcurrentProcessing: 1})
 
-	result, err := proc.Process(ctx, input, imagerequest.FormatJPEG,
-		smallJPEGTransform())
+	result, err := proc.Process(ctx, input, smallJPEGTransform())
 	if result != nil {
 		t.Logf("Process() made a %dx%d image after its deadline passed",
 			result.Width, result.Height)

internal/imageprocessor/empty_format_internal_test.go

@@ -14,12 +14,9 @@ import (
 func TestImageProcessor_EmptyFormatRefused(t *testing.T) {
 	t.Parallel()
 
-	_, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
+	_, err := New(Params{}).Process(
 		t.Context(), bytes.NewReader(createTestJPEG(t, 20, 20)),
-		imagerequest.FormatJPEG, &imagerequest.Transform{},
+		&imagerequest.Transform{},
 	)
 	if !errors.Is(err, ErrUnsupportedOutputFormat) {
 		t.Errorf("Process() error = %v, want %v", err, ErrUnsupportedOutputFormat)

internal/imageprocessor/encoder_settings_internal_test.go

@@ -11,18 +11,14 @@ import (
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// processedSize runs input, an image in sourceFormat, through Process and
-// returns the output's size in bytes.
+// processedSize runs input through Process and returns the output's size in
+// bytes.
 func processedSize(
-	t *testing.T, input []byte, sourceFormat imagerequest.Format,
-	transform *imagerequest.Transform,
+	t *testing.T, input []byte, transform *imagerequest.Transform,
 ) int64 {
 	t.Helper()
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(t.Context(), bytes.NewReader(input), sourceFormat, transform)
+	result, err := New(Params{}).Process(t.Context(), bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -75,7 +71,7 @@ func TestImageProcessor_PNGIsCompressed(t *testing.T) {
 		}
 	}
 
-	size := processedSize(t, encodePNG(t, flat), imagerequest.FormatPNG,
+	size := processedSize(t, encodePNG(t, flat),
 		&imagerequest.Transform{Format: imagerequest.FormatPNG})
 
 	const rawBytes = width * height * 3
@@ -93,7 +89,7 @@ func TestImageProcessor_WebPAtEffort2(t *testing.T) {
 
 	input := createTestJPEG(t, 200, 150)
 
-	size := processedSize(t, input, imagerequest.FormatJPEG,
+	size := processedSize(t, input,
 		&imagerequest.Transform{Format: imagerequest.FormatWebP, Quality: 85})
 
 	want, _, err := decode(t, input).ExportWebp(&vips.WebpExportParams{
@@ -135,7 +131,7 @@ func TestImageProcessor_AVIFAtEffort1(t *testing.T) {
 
 	input := encodePNG(t, source)
 
-	size := processedSize(t, input, imagerequest.FormatPNG,
+	size := processedSize(t, input,
 		&imagerequest.Transform{Format: imagerequest.FormatAVIF, Quality: 85})
 
 	want, _, err := decode(t, input).ExportAvif(&vips.AvifExportParams{
@@ -162,7 +158,7 @@ func TestImageProcessor_JPEGXLAtEffort4(t *testing.T) {
 
 	input := createTestJPEG(t, 200, 150)
 
-	size := processedSize(t, input, imagerequest.FormatJPEG,
+	size := processedSize(t, input,
 		&imagerequest.Transform{Format: imagerequest.FormatJXL, Quality: 85})
 
 	params := vips.NewJxlExportParams()

internal/imageprocessor/fit_cover_internal_test.go

@@ -36,11 +36,8 @@ func TestImageProcessor_FitCoverServesThinSource(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    tt.size,
 					Format:  imagerequest.FormatJPEG,
@@ -109,11 +106,8 @@ func TestImageProcessor_FitCoverCropsTheCentre(t *testing.T) {
 
 			input := createBandsPNG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatPNG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    imagerequest.Size{Width: 50, Height: 50},
 					Format:  imagerequest.FormatPNG,
@@ -236,11 +230,8 @@ func TestImageProcessor_FitCoverKeepsProportions(t *testing.T) {
 
 			input := createSquarePNG(t, tt.side, tt.squareSide)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatPNG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    tt.size,
 					Format:  imagerequest.FormatPNG,

internal/imageprocessor/fit_outside_internal_test.go

@@ -41,11 +41,8 @@ func TestImageProcessor_RefusesFitOutsideAboveMaximum(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    tt.size,
 					Format:  imagerequest.FormatJPEG,
@@ -98,11 +95,8 @@ func TestImageProcessor_FitOutsideSideIsAtLeastOne(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
 				&imagerequest.Transform{
 					Size:    tt.size,
 					Format:  imagerequest.FormatJPEG,

internal/imageprocessor/imageprocessor.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/davidbyttow/govips/v2/vips"
+	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
@@ -70,12 +71,18 @@ type Result struct {
 	InputWidth int
 	// InputHeight is the original image height before processing.
 	InputHeight int
+	// InputFormat is the detected input format (e.g., "jpeg", "png").
+	InputFormat string
 }
 
 // MaxInputDimension is the maximum allowed width or height for input images.
 // Images larger than this are rejected to prevent DoS via decompression bombs.
 const MaxInputDimension = 8192
 
+// DefaultMaxInputBytes is the default maximum input size in bytes (50 MiB).
+// This matches the default upstream fetcher limit.
+const DefaultMaxInputBytes = 50 << 20
+
 // ErrInputTooLarge is returned when input image dimensions exceed MaxInputDimension.
 var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 
@@ -111,10 +118,9 @@ var ErrAVIFOutputTooLarge = errors.New("AVIF output has too many pixels")
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
 
 // ErrUnsupportedInputFormat is returned, before the input is decoded, when
-// libvips reads the input's first bytes as another format than its source
-// format, or as none. An SVG whose first bytes pass the first-bytes check for
-// AVIF is one example. A source format other than the six pixa reads is also
-// refused with it.
+// libvips reads the input's first bytes as another format than the source
+// formats, or as none: for example an SVG whose first bytes pass the
+// first-bytes check for AVIF.
 var ErrUnsupportedInputFormat = errors.New("unsupported input format")
 
 // ErrTooManyImages is returned when MaxConcurrentProcessing images are being
@@ -136,30 +142,42 @@ type ImageProcessor struct {
 	processingWaitTimeout time.Duration
 }
 
-// Params holds configuration for creating an ImageProcessor. Both fields
-// must be at least 1.
+// Params holds configuration for creating an ImageProcessor.
+// Zero values use sensible defaults (MaxInputBytes defaults to DefaultMaxInputBytes).
 type Params struct {
 	// MaxInputBytes is the maximum allowed input size in bytes.
+	// If <= 0, DefaultMaxInputBytes is used.
 	MaxInputBytes int64
 	// MaxConcurrentProcessing is the most images processed at once.
+	// If <= 0, config.DefaultMaxConcurrentProcessing() is used.
 	MaxConcurrentProcessing int
 }
 
 // New creates a new image processor with the given parameters.
+// A zero-value Params{} uses sensible defaults.
 func New(params Params) *ImageProcessor {
 	initVips()
 
+	maxInputBytes := params.MaxInputBytes
+	if maxInputBytes <= 0 {
+		maxInputBytes = DefaultMaxInputBytes
+	}
+
+	maxConcurrentProcessing := params.MaxConcurrentProcessing
+	if maxConcurrentProcessing <= 0 {
+		maxConcurrentProcessing = config.DefaultMaxConcurrentProcessing()
+	}
+
 	return &ImageProcessor{
-		maxInputBytes:         params.MaxInputBytes,
-		processingSemaphore:   make(chan struct{}, params.MaxConcurrentProcessing),
+		maxInputBytes:         maxInputBytes,
+		processingSemaphore:   make(chan struct{}, maxConcurrentProcessing),
 		processingWaitTimeout: ProcessingWaitTimeout,
 	}
 }
 
-// Process transforms the image read from input according to transform.
-// sourceFormat is the input's format, which magic detected from its first
-// bytes. When MaxConcurrentProcessing images are already being processed,
-// it waits up to ProcessingWaitTimeout for one to finish, then fails with
+// Process transforms an image according to transform. When
+// MaxConcurrentProcessing images are already being processed, it waits up
+// to ProcessingWaitTimeout for one to finish, then fails with
 // ErrTooManyImages. When ctx has ended once Process has a slot, or before it
 // encodes, it returns ctx's error and gives the slot back. govips gives pixa
 // no way to stop libvips once an encode has begun, so an encode keeps its
@@ -168,7 +186,6 @@ func New(params Params) *ImageProcessor {
 func (p *ImageProcessor) Process(
 	ctx context.Context,
 	input io.Reader,
-	sourceFormat imagerequest.Format,
 	transform *imagerequest.Transform,
 ) (*Result, error) {
 	release, err := p.acquireSlot(ctx)
@@ -183,9 +200,13 @@ func (p *ImageProcessor) Process(
 		return nil, err
 	}
 
-	// Input libvips would not load as sourceFormat is refused before it is
-	// decoded
-	err = checkInputFormat(data, sourceFormat)
+	// govips picks the libvips loader from the input's first bytes with
+	// DetermineImageType. Input whose first bytes it reads as no source
+	// format, such as SVG, which librsvg would render, is refused before
+	// libvips reads it.
+	inputFormat := p.detectFormat(vips.DetermineImageType(data))
+
+	sourceFormat, err := p.formatFromString(inputFormat)
 	if err != nil {
 		return nil, err
 	}
@@ -251,11 +272,12 @@ func (p *ImageProcessor) Process(
 	return &Result{
 		Content:       io.NopCloser(bytes.NewReader(output)),
 		ContentLength: int64(len(output)),
-		ContentType:   outputFormat.MIMEType(),
+		ContentType:   FormatToMIME(outputFormat),
 		Width:         img.Width(),
 		Height:        img.Height(),
 		InputWidth:    origWidth,
 		InputHeight:   origHeight,
+		InputFormat:   inputFormat,
 	}, nil
 }
 
@@ -290,6 +312,62 @@ func targetDimensions(
 	return width, height, nil
 }
 
+// MIME types for the supported image formats.
+const (
+	mimeJPEG = "image/jpeg"
+	mimePNG  = "image/png"
+	mimeGIF  = "image/gif"
+	mimeWebP = "image/webp"
+	mimeAVIF = "image/avif"
+	mimeJXL  = "image/jxl"
+)
+
+// SupportedInputFormats returns MIME types this processor can read.
+func (p *ImageProcessor) SupportedInputFormats() []string {
+	return []string{
+		mimeJPEG,
+		mimePNG,
+		mimeGIF,
+		mimeWebP,
+		mimeAVIF,
+		mimeJXL,
+	}
+}
+
+// SupportedOutputFormats returns formats this processor can write.
+func (p *ImageProcessor) SupportedOutputFormats() []imagerequest.Format {
+	return []imagerequest.Format{
+		imagerequest.FormatJPEG,
+		imagerequest.FormatPNG,
+		imagerequest.FormatGIF,
+		imagerequest.FormatWebP,
+		imagerequest.FormatAVIF,
+		imagerequest.FormatJXL,
+	}
+}
+
+// FormatToMIME converts a Format to its MIME type string.
+func FormatToMIME(format imagerequest.Format) string {
+	switch format {
+	case imagerequest.FormatJPEG:
+		return mimeJPEG
+	case imagerequest.FormatPNG:
+		return mimePNG
+	case imagerequest.FormatWebP:
+		return mimeWebP
+	case imagerequest.FormatGIF:
+		return mimeGIF
+	case imagerequest.FormatAVIF:
+		return mimeAVIF
+	case imagerequest.FormatJXL:
+		return mimeJXL
+	case imagerequest.FormatOriginal, imagerequest.FormatAuto:
+		return "application/octet-stream"
+	default:
+		return "application/octet-stream"
+	}
+}
+
 // WaitForProcessing waits until no image is being processed, or until ctx
 // ends, and returns how many images were still being processed then. It
 // waits by taking each slot in processingSemaphore as it frees up until it
@@ -358,49 +436,27 @@ func (p *ImageProcessor) readInput(input io.Reader) ([]byte, error) {
 	return data, nil
 }
 
-// checkInputFormat returns ErrUnsupportedInputFormat unless libvips would
-// load data with the loader of sourceFormat. govips picks the libvips loader
-// from the input's first bytes with DetermineImageType. It refuses an SVG
-// whose first bytes pass the first-bytes check for AVIF, which librsvg would
-// otherwise render.
-func checkInputFormat(data []byte, sourceFormat imagerequest.Format) error {
-	// A format with no loader, such as orig or auto, has the type govips also
-	// gives input it cannot read, which the check below would let through.
-	sourceType := vipsImageType(sourceFormat)
-	if sourceType == vips.ImageTypeUnknown {
-		return fmt.Errorf("%w: %q is not a source format",
-			ErrUnsupportedInputFormat, sourceFormat)
-	}
-
-	if vips.DetermineImageType(data) != sourceType {
-		return fmt.Errorf("%w: libvips does not read the input as %s",
-			ErrUnsupportedInputFormat, sourceFormat)
-	}
-
-	return nil
-}
-
-// vipsImageType returns the govips image type whose libvips loader reads
-// format. orig and auto stand for another format, so they have
-// vips.ImageTypeUnknown, which govips has no loader for.
-func vipsImageType(format imagerequest.Format) vips.ImageType {
-	switch format {
-	case imagerequest.FormatJPEG:
-		return vips.ImageTypeJPEG
-	case imagerequest.FormatPNG:
-		return vips.ImageTypePNG
-	case imagerequest.FormatGIF:
-		return vips.ImageTypeGIF
-	case imagerequest.FormatWebP:
-		return vips.ImageTypeWEBP
-	case imagerequest.FormatAVIF:
-		return vips.ImageTypeAVIF
-	case imagerequest.FormatJXL:
-		return vips.ImageTypeJXL
-	case imagerequest.FormatOriginal, imagerequest.FormatAuto:
-		return vips.ImageTypeUnknown
+// detectFormat returns the format string for a govips image type.
+func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
+	switch imageType {
+	case vips.ImageTypeJPEG:
+		return "jpeg"
+	case vips.ImageTypePNG:
+		return "png"
+	case vips.ImageTypeGIF:
+		return "gif"
+	case vips.ImageTypeWEBP:
+		return "webp"
+	case vips.ImageTypeAVIF, vips.ImageTypeHEIF:
+		return string(imagerequest.FormatAVIF)
+	case vips.ImageTypeJXL:
+		return string(imagerequest.FormatJXL)
+	case vips.ImageTypeUnknown, vips.ImageTypeMagick, vips.ImageTypePDF,
+		vips.ImageTypeSVG, vips.ImageTypeTIFF, vips.ImageTypeBMP,
+		vips.ImageTypeJP2K:
+		return "unknown"
 	default:
-		return vips.ImageTypeUnknown
+		return "unknown"
 	}
 }
 
@@ -754,3 +810,26 @@ func jxlDistance(quality int) float64 {
 
 	return 53.0/3000.0*q*q - 23.0/20.0*q + 25.0
 }
+
+// formatFromString converts a format string from detectFormat to Format. A
+// format detectFormat could not name is ErrUnsupportedInputFormat.
+func (p *ImageProcessor) formatFromString(
+	format string,
+) (imagerequest.Format, error) {
+	switch format {
+	case "jpeg":
+		return imagerequest.FormatJPEG, nil
+	case "png":
+		return imagerequest.FormatPNG, nil
+	case "gif":
+		return imagerequest.FormatGIF, nil
+	case "webp":
+		return imagerequest.FormatWebP, nil
+	case string(imagerequest.FormatAVIF):
+		return imagerequest.FormatAVIF, nil
+	case string(imagerequest.FormatJXL):
+		return imagerequest.FormatJXL, nil
+	default:
+		return "", fmt.Errorf("%w: %s", ErrUnsupportedInputFormat, format)
+	}
+}

internal/imageprocessor/imageprocessor_internal_test.go

@@ -94,23 +94,23 @@ func isAVIF(data []byte) bool {
 // detectMIME is a minimal magic-byte detector for test assertions.
 func detectMIME(data []byte) string {
 	if len(data) >= 3 && data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF {
-		return imagerequest.FormatJPEG.MIMEType()
+		return mimeJPEG
 	}
 
 	if len(data) >= 8 && string(data[:8]) == "\x89PNG\r\n\x1a\n" {
-		return imagerequest.FormatPNG.MIMEType()
+		return mimePNG
 	}
 
 	if len(data) >= 4 && string(data[:4]) == "GIF8" {
-		return imagerequest.FormatGIF.MIMEType()
+		return mimeGIF
 	}
 
 	if len(data) >= 12 && string(data[:4]) == "RIFF" && string(data[8:12]) == "WEBP" {
-		return imagerequest.FormatWebP.MIMEType()
+		return mimeWebP
 	}
 
 	if isAVIF(data) {
-		return imagerequest.FormatAVIF.MIMEType()
+		return mimeAVIF
 	}
 
 	return ""
@@ -119,7 +119,7 @@ func detectMIME(data []byte) string {
 func TestImageProcessor_ResizeJPEG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 800, 600)
@@ -131,8 +131,7 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -158,7 +157,7 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatJPEG.MIMEType() {
+	if mime != mimeJPEG {
 		t.Errorf("Output format = %v, want image/jpeg", mime)
 	}
 }
@@ -166,7 +165,7 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 func TestImageProcessor_ConvertToPNG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 200, 150)
@@ -177,8 +176,7 @@ func TestImageProcessor_ConvertToPNG(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -191,7 +189,7 @@ func TestImageProcessor_ConvertToPNG(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatPNG.MIMEType() {
+	if mime != mimePNG {
 		t.Errorf("Output format = %v, want image/png", mime)
 	}
 }
@@ -203,7 +201,7 @@ func processAndCheckSize(
 ) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, inputW, inputH)
@@ -215,8 +213,7 @@ func processAndCheckSize(
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -242,7 +239,7 @@ func TestImageProcessor_OriginalSize(t *testing.T) {
 func TestImageProcessor_FitContain(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// 800x400 image (2:1 aspect) into 400x400 box with contain
@@ -256,8 +253,7 @@ func TestImageProcessor_FitContain(t *testing.T) {
 		FitMode: imagerequest.FitContain,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -289,7 +285,7 @@ func TestImageProcessor_ProportionalScale_HeightOnly(t *testing.T) {
 func TestImageProcessor_ProcessPNG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestPNG(t, 400, 300)
@@ -300,8 +296,7 @@ func TestImageProcessor_ProcessPNG(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatPNG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -317,6 +312,22 @@ func TestImageProcessor_ProcessPNG(t *testing.T) {
 	}
 }
 
+func TestImageProcessor_SupportedFormats(t *testing.T) {
+	t.Parallel()
+
+	proc := New(Params{})
+
+	inputFormats := proc.SupportedInputFormats()
+	if len(inputFormats) == 0 {
+		t.Error("SupportedInputFormats() returned empty slice")
+	}
+
+	outputFormats := proc.SupportedOutputFormats()
+	if len(outputFormats) == 0 {
+		t.Error("SupportedOutputFormats() returned empty slice")
+	}
+}
+
 func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 	t.Parallel()
 
@@ -335,7 +346,7 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+			proc := New(Params{})
 			ctx := context.Background()
 			input := createTestJPEG(t, tt.width, tt.height)
 
@@ -346,8 +357,7 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 				FitMode: imagerequest.FitCover,
 			}
 
-			_, err := proc.Process(ctx, bytes.NewReader(input),
-				imagerequest.FormatJPEG, transform)
+			_, err := proc.Process(ctx, bytes.NewReader(input), transform)
 			if err == nil {
 				t.Error("Process() should reject oversized input images")
 			}
@@ -362,7 +372,7 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// Create an image at exactly MaxInputDimension - should be accepted
@@ -375,8 +385,7 @@ func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf(
 			"Process() should accept images at MaxInputDimension, got error: %v",
@@ -394,7 +403,7 @@ func encodeAndCheck(
 ) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 200, 150)
@@ -406,8 +415,7 @@ func encodeAndCheck(
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil", err)
 	}
@@ -438,13 +446,13 @@ func encodeAndCheck(
 func TestImageProcessor_EncodeWebP(t *testing.T) {
 	t.Parallel()
 
-	encodeAndCheck(t, imagerequest.FormatWebP, 80, imagerequest.FormatWebP.MIMEType())
+	encodeAndCheck(t, imagerequest.FormatWebP, 80, mimeWebP)
 }
 
 func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// Load test AVIF file
@@ -461,8 +469,7 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatAVIF, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil (AVIF decoding should work)", err)
 	}
@@ -476,7 +483,7 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatJPEG.MIMEType() {
+	if mime != mimeJPEG {
 		t.Errorf("Output format = %v, want image/jpeg", mime)
 	}
 }
@@ -487,7 +494,7 @@ func TestImageProcessor_RejectsOversizedInputData(t *testing.T) {
 	// Create a processor with a very small byte limit
 	const limit = 1024
 
-	proc := New(Params{MaxInputBytes: limit, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxInputBytes: limit})
 	ctx := context.Background()
 
 	// Create a valid JPEG that exceeds the byte limit
@@ -503,8 +510,7 @@ func TestImageProcessor_RejectsOversizedInputData(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	_, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	_, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err == nil {
 		t.Fatal("Process() should reject input exceeding maxInputBytes")
 	}
@@ -521,7 +527,7 @@ func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
 	input := createTestJPEG(t, 10, 10)
 	limit := int64(len(input)) * 10 // 10× headroom
 
-	proc := New(Params{MaxInputBytes: limit, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxInputBytes: limit})
 	ctx := context.Background()
 
 	transform := &imagerequest.Transform{
@@ -531,8 +537,7 @@ func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
 		FitMode: imagerequest.FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), transform)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil", err)
 	}
@@ -540,25 +545,37 @@ func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
 	defer func() { _ = result.Content.Close() }()
 }
 
+func TestImageProcessor_DefaultMaxInputBytes(t *testing.T) {
+	t.Parallel()
+
+	// Passing 0 should use the default
+	proc := New(Params{})
+	if proc.maxInputBytes != DefaultMaxInputBytes {
+		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+	}
+
+	// Passing negative should also use the default
+	proc = New(Params{MaxInputBytes: -1})
+	if proc.maxInputBytes != DefaultMaxInputBytes {
+		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+	}
+}
+
 func TestImageProcessor_EncodeAVIF(t *testing.T) {
 	t.Parallel()
 
-	encodeAndCheck(t, imagerequest.FormatAVIF, 85, imagerequest.FormatAVIF.MIMEType())
+	encodeAndCheck(t, imagerequest.FormatAVIF, 85, mimeAVIF)
 }
 
-// processAndDecode runs input, a JPEG, through Process and decodes the output
-// with vips, so a test can inspect the image a client would receive.
+// processAndDecode runs input through Process and decodes the output with
+// vips, so a test can inspect the image a client would receive.
 func processAndDecode(
 	t *testing.T, input []byte, transform *imagerequest.Transform,
 ) *vips.ImageRef {
 	t.Helper()
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		context.Background(), bytes.NewReader(input), imagerequest.FormatJPEG,
-		transform,
+	result, err := New(Params{}).Process(
+		context.Background(), bytes.NewReader(input), transform,
 	)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)

internal/imageprocessor/jpegxl_output_internal_test.go

@@ -21,12 +21,8 @@ func TestImageProcessor_EncodeJPEGXL(t *testing.T) {
 		Format: imagerequest.FormatJXL,
 	}
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		t.Context(), bytes.NewReader(createTestJPEG(t, 200, 150)),
-		imagerequest.FormatJPEG, transform,
+	result, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(createTestJPEG(t, 200, 150)), transform,
 	)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
@@ -68,11 +64,8 @@ func TestImageProcessor_JPEGXLQuality(t *testing.T) {
 	outputBytes := make(map[int]int64)
 
 	for _, quality := range []int{30, 90} {
-		result, err := New(Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 1,
-		}).Process(t.Context(),
-			bytes.NewReader(input), imagerequest.FormatJPEG,
+		result, err := New(Params{}).Process(t.Context(),
+			bytes.NewReader(input),
 			&imagerequest.Transform{Format: imagerequest.FormatJXL, Quality: quality})
 		if err != nil {
 			t.Fatalf("Process() at quality %d error = %v", quality, err)

internal/imageprocessor/max_concurrent_processing_internal_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -93,8 +94,7 @@ func processInBackground(
 	proc *ImageProcessor, reader *gatedReader, results chan<- error,
 ) {
 	go func() {
-		result, err := proc.Process(context.Background(), reader,
-			imagerequest.FormatJPEG, smallJPEGTransform())
+		result, err := proc.Process(context.Background(), reader, smallJPEGTransform())
 		if err == nil {
 			_ = result.Content.Close()
 		}
@@ -117,15 +117,47 @@ func waitForEntries(t *testing.T, entered <-chan struct{}, count int) {
 	}
 }
 
-func TestNewMakesMaxConcurrentProcessingSlots(t *testing.T) {
+func TestNewDefaultsMaxConcurrentProcessingToHalfTheCPUs(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 3})
+	for _, limit := range []int{0, -1} {
+		proc := New(Params{MaxConcurrentProcessing: limit})
+		if got := cap(proc.processingSemaphore); got != max(runtime.GOMAXPROCS(0)/2, 1) {
+			t.Errorf("MaxConcurrentProcessing %d: %d slots, want %d, half the CPUs",
+				limit, got, max(runtime.GOMAXPROCS(0)/2, 1))
+		}
+	}
+
+	proc := New(Params{MaxConcurrentProcessing: 3})
 	if got := cap(proc.processingSemaphore); got != 3 {
 		t.Errorf("MaxConcurrentProcessing 3: %d slots, want 3", got)
 	}
 }
 
+// TestNewDefaultIsHalfTheCPUsAndAtLeastOne checks that New, given no
+// MaxConcurrentProcessing, makes one slot for every two CPUs Go uses,
+// rounded down, and one slot when Go uses one CPU.
+//
+//nolint:paralleltest // it sets GOMAXPROCS, which other tests read
+func TestNewDefaultIsHalfTheCPUsAndAtLeastOne(t *testing.T) {
+	cpusBefore := runtime.GOMAXPROCS(0)
+
+	t.Cleanup(func() { runtime.GOMAXPROCS(cpusBefore) })
+
+	for _, tc := range []struct{ cpus, want int }{
+		{1, 1}, {2, 1}, {3, 1}, {8, 4},
+	} {
+		runtime.GOMAXPROCS(tc.cpus)
+
+		got := cap(New(Params{}).processingSemaphore)
+		t.Logf("GOMAXPROCS %d: %d slots", tc.cpus, got)
+
+		if got != tc.want {
+			t.Errorf("GOMAXPROCS %d: %d slots, want %d", tc.cpus, got, tc.want)
+		}
+	}
+}
+
 // TestProcessNeverExceedsMaxConcurrentProcessing starts more Process calls
 // than MaxConcurrentProcessing allows and holds the first ones inside
 // Process until the test lets them go. No more than the limit may be
@@ -139,7 +171,7 @@ func TestProcessNeverExceedsMaxConcurrentProcessing(t *testing.T) {
 		calls = 6
 	)
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: limit})
+	proc := New(Params{MaxConcurrentProcessing: limit})
 	input := createTestJPEG(t, 50, 50)
 
 	counter := &readingCounter{}
@@ -186,7 +218,7 @@ func TestProcessNeverExceedsMaxConcurrentProcessing(t *testing.T) {
 func TestProcessWaitsThenFailsWhenNoSlotFrees(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxConcurrentProcessing: 1})
 	proc.processingWaitTimeout = 100 * time.Millisecond
 
 	input := createTestJPEG(t, 10, 10)
@@ -207,7 +239,7 @@ func TestProcessWaitsThenFailsWhenNoSlotFrees(t *testing.T) {
 	start := time.Now()
 
 	_, err := proc.Process(context.Background(), bytes.NewReader(input),
-		imagerequest.FormatJPEG, smallJPEGTransform())
+		smallJPEGTransform())
 	if !errors.Is(err, ErrTooManyImages) {
 		t.Fatalf("Process() error = %v, want ErrTooManyImages", err)
 	}
@@ -275,8 +307,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 			proc := New(Params{MaxInputBytes: 4096, MaxConcurrentProcessing: 1})
 			proc.processingWaitTimeout = 100 * time.Millisecond
 
-			_, err := proc.Process(context.Background(), tc.input,
-				imagerequest.FormatJPEG, tc.transform)
+			_, err := proc.Process(context.Background(), tc.input, tc.transform)
 			if err == nil || (tc.want != nil && !errors.Is(err, tc.want)) {
 				t.Fatalf("Process() error = %v, want %v", err, tc.want)
 			}
@@ -286,7 +317,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 			}
 
 			result, err := proc.Process(context.Background(), bytes.NewReader(valid),
-				imagerequest.FormatJPEG, smallJPEGTransform())
+				smallJPEGTransform())
 			if err != nil {
 				t.Fatalf("Process() after the error = %v, want nil", err)
 			}
@@ -303,7 +334,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 func TestWaitForProcessing(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 2})
+	proc := New(Params{MaxConcurrentProcessing: 2})
 
 	gate := make(chan struct{})
 	entered := make(chan struct{}, 1)

internal/imageprocessor/orig_format_internal_test.go

@@ -10,9 +10,8 @@ import (
 )
 
 // TestImageProcessor_OrigOfUnnamedFormatRefused verifies that orig of a TIFF
-// input is refused with ErrUnsupportedInputFormat before it is decoded, and
-// not saved as JPEG. TIFF is not a source format, and the test passes the
-// input to Process as a JPEG.
+// input, which is not a source format, is refused with
+// ErrUnsupportedInputFormat before it is decoded, and not saved as JPEG.
 func TestImageProcessor_OrigOfUnnamedFormatRefused(t *testing.T) {
 	t.Parallel()
 
@@ -28,11 +27,8 @@ func TestImageProcessor_OrigOfUnnamedFormatRefused(t *testing.T) {
 		t.Fatalf("failed to save test TIFF: %v", err)
 	}
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		t.Context(), bytes.NewReader(tiff), imagerequest.FormatJPEG,
+	result, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(tiff),
 		&imagerequest.Transform{Format: imagerequest.FormatOriginal},
 	)
 	if result != nil {

internal/imageprocessor/source_formats_internal_test.go

@@ -2,7 +2,6 @@ package imageprocessor
 
 import (
 	"bytes"
-	"errors"
 	"io"
 	"testing"
 
@@ -15,14 +14,14 @@ import (
 func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 
 	for _, format := range []imagerequest.Format{
 		imagerequest.FormatJPEG, imagerequest.FormatPNG, imagerequest.FormatGIF,
 		imagerequest.FormatWebP, imagerequest.FormatAVIF, imagerequest.FormatJXL,
 	} {
 		saved, err := proc.Process(t.Context(),
-			bytes.NewReader(createTestPNG(t, 20, 20)), imagerequest.FormatPNG,
+			bytes.NewReader(createTestPNG(t, 20, 20)),
 			&imagerequest.Transform{Format: format})
 		if err != nil {
 			t.Fatalf("saving the test image as %s: %v", format, err)
@@ -33,7 +32,7 @@ func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 			t.Fatalf("reading the %s image: %v", format, err)
 		}
 
-		result, err := proc.Process(t.Context(), bytes.NewReader(source), format,
+		result, err := proc.Process(t.Context(), bytes.NewReader(source),
 			&imagerequest.Transform{Format: imagerequest.FormatOriginal})
 		if err != nil {
 			t.Errorf("orig of the %s image: %v", format, err)
@@ -43,33 +42,9 @@ func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 
 		t.Logf("orig of the %s image: %s", format, result.ContentType)
 
-		if result.ContentType != format.MIMEType() {
+		if result.ContentType != FormatToMIME(format) {
 			t.Errorf("orig of the %s image is %s, want %s",
-				format, result.ContentType, format.MIMEType())
-		}
-	}
-}
-
-// TestImageProcessor_NotASourceFormatRefused verifies that a source format
-// other than the six, such as orig, auto or none, is refused with
-// ErrUnsupportedInputFormat. The input is text, which libvips reads as no
-// format.
-func TestImageProcessor_NotASourceFormatRefused(t *testing.T) {
-	t.Parallel()
-
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
-
-	for _, sourceFormat := range []imagerequest.Format{
-		imagerequest.FormatOriginal, imagerequest.FormatAuto, "",
-	} {
-		result, err := proc.Process(t.Context(),
-			bytes.NewReader([]byte("this is text, not an image")), sourceFormat,
-			&imagerequest.Transform{Format: imagerequest.FormatJPEG})
-		t.Logf("source format %q: error = %v", sourceFormat, err)
-
-		if result != nil || !errors.Is(err, ErrUnsupportedInputFormat) {
-			t.Errorf("Process() with source format %q = %v, error %v; want %v",
-				sourceFormat, result, err, ErrUnsupportedInputFormat)
+				format, result.ContentType, FormatToMIME(format))
 		}
 	}
 }

internal/imageproxy/cache_hit_internal_test.go

@@ -1,100 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"os"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// TestProxy_Get_MakesAgainVariantOfNoOutputFormat replaces a cached
-// variant's file with text, and checks that the next request is a miss
-// answered with the variant made again, and the one after a hit.
-func TestProxy_Get_MakesAgainVariantOfNoOutputFormat(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	want, _ := getImage(t, svc, req)
-
-	path := variantFilePath(svc, imagerequest.CacheKey(req))
-
-	err := os.WriteFile(path, []byte("this is text, not an image"),
-		imgcache.StorageFilePerm)
-	if err != nil {
-		t.Fatalf("replacing the variant file: %v", err)
-	}
-
-	got, status := getImage(t, svc, req)
-	t.Logf("after the replacement: %d bytes, %s", len(got), status)
-
-	if status != CacheMiss || !bytes.Equal(got, want) {
-		t.Errorf("after the replacement: Get() = %d bytes, %s; want the %d bytes "+
-			"made again, %s", len(got), status, len(want), CacheMiss)
-	}
-
-	got, status = getImage(t, svc, req)
-
-	if status != CacheHit || !bytes.Equal(got, want) {
-		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
-			len(got), status, len(want), CacheHit)
-	}
-}
-
-// TestProxy_Get_HitWaitsForNoDatabaseWrite holds the database's one
-// connection while a cached variant is requested. The hit must be answered
-// while the connection is still held, and its access time must reach the
-// database once it is free.
-func TestProxy_Get_HitWaitsForNoDatabaseWrite(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-	key := imagerequest.CacheKey(req)
-
-	getImage(t, svc, req)
-
-	// Each connection to an in-memory SQLite database opens a new, empty one,
-	// so the goroutine that writes the access times must share the
-	// connection that holds the schema.
-	svc.db.SetMaxOpenConns(1)
-	svc.cache.StartPendingAccessTimeWrites()
-
-	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
-
-	anHourAgo := time.Now().Add(-time.Hour)
-	setVariantLastAccessed(t, svc.db, key, anHourAgo)
-
-	releaseDatabase := holdDatabase(t, svc.db)
-	defer releaseDatabase()
-
-	results := startGet(t.Context(), svc, req)
-
-	select {
-	case got := <-results:
-		if got.err != nil {
-			t.Fatalf("Get() of the cached variant error = %v", got.err)
-		}
-	case <-time.After(pendingAccessTimesWait):
-		t.Fatal("the cache hit waited for the database")
-	}
-
-	releaseDatabase()
-
-	deadline := time.Now().Add(pendingAccessTimesWait)
-
-	for countRows(t, svc.db, `
-		SELECT COUNT(*) FROM variant_content
-		WHERE cache_key = ? AND last_accessed_at > ?
-	`, string(key), anHourAgo.UTC().Format(sqliteTimestampFormat)) == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the hit's access time was not written")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-}

internal/imageproxy/counters_internal_test.go

@@ -1,77 +0,0 @@
-package imageproxy
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/testutil"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// TestNew_RegistersItsCountersOnItsRegistry checks that New registers the
-// proxy's counters on the registry it is given, under the names README.md
-// gives them. The cache registers its own counters on another registry.
-func TestNew_RegistersItsCountersOnItsRegistry(t *testing.T) {
-	t.Parallel()
-
-	cache, err := imgcache.NewCache(setupTestDB(t),
-		imgcache.Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
-		prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	registry := prometheus.NewRegistry()
-
-	_, err = New(&Config{Cache: cache}, registry)
-	if err != nil {
-		t.Fatalf("New() error = %v", err)
-	}
-
-	names := []string{
-		"pixa_upstream_fetches_total",
-		"pixa_upstream_fetch_bytes_total",
-		"pixa_transforms_total",
-	}
-
-	count, err := testutil.GatherAndCount(registry, names...)
-	if err != nil {
-		t.Fatalf("testutil.GatherAndCount() error = %v", err)
-	}
-
-	if count != len(names) {
-		t.Errorf("%d of the counters %v are on the registry, want %d",
-			count, names, len(names))
-	}
-}
-
-// TestNew_FailsWhenItsCountersCannotBeRegistered makes a second proxy on
-// the registry of a first. Its counters have the same names, so the
-// registry refuses them, and New must return that error.
-func TestNew_FailsWhenItsCountersCannotBeRegistered(t *testing.T) {
-	t.Parallel()
-
-	cache, err := imgcache.NewCache(setupTestDB(t),
-		imgcache.Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
-		prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	registry := prometheus.NewRegistry()
-
-	_, err = New(&Config{Cache: cache}, registry)
-	if err != nil {
-		t.Fatalf("New() of the first proxy error = %v", err)
-	}
-
-	_, err = New(&Config{Cache: cache}, registry)
-	t.Logf("New() of the second proxy error = %v", err)
-
-	var alreadyRegistered prometheus.AlreadyRegisteredError
-	if !errors.As(err, &alreadyRegistered) {
-		t.Errorf("New() of the second proxy error = %v, want %T",
-			err, alreadyRegistered)
-	}
-}

internal/imageproxy/negative_cache_internal_test.go

@@ -1,96 +0,0 @@
-package imageproxy
-
-import (
-	"errors"
-	"os"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// TestProxy_Get_ServesCachedVariantOfNegativeCachedURL caches a variant of
-// the test photo, then keeps a failed fetch of the photo's URL in the negative
-// cache, as a failed fetch for another variant does once the source has been
-// evicted. The cached variant is still served, and a variant not in the cache
-// is made from the cached source. Once the source is evicted, a variant not in
-// the cache needs a fetch and is refused.
-func TestProxy_Get_ServesCachedVariantOfNegativeCachedURL(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	resp, err := svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
-	if err != nil {
-		t.Fatalf("Get() first request error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	err = svc.cache.PutFailure(t.Context(),
-		photoVariant(fixtures, 85, imagerequest.FitCover).Source)
-	if err != nil {
-		t.Fatalf("PutFailure() error = %v", err)
-	}
-
-	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
-	if err != nil {
-		t.Fatalf("Get() of the cached variant error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	if resp.CacheStatus != CacheHit {
-		t.Errorf("cached variant CacheStatus = %q, want %q",
-			resp.CacheStatus, CacheHit)
-	}
-
-	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 40, imagerequest.FitCover))
-	t.Logf("Get() of a variant made from the cached source: error = %v", err)
-
-	if err != nil {
-		t.Fatalf("Get() of a variant made from the cached source error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	source := photoVariant(fixtures, 85, imagerequest.FitCover).Source
-
-	reader, _, _, err := svc.cache.Source(t.Context(), source)
-	if err != nil {
-		t.Fatalf("Source() error = %v, want the cached source", err)
-	}
-
-	_ = reader.Close()
-
-	// Evicts the source as the cache's eviction does: its row, then its file
-	_, err = svc.db.ExecContext(t.Context(),
-		`DELETE FROM source_content WHERE source_key = ?`, string(source.Key()))
-	if err != nil {
-		t.Fatalf("deleting the source's row: %v", err)
-	}
-
-	err = os.Remove(sourceFilePath(svc, source.Key()))
-	if err != nil {
-		t.Fatalf("removing the source's file: %v", err)
-	}
-
-	_, err = svc.Get(t.Context(), photoVariant(fixtures, 60, imagerequest.FitCover))
-	t.Logf("Get() of a variant whose source was evicted: error = %v", err)
-
-	if !errors.Is(err, ErrNegativeCached) {
-		t.Errorf("Get() of a variant whose source was evicted error = %v, want %v",
-			err, ErrNegativeCached)
-	}
-}
-
-func TestProxy_Get_ReturnsErrorForNegativeCachedURL(t *testing.T) {
-	t.Parallel()
-
-	// This test verifies that Proxy.Get() checks the negative cache
-	// We can't easily test the full pipeline without vips, but we can
-	// verify the error type
-	err := ErrNegativeCached
-	if !errors.Is(err, ErrNegativeCached) {
-		t.Error("ErrNegativeCached should be identifiable with errors.Is")
-	}
-}

internal/imageproxy/partial_cache_files_internal_test.go

@@ -1,184 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// getImage calls Get for req and returns the image it answered with and
-// its cache status.
-func getImage(
-	t *testing.T, svc *testProxy, req *imagerequest.Request,
-) ([]byte, CacheStatus) {
-	t.Helper()
-
-	resp, err := svc.Get(t.Context(), req)
-	if err != nil {
-		t.Fatalf("Get() of quality %d error = %v", req.Transform.Quality, err)
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
-	body, err := io.ReadAll(resp.Content)
-	if err != nil {
-		t.Fatalf("reading the image of quality %d: %v", req.Transform.Quality, err)
-	}
-
-	return body, resp.CacheStatus
-}
-
-// fileSize returns the size of the file at path.
-func fileSize(t *testing.T, path string) int64 {
-	t.Helper()
-
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("stat %s: %v", path, err)
-	}
-
-	return info.Size()
-}
-
-// cachedSourcePath returns the path of the cached source file req uses.
-func cachedSourcePath(
-	t *testing.T, svc *testProxy, req *imagerequest.Request,
-) string {
-	t.Helper()
-
-	reader, _, _, err := svc.cache.Source(t.Context(), req.Source)
-	if err != nil {
-		t.Fatalf("Source() error = %v; want the cached source", err)
-	}
-
-	_ = reader.Close()
-
-	return sourceFilePath(svc, req.Source.Key())
-}
-
-// TestProxy_Get_FetchesAgainForRemovedCachedSource removes the cached
-// source's row and file, as the reconciliation pass does when the file is
-// empty or cut short. internal/imgcache tests that the pass does so. The
-// test then asks for two new sizes of the source. The first must fetch it
-// again and cache it whole, so the second is made from the cache without a
-// third fetch.
-func TestProxy_Get_FetchesAgainForRemovedCachedSource(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	source := photoVariant(fixtures, 85, imagerequest.FitCover).Source
-	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-	wholeSize := fileSize(t, path)
-
-	// Removes the source as the reconciliation pass does: its row, then its file
-	_, err := svc.db.ExecContext(t.Context(),
-		`DELETE FROM source_content WHERE source_key = ?`, string(source.Key()))
-	if err != nil {
-		t.Fatalf("deleting the source's row: %v", err)
-	}
-
-	err = os.Remove(path)
-	if err != nil {
-		t.Fatalf("removing the source's file: %v", err)
-	}
-
-	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-	getImage(t, svc, photoVariant(fixtures, 30, imagerequest.FitCover))
-
-	fetches := readCounters(t, svc).upstreamFetchCount
-	t.Logf("upstream fetches = %d", fetches)
-
-	if fetches != 2 {
-		t.Errorf("upstream fetches = %d, want 2", fetches)
-	}
-
-	size := fileSize(t, path)
-	if size != wholeSize {
-		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
-	}
-}
-
-// TestProxy_Get_FetchesAgainSourceOfNoSourceFormat replaces the cached
-// source's file with text. The next request for a new size of the source
-// must fetch it again and cache it whole.
-func TestProxy_Get_FetchesAgainSourceOfNoSourceFormat(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-	wholeSize := fileSize(t, path)
-
-	err := os.WriteFile(path, []byte("this is text, not an image"),
-		imgcache.StorageFilePerm)
-	if err != nil {
-		t.Fatalf("replacing the source's file: %v", err)
-	}
-
-	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-
-	fetches := readCounters(t, svc).upstreamFetchCount
-	t.Logf("upstream fetches = %d", fetches)
-
-	if fetches != 2 {
-		t.Errorf("upstream fetches = %d, want 2", fetches)
-	}
-
-	size := fileSize(t, path)
-	if size != wholeSize {
-		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
-	}
-}
-
-// TestProxy_Get_ConvertsAgainForRemovedCachedVariant caches a variant of
-// the photo and removes its row and file, as the reconciliation pass does
-// when the file is empty or cut short. internal/imgcache tests that the
-// pass does so. The test then checks that Get converts the image again, and
-// that the next Get serves the whole variant from the cache.
-func TestProxy_Get_ConvertsAgainForRemovedCachedVariant(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	want, _ := getImage(t, svc, req)
-
-	key := imagerequest.CacheKey(req)
-
-	// Removes the variant as the reconciliation pass does: its row, then its file
-	_, err := svc.db.ExecContext(t.Context(),
-		`DELETE FROM variant_content WHERE cache_key = ?`, string(key))
-	if err != nil {
-		t.Fatalf("deleting the variant's row: %v", err)
-	}
-
-	err = os.Remove(variantFilePath(svc, key))
-	if err != nil {
-		t.Fatalf("removing the variant's file: %v", err)
-	}
-
-	got, status := getImage(t, svc, req)
-	t.Logf("after the removal: %d bytes, %s", len(got), status)
-
-	if status != CacheMiss || !bytes.Equal(got, want) {
-		t.Errorf("after the removal: Get() = %d bytes, %s; want the %d bytes "+
-			"converted again, %s", len(got), status, len(want), CacheMiss)
-	}
-
-	got, status = getImage(t, svc, req)
-	t.Logf("next request: %d bytes, %s", len(got), status)
-
-	if status != CacheHit || !bytes.Equal(got, want) {
-		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
-			len(got), status, len(want), CacheHit)
-	}
-}

internal/imageproxy/pendingaccesstimes_internal_test.go

@@ -1,78 +0,0 @@
-package imageproxy
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// pendingAccessTimesWait is how long a test waits for the database's
-// connection, for a cache hit to be answered, for an access time to reach
-// the database, or for a request to return past its deadline.
-const pendingAccessTimesWait = 5 * time.Second
-
-// holdDatabase takes the one connection of db, so that every other query
-// waits for it, and returns the func that frees it.
-func holdDatabase(t *testing.T, db *sql.DB) func() {
-	t.Helper()
-
-	ctx, cancel := context.WithTimeout(t.Context(), pendingAccessTimesWait)
-	defer cancel()
-
-	conn, err := db.Conn(ctx)
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
-
-	return func() { _ = conn.Close() }
-}
-
-// TestProxy_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy holds the
-// database's one connection while a request whose fetch is held reaches its
-// deadline. The request must return with the deadline's error while the
-// connection is still held, as it waits for no database write past its
-// deadline.
-func TestProxy_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
-
-	svc.cache.StartPendingAccessTimeWrites()
-	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
-
-	// Room for the request to reach its fetch on a busy host
-	const timeout = 2 * time.Second
-
-	ctx, cancel := context.WithTimeout(t.Context(), timeout)
-	defer cancel()
-
-	deadline, _ := ctx.Deadline()
-
-	results := startGet(ctx, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	// The request has made its database reads by the time it fetches.
-	select {
-	case <-fetcher.started:
-	case <-time.After(timeout):
-		t.Fatal("request did not reach its fetch by its deadline")
-	}
-
-	releaseDatabase := holdDatabase(t, svc.db)
-	defer releaseDatabase()
-
-	select {
-	case got := <-results:
-		t.Logf("Get() returned %v after its deadline, error = %v",
-			time.Since(deadline), got.err)
-
-		if !errors.Is(got.err, context.DeadlineExceeded) {
-			t.Errorf("Get() error = %v, want %v", got.err, context.DeadlineExceeded)
-		}
-	case <-time.After(time.Until(deadline) + pendingAccessTimesWait):
-		t.Fatal("request did not return while the database was busy")
-	}
-}

internal/imageproxy/testutil_internal_test.go

@@ -1,355 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"context"
-	"database/sql"
-	"image"
-	"image/color"
-	"image/gif"
-	"image/jpeg"
-	"image/png"
-	"io/fs"
-	"path/filepath"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// Shared test data literals, extracted as constants for goconst.
-const (
-	testContentTypeJPEG = "image/jpeg"
-)
-
-// sqliteTimestampFormat matches the format SQLite's CURRENT_TIMESTAMP
-// produces, so injected timestamps compare correctly against ones the
-// cache writes.
-const sqliteTimestampFormat = "2006-01-02 15:04:05"
-
-// TestFixtures contains paths to test files in the mock filesystem.
-type TestFixtures struct {
-	// Valid image files
-	GoodHostJPEG  string // valid JPEG on GoodHost
-	GoodHostPNG   string // valid PNG on GoodHost
-	GoodHostGIF   string // valid GIF on GoodHost
-	OtherHostJPEG string // valid JPEG on OtherHost
-	OtherHostPNG  string // valid PNG on OtherHost
-
-	// Invalid/edge case files
-	InvalidFile string // file with wrong magic bytes
-	EmptyFile   string // zero-byte file
-	TextFile    string // text file masquerading as image
-
-	// Hostnames
-	GoodHost  string // a host the mock fetcher serves
-	OtherHost string // a second host the mock fetcher serves
-}
-
-// DefaultFixtures returns the standard test fixture paths.
-func DefaultFixtures() *TestFixtures {
-	return &TestFixtures{
-		GoodHostJPEG:  "goodhost.example.com/images/photo.jpg",
-		GoodHostPNG:   "goodhost.example.com/images/logo.png",
-		GoodHostGIF:   "goodhost.example.com/images/animation.gif",
-		OtherHostJPEG: "otherhost.example.com/uploads/image.jpg",
-		OtherHostPNG:  "otherhost.example.com/uploads/icon.png",
-		InvalidFile:   "goodhost.example.com/images/fake.jpg",
-		EmptyFile:     "goodhost.example.com/images/empty.jpg",
-		TextFile:      "goodhost.example.com/images/text.png",
-		GoodHost:      "goodhost.example.com",
-		OtherHost:     "otherhost.example.com",
-	}
-}
-
-// NewTestFS creates a mock filesystem with test images.
-func NewTestFS(t *testing.T) (fs.FS, *TestFixtures) {
-	t.Helper()
-
-	fixtures := DefaultFixtures()
-
-	// Generate test images
-	jpegData := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
-	pngData := generateTestPNG(t, 100, 100, color.RGBA{0, 255, 0, 255})
-	gifData := generateTestGIF(t, 100, 100, color.RGBA{0, 0, 255, 255})
-
-	// Create the mock filesystem
-	mockFS := fstest.MapFS{
-		// Good host files
-		fixtures.GoodHostJPEG: &fstest.MapFile{Data: jpegData},
-		fixtures.GoodHostPNG:  &fstest.MapFile{Data: pngData},
-		fixtures.GoodHostGIF:  &fstest.MapFile{Data: gifData},
-
-		// Other host files
-		fixtures.OtherHostJPEG: &fstest.MapFile{Data: jpegData},
-		fixtures.OtherHostPNG:  &fstest.MapFile{Data: pngData},
-
-		// Invalid files
-		fixtures.InvalidFile: &fstest.MapFile{Data: []byte("not a real image file content")},
-		fixtures.EmptyFile:   &fstest.MapFile{Data: []byte{}},
-		fixtures.TextFile:    &fstest.MapFile{Data: []byte("This is just text, not a PNG")},
-	}
-
-	return mockFS, fixtures
-}
-
-// generateTestJPEG creates a minimal valid JPEG image.
-func generateTestJPEG(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := range height {
-		for x := range width {
-			img.Set(x, y, c)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := jpeg.Encode(&buf, img, &jpeg.Options{Quality: 85})
-	if err != nil {
-		t.Fatalf("failed to encode test JPEG: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// generateTestPNG creates a minimal valid PNG image.
-func generateTestPNG(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := range height {
-		for x := range width {
-			img.Set(x, y, c)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := png.Encode(&buf, img)
-	if err != nil {
-		t.Fatalf("failed to encode test PNG: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// generateTestGIF creates a minimal valid GIF image.
-func generateTestGIF(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewPaletted(
-		image.Rect(0, 0, width, height),
-		[]color.Color{c, color.White},
-	)
-	for y := range height {
-		for x := range width {
-			img.SetColorIndex(x, y, 0)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := gif.Encode(&buf, img, nil)
-	if err != nil {
-		t.Fatalf("failed to encode test GIF: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// testProxy is a Proxy with the database and the state directory of its
-// cache, through which a test reads and changes the cache behind the proxy.
-// registry is the metrics registry the proxy and its cache share.
-type testProxy struct {
-	*Proxy
-
-	db       *sql.DB
-	stateDir string
-	registry *prometheus.Registry
-}
-
-// setupTestProxy creates a Proxy with mock fetcher for testing.
-func setupTestProxy(t *testing.T) (*testProxy, *TestFixtures) {
-	t.Helper()
-
-	mockFS, fixtures := NewTestFS(t)
-
-	// Create temp directory for cache
-	tmpDir := t.TempDir()
-
-	// Create in-memory database
-	db := setupTestDB(t)
-
-	registry := prometheus.NewRegistry()
-
-	cache, err := imgcache.NewCache(db, imgcache.Config{
-		StateDir:    tmpDir,
-		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, registry)
-	if err != nil {
-		t.Fatalf("failed to create cache: %v", err)
-	}
-
-	proxy, err := New(&Config{
-		Cache:   cache,
-		Fetcher: httpfetcher.NewMock(mockFS),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, registry)
-	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
-	}
-
-	return &testProxy{
-		Proxy:    proxy,
-		db:       db,
-		stateDir: tmpDir,
-		registry: registry,
-	}, fixtures
-}
-
-// counterValues holds the values of the counters of a proxy and its cache.
-type counterValues struct {
-	hitCount           int64
-	missCount          int64
-	upstreamFetchCount int64
-	upstreamFetchBytes int64
-	transformCount     int64
-}
-
-// readCounters reads the counters of svc and its cache from their metrics
-// registry.
-func readCounters(t *testing.T, svc *testProxy) counterValues {
-	t.Helper()
-
-	families, err := svc.registry.Gather()
-	if err != nil {
-		t.Fatalf("failed to gather the counters: %v", err)
-	}
-
-	values := make(map[string]int64, len(families))
-
-	for _, family := range families {
-		values[family.GetName()] = int64(family.GetMetric()[0].GetCounter().GetValue())
-	}
-
-	return counterValues{
-		hitCount:           values["pixa_cache_hits_total"],
-		missCount:          values["pixa_cache_misses_total"],
-		upstreamFetchCount: values["pixa_upstream_fetches_total"],
-		upstreamFetchBytes: values["pixa_upstream_fetch_bytes_total"],
-		transformCount:     values["pixa_transforms_total"],
-	}
-}
-
-// sourceFilePath returns the path of the file of the source key in svc's
-// cache, as README.md gives it: <state_dir>/cache/sources/<ab>/<cd>/<key>.
-func sourceFilePath(svc *testProxy, key imagerequest.SourceKey) string {
-	name := string(key)
-
-	return filepath.Join(svc.stateDir, "cache", "sources", name[0:2], name[2:4], name)
-}
-
-// variantFilePath returns the path of the file of the variant key in svc's
-// cache, as README.md gives it: <state_dir>/cache/variants/<ab>/<cd>/<key>.
-func variantFilePath(svc *testProxy, key imagerequest.VariantKey) string {
-	name := string(key)
-
-	return filepath.Join(svc.stateDir, "cache", "variants", name[0:2], name[2:4], name)
-}
-
-// setVariantLastAccessed backdates the last access time of a tracked
-// variant.
-func setVariantLastAccessed(
-	t *testing.T, db *sql.DB, key imagerequest.VariantKey, when time.Time,
-) {
-	t.Helper()
-
-	res, err := db.ExecContext(t.Context(),
-		`UPDATE variant_content SET last_accessed_at = ? WHERE cache_key = ?`,
-		when.UTC().Format(sqliteTimestampFormat), string(key),
-	)
-	if err != nil {
-		t.Fatalf("failed to set variant last_accessed_at: %v", err)
-	}
-
-	affected, err := res.RowsAffected()
-	if err != nil {
-		t.Fatalf("failed to read affected rows: %v", err)
-	}
-
-	if affected != 1 {
-		t.Fatalf("variant %s has no accounting row (affected=%d); "+
-			"stores must track variants in the database", key, affected)
-	}
-}
-
-// setSourceLastAccessed backdates the last access time of a tracked
-// source content blob.
-func setSourceLastAccessed(
-	t *testing.T, db *sql.DB, key imagerequest.SourceKey, when time.Time,
-) {
-	t.Helper()
-
-	res, err := db.ExecContext(t.Context(),
-		`UPDATE source_content SET last_accessed_at = ? WHERE source_key = ?`,
-		when.UTC().Format(sqliteTimestampFormat), string(key),
-	)
-	if err != nil {
-		t.Fatalf("failed to set source last_accessed_at: %v", err)
-	}
-
-	affected, err := res.RowsAffected()
-	if err != nil {
-		t.Fatalf("failed to read affected rows: %v", err)
-	}
-
-	if affected != 1 {
-		t.Fatalf("source %s has no accounting row (affected=%d)", key, affected)
-	}
-}
-
-// countRows returns the number of rows the given query yields.
-func countRows(t *testing.T, db *sql.DB, query string, args ...any) int {
-	t.Helper()
-
-	var n int
-
-	err := db.QueryRowContext(t.Context(), query, args...).Scan(&n)
-	if err != nil {
-		t.Fatalf("count query %q failed: %v", query, err)
-	}
-
-	return n
-}
-
-// setupTestDB creates an in-memory SQLite database for testing
-// using the production schema.
-func setupTestDB(t *testing.T) *sql.DB {
-	t.Helper()
-
-	db, err := sql.Open("sqlite", ":memory:")
-	if err != nil {
-		t.Fatalf("failed to open test db: %v", err)
-	}
-
-	// Use the real production schema via migrations
-	err = database.ApplyMigrations(context.Background(), db, nil)
-	if err != nil {
-		t.Fatalf("failed to apply migrations: %v", err)
-	}
-
-	return db
-}

internal/imagerequest/imagerequest.go

@@ -1,23 +1,22 @@
 // Package imagerequest holds the image request type, its parts, its checks,
-// the parsing of the /v1/image/ path, the variant key, the source key and the
-// source's upstream URL. It also holds the image format type and the MIME type
-// of each format. It imports no other package of this repo, so every package
-// that handles an image request can import it.
+// the parsing of the /v1/image/ path, the variant key and the source key. It
+// imports no other package of this repo, so every package that handles an
+// image request can import it.
 package imagerequest
 
 import (
 	"errors"
 	"net/url"
+	"time"
 )
 
 // ErrInvalidFitMode is returned when an invalid fit mode is provided.
 var ErrInvalidFitMode = errors.New("invalid fit mode")
 
-// Format is an image format. pixa reads and writes the formats from JPEG to
-// GIF below. In a request, orig and auto stand for one of them.
+// Format represents supported output image formats.
 type Format string
 
-// Supported image formats.
+// Supported image output formats.
 const (
 	FormatOriginal Format = "orig"
 	FormatJPEG     Format = "jpeg"
@@ -33,30 +32,6 @@ const (
 	FormatAuto Format = "auto"
 )
 
-// MIMEType returns the MIME type of the format, such as image/jpeg for
-// FormatJPEG. orig and auto stand for another format, so they have none:
-// MIMEType returns "" for them.
-func (f Format) MIMEType() string {
-	switch f {
-	case FormatJPEG:
-		return "image/jpeg"
-	case FormatPNG:
-		return "image/png"
-	case FormatWebP:
-		return "image/webp"
-	case FormatAVIF:
-		return "image/avif"
-	case FormatJXL:
-		return "image/jxl"
-	case FormatGIF:
-		return "image/gif"
-	case FormatOriginal, FormatAuto:
-		return ""
-	default:
-		return ""
-	}
-}
-
 // Size represents requested image dimensions
 type Size struct {
 	Width  int
@@ -110,13 +85,19 @@ func ValidateImageRequest(req *Request) error {
 }
 
 // Request represents a request for a processed image: the source to fetch
-// and the transform to apply to it. It holds exactly what the variant key
-// covers.
+// and the transform to apply to it.
 type Request struct {
 	// Source is what to fetch
 	Source Source
 	// Transform is what to do to it
 	Transform Transform
+	// Signature is the HMAC signature for non-allowlisted hosts
+	Signature string
+	// Expires is when the URL expires: the exp of a signed URL, or the expiry
+	// of an encrypted URL; the zero time if it has none
+	Expires time.Time
+	// AllowHTTP indicates whether HTTP (non-TLS) is allowed for this request
+	AllowHTTP bool
 }
 
 // Source is the image a request fetches from the origin.
@@ -144,20 +125,23 @@ type Transform struct {
 	FitMode Fit
 }
 
-// URL returns the source's upstream URL, with the scheme http when allowHTTP
-// is true and https otherwise. net/url writes its path percent-encoded again,
-// so each source path is one upstream path. Its query is the source query as
-// it is, with the characters escapeQuery encodes percent-encoded.
-func (s Source) URL(allowHTTP bool) *url.URL {
+// SourceURL returns the full upstream URL to fetch: the source path
+// percent-encoded again, as net/url writes a path, so each source path is one
+// upstream path, and the source query as it is, with the characters
+// escapeQuery encodes percent-encoded. Uses http:// scheme when AllowHTTP is
+// true, otherwise https://.
+func (r *Request) SourceURL() string {
 	scheme := "https"
-	if allowHTTP {
+	if r.AllowHTTP {
 		scheme = "http"
 	}
 
-	return &url.URL{
+	sourceURL := url.URL{
 		Scheme:   scheme,
-		Host:     s.Host,
-		Path:     s.Path,
-		RawQuery: escapeQuery(s.Query),
+		Host:     r.Source.Host,
+		Path:     r.Source.Path,
+		RawQuery: escapeQuery(r.Source.Query),
 	}
+
+	return sourceURL.String()
 }

internal/imagerequest/mimetype_internal_test.go

@@ -1,30 +0,0 @@
-package imagerequest
-
-import "testing"
-
-// TestFormat_MIMEType checks the MIME type of each format pixa reads and
-// writes, and that orig and auto have none.
-func TestFormat_MIMEType(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		format Format
-		want   string
-	}{
-		{FormatJPEG, "image/jpeg"},
-		{FormatPNG, "image/png"},
-		{FormatWebP, "image/webp"},
-		{FormatAVIF, "image/avif"},
-		{FormatJXL, "image/jxl"},
-		{FormatGIF, "image/gif"},
-		{FormatOriginal, ""},
-		{FormatAuto, ""},
-	}
-
-	for _, tt := range tests {
-		got := tt.format.MIMEType()
-		if got != tt.want {
-			t.Errorf("%s MIMEType() = %q, want %q", tt.format, got, tt.want)
-		}
-	}
-}

internal/imagerequest/sourceurl_internal_test.go

@@ -2,49 +2,57 @@ package imagerequest
 
 import "testing"
 
-func TestSource_URL_DefaultHTTPS(t *testing.T) {
+func TestRequest_SourceURL_DefaultHTTPS(t *testing.T) {
 	t.Parallel()
 
-	source := Source{
-		Host:  testHostCDN,
-		Path:  testPathCat,
-		Query: "v=2",
+	req := &Request{
+		Source: Source{
+			Host:  testHostCDN,
+			Path:  testPathCat,
+			Query: "v=2",
+		},
 	}
 
-	got := source.URL(false).String()
+	got := req.SourceURL()
 
 	want := "https://cdn.example.com/photos/cat.jpg?v=2"
 	if got != want {
-		t.Errorf("URL() = %q, want %q", got, want)
+		t.Errorf("SourceURL() = %q, want %q", got, want)
 	}
 }
 
-func TestSource_URL_AllowHTTP(t *testing.T) {
+func TestRequest_SourceURL_AllowHTTP(t *testing.T) {
 	t.Parallel()
 
-	source := Source{
-		Host: "localhost:8080",
-		Path: testPathCat,
+	req := &Request{
+		Source: Source{
+			Host: "localhost:8080",
+			Path: testPathCat,
+		},
+		AllowHTTP: true,
 	}
 
-	got := source.URL(true).String()
+	got := req.SourceURL()
 
 	want := "http://localhost:8080/photos/cat.jpg"
 	if got != want {
-		t.Errorf("URL() = %q, want %q", got, want)
+		t.Errorf("SourceURL() = %q, want %q", got, want)
 	}
 }
 
-func TestSource_URL_AllowHTTPFalse(t *testing.T) {
+func TestRequest_SourceURL_AllowHTTPFalse(t *testing.T) {
 	t.Parallel()
 
-	source := Source{
-		Host: testHostCDN,
-		Path: "/img.jpg",
+	req := &Request{
+		Source: Source{
+			Host: testHostCDN,
+			Path: "/img.jpg",
+		},
+		AllowHTTP: false,
 	}
 
-	got := source.URL(false).String()
+	got := req.SourceURL()
 	if got != "https://cdn.example.com/img.jpg" {
-		t.Errorf("URL() = %q, want https scheme", got)
+		t.Errorf("SourceURL() = %q, want https scheme", got)
 	}
 }

internal/imagerequest/urlparser.go

@@ -66,6 +66,23 @@ var queryEscapeRegex = regexp.MustCompile(`%[0-9A-Fa-f]{2}|[^!-~]|["#'<>%]`)
 var hostRegex = regexp.MustCompile(
 	`^(?:[A-Za-z0-9_.-]+|\[([0-9A-Fa-f:.]+)\])(?::[0-9]*)?$`)
 
+// ParseImagePath parses an image URL's path after /v1/image/, decoded once:
+// <host>/<path>/<size>.<format>, or <host>/<path>/<size> for JPEG XL.
+// Examples:
+//   - cdn.example.com/photos/cat.jpg/800x600.webp
+//   - cdn.example.com/photos/cat.jpg/0x0.jpeg
+//   - cdn.example.com/photos/cat.jpg/orig.png
+//   - cdn.example.com/photos/cat.jpg/800x600
+func ParseImagePath(path string) (*Request, error) {
+	// Strip leading slash if present (chi may include it)
+	path = strings.TrimPrefix(path, "/")
+	if path == "" {
+		return nil, ErrMissingHost
+	}
+
+	return parseImageComponents(path)
+}
+
 // ParseImageURL parses an image URL's path, decoded once as r.URL.Path holds
 // it: /v1/image/<host>/<path>/<size>.<format>, or /v1/image/<host>/<path>/<size>
 // for JPEG XL. A source query follows the source path after a "?", which the
@@ -126,15 +143,15 @@ func parseImageComponents(remainder string) (*Request, error) {
 		return nil, ErrMissingHost
 	}
 
-	// Later steps put the host unparsed into the allowlist check, the cache key
-	// and the upstream URL, so only the forms hostRegex describes are accepted
+	// Only the forms hostRegex describes are accepted. A "?", "#" or "@" in
+	// the host would make Go's URL parser, which the allowlist check and the
+	// fetcher use, read a different host from the one allowlisted and cached
 	hostMatch := hostRegex.FindStringSubmatch(host)
 	if hostMatch == nil {
 		return nil, fmt.Errorf("%w: %q", ErrInvalidHost, host)
 	}
 
-	// The allowlist check and the fetcher drop the brackets, so brackets
-	// around anything but an IPv6 address would give a host a second spelling
+	// Go's URL parser refuses brackets around anything but an IPv6 address
 	if inBrackets := hostMatch[1]; inBrackets != "" {
 		addr, err := netip.ParseAddr(inBrackets)
 		if err != nil || !addr.Is6() {
@@ -147,8 +164,9 @@ func parseImageComponents(remainder string) (*Request, error) {
 	// host
 	host = strings.ToLower(host)
 
-	// A "#" starts a URL's fragment, so neither the source path nor the source
-	// query may hold one
+	// Go's URL parser, which the fetcher uses, reads a "#" as the start of a
+	// fragment and drops the rest, so each text after it would be another
+	// spelling, cached under its own keys, of one upstream request
 	if strings.Contains(path, "#") {
 		return nil, fmt.Errorf(
 			`%w: the source path or query holds a "#"`, ErrInvalidPath)

internal/imagerequest/urlparser_internal_test.go

@@ -192,16 +192,76 @@ func TestParseImageURL_Errors(t *testing.T) {
 	}
 }
 
-// TestParseImageURL_LowerCasesHost verifies that the host is lower-cased, so
+func TestParseImagePath(t *testing.T) {
+	t.Parallel()
+
+	// ParseImagePath is for chi wildcard capture (no /v1/image/ prefix)
+	tests := []struct {
+		name    string
+		input   string
+		want    *Request
+		wantErr bool
+	}{
+		{
+			name:  "chi wildcard capture",
+			input: "cdn.example.com/photos/cat.jpg/800x600.webp",
+			want: &Request{
+				Source: Source{
+					Host: testHostCDN,
+					Path: testPathCat,
+				},
+				Transform: Transform{
+					Size:   Size{Width: 800, Height: 600},
+					Format: FormatWebP,
+				},
+			},
+		},
+		{
+			name:  "with leading slash from chi",
+			input: "/cdn.example.com/photos/cat.jpg/800x600.webp",
+			want: &Request{
+				Source: Source{
+					Host: testHostCDN,
+					Path: testPathCat,
+				},
+				Transform: Transform{
+					Size:   Size{Width: 800, Height: 600},
+					Format: FormatWebP,
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := ParseImagePath(tt.input)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ParseImagePath() error = %v, wantErr %v", err, tt.wantErr)
+
+				return
+			}
+
+			if err != nil {
+				return
+			}
+
+			assertRequest(t, got, tt.want)
+		})
+	}
+}
+
+// TestParseImagePath_LowerCasesHost verifies that the host is lower-cased, so
 // that every spelling of its letter case is the same host to the allowlist,
 // the upstream connection limits and the cache, and that the path keeps its
 // case.
-func TestParseImageURL_LowerCasesHost(t *testing.T) {
+func TestParseImagePath_LowerCasesHost(t *testing.T) {
 	t.Parallel()
 
-	got, err := ParseImageURL("/v1/image/CDN.Example.COM/Photos/Cat.jpg/800x600.webp")
+	got, err := ParseImagePath("CDN.Example.COM/Photos/Cat.jpg/800x600.webp")
 	if err != nil {
-		t.Fatalf("ParseImageURL() error = %v", err)
+		t.Fatalf("ParseImagePath() error = %v", err)
 	}
 
 	t.Logf("parsed host %q, path %q", got.Source.Host, got.Source.Path)
@@ -215,21 +275,21 @@ func TestParseImageURL_LowerCasesHost(t *testing.T) {
 	}
 }
 
-// TestParseImageURL_RefusesUserinfo verifies that a host holding "@" is
+// TestParseImagePath_RefusesUserinfo verifies that a host holding "@" is
 // refused: a URL reads what comes before the "@" as a user name and password
 // and the rest as the host.
-func TestParseImageURL_RefusesUserinfo(t *testing.T) {
+func TestParseImagePath_RefusesUserinfo(t *testing.T) {
 	t.Parallel()
 
 	for _, input := range []string{
-		"/v1/image/user@cdn.example.com/photos/cat.jpg/800x600.webp",
-		"/v1/image/user:password@cdn.example.com/photos/cat.jpg/800x600.webp",
+		"user@cdn.example.com/photos/cat.jpg/800x600.webp",
+		"user:password@cdn.example.com/photos/cat.jpg/800x600.webp",
 	} {
-		got, err := ParseImageURL(input)
-		t.Logf("ParseImageURL(%q) = %+v, error = %v", input, got, err)
+		got, err := ParseImagePath(input)
+		t.Logf("ParseImagePath(%q) = %+v, error = %v", input, got, err)
 
 		if !errors.Is(err, ErrInvalidHost) {
-			t.Errorf("ParseImageURL(%q) error = %v, want %v",
+			t.Errorf("ParseImagePath(%q) error = %v, want %v",
 				input, err, ErrInvalidHost)
 		}
 	}
@@ -255,10 +315,6 @@ func TestParseImageURL_PathTraversal(t *testing.T) {
 			name:  "parent in middle of path",
 			input: "/v1/image/cdn.example.com/photos/../../../etc/passwd/800x600.jpeg",
 		},
-		{
-			name:  "parent directory in path",
-			input: "/v1/image/cdn.example.com/photos/../secret/800x600.jpeg",
-		},
 		{
 			name:  "encoded parent directory",
 			input: "/v1/image/cdn.example.com/photos/%2e%2e/secret/800x600.jpeg",
@@ -301,6 +357,40 @@ func TestParseImageURL_PathTraversal(t *testing.T) {
 	}
 }
 
+func TestParseImagePath_PathTraversal(t *testing.T) {
+	t.Parallel()
+
+	// Test path traversal via ParseImagePath (chi wildcard)
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "parent directory in path",
+			input: "cdn.example.com/photos/../secret/800x600.jpeg",
+		},
+		{
+			name:  "encoded traversal",
+			input: "cdn.example.com/photos/%2e%2e/secret/800x600.jpeg",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := ParseImagePath(tt.input)
+			if err == nil {
+				t.Error("ParseImagePath() should reject path traversal attempts")
+			}
+
+			if !errors.Is(err, ErrPathTraversal) {
+				t.Errorf("ParseImagePath() error = %v, want ErrPathTraversal", err)
+			}
+		})
+	}
+}
+
 // TestParseImageURL_SourceURLHoldingPercent25 verifies that a source path and
 // a source query holding %25, the percent-escape of a literal "%", are
 // accepted as they are, although decoding them once more leaves a "%" that

internal/imgcache/cache.go

@@ -1,10 +1,3 @@
-// Package imgcache is the image cache. It keeps:
-//   - the source images fetched from upstream
-//   - the variants made from them
-//   - the negative cache: the source URLs whose fetch failed recently
-//
-// Each image is a file with a row in the database. Eviction removes the
-// least recently used images to keep the cache under its size limit.
 package imgcache
 
 import (
@@ -19,7 +12,12 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/magic"
+)
+
+// Cache errors.
+var (
+	ErrCacheMiss     = errors.New("cache miss")
+	ErrNegativeCache = errors.New("negative cache hit")
 )
 
 // maxPendingAccessTimes is how many access times of variants served from
@@ -34,22 +32,29 @@ const maxPendingAccessTimes = 10000
 // have expired.
 const cleanExpiredBatchSize = 1000
 
-// DefaultNegativeTTL is how long pixad keeps a failed fetch in the negative
-// cache.
-const DefaultNegativeTTL = 5 * time.Minute
-
-// Config holds cache configuration.
-type Config struct {
+// CacheConfig holds cache configuration.
+type CacheConfig struct {
 	StateDir    string
 	NegativeTTL time.Duration
 
 	// MaxBytes is the disk cache size limit in bytes that eviction
-	// enforces. Zero turns the disk cache off entirely: no cache
-	// directories are created, lookups always miss, stores are no-ops,
-	// and the eviction goroutine only removes the expired negative cache
-	// rows.
+	// enforces. Zero means no limit is enforced (no eviction).
 	MaxBytes int64
 
+	// UseDefaultMaxBytes makes NewCache replace MaxBytes with the
+	// default limit: 75% of the sum of the space free on the filesystem
+	// holding the cache and the bytes the cache already holds, at least
+	// DefaultCacheMaxBytesFloor. The config layer sets this when the
+	// operator omits cache_max_bytes.
+	UseDefaultMaxBytes bool
+
+	// DisableDiskCache turns the disk cache off entirely: no cache
+	// directories are created, lookups always miss, stores are
+	// no-ops, and the eviction goroutine only removes the expired
+	// negative cache rows. The config layer sets this when the
+	// operator configures cache_max_bytes: 0.
+	DisableDiskCache bool
+
 	// Logger receives accounting and eviction log output. A nil
 	// Logger means slog.Default().
 	Logger *slog.Logger
@@ -58,11 +63,15 @@ type Config struct {
 // Cache implements the caching layer for the image proxy.
 type Cache struct {
 	db         *sql.DB
-	srcContent *FileStore // source images by source key
-	variants   *FileStore // processed variants by cache key
-	config     Config
+	srcContent *ContentStorage // source images by source key
+	variants   *VariantStorage // processed variants by cache key
+	config     CacheConfig
 	log        *slog.Logger
 
+	// disabled means the disk cache is turned off entirely: lookups
+	// always miss, stores are no-ops, and no eviction runs.
+	disabled bool
+
 	// Eviction machinery. The channels are created in NewCache so
 	// stores can signal write pressure without racing StartEviction.
 	// evictionCancel, set by StartEviction, cancels the eviction
@@ -85,13 +94,16 @@ type Cache struct {
 	pendingAccessTimesDone    chan struct{}
 	pendingAccessTimesCancel  context.CancelFunc
 
-	// The counts of cache hits and misses, made and registered by
+	// The counts of what the cache does, made and registered by
 	// registerCounters (see counters.go)
-	cacheHits   prometheus.Counter
-	cacheMisses prometheus.Counter
+	cacheHits          prometheus.Counter
+	cacheMisses        prometheus.Counter
+	upstreamFetches    prometheus.Counter
+	upstreamFetchBytes prometheus.Counter
+	transforms         prometheus.Counter
 
 	// reconciliationPageSize is the most rows one read of a content table
-	// returns in the reconciliation pass. NewCache sets it to
+	// returns in the reconciliation pass. newCache sets it to
 	// defaultReconciliationPageSize; tests set it smaller.
 	reconciliationPageSize int
 
@@ -104,9 +116,20 @@ type Cache struct {
 
 // NewCache creates a new cache instance and registers its counters on
 // metricsRegistry. pixad passes Prometheus' default registry, the one
-// /metrics serves. It makes no database call.
+// /metrics serves.
 func NewCache(
-	db *sql.DB, config Config, metricsRegistry prometheus.Registerer,
+	db *sql.DB, config CacheConfig, metricsRegistry prometheus.Registerer,
+) (*Cache, error) {
+	return newCache(db, config, metricsRegistry, defaultFreeSpaceProbe)
+}
+
+// newCache is NewCache with the free-space probe passed in, so tests
+// can fake the free space the default limit is worked out from.
+func newCache(
+	db *sql.DB,
+	config CacheConfig,
+	metricsRegistry prometheus.Registerer,
+	probe FreeSpaceProbeFunc,
 ) (*Cache, error) {
 	log := config.Logger
 	if log == nil {
@@ -117,6 +140,7 @@ func NewCache(
 		db:               db,
 		config:           config,
 		log:              log,
+		disabled:         config.DisableDiskCache,
 		evictionPressure: make(chan struct{}, 1),
 		evictionDone:     make(chan struct{}),
 
@@ -132,18 +156,18 @@ func NewCache(
 		return nil, err
 	}
 
-	if config.MaxBytes == 0 {
+	if c.disabled {
 		return c, nil
 	}
 
-	srcContent, err := NewFileStore(
+	srcContent, err := NewContentStorage(
 		filepath.Join(config.StateDir, "cache", "sources"),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create source content storage: %w", err)
 	}
 
-	variants, err := NewFileStore(
+	variants, err := NewVariantStorage(
 		filepath.Join(config.StateDir, "cache", "variants"),
 	)
 	if err != nil {
@@ -153,63 +177,103 @@ func NewCache(
 	c.srcContent = srcContent
 	c.variants = variants
 
+	if config.UseDefaultMaxBytes {
+		limit, err := c.computeDefaultMaxBytes(context.Background(), probe)
+		if err != nil {
+			return nil, err
+		}
+
+		c.config.MaxBytes = limit
+
+		log.Info("computed default cache size limit from free space and cache contents",
+			"cache_max_bytes", limit,
+			"cache_dir", filepath.Join(config.StateDir, "cache"),
+		)
+	}
+
 	return c, nil
 }
 
-// Variant opens a cached variant and returns a reader, its size and its
+// GetVariant opens a cached variant and returns a reader, its size and its
 // content type, read from the variant file's first bytes. It opens that one
-// file and makes no database call. A variant it opens has its access time
-// handed to the background writer without waiting (see touchVariant). A
-// variant not in the cache, or any variant of a disabled cache, is
-// ErrNotFound; a variant file whose first bytes are not those of an output
-// format is another error.
-func (c *Cache) Variant(
+// file and makes no database call. A variant not in the cache, or any
+// variant of a disabled cache, is ErrNotFound; a variant file whose first
+// bytes are not those of an output format is another error.
+func (c *Cache) GetVariant(
 	cacheKey imagerequest.VariantKey,
 ) (io.ReadCloser, int64, string, error) {
-	if c.config.MaxBytes == 0 {
+	if c.disabled {
 		return nil, 0, "", ErrNotFound
 	}
 
-	file, size, err := c.variants.Open(string(cacheKey))
-	if err != nil {
-		return nil, 0, "", err
-	}
-
-	format, err := readFormat(file)
-	if err != nil {
-		_ = file.Close()
-
-		return nil, 0, "", err
-	}
-
-	c.touchVariant(cacheKey)
-
-	return file, size, format.MIMEType(), nil
+	return c.variants.LoadWithContentType(cacheKey)
 }
 
-// PutVariant stores a processed variant by its cache key and records
-// it in the size accounting. On a disabled cache it is a no-op. The
-// accounting insert is best-effort (the startup reconciliation pass
-// adopts any variant file that misses its accounting row).
-func (c *Cache) PutVariant(
-	ctx context.Context, cacheKey imagerequest.VariantKey, content io.Reader,
-) error {
-	if c.config.MaxBytes == 0 {
-		return nil
+// StoreSource stores fetched source content: it writes the file named by
+// the source's key, then the source's row. When the row cannot be written
+// the file is removed and the store fails, as a file with no row is never
+// served or evicted; if that removal fails too, the next reconciliation
+// pass removes the file. On a disabled cache it is a no-op returning an
+// empty key.
+func (c *Cache) StoreSource(
+	ctx context.Context,
+	req *imagerequest.Request,
+	content io.Reader,
+) (imagerequest.SourceKey, error) {
+	if c.disabled {
+		return "", nil
 	}
 
 	data, err := io.ReadAll(content)
 	if err != nil {
-		return fmt.Errorf("failed to read content: %w", err)
+		return "", fmt.Errorf("failed to read source content: %w", err)
 	}
 
-	err = c.variants.Write(string(cacheKey), data)
+	key := req.Source.Key()
+
+	size, err := c.srcContent.Store(key, data)
+	if err != nil {
+		return "", fmt.Errorf("failed to store source content: %w", err)
+	}
+
+	_, err = c.db.ExecContext(ctx, `
+		INSERT INTO source_content (source_key, size_bytes)
+		VALUES (?, ?)
+		ON CONFLICT(source_key) DO UPDATE SET
+			size_bytes = excluded.size_bytes,
+			last_accessed_at = CURRENT_TIMESTAMP
+	`, string(key), size)
+	if err != nil {
+		deleteErr := c.srcContent.Delete(key)
+		if deleteErr != nil {
+			c.log.Warn("failed to remove source file whose row was not written",
+				"source_key", key, "error", deleteErr)
+		}
+
+		return "", fmt.Errorf("failed to insert source content: %w", err)
+	}
+
+	c.notifyWritePressure()
+
+	return key, nil
+}
+
+// StoreVariant stores a processed variant by its cache key and records
+// it in the size accounting. On a disabled cache it is a no-op. The
+// accounting insert is best-effort (the startup reconciliation pass
+// adopts any variant file that misses its accounting row).
+func (c *Cache) StoreVariant(
+	ctx context.Context, cacheKey imagerequest.VariantKey, content io.Reader,
+) error {
+	if c.disabled {
+		return nil
+	}
+
+	size, err := c.variants.Store(cacheKey, content)
 	if err != nil {
 		return err
 	}
 
-	size := int64(len(data))
-
 	_, err = c.db.ExecContext(ctx, `
 		INSERT INTO variant_content (cache_key, size_bytes)
 		VALUES (?, ?)
@@ -227,20 +291,19 @@ func (c *Cache) PutVariant(
 	return nil
 }
 
-// Source opens the cached source of src and returns a reader, its size in
-// bytes and its format, read from the file's first bytes. A source whose row
-// or file is missing is ErrNotFound, as is any source of a disabled cache; a
-// file whose first bytes are not those of a source format is another error.
-// A source it opens has its access time handed to the background writer
-// without waiting (see touchSourceContent).
-func (c *Cache) Source(
-	ctx context.Context, src imagerequest.Source,
-) (io.ReadCloser, int64, imagerequest.Format, error) {
-	if c.config.MaxBytes == 0 {
-		return nil, 0, "", ErrNotFound
+// LookupSource checks if we have cached source content for a request.
+// Returns the source key if found, or an empty key if not; a row whose
+// file is missing is not found. A source found has its access time
+// handed to the background writer without waiting (see
+// touchSourceContent); a disabled cache always reports no cached source.
+func (c *Cache) LookupSource(
+	ctx context.Context, req *imagerequest.Request,
+) (imagerequest.SourceKey, error) {
+	if c.disabled {
+		return "", nil
 	}
 
-	key := src.Key()
+	key := req.Source.Key()
 
 	var rowExists bool
 
@@ -248,109 +311,25 @@ func (c *Cache) Source(
 		SELECT EXISTS(SELECT 1 FROM source_content WHERE source_key = ?)
 	`, string(key)).Scan(&rowExists)
 	if err != nil {
-		return nil, 0, "", fmt.Errorf("failed to lookup source: %w", err)
+		return "", fmt.Errorf("failed to lookup source: %w", err)
 	}
 
 	if !rowExists {
-		return nil, 0, "", ErrNotFound
+		return "", nil
 	}
 
-	file, size, err := c.srcContent.Open(string(key))
-	if err != nil {
-		return nil, 0, "", err
-	}
-
-	format, err := readFormat(file)
-	if err != nil {
-		_ = file.Close()
-
-		return nil, 0, "", err
+	// Verify the content file exists
+	if !c.srcContent.Exists(key) {
+		return "", nil
 	}
 
 	c.touchSourceContent(key)
 
-	return file, size, format, nil
-}
-
-// PutSource stores fetched source content: it writes the file named by
-// the source's key, then the source's row. When the row cannot be written
-// the file is removed and the store fails, as a file with no row is never
-// served or evicted; if that removal fails too, the next reconciliation
-// pass removes the file. On a disabled cache it is a no-op returning an
-// empty key.
-func (c *Cache) PutSource(
-	ctx context.Context,
-	src imagerequest.Source,
-	content io.Reader,
-) (imagerequest.SourceKey, error) {
-	if c.config.MaxBytes == 0 {
-		return "", nil
-	}
-
-	data, err := io.ReadAll(content)
-	if err != nil {
-		return "", fmt.Errorf("failed to read source content: %w", err)
-	}
-
-	key := src.Key()
-
-	err = c.srcContent.Write(string(key), data)
-	if err != nil {
-		return "", fmt.Errorf("failed to store source content: %w", err)
-	}
-
-	size := int64(len(data))
-
-	_, err = c.db.ExecContext(ctx, `
-		INSERT INTO source_content (source_key, size_bytes)
-		VALUES (?, ?)
-		ON CONFLICT(source_key) DO UPDATE SET
-			size_bytes = excluded.size_bytes,
-			last_accessed_at = CURRENT_TIMESTAMP
-	`, string(key), size)
-	if err != nil {
-		deleteErr := c.srcContent.Delete(string(key))
-		if deleteErr != nil {
-			c.log.Warn("failed to remove source file whose row was not written",
-				"source_key", key, "error", deleteErr)
-		}
-
-		return "", fmt.Errorf("failed to insert source content: %w", err)
-	}
-
-	c.notifyWritePressure()
-
 	return key, nil
 }
 
-// Failure reports whether src is in the negative cache. It only reads: a
-// row past its expiry is not a hit, and the eviction goroutine deletes it
-// with the other expired rows (see CleanExpired).
-func (c *Cache) Failure(
-	ctx context.Context, src imagerequest.Source,
-) (bool, error) {
-	var expiresAt time.Time
-
-	err := c.db.QueryRowContext(ctx, `
-		SELECT expires_at FROM negative_cache
-		WHERE source_host = ? AND source_path = ? AND source_query = ?
-	`, src.Host, src.Path, src.Query).Scan(&expiresAt)
-
-	if errors.Is(err, sql.ErrNoRows) {
-		return false, nil
-	}
-
-	if err != nil {
-		return false, fmt.Errorf("failed to check negative cache: %w", err)
-	}
-
-	expired := time.Now().After(expiresAt)
-
-	return !expired, nil
-}
-
-// PutFailure stores a negative cache entry for src, whose fetch failed.
-func (c *Cache) PutFailure(ctx context.Context, src imagerequest.Source) error {
+// StoreNegative stores a negative cache entry for a failed fetch.
+func (c *Cache) StoreNegative(ctx context.Context, req *imagerequest.Request) error {
 	expiresAt := time.Now().UTC().Add(c.config.NegativeTTL)
 
 	_, err := c.db.ExecContext(ctx, `
@@ -359,7 +338,7 @@ func (c *Cache) PutFailure(ctx context.Context, src imagerequest.Source) error {
 		VALUES (?, ?, ?, ?)
 		ON CONFLICT(source_host, source_path, source_query) DO UPDATE SET
 			expires_at = excluded.expires_at
-	`, src.Host, src.Path, src.Query, expiresAt)
+	`, req.Source.Host, req.Source.Path, req.Source.Query, expiresAt)
 	if err != nil {
 		return fmt.Errorf("failed to insert negative cache: %w", err)
 	}
@@ -367,6 +346,18 @@ func (c *Cache) PutFailure(ctx context.Context, src imagerequest.Source) error {
 	return nil
 }
 
+// GetSourceContent returns a reader for cached source content by its key,
+// and the content's size in bytes.
+func (c *Cache) GetSourceContent(
+	key imagerequest.SourceKey,
+) (io.ReadCloser, int64, error) {
+	if c.disabled {
+		return nil, 0, ErrNotFound
+	}
+
+	return c.srcContent.LoadWithSize(key)
+}
+
 // CleanExpired removes the negative cache rows past their expiry, one
 // batch per statement, until none is left. Once ctx ends it starts no
 // further batch and returns ctx's error. The eviction goroutine calls it
@@ -390,15 +381,34 @@ func (c *Cache) CleanExpired(ctx context.Context) error {
 	}
 }
 
-// IncrementStats counts a cache hit or miss. It only adds to the cache's
-// Prometheus counters in memory (see counters.go), so it never waits for the
-// database or fails.
-func (c *Cache) IncrementStats(hit bool) {
+// IncrementStats counts a cache hit or miss, and an upstream fetch that read
+// fetchBytes bytes, as IncrementUpstreamFetch does. Like the other Increment
+// methods, it only adds to the cache's Prometheus counters in memory (see
+// counters.go), so it never waits for the database or fails.
+func (c *Cache) IncrementStats(hit bool, fetchBytes int64) {
 	if hit {
 		c.cacheHits.Inc()
 	} else {
 		c.cacheMisses.Inc()
 	}
+
+	c.IncrementUpstreamFetch(fetchBytes)
+}
+
+// IncrementUpstreamFetch counts one upstream fetch that read fetchBytes bytes.
+// A fetch that read no bytes is not counted.
+func (c *Cache) IncrementUpstreamFetch(fetchBytes int64) {
+	if fetchBytes <= 0 {
+		return
+	}
+
+	c.upstreamFetches.Inc()
+	c.upstreamFetchBytes.Add(float64(fetchBytes))
+}
+
+// IncrementTransformCount counts one image transcoded by the image processor.
+func (c *Cache) IncrementTransformCount() {
+	c.transforms.Inc()
 }
 
 // touchVariant hands the access time of a variant served from the cache to
@@ -425,6 +435,32 @@ func (c *Cache) touchSourceContent(key imagerequest.SourceKey) {
 	}
 }
 
+// checkNegativeCache checks if a request is in the negative cache. It only
+// reads: a row past its expiry is not a hit, and the eviction goroutine
+// deletes it with the other expired rows (see CleanExpired).
+func (c *Cache) checkNegativeCache(
+	ctx context.Context, req *imagerequest.Request,
+) (bool, error) {
+	var expiresAt time.Time
+
+	err := c.db.QueryRowContext(ctx, `
+		SELECT expires_at FROM negative_cache
+		WHERE source_host = ? AND source_path = ? AND source_query = ?
+	`, req.Source.Host, req.Source.Path, req.Source.Query).Scan(&expiresAt)
+
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+
+	if err != nil {
+		return false, fmt.Errorf("failed to check negative cache: %w", err)
+	}
+
+	expired := time.Now().After(expiresAt)
+
+	return !expired, nil
+}
+
 // cleanExpiredBatch deletes up to cleanExpiredBatchSize negative cache
 // rows past their expiry in one statement, and returns how many it
 // deleted. DELETE ... LIMIT needs a SQLite build option, so the subquery
@@ -448,17 +484,3 @@ func (c *Cache) cleanExpiredBatch(ctx context.Context) (int64, error) {
 
 	return deleted, nil
 }
-
-// readFormat reads the first bytes of a source or variant file, without
-// moving its offset, and returns the format they show. Sources and variants
-// are in the same six formats.
-func readFormat(content io.ReaderAt) (imagerequest.Format, error) {
-	firstBytes := make([]byte, magic.MinMagicBytes)
-
-	_, err := content.ReadAt(firstBytes, 0)
-	if err != nil {
-		return "", fmt.Errorf("failed to read the first bytes: %w", err)
-	}
-
-	return magic.DetectFormat(firstBytes)
-}

internal/imgcache/cache_hit_internal_test.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"image/color"
 	"io"
+	"os"
 	"testing"
 	"time"
 
@@ -14,17 +15,14 @@ import (
 	"sneak.berlin/go/pixa/internal/magic"
 )
 
-// TestVariant_ContentTypeFromFirstBytes stores an image in each output
-// format as a variant and checks that Variant serves it whole with the
+// TestGetVariant_ContentTypeFromFirstBytes stores an image in each output
+// format as a variant and checks that GetVariant serves it whole with the
 // content type of its format, read from the file.
-func TestVariant_ContentTypeFromFirstBytes(t *testing.T) {
+func TestGetVariant_ContentTypeFromFirstBytes(t *testing.T) {
 	t.Parallel()
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
-	processor := imageprocessor.New(imageprocessor.Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	})
+	processor := imageprocessor.New(imageprocessor.Params{})
 	source := generateTestJPEG(t, 40, 30, color.RGBA{200, 40, 40, 255})
 
 	for _, format := range []imagerequest.Format{
@@ -32,7 +30,7 @@ func TestVariant_ContentTypeFromFirstBytes(t *testing.T) {
 		imagerequest.FormatWebP, imagerequest.FormatAVIF, imagerequest.FormatJXL,
 	} {
 		result, err := processor.Process(t.Context(), bytes.NewReader(source),
-			imagerequest.FormatJPEG, &imagerequest.Transform{
+			&imagerequest.Transform{
 				Size:    imagerequest.Size{Width: 20, Height: 15},
 				Format:  format,
 				Quality: 85,
@@ -49,14 +47,14 @@ func TestVariant_ContentTypeFromFirstBytes(t *testing.T) {
 
 		key := imagerequest.VariantKey("aabbccdd10" + string(format))
 
-		err = cache.PutVariant(t.Context(), key, bytes.NewReader(image))
+		err = cache.StoreVariant(t.Context(), key, bytes.NewReader(image))
 		if err != nil {
-			t.Fatalf("PutVariant(%s) error = %v", format, err)
+			t.Fatalf("StoreVariant(%s) error = %v", format, err)
 		}
 
-		reader, size, contentType, err := cache.Variant(key)
+		reader, size, contentType, err := cache.GetVariant(key)
 		if err != nil {
-			t.Fatalf("Variant(%s) error = %v", format, err)
+			t.Fatalf("GetVariant(%s) error = %v", format, err)
 		}
 
 		served, err := io.ReadAll(reader)
@@ -68,7 +66,7 @@ func TestVariant_ContentTypeFromFirstBytes(t *testing.T) {
 
 		t.Logf("%s: %d bytes served as %s", format, size, contentType)
 
-		if want := format.MIMEType(); contentType != want {
+		if want := imageprocessor.FormatToMIME(format); contentType != want {
 			t.Errorf("%s variant content type = %q, want %q", format, contentType, want)
 		}
 
@@ -79,11 +77,11 @@ func TestVariant_ContentTypeFromFirstBytes(t *testing.T) {
 	}
 }
 
-// TestVariant_RefusesFileOfNoOutputFormat checks that Variant refuses
+// TestGetVariant_RefusesFileOfNoOutputFormat checks that GetVariant refuses
 // a variant file whose first bytes are not those of an output format, with
 // an error other than ErrNotFound, and that a variant with no file, or any
 // variant of a disabled cache, is ErrNotFound.
-func TestVariant_RefusesFileOfNoOutputFormat(t *testing.T) {
+func TestGetVariant_RefusesFileOfNoOutputFormat(t *testing.T) {
 	t.Parallel()
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
@@ -96,7 +94,7 @@ func TestVariant_RefusesFileOfNoOutputFormat(t *testing.T) {
 	}{
 		{"text", []byte("this is text, not an image"), magic.ErrUnknownFormat},
 		{"SVG", []byte(`<svg xmlns="http://www.w3.org/2000/svg"></svg>`),
-			magic.ErrUnknownFormat},
+			errNotAnOutputFormat},
 		{"JPEG cut to 10 bytes", jpegImage[:10], io.EOF},
 		{"empty", nil, io.EOF},
 	}
@@ -104,35 +102,123 @@ func TestVariant_RefusesFileOfNoOutputFormat(t *testing.T) {
 	for i, tt := range tests {
 		key := imagerequest.VariantKey(fmt.Sprintf("aabbccdd20%02d", i))
 
-		err := cache.variants.Write(string(key), tt.content)
+		_, err := cache.variants.Store(key, bytes.NewReader(tt.content))
 		if err != nil {
 			t.Fatalf("%s: storing the variant file: %v", tt.name, err)
 		}
 
-		reader, _, contentType, err := cache.Variant(key)
-		t.Logf("%s: Variant() error = %v", tt.name, err)
+		reader, _, contentType, err := cache.GetVariant(key)
+		t.Logf("%s: GetVariant() error = %v", tt.name, err)
 
 		if reader != nil || contentType != "" || !errors.Is(err, tt.wantErr) {
-			t.Errorf("%s: Variant() = reader %v, content type %q, error %v; "+
+			t.Errorf("%s: GetVariant() = reader %v, content type %q, error %v; "+
 				"want no reader and %v", tt.name, reader, contentType, err, tt.wantErr)
 		}
 	}
 
-	reader, _, _, err := cache.Variant(testVariantKeyFour)
+	reader, _, _, err := cache.GetVariant(testVariantKeyFour)
 	if reader != nil || !errors.Is(err, ErrNotFound) {
-		t.Errorf("Variant() of a variant with no file = reader %v, error %v; "+
+		t.Errorf("GetVariant() of a variant with no file = reader %v, error %v; "+
 			"want no reader and %v", reader, err, ErrNotFound)
 	}
 
 	disabled, _ := newEvictionTestCache(t, 0)
 
-	reader, _, _, err = disabled.Variant(testVariantKeyOne)
+	reader, _, _, err = disabled.GetVariant(testVariantKeyOne)
 	if reader != nil || !errors.Is(err, ErrNotFound) {
-		t.Errorf("Variant() on a disabled cache = reader %v, error %v; "+
+		t.Errorf("GetVariant() on a disabled cache = reader %v, error %v; "+
 			"want no reader and %v", reader, err, ErrNotFound)
 	}
 }
 
+// TestService_Get_MakesAgainVariantOfNoOutputFormat replaces a cached
+// variant's file with text, and checks that the next request is a miss
+// answered with the variant made again, and the one after a hit.
+func TestService_Get_MakesAgainVariantOfNoOutputFormat(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
+	req := photoVariant(fixtures, 85, imagerequest.FitCover)
+
+	want, _ := getImage(t, svc, req)
+
+	path := svc.cache.variants.keyToPath(imagerequest.CacheKey(req))
+
+	err := os.WriteFile(path, []byte("this is text, not an image"), StorageFilePerm)
+	if err != nil {
+		t.Fatalf("replacing the variant file: %v", err)
+	}
+
+	got, status := getImage(t, svc, req)
+	t.Logf("after the replacement: %d bytes, %s", len(got), status)
+
+	if status != CacheMiss || !bytes.Equal(got, want) {
+		t.Errorf("after the replacement: Get() = %d bytes, %s; want the %d bytes "+
+			"made again, %s", len(got), status, len(want), CacheMiss)
+	}
+
+	got, status = getImage(t, svc, req)
+
+	if status != CacheHit || !bytes.Equal(got, want) {
+		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
+			len(got), status, len(want), CacheHit)
+	}
+}
+
+// TestService_Get_HitWaitsForNoDatabaseWrite holds the database's one
+// connection while a cached variant is requested. The hit must be answered
+// while the connection is still held, and its access time must reach the
+// database once it is free.
+func TestService_Get_HitWaitsForNoDatabaseWrite(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
+	req := photoVariant(fixtures, 85, imagerequest.FitCover)
+	key := imagerequest.CacheKey(req)
+
+	getImage(t, svc, req)
+
+	// Each connection to an in-memory SQLite database opens a new, empty one,
+	// so the goroutine that writes the access times must share the
+	// connection that holds the schema.
+	svc.cache.db.SetMaxOpenConns(1)
+	svc.cache.StartPendingAccessTimeWrites()
+
+	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
+
+	anHourAgo := time.Now().Add(-time.Hour)
+	setVariantLastAccessed(t, svc.cache, key, anHourAgo)
+
+	releaseDatabase := holdDatabase(t, svc.cache)
+	defer releaseDatabase()
+
+	results := startGet(t.Context(), svc, req)
+
+	select {
+	case got := <-results:
+		if got.err != nil {
+			t.Fatalf("Get() of the cached variant error = %v", got.err)
+		}
+	case <-time.After(pendingAccessTimesWait):
+		t.Fatal("the cache hit waited for the database")
+	}
+
+	releaseDatabase()
+
+	deadline := time.Now().Add(pendingAccessTimesWait)
+
+	for countRows(t, svc.cache, `
+		SELECT COUNT(*) FROM variant_content
+		WHERE cache_key = ? AND last_accessed_at > ?
+	`, string(key), anHourAgo.UTC().Format(sqliteTimestampFormat)) == 0 {
+		if time.Now().After(deadline) {
+			t.Fatal("the hit's access time was not written")
+		}
+
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
 // TestTouchVariantAndTouchSourceContent_DropAccessTimesPastTheLimit hands one
 // more access time of a variant, and one more of a source, than may wait to
 // be written. touchVariant and touchSourceContent must return each time

internal/imgcache/cache_internal_test.go

@@ -50,10 +50,9 @@ func TestCache_CleanExpired(t *testing.T) {
 	tmpDir := t.TempDir()
 	db := setupTestDB(t)
 
-	cache, _ := NewCache(db, Config{
+	cache, _ := NewCache(db, CacheConfig{
 		StateDir:    tmpDir,
 		NegativeTTL: 1 * time.Millisecond,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 
 	ctx := context.Background()
@@ -103,9 +102,8 @@ func TestCache_StorageDirectoriesCreated(t *testing.T) {
 	tmpDir := t.TempDir()
 	db := setupTestDB(t)
 
-	_, err := NewCache(db, Config{
+	_, err := NewCache(db, CacheConfig{
 		StateDir: tmpDir,
-		MaxBytes: 1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("NewCache() error = %v", err)

internal/imgcache/cachesize.go

@@ -0,0 +1,85 @@
+package imgcache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"path/filepath"
+	"syscall"
+)
+
+// DefaultCacheMaxBytesFloor is the minimum computed default for the
+// cache_max_bytes setting: 500 MiB. The floor applies only to the
+// computed default (when the key is omitted from the configuration),
+// never to explicitly configured values.
+const DefaultCacheMaxBytesFloor int64 = 524288000
+
+// freeSpaceFractionNumerator and freeSpaceFractionDenominator express
+// the 75% share used for the computed default limit as integer
+// arithmetic (dividing before multiplying avoids overflow).
+const (
+	freeSpaceFractionNumerator   uint64 = 3
+	freeSpaceFractionDenominator uint64 = 4
+)
+
+var errNegativeBlockSize = errors.New("statfs reported negative block size")
+
+// FreeSpaceProbeFunc reports the number of free bytes available on the
+// filesystem containing path. It is a function type so tests can
+// inject a fake probe instead of depending on the host disk.
+type FreeSpaceProbeFunc func(path string) (uint64, error)
+
+// defaultFreeSpaceProbe reports free filesystem bytes via statfs on
+// the given path, as available to unprivileged processes.
+func defaultFreeSpaceProbe(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+
+	if stat.Bsize < 0 {
+		return 0, fmt.Errorf("%w %d for %q", errNegativeBlockSize, stat.Bsize, path)
+	}
+
+	blockSize := uint64(stat.Bsize)
+
+	return stat.Bavail * blockSize, nil
+}
+
+// computeDefaultMaxBytes returns the default cache size limit: 75% of
+// the sum of the free bytes probe reports for <state_dir>/cache/ and
+// the bytes the cache already holds, with a floor of
+// DefaultCacheMaxBytesFloor. Counting what the cache holds keeps the
+// limit from shrinking as the cache fills.
+func (c *Cache) computeDefaultMaxBytes(
+	ctx context.Context, probe FreeSpaceProbeFunc,
+) (int64, error) {
+	cacheDir := filepath.Join(c.config.StateDir, "cache")
+
+	freeBytes, err := probe(cacheDir)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"default cache_max_bytes: cannot determine free space for %q: %w",
+			cacheDir, err)
+	}
+
+	usedBytes, err := c.UsageBytes(ctx)
+	if err != nil {
+		return 0, err
+	}
+
+	// Both terms are at most math.MaxInt64, so the sum cannot overflow.
+	//nolint:gosec // G115: UsageBytes returns the total cache usage, never negative
+	spaceBytes := min(freeBytes, math.MaxInt64) + uint64(usedBytes)
+
+	computed := spaceBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
+	computed = min(computed, math.MaxInt64)
+
+	limit := int64(computed)
+	limit = max(limit, DefaultCacheMaxBytesFloor)
+
+	return limit, nil
+}

internal/imgcache/cachesize_internal_test.go

@@ -0,0 +1,189 @@
+package imgcache
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// Static errors returned by the stub free-space probes below.
+var (
+	errTestStatfsFailed     = errors.New("statfs failed")
+	errTestProbeNotExpected = errors.New("probe must not be called")
+)
+
+// TestComputeDefaultMaxBytesCountsWhatTheCacheHolds verifies that the
+// default limit is 75% of the free space plus what the cache already
+// holds, so a cache filled to its limit keeps that limit across a
+// restart instead of shrinking to 75% of the space left free.
+func TestComputeDefaultMaxBytesCountsWhatTheCacheHolds(t *testing.T) {
+	t.Parallel()
+
+	cache, _ := newEvictionTestCache(t, 1<<30)
+
+	// Empty cache, 4 GiB free -> 3 GiB default.
+	got, err := cache.computeDefaultMaxBytes(t.Context(),
+		func(string) (uint64, error) { return 4294967296, nil })
+	if err != nil {
+		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
+	}
+
+	t.Logf("default for an empty cache with 4 GiB free: %d", got)
+
+	if got != 3221225472 {
+		t.Errorf("default for an empty cache = %d, want 3221225472 (75%% of 4 GiB)",
+			got)
+	}
+
+	// The cache now holds those 3 GiB, which leaves 1 GiB free.
+	_, err = cache.db.ExecContext(t.Context(),
+		`INSERT INTO variant_content (cache_key, size_bytes) VALUES (?, ?)`,
+		string(testVariantKeyOne), 3221225472,
+	)
+	if err != nil {
+		t.Fatalf("failed to insert variant accounting row: %v", err)
+	}
+
+	got, err = cache.computeDefaultMaxBytes(t.Context(),
+		func(string) (uint64, error) { return 1073741824, nil })
+	if err != nil {
+		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
+	}
+
+	t.Logf("default for a cache holding 3 GiB with 1 GiB free: %d", got)
+
+	if got != 3221225472 {
+		t.Errorf("default for a cache holding 3 GiB with 1 GiB free = %d, "+
+			"want 3221225472 (75%% of 1 GiB + 3 GiB)", got)
+	}
+}
+
+// TestComputeDefaultMaxBytesAppliesFloor verifies that when 75% of the
+// free space plus what the cache holds is below 500 MiB, the default
+// is floored at DefaultCacheMaxBytesFloor.
+func TestComputeDefaultMaxBytesAppliesFloor(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name      string
+		freeBytes uint64
+	}{
+		{name: "100 MiB free", freeBytes: 104857600},
+		{name: "zero free", freeBytes: 0},
+		{name: "just below floor threshold", freeBytes: 699050665},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			cache, _ := newEvictionTestCache(t, 1<<30)
+
+			got, err := cache.computeDefaultMaxBytes(t.Context(),
+				func(string) (uint64, error) { return tc.freeBytes, nil })
+			if err != nil {
+				t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
+			}
+
+			if got != DefaultCacheMaxBytesFloor {
+				t.Errorf("computeDefaultMaxBytes = %d, want floor %d",
+					got, DefaultCacheMaxBytesFloor)
+			}
+		})
+	}
+}
+
+// TestComputeDefaultMaxBytesPropagatesProbeError verifies that a
+// failing free-space probe produces an error naming cache_max_bytes,
+// instead of a silently wrong default.
+func TestComputeDefaultMaxBytesPropagatesProbeError(t *testing.T) {
+	t.Parallel()
+
+	cache, _ := newEvictionTestCache(t, 1<<30)
+
+	_, err := cache.computeDefaultMaxBytes(t.Context(),
+		func(string) (uint64, error) { return 0, errTestStatfsFailed })
+	if err == nil {
+		t.Fatal("probe failure must produce an error, got nil")
+	}
+
+	t.Logf("got expected error: %v", err)
+
+	if !strings.Contains(err.Error(), "cache_max_bytes") {
+		t.Errorf("error %q does not name cache_max_bytes", err.Error())
+	}
+}
+
+// TestNewCacheComputesDefaultMaxBytesWhenAsked verifies that with
+// UseDefaultMaxBytes set, the cache's limit becomes the computed
+// default, and that the probe is pointed at <state_dir>/cache/, which
+// must be created first so statfs measures the right filesystem.
+func TestNewCacheComputesDefaultMaxBytesWhenAsked(t *testing.T) {
+	t.Parallel()
+
+	stateDir := t.TempDir()
+	wantCacheDir := filepath.Join(stateDir, "cache")
+
+	var probedPath string
+
+	// 4 GiB free -> 3 GiB default.
+	probe := func(path string) (uint64, error) {
+		probedPath = path
+
+		info, err := os.Stat(path)
+		if err != nil || !info.IsDir() {
+			t.Errorf("cache directory %q was not created before probing: info=%v err=%v",
+				path, info, err)
+		}
+
+		return 4294967296, nil
+	}
+
+	cache, err := newCache(evictionTestDB(t), CacheConfig{
+		StateDir:           stateDir,
+		UseDefaultMaxBytes: true,
+	}, prometheus.NewRegistry(), probe)
+	if err != nil {
+		t.Fatalf("newCache returned error: %v", err)
+	}
+
+	if cache.config.MaxBytes != 3221225472 {
+		t.Errorf("MaxBytes = %d, want computed default 3221225472",
+			cache.config.MaxBytes)
+	}
+
+	if probedPath != wantCacheDir {
+		t.Errorf("free space probed at %q, want cache directory %q",
+			probedPath, wantCacheDir)
+	}
+}
+
+// TestNewCacheKeepsExplicitMaxBytes verifies that without
+// UseDefaultMaxBytes the cache keeps MaxBytes exactly as given and
+// never consults the free-space probe.
+func TestNewCacheKeepsExplicitMaxBytes(t *testing.T) {
+	t.Parallel()
+
+	probe := func(string) (uint64, error) {
+		t.Error("free-space probe must not be consulted for explicit values")
+
+		return 0, errTestProbeNotExpected
+	}
+
+	cache, err := newCache(evictionTestDB(t), CacheConfig{
+		StateDir: t.TempDir(),
+		MaxBytes: 1024,
+	}, prometheus.NewRegistry(), probe)
+	if err != nil {
+		t.Fatalf("newCache returned error: %v", err)
+	}
+
+	if cache.config.MaxBytes != 1024 {
+		t.Errorf("MaxBytes = %d, want explicit 1024 (no floor, no recompute)",
+			cache.config.MaxBytes)
+	}
+}

internal/imgcache/concurrent_misses_internal_test.go

@@ -1,4 +1,4 @@
-package imageproxy
+package imgcache
 
 import (
 	"bytes"
@@ -36,7 +36,7 @@ type heldFetcher struct {
 }
 
 func (f *heldFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
+	ctx context.Context, url string,
 ) (*httpfetcher.FetchResult, error) {
 	f.fetches.Add(1)
 
@@ -48,7 +48,7 @@ func (f *heldFetcher) Fetch(
 		return nil, ctx.Err()
 	}
 
-	return f.upstream.Fetch(ctx, source)
+	return f.upstream.Fetch(ctx, url)
 }
 
 // releaseFetches lets every held fetch, and every later one, go on.
@@ -56,15 +56,15 @@ func (f *heldFetcher) releaseFetches() {
 	f.releaseOnce.Do(func() { close(f.release) })
 }
 
-// setupHeldFetchProxy returns a test proxy whose fetches go through a
+// setupHeldFetchService returns a test service whose fetches go through a
 // heldFetcher. Its database is limited to one connection: each connection to
 // an in-memory SQLite database opens a new, empty one, so requests running at
 // once must share the connection that holds the schema.
-func setupHeldFetchProxy(t *testing.T) (*testProxy, *TestFixtures, *heldFetcher) {
+func setupHeldFetchService(t *testing.T) (*Service, *TestFixtures, *heldFetcher) {
 	t.Helper()
 
-	svc, fixtures := setupTestProxy(t)
-	svc.db.SetMaxOpenConns(1)
+	svc, fixtures := SetupTestService(t)
+	svc.cache.db.SetMaxOpenConns(1)
 
 	fetcher := &heldFetcher{
 		upstream: svc.fetcher,
@@ -79,8 +79,8 @@ func setupHeldFetchProxy(t *testing.T) (*testProxy, *TestFixtures, *heldFetcher)
 }
 
 // photoVariant asks for the test photo, 100x100, at 50x25 as a JPEG of the
-// given quality and fit mode. Each call returns a new request, which a test
-// may change.
+// given quality and fit mode. Each call returns a new request, as Get writes
+// to the request it is given.
 func photoVariant(
 	fixtures *TestFixtures, quality int, fit imagerequest.Fit,
 ) *imagerequest.Request {
@@ -107,7 +107,7 @@ type getResult struct {
 // startGet calls Get in a goroutine of its own and delivers what it returned
 // on the channel.
 func startGet(
-	ctx context.Context, svc *testProxy, req *imagerequest.Request,
+	ctx context.Context, svc *Service, req *imagerequest.Request,
 ) <-chan getResult {
 	results := make(chan getResult, 1)
 
@@ -139,14 +139,14 @@ func jpegSize(data []byte) (int, int) {
 	return config.Width, config.Height
 }
 
-// TestProxy_Get_ConcurrentMissesShareOneFetch starts several requests for
+// TestService_Get_ConcurrentMissesShareOneFetch starts several requests for
 // one uncached variant while the first one's fetch is held. Between them they
 // must fetch the source once and transcode it once, every one must be answered
 // with the same 50x25 JPEG, and each must count one miss.
-func TestProxy_Get_ConcurrentMissesShareOneFetch(t *testing.T) {
+func TestService_Get_ConcurrentMissesShareOneFetch(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 
 	const requests = 8
 
@@ -183,7 +183,7 @@ func TestProxy_Get_ConcurrentMissesShareOneFetch(t *testing.T) {
 		t.Errorf("%d requests made %d upstream fetches, want 1", requests, fetches)
 	}
 
-	// NewTestFS builds the same files the test proxy's fetcher serves.
+	// NewTestFS builds the same files the test service's fetcher serves.
 	testFS, _ := NewTestFS(t)
 
 	photo, err := fs.ReadFile(testFS, fixtures.GoodHostJPEG)
@@ -193,18 +193,18 @@ func TestProxy_Get_ConcurrentMissesShareOneFetch(t *testing.T) {
 
 	want := counterValues{0, requests, 1, int64(len(photo)), 1}
 
-	if got := readCounters(t, svc); got != want {
+	if got := readCounters(svc.cache); got != want {
 		t.Errorf("counters = %+v, want %+v", got, want)
 	}
 }
 
-// TestProxy_Get_ConcurrentVariantsStayApart requests three variants of the
+// TestService_Get_ConcurrentVariantsStayApart requests three variants of the
 // test photo at once that differ only in quality or fit. Each must be made by
 // a fetch and a transcode of its own, and each answer must be its own variant.
-func TestProxy_Get_ConcurrentVariantsStayApart(t *testing.T) {
+func TestService_Get_ConcurrentVariantsStayApart(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 
 	cover := startGet(t.Context(), svc, photoVariant(fixtures, 85, imagerequest.FitCover))
 	lowQuality := startGet(t.Context(), svc,
@@ -253,14 +253,14 @@ func TestProxy_Get_ConcurrentVariantsStayApart(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_WaiterStopsWhenItsContextEnds has a second request for a
+// TestService_Get_WaiterStopsWhenItsContextEnds has a second request for a
 // variant join the first one's held fetch, then ends the second request's
 // context. The second request must return at once with the context's error,
 // while the fetch is still held, and the first must still be answered.
-func TestProxy_Get_WaiterStopsWhenItsContextEnds(t *testing.T) {
+func TestService_Get_WaiterStopsWhenItsContextEnds(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 
 	first := startGet(t.Context(), svc, photoVariant(fixtures, 85, imagerequest.FitCover))
 
@@ -298,15 +298,15 @@ func TestProxy_Get_WaiterStopsWhenItsContextEnds(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_FirstRequestLeavingKeepsTheWork ends the context of the
+// TestService_Get_FirstRequestLeavingKeepsTheWork ends the context of the
 // request whose fetch is held, after a second request has joined it. The fetch
 // and transcode must go on and answer the second request. The first request
 // waits for its own work, as every request did before misses were shared, and
 // is answered too.
-func TestProxy_Get_FirstRequestLeavingKeepsTheWork(t *testing.T) {
+func TestService_Get_FirstRequestLeavingKeepsTheWork(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 
 	firstCtx, cancelFirst := context.WithCancel(t.Context())
 	first := startGet(firstCtx, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
@@ -337,11 +337,11 @@ func TestProxy_Get_FirstRequestLeavingKeepsTheWork(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_ConcurrentMissesShareAFailure has several requests for an
+// TestService_Get_ConcurrentMissesShareAFailure has several requests for an
 // image that cannot be served arrive while its fetch is held: the one fetch
 // answers all of them with its error. The request after them is answered from
 // the negative cache, where the failure is kept.
-func TestProxy_Get_ConcurrentMissesShareAFailure(t *testing.T) {
+func TestService_Get_ConcurrentMissesShareAFailure(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -362,7 +362,7 @@ func TestProxy_Get_ConcurrentMissesShareAFailure(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			svc, fixtures, fetcher := setupHeldFetchProxy(t)
+			svc, fixtures, fetcher := setupHeldFetchService(t)
 
 			request := func() *imagerequest.Request {
 				req := photoVariant(fixtures, 85, imagerequest.FitCover)
@@ -398,12 +398,12 @@ func TestProxy_Get_ConcurrentMissesShareAFailure(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_EndedRequestFetchesNothing checks that a request whose
+// TestService_Get_EndedRequestFetchesNothing checks that a request whose
 // context has already ended when it misses the cache starts no fetch.
-func TestProxy_Get_EndedRequestFetchesNothing(t *testing.T) {
+func TestService_Get_EndedRequestFetchesNothing(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 
 	ctx, cancel := context.WithCancel(t.Context())
 	cancel()
@@ -418,14 +418,14 @@ func TestProxy_Get_EndedRequestFetchesNothing(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_ReturnsByItsDeadline gives a request a deadline and holds
+// TestService_Get_ReturnsByItsDeadline gives a request a deadline and holds
 // its fetch until the fetch's context ends, as the fetcher does while it waits
 // for a free connection to the host. The request must return by its deadline
 // with the deadline's error.
-func TestProxy_Get_ReturnsByItsDeadline(t *testing.T) {
+func TestService_Get_ReturnsByItsDeadline(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, _ := setupHeldFetchProxy(t)
+	svc, fixtures, _ := setupHeldFetchService(t)
 
 	const timeout = 200 * time.Millisecond
 
@@ -444,18 +444,18 @@ func TestProxy_Get_ReturnsByItsDeadline(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_WaiterGetsProcessingTimedOut has a request with no deadline
+// TestService_Get_WaiterGetsProcessingTimedOut has a request with no deadline
 // join the held fetch of a first request with a short one. With the only
 // processing slot held, the first request's transcode waits for it until the
 // first request's deadline ends, and stops then. The waiting request, whose
 // own context has not ended, must get ErrProcessingTimedOut, which the image
 // routes answer 503 as when pixa is busy.
-func TestProxy_Get_WaiterGetsProcessingTimedOut(t *testing.T) {
+func TestService_Get_WaiterGetsProcessingTimedOut(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
+	svc, fixtures, fetcher := setupHeldFetchService(t)
 	svc.processor = imageprocessor.New(
-		imageprocessor.Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1},
+		imageprocessor.Params{MaxConcurrentProcessing: 1},
 	)
 
 	holdProcessingSlot(t, svc.processor)
@@ -489,18 +489,18 @@ func TestProxy_Get_WaiterGetsProcessingTimedOut(t *testing.T) {
 type panickingFetcher struct{}
 
 func (panickingFetcher) Fetch(
-	context.Context, imagerequest.Source,
+	context.Context, string,
 ) (*httpfetcher.FetchResult, error) {
 	panic("upstream fetcher panicked")
 }
 
-// TestProxy_Get_PanicBecomesAnError checks that a panic while a variant is
+// TestService_Get_PanicBecomesAnError checks that a panic while a variant is
 // being made reaches its request as an error naming the panic, instead of
 // being raised again.
-func TestProxy_Get_PanicBecomesAnError(t *testing.T) {
+func TestService_Get_PanicBecomesAnError(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	svc.fetcher = panickingFetcher{}
 
 	var err error
@@ -520,13 +520,13 @@ func TestProxy_Get_PanicBecomesAnError(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_PanicIsReportedToSentry checks that a panic while a variant
+// TestService_Get_PanicIsReportedToSentry checks that a panic while a variant
 // is being made is reported through the Sentry hub on the request's context,
 // where the Sentry middleware puts one when sentry_dsn is set.
-func TestProxy_Get_PanicIsReportedToSentry(t *testing.T) {
+func TestService_Get_PanicIsReportedToSentry(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	svc.fetcher = panickingFetcher{}
 
 	transport := &sentry.MockTransport{}

internal/imgcache/counters.go

@@ -19,8 +19,22 @@ func (c *Cache) registerCounters(metricsRegistry prometheus.Registerer) error {
 		Name: "pixa_cache_misses_total",
 		Help: "Image requests not served from the cache.",
 	})
+	c.upstreamFetches = prometheus.NewCounter(prometheus.CounterOpts{
+		Name: "pixa_upstream_fetches_total",
+		Help: "Fetches of a source image from upstream that read any bytes.",
+	})
+	c.upstreamFetchBytes = prometheus.NewCounter(prometheus.CounterOpts{
+		Name: "pixa_upstream_fetch_bytes_total",
+		Help: "Bytes read from upstream by fetches of source images.",
+	})
+	c.transforms = prometheus.NewCounter(prometheus.CounterOpts{
+		Name: "pixa_transforms_total",
+		Help: "Images the image processor transformed.",
+	})
 
-	for _, counter := range []prometheus.Counter{c.cacheHits, c.cacheMisses} {
+	for _, counter := range []prometheus.Counter{
+		c.cacheHits, c.cacheMisses, c.upstreamFetches, c.upstreamFetchBytes, c.transforms,
+	} {
 		err := metricsRegistry.Register(counter)
 		if err != nil {
 			return fmt.Errorf("failed to register the cache's counters: %w", err)

internal/imgcache/counters_internal_test.go

@@ -8,6 +8,26 @@ import (
 	"github.com/prometheus/client_golang/prometheus/testutil"
 )
 
+// counterValues holds the values of a cache's counters.
+type counterValues struct {
+	hitCount           int64
+	missCount          int64
+	upstreamFetchCount int64
+	upstreamFetchBytes int64
+	transformCount     int64
+}
+
+// readCounters reads cache's counters.
+func readCounters(cache *Cache) counterValues {
+	return counterValues{
+		hitCount:           int64(testutil.ToFloat64(cache.cacheHits)),
+		missCount:          int64(testutil.ToFloat64(cache.cacheMisses)),
+		upstreamFetchCount: int64(testutil.ToFloat64(cache.upstreamFetches)),
+		upstreamFetchBytes: int64(testutil.ToFloat64(cache.upstreamFetchBytes)),
+		transformCount:     int64(testutil.ToFloat64(cache.transforms)),
+	}
+}
+
 // TestNewCache_RegistersItsCountersOnItsRegistry checks that NewCache
 // registers the cache's counters on the registry it is given, under the
 // names README.md gives them.
@@ -16,8 +36,7 @@ func TestNewCache_RegistersItsCountersOnItsRegistry(t *testing.T) {
 
 	registry := prometheus.NewRegistry()
 
-	_, err := NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30}, registry)
+	_, err := NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()}, registry)
 	if err != nil {
 		t.Fatalf("NewCache() error = %v", err)
 	}
@@ -25,6 +44,9 @@ func TestNewCache_RegistersItsCountersOnItsRegistry(t *testing.T) {
 	names := []string{
 		"pixa_cache_hits_total",
 		"pixa_cache_misses_total",
+		"pixa_upstream_fetches_total",
+		"pixa_upstream_fetch_bytes_total",
+		"pixa_transforms_total",
 	}
 
 	count, err := testutil.GatherAndCount(registry, names...)
@@ -46,14 +68,12 @@ func TestNewCache_FailsWhenItsCountersCannotBeRegistered(t *testing.T) {
 
 	registry := prometheus.NewRegistry()
 
-	_, err := NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30}, registry)
+	_, err := NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()}, registry)
 	if err != nil {
 		t.Fatalf("NewCache() of the first cache error = %v", err)
 	}
 
-	_, err = NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30}, registry)
+	_, err = NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()}, registry)
 	t.Logf("NewCache() of the second cache error = %v", err)
 
 	var alreadyRegistered prometheus.AlreadyRegisteredError

internal/imgcache/divzero_internal_test.go

@@ -1,4 +1,4 @@
-package imageproxy
+package imgcache
 
 import (
 	"fmt"

internal/imgcache/eviction.go

@@ -48,29 +48,22 @@ const staleTempFileAge = time.Hour
 const sqliteTimestampLayout = "2006-01-02 15:04:05"
 
 // tempFilePrefix is the prefix os.CreateTemp uses for in-flight cache
-// writes (the ".tmp-*" pattern in writeFileSynced).
+// writes (".tmp-*" patterns in the storage layer).
 const tempFilePrefix = ".tmp-"
 
 // UsageBytes returns the total number of bytes of cache content
-// tracked in the database, as the package function UsageBytes does, or 0
-// when the disk cache is off.
+// tracked in the database (source content blobs plus processed
+// variants). It reads the total the database keeps up to date as rows
+// are added and removed, so it neither scans the cache directories nor
+// sums the tables.
 func (c *Cache) UsageBytes(ctx context.Context) (int64, error) {
-	if c.config.MaxBytes == 0 {
+	if c.disabled {
 		return 0, nil
 	}
 
-	return UsageBytes(ctx, c.db)
-}
-
-// UsageBytes returns the total number of bytes of cache content tracked
-// in db (source content blobs plus processed variants). It reads the
-// total the database keeps up to date as rows are added and removed, so
-// it neither scans the cache directories nor sums the tables. pixad reads
-// it before it builds the cache, to work out the default cache_max_bytes.
-func UsageBytes(ctx context.Context, db *sql.DB) (int64, error) {
 	var total int64
 
-	err := db.QueryRowContext(ctx,
+	err := c.db.QueryRowContext(ctx,
 		`SELECT total_size_bytes FROM cache_usage WHERE id = 1`,
 	).Scan(&total)
 	if err != nil {
@@ -93,9 +86,9 @@ type evictionCandidate struct {
 
 // EvictToLimit evicts least-recently-used cache entries until total
 // tracked usage is at or below the configured MaxBytes limit. It is a
-// no-op when the cache is disabled.
+// no-op when the cache is disabled or no limit is configured.
 func (c *Cache) EvictToLimit(ctx context.Context) error {
-	if c.config.MaxBytes == 0 {
+	if c.disabled || c.config.MaxBytes <= 0 {
 		return nil
 	}
 
@@ -306,7 +299,7 @@ func (c *Cache) evictVariant(
 		return fmt.Errorf("failed to delete variant accounting row: %w", err)
 	}
 
-	err = c.variants.Delete(string(cacheKey))
+	err = c.variants.Delete(cacheKey)
 	if err != nil {
 		return err
 	}
@@ -317,7 +310,7 @@ func (c *Cache) evictVariant(
 // evictSourceBlob removes one source: its row first, then its file, as
 // evictVariant does for a variant. It holds no lock: a store of the same
 // source in between can leave the source's row with no file, which
-// Source treats as a miss.
+// LookupSource treats as a miss.
 func (c *Cache) evictSourceBlob(ctx context.Context, key imagerequest.SourceKey) error {
 	_, err := c.db.ExecContext(ctx,
 		`DELETE FROM source_content WHERE source_key = ?`, string(key))
@@ -325,7 +318,7 @@ func (c *Cache) evictSourceBlob(ctx context.Context, key imagerequest.SourceKey)
 		return fmt.Errorf("failed to delete source content row: %w", err)
 	}
 
-	return c.srcContent.Delete(string(key))
+	return c.srcContent.Delete(key)
 }
 
 // notifyWritePressure wakes the background evictor after a store, so
@@ -333,7 +326,7 @@ func (c *Cache) evictSourceBlob(ctx context.Context, key imagerequest.SourceKey)
 // storing request. The notification channel has capacity one and drops
 // when a wakeup is already pending.
 func (c *Cache) notifyWritePressure() {
-	if c.config.MaxBytes == 0 {
+	if c.disabled || c.config.MaxBytes <= 0 {
 		return
 	}
 
@@ -479,7 +472,7 @@ func (c *Cache) runCleanExpired(ctx context.Context) {
 // then on the first periodic eviction tick that comes at least ten times
 // as long after the last pass ended as that pass took, off the request
 // hot path: it adopts variant files that predate the accounting table
-// (or whose accounting insert failed, e.g. PutVariant's best-effort
+// (or whose accounting insert failed, e.g. StoreVariant's best-effort
 // insert under transient DB contention), drops variant accounting rows
 // whose files are missing, removes source blob files the database does
 // not know, removes source and variant files that are empty or not the
@@ -492,7 +485,7 @@ func (c *Cache) runCleanExpired(ctx context.Context) {
 // Once ctx is cancelled, it stops at the next file or row and returns
 // ctx's error.
 func (c *Cache) reconcileAccounting(ctx context.Context) error {
-	if c.config.MaxBytes == 0 {
+	if c.disabled {
 		return nil
 	}
 
@@ -515,15 +508,12 @@ func (c *Cache) reconcileAccounting(ctx context.Context) error {
 }
 
 // reconcileFiles walks baseDir, one of the cache's storage directories,
-// sweeping stale temp files and passing each other file, with its info and
-// name, to reconcileFile. It skips a directory it cannot list and a file
-// whose info it cannot read, so one such entry does not stop the pass. It
-// logs a warning naming the path and the error. A file renamed or removed
-// after its directory was listed is skipped with no warning. Once ctx is
-// cancelled it stops at the next file and returns ctx's error.
+// sweeping stale temp files and passing each other file, with its name, to
+// reconcileFile. Once ctx is cancelled it stops at the next file and
+// returns ctx's error.
 func (c *Cache) reconcileFiles(
 	ctx context.Context, baseDir string,
-	reconcileFile func(path string, info fs.FileInfo, name string) error,
+	reconcileFile func(path string, entry fs.DirEntry, name string) error,
 ) error {
 	return filepath.WalkDir(
 		baseDir,
@@ -532,38 +522,19 @@ func (c *Cache) reconcileFiles(
 				return ctx.Err()
 			}
 
-			if err != nil {
-				c.log.Warn("skipped unreadable entry in cache directory",
-					"path", path, "error", err)
-
-				return nil
-			}
-
-			if entry.IsDir() {
-				return nil
-			}
-
-			info, err := entry.Info()
-			if errors.Is(err, fs.ErrNotExist) {
-				return nil
-			}
-
-			if err != nil {
-				c.log.Warn("skipped unreadable entry in cache directory",
-					"path", path, "error", err)
-
-				return nil
+			if err != nil || entry.IsDir() {
+				return err
 			}
 
 			name := entry.Name()
 
 			if strings.HasPrefix(name, tempFilePrefix) {
-				c.sweepStaleTempFile(path, info)
+				c.sweepStaleTempFile(path, entry)
 
 				return nil
 			}
 
-			return reconcileFile(path, info, name)
+			return reconcileFile(path, entry, name)
 		},
 	)
 }
@@ -573,8 +544,8 @@ func (c *Cache) reconcileFiles(
 // and sweeping stale temp files.
 func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
 	return c.reconcileFiles(ctx, c.variants.baseDir,
-		func(path string, info fs.FileInfo, name string) error {
-			return c.reconcileVariantFile(ctx, path, info, imagerequest.VariantKey(name))
+		func(path string, entry fs.DirEntry, name string) error {
+			return c.reconcileVariantFile(ctx, path, entry, imagerequest.VariantKey(name))
 		})
 }
 
@@ -584,11 +555,16 @@ func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
 // crash or a restored snapshot can leave it, is removed with its row and
 // a warning naming it, so the variant is converted again.
 func (c *Cache) reconcileVariantFile(
-	ctx context.Context, path string, info fs.FileInfo, cacheKey imagerequest.VariantKey,
+	ctx context.Context, path string, entry fs.DirEntry, cacheKey imagerequest.VariantKey,
 ) error {
+	info, err := entry.Info()
+	if err != nil {
+		return fmt.Errorf("failed to stat variant file: %w", err)
+	}
+
 	var recordedSize int64
 
-	err := c.db.QueryRowContext(ctx,
+	err = c.db.QueryRowContext(ctx,
 		`SELECT size_bytes FROM variant_content WHERE cache_key = ?`, string(cacheKey),
 	).Scan(&recordedSize)
 
@@ -630,9 +606,7 @@ func (c *Cache) adoptVariantFile(
 }
 
 // reconcileVariantRows drops accounting rows whose variant files are
-// missing, so the database never references deleted content. A file whose
-// size cannot be read for another reason may still be on disk, so its row
-// stays, with a warning naming its key and the error.
+// missing, so the database never references deleted content.
 func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 	var after imagerequest.VariantKey
 
@@ -655,19 +629,11 @@ func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 				return ctx.Err()
 			}
 
-			_, err := c.variants.Size(string(key))
-			if err == nil {
+			if c.variants.Exists(key) {
 				continue
 			}
 
-			if !errors.Is(err, ErrNotFound) {
-				c.log.Warn("kept accounting row for unreadable variant file",
-					"cache_key", key, "error", err)
-
-				continue
-			}
-
-			_, err = c.db.ExecContext(ctx,
+			_, err := c.db.ExecContext(ctx,
 				`DELETE FROM variant_content WHERE cache_key = ?`, string(key))
 			if err != nil {
 				return fmt.Errorf("failed to drop stale variant accounting row: %w", err)
@@ -731,8 +697,8 @@ func queryStringColumn[T ~string](
 // and sweeping stale temp files.
 func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
 	return c.reconcileFiles(ctx, c.srcContent.baseDir,
-		func(path string, info fs.FileInfo, name string) error {
-			return c.reconcileSourceFile(ctx, path, info, imagerequest.SourceKey(name))
+		func(path string, entry fs.DirEntry, name string) error {
+			return c.reconcileSourceFile(ctx, path, entry, imagerequest.SourceKey(name))
 		})
 }
 
@@ -743,11 +709,16 @@ func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
 // is removed with its row and a warning naming it, so the source is
 // fetched again.
 func (c *Cache) reconcileSourceFile(
-	ctx context.Context, path string, info fs.FileInfo, key imagerequest.SourceKey,
+	ctx context.Context, path string, entry fs.DirEntry, key imagerequest.SourceKey,
 ) error {
+	info, err := entry.Info()
+	if err != nil {
+		return fmt.Errorf("failed to stat source content file: %w", err)
+	}
+
 	var recordedSize int64
 
-	err := c.db.QueryRowContext(ctx,
+	err = c.db.QueryRowContext(ctx,
 		`SELECT size_bytes FROM source_content WHERE source_key = ?`,
 		string(key),
 	).Scan(&recordedSize)
@@ -912,12 +883,17 @@ func (c *Cache) correctUsageTotal(
 
 // sweepStaleTempFile removes a temp file left behind by a crashed
 // write once it is old enough that no in-flight store can own it.
-func (c *Cache) sweepStaleTempFile(path string, info fs.FileInfo) {
+func (c *Cache) sweepStaleTempFile(path string, entry fs.DirEntry) {
+	info, err := entry.Info()
+	if err != nil {
+		return
+	}
+
 	if time.Since(info.ModTime()) < staleTempFileAge {
 		return
 	}
 
-	err := os.Remove(path)
+	err = os.Remove(path)
 	if err != nil && !os.IsNotExist(err) {
 		c.log.Warn("failed to remove stale temp file", "path", path, "error", err)
 

internal/imgcache/eviction_internal_test.go

@@ -9,10 +9,8 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"sync"
-	"syscall"
 	"testing"
 	"time"
 
@@ -68,11 +66,15 @@ func newEvictionTestCache(t *testing.T, maxBytes int64) (*Cache, string) {
 	tmpDir := t.TempDir()
 	db := evictionTestDB(t)
 
-	// maxBytes zero turns the disk cache off, as cache_max_bytes: 0 does.
-	cache, err := NewCache(db, Config{
-		StateDir:    tmpDir,
-		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    maxBytes,
+	// maxBytes zero mirrors the production mapping of
+	// cache_max_bytes: 0 (handlers sets DisableDiskCache); at the
+	// CacheConfig layer itself a zero MaxBytes means "no limit" for
+	// backwards compatibility with existing fixtures.
+	cache, err := NewCache(db, CacheConfig{
+		StateDir:         tmpDir,
+		NegativeTTL:      5 * time.Minute,
+		MaxBytes:         maxBytes,
+		DisableDiskCache: maxBytes == 0,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
@@ -100,11 +102,11 @@ func storeEvictionTestSource(
 		},
 	}
 
-	key, err := cache.PutSource(
-		context.Background(), req.Source, bytes.NewReader(content),
+	key, err := cache.StoreSource(
+		context.Background(), req, bytes.NewReader(content),
 	)
 	if err != nil {
-		t.Fatalf("PutSource(%s%s) failed: %v", host, path, err)
+		t.Fatalf("StoreSource(%s%s) failed: %v", host, path, err)
 	}
 
 	return key
@@ -117,9 +119,9 @@ func storeEvictionTestVariant(
 ) {
 	t.Helper()
 
-	err := cache.PutVariant(t.Context(), key, bytes.NewReader(content))
+	err := cache.StoreVariant(t.Context(), key, bytes.NewReader(content))
 	if err != nil {
-		t.Fatalf("PutVariant(%s) failed: %v", key, err)
+		t.Fatalf("StoreVariant(%s) failed: %v", key, err)
 	}
 }
 
@@ -211,8 +213,7 @@ func assertNoDanglingReferences(t *testing.T, cache *Cache) {
 			t.Fatalf("failed to scan source_key: %v", err)
 		}
 
-		_, err = os.Stat(cache.srcContent.keyToPath(key))
-		if err != nil {
+		if !cache.srcContent.Exists(imagerequest.SourceKey(key)) {
 			t.Errorf("source_content references content %s but the file is missing",
 				key)
 		}
@@ -239,8 +240,7 @@ func assertNoDanglingReferences(t *testing.T, cache *Cache) {
 			t.Fatalf("failed to scan cache_key: %v", err)
 		}
 
-		_, err = os.Stat(cache.variants.keyToPath(key))
-		if err != nil {
+		if !cache.variants.Exists(imagerequest.VariantKey(key)) {
 			t.Errorf("variant_content references key %s but the file is missing", key)
 		}
 	}
@@ -338,8 +338,7 @@ func TestEvictToLimitEvictsLeastRecentlyUsedFirst(t *testing.T) {
 		t.Errorf("usage after eviction = %d, want <= %d", usage, limit)
 	}
 
-	_, err = os.Stat(cache.variants.keyToPath(string(keys[0])))
-	if err == nil {
+	if cache.variants.Exists(keys[0]) {
 		t.Errorf("least recently used variant %s must be evicted", keys[0])
 	}
 
@@ -350,8 +349,7 @@ func TestEvictToLimitEvictsLeastRecentlyUsedFirst(t *testing.T) {
 	}
 
 	for _, key := range keys[1:] {
-		_, err = os.Stat(cache.variants.keyToPath(string(key)))
-		if err != nil {
+		if !cache.variants.Exists(key) {
 			t.Errorf("more recently used variant %s must survive eviction", key)
 		}
 	}
@@ -379,8 +377,7 @@ func TestEvictionKeepsEverythingWhenUnderLimit(t *testing.T) {
 	}
 
 	for _, key := range keys {
-		_, err = os.Stat(cache.srcContent.keyToPath(string(key)))
-		if err != nil {
+		if !cache.srcContent.Exists(key) {
 			t.Errorf("source %s must not be evicted while usage is under the limit", key)
 		}
 
@@ -391,8 +388,7 @@ func TestEvictionKeepsEverythingWhenUnderLimit(t *testing.T) {
 		}
 	}
 
-	_, err = os.Stat(cache.variants.keyToPath(string(testVariantKeyOne)))
-	if err != nil {
+	if !cache.variants.Exists(testVariantKeyOne) {
 		t.Error("variant must not be evicted while usage is under the limit")
 	}
 
@@ -431,20 +427,20 @@ func assertDisabledCacheWritesAreNoOps(
 
 	ctx := t.Context()
 
-	err := cache.PutVariant(
+	err := cache.StoreVariant(
 		ctx, imagerequest.CacheKey(req), bytes.NewReader([]byte("data")),
 	)
 	if err != nil {
-		t.Fatalf("PutVariant on disabled cache must be a no-op, got error: %v", err)
+		t.Fatalf("StoreVariant on disabled cache must be a no-op, got error: %v", err)
 	}
 
-	key, err := cache.PutSource(ctx, req.Source, bytes.NewReader([]byte("data")))
+	key, err := cache.StoreSource(ctx, req, bytes.NewReader([]byte("data")))
 	if err != nil {
-		t.Fatalf("PutSource on disabled cache must be a no-op, got error: %v", err)
+		t.Fatalf("StoreSource on disabled cache must be a no-op, got error: %v", err)
 	}
 
 	if key != "" {
-		t.Errorf("PutSource on disabled cache returned key %q, want empty", key)
+		t.Errorf("StoreSource on disabled cache returned key %q, want empty", key)
 	}
 }
 
@@ -457,13 +453,13 @@ func assertDisabledCacheReadsAlwaysMiss(
 
 	ctx := t.Context()
 
-	reader, _, _, err := cache.Source(ctx, req.Source)
-	if !errors.Is(err, ErrNotFound) {
-		t.Fatalf("Source on disabled cache error = %v, want %v", err, ErrNotFound)
+	key, err := cache.LookupSource(ctx, req)
+	if err != nil {
+		t.Fatalf("LookupSource on disabled cache failed: %v", err)
 	}
 
-	if reader != nil {
-		t.Errorf("Source on disabled cache = reader %v, want none", reader)
+	if key != "" {
+		t.Errorf("LookupSource on disabled cache = %q, want empty", key)
 	}
 }
 
@@ -552,7 +548,7 @@ func TestEvictionRunsUnderWritePressure(t *testing.T) {
 }
 
 // TestEvictionRunsOnPeriodicSchedule writes three variant files straight
-// to disk, bypassing PutVariant, so they have no accounting rows and no
+// to disk, bypassing StoreVariant, so they have no accounting rows and no
 // write-pressure notification fires. Only a periodic reconciliation pass
 // can then adopt them, and only the eviction pass that follows it can
 // evict them.
@@ -594,7 +590,7 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 	for i, key := range keys {
 		content := bytes.Repeat([]byte{fills[i]}, 1000)
 
-		err = cache.variants.Write(string(key), content)
+		_, err = cache.variants.Store(key, bytes.NewReader(content))
 		if err != nil {
 			t.Fatalf("failed to store variant file: %v", err)
 		}
@@ -613,8 +609,7 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 		stored = 0
 
 		for _, key := range keys {
-			_, err = os.Stat(cache.variants.keyToPath(string(key)))
-			if err == nil {
+			if cache.variants.Exists(key) {
 				stored++
 			}
 		}
@@ -646,7 +641,9 @@ func TestStartEvictionReconcilesAccountingWithDisk(t *testing.T) {
 	// feature existed) must be adopted into the accounting.
 	untracked := bytes.Repeat([]byte{0x31}, 1000)
 
-	err := cache.variants.Write(string(testVariantKeyOne), untracked)
+	_, err := cache.variants.Store(
+		testVariantKeyOne, bytes.NewReader(untracked),
+	)
 	if err != nil {
 		t.Fatalf("failed to store untracked variant file: %v", err)
 	}
@@ -701,295 +698,10 @@ func TestStartEvictionReconcilesAccountingWithDisk(t *testing.T) {
 	}
 }
 
-// logLineNaming returns the first line of logs, written by slog's JSON
-// handler, that is at level and names the variant key, or "" if none is.
-func logLineNaming(logs, level string, key imagerequest.VariantKey) string {
-	for line := range strings.Lines(logs) {
-		if strings.Contains(line, `"level":"`+level+`"`) &&
-			strings.Contains(line, `"cache_key":"`+string(key)+`"`) {
-			return line
-		}
-	}
-
-	return ""
-}
-
-// TestReconcileVariantRowsDropsOnlyRowsOfMissingFiles gives
-// reconcileVariantRows two tracked variants. The first one's file is a
-// symbolic link to itself, so its size cannot be read. Its row must stay,
-// with a warning naming its key and the error. The second one has no file.
-// Its row must go, with the info line for a missing file.
-func TestReconcileVariantRowsDropsOnlyRowsOfMissingFiles(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-	storeEvictionTestVariant(t, cache, testVariantKeyOne, []byte("variant one"))
-	storeEvictionTestVariant(t, cache, testVariantKeyTwo, []byte("variant two"))
-
-	unreadablePath := cache.variants.keyToPath(string(testVariantKeyOne))
-
-	err := os.Remove(unreadablePath)
-	if err != nil {
-		t.Fatalf("failed to remove the first variant's file: %v", err)
-	}
-
-	err = os.Symlink(unreadablePath, unreadablePath)
-	if err != nil {
-		t.Fatalf("failed to link the first variant's path to itself: %v", err)
-	}
-
-	_, statErr := os.Stat(unreadablePath)
-	if statErr == nil || errors.Is(statErr, fs.ErrNotExist) {
-		t.Fatalf("os.Stat() of the first variant: error = %v, "+
-			"want an error other than a missing file", statErr)
-	}
-
-	err = os.Remove(cache.variants.keyToPath(string(testVariantKeyTwo)))
-	if err != nil {
-		t.Fatalf("failed to remove the second variant's file: %v", err)
-	}
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	err = cache.reconcileVariantRows(t.Context())
-	t.Logf("reconcileVariantRows() error = %v, log: %s", err, logBuf.String())
-
-	if err != nil {
-		t.Fatalf("reconcileVariantRows() error = %v", err)
-	}
-
-	rowQuery := `SELECT COUNT(*) FROM variant_content WHERE cache_key = ?`
-
-	if n := countRows(t, cache, rowQuery, string(testVariantKeyOne)); n != 1 {
-		t.Errorf("the variant whose size cannot be read has %d rows, want 1", n)
-	}
-
-	if n := countRows(t, cache, rowQuery, string(testVariantKeyTwo)); n != 0 {
-		t.Errorf("the variant with no file has %d rows, want 0", n)
-	}
-
-	logs := logBuf.String()
-
-	warning := logLineNaming(logs, "WARN", testVariantKeyOne)
-	if !strings.Contains(warning, statErr.Error()) {
-		t.Errorf("no warning names %s and the error %q", testVariantKeyOne, statErr)
-	}
-
-	if line := logLineNaming(logs, "INFO", testVariantKeyOne); line != "" {
-		t.Errorf("the variant whose size cannot be read was logged at info: %s", line)
-	}
-
-	dropped := logLineNaming(logs, "INFO", testVariantKeyTwo)
-	if !strings.Contains(dropped, "dropped accounting row for missing variant file") {
-		t.Errorf("no info line says the file of %s is missing", testVariantKeyTwo)
-	}
-}
-
-// openDirectoryNearPathLimit makes a chain of directories inside dir, each
-// named with 255 zeros, the longest name Linux allows. Linux refuses a path
-// of 4096 bytes or more, and the chain goes as deep as it can below that.
-// It returns the chain's deepest directory as an os.Root, closed when the
-// test ends. An entry made through it with a 255-byte name has a path even
-// the root user cannot read. The os.Root can make that entry because it
-// names the entry only by its name, not by the whole path.
-func openDirectoryNearPathLimit(t *testing.T, dir string) *os.Root {
-	t.Helper()
-
-	name := strings.Repeat("0", 255)
-	deepest := dir
-
-	for len(filepath.Join(deepest, name)) < 4096 {
-		deepest = filepath.Join(deepest, name)
-	}
-
-	err := os.MkdirAll(deepest, StorageDirPerm)
-	if err != nil {
-		t.Fatalf("failed to make a chain of directories: %v", err)
-	}
-
-	root, err := os.OpenRoot(deepest)
-	if err != nil {
-		t.Fatalf("os.OpenRoot(%s) error = %v", deepest, err)
-	}
-
-	t.Cleanup(func() { _ = root.Close() })
-
-	return root
-}
-
-// makeEntriesTooLongToRead makes a new directory and a new file in the
-// deepest directory of the chain that openDirectoryNearPathLimit makes
-// inside dir. Even the root user can then neither list the new directory
-// nor read the new file's info. It returns the paths of the new directory
-// and the new file.
-func makeEntriesTooLongToRead(t *testing.T, dir string) []string {
-	t.Helper()
-
-	deepest := openDirectoryNearPathLimit(t, dir)
-	dirName := strings.Repeat("0", 255)
-
-	err := deepest.Mkdir(dirName, StorageDirPerm)
-	if err != nil {
-		t.Fatalf("failed to make a directory too deep to list: %v", err)
-	}
-
-	fileName := strings.Repeat("1", 255)
-
-	err = deepest.WriteFile(fileName, []byte("unreadable"), StorageFilePerm)
-	if err != nil {
-		t.Fatalf("failed to make a file too deep to read: %v", err)
-	}
-
-	return []string{
-		filepath.Join(deepest.Name(), dirName),
-		filepath.Join(deepest.Name(), fileName),
-	}
-}
-
-// makeTempFileTooLongToRead makes a temp file in the deepest directory of
-// the chain that openDirectoryNearPathLimit makes inside dir. Even the
-// root user then cannot read the temp file's info. It returns the temp
-// file's path.
-func makeTempFileTooLongToRead(t *testing.T, dir string) string {
-	t.Helper()
-
-	deepest := openDirectoryNearPathLimit(t, dir)
-	name := tempFilePrefix + strings.Repeat("1", 255-len(tempFilePrefix))
-
-	err := deepest.WriteFile(name, []byte("partial"), StorageFilePerm)
-	if err != nil {
-		t.Fatalf("failed to make a temp file too deep to read: %v", err)
-	}
-
-	return filepath.Join(deepest.Name(), name)
-}
-
-// assertSkippedEntryWarning checks that logs hold the warning "skipped
-// unreadable entry in cache directory" naming path, with the error
-// ENAMETOOLONG for that path.
-func assertSkippedEntryWarning(t *testing.T, logs, path string) {
-	t.Helper()
-
-	for line := range strings.Lines(logs) {
-		if strings.Contains(line, `"level":"WARN"`) &&
-			strings.Contains(line, `"msg":"skipped unreadable entry in cache directory"`) &&
-			strings.Contains(line, `"path":"`+path+`"`) &&
-			strings.Contains(line, path+": "+syscall.ENAMETOOLONG.Error()) {
-			return
-		}
-	}
-
-	t.Errorf("no warning %q names %s with the error %q",
-		"skipped unreadable entry in cache directory", path, syscall.ENAMETOOLONG)
-}
-
-// TestReconciliationGoesOnPastEntriesItCannotRead puts, in each storage
-// directory, a directory the pass cannot list and a file whose info it
-// cannot read. The pass walks each directory in name order, so it reaches
-// them before the cache's files, whose keys start with a letter. It must
-// log a warning naming each one's path and the error, and still do the
-// rest of its work:
-//   - adopt a variant file that has no row
-//   - drop the row of a variant whose file is missing
-//   - remove a source file that has no row
-//   - correct a wrong total cache usage
-func TestReconciliationGoesOnPastEntriesItCannotRead(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-	ctx := t.Context()
-
-	untrackedVariant := []byte("variant with no row")
-
-	err := cache.variants.Write(string(testVariantKeyOne), untrackedVariant)
-	if err != nil {
-		t.Fatalf("failed to write a variant file with no row: %v", err)
-	}
-
-	storeEvictionTestVariant(t, cache, testVariantKeyTwo, []byte("variant two"))
-
-	err = os.Remove(cache.variants.keyToPath(string(testVariantKeyTwo)))
-	if err != nil {
-		t.Fatalf("failed to remove the second variant's file: %v", err)
-	}
-
-	untrackedSourceKey := "ffeeddcc0001"
-
-	err = cache.srcContent.Write(untrackedSourceKey, []byte("source with no row"))
-	if err != nil {
-		t.Fatalf("failed to write a source file with no row: %v", err)
-	}
-
-	_, err = cache.db.ExecContext(ctx,
-		`UPDATE cache_usage SET total_size_bytes = 1 WHERE id = 1`)
-	if err != nil {
-		t.Fatalf("failed to set a wrong total: %v", err)
-	}
-
-	unreadable := slices.Concat(
-		makeEntriesTooLongToRead(t, cache.variants.baseDir),
-		makeEntriesTooLongToRead(t, cache.srcContent.baseDir),
-	)
-
-	logs := reconcileAsAtStartup(t, cache)
-
-	for _, path := range unreadable {
-		assertSkippedEntryWarning(t, logs, path)
-	}
-
-	rowQuery := `SELECT COUNT(*) FROM variant_content WHERE cache_key = ?`
-
-	if n := countRows(t, cache, rowQuery, string(testVariantKeyOne)); n != 1 {
-		t.Errorf("the variant file with no row got %d rows, want 1", n)
-	}
-
-	if n := countRows(t, cache, rowQuery, string(testVariantKeyTwo)); n != 0 {
-		t.Errorf("the variant with no file kept %d rows, want 0", n)
-	}
-
-	_, err = os.Stat(cache.srcContent.keyToPath(untrackedSourceKey))
-	if err == nil {
-		t.Error("the source file with no row is still on disk")
-	}
-
-	usage, err := cache.UsageBytes(ctx)
-	if err != nil {
-		t.Fatalf("UsageBytes() error = %v", err)
-	}
-
-	if usage != int64(len(untrackedVariant)) {
-		t.Errorf("UsageBytes() = %d, want %d, the size of the adopted variant",
-			usage, len(untrackedVariant))
-	}
-}
-
-// TestReconciliationWarnsOfTempFilesWhoseInfoItCannotRead puts, in each
-// storage directory, a temp file whose info the pass cannot read. The
-// pass must log a warning naming each one's path and the error, as it
-// does for any other file whose info it cannot read.
-func TestReconciliationWarnsOfTempFilesWhoseInfoItCannotRead(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	unreadable := []string{
-		makeTempFileTooLongToRead(t, cache.variants.baseDir),
-		makeTempFileTooLongToRead(t, cache.srcContent.baseDir),
-	}
-
-	logs := reconcileAsAtStartup(t, cache)
-
-	for _, path := range unreadable {
-		assertSkippedEntryWarning(t, logs, path)
-	}
-}
-
 // TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup proves
 // reconciliation is not a one-shot startup-only pass: it must also run
 // on the periodic ticker, so a variant file that lands on disk with no
-// accounting row well after startup (e.g. because PutVariant's
+// accounting row well after startup (e.g. because StoreVariant's
 // best-effort accounting insert failed under transient contention, or
 // any other cause of an untracked file appearing during steady-state
 // operation) is still adopted into accounting eventually, rather than
@@ -1025,12 +737,14 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 
 	// Simulate a variant whose accounting insert failed after the
 	// process was already running and serving requests: the content
-	// file is written directly, bypassing PutVariant's (and thus its
+	// file is written directly, bypassing StoreVariant's (and thus its
 	// accounting insert) entirely, exactly as would happen if that
 	// insert had failed and only the file write had succeeded.
 	untracked := bytes.Repeat([]byte{0x41}, 900)
 
-	err = cache.variants.Write("aabbccdd0099", untracked)
+	_, err = cache.variants.Store(
+		"aabbccdd0099", bytes.NewReader(untracked),
+	)
 	if err != nil {
 		t.Fatalf("failed to store untracked variant file: %v", err)
 	}
@@ -1336,15 +1050,13 @@ func assertOnlyOldestSourceEvicted(
 ) {
 	t.Helper()
 
-	_, err := os.Stat(cache.srcContent.keyToPath(string(keys[0])))
-	if err == nil {
+	if cache.srcContent.Exists(keys[0]) {
 		t.Errorf("source %s, evicted when the context was cancelled, "+
 			"is still on disk", keys[0])
 	}
 
 	for _, key := range keys[1:] {
-		_, err = os.Stat(cache.srcContent.keyToPath(string(key)))
-		if err != nil {
+		if !cache.srcContent.Exists(key) {
 			t.Errorf("source %s was evicted after the context was cancelled", key)
 		}
 

internal/imgcache/filestore.go

@@ -1,185 +0,0 @@
-package imgcache
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// Storage constants.
-const (
-	// StorageDirPerm is the permission mode for storage directories.
-	StorageDirPerm = 0750
-	// StorageFilePerm is the permission mode for storage files.
-	StorageFilePerm = 0600
-	// MinHashLength is the minimum hash length for path splitting.
-	MinHashLength = 4
-)
-
-// Storage errors.
-var (
-	ErrNotFound = errors.New("content not found")
-)
-
-// FileStore is a directory of files, each named by a hex key. The file for
-// a key is at <basedir>/<ab>/<cd>/<key>, where <ab> and <cd> are the key's
-// first and second pairs of characters. The cache keeps its source images in
-// one FileStore and its variants in another.
-type FileStore struct {
-	baseDir string
-}
-
-// NewFileStore creates the directory baseDir if it is missing and returns
-// the FileStore of the files in it.
-func NewFileStore(baseDir string) (*FileStore, error) {
-	err := os.MkdirAll(baseDir, StorageDirPerm)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create storage directory: %w", err)
-	}
-
-	return &FileStore{baseDir: baseDir}, nil
-}
-
-// Write writes data with writeFileSynced to the file for key, replacing any
-// file already there.
-func (s *FileStore) Write(key string, data []byte) error {
-	path := s.keyToPath(key)
-
-	err := os.MkdirAll(filepath.Dir(path), StorageDirPerm)
-	if err != nil {
-		return fmt.Errorf("failed to create directory: %w", err)
-	}
-
-	return writeFileSynced(path, data)
-}
-
-// Open opens the file for key and returns it with its size in bytes. A
-// missing file is ErrNotFound.
-func (s *FileStore) Open(key string) (*os.File, int64, error) {
-	f, err := os.Open(s.keyToPath(key))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, 0, ErrNotFound
-		}
-
-		return nil, 0, fmt.Errorf("failed to open content: %w", err)
-	}
-
-	stat, err := f.Stat()
-	if err != nil {
-		_ = f.Close()
-
-		return nil, 0, fmt.Errorf("failed to stat content: %w", err)
-	}
-
-	return f, stat.Size(), nil
-}
-
-// Size returns the size in bytes of the file for key. A missing file is
-// ErrNotFound.
-func (s *FileStore) Size(key string) (int64, error) {
-	stat, err := os.Stat(s.keyToPath(key))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return 0, ErrNotFound
-		}
-
-		return 0, fmt.Errorf("failed to stat content: %w", err)
-	}
-
-	return stat.Size(), nil
-}
-
-// Delete removes the file for key. A missing file is not an error.
-func (s *FileStore) Delete(key string) error {
-	err := os.Remove(s.keyToPath(key))
-	if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to delete content: %w", err)
-	}
-
-	return nil
-}
-
-// writeFileSynced writes data to path through a temp file in the same
-// directory: the temp file is synced to disk, renamed to path, and the
-// directory synced after, so that neither a concurrent reader nor a
-// crash finds a partial file under path. When the directory sync fails,
-// the file is removed from path, so that a failed write leaves no file
-// there.
-func writeFileSynced(path string, data []byte) error {
-	dir := filepath.Dir(path)
-
-	tmpFile, err := os.CreateTemp(dir, ".tmp-*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp file: %w", err)
-	}
-
-	tmpPath := tmpFile.Name()
-
-	_, err = tmpFile.Write(data)
-	if err != nil {
-		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath)
-
-		return fmt.Errorf("failed to write temp file: %w", err)
-	}
-
-	err = tmpFile.Sync()
-	if err != nil {
-		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath)
-
-		return fmt.Errorf("failed to sync temp file: %w", err)
-	}
-
-	err = tmpFile.Close()
-	if err != nil {
-		_ = os.Remove(tmpPath)
-
-		return fmt.Errorf("failed to close temp file: %w", err)
-	}
-
-	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
-	if err != nil {
-		_ = os.Remove(tmpPath)
-
-		return fmt.Errorf("failed to rename temp file: %w", err)
-	}
-
-	err = syncDirectory(dir)
-	if err != nil {
-		_ = os.Remove(path)
-
-		return err
-	}
-
-	return nil
-}
-
-// syncDirectory syncs the directory dir to disk, so that a file just
-// renamed into it is still there after a crash.
-func syncDirectory(dir string) error {
-	d, err := os.Open(filepath.Clean(dir))
-	if err != nil {
-		return fmt.Errorf("failed to open directory: %w", err)
-	}
-
-	err = d.Sync()
-	_ = d.Close()
-
-	if err != nil {
-		return fmt.Errorf("failed to sync directory: %w", err)
-	}
-
-	return nil
-}
-
-// keyToPath converts a key to a file path: <basedir>/<ab>/<cd>/<key>
-func (s *FileStore) keyToPath(key string) string {
-	if len(key) < MinHashLength {
-		return filepath.Join(s.baseDir, key)
-	}
-
-	return filepath.Join(s.baseDir, key[0:2], key[2:4], key)
-}

internal/imgcache/filestore_internal_test.go

@@ -1,184 +0,0 @@
-package imgcache
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-func TestFileStore_WriteAndOpen(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-
-	storage, err := NewFileStore(tmpDir)
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	content := []byte("hello world")
-	key := string(imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key())
-
-	err = storage.Write(key, content)
-	if err != nil {
-		t.Fatalf("Write() error = %v", err)
-	}
-
-	// Verify file exists at expected path
-	expectedPath := filepath.Join(tmpDir, key[0:2], key[2:4], key)
-
-	_, err = os.Stat(expectedPath)
-	if err != nil {
-		t.Errorf("File not at expected path %s: %v", expectedPath, err)
-	}
-
-	// Open and verify size and content
-	r, size, err := storage.Open(key)
-	if err != nil {
-		t.Fatalf("Open() error = %v", err)
-	}
-
-	defer func() { _ = r.Close() }()
-
-	if size != int64(len(content)) {
-		t.Errorf("Open() size = %d, want %d", size, len(content))
-	}
-
-	loaded, err := io.ReadAll(r)
-	if err != nil {
-		t.Fatalf("ReadAll() error = %v", err)
-	}
-
-	if !bytes.Equal(loaded, content) {
-		t.Errorf("Open() content = %q, want %q", loaded, content)
-	}
-}
-
-func TestFileStore_OpenNotFound(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-
-	storage, err := NewFileStore(tmpDir)
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	_, _, err = storage.Open("nonexistent")
-	if !errors.Is(err, ErrNotFound) {
-		t.Errorf("Open() error = %v, want ErrNotFound", err)
-	}
-}
-
-// TestFileStore_Size checks that Size returns the size of a written file,
-// and ErrNotFound for a key with no file.
-func TestFileStore_Size(t *testing.T) {
-	t.Parallel()
-
-	storage, err := NewFileStore(t.TempDir())
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	content := []byte("the file's content")
-	key := string(imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key())
-
-	err = storage.Write(key, content)
-	if err != nil {
-		t.Fatalf("Write() error = %v", err)
-	}
-
-	size, err := storage.Size(key)
-	if err != nil || size != int64(len(content)) {
-		t.Errorf("Size() = %d, error %v; want %d", size, err, len(content))
-	}
-
-	_, err = storage.Size("nonexistent")
-	if !errors.Is(err, ErrNotFound) {
-		t.Errorf("Size() of a missing file error = %v, want ErrNotFound", err)
-	}
-}
-
-func TestFileStore_Delete(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-
-	storage, err := NewFileStore(tmpDir)
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	content := []byte("to be deleted")
-	key := string(imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key())
-	path := storage.keyToPath(key)
-
-	err = storage.Write(key, content)
-	if err != nil {
-		t.Fatalf("Write() error = %v", err)
-	}
-
-	_, err = os.Stat(path)
-	if err != nil {
-		t.Errorf("file missing before Delete(): %v", err)
-	}
-
-	err = storage.Delete(key)
-	if err != nil {
-		t.Fatalf("Delete() error = %v", err)
-	}
-
-	_, err = os.Stat(path)
-	if err == nil {
-		t.Error("file still on disk after Delete()")
-	}
-}
-
-func TestFileStore_DeleteNonexistent(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-
-	storage, err := NewFileStore(tmpDir)
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	// Should not error
-	err = storage.Delete("nonexistent")
-	if err != nil {
-		t.Errorf("Delete() error = %v, want nil", err)
-	}
-}
-
-func TestFileStore_KeyToPath(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-
-	storage, err := NewFileStore(tmpDir)
-	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
-	}
-
-	// Test by writing and verifying the resulting path structure
-	content := []byte("test content for path verification")
-	key := string(imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key())
-
-	err = storage.Write(key, content)
-	if err != nil {
-		t.Fatalf("Write() error = %v", err)
-	}
-
-	expectedPath := filepath.Join(tmpDir, key[0:2], key[2:4], key)
-
-	_, err = os.Stat(expectedPath)
-	if err != nil {
-		t.Errorf("File not at expected path %s: %v", expectedPath, err)
-	}
-}

internal/imgcache/imgcache.go

@@ -0,0 +1,47 @@
+// Package imgcache provides interfaces and types for the image caching proxy.
+package imgcache
+
+import (
+	"context"
+	"io"
+	"time"
+
+	"sneak.berlin/go/pixa/internal/imagerequest"
+)
+
+// ImageResponse represents a processed image ready to serve
+type ImageResponse struct {
+	// Content is the image data reader
+	Content io.ReadCloser
+	// ContentLength is the size in bytes (-1 if unknown)
+	ContentLength int64
+	// ContentType is the MIME type of the response
+	ContentType string
+	// ETag is the entity tag for caching
+	ETag string
+	// LastModified is when the content was last modified
+	LastModified time.Time
+	// CacheStatus indicates HIT, MISS, or STALE
+	CacheStatus CacheStatus
+	// FetchedBytes is the number of bytes fetched from upstream (0 if cache hit)
+	FetchedBytes int64
+}
+
+// CacheStatus indicates whether the response was served from cache.
+type CacheStatus string
+
+// Cache status values for response headers.
+const (
+	CacheHit   CacheStatus = "HIT"
+	CacheMiss  CacheStatus = "MISS"
+	CacheStale CacheStatus = "STALE"
+)
+
+// ImageCache is the main interface for the image caching proxy
+type ImageCache interface {
+	// Get retrieves a processed image, fetching and processing if necessary
+	Get(ctx context.Context, req *imagerequest.Request) (*ImageResponse, error)
+
+	// Warm pre-fetches and caches an image without returning it
+	Warm(ctx context.Context, req *imagerequest.Request) error
+}

internal/imgcache/max_concurrent_processing_internal_test.go

@@ -1,4 +1,4 @@
-package imageproxy
+package imgcache
 
 import (
 	"image/color"
@@ -41,8 +41,7 @@ func holdProcessingSlot(
 	input, feed := io.Pipe()
 
 	go func() {
-		_, _ = proc.Process(t.Context(), input, imagerequest.FormatJPEG,
-			&imagerequest.Transform{})
+		_, _ = proc.Process(t.Context(), input, &imagerequest.Transform{})
 	}()
 
 	_, err := feed.Write([]byte{0})
@@ -56,19 +55,18 @@ func holdProcessingSlot(
 	return release
 }
 
-// TestProxy_Get_WaitsForSlotBeforeReadingCachedSource checks that a
+// TestService_Get_WaitsForSlotBeforeReadingCachedSource checks that a
 // request whose source is cached holds none of it while it waits for a
-// processing slot: past the first bytes, which give the source's format, it
-// reads the cached file only once it has a slot. With the only slot held, a
-// request for a new width of the cached 100x100 photo waits; the cached file
-// is then rewritten as a 100x50 image before the slot is freed, so the
-// request must answer with that image scaled to 40x20.
-func TestProxy_Get_WaitsForSlotBeforeReadingCachedSource(t *testing.T) {
+// processing slot: it reads the cached file only once it has a slot. With
+// the only slot held, a request for a new width of the cached 100x100 photo
+// waits; the cached file is then rewritten as a 100x50 image before the slot
+// is freed, so the request must answer with that image scaled to 40x20.
+func TestService_Get_WaitsForSlotBeforeReadingCachedSource(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	svc.processor = imageprocessor.New(
-		imageprocessor.Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1},
+		imageprocessor.Params{MaxConcurrentProcessing: 1},
 	)
 
 	// A first request caches the photo as a source.
@@ -79,15 +77,13 @@ func TestProxy_Get_WaitsForSlotBeforeReadingCachedSource(t *testing.T) {
 
 	_ = resp.Content.Close()
 
-	cachedSource := widthOnlyRequest(fixtures, 50).Source
-
-	reader, _, _, err := svc.cache.Source(t.Context(), cachedSource)
-	if err != nil {
-		t.Fatalf("Source() error = %v; want the cached source", err)
+	sourceKey, err := svc.cache.LookupSource(t.Context(),
+		widthOnlyRequest(fixtures, 50))
+	if err != nil || sourceKey == "" {
+		t.Fatalf("LookupSource() = %q, %v; want the cached source",
+			sourceKey, err)
 	}
 
-	_ = reader.Close()
-
 	release := holdProcessingSlot(t, svc.processor)
 
 	var (
@@ -107,7 +103,7 @@ func TestProxy_Get_WaitsForSlotBeforeReadingCachedSource(t *testing.T) {
 	// before waiting, it would have read it by now.
 	time.Sleep(100 * time.Millisecond)
 
-	err = os.WriteFile(sourceFilePath(svc, cachedSource.Key()),
+	err = os.WriteFile(svc.cache.srcContent.keyToPath(sourceKey),
 		generateTestJPEG(t, 100, 50, color.RGBA{0, 0, 255, 255}), 0o600)
 	if err != nil {
 		t.Fatalf("failed to rewrite the cached source: %v", err)

internal/imgcache/module.go

@@ -0,0 +1,8 @@
+package imgcache
+
+import "time"
+
+// CacheConfig defaults.
+const (
+	DefaultNegativeTTL = 5 * time.Minute
+)

internal/imgcache/negative_cache_internal_test.go

@@ -17,10 +17,9 @@ func TestNegativeCache_StoreAndCheck(t *testing.T) {
 	db := setupTestDB(t)
 	dir := t.TempDir()
 
-	cache, err := NewCache(db, Config{
+	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatal(err)
@@ -35,7 +34,7 @@ func TestNegativeCache_StoreAndCheck(t *testing.T) {
 	}
 
 	// Initially should not be in negative cache
-	hit, err := cache.Failure(ctx, req.Source)
+	hit, err := cache.checkNegativeCache(ctx, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -45,13 +44,13 @@ func TestNegativeCache_StoreAndCheck(t *testing.T) {
 	}
 
 	// Store a negative entry
-	err = cache.PutFailure(ctx, req.Source)
+	err = cache.StoreNegative(ctx, req)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	// Now should be in negative cache
-	hit, err = cache.Failure(ctx, req.Source)
+	hit, err = cache.checkNegativeCache(ctx, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -67,10 +66,9 @@ func TestNegativeCache_Expired(t *testing.T) {
 	db := setupTestDB(t)
 	dir := t.TempDir()
 
-	cache, err := NewCache(db, Config{
+	cache, err := NewCache(db, CacheConfig{
 		StateDir:    dir,
 		NegativeTTL: 1 * time.Millisecond, // very short TTL
-		MaxBytes:    1 << 30,
 	}, prometheus.NewRegistry())
 	if err != nil {
 		t.Fatal(err)
@@ -85,7 +83,7 @@ func TestNegativeCache_Expired(t *testing.T) {
 	}
 
 	// Store a negative entry with very short TTL
-	err = cache.PutFailure(ctx, req.Source)
+	err = cache.StoreNegative(ctx, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -94,7 +92,7 @@ func TestNegativeCache_Expired(t *testing.T) {
 	time.Sleep(10 * time.Millisecond)
 
 	// Should no longer be in negative cache
-	hit, err := cache.Failure(ctx, req.Source)
+	hit, err := cache.checkNegativeCache(ctx, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -104,6 +102,71 @@ func TestNegativeCache_Expired(t *testing.T) {
 	}
 }
 
+// TestService_Get_ServesCachedVariantOfNegativeCachedURL caches a variant of
+// the test photo, then keeps a failed fetch of the photo's URL in the negative
+// cache, as a failed fetch for another variant does once the source has been
+// evicted. The cached variant is still served, and a variant not in the cache
+// is made from the cached source. Once the source is evicted, a variant not in
+// the cache needs a fetch and is refused.
+func TestService_Get_ServesCachedVariantOfNegativeCachedURL(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
+
+	resp, err := svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
+	if err != nil {
+		t.Fatalf("Get() first request error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	err = svc.cache.StoreNegative(t.Context(),
+		photoVariant(fixtures, 85, imagerequest.FitCover))
+	if err != nil {
+		t.Fatalf("StoreNegative() error = %v", err)
+	}
+
+	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
+	if err != nil {
+		t.Fatalf("Get() of the cached variant error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	if resp.CacheStatus != CacheHit {
+		t.Errorf("cached variant CacheStatus = %q, want %q",
+			resp.CacheStatus, CacheHit)
+	}
+
+	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 40, imagerequest.FitCover))
+	t.Logf("Get() of a variant made from the cached source: error = %v", err)
+
+	if err != nil {
+		t.Fatalf("Get() of a variant made from the cached source error = %v", err)
+	}
+
+	_ = resp.Content.Close()
+
+	sourceKey, err := svc.cache.LookupSource(t.Context(),
+		photoVariant(fixtures, 85, imagerequest.FitCover))
+	if err != nil || sourceKey == "" {
+		t.Fatalf("LookupSource() = %q, %v, want the cached source", sourceKey, err)
+	}
+
+	err = svc.cache.evictSourceBlob(t.Context(), sourceKey)
+	if err != nil {
+		t.Fatalf("evictSourceBlob() error = %v", err)
+	}
+
+	_, err = svc.Get(t.Context(), photoVariant(fixtures, 60, imagerequest.FitCover))
+	t.Logf("Get() of a variant whose source was evicted: error = %v", err)
+
+	if !errors.Is(err, ErrNegativeCached) {
+		t.Errorf("Get() of a variant whose source was evicted error = %v, want %v",
+			err, ErrNegativeCached)
+	}
+}
+
 // TestEvictionLoopRemovesExpiredNegativeCacheRows stores a failed fetch
 // that expires a second later and starts the eviction loop with a short
 // interval: a later tick must remove its row although its URL is never
@@ -114,21 +177,21 @@ func TestEvictionLoopRemovesExpiredNegativeCacheRows(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name     string
-		maxBytes int64
+		name             string
+		disableDiskCache bool
 	}{
-		{name: "disk cache enabled", maxBytes: 1 << 30},
-		{name: "disk cache disabled", maxBytes: 0},
+		{name: "disk cache enabled", disableDiskCache: false},
+		{name: "disk cache disabled", disableDiskCache: true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			cache, err := NewCache(evictionTestDB(t), Config{
-				StateDir:    t.TempDir(),
-				NegativeTTL: time.Second,
-				MaxBytes:    tt.maxBytes,
+			cache, err := NewCache(evictionTestDB(t), CacheConfig{
+				StateDir:         t.TempDir(),
+				NegativeTTL:      time.Second,
+				DisableDiskCache: tt.disableDiskCache,
 			}, prometheus.NewRegistry())
 			if err != nil {
 				t.Fatalf("failed to create cache: %v", err)
@@ -138,9 +201,9 @@ func TestEvictionLoopRemovesExpiredNegativeCacheRows(t *testing.T) {
 				Source: imagerequest.Source{Host: testHostExample, Path: "/gone.jpg"},
 			}
 
-			err = cache.PutFailure(t.Context(), expired.Source)
+			err = cache.StoreNegative(t.Context(), expired)
 			if err != nil {
-				t.Fatalf("PutFailure failed: %v", err)
+				t.Fatalf("StoreNegative failed: %v", err)
 			}
 
 			const notExpiredPath = "/later.jpg"
@@ -203,8 +266,7 @@ func negativeCacheRowCount(tb testing.TB, cache *Cache, sourcePath string) int {
 func TestCleanExpiredDeletesInBatches(t *testing.T) {
 	t.Parallel()
 
-	cache, err := NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
+	cache, err := NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()},
 		prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
@@ -259,8 +321,7 @@ func TestCleanExpiredDeletesInBatches(t *testing.T) {
 func TestCleanExpiredRemovesMoreThanOneBatch(t *testing.T) {
 	t.Parallel()
 
-	cache, err := NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
+	cache, err := NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()},
 		prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
@@ -291,8 +352,7 @@ func TestCleanExpiredRemovesMoreThanOneBatch(t *testing.T) {
 func TestCleanExpiredStopsOnceContextEnds(t *testing.T) {
 	t.Parallel()
 
-	cache, err := NewCache(evictionTestDB(t),
-		Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
+	cache, err := NewCache(evictionTestDB(t), CacheConfig{StateDir: t.TempDir()},
 		prometheus.NewRegistry())
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
@@ -345,3 +405,15 @@ func negativeCacheTableRowCount(tb testing.TB, cache *Cache) int {
 
 	return count
 }
+
+func TestService_Get_ReturnsErrorForNegativeCachedURL(t *testing.T) {
+	t.Parallel()
+
+	// This test verifies that Service.Get() checks the negative cache
+	// We can't easily test the full pipeline without vips, but we can
+	// verify the error type
+	err := ErrNegativeCached
+	if !errors.Is(err, ErrNegativeCached) {
+		t.Error("ErrNegativeCached should be identifiable with errors.Is")
+	}
+}

internal/imgcache/partial_cache_files_internal_test.go

@@ -12,6 +12,67 @@ import (
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
+// getImage calls Get for req and returns the image it answered with and
+// its cache status.
+func getImage(
+	t *testing.T, svc *Service, req *imagerequest.Request,
+) ([]byte, CacheStatus) {
+	t.Helper()
+
+	resp, err := svc.Get(t.Context(), req)
+	if err != nil {
+		t.Fatalf("Get() of quality %d error = %v", req.Transform.Quality, err)
+	}
+
+	defer func() { _ = resp.Content.Close() }()
+
+	body, err := io.ReadAll(resp.Content)
+	if err != nil {
+		t.Fatalf("reading the image of quality %d: %v", req.Transform.Quality, err)
+	}
+
+	return body, resp.CacheStatus
+}
+
+// fileSize returns the size of the file at path.
+func fileSize(t *testing.T, path string) int64 {
+	t.Helper()
+
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("stat %s: %v", path, err)
+	}
+
+	return info.Size()
+}
+
+// truncateFile cuts the file at path down to size bytes.
+func truncateFile(t *testing.T, path string, size int64) {
+	t.Helper()
+
+	t.Logf("cutting %s from %d to %d bytes",
+		filepath.Base(path), fileSize(t, path), size)
+
+	err := os.Truncate(path, size)
+	if err != nil {
+		t.Fatalf("truncating %s: %v", path, err)
+	}
+}
+
+// cachedSourcePath returns the path of the cached source file req uses.
+func cachedSourcePath(
+	t *testing.T, svc *Service, req *imagerequest.Request,
+) string {
+	t.Helper()
+
+	sourceKey, err := svc.cache.LookupSource(t.Context(), req)
+	if err != nil || sourceKey == "" {
+		t.Fatalf("LookupSource() = %q, %v; want the cached source", sourceKey, err)
+	}
+
+	return svc.cache.srcContent.keyToPath(sourceKey)
+}
+
 // reconcileAsAtStartup runs the cache's reconciliation pass, as pixa does
 // when it starts, and returns what the pass logged.
 func reconcileAsAtStartup(t *testing.T, cache *Cache) string {
@@ -46,67 +107,127 @@ func assertWarningNames(t *testing.T, logs, path string) {
 	t.Errorf("reconciliation logged no warning naming %s", path)
 }
 
-// TestReconciliationRemovesDamagedFiles empties a cached source file and a
-// cached variant file, or cuts them to half their size, as a crash or a
-// restored snapshot could. It checks that the reconciliation pass removes
-// each file and its row, with a warning naming the file.
-func TestReconciliationRemovesDamagedFiles(t *testing.T) {
+// TestService_Get_FetchesAgainForEmptyCachedSource empties the cached source
+// file, as a crash or a restored snapshot could, and runs the reconciliation
+// pass, which must remove it with a warning naming it. It then asks for two
+// new sizes of the source: the first must fetch it again and cache it whole,
+// so that the second is made from the cache without a third fetch.
+func TestService_Get_FetchesAgainForEmptyCachedSource(t *testing.T) {
 	t.Parallel()
 
-	content := []byte("the whole cached image")
+	svc, fixtures := SetupTestService(t)
 
-	for name, size := range map[string]int64{
-		"empty":   0,
-		"partial": int64(len(content) / 2),
-	} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
+	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
 
-			cache, _ := newEvictionTestCache(t, 1<<30)
+	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
+	wholeSize := fileSize(t, path)
 
-			sourceKey := storeEvictionTestSource(t, cache, testHostCDN, testPathCat, content)
-			storeEvictionTestVariant(t, cache, testVariantKeyOne, content)
+	truncateFile(t, path, 0)
+	assertWarningNames(t, reconcileAsAtStartup(t, svc.cache), path)
 
-			sourcePath := cache.srcContent.keyToPath(string(sourceKey))
-			variantPath := cache.variants.keyToPath(string(testVariantKeyOne))
+	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
+	getImage(t, svc, photoVariant(fixtures, 30, imagerequest.FitCover))
 
-			for _, path := range []string{sourcePath, variantPath} {
-				err := os.Truncate(path, size)
-				if err != nil {
-					t.Fatalf("cutting %s to %d bytes: %v", path, size, err)
-				}
-			}
+	fetches := readCounters(svc.cache).upstreamFetchCount
+	t.Logf("upstream fetches = %d", fetches)
 
-			logs := reconcileAsAtStartup(t, cache)
-
-			assertWarningNames(t, logs, sourcePath)
-			assertWarningNames(t, logs, variantPath)
-
-			_, err := os.Stat(sourcePath)
-			if err == nil {
-				t.Error("the damaged source file is still on disk")
-			}
-
-			_, err = os.Stat(variantPath)
-			if err == nil {
-				t.Error("the damaged variant file is still on disk")
-			}
-
-			rows := countRows(t, cache,
-				`SELECT COUNT(*) FROM source_content WHERE source_key = ?`,
-				string(sourceKey))
-			if rows != 0 {
-				t.Errorf("the damaged source file kept %d rows, want 0", rows)
-			}
-
-			rows = countRows(t, cache,
-				`SELECT COUNT(*) FROM variant_content WHERE cache_key = ?`,
-				string(testVariantKeyOne))
-			if rows != 0 {
-				t.Errorf("the damaged variant file kept %d rows, want 0", rows)
-			}
-		})
+	if fetches != 2 {
+		t.Errorf("upstream fetches = %d, want 2: the empty cached source "+
+			"was kept and fetched again on every new size", fetches)
 	}
+
+	size := fileSize(t, path)
+	if size != wholeSize {
+		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
+	}
+}
+
+// TestService_Get_FetchesAgainForPartialCachedSource cuts the cached source
+// file to half its size, as a crash or a restored snapshot could, and runs
+// the reconciliation pass, which must remove it with a warning naming it.
+// It then asks for two new sizes of the source: the first must fetch it
+// again rather than fail to decode the partial file, and the second is
+// made from the cache.
+func TestService_Get_FetchesAgainForPartialCachedSource(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
+
+	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
+
+	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
+	wholeSize := fileSize(t, path)
+
+	truncateFile(t, path, wholeSize/2)
+	assertWarningNames(t, reconcileAsAtStartup(t, svc.cache), path)
+
+	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
+	getImage(t, svc, photoVariant(fixtures, 30, imagerequest.FitCover))
+
+	fetches := readCounters(svc.cache).upstreamFetchCount
+	t.Logf("upstream fetches = %d", fetches)
+
+	if fetches != 2 {
+		t.Errorf("upstream fetches = %d, want 2", fetches)
+	}
+
+	size := fileSize(t, path)
+	if size != wholeSize {
+		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
+	}
+}
+
+// assertConvertedAgain caches a variant of the photo, cuts its file to size
+// bytes and runs the reconciliation pass, which must remove it with a
+// warning naming it. It then checks that Get converts the image again
+// instead of serving the file, and that the next Get serves the whole
+// variant from the cache.
+func assertConvertedAgain(t *testing.T, size int64) {
+	t.Helper()
+
+	svc, fixtures := SetupTestService(t)
+	req := photoVariant(fixtures, 85, imagerequest.FitCover)
+
+	want, _ := getImage(t, svc, req)
+
+	path := svc.cache.variants.keyToPath(imagerequest.CacheKey(req))
+
+	truncateFile(t, path, size)
+	assertWarningNames(t, reconcileAsAtStartup(t, svc.cache), path)
+
+	got, status := getImage(t, svc, req)
+	t.Logf("after the cut: %d bytes, %s", len(got), status)
+
+	if status != CacheMiss || !bytes.Equal(got, want) {
+		t.Errorf("after the cut: Get() = %d bytes, %s; want the %d bytes "+
+			"converted again, %s", len(got), status, len(want), CacheMiss)
+	}
+
+	got, status = getImage(t, svc, req)
+	t.Logf("next request: %d bytes, %s", len(got), status)
+
+	if status != CacheHit || !bytes.Equal(got, want) {
+		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
+			len(got), status, len(want), CacheHit)
+	}
+}
+
+// TestService_Get_ConvertsAgainForEmptyCachedVariant empties a cached
+// variant file, as a crash or a restored snapshot could, and checks that it
+// is converted again rather than served empty.
+func TestService_Get_ConvertsAgainForEmptyCachedVariant(t *testing.T) {
+	t.Parallel()
+
+	assertConvertedAgain(t, 0)
+}
+
+// TestService_Get_ConvertsAgainForPartialCachedVariant cuts a cached
+// variant file to ten bytes, as a crash or a restored snapshot could, and
+// checks that it is converted again rather than served cut short.
+func TestService_Get_ConvertsAgainForPartialCachedVariant(t *testing.T) {
+	t.Parallel()
+
+	assertConvertedAgain(t, 10)
 }
 
 // TestReconciliationRemovesEmptyVariantFileWithoutRow checks that the
@@ -118,19 +239,16 @@ func TestReconciliationRemovesEmptyVariantFileWithoutRow(t *testing.T) {
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
 
-	err := cache.variants.Write(string(testVariantKeyOne), nil)
+	_, err := cache.variants.Store(testVariantKeyOne, bytes.NewReader(nil))
 	if err != nil {
 		t.Fatalf("failed to store an empty variant file: %v", err)
 	}
 
-	variantPath := cache.variants.keyToPath(string(testVariantKeyOne))
-
 	logs := reconcileAsAtStartup(t, cache)
 
-	assertWarningNames(t, logs, variantPath)
+	assertWarningNames(t, logs, cache.variants.keyToPath(testVariantKeyOne))
 
-	_, err = os.Stat(variantPath)
-	if err == nil {
+	if cache.variants.Exists(testVariantKeyOne) {
 		t.Error("the empty variant file is still on disk")
 	}
 
@@ -142,19 +260,19 @@ func TestReconciliationRemovesEmptyVariantFileWithoutRow(t *testing.T) {
 	}
 }
 
-// TestFileStore_WriteReplacesFileOfAnotherSize checks that a write over a
-// file of another size at the source's path, such as a partial file a crash
-// left, replaces it with the content.
-func TestFileStore_WriteReplacesFileOfAnotherSize(t *testing.T) {
+// TestContentStorage_StoreReplacesFileOfAnotherSize checks that a
+// store over a file of another size at the source's path, such as a
+// partial file a crash left, replaces it with the content.
+func TestContentStorage_StoreReplacesFileOfAnotherSize(t *testing.T) {
 	t.Parallel()
 
-	storage, err := NewFileStore(t.TempDir())
+	storage, err := NewContentStorage(t.TempDir())
 	if err != nil {
-		t.Fatalf("NewFileStore() error = %v", err)
+		t.Fatalf("NewContentStorage() error = %v", err)
 	}
 
 	content := []byte("the whole source image")
-	key := string(imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key())
+	key := imagerequest.Source{Host: testHostCDN, Path: testPathCat}.Key()
 	path := storage.keyToPath(key)
 
 	err = os.MkdirAll(filepath.Dir(path), StorageDirPerm)
@@ -167,14 +285,14 @@ func TestFileStore_WriteReplacesFileOfAnotherSize(t *testing.T) {
 		t.Fatalf("writing a partial file: %v", err)
 	}
 
-	err = storage.Write(key, content)
+	_, err = storage.Store(key, content)
 	if err != nil {
-		t.Fatalf("Write() error = %v", err)
+		t.Fatalf("Store() error = %v", err)
 	}
 
-	stored, _, err := storage.Open(key)
+	stored, err := storage.Load(key)
 	if err != nil {
-		t.Fatalf("Open() error = %v", err)
+		t.Fatalf("Load() error = %v", err)
 	}
 
 	defer func() { _ = stored.Close() }()

internal/imgcache/pendingaccesstimes_internal_test.go

@@ -5,8 +5,6 @@ import (
 	"context"
 	"database/sql"
 	"errors"
-	"image/color"
-	"io"
 	"log/slog"
 	"strings"
 	"testing"
@@ -17,7 +15,8 @@ import (
 
 // pendingAccessTimesWait is how long a test waits for the database's
 // connection, for an access time to reach the database, for a write to start
-// waiting for the connection, or for StopPendingAccessTimeWrites to return.
+// waiting for the connection, for a request to return past its deadline, or
+// for StopPendingAccessTimeWrites to return.
 const pendingAccessTimesWait = 5 * time.Second
 
 // otherWritesWait is how long a test gives other writes, once one write waits
@@ -57,6 +56,52 @@ func waitForConnectionWaits(t *testing.T, db *sql.DB, waits int64) {
 	}
 }
 
+// TestService_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy holds the
+// database's one connection while a request whose fetch is held reaches its
+// deadline. The request must return with the deadline's error while the
+// connection is still held, as it waits for no database write past its
+// deadline.
+func TestService_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures, fetcher := setupHeldFetchService(t)
+
+	svc.cache.StartPendingAccessTimeWrites()
+	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
+
+	// Room for the request to reach its fetch on a busy host
+	const timeout = 2 * time.Second
+
+	ctx, cancel := context.WithTimeout(t.Context(), timeout)
+	defer cancel()
+
+	deadline, _ := ctx.Deadline()
+
+	results := startGet(ctx, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
+
+	// The request has made its database reads by the time it fetches.
+	select {
+	case <-fetcher.started:
+	case <-time.After(timeout):
+		t.Fatal("request did not reach its fetch by its deadline")
+	}
+
+	releaseDatabase := holdDatabase(t, svc.cache)
+	defer releaseDatabase()
+
+	select {
+	case got := <-results:
+		t.Logf("Get() returned %v after its deadline, error = %v",
+			time.Since(deadline), got.err)
+
+		if !errors.Is(got.err, context.DeadlineExceeded) {
+			t.Errorf("Get() error = %v, want %v", got.err, context.DeadlineExceeded)
+		}
+	case <-time.After(time.Until(deadline) + pendingAccessTimesWait):
+		t.Fatal("request did not return while the database was busy")
+	}
+}
+
 // TestStopPendingAccessTimeWrites_LetsTheWriteUnderWayFinish holds the
 // database's one connection while the goroutine that writes the pending
 // access times waits for it, hands over another access time, then stops that
@@ -197,16 +242,16 @@ func TestStopPendingAccessTimeWrites_ReturnsWhenItsContextEnds(t *testing.T) {
 	}
 }
 
-// TestSource_HandsAccessTimeToTheBackgroundWriter finds a cached source
-// whose access time is an hour old. Source must not write the access
+// TestLookupSource_HandsAccessTimeToTheBackgroundWriter finds a cached source
+// whose access time is an hour old. LookupSource must not write the access
 // time itself but hand it over to be written, and StopPendingAccessTimeWrites
 // must then write it.
-func TestSource_HandsAccessTimeToTheBackgroundWriter(t *testing.T) {
+func TestLookupSource_HandsAccessTimeToTheBackgroundWriter(t *testing.T) {
 	t.Parallel()
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
-	content := generateTestJPEG(t, 10, 10, color.RGBA{0, 0, 255, 255})
-	key := storeEvictionTestSource(t, cache, "example.com", "/photo.jpg", content)
+	key := storeEvictionTestSource(t, cache, "example.com", "/photo.jpg",
+		[]byte("source bytes"))
 	anHourAgo := time.Now().Add(-time.Hour)
 	setSourceLastAccessed(t, cache, key, anHourAgo)
 
@@ -216,21 +261,15 @@ func TestSource_HandsAccessTimeToTheBackgroundWriter(t *testing.T) {
 	`
 	anHourAgoInDatabase := anHourAgo.UTC().Format(sqliteTimestampFormat)
 
-	reader, _, _, err := cache.Source(t.Context(),
-		imagerequest.Source{Host: "example.com", Path: "/photo.jpg"})
-	if err != nil {
-		t.Fatalf("Source() error = %v; want the source of %q", err, key)
-	}
-
-	found, err := io.ReadAll(reader)
-	_ = reader.Close()
-
-	if err != nil || !bytes.Equal(found, content) {
-		t.Fatalf("Source() reads %q, %v; want the source of %q", found, err, key)
+	found, err := cache.LookupSource(t.Context(), &imagerequest.Request{
+		Source: imagerequest.Source{Host: "example.com", Path: "/photo.jpg"},
+	})
+	if err != nil || found != key {
+		t.Fatalf("LookupSource() = %q, %v; want %q", found, err, key)
 	}
 
 	if countRows(t, cache, touchedQuery, string(key), anHourAgoInDatabase) != 0 {
-		t.Error("Source wrote the source's access time itself")
+		t.Error("LookupSource wrote the source's access time itself")
 	}
 
 	if waiting := len(cache.pendingSourceAccessTimes); waiting != 1 {

internal/imgcache/service.go

@@ -1,7 +1,4 @@
-// Package imageproxy fetches, transforms, caches and serves images. Its
-// Proxy serves an image from the cache when it can, and otherwise makes it
-// from the cached or fetched source image.
-package imageproxy
+package imgcache
 
 import (
 	"bytes"
@@ -10,73 +7,101 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"net/url"
 	"runtime/debug"
+	"strings"
 	"time"
 
 	"github.com/dustin/go-humanize"
 	"github.com/getsentry/sentry-go"
 	"github.com/go-chi/chi/v5/middleware"
-	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/sync/singleflight"
+	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/magic"
+	"sneak.berlin/go/pixa/internal/signature"
 )
 
-// Proxy orchestrates the cache, fetcher, and processor.
-type Proxy struct {
-	cache           *imgcache.Cache
+// Service implements the ImageCache interface, orchestrating cache,
+// fetcher, and processor.
+type Service struct {
+	cache           *Cache
 	fetcher         httpfetcher.Fetcher
 	processor       *imageprocessor.ImageProcessor
+	signer          *signature.Signer
+	allowlist       *allowlist.HostAllowList
 	log             *slog.Logger
+	allowHTTP       bool
 	maxResponseSize int64
 	// variantsInProgress lets the requests that miss the same variant at the
 	// same time share one fetch and one transcode.
 	variantsInProgress singleflight.Group
-
-	// The counts of upstream fetches and transforms, made and registered by
-	// New. They are kept in memory, so adding to one waits for nothing.
-	upstreamFetches    prometheus.Counter
-	upstreamFetchBytes prometheus.Counter
-	transforms         prometheus.Counter
 }
 
-// Config holds the proxy's configuration.
-type Config struct {
+// ServiceConfig holds configuration for the image service.
+type ServiceConfig struct {
 	// Cache is the cache instance
-	Cache *imgcache.Cache
-	// Fetcher fetches source images from upstream hosts
+	Cache *Cache
+	// FetcherConfig configures the upstream fetcher built when Fetcher is
+	// not set. Its AllowHTTP and MaxResponseSize are used either way.
+	FetcherConfig *httpfetcher.Config
+	// Fetcher is an optional custom fetcher (for testing)
 	Fetcher httpfetcher.Fetcher
-	// Processor converts and resizes the images
-	Processor *imageprocessor.ImageProcessor
-	// MaxResponseSize is the largest source accepted, in bytes; a cached
-	// source larger than this is fetched again
-	MaxResponseSize int64
+	// SigningKey is the HMAC signing key (empty disables signing)
+	SigningKey string
+	// Allowlist is the list of hosts that don't require signatures
+	Allowlist []string
+	// MaxConcurrentProcessing is the most images processed at once; zero
+	// uses the image processor's default, half the CPUs
+	MaxConcurrentProcessing int
 	// Logger for logging
 	Logger *slog.Logger
 }
 
-// errCacheRequired is returned when the proxy is built without a cache.
-var errCacheRequired = errors.New("cache is required")
+// Static errors for service construction.
+var (
+	errCacheRequired      = errors.New("cache is required")
+	errSigningKeyRequired = errors.New("signing key is required")
+)
 
-// New creates a new image proxy and registers its counters on
-// metricsRegistry. pixad passes Prometheus' default registry, the one
-// /metrics serves. It fails when metricsRegistry already holds counters of
-// the same names.
-func New(
-	cfg *Config, metricsRegistry prometheus.Registerer,
-) (*Proxy, error) {
+// NewService creates a new image service.
+func NewService(cfg *ServiceConfig) (*Service, error) {
 	if cfg.Cache == nil {
 		return nil, errCacheRequired
 	}
 
+	if cfg.SigningKey == "" {
+		return nil, errSigningKeyRequired
+	}
+
+	// Resolve fetcher config for defaults
+	fetcherCfg := cfg.FetcherConfig
+	if fetcherCfg == nil {
+		fetcherCfg = httpfetcher.DefaultConfig()
+	}
+
+	// Use custom fetcher if provided, otherwise create HTTP fetcher
+	var fetcher httpfetcher.Fetcher
+	if cfg.Fetcher != nil {
+		fetcher = cfg.Fetcher
+	} else {
+		fetcher = httpfetcher.New(fetcherCfg)
+	}
+
+	signer := signature.New(cfg.SigningKey)
+
 	log := cfg.Logger
 	if log == nil {
 		log = slog.Default()
 	}
 
+	allowHTTP := false
+	if cfg.FetcherConfig != nil {
+		allowHTTP = cfg.FetcherConfig.AllowHTTP
+	}
+
 	// JPEG XL is the default output format, so pixad does not start
 	// without it.
 	err := imageprocessor.CheckJPEGXLSupport()
@@ -84,36 +109,22 @@ func New(
 		return nil, err
 	}
 
-	p := &Proxy{
+	maxResponseSize := fetcherCfg.MaxResponseSize
+	processor := imageprocessor.New(imageprocessor.Params{
+		MaxInputBytes:           maxResponseSize,
+		MaxConcurrentProcessing: cfg.MaxConcurrentProcessing,
+	})
+
+	return &Service{
 		cache:           cfg.Cache,
-		fetcher:         cfg.Fetcher,
-		processor:       cfg.Processor,
+		fetcher:         fetcher,
+		processor:       processor,
+		signer:          signer,
+		allowlist:       allowlist.New(cfg.Allowlist),
 		log:             log,
-		maxResponseSize: cfg.MaxResponseSize,
-		upstreamFetches: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_upstream_fetches_total",
-			Help: "Fetches of a source image from upstream that read any bytes.",
-		}),
-		upstreamFetchBytes: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_upstream_fetch_bytes_total",
-			Help: "Bytes read from upstream by fetches of source images.",
-		}),
-		transforms: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_transforms_total",
-			Help: "Images the image processor transformed.",
-		}),
-	}
-
-	for _, counter := range []prometheus.Counter{
-		p.upstreamFetches, p.upstreamFetchBytes, p.transforms,
-	} {
-		err = metricsRegistry.Register(counter)
-		if err != nil {
-			return nil, fmt.Errorf("failed to register the proxy's counters: %w", err)
-		}
-	}
-
-	return p, nil
+		allowHTTP:       allowHTTP,
+		maxResponseSize: maxResponseSize,
+	}, nil
 }
 
 // ErrNegativeCached is returned when a URL is in the negative cache (recently failed).
@@ -125,49 +136,28 @@ var ErrNegativeCached = errors.New("request is in negative cache (recently faile
 var ErrProcessingTimedOut = errors.New(
 	"image processing stopped at the deadline of the request doing it")
 
-// ImageResponse represents a processed image ready to serve
-type ImageResponse struct {
-	// Content is the image data reader
-	Content io.ReadCloser
-	// ContentLength is the size in bytes (-1 if unknown)
-	ContentLength int64
-	// ContentType is the MIME type of the response
-	ContentType string
-	// ETag is the entity tag for caching
-	ETag string
-	// CacheStatus indicates HIT or MISS
-	CacheStatus CacheStatus
-	// FetchedBytes is the number of bytes fetched from upstream (0 if cache hit)
-	FetchedBytes int64
-}
-
-// CacheStatus indicates whether the response was served from cache.
-type CacheStatus string
-
-// Cache status values for response headers.
-const (
-	CacheHit  CacheStatus = "HIT"
-	CacheMiss CacheStatus = "MISS"
-)
-
 // Get retrieves a processed image, fetching and processing if necessary.
 // While its source URL is in the negative cache, a cached variant is still
 // served and a variant not in the cache is still made from a cached source;
 // only a request that needs the source fetched is refused.
 //
-// A cache hit opens the variant file and makes no database call: the cache
-// hands its access time to the goroutine that writes access times, without
-// waiting for it, and its hit is counted in memory. A variant file that
-// cannot be served, such as one whose first bytes are not those of an output
-// format, is a miss, and the variant is made again.
-func (p *Proxy) Get(
+// A cache hit opens the variant file and makes no database call: its access
+// time is handed to the goroutine that StartPendingAccessTimeWrites starts,
+// without waiting for it, and its hit is counted in memory. A variant file
+// that cannot be served, such as one whose first bytes are not those of an
+// output format, is a miss, and the variant is made again.
+func (s *Service) Get(
 	ctx context.Context, req *imagerequest.Request,
 ) (*ImageResponse, error) {
+	// Propagate AllowHTTP setting to the request
+	req.AllowHTTP = s.allowHTTP
+
 	cacheKey := imagerequest.CacheKey(req)
 
-	reader, size, contentType, err := p.cache.Variant(cacheKey)
+	reader, size, contentType, err := s.cache.GetVariant(cacheKey)
 	if err == nil {
-		p.cache.IncrementStats(true)
+		s.cache.touchVariant(cacheKey)
+		s.cache.IncrementStats(true, 0)
 
 		return &ImageResponse{
 			Content:       reader,
@@ -178,17 +168,17 @@ func (p *Proxy) Get(
 		}, nil
 	}
 
-	if !errors.Is(err, imgcache.ErrNotFound) {
-		p.log.Warn("cached variant not served, making it again",
+	if !errors.Is(err, ErrNotFound) {
+		s.log.Warn("cached variant not served, making it again",
 			"cache_key", cacheKey, "error", err)
 	}
 
 	// Cache miss - get the variant, processed once for all the requests that
 	// miss it at the same time, then count this request's miss, also when it
 	// failed or the request context has ended meanwhile
-	response, err := p.processOrWait(ctx, req)
+	response, err := s.processOrWait(ctx, req)
 
-	p.cache.IncrementStats(false)
+	s.cache.IncrementStats(false, 0)
 
 	if err != nil {
 		return nil, err
@@ -199,10 +189,68 @@ func (p *Proxy) Get(
 	return response, nil
 }
 
+// Warm pre-fetches and caches an image without returning it.
+func (s *Service) Warm(ctx context.Context, req *imagerequest.Request) error {
+	_, err := s.Get(ctx, req)
+
+	return err
+}
+
 // WaitForProcessing waits until no image is being processed, or until ctx
 // ends, and returns how many images were still being processed then.
-func (p *Proxy) WaitForProcessing(ctx context.Context) int {
-	return p.processor.WaitForProcessing(ctx)
+func (s *Service) WaitForProcessing(ctx context.Context) int {
+	return s.processor.WaitForProcessing(ctx)
+}
+
+// ValidateRequest validates the request signature if required.
+func (s *Service) ValidateRequest(req *imagerequest.Request) error {
+	// Check if host is allowed (no signature required)
+	sourceURL := req.SourceURL()
+
+	parsedURL, err := url.Parse(sourceURL)
+	if err != nil {
+		return fmt.Errorf("invalid source URL: %w", err)
+	}
+
+	// An allowlist entry names no port, so a host followed by ":", with or
+	// without a port, needs a signature. The port is read from the parsed
+	// URL, as the fetcher reads it: in an IPv6 address written without
+	// brackets, such as 2001:db8::1:8443, it is what follows the last ":".
+	// This is checked here and not in allowlist.IsAllowed, which also matches
+	// referer_blocklist, where a Referer must be blocked whatever its port.
+	hostHasPort := parsedURL.Port() != "" ||
+		strings.HasSuffix(parsedURL.Host, ":")
+
+	if !hostHasPort && s.allowlist.IsAllowed(parsedURL) {
+		return nil
+	}
+
+	// Signature required for non-allowed hosts
+	return s.signer.Verify(req)
+}
+
+// GenerateSignedURL generates a signed URL for the given request. The URL
+// carries q and fit next to sig and exp, so the image route verifies it for
+// the quality and fit it was signed with. An unset quality or fit is first
+// set to 85 or cover, the values the route uses when a URL has no q or fit.
+func (s *Service) GenerateSignedURL(
+	baseURL string,
+	req *imagerequest.Request,
+	ttl time.Duration,
+) (string, error) {
+	if req.Transform.Quality == 0 {
+		req.Transform.Quality = 85
+	}
+
+	if req.Transform.FitMode == "" {
+		req.Transform.FitMode = imagerequest.FitCover
+	}
+
+	// Sets the request's Expires and Signature
+	path, sig, exp := s.signer.GenerateSignedURL(req, ttl)
+
+	return fmt.Sprintf("%s%s?sig=%s&exp=%d&q=%d&fit=%s",
+		baseURL, path, sig, exp, req.Transform.Quality, req.Transform.FitMode), nil
 }
 
 // errPanicked is returned when processing a variant panicked.
@@ -214,7 +262,7 @@ var errPanicked = errors.New("panic while processing image")
 // and take no upstream connection or processing slot. The processing ignores
 // the first request's cancellation, so the others are still served if that
 // client goes away, but keeps its deadline.
-func (p *Proxy) processOrWait(
+func (s *Service) processOrWait(
 	ctx context.Context, req *imagerequest.Request,
 ) (*ImageResponse, error) {
 	// A request that has already ended starts no processing
@@ -228,7 +276,7 @@ func (p *Proxy) processOrWait(
 	// only when no other request is processing the variant
 	processing := make(chan struct{})
 
-	results := p.variantsInProgress.DoChan(string(cacheKey),
+	results := s.variantsInProgress.DoChan(string(cacheKey),
 		func() (_ any, err error) {
 			close(processing)
 
@@ -239,7 +287,7 @@ func (p *Proxy) processOrWait(
 			defer func() {
 				recovered := recover()
 				if recovered != nil {
-					p.log.Error("panic while processing image",
+					s.log.Error("panic while processing image",
 						"host", req.Source.Host, "path", req.Source.Path,
 						"panic", recovered, "stack", string(debug.Stack()))
 
@@ -254,7 +302,7 @@ func (p *Proxy) processOrWait(
 			processingCtx, cancel := withoutCancelKeepingDeadline(ctx)
 			defer cancel()
 
-			return p.processFromSourceOrFetch(processingCtx, req, cacheKey)
+			return s.processFromSourceOrFetch(processingCtx, req, cacheKey)
 		})
 
 	var result singleflight.Result
@@ -303,52 +351,65 @@ func withoutCancelKeepingDeadline(
 	return context.WithDeadline(context.WithoutCancel(ctx), deadline)
 }
 
-// loadCachedSource opens src's cached source, reading only the first bytes,
-// which give its format, and returns it with its size and its format. It
-// returns nil if the source is not in the cache, cannot be read, is in no
-// source format or exceeds maxResponseSize.
-func (p *Proxy) loadCachedSource(
-	ctx context.Context, src imagerequest.Source,
-) (io.ReadCloser, int64, imagerequest.Format) {
-	reader, size, format, err := p.cache.Source(ctx, src)
-	if errors.Is(err, imgcache.ErrNotFound) {
-		return nil, 0, ""
-	}
-
+// loadCachedSource opens source content from cache, without reading it, and
+// returns it with its size; nil if the cached data is unavailable, empty or
+// exceeds maxResponseSize.
+func (s *Service) loadCachedSource(
+	sourceKey imagerequest.SourceKey,
+) (io.ReadCloser, int64) {
+	reader, size, err := s.cache.GetSourceContent(sourceKey)
 	if err != nil {
-		p.log.Warn("failed to load cached source, fetching", "error", err)
+		s.log.Warn("failed to load cached source, fetching", "error", err)
 
-		return nil, 0, ""
+		return nil, 0
 	}
 
-	p.log.Debug("using cached source", "source_key", src.Key())
-
-	if size > p.maxResponseSize {
+	if size > s.maxResponseSize {
 		_ = reader.Close()
 
-		p.log.Warn("cached source exceeds max response size, discarding",
-			"source_key", src.Key(),
-			"max_bytes", p.maxResponseSize,
+		s.log.Warn("cached source exceeds max response size, discarding",
+			"source_key", sourceKey,
+			"max_bytes", s.maxResponseSize,
 		)
 
-		return nil, 0, ""
+		return nil, 0
 	}
 
-	return reader, size, format
+	if size == 0 {
+		_ = reader.Close()
+
+		return nil, 0
+	}
+
+	return reader, size
 }
 
 // processFromSourceOrFetch processes an image, using cached source content
 // if available.
-func (p *Proxy) processFromSourceOrFetch(
+func (s *Service) processFromSourceOrFetch(
 	ctx context.Context,
 	req *imagerequest.Request,
 	cacheKey imagerequest.VariantKey,
 ) (*processedVariant, error) {
-	source, sourceSize, sourceFormat := p.loadCachedSource(ctx, req.Source)
+	// Check if we have cached source content
+	sourceKey, err := s.cache.LookupSource(ctx, req)
+	if err != nil {
+		s.log.Warn("source lookup failed", "error", err)
+	}
+
+	var (
+		source     io.ReadCloser
+		sourceSize int64
+	)
+
+	if sourceKey != "" {
+		s.log.Debug("using cached source", "source_key", sourceKey)
+		source, sourceSize = s.loadCachedSource(sourceKey)
+	}
 
 	// Fetch from upstream if we don't have source data or it's empty
 	if source == nil {
-		return p.fetchAndProcess(ctx, req, cacheKey)
+		return s.fetchAndProcess(ctx, req, cacheKey)
 	}
 
 	defer func() { _ = source.Close() }()
@@ -356,26 +417,26 @@ func (p *Proxy) processFromSourceOrFetch(
 	// Process using cached source; nothing was fetched from upstream. The
 	// image processor reads the source only once it has a processing slot,
 	// so a request waiting for one holds none of it in memory.
-	return p.processAndStore(ctx, req, cacheKey, source, sourceFormat, sourceSize)
+	return s.processAndStore(ctx, req, cacheKey, source, sourceSize)
 }
 
 // fetchAndProcess fetches from upstream, processes, and caches the result.
 // It counts the fetch with the bytes read from upstream, including when
 // reading the response or a later step fails. It fetches nothing while the
 // source URL is in the negative cache.
-func (p *Proxy) fetchAndProcess(
+func (s *Service) fetchAndProcess(
 	ctx context.Context,
 	req *imagerequest.Request,
 	cacheKey imagerequest.VariantKey,
 ) (*processedVariant, error) {
 	// Check negative cache - skip fetching for recently-failed URLs
-	negHit, err := p.cache.Failure(ctx, req.Source)
+	negHit, err := s.cache.checkNegativeCache(ctx, req)
 	if err != nil {
-		p.log.Warn("negative cache check failed", "error", err)
+		s.log.Warn("negative cache check failed", "error", err)
 	}
 
 	if negHit {
-		p.log.Debug("negative cache hit",
+		s.log.Debug("negative cache hit",
 			"host", req.Source.Host,
 			"path", req.Source.Path,
 		)
@@ -384,14 +445,15 @@ func (p *Proxy) fetchAndProcess(
 	}
 
 	// Fetch from upstream
-	p.log.Debug("fetching from upstream", "host", req.Source.Host,
-		"path", req.Source.Path, "query", req.Source.Query)
+	sourceURL := req.SourceURL()
 
-	fetchResult, err := p.fetcher.Fetch(ctx, req.Source)
+	s.log.Debug("fetching from upstream", "url", sourceURL)
+
+	fetchResult, err := s.fetcher.Fetch(ctx, sourceURL)
 	if err != nil {
 		// Store negative cache for certain errors
 		if isNegativeCacheable(err) {
-			p.storeNegative(ctx, req)
+			s.storeNegative(ctx, req)
 		}
 
 		return nil, fmt.Errorf("upstream fetch failed: %w", err)
@@ -408,7 +470,7 @@ func (p *Proxy) fetchAndProcess(
 	fetchBytes := int64(len(sourceData))
 
 	// Counted also when the request context has ended meanwhile
-	p.incrementUpstreamFetch(fetchBytes)
+	s.cache.IncrementUpstreamFetch(fetchBytes)
 
 	if err != nil {
 		return nil, fmt.Errorf("failed to read upstream response: %w", err)
@@ -424,7 +486,7 @@ func (p *Proxy) fetchAndProcess(
 	}
 
 	// Log upstream fetch details
-	p.log.Info("upstream fetched",
+	s.log.Info("upstream fetched",
 		"request_id", middleware.GetReqID(ctx),
 		"host", req.Source.Host,
 		"path", req.Source.Path,
@@ -437,50 +499,38 @@ func (p *Proxy) fetchAndProcess(
 		"cipher", fetchResult.TLSCipherSuite,
 	)
 
-	// The source's format, detected from its first bytes, which must match
-	// its content type. A body that does not is the upstream's error, so it
-	// gets a negative cache entry, as an upstream error status does.
-	sourceFormat, err := magic.ValidateMagicBytes(sourceData,
-		fetchResult.ContentType)
+	// Validate magic bytes match content type. A body that does not is the
+	// upstream's error, so it gets a negative cache entry, as an upstream
+	// error status does.
+	err = magic.ValidateMagicBytes(sourceData, fetchResult.ContentType)
 	if err != nil {
-		p.log.Warn("source refused", "request_id", middleware.GetReqID(ctx),
+		s.log.Warn("source refused", "request_id", middleware.GetReqID(ctx),
 			"host", req.Source.Host, "path", req.Source.Path,
 			"content_type", fetchResult.ContentType, "error", err)
-		p.storeNegative(ctx, req)
+		s.storeNegative(ctx, req)
 
 		return nil, fmt.Errorf("content validation failed: %w", err)
 	}
 
 	// Store source content
-	_, err = p.cache.PutSource(ctx, req.Source, bytes.NewReader(sourceData))
+	_, err = s.cache.StoreSource(ctx, req, bytes.NewReader(sourceData))
 	if err != nil {
-		p.log.Warn("failed to store source content", "error", err)
+		s.log.Warn("failed to store source content", "error", err)
 		// Continue even if caching fails
 	}
 
-	return p.processAndStore(
-		ctx, req, cacheKey, bytes.NewReader(sourceData), sourceFormat, fetchBytes,
+	return s.processAndStore(
+		ctx, req, cacheKey, bytes.NewReader(sourceData), fetchBytes,
 	)
 }
 
-// incrementUpstreamFetch counts one upstream fetch that read fetchBytes bytes.
-// A fetch that read no bytes is not counted.
-func (p *Proxy) incrementUpstreamFetch(fetchBytes int64) {
-	if fetchBytes <= 0 {
-		return
-	}
-
-	p.upstreamFetches.Inc()
-	p.upstreamFetchBytes.Add(float64(fetchBytes))
-}
-
 // storeNegative stores a negative cache entry for req's source, whose fetch
 // failed, so the source is not fetched again until the entry expires. A
 // failure to store the entry is only logged.
-func (p *Proxy) storeNegative(ctx context.Context, req *imagerequest.Request) {
-	err := p.cache.PutFailure(ctx, req.Source)
+func (s *Service) storeNegative(ctx context.Context, req *imagerequest.Request) {
+	err := s.cache.StoreNegative(ctx, req)
 	if err != nil {
-		p.log.Warn("failed to store negative cache entry",
+		s.log.Warn("failed to store negative cache entry",
 			"host", req.Source.Host, "path", req.Source.Path, "error", err)
 	}
 }
@@ -493,14 +543,13 @@ type processedVariant struct {
 	fetchedBytes int64
 }
 
-// processAndStore processes the image read from source, which is in
-// sourceFormat, and stores the result.
-func (p *Proxy) processAndStore(
+// processAndStore processes the image read from source and stores the
+// result.
+func (s *Service) processAndStore(
 	ctx context.Context,
 	req *imagerequest.Request,
 	cacheKey imagerequest.VariantKey,
 	source io.Reader,
-	sourceFormat imagerequest.Format,
 	fetchBytes int64,
 ) (*processedVariant, error) {
 	// Process the image
@@ -508,8 +557,7 @@ func (p *Proxy) processAndStore(
 
 	// ctx has the deadline of the request doing the processing, which can
 	// end while a request waiting for its image has time left
-	processResult, err := p.processor.Process(ctx, source, sourceFormat,
-		&req.Transform)
+	processResult, err := s.processor.Process(ctx, source, &req.Transform)
 	if errors.Is(err, context.DeadlineExceeded) {
 		return nil, fmt.Errorf("%w: %w", ErrProcessingTimedOut, err)
 	}
@@ -521,7 +569,7 @@ func (p *Proxy) processAndStore(
 	processDuration := time.Since(processStart)
 
 	// Counted also when the request context has ended meanwhile
-	p.transforms.Inc()
+	s.cache.IncrementTransformCount()
 
 	// Read processed content
 	processedData, err := io.ReadAll(processResult.Content)
@@ -540,11 +588,11 @@ func (p *Proxy) processAndStore(
 		sizePercent = float64(outputSize) / float64(fetchBytes) * 100.0
 	}
 
-	p.log.Info("image converted",
+	s.log.Info("image converted",
 		"request_id", middleware.GetReqID(ctx),
 		"host", req.Source.Host,
 		"path", req.Source.Path,
-		"src_format", sourceFormat,
+		"src_format", processResult.InputFormat,
 		"dst_format", req.Transform.Format,
 		"src_bytes", fetchBytes,
 		"dst_bytes", outputSize,
@@ -559,9 +607,9 @@ func (p *Proxy) processAndStore(
 	)
 
 	// Store variant to cache
-	err = p.cache.PutVariant(ctx, cacheKey, bytes.NewReader(processedData))
+	err = s.cache.StoreVariant(ctx, cacheKey, bytes.NewReader(processedData))
 	if err != nil {
-		p.log.Warn("failed to store variant", "error", err)
+		s.log.Warn("failed to store variant", "error", err)
 		// Continue even if caching fails
 	}
 

internal/imgcache/service_internal_test.go

@@ -1,4 +1,4 @@
-package imageproxy
+package imgcache
 
 import (
 	"context"
@@ -9,18 +9,20 @@ import (
 
 	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/magic"
+	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // Test data literals used repeatedly in this file (goconst).
 const (
 	testPathPhoto  = "/images/photo.jpg"
 	testPathUpload = "/uploads/image.jpg"
+	testSigningKey = "test-signing-key-12345"
 )
 
-func TestProxy_Get_GoodHost(t *testing.T) {
+func TestService_Get_AllowlistedHost(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := &imagerequest.Request{
@@ -58,12 +60,36 @@ func TestProxy_Get_GoodHost(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_OtherHost checks that the proxy serves a second host as it
-// serves GoodHost.
-func TestProxy_Get_OtherHost(t *testing.T) {
+func TestService_Get_NonAllowlistedHost_NoSignature(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t, WithSigningKey("test-key"))
+
+	req := &imagerequest.Request{
+		Source: imagerequest.Source{
+			Host: fixtures.OtherHost,
+			Path: testPathUpload,
+		},
+		Transform: imagerequest.Transform{
+			Size:    imagerequest.Size{Width: 50, Height: 50},
+			Format:  imagerequest.FormatJPEG,
+			Quality: 85,
+			FitMode: imagerequest.FitCover,
+		},
+	}
+
+	// Should fail validation - not allowlisted and no signature
+	err := svc.ValidateRequest(req)
+	if err == nil {
+		t.Error("ValidateRequest() expected error for non-allowlisted host without signature")
+	}
+}
+
+func TestService_Get_NonAllowlistedHost_ValidSignature(t *testing.T) {
+	t.Parallel()
+
+	signingKey := testSigningKey
+	svc, fixtures := SetupTestService(t, WithSigningKey(signingKey))
 	ctx := context.Background()
 
 	req := &imagerequest.Request{
@@ -79,6 +105,17 @@ func TestProxy_Get_OtherHost(t *testing.T) {
 		},
 	}
 
+	// Generate a valid signature
+	signer := signature.New(signingKey)
+	req.Expires = time.Now().Add(time.Hour)
+	req.Signature = signer.Sign(req)
+
+	// Should pass validation
+	err := svc.ValidateRequest(req)
+	if err != nil {
+		t.Errorf("ValidateRequest() error = %v", err)
+	}
+
 	// Should fetch successfully
 	resp, err := svc.Get(ctx, req)
 	if err != nil {
@@ -97,10 +134,248 @@ func TestProxy_Get_OtherHost(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_InvalidFile(t *testing.T) {
+func TestService_Get_NonAllowlistedHost_ExpiredSignature(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	signingKey := testSigningKey
+	svc, fixtures := SetupTestService(t, WithSigningKey(signingKey))
+
+	req := &imagerequest.Request{
+		Source: imagerequest.Source{
+			Host: fixtures.OtherHost,
+			Path: testPathUpload,
+		},
+		Transform: imagerequest.Transform{
+			Size:    imagerequest.Size{Width: 50, Height: 50},
+			Format:  imagerequest.FormatJPEG,
+			Quality: 85,
+			FitMode: imagerequest.FitCover,
+		},
+	}
+
+	// Generate an expired signature
+	signer := signature.New(signingKey)
+	req.Expires = time.Now().Add(-time.Hour) // Already expired
+	req.Signature = signer.Sign(req)
+
+	// Should fail validation
+	err := svc.ValidateRequest(req)
+	if err == nil {
+		t.Error("ValidateRequest() expected error for expired signature")
+	}
+}
+
+func TestService_Get_NonAllowlistedHost_InvalidSignature(t *testing.T) {
+	t.Parallel()
+
+	signingKey := testSigningKey
+	svc, fixtures := SetupTestService(t, WithSigningKey(signingKey))
+
+	req := &imagerequest.Request{
+		Source: imagerequest.Source{
+			Host: fixtures.OtherHost,
+			Path: testPathUpload,
+		},
+		Transform: imagerequest.Transform{
+			Size:    imagerequest.Size{Width: 50, Height: 50},
+			Format:  imagerequest.FormatJPEG,
+			Quality: 85,
+			FitMode: imagerequest.FitCover,
+		},
+	}
+
+	// Set an invalid signature
+	req.Signature = "invalid-signature"
+	req.Expires = time.Now().Add(time.Hour)
+
+	// Should fail validation
+	err := svc.ValidateRequest(req)
+	if err == nil {
+		t.Error("ValidateRequest() expected error for invalid signature")
+	}
+}
+
+// TestService_ValidateRequest_SignatureExactHostMatch verifies that
+// ValidateRequest enforces exact host matching for signatures. A
+// signature for one host must not verify for a different host, even
+// if they share a domain suffix.
+func TestService_ValidateRequest_SignatureExactHostMatch(t *testing.T) {
+	t.Parallel()
+
+	signingKey := "test-signing-key-must-be-32-chars"
+	svc, _ := SetupTestService(t,
+		WithSigningKey(signingKey),
+		WithNoAllowlist(),
+	)
+
+	signer := signature.New(signingKey)
+
+	// Sign a request for "cdn.example.com"
+	signedReq := &imagerequest.Request{
+		Source: imagerequest.Source{
+			Host: testHostCDN,
+			Path: testPathCat,
+		},
+		Transform: imagerequest.Transform{
+			Size:    imagerequest.Size{Width: 50, Height: 50},
+			Format:  imagerequest.FormatJPEG,
+			Quality: 85,
+			FitMode: imagerequest.FitCover,
+		},
+		Expires: time.Now().Add(time.Hour),
+	}
+	signedReq.Signature = signer.Sign(signedReq)
+
+	// The original request should pass validation
+	t.Run("exact host passes", func(t *testing.T) {
+		t.Parallel()
+
+		err := svc.ValidateRequest(signedReq)
+		if err != nil {
+			t.Errorf("ValidateRequest() exact host failed: %v", err)
+		}
+	})
+
+	// Try to reuse the signature with different hosts
+	tests := []struct {
+		name string
+		host string
+	}{
+		{"parent domain", testHostExample},
+		{"sibling subdomain", "images.example.com"},
+		{"deeper subdomain", "a.cdn.example.com"},
+		{"evil suffix domain", "cdn.example.com.evil.com"},
+		{"prefixed host", "evilcdn.example.com"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name+" rejected", func(t *testing.T) {
+			t.Parallel()
+
+			req := &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host:  tt.host,
+					Path:  signedReq.Source.Path,
+					Query: signedReq.Source.Query,
+				},
+				Transform: signedReq.Transform,
+				Expires:   signedReq.Expires,
+				Signature: signedReq.Signature,
+			}
+
+			err := svc.ValidateRequest(req)
+			if err == nil {
+				t.Errorf(
+					"ValidateRequest() should reject signature for host %q (signed for %q)",
+					tt.host, signedReq.Source.Host)
+			}
+		})
+	}
+}
+
+// TestService_ValidateRequest_HostWithPortNeedsSignature verifies that a host
+// followed by a port, or by a colon with no port, matches no allowlist entry,
+// so that a request for it without a signature is refused, while the same
+// host with no port is allowlisted.
+func TestService_ValidateRequest_HostWithPortNeedsSignature(t *testing.T) {
+	t.Parallel()
+
+	svc, _ := SetupTestService(t,
+		WithSigningKey(testSigningKey),
+		WithAllowlist(testHostCDN, "203.0.113.5", "2001:db8::1"),
+	)
+
+	tests := []struct {
+		host        string
+		allowlisted bool
+	}{
+		{testHostCDN, true},
+		{"cdn.example.com:8443", false},
+		{"cdn.example.com:443", false},
+		{"cdn.example.com:", false},
+		{"203.0.113.5", true},
+		{"203.0.113.5:8080", false},
+		{"[2001:db8::1]", true},
+		{"[2001:db8::1]:8443", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.host, func(t *testing.T) {
+			t.Parallel()
+
+			req := &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host: tt.host,
+					Path: testPathCat,
+				},
+				Transform: imagerequest.Transform{
+					Size:    imagerequest.Size{Width: 50, Height: 50},
+					Format:  imagerequest.FormatJPEG,
+					Quality: 85,
+					FitMode: imagerequest.FitCover,
+				},
+			}
+
+			err := svc.ValidateRequest(req)
+			t.Logf("ValidateRequest() for host %q with no signature: %v",
+				tt.host, err)
+
+			if allowlisted := err == nil; allowlisted != tt.allowlisted {
+				t.Errorf("host %q served without a signature = %v, want %v",
+					tt.host, allowlisted, tt.allowlisted)
+			}
+		})
+	}
+}
+
+// TestService_ValidateRequest_UnbracketedIPv6PortNeedsSignature verifies that
+// an allowlisted IPv6 address written without brackets and followed by a
+// port, or by a colon with no port, needs a signature. Go's URL parser, which
+// the fetcher uses, reads 2001:db8::1:8443 as the host 2001:db8::1 with the
+// port 8443.
+func TestService_ValidateRequest_UnbracketedIPv6PortNeedsSignature(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	svc, _ := SetupTestService(t,
+		WithSigningKey(testSigningKey),
+		WithAllowlist("2001:db8::1"),
+	)
+
+	for _, host := range []string{"2001:db8::1:8443", "2001:db8::1:"} {
+		t.Run(host, func(t *testing.T) {
+			t.Parallel()
+
+			req := &imagerequest.Request{
+				Source: imagerequest.Source{
+					Host: host,
+					Path: testPathCat,
+				},
+				Transform: imagerequest.Transform{
+					Size:    imagerequest.Size{Width: 50, Height: 50},
+					Format:  imagerequest.FormatJPEG,
+					Quality: 85,
+					FitMode: imagerequest.FitCover,
+				},
+			}
+
+			err := svc.ValidateRequest(req)
+			t.Logf("ValidateRequest() for host %q with no signature: %v",
+				host, err)
+
+			if err == nil {
+				t.Errorf("host %q served without a signature, want refused",
+					host)
+			}
+		})
+	}
+}
+
+func TestService_Get_InvalidFile(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := photoVariant(fixtures, 85, imagerequest.FitCover)
@@ -114,10 +389,10 @@ func TestProxy_Get_InvalidFile(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_NotFound(t *testing.T) {
+func TestService_Get_NotFound(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := photoVariant(fixtures, 85, imagerequest.FitCover)
@@ -130,10 +405,10 @@ func TestProxy_Get_NotFound(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_FormatConversion(t *testing.T) {
+func TestService_Get_FormatConversion(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	tests := []struct {
@@ -191,23 +466,32 @@ func TestProxy_Get_FormatConversion(t *testing.T) {
 				t.Fatalf("failed to read response: %v", err)
 			}
 
-			detectedFormat, err := magic.DetectFormat(data)
+			detectedMIME, err := magic.DetectFormat(data)
 			if err != nil {
 				t.Fatalf("failed to detect format: %v", err)
 			}
 
-			if detectedFormat.MIMEType() != tt.wantMIME {
-				t.Errorf("detected format = %q, want the format of %s",
-					detectedFormat, tt.wantMIME)
+			expectedFormat, ok := magic.MIMEToImageFormat(tt.wantMIME)
+			if !ok {
+				t.Fatalf("unknown format for MIME type: %s", tt.wantMIME)
+			}
+
+			detectedFormat, ok := magic.MIMEToImageFormat(string(detectedMIME))
+			if !ok {
+				t.Fatalf("unknown format for detected MIME type: %s", detectedMIME)
+			}
+
+			if detectedFormat != expectedFormat {
+				t.Errorf("detected format = %q, want %q", detectedFormat, expectedFormat)
 			}
 		})
 	}
 }
 
-func TestProxy_Get_Caching(t *testing.T) {
+func TestService_Get_Caching(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := &imagerequest.Request{
@@ -263,7 +547,7 @@ func TestProxy_Get_Caching(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo caches a source and
+// TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo caches a source and
 // a variant of it and sets back two days every time pixa stored for them.
 // For the source: last_accessed_at in source_content, and the access and
 // modification times of its file. For the variant: last_accessed_at in
@@ -274,10 +558,10 @@ func TestProxy_Get_Caching(t *testing.T) {
 // Left at the present: the files' status change and birth times, which a
 // program cannot set, and the times of the directories holding the files,
 // which other entries share.
-func TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo(t *testing.T) {
+func TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	variant := photoVariant(fixtures, 85, imagerequest.FitCover)
 
 	resp, err := svc.Get(t.Context(), variant)
@@ -288,8 +572,8 @@ func TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo(t *testing.T) {
 	_ = resp.Content.Close()
 
 	twoDaysAgo := time.Now().AddDate(0, 0, -2)
-	backdateSource(t, svc, variant, twoDaysAgo)
-	backdateVariant(t, svc, variant, twoDaysAgo)
+	backdateSource(t, svc.cache, variant, twoDaysAgo)
+	backdateVariant(t, svc.cache, variant, twoDaysAgo)
 
 	resp, err = svc.Get(t.Context(), variant)
 	if err != nil {
@@ -311,23 +595,23 @@ func TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo(t *testing.T) {
 
 	_ = resp.Content.Close()
 
-	fetches := readCounters(t, svc).upstreamFetchCount
+	fetches := readCounters(svc.cache).upstreamFetchCount
 	if fetches != 1 {
 		t.Errorf("upstream fetches = %d, want 1", fetches)
 	}
 }
 
 // backdateSource sets every time pixa stored for req's cached source to when,
-// as listed on TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo.
+// as listed on TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo.
 func backdateSource(
-	t *testing.T, svc *testProxy, req *imagerequest.Request, when time.Time,
+	t *testing.T, cache *Cache, req *imagerequest.Request, when time.Time,
 ) {
 	t.Helper()
 
 	key := req.Source.Key()
-	setSourceLastAccessed(t, svc.db, key, when)
+	setSourceLastAccessed(t, cache, key, when)
 
-	path := sourceFilePath(svc, key)
+	path := cache.srcContent.keyToPath(key)
 
 	err := os.Chtimes(path, when, when)
 	if err != nil {
@@ -337,16 +621,16 @@ func backdateSource(
 
 // backdateVariant sets every time pixa stored for the cached variant req asks
 // for to when, as listed on
-// TestProxy_Get_ServesSourceAndVariantCachedTwoDaysAgo.
+// TestService_Get_ServesSourceAndVariantCachedTwoDaysAgo.
 func backdateVariant(
-	t *testing.T, svc *testProxy, req *imagerequest.Request, when time.Time,
+	t *testing.T, cache *Cache, req *imagerequest.Request, when time.Time,
 ) {
 	t.Helper()
 
 	key := imagerequest.CacheKey(req)
-	path := variantFilePath(svc, key)
+	path := cache.variants.keyToPath(key)
 
-	setVariantLastAccessed(t, svc.db, key, when)
+	setVariantLastAccessed(t, cache, key, when)
 
 	err := os.Chtimes(path, when, when)
 	if err != nil {
@@ -354,10 +638,10 @@ func backdateVariant(
 	}
 }
 
-func TestProxy_Get_DifferentSizes(t *testing.T) {
+func TestService_Get_DifferentSizes(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	// Request same image at different sizes
@@ -408,10 +692,37 @@ func TestProxy_Get_DifferentSizes(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_ContextCancellation(t *testing.T) {
+func TestService_ValidateRequest_NoSigningKey(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	// Service with no signing key - all non-allowlisted requests should fail
+	svc, fixtures := SetupTestService(t, WithNoAllowlist())
+
+	req := &imagerequest.Request{
+		Source: imagerequest.Source{
+			Host: fixtures.OtherHost,
+			Path: testPathUpload,
+		},
+		Transform: imagerequest.Transform{
+			Size:    imagerequest.Size{Width: 50, Height: 50},
+			Format:  imagerequest.FormatJPEG,
+			Quality: 85,
+			FitMode: imagerequest.FitCover,
+		},
+	}
+
+	err := svc.ValidateRequest(req)
+	if err == nil {
+		t.Error(
+			"ValidateRequest() expected error when no signing key and host not allowlisted",
+		)
+	}
+}
+
+func TestService_Get_ContextCancellation(t *testing.T) {
+	t.Parallel()
+
+	svc, fixtures := SetupTestService(t)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // Cancel immediately
@@ -435,10 +746,10 @@ func TestProxy_Get_ContextCancellation(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_ReturnsETag(t *testing.T) {
+func TestService_Get_ReturnsETag(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := &imagerequest.Request{
@@ -472,10 +783,10 @@ func TestProxy_Get_ReturnsETag(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_ETagConsistency(t *testing.T) {
+func TestService_Get_ETagConsistency(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	req := &imagerequest.Request{
@@ -517,10 +828,10 @@ func TestProxy_Get_ETagConsistency(t *testing.T) {
 	}
 }
 
-func TestProxy_Get_DifferentETagsForDifferentContent(t *testing.T) {
+func TestService_Get_DifferentETagsForDifferentContent(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
 
 	// Request same image at different sizes - should get different ETags

internal/imgcache/source_content_internal_test.go

@@ -2,24 +2,19 @@ package imgcache
 
 import (
 	"bytes"
-	"errors"
-	"fmt"
-	"image/color"
 	"io"
 	"os"
 	"path/filepath"
 	"testing"
 
-	"sneak.berlin/go/pixa/internal/imageprocessor"
 	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/magic"
 )
 
-// TestPutSource_StoresIdenticalBytesOfTwoURLsTwice stores the same bytes
+// TestStoreSource_StoresIdenticalBytesOfTwoURLsTwice stores the same bytes
 // for two source URLs and checks that each URL has a source_content row of
 // its own and a file of its own, named by its source key under
 // cache/sources/<ab>/<cd>/.
-func TestPutSource_StoresIdenticalBytesOfTwoURLsTwice(t *testing.T) {
+func TestStoreSource_StoresIdenticalBytesOfTwoURLsTwice(t *testing.T) {
 	t.Parallel()
 
 	cache, stateDir := newEvictionTestCache(t, 1<<30)
@@ -69,7 +64,7 @@ func TestEvictSourceBlob_LeavesSourceWithIdenticalBytesServed(t *testing.T) {
 	t.Parallel()
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
-	content := generateTestJPEG(t, 20, 20, color.RGBA{0x5B, 0x5B, 0x5B, 255})
+	content := bytes.Repeat([]byte{0x5B}, 400)
 
 	evicted := storeEvictionTestSource(t, cache, testHostCDN, "/evicted.jpg", content)
 	storeEvictionTestSource(t, cache, testHostCDN, "/kept.jpg", content)
@@ -79,8 +74,7 @@ func TestEvictSourceBlob_LeavesSourceWithIdenticalBytesServed(t *testing.T) {
 		t.Fatalf("evictSourceBlob() error = %v", err)
 	}
 
-	_, err = os.Stat(cache.srcContent.keyToPath(string(evicted)))
-	if err == nil {
+	if cache.srcContent.Exists(evicted) {
 		t.Error("the evicted source's file is still on disk")
 	}
 
@@ -90,12 +84,18 @@ func TestEvictSourceBlob_LeavesSourceWithIdenticalBytesServed(t *testing.T) {
 		t.Errorf("the evicted source still has %d source_content rows", n)
 	}
 
-	reader, _, _, err := cache.Source(t.Context(),
-		imagerequest.Source{Host: testHostCDN, Path: "/kept.jpg"})
-	t.Logf("Source() of the kept source: error %v", err)
+	kept, err := cache.LookupSource(t.Context(), &imagerequest.Request{
+		Source: imagerequest.Source{Host: testHostCDN, Path: "/kept.jpg"},
+	})
+	t.Logf("LookupSource() of the kept source = %q, error %v", kept, err)
 
+	if err != nil || kept == "" {
+		t.Fatalf("LookupSource() of the kept source = %q, %v; want it cached", kept, err)
+	}
+
+	reader, _, err := cache.GetSourceContent(kept)
 	if err != nil {
-		t.Fatalf("Source() of the kept source error = %v; want it cached", err)
+		t.Fatalf("GetSourceContent() of the kept source error = %v", err)
 	}
 
 	defer func() { _ = reader.Close() }()
@@ -111,10 +111,10 @@ func TestEvictSourceBlob_LeavesSourceWithIdenticalBytesServed(t *testing.T) {
 	}
 }
 
-// TestPutSource_FailedRowWriteLeavesNoFile drops source_content, so that
-// PutSource cannot write the source's row, and checks that the store fails
+// TestStoreSource_FailedRowWriteLeavesNoFile drops source_content, so that
+// StoreSource cannot write the source's row, and checks that the store fails
 // and leaves no file under the source's key.
-func TestPutSource_FailedRowWriteLeavesNoFile(t *testing.T) {
+func TestStoreSource_FailedRowWriteLeavesNoFile(t *testing.T) {
 	t.Parallel()
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
@@ -127,112 +127,15 @@ func TestPutSource_FailedRowWriteLeavesNoFile(t *testing.T) {
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{Host: testHostCDN, Path: testPathCat},
 	}
-	key, err := cache.PutSource(t.Context(), req.Source,
+	key, err := cache.StoreSource(t.Context(), req,
 		bytes.NewReader([]byte("source bytes")))
-	t.Logf("PutSource() = %q, error = %v", key, err)
+	t.Logf("StoreSource() = %q, error = %v", key, err)
 
 	if err == nil {
-		t.Error("PutSource() error = nil, want the failed row write")
+		t.Error("StoreSource() error = nil, want the failed row write")
 	}
 
-	_, err = os.Stat(cache.srcContent.keyToPath(string(req.Source.Key())))
-	if err == nil {
+	if cache.srcContent.Exists(req.Source.Key()) {
 		t.Error("the source's file is on disk although its row was not written")
 	}
 }
-
-// TestSource_FormatFromFirstBytes stores an image in each source format
-// under one source URL, in turn. After each store, Source must return that
-// image whole, with its format read from the file.
-func TestSource_FormatFromFirstBytes(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-	processor := imageprocessor.New(imageprocessor.Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	})
-	jpegImage := generateTestJPEG(t, 40, 30, color.RGBA{200, 40, 40, 255})
-	src := imagerequest.Source{Host: testHostCDN, Path: testPathCat}
-
-	for _, format := range []imagerequest.Format{
-		imagerequest.FormatJPEG, imagerequest.FormatPNG, imagerequest.FormatGIF,
-		imagerequest.FormatWebP, imagerequest.FormatAVIF, imagerequest.FormatJXL,
-	} {
-		result, err := processor.Process(t.Context(), bytes.NewReader(jpegImage),
-			imagerequest.FormatJPEG, &imagerequest.Transform{Format: format})
-		if err != nil {
-			t.Fatalf("making a %s image: %v", format, err)
-		}
-
-		image, err := io.ReadAll(result.Content)
-		if err != nil {
-			t.Fatalf("reading the %s image: %v", format, err)
-		}
-
-		_, err = cache.PutSource(t.Context(), src, bytes.NewReader(image))
-		if err != nil {
-			t.Fatalf("PutSource(%s) error = %v", format, err)
-		}
-
-		reader, size, got, err := cache.Source(t.Context(), src)
-		if err != nil {
-			t.Fatalf("Source() of the %s image error = %v", format, err)
-		}
-
-		served, err := io.ReadAll(reader)
-		_ = reader.Close()
-
-		if err != nil {
-			t.Fatalf("reading the %s source: %v", format, err)
-		}
-
-		t.Logf("%s: %d bytes read as %s", format, size, got)
-
-		if got != format {
-			t.Errorf("Source() of the %s image format = %q, want %q",
-				format, got, format)
-		}
-
-		if size != int64(len(image)) || !bytes.Equal(served, image) {
-			t.Errorf("%s source read as %d bytes, size %d, want the %d bytes stored",
-				format, len(served), size, len(image))
-		}
-	}
-}
-
-// TestSource_RefusesFileOfNoSourceFormat checks that Source refuses a
-// cached source whose file's first bytes are not those of a source format,
-// with an error other than ErrNotFound.
-func TestSource_RefusesFileOfNoSourceFormat(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-	jpegImage := generateTestJPEG(t, 10, 10, color.RGBA{0, 0, 255, 255})
-
-	tests := []struct {
-		name    string
-		content []byte
-		wantErr error
-	}{
-		{"text", []byte("this is text, not an image"), magic.ErrUnknownFormat},
-		{"SVG", []byte(`<svg xmlns="http://www.w3.org/2000/svg"></svg>`),
-			magic.ErrUnknownFormat},
-		{"JPEG cut to 10 bytes", jpegImage[:10], io.EOF},
-		{"empty file", nil, io.EOF},
-	}
-
-	for i, tt := range tests {
-		path := fmt.Sprintf("/refused%d.jpg", i)
-		storeEvictionTestSource(t, cache, testHostCDN, path, tt.content)
-
-		reader, _, format, err := cache.Source(t.Context(),
-			imagerequest.Source{Host: testHostCDN, Path: path})
-		t.Logf("%s: Source() error = %v", tt.name, err)
-
-		if reader != nil || format != "" || !errors.Is(err, tt.wantErr) {
-			t.Errorf("%s: Source() = reader %v, format %q, error %v; "+
-				"want no reader and %v", tt.name, reader, format, err, tt.wantErr)
-		}
-	}
-}

internal/imgcache/stats_internal_test.go

@@ -1,4 +1,4 @@
-package imageproxy
+package imgcache
 
 import (
 	"bytes"
@@ -12,16 +12,15 @@ import (
 	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// TestProxy_Get_CountsStats walks Get through a miss that fetches the
+// TestService_Get_CountsStats walks Get through a miss that fetches the
 // source, a hit, a miss that reuses the cached source, and two misses whose
-// source cannot be used, checking every counter of the proxy and its cache
-// after each.
-func TestProxy_Get_CountsStats(t *testing.T) {
+// source cannot be used, checking every counter of the cache after each.
+func TestService_Get_CountsStats(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 
-	// NewTestFS builds the same files the test proxy's fetcher serves.
+	// NewTestFS builds the same files the test service's fetcher serves.
 	testFS, _ := NewTestFS(t)
 
 	photo, err := fs.ReadFile(testFS, fixtures.GoodHostJPEG)
@@ -77,7 +76,7 @@ func TestProxy_Get_CountsStats(t *testing.T) {
 			_ = resp.Content.Close()
 		}
 
-		got := readCounters(t, svc)
+		got := readCounters(svc.cache)
 		if got != step.want {
 			t.Fatalf("after the %s: counters = %+v, want %+v", step.name, got, step.want)
 		}
@@ -94,7 +93,7 @@ type fakeUpstream struct {
 }
 
 func (u *fakeUpstream) Fetch(
-	context.Context, imagerequest.Source,
+	context.Context, string,
 ) (*httpfetcher.FetchResult, error) {
 	return &httpfetcher.FetchResult{
 		Content:       io.NopCloser(u),
@@ -115,11 +114,10 @@ func (u *fakeUpstream) Read(p []byte) (int, error) {
 	return 0, u.err
 }
 
-// TestProxy_Get_CountsInterruptedMisses checks every counter of the proxy
-// and its cache after a miss whose request context ends during or after the
-// upstream fetch, and after a miss whose upstream body is over the size
-// limit.
-func TestProxy_Get_CountsInterruptedMisses(t *testing.T) {
+// TestService_Get_CountsInterruptedMisses checks every counter of the cache
+// after a miss whose request context ends during or after the upstream
+// fetch, and after a miss whose upstream body is over the size limit.
+func TestService_Get_CountsInterruptedMisses(t *testing.T) {
 	t.Parallel()
 
 	photo := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
@@ -147,7 +145,7 @@ func TestProxy_Get_CountsInterruptedMisses(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			svc, fixtures := setupTestProxy(t)
+			svc, fixtures := SetupTestService(t)
 
 			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
@@ -184,7 +182,7 @@ func TestProxy_Get_CountsInterruptedMisses(t *testing.T) {
 				_ = resp.Content.Close()
 			}
 
-			got := readCounters(t, svc)
+			got := readCounters(svc.cache)
 			if got != tc.want {
 				t.Errorf("counters = %+v, want %+v", got, tc.want)
 			}
@@ -192,13 +190,13 @@ func TestProxy_Get_CountsInterruptedMisses(t *testing.T) {
 	}
 }
 
-// TestProxy_Get_CountsHitAfterRequestEnds checks every counter of the
-// proxy and its cache after a hit served with a request context that has
-// already ended: only the hit count moves.
-func TestProxy_Get_CountsHitAfterRequestEnds(t *testing.T) {
+// TestService_Get_CountsHitAfterRequestEnds checks every counter of the
+// cache after a hit served with a request context that has already ended:
+// only the hit count moves.
+func TestService_Get_CountsHitAfterRequestEnds(t *testing.T) {
 	t.Parallel()
 
-	svc, fixtures := setupTestProxy(t)
+	svc, fixtures := SetupTestService(t)
 
 	req := &imagerequest.Request{
 		Source: imagerequest.Source{
@@ -221,7 +219,7 @@ func TestProxy_Get_CountsHitAfterRequestEnds(t *testing.T) {
 
 	_ = resp.Content.Close()
 
-	want := readCounters(t, svc)
+	want := readCounters(svc.cache)
 	want.hitCount++
 
 	ctx, cancel := context.WithCancel(t.Context())
@@ -238,7 +236,7 @@ func TestProxy_Get_CountsHitAfterRequestEnds(t *testing.T) {
 		t.Fatalf("CacheStatus = %v, want %v", resp.CacheStatus, CacheHit)
 	}
 
-	got := readCounters(t, svc)
+	got := readCounters(svc.cache)
 	if got != want {
 		t.Errorf("counters = %+v, want %+v", got, want)
 	}

internal/imgcache/storage.go

@@ -0,0 +1,358 @@
+package imgcache
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/magic"
+)
+
+// Storage constants.
+const (
+	// StorageDirPerm is the permission mode for storage directories.
+	StorageDirPerm = 0750
+	// StorageFilePerm is the permission mode for storage files.
+	StorageFilePerm = 0600
+	// MinHashLength is the minimum hash length for path splitting.
+	MinHashLength = 4
+)
+
+// Storage errors.
+var (
+	ErrNotFound = errors.New("content not found")
+)
+
+// ContentStorage handles source image file storage, one file per source
+// URL. Files are stored at: <basedir>/<ab>/<cd>/<source key>
+type ContentStorage struct {
+	baseDir string
+}
+
+// NewContentStorage creates a new content storage at the given base directory.
+func NewContentStorage(baseDir string) (*ContentStorage, error) {
+	err := os.MkdirAll(baseDir, StorageDirPerm)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create storage directory: %w", err)
+	}
+
+	return &ContentStorage{baseDir: baseDir}, nil
+}
+
+// Store writes data with writeFileSynced to the path derived from key,
+// replacing any file already there, and returns its size.
+func (s *ContentStorage) Store(
+	key imagerequest.SourceKey, data []byte,
+) (int64, error) {
+	path := s.keyToPath(key)
+
+	err := os.MkdirAll(filepath.Dir(path), StorageDirPerm)
+	if err != nil {
+		return 0, fmt.Errorf("failed to create directory: %w", err)
+	}
+
+	err = writeFileSynced(path, data)
+	if err != nil {
+		return 0, err
+	}
+
+	return int64(len(data)), nil
+}
+
+// Load returns a reader for the content with the given key.
+func (s *ContentStorage) Load(key imagerequest.SourceKey) (io.ReadCloser, error) {
+	path := s.keyToPath(key)
+
+	f, err := os.Open(path) //nolint:gosec // path derived from source key
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, ErrNotFound
+		}
+
+		return nil, fmt.Errorf("failed to open content: %w", err)
+	}
+
+	return f, nil
+}
+
+// LoadWithSize returns a reader and file size for the content with the given key.
+func (s *ContentStorage) LoadWithSize(
+	key imagerequest.SourceKey,
+) (io.ReadCloser, int64, error) {
+	path := s.keyToPath(key)
+
+	f, err := os.Open(path) //nolint:gosec // path derived from source key
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, 0, ErrNotFound
+		}
+
+		return nil, 0, fmt.Errorf("failed to open content: %w", err)
+	}
+
+	stat, err := f.Stat()
+	if err != nil {
+		_ = f.Close()
+
+		return nil, 0, fmt.Errorf("failed to stat content: %w", err)
+	}
+
+	return f, stat.Size(), nil
+}
+
+// Delete removes content with the given key.
+func (s *ContentStorage) Delete(key imagerequest.SourceKey) error {
+	path := s.keyToPath(key)
+
+	err := os.Remove(path)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to delete content: %w", err)
+	}
+
+	return nil
+}
+
+// Exists checks if content with the given key exists.
+func (s *ContentStorage) Exists(key imagerequest.SourceKey) bool {
+	path := s.keyToPath(key)
+	_, err := os.Stat(path)
+
+	return err == nil
+}
+
+// writeFileSynced writes data to path through a temp file in the same
+// directory: the temp file is synced to disk, renamed to path, and the
+// directory synced after, so that neither a concurrent reader nor a
+// crash finds a partial file under path. When the directory sync fails,
+// the file is removed from path, so that a failed write leaves no file
+// there.
+func writeFileSynced(path string, data []byte) error {
+	dir := filepath.Dir(path)
+
+	tmpFile, err := os.CreateTemp(dir, ".tmp-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp file: %w", err)
+	}
+
+	tmpPath := tmpFile.Name()
+
+	_, err = tmpFile.Write(data)
+	if err != nil {
+		_ = tmpFile.Close()
+		_ = os.Remove(tmpPath)
+
+		return fmt.Errorf("failed to write temp file: %w", err)
+	}
+
+	err = tmpFile.Sync()
+	if err != nil {
+		_ = tmpFile.Close()
+		_ = os.Remove(tmpPath)
+
+		return fmt.Errorf("failed to sync temp file: %w", err)
+	}
+
+	err = tmpFile.Close()
+	if err != nil {
+		_ = os.Remove(tmpPath)
+
+		return fmt.Errorf("failed to close temp file: %w", err)
+	}
+
+	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
+	if err != nil {
+		_ = os.Remove(tmpPath)
+
+		return fmt.Errorf("failed to rename temp file: %w", err)
+	}
+
+	err = syncDirectory(dir)
+	if err != nil {
+		_ = os.Remove(path)
+
+		return err
+	}
+
+	return nil
+}
+
+// syncDirectory syncs the directory dir to disk, so that a file just
+// renamed into it is still there after a crash.
+func syncDirectory(dir string) error {
+	d, err := os.Open(filepath.Clean(dir))
+	if err != nil {
+		return fmt.Errorf("failed to open directory: %w", err)
+	}
+
+	err = d.Sync()
+	_ = d.Close()
+
+	if err != nil {
+		return fmt.Errorf("failed to sync directory: %w", err)
+	}
+
+	return nil
+}
+
+// keyToPath converts a key to a file path: <basedir>/<ab>/<cd>/<key>
+func (s *ContentStorage) keyToPath(key imagerequest.SourceKey) string {
+	k := string(key)
+	if len(k) < MinHashLength {
+		return filepath.Clean(filepath.Join(s.baseDir, k))
+	}
+
+	return filepath.Clean(filepath.Join(s.baseDir, k[0:2], k[2:4], k))
+}
+
+// VariantStorage handles key-based file storage for processed image variants.
+// Files are stored at: <basedir>/<ab>/<cd>/<cache_key>
+type VariantStorage struct {
+	baseDir string
+}
+
+// errNotAnOutputFormat is returned for a variant file whose first bytes are
+// those of a format pixa reads but never writes, such as SVG.
+var errNotAnOutputFormat = errors.New("variant file is not in an output format")
+
+// NewVariantStorage creates a new variant storage at the given base directory.
+func NewVariantStorage(baseDir string) (*VariantStorage, error) {
+	err := os.MkdirAll(baseDir, StorageDirPerm)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create variant storage directory: %w", err)
+	}
+
+	return &VariantStorage{baseDir: baseDir}, nil
+}
+
+// Store writes content to storage at the given key with writeFileSynced.
+func (s *VariantStorage) Store(
+	key imagerequest.VariantKey, r io.Reader,
+) (int64, error) {
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return 0, fmt.Errorf("failed to read content: %w", err)
+	}
+
+	path := s.keyToPath(key)
+
+	err = os.MkdirAll(filepath.Dir(path), StorageDirPerm)
+	if err != nil {
+		return 0, fmt.Errorf("failed to create directory: %w", err)
+	}
+
+	err = writeFileSynced(path, data)
+	if err != nil {
+		return 0, err
+	}
+
+	return int64(len(data)), nil
+}
+
+// Load returns a reader for the content at the given key.
+func (s *VariantStorage) Load(key imagerequest.VariantKey) (io.ReadCloser, error) {
+	path := s.keyToPath(key)
+
+	f, err := os.Open(path) //nolint:gosec // path derived from cache key
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, ErrNotFound
+		}
+
+		return nil, fmt.Errorf("failed to open content: %w", err)
+	}
+
+	return f, nil
+}
+
+// LoadWithContentType opens the content at the given key and returns a
+// reader, the file size and the content type, which is read from the
+// file's first bytes. A missing file is ErrNotFound. A file whose first
+// bytes are not those of an output format, an empty one included, is
+// closed again and the reason returned.
+func (s *VariantStorage) LoadWithContentType(
+	key imagerequest.VariantKey,
+) (io.ReadCloser, int64, string, error) {
+	path := s.keyToPath(key)
+
+	f, err := os.Open(path) //nolint:gosec // path derived from cache key
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, 0, "", ErrNotFound
+		}
+
+		return nil, 0, "", fmt.Errorf("failed to open content: %w", err)
+	}
+
+	stat, err := f.Stat()
+	if err != nil {
+		_ = f.Close()
+
+		return nil, 0, "", fmt.Errorf("failed to stat content: %w", err)
+	}
+
+	contentType, err := outputContentType(f)
+	if err != nil {
+		_ = f.Close()
+
+		return nil, 0, "", err
+	}
+
+	return f, stat.Size(), contentType, nil
+}
+
+// outputContentType reads the first bytes of content, without moving its
+// offset, and returns the content type of the output format they show.
+func outputContentType(content io.ReaderAt) (string, error) {
+	firstBytes := make([]byte, magic.MinMagicBytes)
+
+	_, err := content.ReadAt(firstBytes, 0)
+	if err != nil {
+		return "", fmt.Errorf("failed to read the first bytes: %w", err)
+	}
+
+	detected, err := magic.DetectFormat(firstBytes)
+	if err != nil {
+		return "", err
+	}
+
+	_, isOutputFormat := magic.MIMEToImageFormat(string(detected))
+	if !isOutputFormat {
+		return "", fmt.Errorf("%w: %s", errNotAnOutputFormat, detected)
+	}
+
+	return string(detected), nil
+}
+
+// Exists checks if content exists at the given key.
+func (s *VariantStorage) Exists(key imagerequest.VariantKey) bool {
+	path := s.keyToPath(key)
+	_, err := os.Stat(path)
+
+	return err == nil
+}
+
+// Delete removes the content at the given key. A missing file is not an
+// error.
+func (s *VariantStorage) Delete(key imagerequest.VariantKey) error {
+	path := s.keyToPath(key)
+
+	err := os.Remove(path)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to delete content: %w", err)
+	}
+
+	return nil
+}
+
+// keyToPath converts a key to a file path: <basedir>/<ab>/<cd>/<key>
+func (s *VariantStorage) keyToPath(key imagerequest.VariantKey) string {
+	k := string(key)
+	if len(k) < MinHashLength {
+		return filepath.Join(s.baseDir, k)
+	}
+
+	return filepath.Join(s.baseDir, k[0:2], k[2:4], k)
+}