Run only script/cibuild in the Gitea workflow (closes #203)

The workflow's script/docker-smoke step is removed, so the workflow
checks out the repo and runs script/cibuild and nothing else, as the
canonical REPO_POLICIES.md says. The owner ruled on the issue that
make check covers what needs covering.

CI no longer starts the image and waits for its healthcheck.
script/docker-smoke and make docker-smoke stay, to run by hand, and
the script's header comment no longer says the workflow runs it. The
dated TODO.md entries that say the workflow runs it are history and
stay as written.

Model: opus-5-5

.gitignore

@@ -70,3 +70,4 @@ vendor/
 # Local dev configs
 config.yml
 config.yaml
+config.dev.yml

AGENTS.md

@@ -1,76 +1,75 @@
 # Repository Rules
 
-Last Updated 2026-10-27
+Last Updated 2026-01-08
 
-These rules MUST be followed at all times. This is very important.
+These rules MUST be followed at all times, it is very important.
 
-- Never use `git add -A`. Stage specific changes for a deliberate commit. A
-  commit holds one change. After each change, make a commit with a good one-line
-  summary.
+- Never use `git add -A` - add specific changes to a deliberate commit. A commit
+  should contain one change. After each change, make a commit with a good
+  one-line summary.
 
 - NEVER modify the linter config without asking first.
 
-- NEVER modify a test to exclude special cases or otherwise make it pass without
-  asking first. In almost all cases, change the code, NOT the test. You need
-  explicit user approval to modify an existing test. If you think a test needs
-  to change, make your case and ask for permission to proceed. Then stop. A bug
-  fix may change an existing test without asking only when that test pins
-  exactly the behavior the filed bug calls wrong. The change must then move the
-  test to the fixed behavior and nothing else. Any other change to an existing
-  test needs explicit user approval. Writing NEW tests needs no approval.
+- NEVER modify tests to exclude special cases or otherwise get them to pass
+  without asking first. In almost all cases, the code should be changed, NOT the
+  tests. If you think the test needs to be changed, make your case for that and
+  ask for permission to proceed, then stop. You need explicit user approval to
+  modify existing tests. A bug fix may change an existing test without asking
+  when that test pins exactly the behavior the filed bug calls wrong, and the
+  change moves it to the fixed behavior and nothing else; any other change to an
+  existing test still needs explicit user approval. (You do not need user
+  approval for writing NEW tests.)
 
-- When linting, assume the linter config is CORRECT. Treat each item the linter
-  reports as something that legitimately needs fixing in the code.
+- When linting, assume the linter config is CORRECT, and that each item output
+  by the linter is something that legitimately needs fixing in the code.
 
 - When running tests, use `make test`.
 
-- Before committing, run `make check`. It runs `make test`, `make lint` and
-  `make fmt-check`. Any issue it finds MUST be resolved before committing,
-  unless you are explicitly told otherwise.
+- Before commits, run `make check`. This runs `make lint` and `make test` and
+  `make check-fmt`. Any issues discovered MUST be resolved before committing
+  unless explicitly told otherwise.
 
 - When fixing a bug, write a failing test for the bug FIRST. Add appropriate
-  logging to the test, to make sure the test is written correctly. Commit that.
-  Then work on the fix until the test passes, without changing the test further.
-  Then commit the fix.
+  logging to the test to ensure it is written correctly. Commit that. Then go
+  about fixing the bug until the test passes (without modifying the test
+  further). Then commit that.
 
-- When adding a new feature, do the same: write a test first (test-driven
-  development, TDD). The test does not need to be very complex. Commit the test,
-  then commit the feature.
+- When adding a new feature, do the same - implement a test first (TDD). It
+  doesn't have to be super complex. Commit the test, then commit the feature.
 
-- When adding a new feature, use a feature branch. The feature branch reaches
-  `next` through a PR that passes review. It is merged only when the feature is
-  completely finished and the code is up to standards. The code is up to
-  standards when it passes `make check`. The branch is deleted after the merge.
-  Only the user merges `next` into `main`.
+- When adding a new feature, use a feature branch. When the feature is
+  completely finished and the code is up to standards (passes `make check`) then
+  and only then can the feature branch be merged into `main` and the branch
+  deleted.
 
-- Write `godoc` comments for all exported types and functions as you go along.
+- Write godoc documentation comments for all exported types and functions as you
+  go along.
 
-- ALWAYS be consistent in naming. If you name something one way in one place,
-  use the EXACT SAME name in every other place.
+- ALWAYS be consistent in naming. If you name something one thing in one place,
+  name it the EXACT SAME THING in another place.
 
-- Be descriptive and specific in naming. `al` is bad; `SourceHostAllowlist` is
+- Be descriptive and specific in naming. `wl` is bad; `SourceHostWhitelist` is
   good. `ConnsPerHost` is bad; `MaxConnectionsPerHost` is good.
 
-- This is not prototype or teaching code. It is designed for production. Any
-  security issue (such as denial of service) or other web vulnerability is a P1
-  bug. It must be added at the top of `TODO.md`.
+- This is not prototype or teaching code - this is designed for production. Any
+  security issues (such as denial of service) or other web vulnerabilities are
+  P1 bugs and must be added to TODO.md at the top.
 
-- Do not stub an implementation unless you are specifically instructed to. This
-  is production code, and we need working implementations.
+- As this is production code, no stubbing of implementations unless specifically
+  instructed. We need working implementations.
 
 - NEVER silently fall back to a different setting when a user's parameter
-  explicitly specifies a value. For example, if a user requests `format=webp`
-  and WebP encoding is not supported, return an error. Do NOT silently output
-  PNG instead. If a user specifies `fit=invalid` and that fit mode does not
-  exist, return an error. Do NOT silently default to `cover`. A silent fallback
-  violates the principle of least surprise and masks bugs. Defaults are
-  acceptable only for OMITTED parameters, never for INVALID explicit values.
+  explicitly specifies a value. If a user requests format=webp and WebP encoding
+  is not supported, return an error - do NOT silently output PNG instead. If a
+  user specifies fit=invalid and that fit mode doesn't exist, return an error -
+  do NOT silently default to "cover". Silent fallbacks violate the principle of
+  least surprise and mask bugs. The only acceptable defaults are for OMITTED
+  parameters, never for INVALID explicit values.
 
-- Avoid vendoring dependencies unless specifically instructed to. NEVER commit
-  the `vendor/` directory. NEVER commit compiled binaries. If such a directory
-  or file exists and `.gitignore` does not list it, add it to `.gitignore`.
-  Commit that `.gitignore` change. Keep the entire git repository, history
-  included, under 20 MiB. Go over 20 MiB only when you specifically must commit
-  a large file, such as a media file used as a test fixture. Only OUR source
-  code and its immediately supporting files, such as test examples, go into the
-  repository and its history.
+- Avoid vendoring deps unless specifically instructed to. NEVER commit the
+  vendor directory, NEVER commit compiled binaries. If these directories or
+  files exist, add them to .gitignore (and commit the .gitignore) if they are
+  not already in there. Keep the entire git repository (with history) small -
+  under 20MiB, unless you specifically must commit larger files (e.g. test
+  fixture example media files). Only OUR source code and immediately supporting
+  files (such as test examples) goes into the repo/history.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup check lint test fmt fmt-check build clean docker docker-smoke docker-versioned docker-test devserver devserver-stop hooks loadtest bench
+.PHONY: bootstrap setup check lint test fmt fmt-check build clean docker docker-smoke docker-versioned docker-test devserver devserver-stop hooks loadtest
 
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -X main.Version=$(VERSION)
@@ -64,12 +64,6 @@ docker-smoke:
 loadtest:
 	@script/loadtest
 
-# Serve cache hits in parallel through the image handler and report hits per
-# second (needs Go on the host after `script/bootstrap --cgo`, not Docker; a
-# benchmark, not part of check)
-bench:
-	@script/bench
-
 # Build Docker image as `make docker` does, and also tag it pixa:$(VERSION)
 docker-versioned:
 	@script/docker
@@ -79,15 +73,12 @@ docker-versioned:
 docker-test:
 	@script/test
 
-# Run local dev server in Docker, with debug on and a new random signing
-# key each run. Log in to the page with the key it prints.
+# Run local dev server in Docker
 devserver: docker-versioned devserver-stop
-	@key="$$(head -c 32 /dev/urandom | base64)" && \
 	docker run -d --name pixad-dev -p 8080:8080 \
-		-e PIXA_SIGNING_KEY="$$key" -e PIXA_DEBUG=true \
-		pixa:latest >/dev/null && \
-	echo "pixad running at http://localhost:8080" && \
-	echo "signing key: $$key"
+		-v $(CURDIR)/config.dev.yml:/etc/pixa/config.yml:ro \
+		pixa:latest
+	@echo "pixad running at http://localhost:8080"
 
 # Stop dev server
 devserver-stop:

cmd/pixad/main.go

@@ -1,21 +1,10 @@
-// Package main is the entry point for the pixad image proxy server. pixad
-// also runs as a child process of itself, to read the size of an SVG source
-// or to render it (see imageprocessor.RunAsSVGChildProcess).
+// Package main is the entry point for the pixad image proxy server.
 package main
 
-import (
-	"os"
-
-	"sneak.berlin/go/pixa/internal/app"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-)
+import "sneak.berlin/go/pixa/internal/app"
 
 var Version string //nolint:gochecknoglobals // set by ldflags
 
 func main() {
-	if imageprocessor.IsSVGChildProcess(os.Args[1:]) {
-		os.Exit(imageprocessor.RunAsSVGChildProcess(os.Args[1:]))
-	}
-
 	app.Run(Version)
 }

configs/config.example.yml

@@ -158,9 +158,8 @@ access_control_allow_origin: "*"
 # Sentry DSN for error reporting (default: empty, which turns it off)
 sentry_dsn: ""
 
-# Username and password for /metrics, set together (default: unset). pixa
-# serves /metrics, and measures HTTP requests, only when both are set. It
-# measures the pixa_ metrics either way.
+# Username and password for /metrics, set together (default: unset). Metrics
+# are measured and /metrics is served only when both are set.
 # metrics:
 #   username: "admin"
 #   password: "secret"

go.mod

@@ -14,10 +14,10 @@ require (
 	github.com/go-chi/httprate v0.16.0
 	github.com/gorilla/csrf v1.7.3
 	github.com/gorilla/securecookie v1.1.2
+	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/prometheus/client_golang v1.23.2
 	github.com/slok/go-http-metrics v0.13.0
 	github.com/spf13/cobra v1.10.2
-	go.uber.org/dig v1.19.0
 	go.uber.org/fx v1.24.0
 	golang.org/x/crypto v0.41.0
 	golang.org/x/sync v0.19.0
@@ -127,6 +127,7 @@ require (
 	go.opentelemetry.io/otel v1.36.0 // indirect
 	go.opentelemetry.io/otel/metric v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.uber.org/dig v1.19.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect

go.sum

@@ -228,6 +228,8 @@ github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=

internal/allowlist/allowlist.go

@@ -72,3 +72,13 @@ func (w *HostAllowList) IsAllowed(u *url.URL) bool {
 
 	return false
 }
+
+// IsEmpty returns true if the allow list has no entries.
+func (w *HostAllowList) IsEmpty() bool {
+	return len(w.exactHosts) == 0 && len(w.suffixHosts) == 0
+}
+
+// Count returns the total number of allow list entries.
+func (w *HostAllowList) Count() int {
+	return len(w.exactHosts) + len(w.suffixHosts)
+}

internal/allowlist/allowlist_test.go

@@ -139,3 +139,87 @@ func TestHostAllowList_IsAllowed_SuffixMatch(t *testing.T) {
 		},
 	})
 }
+
+func TestHostAllowList_IsEmpty(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		patterns []string
+		want     bool
+	}{
+		{
+			name:     "empty",
+			patterns: []string{},
+			want:     true,
+		},
+		{
+			name:     "nil",
+			patterns: nil,
+			want:     true,
+		},
+		{
+			name:     "whitespace only",
+			patterns: []string{"  ", ""},
+			want:     true,
+		},
+		{
+			name:     "has entries",
+			patterns: []string{"example.com"},
+			want:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			w := allowlist.New(tt.patterns)
+			if got := w.IsEmpty(); got != tt.want {
+				t.Errorf("IsEmpty() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHostAllowList_Count(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		patterns []string
+		want     int
+	}{
+		{
+			name:     "empty",
+			patterns: []string{},
+			want:     0,
+		},
+		{
+			name:     "exact hosts only",
+			patterns: []string{"a.com", "b.com", "c.com"},
+			want:     3,
+		},
+		{
+			name:     "suffix hosts only",
+			patterns: []string{".a.com", ".b.com"},
+			want:     2,
+		},
+		{
+			name:     "mixed",
+			patterns: []string{"exact.com", ".suffix.com"},
+			want:     2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			w := allowlist.New(tt.patterns)
+			if got := w.Count(); got != tt.want {
+				t.Errorf("Count() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

internal/app/app.go

@@ -2,16 +2,12 @@
 package app
 
 import (
-	"context"
 	"fmt"
-	"io"
 	"os"
 	"os/signal"
 	"syscall"
 
-	"github.com/prometheus/client_golang/prometheus"
 	"github.com/spf13/cobra"
-	"go.uber.org/dig"
 	"go.uber.org/fx"
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/database"
@@ -20,7 +16,6 @@ import (
 	"sneak.berlin/go/pixa/internal/healthcheck"
 	"sneak.berlin/go/pixa/internal/logger"
 	"sneak.berlin/go/pixa/internal/middleware"
-	"sneak.berlin/go/pixa/internal/providers"
 	"sneak.berlin/go/pixa/internal/server"
 )
 
@@ -56,10 +51,7 @@ func run(_ *cobra.Command, _ []string) {
 	// A write to a closed stdout or stderr must not end the process.
 	signal.Ignore(syscall.SIGPIPE)
 
-	app := fx.New(
-		// pixad logs with slog only; runApp prints a startup or shutdown
-		// error itself.
-		fx.NopLogger,
+	fx.New(
 		fx.Provide(
 			config.New,
 			database.New,
@@ -69,48 +61,10 @@ func run(_ *cobra.Command, _ []string) {
 			server.New,
 			middleware.New,
 			healthcheck.New,
-			// The registry /metrics serves
-			func() prometheus.Registerer { return prometheus.DefaultRegisterer },
 		),
-		fx.Provide(providers.Constructors()...),
 		fx.Invoke(
 			func(log *logger.Logger) { log.Identify() },
 			func(*server.Server) {},
 		),
-	)
-
-	exitCode := runApp(app, os.Stderr)
-	if exitCode != 0 {
-		os.Exit(exitCode)
-	}
-}
-
-// runApp starts app, waits for a signal or a shutdown request, stops app,
-// and returns the status pixad exits with, as fx.App.Run does. It prints
-// a start or stop error to stderr, once, as the error that caused it:
-// dig.RootCause drops the frames fx and dig wrap around it.
-func runApp(app *fx.App, stderr io.Writer) int {
-	startCtx, cancelStart := context.WithTimeout(context.Background(), app.StartTimeout())
-	defer cancelStart()
-
-	err := app.Start(startCtx)
-	if err != nil {
-		_, _ = fmt.Fprintln(stderr, dig.RootCause(err))
-
-		return 1
-	}
-
-	shutdown := <-app.Wait()
-
-	stopCtx, cancelStop := context.WithTimeout(context.Background(), app.StopTimeout())
-	defer cancelStop()
-
-	err = app.Stop(stopCtx)
-	if err != nil {
-		_, _ = fmt.Fprintln(stderr, dig.RootCause(err))
-
-		return 1
-	}
-
-	return shutdown.ExitCode
+	).Run()
 }

internal/app/app_internal_test.go

@@ -1,65 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"testing"
-
-	"go.uber.org/fx"
-)
-
-var errTestStopFailed = errors.New("test stop hook failed")
-
-// TestRunAppPrintsStopErrorOnce checks that when a stop hook fails, runApp
-// prints the hook's error once and returns exit status 1.
-func TestRunAppPrintsStopErrorOnce(t *testing.T) {
-	t.Parallel()
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Invoke(func(lifecycle fx.Lifecycle, shutdowner fx.Shutdowner) {
-			lifecycle.Append(fx.Hook{
-				// Ask to shut down as soon as the app has started, so
-				// that runApp goes on to stop it.
-				OnStart: func(context.Context) error { return shutdowner.Shutdown() },
-				OnStop:  func(context.Context) error { return errTestStopFailed },
-			})
-		}),
-	)
-
-	var stderr bytes.Buffer
-
-	exitCode := runApp(app, &stderr)
-	if exitCode != 1 {
-		t.Errorf("runApp() = %d, want 1", exitCode)
-	}
-
-	want := errTestStopFailed.Error() + "\n"
-	if stderr.String() != want {
-		t.Errorf("stderr = %q, want %q", stderr.String(), want)
-	}
-}
-
-// TestRunAppReturnsShutdownExitCode checks that runApp returns the exit
-// code a shutdown request names.
-func TestRunAppReturnsShutdownExitCode(t *testing.T) {
-	t.Parallel()
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Invoke(func(lifecycle fx.Lifecycle, shutdowner fx.Shutdowner) {
-			lifecycle.Append(fx.Hook{
-				OnStart: func(context.Context) error {
-					return shutdowner.Shutdown(fx.ExitCode(3))
-				},
-			})
-		}),
-	)
-
-	exitCode := runApp(app, io.Discard)
-	if exitCode != 3 {
-		t.Errorf("runApp() = %d, want 3", exitCode)
-	}
-}

internal/app/app_test.go

@@ -1,177 +0,0 @@
-package app_test
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"strconv"
-	"syscall"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/app"
-)
-
-// These tests run pixad in a child process: the test binary itself,
-// started again with runPixadInChildEnvVar set, which makes TestMain run
-// pixad instead of the tests.
-const runPixadInChildEnvVar = "TEST_RUN_PIXAD_IN_CHILD"
-
-const validTestSigningKey = "test-signing-key-for-app-tests-0123456789"
-
-func TestMain(m *testing.M) {
-	if os.Getenv(runPixadInChildEnvVar) == "1" {
-		os.Args = []string{"pixad"}
-
-		app.Run("test")
-		os.Exit(0)
-	}
-
-	os.Exit(m.Run())
-}
-
-// pixadCommand returns a command that runs pixad with only the given
-// environment, in an empty directory with an empty HOME, so that no
-// config file is found.
-func pixadCommand(t *testing.T, env ...string) (*exec.Cmd, *bytes.Buffer) {
-	t.Helper()
-
-	testBinary := os.Args[0]
-	cmd := exec.CommandContext(t.Context(), testBinary) //nolint:gosec // not tainted
-	cmd.Dir = t.TempDir()
-	// A test binary built with -cover warns on stderr at exit when
-	// GOCOVERDIR is not set.
-	cmd.Env = append([]string{
-		runPixadInChildEnvVar + "=1",
-		"HOME=" + t.TempDir(),
-		"GOCOVERDIR=" + t.TempDir(),
-	}, env...)
-
-	var stderr bytes.Buffer
-
-	cmd.Stderr = &stderr
-
-	return cmd, &stderr
-}
-
-// TestRunPrintsStartupErrorOnce checks that an invalid setting is
-// printed once, as the line that names it, and nothing else goes to
-// stderr.
-func TestRunPrintsStartupErrorOnce(t *testing.T) {
-	t.Parallel()
-
-	cmd, stderr := pixadCommand(t, "PIXA_SIGNING_KEY=short")
-
-	err := cmd.Run()
-
-	var exitErr *exec.ExitError
-	if !errors.As(err, &exitErr) || exitErr.ExitCode() != 1 {
-		t.Fatalf("pixad: got %v, want exit status 1; stderr:\n%s", err, stderr)
-	}
-
-	want := `config key "signing_key" (environment variable PIXA_SIGNING_KEY): ` +
-		"value too short: must be at least 32 characters, got 5\n"
-	if stderr.String() != want {
-		t.Errorf("stderr:\n%s\nwant:\n%s", stderr, want)
-	}
-}
-
-// TestRunWritesNothingToStderrOnStartAndStop starts pixad, waits until
-// it answers its health check, stops it with SIGTERM, and checks that it
-// wrote nothing to stderr.
-func TestRunWritesNothingToStderrOnStartAndStop(t *testing.T) {
-	t.Parallel()
-
-	port := freePort(t)
-	cmd, stderr := pixadCommand(t,
-		"PORT="+strconv.Itoa(port),
-		"PIXA_STATE_DIR="+t.TempDir(),
-		"PIXA_SIGNING_KEY="+validTestSigningKey,
-	)
-
-	err := cmd.Start()
-	if err != nil {
-		t.Fatalf("starting pixad: %v", err)
-	}
-
-	waitForHealthCheck(t, cmd, port, stderr)
-
-	err = cmd.Process.Signal(syscall.SIGTERM)
-	if err != nil {
-		t.Fatalf("signalling pixad: %v", err)
-	}
-
-	err = cmd.Wait()
-	if err != nil {
-		t.Fatalf("pixad: got %v, want exit status 0; stderr:\n%s", err, stderr)
-	}
-
-	if stderr.Len() != 0 {
-		t.Errorf("stderr is not empty:\n%s", stderr)
-	}
-}
-
-// freePort returns a TCP port on the loopback address that nothing
-// listens on.
-func freePort(t *testing.T) int {
-	t.Helper()
-
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("finding a free port: %v", err)
-	}
-
-	addr, ok := listener.Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not a TCP address", listener.Addr())
-	}
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("closing listener: %v", err)
-	}
-
-	return addr.Port
-}
-
-// waitForHealthCheck waits up to 30 seconds for pixad, started as cmd, to
-// answer its health check on port. If it does not, it stops pixad and
-// fails the test with what pixad wrote to stderr.
-func waitForHealthCheck(t *testing.T, cmd *exec.Cmd, port int, stderr *bytes.Buffer) {
-	t.Helper()
-
-	url := fmt.Sprintf("http://127.0.0.1:%d/.well-known/healthcheck.json", port)
-	deadline := time.Now().Add(30 * time.Second)
-
-	for time.Now().Before(deadline) {
-		req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url, nil)
-		if err != nil {
-			t.Fatalf("health check request: %v", err)
-		}
-
-		resp, err := http.DefaultClient.Do(req)
-		if err == nil {
-			_ = resp.Body.Close()
-
-			if resp.StatusCode == http.StatusOK {
-				return
-			}
-		}
-
-		time.Sleep(100 * time.Millisecond)
-	}
-
-	// Stop pixad first: stderr is complete, and safe to read, only once
-	// cmd.Wait has returned.
-	_ = cmd.Process.Kill()
-	_ = cmd.Wait()
-
-	t.Fatalf("pixad did not answer its health check on port %d; stderr:\n%s",
-		port, stderr)
-}

internal/config/cache_max_bytes_internal_test.go

@@ -135,38 +135,10 @@ func TestCacheMaxBytesInvalidValuesAbortStartup(t *testing.T) {
 	}
 }
 
-// TestDefaultCacheMaxBytesAppliesFloor verifies that when 75% of the
-// free space plus what the cache holds is below 500 MiB, the default is
-// floored at DefaultCacheMaxBytesFloor.
-func TestDefaultCacheMaxBytesAppliesFloor(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name      string
-		freeBytes uint64
-	}{
-		{name: "100 MiB free", freeBytes: 104857600},
-		{name: "zero free", freeBytes: 0},
-		{name: "just below floor threshold", freeBytes: 699050665},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := DefaultCacheMaxBytes(tc.freeBytes, 0)
-			if got != DefaultCacheMaxBytesFloor {
-				t.Errorf("DefaultCacheMaxBytes = %d, want floor %d",
-					got, DefaultCacheMaxBytesFloor)
-			}
-		})
-	}
-}
-
 // TestCacheMaxBytesExplicitIsRecorded verifies that an omitted
-// cache_max_bytes is recorded as not explicit, so pixad works out the
-// default when it builds the cache, and that an explicit zero is recorded
-// as explicit, so it disables the disk cache instead.
+// cache_max_bytes is recorded as not explicit, so the cache works out
+// the default when it opens, and that an explicit zero is recorded as
+// explicit, so it disables the disk cache instead.
 func TestCacheMaxBytesExplicitIsRecorded(t *testing.T) {
 	t.Parallel()
 

internal/config/config_internal_test.go

@@ -1,12 +1,97 @@
 package config
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
 	"git.eeqj.de/sneak/smartconfig"
 )
 
+// writeTestConfig writes yamlContent to a temp config file and returns
+// the file path.
+func writeTestConfig(t *testing.T, yamlContent string) string {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "config.yml")
+
+	err := os.WriteFile(configPath, []byte(yamlContent), 0o600)
+	if err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	return configPath
+}
+
+// checkAllowlistHosts loads the config at configPath and asserts that
+// getStringSlice returns the three expected hosts.
+func checkAllowlistHosts(t *testing.T, configPath string) {
+	t.Helper()
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+
+	if len(hosts) != 3 {
+		t.Errorf("expected 3 hosts, got %d: %v", len(hosts), hosts)
+	}
+
+	expected := []string{"static.sneak.cloud", "sneak.berlin", testHostS3}
+	for i, want := range expected {
+		if i >= len(hosts) {
+			t.Errorf("missing host at index %d: want %q", i, want)
+
+			continue
+		}
+
+		if hosts[i] != want {
+			t.Errorf("host[%d] = %q, want %q", i, hosts[i], want)
+		}
+	}
+}
+
+func TestGetStringSlice_YAMLList(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := `
+allowlist_hosts:
+  - static.sneak.cloud
+  - sneak.berlin
+  - s3.sneak.cloud
+`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_CommaSeparated(t *testing.T) {
+	t.Parallel()
+
+	// Backwards compatibility with comma-separated string values.
+	yamlContent := `allowlist_hosts: "static.sneak.cloud, sneak.berlin, s3.sneak.cloud"`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_Empty(t *testing.T) {
+	t.Parallel()
+
+	configPath := writeTestConfig(t, `port: 8080`)
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+	if len(hosts) != 0 {
+		t.Errorf("expected nil or empty slice, got %v", hosts)
+	}
+}
+
 // TestExampleConfigAllowlistsNoHost loads configs/config.example.yml
 // with a real signing key, as Getting Started in README.md has it copied
 // and edited, and checks that it allowlists no host: every image on an

internal/config/config_validation_internal_test.go

@@ -15,36 +15,8 @@ import (
 	_ "modernc.org/sqlite" // SQLite driver registration
 )
 
-// The config keys the tests name in the errors they expect.
-const (
-	keyDebug                      = "debug"
-	keyMaintenanceMode            = "maintenance_mode"
-	keyPort                       = "port"
-	keyStateDir                   = "state_dir"
-	keySentryDSN                  = "sentry_dsn"
-	keyDBURL                      = "db_url"
-	keyMetrics                    = "metrics"
-	keyMetricsUsername            = "metrics.username"
-	keyMetricsPassword            = "metrics.password"
-	keySigningKey                 = "signing_key"
-	keyAllowlistHosts             = "allowlist_hosts"
-	keyRefererBlocklist           = "referer_blocklist"
-	keyAllowHTTP                  = "allow_http"
-	keyUpstreamConnectionsPerHost = "upstream_connections_per_host"
-	keyUpstreamConnections        = "upstream_connections"
-	keyMaxConcurrentProcessing    = "max_concurrent_processing"
-	keyCacheMaxBytes              = "cache_max_bytes"
-	keyBlockedNetworks            = "blocked_networks"
-	keyTrustedProxies             = "trusted_proxies"
-	keyAccessControlAllowOrigin   = "access_control_allow_origin"
-	keyUpstreamFetchTimeout       = "upstream_fetch_timeout"
-	keyUpstreamMaxResponseSize    = "upstream_max_response_size"
-	keyDownstreamTimeout          = "downstream_timeout"
-	keyImageRequestsPerMinute     = "image_requests_per_minute"
-)
-
 // validTestSigningKey is a 32-character signing key that satisfies the
-// minimum length requirement in validateSigningKey.
+// minimum length requirement in validate().
 const validTestSigningKey = "0123456789abcdef0123456789abcdef"
 
 // signingKeyLine is a valid signing_key config line used as the base of

internal/config/documented_settings_internal_test.go

@@ -1,127 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// TestReadmeNamesEverySetting checks that the list of settings in
-// README.md names exactly the keys of the settings table, one item each.
-// The list is the first one in the Configuration section, and it ends at
-// the first blank line. Each item starts with its key in backticks.
-func TestReadmeNamesEverySetting(t *testing.T) {
-	t.Parallel()
-
-	readme, err := os.ReadFile(filepath.Join("..", "..", "README.md"))
-	if err != nil {
-		t.Fatalf("failed to read README.md: %v", err)
-	}
-
-	_, section, found := strings.Cut(string(readme), "\n### Configuration\n")
-	if !found {
-		t.Fatal("README.md has no Configuration section")
-	}
-
-	// The section ends at the next heading of its level or above.
-	section, _, _ = strings.Cut(section, "\n## ")
-	section, _, _ = strings.Cut(section, "\n### ")
-
-	_, list, found := strings.Cut(section, "\n- ")
-	if !found {
-		t.Fatal("README.md's Configuration section has no list")
-	}
-
-	list, _, _ = strings.Cut("- "+list, "\n\n")
-
-	itemKey := regexp.MustCompile("^- `([^`]+)`")
-	named := map[string]bool{}
-
-	for line := range strings.SplitSeq(list, "\n") {
-		// A line that does not start with "- " goes on with the item above.
-		if !strings.HasPrefix(line, "- ") {
-			continue
-		}
-
-		match := itemKey.FindStringSubmatch(line)
-		if match == nil {
-			t.Errorf("README.md's list of settings has an item "+
-				"that does not start with a key in backticks: %s", line)
-
-			continue
-		}
-
-		if named[match[1]] {
-			t.Errorf("README.md's list of settings names %s twice", match[1])
-		}
-
-		named[match[1]] = true
-	}
-
-	for _, s := range new(Config).settings() {
-		if !named[s.key] {
-			t.Errorf("README.md's list of settings does not name %s", s.key)
-		}
-
-		delete(named, s.key)
-	}
-
-	for key := range named {
-		t.Errorf("README.md's list of settings names %s, "+
-			"which is not a setting", key)
-	}
-}
-
-// TestExampleConfigNamesEverySetting checks that
-// configs/config.example.yml names exactly the keys of the settings
-// table, each one set or commented out with "# ". A key line holds the
-// key, a colon and at most a one-word value, which tells it from a
-// comment line that starts with a word and a colon. An indented key is
-// inside the map of the key above it, as username is inside metrics.
-func TestExampleConfigNamesEverySetting(t *testing.T) {
-	t.Parallel()
-
-	const examplePath = "configs/config.example.yml"
-
-	example, err := os.ReadFile(filepath.Join("..", "..", examplePath))
-	if err != nil {
-		t.Fatalf("failed to read %s: %v", examplePath, err)
-	}
-
-	keyLine := regexp.MustCompile(`(?m)^(?:# )?( *)([a-z_]+):(?: \S+)?$`)
-	named := map[string]bool{}
-
-	var mapKey string
-
-	for _, match := range keyLine.FindAllStringSubmatch(string(example), -1) {
-		indent, key := match[1], match[2]
-		if indent == "" {
-			mapKey = key
-			named[key] = true
-
-			continue
-		}
-
-		// The key holding the map is not itself a setting.
-		delete(named, mapKey)
-
-		named[mapKey+"."+key] = true
-	}
-
-	// The env section sets environment variables; it is not a setting.
-	delete(named, "env")
-
-	for _, s := range new(Config).settings() {
-		if !named[s.key] {
-			t.Errorf("%s does not name %s", examplePath, s.key)
-		}
-
-		delete(named, s.key)
-	}
-
-	for key := range named {
-		t.Errorf("%s names %s, which is not a setting", examplePath, key)
-	}
-}

internal/config/env_internal_test.go

@@ -138,8 +138,7 @@ func TestPixaPortAbortsStartupPointingToPort(t *testing.T) {
 
 // TestSettingVariablesAndConfigPathAreAccepted checks that every
 // setting's variable and PIXA_CONFIG_PATH pass the check for unknown
-// PIXA_ variables. TestEnvironmentSetsEveryKey pins the names in the
-// settings table.
+// PIXA_ variables. TestEnvironmentSetsEveryKey pins the names in the list.
 func TestSettingVariablesAndConfigPathAreAccepted(t *testing.T) {
 	// A config file's env section loaded by another test can leave a
 	// PIXA_ variable set for the whole process, so every one is unset
@@ -160,8 +159,8 @@ func TestSettingVariablesAndConfigPathAreAccepted(t *testing.T) {
 
 	t.Setenv("PIXA_CONFIG_PATH", "/etc/pixa/config.yml")
 
-	for _, s := range new(Config).settings() {
-		t.Setenv(s.envVar, "")
+	for _, name := range envVarNames() {
+		t.Setenv(name, "")
 	}
 
 	err := validateKnownEnvVars()

internal/database/concurrent_writes_internal_test.go

@@ -104,31 +104,40 @@ func writeConcurrently(t *testing.T, db *sql.DB) {
 
 	wg.Wait()
 
-	var sources int
+	var hits, sources int
 
-	err := db.QueryRowContext(ctx, `SELECT COUNT(*) FROM source_content`).
-		Scan(&sources)
+	err := db.QueryRowContext(ctx, `
+		SELECT hit_count, (SELECT COUNT(*) FROM source_content)
+		FROM cache_stats WHERE id = 1
+	`).Scan(&hits, &sources)
 	if err != nil {
 		t.Fatalf("failed to count the writes: %v", err)
 	}
 
-	if sources != totalRequests {
-		t.Errorf("%d source_content rows, want %d", sources, totalRequests)
+	if hits != totalRequests || sources != totalRequests {
+		t.Errorf("hit_count = %d and %d source_content rows, want %d of each",
+			hits, sources, totalRequests)
 	}
 }
 
 // writeLikeOneRequest makes the writes one request and the eviction pass
-// make: it stores a source, records a transformed image and deletes that
-// record again.
+// make: it counts a cache hit, stores a source, records a transformed image
+// and deletes that record again.
 func writeLikeOneRequest(ctx context.Context, db *sql.DB, key string) error {
-	_, err := db.ExecContext(ctx, `INSERT INTO source_content
-		(source_key, size_bytes) VALUES (?, 1)`, key)
+	_, err := db.ExecContext(ctx,
+		`UPDATE cache_stats SET hit_count = hit_count + 1 WHERE id = 1`)
+	if err != nil {
+		return fmt.Errorf("counting a cache hit: %w", err)
+	}
+
+	_, err = db.ExecContext(ctx, `INSERT INTO source_content
+		(content_hash, content_type, size_bytes) VALUES (?, 'image/png', 1)`, key)
 	if err != nil {
 		return fmt.Errorf("storing a source: %w", err)
 	}
 
 	_, err = db.ExecContext(ctx, `INSERT INTO variant_content
-		(cache_key, size_bytes) VALUES (?, 1)`, key)
+		(cache_key, size_bytes, content_type) VALUES (?, 1, 'image/png')`, key)
 	if err != nil {
 		return fmt.Errorf("recording a transformed image: %w", err)
 	}

internal/database/database.go

@@ -82,11 +82,7 @@ func ParseMigrationVersion(filename string) (int, error) {
 	return version, nil
 }
 
-// New opens the database and applies the migrations, so that the parts
-// fx builds after it can read the database while they are built. Its
-// stop hook closes the database. fx runs stop hooks in the reverse of the
-// order it built their parts in, so the stop hooks of those parts run
-// before this one.
+// New creates a new Database instance.
 func New(lc fx.Lifecycle, params Params) (*Database, error) {
 	s := &Database{
 		log:    params.Logger.Get(),
@@ -95,16 +91,20 @@ func New(lc fx.Lifecycle, params Params) (*Database, error) {
 
 	s.log.Info("Database instantiated")
 
-	err := s.connect(context.Background())
-	if err != nil {
-		return nil, err
-	}
-
 	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			s.log.Info("Database OnStart Hook")
+
+			return s.connect(ctx)
+		},
 		OnStop: func(_ context.Context) error {
 			s.log.Info("Database OnStop Hook")
 
-			return s.db.Close()
+			if s.db != nil {
+				return s.db.Close()
+			}
+
+			return nil
 		},
 	})
 

internal/database/database_internal_test.go

@@ -159,7 +159,10 @@ func TestApplyMigrations_CreatesSchemaAndTables(t *testing.T) {
 	}
 
 	// Verify that the application tables created by 001.sql exist.
-	tables := []string{"source_content", "negative_cache"}
+	tables := []string{
+		"source_content", "source_metadata", "output_content",
+		"request_cache", "negative_cache", "cache_stats",
+	}
 	for _, table := range tables {
 		var count int
 

internal/db/migrations/001_schema.sql

@@ -1,51 +1,56 @@
 -- Migration 001: Initial schema
 -- Creates all tables for the pixa caching image proxy
 
--- Source images, one row per source URL
--- Files stored at: cache/sources/<ab>/<cd>/<source_key>, where source_key
--- is the SHA-256 of the source's host, path and query.
--- fetched_at is when the cached bytes were fetched. checked_at is when
--- upstream last sent them or answered that they had not changed.
--- upstream_etag and upstream_last_modified are the ETag and Last-Modified
--- headers upstream sent with the bytes, or '' when it sent none.
+-- Source content blobs
+-- Files stored at: cache/sources/<ab>/<cd>/<sha256>
 CREATE TABLE IF NOT EXISTS source_content (
-    source_key TEXT PRIMARY KEY,
+    content_hash TEXT PRIMARY KEY,
+    content_type TEXT NOT NULL,
     size_bytes INTEGER NOT NULL,
-    last_accessed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    fetched_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    checked_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    upstream_etag TEXT NOT NULL DEFAULT '',
-    upstream_last_modified TEXT NOT NULL DEFAULT ''
+    fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    last_accessed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 CREATE INDEX IF NOT EXISTS idx_source_content_last_accessed
     ON source_content(last_accessed_at);
-CREATE INDEX IF NOT EXISTS idx_source_content_checked
-    ON source_content(checked_at);
+
+-- Source URL metadata - maps URLs to content hashes
+-- JSON stored at: cache/metadata/<hostname>/<path_hash>.json
+CREATE TABLE IF NOT EXISTS source_metadata (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    source_host TEXT NOT NULL,
+    source_path TEXT NOT NULL,
+    source_query TEXT NOT NULL DEFAULT '',
+    path_hash TEXT NOT NULL,
+    content_hash TEXT,
+    status_code INTEGER NOT NULL,
+    content_type TEXT,
+    response_headers TEXT,
+    fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at DATETIME,
+    etag TEXT,
+    last_modified TEXT,
+    UNIQUE(source_host, source_path, source_query),
+    FOREIGN KEY (content_hash) REFERENCES source_content(content_hash)
+);
+CREATE INDEX IF NOT EXISTS idx_source_meta_host ON source_metadata(source_host);
+CREATE INDEX IF NOT EXISTS idx_source_meta_path_hash ON source_metadata(path_hash);
+CREATE INDEX IF NOT EXISTS idx_source_meta_expires ON source_metadata(expires_at);
+CREATE INDEX IF NOT EXISTS idx_source_meta_content_hash ON source_metadata(content_hash);
 
 -- Processed variant blobs
--- Files stored at: cache/variants/<ab>/<cd>/<cache_key>. Tracked here
--- (like source content blobs above) so total cache usage is known
--- without a directory scan, and so LRU eviction has a timestamp to order
--- on. A cache hit does not read this table: it takes the content type
--- from the file's first bytes, and its last_accessed_at is written
--- later, in a batch. checked_at is the checked_at of the source the
--- variant was made from, when it was made or last renewed; the variant
--- file's modification time holds the same time for cache hits.
--- upstream_etag and upstream_last_modified are those of the source bytes
--- the variant was made from, so the variant can still be checked with
--- upstream after its source is evicted.
+-- Files stored at: cache/variants/<ab>/<cd>/<cache_key> (plus a .meta
+-- sidecar with the content type). Tracked here (like source content
+-- blobs above) so total cache usage is known without a directory scan,
+-- and so LRU eviction has a timestamp to order on.
 CREATE TABLE IF NOT EXISTS variant_content (
     cache_key TEXT PRIMARY KEY,
     size_bytes INTEGER NOT NULL,
-    last_accessed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    checked_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    upstream_etag TEXT NOT NULL DEFAULT '',
-    upstream_last_modified TEXT NOT NULL DEFAULT ''
+    content_type TEXT NOT NULL,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    last_accessed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 CREATE INDEX IF NOT EXISTS idx_variant_content_last_accessed
     ON variant_content(last_accessed_at);
-CREATE INDEX IF NOT EXISTS idx_variant_content_checked
-    ON variant_content(checked_at);
 
 -- Total cache usage: the sum of size_bytes over source_content and
 -- variant_content, kept by the triggers below in the same statement
@@ -115,19 +120,63 @@ BEGIN
     WHERE id = 1;
 END;
 
--- Negative cache: source URLs whose fetch failed with an upstream error
--- status, or whose first bytes did not match their Content-Type. pixa does
--- not fetch such a URL again until its row expires.
+-- Output/transformed content blobs
+-- Not written: transformed images are stored in cache/variants and
+-- tracked in variant_content above.
+CREATE TABLE IF NOT EXISTS output_content (
+    content_hash TEXT PRIMARY KEY,
+    content_type TEXT NOT NULL,
+    size_bytes INTEGER NOT NULL,
+    fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Request cache - maps full request params to output content
+CREATE TABLE IF NOT EXISTS request_cache (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    cache_key TEXT NOT NULL UNIQUE,
+    source_metadata_id INTEGER NOT NULL,
+    output_hash TEXT NOT NULL,
+    width INTEGER NOT NULL,
+    height INTEGER NOT NULL,
+    format TEXT NOT NULL,
+    quality INTEGER NOT NULL DEFAULT 85,
+    fit_mode TEXT NOT NULL DEFAULT 'cover',
+    fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    access_count INTEGER NOT NULL DEFAULT 1,
+    FOREIGN KEY (source_metadata_id) REFERENCES source_metadata(id),
+    FOREIGN KEY (output_hash) REFERENCES output_content(content_hash)
+);
+CREATE INDEX IF NOT EXISTS idx_request_cache_key ON request_cache(cache_key);
+CREATE INDEX IF NOT EXISTS idx_request_cache_source ON request_cache(source_metadata_id);
+CREATE INDEX IF NOT EXISTS idx_request_cache_output ON request_cache(output_hash);
+CREATE INDEX IF NOT EXISTS idx_request_cache_fetched ON request_cache(fetched_at);
+
+-- Negative cache for failed fetches (404s, timeouts, etc.)
 CREATE TABLE IF NOT EXISTS negative_cache (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     source_host TEXT NOT NULL,
     source_path TEXT NOT NULL,
     source_query TEXT NOT NULL DEFAULT '',
+    status_code INTEGER NOT NULL,
+    error_message TEXT,
+    fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     expires_at DATETIME NOT NULL,
     UNIQUE(source_host, source_path, source_query)
 );
 CREATE INDEX IF NOT EXISTS idx_negative_cache_expires ON negative_cache(expires_at);
 
+-- Cache statistics for monitoring
+CREATE TABLE IF NOT EXISTS cache_stats (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    hit_count INTEGER NOT NULL DEFAULT 0,
+    miss_count INTEGER NOT NULL DEFAULT 0,
+    upstream_fetch_count INTEGER NOT NULL DEFAULT 0,
+    upstream_fetch_bytes INTEGER NOT NULL DEFAULT 0,
+    transform_count INTEGER NOT NULL DEFAULT 0,
+    last_updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+INSERT OR IGNORE INTO cache_stats (id) VALUES (1);
+
 -- A random value that a login session carries from its login. pixa makes it
 -- when the table has no row, and each logout replaces it; a login session
 -- carrying another value is refused, so logging out ends every login session.

internal/encurl/encurl.go

@@ -7,15 +7,18 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/seal"
 )
 
 // Default values for optional fields.
 const (
 	DefaultQuality = 85
-	DefaultFormat  = imagerequest.FormatJXL
-	DefaultFitMode = imagerequest.FitCover
+	DefaultFormat  = imgcache.FormatJXL
+	DefaultFitMode = imgcache.FitCover
+
+	// HKDF salt for URL encryption key derivation
+	urlKeySalt = "pixa-urlenc-v1"
 )
 
 // Errors returned by encurl operations.
@@ -25,19 +28,19 @@ var (
 	ErrDecryptFailed = errors.New("failed to decrypt URL")
 )
 
-// payload contains all image request parameters in a compact format.
+// Payload contains all image request parameters in a compact format.
 // Field names are short to minimize encoded size.
 // Fields with omitempty use sane defaults when absent.
-type payload struct {
-	SourceHost  string              `cbor:"h"`            // required
-	SourcePath  string              `cbor:"p"`            // required
-	SourceQuery string              `cbor:"q,omitempty"`  // optional
-	Width       int                 `cbor:"w,omitempty"`  // 0 = original
-	Height      int                 `cbor:"ht,omitempty"` // 0 = original
-	Format      imagerequest.Format `cbor:"f,omitempty"`  // default: jxl
-	Quality     int                 `cbor:"ql,omitempty"` // default: 85
-	FitMode     imagerequest.Fit    `cbor:"fm,omitempty"` // default: cover
-	ExpiresAt   int64               `cbor:"e,omitempty"`  // 0 = never expires
+type Payload struct {
+	SourceHost  string               `cbor:"h"`            // required
+	SourcePath  string               `cbor:"p"`            // required
+	SourceQuery string               `cbor:"q,omitempty"`  // optional
+	Width       int                  `cbor:"w,omitempty"`  // 0 = original
+	Height      int                  `cbor:"ht,omitempty"` // 0 = original
+	Format      imgcache.ImageFormat `cbor:"f,omitempty"`  // default: jxl
+	Quality     int                  `cbor:"ql,omitempty"` // default: 85
+	FitMode     imgcache.FitMode     `cbor:"fm,omitempty"` // default: cover
+	ExpiresAt   int64                `cbor:"e,omitempty"`  // 0 = never expires
 }
 
 // Generator creates and parses encrypted URL tokens.
@@ -45,35 +48,20 @@ type Generator struct {
 	key [seal.KeySize]byte
 }
 
-// NewGenerator creates an encrypted URL generator that encrypts its tokens
-// with key.
-func NewGenerator(key [seal.KeySize]byte) *Generator {
-	return &Generator{key: key}
+// NewGenerator creates an encrypted URL generator with a key derived
+// from the signing key.
+func NewGenerator(signingKey string) (*Generator, error) {
+	key, err := seal.DeriveKey([]byte(signingKey), urlKeySalt)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Generator{key: key}, nil
 }
 
-// Generate creates an encrypted URL token from the request's source and
-// transform, each as the request holds it, and from expires; an empty format,
-// a quality of 0 or an empty fit mode is left out of the token, and a zero
-// expires makes a token that never expires. The token is CBOR-encoded,
-// encrypted with NaCl secretbox, and base64url-encoded.
-func (g *Generator) Generate(
-	req *imagerequest.Request, expires time.Time,
-) (string, error) {
-	p := &payload{
-		SourceHost:  req.Source.Host,
-		SourcePath:  req.Source.Path,
-		SourceQuery: req.Source.Query,
-		Width:       req.Transform.Size.Width,
-		Height:      req.Transform.Size.Height,
-		Format:      req.Transform.Format,
-		Quality:     req.Transform.Quality,
-		FitMode:     req.Transform.FitMode,
-	}
-
-	if !expires.IsZero() {
-		p.ExpiresAt = expires.Unix()
-	}
-
+// Generate creates an encrypted URL token from the payload.
+// The token is CBOR-encoded, encrypted with NaCl secretbox, and base64url-encoded.
+func (g *Generator) Generate(p *Payload) (string, error) {
 	// CBOR encode the payload
 	data, err := cbor.Marshal(p)
 	if err != nil {
@@ -84,35 +72,40 @@ func (g *Generator) Generate(
 	return seal.Encrypt(g.key, data)
 }
 
-// Parse decrypts and validates an encrypted URL token and returns the
-// request it holds, with default values for omitted optional fields, and its
-// expiry. A token that never expires gives the zero time.
+// Parse decrypts and validates an encrypted URL token.
 // Returns ErrExpired if the token has expired, or other errors for invalid tokens.
-func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error) {
+func (g *Generator) Parse(token string) (*Payload, error) {
 	// Decrypt
 	data, err := seal.Decrypt(g.key, token)
 	if err != nil {
 		if errors.Is(err, seal.ErrDecryptionFailed) ||
 			errors.Is(err, seal.ErrInvalidPayload) {
-			return nil, time.Time{}, ErrDecryptFailed
+			return nil, ErrDecryptFailed
 		}
 
-		return nil, time.Time{}, err
+		return nil, err
 	}
 
 	// CBOR decode
-	var p payload
+	var p Payload
 
 	err = cbor.Unmarshal(data, &p)
 	if err != nil {
-		return nil, time.Time{}, ErrInvalidFormat
+		return nil, ErrInvalidFormat
 	}
 
 	// Check expiration (0 = never expires)
 	if p.ExpiresAt != 0 && time.Now().Unix() > p.ExpiresAt {
-		return nil, time.Time{}, ErrExpired
+		return nil, ErrExpired
 	}
 
+	return &p, nil
+}
+
+// ToImageRequest converts the payload to an ImageRequest.
+// Applies default values for omitted optional fields. An ExpiresAt of 0, a URL
+// that never expires, gives the zero Expires.
+func (p *Payload) ToImageRequest() *imgcache.ImageRequest {
 	format := p.Format
 	if format == "" {
 		format = DefaultFormat
@@ -133,17 +126,44 @@ func (g *Generator) Parse(token string) (*imagerequest.Request, time.Time, error
 		expires = time.Unix(p.ExpiresAt, 0)
 	}
 
-	return &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host:  p.SourceHost,
-			Path:  p.SourcePath,
-			Query: p.SourceQuery,
+	return &imgcache.ImageRequest{
+		SourceHost:  p.SourceHost,
+		SourcePath:  p.SourcePath,
+		SourceQuery: p.SourceQuery,
+		Size: imgcache.Size{
+			Width:  p.Width,
+			Height: p.Height,
 		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: p.Width, Height: p.Height},
-			Format:  format,
-			Quality: quality,
-			FitMode: fitMode,
-		},
-	}, expires, nil
+		Format:  format,
+		Quality: quality,
+		FitMode: fitMode,
+		Expires: expires,
+	}
+}
+
+// FromImageRequest creates a Payload from an ImageRequest with the given expiration.
+func FromImageRequest(req *imgcache.ImageRequest, expiresAt time.Time) *Payload {
+	p := &Payload{
+		SourceHost:  req.SourceHost,
+		SourcePath:  req.SourcePath,
+		SourceQuery: req.SourceQuery,
+		Width:       req.Size.Width,
+		Height:      req.Size.Height,
+		ExpiresAt:   expiresAt.Unix(),
+	}
+
+	// Only set non-default values to benefit from omitempty
+	if req.Format != "" && req.Format != DefaultFormat {
+		p.Format = req.Format
+	}
+
+	if req.Quality != 0 && req.Quality != DefaultQuality {
+		p.Quality = req.Quality
+	}
+
+	if req.FitMode != "" && req.FitMode != DefaultFitMode {
+		p.FitMode = req.FitMode
+	}
+
+	return p
 }

internal/encurl/encurl_test.go

@@ -6,8 +6,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // Shared test fixture strings.
@@ -20,29 +19,24 @@ const (
 func TestGenerator_GenerateAndParse(t *testing.T) {
 	t.Parallel()
 
-	keys, err := seal.DeriveKeys("test-signing-key-12345")
+	gen, err := encurl.NewGenerator("test-signing-key-12345")
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("NewGenerator() error = %v", err)
 	}
 
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host:  testSourceHost,
-			Path:  testSourcePath,
-			Query: testSourceQuery,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 800, Height: 600},
-			Format:  imagerequest.FormatWebP,
-			Quality: 90,
-			FitMode: imagerequest.FitContain,
-		},
+	payload := &encurl.Payload{
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
+		Width:       800,
+		Height:      600,
+		Format:      imgcache.FormatWebP,
+		Quality:     90,
+		FitMode:     imgcache.FitContain,
+		ExpiresAt:   time.Now().Add(time.Hour).Unix(),
 	}
-	expires := time.Now().Add(time.Hour)
 
-	token, err := gen.Generate(req, expires)
+	token, err := gen.Generate(payload)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -51,73 +45,66 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 		t.Fatal("Generate() returned empty token")
 	}
 
-	parsed, parsedExpires, err := gen.Parse(token)
+	parsed, err := gen.Parse(token)
 	if err != nil {
 		t.Fatalf("Parse() error = %v", err)
 	}
 
 	// Verify all fields
-	if parsed.Source.Host != req.Source.Host {
-		t.Errorf("SourceHost = %q, want %q", parsed.Source.Host, req.Source.Host)
+	if parsed.SourceHost != payload.SourceHost {
+		t.Errorf("SourceHost = %q, want %q", parsed.SourceHost, payload.SourceHost)
 	}
 
-	if parsed.Source.Path != req.Source.Path {
-		t.Errorf("SourcePath = %q, want %q", parsed.Source.Path, req.Source.Path)
+	if parsed.SourcePath != payload.SourcePath {
+		t.Errorf("SourcePath = %q, want %q", parsed.SourcePath, payload.SourcePath)
 	}
 
-	if parsed.Source.Query != req.Source.Query {
-		t.Errorf("SourceQuery = %q, want %q", parsed.Source.Query, req.Source.Query)
+	if parsed.SourceQuery != payload.SourceQuery {
+		t.Errorf("SourceQuery = %q, want %q", parsed.SourceQuery, payload.SourceQuery)
 	}
 
-	if parsed.Transform.Size.Width != req.Transform.Size.Width {
-		t.Errorf("Width = %d, want %d",
-			parsed.Transform.Size.Width, req.Transform.Size.Width)
+	if parsed.Width != payload.Width {
+		t.Errorf("Width = %d, want %d", parsed.Width, payload.Width)
 	}
 
-	if parsed.Transform.Size.Height != req.Transform.Size.Height {
-		t.Errorf("Height = %d, want %d",
-			parsed.Transform.Size.Height, req.Transform.Size.Height)
+	if parsed.Height != payload.Height {
+		t.Errorf("Height = %d, want %d", parsed.Height, payload.Height)
 	}
 
-	if parsed.Transform.Format != req.Transform.Format {
-		t.Errorf("Format = %q, want %q",
-			parsed.Transform.Format, req.Transform.Format)
+	if parsed.Format != payload.Format {
+		t.Errorf("Format = %q, want %q", parsed.Format, payload.Format)
 	}
 
-	if parsed.Transform.Quality != req.Transform.Quality {
-		t.Errorf("Quality = %d, want %d",
-			parsed.Transform.Quality, req.Transform.Quality)
+	if parsed.Quality != payload.Quality {
+		t.Errorf("Quality = %d, want %d", parsed.Quality, payload.Quality)
 	}
 
-	if parsed.Transform.FitMode != req.Transform.FitMode {
-		t.Errorf("FitMode = %q, want %q",
-			parsed.Transform.FitMode, req.Transform.FitMode)
+	if parsed.FitMode != payload.FitMode {
+		t.Errorf("FitMode = %q, want %q", parsed.FitMode, payload.FitMode)
 	}
 
-	if parsedExpires.Unix() != expires.Unix() {
-		t.Errorf("ExpiresAt = %d, want %d", parsedExpires.Unix(), expires.Unix())
+	if parsed.ExpiresAt != payload.ExpiresAt {
+		t.Errorf("ExpiresAt = %d, want %d", parsed.ExpiresAt, payload.ExpiresAt)
 	}
 }
 
 func TestGenerator_Parse_Expired(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: testSourceHost,
-			Path: testSourcePath,
-		},
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		ExpiresAt:  time.Now().Add(-time.Hour).Unix(), // Already expired
 	}
 
-	token, err := gen.Generate(req, time.Now().Add(-time.Hour)) // Already expired
+	token, err := gen.Generate(payload)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	_, _, err = gen.Parse(token)
+	_, err = gen.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail for expired token")
 	}
@@ -130,10 +117,9 @@ func TestGenerator_Parse_Expired(t *testing.T) {
 func TestGenerator_Parse_InvalidToken(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	_, _, err := gen.Parse("not-a-valid-token")
+	_, err := gen.Parse("not-a-valid-token")
 	if err == nil {
 		t.Error("Parse() should fail for invalid token")
 	}
@@ -142,17 +128,15 @@ func TestGenerator_Parse_InvalidToken(t *testing.T) {
 func TestGenerator_Parse_TamperedToken(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: testSourceHost,
-			Path: testSourcePath,
-		},
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
-	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen.Generate(payload)
 
 	// Tamper with the token
 	tampered := []byte(token)
@@ -160,7 +144,7 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 		tampered[10] ^= 0x01
 	}
 
-	_, _, err := gen.Parse(string(tampered))
+	_, err := gen.Parse(string(tampered))
 	if err == nil {
 		t.Error("Parse() should fail for tampered token")
 	}
@@ -169,78 +153,172 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 func TestGenerator_Parse_WrongKey(t *testing.T) {
 	t.Parallel()
 
-	keys1, _ := seal.DeriveKeys("signing-key-1")
-	keys2, _ := seal.DeriveKeys("signing-key-2")
-	gen1 := encurl.NewGenerator(keys1.EncryptedURLKey)
-	gen2 := encurl.NewGenerator(keys2.EncryptedURLKey)
+	gen1, _ := encurl.NewGenerator("signing-key-1")
+	gen2, _ := encurl.NewGenerator("signing-key-2")
 
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: testSourceHost,
-			Path: testSourcePath,
-		},
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
-	token, _ := gen1.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen1.Generate(payload)
 
-	_, _, err := gen2.Parse(token)
+	_, err := gen2.Parse(token)
 	if err == nil {
 		t.Error("Parse() should fail with different signing key")
 	}
 }
 
-func TestGenerator_Parse_Defaults(t *testing.T) {
+func TestPayload_ToImageRequest(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	// Request with only required fields - should get defaults
-	token, err := gen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: testSourceHost,
-			Path: testSourcePath,
-		},
-	}, time.Now().Add(time.Hour))
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
+	payload := &encurl.Payload{
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
+		Width:       800,
+		Height:      600,
+		Format:      imgcache.FormatWebP,
+		Quality:     90,
+		FitMode:     imgcache.FitContain,
+		ExpiresAt:   time.Now().Add(time.Hour).Unix(),
 	}
 
-	req, _, err := gen.Parse(token)
-	if err != nil {
-		t.Fatalf("Parse() error = %v", err)
+	req := payload.ToImageRequest()
+
+	if req.SourceHost != payload.SourceHost {
+		t.Errorf("SourceHost = %q, want %q", req.SourceHost, payload.SourceHost)
 	}
 
-	if req.Transform.Format != encurl.DefaultFormat {
-		t.Errorf("Format = %q, want default %q",
-			req.Transform.Format, encurl.DefaultFormat)
+	if req.SourcePath != payload.SourcePath {
+		t.Errorf("SourcePath = %q, want %q", req.SourcePath, payload.SourcePath)
 	}
 
-	if req.Transform.Quality != encurl.DefaultQuality {
-		t.Errorf("Quality = %d, want default %d",
-			req.Transform.Quality, encurl.DefaultQuality)
+	if req.SourceQuery != payload.SourceQuery {
+		t.Errorf("SourceQuery = %q, want %q", req.SourceQuery, payload.SourceQuery)
 	}
 
-	if req.Transform.FitMode != encurl.DefaultFitMode {
-		t.Errorf("FitMode = %q, want default %q",
-			req.Transform.FitMode, encurl.DefaultFitMode)
+	if req.Size.Width != payload.Width {
+		t.Errorf("Width = %d, want %d", req.Size.Width, payload.Width)
+	}
+
+	if req.Size.Height != payload.Height {
+		t.Errorf("Height = %d, want %d", req.Size.Height, payload.Height)
+	}
+
+	if req.Format != payload.Format {
+		t.Errorf("Format = %q, want %q", req.Format, payload.Format)
+	}
+
+	if req.Quality != payload.Quality {
+		t.Errorf("Quality = %d, want %d", req.Quality, payload.Quality)
+	}
+
+	if req.FitMode != payload.FitMode {
+		t.Errorf("FitMode = %q, want %q", req.FitMode, payload.FitMode)
+	}
+}
+
+func TestPayload_ToImageRequest_Defaults(t *testing.T) {
+	t.Parallel()
+
+	// Payload with only required fields - should get defaults
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
+	}
+
+	req := payload.ToImageRequest()
+
+	if req.Format != encurl.DefaultFormat {
+		t.Errorf("Format = %q, want default %q", req.Format, encurl.DefaultFormat)
+	}
+
+	if req.Quality != encurl.DefaultQuality {
+		t.Errorf("Quality = %d, want default %d", req.Quality, encurl.DefaultQuality)
+	}
+
+	if req.FitMode != encurl.DefaultFitMode {
+		t.Errorf("FitMode = %q, want default %q", req.FitMode, encurl.DefaultFitMode)
+	}
+}
+
+func TestFromImageRequest(t *testing.T) {
+	t.Parallel()
+
+	req := &imgcache.ImageRequest{
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
+		Size:        imgcache.Size{Width: 800, Height: 600},
+		Format:      imgcache.FormatWebP,
+		Quality:     90,
+		FitMode:     imgcache.FitContain,
+	}
+
+	expiresAt := time.Now().Add(time.Hour)
+	payload := encurl.FromImageRequest(req, expiresAt)
+
+	if payload.SourceHost != req.SourceHost {
+		t.Errorf("SourceHost = %q, want %q", payload.SourceHost, req.SourceHost)
+	}
+
+	if payload.SourcePath != req.SourcePath {
+		t.Errorf("SourcePath = %q, want %q", payload.SourcePath, req.SourcePath)
+	}
+
+	if payload.Width != req.Size.Width {
+		t.Errorf("Width = %d, want %d", payload.Width, req.Size.Width)
+	}
+
+	if payload.ExpiresAt != expiresAt.Unix() {
+		t.Errorf("ExpiresAt = %d, want %d", payload.ExpiresAt, expiresAt.Unix())
+	}
+}
+
+func TestFromImageRequest_OmitsDefaults(t *testing.T) {
+	t.Parallel()
+
+	// Request with default values - payload should omit them for
+	// smaller encoding
+	req := &imgcache.ImageRequest{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		Format:     encurl.DefaultFormat,
+		Quality:    encurl.DefaultQuality,
+		FitMode:    encurl.DefaultFitMode,
+	}
+
+	payload := encurl.FromImageRequest(req, time.Now().Add(time.Hour))
+
+	// These should be zero/empty because they match defaults
+	if payload.Format != "" {
+		t.Errorf("Format should be empty for default, got %q", payload.Format)
+	}
+
+	if payload.Quality != 0 {
+		t.Errorf("Quality should be 0 for default, got %d", payload.Quality)
+	}
+
+	if payload.FitMode != "" {
+		t.Errorf("FitMode should be empty for default, got %q", payload.FitMode)
 	}
 }
 
 func TestGenerator_TokenIsURLSafe(t *testing.T) {
 	t.Parallel()
 
-	keys, _ := seal.DeriveKeys("test-signing-key-12345")
-	gen := encurl.NewGenerator(keys.EncryptedURLKey)
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: testSourceHost,
-			Path: testSourcePath,
-		},
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
-	token, _ := gen.Generate(req, time.Now().Add(time.Hour))
+	token, _ := gen.Generate(payload)
 
 	// Check that token only contains URL-safe characters
 	for _, c := range token {

internal/handlers/auth.go

@@ -16,7 +16,7 @@ import (
 
 	"sneak.berlin/go/pixa/internal/clientip"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/templates"
 )
 
@@ -145,7 +145,7 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			return
 		}
 
-		req, expiresAt, ttl, err := buildGenerateRequest(parsed, r.Form)
+		payload, expiresAt, ttl, err := buildGeneratePayload(parsed, r.Form)
 		if err != nil {
 			s.renderGeneratorWithForm(w, r, err.Error(), r.Form,
 				http.StatusBadRequest)
@@ -153,20 +153,21 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			return
 		}
 
-		// The image URL must fetch the source URL as it was written. The
-		// fetcher fetches over http only when allow_http is set.
-		fetchURL := req.Source.URL(s.config.AllowHTTP)
+		// The image URL must fetch the source URL as it was written
+		sourceRequest := payload.ToImageRequest()
+		sourceRequest.AllowHTTP = s.config.AllowHTTP
+		fetchURL := sourceRequest.SourceURL()
 
 		if !fetchedAsWritten(parsed, fetchURL) {
 			s.renderGeneratorWithForm(w, r, "Source URL cannot be fetched as "+
-				"written: pixa would fetch "+fetchURL.String(),
+				"written: pixa would fetch "+fetchURL,
 				r.Form, http.StatusBadRequest)
 
 			return
 		}
 
 		// Generate encrypted token
-		token, err := s.encGen.Generate(req, expiresAt)
+		token, err := s.encGen.Generate(payload)
 		if err != nil {
 			s.log.Error("failed to generate encrypted URL", "error", err)
 			s.renderGeneratorWithForm(w, r, "Failed to generate URL", r.Form,
@@ -226,26 +227,27 @@ func parseSourceURL(sourceURL string) (*url.URL, error) {
 // in RawPath when it is not the decoded path percent-encoded again.
 // EscapedPath ignores RawPath when it also holds a character net/url encodes,
 // such as a space, so RawPath is compared itself.
-func fetchedAsWritten(source, fetchURL *url.URL) bool {
+func fetchedAsWritten(source *url.URL, fetchURL string) bool {
 	writtenPath := source.RawPath
 	if writtenPath == "" {
 		writtenPath = source.EscapedPath()
 	}
 
-	return source.User == nil && !source.ForceQuery &&
-		fetchURL.EscapedPath() == writtenPath &&
-		fetchURL.RawQuery == source.RawQuery
+	fetched, err := url.Parse(fetchURL)
+
+	return err == nil && source.User == nil && !source.ForceQuery &&
+		fetched.EscapedPath() == writtenPath &&
+		fetched.RawQuery == source.RawQuery
 }
 
-// buildGenerateRequest parses the numeric form fields and assembles the
-// image request the encrypted URL's token is made from, and its expiry.
-// ttl=0 means never expires (the expiry is the zero time). A non-numeric or
-// out-of-range width, height, quality or ttl, or an unrecognized fit mode, is
-// a client error naming the offending field. The format field is passed
-// through unchecked.
-func buildGenerateRequest(
+// buildGeneratePayload parses the numeric form fields and assembles the
+// encrypted URL payload. ttl=0 means never expires (ExpiresAt stays 0). A
+// non-numeric or out-of-range width, height, quality or ttl, or an
+// unrecognized fit mode, is a client error naming the offending field. The
+// format field is passed through unchecked.
+func buildGeneratePayload(
 	parsed *url.URL, form url.Values,
-) (*imagerequest.Request, time.Time, int, error) {
+) (*encurl.Payload, time.Time, int, error) {
 	width, err := parseFormDimension(form, "width")
 	if err != nil {
 		return nil, time.Time{}, 0, err
@@ -267,39 +269,42 @@ func buildGenerateRequest(
 		return nil, time.Time{}, 0, err
 	}
 
-	fitMode := imagerequest.Fit(form.Get("fit"))
+	fitMode := imgcache.FitMode(form.Get("fit"))
 
-	err = imagerequest.ValidateFitMode(fitMode)
+	err = imgcache.ValidateFitMode(fitMode)
 	if err != nil {
 		return nil, time.Time{}, 0,
-			fmt.Errorf("%w: %s", imagerequest.ErrInvalidFitMode, form.Get("fit"))
+			fmt.Errorf("%w: %s", imgcache.ErrInvalidFitMode, form.Get("fit"))
 	}
 
-	var expiresAt time.Time
+	var (
+		expiresAt     time.Time
+		expiresAtUnix int64
+	)
+
 	if ttl > 0 {
 		expiresAt = time.Now().Add(time.Duration(ttl) * time.Second)
+		expiresAtUnix = expiresAt.Unix()
 	}
 
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host:  parsed.Host,
-			Path:  parsed.Path,
-			Query: parsed.RawQuery,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: width, Height: height},
-			Format:  imagerequest.Format(form.Get("format")),
-			Quality: quality,
-			FitMode: fitMode,
-		},
+	payload := &encurl.Payload{
+		SourceHost:  parsed.Host,
+		SourcePath:  parsed.Path,
+		SourceQuery: parsed.RawQuery,
+		Width:       width,
+		Height:      height,
+		Format:      imgcache.ImageFormat(form.Get("format")),
+		Quality:     quality,
+		FitMode:     fitMode,
+		ExpiresAt:   expiresAtUnix,
 	}
 
-	return req, expiresAt, ttl, nil
+	return payload, expiresAt, ttl, nil
 }
 
 // parseFormDimension reads an optional width or height form field. An empty
 // value means "original size" (0). A non-numeric value, or one
-// imagerequest.ValidateDimension rejects, is an error naming the field.
+// imgcache.ValidateDimension rejects, is an error naming the field.
 func parseFormDimension(form url.Values, field string) (int, error) {
 	raw := form.Get(field)
 	if raw == "" {
@@ -311,7 +316,7 @@ func parseFormDimension(form url.Values, field string) (int, error) {
 		return 0, fmt.Errorf("%w %s: not a number", errInvalidFormField, field)
 	}
 
-	err = imagerequest.ValidateDimension(field, value)
+	err = imgcache.ValidateDimension(field, value)
 	if err != nil {
 		return 0, err
 	}

internal/handlers/auth_csrf_internal_test.go

@@ -14,7 +14,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -45,17 +44,27 @@ func newCSRFTestRouter(t *testing.T) (*Handlers, http.Handler) {
 
 	cfg := &config.Config{SigningKey: testSigningKey, Debug: true}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
+	}
+
+	encGen, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
+	}
+
+	protect, err := newCSRFProtect(testSigningKey, cfg.Debug)
+	if err != nil {
+		t.Fatalf("newCSRFProtect() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:         slog.New(slog.DiscardHandler),
 		config:      cfg,
-		sessMgr:     session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
-		encGen:      encurl.NewGenerator(keys.EncryptedURLKey),
-		csrfProtect: newCSRFProtect(keys.CSRFKey, cfg.Debug, slog.New(slog.DiscardHandler)),
+		sessMgr:     sessMgr,
+		encGen:      encGen,
+		csrfProtect: protect,
 	}
 
 	r := chi.NewRouter()

internal/handlers/auth_generate_internal_test.go

@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // Generator form field names, and a value that is not a number.
@@ -125,10 +125,10 @@ func TestGeneratePostRejectsBadField(t *testing.T) {
 	}
 }
 
-// TestBuildGenerateRequestDefaultAndLimits verifies that an empty quality
+// TestBuildGeneratePayloadDefaultAndLimits verifies that an empty quality
 // takes the default, and that the largest accepted width, height, quality and
 // ttl are accepted with an expiry still in the future.
-func TestBuildGenerateRequestDefaultAndLimits(t *testing.T) {
+func TestBuildGeneratePayloadDefaultAndLimits(t *testing.T) {
 	t.Parallel()
 
 	parsed, err := url.Parse(testSourceURL)
@@ -136,19 +136,19 @@ func TestBuildGenerateRequestDefaultAndLimits(t *testing.T) {
 		t.Fatalf("url.Parse() error = %v", err)
 	}
 
-	req, _, _, err := buildGenerateRequest(parsed, url.Values{})
+	payload, _, _, err := buildGeneratePayload(parsed, url.Values{})
 	if err != nil {
 		t.Fatalf("empty form: error = %v", err)
 	}
 
-	if req.Transform.Quality != encurl.DefaultQuality {
+	if payload.Quality != encurl.DefaultQuality {
 		t.Errorf("empty quality gave %d, want %d",
-			req.Transform.Quality, encurl.DefaultQuality)
+			payload.Quality, encurl.DefaultQuality)
 	}
 
-	_, expiresAt, _, err := buildGenerateRequest(parsed, url.Values{
-		widthField:   {strconv.Itoa(imagerequest.MaxDimension)},
-		heightField:  {strconv.Itoa(imagerequest.MaxDimension)},
+	_, expiresAt, _, err := buildGeneratePayload(parsed, url.Values{
+		widthField:   {strconv.Itoa(imgcache.MaxDimension)},
+		heightField:  {strconv.Itoa(imgcache.MaxDimension)},
 		qualityField: {strconv.Itoa(maxQuality)},
 		ttlField:     {strconv.Itoa(maxTTL)},
 	})

internal/handlers/auth_login_log_internal_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 
 	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -23,15 +22,15 @@ func TestLoginLogLeavesOutSubmittedKey(t *testing.T) {
 
 	var buf bytes.Buffer
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:     slog.New(slog.NewJSONHandler(&buf, nil)),
 		config:  &config.Config{SigningKey: testSigningKey},
-		sessMgr: session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
+		sessMgr: sessMgr,
 	}
 
 	submittedKeys := []string{wrongKey, testSigningKey}

internal/handlers/auth_session_internal_test.go

@@ -10,8 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -233,13 +232,8 @@ func TestHandleLogout_SaveFails_Answers500(t *testing.T) {
 
 	db := setupTestDB(t)
 
-	keys, err := seal.DeriveKeys(testSigningKey)
-	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
-	}
-
 	sessMgr, err := session.NewManagerWithDatabase(
-		t.Context(), keys.SessionHashKey, keys.SessionBlockKey, db)
+		t.Context(), testSigningKey, db)
 	if err != nil {
 		t.Fatalf("session.NewManagerWithDatabase() error = %v", err)
 	}
@@ -320,7 +314,7 @@ func TestGeneratePost_URLServesImage(t *testing.T) {
 		sourceURLField: {"https://" + signedHost + photoPath},
 		widthField:     {"50"},
 		heightField:    {"50"},
-		formatField:    {string(imagerequest.FormatJPEG)},
+		formatField:    {string(imgcache.FormatJPEG)},
 	})
 
 	if rec.Code != http.StatusOK {
@@ -353,7 +347,7 @@ func TestGeneratePost_URLWithTTLExpires(t *testing.T) {
 		sourceURLField: {"https://" + signedHost + photoPath},
 		widthField:     {"50"},
 		heightField:    {"50"},
-		formatField:    {string(imagerequest.FormatJPEG)},
+		formatField:    {string(imgcache.FormatJPEG)},
 		ttlField:       {"1"},
 	})
 

internal/handlers/avif_too_large_internal_test.go

@@ -9,14 +9,14 @@ import (
 	"testing"
 
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// TestAVIFOutputTooLargeAnswers400 checks that respondImageError, which
-// answers the errors of both image routes, answers 400 naming the AVIF pixel
-// limit when the image processor refuses an AVIF output above it, wrapped as
-// the service wraps it. The request's source only goes into a log line, so it
-// is left empty.
+// TestAVIFOutputTooLargeAnswers400 checks that respondImageError and
+// handleImageError, which answer the errors of the two image routes, answer
+// 400 naming the AVIF pixel limit when the image processor refuses an AVIF
+// output above it, wrapped as the service wraps it. The request's source only
+// goes into a log line, so it is left empty.
 func TestAVIFOutputTooLargeAnswers400(t *testing.T) {
 	t.Parallel()
 
@@ -25,15 +25,25 @@ func TestAVIFOutputTooLargeAnswers400(t *testing.T) {
 		imageprocessor.ErrAVIFOutputTooLarge)
 	wantBody := fmt.Sprintf("above %d pixels", imageprocessor.MaxAVIFOutputPixels)
 
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("status = %d, body = %q", rec.Code, rec.Body.String())
+	plain := httptest.NewRecorder()
+	h.respondImageError(plain, &imgcache.ImageRequest{}, err)
 
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusBadRequest)
-	}
+	encrypted := httptest.NewRecorder()
+	h.handleImageError(encrypted, err)
 
-	if !strings.Contains(rec.Body.String(), wantBody) {
-		t.Errorf("body = %q, want it to say %q", rec.Body.String(), wantBody)
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"respondImageError": plain, "handleImageError": encrypted,
+	} {
+		t.Logf("%s: status = %d, body = %q", name, rec.Code, rec.Body.String())
+
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("%s: status = %d, want %d",
+				name, rec.Code, http.StatusBadRequest)
+		}
+
+		if !strings.Contains(rec.Body.String(), wantBody) {
+			t.Errorf("%s: body = %q, want it to say %q",
+				name, rec.Body.String(), wantBody)
+		}
 	}
 }

internal/handlers/bodylimit_internal_test.go

@@ -11,7 +11,6 @@ import (
 
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
 )
 
@@ -33,17 +32,27 @@ func newBodyLimitTestRouter(
 
 	cfg := &config.Config{SigningKey: testSigningKey, Debug: true}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	sessMgr, err := session.NewManager(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("session.NewManager() error = %v", err)
+	}
+
+	encGen, err := encurl.NewGenerator(testSigningKey)
+	if err != nil {
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
+	}
+
+	protect, err := newCSRFProtect(testSigningKey, cfg.Debug)
+	if err != nil {
+		t.Fatalf("newCSRFProtect() error = %v", err)
 	}
 
 	h := &Handlers{
 		log:         slog.New(slog.DiscardHandler),
 		config:      cfg,
-		sessMgr:     session.NewManager(keys.SessionHashKey, keys.SessionBlockKey),
-		encGen:      encurl.NewGenerator(keys.EncryptedURLKey),
-		csrfProtect: newCSRFProtect(keys.CSRFKey, cfg.Debug, slog.New(slog.DiscardHandler)),
+		sessMgr:     sessMgr,
+		encGen:      encGen,
+		csrfProtect: protect,
 	}
 
 	r := chi.NewRouter()

internal/handlers/cache_hit_internal_test.go

@@ -1,278 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"database/sql"
-	"database/sql/driver"
-	"image"
-	"image/jpeg"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"sync/atomic"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/prometheus/client_golang/prometheus"
-
-	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
-)
-
-// countingHost is the allowlisted host whose photoPath the server of
-// newCountingDatabaseServer serves.
-const countingHost = "counting.example.com"
-
-// countingConnector opens connections to the SQLite database file name with
-// sqliteDriver, each one counting in statements the statements run on it.
-type countingConnector struct {
-	sqliteDriver driver.Driver
-	name         string
-	statements   *atomic.Int64
-}
-
-func (c countingConnector) Connect(context.Context) (driver.Conn, error) {
-	conn, err := c.sqliteDriver.Open(c.name)
-	if err != nil {
-		return nil, err
-	}
-
-	return countingConn{Conn: conn, statements: c.statements}, nil
-}
-
-func (c countingConnector) Driver() driver.Driver {
-	return c.sqliteDriver
-}
-
-// countingConn counts the statements run on its connection. It has only the
-// methods of driver.Conn, so database/sql prepares every query and every
-// other statement with Prepare, which counts it.
-type countingConn struct {
-	driver.Conn
-
-	statements *atomic.Int64
-}
-
-func (c countingConn) Prepare(query string) (driver.Stmt, error) {
-	c.statements.Add(1)
-
-	return c.Conn.Prepare(query)
-}
-
-// newCountingDatabase returns a database with pixa's schema, in a file of
-// its own and with one connection, and the count of the statements run on
-// it once the schema is in place.
-func newCountingDatabase(tb testing.TB) (*sql.DB, *atomic.Int64) {
-	tb.Helper()
-
-	path := filepath.Join(tb.TempDir(), "state.sqlite3")
-
-	schemaDB, err := sql.Open("sqlite", path)
-	if err != nil {
-		tb.Fatalf("opening the database: %v", err)
-	}
-
-	defer func() { _ = schemaDB.Close() }()
-
-	err = database.ApplyMigrations(tb.Context(), schemaDB, nil)
-	if err != nil {
-		tb.Fatalf("applying the migrations: %v", err)
-	}
-
-	statements := new(atomic.Int64)
-
-	db := sql.OpenDB(countingConnector{
-		sqliteDriver: schemaDB.Driver(),
-		name:         path,
-		statements:   statements,
-	})
-	db.SetMaxOpenConns(1)
-
-	tb.Cleanup(func() { _ = db.Close() })
-
-	return db, statements
-}
-
-// newCountingDatabaseServer returns a router for both image routes whose
-// image cache uses newCountingDatabase, the count of the statements run on
-// that database, and a URL on each route for a different image of
-// photoPath on countingHost. Nothing writes the cache's access times in the
-// background, so every statement counted comes from a request.
-func newCountingDatabaseServer(
-	tb testing.TB,
-) (http.Handler, *atomic.Int64, []string) {
-	tb.Helper()
-
-	db, statements := newCountingDatabase(tb)
-
-	var photo bytes.Buffer
-
-	err := jpeg.Encode(&photo, image.NewRGBA(image.Rect(0, 0, 100, 100)), nil)
-	if err != nil {
-		tb.Fatalf("encoding the photo: %v", err)
-	}
-
-	cache, err := imgcache.NewCache(db, imgcache.Config{
-		StateDir:    tb.TempDir(),
-		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
-	if err != nil {
-		tb.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache: cache,
-		Fetcher: newMockFetcher(fstest.MapFS{
-			countingHost + photoPath: &fstest.MapFile{Data: photo.Bytes()},
-		}),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          slog.New(slog.DiscardHandler),
-	}, prometheus.NewRegistry())
-	if err != nil {
-		tb.Fatalf("imageproxy.New() error = %v", err)
-	}
-
-	keys, err := seal.DeriveKeys(testSigningKey)
-	if err != nil {
-		tb.Fatalf("seal.DeriveKeys() error = %v", err)
-	}
-
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	token, err := encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{Host: countingHost, Path: photoPath},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 40, Height: 40},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}, time.Time{})
-	if err != nil {
-		tb.Fatalf("encGen.Generate() error = %v", err)
-	}
-
-	h := &Handlers{
-		log:       slog.New(slog.DiscardHandler),
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{countingHost}),
-	}
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-	r.Get("/v1/e/{token}/*", h.HandleImageEnc())
-
-	return r, statements, []string{
-		"/v1/image/" + countingHost + photoPath + "/50x50.jpeg",
-		"/v1/e/" + token + "/img.jpg",
-	}
-}
-
-// serveImage sends srv a GET for target and returns the response, failing
-// the test unless it is a 200 with an image.
-func serveImage(
-	tb testing.TB, srv http.Handler, target string,
-) *httptest.ResponseRecorder {
-	tb.Helper()
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec,
-		httptest.NewRequestWithContext(tb.Context(), http.MethodGet, target, nil))
-
-	if rec.Code != http.StatusOK || rec.Body.Len() == 0 {
-		tb.Errorf("GET %s: %d with %d bytes, want 200 with an image",
-			target, rec.Code, rec.Body.Len())
-	}
-
-	return rec
-}
-
-// TestImageRoutes_CacheHitsMakeNoDatabaseCall serves an image on each image
-// route once, which makes and caches it, then serves it again from the cache.
-// Serving those cache hits must run no statement on the database.
-func TestImageRoutes_CacheHitsMakeNoDatabaseCall(t *testing.T) {
-	t.Parallel()
-
-	srv, statements, targets := newCountingDatabaseServer(t)
-
-	for _, target := range targets {
-		before := statements.Load()
-
-		serveImage(t, srv, target)
-
-		afterMiss := statements.Load()
-		t.Logf("GET %s, a miss: %d statements", target, afterMiss-before)
-
-		if afterMiss == before {
-			t.Fatalf("GET %s, a miss: no statement counted, want some", target)
-		}
-
-		for range 3 {
-			rec := serveImage(t, srv, target)
-
-			cacheStatus := rec.Header().Get("X-Pixa-Cache")
-			if cacheStatus != string(imageproxy.CacheHit) {
-				t.Errorf("GET %s: X-Pixa-Cache = %q, want %s",
-					target, cacheStatus, imageproxy.CacheHit)
-			}
-		}
-
-		if hitStatements := statements.Load() - afterMiss; hitStatements != 0 {
-			t.Errorf("GET %s: 3 cache hits ran %d statements, want 0",
-				target, hitStatements)
-		}
-	}
-}
-
-// BenchmarkHandleImage_CacheHits serves one cached image through the
-// /v1/image/ route from b.RunParallel's goroutines, and reports the cache
-// hits served per second. It fails if serving them ran any statement on the
-// database. script/bench runs it.
-func BenchmarkHandleImage_CacheHits(b *testing.B) {
-	srv, statements, targets := newCountingDatabaseServer(b)
-	target := targets[0]
-
-	serveImage(b, srv, target)
-
-	before := statements.Load()
-
-	b.ResetTimer()
-
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			rec := serveImage(b, srv, target)
-
-			cacheStatus := rec.Header().Get("X-Pixa-Cache")
-			if cacheStatus != string(imageproxy.CacheHit) {
-				b.Errorf("GET %s: X-Pixa-Cache = %q, want %s",
-					target, cacheStatus, imageproxy.CacheHit)
-
-				return
-			}
-		}
-	})
-
-	b.ReportMetric(float64(b.N)/b.Elapsed().Seconds(), "hits/s")
-
-	if hitStatements := statements.Load() - before; hitStatements != 0 {
-		b.Fatalf("%d cache hits ran %d statements, want 0", b.N, hitStatements)
-	}
-}

internal/handlers/cache_max_bytes_internal_test.go

@@ -0,0 +1,147 @@
+package handlers
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"go.uber.org/fx/fxtest"
+
+	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
+	"sneak.berlin/go/pixa/internal/globals"
+	"sneak.berlin/go/pixa/internal/logger"
+)
+
+// TestNewCacheConfigFromCacheMaxBytes checks the cache configuration
+// built from cache_max_bytes: omitted, the cache works out the default
+// limit; 0 turns the disk cache off; a positive value is the limit,
+// unchanged.
+func TestNewCacheConfigFromCacheMaxBytes(t *testing.T) {
+	t.Parallel()
+
+	const oneGiB = 1 << 30
+
+	cases := []struct {
+		name                   string
+		cacheMaxBytes          int64
+		cacheMaxBytesExplicit  bool
+		wantMaxBytes           int64
+		wantUseDefaultMaxBytes bool
+		wantDisableDiskCache   bool
+	}{
+		{
+			name:                   "cache_max_bytes omitted",
+			cacheMaxBytes:          0,
+			cacheMaxBytesExplicit:  false,
+			wantMaxBytes:           0,
+			wantUseDefaultMaxBytes: true,
+			wantDisableDiskCache:   false,
+		},
+		{
+			name:                   "cache_max_bytes: 0",
+			cacheMaxBytes:          0,
+			cacheMaxBytesExplicit:  true,
+			wantMaxBytes:           0,
+			wantUseDefaultMaxBytes: false,
+			wantDisableDiskCache:   true,
+		},
+		{
+			name:                   "cache_max_bytes: 1 GiB",
+			cacheMaxBytes:          oneGiB,
+			cacheMaxBytesExplicit:  true,
+			wantMaxBytes:           oneGiB,
+			wantUseDefaultMaxBytes: false,
+			wantDisableDiskCache:   false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &config.Config{
+				CacheMaxBytes:         tc.cacheMaxBytes,
+				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
+			}
+
+			got := newCacheConfig(cfg, nil)
+			t.Logf("MaxBytes = %d, UseDefaultMaxBytes = %v, DisableDiskCache = %v",
+				got.MaxBytes, got.UseDefaultMaxBytes, got.DisableDiskCache)
+
+			if got.MaxBytes != tc.wantMaxBytes {
+				t.Errorf("MaxBytes = %d, want %d", got.MaxBytes, tc.wantMaxBytes)
+			}
+
+			if got.UseDefaultMaxBytes != tc.wantUseDefaultMaxBytes {
+				t.Errorf("UseDefaultMaxBytes = %v, want %v",
+					got.UseDefaultMaxBytes, tc.wantUseDefaultMaxBytes)
+			}
+
+			if got.DisableDiskCache != tc.wantDisableDiskCache {
+				t.Errorf("DisableDiskCache = %v, want %v",
+					got.DisableDiskCache, tc.wantDisableDiskCache)
+			}
+		})
+	}
+}
+
+// TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes starts the handlers
+// once with cache_max_bytes omitted and once with cache_max_bytes: 0,
+// and checks by whether the cache directories were created that the
+// disk cache is on in the first case and off in the second.
+func TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name                  string
+		cacheMaxBytesExplicit bool
+		wantDiskCache         bool
+	}{
+		{name: "cache_max_bytes omitted", cacheMaxBytesExplicit: false, wantDiskCache: true},
+		{name: "cache_max_bytes: 0", cacheMaxBytesExplicit: true, wantDiskCache: false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			stateDir := t.TempDir()
+			cfg := &config.Config{
+				SigningKey:            testSigningKey,
+				StateDir:              stateDir,
+				DBURL:                 "file:" + filepath.Join(stateDir, "state.sqlite3"),
+				CacheMaxBytes:         0,
+				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
+			}
+
+			lc := fxtest.NewLifecycle(t)
+
+			log, err := logger.New(lc, logger.Params{Globals: &globals.Globals{}})
+			if err != nil {
+				t.Fatalf("logger.New() error = %v", err)
+			}
+
+			db, err := database.New(lc, database.Params{Logger: log, Config: cfg})
+			if err != nil {
+				t.Fatalf("database.New() error = %v", err)
+			}
+
+			_, err = New(lc, Params{Logger: log, Database: db, Config: cfg})
+			if err != nil {
+				t.Fatalf("New() error = %v", err)
+			}
+
+			lc.RequireStart()
+			t.Cleanup(lc.RequireStop)
+
+			_, err = os.Stat(filepath.Join(stateDir, "cache", "variants"))
+			gotDiskCache := err == nil
+
+			if gotDiskCache != tc.wantDiskCache {
+				t.Errorf("cache directories created = %v, want %v",
+					gotDiskCache, tc.wantDiskCache)
+			}
+		})
+	}
+}

internal/handlers/client_gone_internal_test.go

@@ -1,177 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// heldFetcher sends on started when a fetch begins, and holds the fetch until
-// release is closed. It then fails the fetch as an upstream error.
-type heldFetcher struct {
-	started chan struct{}
-	release chan struct{}
-}
-
-// Fetch sends on f.started, waits for f.release to be closed, and returns
-// httpfetcher.ErrUpstreamError.
-func (f heldFetcher) Fetch(
-	context.Context, imagerequest.Source, string, string,
-) (*httpfetcher.FetchResult, error) {
-	f.started <- struct{}{}
-
-	<-f.release
-
-	return nil, httpfetcher.ErrUpstreamError
-}
-
-// readLogLines decodes the JSON log lines in logs.
-func readLogLines(t *testing.T, logs *bytes.Buffer) []map[string]any {
-	t.Helper()
-
-	t.Logf("logged:\n%s", logs.String())
-
-	var lines []map[string]any
-
-	dec := json.NewDecoder(logs)
-	for dec.More() {
-		var line map[string]any
-
-		err := dec.Decode(&line)
-		if err != nil {
-			t.Fatalf("decoding log line: %v", err)
-		}
-
-		lines = append(lines, line)
-	}
-
-	return lines
-}
-
-// TestImageRoutes_ClientGoneWhileWaitingAnswers499 checks that both image
-// routes answer 499 to a request whose client goes away while it waits for an
-// image another request is making. A first request's fetch is held, so the
-// image is being made, and a second request for the same image waits for it
-// until its client goes away. The second request must be logged once at info
-// level with its request ID and the source host and path. Nothing may be
-// logged at error level.
-func TestImageRoutes_ClientGoneWhileWaitingAnswers499(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			fetcher := heldFetcher{started: make(chan struct{}), release: make(chan struct{})}
-			h, routes := newRoutesFetchingThrough(t, fetcher,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-			target := imageURL(t, h)
-
-			firstDone := make(chan struct{})
-
-			go func() {
-				defer close(firstDone)
-
-				sendGet(t, routes, target)
-			}()
-
-			<-fetcher.started
-
-			ctx, cancel := context.WithCancel(context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID))
-			rec := httptest.NewRecorder()
-			secondDone := make(chan struct{})
-
-			go func() {
-				defer close(secondDone)
-
-				routes.ServeHTTP(rec, httptest.NewRequestWithContext(
-					ctx, http.MethodGet, target, nil))
-			}()
-
-			// Give the second request time to start waiting for the first
-			// request's image. The fetch is still held, so the second request
-			// can end only because its client went away
-			time.Sleep(100 * time.Millisecond)
-			cancel()
-			<-secondDone
-
-			close(fetcher.release)
-			<-firstDone
-
-			if rec.Code != 499 {
-				t.Errorf("status = %d, want 499", rec.Code)
-			}
-
-			var clientGoneLines int
-
-			for _, line := range readLogLines(t, &logs) {
-				if line["level"] == slog.LevelError.String() {
-					t.Errorf("logged at error level: %v", line["msg"])
-				}
-
-				if line["level"] == slog.LevelInfo.String() &&
-					line["msg"] == "client went away before the image was ready" &&
-					line["request_id"] == requestID &&
-					line["host"] == signedHost &&
-					line["path"] == photoPath {
-					clientGoneLines++
-				}
-			}
-
-			if clientGoneLines != 1 {
-				t.Errorf("info line naming the request logged %d times, want 1",
-					clientGoneLines)
-			}
-		})
-	}
-}
-
-// TestImageRoutes_CanceledWithLiveRequestAnswers500 checks that both image
-// routes answer 500, logged as "failed to get image" at error level, for an
-// image service error that wraps context.Canceled while the request's own
-// context is live. Its client has not gone away, so the cancellation is
-// pixa's own failure.
-func TestImageRoutes_CanceledWithLiveRequestAnswers500(t *testing.T) {
-	t.Parallel()
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, routes := newRoutesFetchingThrough(t,
-				failingFetcher{err: context.Canceled},
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			rec := sendGet(t, routes, imageURL(t, h))
-			if rec.Code != http.StatusInternalServerError {
-				t.Errorf("status = %d, want %d",
-					rec.Code, http.StatusInternalServerError)
-			}
-
-			if !slices.ContainsFunc(readLogLines(t, &logs),
-				func(line map[string]any) bool {
-					return line["level"] == slog.LevelError.String() &&
-						line["msg"] == "failed to get image"
-				}) {
-				t.Error(`no "failed to get image" line logged at error level`)
-			}
-		})
-	}
-}

internal/handlers/csrf.go

@@ -1,43 +1,23 @@
 package handlers
 
 import (
-	"bytes"
-	"errors"
 	"html/template"
-	"log/slog"
 	"net/http"
-	"net/url"
 
-	"github.com/go-chi/chi/v5/middleware"
 	"github.com/gorilla/csrf"
 
 	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/templates"
 )
 
-// The causes the form-refused page names, each with what to do about it.
-const (
-	causePlainHTTP = "This page was opened over plain HTTP while debug is " +
-		"off. Open it over HTTPS, or turn debug on to use plain HTTP on " +
-		"your own machine."
-	causeHTTPSWithDebug = "This page was opened over HTTPS while debug is " +
-		"on. Turn debug off, or open the page over plain HTTP."
-	causeOtherHost = "The form was sent from another host than the one in " +
-		"the request's Host header. A reverse proxy in front of pixa must " +
-		"pass the Host header on unchanged."
-	causeNoReferer = "The browser sent neither an Origin nor a Referer " +
-		"header, and over HTTPS pixa needs one to check where the form " +
-		"came from. Let the browser send the Referer header to this site."
-	causeStaleToken = "The form token is missing or out of date. Reload " +
-		"the page and submit the form again."
-)
+// csrfKeySalt provides domain separation for the CSRF authentication key,
+// derived from the signing key so tokens survive restarts without extra
+// configuration and never reuse the session or encrypted-URL key material.
+const csrfKeySalt = "pixa-csrf-v1"
 
 // newCSRFProtect builds the CSRF-protection middleware for the
 // state-mutating HTML form routes. The token lives in its own cookie,
 // independent of the session cookie, so it also protects the login POST
-// where no session exists yet (login CSRF). key signs that cookie. A
-// refused form is answered by the handler that handleFormRefused returns.
-// log gets a warning with the library's reason, such as "origin invalid".
+// where no session exists yet (login CSRF).
 //
 // When plaintext is true (local HTTP development), requests are marked
 // plaintext so the library neither demands an https Referer nor sets a
@@ -45,18 +25,22 @@ const (
 // service runs behind a TLS-terminating proxy, so plaintext is false and
 // the library enforces its https Referer origin check.
 func newCSRFProtect(
-	key [seal.KeySize]byte, plaintext bool, log *slog.Logger,
-) func(http.Handler) http.Handler {
+	signingKey string, plaintext bool,
+) (func(http.Handler) http.Handler, error) {
+	key, err := seal.DeriveKey([]byte(signingKey), csrfKeySalt)
+	if err != nil {
+		return nil, err
+	}
+
 	protect := csrf.Protect(
 		key[:],
 		csrf.Path("/"),
 		csrf.Secure(!plaintext),
 		csrf.SameSite(csrf.SameSiteStrictMode),
-		csrf.ErrorHandler(handleFormRefused(plaintext, log)),
 	)
 
 	if !plaintext {
-		return protect
+		return protect, nil
 	}
 
 	return func(next http.Handler) http.Handler {
@@ -65,85 +49,7 @@ func newCSRFProtect(
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			protected.ServeHTTP(w, csrf.PlaintextHTTPRequest(r))
 		})
-	}
-}
-
-// handleFormRefused returns the handler the CSRF middleware calls when it
-// refuses a request. It logs the library's reason with the request ID and
-// answers 403 with a page naming the cause and what to do. A reason that is
-// not a refusal, such as a failure to make a token, answers 500.
-func handleFormRefused(plaintext bool, log *slog.Logger) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		reason := csrf.FailureReason(r)
-		requestID := middleware.GetReqID(r.Context())
-
-		cause := formRefusedCause(r, reason, plaintext)
-		if cause == "" {
-			log.Error("CSRF middleware failed",
-				"request_id", requestID, "error", reason)
-			http.Error(w, "Internal server error",
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		log.Warn("form refused", "request_id", requestID, "reason", reason)
-
-		var page bytes.Buffer
-
-		err := templates.Render(&page, "form_refused.html",
-			struct{ Cause string }{Cause: cause})
-		if err != nil {
-			log.Error("failed to render form refused template", "error", err)
-			http.Error(w, "Internal server error",
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.WriteHeader(http.StatusForbidden)
-
-		_, err = page.WriteTo(w)
-		if err != nil {
-			log.Error("failed to write form refused page", "error", err)
-		}
-	})
-}
-
-// formRefusedCause returns the cause the form-refused page names for the
-// CSRF middleware's reason, or "" when the reason is not a refusal.
-func formRefusedCause(r *http.Request, reason error, plaintext bool) string {
-	switch {
-	case errors.Is(reason, csrf.ErrNoToken), errors.Is(reason, csrf.ErrBadToken):
-		return causeStaleToken
-	case errors.Is(reason, csrf.ErrNoReferer):
-		return causeNoReferer
-	case errors.Is(reason, csrf.ErrBadOrigin):
-		return pageAddressCause(r.Header.Get("Origin"), r.Host, plaintext)
-	case errors.Is(reason, csrf.ErrBadReferer):
-		return pageAddressCause(r.Referer(), r.Host, plaintext)
-	default:
-		return ""
-	}
-}
-
-// pageAddressCause returns the cause for a form whose page address, the
-// Origin or Referer header, the CSRF middleware refused. The middleware
-// expects the request's own host, with https when plaintext is false and
-// http when it is true. So on the request's own host, only the scheme was
-// wrong.
-func pageAddressCause(pageAddress, host string, plaintext bool) string {
-	page, err := url.Parse(pageAddress)
-	if err != nil || page.Host != host {
-		return causeOtherHost
-	}
-
-	if plaintext {
-		return causeHTTPSWithDebug
-	}
-
-	return causePlainHTTP
+	}, nil
 }
 
 // CSRF returns the CSRF-protection middleware for the login and generator

internal/handlers/csrf_refused_internal_test.go

@@ -1,205 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"html/template"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/gorilla/csrf"
-
-	"sneak.berlin/go/pixa/internal/seal"
-)
-
-// refusedFormRequestID is the request ID of the requests postRefusedForm
-// sends, which the warning for a refused form must carry.
-const refusedFormRequestID = "test-request-id"
-
-// TestFormRefusedNamesCause verifies that a form the CSRF middleware refuses
-// answers 403 with a page naming the cause, and logs a warning with the
-// request ID and the middleware's reason.
-func TestFormRefusedNamesCause(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		debug      bool
-		origin     string
-		referer    string
-		wantCause  string
-		wantReason error
-	}{
-		{
-			name:       "plain HTTP origin with debug off",
-			origin:     "http://example.com",
-			wantCause:  causePlainHTTP,
-			wantReason: csrf.ErrBadOrigin,
-		},
-		{
-			name:       "plain HTTP referer with debug off",
-			referer:    "http://example.com/",
-			wantCause:  causePlainHTTP,
-			wantReason: csrf.ErrBadReferer,
-		},
-		{
-			name:       "origin on another host",
-			origin:     "https://proxy.example.net",
-			wantCause:  causeOtherHost,
-			wantReason: csrf.ErrBadOrigin,
-		},
-		{
-			name:       "referer on another host",
-			referer:    "https://proxy.example.net/",
-			wantCause:  causeOtherHost,
-			wantReason: csrf.ErrBadReferer,
-		},
-		{
-			name:       "HTTPS origin with debug on",
-			debug:      true,
-			origin:     "https://example.com",
-			wantCause:  causeHTTPSWithDebug,
-			wantReason: csrf.ErrBadOrigin,
-		},
-		{
-			name:       "no origin or referer with debug off",
-			wantCause:  causeNoReferer,
-			wantReason: csrf.ErrNoReferer,
-		},
-		{
-			name:       "missing token",
-			debug:      true,
-			origin:     "http://example.com",
-			wantCause:  causeStaleToken,
-			wantReason: csrf.ErrNoToken,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec, logLine := postRefusedForm(t, tt.debug, tt.origin, tt.referer,
-				nil, "")
-			checkFormRefused(t, rec, logLine, tt.wantCause, tt.wantReason)
-		})
-	}
-}
-
-// TestFormRefusedNamesCauseForForeignToken verifies that a form whose token
-// does not match its CSRF cookie answers 403 with a page naming
-// causeStaleToken, and logs a warning with the request ID and the
-// middleware's reason.
-func TestFormRefusedNamesCauseForForeignToken(t *testing.T) {
-	t.Parallel()
-
-	// The router and postRefusedForm derive their CSRF key from
-	// testSigningKey, so cookiesA is valid there and only tokenB is wrong.
-	_, router := newCSRFTestRouter(t)
-	cookiesA, _ := csrfCredentials(t, router, nil)
-	_, tokenB := csrfCredentials(t, router, nil)
-
-	rec, logLine := postRefusedForm(t, true, "http://example.com", "",
-		cookiesA, tokenB)
-	checkFormRefused(t, rec, logLine, causeStaleToken, csrf.ErrBadToken)
-}
-
-// postRefusedForm sends a POST with the given cookies to the CSRF
-// middleware built for debug. It adds the form token and the Origin and
-// Referer headers when they are not empty. It returns the response and the
-// one JSON log line the middleware wrote.
-func postRefusedForm(
-	t *testing.T, debug bool, origin, referer string,
-	cookies []*http.Cookie, token string,
-) (*httptest.ResponseRecorder, map[string]any) {
-	t.Helper()
-
-	keys, err := seal.DeriveKeys(testSigningKey)
-	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
-	}
-
-	var logs bytes.Buffer
-
-	log := slog.New(slog.NewJSONHandler(&logs, nil))
-	reached := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		t.Error("the refused form reached the handler behind the middleware")
-	})
-	srv := newCSRFProtect(keys.CSRFKey, debug, log)(reached)
-
-	form := url.Values{loginKeyField: {"x"}}
-	if token != "" {
-		form.Set(csrfTokenField, token)
-	}
-
-	ctx := context.WithValue(context.Background(),
-		middleware.RequestIDKey, refusedFormRequestID)
-	req := httptest.NewRequestWithContext(ctx, http.MethodPost,
-		"http://example.com/", strings.NewReader(form.Encode()))
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	if origin != "" {
-		req.Header.Set("Origin", origin)
-	}
-
-	if referer != "" {
-		req.Header.Set("Referer", referer)
-	}
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, req)
-
-	var logLine map[string]any
-
-	err = json.Unmarshal(logs.Bytes(), &logLine)
-	if err != nil {
-		t.Fatalf("decoding log line %q: %v", logs.String(), err)
-	}
-
-	return rec, logLine
-}
-
-// checkFormRefused checks that rec is a 403 page naming wantCause and that
-// logLine is a warning carrying the request ID and wantReason.
-func checkFormRefused(
-	t *testing.T, rec *httptest.ResponseRecorder, logLine map[string]any,
-	wantCause string, wantReason error,
-) {
-	t.Helper()
-
-	if rec.Code != http.StatusForbidden {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusForbidden)
-	}
-
-	body := rec.Body.String()
-	t.Logf("body: %s", body)
-
-	if !strings.Contains(body, template.HTMLEscapeString(wantCause)) {
-		t.Errorf("page does not name the cause %q", wantCause)
-	}
-
-	t.Logf("log line: %v", logLine)
-
-	if logLine["level"] != "WARN" || logLine["msg"] != "form refused" {
-		t.Errorf("log line = %v, want a WARN \"form refused\"", logLine)
-	}
-
-	if logLine["request_id"] != refusedFormRequestID {
-		t.Errorf("logged request_id = %v, want %q",
-			logLine["request_id"], refusedFormRequestID)
-	}
-
-	if logLine["reason"] != wantReason.Error() {
-		t.Errorf("logged reason = %v, want %q", logLine["reason"], wantReason)
-	}
-}

internal/handlers/fetcher_internal_test.go

@@ -0,0 +1,61 @@
+package handlers
+
+import (
+	"net/http"
+	"net/netip"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxtest"
+
+	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
+	"sneak.berlin/go/pixa/internal/globals"
+	"sneak.berlin/go/pixa/internal/healthcheck"
+	"sneak.berlin/go/pixa/internal/logger"
+)
+
+// TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided builds the handlers as
+// pixad does, in an fx app that provides no fetcher, and requests an image
+// from 192.0.2.10, which is on the allowlist and in blocked_networks. The URL
+// check accepts that address; only the dialer that refuses internal
+// addresses checks blocked_networks, so the answer is 403 only if the
+// fetcher the handlers build from the config connects with that dialer. Any
+// other dialer would try to connect until the upstream fetch timeout, which
+// is short so that the test then fails quickly.
+func TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided(t *testing.T) {
+	t.Parallel()
+
+	const host = "192.0.2.10"
+
+	stateDir := t.TempDir()
+	cfg := &config.Config{
+		SigningKey:           testSigningKey,
+		StateDir:             stateDir,
+		DBURL:                "file:" + filepath.Join(stateDir, "state.sqlite3"),
+		AllowlistHosts:       []string{host},
+		BlockedNetworks:      []netip.Prefix{netip.MustParsePrefix("192.0.2.0/24")},
+		UpstreamFetchTimeout: 2 * time.Second,
+		// With no connection slots, the fetch would fail before dialing.
+		UpstreamConnections: config.DefaultUpstreamConnections,
+	}
+
+	var h *Handlers
+
+	app := fxtest.New(t,
+		fx.Supply(cfg),
+		fx.Provide(globals.New, logger.New, database.New, healthcheck.New, New),
+		fx.Populate(&h),
+	)
+	app.RequireStart()
+	t.Cleanup(app.RequireStop)
+
+	r := chi.NewRouter()
+	r.Get("/v1/image/*", h.HandleImage())
+
+	rec := sendGet(t, r, photoURL(host))
+	checkErrorBody(t, rec, http.StatusForbidden, "forbidden")
+}

internal/handlers/first_bytes_internal_test.go

@@ -12,16 +12,9 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // mismatchedSourcePath is the path of the source that
@@ -31,51 +24,38 @@ import (
 const mismatchedSourcePath = "/images/source.png"
 
 // newRoutesFetchingThrough returns both image routes, and the Handlers behind
-// them, whose image service fetches through fetcher, and which have
-// allowlistedHost on their allowlist. The handlers and the image service log
-// to log.
+// them, whose image service fetches through fetcher and has allowlistedHost on
+// its allowlist. The handlers and the image service log to log.
 func newRoutesFetchingThrough(
 	t *testing.T, fetcher httpfetcher.Fetcher, log *slog.Logger,
 ) (*Handlers, http.Handler) {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
+	})
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          log,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+		Logger:     log,
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	h := &Handlers{
-		log:       log,
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
-	}
+	h := &Handlers{log: log, imgSvc: svc, encGen: encGen}
 
 	r := chi.NewRouter()
 	r.Get("/v1/image/*", h.HandleImage())
@@ -95,16 +75,13 @@ func mismatchedSourcePlainURL(*testing.T, *Handlers) string {
 func mismatchedSourceEncURL(t *testing.T, h *Handlers) string {
 	t.Helper()
 
-	token, err := h.encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: allowlistedHost,
-			Path: mismatchedSourcePath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatJPEG,
-		},
-	}, time.Time{})
+	token, err := h.encGen.Generate(&encurl.Payload{
+		SourceHost: allowlistedHost,
+		SourcePath: mismatchedSourcePath,
+		Width:      50,
+		Height:     50,
+		Format:     imgcache.FormatJPEG,
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/format_auto.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // Errors for an Accept header that an auto URL cannot be served for.
@@ -18,17 +18,16 @@ var (
 		"image/jxl, image/avif, image/webp or image/jpeg")
 )
 
-// chooseAutoFormat returns the format to serve for the requested format: for
-// the format auto, the format formatForAccept chooses from r's Accept header,
-// and any other format as it is. For auto it adds Vary: Accept to the
+// chooseAutoFormat replaces the format auto in req with the format
+// formatForAccept chooses from r's Accept header, and adds Vary: Accept to the
 // response, which then depends on that header. It answers 400 for an Accept
 // header that is not valid and 406 for one that allows none of the formats,
-// and reports whether the image can be served.
+// and reports whether req can be served. Any other format is left as it is.
 func (s *Handlers) chooseAutoFormat(
-	w http.ResponseWriter, r *http.Request, requested imagerequest.Format,
-) (imagerequest.Format, bool) {
-	if requested != imagerequest.FormatAuto {
-		return requested, true
+	w http.ResponseWriter, r *http.Request, req *imgcache.ImageRequest,
+) bool {
+	if req.Format != imgcache.FormatAuto {
+		return true
 	}
 
 	w.Header().Add("Vary", "Accept")
@@ -37,16 +36,18 @@ func (s *Handlers) chooseAutoFormat(
 	if errors.Is(err, errNotAcceptable) {
 		s.respondError(w, err.Error(), http.StatusNotAcceptable)
 
-		return "", false
+		return false
 	}
 
 	if err != nil {
 		s.respondError(w, err.Error(), http.StatusBadRequest)
 
-		return "", false
+		return false
 	}
 
-	return format, true
+	req.Format = format
+
+	return true
 }
 
 // formatForAccept returns the format an auto URL is served in for the Accept
@@ -55,30 +56,30 @@ func (s *Handlers) chooseAutoFormat(
 // specific entry of image/jpeg, image/* and */* allows it, or when it names
 // nothing. A q of 0 refuses a format. JPEG XL, AVIF and WebP must be named, as
 // clients that cannot show them send image/* and */* too.
-func formatForAccept(accept string) (imagerequest.Format, error) {
+func formatForAccept(accept string) (imgcache.ImageFormat, error) {
 	qualities, err := parseAccept(accept)
 	if err != nil {
 		return "", err
 	}
 
 	if len(qualities) == 0 {
-		return imagerequest.FormatJPEG, nil
+		return imgcache.FormatJPEG, nil
 	}
 
-	if qualities[imagerequest.FormatJXL.MIMEType()] > 0 {
-		return imagerequest.FormatJXL, nil
+	if qualities["image/jxl"] > 0 {
+		return imgcache.FormatJXL, nil
 	}
 
-	if qualities[imagerequest.FormatAVIF.MIMEType()] > 0 {
-		return imagerequest.FormatAVIF, nil
+	if qualities["image/avif"] > 0 {
+		return imgcache.FormatAVIF, nil
 	}
 
-	if qualities[imagerequest.FormatWebP.MIMEType()] > 0 {
-		return imagerequest.FormatWebP, nil
+	if qualities["image/webp"] > 0 {
+		return imgcache.FormatWebP, nil
 	}
 
 	// For JPEG, the most specific entry the header has decides
-	quality, named := qualities[imagerequest.FormatJPEG.MIMEType()]
+	quality, named := qualities["image/jpeg"]
 	if !named {
 		quality, named = qualities["image/*"]
 	}
@@ -88,7 +89,7 @@ func formatForAccept(accept string) (imagerequest.Format, error) {
 	}
 
 	if quality > 0 {
-		return imagerequest.FormatJPEG, nil
+		return imgcache.FormatJPEG, nil
 	}
 
 	return "", errNotAcceptable

internal/handlers/format_auto_internal_test.go

@@ -12,7 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // The content types the tests below expect.
@@ -32,24 +33,24 @@ func TestFormatForAccept(t *testing.T) {
 	tests := []struct {
 		name    string
 		accept  string
-		want    imagerequest.Format
+		want    imgcache.ImageFormat
 		wantErr error
 	}{
 		{"AVIF-capable browser",
 			"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
-			imagerequest.FormatAVIF, nil},
+			imgcache.FormatAVIF, nil},
 		{"WebP-capable browser",
 			"image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
-			imagerequest.FormatWebP, nil},
-		{"WebP only", webpType, imagerequest.FormatWebP, nil},
-		{"neither", "image/png,image/*;q=0.8,*/*;q=0.5", imagerequest.FormatJPEG, nil},
-		{"wildcard only", "*/*", imagerequest.FormatJPEG, nil},
-		{"image wildcard only", "image/*", imagerequest.FormatJPEG, nil},
-		{"absent", "", imagerequest.FormatJPEG, nil},
-		{"q=0 on AVIF", "image/avif;q=0,image/webp,*/*", imagerequest.FormatWebP, nil},
+			imgcache.FormatWebP, nil},
+		{"WebP only", webpType, imgcache.FormatWebP, nil},
+		{"neither", "image/png,image/*;q=0.8,*/*;q=0.5", imgcache.FormatJPEG, nil},
+		{"wildcard only", "*/*", imgcache.FormatJPEG, nil},
+		{"image wildcard only", "image/*", imgcache.FormatJPEG, nil},
+		{"absent", "", imgcache.FormatJPEG, nil},
+		{"q=0 on AVIF", "image/avif;q=0,image/webp,*/*", imgcache.FormatWebP, nil},
 		{"AVIF named twice, once with q=0", "image/avif,image/avif;q=0.0,*/*",
-			imagerequest.FormatJPEG, nil},
-		{"upper case and spaces", " Image/AVIF ; Q=0.5 ", imagerequest.FormatAVIF, nil},
+			imgcache.FormatJPEG, nil},
+		{"upper case and spaces", " Image/AVIF ; Q=0.5 ", imgcache.FormatAVIF, nil},
 		{"q=0 on JPEG", "image/jpeg;q=0,image/*", "", errNotAcceptable},
 		{"q=0 on everything", "*/*;q=0", "", errNotAcceptable},
 		{"PNG only", "image/png", "", errNotAcceptable},
@@ -75,33 +76,28 @@ func TestFormatForAccept(t *testing.T) {
 
 // autoPhotoURLs returns a signed /v1/image/ URL and an encrypted /v1/e/ URL,
 // both valid for a minute, for the JPEG at photoPath on signedHost at 50x50 in
-// the format auto. The first is signed with testSigningKey, the key the
-// handlers that newSignedHostServer builds check signatures with. The second
-// is made with h's generator.
+// the format auto, made with h's image service and generator.
 func autoPhotoURLs(t *testing.T, h *Handlers) (string, string) {
 	t.Helper()
 
-	signedURL := generateSignedURL(testSigningKey, &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatAuto,
-		},
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Size:       imgcache.Size{Width: 50, Height: 50},
+		Format:     imgcache.FormatAuto,
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
-	token, err := h.encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatAuto,
-		},
-	}, time.Now().Add(time.Minute))
+	token, err := h.encGen.Generate(&encurl.Payload{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
+		Format:     imgcache.FormatAuto,
+		ExpiresAt:  time.Now().Add(time.Minute).Unix(),
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -186,18 +182,17 @@ func TestFormatAuto_ChosenFromAccept(t *testing.T) {
 func TestFormatAuto_SignatureCoversAuto(t *testing.T) {
 	t.Parallel()
 
-	_, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	signedForAVIF := generateSignedURL(testSigningKey, &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatAVIF,
-		},
+	signedForAVIF, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Size:       imgcache.Size{Width: 50, Height: 50},
+		Format:     imgcache.FormatAVIF,
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
 	target := strings.Replace(signedForAVIF, "/50x50.avif?", "/50x50.auto?", 1)
 	if target == signedForAVIF {

internal/handlers/handlers.go

@@ -4,6 +4,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"time"
@@ -11,13 +12,13 @@ import (
 	"go.uber.org/fx"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/config"
+	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/imageproxy"
+	"sneak.berlin/go/pixa/internal/httpfetcher"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/logger"
-	"sneak.berlin/go/pixa/internal/seal"
 	"sneak.berlin/go/pixa/internal/session"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // Params defines dependencies for Handlers.
@@ -26,50 +27,70 @@ type Params struct {
 
 	Logger      *logger.Logger
 	Healthcheck *healthcheck.Healthcheck
+	Database    *database.Database
 	Config      *config.Config
-	Keys        seal.Keys
 
-	ImageService          *imageproxy.Proxy
-	SessionManager        *session.Manager
-	EncryptedURLGenerator *encurl.Generator
+	// Fetcher, when provided, fetches upstream images in place of the
+	// fetcher the handlers build from the config. Only tests provide one;
+	// pixad does not.
+	Fetcher httpfetcher.Fetcher `optional:"true"`
 }
 
 // Handlers provides HTTP request handlers.
 type Handlers struct {
 	log         *slog.Logger
 	hc          *healthcheck.Healthcheck
+	db          *database.Database
 	config      *config.Config
-	imgSvc      *imageproxy.Proxy
+	fetcher     httpfetcher.Fetcher
+	imgSvc      *imgcache.Service
+	imgCache    *imgcache.Cache
 	sessMgr     *session.Manager
 	encGen      *encurl.Generator
 	csrfProtect func(http.Handler) http.Handler
 
-	// signer checks the signature of a /v1/image/ URL with signing_key.
-	signer *signature.Signer
-	// allowlist matches the hosts of allowlist_hosts, which a /v1/image/
-	// URL may name without a signature.
-	allowlist *allowlist.HostAllowList
 	// refererBlocklist matches the hosts of referer_blocklist; its IsAllowed
 	// reports whether a URL's host is on that list.
 	refererBlocklist *allowlist.HostAllowList
 }
 
 // New creates a new Handlers instance.
-func New(_ fx.Lifecycle, params Params) *Handlers {
-	log := params.Logger.Get()
+func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
+	csrfProtect, err := newCSRFProtect(params.Config.SigningKey, params.Config.Debug)
+	if err != nil {
+		return nil, err
+	}
 
-	return &Handlers{
-		log:              log,
+	s := &Handlers{
+		log:              params.Logger.Get(),
 		hc:               params.Healthcheck,
+		db:               params.Database,
 		config:           params.Config,
-		imgSvc:           params.ImageService,
-		sessMgr:          params.SessionManager,
-		encGen:           params.EncryptedURLGenerator,
-		csrfProtect:      newCSRFProtect(params.Keys.CSRFKey, params.Config.Debug, log),
-		signer:           signature.New(params.Config.SigningKey),
-		allowlist:        allowlist.New(params.Config.AllowlistHosts),
+		fetcher:          params.Fetcher,
+		csrfProtect:      csrfProtect,
 		refererBlocklist: allowlist.New(params.Config.RefererBlocklist),
 	}
+
+	lc.Append(fx.Hook{
+		//nolint:contextcheck // the cache's goroutines outlive OnStart; OnStop stops them
+		OnStart: func(_ context.Context) error {
+			return s.initImageService()
+		},
+		// The pending counts are written here, before the database's stop
+		// hook closes it.
+		OnStop: func(ctx context.Context) error {
+			if s.imgCache == nil {
+				return nil
+			}
+
+			return errors.Join(
+				s.imgCache.StopEviction(ctx),
+				s.imgCache.StopPendingCountWrites(ctx),
+			)
+		},
+	})
+
+	return s, nil
 }
 
 // WaitForProcessing waits until no image is being processed, or until ctx
@@ -78,6 +99,94 @@ func (s *Handlers) WaitForProcessing(ctx context.Context) int {
 	return s.imgSvc.WaitForProcessing(ctx)
 }
 
+// newCacheConfig builds the image cache's configuration from cfg.
+// cache_max_bytes: 0 disables the disk cache entirely; any other value
+// is the eviction limit in bytes; when it is omitted, the cache works
+// out the default limit itself.
+func newCacheConfig(cfg *config.Config, log *slog.Logger) imgcache.CacheConfig {
+	return imgcache.CacheConfig{
+		StateDir:           cfg.StateDir,
+		NegativeTTL:        imgcache.DefaultNegativeTTL,
+		MaxBytes:           cfg.CacheMaxBytes,
+		UseDefaultMaxBytes: !cfg.CacheMaxBytesExplicit,
+		DisableDiskCache:   cfg.CacheMaxBytesExplicit && cfg.CacheMaxBytes == 0,
+		Logger:             log,
+	}
+}
+
+// initImageService initializes the image cache and service.
+func (s *Handlers) initImageService() error {
+	cache, err := imgcache.NewCache(s.db.DB(), newCacheConfig(s.config, s.log))
+	if err != nil {
+		return err
+	}
+
+	s.imgCache = cache
+
+	// Background eviction: startup reconciliation, then periodic and
+	// write-pressure passes, and the removal of expired negative cache
+	// rows, which is all it does when the disk cache is disabled.
+	cache.StartEviction(imgcache.DefaultEvictionInterval)
+
+	// Writes the counts requests could not write by their deadline
+	cache.StartPendingCountWrites()
+
+	// Create the fetcher config
+	fetcherCfg := httpfetcher.DefaultConfig()
+	fetcherCfg.AllowHTTP = s.config.AllowHTTP
+	fetcherCfg.Timeout = s.config.UpstreamFetchTimeout
+	fetcherCfg.MaxResponseSize = s.config.UpstreamMaxResponseSize
+
+	if s.config.UpstreamConnectionsPerHost > 0 {
+		fetcherCfg.MaxConnectionsPerHost = s.config.UpstreamConnectionsPerHost
+	}
+
+	fetcherCfg.MaxConnections = s.config.UpstreamConnections
+	fetcherCfg.BlockedNetworks = s.config.BlockedNetworks
+
+	// Create the service. With no fetcher provided, it builds its own from
+	// fetcherCfg.
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:                   cache,
+		FetcherConfig:           fetcherCfg,
+		Fetcher:                 s.fetcher,
+		SigningKey:              s.config.SigningKey,
+		Allowlist:               s.config.AllowlistHosts,
+		MaxConcurrentProcessing: s.config.MaxConcurrentProcessing,
+		Logger:                  s.log,
+	})
+	if err != nil {
+		return err
+	}
+
+	s.imgSvc = svc
+	s.log.Info("image service initialized")
+
+	// Initialize session manager (signing key is validated at config load
+	// time). Session cookies are always Secure/HttpOnly/SameSite=Strict.
+	// The random value that each logout replaces is saved in the database,
+	// so it outlasts a restart.
+	sessMgr, err := session.NewManagerWithDatabase(
+		context.Background(), s.config.SigningKey, s.db.DB())
+	if err != nil {
+		return err
+	}
+
+	s.sessMgr = sessMgr
+
+	// Initialize encrypted URL generator
+	encGen, err := encurl.NewGenerator(s.config.SigningKey)
+	if err != nil {
+		return err
+	}
+
+	s.encGen = encGen
+
+	s.log.Info("session manager and URL generator initialized")
+
+	return nil
+}
+
 func (s *Handlers) respondJSON(w http.ResponseWriter, data any, status int) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)

internal/handlers/handlers_internal_test.go

@@ -18,20 +18,15 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // testFixtures contains test data.
 type testFixtures struct {
 	handler  *Handlers
+	service  *imgcache.Service
 	goodHost string
 }
 
@@ -50,37 +45,32 @@ func setupTestHandler(t *testing.T) *testFixtures {
 	tmpDir := t.TempDir()
 	db := setupTestDB(t)
 
-	cache, err := imgcache.NewCache(db, imgcache.Config{
+	cache, err := imgcache.NewCache(db, imgcache.CacheConfig{
 		StateDir:    tmpDir,
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
+	})
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: newMockFetcher(mockFS),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    newMockFetcher(mockFS),
+		SigningKey: "test-signing-key-must-be-32-chars",
+		Allowlist:  []string{goodHost},
+	})
 	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
+		t.Fatalf("failed to create service: %v", err)
 	}
 
 	h := &Handlers{
-		imgSvc:    svc,
-		log:       slog.Default(),
-		signer:    signature.New("test-signing-key-must-be-32-chars"),
-		allowlist: allowlist.New([]string{goodHost}),
+		imgSvc: svc,
+		log:    slog.Default(),
 	}
 
 	return &testFixtures{
 		handler:  h,
+		service:  svc,
 		goodHost: goodHost,
 	}
 }
@@ -131,9 +121,10 @@ func newMockFetcher(fs fs.FS) *mockFetcher {
 }
 
 func (f *mockFetcher) Fetch(
-	_ context.Context, source imagerequest.Source, _, _ string,
+	_ context.Context, url string,
 ) (*httpfetcher.FetchResult, error) {
-	path := source.Host + source.Path
+	// Remove https:// prefix
+	path := url[8:] // Remove "https://"
 
 	data, err := fs.ReadFile(f.fs, path)
 	if err != nil {
@@ -257,90 +248,6 @@ func TestHandleImage_ConditionalRequest_IfNoneMatch_DifferentETag(t *testing.T)
 	}
 }
 
-// TestHandleImage_ConditionalRequest_EarlierETagGetsChangedImage serves an
-// image, changes it upstream, and requests it again with the ETag first
-// served, once the cache TTL has passed. The changed image must be served,
-// not 304 Not Modified.
-func TestHandleImage_ConditionalRequest_EarlierETagGetsChangedImage(t *testing.T) {
-	t.Parallel()
-
-	const host = "goodhost.example.com"
-
-	upstream := fstest.MapFS{
-		host + photoPath: &fstest.MapFile{
-			Data: generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255}),
-		},
-	}
-
-	// A cache TTL of one nanosecond has passed by the second request
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
-		StateDir:    t.TempDir(),
-		NegativeTTL: 5 * time.Minute,
-		CacheTTL:    time.Nanosecond,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: newMockFetcher(upstream),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          slog.New(slog.DiscardHandler),
-	}, prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
-	}
-
-	h := &Handlers{
-		imgSvc:    svc,
-		log:       slog.New(slog.DiscardHandler),
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{host}),
-	}
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-
-	target := "/v1/image/" + host + photoPath + "/50x50.jpeg"
-
-	first := httptest.NewRecorder()
-	r.ServeHTTP(first,
-		httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil))
-
-	etag := first.Header().Get("ETag")
-	if first.Code != http.StatusOK || etag == "" {
-		t.Fatalf("first request: status = %d, ETag = %q, want %d and an ETag",
-			first.Code, etag, http.StatusOK)
-	}
-
-	upstream[host+photoPath] = &fstest.MapFile{
-		Data: generateTestJPEG(t, 100, 100, color.RGBA{0, 0, 255, 255}),
-	}
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	req.Header.Set("If-None-Match", etag)
-
-	second := httptest.NewRecorder()
-	r.ServeHTTP(second, req)
-	t.Logf("first ETag %s; with it after the change: status %d, ETag %s, %d bytes",
-		etag, second.Code, second.Header().Get("ETag"), second.Body.Len())
-
-	if second.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d with the changed image",
-			second.Code, http.StatusOK)
-	}
-
-	if bytes.Equal(second.Body.Bytes(), first.Body.Bytes()) {
-		t.Error("the image served is the one made before the change")
-	}
-}
-
 func TestHandleImage_ETagHeader(t *testing.T) {
 	t.Parallel()
 

internal/handlers/image.go

@@ -1,31 +1,22 @@
 package handlers
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/magic"
 )
 
-// statusClientClosedRequest is the status nginx calls "client closed
-// request". The image routes answer it when the client goes away before its
-// image is ready, unless its request is the one making the image. Nobody reads
-// it; it is for logs and metrics.
-const statusClientClosedRequest = 499
-
 // HandleImage handles the main image proxy route:
 // /v1/image/<host>/<path>/<width>x<height>.<format>, or with no format
 // /v1/image/<host>/<path>/<width>x<height>
@@ -35,17 +26,17 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 			return
 		}
 
-		req, sig, expires, ok := s.parseImageRequest(w, r)
+		req, ok := s.parseImageRequest(w, r)
 		if !ok {
 			return
 		}
 
 		// Validate signature if required
-		err := s.validateSignature(req, sig, expires)
+		err := s.imgSvc.ValidateRequest(req)
 		if err != nil {
 			s.log.Warn("signature validation failed",
-				"host", req.Source.Host,
-				"path", req.Source.Path,
+				"host", req.SourceHost,
+				"path", req.SourcePath,
 				"error", err,
 			)
 			s.respondError(w, "unauthorized", http.StatusUnauthorized)
@@ -53,7 +44,27 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 			return
 		}
 
-		s.serveImage(w, r, req, expires)
+		// The signature covers the format auto, not the format chosen
+		if !s.chooseAutoFormat(w, r, req) {
+			return
+		}
+
+		// Get cache key for logging
+		cacheKey := imgcache.CacheKey(req)
+
+		// Get the image (from cache or fetch/process)
+		startTime := time.Now()
+
+		resp, err := s.imgSvc.Get(r.Context(), req)
+		if err != nil {
+			s.respondImageError(w, req, err)
+
+			return
+		}
+
+		defer func() { _ = resp.Content.Close() }()
+
+		s.writeImageResponse(w, r, req, resp, cacheKey, startTime)
 	}
 }
 
@@ -70,17 +81,17 @@ func (s *Handlers) HandleRobotsTxt() http.HandlerFunc {
 }
 
 // parseImageRequest parses the image URL's path and query parameters into
-// an image request, and returns it with the URL's signature and expiry. On
-// invalid input it writes an error response and returns false.
+// an ImageRequest. On invalid input it writes an error response and
+// returns false.
 func (s *Handlers) parseImageRequest(
 	w http.ResponseWriter, r *http.Request,
-) (*imagerequest.Request, string, time.Time, bool) {
+) (*imgcache.ImageRequest, bool) {
 	// The path is parsed decoded once, as r.URL.Path holds it, and not from
 	// chi's wildcard: chi routes on the path as the client wrote it whenever
 	// that is not Go's own encoding of it, so its wildcard would still hold
 	// the %3F before a source query when, say, a "/" in the query is written
 	// as %2F
-	req, err := imagerequest.ParseImageURL(r.URL.Path)
+	parsed, err := imgcache.ParseImageURL(r.URL.Path)
 	if err != nil {
 		s.log.Warn("failed to parse image URL",
 			"path", r.URL.Path,
@@ -88,9 +99,12 @@ func (s *Handlers) parseImageRequest(
 		)
 		s.respondError(w, "invalid image URL: "+err.Error(), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
+	// Convert to ImageRequest
+	req := parsed.ToImageRequest()
+
 	// Parse signature params from query string. r.URL.Query() would silently
 	// drop a pair it cannot decode, such as q=80%, so that q would be served
 	// at 85; a query string that cannot be decoded is refused instead. A
@@ -101,7 +115,7 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, fmt.Sprintf("invalid query string %q: %v",
 			r.URL.RawQuery, err), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	for name, values := range query {
@@ -109,15 +123,17 @@ func (s *Handlers) parseImageRequest(
 			s.respondError(w, fmt.Sprintf("invalid %s: given more than once",
 				name), http.StatusBadRequest)
 
-			return nil, "", time.Time{}, false
+			return nil, false
 		}
 	}
 
-	expires, err := parseExpires(query)
+	req.Signature = query.Get("sig")
+
+	req.Expires, err = parseExpires(query)
 	if err != nil {
 		s.respondError(w, err.Error(), http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Parse optional quality and fit params. Only a q missing from the URL is
@@ -129,76 +145,51 @@ func (s *Handlers) parseImageRequest(
 		s.respondError(w, `invalid q: not a number, got ""`,
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
-	req.Transform.Quality, err = parseFormInt(query, "q",
+	req.Quality, err = parseFormInt(query, "q",
 		encurl.DefaultQuality, minQuality, maxQuality)
 	if err != nil {
 		s.respondError(w, fmt.Sprintf("%v, got %q", err, qStr),
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Only a fit missing from the URL is cover. A fit in the URL that is not a
 	// fit mode is refused by the fit-mode check below; that check would take an
 	// empty fit as missing, so an empty one is refused here.
-	req.Transform.FitMode = imagerequest.Fit(query.Get("fit"))
-	if query.Has("fit") && req.Transform.FitMode == "" {
+	req.FitMode = imgcache.FitMode(query.Get("fit"))
+	if query.Has("fit") && req.FitMode == "" {
 		s.respondError(w, `invalid fit: not a fit mode, got ""`, http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
 	// Default fit mode if not set
-	if req.Transform.FitMode == "" {
-		req.Transform.FitMode = imagerequest.FitCover
+	if req.FitMode == "" {
+		req.FitMode = imgcache.FitCover
 	}
 
 	// Enforce dimension and fit-mode bounds, shared with the encrypted-URL
 	// route. Dimensions are already bounded by the path parser above; this
 	// also rejects an unrecognized fit mode with 400 instead of letting it
 	// reach the processor as a 500.
-	err = imagerequest.ValidateImageRequest(req)
+	err = imgcache.ValidateImageRequest(req)
 	if err != nil {
 		s.respondError(w, "invalid image request: "+err.Error(),
 			http.StatusBadRequest)
 
-		return nil, "", time.Time{}, false
+		return nil, false
 	}
 
-	return req, query.Get("sig"), expires, true
-}
-
-// validateSignature returns nil when the source host of req is on
-// allowlist_hosts and names no port. Otherwise it verifies sig, the URL's
-// signature of req, and expires, the URL's expiry.
-func (s *Handlers) validateSignature(
-	req *imagerequest.Request, sig string, expires time.Time,
-) error {
-	// An allowlist entry names no port, so a host followed by ":", with or
-	// without a port, needs a signature. Go's URL type reads the port as the
-	// fetcher does: in an IPv6 address written without brackets, such as
-	// 2001:db8::1:8443, it is what follows the last ":". This is checked here
-	// and not in allowlist.IsAllowed, which also matches referer_blocklist,
-	// where a Referer must be blocked whatever its port. Port and IsAllowed
-	// read only the host of a URL.
-	sourceURL := &url.URL{Host: req.Source.Host}
-	hostHasPort := sourceURL.Port() != "" ||
-		strings.HasSuffix(sourceURL.Host, ":")
-
-	if !hostHasPort && s.allowlist.IsAllowed(sourceURL) {
-		return nil
-	}
-
-	// Signature required for non-allowed hosts
-	return s.signer.Verify(req, sig, expires)
+	return req, true
 }
 
 // parseExpires reads the exp query parameter, a Unix time in seconds. An exp
-// missing from the URL gives the zero time, which the signature check refuses
-// as a missing exp. An exp in the URL that is not a whole number, an empty
+// missing from the URL gives the zero time, which the signature check takes
+// as no expiration. An exp in the URL that is not a whole number, an empty
 // one included, is an error naming exp and the value.
 func parseExpires(query url.Values) (time.Time, error) {
 	if !query.Has("exp") {
@@ -226,101 +217,75 @@ func (s *Handlers) HandleTooManyRequests() http.HandlerFunc {
 	}
 }
 
-// respondImageError answers err, the image service's error for req, on both
-// image routes. It logs a 500 at error level, as pixa's own failure. It logs
-// the other answers at warn level, since the client, the upstream or a full
-// limit caused them. The 415 for a source refused for its first bytes is not
-// logged here, because the image service logs it.
+// respondImageError maps image retrieval errors to HTTP responses.
 func (s *Handlers) respondImageError(
-	w http.ResponseWriter, req *imagerequest.Request, err error,
+	w http.ResponseWriter, req *imgcache.ImageRequest, err error,
 ) {
-	// The image service has logged this as a refused source
-	if isFirstBytesMismatch(err) {
+	// An upstream body whose first bytes are not those of the format its
+	// Content-Type names is the upstream's error, not pixa's: the image
+	// service has logged it as a refused source.
+	if errors.Is(err, magic.ErrMagicByteMismatch) ||
+		errors.Is(err, magic.ErrUnknownFormat) ||
+		errors.Is(err, magic.ErrNotEnoughData) {
 		s.respondError(w, "unsupported source format",
 			http.StatusUnsupportedMediaType)
 
 		return
 	}
 
-	var (
-		status  int
-		message string
+	s.log.Error("failed to get image",
+		"host", req.SourceHost,
+		"path", req.SourcePath,
+		"error", err,
 	)
 
-	switch {
-	case errors.Is(err, httpfetcher.ErrSSRFBlocked):
-		status, message = http.StatusForbidden, "forbidden"
-	case errors.Is(err, httpfetcher.ErrUpstreamError),
-		errors.Is(err, httpfetcher.ErrInvalidHost),
-		errors.Is(err, httpfetcher.ErrUpstreamRequestFailed):
-		status, message = http.StatusBadGateway, "upstream error"
-	case errors.Is(err, httpfetcher.ErrUpstreamTimeout):
-		status, message = http.StatusGatewayTimeout, "upstream timeout"
-	case errors.Is(err, httpfetcher.ErrTooManyConnections),
-		errors.Is(err, imageprocessor.ErrTooManyImages),
-		errors.Is(err, imageproxy.ErrProcessingTimedOut):
-		status = http.StatusServiceUnavailable
-		message = "server busy, try again later"
-	case errors.Is(err, httpfetcher.ErrInvalidContentType),
-		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat):
-		status = http.StatusUnsupportedMediaType
-		message = "unsupported source format"
-	case errors.Is(err, imageprocessor.ErrSVGTooThin):
-		status = http.StatusUnsupportedMediaType
-		message = fmt.Sprintf("SVG source too thin to render: one side is "+
-			"more than %d times the other", imageprocessor.MaxInputDimension)
-	case errors.Is(err, imageprocessor.ErrSVGRenderFailed):
-		status = http.StatusUnsupportedMediaType
-		message = fmt.Sprintf("SVG source could not be rendered: it is not "+
-			"valid, or it takes more than %d seconds or %d GiB of memory to "+
-			"render", int(imageprocessor.SVGRenderTimeout.Seconds()),
-			imageprocessor.MaxSVGRenderMemory/bytesPerGiB)
-	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
-		status = http.StatusBadRequest
-		message = fmt.Sprintf("size too large for the source: the side "+
-			"computed from its proportions is above %d",
-			imageprocessor.MaxOutputDimension)
-	case errors.Is(err, imageprocessor.ErrSVGNotOriginalSize):
-		status = http.StatusBadRequest
-		message = "an SVG source is returned as SVG only at the orig size; " +
-			"ask for another format to resize it"
-	case errors.Is(err, imageprocessor.ErrSVGTooLargeForOrigSize):
-		status = http.StatusBadRequest
-		message = fmt.Sprintf("SVG source above %d on a side: give a size "+
-			"to render it at", imageprocessor.MaxOutputDimension)
-	case errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge):
-		status = http.StatusBadRequest
-		message = fmt.Sprintf("size too large for AVIF: the output "+
-			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels)
-	default:
-		s.log.Error("failed to get image",
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-			"error", err,
-		)
-		s.respondError(w, "internal error", http.StatusInternalServerError)
+	// Check for specific error types
+	if errors.Is(err, httpfetcher.ErrSSRFBlocked) {
+		s.respondError(w, "forbidden", http.StatusForbidden)
 
 		return
 	}
 
-	s.log.Warn("failed to get image",
-		"host", req.Source.Host,
-		"path", req.Source.Path,
-		"error", err,
-	)
-	s.respondError(w, message, status)
-}
+	if errors.Is(err, httpfetcher.ErrUpstreamError) {
+		s.respondError(w, "upstream error", http.StatusBadGateway)
 
-// bytesPerGiB is the number of bytes in a GiB.
-const bytesPerGiB = 1 << 30
+		return
+	}
 
-// isFirstBytesMismatch reports whether err refuses an upstream body whose
-// first bytes are not those of the format its Content-Type names. That is the
-// upstream's error, not pixa's.
-func isFirstBytesMismatch(err error) bool {
-	return errors.Is(err, magic.ErrMagicByteMismatch) ||
-		errors.Is(err, magic.ErrUnknownFormat) ||
-		errors.Is(err, magic.ErrNotEnoughData)
+	if errors.Is(err, httpfetcher.ErrTooManyConnections) ||
+		errors.Is(err, imageprocessor.ErrTooManyImages) ||
+		errors.Is(err, imgcache.ErrProcessingTimedOut) {
+		s.respondError(w, "server busy, try again later",
+			http.StatusServiceUnavailable)
+
+		return
+	}
+
+	if errors.Is(err, httpfetcher.ErrInvalidContentType) ||
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat) {
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+
+		return
+	}
+
+	if errors.Is(err, imageprocessor.ErrOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+
+		return
+	}
+
+	if errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
+			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
+			http.StatusBadRequest)
+
+		return
+	}
+
+	s.respondError(w, "internal error", http.StatusInternalServerError)
 }
 
 // cacheControl returns the Cache-Control header for an image served through a
@@ -341,26 +306,6 @@ func cacheControl(expires time.Time) string {
 	return fmt.Sprintf("public, max-age=%d, immutable", int64(maxAge/time.Second))
 }
 
-// svgContentSecurityPolicyValue is the Content-Security-Policy header value
-// of an SVG response, in place of the middleware's. A browser that opens the
-// SVG applies its styles and draws its embedded data: images, but runs none
-// of its scripts and loads nothing else. The styles need unsafe-inline, as an
-// SVG keeps them inline, in style elements and attributes.
-const svgContentSecurityPolicyValue = "default-src 'none'; " +
-	"style-src 'unsafe-inline'; " +
-	"img-src data:; " +
-	"frame-ancestors 'none'; " +
-	"sandbox"
-
-// setSVGContentSecurityPolicy sets the Content-Security-Policy in header to
-// svgContentSecurityPolicyValue when contentType is that of SVG. Any other
-// response keeps the middleware's policy.
-func setSVGContentSecurityPolicy(header http.Header, contentType string) {
-	if contentType == imagerequest.FormatSVG.MIMEType() {
-		header.Set("Content-Security-Policy", svgContentSecurityPolicyValue)
-	}
-}
-
 // refuseBlockedReferer answers 403 with a JSON error when the request's Referer
 // names a host on referer_blocklist, and reports whether it answered. A request
 // with no Referer, or one that does not parse as a URL with a host, is not
@@ -397,60 +342,22 @@ func notModified(w http.ResponseWriter, r *http.Request, etag string) bool {
 	return true
 }
 
-// serveImage serves the image that req asks for. Both image routes call it
-// once they have the request and its URL's expiry, which ends the
-// Cache-Control max-age. It chooses the format for the format auto, answers
-// If-None-Match with 304 and HEAD with the headers only. It answers 499 when
-// the image service stopped because the client went away, and any other error
-// of the image service with respondImageError.
-func (s *Handlers) serveImage(
+// writeImageResponse writes headers and streams the image content,
+// handling conditional and HEAD requests.
+func (s *Handlers) writeImageResponse(
 	w http.ResponseWriter, r *http.Request,
-	req *imagerequest.Request, expires time.Time,
+	req *imgcache.ImageRequest, resp *imgcache.ImageResponse,
+	cacheKey imgcache.VariantKey, startTime time.Time,
 ) {
-	// The signature or the token covers the format auto, not the format chosen
-	format, ok := s.chooseAutoFormat(w, r, req.Transform.Format)
-	if !ok {
-		return
-	}
-
-	req.Transform.Format = format
-
-	startTime := time.Now()
-
-	resp, err := s.imgSvc.Get(r.Context(), req)
-
-	// The client went away before its image was ready, which is not pixa's
-	// failure. A cancellation while the request's context is live is pixa's,
-	// and respondImageError answers it 500.
-	if errors.Is(err, context.Canceled) && r.Context().Err() != nil {
-		s.log.Info("client went away before the image was ready",
-			"request_id", middleware.GetReqID(r.Context()),
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-		)
-		w.WriteHeader(statusClientClosedRequest)
-
-		return
-	}
-
-	if err != nil {
-		s.respondImageError(w, req, err)
-
-		return
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
 	// Set response headers
 	w.Header().Set("Content-Type", resp.ContentType)
-	setSVGContentSecurityPolicy(w.Header(), resp.ContentType)
 
 	if resp.ContentLength > 0 {
 		w.Header().Set("Content-Length", strconv.FormatInt(resp.ContentLength, 10))
 	}
 
 	// Cache control headers
-	w.Header().Set("Cache-Control", cacheControl(expires))
+	w.Header().Set("Cache-Control", cacheControl(req.Expires))
 	w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
 	if notModified(w, r, resp.ETag) {
@@ -467,31 +374,21 @@ func (s *Handlers) serveImage(
 	// Stream the response
 	w.WriteHeader(http.StatusOK)
 
-	// A failed write is most often a client that has gone away, not pixa's
-	// failure, so it is logged at warn level
 	servedBytes, err := io.Copy(w, resp.Content)
 	if err != nil {
-		s.log.Warn("failed to write response",
-			"request_id", middleware.GetReqID(r.Context()),
-			"host", req.Source.Host,
-			"path", req.Source.Path,
-			"served_bytes", servedBytes,
+		s.log.Error("failed to write response",
 			"error", err,
 		)
-
-		return
 	}
 
 	// Log cache status and timing after serving
 	duration := time.Since(startTime)
 	s.log.Info("image served",
 		"request_id", middleware.GetReqID(r.Context()),
-		"cache_key", imagerequest.CacheKey(req),
-		"host", req.Source.Host,
-		"path", req.Source.Path,
+		"cache_key", cacheKey,
 		"cache_status", resp.CacheStatus,
 		"duration_ms", duration.Milliseconds(),
-		"format", req.Transform.Format,
+		"format", req.Format,
 		"served_bytes", servedBytes,
 		"fetched_bytes", resp.FetchedBytes,
 	)

internal/handlers/image_cache_control_internal_test.go

@@ -12,16 +12,9 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/prometheus/client_golang/prometheus"
 
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // photoPath is the path of the JPEG that newSignedHostServer serves.
@@ -36,46 +29,37 @@ func newSignedHostServer(
 ) (*Handlers, http.Handler) {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
+	})
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
 	jpegData := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
 
-	svc, err := imageproxy.New(&imageproxy.Config{
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
 		Cache: cache,
 		Fetcher: newMockFetcher(fstest.MapFS{
 			signedHost + photoPath: &fstest.MapFile{Data: jpegData},
 		}),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-		Logger:          log,
-	}, prometheus.NewRegistry())
+		SigningKey: testSigningKey,
+		Logger:     log,
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
-		log:       log,
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New(nil),
+		log:    log,
+		imgSvc: svc,
+		encGen: encGen,
 	}
 
 	r := chi.NewRouter()
@@ -121,18 +105,17 @@ func getMaxAge(t *testing.T, srv http.Handler, target string) int {
 func TestHandleImage_SignedURL_MaxAgeEndsAtExp(t *testing.T) {
 	t.Parallel()
 
-	_, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	signedURL := generateSignedURL(testSigningKey, &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatJPEG,
-		},
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Size:       imgcache.Size{Width: 50, Height: 50},
+		Format:     imgcache.FormatJPEG,
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
 
 	maxAge := getMaxAge(t, srv, signedURL)
 	if maxAge < 50 || maxAge > 60 {
@@ -185,12 +168,12 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 
 	tests := []struct {
 		name        string
-		ttl         time.Duration
+		expiresAt   int64
 		wantAtLeast int
 		wantAtMost  int
 	}{
-		{"60 second TTL", time.Minute, 50, 60},
-		{"two-year TTL", 2 * 365 * 24 * time.Hour, 31536000, 31536000},
+		{"60 second TTL", time.Now().Add(time.Minute).Unix(), 50, 60},
+		{"two-year TTL", time.Now().Add(2 * 365 * 24 * time.Hour).Unix(), 31536000, 31536000},
 		{"no TTL", 0, 31536000, 31536000},
 	}
 
@@ -200,24 +183,14 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 
 			h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-			// The expiry is set here, not in the table: a parallel subtest
-			// can wait behind other tests for more than the 10 seconds the
-			// 60 second case allows.
-			var expires time.Time
-			if tt.ttl != 0 {
-				expires = time.Now().Add(tt.ttl)
-			}
-
-			token, err := h.encGen.Generate(&imagerequest.Request{
-				Source: imagerequest.Source{
-					Host: signedHost,
-					Path: photoPath,
-				},
-				Transform: imagerequest.Transform{
-					Size:   imagerequest.Size{Width: 50, Height: 50},
-					Format: imagerequest.FormatJPEG,
-				},
-			}, expires)
+			token, err := h.encGen.Generate(&encurl.Payload{
+				SourceHost: signedHost,
+				SourcePath: photoPath,
+				Width:      50,
+				Height:     50,
+				Format:     imgcache.FormatJPEG,
+				ExpiresAt:  tt.expiresAt,
+			})
 			if err != nil {
 				t.Fatalf("Generate() error = %v", err)
 			}

internal/handlers/image_errors_internal_test.go

@@ -1,30 +1,19 @@
 package handlers
 
 import (
-	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"image/color"
-	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"slices"
 	"strings"
-	"syscall"
 	"testing"
 	"testing/fstest"
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/signature"
 )
@@ -34,38 +23,29 @@ import (
 const allowlistedHost = "allowed.example.com"
 
 // newImageRoute returns the image route of a Handlers whose service fetches
-// with fetcher, and which checks signatures with testSigningKey.
+// with fetcher and checks signatures with testSigningKey.
 func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
 	t.Helper()
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
+	})
 	if err != nil {
 		t.Fatalf("failed to create cache: %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+	})
 	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
+		t.Fatalf("failed to create service: %v", err)
 	}
 
-	h := &Handlers{
-		imgSvc:    svc,
-		log:       slog.New(slog.DiscardHandler),
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
-	}
+	h := &Handlers{imgSvc: svc, log: slog.New(slog.DiscardHandler)}
 
 	r := chi.NewRouter()
 	r.Get("/v1/image/*", h.HandleImage())
@@ -74,7 +54,7 @@ func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
 }
 
 // newPhotoFetcher returns a mock fetcher that serves a JPEG at photoPath on
-// each of hosts, and answers any other source with an upstream error.
+// each of hosts, and answers any other URL with an upstream error.
 func newPhotoFetcher(t *testing.T, hosts ...string) *httpfetcher.MockFetcher {
 	t.Helper()
 
@@ -101,27 +81,19 @@ func photoURLWithSig(host, sig string, expires time.Time) string {
 	return fmt.Sprintf("%s?sig=%s&exp=%d", photoURL(host), sig, expires.Unix())
 }
 
-// photoRequest returns the image request of photoURL(host) at the default
-// quality and fit.
-func photoRequest(host string) *imagerequest.Request {
-	return &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: host,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-}
-
 // photoSignature returns the signature of photoURL(host) at the default
 // quality and fit, made with key and expiring at expires.
 func photoSignature(key, host string, expires time.Time) string {
-	return signature.New(key).Sign(photoRequest(host), expires)
+	return signature.New(key).Sign(&signature.Request{
+		SourceHost: host,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
+		Format:     string(imgcache.FormatJPEG),
+		Quality:    85,
+		FitMode:    string(imgcache.FitCover),
+		Expires:    expires,
+	})
 }
 
 // sendGet sends a GET for target to route and returns the response.
@@ -192,12 +164,7 @@ func TestHandleImage_ErrorAnswers(t *testing.T) {
 	photos := newPhotoFetcher(t,
 		signedHost, parentHost, siblingHost, subdomainHost, appendedHost)
 	// The real fetcher refuses localhost before any lookup or connection.
-	realFetcher := httpfetcher.New(&httpfetcher.Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
+	realFetcher := httpfetcher.New(httpfetcher.DefaultConfig())
 
 	exp := time.Now().Add(time.Hour)
 	expired := time.Now().Add(-time.Hour)
@@ -302,9 +269,10 @@ func TestHandleImage_AllowlistOrSignature(t *testing.T) {
 // host can be, and checks that each is refused with 400 naming the host as
 // decoded: allowlistedHost with a character after it that a URL host cannot
 // hold, percent-encoded, an IPv6 address without brackets, and brackets
-// around something that is not an IPv6 address. Later steps put the host
-// unparsed into the allowlist check, the cache key and the upstream URL, so
-// such a host is refused first.
+// around something that is not an IPv6 address. A "?" or "#" after
+// allowlistedHost would otherwise end the host when the source URL is read,
+// so the request would pass the allowlist and be fetched and cached under a
+// host that is not the one fetched.
 func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -375,27 +343,26 @@ func TestHandleImage_HostForms_Served(t *testing.T) {
 
 // TestHandleImage_HashInSourcePathOrQuery_Returns400 sends image URLs whose
 // source path or source query holds a "#", written as %23, and checks that
-// each is refused with 400, the one signed for that source path included.
-// A "#" starts a URL's fragment, so neither the source path nor the source
-// query may hold one.
+// each is refused with 400, the one signed for that source path included. The
+// source URL would otherwise end at the "#" when it is fetched, so each text
+// after it would fetch the image at photoPath and cache it under keys of its
+// own.
 func TestHandleImage_HashInSourcePathOrQuery_Returns400(t *testing.T) {
 	t.Parallel()
 
 	photos := newPhotoFetcher(t, allowlistedHost, signedHost)
 	exp := time.Now().Add(time.Hour)
 
-	sig := signature.New(testSigningKey).Sign(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath + "#x",
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}, exp)
+	sig := signature.New(testSigningKey).Sign(&signature.Request{
+		SourceHost: signedHost,
+		SourcePath: photoPath + "#x",
+		Width:      50,
+		Height:     50,
+		Format:     string(imgcache.FormatJPEG),
+		Quality:    85,
+		FitMode:    string(imgcache.FitCover),
+		Expires:    exp,
+	})
 
 	tests := []struct {
 		name   string
@@ -421,175 +388,3 @@ func TestHandleImage_HashInSourcePathOrQuery_Returns400(t *testing.T) {
 		})
 	}
 }
-
-// failingFetcher answers every fetch with its error.
-type failingFetcher struct {
-	err error
-}
-
-// Fetch returns f's error.
-func (f failingFetcher) Fetch(
-	context.Context, imagerequest.Source, string, string,
-) (*httpfetcher.FetchResult, error) {
-	return nil, f.err
-}
-
-// photoURLsByRoute returns, for each image route, the function that makes the
-// URL of the JPEG at photoPath on signedHost on that route.
-func photoURLsByRoute() map[string]func(*testing.T, *Handlers) string {
-	return map[string]func(*testing.T, *Handlers) string{
-		"/v1/image/": signedPhotoURL,
-		"/v1/e/":     encPhotoURL,
-	}
-}
-
-// TestImageRoutes_SameErrorAnswers checks that both image routes answer each
-// upstream fetch error below with the same status. They log it as "failed to
-// get image" at the same level: error for the 500 and warn for the others.
-// Each request gets routes of its own, so no request finds another's failed
-// fetch in the negative cache.
-func TestImageRoutes_SameErrorAnswers(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		err        error
-		wantStatus int
-		wantLevel  slog.Level
-	}{
-		{"blocked upstream address", httpfetcher.ErrSSRFBlocked,
-			http.StatusForbidden, slog.LevelWarn},
-		{"upstream error status",
-			fmt.Errorf("%w: status 404", httpfetcher.ErrUpstreamError),
-			http.StatusBadGateway, slog.LevelWarn},
-		{"upstream host with no address",
-			fmt.Errorf("%w: cdn.example.com", httpfetcher.ErrInvalidHost),
-			http.StatusBadGateway, slog.LevelWarn},
-		{"connection refused",
-			fmt.Errorf("%w: %w", httpfetcher.ErrUpstreamRequestFailed,
-				syscall.ECONNREFUSED),
-			http.StatusBadGateway, slog.LevelWarn},
-		{"no response headers within the fetch timeout",
-			httpfetcher.ErrUpstreamTimeout, http.StatusGatewayTimeout,
-			slog.LevelWarn},
-		{"no free upstream connection", httpfetcher.ErrTooManyConnections,
-			http.StatusServiceUnavailable, slog.LevelWarn},
-		{"Content-Type not a source format",
-			fmt.Errorf("%w: image/tiff", httpfetcher.ErrInvalidContentType),
-			http.StatusUnsupportedMediaType, slog.LevelWarn},
-		{"any other failure", io.ErrUnexpectedEOF,
-			http.StatusInternalServerError, slog.LevelError},
-	}
-
-	for _, tt := range tests {
-		for route, imageURL := range photoURLsByRoute() {
-			t.Run(route+" "+tt.name, func(t *testing.T) {
-				t.Parallel()
-
-				var logs bytes.Buffer
-
-				h, routes := newRoutesFetchingThrough(t,
-					failingFetcher{err: tt.err},
-					slog.New(slog.NewJSONHandler(&logs, nil)))
-
-				rec := sendGet(t, routes, imageURL(t, h))
-				if rec.Code != tt.wantStatus {
-					t.Errorf("status = %d, want %d: %s",
-						rec.Code, tt.wantStatus, rec.Body)
-				}
-
-				levels := loggedLevels(t, &logs)
-				if !slices.Contains(levels[tt.wantLevel.String()],
-					"failed to get image") {
-					t.Errorf(`no "failed to get image" line logged at level %s`,
-						tt.wantLevel)
-				}
-
-				if tt.wantLevel != slog.LevelError &&
-					len(levels[slog.LevelError.String()]) != 0 {
-					t.Errorf("logged at error level: %q",
-						levels[slog.LevelError.String()])
-				}
-			})
-		}
-	}
-}
-
-// failingResponseWriter is a response writer whose Write always fails, as when
-// the client has gone away.
-type failingResponseWriter struct {
-	*httptest.ResponseRecorder
-}
-
-// Write writes nothing and returns io.ErrClosedPipe.
-func (failingResponseWriter) Write([]byte) (int, error) {
-	return 0, io.ErrClosedPipe
-}
-
-// TestImageRoutes_FailedWriteLoggedOnce checks that both image routes log a
-// failed write of the image once, at warn level, with the request's ID, the
-// source host and path, the bytes served and the error. Neither may also log
-// the image as served.
-func TestImageRoutes_FailedWriteLoggedOnce(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	for route, imageURL := range photoURLsByRoute() {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, srv := newSignedHostServer(t,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			ctx := context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID)
-			srv.ServeHTTP(failingResponseWriter{httptest.NewRecorder()},
-				httptest.NewRequestWithContext(
-					ctx, http.MethodGet, imageURL(t, h), nil))
-
-			t.Logf("logged:\n%s", logs.String())
-
-			var failedWrites []map[string]any
-
-			dec := json.NewDecoder(&logs)
-			for dec.More() {
-				var line map[string]any
-
-				err := dec.Decode(&line)
-				if err != nil {
-					t.Fatalf("decoding log line: %v", err)
-				}
-
-				switch line["msg"] {
-				case "image served":
-					t.Error(`"image served" logged after a failed write`)
-				case "failed to write response":
-					failedWrites = append(failedWrites, line)
-				}
-			}
-
-			if len(failedWrites) != 1 {
-				t.Fatalf(`"failed to write response" logged %d times, want 1`,
-					len(failedWrites))
-			}
-
-			want := map[string]any{
-				"level":        slog.LevelWarn.String(),
-				"request_id":   requestID,
-				"host":         signedHost,
-				"path":         photoPath,
-				"served_bytes": float64(0),
-				"error":        io.ErrClosedPipe.Error(),
-			}
-
-			for key, wantValue := range want {
-				if got := failedWrites[0][key]; got != wantValue {
-					t.Errorf("%s = %v, want %v", key, got, wantValue)
-				}
-			}
-		})
-	}
-}

internal/handlers/image_signature_internal_test.go

@@ -5,12 +5,11 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"testing"
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/signature"
 )
 
@@ -37,47 +36,6 @@ func getImage(t *testing.T, fix *testFixtures, target string) int {
 	return rec.Code
 }
 
-// generateSignedURL returns the /v1/image/ URL of req, signed with key and
-// expiring after ttl. It signs a copy of req, so req itself is not changed.
-// An unset quality or fit in the copy is set to 85 or cover, the values the
-// route uses when a URL has no q or fit. The URL carries q and fit next to sig
-// and exp, so the route verifies it for the quality and fit it was signed
-// with.
-func generateSignedURL(
-	key string, req *imagerequest.Request, ttl time.Duration,
-) string {
-	signed := *req
-
-	if signed.Transform.Quality == 0 {
-		signed.Transform.Quality = 85
-	}
-
-	if signed.Transform.FitMode == "" {
-		signed.Transform.FitMode = imagerequest.FitCover
-	}
-
-	expires := time.Now().Add(ttl)
-	sig := signature.New(key).Sign(&signed, expires)
-
-	// A source query follows the source path after a "?". The image route
-	// reads the path decoded once, so the whole path is written in Go's own
-	// percent-encoding of a URL path, which writes "?" as %3F and "%" as %25,
-	// and leaves "/", ";", ",", "=" and "&" as they are.
-	sourcePathAndQuery := signed.Source.Path
-	if signed.Source.Query != "" {
-		sourcePathAndQuery += "?" + signed.Source.Query
-	}
-
-	unescapedPath := fmt.Sprintf("/v1/image/%s%s/%dx%d.%s",
-		signed.Source.Host, sourcePathAndQuery,
-		signed.Transform.Size.Width, signed.Transform.Size.Height,
-		signed.Transform.Format)
-
-	return fmt.Sprintf("%s?sig=%s&exp=%d&q=%d&fit=%s",
-		(&url.URL{Path: unescapedPath}).EscapedPath(), sig, expires.Unix(),
-		signed.Transform.Quality, signed.Transform.FitMode)
-}
-
 // TestHandleImage_SignatureCoversQualityAndFit signs a URL for quality 85
 // and fit cover, the values the route uses when a URL has no q or fit, and
 // sends that signature with each q and fit below.
@@ -86,18 +44,16 @@ func TestHandleImage_SignatureCoversQualityAndFit(t *testing.T) {
 
 	expires := time.Now().Add(time.Hour)
 	signer := signature.New("test-signing-key-must-be-32-chars")
-	sig := signer.Sign(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: "/images/photo.jpg",
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}, expires)
+	sig := signer.Sign(&signature.Request{
+		SourceHost: signedHost,
+		SourcePath: "/images/photo.jpg",
+		Width:      50,
+		Height:     50,
+		Format:     string(imgcache.FormatJPEG),
+		Quality:    85,
+		FitMode:    string(imgcache.FitCover),
+		Expires:    expires,
+	})
 	signedURL := fmt.Sprintf("/v1/image/%s/images/photo.jpg/50x50.jpeg?sig=%s&exp=%d",
 		signedHost, sig, expires.Unix())
 
@@ -124,17 +80,17 @@ func TestHandleImage_SignatureCoversQualityAndFit(t *testing.T) {
 	}
 }
 
-// TestHandleImage_GeneratedSignedURLVerifies sends URLs built by
-// generateSignedURL to the route.
+// TestHandleImage_GeneratedSignedURLVerifies sends URLs built by the
+// service's signed-URL generator to the route.
 func TestHandleImage_GeneratedSignedURLVerifies(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
 		name    string
 		quality int
-		fitMode imagerequest.Fit
+		fitMode imgcache.FitMode
 	}{
-		{"quality 40 and fit contain", 40, imagerequest.FitContain},
+		{"quality 40 and fit contain", 40, imgcache.FitContain},
 		{"quality and fit unset", 0, ""},
 	}
 
@@ -142,21 +98,21 @@ func TestHandleImage_GeneratedSignedURLVerifies(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host: signedHost,
-						Path: "/images/photo.jpg",
-					},
-					Transform: imagerequest.Transform{
-						Size:    imagerequest.Size{Width: 50, Height: 50},
-						Format:  imagerequest.FormatJPEG,
-						Quality: tt.quality,
-						FitMode: tt.fitMode,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imgcache.ImageRequest{
+				SourceHost: signedHost,
+				SourcePath: "/images/photo.jpg",
+				Size:       imgcache.Size{Width: 50, Height: 50},
+				Format:     imgcache.FormatJPEG,
+				Quality:    tt.quality,
+				FitMode:    tt.fitMode,
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}
@@ -215,10 +171,10 @@ func TestHandleImage_InvalidExp_Returns400(t *testing.T) {
 }
 
 // TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies sends URLs built
-// by generateSignedURL for source URLs with a query to the route, through a
-// chi router: chi routes on the path as the client wrote it whenever that is
-// not Go's own encoding of it. A 502 means the signature passed, so the route
-// read the source path and query that were signed.
+// by the service's signed-URL generator for source URLs with a query to the
+// route, through a chi router: chi routes on the path as the client wrote it
+// whenever that is not Go's own encoding of it. A 502 means the signature
+// passed, so the route read the source path and query that were signed.
 func TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies(t *testing.T) {
 	t.Parallel()
 
@@ -238,20 +194,20 @@ func TestHandleImage_GeneratedSignedURLWithSourceQueryVerifies(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host:  signedHost,
-						Path:  photoPath,
-						Query: tt.query,
-					},
-					Transform: imagerequest.Transform{
-						Size:   imagerequest.Size{Width: 50, Height: 50},
-						Format: imagerequest.FormatJPEG,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imgcache.ImageRequest{
+				SourceHost:  signedHost,
+				SourcePath:  photoPath,
+				SourceQuery: tt.query,
+				Size:        imgcache.Size{Width: 50, Height: 50},
+				Format:      imgcache.FormatJPEG,
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}
@@ -268,19 +224,17 @@ func TestHandleImage_SourceQueryEncodedAnyWay(t *testing.T) {
 
 	expires := time.Now().Add(time.Hour)
 	signer := signature.New("test-signing-key-must-be-32-chars")
-	sig := signer.Sign(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host:  signedHost,
-			Path:  photoPath,
-			Query: "url=https://origin.example.com/my%20cat.jpg",
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}, expires)
+	sig := signer.Sign(&signature.Request{
+		SourceHost:  signedHost,
+		SourcePath:  photoPath,
+		SourceQuery: "url=https://origin.example.com/my%20cat.jpg",
+		Width:       50,
+		Height:      50,
+		Format:      string(imgcache.FormatJPEG),
+		Quality:     85,
+		FitMode:     string(imgcache.FitCover),
+		Expires:     expires,
+	})
 
 	tests := []struct {
 		name         string
@@ -312,7 +266,7 @@ func TestHandleImage_SourceQueryEncodedAnyWay(t *testing.T) {
 // TestHandleImage_SourceURLHoldingPercent25Verifies signs a source path and a
 // source query that each hold %25, the percent-escape of a literal "%", and
 // sends each to the route written as the README says, with that "%" written as
-// %25, and as generateSignedURL writes it. A 502 means the signature passed.
+// %25, and as GenerateSignedURL writes it. A 502 means the signature passed.
 func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 	t.Parallel()
 
@@ -334,19 +288,17 @@ func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 
 			expires := time.Now().Add(time.Hour)
 			signer := signature.New("test-signing-key-must-be-32-chars")
-			sig := signer.Sign(&imagerequest.Request{
-				Source: imagerequest.Source{
-					Host:  signedHost,
-					Path:  tt.sourcePath,
-					Query: tt.sourceQuery,
-				},
-				Transform: imagerequest.Transform{
-					Size:    imagerequest.Size{Width: 50, Height: 50},
-					Format:  imagerequest.FormatJPEG,
-					Quality: 85,
-					FitMode: imagerequest.FitCover,
-				},
-			}, expires)
+			sig := signer.Sign(&signature.Request{
+				SourceHost:  signedHost,
+				SourcePath:  tt.sourcePath,
+				SourceQuery: tt.sourceQuery,
+				Width:       50,
+				Height:      50,
+				Format:      string(imgcache.FormatJPEG),
+				Quality:     85,
+				FitMode:     string(imgcache.FitCover),
+				Expires:     expires,
+			})
 
 			target := fmt.Sprintf("/v1/image/%s%s/50x50.jpeg?sig=%s&exp=%d",
 				signedHost, tt.writtenPathAndQuery, sig, expires.Unix())
@@ -357,23 +309,23 @@ func TestHandleImage_SourceURLHoldingPercent25Verifies(t *testing.T) {
 			}
 		})
 
-		t.Run(tt.name+" written by generateSignedURL", func(t *testing.T) {
+		t.Run(tt.name+" written by GenerateSignedURL", func(t *testing.T) {
 			t.Parallel()
 
-			signedURL := generateSignedURL("test-signing-key-must-be-32-chars",
-				&imagerequest.Request{
-					Source: imagerequest.Source{
-						Host:  signedHost,
-						Path:  tt.sourcePath,
-						Query: tt.sourceQuery,
-					},
-					Transform: imagerequest.Transform{
-						Size:   imagerequest.Size{Width: 50, Height: 50},
-						Format: imagerequest.FormatJPEG,
-					},
-				}, time.Hour)
+			fix := setupTestHandler(t)
 
-			status := getImage(t, setupTestHandler(t), signedURL)
+			signedURL, err := fix.service.GenerateSignedURL("", &imgcache.ImageRequest{
+				SourceHost:  signedHost,
+				SourcePath:  tt.sourcePath,
+				SourceQuery: tt.sourceQuery,
+				Size:        imgcache.Size{Width: 50, Height: 50},
+				Format:      imgcache.FormatJPEG,
+			}, time.Hour)
+			if err != nil {
+				t.Fatalf("GenerateSignedURL() error = %v", err)
+			}
+
+			status := getImage(t, fix, signedURL)
 			if status != http.StatusBadGateway {
 				t.Errorf("status = %d, want %d", status, http.StatusBadGateway)
 			}

internal/handlers/imageenc.go

@@ -2,13 +2,20 @@ package handlers
 
 import (
 	"errors"
+	"fmt"
+	"io"
 	"net/http"
+	"strconv"
 	"time"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/httpfetcher"
+	"sneak.berlin/go/pixa/internal/imageprocessor"
+	"sneak.berlin/go/pixa/internal/imgcache"
+	"sneak.berlin/go/pixa/internal/magic"
 )
 
 // HandleImageEnc handles requests to /v1/e/{token}/* for encrypted
@@ -20,59 +27,159 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 			return
 		}
 
-		req, expires, ok := s.parseImageEncRequest(w, r)
-		if !ok {
+		ctx := r.Context()
+		start := time.Now()
+
+		req, ok := s.parseImageEncRequest(w, r)
+		if !ok || !s.chooseAutoFormat(w, r, req) {
 			return
 		}
 
-		s.serveImage(w, r, req, expires)
+		// Log the request
+		s.log.Debug("encrypted image request",
+			"host", req.SourceHost,
+			"path", req.SourcePath,
+			"dimensions", fmt.Sprintf("%dx%d", req.Size.Width, req.Size.Height),
+			"format", req.Format,
+		)
+
+		// Fetch and process the image (no signature validation
+		// needed - encrypted URL is trusted)
+		resp, err := s.imgSvc.Get(ctx, req)
+		if err != nil {
+			s.handleImageError(w, err)
+
+			return
+		}
+
+		defer func() { _ = resp.Content.Close() }()
+
+		// Set response headers
+		w.Header().Set("Content-Type", resp.ContentType)
+
+		if resp.ContentLength > 0 {
+			w.Header().Set("Content-Length", strconv.FormatInt(resp.ContentLength, 10))
+		}
+
+		// Cache headers: max-age ends at the URL's expiry
+		w.Header().Set("Cache-Control", cacheControl(req.Expires))
+		w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
+
+		if notModified(w, r, resp.ETag) {
+			return
+		}
+
+		// A HEAD request gets the headers only
+		if r.Method == http.MethodHead {
+			w.WriteHeader(http.StatusOK)
+
+			return
+		}
+
+		// Stream the response
+		written, err := io.Copy(w, resp.Content)
+		if err != nil {
+			s.log.Error("failed to write response", "error", err)
+
+			return
+		}
+
+		// Log completion
+		duration := time.Since(start)
+		s.log.Info("image served",
+			"request_id", middleware.GetReqID(ctx),
+			"cache_key", imgcache.CacheKey(req),
+			"host", req.SourceHost,
+			"path", req.SourcePath,
+			"format", req.Format,
+			"cache_status", resp.CacheStatus,
+			"served_bytes", written,
+			"duration_ms", duration.Milliseconds(),
+		)
 	}
 }
 
 // parseImageEncRequest decrypts the token of an encrypted image URL into an
-// image request and checks it, and returns it with the token's expiry. On a
-// token that is missing, does not decrypt, has expired or asks for something
-// not valid, it writes an error response and returns false.
+// ImageRequest and checks it. On a token that is missing, does not decrypt,
+// has expired or asks for something not valid, it writes an error response
+// and returns false.
 func (s *Handlers) parseImageEncRequest(
 	w http.ResponseWriter, r *http.Request,
-) (*imagerequest.Request, time.Time, bool) {
+) (*imgcache.ImageRequest, bool) {
 	// Extract token from URL
 	token := chi.URLParam(r, "token")
 	if token == "" {
 		s.respondError(w, "missing token", http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
 	// Decrypt and validate the payload
-	req, expires, err := s.encGen.Parse(token)
+	payload, err := s.encGen.Parse(token)
 	if err != nil {
 		if errors.Is(err, encurl.ErrExpired) {
 			s.log.Debug("encrypted URL expired", "error", err)
 			s.respondError(w, "URL has expired", http.StatusGone)
 
-			return nil, time.Time{}, false
+			return nil, false
 		}
 
-		s.log.Debug("invalid encrypted URL", "error", err)
+		s.log.Debug("failed to decrypt URL", "error", err)
 		s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
+	// Convert payload to ImageRequest
+	req := payload.ToImageRequest()
+
 	// Apply the same dimension and fit-mode bounds as the plain image
 	// route: a sealed payload is trusted for its origin, not for staying
-	// within limits. This refuses an over-limit size before the source is
-	// fetched. An unknown fit mode is a 400 here rather than a 500 from the
-	// processor.
-	err = imagerequest.ValidateImageRequest(req)
+	// within limits, so an over-limit size or unknown fit mode is a 400
+	// here rather than an out-of-memory or a 500 from the processor.
+	err = imgcache.ValidateImageRequest(req)
 	if err != nil {
 		s.log.Debug("encrypted URL failed validation", "error", err)
 		s.respondError(w, "invalid encrypted URL: "+err.Error(),
 			http.StatusBadRequest)
 
-		return nil, time.Time{}, false
+		return nil, false
 	}
 
-	return req, expires, true
+	return req, true
+}
+
+// handleImageError converts image service errors to HTTP responses.
+func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, httpfetcher.ErrSSRFBlocked):
+		s.respondError(w, "forbidden", http.StatusForbidden)
+	case errors.Is(err, httpfetcher.ErrUpstreamError):
+		s.respondError(w, "upstream error", http.StatusBadGateway)
+	case errors.Is(err, httpfetcher.ErrUpstreamTimeout):
+		s.respondError(w, "upstream timeout", http.StatusGatewayTimeout)
+	case errors.Is(err, httpfetcher.ErrTooManyConnections),
+		errors.Is(err, imageprocessor.ErrTooManyImages),
+		errors.Is(err, imgcache.ErrProcessingTimedOut):
+		s.respondError(w, "server busy, try again later",
+			http.StatusServiceUnavailable)
+	case errors.Is(err, httpfetcher.ErrInvalidContentType),
+		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat),
+		errors.Is(err, magic.ErrMagicByteMismatch),
+		errors.Is(err, magic.ErrUnknownFormat),
+		errors.Is(err, magic.ErrNotEnoughData):
+		s.respondError(w, "unsupported source format",
+			http.StatusUnsupportedMediaType)
+	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+	case errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
+			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
+			http.StatusBadRequest)
+	default:
+		s.log.Error("image request failed", "error", err)
+		s.respondError(w, "internal error", http.StatusInternalServerError)
+	}
 }

internal/handlers/imageenc_internal_test.go

@@ -6,13 +6,11 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
-	"time"
 
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // newEncTestServer builds a router serving the encrypted-URL route with a
@@ -22,13 +20,11 @@ import (
 func newEncTestServer(t *testing.T) (*encurl.Generator, http.Handler) {
 	t.Helper()
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
 		log:    slog.New(slog.DiscardHandler),
 		encGen: encGen,
@@ -58,15 +54,12 @@ func TestHandleImageEnc_OverLimitDimension_Returns400(t *testing.T) {
 
 	encGen, srv := newEncTestServer(t)
 
-	token, err := encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: "cdn.example.com",
-			Path: "/photo.jpg",
-		},
-		Transform: imagerequest.Transform{
-			Size: imagerequest.Size{Width: 100000, Height: 100000},
-		},
-	}, time.Time{})
+	token, err := encGen.Generate(&encurl.Payload{
+		SourceHost: "cdn.example.com",
+		SourcePath: "/photo.jpg",
+		Width:      100000,
+		Height:     100000,
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
@@ -86,16 +79,13 @@ func TestHandleImageEnc_InvalidFitMode_Returns400(t *testing.T) {
 
 	encGen, srv := newEncTestServer(t)
 
-	token, err := encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: "cdn.example.com",
-			Path: "/photo.jpg",
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 800, Height: 600},
-			FitMode: imagerequest.Fit("bogus"),
-		},
-	}, time.Time{})
+	token, err := encGen.Generate(&encurl.Payload{
+		SourceHost: "cdn.example.com",
+		SourcePath: "/photo.jpg",
+		Width:      800,
+		Height:     600,
+		FitMode:    imgcache.FitMode("bogus"),
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/imageenc_token_internal_test.go

@@ -9,8 +9,6 @@ import (
 	"time"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/seal"
 )
 
 // requireServedPhoto requires that rec answers 200 with the JPEG at photoPath
@@ -61,34 +59,32 @@ func TestHandleImageEnc_RejectedToken(t *testing.T) {
 
 	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	photo := imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size: imagerequest.Size{Width: 50, Height: 50},
-		},
+	photo := encurl.Payload{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
 	}
 
-	valid, err := h.encGen.Generate(&photo, time.Time{})
+	valid, err := h.encGen.Generate(&photo)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	expired, err := h.encGen.Generate(&photo, time.Now().Add(-time.Minute))
+	expiredPhoto := photo
+	expiredPhoto.ExpiresAt = time.Now().Add(-time.Minute).Unix()
+
+	expired, err := h.encGen.Generate(&expiredPhoto)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys("another-signing-key-fedcba9876543210")
+	otherGen, err := encurl.NewGenerator("another-signing-key-fedcba9876543210")
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	otherGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
-	otherKey, err := otherGen.Generate(&photo, time.Time{})
+	otherKey, err := otherGen.Generate(&photo)
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/jpegxl_default_internal_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/davidbyttow/govips/v2/vips"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/signature"
 )
 
@@ -58,18 +58,16 @@ func TestImageWithoutFormat_SignedAsJXL(t *testing.T) {
 	route := newImageRoute(t, newPhotoFetcher(t, signedHost))
 	expires := time.Now().Add(time.Hour)
 
-	sig := signature.New(testSigningKey).Sign(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJXL,
-			Quality: encurl.DefaultQuality,
-			FitMode: imagerequest.FitCover,
-		},
-	}, expires)
+	sig := signature.New(testSigningKey).Sign(&signature.Request{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
+		Format:     string(imgcache.FormatJXL),
+		Quality:    encurl.DefaultQuality,
+		FitMode:    string(imgcache.FitCover),
+		Expires:    expires,
+	})
 	query := fmt.Sprintf("?sig=%s&exp=%d", sig, expires.Unix())
 
 	for _, size := range []string{"50x50.jxl", "50x50"} {
@@ -85,15 +83,12 @@ func TestImageEncWithoutFormat_ServesJPEGXL(t *testing.T) {
 
 	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
 
-	token, err := h.encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size: imagerequest.Size{Width: 50, Height: 50},
-		},
-	}, time.Time{})
+	token, err := h.encGen.Generate(&encurl.Payload{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/jpegxl_internal_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/davidbyttow/govips/v2/vips"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // jxlType is the content type of JPEG XL.
@@ -22,14 +22,14 @@ func TestFormatForAccept_JPEGXL(t *testing.T) {
 	tests := []struct {
 		name   string
 		accept string
-		want   imagerequest.Format
+		want   imgcache.ImageFormat
 	}{
 		{"JPEG XL-capable browser",
-			"image/jxl,image/avif,image/webp,image/*,*/*;q=0.8", imagerequest.FormatJXL},
-		{"JPEG XL only", jxlType, imagerequest.FormatJXL},
+			"image/jxl,image/avif,image/webp,image/*,*/*;q=0.8", imgcache.FormatJXL},
+		{"JPEG XL only", jxlType, imgcache.FormatJXL},
 		{"JPEG XL with a lower q than AVIF", "image/avif,image/jxl;q=0.5",
-			imagerequest.FormatJXL},
-		{"q=0 on JPEG XL", "image/jxl;q=0,image/avif,*/*", imagerequest.FormatAVIF},
+			imgcache.FormatJXL},
+		{"q=0 on JPEG XL", "image/jxl;q=0,image/avif,*/*", imgcache.FormatAVIF},
 	}
 
 	for _, tt := range tests {

internal/handlers/referer_blocklist_internal_test.go

@@ -10,16 +10,10 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/prometheus/client_golang/prometheus"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/seal"
-	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // blockedReferer is a page on leech.example, which newRefererRoutes puts on
@@ -35,12 +29,11 @@ type countingFetcher struct {
 
 // Fetch counts the fetch and passes it on.
 func (f *countingFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
-	ifNoneMatch, ifModifiedSince string,
+	ctx context.Context, url string,
 ) (*httpfetcher.FetchResult, error) {
 	f.fetches.Add(1)
 
-	return f.Fetcher.Fetch(ctx, source, ifNoneMatch, ifModifiedSince)
+	return f.Fetcher.Fetch(ctx, url)
 }
 
 // newRefererRoutes returns both image routes of a Handlers whose
@@ -54,41 +47,33 @@ func newRefererRoutes(t *testing.T) (http.Handler, *Handlers, *countingFetcher)
 		Fetcher: newPhotoFetcher(t, allowlistedHost, signedHost),
 	}
 
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.Config{
+	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
 		StateDir:    t.TempDir(),
 		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, prometheus.NewRegistry())
+	})
 	if err != nil {
 		t.Fatalf("imgcache.NewCache() error = %v", err)
 	}
 
-	svc, err := imageproxy.New(&imageproxy.Config{
-		Cache:   cache,
-		Fetcher: fetcher,
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, prometheus.NewRegistry())
+	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
+		Cache:      cache,
+		Fetcher:    fetcher,
+		SigningKey: testSigningKey,
+		Allowlist:  []string{allowlistedHost},
+	})
 	if err != nil {
-		t.Fatalf("imageproxy.New() error = %v", err)
+		t.Fatalf("imgcache.NewService() error = %v", err)
 	}
 
-	keys, err := seal.DeriveKeys(testSigningKey)
+	encGen, err := encurl.NewGenerator(testSigningKey)
 	if err != nil {
-		t.Fatalf("seal.DeriveKeys() error = %v", err)
+		t.Fatalf("encurl.NewGenerator() error = %v", err)
 	}
 
-	encGen := encurl.NewGenerator(keys.EncryptedURLKey)
-
 	h := &Handlers{
-		log:       slog.New(slog.DiscardHandler),
-		imgSvc:    svc,
-		encGen:    encGen,
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New([]string{allowlistedHost}),
+		log:    slog.New(slog.DiscardHandler),
+		imgSvc: svc,
+		encGen: encGen,
 		refererBlocklist: allowlist.New(
 			[]string{"leech.example", ".hotlinker.example"}),
 	}

internal/handlers/request_id_internal_test.go

@@ -13,26 +13,26 @@ import (
 
 	"github.com/go-chi/chi/v5/middleware"
 
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/encurl"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
 // signedPhotoURL returns a signed /v1/image/ URL, valid for a minute, for the
-// JPEG at photoPath on signedHost at 50x50. It is signed with testSigningKey,
-// the key the handlers that newSignedHostServer builds check signatures with.
-// It takes a Handlers it does not use, so that it has the type of encPhotoURL.
-func signedPhotoURL(t *testing.T, _ *Handlers) string {
+// JPEG at photoPath on signedHost at 50x50, made with h's image service.
+func signedPhotoURL(t *testing.T, h *Handlers) string {
 	t.Helper()
 
-	return generateSignedURL(testSigningKey, &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatJPEG,
-		},
+	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Size:       imgcache.Size{Width: 50, Height: 50},
+		Format:     imgcache.FormatJPEG,
 	}, time.Minute)
+	if err != nil {
+		t.Fatalf("GenerateSignedURL() error = %v", err)
+	}
+
+	return signedURL
 }
 
 // encPhotoURL returns an encrypted /v1/e/ URL, which never expires, for the
@@ -40,16 +40,13 @@ func signedPhotoURL(t *testing.T, _ *Handlers) string {
 func encPhotoURL(t *testing.T, h *Handlers) string {
 	t.Helper()
 
-	token, err := h.encGen.Generate(&imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: signedHost,
-			Path: photoPath,
-		},
-		Transform: imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 50, Height: 50},
-			Format: imagerequest.FormatJPEG,
-		},
-	}, time.Time{})
+	token, err := h.encGen.Generate(&encurl.Payload{
+		SourceHost: signedHost,
+		SourcePath: photoPath,
+		Width:      50,
+		Height:     50,
+		Format:     imgcache.FormatJPEG,
+	})
 	if err != nil {
 		t.Fatalf("Generate() error = %v", err)
 	}

internal/handlers/server_busy_internal_test.go

@@ -11,64 +11,77 @@ import (
 
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imageproxy"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// TestServerBusyAnswers503 checks that respondImageError, which answers the
-// errors of both image routes, answers 503 with a clear error when the image
-// service gives up waiting for a free upstream connection or processing slot,
-// wrapped as the service wraps them.
+// TestServerBusyAnswers503 checks that both image routes answer 503 with
+// a clear error when the image service gives up waiting for a free upstream
+// connection or processing slot, wrapped as the service wraps them.
 func TestServerBusyAnswers503(t *testing.T) {
 	t.Parallel()
 
 	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{Host: "img.example.com", Path: "/a.jpg"},
-	}
+	req := &imgcache.ImageRequest{SourceHost: "img.example.com", SourcePath: "/a.jpg"}
 
 	for _, err := range []error{
 		fmt.Errorf("upstream fetch failed: %w", httpfetcher.ErrTooManyConnections),
 		fmt.Errorf("image processing failed: %w", imageprocessor.ErrTooManyImages),
 	} {
-		rec := httptest.NewRecorder()
-		h.respondImageError(rec, req, err)
+		plain := httptest.NewRecorder()
+		h.respondImageError(plain, req, err)
 
-		if rec.Code != http.StatusServiceUnavailable {
-			t.Errorf("for %v: status = %d, want %d",
-				err, rec.Code, http.StatusServiceUnavailable)
-		}
+		encrypted := httptest.NewRecorder()
+		h.handleImageError(encrypted, err)
 
-		if !strings.Contains(rec.Body.String(), "server busy, try again later") {
-			t.Errorf("for %v: body = %q, want the server busy error",
-				err, rec.Body.String())
+		for route, rec := range map[string]*httptest.ResponseRecorder{
+			"/v1/image/": plain, "/v1/e/": encrypted,
+		} {
+			if rec.Code != http.StatusServiceUnavailable {
+				t.Errorf("%s for %v: status = %d, want %d",
+					route, err, rec.Code, http.StatusServiceUnavailable)
+			}
+
+			if !strings.Contains(rec.Body.String(), "server busy, try again later") {
+				t.Errorf("%s for %v: body = %q, want the server busy error",
+					route, err, rec.Body.String())
+			}
 		}
 	}
 }
 
-// TestProcessingTimedOutAnswers503 checks that respondImageError, which
-// answers the errors of both image routes, answers 503 with the server busy
-// error when the image service reports that processing stopped at the
-// deadline of the request doing it, wrapped as the service wraps it. A request
-// that waited for that processing gets this error while its own deadline may
-// have time left. The request's source only goes into a log line, so it is
-// left empty.
+// TestProcessingTimedOutAnswers503 checks that respondImageError and
+// handleImageError, which answer the errors of the two image routes, answer
+// 503 with the server busy error when the image service reports that
+// processing stopped at the deadline of the request doing it, wrapped as the
+// service wraps it. A request that waited for that processing gets this error
+// while its own deadline may have time left. The request's source only goes
+// into a log line, so it is left empty.
 func TestProcessingTimedOutAnswers503(t *testing.T) {
 	t.Parallel()
 
 	h := &Handlers{log: slog.New(slog.DiscardHandler)}
 	err := fmt.Errorf("%w: failed to encode: %w",
-		imageproxy.ErrProcessingTimedOut, context.DeadlineExceeded)
+		imgcache.ErrProcessingTimedOut, context.DeadlineExceeded)
 
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("status = %d, body = %q", rec.Code, rec.Body.String())
+	plain := httptest.NewRecorder()
+	h.respondImageError(plain, &imgcache.ImageRequest{}, err)
 
-	if rec.Code != http.StatusServiceUnavailable {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusServiceUnavailable)
-	}
+	encrypted := httptest.NewRecorder()
+	h.handleImageError(encrypted, err)
 
-	if !strings.Contains(rec.Body.String(), "server busy, try again later") {
-		t.Errorf("body = %q, want the server busy error", rec.Body.String())
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"respondImageError": plain, "handleImageError": encrypted,
+	} {
+		t.Logf("%s: status = %d, body = %q", name, rec.Code, rec.Body.String())
+
+		if rec.Code != http.StatusServiceUnavailable {
+			t.Errorf("%s: status = %d, want %d",
+				name, rec.Code, http.StatusServiceUnavailable)
+		}
+
+		if !strings.Contains(rec.Body.String(), "server busy, try again later") {
+			t.Errorf("%s: body = %q, want the server busy error",
+				name, rec.Body.String())
+		}
 	}
 }

internal/handlers/unsupported_source_internal_test.go

@@ -10,104 +10,45 @@ import (
 
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// TestUnsupportedSourceFormatAnswers415 checks that respondImageError, which
-// answers the errors of both image routes, answers 415 with a clear error when
-// the upstream answers with a content type pixa does not accept, such as TIFF,
-// and when libvips does not read a source as the format its first bytes
-// show, wrapped as the service wraps them.
+// TestUnsupportedSourceFormatAnswers415 checks that both image routes answer
+// 415 with a clear error when the upstream answers with a content type pixa
+// does not accept, such as SVG, and when orig is asked of a source in a
+// format the processor cannot name, wrapped as the service wraps them.
 func TestUnsupportedSourceFormatAnswers415(t *testing.T) {
 	t.Parallel()
 
 	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{Host: "img.example.com", Path: "/a.tiff"},
-	}
+	req := &imgcache.ImageRequest{SourceHost: "img.example.com", SourcePath: "/a.svg"}
 
 	for _, err := range []error{
-		fmt.Errorf("upstream fetch failed: %w: image/tiff",
+		fmt.Errorf("upstream fetch failed: %w: image/svg+xml",
 			httpfetcher.ErrInvalidContentType),
-		fmt.Errorf("image processing failed: %w: libvips does not read the input as avif",
+		fmt.Errorf("image processing failed: %w: unknown",
 			imageprocessor.ErrUnsupportedInputFormat),
 	} {
-		rec := httptest.NewRecorder()
-		h.respondImageError(rec, req, err)
-		t.Logf("for %v: %d %s", err, rec.Code, rec.Body.String())
+		plain := httptest.NewRecorder()
+		h.respondImageError(plain, req, err)
 
-		if rec.Code != http.StatusUnsupportedMediaType {
-			t.Errorf("for %v: status = %d, want %d",
-				err, rec.Code, http.StatusUnsupportedMediaType)
-		}
+		encrypted := httptest.NewRecorder()
+		h.handleImageError(encrypted, err)
 
-		if !strings.Contains(rec.Body.String(), "unsupported source format") {
-			t.Errorf("for %v: body = %q, want the unsupported source format error",
-				err, rec.Body.String())
+		for route, rec := range map[string]*httptest.ResponseRecorder{
+			"HandleImage": plain, "HandleImageEnc": encrypted,
+		} {
+			t.Logf("%s for %v: %d %s", route, err, rec.Code, rec.Body.String())
+
+			if rec.Code != http.StatusUnsupportedMediaType {
+				t.Errorf("%s for %v: status = %d, want %d",
+					route, err, rec.Code, http.StatusUnsupportedMediaType)
+			}
+
+			if !strings.Contains(rec.Body.String(), "unsupported source format") {
+				t.Errorf("%s for %v: body = %q, want the unsupported source format error",
+					route, err, rec.Body.String())
+			}
 		}
 	}
 }
-
-// TestSVGTooThinAnswers415 checks that respondImageError answers 415 with a
-// clear error for an SVG source too thin to render, wrapped as the service
-// wraps it.
-func TestSVGTooThinAnswers415(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{Host: "svg.example.com", Path: "/a.svg"},
-	}
-	err := fmt.Errorf("image processing failed: %w: 81930x10",
-		imageprocessor.ErrSVGTooThin)
-
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, req, err)
-	t.Logf("for %v: %d %s", err, rec.Code, rec.Body.String())
-
-	if rec.Code != http.StatusUnsupportedMediaType {
-		t.Errorf("status = %d, want %d", rec.Code,
-			http.StatusUnsupportedMediaType)
-	}
-
-	if !strings.Contains(rec.Body.String(), "SVG source too thin to render") {
-		t.Errorf("body = %q, want the SVG too thin error", rec.Body.String())
-	}
-}
-
-// TestSVGRenderFailedAnswers415 checks that respondImageError answers 415,
-// naming the limits, for an SVG source that a child process could not read
-// or render, wrapped as the service wraps it.
-func TestSVGRenderFailedAnswers415(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	err := fmt.Errorf("image processing failed: %w: it took more than 20s",
-		imageprocessor.ErrSVGRenderFailed)
-
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("for %v: %d %s", err, rec.Code, rec.Body.String())
-
-	checkErrorBody(t, rec, http.StatusUnsupportedMediaType,
-		"SVG source could not be rendered: it is not valid, or it takes more "+
-			"than 20 seconds or 1 GiB of memory to render")
-}
-
-// TestSVGTooLargeForOrigSizeAnswers400 checks that respondImageError answers
-// 400, asking for a size, for an SVG source above 8192 on a side asked for at
-// the orig size in a raster format, wrapped as the service wraps it.
-func TestSVGTooLargeForOrigSizeAnswers400(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	err := fmt.Errorf("image processing failed: %w: 10000x10 is above 8192",
-		imageprocessor.ErrSVGTooLargeForOrigSize)
-
-	rec := httptest.NewRecorder()
-	h.respondImageError(rec, &imagerequest.Request{}, err)
-	t.Logf("for %v: %d %s", err, rec.Code, rec.Body.String())
-
-	checkErrorBody(t, rec, http.StatusBadRequest,
-		"SVG source above 8192 on a side: give a size to render it at")
-}

internal/handlers/validate_signature_internal_test.go

@@ -1,211 +0,0 @@
-package handlers
-
-import (
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/signature"
-)
-
-// Addresses the port tests below put on the allowlist.
-const (
-	allowlistedIPv4 = "203.0.113.5"
-	allowlistedIPv6 = "2001:db8::1"
-)
-
-// newSignatureChecker returns Handlers that check signatures with
-// testSigningKey and have allowlistHosts on their allowlist, as New builds
-// them from signing_key and allowlist_hosts.
-func newSignatureChecker(allowlistHosts ...string) *Handlers {
-	return &Handlers{
-		signer:    signature.New(testSigningKey),
-		allowlist: allowlist.New(allowlistHosts),
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_NoSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-
-	// Should fail validation - not allowlisted and no signature
-	err := h.validateSignature(photoRequest(signedHost), "", time.Time{})
-	if err == nil {
-		t.Error("validateSignature() expected error for non-allowlisted " +
-			"host without signature")
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_ValidSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-	req := photoRequest(signedHost)
-
-	// Generate a valid signature
-	expires := time.Now().Add(time.Hour)
-	sig := signature.New(testSigningKey).Sign(req, expires)
-
-	// Should pass validation
-	err := h.validateSignature(req, sig, expires)
-	if err != nil {
-		t.Errorf("validateSignature() error = %v", err)
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_ExpiredSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-	req := photoRequest(signedHost)
-
-	// Generate an expired signature
-	expires := time.Now().Add(-time.Hour)
-	sig := signature.New(testSigningKey).Sign(req, expires)
-
-	// Should fail validation
-	err := h.validateSignature(req, sig, expires)
-	if err == nil {
-		t.Error("validateSignature() expected error for expired signature")
-	}
-}
-
-func TestValidateSignature_NonAllowlistedHost_InvalidSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost)
-
-	// Should fail validation
-	err := h.validateSignature(photoRequest(signedHost), "invalid-signature",
-		time.Now().Add(time.Hour))
-	if err == nil {
-		t.Error("validateSignature() expected error for invalid signature")
-	}
-}
-
-// TestValidateSignature_NoAllowlist checks that with no host on the
-// allowlist, a request without a signature fails validation.
-func TestValidateSignature_NoAllowlist(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker()
-
-	err := h.validateSignature(photoRequest(signedHost), "", time.Time{})
-	if err == nil {
-		t.Error("validateSignature() expected error when no host is allowlisted")
-	}
-}
-
-// TestValidateSignature_SignatureExactHostMatch verifies that
-// validateSignature enforces exact host matching for signatures. A
-// signature for one host must not verify for a different host, even
-// if they share a domain suffix.
-func TestValidateSignature_SignatureExactHostMatch(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker()
-
-	// Sign a request for signedHost
-	signedReq := photoRequest(signedHost)
-	expires := time.Now().Add(time.Hour)
-	sig := signature.New(testSigningKey).Sign(signedReq, expires)
-
-	// The original request should pass validation
-	t.Run("exact host passes", func(t *testing.T) {
-		t.Parallel()
-
-		err := h.validateSignature(signedReq, sig, expires)
-		if err != nil {
-			t.Errorf("validateSignature() exact host failed: %v", err)
-		}
-	})
-
-	// Try to reuse the signature with different hosts
-	tests := []struct {
-		name string
-		host string
-	}{
-		{"parent domain", "example.com"},
-		{"sibling subdomain", "images.example.com"},
-		{"deeper subdomain", "a." + signedHost},
-		{"evil suffix domain", signedHost + ".evil.com"},
-		{"prefixed host", "evil" + signedHost},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name+" rejected", func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(tt.host), sig, expires)
-			if err == nil {
-				t.Errorf("validateSignature() should reject signature for "+
-					"host %q (signed for %q)", tt.host, signedHost)
-			}
-		})
-	}
-}
-
-// TestValidateSignature_HostWithPortNeedsSignature verifies that a host
-// followed by a port, or by a colon with no port, matches no allowlist entry,
-// so that a request for it without a signature is refused, while the same
-// host with no port is allowlisted.
-func TestValidateSignature_HostWithPortNeedsSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedHost, allowlistedIPv4, allowlistedIPv6)
-
-	tests := []struct {
-		host        string
-		allowlisted bool
-	}{
-		{allowlistedHost, true},
-		{allowlistedHost + ":8443", false},
-		{allowlistedHost + ":443", false},
-		{allowlistedHost + ":", false},
-		{allowlistedIPv4, true},
-		{allowlistedIPv4 + ":8080", false},
-		{"[" + allowlistedIPv6 + "]", true},
-		{"[" + allowlistedIPv6 + "]:8443", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(tt.host), "", time.Time{})
-			t.Logf("validateSignature() for host %q with no signature: %v",
-				tt.host, err)
-
-			if allowlisted := err == nil; allowlisted != tt.allowlisted {
-				t.Errorf("host %q served without a signature = %v, want %v",
-					tt.host, allowlisted, tt.allowlisted)
-			}
-		})
-	}
-}
-
-// TestValidateSignature_UnbracketedIPv6PortNeedsSignature verifies that an
-// allowlisted IPv6 address written without brackets and followed by a port,
-// or by a colon with no port, needs a signature. Go's URL type reads
-// 2001:db8::1:8443 as the host 2001:db8::1 with the port 8443.
-func TestValidateSignature_UnbracketedIPv6PortNeedsSignature(t *testing.T) {
-	t.Parallel()
-
-	h := newSignatureChecker(allowlistedIPv6)
-
-	for _, host := range []string{allowlistedIPv6 + ":8443", allowlistedIPv6 + ":"} {
-		t.Run(host, func(t *testing.T) {
-			t.Parallel()
-
-			err := h.validateSignature(photoRequest(host), "", time.Time{})
-			t.Logf("validateSignature() for host %q with no signature: %v",
-				host, err)
-
-			if err == nil {
-				t.Errorf("host %q served without a signature, want refused",
-					host)
-			}
-		})
-	}
-}

internal/httpfetcher/blocked_networks_internal_test.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/netip"
 	"testing"
-	"time"
 )
 
 // TestIsPrivateIPBlocksSpecialRanges covers the internal and special-use
@@ -71,15 +70,12 @@ func transportOf(t *testing.T, f *HTTPFetcher) *http.Transport {
 func TestDialerEnforcesBlockedNetworks(t *testing.T) {
 	t.Parallel()
 
-	transport := transportOf(t, New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-		// TEST-NET-2 (198.51.100.0/24) is public to the built-in check, so
-		// blocking it can only come from the operator-supplied list.
-		BlockedNetworks: []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")},
-	}))
+	cfg := DefaultConfig()
+	// TEST-NET-2 (198.51.100.0/24) is public to the built-in check, so
+	// blocking it can only come from the operator-supplied list.
+	cfg.BlockedNetworks = []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")}
+
+	transport := transportOf(t, New(cfg))
 
 	blocked := []string{
 		"198.51.100.5:80", // operator-supplied range

internal/httpfetcher/conditional_internal_test.go

@@ -1,76 +0,0 @@
-package httpfetcher
-
-import (
-	"errors"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"sync"
-	"testing"
-)
-
-// TestFetch_SendsConditionalHeadersAndHandlesNotModified checks that Fetch
-// sends a non-empty ifNoneMatch and ifModifiedSince as request headers, that
-// upstream's 304 to such a request is a result with status 304 and no
-// content, and that a 304 to a request with neither is ErrUpstreamError.
-func TestFetch_SendsConditionalHeadersAndHandlesNotModified(t *testing.T) {
-	t.Parallel()
-
-	const (
-		etag         = `"abc"`
-		lastModified = "Mon, 02 Nov 2026 10:00:00 GMT"
-	)
-
-	var (
-		mu       sync.Mutex
-		received http.Header
-	)
-
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			mu.Lock()
-			received = r.Header.Clone()
-			mu.Unlock()
-
-			w.WriteHeader(http.StatusNotModified)
-		}))
-	t.Cleanup(srv.Close)
-
-	f, _ := newServerFetcher(t, srv, nil)
-
-	res, err := f.Fetch(testContext(t), upstreamSource("/image"), etag, lastModified)
-	if err != nil {
-		t.Fatalf("conditional Fetch() error = %v", err)
-	}
-
-	body, err := io.ReadAll(res.Content)
-	_ = res.Content.Close()
-
-	mu.Lock()
-	t.Logf("status = %d, body = %q, request headers = %v", res.StatusCode, body, received)
-	gotIfNoneMatch := received.Get("If-None-Match")
-	gotIfModifiedSince := received.Get("If-Modified-Since")
-	mu.Unlock()
-
-	if err != nil || len(body) != 0 {
-		t.Errorf("304 content = %q, error = %v; want empty", body, err)
-	}
-
-	if res.StatusCode != http.StatusNotModified {
-		t.Errorf("StatusCode = %d, want 304", res.StatusCode)
-	}
-
-	if gotIfNoneMatch != etag || gotIfModifiedSince != lastModified {
-		t.Errorf("If-None-Match = %q, If-Modified-Since = %q; want %q and %q",
-			gotIfNoneMatch, gotIfModifiedSince, etag, lastModified)
-	}
-
-	if held := len(f.allHostsSemaphore); held != 0 {
-		t.Errorf("connection still held after the 304: %d held", held)
-	}
-
-	_, err = f.Fetch(testContext(t), upstreamSource("/image"), "", "")
-	if !errors.Is(err, ErrUpstreamError) {
-		t.Errorf("unconditional Fetch() answered 304: error = %v, want ErrUpstreamError", err)
-	}
-}

internal/httpfetcher/dial_context_internal_test.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net"
 	"testing"
-	"time"
 )
 
 // TestNewUsesCheckedDialerWithoutDialContext checks that a fetcher built
@@ -14,12 +13,7 @@ func TestNewUsesCheckedDialerWithoutDialContext(t *testing.T) {
 	t.Parallel()
 
 	srv := startUpstream(t)
-	transport := transportOf(t, New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}))
+	transport := transportOf(t, New(DefaultConfig()))
 
 	addr := srv.Listener.Addr().String()
 
@@ -38,25 +32,21 @@ func TestDialContextReplacesOnlyTheDialer(t *testing.T) {
 	srv := startUpstream(t)
 	dialer := &recordingDialer{target: srv.Listener.Addr().String()}
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		AllowHTTP:             true,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-		DialContext:           dialer.dialContext,
-	})
+	cfg := DefaultConfig()
+	cfg.AllowHTTP = true
+	cfg.DialContext = dialer.dialContext
+	f := New(cfg)
 
 	if body := fetchBody(t, f, "/image"); body != imagePayload {
 		t.Errorf("body = %q, want %q", body, imagePayload)
 	}
 
-	_, err := f.Fetch(testContext(t), imageSourceOn("127.0.0.1"), "", "")
+	_, err := f.Fetch(testContext(t), "http://127.0.0.1/image")
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("Fetch(loopback URL) error = %v, want ErrSSRFBlocked", err)
 	}
 
-	_, err = f.Fetch(testContext(t), upstreamSource("/redirect/private"), "", "")
+	_, err = f.Fetch(testContext(t), upstreamURL("/redirect/private"))
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("Fetch(/redirect/private) error = %v, want ErrSSRFBlocked", err)
 	}

internal/httpfetcher/fetch_internal_test.go

@@ -14,8 +14,6 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // testPublicHost is a TEST-NET-1 (RFC 5737) literal. isPrivateIP treats it as
@@ -31,9 +29,9 @@ const imagePayload = "fake-jpeg-bytes"
 // would mean SSRF protection let a forbidden target reach the transport.
 var errUnexpectedDial = errors.New("unexpected dial target")
 
-// upstreamSource returns the source at path on the fake public host.
-func upstreamSource(path string) imagerequest.Source {
-	return imagerequest.Source{Host: testPublicHost, Path: path}
+// upstreamURL builds a fetch URL on the fake public host for the given path.
+func upstreamURL(path string) string {
+	return "http://" + testPublicHost + path
 }
 
 // recordingDialer records every address the transport asks it to dial and
@@ -83,7 +81,7 @@ func startUpstream(t *testing.T) *httptest.Server {
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/image", func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+		w.Header().Set("Content-Type", contentTypeJPEG)
 		_, _ = io.WriteString(w, imagePayload)
 	})
 	mux.HandleFunc("/status/500", func(w http.ResponseWriter, _ *http.Request) {
@@ -122,12 +120,7 @@ func newServerFetcher(
 	t.Helper()
 
 	if cfg == nil {
-		cfg = &Config{
-			Timeout:               30 * time.Second,
-			MaxResponseSize:       50 << 20,
-			MaxConnectionsPerHost: 20,
-			MaxConnections:        64,
-		}
+		cfg = DefaultConfig()
 	}
 
 	cfg.AllowHTTP = true
@@ -160,7 +153,7 @@ func testContext(t *testing.T) context.Context {
 func fetchImage(t *testing.T, f *HTTPFetcher, path string) *FetchResult {
 	t.Helper()
 
-	res, err := f.Fetch(testContext(t), upstreamSource(path), "", "")
+	res, err := f.Fetch(testContext(t), upstreamURL(path))
 	if err != nil {
 		t.Fatalf("Fetch(%s) error = %v", path, err)
 	}
@@ -172,7 +165,7 @@ func fetchImage(t *testing.T, f *HTTPFetcher, path string) *FetchResult {
 func fetchExpectError(t *testing.T, f *HTTPFetcher, path string) error {
 	t.Helper()
 
-	res, err := f.Fetch(testContext(t), upstreamSource(path), "", "")
+	res, err := f.Fetch(testContext(t), upstreamURL(path))
 	if err == nil {
 		_ = res.Content.Close()
 
@@ -224,7 +217,7 @@ func TestFetchRedirectToPrivateIPBlocked(t *testing.T) {
 	srv := startUpstream(t)
 	f, dialer := newServerFetcher(t, srv, nil)
 
-	_, err := f.Fetch(testContext(t), upstreamSource("/redirect/private"), "", "")
+	_, err := f.Fetch(testContext(t), upstreamURL("/redirect/private"))
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Fatalf("Fetch() error = %v, want ErrSSRFBlocked", err)
 	}
@@ -287,12 +280,8 @@ func TestFetchMaxResponseSizeEnforced(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       8,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxResponseSize = 8
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -321,12 +310,8 @@ func fetchWithMaxResponseSize(
 	srv := httptest.NewServer(handler)
 	t.Cleanup(srv.Close)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       maxResponseSize,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxResponseSize = maxResponseSize
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -358,7 +343,7 @@ func TestFetchContentLengthBodyAtMaxResponseSize(t *testing.T) {
 
 			res := fetchWithMaxResponseSize(t, maxResponseSize,
 				func(w http.ResponseWriter, _ *http.Request) {
-					w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+					w.Header().Set("Content-Type", contentTypeJPEG)
 					w.Header().Set("Content-Length", strconv.Itoa(tc.size))
 					_, _ = io.WriteString(w, body)
 				})
@@ -406,7 +391,7 @@ func TestFetchChunkedBodyAtMaxResponseSize(t *testing.T) {
 
 			res := fetchWithMaxResponseSize(t, maxResponseSize,
 				func(w http.ResponseWriter, r *http.Request) {
-					w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+					w.Header().Set("Content-Type", contentTypeJPEG)
 					_, _ = io.WriteString(w, body)
 					// With no Content-Length, flushing sends the body
 					// chunked; its end is sent when the handler returns.
@@ -451,12 +436,8 @@ func TestFetchSemaphoreReleasedOnError(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -485,12 +466,8 @@ func assertSlotReleasedByClose(
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        64,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
@@ -547,7 +524,7 @@ func TestFetchSemaphoreReleasedOnPartialReadClose(t *testing.T) {
 	})
 }
 
-// The dial-time re-resolution in dialSSRFSafe is what closes the DNS
+// The dial-time re-resolution in ssrfSafeDialer is what closes the DNS
 // rebinding window: even if validateURL saw a public answer earlier, the
 // dialer independently re-checks the address it is about to connect to. A full
 // rebinding simulation (a resolver returning public, then private) would mean
@@ -567,9 +544,9 @@ func TestSSRFSafeDialerBlocksPrivateTarget(t *testing.T) {
 		t.Run(addr, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := dialSSRFSafe(context.Background(), "tcp", addr, nil)
+			_, err := ssrfSafeDialer(context.Background(), "tcp", addr)
 			if !errors.Is(err, ErrSSRFBlocked) {
-				t.Errorf("dialSSRFSafe(%q) = %v, want ErrSSRFBlocked", addr, err)
+				t.Errorf("ssrfSafeDialer(%q) = %v, want ErrSSRFBlocked", addr, err)
 			}
 		})
 	}
@@ -583,7 +560,7 @@ func TestSSRFSafeDialerAllowsPublicTarget(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	_, err := dialSSRFSafe(ctx, "tcp", testPublicHost+":80", nil)
+	_, err := ssrfSafeDialer(ctx, "tcp", testPublicHost+":80")
 	if err == nil {
 		t.Fatal("expected a dial error for an unreachable public target")
 	}
@@ -592,53 +569,3 @@ func TestSSRFSafeDialerAllowsPublicTarget(t *testing.T) {
 		t.Errorf("public target was SSRF-blocked: %v", err)
 	}
 }
-
-// TestFetchSchemeFollowsAllowHTTP checks that the fetcher fetches a source
-// over https, on port 443, unless AllowHTTP is set, and then over http, on
-// port 80. The test server speaks plain HTTP, so only the fetch over http
-// succeeds.
-func TestFetchSchemeFollowsAllowHTTP(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		allowHTTP bool
-		wantAddr  string
-	}{
-		{false, net.JoinHostPort(testPublicHost, "443")},
-		{true, net.JoinHostPort(testPublicHost, "80")},
-	}
-
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("AllowHTTP %v", tt.allowHTTP), func(t *testing.T) {
-			t.Parallel()
-
-			srv := startUpstream(t)
-			dialer := &recordingDialer{target: srv.Listener.Addr().String()}
-
-			f := New(&Config{
-				Timeout:               30 * time.Second,
-				MaxResponseSize:       50 << 20,
-				AllowHTTP:             tt.allowHTTP,
-				MaxConnectionsPerHost: 20,
-				MaxConnections:        64,
-				DialContext:           dialer.dialContext,
-			})
-
-			res, err := f.Fetch(testContext(t), upstreamSource("/image"), "", "")
-			if err == nil {
-				_ = res.Content.Close()
-			}
-
-			dialed := dialer.dialedAddrs()
-			t.Logf("Fetch(): error %v, dialed %v", err, dialed)
-
-			if served := err == nil; served != tt.allowHTTP {
-				t.Errorf("served = %v, want %v", served, tt.allowHTTP)
-			}
-
-			if len(dialed) != 1 || dialed[0] != tt.wantAddr {
-				t.Errorf("dialed %v, want only %s", dialed, tt.wantAddr)
-			}
-		})
-	}
-}

internal/httpfetcher/httpfetcher.go

@@ -20,24 +20,36 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // Fetcher configuration constants.
 const (
-	DefaultTLSTimeout      = 10 * time.Second
-	DefaultMaxIdleConns    = 100
-	DefaultIdleConnTimeout = 90 * time.Second
-	DefaultMaxRedirects    = 10
+	DefaultFetchTimeout          = 30 * time.Second
+	DefaultMaxResponseSize       = 50 << 20 // 50MB
+	DefaultTLSTimeout            = 10 * time.Second
+	DefaultMaxIdleConns          = 100
+	DefaultIdleConnTimeout       = 90 * time.Second
+	DefaultMaxRedirects          = 10
+	DefaultMaxConnectionsPerHost = 20
+	DefaultMaxConnections        = 64
 )
 
-// userAgent is the User-Agent header sent to upstream servers.
-const userAgent = "pixa/1.0"
-
 // ConnectionWaitTimeout is how long Fetch waits for a free connection when
 // MaxConnections fetches are already in progress.
 const ConnectionWaitTimeout = 10 * time.Second
 
+// MIME content types.
+const (
+	contentTypeJPEG        = "image/jpeg"
+	contentTypePNG         = "image/png"
+	contentTypeGIF         = "image/gif"
+	contentTypeWebP        = "image/webp"
+	contentTypeAVIF        = "image/avif"
+	contentTypeJXL         = "image/jxl"
+	contentTypeSVG         = "image/svg+xml"
+	contentTypeOctetStream = "application/octet-stream"
+)
+
 // Loopback addresses blocked by SSRF protection.
 const (
 	localhostIPv4 = "127.0.0.1"
@@ -69,11 +81,7 @@ var (
 	ErrInvalidContentType = errors.New("invalid or unsupported content type")
 	ErrUpstreamError      = errors.New("upstream server error")
 	ErrUpstreamTimeout    = errors.New("upstream request timeout")
-	// ErrUpstreamRequestFailed is a fetch that failed before the upstream
-	// answered, other than by timeout or cancellation: a failed connection
-	// or TLS handshake, or a redirect the fetcher refuses.
-	ErrUpstreamRequestFailed = errors.New("upstream request failed")
-	ErrTooManyConnections    = errors.New("too many concurrent upstream connections")
+	ErrTooManyConnections = errors.New("too many concurrent upstream connections")
 )
 
 // Internal fetcher errors.
@@ -84,13 +92,8 @@ var (
 
 // Fetcher retrieves content from upstream origins.
 type Fetcher interface {
-	// Fetch retrieves the content of the source image. A non-empty
-	// ifNoneMatch or ifModifiedSince is sent as the request header of that
-	// name, and upstream may then answer 304 Not Modified with no content.
-	Fetch(
-		ctx context.Context, source imagerequest.Source,
-		ifNoneMatch, ifModifiedSince string,
-	) (*FetchResult, error)
+	// Fetch retrieves content from the given URL.
+	Fetch(ctx context.Context, url string) (*FetchResult, error)
 }
 
 // FetchResult contains the result of fetching from upstream.
@@ -117,30 +120,17 @@ type FetchResult struct {
 	TLSCipherSuite string
 }
 
-// allowedContentTypes returns the content types an upstream response may
-// have, which Fetch also sends as its Accept header: the MIME types of the
-// formats pixa reads.
-func allowedContentTypes() []string {
-	return []string{
-		imagerequest.FormatJPEG.MIMEType(),
-		imagerequest.FormatPNG.MIMEType(),
-		imagerequest.FormatGIF.MIMEType(),
-		imagerequest.FormatWebP.MIMEType(),
-		imagerequest.FormatAVIF.MIMEType(),
-		imagerequest.FormatJXL.MIMEType(),
-		imagerequest.FormatSVG.MIMEType(),
-	}
-}
-
-// Config holds configuration for the upstream fetcher. Every field but
-// AllowHTTP, BlockedNetworks and DialContext must be set.
+// Config holds configuration for the upstream fetcher.
 type Config struct {
 	// Timeout for upstream requests.
 	Timeout time.Duration
 	// MaxResponseSize is the maximum allowed response body size.
 	MaxResponseSize int64
-	// AllowHTTP makes the fetcher fetch sources over http instead of https,
-	// and follow redirects to http (for testing only).
+	// UserAgent to send to upstream servers.
+	UserAgent string
+	// AllowedContentTypes is an allow list of MIME types to accept.
+	AllowedContentTypes []string
+	// AllowHTTP allows non-TLS connections (for testing only).
 	AllowHTTP bool
 	// MaxConnectionsPerHost limits concurrent connections to each upstream host.
 	MaxConnectionsPerHost int
@@ -157,6 +147,26 @@ type Config struct {
 	DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
 }
 
+// DefaultConfig returns a Config with sensible defaults.
+func DefaultConfig() *Config {
+	return &Config{
+		Timeout:         DefaultFetchTimeout,
+		MaxResponseSize: DefaultMaxResponseSize,
+		UserAgent:       "pixa/1.0",
+		AllowedContentTypes: []string{
+			contentTypeJPEG,
+			contentTypePNG,
+			contentTypeGIF,
+			contentTypeWebP,
+			contentTypeAVIF,
+			contentTypeJXL,
+		},
+		AllowHTTP:             false,
+		MaxConnectionsPerHost: DefaultMaxConnectionsPerHost,
+		MaxConnections:        DefaultMaxConnections,
+	}
+}
+
 // HTTPFetcher implements Fetcher with SSRF protection and connection limits
 // per host and for all hosts together.
 type HTTPFetcher struct {
@@ -184,6 +194,10 @@ type hostSemaphore struct {
 
 // New creates a new HTTPFetcher with SSRF protection.
 func New(config *Config) *HTTPFetcher {
+	if config == nil {
+		config = DefaultConfig()
+	}
+
 	// Unless config.DialContext replaces it, the transport connects with
 	// the SSRF-safe dialer, which re-resolves and re-checks at connect time
 	// (closing the DNS-rebinding window) against both the built-in ranges
@@ -212,7 +226,7 @@ func New(config *Config) *HTTPFetcher {
 			}
 
 			// Validate the redirect target
-			err := validateURL(req.Context(), req.URL, config.AllowHTTP)
+			err := validateURL(req.Context(), req.URL.String(), config.AllowHTTP)
 			if err != nil {
 				return fmt.Errorf("redirect blocked: %w", err)
 			}
@@ -230,26 +244,18 @@ func New(config *Config) *HTTPFetcher {
 	}
 }
 
-// Fetch retrieves the source image with SSRF protection, over https, or over
-// http when AllowHTTP is set. When MaxConnections fetches are already in
-// progress, it waits up to ConnectionWaitTimeout for one to finish, then
-// fails with ErrTooManyConnections. A non-empty ifNoneMatch or
-// ifModifiedSince is sent as the If-None-Match or If-Modified-Since header.
-// Upstream's 304 Not Modified to such a request is a result with StatusCode
-// 304 and empty Content; to any other request it is ErrUpstreamError.
-func (f *HTTPFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source,
-	ifNoneMatch, ifModifiedSince string,
-) (*FetchResult, error) {
-	sourceURL := source.URL(f.config.AllowHTTP)
-
+// Fetch retrieves content from the given URL with SSRF protection. When
+// MaxConnections fetches are already in progress, it waits up to
+// ConnectionWaitTimeout for one to finish, then fails with
+// ErrTooManyConnections.
+func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, error) {
 	// Validate URL before making request
-	err := validateURL(ctx, sourceURL, f.config.AllowHTTP)
+	err := validateURL(ctx, url, f.config.AllowHTTP)
 	if err != nil {
 		return nil, err
 	}
 
-	release, err := f.acquireConnection(ctx, source.Host)
+	release, err := f.acquireConnection(ctx, extractHost(url))
 	if err != nil {
 		return nil, err
 	}
@@ -263,10 +269,25 @@ func (f *HTTPFetcher) Fetch(
 		}
 	}()
 
+	parsedURL, err := neturl.Parse(url)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse URL: %w", err)
+	}
+
 	req := &http.Request{
 		Method: http.MethodGet,
-		URL:    sourceURL,
-		Header: requestHeaders(ctx, ifNoneMatch, ifModifiedSince),
+		URL:    parsedURL,
+		Header: make(http.Header),
+	}
+
+	req.Header.Set("User-Agent", f.config.UserAgent)
+	req.Header.Set("Accept", strings.Join(f.config.AllowedContentTypes, ", "))
+
+	// The ID of the request this fetch serves, so the fetch can be found in
+	// the upstream host's logs
+	requestID := middleware.GetReqID(ctx)
+	if requestID != "" {
+		req.Header.Set(middleware.RequestIDHeader, requestID)
 	}
 
 	// Use httptrace to capture connection details
@@ -288,21 +309,11 @@ func (f *HTTPFetcher) Fetch(
 	fetchDuration := time.Since(startTime)
 
 	if err != nil {
-		return nil, upstreamRequestError(err)
-	}
+		if errors.Is(err, context.DeadlineExceeded) {
+			return nil, ErrUpstreamTimeout
+		}
 
-	// The deferred release gives the connection back, as no body follows
-	conditional := ifNoneMatch != "" || ifModifiedSince != ""
-	if conditional && resp.StatusCode == http.StatusNotModified {
-		_ = resp.Body.Close()
-
-		return &FetchResult{
-			Content:         http.NoBody,
-			Headers:         resp.Header,
-			StatusCode:      resp.StatusCode,
-			FetchDurationMs: fetchDuration.Milliseconds(),
-			RemoteAddr:      remoteAddr,
-		}, nil
+		return nil, fmt.Errorf("upstream request failed: %w", err)
 	}
 
 	result, err := f.buildResult(resp, remoteAddr, fetchDuration, release)
@@ -317,60 +328,6 @@ func (f *HTTPFetcher) Fetch(
 	return result, nil
 }
 
-// upstreamRequestError returns the error Fetch reports when its upstream
-// request fails with err:
-//   - err wrapped in ErrUpstreamTimeout for a timeout, so the log names what
-//     timed out.
-//   - err, still matching context.Canceled, when the caller cancelled the
-//     fetch.
-//   - err wrapped in ErrUpstreamRequestFailed otherwise.
-func upstreamRequestError(err error) error {
-	var netErr net.Error
-
-	switch {
-	case errors.Is(err, context.DeadlineExceeded),
-		errors.Is(err, ErrUpstreamTimeout),
-		errors.As(err, &netErr) && netErr.Timeout():
-		// A timeout other than the fetch timeout, such as the TLS
-		// handshake timeout, does not match context.DeadlineExceeded. An
-		// address lookup or a connection that timed out is
-		// ErrUpstreamTimeout already, so its log line names that error twice.
-		return fmt.Errorf("%w: %w", ErrUpstreamTimeout, err)
-	case errors.Is(err, context.Canceled):
-		// The caller cancelled the fetch; the upstream did not fail
-		return fmt.Errorf("upstream request cancelled: %w", err)
-	default:
-		return fmt.Errorf("%w: %w", ErrUpstreamRequestFailed, err)
-	}
-}
-
-// requestHeaders returns the headers of a fetch: User-Agent, Accept, the
-// ID of the request the fetch serves, so the fetch can be found in the
-// upstream host's logs, and a non-empty ifNoneMatch or ifModifiedSince.
-func requestHeaders(
-	ctx context.Context, ifNoneMatch, ifModifiedSince string,
-) http.Header {
-	header := make(http.Header)
-
-	header.Set("User-Agent", userAgent)
-	header.Set("Accept", strings.Join(allowedContentTypes(), ", "))
-
-	requestID := middleware.GetReqID(ctx)
-	if requestID != "" {
-		header.Set(middleware.RequestIDHeader, requestID)
-	}
-
-	if ifNoneMatch != "" {
-		header.Set("If-None-Match", ifNoneMatch)
-	}
-
-	if ifModifiedSince != "" {
-		header.Set("If-Modified-Since", ifModifiedSince)
-	}
-
-	return header
-}
-
 // acquireConnection takes a slot for host, then one of the slots shared by
 // all hosts, and returns the func that gives both back. The host's slot
 // comes first, so fetches queued for one busy host hold no shared slot.
@@ -503,7 +460,7 @@ func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 	// Extract the MIME type without parameters
 	mediaType := strings.TrimSpace(strings.Split(contentType, ";")[0])
 
-	for _, allowed := range allowedContentTypes() {
+	for _, allowed := range f.config.AllowedContentTypes {
 		if strings.EqualFold(mediaType, allowed) {
 			return true
 		}
@@ -513,14 +470,19 @@ func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 }
 
 // validateURL checks if a URL is safe to fetch (not internal/private).
-func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) error {
-	if !allowHTTP && fetchURL.Scheme != "https" {
+func validateURL(ctx context.Context, rawURL string, allowHTTP bool) error {
+	if !allowHTTP && !strings.HasPrefix(rawURL, "https://") {
 		return ErrUnsupportedScheme
 	}
 
+	parsedURL, err := neturl.Parse(rawURL)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidHost, err)
+	}
+
 	// Hostname drops any port, and the brackets of an IPv6 address whether
 	// or not a port follows them
-	host := fetchURL.Hostname()
+	host := parsedURL.Hostname()
 	if host == "" {
 		return ErrInvalidHost
 	}
@@ -533,7 +495,7 @@ func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) erro
 	// Resolve the host to check IP addresses
 	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, host)
 	if err != nil {
-		return addressLookupError(host, err)
+		return fmt.Errorf("%w: %s", ErrInvalidHost, host)
 	}
 
 	private := slices.ContainsFunc(addrs, func(addr net.IPAddr) bool {
@@ -546,21 +508,23 @@ func validateURL(ctx context.Context, fetchURL *neturl.URL, allowHTTP bool) erro
 	return nil
 }
 
-// addressLookupError returns the error for a failed address lookup of host:
-//   - ErrUpstreamTimeout when the lookup timed out.
-//   - err, still matching context.Canceled, when the lookup was cancelled.
-//   - ErrInvalidHost otherwise.
-func addressLookupError(host string, err error) error {
-	var netErr net.Error
-	if errors.As(err, &netErr) && netErr.Timeout() {
-		return fmt.Errorf("%w: address lookup of %s", ErrUpstreamTimeout, host)
+// extractHost extracts the host from a URL string.
+func extractHost(rawURL string) string {
+	// Simple extraction without full URL parsing
+	url := rawURL
+	if idx := strings.Index(url, "://"); idx != -1 {
+		url = url[idx+3:]
 	}
 
-	if errors.Is(err, context.Canceled) {
-		return fmt.Errorf("address lookup cancelled: %w", err)
+	if idx := strings.Index(url, "/"); idx != -1 {
+		url = url[:idx]
 	}
 
-	return fmt.Errorf("%w: %s", ErrInvalidHost, host)
+	if idx := strings.Index(url, "?"); idx != -1 {
+		url = url[:idx]
+	}
+
+	return url
 }
 
 // isLocalhost checks if the host is localhost.
@@ -675,6 +639,13 @@ func ipv4CompatibleToIPv4(ip net.IP) net.IP {
 	return ip
 }
 
+// ssrfSafeDialer validates IP addresses against the built-in blocked ranges
+// before connecting. New wraps dialSSRFSafe with the operator-supplied
+// blocklist; this entry point enforces the built-in ranges alone.
+func ssrfSafeDialer(ctx context.Context, network, addr string) (net.Conn, error) {
+	return dialSSRFSafe(ctx, network, addr, nil)
+}
+
 // dialSSRFSafe re-resolves addr and refuses to connect to any built-in
 // internal range or operator-supplied blocked prefix, closing the
 // DNS-rebinding window at connect time.
@@ -691,7 +662,7 @@ func dialSSRFSafe(
 	// Resolve the address
 	ips, err := net.DefaultResolver.LookupIP(ctx, "ip", host)
 	if err != nil {
-		return nil, addressLookupError(host, err)
+		return nil, fmt.Errorf("%w: %s", ErrInvalidHost, host)
 	}
 
 	// Check all resolved IPs
@@ -702,10 +673,7 @@ func dialSSRFSafe(
 	}
 
 	// Connect using the first valid IP
-	var (
-		dialer      net.Dialer
-		lastDialErr error
-	)
+	var dialer net.Dialer
 
 	for _, ip := range ips {
 		addr := net.JoinHostPort(ip.String(), port)
@@ -714,18 +682,9 @@ func dialSSRFSafe(
 		if err == nil {
 			return conn, nil
 		}
-
-		lastDialErr = err
 	}
 
-	// Only the last address tried decides whether the connection timed out
-	var netErr net.Error
-	if errors.As(lastDialErr, &netErr) && netErr.Timeout() {
-		return nil, fmt.Errorf("%w: connect to %s: %w",
-			ErrUpstreamTimeout, host, lastDialErr)
-	}
-
-	return nil, fmt.Errorf("%w to %s: %w", errConnectFailed, host, lastDialErr)
+	return nil, fmt.Errorf("%w to %s", errConnectFailed, host)
 }
 
 // limitedReader wraps a reader and refuses a body longer than remaining

internal/httpfetcher/httpfetcher_internal_test.go

@@ -5,34 +5,70 @@ import (
 	"errors"
 	"io"
 	"net"
-	"net/url"
 	"testing"
 	"testing/fstest"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // testHost is the hostname used by mock fetch tests.
 const testHost = "example.com"
 
+func TestDefaultConfig(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+
+	if cfg.Timeout != DefaultFetchTimeout {
+		t.Errorf("Timeout = %v, want %v", cfg.Timeout, DefaultFetchTimeout)
+	}
+
+	if cfg.MaxResponseSize != DefaultMaxResponseSize {
+		t.Errorf("MaxResponseSize = %d, want %d", cfg.MaxResponseSize, DefaultMaxResponseSize)
+	}
+
+	if cfg.MaxConnectionsPerHost != DefaultMaxConnectionsPerHost {
+		t.Errorf("MaxConnectionsPerHost = %d, want %d",
+			cfg.MaxConnectionsPerHost, DefaultMaxConnectionsPerHost)
+	}
+
+	if cfg.AllowHTTP {
+		t.Error("AllowHTTP should default to false")
+	}
+
+	if len(cfg.AllowedContentTypes) == 0 {
+		t.Error("AllowedContentTypes should not be empty")
+	}
+}
+
+func TestNewWithNilConfigUsesDefaults(t *testing.T) {
+	t.Parallel()
+
+	f := New(nil)
+
+	if f == nil {
+		t.Fatal("New(nil) returned nil")
+	}
+
+	if f.config == nil {
+		t.Fatal("config should be populated from DefaultConfig")
+	}
+
+	if f.config.Timeout != DefaultFetchTimeout {
+		t.Errorf("Timeout = %v, want %v", f.config.Timeout, DefaultFetchTimeout)
+	}
+}
+
 func TestIsAllowedContentType(t *testing.T) {
 	t.Parallel()
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
+	f := New(DefaultConfig())
 
 	tests := []struct {
 		contentType string
 		want        bool
 	}{
-		{imagerequest.FormatJPEG.MIMEType(), true},
-		{imagerequest.FormatPNG.MIMEType(), true},
-		{imagerequest.FormatWebP.MIMEType(), true},
+		{contentTypeJPEG, true},
+		{contentTypePNG, true},
+		{contentTypeWebP, true},
 		{"image/jpeg; charset=utf-8", true},
 		{"IMAGE/JPEG", true},
 		{"text/html", false},
@@ -52,6 +88,33 @@ func TestIsAllowedContentType(t *testing.T) {
 	}
 }
 
+func TestExtractHost(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		url  string
+		want string
+	}{
+		{"https://example.com/path", testHost},
+		{"http://example.com:8080/path", "example.com:8080"},
+		{"https://example.com", testHost},
+		{"https://example.com?q=1", testHost},
+		{"example.com/path", testHost},
+		{"", ""},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.url, func(t *testing.T) {
+			t.Parallel()
+
+			got := extractHost(tc.url)
+			if got != tc.want {
+				t.Errorf("extractHost(%q) = %q, want %q", tc.url, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestIsLocalhost(t *testing.T) {
 	t.Parallel()
 
@@ -164,7 +227,7 @@ func TestIsPrivateIPJudgesEmbeddedIPv4Address(t *testing.T) {
 func TestValidateURL_RejectsNonHTTPS(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "http", Host: testHost}, false)
+	err := validateURL(t.Context(), "http://example.com/path", false)
 	if !errors.Is(err, ErrUnsupportedScheme) {
 		t.Errorf("validateURL http = %v, want ErrUnsupportedScheme", err)
 	}
@@ -174,8 +237,7 @@ func TestValidateURL_AllowsHTTPWhenConfigured(t *testing.T) {
 	t.Parallel()
 
 	// Use a host that won't resolve (explicit .invalid TLD) so we don't hit DNS.
-	err := validateURL(t.Context(),
-		&url.URL{Scheme: "http", Host: "nonexistent.invalid"}, true)
+	err := validateURL(t.Context(), "http://nonexistent.invalid/path", true)
 	// We expect a host resolution error, not ErrUnsupportedScheme.
 	if errors.Is(err, ErrUnsupportedScheme) {
 		t.Error("validateURL with AllowHTTP should not return ErrUnsupportedScheme")
@@ -185,7 +247,7 @@ func TestValidateURL_AllowsHTTPWhenConfigured(t *testing.T) {
 func TestValidateURL_RejectsLocalhost(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "https", Host: "localhost"}, false)
+	err := validateURL(t.Context(), "https://localhost/path", false)
 	if !errors.Is(err, ErrSSRFBlocked) {
 		t.Errorf("validateURL localhost = %v, want ErrSSRFBlocked", err)
 	}
@@ -194,7 +256,7 @@ func TestValidateURL_RejectsLocalhost(t *testing.T) {
 func TestValidateURL_EmptyHost(t *testing.T) {
 	t.Parallel()
 
-	err := validateURL(t.Context(), &url.URL{Scheme: "https"}, false)
+	err := validateURL(t.Context(), "https:///path", false)
 	if !errors.Is(err, ErrInvalidHost) {
 		t.Errorf("validateURL empty host = %v, want ErrInvalidHost", err)
 	}
@@ -209,15 +271,14 @@ func TestMockFetcher_FetchesFile(t *testing.T) {
 
 	m := NewMock(mockFS)
 
-	result, err := m.Fetch(context.Background(),
-		imagerequest.Source{Host: testHost, Path: "/images/photo.jpg"}, "", "")
+	result, err := m.Fetch(context.Background(), "https://example.com/images/photo.jpg")
 	if err != nil {
 		t.Fatalf("Fetch() error = %v", err)
 	}
 
 	defer func() { _ = result.Content.Close() }()
 
-	if result.ContentType != imagerequest.FormatJPEG.MIMEType() {
+	if result.ContentType != contentTypeJPEG {
 		t.Errorf("ContentType = %q, want image/jpeg", result.ContentType)
 	}
 
@@ -241,8 +302,7 @@ func TestMockFetcher_MissingFileReturnsUpstreamError(t *testing.T) {
 	mockFS := fstest.MapFS{}
 	m := NewMock(mockFS)
 
-	_, err := m.Fetch(context.Background(),
-		imagerequest.Source{Host: testHost, Path: "/missing.jpg"}, "", "")
+	_, err := m.Fetch(context.Background(), "https://example.com/missing.jpg")
 	if !errors.Is(err, ErrUpstreamError) {
 		t.Errorf("Fetch() error = %v, want ErrUpstreamError", err)
 	}
@@ -259,7 +319,7 @@ func TestMockFetcher_RespectsContextCancellation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	_, err := m.Fetch(ctx, imagerequest.Source{Host: testHost, Path: "/photo.jpg"}, "", "")
+	_, err := m.Fetch(ctx, "https://example.com/photo.jpg")
 	if !errors.Is(err, context.Canceled) {
 		t.Errorf("Fetch() error = %v, want context.Canceled", err)
 	}
@@ -272,14 +332,14 @@ func TestDetectContentTypeFromPath(t *testing.T) {
 		path string
 		want string
 	}{
-		{"foo/bar.jpg", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.JPG", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.jpeg", imagerequest.FormatJPEG.MIMEType()},
-		{"foo/bar.png", imagerequest.FormatPNG.MIMEType()},
-		{"foo/bar.gif", imagerequest.FormatGIF.MIMEType()},
-		{"foo/bar.webp", imagerequest.FormatWebP.MIMEType()},
-		{"foo/bar.avif", imagerequest.FormatAVIF.MIMEType()},
-		{"foo/bar.svg", imagerequest.FormatSVG.MIMEType()},
+		{"foo/bar.jpg", contentTypeJPEG},
+		{"foo/bar.JPG", contentTypeJPEG},
+		{"foo/bar.jpeg", contentTypeJPEG},
+		{"foo/bar.png", contentTypePNG},
+		{"foo/bar.gif", contentTypeGIF},
+		{"foo/bar.webp", contentTypeWebP},
+		{"foo/bar.avif", contentTypeAVIF},
+		{"foo/bar.svg", contentTypeSVG},
 		{"foo/bar.bin", contentTypeOctetStream},
 		{"foo/bar", contentTypeOctetStream},
 	}

internal/httpfetcher/jpegxl_internal_test.go

@@ -1,26 +1,16 @@
 package httpfetcher
 
-import (
-	"testing"
-	"time"
-)
+import "testing"
 
 // TestJPEGXLContentType verifies that the fetcher accepts an upstream answer
-// of type image/jxl, and that the mock fetcher serves a .jxl file as
-// image/jxl.
+// of type image/jxl by default, and that the mock fetcher serves a .jxl file
+// as image/jxl.
 func TestJPEGXLContentType(t *testing.T) {
 	t.Parallel()
 
 	const jxlType = "image/jxl"
 
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
-
-	if !f.isAllowedContentType(jxlType) {
+	if !New(DefaultConfig()).isAllowedContentType(jxlType) {
 		t.Errorf("isAllowedContentType(%q) = false, want true", jxlType)
 	}
 

internal/httpfetcher/max_connections_internal_test.go

@@ -8,20 +8,22 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// imageSourceOn is the fake upstream's image route on host.
-func imageSourceOn(host string) imagerequest.Source {
-	return imagerequest.Source{Host: host, Path: "/image"}
-}
-
-// imageSourceOnPort is the fake upstream's image route on testPublicHost at
+// imageURLOnPort is the fake upstream's image route on testPublicHost at
 // port. Each port is a different host to the per-host limit, while the test
 // dialer sends every port to the one test server.
-func imageSourceOnPort(port int) imagerequest.Source {
-	return imageSourceOn(net.JoinHostPort(testPublicHost, strconv.Itoa(port)))
+func imageURLOnPort(port int) string {
+	return "http://" + net.JoinHostPort(testPublicHost, strconv.Itoa(port)) +
+		"/image"
+}
+
+func TestDefaultConfigMaxConnections(t *testing.T) {
+	t.Parallel()
+
+	if got := DefaultConfig().MaxConnections; got != DefaultMaxConnections {
+		t.Errorf("MaxConnections = %d, want %d", got, DefaultMaxConnections)
+	}
 }
 
 // TestFetchLimitsConnectionsToAllHostsTogether checks that MaxConnections
@@ -35,22 +37,18 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        2,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 2
 
 	f, _ := newServerFetcher(t, srv, cfg)
 	f.connectionWaitTimeout = 100 * time.Millisecond
 
-	first, err := f.Fetch(testContext(t), imageSourceOnPort(81), "", "")
+	first, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
 
-	second, err := f.Fetch(testContext(t), imageSourceOnPort(82), "", "")
+	second, err := f.Fetch(testContext(t), imageURLOnPort(82))
 	if err != nil {
 		t.Fatalf("second Fetch() error = %v", err)
 	}
@@ -59,7 +57,7 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 
 	start := time.Now()
 
-	_, err = f.Fetch(testContext(t), imageSourceOnPort(83), "", "")
+	_, err = f.Fetch(testContext(t), imageURLOnPort(83))
 	if !errors.Is(err, ErrTooManyConnections) {
 		t.Fatalf("third Fetch() error = %v, want ErrTooManyConnections", err)
 	}
@@ -78,7 +76,7 @@ func TestFetchLimitsConnectionsToAllHostsTogether(t *testing.T) {
 		t.Fatalf("close first body: %v", err)
 	}
 
-	third, err := f.Fetch(testContext(t), imageSourceOnPort(83), "", "")
+	third, err := f.Fetch(testContext(t), imageURLOnPort(83))
 	if err != nil {
 		t.Fatalf("Fetch() after a response was closed: error = %v", err)
 	}
@@ -96,16 +94,12 @@ func TestFetchFreesHostSlotWhenContextEndsWaitingForConnection(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        1,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 
-	first, err := f.Fetch(testContext(t), imageSourceOnPort(81), "", "")
+	first, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
@@ -115,7 +109,7 @@ func TestFetchFreesHostSlotWhenContextEndsWaitingForConnection(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(82), "", "")
+	_, err = f.Fetch(ctx, imageURLOnPort(82))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("second Fetch() error = %v, want context.DeadlineExceeded", err)
 	}
@@ -140,7 +134,7 @@ func TestFetchRemovesIdleHostSemaphores(t *testing.T) {
 
 	for i := range 100 {
 		wg.Go(func() {
-			res, err := f.Fetch(ctx, imageSourceOnPort(1+i%50), "", "")
+			res, err := f.Fetch(ctx, imageURLOnPort(1+i%50))
 			if err != nil {
 				t.Errorf("Fetch() error = %v", err)
 
@@ -169,22 +163,19 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 
 	srv := startUpstream(t)
 
-	cfg := &Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 1,
-		MaxConnections:        1,
-	}
+	cfg := DefaultConfig()
+	cfg.MaxConnections = 1
+	cfg.MaxConnectionsPerHost = 1
 
 	f, _ := newServerFetcher(t, srv, cfg)
 	f.connectionWaitTimeout = 100 * time.Millisecond
 
-	open, err := f.Fetch(testContext(t), imageSourceOnPort(81), "", "")
+	open, err := f.Fetch(testContext(t), imageURLOnPort(81))
 	if err != nil {
 		t.Fatalf("first Fetch() error = %v", err)
 	}
 
-	_, err = f.Fetch(testContext(t), imageSourceOnPort(82), "", "")
+	_, err = f.Fetch(testContext(t), imageURLOnPort(82))
 	if !errors.Is(err, ErrTooManyConnections) {
 		t.Fatalf("Fetch() from another host: error = %v, "+
 			"want ErrTooManyConnections", err)
@@ -193,7 +184,7 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(81), "", "")
+	_, err = f.Fetch(ctx, imageURLOnPort(81))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("Fetch() from the busy host: error = %v, "+
 			"want context.DeadlineExceeded", err)
@@ -205,7 +196,7 @@ func TestFetchRemovesHostSemaphoreWhenNoConnection(t *testing.T) {
 	ctx, cancel = context.WithTimeout(t.Context(), 100*time.Millisecond)
 	defer cancel()
 
-	_, err = f.Fetch(ctx, imageSourceOnPort(83), "", "")
+	_, err = f.Fetch(ctx, imageURLOnPort(83))
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("Fetch() from a host with nothing open: error = %v, "+
 			"want context.DeadlineExceeded", err)
@@ -228,15 +219,15 @@ func TestFetchReleasesConnectionOnError(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name   string
-		source imagerequest.Source
-		want   error
+		name string
+		url  string
+		want error
 	}{
-		{"upstream answers 500", upstreamSource("/status/500"), ErrUpstreamError},
-		{"upstream sends HTML", upstreamSource("/html"), ErrInvalidContentType},
+		{"upstream answers 500", upstreamURL("/status/500"), ErrUpstreamError},
+		{"upstream sends HTML", upstreamURL("/html"), ErrInvalidContentType},
 		// 198.51.100.7 (TEST-NET-2) passes the SSRF checks, and the test
 		// dialer refuses every host but testPublicHost.
-		{"connecting fails", imageSourceOn("198.51.100.7"), errUnexpectedDial},
+		{"connecting fails", "http://198.51.100.7/image", errUnexpectedDial},
 	}
 
 	for _, tc := range cases {
@@ -245,17 +236,13 @@ func TestFetchReleasesConnectionOnError(t *testing.T) {
 
 			srv := startUpstream(t)
 
-			cfg := &Config{
-				Timeout:               30 * time.Second,
-				MaxResponseSize:       50 << 20,
-				MaxConnectionsPerHost: 20,
-				MaxConnections:        1,
-			}
+			cfg := DefaultConfig()
+			cfg.MaxConnections = 1
 
 			f, _ := newServerFetcher(t, srv, cfg)
 			f.connectionWaitTimeout = 100 * time.Millisecond
 
-			_, err := f.Fetch(testContext(t), tc.source, "", "")
+			_, err := f.Fetch(testContext(t), tc.url)
 			if !errors.Is(err, tc.want) {
 				t.Fatalf("Fetch() error = %v, want %v", err, tc.want)
 			}

internal/httpfetcher/mock.go

@@ -7,14 +7,14 @@ import (
 	"io/fs"
 	"net/http"
 	"strings"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
+// errEmptyURLPath is returned when a mock URL has no usable path.
+var errEmptyURLPath = errors.New("empty URL path")
+
 // MockFetcher implements Fetcher using an embedded filesystem.
 // Files are organized as: hostname/path/to/file.ext
-// The source with host example.com and path /images/photo.jpg maps to
-// example.com/images/photo.jpg; the source query is ignored.
+// URLs like https://example.com/images/photo.jpg map to example.com/images/photo.jpg.
 type MockFetcher struct {
 	fs fs.FS
 }
@@ -24,11 +24,8 @@ func NewMock(fsys fs.FS) *MockFetcher {
 	return &MockFetcher{fs: fsys}
 }
 
-// Fetch retrieves the source's content from the mock filesystem. It ignores
-// ifNoneMatch and ifModifiedSince, and always sends the content.
-func (m *MockFetcher) Fetch(
-	ctx context.Context, source imagerequest.Source, _, _ string,
-) (*FetchResult, error) {
+// Fetch retrieves content from the mock filesystem.
+func (m *MockFetcher) Fetch(ctx context.Context, url string) (*FetchResult, error) {
 	// Check context cancellation
 	select {
 	case <-ctx.Done():
@@ -36,7 +33,11 @@ func (m *MockFetcher) Fetch(
 	default:
 	}
 
-	path := source.Host + source.Path
+	// Parse URL to get filesystem path
+	path, err := urlToFSPath(url)
+	if err != nil {
+		return nil, err
+	}
 
 	// Open the file
 	f, err := m.fs.Open(path)
@@ -67,9 +68,31 @@ func (m *MockFetcher) Fetch(
 	}, nil
 }
 
-// contentTypeOctetStream is the content type the mock fetcher gives files in
-// no format pixa reads.
-const contentTypeOctetStream = "application/octet-stream"
+// urlToFSPath converts a URL to a filesystem path.
+// https://example.com/images/photo.jpg -> example.com/images/photo.jpg
+func urlToFSPath(rawURL string) (string, error) {
+	// Strip scheme
+	url := rawURL
+	if idx := strings.Index(url, "://"); idx != -1 {
+		url = url[idx+3:]
+	}
+
+	// Remove query string
+	if idx := strings.Index(url, "?"); idx != -1 {
+		url = url[:idx]
+	}
+
+	// Remove fragment
+	if idx := strings.Index(url, "#"); idx != -1 {
+		url = url[:idx]
+	}
+
+	if url == "" {
+		return "", errEmptyURLPath
+	}
+
+	return url, nil
+}
 
 // detectContentTypeFromPath returns the MIME type based on file extension.
 func detectContentTypeFromPath(path string) string {
@@ -77,19 +100,19 @@ func detectContentTypeFromPath(path string) string {
 
 	switch {
 	case strings.HasSuffix(path, ".jpg"), strings.HasSuffix(path, ".jpeg"):
-		return imagerequest.FormatJPEG.MIMEType()
+		return contentTypeJPEG
 	case strings.HasSuffix(path, ".png"):
-		return imagerequest.FormatPNG.MIMEType()
+		return contentTypePNG
 	case strings.HasSuffix(path, ".gif"):
-		return imagerequest.FormatGIF.MIMEType()
+		return contentTypeGIF
 	case strings.HasSuffix(path, ".webp"):
-		return imagerequest.FormatWebP.MIMEType()
+		return contentTypeWebP
 	case strings.HasSuffix(path, ".avif"):
-		return imagerequest.FormatAVIF.MIMEType()
+		return contentTypeAVIF
 	case strings.HasSuffix(path, ".jxl"):
-		return imagerequest.FormatJXL.MIMEType()
+		return contentTypeJXL
 	case strings.HasSuffix(path, ".svg"):
-		return imagerequest.FormatSVG.MIMEType()
+		return contentTypeSVG
 	default:
 		return contentTypeOctetStream
 	}

internal/httpfetcher/request_failed_internal_test.go

@@ -1,213 +0,0 @@
-package httpfetcher
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// TestFetchFailedBeforeAnswer checks the error of a fetch whose connection
-// fails:
-//   - refused: ErrUpstreamRequestFailed.
-//   - timed out: ErrUpstreamTimeout, still matching the dial's error, even for
-//     a timeout error that does not match context.DeadlineExceeded, such as
-//     the TLS handshake timeout.
-//   - cancelled by its caller: context.Canceled, not ErrUpstreamRequestFailed.
-func TestFetchFailedBeforeAnswer(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		dial       func(cancel context.CancelFunc) error
-		wantErrs   []error
-		wantNotErr error
-	}{
-		{
-			name: "connection refused",
-			dial: func(context.CancelFunc) error {
-				return syscall.ECONNREFUSED
-			},
-			wantErrs:   []error{ErrUpstreamRequestFailed},
-			wantNotErr: context.Canceled,
-		},
-		{
-			name: "timed out while connecting",
-			dial: func(context.CancelFunc) error {
-				return os.ErrDeadlineExceeded
-			},
-			wantErrs:   []error{ErrUpstreamTimeout, os.ErrDeadlineExceeded},
-			wantNotErr: ErrUpstreamRequestFailed,
-		},
-		{
-			name: "cancelled while connecting",
-			dial: func(cancel context.CancelFunc) error {
-				cancel()
-
-				return context.Canceled
-			},
-			wantErrs:   []error{context.Canceled},
-			wantNotErr: ErrUpstreamRequestFailed,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx, cancel := context.WithCancel(testContext(t))
-			defer cancel()
-
-			f := New(&Config{
-				Timeout:               30 * time.Second,
-				MaxResponseSize:       50 << 20,
-				AllowHTTP:             true,
-				MaxConnectionsPerHost: 20,
-				MaxConnections:        64,
-				DialContext: func(context.Context, string, string) (net.Conn, error) {
-					return nil, tt.dial(cancel)
-				},
-			})
-
-			_, err := f.Fetch(ctx, upstreamSource("/image"), "", "")
-			t.Logf("Fetch() error: %v", err)
-
-			for _, wantErr := range tt.wantErrs {
-				if !errors.Is(err, wantErr) {
-					t.Errorf("Fetch() error = %v, want %v", err, wantErr)
-				}
-			}
-
-			if errors.Is(err, tt.wantNotErr) {
-				t.Errorf("Fetch() error = %v, must not be %v", err, tt.wantNotErr)
-			}
-		})
-	}
-}
-
-// TestFetchAddressLookupTimedOut checks that a fetch whose address lookup
-// times out fails with ErrUpstreamTimeout, both for the lookup of the source
-// host and for the lookup while connecting. The error must match neither
-// ErrInvalidHost nor ErrUpstreamRequestFailed, which the image routes answer
-// 502. A context whose deadline has passed makes the lookup time out.
-func TestFetchAddressLookupTimedOut(t *testing.T) {
-	t.Parallel()
-
-	checkTimedOut := func(t *testing.T, err error) {
-		t.Helper()
-		t.Logf("Fetch() error: %v", err)
-
-		if !errors.Is(err, ErrUpstreamTimeout) {
-			t.Errorf("Fetch() error = %v, want ErrUpstreamTimeout", err)
-		}
-
-		if errors.Is(err, ErrInvalidHost) || errors.Is(err, ErrUpstreamRequestFailed) {
-			t.Errorf("Fetch() error = %v, must match neither ErrInvalidHost "+
-				"nor ErrUpstreamRequestFailed", err)
-		}
-	}
-
-	t.Run("lookup of the source host", func(t *testing.T) {
-		t.Parallel()
-
-		ctx, cancel := context.WithTimeout(testContext(t), 0)
-		defer cancel()
-
-		f := New(&Config{
-			Timeout:               30 * time.Second,
-			MaxResponseSize:       50 << 20,
-			MaxConnectionsPerHost: 20,
-			MaxConnections:        64,
-		})
-
-		_, err := f.Fetch(ctx, imageSourceOn("cdn.example.com"), "", "")
-		checkTimedOut(t, err)
-	})
-
-	t.Run("lookup while connecting", func(t *testing.T) {
-		t.Parallel()
-
-		// The source host is an address, which validateURL does not look up;
-		// the dialer looks up a name
-		f := New(&Config{
-			Timeout:               30 * time.Second,
-			MaxResponseSize:       50 << 20,
-			MaxConnectionsPerHost: 20,
-			MaxConnections:        64,
-			DialContext: func(ctx context.Context, network, _ string) (net.Conn, error) {
-				ctx, cancel := context.WithTimeout(ctx, 0)
-				defer cancel()
-
-				return dialSSRFSafe(ctx, network, "img.example.com:443", nil)
-			},
-		})
-
-		_, err := f.Fetch(testContext(t), upstreamSource("/image"), "", "")
-		checkTimedOut(t, err)
-	})
-}
-
-// TestFetchConnectionTimedOut checks that a fetch whose connection in
-// dialSSRFSafe times out fails with ErrUpstreamTimeout, which the image
-// routes answer 504. The error must match neither ErrUpstreamRequestFailed
-// nor ErrInvalidHost, which they answer 502. A context whose deadline has
-// passed makes the connection time out without touching the network.
-func TestFetchConnectionTimedOut(t *testing.T) {
-	t.Parallel()
-
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-			ctx, cancel := context.WithTimeout(ctx, 0)
-			defer cancel()
-
-			return dialSSRFSafe(ctx, network, addr, nil)
-		},
-	})
-
-	_, err := f.Fetch(testContext(t), upstreamSource("/image"), "", "")
-	t.Logf("Fetch() error: %v", err)
-
-	if !errors.Is(err, ErrUpstreamTimeout) {
-		t.Errorf("Fetch() error = %v, want ErrUpstreamTimeout", err)
-	}
-
-	if errors.Is(err, ErrUpstreamRequestFailed) || errors.Is(err, ErrInvalidHost) {
-		t.Errorf("Fetch() error = %v, must match neither "+
-			"ErrUpstreamRequestFailed nor ErrInvalidHost", err)
-	}
-}
-
-// TestFetchAddressLookupCancelled checks that a fetch whose address lookup
-// its caller cancelled fails with an error matching context.Canceled, not
-// ErrInvalidHost, which the image routes answer 502.
-func TestFetchAddressLookupCancelled(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(testContext(t))
-	cancel()
-
-	f := New(&Config{
-		Timeout:               30 * time.Second,
-		MaxResponseSize:       50 << 20,
-		MaxConnectionsPerHost: 20,
-		MaxConnections:        64,
-	})
-
-	_, err := f.Fetch(ctx, imageSourceOn("cdn.example.com"), "", "")
-	t.Logf("Fetch() error: %v", err)
-
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("Fetch() error = %v, want context.Canceled", err)
-	}
-
-	if errors.Is(err, ErrInvalidHost) {
-		t.Errorf("Fetch() error = %v, must not be ErrInvalidHost", err)
-	}
-}

internal/httpfetcher/request_id_internal_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi/v5/middleware"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestFetchSendsRequestID verifies that a fetch sends the ID of the request
@@ -26,7 +25,7 @@ func TestFetchSendsRequestID(t *testing.T) {
 		func(w http.ResponseWriter, r *http.Request) {
 			received <- r.Header.Get("X-Request-Id")
 
-			w.Header().Set("Content-Type", imagerequest.FormatJPEG.MIMEType())
+			w.Header().Set("Content-Type", contentTypeJPEG)
 			_, _ = io.WriteString(w, imagePayload)
 		}))
 	t.Cleanup(srv.Close)
@@ -35,7 +34,7 @@ func TestFetchSendsRequestID(t *testing.T) {
 
 	ctx := context.WithValue(testContext(t), middleware.RequestIDKey, requestID)
 
-	res, err := f.Fetch(ctx, upstreamSource("/image"), "", "")
+	res, err := f.Fetch(ctx, upstreamURL("/image"))
 	if err != nil {
 		t.Fatalf("Fetch() error = %v", err)
 	}

internal/imageprocessor/avif_too_large_internal_test.go

@@ -6,8 +6,6 @@ import (
 	"errors"
 	"os"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_RefusesAVIFAboveMaxPixels verifies that an AVIF output
@@ -39,43 +37,31 @@ func TestImageProcessor_RefusesAVIFAboveMaxPixels(t *testing.T) {
 	tests := []struct {
 		name          string
 		input         []byte
-		sourceFormat  imagerequest.Format
-		format        imagerequest.Format
+		format        Format
 		width, height int
-		fit           imagerequest.Fit
+		fit           FitMode
 		refused       bool
 	}{
-		{"AVIF at the limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 4096, 4096, imagerequest.FitCover, false},
-		{"AVIF above the limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 4096, 4097, imagerequest.FitCover, true},
-		{"WebP above the AVIF limit", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatWebP, 4096, 4097, imagerequest.FitCover, false},
+		{"AVIF at the limit", cutOff, FormatAVIF, 4096, 4096, FitCover, false},
+		{"AVIF above the limit", cutOff, FormatAVIF, 4096, 4097, FitCover, true},
+		{"WebP above the AVIF limit", cutOff, FormatWebP, 4096, 4097, FitCover, false},
 		// FitInside does not enlarge, so the output stays 64x32
-		{"AVIF inside a larger size", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 8192, 8192, imagerequest.FitInside, false},
+		{"AVIF inside a larger size", cutOff, FormatAVIF, 8192, 8192, FitInside, false},
 		// FitOutside scales 64x32 by 128 to cover 8192x1: 8192x4096
-		{"AVIF outside a smaller size", cutOff, imagerequest.FormatPNG,
-			imagerequest.FormatAVIF, 8192, 1, imagerequest.FitOutside, true},
+		{"AVIF outside a smaller size", cutOff, FormatAVIF, 8192, 1, FitOutside, true},
 		// With no size, the output keeps the source's 4097x4096
-		{"AVIF of the source's size", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatAVIF, 0, 0, imagerequest.FitCover, true},
-		{"orig of an AVIF source", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatOriginal, 0, 0, imagerequest.FitCover, true},
-		{"JPEG of the source's size", largeAVIF, imagerequest.FormatAVIF,
-			imagerequest.FormatJPEG, 0, 0, imagerequest.FitCover, false},
+		{"AVIF of the source's size", largeAVIF, FormatAVIF, 0, 0, FitCover, true},
+		{"orig of an AVIF source", largeAVIF, FormatOriginal, 0, 0, FitCover, true},
+		{"JPEG of the source's size", largeAVIF, FormatJPEG, 0, 0, FitCover, false},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(), bytes.NewReader(tt.input), tt.sourceFormat,
-				&imagerequest.Transform{
-					Size:    imagerequest.Size{Width: tt.width, Height: tt.height},
+			_, err := New(Params{}).Process(t.Context(), bytes.NewReader(tt.input),
+				&Request{
+					Size:    Size{Width: tt.width, Height: tt.height},
 					Format:  tt.format,
 					FitMode: tt.fit,
 				})

internal/imageprocessor/computed_side_internal_test.go

@@ -4,8 +4,6 @@ import (
 	"bytes"
 	"errors"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_RefusesComputedSideAboveMaximum verifies that a size
@@ -19,17 +17,13 @@ func TestImageProcessor_RefusesComputedSideAboveMaximum(t *testing.T) {
 	tests := []struct {
 		name                    string
 		inputWidth, inputHeight int
-		size                    imagerequest.Size
+		size                    Size
 		wantErr                 error
 	}{
-		{"width at the maximum", 4096, 1,
-			imagerequest.Size{Height: 2}, nil},
-		{"width above the maximum", 4096, 1,
-			imagerequest.Size{Height: 3}, ErrOutputTooLarge},
-		{"height at the maximum", 1, 4096,
-			imagerequest.Size{Width: 2}, nil},
-		{"height above the maximum", 1, 4096,
-			imagerequest.Size{Width: 3}, ErrOutputTooLarge},
+		{"width at the maximum", 4096, 1, Size{Height: 2}, nil},
+		{"width above the maximum", 4096, 1, Size{Height: 3}, ErrOutputTooLarge},
+		{"height at the maximum", 1, 4096, Size{Width: 2}, nil},
+		{"height above the maximum", 1, 4096, Size{Width: 3}, ErrOutputTooLarge},
 	}
 
 	for _, tt := range tests {
@@ -38,16 +32,9 @@ func TestImageProcessor_RefusesComputedSideAboveMaximum(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
-				&imagerequest.Transform{
-					Size:    tt.size,
-					Format:  imagerequest.FormatJPEG,
-					FitMode: imagerequest.FitCover,
-				})
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitCover})
 			if result != nil {
 				t.Logf("Process() made %dx%d", result.Width, result.Height)
 
@@ -77,21 +64,18 @@ func TestImageProcessor_ComputedSideIsAtLeastOne(t *testing.T) {
 	tests := []struct {
 		name                    string
 		inputWidth, inputHeight int
-		size                    imagerequest.Size
+		size                    Size
 		wantWidth, wantHeight   int
 	}{
-		{"8192x1 at 100x0", 8192, 1, imagerequest.Size{Width: 100}, 100, 1},
-		{"8192x1 at 1300x0", 8192, 1, imagerequest.Size{Width: 1300}, 1300, 1},
-		{"8192x2 at 100x0", 8192, 2, imagerequest.Size{Width: 100}, 100, 1},
-		{"1x8192 at 0x100", 1, 8192, imagerequest.Size{Height: 100}, 1, 100},
-		{"1x8192 at 0x1300", 1, 8192, imagerequest.Size{Height: 1300}, 1, 1300},
-		{"2x8192 at 0x100", 2, 8192, imagerequest.Size{Height: 100}, 1, 100},
+		{"8192x1 at 100x0", 8192, 1, Size{Width: 100}, 100, 1},
+		{"8192x1 at 1300x0", 8192, 1, Size{Width: 1300}, 1300, 1},
+		{"8192x2 at 100x0", 8192, 2, Size{Width: 100}, 100, 1},
+		{"1x8192 at 0x100", 1, 8192, Size{Height: 100}, 1, 100},
+		{"1x8192 at 0x1300", 1, 8192, Size{Height: 1300}, 1, 1300},
+		{"2x8192 at 0x100", 2, 8192, Size{Height: 100}, 1, 100},
 	}
 
-	fits := []imagerequest.Fit{
-		imagerequest.FitCover, imagerequest.FitContain, imagerequest.FitFill,
-		imagerequest.FitInside, imagerequest.FitOutside,
-	}
+	fits := []FitMode{FitCover, FitContain, FitFill, FitInside, FitOutside}
 
 	for _, tt := range tests {
 		for _, fit := range fits {
@@ -107,16 +91,9 @@ func TestImageProcessor_ComputedSideIsAtLeastOne(t *testing.T) {
 
 				input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-				result, err := New(Params{
-					MaxInputBytes:           50 << 20,
-					MaxConcurrentProcessing: 1,
-				}).Process(t.Context(),
-					bytes.NewReader(input), imagerequest.FormatJPEG,
-					&imagerequest.Transform{
-						Size:    tt.size,
-						Format:  imagerequest.FormatJPEG,
-						FitMode: fit,
-					})
+				result, err := New(Params{}).Process(t.Context(),
+					bytes.NewReader(input),
+					&Request{Size: tt.size, Format: FormatJPEG, FitMode: fit})
 				if err != nil {
 					t.Fatalf("Process() error = %v", err)
 				}
@@ -126,14 +103,14 @@ func TestImageProcessor_ComputedSideIsAtLeastOne(t *testing.T) {
 				t.Logf("Process() made %dx%d", result.Width, result.Height)
 
 				ok := result.Width == tt.wantWidth && result.Height == tt.wantHeight
-				if fit == imagerequest.FitOutside {
+				if fit == FitOutside {
 					ok = result.Width >= tt.wantWidth && result.Height >= tt.wantHeight
 				}
 
 				if !ok {
 					t.Errorf("Process() made %dx%d, want %dx%d (at least, for %s)",
 						result.Width, result.Height, tt.wantWidth, tt.wantHeight,
-						imagerequest.FitOutside)
+						FitOutside)
 				}
 			})
 		}

internal/imageprocessor/deadline_internal_test.go

@@ -7,8 +7,6 @@ import (
 	"io"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // readerAfterDeadline is a Process input whose first Read waits until done
@@ -86,10 +84,9 @@ func checkProcessStopsAtDeadline(
 ) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxConcurrentProcessing: 1})
 
-	result, err := proc.Process(ctx, input, imagerequest.FormatJPEG,
-		smallJPEGTransform())
+	result, err := proc.Process(ctx, input, smallJPEGRequest())
 	if result != nil {
 		t.Logf("Process() made a %dx%d image after its deadline passed",
 			result.Width, result.Height)

internal/imageprocessor/empty_format_internal_test.go

@@ -4,8 +4,6 @@ import (
 	"bytes"
 	"errors"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_EmptyFormatRefused verifies that a request with no format
@@ -14,12 +12,8 @@ import (
 func TestImageProcessor_EmptyFormatRefused(t *testing.T) {
 	t.Parallel()
 
-	_, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		t.Context(), bytes.NewReader(createTestJPEG(t, 20, 20)),
-		imagerequest.FormatJPEG, &imagerequest.Transform{},
+	_, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(createTestJPEG(t, 20, 20)), &Request{},
 	)
 	if !errors.Is(err, ErrUnsupportedOutputFormat) {
 		t.Errorf("Process() error = %v, want %v", err, ErrUnsupportedOutputFormat)

internal/imageprocessor/encoder_settings_internal_test.go

@@ -8,21 +8,14 @@ import (
 	"testing"
 
 	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
-// processedSize runs input, an image in sourceFormat, through Process and
-// returns the output's size in bytes.
-func processedSize(
-	t *testing.T, input []byte, sourceFormat imagerequest.Format,
-	transform *imagerequest.Transform,
-) int64 {
+// processedSize runs input through Process and returns the output's size in
+// bytes.
+func processedSize(t *testing.T, input []byte, req *Request) int64 {
 	t.Helper()
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(t.Context(), bytes.NewReader(input), sourceFormat, transform)
+	result, err := New(Params{}).Process(t.Context(), bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -75,8 +68,7 @@ func TestImageProcessor_PNGIsCompressed(t *testing.T) {
 		}
 	}
 
-	size := processedSize(t, encodePNG(t, flat), imagerequest.FormatPNG,
-		&imagerequest.Transform{Format: imagerequest.FormatPNG})
+	size := processedSize(t, encodePNG(t, flat), &Request{Format: FormatPNG})
 
 	const rawBytes = width * height * 3
 	if size > rawBytes/10 {
@@ -93,8 +85,7 @@ func TestImageProcessor_WebPAtEffort2(t *testing.T) {
 
 	input := createTestJPEG(t, 200, 150)
 
-	size := processedSize(t, input, imagerequest.FormatJPEG,
-		&imagerequest.Transform{Format: imagerequest.FormatWebP, Quality: 85})
+	size := processedSize(t, input, &Request{Format: FormatWebP, Quality: 85})
 
 	want, _, err := decode(t, input).ExportWebp(&vips.WebpExportParams{
 		StripMetadata:   true,
@@ -135,8 +126,7 @@ func TestImageProcessor_AVIFAtEffort1(t *testing.T) {
 
 	input := encodePNG(t, source)
 
-	size := processedSize(t, input, imagerequest.FormatPNG,
-		&imagerequest.Transform{Format: imagerequest.FormatAVIF, Quality: 85})
+	size := processedSize(t, input, &Request{Format: FormatAVIF, Quality: 85})
 
 	want, _, err := decode(t, input).ExportAvif(&vips.AvifExportParams{
 		StripMetadata: true,
@@ -162,8 +152,7 @@ func TestImageProcessor_JPEGXLAtEffort4(t *testing.T) {
 
 	input := createTestJPEG(t, 200, 150)
 
-	size := processedSize(t, input, imagerequest.FormatJPEG,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL, Quality: 85})
+	size := processedSize(t, input, &Request{Format: FormatJXL, Quality: 85})
 
 	params := vips.NewJxlExportParams()
 	params.Quality = 85

internal/imageprocessor/fit_cover_internal_test.go

@@ -7,8 +7,6 @@ import (
 	"image/png"
 	"math"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_FitCoverServesThinSource verifies that FitCover serves
@@ -22,12 +20,12 @@ func TestImageProcessor_FitCoverServesThinSource(t *testing.T) {
 	tests := []struct {
 		name                    string
 		inputWidth, inputHeight int
-		size                    imagerequest.Size
+		size                    Size
 	}{
-		{"8192x1 at 8192x8192", 8192, 1, imagerequest.Size{Width: 8192, Height: 8192}},
-		{"8192x1 at 1x8192", 8192, 1, imagerequest.Size{Width: 1, Height: 8192}},
-		{"1x8192 at 8192x8192", 1, 8192, imagerequest.Size{Width: 8192, Height: 8192}},
-		{"1x8192 at 8192x1", 1, 8192, imagerequest.Size{Width: 8192, Height: 1}},
+		{"8192x1 at 8192x8192", 8192, 1, Size{Width: 8192, Height: 8192}},
+		{"8192x1 at 1x8192", 8192, 1, Size{Width: 1, Height: 8192}},
+		{"1x8192 at 8192x8192", 1, 8192, Size{Width: 8192, Height: 8192}},
+		{"1x8192 at 8192x1", 1, 8192, Size{Width: 8192, Height: 1}},
 	}
 
 	for _, tt := range tests {
@@ -36,16 +34,9 @@ func TestImageProcessor_FitCoverServesThinSource(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
-				&imagerequest.Transform{
-					Size:    tt.size,
-					Format:  imagerequest.FormatJPEG,
-					FitMode: imagerequest.FitCover,
-				})
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitCover})
 			if err != nil {
 				t.Fatalf("Process() error = %v", err)
 			}
@@ -109,15 +100,12 @@ func TestImageProcessor_FitCoverCropsTheCentre(t *testing.T) {
 
 			input := createBandsPNG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatPNG,
-				&imagerequest.Transform{
-					Size:    imagerequest.Size{Width: 50, Height: 50},
-					Format:  imagerequest.FormatPNG,
-					FitMode: imagerequest.FitCover,
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{
+					Size:    Size{Width: 50, Height: 50},
+					Format:  FormatPNG,
+					FitMode: FitCover,
 				})
 			if err != nil {
 				t.Fatalf("Process() error = %v", err)
@@ -220,14 +208,14 @@ func TestImageProcessor_FitCoverKeepsProportions(t *testing.T) {
 	tests := []struct {
 		name             string
 		side, squareSide int
-		size             imagerequest.Size
+		size             Size
 	}{
-		{"16x16 at 100x60", 16, 8, imagerequest.Size{Width: 100, Height: 60}},
-		{"16x16 at 60x100", 16, 8, imagerequest.Size{Width: 60, Height: 100}},
-		{"10x10 at 100x35", 10, 2, imagerequest.Size{Width: 100, Height: 35}},
-		{"10x10 at 35x100", 10, 2, imagerequest.Size{Width: 35, Height: 100}},
-		{"64x64 at 300x100", 64, 16, imagerequest.Size{Width: 300, Height: 100}},
-		{"64x64 at 100x300", 64, 16, imagerequest.Size{Width: 100, Height: 300}},
+		{"16x16 at 100x60", 16, 8, Size{Width: 100, Height: 60}},
+		{"16x16 at 60x100", 16, 8, Size{Width: 60, Height: 100}},
+		{"10x10 at 100x35", 10, 2, Size{Width: 100, Height: 35}},
+		{"10x10 at 35x100", 10, 2, Size{Width: 35, Height: 100}},
+		{"64x64 at 300x100", 64, 16, Size{Width: 300, Height: 100}},
+		{"64x64 at 100x300", 64, 16, Size{Width: 100, Height: 300}},
 	}
 
 	for _, tt := range tests {
@@ -236,16 +224,9 @@ func TestImageProcessor_FitCoverKeepsProportions(t *testing.T) {
 
 			input := createSquarePNG(t, tt.side, tt.squareSide)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatPNG,
-				&imagerequest.Transform{
-					Size:    tt.size,
-					Format:  imagerequest.FormatPNG,
-					FitMode: imagerequest.FitCover,
-				})
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatPNG, FitMode: FitCover})
 			if err != nil {
 				t.Fatalf("Process() error = %v", err)
 			}

internal/imageprocessor/fit_outside_internal_test.go

@@ -4,8 +4,6 @@ import (
 	"bytes"
 	"errors"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_RefusesFitOutsideAboveMaximum verifies that FitOutside,
@@ -19,20 +17,15 @@ func TestImageProcessor_RefusesFitOutsideAboveMaximum(t *testing.T) {
 	tests := []struct {
 		name                    string
 		inputWidth, inputHeight int
-		size                    imagerequest.Size
+		size                    Size
 		// wantWidth and wantHeight are the output's, 0 for a refusal
 		wantWidth, wantHeight int
 	}{
-		{"width above the maximum", 3000, 600,
-			imagerequest.Size{Width: 1, Height: 8192}, 0, 0},
-		{"height above the maximum", 600, 3000,
-			imagerequest.Size{Width: 8192, Height: 1}, 0, 0},
-		{"width at the maximum", 1024, 256,
-			imagerequest.Size{Width: 1, Height: 2048}, 8192, 2048},
-		{"height at the maximum", 256, 1024,
-			imagerequest.Size{Width: 2048, Height: 1}, 2048, 8192},
-		{"within the maximum", 3000, 600,
-			imagerequest.Size{Width: 1, Height: 1200}, 6000, 1200},
+		{"width above the maximum", 3000, 600, Size{Width: 1, Height: 8192}, 0, 0},
+		{"height above the maximum", 600, 3000, Size{Width: 8192, Height: 1}, 0, 0},
+		{"width at the maximum", 1024, 256, Size{Width: 1, Height: 2048}, 8192, 2048},
+		{"height at the maximum", 256, 1024, Size{Width: 2048, Height: 1}, 2048, 8192},
+		{"within the maximum", 3000, 600, Size{Width: 1, Height: 1200}, 6000, 1200},
 	}
 
 	for _, tt := range tests {
@@ -41,16 +34,9 @@ func TestImageProcessor_RefusesFitOutsideAboveMaximum(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
-				&imagerequest.Transform{
-					Size:    tt.size,
-					Format:  imagerequest.FormatJPEG,
-					FitMode: imagerequest.FitOutside,
-				})
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitOutside})
 			if result != nil {
 				t.Logf("Process() made %dx%d", result.Width, result.Height)
 			}
@@ -85,11 +71,11 @@ func TestImageProcessor_FitOutsideSideIsAtLeastOne(t *testing.T) {
 	tests := []struct {
 		name                    string
 		inputWidth, inputHeight int
-		size                    imagerequest.Size
+		size                    Size
 		wantWidth, wantHeight   int
 	}{
-		{"49x8192 at 0x100", 49, 8192, imagerequest.Size{Height: 100}, 1, 167},
-		{"49x49 at 1x1", 49, 49, imagerequest.Size{Width: 1, Height: 1}, 1, 1},
+		{"49x8192 at 0x100", 49, 8192, Size{Height: 100}, 1, 167},
+		{"49x49 at 1x1", 49, 49, Size{Width: 1, Height: 1}, 1, 1},
 	}
 
 	for _, tt := range tests {
@@ -98,16 +84,9 @@ func TestImageProcessor_FitOutsideSideIsAtLeastOne(t *testing.T) {
 
 			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
 
-			result, err := New(Params{
-				MaxInputBytes:           50 << 20,
-				MaxConcurrentProcessing: 1,
-			}).Process(t.Context(),
-				bytes.NewReader(input), imagerequest.FormatJPEG,
-				&imagerequest.Transform{
-					Size:    tt.size,
-					Format:  imagerequest.FormatJPEG,
-					FitMode: imagerequest.FitOutside,
-				})
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitOutside})
 			if err != nil {
 				t.Fatalf("Process() error = %v", err)
 			}

internal/imageprocessor/imageprocessor.go

@@ -1,7 +1,4 @@
 // Package imageprocessor provides image format conversion and resizing using libvips.
-// It reads the size of an SVG source and renders it in child processes, each
-// the running program started again (see RunAsSVGChildProcess). pixa kills
-// them after SVGRenderTimeout, and each may use at most MaxSVGRenderMemory.
 package imageprocessor
 
 import (
@@ -10,13 +7,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math"
-	"strconv"
 	"sync"
 	"time"
 
 	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
+	"sneak.berlin/go/pixa/internal/config"
 )
 
 // vipsOnce ensures vips is initialized exactly once.
@@ -59,6 +54,49 @@ func CheckJPEGXLSupport() error {
 	return nil
 }
 
+// Format represents supported output image formats.
+type Format string
+
+// Supported image output formats.
+const (
+	FormatOriginal Format = "orig"
+	FormatJPEG     Format = "jpeg"
+	FormatPNG      Format = "png"
+	FormatWebP     Format = "webp"
+	FormatAVIF     Format = "avif"
+	FormatJXL      Format = "jxl"
+	FormatGIF      Format = "gif"
+)
+
+// FitMode represents how to fit an image into requested dimensions.
+type FitMode string
+
+// Supported image fit modes.
+const (
+	FitCover   FitMode = "cover"
+	FitContain FitMode = "contain"
+	FitFill    FitMode = "fill"
+	FitInside  FitMode = "inside"
+	FitOutside FitMode = "outside"
+)
+
+// ErrInvalidFitMode is returned when an invalid fit mode is provided.
+var ErrInvalidFitMode = errors.New("invalid fit mode")
+
+// Size represents requested image dimensions.
+type Size struct {
+	Width  int
+	Height int
+}
+
+// Request holds the parameters for image processing.
+type Request struct {
+	Size    Size
+	Format  Format
+	Quality int
+	FitMode FitMode
+}
+
 // Result contains the output of image processing.
 type Result struct {
 	// Content is the processed image data.
@@ -75,12 +113,18 @@ type Result struct {
 	InputWidth int
 	// InputHeight is the original image height before processing.
 	InputHeight int
+	// InputFormat is the detected input format (e.g., "jpeg", "png").
+	InputFormat string
 }
 
 // MaxInputDimension is the maximum allowed width or height for input images.
 // Images larger than this are rejected to prevent DoS via decompression bombs.
 const MaxInputDimension = 8192
 
+// DefaultMaxInputBytes is the default maximum input size in bytes (50 MiB).
+// This matches the default upstream fetcher limit.
+const DefaultMaxInputBytes = 50 << 20
+
 // ErrInputTooLarge is returned when input image dimensions exceed MaxInputDimension.
 var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 
@@ -89,8 +133,8 @@ var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
 
 // MaxOutputDimension is the maximum width or height of an output image, and
-// so of a requested size (imagerequest.MaxDimension).
-const MaxOutputDimension = imagerequest.MaxDimension
+// so of a requested size (imgcache.MaxDimension).
+const MaxOutputDimension = 8192
 
 // ErrOutputTooLarge is returned, before resizing, when the output would have a
 // side above MaxOutputDimension: the side of a size with one side 0, computed
@@ -116,45 +160,11 @@ var ErrAVIFOutputTooLarge = errors.New("AVIF output has too many pixels")
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
 
 // ErrUnsupportedInputFormat is returned, before the input is decoded, when
-// libvips reads the input's first bytes as another format than its source
-// format, or as none. An SVG whose first bytes pass the first-bytes check for
-// AVIF is one example. A source format other than the seven pixa reads is
-// also refused with it.
+// libvips reads the input's first bytes as another format than the source
+// formats, or as none: for example an SVG whose first bytes pass the
+// first-bytes check for AVIF.
 var ErrUnsupportedInputFormat = errors.New("unsupported input format")
 
-// ErrSVGNotOriginalSize is returned when orig is asked of an SVG source at a
-// size other than orig. pixa returns an SVG only as it is; a raster format
-// gives it a size.
-var ErrSVGNotOriginalSize = errors.New(
-	"an SVG is returned as SVG only at the orig size")
-
-// ErrSVGTooThin is returned, before rendering, when an SVG source has one
-// side more than MaxInputDimension times the other. Rendered with its longer
-// side at most MaxInputDimension, its shorter side would be under 1 pixel.
-var ErrSVGTooThin = errors.New("SVG source too thin to render")
-
-// ErrSVGTooLargeForOrigSize is returned, before rendering, when a format other
-// than orig asks for an SVG source at the orig size and the SVG has a side
-// above MaxOutputDimension.
-var ErrSVGTooLargeForOrigSize = errors.New(
-	"SVG source too large to render at its own size")
-
-// SVGRenderTimeout is how long the child processes that read the size of one
-// SVG source and render it may run, counted from the start of the first,
-// before pixa kills them.
-const SVGRenderTimeout = 20 * time.Second
-
-// MaxSVGRenderMemory is the most memory, in bytes, that each child process
-// reading the size of an SVG source or rendering it may use. It is the
-// child's RLIMIT_DATA, which limits its heap and its other private writable
-// memory.
-const MaxSVGRenderMemory = 1 << 30 // 1 GiB
-
-// ErrSVGRenderFailed is returned when a child process fails to read the size
-// of an SVG source or to render it: librsvg cannot read the SVG, or the
-// child takes more than SVGRenderTimeout or MaxSVGRenderMemory.
-var ErrSVGRenderFailed = errors.New("SVG source could not be rendered")
-
 // ErrTooManyImages is returned when MaxConcurrentProcessing images are being
 // processed and none finishes within ProcessingWaitTimeout.
 var ErrTooManyImages = errors.New("too many images being processed at once")
@@ -172,51 +182,53 @@ type ImageProcessor struct {
 	processingSemaphore chan struct{}
 	// processingWaitTimeout is ProcessingWaitTimeout; tests shorten it.
 	processingWaitTimeout time.Duration
-	// svgRenderTimeout is SVGRenderTimeout; tests shorten it.
-	svgRenderTimeout time.Duration
-	// maxSVGRenderMemory is MaxSVGRenderMemory; tests lower it.
-	maxSVGRenderMemory int
 }
 
-// Params holds configuration for creating an ImageProcessor. Both fields
-// must be at least 1.
+// Params holds configuration for creating an ImageProcessor.
+// Zero values use sensible defaults (MaxInputBytes defaults to DefaultMaxInputBytes).
 type Params struct {
 	// MaxInputBytes is the maximum allowed input size in bytes.
+	// If <= 0, DefaultMaxInputBytes is used.
 	MaxInputBytes int64
 	// MaxConcurrentProcessing is the most images processed at once.
+	// If <= 0, config.DefaultMaxConcurrentProcessing() is used.
 	MaxConcurrentProcessing int
 }
 
 // New creates a new image processor with the given parameters.
+// A zero-value Params{} uses sensible defaults.
 func New(params Params) *ImageProcessor {
 	initVips()
 
+	maxInputBytes := params.MaxInputBytes
+	if maxInputBytes <= 0 {
+		maxInputBytes = DefaultMaxInputBytes
+	}
+
+	maxConcurrentProcessing := params.MaxConcurrentProcessing
+	if maxConcurrentProcessing <= 0 {
+		maxConcurrentProcessing = config.DefaultMaxConcurrentProcessing()
+	}
+
 	return &ImageProcessor{
-		maxInputBytes:         params.MaxInputBytes,
-		processingSemaphore:   make(chan struct{}, params.MaxConcurrentProcessing),
+		maxInputBytes:         maxInputBytes,
+		processingSemaphore:   make(chan struct{}, maxConcurrentProcessing),
 		processingWaitTimeout: ProcessingWaitTimeout,
-		svgRenderTimeout:      SVGRenderTimeout,
-		maxSVGRenderMemory:    MaxSVGRenderMemory,
 	}
 }
 
-// Process transforms the image read from input according to transform.
-// sourceFormat is the input's format, which magic detected from its first
-// bytes. When MaxConcurrentProcessing images are already being processed,
-// it waits up to ProcessingWaitTimeout for one to finish, then fails with
+// Process transforms an image according to the request. When
+// MaxConcurrentProcessing images are already being processed, it waits up
+// to ProcessingWaitTimeout for one to finish, then fails with
 // ErrTooManyImages. When ctx has ended once Process has a slot, or before it
 // encodes, it returns ctx's error and gives the slot back. govips gives pixa
 // no way to stop libvips once an encode has begun, so an encode keeps its
 // slot until it finishes. An AVIF output of more than MaxAVIFOutputPixels is
-// refused with ErrAVIFOutputTooLarge before anything is decoded. orig of an
-// SVG source is the SVG as it is, since libvips cannot save SVG; any other
-// format renders it at the output size. Child processes read an SVG's size
-// and render it, as processSVG describes.
+// refused with ErrAVIFOutputTooLarge before anything is decoded.
 func (p *ImageProcessor) Process(
 	ctx context.Context,
 	input io.Reader,
-	sourceFormat imagerequest.Format,
-	transform *imagerequest.Transform,
+	req *Request,
 ) (*Result, error) {
 	release, err := p.acquireSlot(ctx)
 	if err != nil {
@@ -230,44 +242,169 @@ func (p *ImageProcessor) Process(
 		return nil, err
 	}
 
-	if sourceFormat == imagerequest.FormatSVG {
-		return p.processSVG(ctx, data, transform)
-	}
+	// govips picks the libvips loader from the input's first bytes with
+	// DetermineImageType. Input whose first bytes it reads as no source
+	// format, such as SVG, which librsvg would render, is refused before
+	// libvips reads it.
+	inputFormat := p.detectFormat(vips.DetermineImageType(data))
 
-	img, err := loadImage(data, sourceFormat)
+	sourceFormat, err := p.formatFromString(inputFormat)
 	if err != nil {
 		return nil, err
 	}
+
+	// Decode image
+	img, err := vips.NewImageFromBuffer(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode image: %w", err)
+	}
 	defer img.Close()
 
-	origWidth, origHeight := img.Width(), img.Height()
-	outputFormat := resolveOutputFormat(transform.Format, sourceFormat)
+	// Turn the image upright now: encode strips the EXIF orientation tag,
+	// and sizes below must be worked out on the upright image.
+	err = img.AutoRotate()
+	if err != nil {
+		return nil, fmt.Errorf("failed to auto-rotate: %w", err)
+	}
+
+	// Get original dimensions
+	origWidth := img.Width()
+	origHeight := img.Height()
+
+	// Validate input dimensions to prevent DoS via decompression bombs
+	if origWidth > MaxInputDimension || origHeight > MaxInputDimension {
+		return nil, ErrInputTooLarge
+	}
 
 	// Determine target dimensions; too large ones are refused before resizing
-	targetWidth, targetHeight, err := targetDimensions(transform.Size,
-		origWidth, origHeight)
+	targetWidth, targetHeight, err := targetDimensions(req.Size, origWidth, origHeight)
 	if err != nil {
 		return nil, err
 	}
 
+	// orig is the source's own format; encode refuses an empty format
+	outputFormat := req.Format
+	if outputFormat == FormatOriginal {
+		outputFormat = sourceFormat
+	}
+
 	// Determine output dimensions; too large ones are refused before
 	// resizing, which with FitCover already decodes the input
 	outputWidth, outputHeight, err := outputDimensions(origWidth, origHeight,
-		targetWidth, targetHeight, transform.FitMode, outputFormat)
+		targetWidth, targetHeight, req.FitMode, outputFormat)
 	if err != nil {
 		return nil, err
 	}
 
 	// Resize if needed
 	if targetWidth != origWidth || targetHeight != origHeight {
-		err := p.resize(img, outputWidth, outputHeight, transform.FitMode)
+		err := p.resize(img, outputWidth, outputHeight, req.FitMode)
 		if err != nil {
 			return nil, fmt.Errorf("failed to resize: %w", err)
 		}
 	}
 
-	return p.encodeResult(ctx, img, outputFormat, transform.Quality,
-		origWidth, origHeight)
+	// Encode to target format
+	output, err := p.encode(ctx, img, outputFormat, req.Quality)
+	if err != nil {
+		return nil, fmt.Errorf("failed to encode: %w", err)
+	}
+
+	return &Result{
+		Content:       io.NopCloser(bytes.NewReader(output)),
+		ContentLength: int64(len(output)),
+		ContentType:   FormatToMIME(outputFormat),
+		Width:         img.Width(),
+		Height:        img.Height(),
+		InputWidth:    origWidth,
+		InputHeight:   origHeight,
+		InputFormat:   inputFormat,
+	}, nil
+}
+
+// targetDimensions calculates the output dimensions for a requested size,
+// scaling proportionally when only one dimension is given and keeping the
+// original dimensions when both are zero. A side scaled proportionally is
+// rounded down but kept at 1 or more, as for a thin image it would round
+// down to 0, a side of no pixels. It can come out above MaxOutputDimension,
+// which is ErrOutputTooLarge.
+func targetDimensions(size Size, origWidth, origHeight int) (int, int, error) {
+	width, height := size.Width, size.Height
+
+	switch {
+	case width == 0 && height == 0:
+		// Both are 0: keep original size
+		return origWidth, origHeight, nil
+	case width == 0:
+		// Only height specified: calculate width proportionally
+		width = max(1, origWidth*height/origHeight)
+	case height == 0:
+		// Only width specified: calculate height proportionally
+		height = max(1, origHeight*width/origWidth)
+	}
+
+	if width > MaxOutputDimension || height > MaxOutputDimension {
+		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+			width, height, MaxOutputDimension)
+	}
+
+	return width, height, nil
+}
+
+// MIME types for the supported image formats.
+const (
+	mimeJPEG = "image/jpeg"
+	mimePNG  = "image/png"
+	mimeGIF  = "image/gif"
+	mimeWebP = "image/webp"
+	mimeAVIF = "image/avif"
+	mimeJXL  = "image/jxl"
+)
+
+// SupportedInputFormats returns MIME types this processor can read.
+func (p *ImageProcessor) SupportedInputFormats() []string {
+	return []string{
+		mimeJPEG,
+		mimePNG,
+		mimeGIF,
+		mimeWebP,
+		mimeAVIF,
+		mimeJXL,
+	}
+}
+
+// SupportedOutputFormats returns formats this processor can write.
+func (p *ImageProcessor) SupportedOutputFormats() []Format {
+	return []Format{
+		FormatJPEG,
+		FormatPNG,
+		FormatGIF,
+		FormatWebP,
+		FormatAVIF,
+		FormatJXL,
+	}
+}
+
+// FormatToMIME converts a Format to its MIME type string.
+func FormatToMIME(format Format) string {
+	switch format {
+	case FormatJPEG:
+		return mimeJPEG
+	case FormatPNG:
+		return mimePNG
+	case FormatWebP:
+		return mimeWebP
+	case FormatGIF:
+		return mimeGIF
+	case FormatAVIF:
+		return mimeAVIF
+	case FormatJXL:
+		return mimeJXL
+	case FormatOriginal:
+		return "application/octet-stream"
+	default:
+		return "application/octet-stream"
+	}
 }
 
 // WaitForProcessing waits until no image is being processed, or until ctx
@@ -295,242 +432,6 @@ func (p *ImageProcessor) WaitForProcessing(ctx context.Context) int {
 	return 0
 }
 
-// processSVG is Process for an SVG source, data. Apart from the first-bytes
-// check, pixad hands the SVG to libvips only in child processes (see
-// runSVGChildProcess). One reads the SVG's size. For a raster format a second
-// renders it as PNG, which is then resized and encoded as any other image.
-// pixa kills them once svgRenderTimeout has passed since the first one
-// started.
-func (p *ImageProcessor) processSVG(
-	ctx context.Context, data []byte, transform *imagerequest.Transform,
-) (*Result, error) {
-	err := checkInputFormat(data, imagerequest.FormatSVG)
-	if err != nil {
-		return nil, err
-	}
-
-	deadline := time.Now().Add(p.svgRenderTimeout)
-
-	origWidth, origHeight, err := p.readSVGSize(ctx, deadline, data)
-	if err != nil {
-		return nil, err
-	}
-
-	outputFormat := resolveOutputFormat(transform.Format, imagerequest.FormatSVG)
-	if outputFormat == imagerequest.FormatSVG {
-		return svgAsItIs(data, transform.Size, origWidth, origHeight)
-	}
-
-	err = checkSVGOrigSize(transform.Size, origWidth, origHeight)
-	if err != nil {
-		return nil, err
-	}
-
-	targetWidth, targetHeight, err := targetDimensions(transform.Size,
-		origWidth, origHeight)
-	if err != nil {
-		return nil, err
-	}
-
-	outputWidth, outputHeight, err := outputDimensions(origWidth, origHeight,
-		targetWidth, targetHeight, transform.FitMode, outputFormat)
-	if err != nil {
-		return nil, err
-	}
-
-	// The SVG is rendered at about the output size, to stay sharp
-	img, err := p.renderSVG(ctx, deadline, data, origWidth, origHeight,
-		outputWidth, outputHeight)
-	if err != nil {
-		return nil, err
-	}
-	defer img.Close()
-
-	if targetWidth != origWidth || targetHeight != origHeight {
-		err := p.resize(img, outputWidth, outputHeight, transform.FitMode)
-		if err != nil {
-			return nil, fmt.Errorf("failed to resize: %w", err)
-		}
-	}
-
-	return p.encodeResult(ctx, img, outputFormat, transform.Quality,
-		origWidth, origHeight)
-}
-
-// encodeResult encodes img as format at quality and returns it as the result
-// for a source of origWidth x origHeight.
-func (p *ImageProcessor) encodeResult(
-	ctx context.Context, img *vips.ImageRef, format imagerequest.Format,
-	quality, origWidth, origHeight int,
-) (*Result, error) {
-	output, err := p.encode(ctx, img, format, quality)
-	if err != nil {
-		return nil, fmt.Errorf("failed to encode: %w", err)
-	}
-
-	return &Result{
-		Content:       io.NopCloser(bytes.NewReader(output)),
-		ContentLength: int64(len(output)),
-		ContentType:   format.MIMEType(),
-		Width:         img.Width(),
-		Height:        img.Height(),
-		InputWidth:    origWidth,
-		InputHeight:   origHeight,
-	}, nil
-}
-
-// targetDimensions calculates the output dimensions for a requested size,
-// scaling proportionally when only one dimension is given and keeping the
-// original dimensions when both are zero. A side scaled proportionally is
-// rounded down but kept at 1 or more, as for a thin image it would round
-// down to 0, a side of no pixels. It can come out above MaxOutputDimension,
-// which is ErrOutputTooLarge.
-func targetDimensions(
-	size imagerequest.Size, origWidth, origHeight int,
-) (int, int, error) {
-	width, height := size.Width, size.Height
-
-	switch {
-	case width == 0 && height == 0:
-		// Both are 0: keep original size
-		return origWidth, origHeight, nil
-	case width == 0:
-		// Only height specified: calculate width proportionally
-		width = max(1, origWidth*height/origHeight)
-	case height == 0:
-		// Only width specified: calculate height proportionally
-		height = max(1, origHeight*width/origWidth)
-	}
-
-	if width > MaxOutputDimension || height > MaxOutputDimension {
-		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
-			width, height, MaxOutputDimension)
-	}
-
-	return width, height, nil
-}
-
-// resolveOutputFormat returns the format of the output for the requested
-// format: sourceFormat for orig, and format itself for any other. encode
-// refuses an empty format.
-func resolveOutputFormat(
-	format, sourceFormat imagerequest.Format,
-) imagerequest.Format {
-	if format == imagerequest.FormatOriginal {
-		return sourceFormat
-	}
-
-	return format
-}
-
-// loadImage refuses data that libvips would not load as sourceFormat, then
-// decodes it and turns the image upright: encode strips the EXIF orientation
-// tag, and sizes must be worked out on the upright image. An image with a
-// side above MaxInputDimension is ErrInputTooLarge, which guards against
-// decompression bombs.
-func loadImage(
-	data []byte, sourceFormat imagerequest.Format,
-) (*vips.ImageRef, error) {
-	err := checkInputFormat(data, sourceFormat)
-	if err != nil {
-		return nil, err
-	}
-
-	img, err := vips.NewImageFromBuffer(data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to decode image: %w", err)
-	}
-
-	err = img.AutoRotate()
-	if err != nil {
-		img.Close()
-
-		return nil, fmt.Errorf("failed to auto-rotate: %w", err)
-	}
-
-	if img.Width() > MaxInputDimension || img.Height() > MaxInputDimension {
-		img.Close()
-
-		return nil, ErrInputTooLarge
-	}
-
-	return img, nil
-}
-
-// svgAsItIs returns the SVG data unchanged, which is orig of an SVG source
-// at the orig size. width x height is the SVG's own size. Any other size is
-// ErrSVGNotOriginalSize.
-func svgAsItIs(
-	data []byte, size imagerequest.Size, width, height int,
-) (*Result, error) {
-	if !size.OriginalSize() {
-		return nil, fmt.Errorf("%w: asked for %dx%d", ErrSVGNotOriginalSize,
-			size.Width, size.Height)
-	}
-
-	return &Result{
-		Content:       io.NopCloser(bytes.NewReader(data)),
-		ContentLength: int64(len(data)),
-		ContentType:   imagerequest.FormatSVG.MIMEType(),
-		Width:         width,
-		Height:        height,
-		InputWidth:    width,
-		InputHeight:   height,
-	}, nil
-}
-
-// checkSVGOrigSize returns ErrSVGTooLargeForOrigSize when size is the orig
-// size and the SVG source, of width x height, has a side above
-// MaxOutputDimension. processSVG calls it after returning orig of the SVG, so
-// the SVG would be rendered at its own size.
-func checkSVGOrigSize(size imagerequest.Size, width, height int) error {
-	if size.OriginalSize() && max(width, height) > MaxOutputDimension {
-		return fmt.Errorf("%w: %dx%d is above %d", ErrSVGTooLargeForOrigSize,
-			width, height, MaxOutputDimension)
-	}
-
-	return nil
-}
-
-// svgRenderSize returns the least size in the proportions of width x height,
-// an SVG's own size, that covers outputWidth x outputHeight, so that resize
-// hardly changes it. Neither side is above MaxInputDimension.
-func svgRenderSize(width, height, outputWidth, outputHeight int) (int, int) {
-	scale := min(
-		max(float64(outputWidth)/float64(width),
-			float64(outputHeight)/float64(height)),
-		float64(MaxInputDimension)/float64(max(width, height)))
-
-	return int(math.Round(float64(width) * scale)),
-		int(math.Round(float64(height) * scale))
-}
-
-// renderSVG renders the SVG data, whose own size is width x height, at
-// svgRenderSize for outputWidth x outputHeight, in a child process that pixa
-// kills at deadline (see runSVGChildProcess). It returns the rendered image,
-// read from the child's PNG. An SVG with one side more than
-// MaxInputDimension times the other is ErrSVGTooThin.
-func (p *ImageProcessor) renderSVG(
-	ctx context.Context, deadline time.Time, data []byte,
-	width, height, outputWidth, outputHeight int,
-) (*vips.ImageRef, error) {
-	if max(width, height) > MaxInputDimension*min(width, height) {
-		return nil, fmt.Errorf("%w: %dx%d", ErrSVGTooThin, width, height)
-	}
-
-	renderWidth, renderHeight := svgRenderSize(width, height,
-		outputWidth, outputHeight)
-
-	png, err := p.runSVGChildProcess(ctx, deadline, data,
-		renderSVGAsPNGArgument, strconv.Itoa(renderWidth),
-		strconv.Itoa(renderHeight))
-	if err != nil {
-		return nil, err
-	}
-
-	return loadImage(png, imagerequest.FormatPNG)
-}
-
 // acquireSlot takes a slot in processingSemaphore, waiting at most
 // processingWaitTimeout for one to free up, and returns the func that gives
 // it back. When ctx has ended by the time it has a slot, it gives the slot
@@ -574,51 +475,27 @@ func (p *ImageProcessor) readInput(input io.Reader) ([]byte, error) {
 	return data, nil
 }
 
-// checkInputFormat returns ErrUnsupportedInputFormat unless libvips would
-// load data with the loader of sourceFormat. govips picks the libvips loader
-// from the input's first bytes with DetermineImageType. It refuses an SVG
-// whose first bytes pass the first-bytes check for AVIF, which librsvg would
-// otherwise render.
-func checkInputFormat(data []byte, sourceFormat imagerequest.Format) error {
-	// A format with no loader, such as orig or auto, has the type govips also
-	// gives input it cannot read, which the check below would let through.
-	sourceType := vipsImageType(sourceFormat)
-	if sourceType == vips.ImageTypeUnknown {
-		return fmt.Errorf("%w: %q is not a source format",
-			ErrUnsupportedInputFormat, sourceFormat)
-	}
-
-	if vips.DetermineImageType(data) != sourceType {
-		return fmt.Errorf("%w: libvips does not read the input as %s",
-			ErrUnsupportedInputFormat, sourceFormat)
-	}
-
-	return nil
-}
-
-// vipsImageType returns the govips image type whose libvips loader reads
-// format. orig and auto stand for another format, so they have
-// vips.ImageTypeUnknown, which govips has no loader for.
-func vipsImageType(format imagerequest.Format) vips.ImageType {
-	switch format {
-	case imagerequest.FormatJPEG:
-		return vips.ImageTypeJPEG
-	case imagerequest.FormatPNG:
-		return vips.ImageTypePNG
-	case imagerequest.FormatGIF:
-		return vips.ImageTypeGIF
-	case imagerequest.FormatWebP:
-		return vips.ImageTypeWEBP
-	case imagerequest.FormatAVIF:
-		return vips.ImageTypeAVIF
-	case imagerequest.FormatJXL:
-		return vips.ImageTypeJXL
-	case imagerequest.FormatSVG:
-		return vips.ImageTypeSVG
-	case imagerequest.FormatOriginal, imagerequest.FormatAuto:
-		return vips.ImageTypeUnknown
+// detectFormat returns the format string for a govips image type.
+func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
+	switch imageType {
+	case vips.ImageTypeJPEG:
+		return "jpeg"
+	case vips.ImageTypePNG:
+		return "png"
+	case vips.ImageTypeGIF:
+		return "gif"
+	case vips.ImageTypeWEBP:
+		return "webp"
+	case vips.ImageTypeAVIF, vips.ImageTypeHEIF:
+		return string(FormatAVIF)
+	case vips.ImageTypeJXL:
+		return string(FormatJXL)
+	case vips.ImageTypeUnknown, vips.ImageTypeMagick, vips.ImageTypePDF,
+		vips.ImageTypeSVG, vips.ImageTypeTIFF, vips.ImageTypeBMP,
+		vips.ImageTypeJP2K:
+		return "unknown"
 	default:
-		return vips.ImageTypeUnknown
+		return "unknown"
 	}
 }
 
@@ -629,18 +506,17 @@ func vipsImageType(format imagerequest.Format) vips.ImageType {
 // outputDimensions returns ErrOutputTooLarge. An AVIF output of more than
 // MaxAVIFOutputPixels is ErrAVIFOutputTooLarge.
 func outputDimensions(
-	imgWidth, imgHeight, width, height int,
-	fit imagerequest.Fit, format imagerequest.Format,
+	imgWidth, imgHeight, width, height int, fit FitMode, format Format,
 ) (int, int, error) {
 	scaleW := float64(width) / float64(imgWidth)
 	scaleH := float64(height) / float64(imgHeight)
 	outputWidth, outputHeight := width, height
 
 	switch fit {
-	case imagerequest.FitCover, imagerequest.FitFill, "":
+	case FitCover, FitFill, "":
 		// Cover crops, and fill stretches, to exactly the target dimensions
 
-	case imagerequest.FitContain:
+	case FitContain:
 		// Fit within the target dimensions, maintaining aspect ratio. Scaled
 		// by the smaller scale, the short side of a thin image can round
 		// down to 0, which libvips refuses as a width, so each side is at
@@ -649,13 +525,13 @@ func outputDimensions(
 		outputWidth = max(1, int(float64(imgWidth)*scale))
 		outputHeight = max(1, int(float64(imgHeight)*scale))
 
-	case imagerequest.FitInside:
+	case FitInside:
 		// Same as contain, but only shrink
 		scale := min(scaleW, scaleH, 1)
 		outputWidth = max(1, int(float64(imgWidth)*scale))
 		outputHeight = max(1, int(float64(imgHeight)*scale))
 
-	case imagerequest.FitOutside:
+	case FitOutside:
 		// The smallest dimension fits, the other may exceed the target. A
 		// side scaled to 1 can come out just under 1 in floating point, as
 		// 49 times 1/49 does, and round down to 0, which libvips refuses as
@@ -665,7 +541,7 @@ func outputDimensions(
 		outputHeight = max(1, int(float64(imgHeight)*scale))
 
 	default:
-		return 0, 0, fmt.Errorf("%w: %s", imagerequest.ErrInvalidFitMode, fit)
+		return 0, 0, fmt.Errorf("%w: %s", ErrInvalidFitMode, fit)
 	}
 
 	// The side FitOutside scales past the target is held to the maximum too
@@ -674,8 +550,7 @@ func outputDimensions(
 			outputWidth, outputHeight, MaxOutputDimension)
 	}
 
-	if format == imagerequest.FormatAVIF &&
-		outputWidth*outputHeight > MaxAVIFOutputPixels {
+	if format == FormatAVIF && outputWidth*outputHeight > MaxAVIFOutputPixels {
 		return 0, 0, fmt.Errorf("%w: %dx%d is above %d pixels",
 			ErrAVIFOutputTooLarge, outputWidth, outputHeight, MaxAVIFOutputPixels)
 	}
@@ -686,18 +561,18 @@ func outputDimensions(
 // resize resizes the image to width x height, the dimensions
 // outputDimensions gives for the fit mode.
 func (p *ImageProcessor) resize(
-	img *vips.ImageRef, width, height int, fit imagerequest.Fit,
+	img *vips.ImageRef, width, height int, fit FitMode,
 ) error {
 	switch fit {
-	case imagerequest.FitCover, "":
+	case FitCover, "":
 		// Crop the centre and resize to fill exact dimensions (default)
 		return cropCentreAndResize(img, width, height)
 
-	case imagerequest.FitFill:
+	case FitFill:
 		// Resize to exact dimensions (may distort)
 		return img.ThumbnailWithSize(width, height, vips.InterestingNone, vips.SizeForce)
 
-	case imagerequest.FitInside:
+	case FitInside:
 		// outputDimensions keeps the dimensions of an image that already fits
 		if img.Width() == width && img.Height() == height {
 			return nil
@@ -705,11 +580,11 @@ func (p *ImageProcessor) resize(
 
 		return img.Thumbnail(width, height, vips.InterestingNone)
 
-	case imagerequest.FitContain, imagerequest.FitOutside:
+	case FitContain, FitOutside:
 		return img.Thumbnail(width, height, vips.InterestingNone)
 
 	default:
-		return fmt.Errorf("%w: %s", imagerequest.ErrInvalidFitMode, fit)
+		return fmt.Errorf("%w: %s", ErrInvalidFitMode, fit)
 	}
 }
 
@@ -751,8 +626,7 @@ const defaultQuality = 85
 // to stop libvips once an encode has begun, so when ctx has ended encode
 // returns ctx's error without beginning one.
 func (p *ImageProcessor) encode(
-	ctx context.Context, img *vips.ImageRef, format imagerequest.Format,
-	quality int,
+	ctx context.Context, img *vips.ImageRef, format Format, quality int,
 ) ([]byte, error) {
 	err := ctx.Err()
 	if err != nil {
@@ -775,27 +649,25 @@ func (p *ImageProcessor) encode(
 	}
 
 	switch format {
-	case imagerequest.FormatJPEG:
+	case FormatJPEG:
 		return exportJPEG(img, quality)
 
-	case imagerequest.FormatPNG:
+	case FormatPNG:
 		return exportPNG(img)
 
-	case imagerequest.FormatGIF:
+	case FormatGIF:
 		return exportGIF(img)
 
-	case imagerequest.FormatWebP:
+	case FormatWebP:
 		return exportWebP(img, quality)
 
-	case imagerequest.FormatAVIF:
+	case FormatAVIF:
 		return exportAVIF(img, quality)
 
-	case imagerequest.FormatJXL:
+	case FormatJXL:
 		return exportJXL(img, quality)
 
-	// libvips cannot save SVG; Process returns an SVG source as it is
-	case imagerequest.FormatSVG, imagerequest.FormatOriginal,
-		imagerequest.FormatAuto:
+	case FormatOriginal:
 		return nil, fmt.Errorf("%w: %s", ErrUnsupportedOutputFormat, format)
 
 	default:
@@ -974,3 +846,24 @@ func jxlDistance(quality int) float64 {
 
 	return 53.0/3000.0*q*q - 23.0/20.0*q + 25.0
 }
+
+// formatFromString converts a format string from detectFormat to Format. A
+// format detectFormat could not name is ErrUnsupportedInputFormat.
+func (p *ImageProcessor) formatFromString(format string) (Format, error) {
+	switch format {
+	case "jpeg":
+		return FormatJPEG, nil
+	case "png":
+		return FormatPNG, nil
+	case "gif":
+		return FormatGIF, nil
+	case "webp":
+		return FormatWebP, nil
+	case string(FormatAVIF):
+		return FormatAVIF, nil
+	case string(FormatJXL):
+		return FormatJXL, nil
+	default:
+		return "", fmt.Errorf("%w: %s", ErrUnsupportedInputFormat, format)
+	}
+}

internal/imageprocessor/imageprocessor_internal_test.go

@@ -15,15 +15,9 @@ import (
 	"testing"
 
 	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 func TestMain(m *testing.M) {
-	// The SVG tests start this test binary again as SVG child processes
-	if IsSVGChildProcess(os.Args[1:]) {
-		os.Exit(RunAsSVGChildProcess(os.Args[1:]))
-	}
-
 	initVips()
 
 	code := m.Run()
@@ -93,29 +87,29 @@ func isAVIF(data []byte) bool {
 
 	brand := string(data[8:12])
 
-	return brand == string(imagerequest.FormatAVIF) || brand == "avis"
+	return brand == string(FormatAVIF) || brand == "avis"
 }
 
 // detectMIME is a minimal magic-byte detector for test assertions.
 func detectMIME(data []byte) string {
 	if len(data) >= 3 && data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF {
-		return imagerequest.FormatJPEG.MIMEType()
+		return mimeJPEG
 	}
 
 	if len(data) >= 8 && string(data[:8]) == "\x89PNG\r\n\x1a\n" {
-		return imagerequest.FormatPNG.MIMEType()
+		return mimePNG
 	}
 
 	if len(data) >= 4 && string(data[:4]) == "GIF8" {
-		return imagerequest.FormatGIF.MIMEType()
+		return mimeGIF
 	}
 
 	if len(data) >= 12 && string(data[:4]) == "RIFF" && string(data[8:12]) == "WEBP" {
-		return imagerequest.FormatWebP.MIMEType()
+		return mimeWebP
 	}
 
 	if isAVIF(data) {
-		return imagerequest.FormatAVIF.MIMEType()
+		return mimeAVIF
 	}
 
 	return ""
@@ -124,20 +118,19 @@ func detectMIME(data []byte) string {
 func TestImageProcessor_ResizeJPEG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 800, 600)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 400, Height: 300},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 400, Height: 300},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -163,7 +156,7 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatJPEG.MIMEType() {
+	if mime != mimeJPEG {
 		t.Errorf("Output format = %v, want image/jpeg", mime)
 	}
 }
@@ -171,19 +164,18 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 func TestImageProcessor_ConvertToPNG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 200, 150)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 200, Height: 150},
-		Format:  imagerequest.FormatPNG,
-		FitMode: imagerequest.FitCover,
+	req := &Request{
+		Size:    Size{Width: 200, Height: 150},
+		Format:  FormatPNG,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -196,7 +188,7 @@ func TestImageProcessor_ConvertToPNG(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatPNG.MIMEType() {
+	if mime != mimePNG {
 		t.Errorf("Output format = %v, want image/png", mime)
 	}
 }
@@ -204,24 +196,23 @@ func TestImageProcessor_ConvertToPNG(t *testing.T) {
 // processAndCheckSize processes a test JPEG of the given input dimensions
 // with the requested size and asserts the resulting dimensions.
 func processAndCheckSize(
-	t *testing.T, inputW, inputH int, size imagerequest.Size, wantW, wantH int,
+	t *testing.T, inputW, inputH int, size Size, wantW, wantH int,
 ) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, inputW, inputH)
 
-	transform := &imagerequest.Transform{
+	req := &Request{
 		Size:    size,
-		Format:  imagerequest.FormatJPEG,
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -241,28 +232,27 @@ func TestImageProcessor_OriginalSize(t *testing.T) {
 	t.Parallel()
 
 	// Width and height 0: keep original size
-	processAndCheckSize(t, 640, 480, imagerequest.Size{Width: 0, Height: 0}, 640, 480)
+	processAndCheckSize(t, 640, 480, Size{Width: 0, Height: 0}, 640, 480)
 }
 
 func TestImageProcessor_FitContain(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// 800x400 image (2:1 aspect) into 400x400 box with contain
 	// Should result in 400x200 (maintaining aspect ratio)
 	input := createTestJPEG(t, 800, 400)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 400, Height: 400},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 400, Height: 400},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitContain,
+		FitMode: FitContain,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -280,7 +270,7 @@ func TestImageProcessor_ProportionalScale_WidthOnly(t *testing.T) {
 
 	// 800x600 image, request width=400 height=0
 	// Should scale proportionally to 400x300
-	processAndCheckSize(t, 800, 600, imagerequest.Size{Width: 400, Height: 0}, 400, 300)
+	processAndCheckSize(t, 800, 600, Size{Width: 400, Height: 0}, 400, 300)
 }
 
 func TestImageProcessor_ProportionalScale_HeightOnly(t *testing.T) {
@@ -288,25 +278,24 @@ func TestImageProcessor_ProportionalScale_HeightOnly(t *testing.T) {
 
 	// 800x600 image, request width=0 height=300
 	// Should scale proportionally to 400x300
-	processAndCheckSize(t, 800, 600, imagerequest.Size{Width: 0, Height: 300}, 400, 300)
+	processAndCheckSize(t, 800, 600, Size{Width: 0, Height: 300}, 400, 300)
 }
 
 func TestImageProcessor_ProcessPNG(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestPNG(t, 400, 300)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 200, Height: 150},
-		Format:  imagerequest.FormatPNG,
-		FitMode: imagerequest.FitCover,
+	req := &Request{
+		Size:    Size{Width: 200, Height: 150},
+		Format:  FormatPNG,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatPNG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
 	}
@@ -322,6 +311,22 @@ func TestImageProcessor_ProcessPNG(t *testing.T) {
 	}
 }
 
+func TestImageProcessor_SupportedFormats(t *testing.T) {
+	t.Parallel()
+
+	proc := New(Params{})
+
+	inputFormats := proc.SupportedInputFormats()
+	if len(inputFormats) == 0 {
+		t.Error("SupportedInputFormats() returned empty slice")
+	}
+
+	outputFormats := proc.SupportedOutputFormats()
+	if len(outputFormats) == 0 {
+		t.Error("SupportedOutputFormats() returned empty slice")
+	}
+}
+
 func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 	t.Parallel()
 
@@ -340,19 +345,18 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+			proc := New(Params{})
 			ctx := context.Background()
 			input := createTestJPEG(t, tt.width, tt.height)
 
-			transform := &imagerequest.Transform{
-				Size:    imagerequest.Size{Width: 100, Height: 100},
-				Format:  imagerequest.FormatJPEG,
+			req := &Request{
+				Size:    Size{Width: 100, Height: 100},
+				Format:  FormatJPEG,
 				Quality: 85,
-				FitMode: imagerequest.FitCover,
+				FitMode: FitCover,
 			}
 
-			_, err := proc.Process(ctx, bytes.NewReader(input),
-				imagerequest.FormatJPEG, transform)
+			_, err := proc.Process(ctx, bytes.NewReader(input), req)
 			if err == nil {
 				t.Error("Process() should reject oversized input images")
 			}
@@ -367,21 +371,20 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// Create an image at exactly MaxInputDimension - should be accepted
 	input := createTestJPEG(t, MaxInputDimension, 100)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 100, Height: 100},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 100, Height: 100},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf(
 			"Process() should accept images at MaxInputDimension, got error: %v",
@@ -394,25 +397,22 @@ func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
 
 // encodeAndCheck processes a 200x150 test JPEG into a 100x75 output of the
 // given format and asserts the output MIME type and dimensions.
-func encodeAndCheck(
-	t *testing.T, format imagerequest.Format, quality int, wantMIME string,
-) {
+func encodeAndCheck(t *testing.T, format Format, quality int, wantMIME string) {
 	t.Helper()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	input := createTestJPEG(t, 200, 150)
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 100, Height: 75},
+	req := &Request{
+		Size:    Size{Width: 100, Height: 75},
 		Format:  format,
 		Quality: quality,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil", err)
 	}
@@ -443,13 +443,13 @@ func encodeAndCheck(
 func TestImageProcessor_EncodeWebP(t *testing.T) {
 	t.Parallel()
 
-	encodeAndCheck(t, imagerequest.FormatWebP, 80, imagerequest.FormatWebP.MIMEType())
+	encodeAndCheck(t, FormatWebP, 80, mimeWebP)
 }
 
 func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 	ctx := context.Background()
 
 	// Load test AVIF file
@@ -459,15 +459,14 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	}
 
 	// Request resize and convert to JPEG
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 2, Height: 2},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 2, Height: 2},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatAVIF, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil (AVIF decoding should work)", err)
 	}
@@ -481,7 +480,7 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	}
 
 	mime := detectMIME(data)
-	if mime != imagerequest.FormatJPEG.MIMEType() {
+	if mime != mimeJPEG {
 		t.Errorf("Output format = %v, want image/jpeg", mime)
 	}
 }
@@ -492,7 +491,7 @@ func TestImageProcessor_RejectsOversizedInputData(t *testing.T) {
 	// Create a processor with a very small byte limit
 	const limit = 1024
 
-	proc := New(Params{MaxInputBytes: limit, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxInputBytes: limit})
 	ctx := context.Background()
 
 	// Create a valid JPEG that exceeds the byte limit
@@ -501,15 +500,14 @@ func TestImageProcessor_RejectsOversizedInputData(t *testing.T) {
 		t.Fatalf("test JPEG must exceed %d bytes, got %d", limit, len(input))
 	}
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 100, Height: 75},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 100, Height: 75},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	_, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	_, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err == nil {
 		t.Fatal("Process() should reject input exceeding maxInputBytes")
 	}
@@ -526,18 +524,17 @@ func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
 	input := createTestJPEG(t, 10, 10)
 	limit := int64(len(input)) * 10 // 10× headroom
 
-	proc := New(Params{MaxInputBytes: limit, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxInputBytes: limit})
 	ctx := context.Background()
 
-	transform := &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 10, Height: 10},
-		Format:  imagerequest.FormatJPEG,
+	req := &Request{
+		Size:    Size{Width: 10, Height: 10},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 
-	result, err := proc.Process(ctx, bytes.NewReader(input),
-		imagerequest.FormatJPEG, transform)
+	result, err := proc.Process(ctx, bytes.NewReader(input), req)
 	if err != nil {
 		t.Fatalf("Process() error = %v, want nil", err)
 	}
@@ -545,25 +542,35 @@ func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
 	defer func() { _ = result.Content.Close() }()
 }
 
+func TestImageProcessor_DefaultMaxInputBytes(t *testing.T) {
+	t.Parallel()
+
+	// Passing 0 should use the default
+	proc := New(Params{})
+	if proc.maxInputBytes != DefaultMaxInputBytes {
+		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+	}
+
+	// Passing negative should also use the default
+	proc = New(Params{MaxInputBytes: -1})
+	if proc.maxInputBytes != DefaultMaxInputBytes {
+		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+	}
+}
+
 func TestImageProcessor_EncodeAVIF(t *testing.T) {
 	t.Parallel()
 
-	encodeAndCheck(t, imagerequest.FormatAVIF, 85, imagerequest.FormatAVIF.MIMEType())
+	encodeAndCheck(t, FormatAVIF, 85, mimeAVIF)
 }
 
-// processAndDecode runs input, a JPEG, through Process and decodes the output
-// with vips, so a test can inspect the image a client would receive.
-func processAndDecode(
-	t *testing.T, input []byte, transform *imagerequest.Transform,
-) *vips.ImageRef {
+// processAndDecode runs input through Process and decodes the output with
+// vips, so a test can inspect the image a client would receive.
+func processAndDecode(t *testing.T, input []byte, req *Request) *vips.ImageRef {
 	t.Helper()
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		context.Background(), bytes.NewReader(input), imagerequest.FormatJPEG,
-		transform,
+	result, err := New(Params{}).Process(
+		context.Background(), bytes.NewReader(input), req,
 	)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
@@ -607,17 +614,15 @@ func TestImageProcessor_StripsEXIF(t *testing.T) {
 		t.Fatal("testdata/gps-exif.jpg has no GPS latitude")
 	}
 
-	formats := []imagerequest.Format{
-		imagerequest.FormatJPEG, imagerequest.FormatPNG, imagerequest.FormatWebP,
-		imagerequest.FormatAVIF, imagerequest.FormatGIF, imagerequest.FormatOriginal,
+	formats := []Format{
+		FormatJPEG, FormatPNG, FormatWebP, FormatAVIF, FormatGIF, FormatOriginal,
 	}
 
 	for _, format := range formats {
 		t.Run(string(format), func(t *testing.T) {
 			t.Parallel()
 
-			output := processAndDecode(t, input,
-				&imagerequest.Transform{Format: format})
+			output := processAndDecode(t, input, &Request{Format: format})
 
 			if output.HasExif() {
 				t.Errorf("output has EXIF: %v", output.GetExif())
@@ -639,21 +644,21 @@ func TestImageProcessor_AppliesEXIFOrientation(t *testing.T) {
 
 	tests := []struct {
 		name  string
-		size  imagerequest.Size
+		size  Size
 		wantW int
 		wantH int
 	}{
-		{name: "original size", size: imagerequest.Size{}, wantW: 8, wantH: 16},
-		{name: "width only", size: imagerequest.Size{Width: 4}, wantW: 4, wantH: 8},
+		{name: "original size", size: Size{}, wantW: 8, wantH: 16},
+		{name: "width only", size: Size{Width: 4}, wantW: 4, wantH: 8},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			output := processAndDecode(t, input, &imagerequest.Transform{
+			output := processAndDecode(t, input, &Request{
 				Size:   tt.size,
-				Format: imagerequest.FormatPNG,
+				Format: FormatPNG,
 			})
 
 			if output.Width() != tt.wantW || output.Height() != tt.wantH {
@@ -689,8 +694,7 @@ func TestImageProcessor_ConvertsWideGamutToSRGB(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	output := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatPNG})
+	output := processAndDecode(t, input, &Request{Format: FormatPNG})
 
 	if output.HasICCProfile() {
 		t.Error("output has an ICC profile")

internal/imageprocessor/jpegxl_output_internal_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_EncodeJPEGXL converts a JPEG to a smaller JPEG XL and
@@ -16,17 +15,10 @@ import (
 func TestImageProcessor_EncodeJPEGXL(t *testing.T) {
 	t.Parallel()
 
-	transform := &imagerequest.Transform{
-		Size:   imagerequest.Size{Width: 100, Height: 75},
-		Format: imagerequest.FormatJXL,
-	}
+	req := &Request{Size: Size{Width: 100, Height: 75}, Format: FormatJXL}
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		t.Context(), bytes.NewReader(createTestJPEG(t, 200, 150)),
-		imagerequest.FormatJPEG, transform,
+	result, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(createTestJPEG(t, 200, 150)), req,
 	)
 	if err != nil {
 		t.Fatalf("Process() error = %v", err)
@@ -68,12 +60,8 @@ func TestImageProcessor_JPEGXLQuality(t *testing.T) {
 	outputBytes := make(map[int]int64)
 
 	for _, quality := range []int{30, 90} {
-		result, err := New(Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 1,
-		}).Process(t.Context(),
-			bytes.NewReader(input), imagerequest.FormatJPEG,
-			&imagerequest.Transform{Format: imagerequest.FormatJXL, Quality: quality})
+		result, err := New(Params{}).Process(t.Context(),
+			bytes.NewReader(input), &Request{Format: FormatJXL, Quality: quality})
 		if err != nil {
 			t.Fatalf("Process() at quality %d error = %v", quality, err)
 		}
@@ -101,8 +89,7 @@ func TestImageProcessor_JPEGXLDropsSourceEXIF(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	exif := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL}).GetExif()
+	exif := processAndDecode(t, input, &Request{Format: FormatJXL}).GetExif()
 
 	for _, field := range []string{
 		"exif-ifd0-Make", "exif-ifd0-Model", "exif-ifd2-BodySerialNumber",
@@ -128,8 +115,7 @@ func TestImageProcessor_JPEGXLDropsSourceResolution(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	output := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL})
+	output := processAndDecode(t, input, &Request{Format: FormatJXL})
 
 	// libvips gives the resolution in pixels per millimetre.
 	xDPI := math.Round(output.ResX() * 25.4)
@@ -154,8 +140,7 @@ func TestImageProcessor_JPEGXLAppliesEXIFOrientation(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	output := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL})
+	output := processAndDecode(t, input, &Request{Format: FormatJXL})
 
 	if output.Width() != 8 || output.Height() != 16 {
 		t.Fatalf("output is %dx%d, want 8x16", output.Width(), output.Height())
@@ -191,8 +176,7 @@ func TestImageProcessor_JPEGXLConvertsWideGamutToSRGB(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	output := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL})
+	output := processAndDecode(t, input, &Request{Format: FormatJXL})
 
 	pixel, err := output.GetPoint(4, 4)
 	if err != nil {
@@ -219,8 +203,7 @@ func TestImageProcessor_JPEGXLFromCMYK(t *testing.T) {
 		t.Fatalf("failed to read test JPEG: %v", err)
 	}
 
-	output := processAndDecode(t, input,
-		&imagerequest.Transform{Format: imagerequest.FormatJXL})
+	output := processAndDecode(t, input, &Request{Format: FormatJXL})
 
 	if output.Bands() != 3 {
 		t.Fatalf("output has %d bands, want 3", output.Bands())

internal/imageprocessor/max_concurrent_processing_internal_test.go

@@ -5,13 +5,12 @@ import (
 	"context"
 	"errors"
 	"io"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
 	"testing/iotest"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // errTestReadFailed is the error the unreadable test input returns.
@@ -77,13 +76,13 @@ func (r *gatedReader) Read(p []byte) (int, error) {
 	return n, err
 }
 
-// smallJPEGTransform asks for a 5x5 JPEG.
-func smallJPEGTransform() *imagerequest.Transform {
-	return &imagerequest.Transform{
-		Size:    imagerequest.Size{Width: 5, Height: 5},
-		Format:  imagerequest.FormatJPEG,
+// smallJPEGRequest asks for a 5x5 JPEG.
+func smallJPEGRequest() *Request {
+	return &Request{
+		Size:    Size{Width: 5, Height: 5},
+		Format:  FormatJPEG,
 		Quality: 85,
-		FitMode: imagerequest.FitCover,
+		FitMode: FitCover,
 	}
 }
 
@@ -93,8 +92,7 @@ func processInBackground(
 	proc *ImageProcessor, reader *gatedReader, results chan<- error,
 ) {
 	go func() {
-		result, err := proc.Process(context.Background(), reader,
-			imagerequest.FormatJPEG, smallJPEGTransform())
+		result, err := proc.Process(context.Background(), reader, smallJPEGRequest())
 		if err == nil {
 			_ = result.Content.Close()
 		}
@@ -117,15 +115,47 @@ func waitForEntries(t *testing.T, entered <-chan struct{}, count int) {
 	}
 }
 
-func TestNewMakesMaxConcurrentProcessingSlots(t *testing.T) {
+func TestNewDefaultsMaxConcurrentProcessingToHalfTheCPUs(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 3})
+	for _, limit := range []int{0, -1} {
+		proc := New(Params{MaxConcurrentProcessing: limit})
+		if got := cap(proc.processingSemaphore); got != max(runtime.GOMAXPROCS(0)/2, 1) {
+			t.Errorf("MaxConcurrentProcessing %d: %d slots, want %d, half the CPUs",
+				limit, got, max(runtime.GOMAXPROCS(0)/2, 1))
+		}
+	}
+
+	proc := New(Params{MaxConcurrentProcessing: 3})
 	if got := cap(proc.processingSemaphore); got != 3 {
 		t.Errorf("MaxConcurrentProcessing 3: %d slots, want 3", got)
 	}
 }
 
+// TestNewDefaultIsHalfTheCPUsAndAtLeastOne checks that New, given no
+// MaxConcurrentProcessing, makes one slot for every two CPUs Go uses,
+// rounded down, and one slot when Go uses one CPU.
+//
+//nolint:paralleltest // it sets GOMAXPROCS, which other tests read
+func TestNewDefaultIsHalfTheCPUsAndAtLeastOne(t *testing.T) {
+	cpusBefore := runtime.GOMAXPROCS(0)
+
+	t.Cleanup(func() { runtime.GOMAXPROCS(cpusBefore) })
+
+	for _, tc := range []struct{ cpus, want int }{
+		{1, 1}, {2, 1}, {3, 1}, {8, 4},
+	} {
+		runtime.GOMAXPROCS(tc.cpus)
+
+		got := cap(New(Params{}).processingSemaphore)
+		t.Logf("GOMAXPROCS %d: %d slots", tc.cpus, got)
+
+		if got != tc.want {
+			t.Errorf("GOMAXPROCS %d: %d slots, want %d", tc.cpus, got, tc.want)
+		}
+	}
+}
+
 // TestProcessNeverExceedsMaxConcurrentProcessing starts more Process calls
 // than MaxConcurrentProcessing allows and holds the first ones inside
 // Process until the test lets them go. No more than the limit may be
@@ -139,7 +169,7 @@ func TestProcessNeverExceedsMaxConcurrentProcessing(t *testing.T) {
 		calls = 6
 	)
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: limit})
+	proc := New(Params{MaxConcurrentProcessing: limit})
 	input := createTestJPEG(t, 50, 50)
 
 	counter := &readingCounter{}
@@ -186,7 +216,7 @@ func TestProcessNeverExceedsMaxConcurrentProcessing(t *testing.T) {
 func TestProcessWaitsThenFailsWhenNoSlotFrees(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{MaxConcurrentProcessing: 1})
 	proc.processingWaitTimeout = 100 * time.Millisecond
 
 	input := createTestJPEG(t, 10, 10)
@@ -207,7 +237,7 @@ func TestProcessWaitsThenFailsWhenNoSlotFrees(t *testing.T) {
 	start := time.Now()
 
 	_, err := proc.Process(context.Background(), bytes.NewReader(input),
-		imagerequest.FormatJPEG, smallJPEGTransform())
+		smallJPEGRequest())
 	if !errors.Is(err, ErrTooManyImages) {
 		t.Fatalf("Process() error = %v, want ErrTooManyImages", err)
 	}
@@ -233,38 +263,38 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 
 	valid := createTestJPEG(t, 10, 10)
 
-	unsupported := smallJPEGTransform()
+	unsupported := smallJPEGRequest()
 	unsupported.Format = "bmp"
 
 	cases := []struct {
-		name      string
-		input     io.Reader
-		transform *imagerequest.Transform
+		name  string
+		input io.Reader
+		req   *Request
 		// want is the error Process must return; nil means any error.
 		want error
 	}{
 		{
-			name:      "input cannot be read",
-			input:     iotest.ErrReader(errTestReadFailed),
-			transform: smallJPEGTransform(),
-			want:      errTestReadFailed,
+			name:  "input cannot be read",
+			input: iotest.ErrReader(errTestReadFailed),
+			req:   smallJPEGRequest(),
+			want:  errTestReadFailed,
 		},
 		{
-			name:      "input over the byte limit",
-			input:     bytes.NewReader(createTestJPEG(t, 800, 600)),
-			transform: smallJPEGTransform(),
-			want:      ErrInputDataTooLarge,
+			name:  "input over the byte limit",
+			input: bytes.NewReader(createTestJPEG(t, 800, 600)),
+			req:   smallJPEGRequest(),
+			want:  ErrInputDataTooLarge,
 		},
 		{
-			name:      "input not an image",
-			input:     strings.NewReader("not an image"),
-			transform: smallJPEGTransform(),
+			name:  "input not an image",
+			input: strings.NewReader("not an image"),
+			req:   smallJPEGRequest(),
 		},
 		{
-			name:      "output format not supported",
-			input:     bytes.NewReader(valid),
-			transform: unsupported,
-			want:      ErrUnsupportedOutputFormat,
+			name:  "output format not supported",
+			input: bytes.NewReader(valid),
+			req:   unsupported,
+			want:  ErrUnsupportedOutputFormat,
 		},
 	}
 
@@ -275,8 +305,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 			proc := New(Params{MaxInputBytes: 4096, MaxConcurrentProcessing: 1})
 			proc.processingWaitTimeout = 100 * time.Millisecond
 
-			_, err := proc.Process(context.Background(), tc.input,
-				imagerequest.FormatJPEG, tc.transform)
+			_, err := proc.Process(context.Background(), tc.input, tc.req)
 			if err == nil || (tc.want != nil && !errors.Is(err, tc.want)) {
 				t.Fatalf("Process() error = %v, want %v", err, tc.want)
 			}
@@ -286,7 +315,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 			}
 
 			result, err := proc.Process(context.Background(), bytes.NewReader(valid),
-				imagerequest.FormatJPEG, smallJPEGTransform())
+				smallJPEGRequest())
 			if err != nil {
 				t.Fatalf("Process() after the error = %v, want nil", err)
 			}
@@ -303,7 +332,7 @@ func TestProcessReleasesSlotOnError(t *testing.T) {
 func TestWaitForProcessing(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 2})
+	proc := New(Params{MaxConcurrentProcessing: 2})
 
 	gate := make(chan struct{})
 	entered := make(chan struct{}, 1)

internal/imageprocessor/orig_format_internal_test.go

@@ -6,13 +6,11 @@ import (
 	"testing"
 
 	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_OrigOfUnnamedFormatRefused verifies that orig of a TIFF
-// input is refused with ErrUnsupportedInputFormat before it is decoded, and
-// not saved as JPEG. TIFF is not a source format, and the test passes the
-// input to Process as a JPEG.
+// input, which is not a source format, is refused with
+// ErrUnsupportedInputFormat before it is decoded, and not saved as JPEG.
 func TestImageProcessor_OrigOfUnnamedFormatRefused(t *testing.T) {
 	t.Parallel()
 
@@ -28,12 +26,8 @@ func TestImageProcessor_OrigOfUnnamedFormatRefused(t *testing.T) {
 		t.Fatalf("failed to save test TIFF: %v", err)
 	}
 
-	result, err := New(Params{
-		MaxInputBytes:           50 << 20,
-		MaxConcurrentProcessing: 1,
-	}).Process(
-		t.Context(), bytes.NewReader(tiff), imagerequest.FormatJPEG,
-		&imagerequest.Transform{Format: imagerequest.FormatOriginal},
+	result, err := New(Params{}).Process(
+		t.Context(), bytes.NewReader(tiff), &Request{Format: FormatOriginal},
 	)
 	if result != nil {
 		t.Logf("Process() returned %s", result.ContentType)

internal/imageprocessor/source_formats_internal_test.go

@@ -2,11 +2,8 @@ package imageprocessor
 
 import (
 	"bytes"
-	"errors"
 	"io"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
 )
 
 // TestImageProcessor_LoadsEachSourceFormat verifies that an image in each of
@@ -15,15 +12,13 @@ import (
 func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 	t.Parallel()
 
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
+	proc := New(Params{})
 
-	for _, format := range []imagerequest.Format{
-		imagerequest.FormatJPEG, imagerequest.FormatPNG, imagerequest.FormatGIF,
-		imagerequest.FormatWebP, imagerequest.FormatAVIF, imagerequest.FormatJXL,
+	for _, format := range []Format{
+		FormatJPEG, FormatPNG, FormatGIF, FormatWebP, FormatAVIF, FormatJXL,
 	} {
 		saved, err := proc.Process(t.Context(),
-			bytes.NewReader(createTestPNG(t, 20, 20)), imagerequest.FormatPNG,
-			&imagerequest.Transform{Format: format})
+			bytes.NewReader(createTestPNG(t, 20, 20)), &Request{Format: format})
 		if err != nil {
 			t.Fatalf("saving the test image as %s: %v", format, err)
 		}
@@ -33,8 +28,8 @@ func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 			t.Fatalf("reading the %s image: %v", format, err)
 		}
 
-		result, err := proc.Process(t.Context(), bytes.NewReader(source), format,
-			&imagerequest.Transform{Format: imagerequest.FormatOriginal})
+		result, err := proc.Process(t.Context(), bytes.NewReader(source),
+			&Request{Format: FormatOriginal})
 		if err != nil {
 			t.Errorf("orig of the %s image: %v", format, err)
 
@@ -43,33 +38,9 @@ func TestImageProcessor_LoadsEachSourceFormat(t *testing.T) {
 
 		t.Logf("orig of the %s image: %s", format, result.ContentType)
 
-		if result.ContentType != format.MIMEType() {
+		if result.ContentType != FormatToMIME(format) {
 			t.Errorf("orig of the %s image is %s, want %s",
-				format, result.ContentType, format.MIMEType())
-		}
-	}
-}
-
-// TestImageProcessor_NotASourceFormatRefused verifies that a source format
-// other than the seven, such as orig, auto or none, is refused with
-// ErrUnsupportedInputFormat. The input is text, which libvips reads as no
-// format.
-func TestImageProcessor_NotASourceFormatRefused(t *testing.T) {
-	t.Parallel()
-
-	proc := New(Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1})
-
-	for _, sourceFormat := range []imagerequest.Format{
-		imagerequest.FormatOriginal, imagerequest.FormatAuto, "",
-	} {
-		result, err := proc.Process(t.Context(),
-			bytes.NewReader([]byte("this is text, not an image")), sourceFormat,
-			&imagerequest.Transform{Format: imagerequest.FormatJPEG})
-		t.Logf("source format %q: error = %v", sourceFormat, err)
-
-		if result != nil || !errors.Is(err, ErrUnsupportedInputFormat) {
-			t.Errorf("Process() with source format %q = %v, error %v; want %v",
-				sourceFormat, result, err, ErrUnsupportedInputFormat)
+				format, result.ContentType, FormatToMIME(format))
 		}
 	}
 }

internal/imageprocessor/svg_child_process.go

@@ -1,255 +0,0 @@
-package imageprocessor
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"strconv"
-	"syscall"
-	"time"
-
-	"github.com/davidbyttow/govips/v2/vips"
-)
-
-// An SVG child process is the running program started again with one of
-// these arguments first, naming what it does. Its command line, after the
-// program's name, is one of:
-//
-//	read-svg-size MEMORY_LIMIT
-//	render-svg-as-png MEMORY_LIMIT WIDTH HEIGHT
-//
-// MEMORY_LIMIT is in bytes. The child reads the SVG on standard input. It
-// writes the SVG's size as WIDTH HEIGHT, or the SVG rendered at WIDTH x
-// HEIGHT as PNG, to standard output.
-const (
-	readSVGSizeArgument    = "read-svg-size"
-	renderSVGAsPNGArgument = "render-svg-as-png"
-)
-
-// errSVGChildProcessArguments is returned for a command line that is not
-// that of an SVG child process.
-var errSVGChildProcessArguments = errors.New(
-	"not the command line of an SVG child process")
-
-// IsSVGChildProcess reports whether args, a process's command line after the
-// program's name, are those of an SVG child process.
-func IsSVGChildProcess(args []string) bool {
-	return len(args) > 0 &&
-		(args[0] == readSVGSizeArgument || args[0] == renderSVGAsPNGArgument)
-}
-
-// RunAsSVGChildProcess runs this process as the SVG child process that args,
-// its command line after the program's name, ask for. It returns the status
-// to exit with: 0 once it has written its result, and 1 after writing an
-// error to standard error, which the parent discards.
-func RunAsSVGChildProcess(args []string) int {
-	err := runAsSVGChildProcess(args, os.Stdin, os.Stdout)
-	if err != nil {
-		_, _ = fmt.Fprintln(os.Stderr, err)
-
-		return 1
-	}
-
-	return 0
-}
-
-// runAsSVGChildProcess does the work of RunAsSVGChildProcess, reading the SVG
-// from stdin and writing the result to stdout. It sets the process's limits
-// before it reads the SVG.
-func runAsSVGChildProcess(
-	args []string, stdin io.Reader, stdout io.Writer,
-) error {
-	numbers, err := parseSVGChildProcessArguments(args)
-	if err != nil {
-		return err
-	}
-
-	err = setSVGChildProcessLimits(numbers[0])
-	if err != nil {
-		return err
-	}
-
-	initVips()
-
-	svg, err := io.ReadAll(stdin)
-	if err != nil {
-		return fmt.Errorf("failed to read the SVG: %w", err)
-	}
-
-	if args[0] == readSVGSizeArgument {
-		return writeSVGSize(svg, stdout)
-	}
-
-	return writeSVGAsPNG(svg, numbers[1], numbers[2], stdout)
-}
-
-// parseSVGChildProcessArguments returns the numbers on the command line of an
-// SVG child process, args: the memory limit, then the width and height for
-// render-svg-as-png.
-func parseSVGChildProcessArguments(args []string) ([]int, error) {
-	wantArgs := 2
-	if len(args) > 0 && args[0] == renderSVGAsPNGArgument {
-		wantArgs = 4
-	}
-
-	if !IsSVGChildProcess(args) || len(args) != wantArgs {
-		return nil, fmt.Errorf("%w: %q", errSVGChildProcessArguments, args)
-	}
-
-	numbers := make([]int, 0, len(args)-1)
-
-	for _, arg := range args[1:] {
-		number, err := strconv.Atoi(arg)
-		if err != nil {
-			return nil, fmt.Errorf("%w: %q: %w", errSVGChildProcessArguments,
-				args, err)
-		}
-
-		numbers = append(numbers, number)
-	}
-
-	return numbers, nil
-}
-
-// setSVGChildProcessLimits sets this process's RLIMIT_DATA to memoryLimit
-// bytes, so that allocating heap or other private writable memory past it
-// fails. RLIMIT_AS would also count the address space the Go runtime reserves
-// but does not use. It also sets RLIMIT_CORE to 0: librsvg crashes when an
-// allocation fails, and the crash would write a core file of up to
-// memoryLimit bytes into pixad's working directory.
-func setSVGChildProcessLimits(memoryLimit int) error {
-	if memoryLimit < 1 {
-		return fmt.Errorf("%w: memory limit %d", errSVGChildProcessArguments,
-			memoryLimit)
-	}
-
-	err := syscall.Setrlimit(syscall.RLIMIT_DATA, &syscall.Rlimit{
-		Cur: uint64(memoryLimit),
-		Max: uint64(memoryLimit),
-	})
-	if err != nil {
-		return fmt.Errorf("failed to limit memory to %d bytes: %w",
-			memoryLimit, err)
-	}
-
-	err = syscall.Setrlimit(syscall.RLIMIT_CORE, &syscall.Rlimit{})
-	if err != nil {
-		return fmt.Errorf("failed to turn off core files: %w", err)
-	}
-
-	return nil
-}
-
-// writeSVGSize writes the size of svg to stdout as WIDTH HEIGHT. librsvg
-// reads the whole SVG for it.
-func writeSVGSize(svg []byte, stdout io.Writer) error {
-	img, err := vips.NewImageFromBuffer(svg)
-	if err != nil {
-		return fmt.Errorf("failed to read the SVG: %w", err)
-	}
-
-	defer img.Close()
-
-	_, err = fmt.Fprintf(stdout, "%d %d\n", img.Width(), img.Height())
-
-	return err
-}
-
-// writeSVGAsPNG renders svg at width x height and writes it to stdout as PNG.
-// libvips' thumbnail has librsvg render the SVG at that size directly, at
-// any scale: govips takes a density only in whole dots per inch, which cannot
-// render an SVG below 1/72 of its own size. Given the SVG as bytes with no
-// file name, librsvg loads no file or URL the SVG refers to.
-func writeSVGAsPNG(svg []byte, width, height int, stdout io.Writer) error {
-	img, err := vips.NewThumbnailWithSizeFromBuffer(svg, width, height,
-		vips.InterestingNone, vips.SizeBoth)
-	if err != nil {
-		return fmt.Errorf("failed to render the SVG: %w", err)
-	}
-
-	defer img.Close()
-
-	png, err := exportPNG(img)
-	if err != nil {
-		return fmt.Errorf("failed to save the SVG as PNG: %w", err)
-	}
-
-	_, err = stdout.Write(png)
-
-	return err
-}
-
-// readSVGSize reads the size of the SVG data in a child process that pixa
-// kills at deadline (see runSVGChildProcess).
-func (p *ImageProcessor) readSVGSize(
-	ctx context.Context, deadline time.Time, data []byte,
-) (int, int, error) {
-	output, err := p.runSVGChildProcess(ctx, deadline, data,
-		readSVGSizeArgument)
-	if err != nil {
-		return 0, 0, err
-	}
-
-	var width, height int
-
-	_, err = fmt.Sscan(string(output), &width, &height)
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to read the size %q an SVG child "+
-			"process wrote: %w", output, err)
-	}
-
-	return width, height, nil
-}
-
-// runSVGChildProcess starts the running program again as an SVG child
-// process, with argument, p.maxSVGRenderMemory and extraArgs as its command
-// line, and waits for it. It gives the child data on standard input,
-// discards its standard error, and returns its standard output. pixa kills
-// the child at deadline. A child that fails or is killed is
-// ErrSVGRenderFailed, unless ctx has ended: runSVGChildProcess then returns
-// ctx's error. Failing to start the child is another error.
-func (p *ImageProcessor) runSVGChildProcess(
-	ctx context.Context, deadline time.Time, data []byte,
-	argument string, extraArgs ...string,
-) ([]byte, error) {
-	executable, err := os.Executable()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find the running program: %w", err)
-	}
-
-	childCtx, cancel := context.WithDeadline(ctx, deadline)
-	defer cancel()
-
-	args := append([]string{argument, strconv.Itoa(p.maxSVGRenderMemory)},
-		extraArgs...)
-
-	//nolint:gosec // the running program, with arguments pixa makes
-	cmd := exec.CommandContext(childCtx, executable, args...)
-	cmd.Stdin = bytes.NewReader(data)
-
-	var stdout bytes.Buffer
-
-	cmd.Stdout = &stdout
-
-	err = cmd.Run()
-
-	var exitError *exec.ExitError
-
-	switch {
-	case err == nil:
-		return stdout.Bytes(), nil
-	case ctx.Err() != nil:
-		return nil, ctx.Err()
-	case childCtx.Err() != nil:
-		return nil, fmt.Errorf("%w: it took more than %v", ErrSVGRenderFailed,
-			p.svgRenderTimeout)
-	case errors.As(err, &exitError):
-		return nil, fmt.Errorf("%w: %w", ErrSVGRenderFailed, err)
-	default:
-		return nil, fmt.Errorf("failed to run an SVG child process: %w", err)
-	}
-}

internal/imageprocessor/svg_internal_test.go

@@ -1,503 +0,0 @@
-package imageprocessor
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/davidbyttow/govips/v2/vips"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// testSVG is a 16x12 SVG, black on its left half and white on its right.
-const testSVG = `<svg xmlns="http://www.w3.org/2000/svg" width="16" height="12">` +
-	`<rect width="16" height="12" fill="white"/>` +
-	`<rect width="8" height="12" fill="black"/></svg>`
-
-// newSVGTestProcessor returns a processor for the SVG tests.
-func newSVGTestProcessor() *ImageProcessor {
-	return New(Params{MaxInputBytes: 1 << 20, MaxConcurrentProcessing: 1})
-}
-
-// processSVG processes svg, as an SVG source, with transform.
-func processSVG(
-	t *testing.T, svg string, transform imagerequest.Transform,
-) (*Result, []byte, error) {
-	t.Helper()
-
-	result, err := newSVGTestProcessor().Process(t.Context(),
-		bytes.NewReader([]byte(svg)), imagerequest.FormatSVG, &transform)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	output, err := io.ReadAll(result.Content)
-	if err != nil {
-		t.Fatalf("reading the output: %v", err)
-	}
-
-	return result, output, nil
-}
-
-// TestImageProcessor_SVGOrigIsTheSVG checks that orig of an SVG at the orig
-// size is the SVG itself, never another format, and that orig at another
-// size is ErrSVGNotOriginalSize.
-func TestImageProcessor_SVGOrigIsTheSVG(t *testing.T) {
-	t.Parallel()
-
-	result, output, err := processSVG(t, testSVG,
-		imagerequest.Transform{Format: imagerequest.FormatOriginal})
-	if err != nil {
-		t.Fatalf("orig of the SVG: %v", err)
-	}
-
-	t.Logf("orig of the SVG: %s, %dx%d", result.ContentType, result.Width,
-		result.Height)
-
-	if result.ContentType != "image/svg+xml" || string(output) != testSVG {
-		t.Errorf("orig of the SVG = %s %q, want image/svg+xml %q",
-			result.ContentType, output, testSVG)
-	}
-
-	_, _, err = processSVG(t, testSVG, imagerequest.Transform{
-		Size:   imagerequest.Size{Width: 32, Height: 24},
-		Format: imagerequest.FormatOriginal,
-	})
-	if !errors.Is(err, ErrSVGNotOriginalSize) {
-		t.Errorf("orig of the SVG at 32x24: error = %v, want %v", err,
-			ErrSVGNotOriginalSize)
-	}
-}
-
-// TestImageProcessor_RendersSVGToEachRasterFormat checks that an SVG is
-// rendered to each raster format at the requested size.
-func TestImageProcessor_RendersSVGToEachRasterFormat(t *testing.T) {
-	t.Parallel()
-
-	for _, format := range []imagerequest.Format{
-		imagerequest.FormatJPEG, imagerequest.FormatPNG, imagerequest.FormatGIF,
-		imagerequest.FormatWebP, imagerequest.FormatAVIF, imagerequest.FormatJXL,
-	} {
-		result, output, err := processSVG(t, testSVG, imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 40, Height: 30},
-			Format: format,
-		})
-		if err != nil {
-			t.Errorf("SVG as %s: %v", format, err)
-
-			continue
-		}
-
-		t.Logf("SVG as %s: %s, %dx%d, %d bytes", format, result.ContentType,
-			result.Width, result.Height, len(output))
-
-		if result.ContentType != format.MIMEType() ||
-			vips.DetermineImageType(output) != vipsImageType(format) ||
-			result.Width != 40 || result.Height != 30 {
-			t.Errorf("SVG as %s = %s, %dx%d; want %s, 40x30", format,
-				result.ContentType, result.Width, result.Height, format.MIMEType())
-		}
-	}
-}
-
-// TestImageProcessor_RendersSVGSharpWhenEnlarged checks that a 16x12 SVG
-// asked for at 1600x1200 is rendered at that size, not rendered at 16x12 and
-// enlarged: 10 pixels either side of the edge between its black and white
-// halves are black and white, where an enlarged image is grey there.
-func TestImageProcessor_RendersSVGSharpWhenEnlarged(t *testing.T) {
-	t.Parallel()
-
-	_, output, err := processSVG(t, testSVG, imagerequest.Transform{
-		Size:   imagerequest.Size{Width: 1600, Height: 1200},
-		Format: imagerequest.FormatPNG,
-	})
-	if err != nil {
-		t.Fatalf("SVG as PNG at 1600x1200: %v", err)
-	}
-
-	img, err := vips.NewImageFromBuffer(output)
-	if err != nil {
-		t.Fatalf("decoding the PNG: %v", err)
-	}
-
-	t.Cleanup(img.Close)
-
-	for x, want := range map[int]float64{790: 0, 810: 255} {
-		point, err := img.GetPoint(x, 600)
-		if err != nil {
-			t.Fatalf("GetPoint(%d, 600): %v", x, err)
-		}
-
-		t.Logf("pixel at %d,600: %v", x, point)
-
-		if point[0] != want {
-			t.Errorf("pixel at %d,600 = %v, want %v", x, point[0], want)
-		}
-	}
-}
-
-// TestImageProcessor_SVGFetchesNothing checks that rendering an SVG draws no
-// image it refers to: one at a URL on a local server, by href or xlink:href,
-// or a local file that exists. Each SVG renders without error, white where
-// the image would be. An SVG that uses an external entity at that server is
-// a separate case. No SVG makes a request to the server.
-func TestImageProcessor_SVGFetchesNothing(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int64
-
-	// Blue is 128 in every pixel of this PNG.
-	png := createTestPNG(t, 4, 4)
-
-	server := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			requests.Add(1)
-			t.Logf("request for %s", r.URL)
-			w.Header().Set("Content-Type", "image/png")
-			_, _ = w.Write(png)
-		}))
-	t.Cleanup(server.Close)
-
-	pngPath := filepath.Join(t.TempDir(), "image.png")
-
-	err := os.WriteFile(pngPath, png, 0o600)
-	if err != nil {
-		t.Fatalf("writing the PNG file: %v", err)
-	}
-
-	for _, reference := range []string{
-		`href="` + server.URL + `/image.png"`,
-		`xlink:href="` + server.URL + `/xlink.png"`,
-		`href="file://` + pngPath + `"`,
-	} {
-		svg := `<svg xmlns="http://www.w3.org/2000/svg" ` +
-			`xmlns:xlink="http://www.w3.org/1999/xlink" width="16" height="12">` +
-			`<rect width="16" height="12" fill="white"/>` +
-			`<image ` + reference + ` width="16" height="12"/></svg>`
-
-		_, output, err := processSVG(t, svg, imagerequest.Transform{
-			Format: imagerequest.FormatPNG,
-		})
-		if err != nil {
-			t.Errorf("SVG with image %s as PNG: %v", reference, err)
-
-			continue
-		}
-
-		img, err := vips.NewImageFromBuffer(output)
-		if err != nil {
-			t.Fatalf("decoding the PNG: %v", err)
-		}
-
-		point, err := img.GetPoint(8, 6)
-		img.Close()
-
-		if err != nil {
-			t.Fatalf("GetPoint(8, 6): %v", err)
-		}
-
-		t.Logf("SVG with image %s: pixel at 8,6 = %v", reference, point)
-
-		if point[2] != 255 {
-			t.Errorf("SVG with image %s: blue at 8,6 = %v, want 255: the "+
-				"image is drawn", reference, point[2])
-		}
-	}
-
-	svg := `<?xml version="1.0"?>` +
-		`<!DOCTYPE svg [<!ENTITY outside SYSTEM "` + server.URL + `/entity">]>` +
-		`<svg xmlns="http://www.w3.org/2000/svg" width="16" height="12">` +
-		`<text y="10">&outside;</text></svg>`
-
-	// librsvg loads no external entity, so it refuses this SVG: outside is
-	// not defined.
-	_, _, err = processSVG(t, svg, imagerequest.Transform{
-		Format: imagerequest.FormatPNG,
-	})
-	t.Logf("SVG with an external entity as PNG: error = %v", err)
-
-	if requests.Load() != 0 {
-		t.Errorf("rendering the SVGs made %d requests, want none",
-			requests.Load())
-	}
-}
-
-// TestImageProcessor_RendersSVGLargerThanMaxInputDimension checks that an
-// SVG whose own size is above MaxInputDimension is limited only by the
-// output checks: it is rendered at a raster size, orig of it is the SVG
-// itself, and a raster format at its own size is ErrSVGTooLargeForOrigSize.
-// The 1000000x1000000 one is rendered at a ten-thousandth of its own size.
-func TestImageProcessor_RendersSVGLargerThanMaxInputDimension(t *testing.T) {
-	t.Parallel()
-
-	for _, svg := range []string{
-		`<svg xmlns="http://www.w3.org/2000/svg" width="10000" height="10">` +
-			`<rect width="10000" height="10"/></svg>`,
-		`<svg xmlns="http://www.w3.org/2000/svg" width="1000000" ` +
-			`height="1000000"><rect width="1000000" height="1000000"/></svg>`,
-	} {
-		result, _, err := processSVG(t, svg, imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 100, Height: 100},
-			Format: imagerequest.FormatPNG,
-		})
-		if err != nil {
-			t.Errorf("%s as PNG at 100x100: %v", svg, err)
-		} else {
-			t.Logf("%s as PNG at 100x100: %dx%d", svg, result.Width, result.Height)
-
-			if result.Width != 100 || result.Height != 100 {
-				t.Errorf("%s as PNG at 100x100 = %dx%d, want 100x100", svg,
-					result.Width, result.Height)
-			}
-		}
-
-		result, output, err := processSVG(t, svg,
-			imagerequest.Transform{Format: imagerequest.FormatOriginal})
-		if err != nil || result.ContentType != imagerequest.FormatSVG.MIMEType() ||
-			string(output) != svg {
-			t.Errorf("orig of %s: error = %v, want the SVG itself", svg, err)
-		}
-
-		_, _, err = processSVG(t, svg,
-			imagerequest.Transform{Format: imagerequest.FormatPNG})
-		if !errors.Is(err, ErrSVGTooLargeForOrigSize) {
-			t.Errorf("%s as PNG at its own size: error = %v, want %v", svg,
-				err, ErrSVGTooLargeForOrigSize)
-		}
-	}
-}
-
-// TestImageProcessor_RefusesSVGTooThin checks that an SVG with one side more
-// than MaxInputDimension times the other is ErrSVGTooThin at a raster size,
-// that one at exactly that proportion is rendered, and that orig of either
-// is the SVG itself.
-func TestImageProcessor_RefusesSVGTooThin(t *testing.T) {
-	t.Parallel()
-
-	tooThin := `<svg xmlns="http://www.w3.org/2000/svg" width="81930" ` +
-		`height="10"><rect width="81930" height="10"/></svg>`
-	atTheLimit := `<svg xmlns="http://www.w3.org/2000/svg" width="81920" ` +
-		`height="10"><rect width="81920" height="10"/></svg>`
-	size := imagerequest.Size{Width: 100, Height: 100}
-
-	_, _, err := processSVG(t, tooThin,
-		imagerequest.Transform{Size: size, Format: imagerequest.FormatPNG})
-	if !errors.Is(err, ErrSVGTooThin) {
-		t.Errorf("81930x10 SVG as PNG at 100x100: error = %v, want %v", err,
-			ErrSVGTooThin)
-	}
-
-	result, _, err := processSVG(t, atTheLimit,
-		imagerequest.Transform{Size: size, Format: imagerequest.FormatPNG})
-	if err != nil {
-		t.Errorf("81920x10 SVG as PNG at 100x100: %v", err)
-	} else if result.Width != 100 || result.Height != 100 {
-		t.Errorf("81920x10 SVG as PNG at 100x100 = %dx%d, want 100x100",
-			result.Width, result.Height)
-	}
-
-	for _, svg := range []string{tooThin, atTheLimit} {
-		result, output, err := processSVG(t, svg,
-			imagerequest.Transform{Format: imagerequest.FormatOriginal})
-		if err != nil || result.ContentType != imagerequest.FormatSVG.MIMEType() ||
-			string(output) != svg {
-			t.Errorf("orig of %s: error = %v, want the SVG itself", svg, err)
-		}
-	}
-}
-
-// testSVGRenderTimeout is the time limit of the SVG time limit tests, short
-// so that they finish in a few seconds. Under the race detector a child
-// process takes about a second to start and read an SVG's size.
-const testSVGRenderTimeout = 3 * time.Second
-
-// processSVGTimed has processor process svg, as an SVG source, with transform,
-// and returns the error and how long it took.
-func processSVGTimed(
-	t *testing.T, processor *ImageProcessor, svg string,
-	transform imagerequest.Transform,
-) (time.Duration, error) {
-	t.Helper()
-
-	start := time.Now()
-	_, err := processor.Process(t.Context(), strings.NewReader(svg),
-		imagerequest.FormatSVG, &transform)
-
-	return time.Since(start), err
-}
-
-// checkProcessesAnotherImage checks that processor, after refusing an SVG,
-// processes a PNG.
-func checkProcessesAnotherImage(t *testing.T, processor *ImageProcessor) {
-	t.Helper()
-
-	_, err := processor.Process(t.Context(),
-		bytes.NewReader(createTestPNG(t, 64, 48)), imagerequest.FormatPNG,
-		&imagerequest.Transform{
-			Size:   imagerequest.Size{Width: 32, Height: 24},
-			Format: imagerequest.FormatJPEG,
-		})
-	if err != nil {
-		t.Errorf("a PNG after the SVG: %v", err)
-	}
-}
-
-// TestImageProcessor_StopsSlowSVGRender checks that an SVG that takes about
-// 12 seconds to render, 600 shapes each drawn with an feTurbulence filter
-// effect, is ErrSVGRenderFailed soon after a time limit of
-// testSVGRenderTimeout, not when the render would end. The processor then
-// processes another image.
-func TestImageProcessor_StopsSlowSVGRender(t *testing.T) {
-	t.Parallel()
-
-	svg := `<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256">` +
-		`<filter id="noise">` +
-		`<feTurbulence baseFrequency="0.05" numOctaves="4"/></filter>` +
-		strings.Repeat(`<rect width="256" height="256" filter="url(#noise)"/>`,
-			600) +
-		`</svg>`
-
-	processor := newSVGTestProcessor()
-	processor.svgRenderTimeout = testSVGRenderTimeout
-
-	elapsed, err := processSVGTimed(t, processor, svg, imagerequest.Transform{
-		Size:   imagerequest.Size{Width: 256, Height: 256},
-		Format: imagerequest.FormatPNG,
-	})
-	t.Logf("slow SVG as PNG: error %v after %v", err, elapsed)
-
-	if !errors.Is(err, ErrSVGRenderFailed) {
-		t.Errorf("slow SVG as PNG: error = %v, want %v", err,
-			ErrSVGRenderFailed)
-	}
-
-	if elapsed > testSVGRenderTimeout+2*time.Second {
-		t.Errorf("slow SVG as PNG: refused after %v, want soon after %v",
-			elapsed, testSVGRenderTimeout)
-	}
-
-	checkProcessesAnotherImage(t, processor)
-}
-
-// TestImageProcessor_StopsSlowSVGSizeRead checks that orig of an SVG whose
-// size takes about 10 seconds to read is ErrSVGRenderFailed soon after a time
-// limit of testSVGRenderTimeout. To read the size, librsvg matches each of the
-// SVG's 2500 CSS rules against each of its 2500 shapes, walking up the 75
-// groups around it. The processor then processes another image.
-func TestImageProcessor_StopsSlowSVGSizeRead(t *testing.T) {
-	t.Parallel()
-
-	var rules strings.Builder
-
-	for i := range 2500 {
-		fmt.Fprintf(&rules, ".group%d rect { fill: red }", i)
-	}
-
-	svg := `<svg xmlns="http://www.w3.org/2000/svg" width="16" height="12">` +
-		`<style>` + rules.String() + `</style>` + strings.Repeat(`<g>`, 75) +
-		strings.Repeat(`<rect width="1" height="1"/>`, 2500) +
-		strings.Repeat(`</g>`, 75) + `</svg>`
-
-	processor := newSVGTestProcessor()
-	processor.svgRenderTimeout = testSVGRenderTimeout
-
-	elapsed, err := processSVGTimed(t, processor, svg,
-		imagerequest.Transform{Format: imagerequest.FormatOriginal})
-	t.Logf("orig of the SVG: error %v after %v", err, elapsed)
-
-	if !errors.Is(err, ErrSVGRenderFailed) {
-		t.Errorf("orig of the SVG: error = %v, want %v", err,
-			ErrSVGRenderFailed)
-	}
-
-	if elapsed > testSVGRenderTimeout+2*time.Second {
-		t.Errorf("orig of the SVG: refused after %v, want soon after %v",
-			elapsed, testSVGRenderTimeout)
-	}
-
-	checkProcessesAnotherImage(t, processor)
-}
-
-// TestImageProcessor_StopsSVGRenderOverMemoryLimit checks that an SVG that
-// needs about 500 MiB more than a child process's own memory to render, a
-// chain of 2000 blurs that each keep their result, is ErrSVGRenderFailed with
-// a memory limit of 512 MiB, and that a plain SVG renders under the same
-// limit. A child process needs about 130 MiB of its own, and about 350 MiB
-// under the race detector, so the chain also renders under MaxSVGRenderMemory.
-func TestImageProcessor_StopsSVGRenderOverMemoryLimit(t *testing.T) {
-	t.Parallel()
-
-	var blurs strings.Builder
-
-	blurs.WriteString(`<feGaussianBlur stdDeviation="3" result="blur0"/>`)
-
-	for i := 1; i < 2000; i++ {
-		fmt.Fprintf(&blurs,
-			`<feGaussianBlur in="blur%d" stdDeviation="3" result="blur%d"/>`,
-			i-1, i)
-	}
-
-	svg := `<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256">` +
-		`<filter id="blurs" color-interpolation-filters="sRGB">` +
-		blurs.String() + `</filter>` +
-		`<rect width="256" height="256" fill="red" filter="url(#blurs)"/></svg>`
-	size := imagerequest.Size{Width: 256, Height: 256}
-
-	processor := newSVGTestProcessor()
-	processor.maxSVGRenderMemory = 512 << 20
-
-	elapsed, err := processSVGTimed(t, processor, svg,
-		imagerequest.Transform{Size: size, Format: imagerequest.FormatPNG})
-	t.Logf("SVG of 2000 blurs as PNG: error %v after %v", err, elapsed)
-
-	if !errors.Is(err, ErrSVGRenderFailed) {
-		t.Errorf("SVG of 2000 blurs as PNG: error = %v, want %v", err,
-			ErrSVGRenderFailed)
-	}
-
-	_, err = processSVGTimed(t, processor, testSVG,
-		imagerequest.Transform{Size: size, Format: imagerequest.FormatPNG})
-	if err != nil {
-		t.Errorf("plain SVG as PNG after it: %v", err)
-	}
-}
-
-// TestSVGRenderSize checks the size at which an SVG is rendered to cover an
-// output size, and that it is held to MaxInputDimension.
-func TestSVGRenderSize(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name                      string
-		width, height             int
-		outputWidth, outputHeight int
-		wantWidth, wantHeight     int
-	}{
-		{"own size", 16, 12, 16, 12, 16, 12},
-		{"100 times larger", 16, 12, 1600, 1200, 1600, 1200},
-		{"wider than the SVG's proportions", 16, 12, 160, 12, 160, 120},
-		{"10 times smaller", 100, 100, 10, 10, 10, 10},
-		{"held to MaxInputDimension", 8192, 1, 8192, 8192, 8192, 1},
-		{"held to MaxInputDimension when enlarged", 1024, 1, 8192, 8192, 8192, 8},
-		{"far above MaxInputDimension", 1000000, 1000000, 100, 100, 100, 100},
-	}
-
-	for _, tt := range tests {
-		gotWidth, gotHeight := svgRenderSize(tt.width, tt.height,
-			tt.outputWidth, tt.outputHeight)
-		if gotWidth != tt.wantWidth || gotHeight != tt.wantHeight {
-			t.Errorf("%s: svgRenderSize(%d, %d, %d, %d) = %dx%d, want %dx%d",
-				tt.name, tt.width, tt.height, tt.outputWidth, tt.outputHeight,
-				gotWidth, gotHeight, tt.wantWidth, tt.wantHeight)
-		}
-	}
-}

internal/imageproxy/cache_hit_internal_test.go

@@ -1,100 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"os"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// TestProxy_Get_MakesAgainVariantOfNoOutputFormat replaces a cached
-// variant's file with text, and checks that the next request is a miss
-// answered with the variant made again, and the one after a hit.
-func TestProxy_Get_MakesAgainVariantOfNoOutputFormat(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	want, _ := getImage(t, svc, req)
-
-	path := variantFilePath(svc, imagerequest.CacheKey(req))
-
-	err := os.WriteFile(path, []byte("this is text, not an image"),
-		imgcache.StorageFilePerm)
-	if err != nil {
-		t.Fatalf("replacing the variant file: %v", err)
-	}
-
-	got, status := getImage(t, svc, req)
-	t.Logf("after the replacement: %d bytes, %s", len(got), status)
-
-	if status != CacheMiss || !bytes.Equal(got, want) {
-		t.Errorf("after the replacement: Get() = %d bytes, %s; want the %d bytes "+
-			"made again, %s", len(got), status, len(want), CacheMiss)
-	}
-
-	got, status = getImage(t, svc, req)
-
-	if status != CacheHit || !bytes.Equal(got, want) {
-		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
-			len(got), status, len(want), CacheHit)
-	}
-}
-
-// TestProxy_Get_HitWaitsForNoDatabaseWrite holds the database's one
-// connection while a cached variant is requested. The hit must be answered
-// while the connection is still held, and its access time must reach the
-// database once it is free.
-func TestProxy_Get_HitWaitsForNoDatabaseWrite(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-	key := imagerequest.CacheKey(req)
-
-	getImage(t, svc, req)
-
-	// Each connection to an in-memory SQLite database opens a new, empty one,
-	// so the goroutine that writes the access times must share the
-	// connection that holds the schema.
-	svc.db.SetMaxOpenConns(1)
-	svc.cache.StartPendingAccessTimeWrites()
-
-	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
-
-	anHourAgo := time.Now().Add(-time.Hour)
-	setVariantLastAccessed(t, svc.db, key, anHourAgo)
-
-	releaseDatabase := holdDatabase(t, svc.db)
-	defer releaseDatabase()
-
-	results := startGet(t.Context(), svc, req)
-
-	select {
-	case got := <-results:
-		if got.err != nil {
-			t.Fatalf("Get() of the cached variant error = %v", got.err)
-		}
-	case <-time.After(pendingAccessTimesWait):
-		t.Fatal("the cache hit waited for the database")
-	}
-
-	releaseDatabase()
-
-	deadline := time.Now().Add(pendingAccessTimesWait)
-
-	for countRows(t, svc.db, `
-		SELECT COUNT(*) FROM variant_content
-		WHERE cache_key = ? AND last_accessed_at > ?
-	`, string(key), anHourAgo.UTC().Format(sqliteTimestampFormat)) == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the hit's access time was not written")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-}

internal/imageproxy/cache_ttl_internal_test.go

@@ -1,493 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"image/color"
-	"io"
-	"net/http"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// Validators the test upstream sends with its image.
-const (
-	testETag         = `"v1"`
-	testLastModified = "Mon, 02 Nov 2026 10:00:00 GMT"
-)
-
-// errConnectionRefused stands for an upstream that cannot be reached.
-var errConnectionRefused = errors.New("connection refused")
-
-// upstreamFailure is one way a fetch from upstream fails.
-type upstreamFailure struct {
-	name string
-	err  error
-}
-
-// upstreamFailures returns the ways a check of a cached image with upstream
-// can fail: an error status, a timeout and no connection.
-func upstreamFailures() []upstreamFailure {
-	return []upstreamFailure{
-		{"error status", fmt.Errorf("%w: status 503", httpfetcher.ErrUpstreamError)},
-		{"timeout", httpfetcher.ErrUpstreamTimeout},
-		{"no connection", errConnectionRefused},
-	}
-}
-
-// conditionalUpstream serves one JPEG image with an ETag or a Last-Modified
-// header, or both. It answers 304 Not Modified to a fetch whose If-None-Match
-// is its ETag, or, when it has no ETag, whose If-Modified-Since is its
-// Last-Modified. While err is set, every fetch fails with it. It records the
-// conditional headers of every fetch.
-type conditionalUpstream struct {
-	mu           sync.Mutex
-	image        []byte
-	etag         string
-	lastModified string
-	err          error
-
-	ifNoneMatch     []string
-	ifModifiedSince []string
-}
-
-func (u *conditionalUpstream) Fetch(
-	_ context.Context, _ imagerequest.Source,
-	ifNoneMatch, ifModifiedSince string,
-) (*httpfetcher.FetchResult, error) {
-	u.mu.Lock()
-	defer u.mu.Unlock()
-
-	u.ifNoneMatch = append(u.ifNoneMatch, ifNoneMatch)
-	u.ifModifiedSince = append(u.ifModifiedSince, ifModifiedSince)
-
-	if u.err != nil {
-		return nil, u.err
-	}
-
-	unchanged := ifNoneMatch == u.etag
-	if u.etag == "" {
-		unchanged = ifModifiedSince == u.lastModified
-	}
-
-	if unchanged {
-		return &httpfetcher.FetchResult{
-			Content:    http.NoBody,
-			StatusCode: http.StatusNotModified,
-		}, nil
-	}
-
-	headers := http.Header{}
-	if u.etag != "" {
-		headers.Set("ETag", u.etag)
-	}
-
-	if u.lastModified != "" {
-		headers.Set("Last-Modified", u.lastModified)
-	}
-
-	return &httpfetcher.FetchResult{
-		Content:       io.NopCloser(bytes.NewReader(u.image)),
-		ContentLength: int64(len(u.image)),
-		ContentType:   testContentTypeJPEG,
-		Headers:       headers,
-		StatusCode:    http.StatusOK,
-	}, nil
-}
-
-// change replaces the upstream image and its ETag.
-func (u *conditionalUpstream) change(image []byte, etag string) {
-	u.mu.Lock()
-	defer u.mu.Unlock()
-
-	u.image = image
-	u.etag = etag
-}
-
-// fail makes every later fetch fail with err.
-func (u *conditionalUpstream) fail(err error) {
-	u.mu.Lock()
-	defer u.mu.Unlock()
-
-	u.err = err
-}
-
-// fetches returns how many fetches upstream was asked for.
-func (u *conditionalUpstream) fetches() int {
-	u.mu.Lock()
-	defer u.mu.Unlock()
-
-	return len(u.ifNoneMatch)
-}
-
-// lastConditionalHeaders returns the If-None-Match and If-Modified-Since of
-// the last fetch.
-func (u *conditionalUpstream) lastConditionalHeaders() (string, string) {
-	u.mu.Lock()
-	defer u.mu.Unlock()
-
-	last := len(u.ifNoneMatch) - 1
-
-	return u.ifNoneMatch[last], u.ifModifiedSince[last]
-}
-
-// setupConditionalUpstreamProxy returns a proxy whose upstream is a
-// conditionalUpstream serving a red JPEG with an ETag.
-func setupConditionalUpstreamProxy(
-	t *testing.T,
-) (*testProxy, *TestFixtures, *conditionalUpstream) {
-	t.Helper()
-
-	svc, fixtures := setupTestProxy(t)
-	upstream := &conditionalUpstream{
-		image: generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255}),
-		etag:  testETag,
-	}
-	svc.fetcher = upstream
-
-	return svc, fixtures, upstream
-}
-
-// TestProxy_Get_FreshVariantAsksUpstreamNothing checks that a variant whose
-// source was checked with upstream less than the cache TTL ago is served from
-// the cache without asking upstream.
-func TestProxy_Get_FreshVariantAsksUpstreamNothing(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-	variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	first, _ := getImage(t, svc, variant)
-	second, status := getImage(t, svc, variant)
-
-	t.Logf("cache status = %s, upstream fetches = %d", status, upstream.fetches())
-
-	if status != CacheHit {
-		t.Errorf("CacheStatus = %q, want %q", status, CacheHit)
-	}
-
-	if !bytes.Equal(first, second) {
-		t.Error("the cached variant differs from the one first served")
-	}
-
-	if n := upstream.fetches(); n != 1 {
-		t.Errorf("upstream fetches = %d, want 1", n)
-	}
-}
-
-// TestProxy_Get_UnchangedSourceAfterTTLIsNotDownloadedAgain caches a variant,
-// sets its source's check time and the variant's file time two days back,
-// and requests it again, with the source still cached and with the source's
-// row and file removed, as eviction does. Upstream must be asked with the
-// validator it sent, answer 304, and send no bytes; the variant must be served
-// again without being made again, and then be served from the cache until the
-// TTL passes.
-func TestProxy_Get_UnchangedSourceAfterTTLIsNotDownloadedAgain(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name                string
-		sourceEvicted       bool
-		etag                string
-		lastModified        string
-		wantIfNoneMatch     string
-		wantIfModifiedSince string
-	}{
-		{"ETag", false, testETag, "", testETag, ""},
-		{"Last-Modified only", false, "", testLastModified, "", testLastModified},
-		{"both", false, testETag, testLastModified, testETag, testLastModified},
-		{"ETag, source evicted", true, testETag, "", testETag, ""},
-		{"Last-Modified only, source evicted", true, "", testLastModified, "",
-			testLastModified},
-		{"both, source evicted", true, testETag, testLastModified, testETag,
-			testLastModified},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-			upstream.etag = tt.etag
-			upstream.lastModified = tt.lastModified
-			variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-			first, _ := getImage(t, svc, variant)
-			setBackSourceAndVariant(t, svc, variant, time.Now().AddDate(0, 0, -2))
-
-			if tt.sourceEvicted {
-				evictSource(t, svc, variant.Source)
-			}
-
-			second, status := getImage(t, svc, variant)
-
-			ifNoneMatch, ifModifiedSince := upstream.lastConditionalHeaders()
-			counters := readCounters(t, svc)
-			t.Logf("cache status = %s, If-None-Match = %q, If-Modified-Since = %q, "+
-				"counters = %+v", status, ifNoneMatch, ifModifiedSince, counters)
-
-			if ifNoneMatch != tt.wantIfNoneMatch {
-				t.Errorf("If-None-Match = %q, want %q", ifNoneMatch, tt.wantIfNoneMatch)
-			}
-
-			if ifModifiedSince != tt.wantIfModifiedSince {
-				t.Errorf("If-Modified-Since = %q, want %q",
-					ifModifiedSince, tt.wantIfModifiedSince)
-			}
-
-			if !bytes.Equal(first, second) {
-				t.Error("the variant served after the check differs from the cached one")
-			}
-
-			if counters.upstreamFetchCount != 1 || counters.transformCount != 1 {
-				t.Errorf("upstream downloads = %d, transforms = %d; want 1 and 1",
-					counters.upstreamFetchCount, counters.transformCount)
-			}
-
-			_, status = getImage(t, svc, variant)
-			if status != CacheHit {
-				t.Errorf("CacheStatus after the check = %q, want %q", status, CacheHit)
-			}
-
-			if n := upstream.fetches(); n != 2 {
-				t.Errorf("upstream fetches = %d, want 2", n)
-			}
-		})
-	}
-}
-
-// TestProxy_Get_ChangedSourceAfterTTLReplacesSourceAndVariants caches two
-// variants of one source, changes the image upstream, and sets the source's
-// check time and both variants' file times two days back. Each variant must
-// then be made again from the new image, which is downloaded once.
-func TestProxy_Get_ChangedSourceAfterTTLReplacesSourceAndVariants(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-	variants := []*imagerequest.Request{
-		photoVariant(fixtures, 85, imagerequest.FitCover),
-		photoVariant(fixtures, 40, imagerequest.FitCover),
-	}
-
-	oldImages := make([][]byte, len(variants))
-	for i, variant := range variants {
-		oldImages[i], _ = getImage(t, svc, variant)
-	}
-
-	newSource := generateTestJPEG(t, 120, 90, color.RGBA{0, 0, 255, 255})
-	upstream.change(newSource, `"v2"`)
-
-	twoDaysAgo := time.Now().AddDate(0, 0, -2)
-	for _, variant := range variants {
-		setBackSourceAndVariant(t, svc, variant, twoDaysAgo)
-	}
-
-	for i, variant := range variants {
-		image, _ := getImage(t, svc, variant)
-		if bytes.Equal(image, oldImages[i]) {
-			t.Errorf("variant %d is still made from the old image", i)
-		}
-	}
-
-	counters := readCounters(t, svc)
-	t.Logf("counters = %+v, upstream fetches = %d", counters, upstream.fetches())
-
-	if counters.upstreamFetchCount != 2 {
-		t.Errorf("upstream downloads = %d, want 2", counters.upstreamFetchCount)
-	}
-
-	cached, err := os.ReadFile(sourceFilePath(svc, variants[0].Source.Key()))
-	if err != nil {
-		t.Fatalf("reading the cached source: %v", err)
-	}
-
-	if !bytes.Equal(cached, newSource) {
-		t.Error("the cached source is not the new image")
-	}
-}
-
-// TestProxy_Get_UpstreamFailureAfterTTLServesCachedImage caches a variant,
-// sets its source's check time and the variant's file time two days back, and
-// makes upstream fail. The cached variant must still be served, and a variant
-// not yet cached must be made from the cached source.
-func TestProxy_Get_UpstreamFailureAfterTTLServesCachedImage(t *testing.T) {
-	t.Parallel()
-
-	for _, failure := range upstreamFailures() {
-		t.Run(failure.name, func(t *testing.T) {
-			t.Parallel()
-
-			svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-			variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-			first, _ := getImage(t, svc, variant)
-			setBackSourceAndVariant(t, svc, variant, time.Now().AddDate(0, 0, -2))
-			upstream.fail(failure.err)
-
-			second, _ := getImage(t, svc, variant)
-			t.Logf("upstream fetches = %d", upstream.fetches())
-
-			if upstream.fetches() != 2 {
-				t.Errorf("upstream fetches = %d, want 2", upstream.fetches())
-			}
-
-			if !bytes.Equal(first, second) {
-				t.Error("the variant served while upstream fails differs from the cached one")
-			}
-
-			getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-		})
-	}
-}
-
-// TestProxy_Get_FailingUpstreamIsAskedOnceWhileImageIsServedOften caches a
-// variant, sets its source's check time and the variant's file time two days
-// back, and makes every fetch time out. Serving the variant ten times, and a
-// variant not yet cached, must ask upstream once: the failed check puts the
-// source URL in the negative cache.
-func TestProxy_Get_FailingUpstreamIsAskedOnceWhileImageIsServedOften(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-	variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	getImage(t, svc, variant)
-	setBackSourceAndVariant(t, svc, variant, time.Now().AddDate(0, 0, -2))
-	upstream.fail(httpfetcher.ErrUpstreamTimeout)
-
-	for range 10 {
-		getImage(t, svc, variant)
-	}
-
-	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-
-	t.Logf("upstream fetches = %d", upstream.fetches())
-
-	if n := upstream.fetches(); n != 2 {
-		t.Errorf("upstream fetches = %d, want 2: the first fetch and one check", n)
-	}
-}
-
-// TestProxy_Get_UpstreamFailureAfterTTLServesVariantOfEvictedSource caches a
-// variant, sets its file time two days back, removes its source's row and
-// file, as eviction does, and makes upstream fail. The cached variant must
-// still be served.
-func TestProxy_Get_UpstreamFailureAfterTTLServesVariantOfEvictedSource(t *testing.T) {
-	t.Parallel()
-
-	for _, failure := range upstreamFailures() {
-		t.Run(failure.name, func(t *testing.T) {
-			t.Parallel()
-
-			svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-			variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-			first, _ := getImage(t, svc, variant)
-			setBackSourceAndVariant(t, svc, variant, time.Now().AddDate(0, 0, -2))
-			evictSource(t, svc, variant.Source)
-			upstream.fail(failure.err)
-
-			second, _ := getImage(t, svc, variant)
-			t.Logf("upstream fetches = %d", upstream.fetches())
-
-			if !bytes.Equal(first, second) {
-				t.Error("the variant served while upstream fails differs from the cached one")
-			}
-
-			if n := upstream.fetches(); n != 2 {
-				t.Errorf("upstream fetches = %d, want 2", n)
-			}
-		})
-	}
-}
-
-// TestProxy_Get_FailingUpstreamIsAskedOnceForVariantOfEvictedSource caches a
-// variant, sets its file time two days back, removes its source's row and
-// file, as eviction does, and makes every fetch time out. Serving the variant
-// ten times must ask upstream once: the failed check puts the source URL in
-// the negative cache.
-func TestProxy_Get_FailingUpstreamIsAskedOnceForVariantOfEvictedSource(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, upstream := setupConditionalUpstreamProxy(t)
-	variant := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	first, _ := getImage(t, svc, variant)
-	setBackSourceAndVariant(t, svc, variant, time.Now().AddDate(0, 0, -2))
-	evictSource(t, svc, variant.Source)
-	upstream.fail(httpfetcher.ErrUpstreamTimeout)
-
-	for range 10 {
-		image, _ := getImage(t, svc, variant)
-		if !bytes.Equal(image, first) {
-			t.Fatal("the variant served while upstream fails differs from the cached one")
-		}
-	}
-
-	t.Logf("upstream fetches = %d", upstream.fetches())
-
-	if n := upstream.fetches(); n != 2 {
-		t.Errorf("upstream fetches = %d, want 2: the first fetch and one check", n)
-	}
-}
-
-// evictSource removes the row and then the file of src's cached source, as
-// the cache's eviction does, and leaves its variants cached.
-func evictSource(t *testing.T, svc *testProxy, src imagerequest.Source) {
-	t.Helper()
-
-	_, err := svc.db.ExecContext(t.Context(),
-		`DELETE FROM source_content WHERE source_key = ?`, string(src.Key()))
-	if err != nil {
-		t.Fatalf("deleting the source's row: %v", err)
-	}
-
-	err = os.Remove(sourceFilePath(svc, src.Key()))
-	if err != nil {
-		t.Fatalf("removing the source's file: %v", err)
-	}
-}
-
-// setBackSourceAndVariant sets back to when the times the cache keeps for
-// req's source and for the variant req asks for: the source's fetch and check
-// times, both last access times, the variant's check time, and the variant
-// file's modification time.
-func setBackSourceAndVariant(
-	t *testing.T, svc *testProxy, req *imagerequest.Request, when time.Time,
-) {
-	t.Helper()
-
-	key := req.Source.Key()
-	setSourceLastAccessed(t, svc.db, key, when)
-
-	_, err := svc.db.ExecContext(t.Context(),
-		`UPDATE source_content SET fetched_at = ?, checked_at = ?
-		WHERE source_key = ?`, when.UTC(), when.UTC(), string(key))
-	if err != nil {
-		t.Fatalf("setting back the source's fetch and check times: %v", err)
-	}
-
-	variantKey := imagerequest.CacheKey(req)
-	setVariantLastAccessed(t, svc.db, variantKey, when)
-
-	_, err = svc.db.ExecContext(t.Context(),
-		`UPDATE variant_content SET checked_at = ? WHERE cache_key = ?`,
-		when.UTC(), string(variantKey))
-	if err != nil {
-		t.Fatalf("setting back the variant's check time: %v", err)
-	}
-
-	path := variantFilePath(svc, variantKey)
-
-	err = os.Chtimes(path, when, when)
-	if err != nil {
-		t.Fatalf("setting back the times of %s: %v", path, err)
-	}
-}

internal/imageproxy/counters_internal_test.go

@@ -1,77 +0,0 @@
-package imageproxy
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/testutil"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// TestNew_RegistersItsCountersOnItsRegistry checks that New registers the
-// proxy's counters on the registry it is given, under the names README.md
-// gives them. The cache registers its own counters on another registry.
-func TestNew_RegistersItsCountersOnItsRegistry(t *testing.T) {
-	t.Parallel()
-
-	cache, err := imgcache.NewCache(setupTestDB(t),
-		imgcache.Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
-		prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	registry := prometheus.NewRegistry()
-
-	_, err = New(&Config{Cache: cache}, registry)
-	if err != nil {
-		t.Fatalf("New() error = %v", err)
-	}
-
-	names := []string{
-		"pixa_upstream_fetches_total",
-		"pixa_upstream_fetch_bytes_total",
-		"pixa_transforms_total",
-	}
-
-	count, err := testutil.GatherAndCount(registry, names...)
-	if err != nil {
-		t.Fatalf("testutil.GatherAndCount() error = %v", err)
-	}
-
-	if count != len(names) {
-		t.Errorf("%d of the counters %v are on the registry, want %d",
-			count, names, len(names))
-	}
-}
-
-// TestNew_FailsWhenItsCountersCannotBeRegistered makes a second proxy on
-// the registry of a first. Its counters have the same names, so the
-// registry refuses them, and New must return that error.
-func TestNew_FailsWhenItsCountersCannotBeRegistered(t *testing.T) {
-	t.Parallel()
-
-	cache, err := imgcache.NewCache(setupTestDB(t),
-		imgcache.Config{StateDir: t.TempDir(), MaxBytes: 1 << 30},
-		prometheus.NewRegistry())
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	registry := prometheus.NewRegistry()
-
-	_, err = New(&Config{Cache: cache}, registry)
-	if err != nil {
-		t.Fatalf("New() of the first proxy error = %v", err)
-	}
-
-	_, err = New(&Config{Cache: cache}, registry)
-	t.Logf("New() of the second proxy error = %v", err)
-
-	var alreadyRegistered prometheus.AlreadyRegisteredError
-	if !errors.As(err, &alreadyRegistered) {
-		t.Errorf("New() of the second proxy error = %v, want %T",
-			err, alreadyRegistered)
-	}
-}

internal/imageproxy/imageproxy.go

@@ -1,933 +0,0 @@
-// Package imageproxy fetches, transforms, caches and serves images. Its
-// Proxy serves an image from the cache when it can, and otherwise makes it
-// from the cached or fetched source image.
-package imageproxy
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"runtime/debug"
-	"time"
-
-	"github.com/dustin/go-humanize"
-	"github.com/getsentry/sentry-go"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/prometheus/client_golang/prometheus"
-	"golang.org/x/sync/singleflight"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/magic"
-)
-
-// Proxy orchestrates the cache, fetcher, and processor.
-type Proxy struct {
-	cache           *imgcache.Cache
-	fetcher         httpfetcher.Fetcher
-	processor       *imageprocessor.ImageProcessor
-	log             *slog.Logger
-	maxResponseSize int64
-	// variantsInProgress lets the requests that miss the same variant at the
-	// same time share one fetch and one transcode.
-	variantsInProgress singleflight.Group
-
-	// The metrics of upstream fetches and transforms, made and registered by
-	// New. They are kept in memory, so updating one waits for nothing.
-	upstreamFetches        prometheus.Counter
-	upstreamFetchBytes     prometheus.Counter
-	upstreamFetchDurations prometheus.Histogram
-	upstreamFetchErrors    prometheus.Counter
-	transforms             prometheus.Counter
-	transformDurations     prometheus.Histogram
-	transformsInProgress   prometheus.Gauge
-}
-
-// Config holds the proxy's configuration.
-type Config struct {
-	// Cache is the cache instance
-	Cache *imgcache.Cache
-	// Fetcher fetches source images from upstream hosts
-	Fetcher httpfetcher.Fetcher
-	// Processor converts and resizes the images
-	Processor *imageprocessor.ImageProcessor
-	// MaxResponseSize is the largest source accepted, in bytes; a cached
-	// source larger than this is fetched again
-	MaxResponseSize int64
-	// Logger for logging
-	Logger *slog.Logger
-}
-
-// errCacheRequired is returned when the proxy is built without a cache.
-var errCacheRequired = errors.New("cache is required")
-
-// New creates a new image proxy and registers its metrics on
-// metricsRegistry. pixad passes Prometheus' default registry, the one
-// /metrics serves. It fails when metricsRegistry already holds metrics of
-// the same names.
-func New(
-	cfg *Config, metricsRegistry prometheus.Registerer,
-) (*Proxy, error) {
-	if cfg.Cache == nil {
-		return nil, errCacheRequired
-	}
-
-	log := cfg.Logger
-	if log == nil {
-		log = slog.Default()
-	}
-
-	// JPEG XL is the default output format, so pixad does not start
-	// without it.
-	err := imageprocessor.CheckJPEGXLSupport()
-	if err != nil {
-		return nil, err
-	}
-
-	p := &Proxy{
-		cache:           cfg.Cache,
-		fetcher:         cfg.Fetcher,
-		processor:       cfg.Processor,
-		log:             log,
-		maxResponseSize: cfg.MaxResponseSize,
-		upstreamFetches: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_upstream_fetches_total",
-			Help: "Fetches of a source image from upstream that read any bytes.",
-		}),
-		upstreamFetchBytes: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_upstream_fetch_bytes_total",
-			Help: "Bytes read from upstream by fetches of source images.",
-		}),
-		upstreamFetchDurations: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Name: "pixa_upstream_fetch_duration_seconds",
-			Help: "Duration of the fetches pixa_upstream_fetches_total counts, " +
-				"until the response's last byte.",
-		}),
-		upstreamFetchErrors: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_upstream_fetch_errors_total",
-			Help: "Fetches of a source image from upstream that failed, " +
-				"before or while reading the response.",
-		}),
-		transforms: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "pixa_transforms_total",
-			Help: "Images the image processor transformed.",
-		}),
-		transformDurations: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Name: "pixa_transform_duration_seconds",
-			Help: "Duration of the transforms pixa_transforms_total counts, " +
-				"waiting for a processing slot included.",
-		}),
-		transformsInProgress: prometheus.NewGauge(prometheus.GaugeOpts{
-			Name: "pixa_transforms_in_progress",
-			Help: "Images being transformed or waiting for a processing slot.",
-		}),
-	}
-
-	for _, metric := range []prometheus.Collector{
-		p.upstreamFetches, p.upstreamFetchBytes, p.upstreamFetchDurations,
-		p.upstreamFetchErrors, p.transforms, p.transformDurations,
-		p.transformsInProgress,
-	} {
-		err = metricsRegistry.Register(metric)
-		if err != nil {
-			return nil, fmt.Errorf("failed to register the proxy's metrics: %w", err)
-		}
-	}
-
-	return p, nil
-}
-
-// ErrNegativeCached is returned when a URL is in the negative cache (recently failed).
-var ErrNegativeCached = errors.New("request is in negative cache (recently failed)")
-
-// ErrProcessingTimedOut is returned when processing an image stopped because
-// the downstream_timeout of the request doing it ended, to that request and to
-// every request that waited for its image.
-var ErrProcessingTimedOut = errors.New(
-	"image processing stopped at the deadline of the request doing it")
-
-// ImageResponse represents a processed image ready to serve
-type ImageResponse struct {
-	// Content is the image data reader
-	Content io.ReadCloser
-	// ContentLength is the size in bytes (-1 if unknown)
-	ContentLength int64
-	// ContentType is the MIME type of the response
-	ContentType string
-	// ETag is the entity tag for caching
-	ETag string
-	// CacheStatus indicates HIT or MISS
-	CacheStatus CacheStatus
-	// FetchedBytes is the number of bytes fetched from upstream (0 if cache hit)
-	FetchedBytes int64
-}
-
-// CacheStatus indicates whether the response was served from cache.
-type CacheStatus string
-
-// Cache status values for response headers.
-const (
-	CacheHit  CacheStatus = "HIT"
-	CacheMiss CacheStatus = "MISS"
-)
-
-// Get retrieves a processed image, fetching and processing if necessary.
-// While its source URL is in the negative cache, a cached variant is still
-// served and a variant not in the cache is still made from a cached source;
-// only a request that needs the source fetched is refused.
-//
-// A cache hit opens the variant file and makes no database call: the cache
-// hands its access time to the goroutine that writes access times, without
-// waiting for it, and its hit is counted in memory. A variant whose source
-// was last checked with upstream CacheTTL or more ago is a miss, which checks
-// the source first (see processFromSourceOrFetch). A variant file that
-// cannot be served, such as one whose first bytes are not those of an output
-// format, is a miss, and the variant is made again.
-func (p *Proxy) Get(
-	ctx context.Context, req *imagerequest.Request,
-) (*ImageResponse, error) {
-	cacheKey := imagerequest.CacheKey(req)
-
-	cached, err := p.cache.Variant(cacheKey)
-	if err == nil {
-		p.cache.IncrementStats(true)
-
-		return &ImageResponse{
-			Content:       cached.Content,
-			ContentLength: cached.Size,
-			ContentType:   cached.ContentType,
-			CacheStatus:   CacheHit,
-			ETag:          formatETag(cacheKey, cached.CheckedAt),
-		}, nil
-	}
-
-	if !errors.Is(err, imgcache.ErrNotFound) && !errors.Is(err, imgcache.ErrStale) {
-		p.log.Warn("cached variant not served, making it again",
-			"cache_key", cacheKey, "error", err)
-	}
-
-	// Cache miss - get the variant, processed once for all the requests that
-	// miss it at the same time, then count this request's miss, also when it
-	// failed or the request context has ended meanwhile
-	response, err := p.processOrWait(ctx, req)
-
-	p.cache.IncrementStats(false)
-
-	if err != nil {
-		return nil, err
-	}
-
-	response.CacheStatus = CacheMiss
-
-	return response, nil
-}
-
-// WaitForProcessing waits until no image is being processed, or until ctx
-// ends, and returns how many images were still being processed then.
-func (p *Proxy) WaitForProcessing(ctx context.Context) int {
-	return p.processor.WaitForProcessing(ctx)
-}
-
-// errPanicked is returned when processing a variant panicked.
-var errPanicked = errors.New("panic while processing image")
-
-// processOrWait returns the variant req asks for. The first of the requests
-// that miss a variant at the same time processes it, and singleflight hands
-// its result, or its error, to the others: they fetch nothing, read no source
-// and take no upstream connection or processing slot. The processing ignores
-// the first request's cancellation, so the others are still served if that
-// client goes away, but keeps its deadline.
-func (p *Proxy) processOrWait(
-	ctx context.Context, req *imagerequest.Request,
-) (*ImageResponse, error) {
-	// A request that has already ended starts no processing
-	if ctx.Err() != nil {
-		return nil, ctx.Err()
-	}
-
-	cacheKey := imagerequest.CacheKey(req)
-
-	// Closed when this request's own function runs, which singleflight does
-	// only when no other request is processing the variant
-	processing := make(chan struct{})
-
-	results := p.variantsInProgress.DoChan(string(cacheKey),
-		func() (_ any, err error) {
-			close(processing)
-
-			// singleflight would raise a panic again in a goroutine of its
-			// own, where no handler recovers it, and stop pixad. It is
-			// reported through the Sentry hub that the Sentry middleware puts
-			// on the request's context when sentry_dsn is set.
-			defer func() {
-				recovered := recover()
-				if recovered != nil {
-					p.log.Error("panic while processing image",
-						"host", req.Source.Host, "path", req.Source.Path,
-						"panic", recovered, "stack", string(debug.Stack()))
-
-					if hub := sentry.GetHubFromContext(ctx); hub != nil {
-						hub.RecoverWithContext(ctx, recovered)
-					}
-
-					err = fmt.Errorf("%w: %v", errPanicked, recovered)
-				}
-			}()
-
-			processingCtx, cancel := withoutCancelKeepingDeadline(ctx)
-			defer cancel()
-
-			return p.processFromSourceOrFetch(processingCtx, req, cacheKey)
-		})
-
-	var result singleflight.Result
-
-	select {
-	case result = <-results:
-	case <-ctx.Done():
-		select {
-		case <-processing:
-			// This request is processing the variant: it waits for the
-			// result, as every request did before misses were shared
-			result = <-results
-		default:
-			// Another request is processing the variant, or this request's
-			// function has not started yet; the processing goes on without it
-			return nil, ctx.Err()
-		}
-	}
-
-	if result.Err != nil {
-		return nil, result.Err
-	}
-
-	variant, _ := result.Val.(*processedVariant)
-
-	return &ImageResponse{
-		Content:       io.NopCloser(bytes.NewReader(variant.data)),
-		ContentLength: int64(len(variant.data)),
-		ContentType:   variant.contentType,
-		FetchedBytes:  variant.fetchedBytes,
-		ETag:          formatETag(cacheKey, variant.checkedAt),
-	}, nil
-}
-
-// withoutCancelKeepingDeadline returns ctx without its cancellation but with
-// its deadline, if it has one, and the func that releases the returned
-// context.
-func withoutCancelKeepingDeadline(
-	ctx context.Context,
-) (context.Context, context.CancelFunc) {
-	deadline, hasDeadline := ctx.Deadline()
-	if !hasDeadline {
-		return context.WithoutCancel(ctx), func() {}
-	}
-
-	return context.WithDeadline(context.WithoutCancel(ctx), deadline)
-}
-
-// loadCachedSource opens src's cached source, reading only the first bytes,
-// which give its format, and returns it with its size and its format. It
-// returns nil if the source is not in the cache, cannot be read, is in no
-// source format or exceeds maxResponseSize.
-func (p *Proxy) loadCachedSource(
-	ctx context.Context, src imagerequest.Source,
-) (io.ReadCloser, int64, imagerequest.Format) {
-	reader, size, format, err := p.cache.Source(ctx, src)
-	if errors.Is(err, imgcache.ErrNotFound) {
-		return nil, 0, ""
-	}
-
-	if err != nil {
-		p.log.Warn("failed to load cached source, fetching", "error", err)
-
-		return nil, 0, ""
-	}
-
-	p.log.Debug("using cached source", "source_key", src.Key())
-
-	if size > p.maxResponseSize {
-		_ = reader.Close()
-
-		p.log.Warn("cached source exceeds max response size, discarding",
-			"source_key", src.Key(),
-			"max_bytes", p.maxResponseSize,
-		)
-
-		return nil, 0, ""
-	}
-
-	return reader, size, format
-}
-
-// processFromSourceOrFetch makes the variant req asks for, from the cached
-// source when there is one and from a fetched source otherwise. It counts a
-// source cache miss when it fetches the source because the source has no row
-// in the cache or its cached file cannot be used, and a source cache hit
-// otherwise.
-//
-// A cached source last checked with upstream CacheTTL or more ago is checked
-// first: upstream is asked to send it only if it changed since. When it
-// changed, the new bytes replace the cached source and the variant is made
-// from them. When it did not change, or the check fails, the cached source
-// is used: the variant's cached file is served again if it was made from the
-// cached source's bytes, and otherwise the variant is made from them. When
-// the source is not cached but the variant is, the variant is checked with
-// upstream the same way (see fetchAndProcess).
-func (p *Proxy) processFromSourceOrFetch(
-	ctx context.Context,
-	req *imagerequest.Request,
-	cacheKey imagerequest.VariantKey,
-) (*processedVariant, error) {
-	cached, err := p.cache.LookupSource(ctx, req.Source)
-	if err != nil {
-		if !errors.Is(err, imgcache.ErrNotFound) {
-			p.log.Warn("failed to look up cached source, fetching", "error", err)
-		}
-
-		p.cache.IncrementSourceStats(false)
-
-		return p.fetchAndProcess(ctx, req, cacheKey)
-	}
-
-	if p.cache.Stale(cached.CheckedAt) {
-		fetched, err := p.fetchSource(ctx, req, cached.ETag, cached.LastModified)
-
-		switch {
-		case errors.Is(err, errSourceNotModified):
-			cached.CheckedAt = time.Now().UTC()
-			p.renewSource(ctx, req.Source, cached.CheckedAt)
-		case err != nil:
-			p.recordFailedCheck(ctx, req, err)
-		default:
-			p.cache.IncrementSourceStats(true)
-
-			return p.processFetched(ctx, req, cacheKey, fetched)
-		}
-	}
-
-	variant := p.renewVariant(ctx, cacheKey, cached)
-	if variant != nil {
-		p.cache.IncrementSourceStats(true)
-
-		return variant, nil
-	}
-
-	source, sourceSize, sourceFormat := p.loadCachedSource(ctx, req.Source)
-	p.cache.IncrementSourceStats(source != nil)
-
-	// Fetch from upstream if we don't have source data or it's empty
-	if source == nil {
-		return p.fetchAndProcess(ctx, req, cacheKey)
-	}
-
-	defer func() { _ = source.Close() }()
-
-	// Process using cached source; nothing was fetched from upstream. The
-	// image processor reads the source only once it has a processing slot,
-	// so a request waiting for one holds none of it in memory.
-	return p.processAndStore(ctx, req, cacheKey, cached, source, sourceFormat,
-		sourceSize)
-}
-
-// recordFailedCheck logs a failed check of req's source with upstream, after
-// which the image is still served from the cache. It puts the source URL in
-// the negative cache, whatever the failure, a timeout included, so upstream
-// is asked at most once per NegativeTTL while it fails, however often the
-// image is served. A failure that was a negative cache hit records nothing.
-func (p *Proxy) recordFailedCheck(
-	ctx context.Context, req *imagerequest.Request, err error,
-) {
-	if errors.Is(err, ErrNegativeCached) {
-		return
-	}
-
-	p.log.Warn("checking source with upstream failed, serving from the cache",
-		"request_id", middleware.GetReqID(ctx),
-		"host", req.Source.Host, "path", req.Source.Path, "error", err)
-	p.storeNegative(ctx, req)
-}
-
-// renewSource records that upstream answered at checkedAt that src's cached
-// source had not changed. A failure to record it is only logged: the source
-// is then checked again on its next use.
-func (p *Proxy) renewSource(
-	ctx context.Context, src imagerequest.Source, checkedAt time.Time,
-) {
-	err := p.cache.RenewSource(ctx, src, checkedAt)
-	if err != nil {
-		p.log.Warn("failed to renew cached source", "source_key", src.Key(),
-			"error", err)
-	}
-}
-
-// renewVariant returns the cached variant of cacheKey when it was made from
-// the bytes of the cached source that source describes, and renews it to
-// source.CheckedAt (see imgcache.Cache.RenewVariant). It returns nil when
-// there is no such variant or it cannot be read.
-func (p *Proxy) renewVariant(
-	ctx context.Context, cacheKey imagerequest.VariantKey,
-	source imgcache.SourceInfo,
-) *processedVariant {
-	cached, err := p.cache.RenewVariant(ctx, cacheKey, source)
-	if err != nil {
-		if !errors.Is(err, imgcache.ErrNotFound) {
-			p.log.Warn("cached variant not renewed, making it again",
-				"cache_key", cacheKey, "error", err)
-		}
-
-		return nil
-	}
-
-	return p.readCachedVariant(cacheKey, cached)
-}
-
-// cachedVariantIgnoringTTL returns the cached variant of cacheKey whatever
-// its age, with what its row keeps about the source bytes it was made from
-// (see imgcache.Cache.LookupVariant). It returns nil when the variant is not
-// cached or cannot be read. The SourceInfo is empty when the variant is not
-// returned, or its row is missing or cannot be read.
-func (p *Proxy) cachedVariantIgnoringTTL(
-	ctx context.Context, cacheKey imagerequest.VariantKey,
-) (*processedVariant, imgcache.SourceInfo) {
-	cached, err := p.cache.VariantIgnoringTTL(cacheKey)
-	if err != nil {
-		if !errors.Is(err, imgcache.ErrNotFound) {
-			p.log.Warn("cached variant not served", "cache_key", cacheKey,
-				"error", err)
-		}
-
-		return nil, imgcache.SourceInfo{}
-	}
-
-	variant := p.readCachedVariant(cacheKey, cached)
-	if variant == nil {
-		return nil, imgcache.SourceInfo{}
-	}
-
-	madeFrom, err := p.cache.LookupVariant(ctx, cacheKey)
-	if err != nil && !errors.Is(err, imgcache.ErrNotFound) {
-		p.log.Warn("failed to look up cached variant", "cache_key", cacheKey,
-			"error", err)
-	}
-
-	return variant, madeFrom
-}
-
-// readCachedVariant reads the cached variant of cacheKey from its opened file,
-// and closes the file. It returns nil when the variant cannot be read.
-func (p *Proxy) readCachedVariant(
-	cacheKey imagerequest.VariantKey, file imgcache.VariantFile,
-) *processedVariant {
-	defer func() { _ = file.Content.Close() }()
-
-	data, err := io.ReadAll(file.Content)
-	if err != nil {
-		p.log.Warn("failed to read cached variant", "cache_key", cacheKey,
-			"error", err)
-
-		return nil
-	}
-
-	return &processedVariant{
-		data:        data,
-		contentType: file.ContentType,
-		checkedAt:   file.CheckedAt,
-	}
-}
-
-// fetchAndProcess fetches the source from upstream, stores it, and makes
-// and stores the variant from it.
-//
-// The variant can still be cached after eviction removed its source. The
-// fetch then sends the ETag and Last-Modified of the source bytes the variant
-// was made from, so upstream sends the source only if it changed since. When
-// it did not change, the cached variant is renewed and served, with no
-// download and no conversion. When the fetch fails, the cached variant is
-// served whatever its age, and the failure is recorded as a failed check (see
-// recordFailedCheck).
-func (p *Proxy) fetchAndProcess(
-	ctx context.Context,
-	req *imagerequest.Request,
-	cacheKey imagerequest.VariantKey,
-) (*processedVariant, error) {
-	variant, madeFrom := p.cachedVariantIgnoringTTL(ctx, cacheKey)
-
-	fetched, err := p.fetchSource(ctx, req, madeFrom.ETag, madeFrom.LastModified)
-
-	switch {
-	case err == nil:
-		return p.processFetched(ctx, req, cacheKey, fetched)
-	case variant == nil:
-		return nil, err
-	case errors.Is(err, errSourceNotModified):
-		variant.checkedAt = time.Now().UTC()
-
-		err = p.cache.SetVariantCheckedAt(ctx, cacheKey, variant.checkedAt)
-		if err != nil {
-			p.log.Warn("failed to renew cached variant", "cache_key", cacheKey,
-				"error", err)
-		}
-	default:
-		p.recordFailedCheck(ctx, req, err)
-	}
-
-	return variant, nil
-}
-
-// processFetched makes and stores the variant from the source fetchSource
-// fetched, then closes the fetch's response.
-func (p *Proxy) processFetched(
-	ctx context.Context,
-	req *imagerequest.Request,
-	cacheKey imagerequest.VariantKey,
-	fetched *fetchedSource,
-) (*processedVariant, error) {
-	// Closing the response frees the upstream connection. It is closed only
-	// after processing, so the fetcher's connection limit also bounds the
-	// fetched sources held in memory while their requests wait for a
-	// processing slot.
-	defer func() { _ = fetched.response.Close() }()
-
-	return p.processAndStore(ctx, req, cacheKey, fetched.info,
-		bytes.NewReader(fetched.data), fetched.format, int64(len(fetched.data)))
-}
-
-// errSourceNotModified is returned by fetchSource when upstream answers 304
-// Not Modified: the cached source has not changed.
-var errSourceNotModified = errors.New("upstream source not modified")
-
-// fetchedSource is a source fetchSource fetched and stored in the cache.
-type fetchedSource struct {
-	data   []byte
-	format imagerequest.Format
-	// info is what the cache keeps about the source
-	info imgcache.SourceInfo
-	// response is the fetch's response, still open; closing it frees the
-	// upstream connection
-	response io.Closer
-}
-
-// fetchSource fetches req's source from upstream and stores it in the cache.
-// A non-empty ifNoneMatch or ifModifiedSince asks upstream to send the source
-// only if it changed since; errSourceNotModified says it did not. It counts
-// the fetch with the bytes read from upstream and its duration, including
-// when reading the response or a later step fails, and counts a fetch that
-// fails or whose response cannot be read as an upstream fetch error. It
-// fetches nothing while the source URL is in the negative cache. The caller
-// closes the returned response.
-func (p *Proxy) fetchSource(
-	ctx context.Context,
-	req *imagerequest.Request,
-	ifNoneMatch, ifModifiedSince string,
-) (*fetchedSource, error) {
-	err := p.refuseNegativeCached(ctx, req)
-	if err != nil {
-		return nil, err
-	}
-
-	// Fetch from upstream
-	p.log.Debug("fetching from upstream", "host", req.Source.Host,
-		"path", req.Source.Path, "query", req.Source.Query)
-
-	fetchStart := time.Now()
-
-	fetchResult, err := p.fetcher.Fetch(ctx, req.Source,
-		ifNoneMatch, ifModifiedSince)
-	if err != nil {
-		p.upstreamFetchErrors.Inc()
-
-		// Store negative cache for certain errors
-		if isNegativeCacheable(err) {
-			p.storeNegative(ctx, req)
-		}
-
-		return nil, fmt.Errorf("upstream fetch failed: %w", err)
-	}
-
-	if fetchResult.StatusCode == http.StatusNotModified {
-		_ = fetchResult.Content.Close()
-
-		p.log.Info("upstream source not modified",
-			"request_id", middleware.GetReqID(ctx), "host", req.Source.Host,
-			"path", req.Source.Path, "fetch_ms", fetchResult.FetchDurationMs)
-
-		return nil, errSourceNotModified
-	}
-
-	// Read and validate the source content
-	sourceData, err := io.ReadAll(fetchResult.Content)
-	fetchBytes := int64(len(sourceData))
-
-	// Counted also when the request context has ended meanwhile
-	p.incrementUpstreamFetch(fetchBytes, time.Since(fetchStart))
-
-	if err != nil {
-		p.upstreamFetchErrors.Inc()
-
-		_ = fetchResult.Content.Close()
-
-		return nil, fmt.Errorf("failed to read upstream response: %w", err)
-	}
-
-	p.logUpstreamFetch(ctx, req, fetchResult, fetchBytes)
-
-	// The source's format, detected from its first bytes, which must match
-	// its content type. A body that does not is the upstream's error, so it
-	// gets a negative cache entry, as an upstream error status does.
-	sourceFormat, err := magic.ValidateMagicBytes(sourceData,
-		fetchResult.ContentType)
-	if err != nil {
-		p.log.Warn("source refused", "request_id", middleware.GetReqID(ctx),
-			"host", req.Source.Host, "path", req.Source.Path,
-			"content_type", fetchResult.ContentType, "error", err)
-		p.storeNegative(ctx, req)
-
-		_ = fetchResult.Content.Close()
-
-		return nil, fmt.Errorf("content validation failed: %w", err)
-	}
-
-	info := fetchedSourceInfo(fetchResult)
-
-	// Store source content
-	_, err = p.cache.PutSource(ctx, req.Source, bytes.NewReader(sourceData), info)
-	if err != nil {
-		p.log.Warn("failed to store source content", "error", err)
-		// Continue even if caching fails
-	}
-
-	return &fetchedSource{
-		data:     sourceData,
-		format:   sourceFormat,
-		info:     info,
-		response: fetchResult.Content,
-	}, nil
-}
-
-// refuseNegativeCached returns an error wrapping ErrNegativeCached while
-// req's source URL is in the negative cache, and nil otherwise. A failure to
-// read the negative cache is only logged, and returns nil.
-func (p *Proxy) refuseNegativeCached(
-	ctx context.Context, req *imagerequest.Request,
-) error {
-	negHit, err := p.cache.Failure(ctx, req.Source)
-	if err != nil {
-		p.log.Warn("negative cache check failed", "error", err)
-	}
-
-	if !negHit {
-		return nil
-	}
-
-	p.log.Debug("negative cache hit",
-		"host", req.Source.Host,
-		"path", req.Source.Path,
-	)
-
-	return fmt.Errorf("%w: %w", httpfetcher.ErrUpstreamError, ErrNegativeCached)
-}
-
-// fetchedSourceInfo returns what the cache keeps about a source upstream
-// just sent: fetched and checked now, with the ETag and Last-Modified
-// headers of fetchResult.
-func fetchedSourceInfo(fetchResult *httpfetcher.FetchResult) imgcache.SourceInfo {
-	now := time.Now().UTC()
-	upstreamHeaders := http.Header(fetchResult.Headers)
-
-	return imgcache.SourceInfo{
-		FetchedAt:    now,
-		CheckedAt:    now,
-		ETag:         upstreamHeaders.Get("ETag"),
-		LastModified: upstreamHeaders.Get("Last-Modified"),
-	}
-}
-
-// logUpstreamFetch logs a fetch of req's source that read fetchBytes bytes,
-// with its download rate and connection details.
-func (p *Proxy) logUpstreamFetch(
-	ctx context.Context,
-	req *imagerequest.Request,
-	fetchResult *httpfetcher.FetchResult,
-	fetchBytes int64,
-) {
-	var downloadRate string
-
-	if fetchResult.FetchDurationMs > 0 {
-		seconds := float64(fetchResult.FetchDurationMs) / 1000.0 //nolint:mnd // ms to seconds
-		bitsPerSecond := float64(fetchBytes*8) / seconds         //nolint:mnd // bytes to bits
-		downloadRate = humanize.SI(bitsPerSecond, "bps")
-	}
-
-	p.log.Info("upstream fetched",
-		"request_id", middleware.GetReqID(ctx),
-		"host", req.Source.Host,
-		"path", req.Source.Path,
-		"bytes", fetchBytes,
-		"fetch_ms", fetchResult.FetchDurationMs,
-		"rate", downloadRate,
-		"remote_addr", fetchResult.RemoteAddr,
-		"http", fetchResult.HTTPVersion,
-		"tls", fetchResult.TLSVersion,
-		"cipher", fetchResult.TLSCipherSuite,
-	)
-}
-
-// incrementUpstreamFetch counts one upstream fetch that read fetchBytes bytes
-// and took duration. A fetch that read no bytes is not counted.
-func (p *Proxy) incrementUpstreamFetch(fetchBytes int64, duration time.Duration) {
-	if fetchBytes <= 0 {
-		return
-	}
-
-	p.upstreamFetches.Inc()
-	p.upstreamFetchBytes.Add(float64(fetchBytes))
-	p.upstreamFetchDurations.Observe(duration.Seconds())
-}
-
-// storeNegative stores a negative cache entry for req's source, whose fetch
-// failed, so the source is not fetched again until the entry expires. A
-// failure to store the entry is only logged.
-func (p *Proxy) storeNegative(ctx context.Context, req *imagerequest.Request) {
-	err := p.cache.PutFailure(ctx, req.Source)
-	if err != nil {
-		p.log.Warn("failed to store negative cache entry",
-			"host", req.Source.Host, "path", req.Source.Path, "error", err)
-	}
-}
-
-// processedVariant is a variant as processAndStore made it. Each request that
-// shared its processing serves it through a reader of its own.
-type processedVariant struct {
-	data         []byte
-	contentType  string
-	fetchedBytes int64
-	// checkedAt is its source's check time when the variant was made or last
-	// renewed, which its cached file has as its modification time
-	checkedAt time.Time
-}
-
-// processAndStore processes the image read from source, which is in
-// sourceFormat, and stores the result. sourceInfo describes the source's
-// bytes, and is stored with the variant (see imgcache.Cache.PutVariant).
-func (p *Proxy) processAndStore(
-	ctx context.Context,
-	req *imagerequest.Request,
-	cacheKey imagerequest.VariantKey,
-	sourceInfo imgcache.SourceInfo,
-	source io.Reader,
-	sourceFormat imagerequest.Format,
-	fetchBytes int64,
-) (*processedVariant, error) {
-	// Process the image
-	processStart := time.Now()
-
-	// ctx has the deadline of the request doing the processing, which can
-	// end while a request waiting for its image has time left
-	processResult, err := p.transform(ctx, source, sourceFormat, &req.Transform)
-	if errors.Is(err, context.DeadlineExceeded) {
-		return nil, fmt.Errorf("%w: %w", ErrProcessingTimedOut, err)
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("image processing failed: %w", err)
-	}
-
-	processDuration := time.Since(processStart)
-
-	// Counted also when the request context has ended meanwhile
-	p.transforms.Inc()
-	p.transformDurations.Observe(processDuration.Seconds())
-
-	// Read processed content
-	processedData, err := io.ReadAll(processResult.Content)
-	_ = processResult.Content.Close()
-
-	if err != nil {
-		return nil, fmt.Errorf("failed to read processed content: %w", err)
-	}
-
-	// Log conversion details
-	outputSize := int64(len(processedData))
-
-	var sizePercent float64
-	if fetchBytes > 0 {
-		//nolint:mnd // percentage calculation
-		sizePercent = float64(outputSize) / float64(fetchBytes) * 100.0
-	}
-
-	p.log.Info("image converted",
-		"request_id", middleware.GetReqID(ctx),
-		"host", req.Source.Host,
-		"path", req.Source.Path,
-		"src_format", sourceFormat,
-		"dst_format", req.Transform.Format,
-		"src_bytes", fetchBytes,
-		"dst_bytes", outputSize,
-		"src_dimensions", fmt.Sprintf("%dx%d",
-			processResult.InputWidth, processResult.InputHeight),
-		"dst_dimensions", fmt.Sprintf("%dx%d",
-			processResult.Width, processResult.Height),
-		"size_ratio", fmt.Sprintf("%.1f%%", sizePercent),
-		"convert_ms", processDuration.Milliseconds(),
-		"quality", req.Transform.Quality,
-		"fit", req.Transform.FitMode,
-	)
-
-	// Store variant to cache
-	err = p.cache.PutVariant(ctx, cacheKey, sourceInfo,
-		bytes.NewReader(processedData))
-	if err != nil {
-		p.log.Warn("failed to store variant", "error", err)
-		// Continue even if caching fails
-	}
-
-	return &processedVariant{
-		data:         processedData,
-		contentType:  processResult.ContentType,
-		fetchedBytes: fetchBytes,
-		checkedAt:    sourceInfo.CheckedAt,
-	}, nil
-}
-
-// transform has the image processor transform the image read from source
-// as requested says, and counts it in pixa_transforms_in_progress until the
-// processor returns or panics.
-func (p *Proxy) transform(
-	ctx context.Context,
-	source io.Reader,
-	sourceFormat imagerequest.Format,
-	requested *imagerequest.Transform,
-) (*imageprocessor.Result, error) {
-	p.transformsInProgress.Inc()
-	defer p.transformsInProgress.Dec()
-
-	return p.processor.Process(ctx, source, sourceFormat, requested)
-}
-
-// isNegativeCacheable returns true if the error should be cached.
-func isNegativeCacheable(err error) bool {
-	return errors.Is(err, httpfetcher.ErrUpstreamError)
-}
-
-// etagHashLength is the number of hash characters to use for ETags.
-const etagHashLength = 16
-
-// formatETag returns the quoted ETag of the variant of key: the first
-// etagHashLength characters of key, then checkedAt in Unix nanoseconds.
-// checkedAt is its source's check time when the variant was made or last
-// renewed, so a variant made again from new source bytes gets another ETag.
-func formatETag(key imagerequest.VariantKey, checkedAt time.Time) string {
-	hash := string(key)
-	// Use first 16 characters of hash for a shorter but still unique ETag
-	if len(hash) > etagHashLength {
-		hash = hash[:etagHashLength]
-	}
-
-	return fmt.Sprintf(`"%s-%d"`, hash, checkedAt.UnixNano())
-}

internal/imageproxy/imageproxy_internal_test.go

@@ -1,482 +0,0 @@
-package imageproxy
-
-import (
-	"context"
-	"io"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/magic"
-)
-
-// Test data literals used repeatedly in this file (goconst).
-const (
-	testPathPhoto  = "/images/photo.jpg"
-	testPathUpload = "/uploads/image.jpg"
-)
-
-func TestProxy_Get_GoodHost(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	resp, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() error = %v", err)
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
-	// Verify we got content
-	data, err := io.ReadAll(resp.Content)
-	if err != nil {
-		t.Fatalf("failed to read response: %v", err)
-	}
-
-	if len(data) == 0 {
-		t.Error("expected non-empty response")
-	}
-
-	if resp.ContentType != testContentTypeJPEG {
-		t.Errorf("ContentType = %q, want %q", resp.ContentType, testContentTypeJPEG)
-	}
-}
-
-// TestProxy_Get_OtherHost checks that the proxy serves a second host as it
-// serves GoodHost.
-func TestProxy_Get_OtherHost(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.OtherHost,
-			Path: testPathUpload,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	// Should fetch successfully
-	resp, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() error = %v", err)
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
-	data, err := io.ReadAll(resp.Content)
-	if err != nil {
-		t.Fatalf("failed to read response: %v", err)
-	}
-
-	if len(data) == 0 {
-		t.Error("expected non-empty response")
-	}
-}
-
-func TestProxy_Get_InvalidFile(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-	req.Source.Path = "/images/fake.jpg"
-	req.Transform.Size = imagerequest.Size{Width: 50, Height: 50}
-
-	// Should fail because magic bytes don't match
-	_, err := svc.Get(ctx, req)
-	if err == nil {
-		t.Error("Get() expected error for invalid file")
-	}
-}
-
-func TestProxy_Get_NotFound(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-	req.Source.Path = "/images/nonexistent.jpg"
-	req.Transform.Size = imagerequest.Size{Width: 50, Height: 50}
-
-	_, err := svc.Get(ctx, req)
-	if err == nil {
-		t.Error("Get() expected error for nonexistent file")
-	}
-}
-
-func TestProxy_Get_FormatConversion(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	tests := []struct {
-		name       string
-		sourcePath string
-		outFormat  imagerequest.Format
-		wantMIME   string
-	}{
-		{
-			name:       "JPEG to PNG",
-			sourcePath: testPathPhoto,
-			outFormat:  imagerequest.FormatPNG,
-			wantMIME:   "image/png",
-		},
-		{
-			name:       "PNG to JPEG",
-			sourcePath: "/images/logo.png",
-			outFormat:  imagerequest.FormatJPEG,
-			wantMIME:   testContentTypeJPEG,
-		},
-		{
-			name:       "GIF to PNG",
-			sourcePath: "/images/animation.gif",
-			outFormat:  imagerequest.FormatPNG,
-			wantMIME:   "image/png",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			req := &imagerequest.Request{
-				Source: imagerequest.Source{Host: fixtures.GoodHost, Path: tt.sourcePath},
-				Transform: imagerequest.Transform{
-					Size:   imagerequest.Size{Width: 50, Height: 50},
-					Format: tt.outFormat, Quality: 85, FitMode: imagerequest.FitCover,
-				},
-			}
-
-			resp, err := svc.Get(ctx, req)
-			if err != nil {
-				t.Fatalf("Get() error = %v", err)
-			}
-
-			defer func() { _ = resp.Content.Close() }()
-
-			if resp.ContentType != tt.wantMIME {
-				t.Errorf("ContentType = %q, want %q", resp.ContentType, tt.wantMIME)
-			}
-
-			// Verify magic bytes match the expected format
-			data, err := io.ReadAll(resp.Content)
-			if err != nil {
-				t.Fatalf("failed to read response: %v", err)
-			}
-
-			detectedFormat, err := magic.DetectFormat(data)
-			if err != nil {
-				t.Fatalf("failed to detect format: %v", err)
-			}
-
-			if detectedFormat.MIMEType() != tt.wantMIME {
-				t.Errorf("detected format = %q, want the format of %s",
-					detectedFormat, tt.wantMIME)
-			}
-		})
-	}
-}
-
-func TestProxy_Get_Caching(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	// First request - should be a cache miss
-	resp1, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() first request error = %v", err)
-	}
-
-	if resp1.CacheStatus != CacheMiss {
-		t.Errorf("first request CacheStatus = %q, want %q", resp1.CacheStatus, CacheMiss)
-	}
-
-	data1, err := io.ReadAll(resp1.Content)
-	if err != nil {
-		t.Fatalf("failed to read first response: %v", err)
-	}
-
-	_ = resp1.Content.Close()
-
-	// Second request - should be a cache hit
-	resp2, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() second request error = %v", err)
-	}
-
-	if resp2.CacheStatus != CacheHit {
-		t.Errorf("second request CacheStatus = %q, want %q", resp2.CacheStatus, CacheHit)
-	}
-
-	data2, err := io.ReadAll(resp2.Content)
-	if err != nil {
-		t.Fatalf("failed to read second response: %v", err)
-	}
-
-	_ = resp2.Content.Close()
-
-	// Content should be identical
-	if len(data1) != len(data2) {
-		t.Errorf("response sizes differ: %d vs %d", len(data1), len(data2))
-	}
-}
-
-func TestProxy_Get_DifferentSizes(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	// Request same image at different sizes
-	sizes := []imagerequest.Size{
-		{Width: 25, Height: 25},
-		{Width: 50, Height: 50},
-		{Width: 75, Height: 75},
-	}
-
-	responses := make([][]byte, 0, len(sizes))
-
-	for _, size := range sizes {
-		req := &imagerequest.Request{
-			Source: imagerequest.Source{
-				Host: fixtures.GoodHost,
-				Path: testPathPhoto,
-			},
-			Transform: imagerequest.Transform{
-				Size:    size,
-				Format:  imagerequest.FormatJPEG,
-				Quality: 85,
-				FitMode: imagerequest.FitCover,
-			},
-		}
-
-		resp, err := svc.Get(ctx, req)
-		if err != nil {
-			t.Fatalf("Get() error for size %v = %v", size, err)
-		}
-
-		data, err := io.ReadAll(resp.Content)
-		if err != nil {
-			t.Fatalf("failed to read response: %v", err)
-		}
-
-		_ = resp.Content.Close()
-
-		responses = append(responses, data)
-	}
-
-	// All responses should be different sizes (different cache entries)
-	for i := range len(responses) - 1 {
-		if len(responses[i]) == len(responses[i+1]) {
-			// Not necessarily an error, but worth noting
-			t.Logf("responses %d and %d have same size: %d bytes",
-				i, i+1, len(responses[i]))
-		}
-	}
-}
-
-func TestProxy_Get_ContextCancellation(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel() // Cancel immediately
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	_, err := svc.Get(ctx, req)
-	if err == nil {
-		t.Error("Get() expected error for cancelled context")
-	}
-}
-
-func TestProxy_Get_ReturnsETag(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	resp, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() error = %v", err)
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
-	// ETag should be set
-	if resp.ETag == "" {
-		t.Error("ETag should be set in response")
-	}
-
-	// ETag should be properly quoted
-	if len(resp.ETag) < 2 || resp.ETag[0] != '"' || resp.ETag[len(resp.ETag)-1] != '"' {
-		t.Errorf("ETag should be quoted, got %q", resp.ETag)
-	}
-}
-
-func TestProxy_Get_ETagConsistency(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	// First request
-	resp1, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() first request error = %v", err)
-	}
-
-	etag1 := resp1.ETag
-
-	_ = resp1.Content.Close()
-
-	// Second request (from cache)
-	resp2, err := svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() second request error = %v", err)
-	}
-
-	etag2 := resp2.ETag
-
-	_ = resp2.Content.Close()
-
-	// ETags should be identical for the same content
-	if etag1 != etag2 {
-		t.Errorf("ETags should match: %q != %q", etag1, etag2)
-	}
-}
-
-func TestProxy_Get_DifferentETagsForDifferentContent(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	ctx := context.Background()
-
-	// Request same image at different sizes - should get different ETags
-	req1 := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 25, Height: 25},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	req2 := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	resp1, err := svc.Get(ctx, req1)
-	if err != nil {
-		t.Fatalf("Get() first request error = %v", err)
-	}
-
-	etag1 := resp1.ETag
-
-	_ = resp1.Content.Close()
-
-	resp2, err := svc.Get(ctx, req2)
-	if err != nil {
-		t.Fatalf("Get() second request error = %v", err)
-	}
-
-	etag2 := resp2.ETag
-
-	_ = resp2.Content.Close()
-
-	// ETags should be different for different content
-	if etag1 == etag2 {
-		t.Error("ETags should differ for different sizes")
-	}
-}

internal/imageproxy/metrics_internal_test.go

@@ -1,213 +0,0 @@
-package imageproxy
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// metricValues holds the source cache, upstream fetch and transform metrics
-// of a proxy and its cache. A histogram is given by its count of
-// observations.
-type metricValues struct {
-	sourceCacheHits   uint64
-	sourceCacheMisses uint64
-	fetchDurations    uint64
-	fetchErrors       uint64
-	transformDuration uint64
-	inProgress        float64
-}
-
-// readMetricValues reads the metrics of svc and its cache that
-// metricValues holds from their metrics registry.
-func readMetricValues(t *testing.T, svc *testProxy) metricValues {
-	t.Helper()
-
-	families, err := svc.registry.Gather()
-	if err != nil {
-		t.Fatalf("failed to gather the metrics: %v", err)
-	}
-
-	var values metricValues
-
-	for _, family := range families {
-		metric := family.GetMetric()[0]
-
-		switch family.GetName() {
-		case "pixa_source_cache_hits_total":
-			values.sourceCacheHits = uint64(metric.GetCounter().GetValue())
-		case "pixa_source_cache_misses_total":
-			values.sourceCacheMisses = uint64(metric.GetCounter().GetValue())
-		case "pixa_upstream_fetch_duration_seconds":
-			values.fetchDurations = metric.GetHistogram().GetSampleCount()
-		case "pixa_upstream_fetch_errors_total":
-			values.fetchErrors = uint64(metric.GetCounter().GetValue())
-		case "pixa_transform_duration_seconds":
-			values.transformDuration = metric.GetHistogram().GetSampleCount()
-		case "pixa_transforms_in_progress":
-			values.inProgress = metric.GetGauge().GetValue()
-		}
-	}
-
-	return values
-}
-
-// TestProxy_Get_CountsSourceCacheFetchesAndTransforms walks Get through a
-// miss that fetches the source, a hit, a miss that uses the cached source
-// and a miss whose source is not found upstream, checking the source cache,
-// upstream fetch and transform metrics after each.
-func TestProxy_Get_CountsSourceCacheFetchesAndTransforms(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	// want is source cache hits, source cache misses, fetch durations
-	// observed, fetch errors, transform durations observed, transforms in
-	// progress.
-	steps := []struct {
-		name    string
-		path    string
-		size    int
-		wantErr bool
-		want    metricValues
-	}{
-		{"miss that fetches the source", testPathPhoto, 50, false,
-			metricValues{0, 1, 1, 0, 1, 0}},
-		{"hit", testPathPhoto, 50, false,
-			metricValues{0, 1, 1, 0, 1, 0}},
-		{"miss that uses the cached source", testPathPhoto, 25, false,
-			metricValues{1, 1, 1, 0, 2, 0}},
-		{"miss whose source is not found", "/images/absent.jpg", 50, true,
-			metricValues{1, 2, 1, 1, 2, 0}},
-	}
-
-	for _, step := range steps {
-		resp, err := svc.Get(t.Context(), &imagerequest.Request{
-			Source: imagerequest.Source{
-				Host: fixtures.GoodHost,
-				Path: step.path,
-			},
-			Transform: imagerequest.Transform{
-				Size:    imagerequest.Size{Width: step.size, Height: step.size},
-				Format:  imagerequest.FormatJPEG,
-				Quality: 85,
-				FitMode: imagerequest.FitCover,
-			},
-		})
-		if (err != nil) != step.wantErr {
-			t.Fatalf("%s: Get() error = %v, want error %t", step.name, err, step.wantErr)
-		}
-
-		if err == nil {
-			_ = resp.Content.Close()
-		}
-
-		got := readMetricValues(t, svc)
-		t.Logf("after the %s: metrics = %+v", step.name, got)
-
-		if got != step.want {
-			t.Fatalf("after the %s: metrics = %+v, want %+v", step.name, got, step.want)
-		}
-	}
-}
-
-// TestProxy_Get_CountsMissingSourceFileAsSourceCacheMiss deletes the file of
-// a cached source but keeps its row. A request for a second variant of that
-// source must fetch the source again, and count a source cache miss, not a
-// hit.
-func TestProxy_Get_CountsMissingSourceFileAsSourceCacheMiss(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	// A first request caches the photo as a source.
-	resp, err := svc.Get(t.Context(), widthOnlyRequest(fixtures, 50))
-	if err != nil {
-		t.Fatalf("first Get() error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	source := widthOnlyRequest(fixtures, 50).Source
-
-	err = os.Remove(sourceFilePath(svc, source.Key()))
-	if err != nil {
-		t.Fatalf("failed to delete the cached source file: %v", err)
-	}
-
-	before := readMetricValues(t, svc)
-
-	resp, err = svc.Get(t.Context(), widthOnlyRequest(fixtures, 25))
-	if err != nil {
-		t.Fatalf("Get() of a second variant error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	after := readMetricValues(t, svc)
-	t.Logf("before the second variant: metrics = %+v; after: %+v", before, after)
-
-	if after.sourceCacheHits != before.sourceCacheHits ||
-		after.sourceCacheMisses != before.sourceCacheMisses+1 {
-		t.Errorf("source cache hits went from %d to %d and misses from %d to %d, "+
-			"want no new hit and one more miss", before.sourceCacheHits,
-			after.sourceCacheHits, before.sourceCacheMisses, after.sourceCacheMisses)
-	}
-}
-
-// TestProxy_Get_CountsTransformWaitingForSlotAsInProgress holds the only
-// processing slot and starts a request that must transform the photo. While
-// the request waits for the slot, pixa_transforms_in_progress must be 1; once
-// the request returns, 0.
-func TestProxy_Get_CountsTransformWaitingForSlotAsInProgress(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	svc.processor = imageprocessor.New(
-		imageprocessor.Params{MaxInputBytes: 50 << 20, MaxConcurrentProcessing: 1},
-	)
-
-	release := holdProcessingSlot(t, svc.processor)
-
-	result := startGet(t.Context(), svc, widthOnlyRequest(fixtures, 50))
-
-	// The request fetches the photo first, then waits for the slot.
-	deadline := time.Now().Add(5 * time.Second)
-	for readMetricValues(t, svc).inProgress != 1 && time.Now().Before(deadline) {
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	waiting := readMetricValues(t, svc).inProgress
-	t.Logf("while the request waits for the slot: transforms in progress = %v",
-		waiting)
-
-	select {
-	case got := <-result:
-		t.Fatalf("Get() returned while the only processing slot was held, "+
-			"error = %v", got.err)
-	default:
-	}
-
-	if waiting != 1 {
-		t.Fatalf("transforms in progress = %v while the request waits for the "+
-			"slot, want 1", waiting)
-	}
-
-	release()
-
-	got := <-result
-	if got.err != nil {
-		t.Fatalf("Get() error = %v", got.err)
-	}
-
-	returned := readMetricValues(t, svc).inProgress
-	t.Logf("once the request returned: transforms in progress = %v", returned)
-
-	if returned != 0 {
-		t.Errorf("transforms in progress = %v once the request returned, want 0",
-			returned)
-	}
-}

internal/imageproxy/negative_cache_internal_test.go

@@ -1,84 +0,0 @@
-package imageproxy
-
-import (
-	"errors"
-	"os"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// TestProxy_Get_ServesCachedVariantOfNegativeCachedURL caches a variant of
-// the test photo, then keeps a failed fetch of the photo's URL in the negative
-// cache, as a failed fetch for another variant does once the source has been
-// evicted. The cached variant is still served, and a variant not in the cache
-// is made from the cached source. Once the source is evicted, a variant not in
-// the cache needs a fetch and is refused.
-func TestProxy_Get_ServesCachedVariantOfNegativeCachedURL(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	resp, err := svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
-	if err != nil {
-		t.Fatalf("Get() first request error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	err = svc.cache.PutFailure(t.Context(),
-		photoVariant(fixtures, 85, imagerequest.FitCover).Source)
-	if err != nil {
-		t.Fatalf("PutFailure() error = %v", err)
-	}
-
-	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 85, imagerequest.FitCover))
-	if err != nil {
-		t.Fatalf("Get() of the cached variant error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	if resp.CacheStatus != CacheHit {
-		t.Errorf("cached variant CacheStatus = %q, want %q",
-			resp.CacheStatus, CacheHit)
-	}
-
-	resp, err = svc.Get(t.Context(), photoVariant(fixtures, 40, imagerequest.FitCover))
-	t.Logf("Get() of a variant made from the cached source: error = %v", err)
-
-	if err != nil {
-		t.Fatalf("Get() of a variant made from the cached source error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	source := photoVariant(fixtures, 85, imagerequest.FitCover).Source
-
-	reader, _, _, err := svc.cache.Source(t.Context(), source)
-	if err != nil {
-		t.Fatalf("Source() error = %v, want the cached source", err)
-	}
-
-	_ = reader.Close()
-
-	// Evicts the source as the cache's eviction does: its row, then its file
-	_, err = svc.db.ExecContext(t.Context(),
-		`DELETE FROM source_content WHERE source_key = ?`, string(source.Key()))
-	if err != nil {
-		t.Fatalf("deleting the source's row: %v", err)
-	}
-
-	err = os.Remove(sourceFilePath(svc, source.Key()))
-	if err != nil {
-		t.Fatalf("removing the source's file: %v", err)
-	}
-
-	_, err = svc.Get(t.Context(), photoVariant(fixtures, 60, imagerequest.FitCover))
-	t.Logf("Get() of a variant whose source was evicted: error = %v", err)
-
-	if !errors.Is(err, ErrNegativeCached) {
-		t.Errorf("Get() of a variant whose source was evicted error = %v, want %v",
-			err, ErrNegativeCached)
-	}
-}

internal/imageproxy/partial_cache_files_internal_test.go

@@ -1,184 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// getImage calls Get for req and returns the image it answered with and
-// its cache status.
-func getImage(
-	t *testing.T, svc *testProxy, req *imagerequest.Request,
-) ([]byte, CacheStatus) {
-	t.Helper()
-
-	resp, err := svc.Get(t.Context(), req)
-	if err != nil {
-		t.Fatalf("Get() of quality %d error = %v", req.Transform.Quality, err)
-	}
-
-	defer func() { _ = resp.Content.Close() }()
-
-	body, err := io.ReadAll(resp.Content)
-	if err != nil {
-		t.Fatalf("reading the image of quality %d: %v", req.Transform.Quality, err)
-	}
-
-	return body, resp.CacheStatus
-}
-
-// fileSize returns the size of the file at path.
-func fileSize(t *testing.T, path string) int64 {
-	t.Helper()
-
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("stat %s: %v", path, err)
-	}
-
-	return info.Size()
-}
-
-// cachedSourcePath returns the path of the cached source file req uses.
-func cachedSourcePath(
-	t *testing.T, svc *testProxy, req *imagerequest.Request,
-) string {
-	t.Helper()
-
-	reader, _, _, err := svc.cache.Source(t.Context(), req.Source)
-	if err != nil {
-		t.Fatalf("Source() error = %v; want the cached source", err)
-	}
-
-	_ = reader.Close()
-
-	return sourceFilePath(svc, req.Source.Key())
-}
-
-// TestProxy_Get_FetchesAgainForRemovedCachedSource removes the cached
-// source's row and file, as the reconciliation pass does when the file is
-// empty or cut short. internal/imgcache tests that the pass does so. The
-// test then asks for two new sizes of the source. The first must fetch it
-// again and cache it whole, so the second is made from the cache without a
-// third fetch.
-func TestProxy_Get_FetchesAgainForRemovedCachedSource(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	source := photoVariant(fixtures, 85, imagerequest.FitCover).Source
-	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-	wholeSize := fileSize(t, path)
-
-	// Removes the source as the reconciliation pass does: its row, then its file
-	_, err := svc.db.ExecContext(t.Context(),
-		`DELETE FROM source_content WHERE source_key = ?`, string(source.Key()))
-	if err != nil {
-		t.Fatalf("deleting the source's row: %v", err)
-	}
-
-	err = os.Remove(path)
-	if err != nil {
-		t.Fatalf("removing the source's file: %v", err)
-	}
-
-	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-	getImage(t, svc, photoVariant(fixtures, 30, imagerequest.FitCover))
-
-	fetches := readCounters(t, svc).upstreamFetchCount
-	t.Logf("upstream fetches = %d", fetches)
-
-	if fetches != 2 {
-		t.Errorf("upstream fetches = %d, want 2", fetches)
-	}
-
-	size := fileSize(t, path)
-	if size != wholeSize {
-		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
-	}
-}
-
-// TestProxy_Get_FetchesAgainSourceOfNoSourceFormat replaces the cached
-// source's file with text. The next request for a new size of the source
-// must fetch it again and cache it whole.
-func TestProxy_Get_FetchesAgainSourceOfNoSourceFormat(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	getImage(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	path := cachedSourcePath(t, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-	wholeSize := fileSize(t, path)
-
-	err := os.WriteFile(path, []byte("this is text, not an image"),
-		imgcache.StorageFilePerm)
-	if err != nil {
-		t.Fatalf("replacing the source's file: %v", err)
-	}
-
-	getImage(t, svc, photoVariant(fixtures, 40, imagerequest.FitCover))
-
-	fetches := readCounters(t, svc).upstreamFetchCount
-	t.Logf("upstream fetches = %d", fetches)
-
-	if fetches != 2 {
-		t.Errorf("upstream fetches = %d, want 2", fetches)
-	}
-
-	size := fileSize(t, path)
-	if size != wholeSize {
-		t.Errorf("cached source is %d bytes, want %d", size, wholeSize)
-	}
-}
-
-// TestProxy_Get_ConvertsAgainForRemovedCachedVariant caches a variant of
-// the photo and removes its row and file, as the reconciliation pass does
-// when the file is empty or cut short. internal/imgcache tests that the
-// pass does so. The test then checks that Get converts the image again, and
-// that the next Get serves the whole variant from the cache.
-func TestProxy_Get_ConvertsAgainForRemovedCachedVariant(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-	req := photoVariant(fixtures, 85, imagerequest.FitCover)
-
-	want, _ := getImage(t, svc, req)
-
-	key := imagerequest.CacheKey(req)
-
-	// Removes the variant as the reconciliation pass does: its row, then its file
-	_, err := svc.db.ExecContext(t.Context(),
-		`DELETE FROM variant_content WHERE cache_key = ?`, string(key))
-	if err != nil {
-		t.Fatalf("deleting the variant's row: %v", err)
-	}
-
-	err = os.Remove(variantFilePath(svc, key))
-	if err != nil {
-		t.Fatalf("removing the variant's file: %v", err)
-	}
-
-	got, status := getImage(t, svc, req)
-	t.Logf("after the removal: %d bytes, %s", len(got), status)
-
-	if status != CacheMiss || !bytes.Equal(got, want) {
-		t.Errorf("after the removal: Get() = %d bytes, %s; want the %d bytes "+
-			"converted again, %s", len(got), status, len(want), CacheMiss)
-	}
-
-	got, status = getImage(t, svc, req)
-	t.Logf("next request: %d bytes, %s", len(got), status)
-
-	if status != CacheHit || !bytes.Equal(got, want) {
-		t.Errorf("next request: Get() = %d bytes, %s; want the %d bytes, %s",
-			len(got), status, len(want), CacheHit)
-	}
-}

internal/imageproxy/pendingaccesstimes_internal_test.go

@@ -1,78 +0,0 @@
-package imageproxy
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// pendingAccessTimesWait is how long a test waits for the database's
-// connection, for a cache hit to be answered, for an access time to reach
-// the database, or for a request to return past its deadline.
-const pendingAccessTimesWait = 5 * time.Second
-
-// holdDatabase takes the one connection of db, so that every other query
-// waits for it, and returns the func that frees it.
-func holdDatabase(t *testing.T, db *sql.DB) func() {
-	t.Helper()
-
-	ctx, cancel := context.WithTimeout(t.Context(), pendingAccessTimesWait)
-	defer cancel()
-
-	conn, err := db.Conn(ctx)
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
-
-	return func() { _ = conn.Close() }
-}
-
-// TestProxy_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy holds the
-// database's one connection while a request whose fetch is held reaches its
-// deadline. The request must return with the deadline's error while the
-// connection is still held, as it waits for no database write past its
-// deadline.
-func TestProxy_Get_ReturnsByItsDeadlineWhileTheDatabaseIsBusy(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures, fetcher := setupHeldFetchProxy(t)
-
-	svc.cache.StartPendingAccessTimeWrites()
-	defer func() { _ = svc.cache.StopPendingAccessTimeWrites(t.Context()) }()
-
-	// Room for the request to reach its fetch on a busy host
-	const timeout = 2 * time.Second
-
-	ctx, cancel := context.WithTimeout(t.Context(), timeout)
-	defer cancel()
-
-	deadline, _ := ctx.Deadline()
-
-	results := startGet(ctx, svc, photoVariant(fixtures, 85, imagerequest.FitCover))
-
-	// The request has made its database reads by the time it fetches.
-	select {
-	case <-fetcher.started:
-	case <-time.After(timeout):
-		t.Fatal("request did not reach its fetch by its deadline")
-	}
-
-	releaseDatabase := holdDatabase(t, svc.db)
-	defer releaseDatabase()
-
-	select {
-	case got := <-results:
-		t.Logf("Get() returned %v after its deadline, error = %v",
-			time.Since(deadline), got.err)
-
-		if !errors.Is(got.err, context.DeadlineExceeded) {
-			t.Errorf("Get() error = %v, want %v", got.err, context.DeadlineExceeded)
-		}
-	case <-time.After(time.Until(deadline) + pendingAccessTimesWait):
-		t.Fatal("request did not return while the database was busy")
-	}
-}

internal/imageproxy/stats_internal_test.go

@@ -1,245 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"context"
-	"image/color"
-	"io"
-	"io/fs"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-)
-
-// TestProxy_Get_CountsStats walks Get through a miss that fetches the
-// source, a hit, a miss that reuses the cached source, and two misses whose
-// source cannot be used, checking every counter of the proxy and its cache
-// after each.
-func TestProxy_Get_CountsStats(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	// NewTestFS builds the same files the test proxy's fetcher serves.
-	testFS, _ := NewTestFS(t)
-
-	photo, err := fs.ReadFile(testFS, fixtures.GoodHostJPEG)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fake, err := fs.ReadFile(testFS, fixtures.InvalidFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	photoBytes, fakeBytes := int64(len(photo)), int64(len(fake))
-
-	// want is hits, misses, upstream fetches, upstream bytes, transforms.
-	steps := []struct {
-		name    string
-		path    string
-		size    int
-		wantErr bool
-		want    counterValues
-	}{
-		{"miss that fetches the source", testPathPhoto, 50, false,
-			counterValues{0, 1, 1, photoBytes, 1}},
-		{"hit", testPathPhoto, 50, false,
-			counterValues{1, 1, 1, photoBytes, 1}},
-		{"miss that reuses the cached source", testPathPhoto, 25, false,
-			counterValues{1, 2, 1, photoBytes, 2}},
-		{"miss whose source fails the magic byte check", "/images/fake.jpg", 50, true,
-			counterValues{1, 3, 2, photoBytes + fakeBytes, 2}},
-		{"miss whose source is not found", "/images/nonexistent.jpg", 50, true,
-			counterValues{1, 4, 2, photoBytes + fakeBytes, 2}},
-	}
-
-	for _, step := range steps {
-		resp, err := svc.Get(t.Context(), &imagerequest.Request{
-			Source: imagerequest.Source{
-				Host: fixtures.GoodHost,
-				Path: step.path,
-			},
-			Transform: imagerequest.Transform{
-				Size:    imagerequest.Size{Width: step.size, Height: step.size},
-				Format:  imagerequest.FormatJPEG,
-				Quality: 85,
-				FitMode: imagerequest.FitCover,
-			},
-		})
-		if (err != nil) != step.wantErr {
-			t.Fatalf("%s: Get() error = %v, want error %t", step.name, err, step.wantErr)
-		}
-
-		if err == nil {
-			_ = resp.Content.Close()
-		}
-
-		got := readCounters(t, svc)
-		if got != step.want {
-			t.Fatalf("after the %s: counters = %+v, want %+v", step.name, got, step.want)
-		}
-	}
-}
-
-// fakeUpstream answers every fetch with itself as a JPEG body. The body
-// serves data, then calls cancel, when set, and returns err; io.EOF ends
-// the body normally.
-type fakeUpstream struct {
-	data   *bytes.Reader
-	cancel context.CancelFunc
-	err    error
-}
-
-func (u *fakeUpstream) Fetch(
-	context.Context, imagerequest.Source, string, string,
-) (*httpfetcher.FetchResult, error) {
-	return &httpfetcher.FetchResult{
-		Content:       io.NopCloser(u),
-		ContentLength: -1,
-		ContentType:   testContentTypeJPEG,
-	}, nil
-}
-
-func (u *fakeUpstream) Read(p []byte) (int, error) {
-	if u.data.Len() > 0 {
-		return u.data.Read(p)
-	}
-
-	if u.cancel != nil {
-		u.cancel()
-	}
-
-	return 0, u.err
-}
-
-// TestProxy_Get_CountsInterruptedMisses checks every counter of the proxy
-// and its cache after a miss whose request context ends during or after the
-// upstream fetch, and after a miss whose upstream body is over the size
-// limit.
-func TestProxy_Get_CountsInterruptedMisses(t *testing.T) {
-	t.Parallel()
-
-	photo := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
-	half := len(photo) / 2
-
-	// want is hits, misses, upstream fetches, upstream bytes, transforms.
-	tests := []struct {
-		name    string
-		served  int   // bytes of the photo the upstream body serves
-		cancel  bool  // whether the body then ends the request context
-		readErr error // what the body then returns
-		wantErr bool
-		want    counterValues
-	}{
-		{"request context ends during the fetch", half, true, context.Canceled, true,
-			counterValues{0, 1, 1, int64(half), 0}},
-		{"request context ends after the fetch", len(photo), true, io.EOF, false,
-			counterValues{0, 1, 1, int64(len(photo)), 1}},
-		{"upstream body over the size limit", half, false,
-			httpfetcher.ErrResponseTooLarge, true,
-			counterValues{0, 1, 1, int64(half), 0}},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			svc, fixtures := setupTestProxy(t)
-
-			ctx, cancel := context.WithCancel(t.Context())
-			defer cancel()
-
-			upstream := &fakeUpstream{
-				data: bytes.NewReader(photo[:tc.served]),
-				err:  tc.readErr,
-			}
-			if tc.cancel {
-				upstream.cancel = cancel
-			}
-
-			svc.fetcher = upstream
-
-			resp, err := svc.Get(ctx, &imagerequest.Request{
-				Source: imagerequest.Source{
-					Host: fixtures.GoodHost,
-					Path: testPathPhoto,
-				},
-				Transform: imagerequest.Transform{
-					Size:    imagerequest.Size{Width: 50, Height: 50},
-					Format:  imagerequest.FormatJPEG,
-					Quality: 85,
-					FitMode: imagerequest.FitCover,
-				},
-			})
-			t.Logf("Get() error = %v", err)
-
-			if (err != nil) != tc.wantErr {
-				t.Fatalf("Get() error = %v, want error %t", err, tc.wantErr)
-			}
-
-			if err == nil {
-				_ = resp.Content.Close()
-			}
-
-			got := readCounters(t, svc)
-			if got != tc.want {
-				t.Errorf("counters = %+v, want %+v", got, tc.want)
-			}
-		})
-	}
-}
-
-// TestProxy_Get_CountsHitAfterRequestEnds checks every counter of the
-// proxy and its cache after a hit served with a request context that has
-// already ended: only the hit count moves.
-func TestProxy_Get_CountsHitAfterRequestEnds(t *testing.T) {
-	t.Parallel()
-
-	svc, fixtures := setupTestProxy(t)
-
-	req := &imagerequest.Request{
-		Source: imagerequest.Source{
-			Host: fixtures.GoodHost,
-			Path: testPathPhoto,
-		},
-		Transform: imagerequest.Transform{
-			Size:    imagerequest.Size{Width: 50, Height: 50},
-			Format:  imagerequest.FormatJPEG,
-			Quality: 85,
-			FitMode: imagerequest.FitCover,
-		},
-	}
-
-	// A first request caches the variant.
-	resp, err := svc.Get(t.Context(), req)
-	if err != nil {
-		t.Fatalf("first Get() error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	want := readCounters(t, svc)
-	want.hitCount++
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	resp, err = svc.Get(ctx, req)
-	if err != nil {
-		t.Fatalf("Get() with an ended request context: error = %v", err)
-	}
-
-	_ = resp.Content.Close()
-
-	if resp.CacheStatus != CacheHit {
-		t.Fatalf("CacheStatus = %v, want %v", resp.CacheStatus, CacheHit)
-	}
-
-	got := readCounters(t, svc)
-	if got != want {
-		t.Errorf("counters = %+v, want %+v", got, want)
-	}
-}

internal/imageproxy/testutil_internal_test.go

@@ -1,355 +0,0 @@
-package imageproxy
-
-import (
-	"bytes"
-	"context"
-	"database/sql"
-	"image"
-	"image/color"
-	"image/gif"
-	"image/jpeg"
-	"image/png"
-	"io/fs"
-	"path/filepath"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imagerequest"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// Shared test data literals, extracted as constants for goconst.
-const (
-	testContentTypeJPEG = "image/jpeg"
-)
-
-// sqliteTimestampFormat matches the format SQLite's CURRENT_TIMESTAMP
-// produces, so injected timestamps compare correctly against ones the
-// cache writes.
-const sqliteTimestampFormat = "2006-01-02 15:04:05"
-
-// TestFixtures contains paths to test files in the mock filesystem.
-type TestFixtures struct {
-	// Valid image files
-	GoodHostJPEG  string // valid JPEG on GoodHost
-	GoodHostPNG   string // valid PNG on GoodHost
-	GoodHostGIF   string // valid GIF on GoodHost
-	OtherHostJPEG string // valid JPEG on OtherHost
-	OtherHostPNG  string // valid PNG on OtherHost
-
-	// Invalid/edge case files
-	InvalidFile string // file with wrong magic bytes
-	EmptyFile   string // zero-byte file
-	TextFile    string // text file masquerading as image
-
-	// Hostnames
-	GoodHost  string // a host the mock fetcher serves
-	OtherHost string // a second host the mock fetcher serves
-}
-
-// DefaultFixtures returns the standard test fixture paths.
-func DefaultFixtures() *TestFixtures {
-	return &TestFixtures{
-		GoodHostJPEG:  "goodhost.example.com/images/photo.jpg",
-		GoodHostPNG:   "goodhost.example.com/images/logo.png",
-		GoodHostGIF:   "goodhost.example.com/images/animation.gif",
-		OtherHostJPEG: "otherhost.example.com/uploads/image.jpg",
-		OtherHostPNG:  "otherhost.example.com/uploads/icon.png",
-		InvalidFile:   "goodhost.example.com/images/fake.jpg",
-		EmptyFile:     "goodhost.example.com/images/empty.jpg",
-		TextFile:      "goodhost.example.com/images/text.png",
-		GoodHost:      "goodhost.example.com",
-		OtherHost:     "otherhost.example.com",
-	}
-}
-
-// NewTestFS creates a mock filesystem with test images.
-func NewTestFS(t *testing.T) (fs.FS, *TestFixtures) {
-	t.Helper()
-
-	fixtures := DefaultFixtures()
-
-	// Generate test images
-	jpegData := generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255})
-	pngData := generateTestPNG(t, 100, 100, color.RGBA{0, 255, 0, 255})
-	gifData := generateTestGIF(t, 100, 100, color.RGBA{0, 0, 255, 255})
-
-	// Create the mock filesystem
-	mockFS := fstest.MapFS{
-		// Good host files
-		fixtures.GoodHostJPEG: &fstest.MapFile{Data: jpegData},
-		fixtures.GoodHostPNG:  &fstest.MapFile{Data: pngData},
-		fixtures.GoodHostGIF:  &fstest.MapFile{Data: gifData},
-
-		// Other host files
-		fixtures.OtherHostJPEG: &fstest.MapFile{Data: jpegData},
-		fixtures.OtherHostPNG:  &fstest.MapFile{Data: pngData},
-
-		// Invalid files
-		fixtures.InvalidFile: &fstest.MapFile{Data: []byte("not a real image file content")},
-		fixtures.EmptyFile:   &fstest.MapFile{Data: []byte{}},
-		fixtures.TextFile:    &fstest.MapFile{Data: []byte("This is just text, not a PNG")},
-	}
-
-	return mockFS, fixtures
-}
-
-// generateTestJPEG creates a minimal valid JPEG image.
-func generateTestJPEG(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := range height {
-		for x := range width {
-			img.Set(x, y, c)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := jpeg.Encode(&buf, img, &jpeg.Options{Quality: 85})
-	if err != nil {
-		t.Fatalf("failed to encode test JPEG: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// generateTestPNG creates a minimal valid PNG image.
-func generateTestPNG(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := range height {
-		for x := range width {
-			img.Set(x, y, c)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := png.Encode(&buf, img)
-	if err != nil {
-		t.Fatalf("failed to encode test PNG: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// generateTestGIF creates a minimal valid GIF image.
-func generateTestGIF(t *testing.T, width, height int, c color.Color) []byte {
-	t.Helper()
-
-	img := image.NewPaletted(
-		image.Rect(0, 0, width, height),
-		[]color.Color{c, color.White},
-	)
-	for y := range height {
-		for x := range width {
-			img.SetColorIndex(x, y, 0)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := gif.Encode(&buf, img, nil)
-	if err != nil {
-		t.Fatalf("failed to encode test GIF: %v", err)
-	}
-
-	return buf.Bytes()
-}
-
-// testProxy is a Proxy with the database and the state directory of its
-// cache, through which a test reads and changes the cache behind the proxy.
-// registry is the metrics registry the proxy and its cache share.
-type testProxy struct {
-	*Proxy
-
-	db       *sql.DB
-	stateDir string
-	registry *prometheus.Registry
-}
-
-// setupTestProxy creates a Proxy with mock fetcher for testing.
-func setupTestProxy(t *testing.T) (*testProxy, *TestFixtures) {
-	t.Helper()
-
-	mockFS, fixtures := NewTestFS(t)
-
-	// Create temp directory for cache
-	tmpDir := t.TempDir()
-
-	// Create in-memory database
-	db := setupTestDB(t)
-
-	registry := prometheus.NewRegistry()
-
-	cache, err := imgcache.NewCache(db, imgcache.Config{
-		StateDir:    tmpDir,
-		NegativeTTL: 5 * time.Minute,
-		MaxBytes:    1 << 30,
-	}, registry)
-	if err != nil {
-		t.Fatalf("failed to create cache: %v", err)
-	}
-
-	proxy, err := New(&Config{
-		Cache:   cache,
-		Fetcher: httpfetcher.NewMock(mockFS),
-		Processor: imageprocessor.New(imageprocessor.Params{
-			MaxInputBytes:           50 << 20,
-			MaxConcurrentProcessing: 2,
-		}),
-		MaxResponseSize: 50 << 20,
-	}, registry)
-	if err != nil {
-		t.Fatalf("failed to create proxy: %v", err)
-	}
-
-	return &testProxy{
-		Proxy:    proxy,
-		db:       db,
-		stateDir: tmpDir,
-		registry: registry,
-	}, fixtures
-}
-
-// counterValues holds the values of the counters of a proxy and its cache.
-type counterValues struct {
-	hitCount           int64
-	missCount          int64
-	upstreamFetchCount int64
-	upstreamFetchBytes int64
-	transformCount     int64
-}
-
-// readCounters reads the counters of svc and its cache from their metrics
-// registry.
-func readCounters(t *testing.T, svc *testProxy) counterValues {
-	t.Helper()
-
-	families, err := svc.registry.Gather()
-	if err != nil {
-		t.Fatalf("failed to gather the counters: %v", err)
-	}
-
-	values := make(map[string]int64, len(families))
-
-	for _, family := range families {
-		values[family.GetName()] = int64(family.GetMetric()[0].GetCounter().GetValue())
-	}
-
-	return counterValues{
-		hitCount:           values["pixa_cache_hits_total"],
-		missCount:          values["pixa_cache_misses_total"],
-		upstreamFetchCount: values["pixa_upstream_fetches_total"],
-		upstreamFetchBytes: values["pixa_upstream_fetch_bytes_total"],
-		transformCount:     values["pixa_transforms_total"],
-	}
-}
-
-// sourceFilePath returns the path of the file of the source key in svc's
-// cache, as README.md gives it: <state_dir>/cache/sources/<ab>/<cd>/<key>.
-func sourceFilePath(svc *testProxy, key imagerequest.SourceKey) string {
-	name := string(key)
-
-	return filepath.Join(svc.stateDir, "cache", "sources", name[0:2], name[2:4], name)
-}
-
-// variantFilePath returns the path of the file of the variant key in svc's
-// cache, as README.md gives it: <state_dir>/cache/variants/<ab>/<cd>/<key>.
-func variantFilePath(svc *testProxy, key imagerequest.VariantKey) string {
-	name := string(key)
-
-	return filepath.Join(svc.stateDir, "cache", "variants", name[0:2], name[2:4], name)
-}
-
-// setVariantLastAccessed backdates the last access time of a tracked
-// variant.
-func setVariantLastAccessed(
-	t *testing.T, db *sql.DB, key imagerequest.VariantKey, when time.Time,
-) {
-	t.Helper()
-
-	res, err := db.ExecContext(t.Context(),
-		`UPDATE variant_content SET last_accessed_at = ? WHERE cache_key = ?`,
-		when.UTC().Format(sqliteTimestampFormat), string(key),
-	)
-	if err != nil {
-		t.Fatalf("failed to set variant last_accessed_at: %v", err)
-	}
-
-	affected, err := res.RowsAffected()
-	if err != nil {
-		t.Fatalf("failed to read affected rows: %v", err)
-	}
-
-	if affected != 1 {
-		t.Fatalf("variant %s has no accounting row (affected=%d); "+
-			"stores must track variants in the database", key, affected)
-	}
-}
-
-// setSourceLastAccessed backdates the last access time of a tracked
-// source content blob.
-func setSourceLastAccessed(
-	t *testing.T, db *sql.DB, key imagerequest.SourceKey, when time.Time,
-) {
-	t.Helper()
-
-	res, err := db.ExecContext(t.Context(),
-		`UPDATE source_content SET last_accessed_at = ? WHERE source_key = ?`,
-		when.UTC().Format(sqliteTimestampFormat), string(key),
-	)
-	if err != nil {
-		t.Fatalf("failed to set source last_accessed_at: %v", err)
-	}
-
-	affected, err := res.RowsAffected()
-	if err != nil {
-		t.Fatalf("failed to read affected rows: %v", err)
-	}
-
-	if affected != 1 {
-		t.Fatalf("source %s has no accounting row (affected=%d)", key, affected)
-	}
-}
-
-// countRows returns the number of rows the given query yields.
-func countRows(t *testing.T, db *sql.DB, query string, args ...any) int {
-	t.Helper()
-
-	var n int
-
-	err := db.QueryRowContext(t.Context(), query, args...).Scan(&n)
-	if err != nil {
-		t.Fatalf("count query %q failed: %v", query, err)
-	}
-
-	return n
-}
-
-// setupTestDB creates an in-memory SQLite database for testing
-// using the production schema.
-func setupTestDB(t *testing.T) *sql.DB {
-	t.Helper()
-
-	db, err := sql.Open("sqlite", ":memory:")
-	if err != nil {
-		t.Fatalf("failed to open test db: %v", err)
-	}
-
-	// Use the real production schema via migrations
-	err = database.ApplyMigrations(context.Background(), db, nil)
-	if err != nil {
-		t.Fatalf("failed to apply migrations: %v", err)
-	}
-
-	return db
-}

internal/imagerequest/imagerequest.go

@@ -1,167 +0,0 @@
-// Package imagerequest holds the image request type, its parts, its checks,
-// the parsing of the /v1/image/ path, the variant key, the source key and the
-// source's upstream URL. It also holds the image format type and the MIME type
-// of each format. It imports no other package of this repo, so every package
-// that handles an image request can import it.
-package imagerequest
-
-import (
-	"errors"
-	"net/url"
-)
-
-// ErrInvalidFitMode is returned when an invalid fit mode is provided.
-var ErrInvalidFitMode = errors.New("invalid fit mode")
-
-// Format is an image format. pixa reads and writes the formats from JPEG to
-// GIF below. It reads SVG and writes it only as orig of an SVG source. In a
-// request, orig and auto stand for another format.
-type Format string
-
-// Supported image formats.
-const (
-	FormatOriginal Format = "orig"
-	FormatJPEG     Format = "jpeg"
-	FormatPNG      Format = "png"
-	FormatWebP     Format = "webp"
-	FormatAVIF     Format = "avif"
-	FormatJXL      Format = "jxl"
-	FormatGIF      Format = "gif"
-	FormatSVG      Format = "svg"
-
-	// FormatAuto stands for JPEG XL, AVIF, WebP or JPEG, chosen for each
-	// request from its Accept header once the URL's signature or token has
-	// been checked; it is never processed or cached as itself.
-	FormatAuto Format = "auto"
-)
-
-// MIMEType returns the MIME type of the format, such as image/jpeg for
-// FormatJPEG. orig and auto stand for another format, so they have none:
-// MIMEType returns "" for them.
-func (f Format) MIMEType() string {
-	switch f {
-	case FormatJPEG:
-		return "image/jpeg"
-	case FormatPNG:
-		return "image/png"
-	case FormatWebP:
-		return "image/webp"
-	case FormatAVIF:
-		return "image/avif"
-	case FormatJXL:
-		return "image/jxl"
-	case FormatGIF:
-		return "image/gif"
-	case FormatSVG:
-		return "image/svg+xml"
-	case FormatOriginal, FormatAuto:
-		return ""
-	default:
-		return ""
-	}
-}
-
-// Size represents requested image dimensions
-type Size struct {
-	Width  int
-	Height int
-}
-
-// OriginalSize returns true if this represents "keep original size"
-func (s Size) OriginalSize() bool {
-	return s.Width == 0 && s.Height == 0
-}
-
-// Fit represents how to fit image into requested dimensions.
-type Fit string
-
-// Supported image fit modes.
-const (
-	FitCover   Fit = "cover"
-	FitContain Fit = "contain"
-	FitFill    Fit = "fill"
-	FitInside  Fit = "inside"
-	FitOutside Fit = "outside"
-)
-
-// ValidateFitMode checks if the given fit mode is valid.
-// Returns ErrInvalidFitMode for unrecognized fit modes.
-func ValidateFitMode(fit Fit) error {
-	switch fit {
-	case FitCover, FitContain, FitFill, FitInside, FitOutside, "":
-		return nil
-	default:
-		return ErrInvalidFitMode
-	}
-}
-
-// ValidateImageRequest checks a request's width and height with
-// ValidateDimension and its fit mode with ValidateFitMode. Both the plain
-// /v1/image/ route and the encrypted /v1/e/ route validate through this
-// function so a request from either source enforces identical bounds.
-func ValidateImageRequest(req *Request) error {
-	err := ValidateDimension("width", req.Transform.Size.Width)
-	if err != nil {
-		return err
-	}
-
-	err = ValidateDimension("height", req.Transform.Size.Height)
-	if err != nil {
-		return err
-	}
-
-	return ValidateFitMode(req.Transform.FitMode)
-}
-
-// Request represents a request for a processed image: the source to fetch
-// and the transform to apply to it. It holds exactly what the variant key
-// covers.
-type Request struct {
-	// Source is what to fetch
-	Source Source
-	// Transform is what to do to it
-	Transform Transform
-}
-
-// Source is the image a request fetches from the origin.
-type Source struct {
-	// Host is the origin host (e.g., "cdn.example.com")
-	Host string
-	// Path is the path on the origin with its percent-escapes decoded, as
-	// url.URL's Path holds it (e.g., "/photos/my cat.jpg")
-	Path string
-	// Query is the optional query string for the origin URL as the URL
-	// writes it, percent-escapes included, as url.URL's RawQuery holds it
-	Query string
-}
-
-// Transform is what a request does to its source; the image processor
-// takes it alone.
-type Transform struct {
-	// Size is the requested output dimensions
-	Size Size
-	// Format is the requested output format
-	Format Format
-	// Quality is the output quality (1-100) for lossy formats
-	Quality int
-	// FitMode is how to fit the image into requested dimensions
-	FitMode Fit
-}
-
-// URL returns the source's upstream URL, with the scheme http when allowHTTP
-// is true and https otherwise. net/url writes its path percent-encoded again,
-// so each source path is one upstream path. Its query is the source query as
-// it is, with the characters escapeQuery encodes percent-encoded.
-func (s Source) URL(allowHTTP bool) *url.URL {
-	scheme := "https"
-	if allowHTTP {
-		scheme = "http"
-	}
-
-	return &url.URL{
-		Scheme:   scheme,
-		Host:     s.Host,
-		Path:     s.Path,
-		RawQuery: escapeQuery(s.Query),
-	}
-}

internal/imagerequest/mimetype_internal_test.go

@@ -1,30 +0,0 @@
-package imagerequest
-
-import "testing"
-
-// TestFormat_MIMEType checks the MIME type of each format pixa reads and
-// writes, and that orig and auto have none.
-func TestFormat_MIMEType(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		format Format
-		want   string
-	}{
-		{FormatJPEG, "image/jpeg"},
-		{FormatPNG, "image/png"},
-		{FormatWebP, "image/webp"},
-		{FormatAVIF, "image/avif"},
-		{FormatJXL, "image/jxl"},
-		{FormatGIF, "image/gif"},
-		{FormatOriginal, ""},
-		{FormatAuto, ""},
-	}
-
-	for _, tt := range tests {
-		got := tt.format.MIMEType()
-		if got != tt.want {
-			t.Errorf("%s MIMEType() = %q, want %q", tt.format, got, tt.want)
-		}
-	}
-}

internal/imagerequest/sourcekey.go

@@ -1,26 +0,0 @@
-package imagerequest
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-)
-
-// SourceKey is a SHA256 hash identifying a cached source image (hex-encoded).
-type SourceKey string
-
-// Key returns the key the source is cached under, made as CacheKey makes a
-// variant key.
-// Format: sha256(host:path:query)
-// The path and query go through escapePercentAndColon, so that a ":" in
-// either cannot be taken for the one between them.
-func (s Source) Key() SourceKey {
-	data := fmt.Sprintf("%s:%s:%s",
-		s.Host,
-		escapePercentAndColon(s.Path),
-		escapePercentAndColon(s.Query),
-	)
-	h := sha256.Sum256([]byte(data))
-
-	return SourceKey(hex.EncodeToString(h[:]))
-}

internal/imagerequest/sourcekey_internal_test.go

@@ -1,40 +0,0 @@
-package imagerequest
-
-import "testing"
-
-// TestSourceKey_DiffersForEachSource checks that each source gets a key of
-// 64 hex characters, the same each time, and that no two of these sources
-// share one, also when they differ only by a ":" or "%" in the path or query.
-func TestSourceKey_DiffersForEachSource(t *testing.T) {
-	t.Parallel()
-
-	sources := []Source{
-		{Host: testHostCDN, Path: testPathCat},
-		{Host: testHostCDN, Path: testPathCat, Query: "v=2"},
-		{Host: "other.example.com", Path: testPathCat},
-		{Host: testHostCDN, Path: "/c:d"},
-		{Host: testHostCDN, Path: "/c", Query: "d:"},
-		{Host: testHostCDN, Path: "/c%3Ad"},
-	}
-
-	seen := make(map[SourceKey]Source)
-
-	for _, source := range sources {
-		key := source.Key()
-		t.Logf("Key() of %+v = %s", source, key)
-
-		if len(key) != 64 {
-			t.Errorf("Key() of %+v length = %d, want 64", source, len(key))
-		}
-
-		if again := source.Key(); again != key {
-			t.Errorf("Key() of %+v not deterministic: %s vs %s", source, key, again)
-		}
-
-		if earlier, found := seen[key]; found {
-			t.Errorf("Key() gave %+v and %+v the same key", earlier, source)
-		}
-
-		seen[key] = source
-	}
-}

internal/imagerequest/sourceurl_internal_test.go

@@ -1,50 +0,0 @@
-package imagerequest
-
-import "testing"
-
-func TestSource_URL_DefaultHTTPS(t *testing.T) {
-	t.Parallel()
-
-	source := Source{
-		Host:  testHostCDN,
-		Path:  testPathCat,
-		Query: "v=2",
-	}
-
-	got := source.URL(false).String()
-
-	want := "https://cdn.example.com/photos/cat.jpg?v=2"
-	if got != want {
-		t.Errorf("URL() = %q, want %q", got, want)
-	}
-}
-
-func TestSource_URL_AllowHTTP(t *testing.T) {
-	t.Parallel()
-
-	source := Source{
-		Host: "localhost:8080",
-		Path: testPathCat,
-	}
-
-	got := source.URL(true).String()
-
-	want := "http://localhost:8080/photos/cat.jpg"
-	if got != want {
-		t.Errorf("URL() = %q, want %q", got, want)
-	}
-}
-
-func TestSource_URL_AllowHTTPFalse(t *testing.T) {
-	t.Parallel()
-
-	source := Source{
-		Host: testHostCDN,
-		Path: "/img.jpg",
-	}
-
-	got := source.URL(false).String()
-	if got != "https://cdn.example.com/img.jpg" {
-		t.Errorf("URL() = %q, want https scheme", got)
-	}
-}