Item 8 of 15 of #168: "Take the signature, the expiry, the scheme and the source URL off the request". Starts when the item before it (building the image pipeline in the fx graph) is squash-merged to next.
Today (next at 989da78)
The image request carries Signature, Expires and AllowHTTP next to the fields that name the cached object. Service.Get writes req.AllowHTTP = s.allowHTTP, a process-wide setting, onto every request, and ImageRequest.SourceURL builds a URL string the fetcher then parses again. Service.GenerateSignedURL writes Quality, FitMode, Expires and Signature back into its argument, and signature.Request contains the signature it is verified against. Service.ValidateRequest (allow list, else signature) serves the /v1/image/ route alone, yet lives in the image service, which therefore holds a Signer and a HostAllowList it needs for nothing else.
Definition of done
The image request holds only what names the cached object: the source (host, path, query) and the transform. That is exactly what the variant key covers.
The /v1/image/ handler checks the allow list and verifies the signature itself, as Verify(req, sig, expires); the image service holds no signer and no allow list, and serves images through one method, Get, besides what shutdown needs.
The expiry is a value local to the handler, used for Cache-Control.
The fetcher takes the source (host, path, query) and chooses http or https from its own AllowHTTP setting; no URL string is built from the request to be parsed again.
Nothing writes back into a request it was given.
The signed URL format and signing algorithm README.md documents for clients are unchanged, and every route answers as before.
Approval and tests
sneak asked for each main recommendation of #168 to be its own issue, built before 1.0, one at a time in the order listed (#168 (comment)). That instruction is his approval of this item. Existing tests change only as this item needs: they follow code that moves or is renamed, and the tests of code this item removes go with it; no other assertion is weakened or dropped.
Model: opus-5-5
Item 8 of 15 of https://git.eeqj.de/sneak/pixa/issues/168: "Take the signature, the expiry, the scheme and the source URL off the request". Starts when the item before it (building the image pipeline in the fx graph) is squash-merged to `next`.
## Today (`next` at `989da78`)
The image request carries `Signature`, `Expires` and `AllowHTTP` next to the fields that name the cached object. `Service.Get` writes `req.AllowHTTP = s.allowHTTP`, a process-wide setting, onto every request, and `ImageRequest.SourceURL` builds a URL string the fetcher then parses again. `Service.GenerateSignedURL` writes `Quality`, `FitMode`, `Expires` and `Signature` back into its argument, and `signature.Request` contains the signature it is verified against. `Service.ValidateRequest` (allow list, else signature) serves the `/v1/image/` route alone, yet lives in the image service, which therefore holds a `Signer` and a `HostAllowList` it needs for nothing else.
## Definition of done
- The image request holds only what names the cached object: the source (host, path, query) and the transform. That is exactly what the variant key covers.
- The `/v1/image/` handler checks the allow list and verifies the signature itself, as `Verify(req, sig, expires)`; the image service holds no signer and no allow list, and serves images through one method, `Get`, besides what shutdown needs.
- The expiry is a value local to the handler, used for `Cache-Control`.
- The fetcher takes the source (host, path, query) and chooses `http` or `https` from its own `AllowHTTP` setting; no URL string is built from the request to be parsed again.
- Nothing writes back into a request it was given.
- The signed URL format and signing algorithm `README.md` documents for clients are unchanged, and every route answers as before.
## Approval and tests
sneak asked for each main recommendation of https://git.eeqj.de/sneak/pixa/issues/168 to be its own issue, built before 1.0, one at a time in the order listed (https://git.eeqj.de/sneak/pixa/issues/168#issuecomment-153513). That instruction is his approval of this item. Existing tests change only as this item needs: they follow code that moves or is renamed, and the tests of code this item removes go with it; no other assertion is weakened or dropped.
Model: opus-5-5
clawbot
added this to the 1.0.0 milestone 2026-10-21 12:50:31 +02:00
clawbot
self-assigned this 2026-10-21 12:50:32 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Item 8 of 15 of #168: "Take the signature, the expiry, the scheme and the source URL off the request". Starts when the item before it (building the image pipeline in the fx graph) is squash-merged to
next.Today (
nextat989da78)The image request carries
Signature,ExpiresandAllowHTTPnext to the fields that name the cached object.Service.Getwritesreq.AllowHTTP = s.allowHTTP, a process-wide setting, onto every request, andImageRequest.SourceURLbuilds a URL string the fetcher then parses again.Service.GenerateSignedURLwritesQuality,FitMode,ExpiresandSignatureback into its argument, andsignature.Requestcontains the signature it is verified against.Service.ValidateRequest(allow list, else signature) serves the/v1/image/route alone, yet lives in the image service, which therefore holds aSignerand aHostAllowListit needs for nothing else.Definition of done
/v1/image/handler checks the allow list and verifies the signature itself, asVerify(req, sig, expires); the image service holds no signer and no allow list, and serves images through one method,Get, besides what shutdown needs.Cache-Control.httporhttpsfrom its ownAllowHTTPsetting; no URL string is built from the request to be parsed again.README.mddocuments for clients are unchanged, and every route answers as before.Approval and tests
sneak asked for each main recommendation of #168 to be its own issue, built before 1.0, one at a time in the order listed (#168 (comment)). That instruction is his approval of this item. Existing tests change only as this item needs: they follow code that moves or is renamed, and the tests of code this item removes go with it; no other assertion is weakened or dropped.
Model: opus-5-5