Records the P0 manual test pass in TODO.md per its Workflow section
(checked-off results into Completed Steps; cache size management and
eviction promoted to Next Step). TODO.md is the only changed file —
no production code changes, as the issue requires.
Test setup
pixad built from main at 6573b9d via make build, run on port
18099 with a throwaway local config (temp state dir, known signing_key, allowlist_hosts including s3.sneak.cloud), driven
with curl using explicit cookie replay (session cookies are Secure/HttpOnly/SameSite=Strict).
Results — all six checks PASS
Login form: GET / → HTTP 200, Pixa - Login page with name="key" password form.
Wrong key error: POST / with key=wrong-key → HTTP 200 login
page containing "Invalid signing key".
Generator form: POST / with the correct signing key → HTTP 303
to / with Set-Cookie: pixa_session=...; HttpOnly; Secure; SameSite=Strict; GET / with that cookie → Pixa - URL Generator
with the /generate form and logout link.
Encrypted URL serves image: POST /generate (ttl=3600) produced
a /v1/e/<token>/img.jpeg URL → HTTP 200, Content-Type: image/jpeg, 800x600 baseline JPEG, 61706 bytes.
Expired URL → 410: a ttl=1 URL fetched after 3 s → HTTP 410 Gone
with {"error":"URL has expired","status":410,...}.
Logout: GET /logout → HTTP 303 to / with Set-Cookie: pixa_session=; Max-Age=0; subsequent GET / → login form again.
Additionally, all nine checks in scripts/manual-test.sh passed
against the same server instance.
Verification
make check green on the branch head (all tests, golangci-lint 0
issues, fmt-check clean) — the first fully green make check on a main-derived branch under the current linter, confirming the #47/#48
fix on merged main.
Note for review: the test execution was performed this session; the
adversarial re-review (independently re-running the six flows) is still
pending and should happen before merge.
closes #49
Records the P0 manual test pass in `TODO.md` per its Workflow section
(checked-off results into Completed Steps; cache size management and
eviction promoted to Next Step). `TODO.md` is the only changed file —
no production code changes, as the issue requires.
## Test setup
`pixad` built from `main` at `6573b9d` via `make build`, run on port
18099 with a throwaway local config (temp state dir, known
`signing_key`, `allowlist_hosts` including `s3.sneak.cloud`), driven
with curl using explicit cookie replay (session cookies are
`Secure`/`HttpOnly`/`SameSite=Strict`).
## Results — all six checks PASS
1. **Login form**: GET `/` → HTTP 200, `Pixa - Login` page with
`name="key"` password form.
2. **Wrong key error**: POST `/` with `key=wrong-key` → HTTP 200 login
page containing "Invalid signing key".
3. **Generator form**: POST `/` with the correct signing key → HTTP 303
to `/` with `Set-Cookie: pixa_session=...; HttpOnly; Secure;
SameSite=Strict`; GET `/` with that cookie → `Pixa - URL Generator`
with the `/generate` form and logout link.
4. **Encrypted URL serves image**: POST `/generate` (ttl=3600) produced
a `/v1/e/<token>/img.jpeg` URL → HTTP 200, `Content-Type:
image/jpeg`, 800x600 baseline JPEG, 61706 bytes.
5. **Expired URL → 410**: a ttl=1 URL fetched after 3 s → HTTP 410 Gone
with `{"error":"URL has expired","status":410,...}`.
6. **Logout**: GET `/logout` → HTTP 303 to `/` with `Set-Cookie:
pixa_session=; Max-Age=0`; subsequent GET `/` → login form again.
Additionally, all nine checks in `scripts/manual-test.sh` passed
against the same server instance.
## Verification
`make check` green on the branch head (all tests, golangci-lint 0
issues, fmt-check clean) — the first fully green `make check` on a
`main`-derived branch under the current linter, confirming the #47/#48
fix on merged `main`.
Note for review: the test execution was performed this session; the
adversarial re-review (independently re-running the six flows) is still
pending and should happen before merge.
All six checks from issue #49 executed against a locally built and
running pixad (main at 6573b9d, port 18099, throwaway local config):
login form, wrong-key error, generator form after login, encrypted URL
serving an image, expired URL returning 410, and logout redirect. All
passed, as did the nine checks in scripts/manual-test.sh. Evidence
recorded as a checklist in TODO.md per its Workflow section; the cache
size management and eviction item is promoted to Next Step.
Independent adversarial review of PR #50 — verdict: merge-ready
Reviewed by a session independent of the authoring session. Scope: diff vs REPO_POLICIES.md and issue #49 (including all comments), independent re-execution of every claimed check, make check, commit hygiene.
Independent reproduction — all claims verified
Built pixad from the branch head (b045de9) via make build (nix-shell with libvips, as on the authoring run) and ran it on port 18299 with a throwaway config (temp state_dir, 39-char signing_key, allowlist_hosts containing s3.sneak.cloud). Re-ran all six checks from issue #49 with curl and explicit Set-Cookie replay:
GET / returned HTTP 200, <title>Pixa - Login</title>, form field name="key" — matches claim.
POST / with key=wrong-key returned HTTP 200 login page containing "Invalid signing key" — matches claim.
POST / with the correct signing key returned HTTP 303 to / with Set-Cookie: pixa_session=...; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict; GET / replaying that cookie rendered <title>Pixa - URL Generator</title> with the /generate form and /logout link — matches claim.
POST /generate (ttl=3600) produced a /v1/e/<token>/img.jpeg URL that returned HTTP 200, Content-Type: image/jpeg, a baseline JPEG at 800x600 and exactly 61706 bytes — byte-identical to the size claimed in the PR.
A ttl=1 URL fetched after 3 s returned HTTP 410 with body {"error":"URL has expired","status":410,...} — matches claim.
GET /logout returned HTTP 303 to / with Set-Cookie: pixa_session=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict; subsequent GET / rendered the login form — matches claim.
Additionally re-ran scripts/manual-test.sh against the same server instance: all nine checks pass, including the direct-proxy check (test 7) not covered by the six issue checks.
Review findings
Diff scope: single commit b045de9 atop current main (6573b9d), touching only TODO.md — exactly what issue #49's definition of done requires (no production code changes). Merge base is current main; no rebase needed.
Document placement: results recorded in TODO.md Completed Steps per its Workflow section — correct location for this repo; the issue explicitly mandates it.
TODO bookkeeping: the finished Next Step moved to the top of Completed Steps as a checked-off checklist with concrete evidence (status codes, header values, byte counts — reproducible, not vague); the top Future Step (P0 cache size management and eviction, now #51) correctly promoted into Next Step and removed from Future Steps.
Claims are concrete and reproducible: every checklist item names the exact request, the expected response, and the observed evidence; I reproduced each one without needing any information not in the PR body or TODO.md.
make check: green on the branch head, independently verified (all tests pass, golangci-lint 0 issues, fmt-check clean, prose properly wrapped).
Commit hygiene: one commit, one change; title docs: record manual test pass of auth and encrypted URL flows (closes #49) ends with the required closer; body is accurate; no attribution trailers of any kind.
No AI-tool references anywhere in the diff, commit message, or PR body.
No findings. Replacing needs-review with merge-ready and assigning sneak for merge. Merging will close#49.
## Independent adversarial review of PR #50 — verdict: merge-ready
Reviewed by a session independent of the authoring session. Scope: diff vs `REPO_POLICIES.md` and issue #49 (including all comments), independent re-execution of every claimed check, `make check`, commit hygiene.
### Independent reproduction — all claims verified
Built `pixad` from the branch head (`b045de9`) via `make build` (nix-shell with libvips, as on the authoring run) and ran it on port 18299 with a throwaway config (temp `state_dir`, 39-char `signing_key`, `allowlist_hosts` containing `s3.sneak.cloud`). Re-ran all six checks from issue #49 with curl and explicit `Set-Cookie` replay:
1. GET `/` returned HTTP 200, `<title>Pixa - Login</title>`, form field `name="key"` — matches claim.
2. POST `/` with `key=wrong-key` returned HTTP 200 login page containing "Invalid signing key" — matches claim.
3. POST `/` with the correct signing key returned HTTP 303 to `/` with `Set-Cookie: pixa_session=...; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict`; GET `/` replaying that cookie rendered `<title>Pixa - URL Generator</title>` with the `/generate` form and `/logout` link — matches claim.
4. POST `/generate` (ttl=3600) produced a `/v1/e/<token>/img.jpeg` URL that returned HTTP 200, `Content-Type: image/jpeg`, a baseline JPEG at 800x600 and exactly 61706 bytes — byte-identical to the size claimed in the PR.
5. A ttl=1 URL fetched after 3 s returned HTTP 410 with body `{"error":"URL has expired","status":410,...}` — matches claim.
6. GET `/logout` returned HTTP 303 to `/` with `Set-Cookie: pixa_session=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`; subsequent GET `/` rendered the login form — matches claim.
Additionally re-ran `scripts/manual-test.sh` against the same server instance: all nine checks pass, including the direct-proxy check (test 7) not covered by the six issue checks.
### Review findings
- **Diff scope**: single commit `b045de9` atop current `main` (`6573b9d`), touching only `TODO.md` — exactly what issue #49's definition of done requires (no production code changes). Merge base is current `main`; no rebase needed.
- **Document placement**: results recorded in `TODO.md` Completed Steps per its Workflow section — correct location for this repo; the issue explicitly mandates it.
- **TODO bookkeeping**: the finished Next Step moved to the top of Completed Steps as a checked-off checklist with concrete evidence (status codes, header values, byte counts — reproducible, not vague); the top Future Step (P0 cache size management and eviction, now #51) correctly promoted into Next Step and removed from Future Steps.
- **Claims are concrete and reproducible**: every checklist item names the exact request, the expected response, and the observed evidence; I reproduced each one without needing any information not in the PR body or `TODO.md`.
- **`make check`**: green on the branch head, independently verified (all tests pass, golangci-lint 0 issues, fmt-check clean, prose properly wrapped).
- **Commit hygiene**: one commit, one change; title `docs: record manual test pass of auth and encrypted URL flows (closes #49)` ends with the required closer; body is accurate; no attribution trailers of any kind.
- **No AI-tool references** anywhere in the diff, commit message, or PR body.
No findings. Replacing `needs-review` with `merge-ready` and assigning sneak for merge. Merging will close #49.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
closes #49
Records the P0 manual test pass in
TODO.mdper its Workflow section(checked-off results into Completed Steps; cache size management and
eviction promoted to Next Step).
TODO.mdis the only changed file —no production code changes, as the issue requires.
Test setup
pixadbuilt frommainat6573b9dviamake build, run on port18099 with a throwaway local config (temp state dir, known
signing_key,allowlist_hostsincludings3.sneak.cloud), drivenwith curl using explicit cookie replay (session cookies are
Secure/HttpOnly/SameSite=Strict).Results — all six checks PASS
/→ HTTP 200,Pixa - Loginpage withname="key"password form./withkey=wrong-key→ HTTP 200 loginpage containing "Invalid signing key".
/with the correct signing key → HTTP 303to
/withSet-Cookie: pixa_session=...; HttpOnly; Secure; SameSite=Strict; GET/with that cookie →Pixa - URL Generatorwith the
/generateform and logout link./generate(ttl=3600) produceda
/v1/e/<token>/img.jpegURL → HTTP 200,Content-Type: image/jpeg, 800x600 baseline JPEG, 61706 bytes.with
{"error":"URL has expired","status":410,...}./logout→ HTTP 303 to/withSet-Cookie: pixa_session=; Max-Age=0; subsequent GET/→ login form again.Additionally, all nine checks in
scripts/manual-test.shpassedagainst the same server instance.
Verification
make checkgreen on the branch head (all tests, golangci-lint 0issues, fmt-check clean) — the first fully green
make checkon amain-derived branch under the current linter, confirming the #47/#48fix on merged
main.Note for review: the test execution was performed this session; the
adversarial re-review (independently re-running the six flows) is still
pending and should happen before merge.
Independent adversarial review of PR #50 — verdict: merge-ready
Reviewed by a session independent of the authoring session. Scope: diff vs
REPO_POLICIES.mdand issue #49 (including all comments), independent re-execution of every claimed check,make check, commit hygiene.Independent reproduction — all claims verified
Built
pixadfrom the branch head (b045de9) viamake build(nix-shell with libvips, as on the authoring run) and ran it on port 18299 with a throwaway config (tempstate_dir, 39-charsigning_key,allowlist_hostscontainings3.sneak.cloud). Re-ran all six checks from issue #49 with curl and explicitSet-Cookiereplay:/returned HTTP 200,<title>Pixa - Login</title>, form fieldname="key"— matches claim./withkey=wrong-keyreturned HTTP 200 login page containing "Invalid signing key" — matches claim./with the correct signing key returned HTTP 303 to/withSet-Cookie: pixa_session=...; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict; GET/replaying that cookie rendered<title>Pixa - URL Generator</title>with the/generateform and/logoutlink — matches claim./generate(ttl=3600) produced a/v1/e/<token>/img.jpegURL that returned HTTP 200,Content-Type: image/jpeg, a baseline JPEG at 800x600 and exactly 61706 bytes — byte-identical to the size claimed in the PR.{"error":"URL has expired","status":410,...}— matches claim./logoutreturned HTTP 303 to/withSet-Cookie: pixa_session=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict; subsequent GET/rendered the login form — matches claim.Additionally re-ran
scripts/manual-test.shagainst the same server instance: all nine checks pass, including the direct-proxy check (test 7) not covered by the six issue checks.Review findings
b045de9atop currentmain(6573b9d), touching onlyTODO.md— exactly what issue #49's definition of done requires (no production code changes). Merge base is currentmain; no rebase needed.TODO.mdCompleted Steps per its Workflow section — correct location for this repo; the issue explicitly mandates it.TODO.md.make check: green on the branch head, independently verified (all tests pass, golangci-lint 0 issues, fmt-check clean, prose properly wrapped).docs: record manual test pass of auth and encrypted URL flows (closes #49)ends with the required closer; body is accurate; no attribution trailers of any kind.No findings. Replacing
needs-reviewwithmerge-readyand assigning sneak for merge. Merging will close #49.