pixa/internal/imageprocessor/imageprocessor.go

// Package imageprocessor provides image format conversion and resizing using libvips.
package imageprocessor

import (
	"bytes"
	"context"
	"errors"
	"fmt"
	"io"
	"math"
	"sync"
	"time"

	"github.com/davidbyttow/govips/v2/vips"
	"sneak.berlin/go/pixa/internal/imagerequest"
)

// vipsOnce ensures vips is initialized exactly once.
//
//nolint:gochecknoglobals // package-level sync.Once for one-time vips init
var vipsOnce sync.Once

// initVips initializes libvips with quiet logging, one worker thread per
// image and no operation cache. Each request decodes different source
// bytes, so the operation cache would rarely be hit and would hold memory
// outside MaxConcurrentProcessing; repeated requests are served from
// pixa's disk cache instead.
func initVips() {
	vipsOnce.Do(func() {
		vips.LoggingSettings(nil, vips.LogLevelError)
		vips.Startup(&vips.Config{
			ConcurrencyLevel: 1,
			MaxCacheSize:     0,
			MaxCacheMem:      0,
			MaxCacheFiles:    0,
		})
	})
}

// errNoJPEGXL is returned by CheckJPEGXLSupport.
var errNoJPEGXL = errors.New("libvips lacks JPEG XL support: install " +
	"vips-jxl on Alpine, or use a libvips built with libjxl")

// CheckJPEGXLSupport returns an error, naming the fix, when libvips
// cannot load and save JPEG XL.
func CheckJPEGXLSupport() error {
	initVips()

	// govips counts a format as supported when libvips has its loader;
	// libvips builds the JPEG XL loader and saver together.
	if !vips.IsTypeSupported(vips.ImageTypeJXL) {
		return errNoJPEGXL
	}

	return nil
}

// Result contains the output of image processing.
type Result struct {
	// Content is the processed image data.
	Content io.ReadCloser
	// ContentLength is the size in bytes.
	ContentLength int64
	// ContentType is the MIME type of the output.
	ContentType string
	// Width is the output image width.
	Width int
	// Height is the output image height.
	Height int
	// InputWidth is the original image width before processing.
	InputWidth int
	// InputHeight is the original image height before processing.
	InputHeight int
}

// MaxInputDimension is the maximum allowed width or height for input images.
// Images larger than this are rejected to prevent DoS via decompression bombs.
const MaxInputDimension = 8192

// ErrInputTooLarge is returned when input image dimensions exceed MaxInputDimension.
var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")

// ErrInputDataTooLarge is returned when the raw input data exceeds the
// configured byte limit.
var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")

// MaxOutputDimension is the maximum width or height of an output image, and
// so of a requested size (imagerequest.MaxDimension).
const MaxOutputDimension = imagerequest.MaxDimension

// ErrOutputTooLarge is returned, before resizing, when the output would have a
// side above MaxOutputDimension: the side of a size with one side 0, computed
// from the input's proportions, or with FitOutside, the side scaled past the
// requested size.
var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")

// MaxAVIFOutputPixels is the most pixels an AVIF output may have, so that an
// encode takes at most 40 seconds of the default downstream_timeout of 60
// seconds; AVIF is already at the lowest effort govips can set (avifEffort).
// With one thread, as pixad runs libvips, saving 4096x4096, 8192x2048 or
// 2048x8192 random pixels with an alpha channel takes up to about 34
// seconds, the slowest at any quality and at 8 or 16 bits per sample, and
// 5120x4096 at 8 bits already takes about 36.
const MaxAVIFOutputPixels = 4096 * 4096

// ErrAVIFOutputTooLarge is returned, before anything is decoded, when an AVIF
// output would have more than MaxAVIFOutputPixels pixels.
var ErrAVIFOutputTooLarge = errors.New("AVIF output has too many pixels")

// ErrUnsupportedOutputFormat is returned when the requested output format is
// not supported.
var ErrUnsupportedOutputFormat = errors.New("unsupported output format")

// ErrUnsupportedInputFormat is returned, before the input is decoded, when
// libvips reads the input's first bytes as another format than its source
// format, or as none. An SVG whose first bytes pass the first-bytes check for
// AVIF is one example. A source format other than the seven pixa reads is
// also refused with it.
var ErrUnsupportedInputFormat = errors.New("unsupported input format")

// ErrSVGNotOriginalSize is returned when orig is asked of an SVG source at a
// size other than orig. pixa returns an SVG only as it is; a raster format
// gives it a size.
var ErrSVGNotOriginalSize = errors.New(
	"an SVG is returned as SVG only at the orig size")

// ErrTooManyImages is returned when MaxConcurrentProcessing images are being
// processed and none finishes within ProcessingWaitTimeout.
var ErrTooManyImages = errors.New("too many images being processed at once")

// ProcessingWaitTimeout is how long Process waits for a free slot when
// MaxConcurrentProcessing images are already being processed.
const ProcessingWaitTimeout = 10 * time.Second

// ImageProcessor implements image transformation using libvips via govips.
type ImageProcessor struct {
	maxInputBytes int64
	// processingSemaphore has one slot per image that may be processed at
	// once. Process holds a slot from before it reads its input until it
	// returns, so the input, the decoded image and the output all count.
	processingSemaphore chan struct{}
	// processingWaitTimeout is ProcessingWaitTimeout; tests shorten it.
	processingWaitTimeout time.Duration
}

// Params holds configuration for creating an ImageProcessor. Both fields
// must be at least 1.
type Params struct {
	// MaxInputBytes is the maximum allowed input size in bytes.
	MaxInputBytes int64
	// MaxConcurrentProcessing is the most images processed at once.
	MaxConcurrentProcessing int
}

// New creates a new image processor with the given parameters.
func New(params Params) *ImageProcessor {
	initVips()

	return &ImageProcessor{
		maxInputBytes:         params.MaxInputBytes,
		processingSemaphore:   make(chan struct{}, params.MaxConcurrentProcessing),
		processingWaitTimeout: ProcessingWaitTimeout,
	}
}

// Process transforms the image read from input according to transform.
// sourceFormat is the input's format, which magic detected from its first
// bytes. When MaxConcurrentProcessing images are already being processed,
// it waits up to ProcessingWaitTimeout for one to finish, then fails with
// ErrTooManyImages. When ctx has ended once Process has a slot, or before it
// encodes, it returns ctx's error and gives the slot back. govips gives pixa
// no way to stop libvips once an encode has begun, so an encode keeps its
// slot until it finishes. An AVIF output of more than MaxAVIFOutputPixels is
// refused with ErrAVIFOutputTooLarge before anything is decoded. orig of an
// SVG source is the SVG as it is, since libvips cannot save SVG; any other
// format renders it at the output size.
func (p *ImageProcessor) Process(
	ctx context.Context,
	input io.Reader,
	sourceFormat imagerequest.Format,
	transform *imagerequest.Transform,
) (*Result, error) {
	release, err := p.acquireSlot(ctx)
	if err != nil {
		return nil, err
	}

	defer release()

	data, err := p.readInput(input)
	if err != nil {
		return nil, err
	}

	// Input libvips would not load as sourceFormat is refused before it is
	// decoded
	err = checkInputFormat(data, sourceFormat)
	if err != nil {
		return nil, err
	}

	img, err := loadImage(data)
	if err != nil {
		return nil, err
	}
	defer img.Close()

	origWidth, origHeight := img.Width(), img.Height()
	outputFormat := resolveOutputFormat(transform.Format, sourceFormat)

	if outputFormat == imagerequest.FormatSVG && sourceFormat == imagerequest.FormatSVG {
		return svgAsItIs(data, transform.Size, origWidth, origHeight)
	}

	// Determine target dimensions; too large ones are refused before resizing
	targetWidth, targetHeight, err := targetDimensions(transform.Size,
		origWidth, origHeight)
	if err != nil {
		return nil, err
	}

	// Determine output dimensions; too large ones are refused before
	// resizing, which with FitCover already decodes the input
	outputWidth, outputHeight, err := outputDimensions(origWidth, origHeight,
		targetWidth, targetHeight, transform.FitMode, outputFormat)
	if err != nil {
		return nil, err
	}

	// An SVG is rendered again at about the output size, to stay sharp
	if sourceFormat == imagerequest.FormatSVG {
		rendered, err := renderSVG(data,
			svgDensity(origWidth, origHeight, outputWidth, outputHeight))
		if err != nil {
			return nil, err
		}

		defer rendered.Close()

		img = rendered
	}

	// Resize if needed
	if targetWidth != origWidth || targetHeight != origHeight {
		err := p.resize(img, outputWidth, outputHeight, transform.FitMode)
		if err != nil {
			return nil, fmt.Errorf("failed to resize: %w", err)
		}
	}

	// Encode to target format
	output, err := p.encode(ctx, img, outputFormat, transform.Quality)
	if err != nil {
		return nil, fmt.Errorf("failed to encode: %w", err)
	}

	return &Result{
		Content:       io.NopCloser(bytes.NewReader(output)),
		ContentLength: int64(len(output)),
		ContentType:   outputFormat.MIMEType(),
		Width:         img.Width(),
		Height:        img.Height(),
		InputWidth:    origWidth,
		InputHeight:   origHeight,
	}, nil
}

// targetDimensions calculates the output dimensions for a requested size,
// scaling proportionally when only one dimension is given and keeping the
// original dimensions when both are zero. A side scaled proportionally is
// rounded down but kept at 1 or more, as for a thin image it would round
// down to 0, a side of no pixels. It can come out above MaxOutputDimension,
// which is ErrOutputTooLarge.
func targetDimensions(
	size imagerequest.Size, origWidth, origHeight int,
) (int, int, error) {
	width, height := size.Width, size.Height

	switch {
	case width == 0 && height == 0:
		// Both are 0: keep original size
		return origWidth, origHeight, nil
	case width == 0:
		// Only height specified: calculate width proportionally
		width = max(1, origWidth*height/origHeight)
	case height == 0:
		// Only width specified: calculate height proportionally
		height = max(1, origHeight*width/origWidth)
	}

	if width > MaxOutputDimension || height > MaxOutputDimension {
		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
			width, height, MaxOutputDimension)
	}

	return width, height, nil
}

// resolveOutputFormat returns the format of the output for the requested
// format: sourceFormat for orig, and format itself for any other. encode
// refuses an empty format.
func resolveOutputFormat(
	format, sourceFormat imagerequest.Format,
) imagerequest.Format {
	if format == imagerequest.FormatOriginal {
		return sourceFormat
	}

	return format
}

// loadImage decodes data and turns the image upright: encode strips the EXIF
// orientation tag, and sizes must be worked out on the upright image. An
// image with a side above MaxInputDimension is ErrInputTooLarge, which guards
// against decompression bombs.
func loadImage(data []byte) (*vips.ImageRef, error) {
	img, err := vips.NewImageFromBuffer(data)
	if err != nil {
		return nil, fmt.Errorf("failed to decode image: %w", err)
	}

	err = img.AutoRotate()
	if err != nil {
		img.Close()

		return nil, fmt.Errorf("failed to auto-rotate: %w", err)
	}

	if img.Width() > MaxInputDimension || img.Height() > MaxInputDimension {
		img.Close()

		return nil, ErrInputTooLarge
	}

	return img, nil
}

// svgAsItIs returns the SVG data unchanged, which is orig of an SVG source
// at the orig size. width x height is the SVG's own size. Any other size is
// ErrSVGNotOriginalSize.
func svgAsItIs(
	data []byte, size imagerequest.Size, width, height int,
) (*Result, error) {
	if !size.OriginalSize() {
		return nil, fmt.Errorf("%w: asked for %dx%d", ErrSVGNotOriginalSize,
			size.Width, size.Height)
	}

	return &Result{
		Content:       io.NopCloser(bytes.NewReader(data)),
		ContentLength: int64(len(data)),
		ContentType:   imagerequest.FormatSVG.MIMEType(),
		Width:         width,
		Height:        height,
		InputWidth:    width,
		InputHeight:   height,
	}, nil
}

// svgDefaultDensity is the density, in dots per inch, at which libvips
// renders an SVG unless told otherwise. At it, an SVG of width="64" is 64
// pixels wide.
const svgDefaultDensity = 72

// svgDensity returns the least density at which an SVG of width x height,
// its size at svgDefaultDensity, covers outputWidth x outputHeight, so that
// resize hardly changes it. Neither side is rendered above
// MaxInputDimension.
func svgDensity(width, height, outputWidth, outputHeight int) int {
	scale := max(float64(outputWidth)/float64(width),
		float64(outputHeight)/float64(height))
	maxScale := float64(MaxInputDimension) / float64(max(width, height))

	return min(int(math.Ceil(svgDefaultDensity*scale)),
		int(svgDefaultDensity*maxScale))
}

// renderSVG loads the SVG data rendered at density, in dots per inch.
// librsvg renders it and, given the SVG as bytes with no file name, loads
// no file or URL the SVG refers to.
func renderSVG(data []byte, density int) (*vips.ImageRef, error) {
	params := vips.NewImportParams()
	params.Density.Set(density)

	img, err := vips.LoadImageFromBuffer(data, params)
	if err != nil {
		return nil, fmt.Errorf("failed to render SVG: %w", err)
	}

	return img, nil
}

// WaitForProcessing waits until no image is being processed, or until ctx
// ends, and returns how many images were still being processed then. It
// waits by taking each slot in processingSemaphore as it frees up until it
// holds them all, or until ctx ends, then gives back the slots it took.
func (p *ImageProcessor) WaitForProcessing(ctx context.Context) int {
	taken := 0

	defer func() {
		for range taken {
			<-p.processingSemaphore
		}
	}()

	for taken < cap(p.processingSemaphore) {
		select {
		case p.processingSemaphore <- struct{}{}:
			taken++
		case <-ctx.Done():
			return len(p.processingSemaphore) - taken
		}
	}

	return 0
}

// acquireSlot takes a slot in processingSemaphore, waiting at most
// processingWaitTimeout for one to free up, and returns the func that gives
// it back. When ctx has ended by the time it has a slot, it gives the slot
// back and returns ctx's error.
func (p *ImageProcessor) acquireSlot(ctx context.Context) (func(), error) {
	select {
	case p.processingSemaphore <- struct{}{}:
	case <-time.After(p.processingWaitTimeout):
		return nil, ErrTooManyImages
	case <-ctx.Done():
		return nil, ctx.Err()
	}

	release := func() { <-p.processingSemaphore }

	// select takes the slot even when ctx has ended at the same moment
	err := ctx.Err()
	if err != nil {
		release()

		return nil, err
	}

	return release, nil
}

// readInput reads input with a size limit to prevent unbounded memory
// consumption, refusing more than maxInputBytes with ErrInputDataTooLarge. It
// reads at most maxInputBytes+1 so it can detect if the input exceeds the
// limit without consuming additional memory.
func (p *ImageProcessor) readInput(input io.Reader) ([]byte, error) {
	data, err := io.ReadAll(io.LimitReader(input, p.maxInputBytes+1))
	if err != nil {
		return nil, fmt.Errorf("failed to read input: %w", err)
	}

	if int64(len(data)) > p.maxInputBytes {
		return nil, ErrInputDataTooLarge
	}

	return data, nil
}

// checkInputFormat returns ErrUnsupportedInputFormat unless libvips would
// load data with the loader of sourceFormat. govips picks the libvips loader
// from the input's first bytes with DetermineImageType. It refuses an SVG
// whose first bytes pass the first-bytes check for AVIF, which librsvg would
// otherwise render.
func checkInputFormat(data []byte, sourceFormat imagerequest.Format) error {
	// A format with no loader, such as orig or auto, has the type govips also
	// gives input it cannot read, which the check below would let through.
	sourceType := vipsImageType(sourceFormat)
	if sourceType == vips.ImageTypeUnknown {
		return fmt.Errorf("%w: %q is not a source format",
			ErrUnsupportedInputFormat, sourceFormat)
	}

	if vips.DetermineImageType(data) != sourceType {
		return fmt.Errorf("%w: libvips does not read the input as %s",
			ErrUnsupportedInputFormat, sourceFormat)
	}

	return nil
}

// vipsImageType returns the govips image type whose libvips loader reads
// format. orig and auto stand for another format, so they have
// vips.ImageTypeUnknown, which govips has no loader for.
func vipsImageType(format imagerequest.Format) vips.ImageType {
	switch format {
	case imagerequest.FormatJPEG:
		return vips.ImageTypeJPEG
	case imagerequest.FormatPNG:
		return vips.ImageTypePNG
	case imagerequest.FormatGIF:
		return vips.ImageTypeGIF
	case imagerequest.FormatWebP:
		return vips.ImageTypeWEBP
	case imagerequest.FormatAVIF:
		return vips.ImageTypeAVIF
	case imagerequest.FormatJXL:
		return vips.ImageTypeJXL
	case imagerequest.FormatSVG:
		return vips.ImageTypeSVG
	case imagerequest.FormatOriginal, imagerequest.FormatAuto:
		return vips.ImageTypeUnknown
	default:
		return vips.ImageTypeUnknown
	}
}

// outputDimensions returns the dimensions resize gives an image of imgWidth x
// imgHeight for the target dimensions and fit mode, without resizing it, and
// refuses an output too large for format. With FitOutside one side can come
// out larger than the target; when it would be above MaxOutputDimension,
// outputDimensions returns ErrOutputTooLarge. An AVIF output of more than
// MaxAVIFOutputPixels is ErrAVIFOutputTooLarge.
func outputDimensions(
	imgWidth, imgHeight, width, height int,
	fit imagerequest.Fit, format imagerequest.Format,
) (int, int, error) {
	scaleW := float64(width) / float64(imgWidth)
	scaleH := float64(height) / float64(imgHeight)
	outputWidth, outputHeight := width, height

	switch fit {
	case imagerequest.FitCover, imagerequest.FitFill, "":
		// Cover crops, and fill stretches, to exactly the target dimensions

	case imagerequest.FitContain:
		// Fit within the target dimensions, maintaining aspect ratio. Scaled
		// by the smaller scale, the short side of a thin image can round
		// down to 0, which libvips refuses as a width, so each side is at
		// least 1.
		scale := min(scaleW, scaleH)
		outputWidth = max(1, int(float64(imgWidth)*scale))
		outputHeight = max(1, int(float64(imgHeight)*scale))

	case imagerequest.FitInside:
		// Same as contain, but only shrink
		scale := min(scaleW, scaleH, 1)
		outputWidth = max(1, int(float64(imgWidth)*scale))
		outputHeight = max(1, int(float64(imgHeight)*scale))

	case imagerequest.FitOutside:
		// The smallest dimension fits, the other may exceed the target. A
		// side scaled to 1 can come out just under 1 in floating point, as
		// 49 times 1/49 does, and round down to 0, which libvips refuses as
		// a width, so each side is at least 1.
		scale := max(scaleW, scaleH)
		outputWidth = max(1, int(float64(imgWidth)*scale))
		outputHeight = max(1, int(float64(imgHeight)*scale))

	default:
		return 0, 0, fmt.Errorf("%w: %s", imagerequest.ErrInvalidFitMode, fit)
	}

	// The side FitOutside scales past the target is held to the maximum too
	if max(outputWidth, outputHeight) > MaxOutputDimension {
		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
			outputWidth, outputHeight, MaxOutputDimension)
	}

	if format == imagerequest.FormatAVIF &&
		outputWidth*outputHeight > MaxAVIFOutputPixels {
		return 0, 0, fmt.Errorf("%w: %dx%d is above %d pixels",
			ErrAVIFOutputTooLarge, outputWidth, outputHeight, MaxAVIFOutputPixels)
	}

	return outputWidth, outputHeight, nil
}

// resize resizes the image to width x height, the dimensions
// outputDimensions gives for the fit mode.
func (p *ImageProcessor) resize(
	img *vips.ImageRef, width, height int, fit imagerequest.Fit,
) error {
	switch fit {
	case imagerequest.FitCover, "":
		// Crop the centre and resize to fill exact dimensions (default)
		return cropCentreAndResize(img, width, height)

	case imagerequest.FitFill:
		// Resize to exact dimensions (may distort)
		return img.ThumbnailWithSize(width, height, vips.InterestingNone, vips.SizeForce)

	case imagerequest.FitInside:
		// outputDimensions keeps the dimensions of an image that already fits
		if img.Width() == width && img.Height() == height {
			return nil
		}

		return img.Thumbnail(width, height, vips.InterestingNone)

	case imagerequest.FitContain, imagerequest.FitOutside:
		return img.Thumbnail(width, height, vips.InterestingNone)

	default:
		return fmt.Errorf("%w: %s", imagerequest.ErrInvalidFitMode, fit)
	}
}

// cropCentreAndResize scales img by the same amount on both sides, the
// least that makes it cover width x height, and cuts the centre width x
// height out of it, as libvips' thumbnail does with InterestingCentre.
// thumbnail alone scales the whole image and copies the result into memory
// before it cuts, and for a thin image that is far larger than the image or
// the output: 8192x64 at 8192x8192 is 1048576x8192, about 24 GiB. So the
// centre is cut from img first, widened to whole pixels of img, which adds
// less than one pixel of img on each side, and thumbnail scales and cuts
// only that.
func cropCentreAndResize(img *vips.ImageRef, width, height int) error {
	imgW, imgH := img.Width(), img.Height()

	// An image wider than the requested proportions keeps its height and
	// loses width down to imgH*width/height, any other keeps its width and
	// loses height down to imgW*height/width. Half of what is lost comes
	// off each side, rounded down to whole pixels, so the part kept holds
	// all of the centre.
	left, top := 0, 0
	if imgW*height > imgH*width {
		left = (imgW*height - imgH*width) / (2 * height) //nolint:mnd // each side
	} else {
		top = (imgH*width - imgW*height) / (2 * width) //nolint:mnd // each side
	}

	err := img.ExtractArea(left, top, imgW-2*left, imgH-2*top)
	if err != nil {
		return err
	}

	return img.Thumbnail(width, height, vips.InterestingCentre)
}

const defaultQuality = 85

// encode encodes an image to the specified format. govips gives pixa no way
// to stop libvips once an encode has begun, so when ctx has ended encode
// returns ctx's error without beginning one.
func (p *ImageProcessor) encode(
	ctx context.Context, img *vips.ImageRef, format imagerequest.Format,
	quality int,
) ([]byte, error) {
	err := ctx.Err()
	if err != nil {
		return nil, err
	}

	if quality <= 0 {
		quality = defaultQuality
	}

	// Stripping drops the ICC profile as well, and clients show an image
	// with no profile as sRGB, so convert to sRGB first. "srgb" names
	// libvips' built-in profile; govips' own sRGB path variable is set on
	// first use but read without a lock, so concurrent requests race on it.
	if img.HasICCProfile() {
		err = img.TransformICCProfileWithFallback("srgb", "srgb")
		if err != nil {
			return nil, fmt.Errorf("failed to convert to sRGB: %w", err)
		}
	}

	switch format {
	case imagerequest.FormatJPEG:
		return exportJPEG(img, quality)

	case imagerequest.FormatPNG:
		return exportPNG(img)

	case imagerequest.FormatGIF:
		return exportGIF(img)

	case imagerequest.FormatWebP:
		return exportWebP(img, quality)

	case imagerequest.FormatAVIF:
		return exportAVIF(img, quality)

	case imagerequest.FormatJXL:
		return exportJXL(img, quality)

	// libvips cannot save SVG; Process returns an SVG source as it is
	case imagerequest.FormatSVG, imagerequest.FormatOriginal,
		imagerequest.FormatAuto:
		return nil, fmt.Errorf("%w: %s", ErrUnsupportedOutputFormat, format)

	default:
		return nil, fmt.Errorf("%w: %s", ErrUnsupportedOutputFormat, format)
	}
}

// govips sends libvips Go's zero value for some settings an export leaves
// out, such as no compression at all for PNG, so each export below sets
// every setting whose zero value is not what pixa wants. Stripping metadata
// drops EXIF, XMP, IPTC and the ICC profile.

// exportJPEG encodes img as JPEG at quality, without metadata. The settings
// it leaves out are at libvips' defaults.
func exportJPEG(img *vips.ImageRef, quality int) ([]byte, error) {
	output, _, err := img.ExportJpeg(&vips.JpegExportParams{
		StripMetadata: true,
		Quality:       quality,
	})

	return output, err
}

// pngCompression is libvips' default PNG compression, from 0 (none) to 9.
const pngCompression = 6

// exportPNG encodes img as PNG at libvips' default compression and row
// filter, without metadata.
func exportPNG(img *vips.ImageRef) ([]byte, error) {
	output, _, err := img.ExportPng(&vips.PngExportParams{
		StripMetadata: true,
		Compression:   pngCompression,
		Filter:        vips.PngFilterNone,
	})

	return output, err
}

// gifEffort is libvips' default GIF effort, from 1 to 10.
const gifEffort = 7

// exportGIF encodes img as GIF at libvips' default effort. govips cannot
// have libvips strip metadata from GIF, which carries none.
func exportGIF(img *vips.ImageRef) ([]byte, error) {
	output, _, err := img.ExportGIF(&vips.GifExportParams{Effort: gifEffort})

	return output, err
}

// webpEffort is the WebP effort, from 0 (fastest) to 6. It is below libvips'
// default of 4 so that an encode takes at most 40 seconds of the default
// downstream_timeout of 60 seconds. With one thread, as pixad runs libvips,
// saving an 8192x8192 image of random pixels with an alpha channel takes up
// to about 23 seconds at 2, and up to about 16 without one, at any quality;
// with an alpha channel, 3 takes about 50 seconds and 4 about 61.
const webpEffort = 2

// exportWebP encodes img as lossy WebP at quality and webpEffort, without
// metadata.
func exportWebP(img *vips.ImageRef, quality int) ([]byte, error) {
	output, _, err := img.ExportWebp(&vips.WebpExportParams{
		StripMetadata:   true,
		Quality:         quality,
		ReductionEffort: webpEffort,
	})

	return output, err
}

// avifEffort is the AVIF effort, from 0 (fastest) to 9; 1 is the lowest
// govips can set. With one thread, as pixad runs libvips, 1 takes about 52
// seconds to save an 8192x8192 RGB image of random pixels at quality 85,
// and about 96 with an alpha channel, against the default
// downstream_timeout of 60 seconds, so an AVIF output is held to
// MaxAVIFOutputPixels. On an image of milder noise, which 1 saves in about
// 12 seconds, 2 takes nearly a minute and libvips' default, 4, takes
// minutes.
const avifEffort = 1

// avifBitdepth is the AVIF bit depth, 8 bits per sample for every image.
// libvips would save a 16-bit image with 12, but at avifEffort that takes
// about 54 seconds for a 16-bit 8192x8192 image of milder noise, nearly all
// of the default downstream_timeout, and about 12 seconds with 8.
const avifBitdepth = 8

// exportAVIF encodes img as lossy AVIF at quality, avifEffort and
// avifBitdepth, without metadata.
func exportAVIF(img *vips.ImageRef, quality int) ([]byte, error) {
	output, _, err := img.ExportAvif(&vips.AvifExportParams{
		StripMetadata: true,
		Quality:       quality,
		Effort:        avifEffort,
		Bitdepth:      avifBitdepth,
	})

	return output, err
}

// jxlResolution is the resolution every JPEG XL image is saved with, in
// pixels per millimetre as libvips counts it: 72 dpi, what libvips gives a
// JPEG that names none.
const jxlResolution = 72 / 25.4

// jxlEffort is the JPEG XL effort, from 1 (fastest) to 9. It is below
// libvips' default of 7 so that an encode takes at most 40 seconds of the
// default downstream_timeout of 60 seconds. With one thread, as pixad runs
// libvips, saving an 8192x8192 image of random pixels with an alpha channel
// takes up to about 27 seconds at 4, and up to about 13 without one, at any
// quality; with an alpha channel, 5 takes about 43 seconds and 7 about 81.
const jxlEffort = 4

// exportJXL encodes img as JPEG XL at quality and jxlEffort, without
// metadata. govips sends libvips a distance, the JPEG XL encoder's own
// measure of quality, along with the quality, and libvips then uses the
// distance alone, so the quality is also given as a distance.
func exportJXL(img *vips.ImageRef, quality int) ([]byte, error) {
	// libvips converts a CMYK image to sRGB before it saves WebP, AVIF or
	// PNG, but cannot save one as JPEG XL. encode has already converted
	// any image with an ICC profile to sRGB, so this is CMYK with none.
	if img.Interpretation() == vips.InterpretationCMYK {
		err := img.ToColorSpace(vips.InterpretationSRGB)
		if err != nil {
			return nil, fmt.Errorf("failed to convert CMYK to sRGB: %w", err)
		}
	}

	// govips cannot make libvips strip metadata from JPEG XL, so it is
	// removed from the image itself. RemoveMetadata removes EXIF, XMP and
	// IPTC but keeps the ICC profile.
	err := img.RemoveMetadata()
	if err != nil {
		return nil, err
	}

	err = img.RemoveICCProfile()
	if err != nil {
		return nil, err
	}

	// libvips 8.16 and later still write an EXIF block of their own, from
	// the image's size, orientation and resolution, and fixed values. The
	// image is upright, so its orientation is 1, but its resolution is still
	// the source's.
	toSave, err := img.CopyChangingResolution(jxlResolution, jxlResolution)
	if err != nil {
		return nil, err
	}

	defer toSave.Close()

	params := vips.NewJxlExportParams()
	params.Quality = quality
	params.Distance = jxlDistance(quality)
	params.Effort = jxlEffort

	output, _, err := toSave.ExportJxl(params)
	if err != nil {
		return nil, err
	}

	return output, nil
}

// jxlDistance turns a quality from 1 to 100 into the JPEG XL encoder's
// distance, with the formula libvips and libjxl use for their own quality
// setting, except that 100 stays lossy (distance 0.1) where libjxl makes it
// lossless.
//
//nolint:mnd // the constants of that formula
func jxlDistance(quality int) float64 {
	q := float64(quality)

	if quality >= 30 {
		return 0.1 + (100-q)*0.09
	}

	return 53.0/3000.0*q*q - 23.0/20.0*q + 25.0
}