clawbot d3c8b5f422 Add failing tests for referer_blocklist ...

Both image routes must refuse a request whose Referer names a host on
referer_blocklist with 403 and the JSON error, without fetching from the
upstream host and whether or not the image is cached, and must serve a
request with no Referer, one that does not parse, or one naming another
host. Hosts match as allowlist_hosts matches them. The config tests check
the list is read from the file and from PIXA_REFERER_BLOCKLIST, and that an
entry that is not a host aborts startup naming the setting and the entry.
These do not compile until the setting exists.

Model: opus-5-5

2026-10-04 18:06:04 +00:00

..

auth_clientip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

auth_csrf_internal_test.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

auth_generate_internal_test.go

Validate dimensions and fit mode on encrypted URLs (closes #62)

2026-09-28 15:24:32 +02:00

auth_login_log_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 14:39:27 +02:00

auth_session_internal_test.go

Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77)

2026-10-04 19:24:39 +02:00

auth.go

Refuse an unparseable exp with 400; log swallowed cache errors (closes #72)

2026-09-28 19:59:39 +02:00

bodylimit_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

bodylimit.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

cache_max_bytes_internal_test.go

Count what the cache holds in the default cache_max_bytes (closes #184)

2026-10-04 19:41:49 +02:00

csrf.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

handlers_internal_test.go

Refuse an empty fit on /v1/image/ with 400 (closes #139)

2026-09-28 18:07:11 +02:00

handlers.go

Count what the cache holds in the default cache_max_bytes (closes #184)

2026-10-04 19:41:49 +02:00

healthcheck.go

Add doc comment to HandleHealthCheck method

2026-01-08 02:28:30 -08:00

image_cache_control_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

image_errors_internal_test.go

Test the image route's signature check and error answers (closes #76)

2026-10-04 13:58:29 +02:00

image_signature_internal_test.go

Keep max-age within an expiring image URL's lifetime (closes #63)

2026-09-29 03:51:58 +02:00

image.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

imageenc_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

imageenc_token_internal_test.go

Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77)

2026-10-04 19:24:39 +02:00

imageenc.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

referer_blocklist_internal_test.go

Add failing tests for referer_blocklist

2026-10-04 18:06:04 +00:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

robots_healthcheck_internal_test.go

Test the image route's signature check and error answers (closes #76)

2026-10-04 13:58:29 +02:00

server_busy_internal_test.go

Bound concurrent image processing and upstream fetches (closes #64)

2026-09-29 10:32:16 +02:00