4 Commits

Include renames

Author	SHA1	Message	Date
sneak	4d1d172afd	middleware: take the client address from the right of X-Forwarded-For (closes #181) ... realIP took the first X-Forwarded-For entry, which the client itself can write, so behind a proxy that appends to the header a client chose the address dnswatcher logs and the /metrics rate limit counts. It now walks the entries from the right past trusted proxies, using the existing trusted-proxy check, and takes the first that is not one; the leftmost when all are. All X-Forwarded-For header lines are read as one list, since a proxy may add its own line instead of appending to the client's. An empty entry where the client address belongs falls back to the peer address, as an empty first entry did before. X-Real-IP is unchanged. Model: opus-5-5	2026-10-01 20:33:54 +00:00
clawbot	ed0f56f144	metrics: rate limit /metrics per client address before Basic Auth (closes #101) ... /metrics is behind a password, and REPO_POLICIES.md requires rate limiting on password logins. Each client address may now send it 30 requests a minute, counted by httprate before Basic Auth, so failed logins use up the allowance and a request over it gets 429 without the password being checked. The address is the one the existing trusted-proxy logic in internal/middleware works out, with IPv6 addresses grouped by /64; an IPv4 address a proxy reports in IPv6-mapped form counts as the plain IPv4 address. A Prometheus server scraping every 15 seconds sends 4 requests a minute. Model: opus-5-5	2026-10-01 22:09:14 +02:00
clawbot	db94c903df	tests: move the test-only constructors into export_test.go (closes #111) ... state.NewForTest, state.NewForTestWithDataDir and watcher.NewForTest were compiled into and exported by the production packages internal/state and internal/watcher. NewForTestWithDataDir and watcher.NewForTest now live in their package's export_test.go. Tests in other packages cannot see those files, so the watcher and middleware tests build their State with state.New and a temporary data directory; the watcher tests no longer try to save to /state.json. state.NewForTest, whose State saved to /, is deleted: the state tests that used it pass t.TempDir() to NewForTestWithDataDir, and the test of the helper itself is gone. Model: opus-5-5	2026-10-01 21:03:03 +02:00
clawbot	8aaa103956	middleware: add security response headers (closes #98) ... Adds a SecurityHeaders middleware and registers it globally, right after the request ID middleware, so every route gets the headers, including static files, /metrics and error responses. It sets Strict-Transport-Security (one year, includeSubDomains), a Content-Security-Policy with default-src 'self', no scripts and frame-ancestors 'none', X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy no-referrer and a Permissions-Policy that turns every listed feature off. HSTS is sent on every response, not only over TLS: the service runs behind a TLS-terminating proxy and REPO_POLICIES.md requires the application to send it. Referrer-Policy is stricter than the policy baseline because dashboard URLs can name internal hosts. model: claude-opus-4-8 (implementation); claude-fable-5 (commit message)	2026-09-22 00:52:48 +02:00