3 Commits

Include renames

Author	SHA1	Message	Date
sneak	b4d53102e5	server: a directory under /s/ answers 404, not a listing (closes #286) ... http.FileServer answered /s/ and /s/css/ with an HTML listing of the embedded files, and /s/css with a redirect to that listing. The static handler now looks the name up in the embedded files first and answers 404 when it names a directory; files are served as before. Model: opus-5-5	2026-10-15 11:34:54 +00:00
clawbot	ed0f56f144	metrics: rate limit /metrics per client address before Basic Auth (closes #101) ... /metrics is behind a password, and REPO_POLICIES.md requires rate limiting on password logins. Each client address may now send it 30 requests a minute, counted by httprate before Basic Auth, so failed logins use up the allowance and a request over it gets 429 without the password being checked. The address is the one the existing trusted-proxy logic in internal/middleware works out, with IPv6 addresses grouped by /64; an IPv4 address a proxy reports in IPv6-mapped form counts as the plain IPv4 address. A Prometheus server scraping every 15 seconds sends 4 requests a minute. Model: opus-5-5	2026-10-01 22:09:14 +02:00
clawbot	f7cc6b42e0	server: limit wildcard CORS to the public routes (closes #100) ... The CORS wildcard was global, so it also covered the Basic-Auth protected /metrics, which REPO_POLICIES.md forbids, and it allowed POST, PUT and DELETE, which no route serves, plus the Authorization and X-CSRF-Token headers. CORS now sits on a router holding only the public routes and allows GET and OPTIONS with the Accept and Content-Type headers. /metrics gets no CORS at all. Both are mounted routers rather than a Group: chi answers OPTIONS on a Group's route with 405 before its middleware runs, and any method /metrics does not register would otherwise fall through to the public router. So every method on /metrics now meets Basic Auth first, and /metrics/ is served like /metrics. Model: opus-5-5	2026-10-01 21:05:43 +02:00