4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	7a3c706fe6	main() is one call into internal/cli (closes #160) ... cmd/netwatch-server/main.go parsed the command line, ran the check-cidr and prepare-data-dir subcommands and built the fx application itself; the Go style guide puts all of that in internal/ or pkg/. The new package internal/cli does it, with the same arguments, messages and exit codes. main() is now os.Exit(cli.Main(os.Stderr, Appname, Version, os.Args[1:], cli.RunServer)): Main takes the writer for errors and the function that runs the server, so its tests give it a buffer and a function that fails them. Appname and Version stay in main, where the build sets Version. The function behind prepare-data-dir also takes the volume and the user's name, so its own tests give it a temporary directory and the user they run as. Model: opus-5-5	2026-10-19 07:53:09 +02:00
clawbot	e628dfe6cf	A handler's panic is logged and counted as 500 (closes #125) ... Recoverer comes first, so it wrote the 500 only after the panic had passed the request log and the metrics, which both recorded 200. Write500OnPanic, placed after the request log and after the metrics, writes the 500 as the panic passes and panics again, so Sentry and Recoverer still get it. Recoverer now writes its 500 only when no status was written, so the server logs no superfluous WriteHeader call. The test also requires Recoverer's log line for the handler's panic, so it fails if Write500OnPanic stops passing the panic on. Model: opus-5-5	2026-10-14 13:30:11 +02:00
clawbot	73b39e485b	Reports are taken only as application/json (closes #126) ... A page on another origin can POST text/plain or a form without a CORS preflight, so its visitors' browsers could store reports although the server sends no CORS headers. decodeJSON now refuses a request whose Content-Type is not application/json (parameters such as charset allowed), and the report handler answers it 415 with the usual error body, storing nothing. A JSON POST waits for the preflight, which only an origin in CORS_ALLOWED_ORIGINS passes; the page already sends application/json. Model: opus-5-5	2026-10-14 12:43:25 +02:00
clawbot	406e073aee	Move to the layout REPO_POLICIES.md gives (closes #30) ... The Go module moves from backend/ to the root (go.mod, go.sum, .golangci.yml, cmd/, internal/), the page's source to web/, and nginx's two files to configs/. backend/ is gone: its LICENSE and .dockerignore are deleted, and its .gitignore entries, README and scripts are folded into the root ones. script/build builds the server binary after the frontend; script/run and script/clean move up from backend/script/; make test, lint, fmt and fmt-check do what the backend's did. Vite's root is web/ and it still builds into dist/. go.mod ignores node_modules/, whose npm packages can ship .go files. script/bootstrap no longer installs gcc, which only the host Go tests needed. Model: opus-5-5	2026-10-14 12:01:32 +02:00