5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	e4df415676	Delete the oldest report files to stay under the size cap (closes #54) ... When a report would take the report files past DATA_DIR_MAX_BYTES, reportbuf now deletes the oldest report files until it fits, and does the same at start when files left by an earlier run are already past it. A file joins the files that may be deleted, at its place by name, only once it is completely written, so a file still being written is never deleted. A report is refused with 507 only when the reports waiting to be written fill the cap on their own, and then no file is deleted. The reports of a failed write stop counting, and the part of its file written is removed. A file whose deletion fails keeps counting; one already deleted by hand counts as freed. Model: opus-5-5	2026-10-03 17:51:08 +02:00
clawbot	aa35625d47	Go tests run with -race and -cover under Go's own timeout (closes #88) ... backend/script/test runs go test -timeout 30s -race -cover and, if that fails, runs it again with -v and fails. The root script/test drops its one 30-second timeout around both halves: from a cold Go build cache, compiling the tests with -race used it all up. Each half keeps its own limit. The race detector needs a C compiler: the Dockerfile builder stage gains gcc and musl-dev, and script/bootstrap installs gcc, with the C library headers on apt and apk, when gcc is missing; make build still sets CGO_ENABLED=0. New tests: the health check's answer, a valid report's answer, a report file's exact lines, and the flush at the 10 MiB threshold. The handlers TestImport stub is gone. Model: opus-5-5	2026-10-03 16:26:17 +02:00
clawbot	d74d1e311e	fix(backend): cut request log fields to the log bound (closes #60) ... The request log wrote the URL, User-Agent, Referer and other request-supplied strings with no length limit, and the server accepts headers up to 1 MiB, so one request could put about 1 MiB per field into a log line. Every string the request log takes from the request, including the request ID chi copies from X-Request-Id, is now cut to the 128-byte bound the report handler already used. That bound and its helper moved from the handlers package to the logger package so both use the one copy. Model: opus-5-5	2026-09-29 09:39:11 +02:00
clawbot	ea66caf338	fix(backend): rate-limit and cap report ingest, drop wildcard CORS (closes #20) ... POST /api/v1/reports stays unauthenticated but is bounded. Each client address, as the trusted-proxy logic resolves it, may send REPORTS_PER_MINUTE reports a minute (default 60, counted by go-chi/httprate over a sliding minute); past that it gets 429 with Retry-After. reportbuf refuses a report that would take the report files past DATA_DIR_MAX_BYTES (default 1 GiB), counting the files already in DATA_DIR and unwritten reports at their uncompressed size; the handler answers 507. CORS adds nothing unless CORS_ALLOWED_ORIGINS lists origins. A limit that is not a positive number, or an origin that is not a plain scheme://host[:port], stops the server from starting. Model: opus-5-5	2026-09-29 04:22:19 +02:00
clawbot	503399e020	fix(backend): report ingest correctness: 500 on a refused report, 413 on oversize, global body cap (closes #23) ... A report the buffer refuses now returns 500 instead of a false `ok`. Reports reach disk later, so a failed disk write is still answered 200 and shows in the log, and at shutdown as a failed stop with a non-zero exit. An over-limit body returns 413; malformed JSON stays 400. A MaxBodyBytes middleware caps every route at 1 MiB; a route group can only lower that limit. The raw geo blob is no longer logged; client_id, timestamp and decode error text are cut to 128 bytes before logging. Panic recovery logs the panic value and stack through slog. Model: opus-5-5	2026-09-28 20:39:39 +02:00