clawbot 483ada3be0 Test metrics auth, CORS preflight, login logging and metrics (closes #79) ...

New tests only. The basic auth in front of /metrics answers 401 with a
challenge without credentials or with a wrong username or password, and
lets the configured ones through. A CORS preflight request gets the same
Access-Control-Allow-Origin as a GET. A POST / whose form carries the
signing key leaves the key out of the log line. The router records
requests, and /metrics reports them, only when the metrics username is
set; that test is the one in internal/server allowed to set up the
process-wide Prometheus registry.

The pinned basicauth-go already compares the password in constant time
with crypto/subtle, so no code changes.

Model: opus-5-5

2026-10-04 07:47:07 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 07:47:07 +00:00

middleware.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00