clawbot
c4fe5c1d75
check / check (push) Failing after 2s
New tests only. The basic auth in front of /metrics answers 401 with a challenge without credentials or with a wrong username or password, and lets the configured ones through. A CORS preflight request gets the same Access-Control-Allow-Origin as a GET. A POST / whose form carries the signing key leaves the key out of the log line. The metrics middleware records a request it served, and the router records nothing while no metrics username is set. The pinned basicauth-go already compares the password in constant time with crypto/subtle, so no code changes. Model: opus-5-5