clawbot c4fe5c1d75 Test metrics auth, CORS preflight, login logging and metrics (closes #79) ...

New tests only. The basic auth in front of /metrics answers 401 with a
challenge without credentials or with a wrong username or password, and
lets the configured ones through. A CORS preflight request gets the same
Access-Control-Allow-Origin as a GET. A POST / whose form carries the
signing key leaves the key out of the log line. The metrics middleware
records a request it served, and the router records nothing while no
metrics username is set.

The pinned basicauth-go already compares the password in constant time
with crypto/subtle, so no code changes.

Model: opus-5-5

2026-10-04 08:10:43 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 08:10:43 +00:00

middleware.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00