Report which public blocklists list an address in the IP lookup (closes #158)

A new package, internal/blocklist, downloads seven public lists on a
schedule: DShield, Feodo Tracker, FireHOL abusers and level 3, Spamhaus
DROP for IPv4 and IPv6, and the Tor exit list. It keeps the last good
copy of each in memory and on disk. A download sends back the
Last-Modified and ETag the publisher gave for the copy, also kept on
disk.

Every IP lookup result carries blocklists. An address with no live route
now gets a result too, without route fields, so the lookup no longer
answers 404. A successful answer carries Cache-Control, private for the
caller's own address. The address sets come from go4.org/netipx.

Model: opus-5-5

internal/server/handlers_internal_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"html"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -16,6 +17,7 @@ import (
 	"testing"
 	"time"
 
+	"git.eeqj.de/sneak/routewatch/internal/blocklist"
 	"git.eeqj.de/sneak/routewatch/internal/config"
 	"git.eeqj.de/sneak/routewatch/internal/database"
 	"git.eeqj.de/sneak/routewatch/internal/logger"
@@ -1040,14 +1042,15 @@ func (failingIPLookupDB) GetIPInfoContext(
 // server's router with a store whose read of one address fails with the
 // driver's error. A lookup that asks for that address answers 500 with the
 // JSON error body, as the AS and prefix JSON routes do; an address with no
-// route still answers 404. Before the fix the failed read was reported as if
-// the address had no route: 404 for that address alone, and 200 beside a
-// routed address (https://git.eeqj.de/sneak/routewatch/issues/109).
+// route answers 200. Before the fix the failed read was reported as if the
+// address had no route: 404 for that address alone, and 200 beside a routed
+// address (https://git.eeqj.de/sneak/routewatch/issues/109).
 func TestIPLookupAnswers500WhenDatabaseReadFails(t *testing.T) {
 	t.Parallel()
 
 	s := New(failingIPLookupDB{}, streamer.New(logger.New(), metrics.New()),
 		logger.New(), &config.Config{})
+	s.resolver = &fakeResolver{}
 
 	tests := []struct {
 		path     string
@@ -1063,7 +1066,7 @@ func TestIPLookupAnswers500WhenDatabaseReadFails(t *testing.T) {
 		},
 		{
 			path:     "/api/v1/ip/203.0.113.1",
-			wantCode: http.StatusNotFound,
+			wantCode: http.StatusOK,
 		},
 	}
 
@@ -1077,7 +1080,9 @@ func TestIPLookupAnswers500WhenDatabaseReadFails(t *testing.T) {
 				tt.path, rec.Code, tt.wantCode, rec.Body)
 		}
 
-		checkJSONErrorCode(t, tt.path, rec, tt.wantCode)
+		if tt.wantCode != http.StatusOK {
+			checkJSONErrorCode(t, tt.path, rec, tt.wantCode)
+		}
 	}
 }
 
@@ -1165,10 +1170,10 @@ func TestIPLookupRefusesTooManyAddresses(t *testing.T) {
 	}{
 		{
 			strings.Join(addrs[:maxLookupTargets], ","),
-			http.StatusNotFound, maxLookupTargets, 0,
+			http.StatusOK, maxLookupTargets, 0,
 		},
 		{strings.Join(addrs, ","), http.StatusBadRequest, 0, 0},
-		{"most.test", http.StatusNotFound, maxLookupTargets, 1},
+		{"most.test", http.StatusOK, maxLookupTargets, 1},
 		{"too-many.test", http.StatusBadRequest, 0, 1},
 		{strings.Join(names, ","), http.StatusBadRequest, 0, 0},
 	}
@@ -1189,7 +1194,9 @@ func TestIPLookupRefusesTooManyAddresses(t *testing.T) {
 				tt.target, rec.Code, tt.wantCode, rec.Body)
 		}
 
-		checkJSONErrorCode(t, tt.target, rec, tt.wantCode)
+		if tt.wantCode != http.StatusOK {
+			checkJSONErrorCode(t, tt.target, rec, tt.wantCode)
+		}
 
 		got := db.lookups.Load()
 		if got != tt.wantLookups {
@@ -1246,6 +1253,191 @@ func TestIPLookupKeepsRouteWhenPTRLookupDoesNotAnswer(t *testing.T) {
 	}
 }
 
+// addrInTestPrefixV6 is an address in testPrefixV6, which
+// newServerWithTestRoutes stores a route for.
+const addrInTestPrefixV6 = "2001:db8::1"
+
+// testBlocklistInterval is fakeBlocklists' shortest interval.
+const testBlocklistInterval = 15 * time.Minute
+
+// ownAddressPath is the IP lookup of the caller's own address.
+const ownAddressPath = "/ip/"
+
+// listedUnroutedAddr is an address that fakeBlocklists lists, outside the
+// routes newServerWithTestRoutes stores.
+const listedUnroutedAddr = "203.0.113.1"
+
+// fakeBlocklists has one list, which lists addrInTestPrefixV4 and
+// listedUnroutedAddr and no other address.
+type fakeBlocklists struct{}
+
+func testListing() blocklist.Listing {
+	return blocklist.Listing{
+		Name:        "test_list",
+		Description: "On the test list",
+		Updated:     time.Date(2026, 10, 27, 4, 0, 0, 0, time.UTC),
+	}
+}
+
+func (fakeBlocklists) Lookup(addr netip.Addr) []blocklist.Listing {
+	if addr == netip.MustParseAddr(addrInTestPrefixV4) ||
+		addr == netip.MustParseAddr(listedUnroutedAddr) {
+		return []blocklist.Listing{testListing()}
+	}
+
+	return []blocklist.Listing{}
+}
+
+func (fakeBlocklists) ShortestInterval() time.Duration {
+	return testBlocklistInterval
+}
+
+// TestIPLookupReportsBlocklists looks up two routed addresses, one of them on
+// a blocklist. The listed address's result names the list, says what it means
+// and when it was updated. The other's result has an empty list.
+func TestIPLookupReportsBlocklists(t *testing.T) {
+	t.Parallel()
+
+	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
+	s.SetBlocklists(fakeBlocklists{})
+
+	rec := httptest.NewRecorder()
+	s.router.ServeHTTP(rec, httptest.NewRequestWithContext(t.Context(),
+		http.MethodGet,
+		"/api/v1/ip/"+addrInTestPrefixV4+","+addrInTestPrefixV6, nil))
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d, want %d; body %s", rec.Code, http.StatusOK, rec.Body)
+	}
+
+	var body struct {
+		Data IPLookupResponse `json:"data"`
+	}
+
+	err := json.Unmarshal(rec.Body.Bytes(), &body)
+	if err != nil {
+		t.Fatalf("decoding the answer %q: %v", rec.Body, err)
+	}
+
+	results := body.Data.Results
+	if len(results) != 2 {
+		t.Fatalf("answer %s, want two results", rec.Body)
+	}
+
+	want := testListing()
+
+	listed := results[0].Blocklists
+	if len(listed) != 1 || listed[0].Name != want.Name ||
+		listed[0].Description != want.Description ||
+		!listed[0].Updated.Equal(want.Updated) {
+		t.Errorf("%s: blocklists %+v, want [%+v]", results[0].IP, listed, want)
+	}
+
+	if !strings.Contains(rec.Body.String(), `"blocklists":[]`) {
+		t.Errorf("answer %s, want an empty blocklists list for %s",
+			rec.Body, addrInTestPrefixV6)
+	}
+}
+
+// TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute looks up a listed
+// address that has no live route, alone and beside a routed address. Each
+// answer is 200 and has a result for the address, with its blocklists and no
+// route fields. Before the fix the lookup of that address alone answered
+// 404, and beside a routed address it was only named in errors, so its
+// blocklists were never reported.
+func TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute(t *testing.T) {
+	t.Parallel()
+
+	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
+	s.SetBlocklists(fakeBlocklists{})
+
+	for _, target := range []string{
+		listedUnroutedAddr,
+		addrInTestPrefixV4 + "," + listedUnroutedAddr,
+	} {
+		rec := httptest.NewRecorder()
+		s.router.ServeHTTP(rec, httptest.NewRequestWithContext(t.Context(),
+			http.MethodGet, "/api/v1/ip/"+target, nil))
+
+		var body struct {
+			Data IPLookupResponse `json:"data"`
+		}
+
+		err := json.Unmarshal(rec.Body.Bytes(), &body)
+		if rec.Code != http.StatusOK || err != nil {
+			t.Errorf("%s: status %d (%v), want %d; body %s",
+				target, rec.Code, err, http.StatusOK, rec.Body)
+
+			continue
+		}
+
+		i := slices.IndexFunc(body.Data.Results, func(r IPLookupResult) bool {
+			return r.IP == listedUnroutedAddr
+		})
+		if i < 0 || len(body.Data.Errors) != 0 {
+			t.Errorf("%s: answer %s, want a result for %s and no errors",
+				target, rec.Body, listedUnroutedAddr)
+
+			continue
+		}
+
+		result := body.Data.Results[i]
+		if result.IPInfo != nil {
+			t.Errorf("%s: result for %s has route fields %+v",
+				target, listedUnroutedAddr, result.IPInfo)
+		}
+
+		if len(result.Blocklists) != 1 ||
+			result.Blocklists[0].Name != testListing().Name {
+			t.Errorf("%s: blocklists %+v, want [%+v]",
+				target, result.Blocklists, testListing())
+		}
+	}
+}
+
+// TestIPLookupAnswersMayBeCached checks the Cache-Control header of the IP
+// lookup answers. Caches may keep them for the blocklists' shortest interval,
+// and only the caller's own browser may keep the answer about the caller's
+// own address.
+func TestIPLookupAnswersMayBeCached(t *testing.T) {
+	t.Parallel()
+
+	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
+	s.SetBlocklists(fakeBlocklists{})
+
+	tests := []struct {
+		path string
+		want string
+	}{
+		{"/api/v1/ip/" + addrInTestPrefixV4, "public, max-age=900"},
+		{ownAddressPath + addrInTestPrefixV4, "public, max-age=900"},
+		{ownAddressPath, "private, max-age=900"},
+	}
+
+	for _, tt := range tests {
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			tt.path, nil)
+		req.RemoteAddr = net.JoinHostPort(addrInTestPrefixV4, "1234")
+
+		rec := httptest.NewRecorder()
+		s.router.ServeHTTP(rec, req)
+
+		if rec.Code != http.StatusOK {
+			t.Errorf("%s: status %d, want %d; body %s",
+				tt.path, rec.Code, http.StatusOK, rec.Body)
+
+			continue
+		}
+
+		if got := rec.Header().Get(cacheControlHeader); got != tt.want {
+			t.Errorf("%s: Cache-Control %q, want %q", tt.path, got, tt.want)
+		}
+	}
+}
+
 // The host name TestIPLookupHidesPrivateAddresses resolves to a private
 // address, and that address.
 const (