5 Commits

Include renames

Author	SHA1	Message	Date
sneak	293d0aec23	Add the HTTP hardening the policy requires before 1.0 (closes #108) ... Every answer carries the six security headers REPO_POLICIES.md lists. The Content-Security-Policy allows inline content only with a nonce made for that answer; the pages put it on their style and script blocks and drop their four style attributes. The request log and /ip/ take a forwarded address only from a proxy listed in TRUSTED_PROXIES, which stops the start when set but invalid: the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP and True-Client-IP are no longer read. The JSON routes and the health check send fixed messages in place of database, parser and resolver errors, and log the detail. Model: opus-5-5	2026-10-19 23:21:43 +00:00
clawbot	d2a6e30360	Percent-decode URL parameters before parsing them (closes #103) ... chi matches routes against the escaped path when a request has one and hands the handlers their URL parameters still percent-encoded. The home page's lookup form encodes the address it asks for, so every IPv6 lookup answered 400, as did a comma-separated address list or a prefix that a client percent-encoded. The router now matches against the decoded path, so every handler reads its parameters decoded. Model: opus-5-5	2026-10-19 23:02:00 +02:00
clawbot	d84dd56460	Make live route writes cheaper so the prefix handler keeps up (closes #96) ... The live route tables lose their random UUID key; the row id the prefix-length sample draws is declared as the integer key. The prefix tables are keyed by prefix and keep only first_seen; a batch inserts only prefixes not stored yet. A route update sets only the columns that change. Each kept index names the queries using it. Every write goes through one connection kept for writing, with a 1 GiB page cache; reading connections get 16 MiB, heap limits rise to 1.5 and 2 GiB (README "Memory"). Batch writes go in key order. A benchmark run by hand writes 250,000 updates on 5 million routes faster than the feed's 10,000 a second; a live run follows. Model: opus-5-5	2026-10-19 15:43:38 +02:00
clawbot	2712183f21	Keep a trailing AS set out of the origin and the peerings (closes #75) ... A path ending in an AS set, such as [64496, 64497, [64498, 64499]], was flattened into the sequence, so the route was stored as originated by the last set member and the peering handler recorded peerings the path does not show. ASPath now keeps the sequence and a trailing set of several members apart; Origin() gives the last AS of the sequence, or 0 (no known origin) for such a set. The handlers use it; peerings come from the sequence only. The pages show origin 0 as no known origin, and the IP lookup asks no WHOIS lookup for it. Empty paths are unchanged. Model: opus-5-5	2026-10-19 12:50:05 +02:00
clawbot	b89987e356	Re-vendor the shared files from sneak/prompts at 0653579 (closes #52) ... Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the workflow and REPO_POLICIES.md from sneak/prompts 0653579, with this repository's own entries after the shared content. Lint (golangci-lint v2.14.0) and test are Dockerfile phases that script/lint and script/test build alone with a new CACHEBUST value, keeping Go's and golangci-lint's caches; the image build depends on both. make fmt and make fmt-check also format the markdown with prettier, pinned in yarn.lock. The agent guidance moves to AGENTS.md. The Go code is fixed for what the new configuration finds, and the AS and prefix detail reads now return the rows' error after their loops. Model: opus-5-5	2026-10-19 12:10:11 +02:00