Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/bans/bans_test.go

@@ -27,8 +27,14 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 		length := time.Duration(hours) * time.Hour
 		if !ban.Expires.Equal(now.Add(length)) ||
 			ban.Notes.EarlierBans != (bans.EarlierBans{Limit: i}) {
-			t.Fatalf("ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
-				i+1, ban.Expires.Sub(now), ban.Notes.EarlierBans, hours, i)
+			t.Fatalf(
+				"ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
+				i+1,
+				ban.Expires.Sub(now),
+				ban.Notes.EarlierBans,
+				hours,
+				i,
+			)
 		}
 
 		now = ban.Expires
@@ -65,13 +71,27 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 			ledger := bans.New(defaultParams())
 			netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-			first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-			second, _ := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
+			first, _ := ledger.BanForLimit(
+				netblock,
+				midnight(),
+				bans.Notes{},
+			)
+			second, _ := ledger.BanForLimit(
+				netblock,
+				first.Expires.Add(tc.gap),
+				bans.Notes{},
+			)
 
 			if second.Expires.Sub(second.Start) != tc.want ||
 				second.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-				t.Errorf("second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
-					second.Expires.Sub(second.Start), second.Notes.EarlierBans, tc.want)
+				t.Errorf(
+					"second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
+					second.Expires.Sub(
+						second.Start,
+					),
+					second.Notes.EarlierBans,
+					tc.want,
+				)
 			}
 		})
 	}
@@ -84,8 +104,11 @@ func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	params.LimitBanDuration = params.MaxBanDuration + time.Hour
 	ledger := bans.New(params)
 
-	ban, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
-		bans.Notes{})
+	ban, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.9/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	if !ban.Permanent() {
 		t.Errorf("first ban ends at %s, want a permanent one", ban.Expires)
 	}
@@ -106,7 +129,12 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	for i := range 14 {
 		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 		if !ban.Expires.After(ban.Start) {
-			t.Fatalf("ban %d starts at %s and ends at %s", i+1, ban.Start, ban.Expires)
+			t.Fatalf(
+				"ban %d starts at %s and ends at %s",
+				i+1,
+				ban.Start,
+				ban.Expires,
+			)
 		}
 
 		now = ban.Expires
@@ -129,17 +157,36 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 		t.Error("the first ban was not made")
 	}
 
-	again, made := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made := ledger.BanForLimit(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 
-	if made || !reflect.DeepEqual(again, first) || len(ledger.Bans(netblock)) != 1 {
-		t.Errorf("a limit broken during a ban gave %+v, made %t, and %d bans, "+
-			"want %+v, not made, and 1", again, made, len(ledger.Bans(netblock)), first)
+	if made || !reflect.DeepEqual(again, first) ||
+		len(ledger.Bans(netblock)) != 1 {
+		t.Errorf(
+			"a limit broken during a ban gave %+v, made %t, and %d bans, "+
+				"want %+v, not made, and 1",
+			again,
+			made,
+			len(ledger.Bans(netblock)),
+			first,
+		)
 	}
 
-	again, made = ledger.BanForAttack(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made = ledger.BanForAttack(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 	if made || !reflect.DeepEqual(again, first) {
-		t.Errorf("an attack during a ban gave %+v, made %t, want %+v, not made",
-			again, made, first)
+		t.Errorf(
+			"an attack during a ban gave %+v, made %t, want %+v, not made",
+			again,
+			made,
+			first,
+		)
 	}
 }
 
@@ -148,16 +195,26 @@ func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
 	for range 3 {
-		got, banned, _ := ledger.Check(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+		got, banned, _ := ledger.Check(
+			netblock.Addr(),
+			ban.Expires.Add(-time.Nanosecond),
+		)
 		if !banned || got.Start != ban.Start {
 			t.Fatalf("check during the ban gives %+v and %t", got, banned)
 		}
 	}
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.10"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.10"),
+		midnight(),
+	)
 	if banned {
 		t.Error("another netblock is banned")
 	}
@@ -180,11 +237,23 @@ func TestFindCountsNothing(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
-	got, banned, _ := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+	got, banned, _ := ledger.Find(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Nanosecond),
+	)
 	if !banned || !reflect.DeepEqual(got, ban) {
-		t.Errorf("find during the ban gives %+v and %t, want %+v", got, banned, ban)
+		t.Errorf(
+			"find during the ban gives %+v and %t, want %+v",
+			got,
+			banned,
+			ban,
+		)
 	}
 
 	_, banned, _ = ledger.Find(netblock.Addr(), ban.Expires)
@@ -192,12 +261,21 @@ func TestFindCountsNothing(t *testing.T) {
 		t.Error("the ban did not end")
 	}
 
-	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(notes, ban.Notes) {
-		t.Errorf("the notes are %+v, want them unchanged, %+v", notes, ban.Notes)
+	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(
+		notes,
+		ban.Notes,
+	) {
+		t.Errorf(
+			"the notes are %+v, want them unchanged, %+v",
+			notes,
+			ban.Notes,
+		)
 	}
 }
 
-func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
+func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	params := defaultParams()
@@ -230,7 +308,10 @@ func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{a: 1, b: 1, d: 1})
 
 	if !ledger.Bans(a)[0].Start.Equal(first.Expires) {
-		t.Errorf("a kept its ban of %s, want the later one", ledger.Bans(a)[0].Start)
+		t.Errorf(
+			"a kept its ban of %s, want the later one",
+			ledger.Bans(a)[0].Start,
+		)
 	}
 }
 
@@ -263,41 +344,70 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 	notes := bans.Notes{RuleID: "env-file", Target: "path"}
 
 	ban, _ := ledger.BanForAttack(netblock, midnight(), notes)
-	if !ban.Expires.Equal(midnight().Add(7*day)) || ban.Cause != bans.CauseAttack ||
-		ban.Notes.RuleID != "env-file" || ledger.Made(bans.CauseAttack) != 1 ||
+	if !ban.Expires.Equal(midnight().Add(7*day)) ||
+		ban.Cause != bans.CauseAttack ||
+		ban.Notes.RuleID != "env-file" ||
+		ledger.Made(bans.CauseAttack) != 1 ||
 		ledger.Made(bans.CauseLimit) != 0 {
-		t.Fatalf("the ban is %+v, with %d made for an attack and %d for a limit, "+
-			"want one for an attack, of seven days", ban,
-			ledger.Made(bans.CauseAttack), ledger.Made(bans.CauseLimit))
+		t.Fatalf(
+			"the ban is %+v, with %d made for an attack and %d for a limit, "+
+				"want one for an attack, of seven days",
+			ban,
+			ledger.Made(bans.CauseAttack),
+			ledger.Made(bans.CauseLimit),
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// In observe mode the ban refuses nothing, and stays as it is, while
 	// Find tells that the request would have made it permanent.
-	got, _, wouldMakePermanent := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
-	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() || !wouldMakePermanent {
-		t.Fatalf("a request found under the ban left it %+v, would have made it "+
-			"permanent %t, want it as it was, and true", got, wouldMakePermanent)
+	got, _, wouldMakePermanent := ledger.Find(
+		netblock.Addr(),
+		midnight().Add(time.Hour),
+	)
+	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() ||
+		!wouldMakePermanent {
+		t.Fatalf(
+			"a request found under the ban left it %+v, would have made it "+
+				"permanent %t, want it as it was, and true",
+			got,
+			wouldMakePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, false)
 
 	// A request it refuses makes it permanent, says so, and makes
 	// bans.json due.
-	got, _, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
-	if !madePermanent || !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
-		t.Fatalf("after a request during the ban, it is %+v, made permanent %t, "+
-			"want it made permanent", got, madePermanent)
+	got, _, madePermanent := ledger.Check(
+		netblock.Addr(),
+		midnight().Add(time.Hour),
+	)
+	if !madePermanent || !got.Permanent() ||
+		!ledger.Bans(netblock)[0].Permanent() {
+		t.Fatalf(
+			"after a request during the ban, it is %+v, made permanent %t, "+
+				"want it made permanent",
+			got,
+			madePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// The next request finds it permanent already.
-	_, banned, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
+	_, banned, madePermanent := ledger.Check(
+		netblock.Addr(),
+		midnight().Add(100*365*day),
+	)
 	if !banned || madePermanent {
-		t.Errorf("a later request is banned %t, and made the ban permanent %t, "+
-			"want banned by the permanent ban", banned, madePermanent)
+		t.Errorf(
+			"a later request is banned %t, and made the ban permanent %t, "+
+				"want banned by the permanent ban",
+			banned,
+			madePermanent,
+		)
 	}
 }
 
@@ -325,7 +435,11 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 
 	// Its notes show the earlier ban for an attack that makes it permanent,
 	// beside the one for a limit.
-	third, _ := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
+	third, _ := ledger.BanForAttack(
+		netblock,
+		second.Expires.Add(30*day),
+		bans.Notes{},
+	)
 	if !third.Permanent() ||
 		third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Attack: 1}) {
 		t.Errorf("the next ban for an attack is %+v, want a permanent one, "+
@@ -342,10 +456,18 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	wantChanged(t, ledger, true)
 
 	// While the first ban lasts, none would be made.
-	during, would := ledger.WouldBanForAttack(netblock, midnight(), bans.Notes{})
+	during, would := ledger.WouldBanForAttack(
+		netblock,
+		midnight(),
+		bans.Notes{},
+	)
 	if would || !reflect.DeepEqual(during, first) {
-		t.Errorf("during the first ban, would ban %t with %+v, want false with %+v",
-			would, during, first)
+		t.Errorf(
+			"during the first ban, would ban %t with %+v, want false with %+v",
+			would,
+			during,
+			first,
+		)
 	}
 
 	// As it ends, a clear sign of attack would ban for seven days, and a
@@ -353,19 +475,31 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	limitNotes := bans.Notes{Kind: "requests", Limit: 1, Window: "minute"}
 	attack, wouldAttack := ledger.WouldBanForAttack(netblock, first.Expires,
 		bans.Notes{RuleID: "git-dir"})
-	limit, wouldLimit := ledger.WouldBanForLimit(netblock, first.Expires, limitNotes)
+	limit, wouldLimit := ledger.WouldBanForLimit(
+		netblock,
+		first.Expires,
+		limitNotes,
+	)
 
 	if !wouldAttack || !attack.Expires.Equal(first.Expires.Add(7*day)) ||
 		attack.Reason != "matched the rule git-dir" || !wouldLimit ||
 		!limit.Expires.Equal(first.Expires.Add(3*time.Hour)) ||
 		limit.Reason != "requests per minute over the limit of 1" {
-		t.Errorf("would ban with %+v and %+v, want seven days for the attack and "+
-			"three hours for the limit", attack, limit)
+		t.Errorf(
+			"would ban with %+v and %+v, want seven days for the attack and "+
+				"three hours for the limit",
+			attack,
+			limit,
+		)
 	}
 
-	if len(ledger.Bans(netblock)) != 1 || ledger.Made(bans.CauseLimit) != 1 ||
+	if len(ledger.Bans(netblock)) != 1 ||
+		ledger.Made(bans.CauseLimit) != 1 ||
 		ledger.Made(bans.CauseAttack) != 0 {
-		t.Errorf("the ledger holds %+v, want the first ban alone", ledger.Bans(netblock))
+		t.Errorf(
+			"the ledger holds %+v, want the first ban alone",
+			ledger.Bans(netblock),
+		)
 	}
 
 	wantChanged(t, ledger, false)
@@ -422,7 +556,8 @@ func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	attack, _ := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
 	limit, _ := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
 
-	if limit.Expires.Sub(limit.Start) != time.Hour || limit.Cause != bans.CauseLimit {
+	if limit.Expires.Sub(limit.Start) != time.Hour ||
+		limit.Cause != bans.CauseLimit {
 		t.Errorf("the ban for a limit is %+v, want one of an hour", limit)
 	}
 
@@ -443,15 +578,23 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 		Time: midnight(), Method: long, Host: long, Path: long, Status: 403, UserAgent: long,
 	}
 
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Request: request})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Request: request},
+	)
 
 	cut := long[:256]
 	want := bans.Request{
 		Time: midnight(), Method: cut, Host: cut, Path: cut, Status: 403, UserAgent: cut,
 	}
 
-	if ban.Notes.Request != want || ledger.Bans(netblock)[0].Notes.Request != want {
-		t.Errorf("the notes keep %+v, want each text cut to 256 bytes", ban.Notes.Request)
+	if ban.Notes.Request != want ||
+		ledger.Bans(netblock)[0].Notes.Request != want {
+		t.Errorf(
+			"the notes keep %+v, want each text cut to 256 bytes",
+			ban.Notes.Request,
+		)
 	}
 }
 
@@ -482,13 +625,23 @@ func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
 		{ASN: "AS64496", ASName: "Example Net", Country: "DE"},
 	} {
 		got := held[i].Notes
-		if got.ASN != want.ASN || got.ASName != want.ASName || got.Country != want.Country {
-			t.Errorf("ban %d's notes give %q, %q and %q, want %q, %q and %q", i+1,
-				got.ASN, got.ASName, got.Country, want.ASN, want.ASName, want.Country)
+		if got.ASN != want.ASN || got.ASName != want.ASName ||
+			got.Country != want.Country {
+			t.Errorf(
+				"ban %d's notes give %q, %q and %q, want %q, %q and %q",
+				i+1,
+				got.ASN,
+				got.ASName,
+				got.Country,
+				want.ASN,
+				want.ASName,
+				want.Country,
+			)
 		}
 	}
 
-	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" || notes.Country != "" {
+	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" ||
+		notes.Country != "" {
 		t.Errorf("the ban on %s has %q and %q, want neither",
 			other, notes.ASN, notes.Country)
 	}