Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/answertime_test.go

@@ -84,7 +84,7 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 	if line.DurationWAF != nil {
 		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
@@ -157,7 +157,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
-				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 				return
 			}
@@ -219,9 +219,10 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 
 	line := s.out.requestLine(t)
-	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
+	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
+		line.DurationWAF != nil {
 		t.Errorf("would_action %q and duration_waf %v, want %q and none",
-			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
+			line.WouldAction, line.DurationWAF, requestlog.ActionRequestHeaderTooLarge)
 	}
 }
 
@@ -240,7 +241,7 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
-	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 }
 
 func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
@@ -249,8 +250,8 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 	for _, tc := range []struct {
 		name, path, action string
 	}{
-		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
-		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
+		{"a trap path", "/wp-login.php", requestlog.ActionTemporarilyBanned},
+		{"a block rule", "/blocked", requestlog.ActionBlockedByBlockRule},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -280,7 +281,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 	if line.LimitPercent != nil {
 		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
@@ -304,7 +305,8 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
-	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited)
 }
 
 func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
@@ -412,33 +414,37 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	}{
 		{
 			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
-			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
 		},
 		{
 			name:    "a ban",
-			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
+			prepare: banClient, status: forbidden, action: requestlog.ActionTemporarilyBanned,
 		},
 		{
 			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
-			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
 		},
 		{
 			name:    "the rate limits, with a biased threshold",
 			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
-			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
 		},
 		{
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
-			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
+			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
 		},
 		{
 			name:    "the CrowdSec decision list",
 			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
-			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
+			prepare: decideOnClient, status: forbidden,
+			action: requestlog.ActionTemporarilyBanned,
 		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
-			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
+			prepare: leaveAsItIs, status: tooLarge,
+			action: requestlog.ActionRequestHeaderTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {