Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/refusallimit_test.go

@@ -37,9 +37,10 @@ func (r refused) send(s *sender, from string) logLine {
 	switch r {
 	case blockRule:
 		return s.request(from, blockedPath, http.StatusForbidden,
-			requestlog.ActionRuleBlocked)
+			requestlog.ActionBlockedByBlockRule)
 	case banRule:
-		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
+		return s.request(from, probePath, http.StatusForbidden,
+			requestlog.ActionTemporarilyBanned)
 	}
 
 	s.t.Fatalf("no request for the refusal %d", r)
@@ -71,9 +72,20 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 		name string
 		// refusals are four, one over the threshold of three.
 		refusals []refused
+		// nextAction is the action of the client's next request: the next
+		// request after a ban for a ban rule makes it permanent.
+		nextAction string
 	}{
-		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
-		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
+		{
+			"block rule",
+			[]refused{blockRule, blockRule, blockRule, blockRule},
+			requestlog.ActionTemporarilyBanned,
+		},
+		{
+			"a ban rule last",
+			[]refused{blockRule, blockRule, blockRule, banRule},
+			requestlog.ActionPermanentlyBanned,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -101,7 +113,7 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 					"and limit", line.LimitHit, line.Offence)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, tc.nextAction)
 		})
 	}
 }
@@ -169,7 +181,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
 
-	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
+	wantOffences := ratelimit.Offences{Limit: 1, BlockedByBlockRule: 3}
 	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
 		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
 	}
@@ -179,7 +191,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		`kind="refusals",window="minute"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="rule_blocked"}`, 3)
+		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 3)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
 }
 
@@ -298,7 +310,7 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
 	}
 
-	s.get(exempt, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(exempt, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
@@ -341,7 +353,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	for range 2 {
 		line := s.request(otherClient, blockedPath, http.StatusOK,
 			requestlog.ActionForward)
-		wantWouldAction(t, line, requestlog.ActionBanned)
+		wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 
 		if line.LimitHit != "" {
 			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
@@ -353,7 +365,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 
 	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
 
 	if line.LimitHit != requestlog.LimitHitErrorBurst || line.BanExpires != "" {
 		t.Errorf("log line has limit_hit %q and ban_expires %q, want error_burst "+