3 Commits

Include renames

Author	SHA1	Message	Date
sneak	ad593c7573	Read every setting through viper and rename the settings (closes #211) ... Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-11 06:37:26 +00:00
clawbot	fb25f5ebd2	Core Rule Set tests: check WordPress's recorded requests as the other apps' (closes #284) ... TestOrdinaryWordPressRequestsPass skipped the inspection that reads bodies for a request with no body, including one with a Content-Type. It now calls wantRecordedRequestsPass. Model: opus-5-5	2026-11-10 15:57:53 +01:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290) ... The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00