Per-client byte limits over a minute, an hour and a day, as the "Byte limits" settings in SPEC.md (#9) describe. Milestone 2 limits requests only.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Per-client byte limits over a minute, an hour and a day, as the "Byte limits" settings in `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describe. Milestone 2 limits requests only.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts byte limits in the third stage. Built as "Byte limits" and "Data flow for one request" give them. One PR to next.
SWWAF_BYTES_LIMIT_PER_MINUTE (default 10G), ..._PER_HOUR (20G), ..._PER_DAY (50G), each off-able; SWWAF_BYTES_COUNT (default both: response, request or both).
After each response, its bytes (and the request body's, as SWWAF_BYTES_COUNT says) are added to the client's minute, hour and day byte counters, kept like the request counters (clients.json included). A response that takes a total past a limit breaks it, and the client is banned by the rules in "Bans" for a broken limit; the response in progress is not cut off. The client's next request is refused as banned, as for a request limit.
SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_RATE_LIMIT_EXEMPT_PATHS skip byte limits as they skip request limits; SWWAF_ALLOW_NETS skips both.
The request log's counts gain the byte totals and limit_hit names a byte window; the ban notes name the byte limit broken; metrics count byte-limit hits by window, as "Metrics endpoint" gives them; observe mode logs and alerts what would have happened.
README.md documents the settings and that a single download never breaks a limit at the defaults.
Not in this unit: the percentages for listed AS numbers and countries (#21), which apply to byte limits too.
Definition of done: tests, on a clock the test controls, show each window broken by response bytes, by request bytes and by both as SWWAF_BYTES_COUNT says, the ban that follows, the response in progress completed, the exemptions, off, the log fields, notes, metrics and observe mode; each test failing with its rule broken; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts byte limits in the third stage. Built as "Byte limits" and "Data flow for one request" give them. One PR to `next`.
- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `10G`), `..._PER_HOUR` (`20G`), `..._PER_DAY` (`50G`), each `off`-able; `SWWAF_BYTES_COUNT` (default `both`: `response`, `request` or `both`).
- After each response, its bytes (and the request body's, as `SWWAF_BYTES_COUNT` says) are added to the client's minute, hour and day byte counters, kept like the request counters (`clients.json` included). A response that takes a total past a limit breaks it, and the client is banned by the rules in "Bans" for a broken limit; the response in progress is not cut off. The client's next request is refused as banned, as for a request limit.
- `SWWAF_RATE_LIMIT_EXEMPT_NETS` and `SWWAF_RATE_LIMIT_EXEMPT_PATHS` skip byte limits as they skip request limits; `SWWAF_ALLOW_NETS` skips both.
- The request log's `counts` gain the byte totals and `limit_hit` names a byte window; the ban notes name the byte limit broken; metrics count byte-limit hits by window, as "Metrics endpoint" gives them; `observe` mode logs and alerts what would have happened.
- `README.md` documents the settings and that a single download never breaks a limit at the defaults.
Not in this unit: the percentages for listed AS numbers and countries (https://git.eeqj.de/sneak/smallwebwaf/issues/21), which apply to byte limits too.
Definition of done: tests, on a clock the test controls, show each window broken by response bytes, by request bytes and by both as `SWWAF_BYTES_COUNT` says, the ban that follows, the response in progress completed, the exemptions, `off`, the log fields, notes, metrics and `observe` mode; each test failing with its rule broken; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-07 07:30:46 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Per-client byte limits over a minute, an hour and a day, as the "Byte limits" settings in
SPEC.md(#9) describe. Milestone 2 limits requests only.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs byte limits in the third stage. Built as "Byte limits" and "Data flow for one request" give them. One PR tonext.SWWAF_BYTES_LIMIT_PER_MINUTE(default10G),..._PER_HOUR(20G),..._PER_DAY(50G), eachoff-able;SWWAF_BYTES_COUNT(defaultboth:response,requestorboth).SWWAF_BYTES_COUNTsays) are added to the client's minute, hour and day byte counters, kept like the request counters (clients.jsonincluded). A response that takes a total past a limit breaks it, and the client is banned by the rules in "Bans" for a broken limit; the response in progress is not cut off. The client's next request is refused as banned, as for a request limit.SWWAF_RATE_LIMIT_EXEMPT_NETSandSWWAF_RATE_LIMIT_EXEMPT_PATHSskip byte limits as they skip request limits;SWWAF_ALLOW_NETSskips both.countsgain the byte totals andlimit_hitnames a byte window; the ban notes name the byte limit broken; metrics count byte-limit hits by window, as "Metrics endpoint" gives them;observemode logs and alerts what would have happened.README.mddocuments the settings and that a single download never breaks a limit at the defaults.Not in this unit: the percentages for listed AS numbers and countries (#21), which apply to byte limits too.
Definition of done: tests, on a clock the test controls, show each window broken by response bytes, by request bytes and by both as
SWWAF_BYTES_COUNTsays, the ban that follows, the response in progress completed, the exemptions,off, the log fields, notes, metrics andobservemode; each test failing with its rule broken;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Built in #102, for review.
Model: opus-5-5