The app already could get the client's AS number and country in X-Client-ASN and X-Client-Country, but only with SWW_WAF_ADD_LOOKUP_HEADERS=true. This makes true the default.
While SWW_WAF_LOOKUP_SOURCE is off, the default is false, so turning lookups off alone still starts. Setting true with the lookup off still stops the start, as before.
The default is set after the settings literal in internal/config/waf.go, because it depends on the lookup source. That moves the setting's place in the startup settings line.
Tests that check which settings make a request wait for GeoJS now set the headers to false, since the headers alone make a new client's request wait.
Disclosures:
Judgement call: with the default source geojs, a new client's first request now waits for GeoJS, up to SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS (800 ms). Later requests from that client use the kept answer. Reversing this is the one default in internal/config/waf.go.
The issue's question about what else is available is answered on the issue. Nothing beyond AS number and country is built here.
Model: opus-5-5
closes https://git.eeqj.de/sneak/smallwebwaf/issues/379
The app already could get the client's AS number and country in `X-Client-ASN` and `X-Client-Country`, but only with `SWW_WAF_ADD_LOOKUP_HEADERS=true`. This makes `true` the default.
- While `SWW_WAF_LOOKUP_SOURCE` is `off`, the default is `false`, so turning lookups off alone still starts. Setting `true` with the lookup off still stops the start, as before.
- The default is set after the settings literal in `internal/config/waf.go`, because it depends on the lookup source. That moves the setting's place in the startup settings line.
- Tests that check which settings make a request wait for GeoJS now set the headers to `false`, since the headers alone make a new client's request wait.
Disclosures:
- Judgement call: with the default source `geojs`, a new client's first request now waits for GeoJS, up to `SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS` (800 ms). Later requests from that client use the kept answer. Reversing this is the one default in `internal/config/waf.go`.
- The issue's question about what else is available is answered on the issue. Nothing beyond AS number and country is built here.
Model: opus-5-5
clawbot
self-assigned this 2026-11-13 20:01:54 +01:00
internal/waf/lookup_test.go, TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays, and internal/waf/countries_test.go, TestCountryRefusalNamesItsHeuristicCountryAndSetting: with the headers on by default, the request in each now waits because of SWW_WAF_ADD_LOOKUP_HEADERS, not because of SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES. No test still shows that the country list makes a new client's request wait, so the country list's part of Wait in internal/waf/proxy.go can break unnoticed. Set addLookupHeaders: falseValue in both tests, as the PR already does in TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet. Acceptable: as on next, a change that stops the country list making the request wait fails both tests.
Disclosure: merging closes #379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5
Verdict: FAIL
Head: d557a25876a327398818bc85bc358a288e17f6a3
Needs rework:
1. `internal/waf/lookup_test.go`, `TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays`, and `internal/waf/countries_test.go`, `TestCountryRefusalNamesItsHeuristicCountryAndSetting`: with the headers on by default, the request in each now waits because of `SWW_WAF_ADD_LOOKUP_HEADERS`, not because of `SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES`. No test still shows that the country list makes a new client's request wait, so the country list's part of `Wait` in `internal/waf/proxy.go` can break unnoticed. Set `addLookupHeaders: falseValue` in both tests, as the PR already does in `TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet`. Acceptable: as on `next`, a change that stops the country list making the request wait fails both tests.
Disclosure: merging closes https://git.eeqj.de/sneak/smallwebwaf/issues/379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5
Disclosure: no change; the open question on #379 is sneak's to answer.
Model: opus-5-5
Head: c145424099847155db9f38b725af3feba278765b
1. Fixed: both tests set the headers to `false`.
Disclosure: no change; the open question on https://git.eeqj.de/sneak/smallwebwaf/issues/379 is sneak's to answer.
Model: opus-5-5
internal/waf/countries_test.go, TestPrivateAddressIsNeverLookedUp, case no setting needs the lookup: with the headers on by default, this case now runs with a setting that needs the lookup. Its name is now false, and no test shows that a private address is never sent to GeoJS when the request does not wait. A change that skips the private-address check for requests that do not wait now passes every test. Set addLookupHeaders: falseValue in that case's settings. Acceptable: as on next, that change fails this case.
internal/config/waf_test.go: no test covers the new default with SWW_WAF_LOOKUP_SOURCE=file. Tying the default to geojs alone passes every test, though README.md and docs/settings.md give true for every source but off. Acceptable: a check, for example in TestLookupDBPathGoesWithTheFileSourceAlone, that with the source file, a database path and the headers unset, AddLookupHeaders is true.
Disclosures:
Merging closes #379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Judgement call: the wait for GeoJS on a new client's first request, now on by default, is taken as within the issue's scope, as the PR body discloses.
Model: opus-5-5
Verdict: FAIL
Head: c145424099847155db9f38b725af3feba278765b
1. `internal/waf/countries_test.go`, `TestPrivateAddressIsNeverLookedUp`, case `no setting needs the lookup`: with the headers on by default, this case now runs with a setting that needs the lookup. Its name is now false, and no test shows that a private address is never sent to GeoJS when the request does not wait. A change that skips the private-address check for requests that do not wait now passes every test. Set `addLookupHeaders: falseValue` in that case's settings. Acceptable: as on `next`, that change fails this case.
2. `internal/config/waf_test.go`: no test covers the new default with `SWW_WAF_LOOKUP_SOURCE=file`. Tying the default to `geojs` alone passes every test, though `README.md` and `docs/settings.md` give `true` for every source but `off`. Acceptable: a check, for example in `TestLookupDBPathGoesWithTheFileSourceAlone`, that with the source `file`, a database path and the headers unset, `AddLookupHeaders` is true.
Disclosures:
- Merging closes https://git.eeqj.de/sneak/smallwebwaf/issues/379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
- Judgement call: the wait for GeoJS on a new client's first request, now on by default, is taken as within the issue's scope, as the PR body discloses.
Model: opus-5-5
SWW_WAF_ADD_LOOKUP_HEADERS now defaults to true, so the app gets
X-Client-ASN and X-Client-Country with no setting. While
SWW_WAF_LOOKUP_SOURCE is off it defaults to false, so turning lookups
off alone still starts; true set with the lookup off still stops the
start. With GeoJS, a new client's first request now waits for its
answer, up to SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS.
Model: opus-5-5
Fixed: case no setting needs the lookup sets the headers to false.
Fixed: TestLookupDBPathGoesWithTheFileSourceAlone checks that the headers are on by default with the source file.
Disclosures: no change; the question on #379 is sneak's to answer.
Model: opus-5-5
Head: 784f3d2fb7a236beb4ff0ed5d94efbed14facbd5, rebased onto `next`.
1. Fixed: case `no setting needs the lookup` sets the headers to `false`.
2. Fixed: `TestLookupDBPathGoesWithTheFileSourceAlone` checks that the headers are on by default with the source `file`.
Disclosures: no change; the question on https://git.eeqj.de/sneak/smallwebwaf/issues/379 is sneak's to answer.
Model: opus-5-5
The app now gets X-Client-ASN and X-Client-Country by default, and only while the lookup source is not off; the documents and tests match.
Disclosure: merging closes #379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5
Verdict: PASS
Head: 784f3d2fb7a236beb4ff0ed5d94efbed14facbd5
The app now gets `X-Client-ASN` and `X-Client-Country` by default, and only while the lookup source is not `off`; the documents and tests match.
Disclosure: merging closes https://git.eeqj.de/sneak/smallwebwaf/issues/379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5
clawbot
merged commit 3550956cbb into next2026-11-13 21:27:08 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
closes #379
The app already could get the client's AS number and country in
X-Client-ASNandX-Client-Country, but only withSWW_WAF_ADD_LOOKUP_HEADERS=true. This makestruethe default.SWW_WAF_LOOKUP_SOURCEisoff, the default isfalse, so turning lookups off alone still starts. Settingtruewith the lookup off still stops the start, as before.internal/config/waf.go, because it depends on the lookup source. That moves the setting's place in the startup settings line.false, since the headers alone make a new client's request wait.Disclosures:
geojs, a new client's first request now waits for GeoJS, up toSWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS(800 ms). Later requests from that client use the kept answer. Reversing this is the one default ininternal/config/waf.go.Model: opus-5-5
Verdict: FAIL
Head:
d557a25876Needs rework:
internal/waf/lookup_test.go,TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays, andinternal/waf/countries_test.go,TestCountryRefusalNamesItsHeuristicCountryAndSetting: with the headers on by default, the request in each now waits because ofSWW_WAF_ADD_LOOKUP_HEADERS, not because ofSWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES. No test still shows that the country list makes a new client's request wait, so the country list's part ofWaitininternal/waf/proxy.gocan break unnoticed. SetaddLookupHeaders: falseValuein both tests, as the PR already does inTestRequestWaitsForItsLookupWhileABiasedThresholdIsSet. Acceptable: as onnext, a change that stops the country list making the request wait fails both tests.Disclosure: merging closes #379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5
d557a25876toc145424099Head:
c145424099false.Disclosure: no change; the open question on #379 is sneak's to answer.
Model: opus-5-5
Verdict: FAIL
Head:
c145424099internal/waf/countries_test.go,TestPrivateAddressIsNeverLookedUp, caseno setting needs the lookup: with the headers on by default, this case now runs with a setting that needs the lookup. Its name is now false, and no test shows that a private address is never sent to GeoJS when the request does not wait. A change that skips the private-address check for requests that do not wait now passes every test. SetaddLookupHeaders: falseValuein that case's settings. Acceptable: as onnext, that change fails this case.internal/config/waf_test.go: no test covers the new default withSWW_WAF_LOOKUP_SOURCE=file. Tying the default togeojsalone passes every test, thoughREADME.mdanddocs/settings.mdgivetruefor every source butoff. Acceptable: a check, for example inTestLookupDBPathGoesWithTheFileSourceAlone, that with the sourcefile, a database path and the headers unset,AddLookupHeadersis true.Disclosures:
Model: opus-5-5
c145424099to784f3d2fb7Head:
784f3d2fb7, rebased ontonext.no setting needs the lookupsets the headers tofalse.TestLookupDBPathGoesWithTheFileSourceAlonechecks that the headers are on by default with the sourcefile.Disclosures: no change; the question on #379 is sneak's to answer.
Model: opus-5-5
Verdict: PASS
Head:
784f3d2fb7The app now gets
X-Client-ASNandX-Client-Countryby default, and only while the lookup source is notoff; the documents and tests match.Disclosure: merging closes #379 while its question to sneak, whether to add the AS name or other headers, is still unanswered there.
Model: opus-5-5