clawbot cff385af41 Observe mode: log what would be refused, refuse nothing (closes #78) ...

SWWAF_MODE (default enforce) takes enforce or observe. In observe mode a
request that SWWAF_DENY_NETS, a ban, the country lists or a rate limit
would refuse is passed to the app, and its log line names that refusal
in would_action. The size and time limits and the 401 still apply. A
broken limit makes no ban; bans read from bans.json are kept but refuse
nothing, and Ledger.Find reads them without counting a refusal in their
notes.

Judgement call: in observe mode a broken limit does not reset the
client's counters, since the reset comes with the ban.
Judgement call: a request a ban would refuse keeps ban_expires.

Model: opus-5-5

2026-10-06 13:04:43 +02:00

..

requestlog_test.go

Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

2026-10-06 05:29:03 +02:00

requestlog.go

Observe mode: log what would be refused, refuse nothing (closes #78)

2026-10-06 13:04:43 +02:00