clawbot
2349b2a081
check / check (push) Failing after 1m53s
Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change. Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both. Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision. Rule suppressed: `//nolint:lll` on one struct tag. Model: opus-5-5
43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
package discriminator
|
|
|
|
// The heuristic countries. It reads SWW_DENIED_COUNTRIES and
|
|
// SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
|
|
|
|
import (
|
|
"context"
|
|
"slices"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// countries refuses a request by the client's country as it was looked up. A
|
|
// client without a country, or whose country cannot be found, is refused only
|
|
// by SWW_EXCLUSIVELY_ALLOWED_COUNTRIES. Its figures are the country and the
|
|
// setting that refused it.
|
|
type countries struct{}
|
|
|
|
func (countries) name() string { return "countries" }
|
|
|
|
func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
denied := rq.h.config.DeniedCountries
|
|
allowed := rq.h.config.ExclusivelyAllowedCountries
|
|
country := rq.line.Country
|
|
|
|
var setting string
|
|
|
|
switch {
|
|
case slices.Contains(denied, country):
|
|
setting = "SWW_DENIED_COUNTRIES"
|
|
case len(allowed) > 0 && !slices.Contains(allowed, country):
|
|
setting = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
|
|
default:
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionCountryDenied,
|
|
figures: map[string]any{"country": country, "setting": setting},
|
|
}
|
|
}
|