clawbot 1b83d25c80 Say how to allow a refused private target address (closes #398) ...

Adding or editing an http or slack target whose address is private or
reserved was refused with no hint that the refusal is deliberate or
that it can be lifted. The refusal now adds that such addresses are
refused by default and that the server's ALLOWED_EGRESS_CIDRS setting
allows named networks, naming the README section "Allowing egress to
your own network". Link-local and cloud metadata refusals, which no
setting can lift, are unchanged.

The delivery package's blocked-address error is exported so the
handler can tell this refusal from the others.

Model: opus-5-5

2026-10-01 20:49:22 +00:00

..

auth_test.go

Bound username length at creation (closes #184)

2026-10-01 21:38:48 +02:00

auth.go

Bound every slog line against client-chosen text (closes #176)

2026-08-18 06:03:10 +02:00

delivery_replay_test.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

delivery_replay.go

Validate max_retries on both target forms (closes #221)

2026-08-24 01:32:48 +02:00

delivery_result_view_test.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

delivery_result_view.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

entrypoint_view.go

Remove inbound request signature verification (closes #279)

2026-08-24 03:25:09 +02:00

event_body_test.go

Serve an event's full stored body over HTTP (closes #157)

2026-08-18 00:41:31 +02:00

event_body.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

event_log_view_test.go

Serve an event's full stored body over HTTP (closes #157)

2026-08-18 00:41:31 +02:00

event_log_view.go

Resubmit a stored event as a new undelivered event (closes #250)

2026-08-24 00:53:37 +02:00

event_resubmit_test.go

Resubmit a stored event as a new undelivered event (closes #250)

2026-08-24 00:53:37 +02:00

event_resubmit.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

export_test.go

Validate max_retries on both target forms (closes #221)

2026-08-24 01:32:48 +02:00

footer_version_test.go

Stamp the build version into the binary (closes #253)

2026-08-24 03:15:20 +02:00

gormlogbound_test.go

Route GORM's logger through slog and bound it (closes #178)

2026-08-18 07:17:43 +02:00

handlers_test.go

Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

2026-08-20 10:34:42 +02:00

handlers.go

Stamp the build version into the binary (closes #253)

2026-08-24 03:15:20 +02:00

healthcheck.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00

index.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00

logbound_test.go

Bound username length at creation (closes #184)

2026-10-01 21:38:48 +02:00

profile_test.go

Add admin password change flow (closes #65) (#83)

2026-08-07 23:23:05 +02:00

profile.go

Read form fields from the POST body only (closes #160)

2026-08-18 02:04:09 +02:00

source_delete_test.go

Roll back a failed webhook deletion instead of committing it (closes #262)

2026-08-24 03:01:33 +02:00

source_detail_baseurl_test.go

Derive the entrypoint URL scheme from the shared TLS predicate (closes #272)

2026-08-24 04:04:04 +02:00

source_detail_test.go

Mask the http target's destination URL in the UI (closes #115)

2026-08-17 22:50:26 +02:00

source_logs_deleted_target_test.go

Name a deleted target on its historical deliveries (closes #211)

2026-08-24 02:03:23 +02:00

source_logs_test.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

source_management_test.go

Allow retention_days of 0 to mean retain forever (closes #79)

2026-08-11 14:35:34 +02:00

source_management.go

Say how to allow a refused private target address (closes #398)

2026-10-01 20:49:22 +00:00

target_create_query_test.go

Read form fields from the POST body only (closes #160)

2026-08-18 02:04:09 +02:00

target_edit_test.go

Add a target edit form with headers and timeout fields (closes #127) (#229)

2026-08-20 07:24:12 +02:00

target_edit.go

Validate max_retries on both target forms (closes #221)

2026-08-24 01:32:48 +02:00

target_private_refusal_test.go

Say how to allow a refused private target address (closes #398)

2026-10-01 20:49:22 +00:00

target_retries_test.go

Validate max_retries on both target forms (closes #221)

2026-08-24 01:32:48 +02:00

target_retries.go

Validate max_retries on both target forms (closes #221)

2026-08-24 01:32:48 +02:00

ui_copy_test.go

Say max_retries is the total attempt count, not a retry count (closes #316)

2026-09-21 18:33:09 +02:00

webhook.go

Remove inbound request signature verification (closes #279)

2026-08-24 03:25:09 +02:00