clawbot d084f4f912 Pin the body cap's order in every page route group (closes #93) ...

Follow-ups from an August review of the body cap, each checked against the current tree. One route test now requires an oversized POST, with no session and no CSRF token, to be refused with 413 before CSRF runs, in every page route group with a POST route and in /settings/, so moving a group's body cap after CSRF fails it. The three test router helpers build the server through New with a lifecycle that is never started, so no field is set by hand. The middleware test comment names runMaxBodySize, and the MaxBodySize doc comment says methods other than POST, PUT and PATCH pass uncapped on purpose. The README item was already settled.

Model: opus-5-5

2026-10-02 17:53:21 +02:00

..

accesslog_test.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

clientip_test.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

csrf_test.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

csrf.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

export_test.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

logbound_test.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

loginguard_test.go

Stop a slow host turning a login-guard test into a segfault (closes #186)

2026-08-18 05:01:13 +02:00

loginguard.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

metrics_method_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

metrics_test.go

Serve /metrics from a registry of its own (closes #227)

2026-10-02 09:06:20 +02:00

metrics.go

Let a handler flush or set a write deadline through the access log and metrics (closes #191)

2026-10-02 13:08:54 +02:00

middleware_test.go

Pin the body cap's order in every page route group (closes #93)

2026-10-02 17:53:21 +02:00

middleware.go

Pin the body cap's order in every page route group (closes #93)

2026-10-02 17:53:21 +02:00

ratelimit_test.go

Pin the rate-limit key for an empty RemoteAddr (closes #168)

2026-10-02 17:09:23 +02:00

ratelimit.go

Pin the rate-limit key for an empty RemoteAddr (closes #168)

2026-10-02 17:09:23 +02:00

recoverer_test.go

Let a handler flush or set a write deadline through the access log and metrics (closes #191)

2026-10-02 13:08:54 +02:00

recoverer.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

testing.go

Serve /metrics from a registry of its own (closes #227)

2026-10-02 09:06:20 +02:00