v0.26.6

scripts/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.26.5"
+assert manifest["package"]["version"] == "0.26.6"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.26.5"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.26.6"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.26.5",
-    "CHANGELOG.md": "## 0.26.5",
-    "ROADMAP.md": "## 0.26.5",
-    "AGENTS.md": "Current source version: 0.26.5.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.26.5",
+    "README.md": "# RustProxy 0.26.6",
+    "CHANGELOG.md": "## 0.26.6",
+    "ROADMAP.md": "## 0.26.6",
+    "AGENTS.md": "Current source version: 0.26.6.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.26.6",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -75,6 +75,11 @@ for marker in [
 assert 'pub last_error:' not in update_check_source, "update-check errors must not change dashboard/API state"
 for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
     assert (root / name).is_file(), name
+npm_doc = (root / "docs/NPM_MIGRATION.md").read_text(encoding="utf-8")
+for marker in ["scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py", '-v "$PWD/scripts:/rustproxy-scripts:ro"', "python /rustproxy-scripts/migrate_npm.py"]:
+    assert marker in npm_doc, marker
+for module in ["scripts/migrate_npm.py", "scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py"]:
+    assert (root / module).is_file(), module
 for path in (root / "examples").glob("*.json"):
     data = json.loads(path.read_text())
     assert isinstance(data, dict), path
@@ -199,6 +204,7 @@ for marker in ['--scrollbar-thumb', '*::-webkit-scrollbar-thumb', '.backend-tabl
     assert marker in style_ui, marker
 preferences_js = (root / "src/admin/web/app/preferences.js").read_text()
 assert 'dashboard-widget-toggle' in preferences_js and 'visible.type = "checkbox"' not in preferences_js
+assert 'window.rustProxyVhosts?.applyPreferences(normalized);' in preferences_js, "saved backend table preferences must be reapplied from the shared account preference path"
 core_js = (root / "src/admin/web/app/core.js").read_text()
 assert 'window.rustProxyEnableControl = enhanceEnabledControl' in core_js
 assert 'id="admin-session-days"' in html and 'min="7" max="30"' in html
@@ -250,7 +256,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.26.5"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.26.6"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -261,10 +267,14 @@ for marker in ['rustProxyNotFound', 'saveSection("not_found_hosts"', 'rustProxyI
 assert 'for (let code = 200; code <= 599; code++)' not in host404_js
 assert 'preserve_host: true' in vhosts_js, "new HTTP/1.1 backend drafts must preserve the public Host"
 assert 'id="panel-acl-profiles"' in html and 'id="acl-profile-form"' in html
-for marker in ['id="acl-profile-rule-rows"', 'id="acl-profile-rule-add"', 'id="acl-profile-import-rules"']:
+for marker in ['id="acl-profile-rule-rows"', 'id="acl-profile-rule-add"', 'id="acl-profile-import-rules"', 'id="acl-profile-mode-options"', 'id="acl-profile-preview-flow"', 'id="acl-profile-country-enabled"']:
     assert marker in html, marker
 management = (root / "src/admin/web/management.js").read_text()
-assert 'collectRuleRows' in management and 'parseRules(rules.value, rules)' in management
+for marker in ['collectRuleRows', 'parseBulkRules', 'guidedAction', 'allow_exceptions', 'block_exceptions', 'renderPreview', 'normalizeNetwork']:
+    assert marker in management, marker
+for marker in ['function refreshTranslations()', 'refreshTranslations }']:
+    assert marker in management, marker
+assert 'window.rustProxyAclProfiles?.refreshTranslations?.();' in js
 assert 'normalizeAclRuleText' in js and 'ruleSyntaxLine' in js
 cache_source = read_cache_source()
 assert not (root / "src/cache.rs").exists()
@@ -506,6 +516,9 @@ for marker in ['data-certificate-tab="installed"', 'data-certificate-tab="renewa
 assert 'id="certificate-dialog"' not in html and 'id="certificate-close"' not in html
 for marker in ['function selectTab(name, focus = false, persist = true)', 'log_directories', 'certbotLogs', 'value?.kind?.startsWith("renewal")', 'selectTab("installed")']:
     assert marker in acme_js, marker
+for marker in ['resetIssueFormJob = value.job?.id || null', 'value.status === "ready"', 'resetIssueForm(); resetIssueFormJob = null', 'value.status === "failed"']:
+    assert marker in acme_js, marker
+assert 'render(value.job); resetIssueForm();' not in acme_js, "ACME form must not reset before issuance actually succeeds"
 login_js = (root / "src/admin/web/login.js").read_text()
 assert 'const panelPaths = new Set' in login_js and 'panelPaths.has(location.pathname)' in login_js
 assert '"/404-hosts"' in login_js
@@ -649,6 +662,8 @@ assert 'Kind::Builtin' in pages_rust and 'builtin_application_page' in pages_rus
 assert 'pub covered_hosts: Vec<String>' in tls_source and 'fn certificate_dns_names' in tls_source and 'pub fn certificate_covered_hosts' in tls_source and 'legacy_certificate_coverage_can_be_read_from_existing_pem' in tls_source and 'assert_eq!(a.covered_hosts' in tls_source
 acl_source = rust_source(root, 'src/acl.rs')
 assert '/Ubuntu%2014.04%20LTS/' in acl_source and 'repeated_slashes_are_normalized_for_routing' in acl_source and 'merge_slashes' in acl_source
+for marker in ['pub fn allows_with_country(', 'ip_action == Some(Action::Deny)', 'CountryMode::Allow', 'ip_action == Some(Action::Allow) || country_listed', 'country_allow_and_ip_allow_are_alternatives_inside_one_scope', 'country_block_and_ip_deny_are_alternatives_inside_one_scope', 'plain_host_addresses_are_valid_acl_rules', 'fn parse_network(']:
+    assert marker in acl_source, marker
 policies_source = (root / 'tests/policies.rs').read_text()
 assert 'percent_encoded_spaces_are_valid_request_paths' in policies_source and 'repeated_slashes_route_normally_but_reach_upstream_unchanged' in policies_source and 'local_location_response_uses_response_rules_without_opening_backend' in policies_source and 'local_location_response_still_respects_route_acl' in policies_source
 http3_source = rust_source(root, "src/http3.rs")
@@ -880,6 +895,9 @@ for marker in ['pub fn cloudflare_country', 'headers.get_all("cf-ipcountry")', '
 forward_entry_source = rust_source(root, "src/proxy/forward_entry.rs")
 for marker in ['cloudflare_country = crate::forwarding::cloudflare_country', '.or_else(|| state.geoip.country(context.client_ip))']:
     assert marker in forward_entry_source, marker
+assert forward_entry_source.count('crate::acl::allows_with_country(') >= 4, "profile/vhost/location access scopes must use composed IP+country evaluation"
+route_cache_source = rust_source(root, "src/proxy/forward/route_cache.rs")
+assert 'Do not re-evaluate IP ACLs in isolation here' in route_cache_source
 assert 'if (envelope) render();' in (root / "src/admin/web/web-server.js").read_text()
 assert 'pub capture_user_agent: bool' in logging_source and 'pub capture_country: bool' in logging_source
 assert 'spawn_blocking(crate::diagnostics::trim_allocator)' in rust_source(root, 'src/runtime.rs')
@@ -1213,7 +1231,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.26.5"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.26.6"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1258,5 +1276,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.26.5 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
+print("PASS: 0.26.6 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")