@jrpool/kilotest 49.0.0 → 50.0.0

package/api/getReport.ts

@@ -25,7 +25,9 @@ type ResponseContent = z.infer<typeof getReportResponseSchema>['response content
 export const response = async (args: string[]) => {
   const [timeStamp = '', jobID = ''] = args;
   const thisHost = getThisHost();
-  // Get the report size.
+  // Get the report size. A malformed timestamp or job ID resolves to a nonexistent file
+  // path, which getReportStats already reports as unavailable, so no separate syntactic
+  // check is needed here.
   const reportStats = await getReportStats(timeStamp, jobID);
   // Create the response content.
   const responseContent: ResponseContent = reportStats

package/api/requestFeature.test.ts

@@ -37,6 +37,24 @@ test('requestFeature rejects an empty feature request', async () => {
   );
 });
 
+test('requestFeature rejects a feature request shorter than 20 characters', async () => {
+  const body = await response(['Too short']);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('feature description'));
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
+test('requestFeature rejects a feature request longer than 1000 characters', async () => {
+  const body = await response(['x'.repeat(1001)]);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('feature description'));
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
 test('requestFeature accepts a non-empty feature request and notifies the manager', async () => {
   const body = await response(['Add a dark mode toggle']);
   const details = body['response content']['details about your request'] as any;
@@ -50,7 +68,7 @@ test('requestFeature accepts a non-empty feature request and notifies the manage
 });
 
 test('requestFeature includes tool name and metadata', async () => {
-  const body = await response(['Some feature']);
+  const body = await response(['A sufficiently long feature description']);
   assert.equal(body['tool name'], 'requestFeature');
   assert.ok(body['response metadata'].identifier);
 });

package/api/requestFeature.ts

@@ -8,6 +8,7 @@
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
 import {sendAlert} from '../alerts.ts';
+import {checkLength} from '../util.ts';
 import {requestFeatureResponseSchema} from './schemas.ts';
 
 // TYPES
@@ -21,20 +22,27 @@ type ResponseContent = z.infer<typeof requestFeatureResponseSchema>['response co
 export const response = async (args: string[]) => {
   const [feature = ''] = args;
   const thisHost = getThisHost();
+  const lengthCheck = checkLength(feature, 20, 1000, 'feature description');
   // Initialize the response content.
-  const responseContent: ResponseContent = {
-    'details about your request': {
-      error: 'request invalid: request is empty'
-    }
-  };
-  // If the requested feature or improvement exists:
-  if (feature) {
+  let responseContent: ResponseContent;
+  // If the feature description is invalid:
+  if (lengthCheck.status === 'error') {
+    responseContent = {
+      'details about your request': {
+        error: `request invalid: ${lengthCheck.message}`
+      }
+    };
+  }
+  // Otherwise, i.e. if it is valid:
+  else {
     // Notify the manager.
     await sendAlert('Kilotest: MCP feature request received', feature);
     // Add the disposition to the response content.
-    responseContent['details about your request'] = {
-      'date and time received': new Date().toISOString(),
-      disposition: 'received and logged; manager notified'
+    responseContent = {
+      'details about your request': {
+        'date and time received': new Date().toISOString(),
+        disposition: 'received and logged; manager notified'
+      }
     };
   }
   // Create a response body.

package/api/requestRetest.test.ts

@@ -15,11 +15,29 @@ import {fixtureDBDir} from '../test/dbFixture.ts';
 
 const savedDBDir = process.env.DB_DIR;
 const testRequestsPath = path.join(fixtureDBDir, 'jobs', 'testRequests.json');
+// A report added only to this test's disposable copy of the fixture database (never to
+// the tracked test/fixtures/db corpus), so its 3-character job ID satisfies isJobID
+// without perturbing report-count tests elsewhere that copy the whole corpus. Its job ID
+// intentionally differs from the tracked corpus's 2-character 260101T0001-ct.json, which
+// isJobID would reject.
+const retestFixturePath = path.join(fixtureDBDir, 'reports', '260101T0003-ret.json');
+const retestFixtureReport = {
+  id: '260101T0003-ret',
+  what: 'Retest Fixture Page',
+  target: {what: 'Retest Fixture Page', url: 'https://example.com/retestfixture'},
+  sources: {worker: 'test-worker'},
+  acts: [],
+  jobData: {startTime: '26-01-01T00:00', endTime: '26-01-01T00:10', elapsedSeconds: 600, preventions: {}, issuelessRules: []},
+  catalog: {},
+  images: {},
+  checkpoints: []
+};
 let logged: any[] = [];
 const originalLog = console.log;
 
-before(() => {
+before(async () => {
   process.env.DB_DIR = fixtureDBDir;
+  await fs.writeFile(retestFixturePath, JSON.stringify(retestFixtureReport));
 });
 
 // Reset the test-requests file and capture console.log, so the alert that
@@ -32,8 +50,9 @@ beforeEach(async () => {
 
 import {response} from './requestRetest.ts';
 
-after(() => {
+after(async () => {
   console.log = originalLog;
+  await fs.unlink(retestFixturePath);
   if (savedDBDir !== undefined) {
     process.env.DB_DIR = savedDBDir;
   }
@@ -45,12 +64,19 @@ after(() => {
 // TESTS
 
 test('requestRetest rejects a nonexistent report', async () => {
-  const body = await response(['999999T9999', 'xyz', 'A reason that is long enough.']);
+  const body = await response(['251231T0000', 'zzz', 'A reason that is long enough.']);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('does not exist'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
 });
 
+test('requestRetest rejects a malformed timestamp or job identifier', async () => {
+  const body = await response(['999999T9999', 'xyz', 'A reason that is long enough.']);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('malformed'));
+  assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
+});
+
 test('requestRetest rejects a superseded report', async () => {
   // 260101T0000-mix is an earlier report of "Mixed Outcomes Page" than 260202T0000-new,
   // so it is superseded and processTestRequest returns 'superseded', reported via the
@@ -66,7 +92,7 @@ test('requestRetest rejects a superseded report', async () => {
 });
 
 test('requestRetest rejects a reason shorter than 20 characters', async () => {
-  const body = await response(['260101T0001', 'ct', 'short']);
+  const body = await response(['260101T0003', 'ret', 'short']);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('reason'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
@@ -74,20 +100,20 @@ test('requestRetest rejects a reason shorter than 20 characters', async () => {
 
 test('requestRetest rejects a reason longer than 100 characters', async () => {
   const longReason = 'x'.repeat(101);
-  const body = await response(['260101T0001', 'ct', longReason]);
+  const body = await response(['260101T0003', 'ret', longReason]);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('reason'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
 });
 
 test('requestRetest rejects a report matching a claimed job by description', async () => {
-  // 260101T0001-ct is the "All CantTell Page" report.
+  // 260101T0003-ret is the "Retest Fixture Page" report.
   const claimedPath = path.join(fixtureDBDir, 'jobs', 'claimed', 'clm.json');
   await fs.writeFile(claimedPath, JSON.stringify({
-    target: {what: 'All CantTell Page', url: 'https://example.com/unrelated'}
+    target: {what: 'Retest Fixture Page', url: 'https://example.com/unrelated'}
   }));
   try {
-    const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+    const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
     const details = body['response content']['details about your request'] as any;
     assert.equal(details.error, undefined);
     const disposition = body['response content']['disposition of your request'] as any;
@@ -102,13 +128,13 @@ test('requestRetest rejects a report matching a claimed job by description', asy
 });
 
 test('requestRetest rejects a report matching a queued job by URL', async () => {
-  // 260101T0001-ct's URL is https://example.com/canttell.
+  // 260101T0003-ret's URL is https://example.com/retestfixture.
   const queuedPath = path.join(fixtureDBDir, 'jobs', 'queue', 'que.json');
   await fs.writeFile(queuedPath, JSON.stringify({
-    target: {what: 'Some Other Page', url: 'https://example.com/canttell'}
+    target: {what: 'Some Other Page', url: 'https://example.com/retestfixture'}
   }));
   try {
-    const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+    const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
     const details = body['response content']['details about your request'] as any;
     assert.equal(details.error, undefined);
     const disposition = body['response content']['disposition of your request'] as any;
@@ -123,8 +149,8 @@ test('requestRetest rejects a report matching a queued job by URL', async () =>
 });
 
 test('requestRetest rejects a duplicate request', async () => {
-  await response(['260101T0001', 'ct', 'A reason that is long enough.']);
-  const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+  await response(['260101T0003', 'ret', 'A reason that is long enough.']);
+  const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
   const details = body['response content']['details about your request'] as any;
   assert.equal(details.error, undefined);
   const disposition = body['response content']['disposition of your request'] as any;

package/api/requestRetest.ts

@@ -7,7 +7,7 @@
 
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
-import {processTestRequest} from '../util.ts';
+import {checkLength, isJobID, isTimeStamp, processTestRequest} from '../util.ts';
 import {requestRetestResponseSchema} from './schemas.ts';
 
 // TYPES
@@ -21,14 +21,20 @@ type ResponseContent = z.infer<typeof requestRetestResponseSchema>['response con
 export const response = async (args: string[]) => {
   const [timeStamp = '', jobID = '', reason = ''] = args;
   const thisHost = getThisHost();
-  const reasonLength = reason.length;
+  const reasonCheck = checkLength(reason, 20, 100, 'reason');
   // Initialize the response-content properties.
   let requestDetails: ResponseContent['details about your request'];
   let requestDisposition: ResponseContent['disposition of your request'] = null;
-  // If the encoded reason is too short or too long:
-  if (reasonLength < 20 || reasonLength > 100) {
+  // If the timestamp or job ID is not syntactically valid:
+  if (!isTimeStamp(timeStamp) || !isJobID(jobID)) {
     requestDetails = {
-      error: 'request invalid: your reason is not between 20 and 100 characters long'
+      error: 'request invalid: the report timestamp or job identifier is malformed'
+    };
+  }
+  // Otherwise, if the encoded reason is too short or too long:
+  else if (reasonCheck.status === 'error') {
+    requestDetails = {
+      error: `request invalid: your ${reasonCheck.message}`
     }
   }
   // Otherwise, i.e. if the request is facially valid:

package/api/requestTest.ts

@@ -7,7 +7,7 @@
 
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
-import {isURL, processTestRequest} from '../util.ts';
+import {checkLength, isURL, processTestRequest} from '../util.ts';
 import {requestTestResponseSchema} from './schemas.ts';
 
 // TYPES
@@ -24,14 +24,14 @@ export const response = async (args: string[]) => {
   // Initialize the response-content properties.
   let requestDetails: ResponseContent['details about your request'];
   let requestDisposition: ResponseContent['disposition of your request'] = null;
-  const descriptionLength = description.length;
-  // If the description is empty or too long:
-  if (!descriptionLength || descriptionLength > 100) {
+  const descriptionCheck = checkLength(description, 1, 100, 'description of the page');
+  // If the description is invalid:
+  if (descriptionCheck.status === 'error') {
     requestDetails = {
-      error: 'request invalid: your description of the page is not between 1 and 100 characters long'
+      error: `request invalid: your ${descriptionCheck.message}`
     };
   }
-  // Otherwise, i.e. if the URL is too short or too long::
+  // Otherwise, i.e. if the URL is too short or too long:
   else if (url.length < 12 || url.length > 300) {
     requestDetails = {
       error: 'request invalid: you specified a URL for the page that is not between 12 and 300 characters long'

package/api/schemas.ts

@@ -43,7 +43,7 @@ export const getReportSchema = {
 
 // requestTest: POST /api/requestTest
 export const requestTestSchema = {
-  description: z.string().describe('10- to 100-character description of the page conforming to the naming convention used in the listReports output'),
+  description: z.string().describe('1- to 100-character description of the page conforming to the naming convention used in the listReports output'),
   URL: z.string().describe('12- to 300-character URL of the page, including the https:// scheme and any query'),
   reason: z.string().describe('20- to 100-character reason why the page should be tested')
 };
@@ -57,7 +57,7 @@ export const requestRetestSchema = {
 
 // requestFeature: POST /api/requestFeature
 export const requestFeatureSchema = {
-  feature: z.string().describe('description of requested feature improvement or new feature')
+  feature: z.string().describe('20- to 1000-character description of requested feature improvement or new feature')
 };
 
 // listReports takes no input; omitted (mcp.ts already uses inputSchema: {}).

package/docs/BACKLOG.md

@@ -4,9 +4,21 @@ Engineering tasks and risks that are not yet scheduled.
 
 Items marked completed or not adopted are preserved for about 2 weeks in case of production bugs.
 
-## Make validation locations consistent
+## Make validation locations consistent (completed)
 
-Inventory where request validations occur, e.g. in `index.ts` versus in the modules to which it routes requests. Find any arbitrary inconsistencies in the locations. If any are found, decide where it is most parsimonious and maintainable for the validation to take place and standardize on that.
+Inventory where request validations occur, e.g. in `index.ts` versus in the modules to which it routes requests. Find any arbitrary inconsistencies in the locations. If any are found, decide where it is most parsimonious and maintainable for the validation to take place and, when the user approves, standardize on that.
+
+### Inventory findings
+
+Validation was spread across `index.ts`, the `web/*` modules it dispatches to, and the `api/*.ts` modules shared by the HTTP API and the MCP tools (`mcp.ts` itself performs no validation; it delegates entirely to `api/*.ts`, whose zod `inputSchema`s in `api/schemas.ts` are shape-only, documenting length/format bounds in `.describe()` prose rather than enforcing them). Several arbitrary inconsistencies were found and fixed:
+
+- **A URL was validated three different, inconsistent ways** for what is logically the same field: a loose inline `url.startsWith('https://')` check in `index.ts` (for both `requestTest.html` and `requestAction.html`), and the correct, stricter shared `isURL()` helper (already used by `api/requestTest.ts` and `web/enqueue/index.ts`) nowhere in `index.ts` itself. Fixed by having `index.ts` call `isURL()` at both sites.
+- **`requestAction.html`'s URL and authorization code were validated twice**: once in `index.ts` before dispatch, and again inside `web/enqueue/index.ts`'s own `answer()`, using different strictness for the URL check. Once both checks used the same `isURL()`/`isValidAuthCode()` helpers, the inner check in `enqueue` became strictly unreachable-as-false (its only caller, `index.ts`, already guarantees both conditions), so it was removed; `enqueue` now trusts its caller, consistent with `web/requestTest/` and `web/requestRetest/`.
+- **The authorization-code check (`authCode === process.env.AUTH_CODE`) was copy-pasted verbatim across 8 separate modules** (`hideReportForm`, `unhideReportForm`, `ai0BalanceForm`, `showHiddenReportsForm`, `metrics`, `renewWCAG`, `reannotate`, and, via the already-shared `web/reportDeletion.ts`, `pruneReportsForm`/`expungeReportsForm`/`rewindReportsForm`). Consolidated into one shared `isValidAuthCode()` helper in `util.ts`, called everywhere the check occurs.
+- **`api/requestRetest.ts` never validated `timeStamp`/`jobID` syntactically**, unlike the equivalent web path (`index.ts`, `requestRetest.html`) and the equivalent worker path, both of which call `isTimeStamp`/`isJobID` before proceeding; it relied solely on the report lookup failing gracefully. Added the same `isTimeStamp`/`isJobID` pre-check, matching the web path, with its own dedicated (non-corpus) test fixture since the shared 2-character fixture job IDs used elsewhere in the test suite do not satisfy the real, production 3-character job ID format `isJobID` enforces.
+- **`api/requestFeature.ts` had no length bound at all** (only a truthiness check), unlike every other free-text field in the codebase (comments: 20-1000 characters; `reason`/`why`: 20-100). Added a matching 20-1000 character bound via a new, generic `checkLength()` helper (generalized from the existing `checkCommentLength()`, which was already comment-specific and left unchanged), and corrected `api/schemas.ts`'s description accordingly.
+- **A documentation/code mismatch**: `api/schemas.ts` described `requestTest`'s `description` field as "10- to 100-character" while the code actually enforced (and still enforces) 1-100. Corrected the description to match the code's real, existing behavior.
+- **`api/getReport.ts`, `api/listIssues.ts`, `api/listViolators.ts`, `api/listDiagnoses.ts` perform no syntactic validation of `timeStamp`/`jobID`/`issueID`/`catalogIndex`**, unlike routes elsewhere that call `isTimeStamp`/`isJobID` before proceeding. Investigated as a candidate gap, but not changed: these four read-only operations resolve straight to a file-path lookup (`getReport`/`getReportStats`) that already fails gracefully for any malformed or nonexistent input, so a syntactic pre-check would produce an identical outcome through a different code path, with no functional benefit. This is a legitimate, already-consistent "fail-on-use" validation strategy for pure lookups, distinct from (and not required to match) the "fail-fast" strategy used for mutating requests elsewhere.
 
 ## Protect hidden report list (completed)
 

package/docs/SERVICE.md

@@ -64,7 +64,18 @@ pm2 start pm2.config.cjs
 pm2 save
 ```
 
-The management of the PM2 logs is [documented by PM2](https://pm2.keymetrics.io/docs/usage/log-management/).
+### PM2 log rotation
+
+PM2's own log management is [documented by PM2](https://pm2.keymetrics.io/docs/usage/log-management/), but PM2 does not rotate its logs by default. Since the general request log (see “Request logging” above) writes one line per request rather than only for rejections, log volume is meaningfully higher than before that addition, so explicit rotation is configured via the [`pm2-logrotate`](https://github.com/keymetrics/pm2-logrotate) module:
+
+```text
+pm2 install pm2-logrotate
+pm2 set pm2-logrotate:max_size 20M
+pm2 set pm2-logrotate:retain 14
+pm2 set pm2-logrotate:compress true
+```
+
+This rotates `~/.pm2/logs/kilotest-out-0.log` (and the error log) once it reaches 20MB, keeps 14 rotated files, and compresses rotated files with gzip.
 
 ### Process tuning
 
@@ -233,6 +244,16 @@ The Caddy configuration is maintained and tracked in `/etc/caddy/Caddyfile`. Lea
 # Docs: https://caddyserver.com/docs/caddyfile.
 
 kilotest.com {
+  # Log every request in structured JSON, rotated so it cannot grow unbounded. See
+  # "Request logging" below for why this exists alongside Kilotest's own request log.
+  log {
+    output file /var/log/caddy/kilotest-access.log {
+      roll_size 50mb
+      roll_keep 10
+      roll_keep_for 720h
+    }
+    format json
+  }
   # Enable Zstandard and Gzip compression of responses.
   encode zstd gzip
   # Specify the only paths of forwardable requests. UptimeRobet uses HEAD.
@@ -278,6 +299,15 @@ This configuration can be futher tightened if experience warrants.
 
 The `flush_interval` setting prevents granular reporting by Testaro workers from being buffered, so the updates reach the browser without delay.
 
+### Request logging
+
+Two independent request logs exist, added as part of the abuse evaluation in [GitHub issue #3](https://github.com/jrpool/kilotest/issues/3), so that suspicious traffic can be recognized after the fact rather than only the narrower set of cases that already trigger a rejection:
+
+- **Application-level, general request log** (`index.ts`): every request Kilotest itself receives, whether it succeeds or is rejected, is logged as one single-line JSON record via `console.log` (captured by PM2 like all of Kilotest's other console output), with the fields `type: 'request'`, `time`, `ip`, `method`, `path` (no query string, so a parameter such as `authCode` is never written to a log file), `status`, and `userAgent`. This is separate from, and does not replace, `getAbuseError`'s existing multi-line dump, which remains a rarer, human-read-in-the-moment record logged only for rejected requests. Smoke-test-tagged requests (`x-kilotest-smoke`) are excluded from this log, exactly as they are already excluded from usage metrics; the maintainer's own manual testing is deliberately *not* excluded (unlike usage metrics), since abuse visibility should see all real traffic.
+- **Caddy access log**: enabled at the reverse-proxy layer for connection- and pre-dispatch-level visibility the application itself never sees (for example, requests to paths outside Kilotest's own allowlist, which Caddy rejects before ever forwarding them). See the `log` directive in the Caddyfile above.
+
+Both logs are rotated; see “PM2 log rotation” above for the application log and the `log` directive’s own `roll_size`/`roll_keep` options for the Caddy log.
+
 ## Version management
 
 When a new version of the `kilotest` package has been published, the service can be updated as follows:
@@ -310,7 +340,7 @@ The smoke-test check is defined in `.github/workflows/smoke-test.yml` and runs `
 When a pull request adds a new route to `index.js`, the Caddyfile at `/etc/caddy/Caddyfile` on the server must be updated to forward the new path before the pull request can merge. The workflow to follow is:
 
 1. Add the new route to the `routes` constant and the dispatch chain in `index.js`.
-1. Update the Caddyfile (`/etc/caddy/Caddyfile`) on the server to forward the new path.
+1. Update the Caddyfile (`/etc/caddy/Caddyfile`) on the server to forward the new path, then reload Caddy so the change takes effect: `sudo systemctl reload caddy` (a reload, not a restart, so in-flight connections are not dropped).
 1. Open or update the pull request.
 1. The smoke test workflow runs and verifies that all paths, including the new one, are forwarded by Caddy.
 1. If the Caddyfile was not updated, the smoke test reports a bare 404 for the new path, the required status check fails, and the pull request cannot merge.

package/index.test.ts

@@ -826,6 +826,40 @@ test('GET /qai/comments redirects to /tutorialAI.html', async () => {
   assert.equal(res.headers['location'], '/tutorialAI.html');
 });
 
+test('GET /diagnoses.html/<segments> redirects to the equivalent /listDiagnoses.html/<segments>, preserving the query string', async () => {
+  const res = await request(
+    'GET', '/diagnoses.html/duplicateID/260426T1741/77w/718?pathID=/html/body', {}, {followRedirects: false}
+  );
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listDiagnoses.html/duplicateID/260426T1741/77w/718?pathID=/html/body');
+});
+
+test('GET /reportIssues.html/<timeStamp>/<jobID> redirects to the equivalent /listIssues.html/<timeStamp>/<jobID>', async () => {
+  const res = await request('GET', '/reportIssues.html/260101T0000/mix', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listIssues.html/260101T0000/mix');
+});
+
+test('GET /reportIssue.html/<segments> redirects to the equivalent /listViolators.html/<segments>', async () => {
+  const res = await request(
+    'GET', '/reportIssue.html/duplicateID/260101T0000/mix', {}, {followRedirects: false}
+  );
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listViolators.html/duplicateID/260101T0000/mix');
+});
+
+test('GET /rules.html/<segment> redirects to the equivalent /listRules.html/<segment>', async () => {
+  const res = await request('GET', '/rules.html/allCaps', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listRules.html/allCaps');
+});
+
+test('GET /targets.html redirects to /listReports.html', async () => {
+  const res = await request('GET', '/targets.html', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listReports.html');
+});
+
 test('POST /requestTest.html with non-https URL returns an error', async () => {
   const res = await formRequest('POST', '/requestTest.html', {
     description: 'Test Page',
@@ -1545,7 +1579,7 @@ test('POST /requestRetest.html with valid format but duplicate retest returns an
   assert.ok(res.body.includes('Test request duplicates an already submitted request'));
 });
 
-test('POST /requestAction.html with valid auth code and approval of a duplicate returns an error', {timeout: 500}, async () => {
+test('POST /requestAction.html with valid auth code approves the same target twice without error', {timeout: 500}, async () => {
   await fs.writeFile(testRequestsPath, '{}\n');
   // Create a request.
   await formRequest('POST', '/requestTest.html', {
@@ -1559,20 +1593,19 @@ test('POST /requestAction.html with valid auth code and approval of a duplicate
     authCode: 'test-auth-code',
     what: 'yes'
   });
-  // Approve it again (the requests may have been cleared, so this may succeed or fail).
-  // This test covers the requestAction answer error branch.
+  // Approve it again. enqueue.answer has no duplicate-detection logic of its own (that
+  // lives in processTestRequest, upstream of approval), so a second approval of the same
+  // target queues a second job rather than erroring.
   const res = await formRequest('POST', '/requestAction.html', {
     target: `https://example.com/action-dup-${uniqueStamp}\tAction Dup Page ${uniqueStamp}`,
     authCode: 'test-auth-code',
     what: 'yes'
   });
-  // Either it succeeds (200) or returns an error (400).
-  assert.ok(res.statusCode === 200 || res.statusCode === 400);
+  assert.equal(res.statusCode, 200);
 });
 
 test('POST /requestAction.html with valid auth code and approval of an invalid URL returns an error', async () => {
-  // A URL that starts with https:// but is not a valid URL causes
-  // enqueue.answer to return status error.
+  // A URL that starts with https:// but is not a valid URL fails index.ts's own isURL check.
   const res = await formRequest('POST', '/requestAction.html', {
     target: 'https://\tTest Page',
     authCode: 'test-auth-code',
@@ -1646,6 +1679,75 @@ test('getAbuseError uses unknown IP when no forwarding header or remote address'
   assert.equal(result.reason, 'test reason');
 });
 
+// TESTS FOR general per-request logging
+
+test('a request logs a single-line JSON record with the expected fields', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listReports.html');
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const requestLines = logged.filter(line => {
+    try {
+      return JSON.parse(line).type === 'request';
+    }
+    catch {
+      return false;
+    }
+  });
+  assert.equal(requestLines.length, 1);
+  const record = JSON.parse(requestLines[0]!);
+  assert.equal(record.method, 'GET');
+  assert.equal(record.path, '/listReports.html');
+  assert.equal(record.status, 200);
+  assert.ok(record.ip);
+  assert.ok(record.userAgent);
+  assert.ok(record.time);
+});
+
+test('a request logs its path without its query string', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listIssues.html/260101T0000/mix?authCode=secret');
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const record = logged
+  .map(line => { try {return JSON.parse(line);} catch {return null;} })
+  .find(parsed => parsed?.type === 'request');
+  assert.ok(record);
+  assert.equal(record.path, '/listIssues.html/260101T0000/mix');
+  assert.ok(!JSON.stringify(record).includes('secret'));
+});
+
+test('a smoke-test-flagged request is not logged as a general request', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listReports.html', null, {'x-kilotest-smoke': '1'});
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const requestLines = logged.filter(line => {
+    try {
+      return JSON.parse(line).type === 'request';
+    }
+    catch {
+      return false;
+    }
+  });
+  assert.equal(requestLines.length, 0);
+});
+
 // UNIT TESTS FOR startServer
 
 test('startServer starts an HTTP server when protocol is http', {timeout: 500}, async () => {

package/index.ts

@@ -23,7 +23,9 @@ import {
   isReportAvailable,
   isTimeStamp,
   isJobID,
+  isURL,
   isUsableReport,
+  isValidAuthCode,
   jobsPath,
   metricsExclusionCookieName,
   recordMetric,
@@ -260,6 +262,17 @@ const selfSubmittingManagerPages = new Set([
 // unhideReportForm is served only by showHiddenReportsForm, once a valid authorization code
 // has been submitted), so that the names of hidden reports are never disclosed without one.
 const noDirectGetPages = new Set(['unhideReportForm']);
+// Old page names, from before a 2026-08-31 rename (see GitHub issue #3), that search
+// engines and other crawlers are still requesting. Redirecting them lets crawlers update
+// their own indexes, rather than leaving them to repeat the same dead request indefinitely.
+// TEMPORARY: retire this redirect after 2027-04-01 once crawlers have re-indexed.
+const renamedPagePrefixes: Record<string, string> = {
+  diagnoses: 'listDiagnoses',
+  reportIssue: 'listViolators',
+  reportIssues: 'listIssues',
+  rules: 'listRules',
+  targets: 'listReports'
+};
 const jobLock = createLock();
 
 // FUNCTIONS
@@ -309,16 +322,22 @@ export const serveError = async (error: Record<string, unknown>, response: Serve
     console.log('Cannot send error response because the response has ended.');
   }
 };
+// Returns the IP address a request should be attributed to: the value of its
+// x-forwarded-for header (Caddy runs in front of Kilotest, so a real client's address
+// arrives this way, not as the socket's own remote address), else the socket's remote
+// address, else 'unknown' if neither is available.
+export const getRequestIP = (request: IncomingMessage): string | string[] => {
+  const forwardedFor = request.headers['x-forwarded-for'];
+  const remoteAddress = request.socket.remoteAddress;
+  return forwardedFor || remoteAddress || 'unknown';
+};
 // Creates an error object about a suspicious request.
 export const getAbuseError = (request: IncomingMessage, reason: string | undefined) => {
   const {method, url, headers} = request;
-  const forwardedFor = headers['x-forwarded-for'];
-  const remoteAddress = request.socket.remoteAddress;
-  const ip = forwardedFor || remoteAddress || 'unknown';
   return {
     message: 'Invalid request',
     reason,
-    'IP address': ip,
+    'IP address': getRequestIP(request),
     method,
     URL: url,
     'user agent': headers['user-agent'] || 'none',
@@ -326,6 +345,39 @@ export const getAbuseError = (request: IncomingMessage, reason: string | undefin
     time: new Date().toISOString()
   };
 };
+// Logs one line for every request, successful or not, once it finishes. Unlike
+// getAbuseError (logged only for rejected requests, as a rare, human-read-in-the-moment
+// dump), this is a terse, single-line-per-request JSON record, intended to be high-volume
+// and machine-parseable, so that any kind of suspicious traffic pattern (not only the
+// specific rejection reasons getAbuseError already covers) can be recognized later. It
+// deliberately does not consult isMetricsExcluded: that exclusion exists to keep the
+// maintainer's own manual testing out of usage counts, but abuse visibility should see
+// all traffic, including the maintainer's own, or it recreates the same kind of blind
+// spot this logging exists to close.
+const logRequestOnFinish = (request: IncomingMessage, response: ServerResponse): void => {
+  const {method, headers} = request;
+  const ip = getRequestIP(request);
+  const userAgent = headers['user-agent'] || 'none';
+  const path = new URL(request.url as string, 'https://localhost:3000').pathname;
+  const originalEnd = response.end.bind(response);
+  // Reassign response.end so that every path through handleRequest logs exactly once,
+  // right before the response is actually sent, rather than requiring every dispatch
+  // branch to remember to log itself (the same class of gap that left successful
+  // requests unlogged in the first place). No query string is logged, so that a
+  // parameter such as authCode is never written to a log file.
+  response.end = ((...args: Parameters<typeof originalEnd>) => {
+    console.log(JSON.stringify({
+      type: 'request',
+      time: new Date().toISOString(),
+      ip,
+      method,
+      path,
+      status: response.statusCode,
+      userAgent
+    }));
+    return originalEnd(...args);
+  }) as typeof response.end;
+};
 // Returns whether a request carries the metrics-exclusion cookie with the value that
 // proves it. A request without a valid AUTH_CODE configured can never match, since
 // getExclusionCookieValue then hashes an empty string, which no cookie should equal.
@@ -487,6 +539,10 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     response.end('{}');
     return;
   }
+  // Log this request once it finishes, for general abuse/usage visibility (see GitHub
+  // issue #3). Placed after the smoke-test short-circuit above, so CI's own smoke-test
+  // traffic is excluded from this log exactly as it is already excluded from metrics.
+  logRequestOnFinish(request, response);
   // Records a pageViews or apiOperations metric, unless this request's browser has proven,
   // via a valid authCode submitted earlier on metrics.html, that it belongs to the
   // maintainer testing Kilotest manually rather than to real usage.
@@ -636,13 +692,21 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     // Otherwise, if it is for an HTML page other than the home page:
     else if (pageName.endsWith('.html')) {
       const topic = pageName.slice(0, -5);
-      // If the page can be generated and is not POST-only (a POST-only path also matches
+      // If it is for a page's old, pre-rename name:
+      if (renamedPagePrefixes[topic]) {
+        // Redirect the client permanently to the current page name, preserving any
+        // further path segments and the query string.
+        const newLocation = `/${renamedPagePrefixes[topic]}.html${pathTail ? `/${pathTail}` : ''}${search}`;
+        response.writeHead(301, {Location: newLocation});
+        response.end();
+      }
+      // Otherwise, if the page can be generated and is not POST-only (a POST-only path also matches
       // the '*.html*' GET pattern, but its handler expects POST's argument list and
       // performs no GET-appropriate rendering; a self-submitting manager page is POST-allowed
       // too, but its handler serves both methods the same way, so it is not excluded here,
       // except for a page in noDirectGetPages, which stays excluded from GET even though
       // it is self-submitting, since it must be reachable only via another page's POST):
-      if (
+      else if (
         answer[topic] &&
         !noDirectGetPages.has(topic) &&
         (!isPathAllowed('POST', pathname) || selfSubmittingManagerPages.has(topic))
@@ -815,7 +879,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (pageName === 'requestTest.html') {
         const {description, url, why} = postData as {description?: string; url: string; why?: string};
         // If the request is valid:
-        if (description && url.startsWith('https://') && why) {
+        if (description && isURL(url) && why) {
           // If a report on the page is already available:
           if (await isReportAvailable(description, url)) {
             // Report the error.
@@ -877,7 +941,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         const {target, authCode} = postData as {target: string; authCode?: string};
         const [url, description] = target.split('\t') as [string, string];
         // If the request is valid:
-        if (url.startsWith('https://') && authCode === process.env.AUTH_CODE) {
+        if (isURL(url) && isValidAuthCode(authCode)) {
           // Set the non-location headers for a response.
           setHeaders('text/html', null, 'ultra');
           // If the request is an approval:
@@ -885,19 +949,10 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
             // Set a location header for a response.
             response.setHeader('content-location', pathname);
             // Process the approval and get the answer data about the remaining requests.
-            const answerData = await answer.enqueue(url, description, authCode);
-            // If the answer data are valid:
-            if (answerData.status === 'ok') {
-              await recordMetric('managerActivity', 'requestAction.html', 'ok');
-              // Serve the test-order page with the remaining recommendations.
-              response.end(answerData.answerPage);
-            }
-            // Otherwise, i.e. if they are invalid:
-            else {
-              await recordMetric('managerActivity', 'requestAction.html', 'error');
-              // Report the error.
-              await serveError({message: answerData.message}, response, true);
-            }
+            const answerData = await answer.enqueue(url, description);
+            await recordMetric('managerActivity', 'requestAction.html', 'ok');
+            // Serve the test-order page with the remaining recommendations.
+            response.end(answerData.answerPage);
           }
           // Otherwise, i.e. if it is a rejection:
           else {

package/mcp.test.ts

@@ -157,7 +157,7 @@ test('requestFeature handler returns content and structuredContent', async () =>
   const server = createMCPServer();
   const countBefore = getToolCallCount('requestFeature');
   const result = await (server as any)._registeredTools.requestFeature.handler({
-    feature: 'A new feature idea'
+    feature: 'A new feature idea worth considering'
   });
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "49.0.0",
+  "version": "50.0.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",

package/util.test.ts

@@ -13,6 +13,7 @@ import {
   annotateReportObject,
   checkCommentDuplicate,
   checkCommentLength,
+  checkLength,
   createLock,
   dbPath,
   getAgoDays,
@@ -45,6 +46,7 @@ import {
   isReportAvailable,
   isTimeStamp,
   isURL,
+  isValidAuthCode,
   jobsPath,
   makeBreakable,
   minifyURL,
@@ -83,6 +85,32 @@ test('checkCommentLength rejects a comment longer than 1000 characters', () => {
   });
 });
 
+test('checkLength accepts text at the minimum bound', () => {
+  const result = checkLength('a'.repeat(5), 5, 10, 'reason');
+  assert.deepEqual(result, {status: 'ok'});
+});
+
+test('checkLength accepts text at the maximum bound', () => {
+  const result = checkLength('a'.repeat(10), 5, 10, 'reason');
+  assert.deepEqual(result, {status: 'ok'});
+});
+
+test('checkLength rejects text shorter than the minimum bound', () => {
+  const result = checkLength('a'.repeat(4), 5, 10, 'reason');
+  assert.deepEqual(result, {
+    status: 'error',
+    message: 'The reason must be between 5 and 10 characters long'
+  });
+});
+
+test('checkLength rejects text longer than the maximum bound', () => {
+  const result = checkLength('a'.repeat(11), 5, 10, 'reason');
+  assert.deepEqual(result, {
+    status: 'error',
+    message: 'The reason must be between 5 and 10 characters long'
+  });
+});
+
 test('checkCommentDuplicate accepts a comment with no existing comments', () => {
   const result = checkCommentDuplicate([], 'a'.repeat(20));
   assert.deepEqual(result, {status: 'ok'});
@@ -337,6 +365,42 @@ test('isURL returns false for an invalid URL', () => {
   assert.equal(isURL('not-a-url'), false);
 });
 
+test('isValidAuthCode returns true when the code matches AUTH_CODE', () => {
+  const saved = process.env.AUTH_CODE;
+  process.env.AUTH_CODE = 'secret-code';
+  try {
+    assert.equal(isValidAuthCode('secret-code'), true);
+  }
+  finally {
+    if (saved === undefined) {
+      delete process.env.AUTH_CODE;
+    }
+    else {
+      process.env.AUTH_CODE = saved;
+    }
+  }
+});
+
+test('isValidAuthCode returns false when the code does not match AUTH_CODE', () => {
+  const saved = process.env.AUTH_CODE;
+  process.env.AUTH_CODE = 'secret-code';
+  try {
+    assert.equal(isValidAuthCode('wrong-code'), false);
+  }
+  finally {
+    if (saved === undefined) {
+      delete process.env.AUTH_CODE;
+    }
+    else {
+      process.env.AUTH_CODE = saved;
+    }
+  }
+});
+
+test('isValidAuthCode returns false for an undefined code', () => {
+  assert.equal(isValidAuthCode(undefined), false);
+});
+
 test('makeBreakable inserts wbr before non-initial slashes', () => {
   assert.equal(makeBreakable('/api/listReports'), '/api<wbr>/listReports');
 });

package/util.ts

@@ -173,6 +173,24 @@ export type ReportData = {
 const alphaCompare = (a: string, b: string) => a.localeCompare(b, 'en', {sensitivity: 'base'});
 // Sorts strings alphabetically and case-insensitively.
 const alphaSort = (strings: string[]) => strings.sort((a, b) => alphaCompare(a, b));
+// Returns whether a string's length is within the given bounds. Generic length check
+// shared by any field with a min/max character-count rule (e.g. a request description
+// or reason), so each caller states its own bounds and label instead of hardcoding an
+// ad hoc length comparison.
+export const checkLength = (
+  text: string, min: number, max: number, label: string
+): {status: 'ok'} | {status: 'error'; message: string} => {
+  const {length} = text;
+  // If the length is invalid:
+  if (length < min || length > max) {
+    // Return the applicable error message.
+    return {
+      status: 'error',
+      message: `The ${label} must be between ${min} and ${max} characters long`
+    };
+  }
+  return {status: 'ok'};
+};
 // Returns whether a comment's raw length is within the 20-to-1000-character bounds.
 export const checkCommentLength = (
   content: string
@@ -536,6 +554,12 @@ export const isURL = (string: string): boolean => {
     return false;
   }
 };
+// Returns whether a string is the authorization code, the shared check every
+// manager-facing page and action uses to gate a submission. Centralized so all call
+// sites compare against process.env.AUTH_CODE the same way.
+export const isValidAuthCode = (authCode: string | undefined | null): boolean => {
+  return !!authCode && authCode === process.env.AUTH_CODE;
+};
 // Makes a string breakable before non-initial slashes.
 export const makeBreakable = (string: string): string => string.replace(/\//g, '<wbr>/').replace(/^<wbr>/, '');
 // Minifies a URL for duplicate detection.

package/web/ai0BalanceForm/index.ts

@@ -7,7 +7,7 @@
 
 import fs from 'node:fs/promises';
 import {balancePath} from '../../balances.ts';
-import {getJSON, populateTemplate} from '../../util.ts';
+import {getJSON, isValidAuthCode, populateTemplate} from '../../util.ts';
 
 // FUNCTIONS
 
@@ -22,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST' && newBalanceString) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const newBalance = Number.parseFloat(newBalanceString);
       // If the new balance is valid:
       if (

package/web/enqueue/index.ts

@@ -6,54 +6,45 @@
 // IMPORTS
 
 import {
-  deleteTestRequests, getJSON, getNowStamp, getRandomString, isURL, jobsPath, populateTemplate
+  deleteTestRequests, getJSON, getNowStamp, getRandomString, jobsPath, populateTemplate
 } from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS
 
-// Implements a test request approval and returns a revised request page.
-export const answer = async (url: string, description: string, authCode: string) => {
-  // If the arguments are valid:
-  if (isURL(url) && description && authCode === process.env.AUTH_CODE) {
-    // Get the job template.
-    const jobTemplateJSON = await fs.readFile(path.join(import.meta.dirname, '..', '..', 'job.json'), 'utf8');
-    const job = JSON.parse(jobTemplateJSON);
-    const nowStamp = getNowStamp();
-    // Populate the template with job properties.
-    const jobIDSuffix = getRandomString(3);
-    const jobName = `${nowStamp}-${jobIDSuffix}`;
-    job.id = jobName;
-    job.creationTimeStamp = nowStamp;
-    job.executionTimeStamp = nowStamp;
-    job.target.what = description;
-    job.target.url = url;
-    const query: Record<string, string> = {
-      target: description,
-      jobName
-    };
-    // Save the job in the queue.
-    await fs.writeFile(
-      path.join(jobsPath(), 'queue', `${jobName}.json`), getJSON(job)
-    );
-    console.log(`Retest queued for ${description} as job ${jobName}`);
-    // Delete the test requests for the target.
-    await deleteTestRequests(url);
-    // Get the populated answer template.
-    const answerPage = await populateTemplate(import.meta.dirname, query);
-    // Return the populated page.
-    return {
-      status: 'ok',
-      answerPage
-    };
-  }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
-  // message is deliberately vague so as not to confirm to an attacker that the
-  // authorization code specifically (as opposed to some other part of the request) is
-  // what was wrong.
+// Implements a test request approval and returns a revised request page. The caller
+// (index.ts, this function's only caller) has already validated the URL and
+// authorization code before invoking this function.
+export const answer = async (url: string, description: string) => {
+  // Get the job template.
+  const jobTemplateJSON = await fs.readFile(path.join(import.meta.dirname, '..', '..', 'job.json'), 'utf8');
+  const job = JSON.parse(jobTemplateJSON);
+  const nowStamp = getNowStamp();
+  // Populate the template with job properties.
+  const jobIDSuffix = getRandomString(3);
+  const jobName = `${nowStamp}-${jobIDSuffix}`;
+  job.id = jobName;
+  job.creationTimeStamp = nowStamp;
+  job.executionTimeStamp = nowStamp;
+  job.target.what = description;
+  job.target.url = url;
+  const query: Record<string, string> = {
+    target: description,
+    jobName
+  };
+  // Save the job in the queue.
+  await fs.writeFile(
+    path.join(jobsPath(), 'queue', `${jobName}.json`), getJSON(job)
+  );
+  console.log(`Retest queued for ${description} as job ${jobName}`);
+  // Delete the test requests for the target.
+  await deleteTestRequests(url);
+  // Get the populated answer template.
+  const answerPage = await populateTemplate(import.meta.dirname, query);
+  // Return the populated page.
   return {
-    status: 'error',
-    message: 'Invalid request'
+    status: 'ok',
+    answerPage
   };
 };

package/web/hideReportForm/index.ts

@@ -5,7 +5,9 @@
 
 // IMPORTS
 
-import {getReportExtracts, hiddenReportsPath, populateTemplate, reportsPath} from '../../util.ts';
+import {
+  getReportExtracts, hiddenReportsPath, isValidAuthCode, populateTemplate, reportsPath
+} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -20,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted and a report is to be hidden:
   if (method === 'POST' && jobName) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const fileName = `${jobName}.json`;
       try {
         // Move the specified report to the directory of hidden reports.

package/web/metrics/index.ts

@@ -7,7 +7,8 @@
 // IMPORTS
 
 import {
-  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, metricsExclusionCookieName, populateTemplate
+  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, isValidAuthCode,
+  metricsExclusionCookieName, populateTemplate
 } from '../../util.ts';
 
 // FUNCTIONS
@@ -64,7 +65,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST') {
     // If the authorization code is invalid:
-    if (authCode !== process.env.AUTH_CODE) {
+    if (!isValidAuthCode(authCode)) {
       // Report the error, deliberately vague so as not to confirm to an attacker that the
       // authorization code specifically (as opposed to some other part of the request) is
       // what was wrong.

package/web/reannotate/index.ts

@@ -11,6 +11,7 @@ import {
   getReport,
   getReportPath,
   isReportError,
+  isValidAuthCode,
   readdirOrCreate,
   reportsPath
 } from '../../util.ts';
@@ -22,7 +23,7 @@ import path from 'node:path';
 // Implements a reannotation order and returns an acknowledgement page.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the names of the stored report files.
     const reportFileNames = (await readdirOrCreate(reportsPath(), 'Reports directory'))
     .filter(fileName => fileName.endsWith('.json'));

package/web/renewWCAG/index.ts

@@ -7,14 +7,14 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import {getJSON} from '../../util.ts';
+import {getJSON, isValidAuthCode} from '../../util.ts';
 
 // FUNCTIONS
 
 // Renews the WCAG map and serves an acknowledgment.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the map source response.
     const mapSourceResponse = await fetch('https://www.w3.org/WAI/WCAG22/Understanding/');
     const mapSourceStatus = mapSourceResponse.status;

package/web/reportDeletion.ts

@@ -6,7 +6,8 @@
 // IMPORTS
 
 import {
-  errorMessage, getReportData, objectSort, populateTemplate, readdirOrCreate, reportsPath
+  errorMessage, getReportData, isValidAuthCode, objectSort, populateTemplate, readdirOrCreate,
+  reportsPath
 } from '../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -48,7 +49,7 @@ export const reportDeletionForm = async (
   // If the form has been submitted and any reports are to be deleted:
   if (method === 'POST' && jobNames?.length) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       try {
         // For each report to be deleted:
         for (const jobName of jobNames) {

package/web/showHiddenReportsForm/index.ts

@@ -7,7 +7,7 @@
 
 // IMPORTS
 
-import {populateTemplate} from '../../util.ts';
+import {isValidAuthCode, populateTemplate} from '../../util.ts';
 import {answer as unhideReportForm} from '../unhideReportForm/index.ts';
 
 // FUNCTIONS
@@ -22,7 +22,7 @@ export const answer = async (pathTail: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST') {
     // If the authorization code is invalid:
-    if (authCode !== process.env.AUTH_CODE) {
+    if (!isValidAuthCode(authCode)) {
       // Report the error, deliberately vague so as not to confirm to an attacker that the
       // authorization code specifically (as opposed to some other part of the request) is
       // what was wrong.

package/web/unhideReportForm/index.ts

@@ -5,7 +5,9 @@
 
 // IMPORTS
 
-import {hiddenReportsPath, populateTemplate, readdirOrCreate, reportsPath} from '../../util.ts';
+import {
+  hiddenReportsPath, isValidAuthCode, populateTemplate, readdirOrCreate, reportsPath
+} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -20,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted and a report is to be unhidden:
   if (method === 'POST' && jobName) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const fileName = `${jobName}.json`;
       try {
         // Move the report to the reports directory.