milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output

src/web/handlers/blocklists.zig

@@ -9,6 +9,10 @@
 //! refresh downloads and compiles before the response is written: 202 is
 //! "accepted and done as far as this connection is concerned", and the status
 //! table in the body is what tells the operator which sources actually landed.
+//!
+//! `DELETE /api/blocklists/{id}` removes the row, reloads, and then sweeps the
+//! compiled files that row named, so `<data_dir>/blocklists/` follows the table
+//! the operator is looking at rather than the scheduler's next pass.
 
 const std = @import("std");
 const Allocator = std.mem.Allocator;
@@ -130,7 +134,27 @@ pub fn applyDelete(state: *server.WebState, io: std.Io, id: i64) ?Failure {
     state.config_lock.unlock(io);
 
     written catch |err| return mutations.dbFailure(err, url_conflict);
-    return mutations.reload(state, io);
+    const failure = mutations.reload(state, io);
+    pruneFiles(state, io);
+    return failure;
+}
+
+/// Removes the compiled files the deleted row leaves behind.
+///
+/// This is the moment an orphan is made during normal operation, and the only
+/// other sweep is the scheduler's — up to `blocklist_update.interval_hours`
+/// away. Without this call a deleted list keeps its megabytes on disk for a day.
+///
+/// After the reload and never part of the response: the row is gone and the
+/// snapshot has stopped enforcing the list, so bytes still on disk are not a
+/// failed delete. `Manager.pruneOrphans` takes the manager's writer lock, which
+/// the reload above has already taken and released — nothing here holds it, and
+/// `state.config_lock` was released before either.
+fn pruneFiles(state: *server.WebState, io: std.Io) void {
+    const manager = state.manager orelse return;
+    manager.pruneOrphans(io) catch |err| {
+        log.warn("pruning the deleted blocklist's files failed: {s}", .{@errorName(err)});
+    };
 }
 
 /// Refreshes every enabled source, then applies the result (ruling 12).

src/web/handlers/mutations.zig

@@ -184,8 +184,12 @@ fn rebuildFailed(what: []const u8, cause: []const u8) Failure {
 const skeleton_group = "default";
 const skeleton_upstream: model.UpstreamServer = .{ .url = "https://dns.example/dns-query" };
 
-/// Runs the shipped validator over `cfg` and returns the first problem's text,
+/// Runs the shipped validator over `cfg` and returns the first failure's text,
 /// or null when the candidate is valid. The text is arena-allocated.
+///
+/// Failures only: a warning describes a configuration that is legal, and a row
+/// this API is about to store cannot be rejected for one. The blocklist source
+/// a POST creates is in no group yet — a warning by design, and never a 400.
 pub fn firstProblem(arena: Allocator, cfg: model.Config) error{OutOfMemory}!?[]const u8 {
     var diags: validate.Diagnostics = .init(arena);
     defer diags.deinit();
@@ -194,8 +198,7 @@ pub fn firstProblem(arena: Allocator, cfg: model.Config) error{OutOfMemory}!?[]c
         error.OutOfMemory => return error.OutOfMemory,
         else => {},
     };
-    if (diags.problems.items.len == 0) return null;
-    const problem = diags.problems.items[0];
+    const problem = diags.firstFailure() orelse return null;
     return try std.fmt.allocPrint(arena, "{s}: {s}", .{ problem.path, problem.message });
 }