feat: enhance auth, add input validation and pagination

- Add IP validation in auth handler with detailed logging
- Implement apiKeyMiddleware helper for API key verification
- Add IP and CIDR validation for whitelist operations
- Support pagination for listing temp and permanent entries
- Add parsePagination helper to extract limit and offset
- Include comprehensive unit tests for IsIP, IsCIDR, and IPMatch

db.go

@@ -2,12 +2,12 @@ package main
 
 import (
 	"database/sql"
+	"errors"
 	"log/slog"
 	"net"
-	"strings"
 	"time"
 
-	_ "modernc.org/sqlite"
+	sqlite "modernc.org/sqlite"
 )
 
 func InitDB(dbPath string) (*sql.DB, error) {
@@ -271,6 +271,59 @@ func ListPermEntries(db *sql.DB) ([]map[string]interface{}, error) {
 	return list, nil
 }
 
+func ListTempEntriesPaginated(db *sql.DB, limit, offset int) ([]map[string]interface{}, error) {
+	rows, err := db.Query(`
+		SELECT ip, expires_at, reason
+		FROM temp_whitelist
+		WHERE expires_at > ?
+		ORDER BY expires_at
+		LIMIT ? OFFSET ?
+	`, time.Now(), limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var list []map[string]interface{} = make([]map[string]interface{}, 0)
+	for rows.Next() {
+		var ip string
+		var expiresAt time.Time
+		var reason sql.NullString
+		if err := rows.Scan(&ip, &expiresAt, &reason); err != nil {
+			continue
+		}
+		list = append(list, map[string]interface{}{
+			"ip":      ip,
+			"expires": expiresAt,
+			"reason":  reason.String,
+		})
+	}
+	return list, nil
+}
+
+func ListPermEntriesPaginated(db *sql.DB, limit, offset int) ([]map[string]interface{}, error) {
+	rows, err := db.Query(`
+		SELECT entry
+		FROM perm_whitelist
+		ORDER BY created_at
+		LIMIT ? OFFSET ?
+	`, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var list []map[string]interface{} = make([]map[string]interface{}, 0)
+	for rows.Next() {
+		var entry string
+		if err := rows.Scan(&entry); err != nil {
+			continue
+		}
+		list = append(list, map[string]interface{}{
+			"entry": entry,
+		})
+	}
+	return list, nil
+}
+
 func ipMatchesEntry(ip, entry string) (bool, error) {
 	if entry == ip {
 		return true, nil
@@ -303,5 +356,57 @@ func isUniqueConstraintError(err error) bool {
 	if err == nil {
 		return false
 	}
-	return strings.Contains(err.Error(), "UNIQUE constraint failed")
+	var sqliteErr *sqlite.Error
+	if errors.As(err, &sqliteErr) {
+		return sqliteErr.Code() == 19
+	}
+	return false
+}
+
+func IsIP(s string) bool {
+	return net.ParseIP(s) != nil
+}
+
+func IsCIDR(s string) bool {
+	_, _, err := net.ParseCIDR(s)
+	return err == nil
+}
+
+func RotateAuditLog(db *sql.DB, maxEntries int) error {
+	if maxEntries <= 0 {
+		maxEntries = 200000
+	}
+	var count int
+	err := db.QueryRow(`SELECT COUNT(*) FROM audit_log`).Scan(&count)
+	if err != nil {
+		return err
+	}
+	if count <= maxEntries {
+		return nil
+	}
+	rows, err := db.Query(`
+		SELECT id FROM audit_log
+		ORDER BY timestamp ASC
+		LIMIT ?
+	`, count-maxEntries)
+	if err != nil {
+		return err
+	}
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err == nil {
+			ids = append(ids, id)
+		}
+	}
+	rows.Close()
+	_, err = db.Exec(`
+		DELETE FROM audit_log
+		WHERE id IN (
+			SELECT id FROM audit_log
+			ORDER BY timestamp ASC
+			LIMIT ?
+		)
+	`, count-maxEntries)
+	return err
 }