efitenandClaude Sonnet 4.6 51f823bf7e feat: one-click prune nodes outside geofilter (#669 M4) (#738) ...

## Summary

- Adds `POST /api/admin/prune-geo-filter` endpoint — dry-run by default,
`?confirm=true` to permanently delete nodes outside the current
geofilter polygon + buffer. Requires `X-API-Key` header.
- Adds **Prune nodes** section inside the GeoFilter customizer tab
(write-access only, same `writeEnabled` gate as PUT). **Preview** lists
affected nodes; **Confirm delete** removes them.
- Adds `GetNodesForGeoPrune` and `DeleteNodesByPubkeys` DB helpers.
- Updates `docs/user-guide/geofilter.md` — documents the UI button as
primary workflow, CLI script as alternative.

> **Depends on M3** (`feat/geofilter-m3-customizer`, PR #736). Merge M3
first.

## Test plan

- [x] `cd cmd/server && go test ./...` — all pass
- [x] Customizer GeoFilter tab without `apiKey` — Prune section not
visible
- [x] With `apiKey` + polygon active — Prune section visible
- [x] **Preview** returns list of nodes outside polygon (no deletions)
- [x] **Confirm delete** removes nodes, list clears
- [x] `POST /api/admin/prune-geo-filter` without `X-API-Key` → 401
- [x] `POST /api/admin/prune-geo-filter` with no polygon configured →
400

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-21 03:19:31 +00:00

..

testdata/golden

feat(#847): dedupe Top Longest Hops by pair + add obs count and SNR cues (#848)

2026-04-21 09:09:39 -07:00

advert_pubkey_test.go

perf: track advert pubkeys incrementally, eliminate per-request JSON parsing (#360) (#544)

2026-04-03 13:51:13 -07:00

analytics_recomputer_test.go

perf(#1240): steady-state background recompute for analytics endpoints (#1248)

2026-05-17 17:33:30 +00:00

analytics_recomputer.go

perf(#1265): wire /api/observers/clock-skew + /api/nodes/clock-skew into analytics recomputer (#1266)

2026-05-18 12:27:44 -07:00

apikey_security_test.go

fix: reject weak/default API keys + startup warning (#532) (#628)

2026-04-05 14:50:40 -07:00

backup_test.go

feat: /api/backup — one-click SQLite database export (#474) (#1022)

2026-05-03 17:56:42 -07:00

backup.go

feat: /api/backup — one-click SQLite database export (#474) (#1022)

2026-05-03 17:56:42 -07:00

bounded_load_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

bridge_handle_nodes_test.go

feat(repeater): usefulness score — bridge axis (#672 axis 2 of 4) (#1275)

2026-05-18 22:51:23 -07:00

bridge_recomputer.go

feat(repeater): usefulness score — bridge axis (#672 axis 2 of 4) (#1275)

2026-05-18 22:51:23 -07:00

bridge_score_test.go

feat(repeater): usefulness score — bridge axis (#672 axis 2 of 4) (#1275)

2026-05-18 22:51:23 -07:00

bridge_score.go

feat(repeater): usefulness score — bridge axis (#672 axis 2 of 4) (#1275)

2026-05-18 22:51:23 -07:00

cache_invalidation_test.go

fix: cache invalidation tuning — 7% → 50-80% hit rate (#721)

2026-04-12 18:09:23 -07:00

channel_analytics_test.go

feat(analytics): selectable timeframes via ?window/?from/?to (#842) (#1018)

2026-05-03 17:41:22 -07:00

channel_filter_test.go

Fix channel filter on Packets page (UI + API) — #812 (#816)

2026-04-20 21:46:34 -07:00

clock_skew_issue1285_test.go

fix(#1285): exclude RTC-reset outliers from clock-skew hash median + recent bad count (#1288)

2026-05-19 01:17:12 -07:00

clock_skew_recompute_test.go

perf(#1265): wire /api/observers/clock-skew + /api/nodes/clock-skew into analytics recomputer (#1266)

2026-05-18 12:27:44 -07:00

clock_skew_test.go

fix(#1285): exclude RTC-reset outliers from clock-skew hash median + recent bad count (#1288)

2026-05-19 01:17:12 -07:00

clock_skew.go

fix(#1285): exclude RTC-reset outliers from clock-skew hash median + recent bad count (#1288)

2026-05-19 01:17:12 -07:00

collision_details_test.go

feat: show collision details in Hash Usage Matrix for all hash sizes (#758)

2026-04-16 00:18:25 -07:00

config_knobs_test.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

config_test.go

feat: add observer retention — remove stale observers after configurable days (#764)

2026-04-17 09:24:40 -07:00

config.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

cors_test.go

feat(server): explicit CORS policy with configurable origin allowlist (#883) (#971)

2026-05-02 12:04:37 -07:00

cors.go

feat(server): explicit CORS policy with configurable origin allowlist (#883) (#971)

2026-05-02 12:04:37 -07:00

coverage_test.go

feat(startup): hot startup — load hotStartupHours synchronously, fill retentionHours in background (#1187)

2026-05-15 22:46:25 -07:00

db_channel_messages_perf_test.go

fix(#1225): paginate channel messages at SQL level — 30s → <500ms (#1226)

2026-05-16 17:28:40 +00:00

db_test.go

fix(#1143): structural pubkey attribution via from_pubkey column (#1152)

2026-05-06 23:50:44 -07:00

db.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

decoder_bounds_test.go

fix(#1211): bounds-check path length to prevent slice [218:15] panic in MQTT decode (#1214)

2026-05-15 22:34:21 -07:00

decoder_test.go

fix(#1211): bounds-check path length to prevent slice [218:15] panic in MQTT decode (#1214)

2026-05-15 22:34:21 -07:00

decoder.go

feat(decoder+ui): close remaining P2 items from #1279 — payloadTypeNames, legend, TransportCodes, Feat1/2, RAW_CUSTOM, sensor docs (#1291)

2026-05-19 08:08:28 -07:00

discovered_channels_test.go

fix(#688): auto-discover hashtag channels from message text (#1071)

2026-05-05 01:16:57 -07:00

discovered_channels.go

fix(#688): auto-discover hashtag channels from message text (#1071)

2026-05-05 01:16:57 -07:00

distance_lock_contention_test.go

perf(#1239): /api/analytics/distance — TTL 15s→60s + drop main RLock around compute (#1241)

2026-05-16 20:56:52 +00:00

encrypted_channels_test.go

fix: channel query performance — add channel_hash column, SQL-level filtering (#762) (#763)

2026-04-16 00:09:36 -07:00

eviction_test.go

perf(#1239): /api/analytics/distance — TTL 15s→60s + drop main RLock around compute (#1241)

2026-05-16 20:56:52 +00:00

foreign_advert_test.go

feat(#730): foreign-advert detection — flag instead of silent drop (#1084)

2026-05-05 01:58:52 -07:00

from_pubkey_migration.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

geo_filter.go

feat: geo_filter enforcement, DB pruning, geofilter-builder tool, HB column (#215)

2026-03-31 01:10:56 -07:00

go.mod

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

go.sum

feat: add Go web server (cmd/server/) — full API + WebSocket + static files

2026-03-27 01:16:59 -07:00

hash_migrate_test.go

fix: use payload type bits only in content hash (not full header byte) (#787)

2026-04-18 11:52:22 -07:00

hash_migrate.go

fix: use payload type bits only in content hash (not full header byte) (#787)

2026-04-18 11:52:22 -07:00

healthz_test.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

healthz.go

fix(#1143): structural pubkey attribution via from_pubkey column (#1152)

2026-05-06 23:50:44 -07:00

helpers_test.go

perf: replace O(n²) selection sort with sort.Slice (#354) (#542)

2026-04-03 13:11:59 -07:00

hop_context_bench_test.go

fix(#1199): 6 deferred quality items from PR #1198 r2 review (#1200)

2026-05-15 16:21:14 +00:00

hop_disambig_confidence_test.go

fix(#1229): source-diversity confidence weighting in neighbor-graph tier-1 resolver (#1235)

2026-05-16 19:55:00 +00:00

hop_disambig_e2e_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

hop_disambig_tier1_test.go

test(#1201): regression coverage for hop disambiguator tier-1 + end-to-end top-hops fixture (#1202)

2026-05-15 20:24:55 -07:00

hot_startup_consistency_test.go

feat(startup): hot startup — load hotStartupHours synchronously, fill retentionHours in background (#1187)

2026-05-15 22:46:25 -07:00

hot_startup_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

issue673_test.go

fix(#673): replace raw JSON text search with byNode index for node packet queries (#803)

2026-04-20 22:15:02 -07:00

issue804_repeater_region_test.go

fix(#804): attribute analytics by repeater home region, not observer (#1025)

2026-05-03 20:10:02 -07:00

issue810_repro_test.go

fix(#810): /health.recentPackets resolved_path falls back to longest sibling obs (#821)

2026-04-21 04:51:24 +00:00

issue871_test.go

fix: drop/filter packets with null hash or timestamp (closes #871) (#993)

2026-05-02 20:35:15 -07:00

issue1189_distinct_iatas_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

issue1279_p2_test.go

feat(decoder+ui): close remaining P2 items from #1279 — payloadTypeNames, legend, TransportCodes, Feat1/2, RAW_CUSTOM, sensor docs (#1291)

2026-05-19 08:08:28 -07:00

issue1279_test.go

feat(decoder): GRP_DATA + MULTIPART + advertRole fix + CONTROL flags (#1279 P0+P1) (#1280)

2026-05-18 23:19:27 -07:00

main.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

memlimit_test.go

feat(memlimit): GOMEMLIMIT support, derive from packetStore.maxMemoryMB (#836) (#1077)

2026-05-05 01:33:23 -07:00

memlimit.go

feat(memlimit): GOMEMLIMIT support, derive from packetStore.maxMemoryMB (#836) (#1077)

2026-05-05 01:33:23 -07:00

memory.go

obs: surface real RSS alongside tracked store bytes in /api/stats (#832) (#835)

2026-04-20 23:10:33 -07:00

multibyte_capability_test.go

feat: validate advert signatures on ingest, reject corrupt packets (#794)

2026-04-18 11:39:13 -07:00

multibyte_enrich_test.go

feat: show multi-byte hash support indicator on map markers (#1002)

2026-05-03 08:56:09 -07:00

multibyte_region_filter_test.go

fix(analytics): multiByteCapability missing under region filter → all rows 'unknown' (#1049)

2026-05-05 06:42:58 +00:00

neighbor_api_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

neighbor_api.go

feat(#1228): reject geo-implausible neighbor-graph edges at build time (#1230)

2026-05-16 10:14:44 -07:00

neighbor_debug_test.go

feat: affinity debugging tools (#482) — milestone 6 (#521)

2026-04-02 23:45:03 -07:00

neighbor_debug.go

fix(#1197): plumb hop-context + observation-count tiebreak to disambiguator (#1198)

2026-05-15 09:16:39 -07:00

neighbor_dedup_test.go

fix(#1197): plumb hop-context + observation-count tiebreak to disambiguator (#1198)

2026-05-15 09:16:39 -07:00

neighbor_graph_geo_test.go

feat(#1228): reject geo-implausible neighbor-graph edges at build time (#1230)

2026-05-16 10:14:44 -07:00

neighbor_graph_test.go

fix: exclude non-repeater nodes from path-hop resolution (#935) (#936)

2026-04-30 09:25:51 -07:00

neighbor_graph.go

fix(#1229): source-diversity confidence weighting in neighbor-graph tier-1 resolver (#1235)

2026-05-16 19:55:00 +00:00

neighbor_persist.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

neighbor_recomputer_test.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

neighbor_recomputer.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

node_battery_test.go

feat(node-battery): voltage trend chart + /api/nodes/{pubkey}/battery (#663) (#1082)

2026-05-05 01:41:00 -07:00

node_battery.go

feat(node-battery): voltage trend chart + /api/nodes/{pubkey}/battery (#663) (#1082)

2026-05-05 01:41:00 -07:00

node_blacklist_test.go

feat: add nodeBlacklist config to hide abusive/troll nodes (#742)

2026-04-17 23:43:05 +00:00

nodes_perf_limit2000_test.go

perf(#1262): /api/nodes?limit=2000 cold-miss 15.7s → <100ms — prewarm repeater enrichment cache (#1263)

2026-05-18 09:22:27 -07:00

nodes_perf_test.go

perf(#1257): bulk-cache repeater enrichment in /api/nodes — 32s → <500ms (#1260)

2026-05-18 07:36:33 -07:00

obs_dedup_test.go

perf: replace O(n²) observation dedup with map-based O(n) (#355) (#543)

2026-04-03 13:33:26 -07:00

observer_blacklist_test.go

feat(ingestor + server): observerBlacklist config (#962) (#963)

2026-05-01 23:11:27 -07:00

openapi_test.go

feat: auto-generated OpenAPI 3.0 spec endpoint + Swagger UI (#530) (#632)

2026-04-05 15:05:20 -07:00

openapi.go

refactor(db): move all writes from server to ingestor; server truly read-only (fixes #1283) (#1286)

2026-05-18 23:52:27 -07:00

packets_observer_iata_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

parity_test.go

feat: implement packet store eviction/aging to prevent OOM (#273)

2026-03-30 03:42:11 +00:00

path_inspect_atomic_race_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect_coldstart_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect_panic_safety_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect_singleflight_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect_swr_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect_test.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

path_inspect.go

fix(#1203): path-inspector — singleflight + stale-while-revalidate (#1208)

2026-05-15 22:46:28 -07:00

paths_anchor_bias_test.go

fix(#1278): /api/nodes/{pk}/paths uses canonical persisted resolved_path (drop anchor-bias inconsistency) (#1282)

2026-05-18 23:19:30 -07:00

paths_through_test.go

fix(paths): exclude false-positive paths from short-prefix collisions (#930)

2026-05-02 11:15:25 -07:00

perf_io_bench_test.go

perf: cancelled writes + ingestor I/O + threshold tests (#1120 follow-up) (#1167)

2026-05-08 16:29:23 -07:00

perf_io_carmack_test.go

perf: cancelled writes + ingestor I/O + threshold tests (#1120 follow-up) (#1167)

2026-05-08 16:29:23 -07:00

perf_io_followup_test.go

perf: cancelled writes + ingestor I/O + threshold tests (#1120 follow-up) (#1167)

2026-05-08 16:29:23 -07:00

perf_io_freshness_test.go

perf: cancelled writes + ingestor I/O + threshold tests (#1120 follow-up) (#1167)

2026-05-08 16:29:23 -07:00

perf_io_test.go

feat(perf): per-component disk I/O + write source metrics on Perf page (#1120) (#1123)

2026-05-05 17:56:56 -07:00

perf_io.go

perf: cancelled writes + ingestor I/O + threshold tests (#1120 follow-up) (#1167)

2026-05-08 16:29:23 -07:00

perfstats_race_test.go

fix: add mutex synchronization to PerfStats to eliminate data races (#469)

2026-04-01 19:26:11 -07:00

prefix_map_role_test.go

fix(#1197): plumb hop-context + observation-count tiebreak to disambiguator (#1198)

2026-05-15 09:16:39 -07:00

readonly_invariant_test.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

region_filter_test.go

fix(#770): treat region 'All' as no-filter + document region behavior (#1026)

2026-05-03 19:50:01 -07:00

repeater_enrich_bulk.go

perf(#1257): bulk-cache repeater enrichment in /api/nodes — 32s → <500ms (#1260)

2026-05-18 07:36:33 -07:00

repeater_enrich_recomputer.go

perf(#1262): /api/nodes?limit=2000 cold-miss 15.7s → <100ms — prewarm repeater enrichment cache (#1263)

2026-05-18 09:22:27 -07:00

repeater_liveness_test.go

fix(#662): GetRepeaterRelayInfo also looks up byPathHop by 1-byte prefix (#1086)

2026-05-05 02:33:27 -07:00

repeater_liveness.go

fix(#662): GetRepeaterRelayInfo also looks up byPathHop by 1-byte prefix (#1086)

2026-05-05 02:33:27 -07:00

repeater_usefulness_test.go

feat(repeater): usefulness score — traffic axis (#672) (#1079)

2026-05-05 01:34:08 -07:00

repeater_usefulness.go

feat(repeater): usefulness score — traffic axis (#672) (#1079)

2026-05-05 01:34:08 -07:00

resolve_context_callsites_test.go

fix(#1199): 6 deferred quality items from PR #1198 r2 review (#1200)

2026-05-15 16:21:14 +00:00

resolve_context_test.go

fix(#1197): plumb hop-context + observation-count tiebreak to disambiguator (#1198)

2026-05-15 09:16:39 -07:00

resolve_with_context_bench_test.go

perf(#1247): surgical fix for resolveWithContext tier-1 hot path (4.6× speedup) (#1253)

2026-05-17 16:42:01 -07:00

resolved_index_test.go

perf(#800): remove per-StoreTx ResolvedPath, replace with membership index + on-demand decode (#806)

2026-04-20 19:55:00 -07:00

resolved_index.go

fix(#810): /health.recentPackets resolved_path falls back to longest sibling obs (#821)

2026-04-21 04:51:24 +00:00

role_analytics_recompute_test.go

perf(#1256): wire /api/analytics/roles into steady-state recomputer (#1259)

2026-05-18 07:36:28 -07:00

role_analytics_test.go

feat(roles): /#/roles page + /api/analytics/roles endpoint (Fixes #818) (#1023)

2026-05-03 17:56:12 -07:00

role_analytics.go

perf(#1256): wire /api/analytics/roles into steady-state recomputer (#1259)

2026-05-18 07:36:28 -07:00

routes_test.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

routes.go

feat: one-click prune nodes outside geofilter (#669 M4) (#738)

2026-05-21 03:19:31 +00:00

schema_degradation_per_store_test.go

fix(#1199): 6 deferred quality items from PR #1198 r2 review (#1200)

2026-05-15 16:21:14 +00:00

short_url_test.go

feat(#772): short pubkey-prefix URLs for mesh sharing (#1016)

2026-05-03 17:40:54 -07:00

stats_memory_test.go

obs: surface real RSS alongside tracked store bytes in /api/stats (#832) (#835)

2026-04-20 23:10:33 -07:00

store_tophops_test.go

feat(#847): dedupe Top Longest Hops by pair + add obs count and SNR cues (#848)

2026-04-21 09:09:39 -07:00

store.go

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

time_window_test.go

feat(analytics): selectable timeframes via ?window/?from/?to (#842) (#1018)

2026-05-03 17:41:22 -07:00

time_window.go

feat(analytics): selectable timeframes via ?window/?from/?to (#842) (#1018)

2026-05-03 17:41:22 -07:00

topology_dedup_test.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

touch_last_seen_test.go

perf(#800): remove per-StoreTx ResolvedPath, replace with membership index + on-demand decode (#806)

2026-04-20 19:55:00 -07:00

tracked_bytes_test.go

perf(#800): remove per-StoreTx ResolvedPath, replace with membership index + on-demand decode (#806)

2026-04-20 19:55:00 -07:00

types.go

feat(#1188): show observer IATA on packets + filter grammar (#1189)

2026-05-17 16:13:11 +00:00

websocket_test.go

feat: implement packet store eviction/aging to prevent OOM (#273)

2026-03-30 03:42:11 +00:00

websocket.go

fix: graceful container shutdown for reliable deployments (#453)

2026-04-01 12:19:20 -07:00