legacyAddUser inserts a user directly in the pre-30 schema. It bypasses the store on purpose: the store now speaks the post-33 schema.

Announce pushes routes to a specific peer, identified by its address and ASN.

AuthenticateUser looks up a user by login credential (login + password). It joins user_credentials with users and compares the bcrypt hash. Returns th

RecordUserSnapshot saves a user metric snapshot, only when metrics are enabled. peerStates is the BGP peer state map (peer IP:ASN → state string).

Validate reports whether v would be accepted by Set — same parse and domain-validation steps, without persisting or mutating anything. Lets a caller v

apiModesCreate handles POST /api/admin/modes.

decodePrefixes decodes NLRI/withdrawn prefixes from wire format. afi is the Address Family Identifier (1=IPv4, 2=IPv6).

encodePrefixes serializes a slice of prefixes into wire format (NLRI / withdrawn).

sendNotification sends a BGP NOTIFICATION message.

EncodePrefixString parses and encodes a textual CIDR in one step.

startSpeakerAndClient starts a Speaker as a BGP server and a Peer as a client. The speaker listens on a random free port; the client connects to it.

ActiveNetworksOverlap reports whether any candidate network overlaps with an active (web_auth network/both/any, and enabled) network belonging to a di

AggregateNetworks parses each CIDR, then returns the minimal set of prefixes covering the same address space — masked, deduplicated, and with overlapp

CountPrefixes returns the number of unique IPv4 and IPv6 prefixes that would be announced for a given explicit selection (categories + services lists)

EnsureServiceID returns the dictionary id for a (category, service) name pair, creating both rows if needed.

GetFeedSnapshots returns feed prefix counts for the last N days.

SaveUserSnapshot records user metrics, rate-limited to one row per userSnapshotMinInterval. If the last row is within the interval and values changed,

Serialize encodes the UPDATE message to wire format including header.

network, both, any

clientIP returns the address the request should be attributed to. When TrustProxyHeaders is on, the reverse proxy is trusted to append the real clien

decodePathAttributes decodes path attributes from wire format.

encodePathAttribute encodes a single path attribute in TLV format.

freeTCPPort returns a free TCP port for testing.

============================================================================= IPv6 session tests — same patterns as IPv4 but over [::1] with IPv6 pref

Aggregate returns the minimal set of CIDR prefixes that covers exactly the same address space as the input — masking host bits, dropping exact and sub

BuiltInAdapterVersion returns the current builtin version for a given adapter ID.

Do executes fn with exponential backoff retry.

EnsureCategoryID returns the dictionary id for a category name, creating the row if needed. Dictionary rows are append-only: a name referenced by a se

GetUserCredentials returns all login credentials for a user.

GetUserSnapshots returns user metrics for the last N days.

NewCircuitBreaker creates a new circuit breaker with the given configuration.

SetCommunity upserts a community. service="" means group-level.

dbTableHasColumn reports whether a column exists on a table. A missing table yields false, not an error (pragma_table_info returns no rows).

newTestManager builds a Manager with its restart-only-setting snapshot (localASN/localAddrV4/localAddrV6) populated to match cfg, mirroring what start

parseDefaultRule loops items until srsItemFinal.

EncodePrefix converts a prefix to its stored (ip, bits) form, masking it so the encoding is canonical.

NewLogger creates a new logger with the specified level and format

PeerStates returns the BGP state for each configured peer.

RecordFeedSnapshot saves a feed prefix count snapshot, only when metrics are enabled.

SaveFeedSnapshot records feed prefix counts, rate-limited to one row per feedSnapshotMinInterval. If the last row is within the interval and values ch

Serialize encodes the OPEN message to wire format including header. Advertises IPv6 unicast (RFC 4760) and Four-octet ASN (RFC 6793) capabilities. Use

Serialize encodes the AS_PATH path attribute value. Uses AS_SEQUENCE (type code 2) for both 2-byte and 4-byte ASNs.

ToggleSelectedCategory adds or removes a single category selection.

ValidateDBPath checks that a database file's parent directory, if it already exists, is actually a directory and is writable. A parent directory that

apiAdminUserSaveSelections handles PUT /api/admin/users/{id}/selections. Saves category/service selections for any user (admin-only), bypassing select

apiModeFeedsSet handles PUT /api/admin/modes/{id}/feeds.

Migration 30 ran against the text-era schema (user_networks.cidr TEXT, users.web_auth TEXT) — migration 33 later converted both to binary/enum form, s

replayMigrationsBefore applies every registered migration with Version < stop to db, mirroring store.go's runner (NoTxSQL first, then the transactiona

requireUser extracts the authenticated user from the request context. Writes a 401 JSON response and returns false if the user is not authenticated.

setBuiltInAdapterVersion records the current builtin version for an adapter ID. Guarded by builtInMu since this map is per-Store but can still be read

setCSRFCookie issues a new CSRF cookie, mirroring the lifetime of the session cookie it accompanies.

============================================================================= Helpers ================================================================

BuiltinAdapterAllowedHosts returns the additional allowed hosts declared by a built-in adapter, or empty string if the adapter is not built-in (or a f

DoWithResult executes fn with exponential backoff retry and returns a result.