Named lists policies can test membership against, such as known-bad JA4 fingerprints or allow-listed networks.

Lists belong to an instance and live in :persistent_term, so a membership test on the request path is a lookup with no copying. Replacing a list triggers a global GC scan in the runtime: reload lists when they change, not per request.

There are three kinds of lists:

• exact lists, whose members are compared as terms (put/3);
• CIDR lists, whose members are address ranges and which match any address inside them (put_cidrs/3);
• substring lists, which match any string containing one of their members, case included (put_substrings/3), for user agents and other headers.

Lists can also be configured with the instance, and are then loaded when it starts:

config :my_app, Limen,
  lists: [
    bad_ja4: ["t13d1812h1_85036bcba153_375ca2c5e164"],
    office: {:cidr, ["192.0.2.0/24", "2001:db8::/32"]},
    scrapers: {:substrings, ["SiteSucker", "HTTrack"]}
  ]

In a policy, signal(:user_agent) in list(:scrapers) then holds for any user agent containing SiteSucker or HTTrack. A substring list is searched in one pass, however many members it has.

In a policy, signal(:ja4) in list(:bad_ja4) compiles to member?/3 against the request's instance. Testing a list that was never defined is not an error: it has no members.