feat: make MikroTik blocklist cumulative via git history

app/firewall.py

@@ -182,7 +182,16 @@ class MikrotikFirewall:
                        blocked_ipv6: Iterable[str],
                        dry_run: bool = False,
                        report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
-        """Synchronize the Blocked list with scan targets and audit the result."""
+        """Synchronize the Blocked list cumulatively and audit the result.
+
+        The blocklist is grow-only: targets are added when present in the
+        complete set (all git history of the blocklist files + the current
+        working files + this scan's targets) and never removed automatically.
+        Only router entries absent from the complete set — i.e. never blocked
+        by the system — are pruned. See ``app.blocklist_history``.
+        """
+        from .blocklist_history import compute_changes, cumulative_blocklist
+
         desired_ipv4 = set(blocked_ipv4)
         desired_ipv6 = set(blocked_ipv6)
         current_ipv4 = self.get_address_list_ipv4(BLOCKLIST_NAME)
@@ -193,13 +202,19 @@ class MikrotikFirewall:
             whitelisted_ipv4.update(self.get_address_list_ipv4(name))
             whitelisted_ipv6.update(self.get_address_list_ipv6(name))
 
-        changes = {
-            "added_ipv4": sorted(desired_ipv4 - current_ipv4 - whitelisted_ipv4),
-            "added_ipv6": sorted(desired_ipv6 - current_ipv6 - whitelisted_ipv6),
-            "removed_ipv4": sorted(current_ipv4 - desired_ipv4),
-            "removed_ipv6": sorted(current_ipv6 - desired_ipv6),
-            "dry_run": dry_run,
-        }
+        v4_path = os.path.join(
+            report_dir, "app", "data", "blocklist_ipv4.txt")
+        v6_path = os.path.join(
+            report_dir, "app", "data", "blocklist_ipv6.txt")
+        complete_v4, complete_v6 = cumulative_blocklist(
+            v4_path, v6_path, desired_ipv4, desired_ipv6)
+
+        changes = compute_changes(
+            current_ipv4, current_ipv6,
+            complete_v4, complete_v6,
+            whitelisted_ipv4, whitelisted_ipv6)
+        changes["dry_run"] = dry_run
+
         if not dry_run:
             for ip in changes["removed_ipv4"]:
                 self.execute_command(