CSP violation reports: ingest endpoint, ClickHouse storage, UI view

- POST /v1/csp collects browser CSP reports in both wire formats (legacy application/csp-report and Reporting API application/reports+json), with CORS limited to the operator's domains (any subdomain of k6n.net, tornberg.me, knatofs.se) and preflight handling. - Reports are stored in a dedicated typed ClickHouse table (csp_reports, 90-day TTL) with a JSONL file fallback (OTEL_CSP_PATH). - New authenticated view endpoints /api/csp/reports and /api/csp/summary plus a 'CSP reports' screen in the UI (tab 12) with time window, site and directive filters and report drill-down. - Documented in instrumentation.md; unit tests for parsing/handlers/file store and an env-gated ClickHouse integration test.
2026-09-23 16:50:43 +00:00
1 parent 9685de64da
commit 36f00d49b9
@@ -0,0 +1,187 @@
+package collector
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.tornberg.me/go-otel/internal/storage"
+)
+
+// cspMemStore records ingested reports and serves canned query results.
+type cspMemStore struct {
+	reports []storage.CSPReport
+}
+
+func (s *cspMemStore) AppendCSPReport(_ context.Context, r storage.CSPReport) error {
+	s.reports = append(s.reports, r)
+	return nil
+}
+
+func (s *cspMemStore) CSPReports(_ context.Context, q storage.CSPReportsQuery) ([]storage.CSPReport, error) {
+	return s.reports, nil
+}
+
+func (s *cspMemStore) CSPSummary(_ context.Context, _ int) (storage.CSPSummary, error) {
+	return storage.CSPSummary{Total: uint64(len(s.reports))}, nil
+}
+
+func TestParseCSPReportsLegacy(t *testing.T) {
+	body := []byte(`{"csp-report":{
+		"document-uri":"https://app.k6n.net/page?x=1",
+		"referrer":"https://k6n.net/",
+		"blocked-uri":"https://evil.example.com/tracker.js",
+		"violated-directive":"script-src-elem",
+		"effective-directive":"script-src-elem",
+		"original-policy":"script-src 'self'; default-src 'self'",
+		"disposition":"enforce",
+		"status-code":200,
+		"script-sample":"evil()"}}`)
+	reports := parseCSPReports(body)
+	if len(reports) != 1 {
+		t.Fatalf("want 1 report, got %d", len(reports))
+	}
+	r := reports[0]
+	if r.DocumentURL != "https://app.k6n.net/page?x=1" || r.BlockedURL != "https://evil.example.com/tracker.js" {
+		t.Errorf("urls not parsed: %+v", r)
+	}
+	if r.EffectiveDirective != "script-src-elem" || r.Disposition != "enforce" || r.StatusCode != 200 {
+		t.Errorf("directives/disposition/status not parsed: %+v", r)
+	}
+	if r.OriginalPolicy != "script-src 'self'; default-src 'self'" || r.Sample != "evil()" {
+		t.Errorf("policy/sample not parsed: %+v", r)
+	}
+}
+
+func TestParseCSPReportsReportingAPI(t *testing.T) {
+	body := []byte(`[
+		{"age":1,"type":"csp-violation","url":"https://docs.tornberg.me/a","user_agent":"Mozilla/5.0",
+		 "body":{"documentURL":"https://docs.tornberg.me/a","blockedURL":"inline","effectiveDirective":"style-src",
+		          "disposition":"report","statusCode":200,"sample":"color:red","sourceFile":"x.js"}},
+		{"age":2,"type":"deprecation","body":{}}]`)
+	reports := parseCSPReports(body)
+	if len(reports) != 1 {
+		t.Fatalf("want only the csp-violation report, got %d", len(reports))
+	}
+	r := reports[0]
+	if r.EffectiveDirective != "style-src" || r.UserAgent != "Mozilla/5.0" || r.ReportType != "csp-violation" {
+		t.Errorf("reporting-api fields not parsed: %+v", r)
+	}
+}
+
+func TestParseCSPReportsRejectsGarbage(t *testing.T) {
+	for _, body := range []string{"", "not json", `{"nope":1}`, `[]`, `[{"body":{}}]`} {
+		if got := parseCSPReports([]byte(body)); got != nil {
+			t.Errorf("parseCSPReports(%q) = %+v, want nil", body, got)
+		}
+	}
+}
+
+func TestHandleCSPIngest(t *testing.T) {
+	store := &cspMemStore{}
+	c := New(nil, 10, nil)
+	c.SetCSPStore(store)
+
+	// Legacy payload via sendBeacon (text/plain, no UA in body).
+	req := httptest.NewRequest(http.MethodPost, "/v1/csp", strings.NewReader(
+		`{"csp-report":{"document-uri":"https://app.k6n.net/p","blocked-uri":"https://ads.knatofs.se/x.js",
+		  "effective-directive":"script-src","disposition":"enforce"}}`))
+	req.Header.Set("User-Agent", "TestUA/1.0")
+	req.RemoteAddr = "203.0.113.7:1234"
+	rec := httptest.NewRecorder()
+	c.HandleCSPIngest(rec, req)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("legacy ingest: code=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if len(store.reports) != 1 {
+		t.Fatalf("legacy ingest: stored %d reports", len(store.reports))
+	}
+	got := store.reports[0]
+	if got.Site != "app.k6n.net" || got.SourceIP != "203.0.113.7" {
+		t.Errorf("site/source ip not derived: %+v", got)
+	}
+	if got.UserAgent != "TestUA/1.0" || got.ReportType != "csp-report" || got.ID == "" {
+		t.Errorf("ua/type/id not finished: %+v", got)
+	}
+
+	// Reporting API batch.
+	req = httptest.NewRequest(http.MethodPost, "/v1/csp", strings.NewReader(
+		`[{"type":"csp-violation","body":{"documentURL":"https://www.tornberg.me/","blockedURL":"https://b.example/"}}]`))
+	req.Header.Set("X-Forwarded-For", "198.51.100.9, 10.0.0.1")
+	rec = httptest.NewRecorder()
+	c.HandleCSPIngest(rec, req)
+	if rec.Code != http.StatusNoContent || len(store.reports) != 2 {
+		t.Fatalf("api ingest: code=%d stored=%d", rec.Code, len(store.reports))
+	}
+	if got := store.reports[1]; got.Site != "www.tornberg.me" || got.SourceIP != "198.51.100.9" {
+		t.Errorf("api ingest normalization: %+v", got)
+	}
+
+	// Garbage is rejected; reads stay 405.
+	if rec := post(c, "/v1/csp", "garbage"); rec.Code != http.StatusBadRequest {
+		t.Errorf("garbage: code=%d", rec.Code)
+	}
+	getRec := httptest.NewRecorder()
+	c.HandleCSPIngest(getRec, httptest.NewRequest(http.MethodGet, "/v1/csp", nil))
+	if getRec.Code != http.StatusMethodNotAllowed {
+		t.Errorf("GET: code=%d", getRec.Code)
+	}
+}
+
+func post(c *Collector, path, body string) *httptest.ResponseRecorder {
+	rec := httptest.NewRecorder()
+	c.HandleCSPIngest(rec, httptest.NewRequest(http.MethodPost, path, strings.NewReader(body)))
+	return rec
+}
+
+func TestHandleCSPViews(t *testing.T) {
+	store := &cspMemStore{reports: []storage.CSPReport{{
+		ID: "abc", Timestamp: time.Now(), Site: "app.k6n.net", EffectiveDirective: "script-src",
+	}}}
+	c := New(nil, 10, nil)
+	c.SetCSPStore(store)
+
+	rec := httptest.NewRecorder()
+	c.HandleCSPReports(rec, httptest.NewRequest(http.MethodGet, "/api/csp/reports?site=app.k6n.net&hours=24", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("reports: code=%d", rec.Code)
+	}
+	var list struct {
+		Reports []storage.CSPReport `json:"reports"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil || len(list.Reports) != 1 {
+		t.Fatalf("reports: err=%v body=%s", err, rec.Body.String())
+	}
+
+	rec = httptest.NewRecorder()
+	c.HandleCSPSummary(rec, httptest.NewRequest(http.MethodGet, "/api/csp/summary?hours=168", nil))
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `"total":1`) {
+		t.Fatalf("summary: code=%d body=%s", rec.Code, rec.Body.String())
+	}
+
+	// Without a store both views answer 501 politely.
+	c2 := New(nil, 10, nil)
+	rec = httptest.NewRecorder()
+	c2.HandleCSPReports(rec, httptest.NewRequest(http.MethodGet, "/api/csp/reports", nil))
+	if rec.Code != http.StatusNotImplemented {
+		t.Fatalf("no store: code=%d", rec.Code)
+	}
+}
+
+func TestFinishCSPReportIDStable(t *testing.T) {
+	now := time.Date(2025, 1, 2, 3, 4, 5, 0, time.UTC)
+	a := finishCSPReport(storage.CSPReport{DocumentURL: "https://a.k6n.net/", BlockedURL: "https://b/"}, now, "1.2.3.4", "UA")
+	b := finishCSPReport(storage.CSPReport{DocumentURL: "https://a.k6n.net/", BlockedURL: "https://b/"}, now, "5.6.7.8", "Other")
+	if a.ID != b.ID {
+		// The id intentionally covers report content only, not delivery
+		// context, so duplicate re-deliveries share it.
+		t.Errorf("ids differ across delivery context: %s vs %s", a.ID, b.ID)
+	}
+	if a.Site != "a.k6n.net" || a.Timestamp != now.UTC() {
+		t.Errorf("finish: %+v", a)
+	}
+}