- POST /v1/csp collects browser CSP reports in both wire formats (legacy
application/csp-report and Reporting API application/reports+json), with
CORS limited to the operator's domains (any subdomain of k6n.net,
tornberg.me, knatofs.se) and preflight handling.
- Reports are stored in a dedicated typed ClickHouse table (csp_reports,
90-day TTL) with a JSONL file fallback (OTEL_CSP_PATH).
- New authenticated view endpoints /api/csp/reports and /api/csp/summary
plus a 'CSP reports' screen in the UI (tab 12) with time window, site and
directive filters and report drill-down.
- Documented in instrumentation.md; unit tests for parsing/handlers/file
store and an env-gated ClickHouse integration test.
Verified end to end against users.k6n.net: device grant approved in a
browser, refresh token stored 0600, access token carries aud
[dev-console, https://otel.k6n.net].
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Normalize radii, drop shadows/blur and font-black, and document the
one-view-at-a-time plan in AGENTS.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Restore IssuesVisualizer redesign reverted by merge 67ce419 and re-apply
Needle triage/test additions. Migrate all remaining screens off the MD3
palette, raw Tailwind colors, gradients and Material Symbols. Remove the
legacy theme block and fonts, drop the duplicate tab strip, rebuild
TelemetryFilters on FilterBar, and document status in AGENTS.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
developer
mats