- POST /v1/csp collects browser CSP reports in both wire formats (legacy
application/csp-report and Reporting API application/reports+json), with
CORS limited to the operator's domains (any subdomain of k6n.net,
tornberg.me, knatofs.se) and preflight handling.
- Reports are stored in a dedicated typed ClickHouse table (csp_reports,
90-day TTL) with a JSONL file fallback (OTEL_CSP_PATH).
- New authenticated view endpoints /api/csp/reports and /api/csp/summary
plus a 'CSP reports' screen in the UI (tab 12) with time window, site and
directive filters and report drill-down.
- Documented in instrumentation.md; unit tests for parsing/handlers/file
store and an env-gated ClickHouse integration test.
developer