fix(backend): report ingest correctness: 500 on a refused report, 413 on oversize, global body cap (closes #23)

A report the buffer refuses now returns 500 instead of a false `ok`.
Reports reach disk later, so a failed disk write is still answered 200
and shows in the log, and at shutdown as a failed stop with a non-zero
exit. An over-limit body returns 413; malformed JSON stays 400. A
MaxBodyBytes middleware caps every route at 1 MiB; a route group can
only lower that limit. The raw geo blob is no longer logged; client_id,
timestamp and decode error text are cut to 128 bytes before logging.
Panic recovery logs the panic value and stack through slog.

Model: opus-5-5

backend/internal/handlers/report.go

@@ -2,10 +2,14 @@ package handlers
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 )
 
-const maxReportBodyBytes = 1 << 20 // 1 MiB
+// maxLoggedFieldBytes bounds untrusted text (string fields,
+// decode error text) before it is logged, so a caller cannot
+// inflate log volume with an oversized value.
+const maxLoggedFieldBytes = 128
 
 type reportSample struct {
 	T       int64   `json:"t"`
@@ -35,48 +39,80 @@ func (s *Handlers) HandleReport() http.HandlerFunc {
 	}
 
 	return func(w http.ResponseWriter, r *http.Request) {
-		r.Body = http.MaxBytesReader(
-			w, r.Body, maxReportBodyBytes,
-		)
-
 		var rpt report
 
-		err := json.NewDecoder(r.Body).Decode(&rpt)
+		err := s.decodeJSON(w, r, &rpt)
 		if err != nil {
-			s.log.Error("failed to decode report",
-				"error", err,
-			)
 			s.respondJSON(w, r,
 				&response{Status: "error"},
-				http.StatusBadRequest,
+				s.decodeErrorStatus(err),
 			)
 
 			return
 		}
 
-		totalSamples := 0
-		for _, h := range rpt.Hosts {
-			totalSamples += len(h.History)
-		}
+		s.logReportReceived(rpt)
 
-		s.log.Info("report received",
-			"client_id", rpt.ClientID,
-			"timestamp", rpt.Timestamp,
-			"host_count", len(rpt.Hosts),
-			"total_samples", totalSamples,
-			"geo", string(rpt.Geo),
-		)
-
-		bufErr := s.buf.Append(rpt)
-		if bufErr != nil {
-			s.log.Error("failed to buffer report",
-				"error", bufErr,
+		err = s.buf.Append(rpt)
+		if err != nil {
+			s.log.Error("failed to buffer report", "error", err)
+			s.respondJSON(w, r,
+				&response{Status: "error"},
+				http.StatusInternalServerError,
 			)
+
+			return
 		}
 
-		s.respondJSON(w, r,
-			&response{Status: "ok"},
-			http.StatusOK,
-		)
+		s.respondJSON(w, r, &response{Status: "ok"}, http.StatusOK)
 	}
 }
+
+// decodeErrorStatus logs a report decode failure and returns the
+// status to send: 413 when the body exceeded the size limit,
+// otherwise 400 for malformed JSON.
+func (s *Handlers) decodeErrorStatus(err error) int {
+	var tooLarge *http.MaxBytesError
+	if errors.As(err, &tooLarge) {
+		s.log.Warn("report body too large", "limit_bytes", tooLarge.Limit)
+
+		return http.StatusRequestEntityTooLarge
+	}
+
+	// The decoder's error text can quote request bytes (a whole
+	// oversized number, for example), so it is bounded too.
+	s.log.Error("failed to decode report",
+		"error", boundedForLog(err.Error()),
+	)
+
+	return http.StatusBadRequest
+}
+
+// logReportReceived logs an accepted report. Untrusted fields are
+// bounded (client_id, timestamp) or reduced to a length
+// (geo_bytes) so the raw attacker-controlled body never reaches
+// the log.
+func (s *Handlers) logReportReceived(rpt report) {
+	totalSamples := 0
+	for _, h := range rpt.Hosts {
+		totalSamples += len(h.History)
+	}
+
+	s.log.Info("report received",
+		"client_id", boundedForLog(rpt.ClientID),
+		"timestamp", boundedForLog(rpt.Timestamp),
+		"host_count", len(rpt.Hosts),
+		"total_samples", totalSamples,
+		"geo_bytes", len(rpt.Geo),
+	)
+}
+
+// boundedForLog truncates an untrusted string to a fixed byte
+// bound so an attacker-controlled field cannot dominate the log.
+func boundedForLog(s string) string {
+	if len(s) > maxLoggedFieldBytes {
+		return s[:maxLoggedFieldBytes]
+	}
+
+	return s
+}