fix(backend): rate-limit and cap report ingest, drop wildcard CORS (closes #20)

POST /api/v1/reports stays unauthenticated but is bounded. Each client
address, as the trusted-proxy logic resolves it, may send
REPORTS_PER_MINUTE reports a minute (default 60, counted by
go-chi/httprate over a sliding minute); past that it gets 429 with
Retry-After. reportbuf refuses a report that would take the report
files past DATA_DIR_MAX_BYTES (default 1 GiB), counting the files
already in DATA_DIR and unwritten reports at their uncompressed size;
the handler answers 507. CORS adds nothing unless CORS_ALLOWED_ORIGINS
lists origins. A limit that is not a positive number, or an origin
that is not a plain scheme://host[:port], stops the server from
starting.

Model: opus-5-5

backend/internal/handlers/report.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+
+	"sneak.berlin/go/netwatch/internal/reportbuf"
 )
 
 // maxLoggedFieldBytes bounds untrusted text (string fields,
@@ -55,10 +57,9 @@ func (s *Handlers) HandleReport() http.HandlerFunc {
 
 		err = s.buf.Append(rpt)
 		if err != nil {
-			s.log.Error("failed to buffer report", "error", err)
 			s.respondJSON(w, r,
 				&response{Status: "error"},
-				http.StatusInternalServerError,
+				s.appendErrorStatus(err),
 			)
 
 			return
@@ -88,6 +89,21 @@ func (s *Handlers) decodeErrorStatus(err error) int {
 	return http.StatusBadRequest
 }
 
+// appendErrorStatus logs a failure to store a report and returns
+// the status to send: 507 when the report files are at their size
+// cap, otherwise 500.
+func (s *Handlers) appendErrorStatus(err error) int {
+	if errors.Is(err, reportbuf.ErrFull) {
+		s.log.Warn("report refused: report files at their size cap")
+
+		return http.StatusInsufficientStorage
+	}
+
+	s.log.Error("failed to buffer report", "error", err)
+
+	return http.StatusInternalServerError
+}
+
 // logReportReceived logs an accepted report. Untrusted fields are
 // bounded (client_id, timestamp) or reduced to a length
 // (geo_bytes) so the raw attacker-controlled body never reaches

backend/internal/handlers/report_test.go

@@ -13,6 +13,7 @@ import (
 
 	"sneak.berlin/go/netwatch/internal/handlers"
 	"sneak.berlin/go/netwatch/internal/middleware"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
 )
 
 var errStorageFailed = errors.New("storage failed")
@@ -66,6 +67,32 @@ func TestHandleReportStorageFailureIsNon2xx(t *testing.T) {
 	}
 }
 
+// TestHandleReportFullIs507 checks the answer when the report files
+// are at their size cap: 507 and the usual error body, which tells
+// the client nothing more.
+func TestHandleReportFullIs507(t *testing.T) {
+	t.Parallel()
+
+	h := newTestHandlers(stubAppender{err: reportbuf.ErrFull}, io.Discard)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(t.Context(),
+		http.MethodPost, "/api/v1/reports",
+		strings.NewReader(`{"clientId":"c1","hosts":[]}`),
+	)
+
+	h.HandleReport().ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusInsufficientStorage {
+		t.Fatalf("status = %d, want %d",
+			rec.Code, http.StatusInsufficientStorage)
+	}
+
+	if got := rec.Body.String(); got != "{\"status\":\"error\"}\n" {
+		t.Errorf("body = %q, want %q", got, "{\"status\":\"error\"}\n")
+	}
+}
+
 func TestHandleReportMalformedJSONIs400(t *testing.T) {
 	t.Parallel()