Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/middleware/middleware.go

@@ -3,21 +3,26 @@
 package middleware
 
 import (
+	"context"
 	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
+	"strconv"
 	"sync"
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
-	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
+	"github.com/prometheus/client_golang/prometheus"
+	httpmetrics "github.com/slok/go-http-metrics/metrics"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/logfield"
-	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/referer"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
@@ -65,18 +70,19 @@ const (
 	//	url, useragent, referer   3*(512+11) = 1569
 	//	request_id                    128+11 =  139
 	//	method                         32+11 =   43
-	//	fixed portion                        =  336
+	//	fixed portion                        =  405
 	//	                                        ----
-	//	                                        2087
+	//	                                        2156
 	//
 	// The 512 is logfield.MaxBytes; the 11 is the truncation marker,
 	// charged on top of each budget rather than inside it.
 	//
 	// The fixed portion is the JSON punctuation, the field names, the
-	// level and the message, both timestamps at their longest, an IPv6
-	// remoteIP with a zone, a three-digit status and a full-width int64
-	// latency. Stated at 2560 so the figure carries headroom rather
-	// than sitting on the arithmetic.
+	// level and the message, both timestamps at their longest, remoteIP
+	// and clientIP each charged as an IPv6 address with a zone, a
+	// three-digit status and a full-width int64 latency. Stated at 2560
+	// so the figure carries headroom rather than sitting on the
+	// arithmetic.
 	//
 	// The tty text handler in internal/logger is covered by the same
 	// figure. logfield.EncodedBytes charges every rune at least what
@@ -84,20 +90,20 @@ const (
 	// bytes strconv.Quote spends on a non-printable rune at or above
 	// U+10000, which is four more than the JSON handler ever spends —
 	// so each budget bounds the encoded field under either handler.
-	// The text handler's fixed portion is 286, the smaller of the two,
-	// which puts its worst case at 2037.
+	// The text handler's fixed portion is 351, the smaller of the two,
+	// which puts its worst case at 2102.
 	//
 	// It is also the ceiling on every OTHER line this service writes
 	// THROUGH SLOG that carries text an UNAUTHENTICATED client
 	// supplies. Those lines — the MaxBodySize rejection, the CSRF
-	// rejection, the rate-limit rejection, the unauthenticated-request
-	// and unknown-entrypoint DEBUG lines, the failed-login DEBUG
-	// lines, and the two login-throttle WARN lines ("login failure
-	// limit exceeded" in loginguard.go and "password verification
-	// capacity exhausted" in internal/handlers/auth.go) — spend the
-	// same per-field budgets, and each carries strictly fewer
-	// client-supplied fields than the access log does,
-	// so none of them can reach a width the access log cannot. That is
+	// rejection, the unauthenticated-request DEBUG line, the
+	// failed-login DEBUG lines, and the two login-throttle WARN
+	// lines ("login failure limit exceeded" in loginguard.go and
+	// "password verification capacity exhausted" in
+	// internal/handlers/auth.go) — spend the same per-field budgets,
+	// and each carries strictly fewer client-supplied fields than the
+	// access log does, so none of them can reach a width the access
+	// log cannot. That is
 	// asserted directly, per line and under both handlers, rather than
 	// left to the reasoning: see logbound_test.go in this package and
 	// in internal/handlers.
@@ -109,24 +115,24 @@ const (
 	// a caller on a parameterised route would supply, which is the
 	// only way those caps can be pinned at all.
 	//
-	// One writer in that set is not a handler's own slog call. The
-	// GORM adapter in internal/gormlog logs the statement with the
-	// client-chosen parameter already interpolated into it, which on
-	// the receiver and login lookups is exactly the value the budgets
-	// above exist for. Its widest line spends two logfield.MaxBytes
-	// budgets — the statement and the driver error — against a fixed
-	// portion smaller than this one's, and
-	// internal/gormlog/gormlog_test.go asserts every line it emits
-	// against this constant directly rather than leaving it as
-	// arithmetic.
+	// The GORM adapter in internal/gormlog writes through slog as well.
+	// It logs each statement with its placeholders rather than the
+	// values bound to them (see its ParamsFilter), so the key a client
+	// sends to the receiver or login lookup does not reach its lines.
+	// Its widest line spends two logfield.MaxBytes budgets — the
+	// statement and the driver error — against a fixed portion smaller
+	// than this one's, and internal/gormlog/gormlog_test.go asserts
+	// every line it emits against this constant directly rather than
+	// leaving it as arithmetic.
 	//
 	// What it does NOT cover, so that the figure above is not read as
 	// more than it is:
 	//
 	//   - Lines carrying an AUTHENTICATED operator's own input, which
 	//     are not truncated at all: the webhook name on "webhook
-	//     created" and the target host on "target URL blocked by SSRF
-	//     protection" (both internal/handlers/source_management.go),
+	//     created" (internal/handlers/webhook_create.go) and the target
+	//     host on "target URL blocked by SSRF protection"
+	//     (internal/handlers/target_create.go),
 	//     and target_name in internal/delivery/engine.go and
 	//     target_http.go. Each is bounded only by the 1 MB form body
 	//     cap, so a 100 KB name writes one line of roughly 600 KB.
@@ -144,14 +150,21 @@ const (
 	MaxAccessLogLineBytes = 2560
 )
 
+// ReceiverRoute is the route pattern the webhook receiver is served
+// at. Its path carries the entrypoint UUID, which is the receiver's
+// only credential, so the log lines this package writes name a
+// request on this route by the pattern, never by its path.
+const ReceiverRoute = "/h/{uuid}"
+
 //nolint:revive // MiddlewareParams is a standard fx naming convention.
 type MiddlewareParams struct {
 	fx.In
 
-	Logger  *logger.Logger
-	Globals *globals.Globals
-	Config  *config.Config
-	Session *session.Session
+	Logger   *slog.Logger
+	Globals  *globals.Globals
+	Config   *config.Config
+	Session  *session.Session
+	Registry *prometheus.Registry
 }
 
 // Middleware provides HTTP middleware for logging, CORS, auth, and
@@ -161,6 +174,12 @@ type Middleware struct {
 	params  *MiddlewareParams
 	session *session.Session
 
+	// metricsRecorder records the inbound HTTP metrics on
+	// params.Registry. It is built once per Middleware and Metrics
+	// reuses it, because building it registers its collectors, and a
+	// second registration on the same registry panics.
+	metricsRecorder httpmetrics.Recorder
+
 	// loginGuard counts failed credential verifications and bounds
 	// concurrent password hashing. It is built on first use so that
 	// every construction path gets one; see guard().
@@ -177,8 +196,11 @@ func New(
 ) (*Middleware, error) {
 	s := new(Middleware)
 	s.params = &params
-	s.log = params.Logger.Get()
+	s.log = params.Logger
 	s.session = params.Session
+	s.metricsRecorder = prommetrics.NewRecorder(
+		prommetrics.Config{Registry: params.Registry},
+	)
 
 	return s, nil
 }
@@ -199,6 +221,28 @@ func ipFromHostPort(hp string) string {
 	return h
 }
 
+// RemoteIP returns the address of the connecting peer, without its
+// port. Behind a reverse proxy it is the proxy. Every log line that
+// names the client logs it as remoteIP, next to clientIP.
+func RemoteIP(r *http.Request) string {
+	return ipFromHostPort(r.RemoteAddr)
+}
+
+// clientIPKey is the request context key under which Logging stores
+// the value ClientIP returns.
+type clientIPKey struct{}
+
+// ClientIP returns the address the request is attributed to, which
+// Logging works out once per request with clientAddr in ratelimit.go
+// and logs as clientIP. The other lines that name the client read it
+// from here, so all of them agree. It is empty for a request Logging
+// has not seen.
+func ClientIP(r *http.Request) string {
+	ip, _ := r.Context().Value(clientIPKey{}).(string)
+
+	return ip
+}
+
 type loggingResponseWriter struct {
 	http.ResponseWriter
 
@@ -217,26 +261,35 @@ func (lrw *loggingResponseWriter) WriteHeader(code int) {
 	lrw.ResponseWriter.WriteHeader(code)
 }
 
+// Unwrap lets http.ResponseController reach the writer underneath, so
+// a handler can still flush or set a write deadline through the access
+// log.
+func (lrw *loggingResponseWriter) Unwrap() http.ResponseWriter {
+	return lrw.ResponseWriter
+}
+
 // concreteLogURL renders the request's own URL for the access log
 // branches that keep it, with the query string replaced by a fixed
 // marker.
 //
 // The path on those branches is bounded by the service's routes or by
-// the operator's data — a 2xx on the receiver means the UUID named a
-// stored entrypoint, a 2xx under /s means the file is in the embedded
-// tree. The query is not bounded by anything: /.well-known/healthcheck
-// and /s/* take no authentication and sit behind no rate limiter, and
-// /pages/login behind only the login limiter, so any of them will
-// answer 200 to a URL carrying an arbitrary number of arbitrary bytes
-// after the '?'. Keeping the path and dropping the query is what makes
-// this branch as bounded as the pattern branches below.
+// the operator's data — a 2xx under /s means the file is in the
+// embedded tree. The query is not bounded by anything:
+// /.well-known/healthcheck and /s/* take no authentication and sit
+// behind no rate limiter, and /pages/login behind only the login
+// limiter, so any of them will answer 200 to a URL carrying an
+// arbitrary number of arbitrary bytes after the '?'. Keeping the path
+// and dropping the query is what makes this branch as bounded as the
+// pattern branches below.
 //
-// Nothing debuggable is lost. One route in the service reads a query
-// parameter at all — `page`, on the authenticated pagination links in
-// internal/handlers/source_management.go — and the alternatives that
-// would preserve more (a key count, a key allowlist) all require
-// parsing an attacker-sized query on every request, which is work an
-// unauthenticated client would then be choosing for us.
+// Nothing debuggable is lost. The only query parameters the service
+// reads are the login page's `next`, the page to return to,
+// `notice`, which names the line a page shows after an action, and
+// the event log's `show`, which picks the events it lists. The
+// alternatives that would preserve more (a key count, a key
+// allowlist) all require parsing an attacker-sized query on every
+// request, which is work an unauthenticated client would then be
+// choosing for us.
 func concreteLogURL(r *http.Request) string {
 	path := r.URL.EscapedPath()
 
@@ -249,36 +302,40 @@ func concreteLogURL(r *http.Request) string {
 
 // accessLogURL returns the value for the access log's url field.
 //
-// 2xx and 5xx responses get the concrete path (see concreteLogURL). A
-// success resolved against a static route or against the operator's
-// own data — on the receiver, a 2xx means the UUID named a stored
-// entrypoint — and a server error is our own bug, where the exact URL
-// is the primary evidence and which no client can provoke at will.
+// On ReceiverRoute it is the route pattern whatever the status, so
+// the entrypoint UUID in the path is never logged. A request chi never
+// routed gets unmatchedRoute whatever the status, for the same reason:
+// in dev, CORS answers a preflight to the receiver before routing.
+//
+// On every other route, 2xx and 5xx responses get the concrete path
+// (see concreteLogURL). A success resolved against a static route or
+// against the operator's own data, and a server error is our own bug,
+// where the exact URL is the primary evidence and which no client can
+// provoke at will.
 //
 // 3xx and 4xx responses get the chi route pattern instead. Those are
-// the outcomes an unauthenticated client drives for free: 404 or 429
-// on any invented /webhook/ path, 303 to the login page on any
-// invented /user/ path. Logging the concrete URL there lets a flood
-// write attacker-chosen text, of attacker-chosen length, into the
-// operator's log at one line per request. The pattern comes from the
-// router's own table, so it is bounded by the service's routes while
-// still naming which class of request was rejected.
+// the outcomes an unauthenticated client drives for free, such as a
+// 303 to the login page on any invented /user/ path. Logging the
+// concrete URL there lets a flood write attacker-chosen text, of
+// attacker-chosen length, into the operator's log at one line per
+// request. The pattern comes from the router's own table, so it is
+// bounded by the service's routes while still naming which class of
+// request was rejected.
 //
 // The pattern is only populated once routing has run, so this must be
 // called after the handler returns, not before.
 func accessLogURL(r *http.Request, status int) string {
+	pattern := routePatternID(r.Context())
+	if pattern == ReceiverRoute || pattern == unmatchedRoute {
+		return pattern
+	}
+
 	if status < http.StatusMultipleChoices ||
 		status >= http.StatusInternalServerError {
 		return concreteLogURL(r)
 	}
 
-	if rc := chi.RouteContext(r.Context()); rc != nil {
-		if pattern := rc.RoutePattern(); pattern != "" {
-			return pattern
-		}
-	}
-
-	return unmatchedRoute
+	return pattern
 }
 
 // Logging returns middleware that logs each HTTP request with
@@ -293,6 +350,13 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 			lrw := newLoggingResponseWriter(w)
 			ctx := r.Context()
 
+			// When RemoteAddr is not an address, the peer's own
+			// text is all the request can be attributed to.
+			clientIP := RemoteIP(r)
+			if addr, ok := s.clientAddr(r); ok {
+				clientIP = addr.String()
+			}
+
 			defer func() {
 				latency := time.Since(start)
 				requestID := ""
@@ -324,16 +388,20 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 						requestID, maxLogRequestIDBytes,
 					),
 					"referer", logfield.Truncate(
-						r.Referer(), logfield.MaxBytes,
+						referer.SchemeAndHost(r.Referer()),
+						logfield.MaxBytes,
 					),
 					"proto", r.Proto,
-					"remoteIP", ipFromHostPort(r.RemoteAddr),
+					"remoteIP", RemoteIP(r),
+					"clientIP", clientIP,
 					"status", lrw.statusCode,
 					"latency_ms", latency.Milliseconds(),
 				)
 			}()
 
-			next.ServeHTTP(lrw, r)
+			next.ServeHTTP(lrw, r.WithContext(
+				context.WithValue(ctx, clientIPKey{}, clientIP),
+			))
 		})
 	}
 }
@@ -366,6 +434,30 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	}
 }
 
+// NextParam is the query parameter on the login redirect, and the
+// login form field, that holds the page to return to after login.
+const NextParam = "next"
+
+// MaxNextBytes bounds the NextParam value. The login page writes it
+// into its form, and every page is rendered into a buffer first, so
+// without a bound a request would choose the size of that buffer.
+const MaxNextBytes = 2048
+
+// loginURL is the login page RequireAuth redirects to. A GET carries
+// its own path and query in NextParam so that logging in returns to
+// it, unless they are longer than MaxNextBytes; loginDestination in
+// the handlers package checks whether that value is safe to follow.
+// Other methods carry nothing, since a redirect cannot repeat them.
+func loginURL(r *http.Request) string {
+	next := r.URL.RequestURI()
+
+	if r.Method != http.MethodGet || len(next) > MaxNextBytes {
+		return "/pages/login"
+	}
+
+	return "/pages/login?" + url.Values{NextParam: {next}}.Encode()
+}
+
 // RequireAuth returns middleware that checks for a valid session.
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
@@ -381,7 +473,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					"error", err,
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return
@@ -409,7 +501,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					),
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return
@@ -454,18 +546,25 @@ func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 }
 
 // SecurityHeaders returns middleware that sets production security
-// headers on every response: HSTS, X-Content-Type-Options,
-// X-Frame-Options, CSP, Referrer-Policy, and Permissions-Policy.
+// headers on every response: HSTS (unless HSTS_MAX_AGE is zero),
+// X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, and
+// Permissions-Policy. The CSP takes scripts and styles only from
+// files on this origin, so a template may hold no inline script,
+// event handler or style attribute.
 func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
+	maxAge := s.params.Config.HSTSMaxAge
+	hsts := "max-age=" + strconv.FormatInt(int64(maxAge/time.Second), 10) +
+		"; includeSubDomains; preload"
+
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			w.Header().Set(
-				"Strict-Transport-Security",
-				"max-age=63072000; includeSubDomains; preload",
-			)
+			if maxAge > 0 {
+				w.Header().Set("Strict-Transport-Security", hsts)
+			}
+
 			w.Header().Set(
 				"X-Content-Type-Options", "nosniff",
 			)
@@ -473,8 +572,8 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 			w.Header().Set(
 				"Content-Security-Policy",
 				"default-src 'self'; "+
-					"script-src 'self' 'unsafe-inline'; "+
-					"style-src 'self' 'unsafe-inline'",
+					"script-src 'self'; "+
+					"style-src 'self'",
 			)
 			w.Header().Set(
 				"Referrer-Policy",
@@ -519,7 +618,10 @@ func bodyLimitedMethod(method string) bool {
 }
 
 // MaxBodySize returns middleware that limits the size of
-// POST/PUT/PATCH request bodies to maxBytes. It must be registered
+// POST/PUT/PATCH request bodies to maxBytes. A request with any other
+// method passes through uncapped, deliberately: no route behind it
+// reads a body on GET, HEAD or DELETE. A handler that starts to needs
+// its method added to bodyLimitedMethod first. It must be registered
 // before any middleware that parses the body — notably CSRF, which
 // calls r.PostFormValue — so that form parsing happens under this
 // cap rather than net/http's 10 MB default.
@@ -560,7 +662,7 @@ func (s *Middleware) MaxBodySize(
 				// internal/server/routes.go), so an
 				// unauthenticated client reaches it with a path
 				// of its own choosing and its own length —
-				// POST /source/<8 KB>/edit with an oversize
+				// POST /hook/<8 KB>/edit with an oversize
 				// declared Content-Length costs nothing to
 				// send. At WARN, on by default, that is a
 				// write into the operator's log sized by the