Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/referer/referer.go

@@ -0,0 +1,32 @@
+// Package referer reduces a Referer header to its scheme and host, so
+// that a URL path, which on the receiver route carries the entrypoint
+// UUID, never reaches a log line or an error report.
+package referer
+
+import "net/url"
+
+// redacted stands in for a Referer that cannot be reduced to its
+// scheme and host.
+const redacted = "(redacted)"
+
+// SchemeAndHost returns a Referer's scheme and host, never its path or
+// query. The path can be an entrypoint URL, which carries the UUID: a
+// sender that follows a redirect from http:// to https:// sends the
+// URL it was redirected from, and a browser sends the 404 page's URL
+// under /h/ when it fetches that page's stylesheet. A Referer without
+// both a scheme and a host comes back as "(redacted)".
+//
+// It is the access log's referer field, and the Referer header the
+// Sentry hook sends.
+func SchemeAndHost(referer string) string {
+	if referer == "" {
+		return ""
+	}
+
+	parsed, err := url.Parse(referer)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return redacted
+	}
+
+	return parsed.Scheme + "://" + parsed.Host
+}