Send the chi route pattern to Sentry, not the concrete path (closes #179)

The Sentry SDK builds Request.URL as scheme://host/path from the
concrete path, which on the receiver route is /webhook/<uuid> in full.
That UUID is a write capability, not an identifier: anyone holding it
can post events this service accepts and its targets then deliver. A
third-party tracker has its own retention, access control and deletion
policy, so the rule the local access log follows does not carry across
that boundary.

The BeforeSend hook now rebuilds the URL from the chi route pattern,
on every route rather than by route list, since a route-conditional
rule leaks on any route someone forgets to add. Scheme and host are
kept and everything else in the URL is discarded rather than edited:
the scheme is the CSRF TLS decision the header allowlist relies on,
and the host is whatever the client's Host header carried, which the
allowlisted Host header already sends anyway.

The pattern is reachable only on the error dispatch, where sentryhttp
puts the request on the context the client copies onto the hint. A
finished span captures with a nil hint, so BeforeSendTransaction sees
no context; there and wherever else the pattern is missing the path
falls back to the literal /(redacted), never to the concrete path, and
a URL that will not parse into a scheme is withheld whole. A
transaction event's SDK-built "METHOD /path" name carries the same
capability and is rewritten on the same terms.

internal/server/sentry_test.go

@@ -13,12 +13,13 @@ import (
 
 	"github.com/getsentry/sentry-go"
 	sentryhttp "github.com/getsentry/sentry-go/http"
+	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/server"
 )
 
-// The three markers below are the credentials a captured event could
+// The four markers below are the credentials a captured event could
 // carry off-host, one per field of sentry.Request that the SDK fills
 // from the request without a SendDefaultPII guard.
 const (
@@ -33,6 +34,12 @@ const (
 	// sentryHeaderMarker rides X-Csrf-Token, which gorilla/csrf
 	// accepts in place of the form field.
 	sentryHeaderMarker = "QQSENTRYHEADERMARKERQQ"
+
+	// sentryReceiverUUID is the entrypoint identifier in the path of
+	// a receiver request. It is a write capability: anyone holding
+	// it can POST events this service accepts and its targets then
+	// deliver, so it may not reach a third-party tracker.
+	sentryReceiverUUID = "6d1f9c2a-3b7e-4f58-9a0d-c0ffeebadc0d"
 )
 
 // sentryKeptUserAgent is a non-secret header value planted so the
@@ -58,19 +65,41 @@ func (c *captureTransport) SendEvent(event *sentry.Event) {
 	c.events = append(c.events, event)
 }
 
-// captureThroughSentryHTTP panics inside a form handler wrapped in the
-// real sentryhttp middleware and returns the event the SDK produced.
+// sentryCase drives one request through the real sentryhttp middleware
+// inside a real chi router and returns the events the SDK produced.
 //
-// This is the only construction path on which Request.Data appears:
-// sentryhttp calls Scope.SetRequest, which tees r.Body into a 10 KiB
-// buffer, ParseForm drains the tee, and Scope.ApplyToEvent copies the
-// buffer into the event inside prepareEvent — before BeforeSend runs.
-// A hand-built sentry.NewRequest never reads the body and so cannot
-// regress-test any of it.
+// Routing through a chi mux is load-bearing, not decoration. chi puts
+// its routing context on the request context before the middleware
+// chain runs and fills it in as it matches, so a hand-built request
+// carries no route pattern at all and could not distinguish the hook
+// working from the hook falling back.
 //
-// scrub selects whether the production BeforeSend hooks are installed,
-// so the same path shows both what the SDK collects and what survives.
-func captureThroughSentryHTTP(t *testing.T, scrub bool) *sentry.Event {
+// This is also the only construction path on which Request.Data
+// appears: sentryhttp calls Scope.SetRequest, which tees r.Body into a
+// 10 KiB buffer, ParseForm drains the tee, and Scope.ApplyToEvent
+// copies the buffer into the event inside prepareEvent — before
+// BeforeSend runs. A hand-built sentry.NewRequest never reads the body
+// and so cannot regress-test any of it.
+type sentryCase struct {
+	// scrub selects whether the production BeforeSend hooks are
+	// installed, so the same path shows both what the SDK collects
+	// and what survives.
+	scrub bool
+
+	// tracing enables the transaction dispatch, which the service
+	// leaves off. With it on, a served request produces a
+	// transaction event through BeforeSendTransaction.
+	tracing bool
+
+	// panics selects the error dispatch, via BeforeSend.
+	panics bool
+
+	// request builds the request to serve, given the client whose
+	// hub it must carry.
+	request func(*sentry.Client) *http.Request
+}
+
+func (c sentryCase) capture(t *testing.T) []*sentry.Event {
 	t.Helper()
 
 	transport := &captureTransport{}
@@ -80,57 +109,107 @@ func captureThroughSentryHTTP(t *testing.T, scrub bool) *sentry.Event {
 	)
 	opts.Transport = transport
 
-	if !scrub {
+	if !c.scrub {
 		opts.BeforeSend = nil
 		opts.BeforeSendTransaction = nil
 	}
 
+	if c.tracing {
+		opts.EnableTracing = true
+		opts.TracesSampleRate = 1.0
+	}
+
 	client, err := sentry.NewClient(opts)
 	require.NoError(t, err)
 
-	handler := sentryhttp.New(sentryhttp.Options{}).Handle(
-		http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-			// This call is what drains the tee and fills the
-			// buffer. Its success is asserted by the unscrubbed
-			// case below, which sees the body in the event.
-			_ = r.ParseForm()
+	c.router().ServeHTTP(httptest.NewRecorder(), c.request(client))
 
-			panic("boom")
-		}),
-	)
-
-	handler.ServeHTTP(
-		httptest.NewRecorder(),
-		sentryLoginRequest(client),
-	)
-
-	require.Len(t, transport.events, 1)
-
-	return transport.events[0]
+	return transport.events
 }
 
-// sentryLoginRequest builds the password POST the capture above drives,
-// with a credential planted in the body, the query and a header.
+// router mirrors setupGlobalMiddleware's ordering over the two route
+// patterns these tests need: a recovering middleware first, then the
+// sentryhttp handler registered with Use and Repanic set, exactly as
+// routes.go registers it. The local recover stands in for chi's
+// middleware.Recoverer, which holds that slot in production; it is
+// here only to keep panic stacks out of the test output.
+func (c sentryCase) router() http.Handler {
+	handler := func(_ http.ResponseWriter, r *http.Request) {
+		// This call is what drains the body tee and fills the
+		// buffer. Its success is asserted by the unscrubbed case
+		// below, which sees the body in the event.
+		_ = r.ParseForm()
+
+		if c.panics {
+			panic("boom")
+		}
+	}
+
+	router := chi.NewRouter()
+	router.Use(recoveringMiddleware)
+	router.Use(
+		sentryhttp.New(sentryhttp.Options{Repanic: true}).Handle,
+	)
+	router.HandleFunc("/pages/login", handler)
+	router.HandleFunc("/webhook/{uuid}", handler)
+
+	return router
+}
+
+func recoveringMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			defer func() { _ = recover() }()
+
+			next.ServeHTTP(w, r)
+		},
+	)
+}
+
+// sentryLoginRequest builds the password POST most cases drive, with a
+// credential planted in the body, the query and a header.
 func sentryLoginRequest(client *sentry.Client) *http.Request {
 	form := url.Values{}
 	form.Set("username", "admin")
 	form.Set("password", sentryBodyMarker)
 
+	req := sentryRequest(
+		client,
+		"/pages/login?url=https://hooks.slack.com/services/"+
+			sentryQueryMarker,
+		form.Encode(),
+	)
+
+	req.Header.Set("X-Csrf-Token", sentryHeaderMarker)
+
+	return req
+}
+
+// sentryReceiverRequest builds a POST to the receiver route, whose
+// concrete path carries the entrypoint capability.
+func sentryReceiverRequest(client *sentry.Client) *http.Request {
+	return sentryRequest(
+		client, "/webhook/"+sentryReceiverUUID, "payload=hello",
+	)
+}
+
+func sentryRequest(
+	client *sentry.Client,
+	target, body string,
+) *http.Request {
 	req := httptest.NewRequestWithContext(
 		sentry.SetHubOnContext(
 			context.Background(),
 			sentry.NewHub(client, sentry.NewScope()),
 		),
 		http.MethodPost,
-		"/pages/login?url=https://hooks.slack.com/services/"+
-			sentryQueryMarker,
-		strings.NewReader(form.Encode()),
+		target,
+		strings.NewReader(body),
 	)
 
 	req.Header.Set(
 		"Content-Type", "application/x-www-form-urlencoded",
 	)
-	req.Header.Set("X-Csrf-Token", sentryHeaderMarker)
 	req.Header.Set("User-Agent", sentryKeptUserAgent)
 
 	return req
@@ -146,15 +225,27 @@ func marshalEvent(t *testing.T, event *sentry.Event) string {
 	return string(encoded)
 }
 
+// onlyEvent asserts a single event was captured and returns it.
+func onlyEvent(t *testing.T, events []*sentry.Event) *sentry.Event {
+	t.Helper()
+
+	require.Len(t, events, 1)
+	require.NotNil(t, events[0].Request)
+
+	return events[0]
+}
+
 // TestSentryScrub_SDKCollectsTheRequestUnscrubbed pins the premise the
 // hook exists for. Without it the SDK ships the whole POST body, the
-// raw query and the CSRF header, none of which SendDefaultPII=false
-// suppresses.
+// raw query, the CSRF header and the concrete request path, none of
+// which SendDefaultPII=false suppresses.
 func TestSentryScrub_SDKCollectsTheRequestUnscrubbed(t *testing.T) {
 	t.Parallel()
 
-	event := captureThroughSentryHTTP(t, false)
-	require.NotNil(t, event.Request)
+	event := onlyEvent(t, sentryCase{
+		panics:  true,
+		request: sentryLoginRequest,
+	}.capture(t))
 
 	assert.Contains(
 		t, event.Request.Data, sentryBodyMarker,
@@ -165,6 +256,18 @@ func TestSentryScrub_SDKCollectsTheRequestUnscrubbed(t *testing.T) {
 	assert.Contains(
 		t, marshalEvent(t, event), sentryHeaderMarker,
 	)
+
+	receiver := onlyEvent(t, sentryCase{
+		panics:  true,
+		request: sentryReceiverRequest,
+	}.capture(t))
+
+	assert.Contains(
+		t, receiver.Request.URL, sentryReceiverUUID,
+		"the SDK is expected to build Request.URL from the "+
+			"concrete path; if it no longer does, the route "+
+			"pattern rewrite's premise changed",
+	)
 }
 
 // TestSentryScrub_RedactsTheCapturedRequest is the regression test: no
@@ -173,8 +276,11 @@ func TestSentryScrub_SDKCollectsTheRequestUnscrubbed(t *testing.T) {
 func TestSentryScrub_RedactsTheCapturedRequest(t *testing.T) {
 	t.Parallel()
 
-	event := captureThroughSentryHTTP(t, true)
-	require.NotNil(t, event.Request)
+	event := onlyEvent(t, sentryCase{
+		scrub:   true,
+		panics:  true,
+		request: sentryLoginRequest,
+	}.capture(t))
 
 	encoded := marshalEvent(t, event)
 
@@ -189,16 +295,45 @@ func TestSentryScrub_RedactsTheCapturedRequest(t *testing.T) {
 	assert.Empty(t, event.Request.Env)
 }
 
+// TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern is the
+// regression test for the receiver URL: the entrypoint UUID is a write
+// capability and may not reach the tracker, while the route it names
+// must still be readable there.
+func TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	event := onlyEvent(t, sentryCase{
+		scrub:   true,
+		panics:  true,
+		request: sentryReceiverRequest,
+	}.capture(t))
+
+	assert.NotContains(
+		t, marshalEvent(t, event), sentryReceiverUUID,
+	)
+	assert.Equal(
+		t, "http://example.com/webhook/{uuid}", event.Request.URL,
+	)
+}
+
 // TestSentryScrub_KeepsTheRoutingContext checks the hook does not cost
-// the debugging signal: the route, the method and the metadata headers
-// still identify what failed.
+// the debugging signal: the route, its scheme and host, the method and
+// the metadata headers still identify what failed. On a static route
+// the pattern is the path, so the URL is unchanged there.
 func TestSentryScrub_KeepsTheRoutingContext(t *testing.T) {
 	t.Parallel()
 
-	event := captureThroughSentryHTTP(t, true)
-	require.NotNil(t, event.Request)
+	event := onlyEvent(t, sentryCase{
+		scrub:   true,
+		panics:  true,
+		request: sentryLoginRequest,
+	}.capture(t))
 
-	assert.Contains(t, event.Request.URL, "/pages/login")
+	assert.Equal(
+		t, "http://example.com/pages/login", event.Request.URL,
+	)
 	assert.Equal(t, http.MethodPost, event.Request.Method)
 	assert.Equal(
 		t,
@@ -212,6 +347,127 @@ func TestSentryScrub_KeepsTheRoutingContext(t *testing.T) {
 	)
 }
 
+// TestSentryScrub_RedactsTheTransactionDispatch covers the other hook.
+// Span.doFinish captures with a nil hint, so BeforeSendTransaction
+// gets one with no context and no request: the route pattern is out of
+// reach and both the URL and the SDK-built transaction name have to
+// fall back. Tracing is off in this service, so no transaction event
+// is produced today; the hook is a floor against that changing.
+func TestSentryScrub_RedactsTheTransactionDispatch(t *testing.T) {
+	t.Parallel()
+
+	events := sentryCase{
+		scrub:   true,
+		tracing: true,
+		request: sentryReceiverRequest,
+	}.capture(t)
+
+	event := onlyEvent(t, events)
+	require.Equal(t, "transaction", event.Type)
+
+	assert.NotContains(
+		t, marshalEvent(t, event), sentryReceiverUUID,
+	)
+	assert.Equal(
+		t, "http://example.com/(redacted)", event.Request.URL,
+	)
+	assert.Equal(t, "POST /(redacted)", event.Transaction)
+}
+
+// TestSentryScrub_TransactionDispatchIsUnscrubbedWithoutTheHook pins
+// that dispatch's premise the same way, since it is the one the
+// service does not exercise today.
+func TestSentryScrub_TransactionDispatchIsUnscrubbedWithoutTheHook(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	event := onlyEvent(t, sentryCase{
+		tracing: true,
+		request: sentryReceiverRequest,
+	}.capture(t))
+
+	require.Equal(t, "transaction", event.Type)
+	assert.Contains(t, event.Request.URL, sentryReceiverUUID)
+	assert.Contains(t, event.Transaction, sentryReceiverUUID)
+}
+
+// TestSentryScrub_FallsBackWithoutARoutePattern covers every way the
+// pattern can be missing. None of them may fall back to the concrete
+// path, and all of them keep the scheme, which is the CSRF TLS
+// decision.
+func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
+	t.Parallel()
+
+	concrete := "https://example.com/webhook/" + sentryReceiverUUID
+
+	// A request with no chi routing context on it at all, which is
+	// what an event captured outside the router would carry.
+	unrouted := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, concrete, nil,
+	)
+
+	for name, hint := range map[string]*sentry.EventHint{
+		"no hint":    nil,
+		"no context": {},
+		"no request": {Context: context.Background()},
+		"unrouted request": {
+			Context: context.WithValue(
+				context.Background(),
+				sentry.RequestContextKey,
+				unrouted,
+			),
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			event := sentry.NewEvent()
+			event.Request = &sentry.Request{URL: concrete}
+			event.Transaction = "POST /webhook/" +
+				sentryReceiverUUID
+
+			scrubbed := server.ScrubSentryRequestForTest(
+				event, hint,
+			)
+			require.NotNil(t, scrubbed)
+
+			assert.Equal(
+				t,
+				"https://example.com/(redacted)",
+				scrubbed.Request.URL,
+			)
+			assert.Equal(
+				t, "POST /(redacted)", scrubbed.Transaction,
+			)
+			assert.NotContains(
+				t,
+				marshalEvent(t, scrubbed),
+				sentryReceiverUUID,
+			)
+		})
+	}
+}
+
+// TestSentryScrub_WithholdsUnparseableValues covers the shapes the
+// rewrite cannot take apart. Withholding them whole is the safe
+// answer, since nothing can be said about which part is a path.
+func TestSentryScrub_WithholdsUnparseableValues(t *testing.T) {
+	t.Parallel()
+
+	event := sentry.NewEvent()
+	event.Request = &sentry.Request{
+		URL: "/webhook/" + sentryReceiverUUID,
+	}
+	event.Transaction = "/webhook/" + sentryReceiverUUID
+
+	scrubbed := server.ScrubSentryRequestForTest(event, nil)
+	require.NotNil(t, scrubbed)
+
+	assert.Equal(t, "(redacted)", scrubbed.Request.URL)
+	assert.Equal(t, "(redacted)", scrubbed.Transaction)
+}
+
 // TestSentryScrub_ToleratesEventsWithoutARequest covers the events the
 // hook sees outside an HTTP handler, where no request is attached.
 func TestSentryScrub_ToleratesEventsWithoutARequest(t *testing.T) {
@@ -223,5 +479,6 @@ func TestSentryScrub_ToleratesEventsWithoutARequest(t *testing.T) {
 
 	require.NotNil(t, scrubbed)
 	assert.Nil(t, scrubbed.Request)
+	assert.Empty(t, scrubbed.Transaction)
 	assert.Nil(t, server.ScrubSentryRequestForTest(nil, nil))
 }