Bucket IPv6 rate-limit keys by /64 (closes #125)

Rate-limit keys were per-address, i.e. per /128 for IPv6. A routed /64
is the normal residential and mobile IPv6 allocation, so a client could
rotate source addresses inside its own prefix and mint a fresh bucket
per request, evading every limiter here at the network layer with no
spoofing and nothing to detect.

The shared key function now reduces the client address to a bucket by
family: IPv4 keys on the full address, IPv6 on its /64 prefix. All four
limiter instances (login, password change, and the receiver's
per-entrypoint and aggregate limits) go through that one function, so
all of them are covered.

Both branches of that function are covered by tests: the direct-peer
branch, and the trusted-proxy branch that takes the client address out
of X-Forwarded-For. The second is the one a production deployment
takes, since it is required to run behind a reverse proxy with
TRUSTED_PROXIES set.

IPv4-mapped addresses (::ffff:1.2.3.4) key as the IPv4 address they
carry rather than being masked, which would otherwise collapse every
IPv4 client behind a mapping proxy into the ::ffff:0:0/96 bucket. An
unparseable RemoteAddr still keys on its raw value, so those stay in
distinct buckets instead of collapsing together.

No new configuration surface.

.dockerignore

@@ -3,6 +3,11 @@
 # stage of the Dockerfile.
 .git/
 bin/
+# Third-party browser assets are fetched and hash-verified inside the build by
+# script/fetch-assets. Excluding any host copy keeps a developer's working tree
+# from supplying the bytes that get shipped. The script and its
+# static/vendor.sha256 manifest stay in the context.
+static/js/alpine.min.js
 *.md
 LICENSE
 .editorconfig

.gitignore

@@ -44,4 +44,9 @@ tmp/
 temp/
 
 # CI cache barrier, written into the build context by the check workflow
-.ci-fingerprint 
+.ci-fingerprint
+
+# Third-party browser assets, fetched and hash-verified by
+# script/fetch-assets against static/vendor.sha256. Not committed:
+# REPO_POLICIES.md forbids minified bundles in version control.
+/static/js/alpine.min.js 

Dockerfile

@@ -32,7 +32,7 @@ FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a349228
 # Depend on lint stage passing
 COPY --from=lint /src/go.sum /dev/null
 
-RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
@@ -44,6 +44,14 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
+# Fetch the third-party browser assets the UI serves. They are not committed
+# (REPO_POLICIES.md forbids minified bundles in version control) and
+# .dockerignore keeps any host copy out of the build context, so this step is
+# the only way they enter the image. Each download is checked against a
+# hardcoded sha256 and the build fails on mismatch; make test re-checks the
+# hashes against the bytes go:embed actually put in the binary.
+RUN script/fetch-assets
+
 # Run tests and build
 RUN make test
 RUN make build

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check build run dev deps docker clean hooks css
+.PHONY: bootstrap setup assets test lint fmt fmt-check check build run dev deps docker clean hooks css
 
 # Default target
 .DEFAULT_GOAL := check
@@ -9,6 +9,9 @@ bootstrap:
 setup:
 	@script/setup
 
+assets:
+	@script/fetch-assets
+
 test:
 	@script/test
 

README.md

@@ -40,6 +40,7 @@ make docker
 ```bash
 make bootstrap  # Install all dependencies (idempotent)
 make setup      # Bootstrap + install git pre-commit hook
+make assets     # Fetch + verify third-party browser assets
 make fmt        # Format code (gofmt + goimports)
 make lint       # Run golangci-lint
 make test       # Run tests with race detection
@@ -247,6 +248,8 @@ them. We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
+- `script/fetch-assets` — download the third-party browser assets into
+  `static/`, verifying each against its pinned sha256
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint
 - `script/fmt` — format all code (writes)
@@ -260,6 +263,27 @@ them. We provide:
 - `script/install-precommit` — install the git pre-commit hook that
   runs `script/precommit`
 
+## Third-party browser assets
+
+The web UI serves one third-party script, Alpine.js. It is **not** committed:
+a minified bundle in the tree is unreviewable, and `REPO_POLICIES.md` bars
+both committed build artifacts and unpinned external references.
+
+Instead `script/fetch-assets` downloads it from a pinned URL, checks the
+download against a hardcoded sha256, and installs it under `static/`. The
+sha256 of every installed asset is recorded in `static/vendor.sha256`, and
+`static/vendor_test.go` re-hashes the bytes `go:embed` put in the binary
+against that manifest — so the pin is enforced on what actually ships, not
+merely written down. Any mismatch fails the build.
+
+`make bootstrap` runs the fetch for local development, and the Dockerfile
+runs it in the build stage; `.gitignore` and `.dockerignore` keep the
+artifact out of both the repo and the build context.
+
+To move to a new version: update the version, URL, and tarball sha256 in
+`script/fetch-assets` and the asset sha256 in `static/vendor.sha256`, then
+run `make assets && make check`.
+
 ## Rationale
 
 Webhook integrations between services are inherently fragile. The
@@ -911,7 +935,14 @@ Every limiter here — receiver, login, and password change — identifies
 the client the same way, through one shared key function: the
 connection's own address, unless the peer is listed in
 `TRUSTED_PROXIES`, in which case the forwarded client address is used
-instead. See [Trusted proxies](#trusted-proxies). Deployed without that
+instead. That address becomes a bucket by family: IPv4 keys on the full
+address, IPv6 on its `/64` prefix. A routed `/64` is the normal
+residential and mobile IPv6 allocation, so keying IPv6 per address would
+let one subscriber rotate source addresses and mint a fresh bucket per
+request, evading these limits at the network layer without spoofing
+anything; the cost is that distinct clients inside one `/64` share a
+bucket. IPv4-mapped addresses (`::ffff:1.2.3.4`) key as the IPv4 address
+they carry. See [Trusted proxies](#trusted-proxies). Deployed without that
 variable set, a client behind a reverse proxy shares one bucket with
 every other client behind the same proxy. Set `TRUSTED_PROXIES` to the
 proxy's address to get per-client limits back. What the shared bucket

internal/handlers/event_log_view.go

@@ -0,0 +1,120 @@
+package handlers
+
+import (
+	"time"
+	"unicode/utf8"
+)
+
+// maxRenderedBodyBytes caps how many bytes of a stored event
+// body reach the event log page. Bodies come from the
+// unauthenticated receiver under the 1 MB ingest cap and
+// renderTemplate buffers a whole page before writing it, so
+// an uncapped page of paginationPerPage events is tens of
+// megabytes of resident memory per concurrent viewer.
+const maxRenderedBodyBytes = 8192
+
+// eventLogColumns is the event log's projection. The casts to
+// blob are load-bearing: they make substr and length count
+// bytes rather than characters, so the cap bounds the page in
+// bytes whatever the payload's encoding. Cutting in SQLite
+// rather than in Go is the point of the projection — an
+// oversized body never becomes a Go string at all.
+const eventLogColumns = "id, created_at, method, content_type, " +
+	"substr(cast(body as blob), 1, ?) AS body, " +
+	"length(cast(body as blob)) AS body_bytes"
+
+// EventLogView is the display-safe projection of an event for
+// the event log page, alongside DeliveryView and TargetView.
+// It carries a capped body plus the true stored size, so the
+// page can mark a body as truncated without ever holding the
+// whole thing.
+type EventLogView struct {
+	ID          string
+	CreatedAt   time.Time
+	Method      string
+	ContentType string
+
+	// Body holds at most maxRenderedBodyBytes bytes of the
+	// stored body.
+	Body string
+
+	// BodyBytes is the true size of the stored body.
+	BodyBytes int64
+
+	// BodyTruncated reports that the stored body was larger
+	// than the cap, so the page owes the reader a marker.
+	BodyTruncated bool
+
+	Deliveries []DeliveryView
+}
+
+// BodyShownBytes is how many body bytes the page is actually
+// rendering, which the truncation marker reports beside the
+// true size.
+func (v EventLogView) BodyShownBytes() int {
+	return len(v.Body)
+}
+
+// eventLogRow is one row of the event log projection. Its
+// body column arrives already cut to the cap by SQLite, with
+// the true size beside it.
+type eventLogRow struct {
+	ID          string
+	CreatedAt   time.Time
+	Method      string
+	ContentType string
+	Body        []byte
+	BodyBytes   int64
+}
+
+// view projects a loaded row for rendering.
+func (r *eventLogRow) view() EventLogView {
+	body := r.Body
+	truncated := r.BodyBytes > int64(len(body))
+
+	// Only a cut body can have been left mid-sequence by
+	// this query. A whole body is passed through exactly as
+	// stored, however malformed.
+	if truncated {
+		body = trimPartialRune(body)
+	}
+
+	return EventLogView{
+		ID:            r.ID,
+		CreatedAt:     r.CreatedAt,
+		Method:        r.Method,
+		ContentType:   r.ContentType,
+		Body:          string(body),
+		BodyBytes:     r.BodyBytes,
+		BodyTruncated: truncated,
+	}
+}
+
+// trimPartialRune drops a trailing UTF-8 sequence that the
+// byte-wise cut left incomplete, so a multi-byte rune severed
+// at the cap does not surface as a mojibake tail.
+//
+// Bytes that are merely invalid UTF-8 are left exactly as
+// stored: this service receives binary payloads, and rewriting
+// them would misreport what was delivered. The distinction is
+// utf8.FullRune's — it reports a complete sequence for an
+// invalid encoding too, since that decodes to a width-1 error
+// rune, so only a valid prefix still waiting for its
+// continuation bytes is removed. A tail with no rune start in
+// its last utf8.UTFMax bytes cannot be an incomplete sequence
+// either, and is likewise left alone.
+func trimPartialRune(b []byte) []byte {
+	for i := len(b) - 1; i >= 0 && len(b)-i <= utf8.UTFMax; i-- {
+		if !utf8.RuneStart(b[i]) {
+			continue
+		}
+
+		if utf8.FullRune(b[i:]) {
+			return b
+		}
+
+		return b[:i]
+	}
+
+	return b
+}

internal/handlers/event_log_view_test.go

@@ -0,0 +1,258 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// bodyCap is the number of body bytes the event log page is
+// allowed to render for one event.
+const bodyCap = handlers.MaxRenderedBodyBytesForTest
+
+// snowman is a three-byte rune, so a body of them straddles the
+// byte-wise cut: bodyCap is not a multiple of three.
+const snowman = "☃"
+
+// seedEventWithBody records one event with the given body in the
+// webhook's own database.
+func seedEventWithBody(
+	t *testing.T,
+	dbMgr *database.WebhookDBManager,
+	webhookID string,
+	body string,
+) {
+	t.Helper()
+
+	webhookDB, err := dbMgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	event := &database.Event{
+		WebhookID:   webhookID,
+		Method:      http.MethodPost,
+		Body:        body,
+		ContentType: "application/octet-stream",
+	}
+
+	require.NoError(t, webhookDB.Omit(
+		clause.Associations,
+	).Create(event).Error)
+}
+
+// seedAndProject stores one body and returns the projection the
+// event log page would be handed for it.
+func seedAndProject(
+	t *testing.T,
+	body string,
+) handlers.EventLogView {
+	t.Helper()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedEventWithBody(t, dbMgr, wh.ID, body)
+
+	views := h.LoadEventLogViewsForTest(
+		httptest.NewRecorder(), *wh, 1,
+	)
+	require.Len(t, views, 1)
+
+	return views[0]
+}
+
+// TestHandleSourceLogs_BoundsOversizeBody proves the rendered
+// page is bounded by the cap rather than by the stored payload:
+// the body here is 64 times the cap, and the ingest path would
+// accept twice as much again.
+func TestHandleSourceLogs_BoundsOversizeBody(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	const (
+		sentinel    = "TAIL-SENTINEL-1f4a9c"
+		storedBytes = 512 * 1024
+	)
+
+	wh := seedWebhook(t, db)
+	seedEventWithBody(
+		t, dbMgr, wh.ID,
+		strings.Repeat("A", storedBytes-len(sentinel))+sentinel,
+	)
+
+	page := renderSourceLogsPage(t, h, sess, wh.ID)
+
+	// Nothing past the cap reaches the page, and the whole page
+	// stays far below the stored body it is reporting on.
+	assert.NotContains(t, page, sentinel)
+	assert.Less(t, len(page), 4*bodyCap)
+
+	// The marker states the true stored size, not the cut one.
+	assert.Contains(
+		t, page,
+		"showing "+strconv.Itoa(bodyCap)+
+			" of "+strconv.Itoa(storedBytes)+" bytes",
+	)
+}
+
+// TestHandleSourceLogs_SmallBodyRendersWhole guards the other
+// side of the cap: a body under it is shown in full and carries
+// no truncation marker.
+func TestHandleSourceLogs_SmallBodyRendersWhole(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedEventWithBody(t, dbMgr, wh.ID, `{"kept":"whole"}`)
+
+	page := renderSourceLogsPage(t, h, sess, wh.ID)
+
+	assert.Contains(t, page, ""kept"")
+	assert.NotContains(t, page, "Body truncated for display")
+}
+
+// TestEventLogView_CutMidRune proves a multi-byte rune severed
+// by the byte-wise cut is dropped rather than surfaced as a
+// mojibake tail.
+func TestEventLogView_CutMidRune(t *testing.T) {
+	t.Parallel()
+
+	body := strings.Repeat(snowman, 4096)
+	view := seedAndProject(t, body)
+
+	// bodyCap bytes hold bodyCap/3 whole snowmen and two bytes
+	// of the next one; those two are dropped.
+	whole := bodyCap / len(snowman)
+
+	assert.True(t, view.BodyTruncated)
+	assert.Equal(t, int64(len(body)), view.BodyBytes)
+	assert.Equal(t, strings.Repeat(snowman, whole), view.Body)
+	assert.True(t, utf8.ValidString(view.Body))
+	assert.LessOrEqual(t, len(view.Body), bodyCap)
+}
+
+// TestEventLogView_BinaryBodyLeftAsStored proves a binary
+// payload is passed through byte for byte. Its tail is invalid
+// UTF-8 however the cut falls, so repairing it would misreport
+// what the sender delivered.
+func TestEventLogView_BinaryBodyLeftAsStored(t *testing.T) {
+	t.Parallel()
+
+	raw := make([]byte, bodyCap+808)
+	for i := range raw {
+		// 0x80..0xBF: continuation bytes, never a rune start.
+		raw[i] = 0x80 | byte(i%0x40)
+	}
+
+	view := seedAndProject(t, string(raw))
+
+	assert.True(t, view.BodyTruncated)
+	assert.Equal(t, int64(len(raw)), view.BodyBytes)
+	assert.Equal(t, string(raw[:bodyCap]), view.Body)
+	assert.False(t, utf8.ValidString(view.Body))
+}
+
+// TestTrimPartialRune covers the distinction the cut repair
+// turns on: an incomplete but valid sequence is dropped, while
+// bytes that are merely invalid UTF-8 are left alone.
+func TestTrimPartialRune(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		in   []byte
+		want []byte
+	}{{
+		name: "complete ascii",
+		in:   []byte("abc"),
+		want: []byte("abc"),
+	}, {
+		name: "complete multibyte",
+		in:   []byte("ab" + snowman),
+		want: []byte("ab" + snowman),
+	}, {
+		name: "two byte rune cut",
+		in:   []byte{'a', 0xC3},
+		want: []byte{'a'},
+	}, {
+		name: "three byte rune cut after one",
+		in:   []byte{'a', 0xE2},
+		want: []byte{'a'},
+	}, {
+		name: "three byte rune cut after two",
+		in:   []byte{'a', 0xE2, 0x98},
+		want: []byte{'a'},
+	}, {
+		name: "four byte rune cut",
+		in:   []byte{'a', 0xF0, 0x9F, 0x92}, // U+1F4A9 cut
+		want: []byte{'a'},
+	}, {
+		name: "invalid start byte kept",
+		in:   []byte{'a', 0xFF},
+		want: []byte{'a', 0xFF},
+	}, {
+		name: "orphan continuation bytes kept",
+		in:   []byte{0x80, 0x81, 0x82, 0x83, 0x84},
+		want: []byte{0x80, 0x81, 0x82, 0x83, 0x84},
+	}, {
+		name: "truncated sequence followed by junk kept",
+		in:   []byte{0xE2, 0x98, 0xFF},
+		want: []byte{0xE2, 0x98, 0xFF},
+	}, {
+		name: "empty",
+		in:   []byte{},
+		want: []byte{},
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(
+				t, tc.want,
+				handlers.TrimPartialRuneForTest(tc.in),
+			)
+		})
+	}
+}

internal/handlers/export_test.go

@@ -3,8 +3,35 @@ package handlers
 import (
 	"html/template"
 	"net/http"
+
+	"sneak.berlin/go/webhooker/internal/database"
 )
 
+// MaxRenderedBodyBytesForTest exposes the event log's body cap
+// to the handlers_test package.
+const MaxRenderedBodyBytesForTest = maxRenderedBodyBytes
+
+// TrimPartialRuneForTest exposes trimPartialRune for use in the
+// handlers_test package.
+func TrimPartialRuneForTest(b []byte) []byte {
+	return trimPartialRune(b)
+}
+
+// LoadEventLogViewsForTest exposes loadEventsWithDeliveries for
+// use in the handlers_test package. Assertions on the projected
+// body need the bytes as loaded: html/template rewrites invalid
+// UTF-8 on the way out, so the rendered page cannot show whether
+// a binary body survived the projection intact.
+func (s *Handlers) LoadEventLogViewsForTest(
+	w http.ResponseWriter,
+	webhook database.Webhook,
+	page int,
+) []EventLogView {
+	views, _ := s.loadEventsWithDeliveries(w, webhook, nil, page)
+
+	return views
+}
+
 // AddTemplateForTest registers a template under a page name so that
 // the handlers_test package can drive the render path with a
 // template of its own.

internal/handlers/handlers.go

@@ -229,8 +229,10 @@ func (s *Handlers) renderTemplate(
 // the response only once rendering has fully succeeded. Executing
 // straight into the ResponseWriter commits a partial body and a 200
 // status before a mid-render error can be reported, leaving no way
-// to serve a 500. These pages are small, so holding one in memory is
-// the right trade.
+// to serve a 500. Buffering makes a page's rendered size resident
+// memory per concurrent viewer, so every page owes it a bound: the
+// event log caps each stored body at maxRenderedBodyBytes for exactly
+// this reason.
 func (s *Handlers) executeTemplate(
 	w http.ResponseWriter,
 	tmpl *template.Template,

internal/handlers/source_management.go

@@ -92,13 +92,6 @@ func parseRetentionDays(raw string, fallback int) (int, error) {
 	return v, nil
 }
 
-// EventWithDeliveries holds an event and its deliveries.
-type EventWithDeliveries struct {
-	database.Event
-
-	Deliveries []DeliveryView
-}
-
 // DeliveryView is the display-safe projection of a delivery
 // for the event log page. Its target is a TargetView, so the
 // stored configuration blob — which holds the target's
@@ -815,16 +808,18 @@ func (h *Handlers) parsePage(r *http.Request) int {
 }
 
 // loadEventsWithDeliveries loads paginated events and their
-// deliveries from the per-webhook database.
+// deliveries from the per-webhook database. Events come back
+// as capped projections rather than database.Event rows: see
+// eventLogColumns for why the cut happens in SQL.
 func (h *Handlers) loadEventsWithDeliveries(
 	w http.ResponseWriter,
 	webhook database.Webhook,
 	targetMap map[string]delivery.TargetView,
 	page int,
-) ([]EventWithDeliveries, int64) {
+) ([]EventLogView, int64) {
 	var totalEvents int64
 
-	var result []EventWithDeliveries
+	var result []EventLogView
 
 	if !h.dbMgr.DBExists(webhook.ID) {
 		return result, totalEvents
@@ -845,23 +840,25 @@ func (h *Handlers) loadEventsWithDeliveries(
 
 	offset := (page - 1) * paginationPerPage
 
-	var events []database.Event
+	var rows []eventLogRow
 
-	webhookDB.Where(
+	webhookDB.Model(&database.Event{}).Select(
+		eventLogColumns, maxRenderedBodyBytes,
+	).Where(
 		"webhook_id = ?", webhook.ID,
 	).Order("created_at DESC").Offset(offset).Limit(
 		paginationPerPage,
-	).Find(&events)
+	).Find(&rows)
 
-	result = make([]EventWithDeliveries, len(events))
+	result = make([]EventLogView, len(rows))
 
-	for i := range events {
-		result[i].Event = events[i]
+	for i := range rows {
+		result[i] = rows[i].view()
 
 		var deliveries []database.Delivery
 
 		webhookDB.Where(
-			"event_id = ?", events[i].ID,
+			"event_id = ?", rows[i].ID,
 		).Find(&deliveries)
 
 		result[i].Deliveries = newDeliveryViews(

internal/middleware/ratelimit.go

@@ -48,6 +48,12 @@ const (
 	// bound every request pays a walk proportional to whatever the
 	// client sent.
 	maxForwardedHops = 64
+
+	// ipv6BucketBits is the prefix length IPv6 clients are bucketed
+	// on. A routed /64 is the normal residential and mobile
+	// allocation, so it is the unit an attacker gets addresses in
+	// and therefore the unit worth limiting.
+	ipv6BucketBits = 64
 )
 
 // normalizeAddr strips the IPv4-in-IPv6 wrapper and any zone from
@@ -56,6 +62,40 @@ func normalizeAddr(addr netip.Addr) netip.Addr {
 	return addr.Unmap().WithZone("")
 }
 
+// bucketKey is the rate-limit bucket identity of a client address.
+// IPv4 keys on the full address; IPv6 keys on its /64 prefix,
+// because keying IPv6 per /128 lets one ordinary subscriber rotate
+// source addresses inside its own routed /64 and mint a fresh bucket
+// per request — evading every limiter here at the network layer,
+// with no spoofing and nothing to detect.
+//
+// An IPv4-mapped address (::ffff:1.2.3.4) is keyed as the IPv4
+// address it carries, never masked to a /64: mapped form all shares
+// the ::ffff:0:0/96 prefix, so masking would collapse every IPv4
+// client reaching a proxy that emits it into one bucket. Callers
+// pass addresses through normalizeAddr, which already unmaps; the
+// unmap here keeps the property true of the key function itself.
+//
+// The two families cannot collide: an IPv4 key is a bare dotted
+// quad, and an IPv6 key always carries a "/64" suffix.
+func bucketKey(addr netip.Addr) string {
+	addr = addr.Unmap()
+
+	if addr.Is4() {
+		return addr.String()
+	}
+
+	// Prefix errors only on a negative bit count, on over 32 bits
+	// for an IPv4 address, or on over 128 for IPv6. The count here
+	// is the constant 64 and the IPv4 case returned above, so the
+	// error is unreachable. (The zero Addr does not error either: it
+	// yields the zero Prefix. Neither call site can produce one,
+	// since both parse the address first.)
+	prefix, _ := addr.Prefix(ipv6BucketBits)
+
+	return prefix.String()
+}
+
 // isTrustedProxy reports whether addr belongs to a network the
 // operator listed in TRUSTED_PROXIES. The list is empty by default,
 // so by default nothing is trusted.
@@ -143,6 +183,9 @@ func (m *Middleware) forwardedClientAddr(
 // another client's bucket, by picking an X-Forwarded-For value —
 // which makes every limit here decorative against a deliberate
 // attacker.
+//
+// The address that identifies the client is then reduced to a bucket
+// by bucketKey: full address for IPv4, /64 prefix for IPv6.
 func (m *Middleware) rateLimitKey(r *http.Request) (string, error) {
 	return m.clientKey(r), nil
 }
@@ -152,23 +195,25 @@ func (m *Middleware) clientKey(r *http.Request) string {
 	peer, err := netip.ParseAddr(ipFromHostPort(r.RemoteAddr))
 	if err != nil {
 		// Not an address we can reason about; key on the raw
-		// value, the most specific identity left. On a
-		// Unix-socket listener every peer carries the same
-		// RemoteAddr and so shares one bucket, which is the
-		// fail-closed direction.
+		// value, the most specific identity left. Distinct
+		// RemoteAddr values stay in distinct buckets, so this
+		// path cannot silently collapse unrelated clients
+		// together. On a Unix-socket listener every peer
+		// carries the same RemoteAddr and so shares one bucket,
+		// which is the fail-closed direction.
 		return r.RemoteAddr
 	}
 
 	peer = normalizeAddr(peer)
 	if !m.isTrustedProxy(peer) {
-		return peer.String()
+		return bucketKey(peer)
 	}
 
 	if addr, ok := m.forwardedClientAddr(r); ok {
-		return addr.String()
+		return bucketKey(addr)
 	}
 
-	return peer.String()
+	return bucketKey(peer)
 }
 
 // tooManyRequests returns the 429 handler used by the login,

internal/middleware/ratelimit_test.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/middleware"
 )
@@ -370,6 +371,30 @@ const (
 	headerXFF  = "X-Forwarded-For"
 	headerReal = "X-Real-IP"
 	headerTrue = "True-Client-IP"
+
+	// clientIPv4 is the sample IPv4 client address these tests key
+	// on, both directly and in IPv4-mapped form. clientIPv4Alt is
+	// its neighbour, used to show the two do not share a bucket.
+	clientIPv4    = "198.51.100.7"
+	clientIPv4Alt = "198.51.100.8"
+
+	// clientIPv6 and clientIPv6Same are two addresses inside one
+	// routed /64, so both must key on clientBucketV6.
+	// clientIPv6Other is a different allocation and must key on
+	// clientOtherBucketV6.
+	clientIPv6          = "2001:db8:1:2:3:4:5:6"
+	clientIPv6Same      = "2001:db8:1:2:aaaa:bbbb:cccc:dddd"
+	clientIPv6Other     = "2001:db8:1:3::1"
+	clientBucketV6      = "2001:db8:1:2::/64"
+	clientOtherBucketV6 = "2001:db8:1:3::/64"
+
+	// trustedProxyCIDR is the proxy network the forwarded-path
+	// tests configure, and trustedPeer an address inside it. A
+	// production deployment is required to run behind a reverse
+	// proxy with TRUSTED_PROXIES set, so this is the shape the
+	// bucketing has to hold in.
+	trustedProxyCIDR = "10.0.0.0/8"
+	trustedPeer      = "10.0.0.1:44444"
 )
 
 // assertSharedBucket drives the login limiter from peer with the
@@ -458,8 +483,8 @@ func TestRateLimitKey_SingleValuedHeadersIgnoredFromTrustedPeer(
 			t.Parallel()
 
 			assertSharedBucket(
-				t, trustedProxies("10.0.0.0/8"),
-				"10.0.0.1:44444",
+				t, trustedProxies(trustedProxyCIDR),
+				trustedPeer,
 				func(i int) map[string]string {
 					return map[string]string{
 						header: fmt.Sprintf(
@@ -495,8 +520,8 @@ func TestRateLimitKey_MalformedRightmostHopFallsBackToPeer(
 			t.Parallel()
 
 			assertSharedBucket(
-				t, trustedProxies("10.0.0.0/8"),
-				"10.0.0.1:44444",
+				t, trustedProxies(trustedProxyCIDR),
+				trustedPeer,
 				func(i int) map[string]string {
 					return map[string]string{
 						headerXFF: fmt.Sprintf(
@@ -522,13 +547,13 @@ func TestRateLimitKey_ForwardedHonouredFromTrustedPeer(
 	t.Parallel()
 
 	m := rateLimitMiddleware(t, &config.Config{
-		TrustedProxies: trustedProxies("10.0.0.0/8"),
+		TrustedProxies: trustedProxies(trustedProxyCIDR),
 	})
 	handler := m.LoginRateLimit()(okHandler())
 
-	const peer = "10.0.0.1:44444"
+	const peer = trustedPeer
 
-	first := map[string]string{headerXFF: "198.51.100.7"}
+	first := map[string]string{headerXFF: clientIPv4}
 
 	for range middleware.LoginRateLimitConst {
 		postWithHeaders(handler, peer, loginPath, first)
@@ -542,7 +567,7 @@ func TestRateLimitKey_ForwardedHonouredFromTrustedPeer(
 
 	w = postWithHeaders(
 		handler, peer, loginPath,
-		map[string]string{headerXFF: "198.51.100.8"},
+		map[string]string{headerXFF: clientIPv4Alt},
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -559,7 +584,7 @@ func TestRateLimitKey_ChainWalkSkipsClientPrepended(t *testing.T) {
 	t.Parallel()
 
 	assertSharedBucket(
-		t, trustedProxies("10.0.0.0/8"), "10.0.0.1:44444",
+		t, trustedProxies(trustedProxyCIDR), trustedPeer,
 		func(i int) map[string]string {
 			return map[string]string{
 				headerXFF: fmt.Sprintf(
@@ -594,7 +619,7 @@ func TestRateLimitKey_LongChainCapsWalkAndFallsBackToPeer(
 	start := time.Now()
 
 	assertSharedBucket(
-		t, trustedProxies("10.0.0.0/8"), "10.0.0.1:44444",
+		t, trustedProxies(trustedProxyCIDR), trustedPeer,
 		func(i int) map[string]string {
 			return map[string]string{
 				headerXFF: fmt.Sprintf("9.9.9.%d%s", i+1, padding),
@@ -633,13 +658,13 @@ func TestRateLimitKey_LongChainAllocationIsBounded(t *testing.T) {
 	)
 
 	m := rateLimitMiddleware(t, &config.Config{
-		TrustedProxies: trustedProxies("10.0.0.0/8"),
+		TrustedProxies: trustedProxies(trustedProxyCIDR),
 	})
 
 	req := httptest.NewRequestWithContext(
 		context.Background(), http.MethodPost, loginPath, nil,
 	)
-	req.RemoteAddr = "10.0.0.1:44444"
+	req.RemoteAddr = trustedPeer
 	req.Header.Set(
 		headerXFF, "9.9.9.9"+strings.Repeat(", 10.0.0.2", hops),
 	)
@@ -835,3 +860,369 @@ func TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer(
 			"not mint a fresh receiver bucket",
 	)
 }
+
+// clientKeyFor returns the bucket key m computes for a request whose
+// direct peer is remoteAddr and which carries no forwarded headers.
+func clientKeyFor(
+	t *testing.T, m *middleware.Middleware, remoteAddr string,
+) string {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, loginPath, nil,
+	)
+	req.RemoteAddr = remoteAddr
+
+	return middleware.ClientKeyForTest(m, req)
+}
+
+// TestRateLimitKey_IPv6BucketsByPrefix pins the key function's
+// address-family behaviour. IPv6 clients must bucket by /64 — a
+// routed /64 is the normal residential and mobile allocation, so
+// per-/128 keying lets one subscriber rotate source addresses and
+// mint a fresh bucket per request — while IPv4 keeps keying on the
+// full address and IPv4-mapped form is keyed as the IPv4 address it
+// carries.
+func TestRateLimitKey_IPv6BucketsByPrefix(t *testing.T) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{})
+
+	for _, tc := range []struct {
+		name  string
+		peer  string
+		want  string
+		about string
+	}{{
+		name:  "ipv6",
+		peer:  "[" + clientIPv6 + "]:44444",
+		want:  clientBucketV6,
+		about: "an IPv6 peer must key on its /64",
+	}, {
+		name:  "ipv6-other-in-same-64",
+		peer:  "[" + clientIPv6Same + "]:1",
+		want:  clientBucketV6,
+		about: "another address in the same /64 must key the same",
+	}, {
+		name:  "ipv6-different-64",
+		peer:  "[" + clientIPv6Other + "]:44444",
+		want:  clientOtherBucketV6,
+		about: "a different /64 must key differently",
+	}, {
+		name:  "ipv4",
+		peer:  clientIPv4 + ":44444",
+		want:  clientIPv4,
+		about: "IPv4 must keep keying on the full address",
+	}, {
+		name:  "ipv4-neighbour",
+		peer:  clientIPv4Alt + ":44444",
+		want:  clientIPv4Alt,
+		about: "adjacent IPv4 addresses must not share a bucket",
+	}, {
+		name: "ipv4-mapped",
+		peer: "[::ffff:" + clientIPv4 + "]:44444",
+		want: clientIPv4,
+		about: "IPv4-mapped form must key as the IPv4 address, " +
+			"not be masked to a /64: mapped addresses all share " +
+			"::ffff:0:0/96, so masking would collapse every IPv4 " +
+			"client behind a mapping proxy into one bucket",
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(
+				t, tc.want, clientKeyFor(t, m, tc.peer), tc.about,
+			)
+		})
+	}
+}
+
+// TestRateLimitKey_FamiliesDoNotCollide pins the structure the
+// no-collision property rests on, rather than one sample pair: every
+// IPv4 key is a bare address and every IPv6 key is a /64 in CIDR
+// form, so the two name spaces are disjoint by shape. Dropping the
+// masking strips the suffix that guarantees it, which is why this
+// asserts the form of each key and not just that two of them differ.
+func TestRateLimitKey_FamiliesDoNotCollide(t *testing.T) {
+	t.Parallel()
+
+	// Restated here rather than imported from the package under
+	// test, so that changing the production bucket width fails this
+	// test instead of silently moving with it.
+	const wantBits = 64
+
+	m := rateLimitMiddleware(t, &config.Config{})
+
+	v4Keys := map[string]bool{}
+
+	for _, peer := range []string{
+		clientIPv4 + ":44444",
+		clientIPv4Alt + ":44444",
+		"[::ffff:" + clientIPv4 + "]:44444",
+	} {
+		key := clientKeyFor(t, m, peer)
+
+		addr, err := netip.ParseAddr(key)
+		require.NoError(
+			t, err, "%s: an IPv4 key must be a bare address", peer,
+		)
+		assert.True(
+			t, addr.Is4(),
+			"%s: an IPv4 key must be a dotted quad, got %q", peer, key,
+		)
+
+		v4Keys[key] = true
+	}
+
+	for _, peer := range []string{
+		"[" + clientIPv6 + "]:44444",
+		"[" + clientIPv6Same + "]:44444",
+		"[" + clientIPv6Other + "]:44444",
+		"[2001:db8::" + clientIPv4 + "]:44444",
+	} {
+		key := clientKeyFor(t, m, peer)
+
+		prefix, err := netip.ParsePrefix(key)
+		require.NoError(
+			t, err, "%s: an IPv6 key must be a CIDR prefix", peer,
+		)
+		assert.Equal(
+			t, wantBits, prefix.Bits(),
+			"%s: an IPv6 key must name a /64", peer,
+		)
+		assert.False(
+			t, v4Keys[key],
+			"%s: an IPv6 key must never equal an IPv4 key", peer,
+		)
+	}
+}
+
+// TestRateLimitKey_UnparseablePeerKeepsDistinctBuckets covers the
+// fallback path. A RemoteAddr that is not an address must not panic,
+// and must not drop unrelated clients into one shared bucket by
+// accident: the raw value is the most specific identity left, so
+// distinct values stay in distinct buckets.
+func TestRateLimitKey_UnparseablePeerKeepsDistinctBuckets(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{})
+
+	first := clientKeyFor(t, m, "not-an-address")
+	second := clientKeyFor(t, m, "also-not-an-address:1234")
+
+	assert.NotEmpty(t, first)
+	assert.NotEqual(
+		t, first, second,
+		"unparseable peers must not collapse into one bucket",
+	)
+}
+
+// TestLoginRateLimit_IPv6SharesBucketWithinSlash64 is the behavioural
+// half, and the regression test for the bypass itself: a client that
+// rotates source addresses inside its own routed /64 must stay in one
+// bucket. Reverting the masking makes this test fail, because each
+// rotated address would mint a fresh bucket and nothing would be
+// rejected.
+func TestLoginRateLimit_IPv6SharesBucketWithinSlash64(t *testing.T) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{})
+	handler := m.LoginRateLimit()(okHandler())
+
+	for i := range middleware.LoginRateLimitConst {
+		w := postWithHeaders(
+			handler,
+			fmt.Sprintf("[2001:db8:1:2::%d]:44444", i+1),
+			loginPath, nil,
+		)
+		assert.Equal(
+			t, http.StatusOK, w.Code, "request %d should pass", i,
+		)
+	}
+
+	w := postWithHeaders(
+		handler, "[2001:db8:1:2::ffff]:44444", loginPath, nil,
+	)
+	assert.Equal(
+		t, http.StatusTooManyRequests, w.Code,
+		"rotating source addresses inside one routed /64 must not "+
+			"mint fresh buckets",
+	)
+}
+
+// TestLoginRateLimit_IPv6IndependentAcrossSlash64 is the other side
+// of the trade: bucketing by /64 must not merge separate allocations,
+// so a client in a different /64 keeps its own limit.
+func TestLoginRateLimit_IPv6IndependentAcrossSlash64(t *testing.T) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{})
+	handler := m.LoginRateLimit()(okHandler())
+
+	for range middleware.LoginRateLimitConst + 1 {
+		postWithHeaders(
+			handler, "[2001:db8:1:2::1]:44444", loginPath, nil,
+		)
+	}
+
+	w := postWithHeaders(
+		handler, "[2001:db8:1:3::1]:44444", loginPath, nil,
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a different /64 must have its own bucket",
+	)
+}
+
+// TestLoginRateLimit_IPv4IndependentPerAddress guards against the
+// masking leaking into IPv4: two addresses one apart must still hold
+// separate buckets.
+func TestLoginRateLimit_IPv4IndependentPerAddress(t *testing.T) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{})
+	handler := m.LoginRateLimit()(okHandler())
+
+	for range middleware.LoginRateLimitConst + 1 {
+		postWithHeaders(
+			handler, clientIPv4+":44444", loginPath, nil,
+		)
+	}
+
+	w := postWithHeaders(
+		handler, clientIPv4Alt+":44444", loginPath, nil,
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a second IPv4 address must have its own bucket",
+	)
+}
+
+// forwardedKeyFor returns the bucket key m computes for a request
+// that arrives from trustedPeer — a configured trusted proxy — and
+// names forwarded as its client in X-Forwarded-For. That is the
+// production path: a deployment is required to run behind a reverse
+// proxy with TRUSTED_PROXIES set, so the forwarded address, not the
+// peer, is what the limiters bucket on there.
+func forwardedKeyFor(
+	t *testing.T, m *middleware.Middleware, forwarded string,
+) string {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, loginPath, nil,
+	)
+	req.RemoteAddr = trustedPeer
+	req.Header.Set(headerXFF, forwarded)
+
+	return middleware.ClientKeyForTest(m, req)
+}
+
+// TestRateLimitKey_ForwardedIPv6BucketsByPrefix pins the /64
+// bucketing on the trusted-proxy branch. The direct-peer tests above
+// cannot reach it, so without this the masking could be reverted for
+// forwarded clients alone — the only shape a production deployment
+// runs in — and the rest of the suite would stay green.
+func TestRateLimitKey_ForwardedIPv6BucketsByPrefix(t *testing.T) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{
+		TrustedProxies: trustedProxies(trustedProxyCIDR),
+	})
+
+	for _, tc := range []struct {
+		name      string
+		forwarded string
+		want      string
+		about     string
+	}{{
+		name:      "ipv6",
+		forwarded: clientIPv6,
+		want:      clientBucketV6,
+		about:     "a forwarded IPv6 client must key on its /64",
+	}, {
+		name:      "ipv6-other-in-same-64",
+		forwarded: clientIPv6Same,
+		want:      clientBucketV6,
+		about: "another forwarded address in the same /64 must " +
+			"key the same",
+	}, {
+		name:      "ipv6-different-64",
+		forwarded: clientIPv6Other,
+		want:      clientOtherBucketV6,
+		about:     "a forwarded address in another /64 must differ",
+	}, {
+		name:      "ipv4",
+		forwarded: clientIPv4,
+		want:      clientIPv4,
+		about:     "a forwarded IPv4 client must key on the address",
+	}, {
+		name:      "ipv4-mapped",
+		forwarded: "::ffff:" + clientIPv4,
+		want:      clientIPv4,
+		about: "a proxy that forwards IPv4-mapped form must key as " +
+			"the IPv4 address it carries, not be masked to a /64: " +
+			"mapped addresses all share ::ffff:0:0/96",
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(
+				t, tc.want,
+				forwardedKeyFor(t, m, tc.forwarded), tc.about,
+			)
+		})
+	}
+}
+
+// TestLoginRateLimit_ForwardedIPv6SharesBucketWithinSlash64 is the
+// behavioural half on the production path: behind a trusted proxy, a
+// client rotating source addresses inside its own routed /64 must
+// stay in one bucket.
+func TestLoginRateLimit_ForwardedIPv6SharesBucketWithinSlash64(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	assertSharedBucket(
+		t, trustedProxies(trustedProxyCIDR), trustedPeer,
+		func(i int) map[string]string {
+			return map[string]string{
+				headerXFF: fmt.Sprintf("2001:db8:1:2::%d", i+1),
+			}
+		},
+		"rotating forwarded source addresses inside one routed /64 "+
+			"must not mint fresh buckets",
+	)
+}
+
+// TestLoginRateLimit_ForwardedIPv6IndependentAcrossSlash64 is the
+// other side of that trade on the same path: bucketing by /64 must
+// not merge two allocations reaching the proxy.
+func TestLoginRateLimit_ForwardedIPv6IndependentAcrossSlash64(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	m := rateLimitMiddleware(t, &config.Config{
+		TrustedProxies: trustedProxies(trustedProxyCIDR),
+	})
+	handler := m.LoginRateLimit()(okHandler())
+
+	spent := map[string]string{headerXFF: clientIPv6}
+	for range middleware.LoginRateLimitConst + 1 {
+		postWithHeaders(handler, trustedPeer, loginPath, spent)
+	}
+
+	w := postWithHeaders(
+		handler, trustedPeer, loginPath,
+		map[string]string{headerXFF: clientIPv6Other},
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a forwarded client in a different /64 must have its own "+
+			"bucket",
+	)
+}

internal/server/static_assets_test.go

@@ -0,0 +1,50 @@
+package server_test
+
+import (
+	"net/http"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/webhooker/templates"
+)
+
+// TestBaseTemplateScriptsAreServed walks every /s/ script the base
+// template loads on each page and fetches it through the real router.
+// Alpine.js is fetched at build time rather than committed, so nothing
+// in the repo guarantees it is present: this is the check that the page
+// still gets the JavaScript it asks for.
+func TestBaseTemplateScriptsAreServed(t *testing.T) {
+	t.Parallel()
+
+	// scriptSrc matches the src of every <script> tag pointing at the
+	// /s/ static mount.
+	scriptSrc := regexp.MustCompile(`<script[^>]+src="(/s/[^"]+)"`)
+
+	base, err := templates.Templates.ReadFile("base.html")
+	require.NoError(t, err)
+
+	matches := scriptSrc.FindAllStringSubmatch(string(base), -1)
+	require.NotEmpty(t, matches, "base.html should load scripts from /s/")
+
+	env := newTestEnv(t)
+
+	for _, m := range matches {
+		src := m[1]
+		t.Run(src, func(t *testing.T) {
+			t.Parallel()
+
+			w := env.get(src, nil)
+
+			require.Equalf(
+				t, http.StatusOK, w.Code,
+				"base.html loads %s but the server does not serve it", src,
+			)
+			assert.NotEmptyf(
+				t, w.Body.Bytes(), "%s is served but empty", src,
+			)
+		})
+	}
+}

script/bootstrap

@@ -5,7 +5,8 @@
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
 # it is installed from a hash-verified GitHub release archive (never
-# curl | sh).
+# curl | sh). Finishes by running script/fetch-assets, which installs the
+# hash-pinned third-party browser assets the repo does not commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -115,6 +116,11 @@ main() {
 
     go mod download
 
+    # Third-party browser assets are not committed; fetch and verify them
+    # so a fresh clone can build and test.
+    if missing curl; then pkg_install curl curl curl curl; fi
+    "$ROOT/script/fetch-assets"
+
     echo "bootstrap complete"
 }
 

script/fetch-assets

@@ -0,0 +1,104 @@
+#!/bin/sh
+# script/fetch-assets: download the third-party browser assets the web UI
+# ships and install them under static/. Minified bundles are not committed
+# (REPO_POLICIES.md: no build artifacts in version control), so the build
+# fetches them here. Every download is verified against a hardcoded sha256
+# before it is installed, and any mismatch aborts. Idempotent: an asset
+# already present with its pinned hash is left alone.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# The sha256 of each installed asset lives in static/vendor.sha256, in
+# sha256sum(1) format, with paths relative to static/. That file is the
+# single source of truth: this script verifies against it, and
+# static/vendor_test.go asserts the bytes embedded into the binary match
+# it, so the hash cannot rot into a value nothing checks.
+MANIFEST="static/vendor.sha256"
+
+# Alpine.js 3.14.9, 2026-08-17. Fetched from registry.npmjs.org, the
+# publisher of record; the jsDelivr and unpkg copies are mirrors of this
+# same tarball. dist/cdn.min.js is the browser build Alpine publishes for
+# a <script> tag.
+ALPINE_VERSION="3.14.9"
+ALPINE_URL="https://registry.npmjs.org/alpinejs/-/alpinejs-${ALPINE_VERSION}.tgz"
+# sha256 of alpinejs-3.14.9.tgz
+ALPINE_TARBALL_SHA256="97dad7c0c81e659cfc8e7700055da9770f8186187cb9a8a76efb57e00d5ce52a"
+ALPINE_MEMBER="package/dist/cdn.min.js"
+ALPINE_DEST="js/alpine.min.js"
+
+sha256_of() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+# expected_sha256 <path-relative-to-static>
+expected_sha256() {
+    awk -v want="$1" '$2 == want { print $1; found = 1 }
+        END { if (!found) exit 1 }' "$ROOT/$MANIFEST"
+}
+
+# verify <file> <expected-sha256> <what>
+verify() {
+    actual="$(sha256_of "$1")"
+    if [ "$actual" != "$2" ]; then
+        echo "fetch-assets: sha256 mismatch for $3" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# up_to_date <path-relative-to-static> <expected-sha256>
+up_to_date() {
+    [ -f "$ROOT/static/$1" ] || return 1
+    [ "$(sha256_of "$ROOT/static/$1")" = "$2" ]
+}
+
+fetch_alpine() {
+    want="$(expected_sha256 "$ALPINE_DEST")"
+
+    if up_to_date "$ALPINE_DEST" "$want"; then
+        echo "fetch-assets: static/$ALPINE_DEST already at $want"
+        return 0
+    fi
+
+    echo "fetch-assets: fetching Alpine.js $ALPINE_VERSION from $ALPINE_URL"
+    tmp="$(mktemp -d)"
+    trap 'rm -rf "$tmp"' EXIT INT TERM
+    curl -fsSL -o "$tmp/alpine.tgz" "$ALPINE_URL"
+    verify "$tmp/alpine.tgz" "$ALPINE_TARBALL_SHA256" "alpinejs-${ALPINE_VERSION}.tgz"
+    tar -xzOf "$tmp/alpine.tgz" "$ALPINE_MEMBER" >"$tmp/alpine.min.js"
+    verify "$tmp/alpine.min.js" "$want" "$ALPINE_MEMBER from alpinejs-${ALPINE_VERSION}.tgz"
+
+    mkdir -p "$(dirname "$ROOT/static/$ALPINE_DEST")"
+    cp "$tmp/alpine.min.js" "$ROOT/static/$ALPINE_DEST"
+    rm -rf "$tmp"
+    trap - EXIT INT TERM
+    echo "fetch-assets: installed static/$ALPINE_DEST ($want)"
+}
+
+# Re-check every manifest entry against what is now on disk, so an entry
+# no script installs fails loudly instead of passing silently.
+verify_manifest() {
+    while read -r want path; do
+        case "$want" in '' | '#'*) continue ;; esac
+        if [ ! -f "$ROOT/static/$path" ]; then
+            echo "fetch-assets: $MANIFEST lists static/$path, which is missing" >&2
+            exit 1
+        fi
+        verify "$ROOT/static/$path" "$want" "static/$path"
+    done <"$ROOT/$MANIFEST"
+}
+
+main() {
+    cd "$ROOT"
+    fetch_alpine
+    verify_manifest
+    echo "fetch-assets: all assets in $MANIFEST verified"
+}
+
+main "$@"

static/vendor.sha256

@@ -0,0 +1 @@
+3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3  js/alpine.min.js

static/vendor_test.go

@@ -0,0 +1,92 @@
+package static_test
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/webhooker/static"
+)
+
+const manifestPath = "vendor.sha256"
+
+// fetchHint is appended to every failure here: the assets the manifest
+// covers are fetched by the build, not committed, so a fresh clone that
+// has not run script/fetch-assets fails this test and should be told why.
+const fetchHint = "run `script/fetch-assets` (or `make assets`) to install " +
+	"the pinned third-party assets"
+
+// TestVendoredAssetsMatchManifest asserts that every asset listed in
+// static/vendor.sha256 is embedded in the binary with exactly the pinned
+// bytes. script/fetch-assets verifies the same hashes at download time;
+// this test verifies them again on what actually ships, so a build that
+// skipped, cached, or subverted the fetch cannot produce a binary serving
+// unpinned third-party JavaScript.
+func TestVendoredAssetsMatchManifest(t *testing.T) {
+	t.Parallel()
+
+	entries := readManifest(t)
+	require.NotEmpty(t, entries, "%s lists no assets", manifestPath)
+
+	for path, want := range entries {
+		t.Run(path, func(t *testing.T) {
+			t.Parallel()
+
+			data, err := static.Static.ReadFile(path)
+			require.NoErrorf(
+				t, err,
+				"%s is listed in %s but is not embedded; %s",
+				path, manifestPath, fetchHint,
+			)
+
+			sum := sha256.Sum256(data)
+			got := hex.EncodeToString(sum[:])
+			require.Equalf(
+				t, want, got,
+				"embedded %s does not match its pinned sha256 in %s; %s",
+				path, manifestPath, fetchHint,
+			)
+		})
+	}
+}
+
+// readManifest parses static/vendor.sha256, which is in sha256sum(1)
+// format with paths relative to static/.
+func readManifest(t *testing.T) map[string]string {
+	t.Helper()
+
+	f, err := os.Open(manifestPath)
+	require.NoError(t, err, "opening %s", manifestPath)
+
+	defer func() { require.NoError(t, f.Close()) }()
+
+	entries := make(map[string]string)
+	scanner := bufio.NewScanner(f)
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		fields := strings.Fields(line)
+		require.Lenf(
+			t, fields, 2,
+			"%s: malformed entry %q, want \"<sha256>  <path>\"",
+			manifestPath, line,
+		)
+
+		sum, path := fields[0], fields[1]
+		require.Lenf(t, sum, 64, "%s: %q is not a sha256", manifestPath, sum)
+		entries[path] = sum
+	}
+
+	require.NoError(t, scanner.Err(), "reading %s", manifestPath)
+
+	return entries
+}

templates/source_logs.html

@@ -37,6 +37,9 @@
 
                 <div x-show="open" x-cloak class="mt-3 p-3 bg-gray-50 rounded-md">
                     <pre class="text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all">{{.Body}}</pre>
+                    {{if .BodyTruncated}}
+                    <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged.</p>
+                    {{end}}
                 </div>
             </div>
             {{else}}