JMR-devandClaude Opus 4.8
bd7fe21d97
Implement the storage path: for each accepted report, scrub PII (#8), encrypt with AES-256-GCM (ADR #5), and write only ciphertext to R2, wired in as the real ingest Sink replacing NopSink. - internal/crypto: AES-256-GCM in the exact ADR #5 wire format (magic "LMB1" || version || key_id BE16 || nonce(12) || ct || tag(16); the 7-byte header is the GCM AAD). Provider-independent framing shared by a host crypto/aes+crypto/cipher impl (tests, devserver) and a Wasm SubtleCrypto impl (syscall/js, //go:build js && wasm) per the TinyGo constraint; both produce byte-identical frames. Versioned keyring with key_id rotation; ParseKeyring reads the Secrets Store JSON secret. - internal/storage: ObjectStore interface with an in-memory fake (tests, devserver) and a Wasm R2Store (syumai/workers R2 binding). Sink ties scrub -> Seal -> Put under a unique reports/<ts>-<rand> key. WorkerSink loads the keyring from Secrets Store (BUGREPORT_ENC_KEYRING), cached for the isolate lifetime. - handler.New now takes an injectable ingest.Sink; the Worker uses the real R2/Secrets-Store sink, the devserver a memory + throwaway-key sink. - wrangler.jsonc: add REPORTS_BUCKET (R2) and BUGREPORT_ENC_KEYRING (Secrets Store) bindings. Tests (host, no TinyGo): encrypt/decrypt roundtrip; ciphertext != plaintext; wrong key + tamper (ct/tag/nonce/header-AAD) fail; exact wire layout plus a known-answer vector; key_id rotation with retained keys; full sink path (PII scrubbed then encrypted, readback requires the key and yields the scrubbed content). Existing ingest/handler behavior preserved (202 on valid POST). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
1.6 KiB
Go
48 lines
1.6 KiB
Go
// Command devserver runs the core bug-report ingest handler on a plain
|
|
// net/http server for local development.
|
|
//
|
|
// It deliberately does not depend on TinyGo or the Cloudflare Workers runtime,
|
|
// so `go run ./cmd/devserver` works with the standard Go toolchain and exercises
|
|
// the exact same handler that the deployed Wasm Worker serves. It listens on
|
|
// :8787 by default (matching wrangler dev's default port); override with ADDR.
|
|
//
|
|
// The ingest path is wired with the real scrub+encrypt storage Sink (#9) backed
|
|
// by an in-memory object store and a throwaway per-run AES-256 key, so a POST
|
|
// /v1/reports exercises the full pipeline locally. Stored objects live only for
|
|
// the process lifetime.
|
|
package main
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
|
|
"github.com/JMR-dev/LibreMail-Bug-Report-Ingest/internal/crypto"
|
|
"github.com/JMR-dev/LibreMail-Bug-Report-Ingest/internal/handler"
|
|
"github.com/JMR-dev/LibreMail-Bug-Report-Ingest/internal/storage"
|
|
)
|
|
|
|
func main() {
|
|
addr := os.Getenv("ADDR")
|
|
if addr == "" {
|
|
addr = ":8787"
|
|
}
|
|
|
|
// A throwaway keyring: a single random key generated at startup. Reports are
|
|
// scrubbed, encrypted under it, and held in memory; nothing is persisted.
|
|
key, err := crypto.GenerateKey()
|
|
if err != nil {
|
|
log.Fatalf("devserver: generate key: %v", err)
|
|
}
|
|
keyring, err := crypto.NewKeyring(1, map[uint16][]byte{1: key})
|
|
if err != nil {
|
|
log.Fatalf("devserver: build keyring: %v", err)
|
|
}
|
|
sink := storage.NewSink(storage.NewMemoryStore(), keyring)
|
|
|
|
log.Printf("devserver listening on %s (try GET / and GET /healthz)", addr)
|
|
if err := http.ListenAndServe(addr, handler.New(sink)); err != nil {
|
|
log.Fatalf("devserver: %v", err)
|
|
}
|
|
}
|