workers/csp-report.ts

Functions

Imports

It imports workers/security-headers.ts. Imported by workers/app.ts.

Source

1// The Content-Security-Policy report sink, on the AI door (the one Carrel host outside Access, so a
2// browser's report reaches it without a session). The receiver is the portfolio's shared one
3// (@dustinedwards/site-runtime/csp-report): 204 to every POST, the body read to 16 KB and no further,
4// at most 10 violations logged with URLs cut to origin and path, nothing stored. Pages on the browser
5// host report here cross-origin: `report-uri` posts without a preflight, and `report-to` (the
6// Reporting API) preflights, so the receiver answers CORS for Carrel's origin alone. The door has no
7// limiter for reports (its only one counts client registrations in KV), so each isolate logs at most
8// REPORTS_PER_MINUTE requests a minute and drops the rest, still with 204 (Grok audit 2026-10-21, CR-5).
9
10import { receiveCspReport } from "@dustinedwards/site-runtime/csp-report";
11
12import { CSP_REPORT_PATH, doorSecurityHeaders } from "./security-headers";
13
14/** Whether a request is for the sink. */
15export function isCspReport(request: Request): boolean {
16  return new URL(request.url).pathname === CSP_REPORT_PATH;
17}
18
19const REPORTS_PER_MINUTE = 60;
20let budget = { minute: 0, used: 0 };
21
22/** Whether this isolate may log one more report request this minute. */
23function withinBudget(): boolean {
24  const minute = Math.floor(Date.now() / 60_000);
25  if (budget.minute !== minute) budget = { minute, used: 0 };
26  return ++budget.used <= REPORTS_PER_MINUTE;
27}
28
29/** Receives one report request on the AI door, with CORS for Carrel's own pages. */
30export function cspReport(request: Request, carrelOrigin: string): Promise<Response> {
31  return receiveCspReport(request, { allow: withinBudget, allowOrigin: carrelOrigin, headers: doorSecurityHeaders });
32}