siftlode/backend/app/routes/diagnostics.py

"""The browser's log, sent while its user has a raised diagnostics level (E22 S5).

The client keeps its log in memory (frontend `lib/log.ts`). Only after the user consented to Részletes
or Teljes in Settings → Diagnosztika does it stream that log here, in batches, and each batch lands in
`log_events` beside the server's own rows: `source="web"`, the account from the SESSION (never from
the body), and the request id each event carries, which is what joins a browser line to the server
line of the same request.

Nothing from the body is trusted as-is:
  * only a JSON Content-Type is read, and the whole body is capped before it is parsed, and so are
    the number of events and each event's attributes;
  * the pace is capped per account, and so is what an account may store per hour;
  * everything is redacted AGAIN with the server's own rules — the client redacts at capture, but a
    modified client would not;
  * an event below the consented level is dropped (a Részletes consent does not store what only
    Teljes may carry), and so is the whole batch once the level has lapsed — where an open debug
    session the request names counts as consent to ITS level (E16), and only its own events keep
    its tag;
  * the timestamp is clamped to the consent window, so a row cannot dodge the retention job by
    claiming to come from the future.
"""

import json
from datetime import datetime, timedelta, timezone
from typing import Any, Literal

from fastapi import APIRouter, Depends, HTTPException, Request
from pydantic import BaseModel, Field, ValidationError
from sqlalchemy import insert
from sqlalchemy.orm import Session

from app import debugsession, diagnostics, logs, logsink
from app.auth import current_user
from app.db import get_db
from app.models import DebugSession, LogEvent, User
from app.ratelimit import RateLimiter
from app.routes._common import capped_body

router = APIRouter(prefix="/api/diagnostics", tags=["diagnostics"])

BODY_MAX_BYTES = 512 * 1024
EVENTS_MAX = 200
ATTRS_MAX_BYTES = 16 * 1024
# The client flushes every few seconds and when its buffer fills; this is room for a burst, not a
# pace anything legitimate keeps up for a minute.
_batches = RateLimiter(max_events=30, window_seconds=60)
# What one account may STORE per hour. The pace cap alone still lets a self-consented account write
# ~15 MiB a minute into the one shared database, kept for the whole retention window; a real session
# at Teljes stores a few hundred kB an hour. Past the budget a batch is accepted and not stored (a
# refusal would only make the client resend it), and one notice per hour says so.
STORED_BYTES_PER_HOUR = 5 * 1024 * 1024
_stored_bytes = RateLimiter(max_events=STORED_BYTES_PER_HOUR, window_seconds=3600)
_budget_notices = RateLimiter(max_events=1, window_seconds=3600)

ClientLevel = Literal["TRACE", "DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"]


class ClientEvent(BaseModel):
    ts: datetime
    level: ClientLevel
    event: str = Field(max_length=64, pattern=r"^[a-z][a-z0-9_]*(\.[a-z0-9_]+)*$")
    msg: str = Field(max_length=8_000)
    attrs: dict[str, Any] | None = None
    request_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9._-]{8,64}$")
    tab_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_-]{1,32}$")
    # The debug session the event was captured in (E16); kept only when it is the one this request
    # names in `X-Debug-Session` and the auth dependency found it the caller's own and open.
    debug_session_id: str | None = Field(default=None, pattern=r"^[0-9a-f]{16}$")
    version: str | None = Field(default=None, max_length=64)


class ClientEventsIn(BaseModel):
    events: list[ClientEvent] = Field(max_length=EVENTS_MAX)


async def _parsed_events(request: Request) -> ClientEventsIn:
    """The body as the model — parsed only after the size cap, which is why this is a dependency and
    not a plain body parameter (FastAPI reads a declared body in full before anything else runs).

    JSON only, by its Content-Type, as a declared body would be. Parsing any body as JSON would let a
    CORS-simple `text/plain` form post from a same-site page write events into a signed-in user's
    log; the app's own client always sends `application/json`, the unload beacon included."""
    media_type = request.headers.get("content-type", "").split(";")[0].strip().lower()
    if media_type != "application/json" and not media_type.endswith("+json"):
        raise HTTPException(status_code=415, detail={"code": "json_required"})
    raw = await capped_body(request, BODY_MAX_BYTES)
    try:
        return ClientEventsIn.model_validate_json(raw)
    except ValidationError as exc:
        raise HTTPException(status_code=422, detail=json.loads(exc.json())) from exc


def _row(
    item: ClientEvent,
    user: User,
    now: datetime,
    window_start: datetime,
    session: DebugSession | None,
) -> dict[str, Any]:
    attrs = logs.redact(item.attrs) if item.attrs else None
    if attrs is not None:
        size = len(json.dumps(attrs, ensure_ascii=False, default=str).encode())
        if size > ATTRS_MAX_BYTES:
            attrs = {"attrs_dropped_bytes": size}
    if item.tab_id:
        attrs = {**(attrs or {}), "tab_id": item.tab_id}
    ts = item.ts if item.ts.tzinfo else item.ts.replace(tzinfo=timezone.utc)
    return logsink.to_row(
        {
            "ts": min(max(ts, window_start), now),
            "level": item.level,
            "sev": logs.SEVERITY[item.level],
            "source": "web",
            "logger": "web",
            "event": item.event,
            "msg": logs.redact_text(item.msg),
            "attrs": attrs,
            "request_id": item.request_id,
            "user_id": user.id,
            "debug_session_id": (
                session.id if session and item.debug_session_id == session.id else None
            ),
            "version": item.version,
        }
    )


@router.post("/events")
def ingest_events(
    # The account first: dependencies resolve in order, so an anonymous caller is refused before a
    # byte of its body is read.
    request: Request,
    user: User = Depends(current_user),
    body: ClientEventsIn = Depends(_parsed_events),
    db: Session = Depends(get_db),
) -> dict:
    # A debug session the request names raises the level for its own events (E16): starting one is
    # the consent to that level for its duration, whatever the user's own level is.
    session = debugsession.from_header(db, user, request.headers.get(debugsession.HEADER))
    level, _ = debugsession.level_for(user, session)
    if level == diagnostics.BASE:
        # Lapsed or withdrawn: the client stops streaming when it sees this.
        raise HTTPException(status_code=409, detail={"code": "diagnostics_off"})
    if not _batches.allow(str(user.id)):
        raise HTTPException(status_code=429, detail={"code": "rate_limited"})
    now = datetime.now(timezone.utc)
    window_start = now - timedelta(hours=diagnostics.ELEVATION_HOURS)
    floor = logs.SEVERITY[level]
    rows = [
        _row(item, user, now, window_start, session)
        for item in body.events
        if logs.SEVERITY[item.level] >= floor
    ]
    if not rows:
        return {"ok": True, "stored": 0}
    size = sum(len(json.dumps(row, ensure_ascii=False, default=str).encode()) for row in rows)
    stored = len(rows)
    if not _stored_bytes.allow(str(user.id), size):
        stored = 0
        if not _budget_notices.allow(str(user.id)):
            return {"ok": True, "stored": 0}
        rows = [_budget_notice(user, now)]
    # Under the erasure guard until the commit: an account erased meanwhile gets no rows back.
    with logs.erasure_guard():
        db.execute(insert(LogEvent), logsink.without_erased(rows))
        db.commit()
    return {"ok": True, "stored": stored}


def _budget_notice(user: User, now: datetime) -> dict[str, Any]:
    return logsink.to_row(
        {
            "ts": now,
            "level": "WARNING",
            "sev": logs.SEVERITY["WARNING"],
            "source": "web",
            "logger": "web",
            "event": "diagnostics.budget_spent",
            # What the budget does, exactly: it is a SLIDING hour, and a refused batch is not
            # charged to it, so smaller batches keep landing while there is room for them. Saying
            # "the rest of the hour is not kept" would be a row contradicting the rows beneath it.
            "msg": "The browser log passed its hourly storage budget; a batch bigger than what is left of it is not kept",
            "attrs": {"budget_bytes": STORED_BYTES_PER_HOUR},
            "user_id": user.id,
        }
    )