Cookie banner public REST API

[codenem]

Closes ENG-271

---

Summary by cubic

Validate and canonicalize cookie banner origins, enforce one active banner per origin per tenant, and add public JS SDK endpoints (config, consent read/write) with per-banner CORS, CSRF bypass, and anonymized IP logging. Add pkg/server/trustedproxy to strip untrusted forwarded headers and convert pkg/server/api/clientip into an RFC 7239 extractor; addresses ENG-271.

• New Features

  • Origin handling: new validator Origin() and canonicalization to scheme://host[:port] (strip www., remove trailing slash, no path/query/userinfo, reject empty port). Applied on create/update so CORS checks match.
  • Uniqueness: partial unique index idx_cookie_banners_unique_active_origin; DB violations map to ErrOriginAlreadyInUse on create/update/activate.
  • Public REST API under /cookie-banner/v1: GET /{bannerID}/config, GET /{bannerID}/consents/{visitorID}, POST /{bannerID}/consents. Per-banner CORS validates the request Origin against the banner’s canonical origin; CSRF bypass added.
  • Consent flow: IPs anonymized (IPv4 last octet, IPv6 /48). Client IP from RFC 7239 Forwarded, then leftmost X-Forwarded-For; consent reads are deterministic (created_at then id desc). Adds pkg/server/jsonutil error helpers.
  • Trusted proxies: new pkg/server/trustedproxy middleware strips Forwarded and X-Forwarded-For from untrusted sources; wired into the API server using existing trusted-proxies config. pkg/server/api/clientip is now a pure extractor.

• Migration

  • Run DB migrations to create the partial unique index.
  • Ensure no tenant has multiple ACTIVE banners with the same origin before migrating; docs updated with timestamp naming.

^{Written for commit e3ab373. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/server/api/cookiebanner/v1/handler.go">

<violation number="1" location="pkg/server/api/cookiebanner/v1/handler.go:48">
P1: The new `/{bannerID}/config` handler returns a static `{\"status\":\"ok\"}` response instead of banner configuration, so SDK clients cannot fetch the data this endpoint is meant to provide.</violation>
</file>

<file name="pkg/server/api/api.go">

<violation number="1" location="pkg/server/api/api.go:186">
P1: `cfg.CookieBanner` is used without validation. A nil `CookieBanner` service will panic when the cookie-banner middleware handles requests.</violation>
</file>

<file name="contrib/claude/coredata.md">

<violation number="1" location="contrib/claude/coredata.md:177">
P3: The first migration bullet is incomplete and drops the explicit naming rule, making the guideline unclear.</violation>
</file>

<file name="pkg/coredata/cookie_banner.go">

<violation number="1" location="pkg/coredata/cookie_banner.go:188">
P1: `LoadActiveByOrigin` is not tenant-scoped, so origin lookups can return another tenant’s active banner when origins overlap.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[gearnode]

LGTM

[cubic-dev-ai]

4 issues found across 15 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/server/api/cookiebanner/v1/handler.go">

<violation number="1" location="pkg/server/api/cookiebanner/v1/handler.go:170">
P1: `clientIP` can return the full `X-Forwarded-For` chain, which is not a single IP and bypasses anonymization (it gets stored raw when `ParseIP` fails). Parse and use only the first forwarded client IP before passing it to `RecordConsent`.</violation>
</file>

<file name="pkg/coredata/cookie_consent_record.go">

<violation number="1" location="pkg/coredata/cookie_consent_record.go:226">
P2: Make latest-consent selection deterministic by adding a secondary sort key.</violation>
</file>

<file name="pkg/validator/validator_format.go">

<violation number="1" location="pkg/validator/validator_format.go:163">
P2: Origin validation accepts malformed host values with an empty port suffix (e.g. `https://example.com:/`) because only `parsedURL.Host == ""` is checked.</violation>
</file>

<file name="pkg/coredata/migrations/20260413T130000Z.sql">

<violation number="1" location="pkg/coredata/migrations/20260413T130000Z.sql:15">
P1: Backfill/canonicalize existing `cookie_banners.origin` values before creating this unique index; otherwise canonical-equivalent legacy origins remain unenforced and can break origin matching.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[gearnode]

LGTM