보안 모바일 Telemetry 프록시

{
  "event_name": "mobile_sync_completed",
  "event_version": 1,
  "event_id": "0196f37e-6e83-7b75-9d04-6b8283b35f74",
  "occurred_at": "2026-07-30T18:42:11.150Z",
  "status": "success",
  "duration_ms": 842,
  "item_count": 12,
  "network_type": "wifi"
}

type Actor = {
  accountId: string;
  deviceSessionId: string;
  platform: "ios" | "android";
  appVersion: string;
};
type Dependencies = {
  authenticate: (request: Request) => Promise<Actor | null>;
  allowRequest: (actor: Actor) => Promise<boolean>;
  apiKey: string;
  environment: "production" | "staging" | "development";
  diagnostic?: () => void;
};
const fields = new Set([
  "event_name", "event_version", "event_id", "occurred_at",
  "status", "duration_ms", "item_count", "network_type",
]);
const statuses = new Set(["success", "failed", "cancelled"]);
const networks = new Set(["wifi", "cellular", "ethernet", "offline", "unknown"]);

async function readBoundedJson(request: Request) {
  if (!request.body) return { ok: false as const, status: 400 };
  const reader = request.body.getReader();
  const chunks: Uint8Array[] = [];
  let bytes = 0;
  try {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      bytes += value.byteLength;
      if (bytes > 4096) {
        void reader.cancel().catch(() => {});
        return { ok: false as const, status: 413 };
      }
      chunks.push(value);
    }
    const joined = new Uint8Array(bytes);
    let offset = 0;
    for (const chunk of chunks) {
      joined.set(chunk, offset);
      offset += chunk.byteLength;
    }
    const text = new TextDecoder("utf-8", { fatal: true }).decode(joined);
    return { ok: true as const, value: JSON.parse(text) as unknown };
  } catch {
    return { ok: false as const, status: 400 };
  } finally {
    reader.releaseLock();
  }
}
function integerBetween(value: unknown, maximum: number): value is number {
  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= maximum;
}
function boundedText(value: unknown, maximum: number): value is string {
  return typeof value === "string" && value.length > 0 && value.length <= maximum;
}
function clientTimestamp(value: unknown, receivedAt: number) {
  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return false;
  const parsed = Date.parse(value);
  return Number.isFinite(parsed) && new Date(parsed).toISOString() === value &&
    parsed >= receivedAt - 86_400_000 && parsed <= receivedAt + 300_000;
}

export function createMobileTelemetryHandler(deps: Dependencies) {
  return async function postMobileTelemetry(request: Request) {
    const reportFailure = () => { try { deps.diagnostic?.(); } catch {} };
    try {
      if (request.method !== "POST") return new Response(null, { status: 405, headers: { Allow: "POST" } });
      const actor = await deps.authenticate(request);
      if (!actor) return new Response("unauthorized", { status: 401 });
      const type = request.headers.get("content-type")?.split(";")[0].trim().toLowerCase();
      if (type !== "application/json") return new Response("unsupported content type", { status: 415 });
      if (!(await deps.allowRequest(actor))) return new Response("rate limited", { status: 429 });
      const parsed = await readBoundedJson(request);
      if (!parsed.ok) return new Response("invalid body", { status: parsed.status });
      const input = parsed.value;
      if (input === null || typeof input !== "object" || Array.isArray(input)) {
        return new Response("invalid event", { status: 422 });
      }
      const body = input as Record<string, unknown>;
      const receivedAt = Date.now();
      if (
        Object.keys(body).some(key => !fields.has(key)) ||
        body.event_name !== "mobile_sync_completed" || body.event_version !== 1 ||
        typeof body.event_id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(body.event_id) ||
        !clientTimestamp(body.occurred_at, receivedAt) ||
        typeof body.status !== "string" || !statuses.has(body.status) ||
        !integerBetween(body.duration_ms, 300_000) || !integerBetween(body.item_count, 10_000) ||
        typeof body.network_type !== "string" || !networks.has(body.network_type)
      ) return new Response("invalid event", { status: 422 });
      if (
        !deps.apiKey || !boundedText(actor.accountId, 128) || !boundedText(actor.deviceSessionId, 128) ||
        !boundedText(actor.appVersion, 80) || !["ios", "android"].includes(actor.platform) ||
        !["production", "staging", "development"].includes(deps.environment)
      ) return new Response("collector unavailable", { status: 503 });
      const response = await fetch("https://api.telemetry.sh/log", {
        method: "POST",
        headers: { "Content-Type": "application/json", Authorization: `Bearer ${deps.apiKey}` },
        signal: AbortSignal.timeout(1000),
        body: JSON.stringify({ table: "mobile_sync_completed", data: {
          event_id: body.event_id, event_version: 1, occurred_at: body.occurred_at,
          received_at: new Date(receivedAt).toISOString(), status: body.status,
          duration_ms: body.duration_ms, item_count: body.item_count,
          network_type: body.network_type, account_id: actor.accountId,
          app_platform: actor.platform, app_version: actor.appVersion,
          environment: deps.environment,
        } }),
      });
      if (!response.ok) {
        void response.body?.cancel().catch(() => {});
        reportFailure();
        return new Response("collection unavailable", { status: 503 });
      }
      void response.body?.cancel().catch(() => {});
      return new Response(null, { status: 202 });
    } catch {
      reportFailure();
      return new Response("collection unavailable", { status: 503 });
    }
  };
}

SELECT
  received_at,
  event_id,
  app_platform,
  app_version,
  status,
  duration_ms,
  item_count
FROM mobile_sync_completed
WHERE event_id = 'your-real-observed-event-id'
ORDER BY received_at DESC
LIMIT 50;