Add Bounded Web Admission Diagnostics

src/web_server.c

@@ -29,6 +29,7 @@
 #include "web_session_store.h"
 #include "web_cookie_auth.h"
 #include "web_httpd_adapter.h"
+#include "web_diagnostics.h"
 #include "web_ui.h"
 #include "wifi_manager.h"
 
@@ -421,10 +422,15 @@ static const httpd_uri_t s_status_uri = {
     .user_ctx = NULL,
 };
 
+static esp_err_t traced_ticket_handler(httpd_req_t *request)
+{
+    return web_diagnostics_handler(request, WEB_DIAG_SERIAL_TICKET, ticket_handler);
+}
+
 static const httpd_uri_t s_ticket_uri = {
     .uri = WEB_SERIAL_TRANSPORT_TICKET_URI,
     .method = HTTP_POST,
-    .handler = ticket_handler,
+    .handler = traced_ticket_handler,
     .user_ctx = NULL,
 };
 
@@ -439,10 +445,25 @@ static esp_err_t websocket_handler(httpd_req_t *request)
     return error;
 }
 
+static esp_err_t traced_websocket_handler(httpd_req_t *request)
+{
+    return web_diagnostics_handler(request, WEB_DIAG_SERIAL_UPGRADE, websocket_handler);
+}
+
+static esp_err_t traced_admin_ticket_handler(httpd_req_t *request)
+{
+    return web_diagnostics_handler(request, WEB_DIAG_ADMIN_TICKET, web_admin_transport_ticket_handler);
+}
+
+static esp_err_t traced_admin_upgrade_handler(httpd_req_t *request)
+{
+    return web_diagnostics_handler(request, WEB_DIAG_ADMIN_UPGRADE, web_admin_transport_upgrade_handler);
+}
+
 static const httpd_uri_t s_websocket_uri = {
     .uri = WEB_SERIAL_TRANSPORT_WS_URI,
     .method = HTTP_GET,
-    .handler = websocket_handler,
+    .handler = traced_websocket_handler,
     .user_ctx = NULL,
     /* Authorize and admit before the adapter sends 101, not IDF's pre-handler path. */
     .is_websocket = false,
@@ -452,13 +473,13 @@ static const httpd_uri_t s_websocket_uri = {
 static const httpd_uri_t s_admin_ticket_uri = {
     .uri = WEB_ADMIN_TICKET_URI,
     .method = HTTP_POST,
-    .handler = web_admin_transport_ticket_handler,
+    .handler = traced_admin_ticket_handler,
 };
 
 static const httpd_uri_t s_admin_websocket_uri = {
     .uri = WEB_ADMIN_WS_URI,
     .method = HTTP_GET,
-    .handler = web_admin_transport_upgrade_handler,
+    .handler = traced_admin_upgrade_handler,
     .is_websocket = false, /* Cookie/Origin/ticket/console admission precedes 101. */
 };
 
@@ -606,6 +627,8 @@ esp_err_t web_server_start(void)
         config.prvtkey_len = private_key_length;
         config.port_secure = WEB_SERVER_PORT;
         config.tls_handshake_timeout_ms = 5000U;
+        /* Public synchronous post-TLS observation; HTTPS retains all cleanup. */
+        config.user_cb = web_diagnostics_tls;
         error = httpd_ssl_start(&server, &config);
     }
     secure_wipe(certificate, sizeof(certificate));