clawbot
0 Followers · 0 Following
  • Joined on 2026-02-08
Repositories
1
 Projects Packages Code Public Activity Starred Repositories
clawbot commented on pull request sneak/webhooker#74 2026-08-07 14:02:22 +02:00
Keep the SSRF-safe transport in clientForConfig (closes #69)

Independent review — PASS (merge-ready)

Adversarial review against the issue spec and repo policies. This one is security-sensitive, so I scrutinized it closely.

  • `internal/delivery/engine.g…
clawbot commented on pull request sneak/webhooker#73 2026-08-07 14:00:45 +02:00
Validate Slack target URLs at creation time (closes #68)

Independent review — PASS (merge-ready)

Adversarial review against the issue spec and repo policies.

  • internal/handlers/source_management.go: buildSlackTargetConfig now calls `delivery.V…
clawbot commented on pull request sneak/webhooker#74 2026-08-07 14:00:19 +02:00
Keep the SSRF-safe transport in clientForConfig (closes #69)

What changed

  • internal/delivery/engine.go — clientForConfig(): when a per-target timeout is set, the returned http.Client now sets Transport: e.client.Transport (the shared…
clawbot created pull request sneak/webhooker#74 2026-08-07 14:00:10 +02:00
Keep the SSRF-safe transport in clientForConfig (closes #69)
clawbot commented on pull request sneak/webhooker#73 2026-08-07 13:59:09 +02:00
Validate Slack target URLs at creation time (closes #68)

What changed

Confined to internal/handlers/ (validator in internal/delivery/ untouched):

  • internal/handlers/source_management.go: buildSlackTargetConfig now takes the request and…
clawbot created pull request sneak/webhooker#73 2026-08-07 13:58:57 +02:00
Validate Slack target URLs at creation time (closes #68)
clawbot commented on pull request sneak/webhooker#72 2026-08-07 13:56:48 +02:00
Raise HTTP WriteTimeout above the request middleware timeout (closes #62)

Independent review — PASS (merge-ready)

Adversarial review against the issue spec and repo policies.

  • internal/server/http.go: httpWriteTimeout raised from 10s to 65s, above the…
clawbot commented on pull request sneak/webhooker#72 2026-08-07 13:56:07 +02:00
Raise HTTP WriteTimeout above the request middleware timeout (closes #62)

Change summary

Single file changed: internal/server/http.go

  • httpWriteTimeout raised from 10 * time.Second to 65 * time.Second
  • comment added explaining it must stay above the…
clawbot created pull request sneak/webhooker#72 2026-08-07 13:55:59 +02:00
Raise HTTP WriteTimeout above the request middleware timeout (closes #62)
clawbot commented on pull request sneak/webhooker#71 2026-08-07 13:50:55 +02:00
Wrap /user/{username} in RequireAuth middleware (closes #60)

Independent review — PASS (merge-ready)

Reviewed the diff against the issue spec and repo policies; posture was adversarial.

Correctness / spec

  • internal/server/routes.go `setupUserRo…
clawbot commented on pull request sneak/webhooker#71 2026-08-07 13:48:48 +02:00
Wrap /user/{username} in RequireAuth middleware (closes #60)

What changed

internal/server/routes.go — in setupUserRoutes(), added r.Use(s.mw.RequireAuth()) immediately after the existing r.Use(s.mw.CSRF()) on the /user/{username} route…

clawbot created pull request sneak/webhooker#71 2026-08-07 13:48:38 +02:00
Wrap /user/{username} in RequireAuth middleware (closes #60)
clawbot commented on issue sneak/webhooker#69 2026-08-07 13:45:46 +02:00
Keep the SSRF-safe Transport in clientForConfig when a per-target timeout is set

Implementation instructions

Confine this change to internal/delivery/ ONLY (engine.go plus a delivery-package test). Do not touch handlers or server code.

The problem: the engine's shared…

clawbot commented on issue sneak/webhooker#68 2026-08-07 13:45:40 +02:00
Validate Slack target URLs at creation time (SSRF parity with HTTP targets)

Implementation instructions

Confine this change to internal/handlers/source_management.go and its test file ONLY. Do NOT modify internal/delivery/ — the validator already exists and is…

clawbot commented on issue sneak/webhooker#62 2026-08-07 13:45:34 +02:00
Reconcile HTTP WriteTimeout with the request middleware timeout

Implementation instructions

Confine this change to internal/server/http.go ONLY. Do NOT edit internal/server/routes.go — another change is in flight there, and requestTimeout (60s)…

clawbot commented on issue sneak/webhooker#60 2026-08-07 13:32:52 +02:00
Wrap the /user/{username} route in RequireAuth middleware

Implementation instructions

Scope is exactly the definition of done above — one small, isolated change. Do not expand scope.

Change 1 — internal/server/routes.go, setupUserRoutes()

…

clawbot commented on issue sneak/webhooker#33 2026-08-07 13:20:25 +02:00
1.0/mvp

Correction per your decision (2026-08-07): the database and log delivery targets are REQUIRED for 1.0, so nothing gets hidden. #70 is reframed from "hide the no-op options" to "implement the…

clawbot commented on issue sneak/webhooker#57 2026-08-07 13:20:24 +02:00
Clean up and clarify the web UI

Correction per @sneak's 2026-08-07 decision: the database and log target options stay — they are required for 1.0 and will be implemented (database archiving in #43, log target in #70).…

clawbot commented on issue sneak/webhooker#33 2026-08-07 13:16:34 +02:00
1.0/mvp

Follow-up: a deeper build-level pass finished after the comment above (assessed origin/main @ 2cc8723 in a throwaway worktree; make check and docker build . are both GREEN — the CI-pinned…

clawbot commented on issue sneak/webhooker#57 2026-08-07 13:16:27 +02:00
Clean up and clarify the web UI

Concrete items for this cleanup, from the 1.0 re-audit (see #33):

  • Unify terminology: the nav and URLs say Sources / /source, but page headings say Webhook(s) — one concept, pick one name. -…