Validate Slack target URLs at creation time (closes #68)

internal/handlers/source_management.go

@@ -902,7 +902,7 @@ func (h *Handlers) buildTargetConfig(
 	case database.TargetTypeHTTP:
 		return h.buildHTTPTargetConfig(w, r, targetURL)
 	case database.TargetTypeSlack:
-		return h.buildSlackTargetConfig(w, targetURL)
+		return h.buildSlackTargetConfig(w, r, targetURL)
 	case database.TargetTypeDatabase, database.TargetTypeLog:
 		return "", nil
 	default:
@@ -967,6 +967,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 // buildSlackTargetConfig builds config JSON for a Slack target.
 func (h *Handlers) buildSlackTargetConfig(
 	w http.ResponseWriter,
+	r *http.Request,
 	targetURL string,
 ) (string, error) {
 	if targetURL == "" {
@@ -979,6 +980,24 @@ func (h *Handlers) buildSlackTargetConfig(
 		return "", errMissingURL
 	}
 
+	err := delivery.ValidateTargetURL(
+		r.Context(), targetURL,
+	)
+	if err != nil {
+		h.log.Warn(
+			"target URL blocked by SSRF protection",
+			"url", targetURL,
+			"error", err,
+		)
+		http.Error(
+			w,
+			"Invalid target URL: "+err.Error(),
+			http.StatusBadRequest,
+		)
+
+		return "", err
+	}
+
 	cfg := map[string]any{"webhookUrl": targetURL}
 
 	configBytes, err := json.Marshal(cfg)