Store a target's number of delivery attempts, at least one (closes #540)

Target.MaxRetries (max_retries) becomes Target.MaxAttempts
(max_attempts), and the form field, parser and ceiling are renamed to
match. 1 is a single attempt with no circuit breaker; above 1 retries
behind the breaker up to that many attempts. Both target forms refuse
0 and less and default a blank field to 1. The target page shows the
plain number, and the README's two paragraphs on 0 against 1 become
one sentence.

Model: opus-5-5

internal/handlers/delivery_replay.go

@@ -308,7 +308,7 @@ func createReplayDelivery(
 		TargetName:   target.Name,
 		TargetType:   target.Type,
 		TargetConfig: target.Config,
-		MaxRetries:   target.MaxRetries,
+		MaxAttempts:  target.MaxAttempts,
 		Method:       event.Method,
 		RawQuery:     event.RawQuery,
 		Headers:      event.Headers,

internal/handlers/event_log.go

@@ -496,7 +496,7 @@ const deliveryIDChunkSize = 500
 //
 // Each response body is cut by SQLite rather than in Go, for
 // the reason deliveryResultColumns gives. How many attempts a
-// delivery has is the target's MaxRetries, which the
+// delivery has is bounded by the target's MaxAttempts, which the
 // authenticated operator sets; how many of them reach the page
 // is bounded again by maxRenderedAttempts.
 func (h *Handlers) loadDeliveryResults(

internal/handlers/export_test.go

@@ -37,10 +37,10 @@ const MaxRenderedResponseBytesForTest = maxRenderedResponseBytes
 // per-delivery attempt ceiling to the handlers_test package.
 const MaxRenderedAttemptsForTest = maxRenderedAttempts
 
-// MaxTargetRetriesForTest exposes the target max_retries ceiling to
+// MaxTargetAttemptsForTest exposes the target max_attempts ceiling to
 // the handlers_test package, so the tests assert against the constant
 // the handlers enforce rather than a number copied beside it.
-const MaxTargetRetriesForTest = maxTargetRetries
+const MaxTargetAttemptsForTest = maxTargetAttempts
 
 // EventDBLeftMsgForTest and SidecarLeftMsgForTest expose the two
 // messages the webhook delete handler logs when a file of the event

internal/handlers/target_attempts.go

@@ -0,0 +1,81 @@
+package handlers
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+// maxTargetAttempts bounds a target's max_attempts.
+//
+// Both target forms already declare max="20" on the input, so this
+// enforces server-side what the UI has always advertised rather than
+// introducing a new limit.
+//
+// The number is not cosmetic. Every attempt writes a delivery_results
+// row that the event log then loads and renders, and the engine backs
+// off by 2^(n-1) seconds, so attempt 20 is already about six days
+// after the first. A value beyond this buys no additional durability
+// and only costs rows.
+const maxTargetAttempts = 20
+
+// Errors returned when a max_attempts form value cannot be turned into
+// a number of attempts.
+var (
+	// errAttemptsInvalid signals a max_attempts form value that is not
+	// a whole number of at least 1.
+	errAttemptsInvalid = errors.New(
+		"must be a whole number, at least 1",
+	)
+
+	// errAttemptsTooLarge signals a max_attempts form value that is a
+	// whole number but above maxTargetAttempts. It is distinguished
+	// from errAttemptsInvalid so the message can name the ceiling
+	// instead of implying the input was not a number.
+	errAttemptsTooLarge = errors.New("out of range")
+)
+
+// parseMaxAttempts interprets a max_attempts form value.
+//
+// An ABSENT value — the field empty or not submitted — yields
+// fallback, which lets the create path apply its default and the edit
+// path leave the stored value alone. A value that is SET BUT INVALID
+// is an error: unparseable, below 1, or above maxTargetAttempts.
+//
+// The distinction is the whole point of this function. Returning a
+// default for input the operator typed but that did not parse would
+// silently turn retries off on a store-and-forward proxy — and on the
+// edit path destroy a working configuration over a typo. A default
+// answers a question that was not asked; it never answers one that
+// was asked badly.
+func parseMaxAttempts(raw string, fallback int) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return fallback, nil
+	}
+
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 1 {
+		return 0, errAttemptsInvalid
+	}
+
+	if v > maxTargetAttempts {
+		return 0, errAttemptsTooLarge
+	}
+
+	return v, nil
+}
+
+// attemptsErrorMessage returns the message the create and edit forms
+// show for a rejected max_attempts value. Any error other than
+// errAttemptsTooLarge falls back to the generic wording, so an
+// unrecognised parse failure still produces a sensible 400.
+func attemptsErrorMessage(err error) string {
+	if errors.Is(err, errAttemptsTooLarge) {
+		return errAttemptsTooLarge.Error() +
+			": at most " + strconv.Itoa(maxTargetAttempts) +
+			" attempts"
+	}
+
+	return errAttemptsInvalid.Error()
+}

internal/handlers/target_attempts_test.go

@@ -0,0 +1,429 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+)
+
+// attemptsTargetURL is the destination the attempts-validation targets
+// point at. It is a literal public address rather than a hostname so
+// the SSRF check resolves nothing and a sandbox without DNS cannot
+// make these cases pass or fail for the wrong reason.
+const attemptsTargetURL = "https://93.184.216.34/hooks/attempts"
+
+const (
+	// wayAboveCeiling is the typo'd-extra-zero case from the report.
+	wayAboveCeiling = "999999999"
+
+	// notANumber is the plainest garbage an operator can type, and
+	// the value the report submitted on the edit form.
+	notANumber = "abc"
+
+	// workingAttempts is the number of attempts a seeded target is
+	// already delivering with, which a rejected submission must not
+	// disturb.
+	workingAttempts = 2
+)
+
+// aboveCeiling is the smallest rejected whole number.
+func aboveCeiling() string {
+	return strconv.Itoa(handlers.MaxTargetAttemptsForTest + 1)
+}
+
+// overCeilingAttempts is whole-number input past the limit, which is
+// rejected with the limit named.
+func overCeilingAttempts() []string {
+	return []string{aboveCeiling(), wayAboveCeiling}
+}
+
+// belowOneAttempts is whole-number input under the floor of one
+// attempt, which is rejected with the floor named.
+func belowOneAttempts() []string {
+	return []string{"0", "-5"}
+}
+
+// unparseableAttempts is input an operator can type into the field
+// that is not a number of attempts. Each must be REJECTED: silently
+// reading any of them as a default turns retries off on a
+// store-and-forward proxy without saying so.
+//
+// The twenty-digit case is here because it parses as digits but
+// overflows int, which is the one failure the field's own min/max
+// attributes cannot describe.
+func unparseableAttempts() []string {
+	return []string{
+		notANumber,
+		"2.7",
+		"12345678901234567890",
+		"1e3",
+	}
+}
+
+// createAttemptsForm is a complete, otherwise-valid HTTP target
+// creation, so the only thing any case below varies is max_attempts.
+func createAttemptsForm(attempts string) url.Values {
+	form := url.Values{}
+	form.Set("name", "attempts-target")
+	form.Set("type", string(database.TargetTypeHTTP))
+	form.Set("url", attemptsTargetURL)
+
+	if attempts != absentField {
+		form.Set("max_attempts", attempts)
+	}
+
+	return form
+}
+
+// absentField marks a field the form does not submit at all, which is
+// the case that legitimately takes a default and must stay distinct
+// from a field submitted with garbage in it.
+const absentField = "\x00absent"
+
+// absentAttempts is every way of saying "the operator did not set
+// this", each of which takes the default rather than a 400. Blank and
+// whitespace-only count as absent here because they do in the timeout
+// and retention controls on the same forms; a rule the fields do not
+// share would be its own surprise.
+func absentAttempts() []string {
+	return []string{absentField, "", "  "}
+}
+
+// createWithAttempts posts the target create form for a fresh webhook
+// and returns the webhook and the response.
+func createWithAttempts(
+	t *testing.T,
+	env *sourceTestEnv,
+	attempts string,
+) (database.Webhook, int, string) {
+	t.Helper()
+
+	webhook := seedWebhookWithRetention(t, env.db, 30)
+
+	w := serveTarget(
+		env, http.MethodPost,
+		"/hook/"+webhook.ID+"/targets",
+		createAttemptsForm(attempts),
+	)
+
+	return webhook, w.Code, w.Body.String()
+}
+
+// TestTargetCreate_AttemptsAboveCeilingRejected proves the create form
+// enforces a ceiling at all, and that the 400 names it — a rejection
+// that does not say what the limit is leaves the operator guessing.
+func TestTargetCreate_AttemptsAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
+
+	for _, attempts := range overCeilingAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%s should be rejected", attempts)
+		assert.Contains(t, body, ceiling,
+			"the rejection for %s should name the ceiling",
+			attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %s", attempts)
+	}
+}
+
+// TestTargetCreate_AttemptsBelowOneRejected proves the create form
+// refuses 0 and less, naming the floor: every delivery is attempted
+// at least once.
+func TestTargetCreate_AttemptsBelowOneRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range belowOneAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%s should be rejected", attempts)
+		assert.Contains(t, body, "at least 1",
+			"the rejection for %s should name the floor",
+			attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %s", attempts)
+	}
+}
+
+// TestTargetCreate_UnparseableAttemptsRejected is the core of the
+// defect: each of these was accepted with HTTP 200 and stored as a
+// default.
+func TestTargetCreate_UnparseableAttemptsRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range unparseableAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%q should be rejected, not coerced",
+			attempts)
+		assert.Contains(t, body, "whole number",
+			"the rejection for %q should say why", attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %q", attempts)
+	}
+}
+
+// TestTargetCreate_ValidAttemptsStored covers the accepting half,
+// including both bounds: a bound that rejects its own limit would
+// make the advertised range unreachable.
+func TestTargetCreate_ValidAttemptsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{1, 3, handlers.MaxTargetAttemptsForTest} {
+		webhook, code, body := createWithAttempts(
+			t, env, strconv.Itoa(want),
+		)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, want, targets[0].MaxAttempts)
+	}
+}
+
+// TestTargetCreate_AbsentAttemptsTakesDefault keeps the two cases
+// distinct. An omitted field is not an operator asking for something
+// invalid, so it still gets the default of one attempt rather than a
+// 400 — otherwise the fix above would make the form unusable.
+func TestTargetCreate_AbsentAttemptsTakesDefault(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range absentAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, 1, targets[0].MaxAttempts,
+			"an absent max_attempts should take the default")
+	}
+}
+
+// seedAttemptsTarget creates an HTTP target already delivering with
+// workingAttempts attempts, through the real create handler.
+func seedAttemptsTarget(
+	t *testing.T,
+	env *sourceTestEnv,
+) (database.Webhook, database.Target) {
+	t.Helper()
+
+	webhook, code, body := createWithAttempts(
+		t, env, strconv.Itoa(workingAttempts),
+	)
+	require.Equal(t, http.StatusSeeOther, code, body)
+
+	targets := targetsForWebhook(t, env.db, webhook.ID)
+	require.Len(t, targets, 1)
+	require.Equal(t, workingAttempts, targets[0].MaxAttempts)
+
+	return webhook, targets[0]
+}
+
+// editAttemptsForm is a complete edit submission that changes the
+// target's name as well, so a rejected submission can be shown to
+// have written nothing at all rather than merely to have left
+// max_attempts alone.
+func editAttemptsForm(attempts string) url.Values {
+	form := url.Values{}
+	form.Set("name", "renamed-by-edit")
+	form.Set("url", attemptsTargetURL)
+
+	if attempts != absentField {
+		form.Set("max_attempts", attempts)
+	}
+
+	return form
+}
+
+// assertEditRejectedAndUnchanged submits an edit expected to fail and
+// checks both halves of the requirement: the 400 explains itself, and
+// the target it was submitted against is untouched.
+func assertEditRejectedAndUnchanged(
+	t *testing.T,
+	env *sourceTestEnv,
+	attempts, wantReason string,
+) {
+	t.Helper()
+
+	webhook, target := seedAttemptsTarget(t, env)
+
+	w := submitTargetEdit(
+		env, webhook.ID, target.ID, editAttemptsForm(attempts),
+	)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code,
+		"max_attempts=%q should be rejected on edit", attempts)
+	assert.Contains(t, w.Body.String(), wantReason,
+		"the rejection for %q should say why", attempts)
+
+	stored := storedTarget(t, env, target.ID)
+	assert.Equal(t, workingAttempts, stored.MaxAttempts,
+		"a rejected edit must not destroy the working number "+
+			"of attempts with %q", attempts)
+	assert.Equal(t, "attempts-target", stored.Name,
+		"a rejected edit must write nothing at all")
+}
+
+// TestTargetEdit_UnparseableAttemptsRejected is the damaging half of
+// the defect. A target delivering with retries, re-saved with a typo
+// in the field, returned 200 and was left with retries disabled and
+// nothing said.
+func TestTargetEdit_UnparseableAttemptsRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range unparseableAttempts() {
+		assertEditRejectedAndUnchanged(
+			t, env, attempts, "whole number",
+		)
+	}
+}
+
+// TestTargetEdit_AttemptsBelowOneRejected proves the floor applies
+// to the edit path too.
+func TestTargetEdit_AttemptsBelowOneRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range belowOneAttempts() {
+		assertEditRejectedAndUnchanged(t, env, attempts, "at least 1")
+	}
+}
+
+// TestTargetEdit_AttemptsAboveCeilingRejected proves the ceiling
+// applies to the edit path too, naming itself, so the two paths
+// cannot disagree about what is storable.
+func TestTargetEdit_AttemptsAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
+
+	for _, attempts := range overCeilingAttempts() {
+		assertEditRejectedAndUnchanged(t, env, attempts, ceiling)
+	}
+}
+
+// TestTargetEdit_ValidAttemptsStored covers the accepting half of the
+// edit path, so the bounds cannot be enforced by simply refusing
+// every submission.
+func TestTargetEdit_ValidAttemptsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{1, 9, handlers.MaxTargetAttemptsForTest} {
+		webhook, target := seedAttemptsTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(strconv.Itoa(want)),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, want,
+			storedTarget(t, env, target.ID).MaxAttempts)
+	}
+}
+
+// TestTargetEdit_AbsentAttemptsLeavesStoredValue is the edit path's
+// absent-versus-invalid case. The field is only offered by the forms
+// for types that retry, so a submission without it must leave the
+// stored count alone rather than be rejected or reset.
+func TestTargetEdit_AbsentAttemptsLeavesStoredValue(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range absentAttempts() {
+		webhook, target := seedAttemptsTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(attempts),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, workingAttempts,
+			storedTarget(t, env, target.ID).MaxAttempts,
+			"an absent max_attempts must leave the stored "+
+				"count alone (%q)", attempts)
+	}
+}
+
+// TestTargetAttempts_CreateAndEditAgreeOnEveryCase proves the two
+// paths cannot disagree, which is what let the create form and the
+// edit form drift apart in the first place. Every input is submitted
+// to both and the accept/reject verdicts are compared.
+func TestTargetAttempts_CreateAndEditAgreeOnEveryCase(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	accepted := []string{
+		"1", "2",
+		strconv.Itoa(handlers.MaxTargetAttemptsForTest),
+	}
+	overCeiling := overCeilingAttempts()
+	belowOne := belowOneAttempts()
+	unparseable := unparseableAttempts()
+
+	cases := make(
+		[]string, 0,
+		len(accepted)+len(overCeiling)+len(belowOne)+
+			len(unparseable),
+	)
+	cases = append(cases, accepted...)
+	cases = append(cases, overCeiling...)
+	cases = append(cases, belowOne...)
+	cases = append(cases, unparseable...)
+
+	for _, attempts := range cases {
+		_, createCode, _ := createWithAttempts(t, env, attempts)
+
+		webhook, target := seedAttemptsTarget(t, env)
+		editCode := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(attempts),
+		).Code
+
+		assert.Equal(t,
+			createCode == http.StatusBadRequest,
+			editCode == http.StatusBadRequest,
+			"create and edit must agree on max_attempts=%q "+
+				"(create %d, edit %d)",
+			attempts, createCode, editCode,
+		)
+	}
+}

internal/handlers/target_create.go

@@ -102,9 +102,10 @@ func (h *Handlers) newTarget(
 	in targetFormInput,
 ) (*database.Target, string, error) {
 	target := &database.Target{
-		WebhookID: webhookID,
-		Type:      in.Type,
-		Active:    true,
+		WebhookID:   webhookID,
+		Type:        in.Type,
+		Active:      true,
+		MaxAttempts: 1,
 	}
 
 	errMsg, err := h.setTargetFromForm(ctx, target, in)
@@ -117,9 +118,10 @@ func (h *Handlers) newTarget(
 
 // setTargetFromForm validates a target form against the target's type
 // and, when it accepts it, sets the target's name, configuration and
-// retry count from it. It returns the message the form shows for
-// anything it refuses, an unknown type among them, and then leaves the
-// target unchanged; an error is the server's fault, as for newTarget.
+// number of delivery attempts from it. It returns the message the form
+// shows for anything it refuses, an unknown type among them, and then
+// leaves the target unchanged; an error is the server's fault, as for
+// newTarget.
 // The add target form and the target edit form both go through here,
 // so the two cannot come to disagree about what a target may be.
 func (h *Handlers) setTargetFromForm(
@@ -136,20 +138,20 @@ func (h *Handlers) setTargetFromForm(
 		return errMsg, err
 	}
 
-	// An empty max_retries keeps the target's count: the
-	// fire-and-forget default of 0 for a new target, and the stored
-	// count for an edited one, since the forms for target types that
-	// do not retry have no such field. A value that is filled in but
-	// invalid is refused rather than becoming that count, so a typo
-	// cannot destroy the count a target is delivering with.
-	maxRetries, err := parseMaxRetries(in.MaxRetries, target.MaxRetries)
+	// An empty max_attempts keeps the target's count: the default of
+	// 1 for a new target, and the stored count for an edited one,
+	// since the forms for target types that do not retry have no such
+	// field. A value that is filled in but invalid is refused rather
+	// than becoming that count, so a typo cannot destroy the count a
+	// target is delivering with.
+	maxAttempts, err := parseMaxAttempts(in.MaxAttempts, target.MaxAttempts)
 	if err != nil {
-		return "Invalid delivery attempts: " + retriesErrorMessage(err), nil
+		return "Invalid delivery attempts: " + attemptsErrorMessage(err), nil
 	}
 
 	target.Name = in.Name
 	target.Config = configJSON
-	target.MaxRetries = maxRetries
+	target.MaxAttempts = maxAttempts
 
 	return "", nil
 }
@@ -176,8 +178,8 @@ type targetFormInput struct {
 	// ForwardQuery is an HTTP target's checkbox that passes each
 	// event's query string on to it.
 	ForwardQuery bool
-	// MaxRetries is an HTTP or Slack target's max_retries.
-	MaxRetries string
+	// MaxAttempts is an HTTP or Slack target's max_attempts.
+	MaxAttempts string
 	// Expiry is a database (archive) target's row expiry.
 	Expiry string
 	// Rotation is a database (archive) target's rotation.
@@ -204,7 +206,7 @@ func targetFormInputFrom(r *http.Request) targetFormInput {
 		Headers:      r.PostFormValue("headers"),
 		Timeout:      r.PostFormValue("timeout"),
 		ForwardQuery: r.PostFormValue("forward_query") != "",
-		MaxRetries:   r.PostFormValue("max_retries"),
+		MaxAttempts:  r.PostFormValue("max_attempts"),
 		Expiry:       r.PostFormValue("expiry"),
 		Rotation:     r.PostFormValue("rotation"),
 	}

internal/handlers/target_create_query_test.go

@@ -196,7 +196,7 @@ func TestHandleTargetCreate_QueryStringCannotSupplyNameOrType(
 
 	w, _ := postTargetCreate(
 		t, env, webhook.ID,
-		"name=leaky&type=slack&max_retries=9&expiry=30d&url="+
+		"name=leaky&type=slack&max_attempts=9&expiry=30d&url="+
 			url.QueryEscape(targetSecretURL),
 		url.Values{},
 	)

internal/handlers/target_create_test.go

@@ -21,24 +21,24 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {
 
 	// fields is the rest of each submission, as a query string.
 	cases := []struct {
-		targetType  database.TargetType
-		fields      string
-		wantConfig  string
-		wantRetries int
+		targetType   database.TargetType
+		fields       string
+		wantConfig   string
+		wantAttempts int
 	}{
 		{
-			database.TargetTypeHTTP, "timeout=12&max_retries=3",
+			database.TargetTypeHTTP, "timeout=12&max_attempts=3",
 			`{"url":"` + editOriginalURL + `","timeout":12}`, 3,
 		},
 		{
-			database.TargetTypeSlack, "max_retries=4",
+			database.TargetTypeSlack, "max_attempts=4",
 			`{"webhookUrl":"` + editOriginalURL + `"}`, 4,
 		},
 		{
 			database.TargetTypeDatabase, "expiry=720h",
-			`{"expiry":"720h"}`, 0,
+			`{"expiry":"720h"}`, 1,
 		},
-		{database.TargetTypeLog, "", "", 0},
+		{database.TargetTypeLog, "", "", 1},
 	}
 
 	for _, tc := range cases {
@@ -62,7 +62,7 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {
 			targets := targetsForWebhook(t, env.db, webhook.ID)
 			require.Len(t, targets, 1)
 			assert.Equal(t, tc.targetType, targets[0].Type)
-			assert.Equal(t, tc.wantRetries, targets[0].MaxRetries)
+			assert.Equal(t, tc.wantAttempts, targets[0].MaxAttempts)
 
 			if tc.wantConfig == "" {
 				assert.Empty(t, targets[0].Config)
@@ -90,11 +90,11 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=private&url=" + editBlockedURL +
-				"&timeout=12&max_retries=3",
+				"&timeout=12&max_attempts=3",
 			"Invalid target URL",
 		},
 		{
-			database.TargetTypeSlack, "name=no-url&max_retries=4",
+			database.TargetTypeSlack, "name=no-url&max_attempts=4",
 			"Webhook URL is required for Slack targets",
 		},
 		{
@@ -133,8 +133,8 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 			assert.Contains(t, page, html.EscapeString(tc.reason))
 
 			// Each value comes back in a data attribute of the targets
-			// section named after its field (max_retries as
-			// data-max-retries), except url, which comes back in
+			// section named after its field (max_attempts as
+			// data-max-attempts), except url, which comes back in
 			// data-destination; templates/source_detail.html says why.
 			for field := range typed {
 				attr := "data-" + strings.ReplaceAll(field, "_", "-")

internal/handlers/target_edit.go

@@ -82,7 +82,7 @@ func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 			Headers:      cfg.Headers,
 			Timeout:      cfg.Timeout,
 			ForwardQuery: cfg.ForwardQuery,
-			MaxRetries:   strconv.Itoa(target.MaxRetries),
+			MaxAttempts:  strconv.Itoa(target.MaxAttempts),
 			Expiry:       cfg.Expiry,
 			Rotation:     cfg.Rotation,
 		}

internal/handlers/target_edit_test.go

@@ -117,7 +117,7 @@ func seedHTTPTarget(
 	form.Set("url", editOriginalURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_retries", "3")
+	form.Set("max_attempts", "3")
 
 	w := serveTarget(
 		env, http.MethodPost,
@@ -179,7 +179,7 @@ func editForm(targetURL, headers, timeout string) url.Values {
 	form.Set("url", targetURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_retries", "5")
+	form.Set("max_attempts", "5")
 
 	return form
 }
@@ -280,9 +280,9 @@ func TestHandleTargetEditSubmit_Saves(t *testing.T) {
 		assertEditClearingRemovesThem(t, env)
 	})
 
-	t.Run("absent max_retries is not zeroed", func(t *testing.T) {
+	t.Run("absent max_attempts is kept", func(t *testing.T) {
 		t.Parallel()
-		assertEditKeepsAbsentMaxRetries(t, env)
+		assertEditKeepsAbsentMaxAttempts(t, env)
 	})
 }
 
@@ -307,7 +307,7 @@ func assertEditChangesDestination(
 
 	reloaded := storedTarget(t, env, target.ID)
 	assert.Equal(t, "edited-name", reloaded.Name)
-	assert.Equal(t, 5, reloaded.MaxRetries)
+	assert.Equal(t, 5, reloaded.MaxAttempts)
 	assert.Equal(
 		t, database.TargetTypeHTTP, reloaded.Type,
 		"the edit form must not change a target's type",
@@ -368,25 +368,25 @@ func assertEditClearingRemovesThem(
 	assert.Zero(t, cfg.Timeout)
 }
 
-// Retries are offered only by the forms for target types that retry.
-// An absent field means the form does not edit retries, not that
-// they should be turned off.
-func assertEditKeepsAbsentMaxRetries(
+// Delivery attempts are offered only by the forms for target types
+// that retry. An absent field means the form does not edit them, not
+// that retries should be turned off.
+func assertEditKeepsAbsentMaxAttempts(
 	t *testing.T, env *sourceTestEnv,
 ) {
 	t.Helper()
 
 	webhook, target := seedHTTPTarget(t, env, "", "")
-	require.Equal(t, 3, target.MaxRetries)
+	require.Equal(t, 3, target.MaxAttempts)
 
 	form := editForm(editOriginalURL, "", "")
-	form.Del("max_retries")
+	form.Del("max_attempts")
 
 	w := submitTargetEdit(env, webhook.ID, target.ID, form)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
 
 	assert.Equal(
-		t, 3, storedTarget(t, env, target.ID).MaxRetries,
+		t, 3, storedTarget(t, env, target.ID).MaxAttempts,
 	)
 }
 
@@ -659,12 +659,12 @@ func TestHandleTargetEditSubmit_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=edited&url=" + editBlockedURL +
-				"&headers=X-Edited:+kept&timeout=12&max_retries=3",
+				"&headers=X-Edited:+kept&timeout=12&max_attempts=3",
 			"Invalid target URL",
 		},
 		{
 			database.TargetTypeSlack,
-			"name=edited&url=" + editOriginalURL + "&max_retries=25",
+			"name=edited&url=" + editOriginalURL + "&max_attempts=25",
 			"Invalid delivery attempts",
 		},
 		{

internal/handlers/target_retries.go

@@ -1,83 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"strconv"
-	"strings"
-)
-
-// maxTargetRetries bounds a target's max_retries.
-//
-// Both target forms already declare max="20" on the input, so this
-// enforces server-side what the UI has always advertised rather than
-// introducing a new limit.
-//
-// The number is not cosmetic. Every attempt writes a delivery_results
-// row that the event log then loads and renders, and the engine backs
-// off by 2^(n-1) seconds, so attempt 20 is already about six days
-// after the first. A value beyond this buys no additional durability
-// and only costs rows.
-const maxTargetRetries = 20
-
-// Errors returned when a max_retries form value cannot be turned into
-// a retry count.
-var (
-	// errRetriesInvalid signals a max_retries form value that is not
-	// a non-negative whole number.
-	errRetriesInvalid = errors.New(
-		"must be a whole number",
-	)
-
-	// errRetriesTooLarge signals a max_retries form value that is a
-	// whole number but above maxTargetRetries. It is distinguished
-	// from errRetriesInvalid so the message can name the ceiling
-	// instead of implying the input was not a number.
-	errRetriesTooLarge = errors.New("out of range")
-)
-
-// parseMaxRetries interprets a max_retries form value.
-//
-// An ABSENT value — the field empty or not submitted — yields
-// fallback, which lets the create path apply its default and the edit
-// path leave the stored value alone. A value that is SET BUT INVALID
-// is an error: unparseable, negative, or above maxTargetRetries.
-//
-// The distinction is the whole point of this function. max_retries=0
-// means fire-and-forget, so returning 0 for input the operator typed
-// but that did not parse silently disables retries on a
-// store-and-forward proxy — and on the edit path it destroys a
-// working retry configuration over a typo. A default answers a
-// question that was not asked; it never answers one that was asked
-// badly.
-func parseMaxRetries(raw string, fallback int) (int, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return fallback, nil
-	}
-
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 0 {
-		return 0, errRetriesInvalid
-	}
-
-	if v > maxTargetRetries {
-		return 0, errRetriesTooLarge
-	}
-
-	return v, nil
-}
-
-// retriesErrorMessage returns the message the create and edit forms
-// show for a rejected max_retries value. Any error other than
-// errRetriesTooLarge falls back to the generic wording, so an
-// unrecognised parse failure still produces a sensible 400.
-func retriesErrorMessage(err error) string {
-	if errors.Is(err, errRetriesTooLarge) {
-		return errRetriesTooLarge.Error() +
-			": at most " + strconv.Itoa(maxTargetRetries) +
-			" attempts"
-	}
-
-	return errRetriesInvalid.Error() +
-		", or 0 for fire-and-forget"
-}

internal/handlers/target_retries_test.go

@@ -1,385 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/url"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/handlers"
-)
-
-// retriesTargetURL is the destination the retry-validation targets
-// point at. It is a literal public address rather than a hostname so
-// the SSRF check resolves nothing and a sandbox without DNS cannot
-// make these cases pass or fail for the wrong reason.
-const retriesTargetURL = "https://93.184.216.34/hooks/retries"
-
-const (
-	// wayAboveCeiling is the typo'd-extra-zero case from the report.
-	wayAboveCeiling = "999999999"
-
-	// notANumber is the plainest garbage an operator can type, and
-	// the value the report submitted on the edit form.
-	notANumber = "abc"
-
-	// workingRetries is the retry count a seeded target is already
-	// delivering with, which a rejected submission must not disturb.
-	workingRetries = 2
-)
-
-// aboveCeiling is the smallest rejected whole number.
-func aboveCeiling() string {
-	return strconv.Itoa(handlers.MaxTargetRetriesForTest + 1)
-}
-
-// overCeilingRetries is whole-number input past the limit, which is
-// rejected with the limit named.
-func overCeilingRetries() []string {
-	return []string{aboveCeiling(), wayAboveCeiling}
-}
-
-// unparseableRetries is input an operator can type into the field
-// that is not a retry count. Each must be REJECTED: silently reading
-// any of them as 0 turns a store-and-forward proxy into
-// fire-and-forget without saying so.
-//
-// The twenty-digit case is here because it parses as digits but
-// overflows int, which is the one failure the field's own min/max
-// attributes cannot describe.
-func unparseableRetries() []string {
-	return []string{
-		notANumber,
-		"2.7",
-		"-5",
-		"12345678901234567890",
-		"1e3",
-	}
-}
-
-// createRetriesForm is a complete, otherwise-valid HTTP target
-// creation, so the only thing any case below varies is max_retries.
-func createRetriesForm(retries string) url.Values {
-	form := url.Values{}
-	form.Set("name", "retries-target")
-	form.Set("type", string(database.TargetTypeHTTP))
-	form.Set("url", retriesTargetURL)
-
-	if retries != absentField {
-		form.Set("max_retries", retries)
-	}
-
-	return form
-}
-
-// absentField marks a field the form does not submit at all, which is
-// the case that legitimately takes a default and must stay distinct
-// from a field submitted with garbage in it.
-const absentField = "\x00absent"
-
-// absentRetries is every way of saying "the operator did not set
-// this", each of which takes the default rather than a 400. Blank and
-// whitespace-only count as absent here because they do in the timeout
-// and retention controls on the same forms; a rule the fields do not
-// share would be its own surprise.
-func absentRetries() []string {
-	return []string{absentField, "", "  "}
-}
-
-// createWithRetries posts the target create form for a fresh webhook
-// and returns the webhook and the response.
-func createWithRetries(
-	t *testing.T,
-	env *sourceTestEnv,
-	retries string,
-) (database.Webhook, int, string) {
-	t.Helper()
-
-	webhook := seedWebhookWithRetention(t, env.db, 30)
-
-	w := serveTarget(
-		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets",
-		createRetriesForm(retries),
-	)
-
-	return webhook, w.Code, w.Body.String()
-}
-
-// TestTargetCreate_RetriesAboveCeilingRejected proves the create form
-// enforces a ceiling at all, and that the 400 names it — a rejection
-// that does not say what the limit is leaves the operator guessing.
-func TestTargetCreate_RetriesAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
-
-	for _, retries := range overCeilingRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_retries=%s should be rejected", retries)
-		assert.Contains(t, body, ceiling,
-			"the rejection for %s should name the ceiling",
-			retries)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %s", retries)
-	}
-}
-
-// TestTargetCreate_UnparseableRetriesRejected is the core of the
-// defect: each of these was accepted with HTTP 200 and stored as 0.
-func TestTargetCreate_UnparseableRetriesRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range unparseableRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_retries=%q should be rejected, not coerced",
-			retries)
-		assert.Contains(t, body, "whole number",
-			"the rejection for %q should say why", retries)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %q", retries)
-	}
-}
-
-// TestTargetCreate_ValidRetriesStored covers the accepting half,
-// including the ceiling itself: a bound that rejects its own limit
-// would make the advertised maximum unreachable.
-func TestTargetCreate_ValidRetriesStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{0, 3, handlers.MaxTargetRetriesForTest} {
-		webhook, code, body := createWithRetries(
-			t, env, strconv.Itoa(want),
-		)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, want, targets[0].MaxRetries)
-	}
-}
-
-// TestTargetCreate_AbsentRetriesTakesDefault keeps the two cases
-// distinct. An omitted field is not an operator asking for something
-// invalid, so it still gets the fire-and-forget default rather than a
-// 400 — otherwise the fix above would make the form unusable.
-func TestTargetCreate_AbsentRetriesTakesDefault(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range absentRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, 0, targets[0].MaxRetries,
-			"an absent max_retries should take the default")
-	}
-}
-
-// seedRetriesTarget creates an HTTP target already delivering with
-// workingRetries retries, through the real create handler.
-func seedRetriesTarget(
-	t *testing.T,
-	env *sourceTestEnv,
-) (database.Webhook, database.Target) {
-	t.Helper()
-
-	webhook, code, body := createWithRetries(
-		t, env, strconv.Itoa(workingRetries),
-	)
-	require.Equal(t, http.StatusSeeOther, code, body)
-
-	targets := targetsForWebhook(t, env.db, webhook.ID)
-	require.Len(t, targets, 1)
-	require.Equal(t, workingRetries, targets[0].MaxRetries)
-
-	return webhook, targets[0]
-}
-
-// editRetriesForm is a complete edit submission that changes the
-// target's name as well, so a rejected submission can be shown to
-// have written nothing at all rather than merely to have left
-// max_retries alone.
-func editRetriesForm(retries string) url.Values {
-	form := url.Values{}
-	form.Set("name", "renamed-by-edit")
-	form.Set("url", retriesTargetURL)
-
-	if retries != absentField {
-		form.Set("max_retries", retries)
-	}
-
-	return form
-}
-
-// assertEditRejectedAndUnchanged submits an edit expected to fail and
-// checks both halves of the requirement: the 400 explains itself, and
-// the target it was submitted against is untouched.
-func assertEditRejectedAndUnchanged(
-	t *testing.T,
-	env *sourceTestEnv,
-	retries, wantReason string,
-) {
-	t.Helper()
-
-	webhook, target := seedRetriesTarget(t, env)
-
-	w := submitTargetEdit(
-		env, webhook.ID, target.ID, editRetriesForm(retries),
-	)
-
-	assert.Equal(t, http.StatusBadRequest, w.Code,
-		"max_retries=%q should be rejected on edit", retries)
-	assert.Contains(t, w.Body.String(), wantReason,
-		"the rejection for %q should say why", retries)
-
-	stored := storedTarget(t, env, target.ID)
-	assert.Equal(t, workingRetries, stored.MaxRetries,
-		"a rejected edit must not destroy the working retry "+
-			"count with %q", retries)
-	assert.Equal(t, "retries-target", stored.Name,
-		"a rejected edit must write nothing at all")
-}
-
-// TestTargetEdit_UnparseableRetriesRejected is the damaging half of
-// the defect. A target delivering with two retries, re-saved with a
-// typo in the field, returned 200 and was left with retries disabled
-// and nothing said.
-func TestTargetEdit_UnparseableRetriesRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range unparseableRetries() {
-		assertEditRejectedAndUnchanged(
-			t, env, retries, "whole number",
-		)
-	}
-}
-
-// TestTargetEdit_RetriesAboveCeilingRejected proves the ceiling
-// applies to the edit path too, naming itself, so the two paths
-// cannot disagree about what is storable.
-func TestTargetEdit_RetriesAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
-
-	for _, retries := range overCeilingRetries() {
-		assertEditRejectedAndUnchanged(t, env, retries, ceiling)
-	}
-}
-
-// TestTargetEdit_ValidRetriesStored covers the accepting half of the
-// edit path, so the ceiling cannot be enforced by simply refusing
-// every submission.
-func TestTargetEdit_ValidRetriesStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{0, 9, handlers.MaxTargetRetriesForTest} {
-		webhook, target := seedRetriesTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(strconv.Itoa(want)),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, want,
-			storedTarget(t, env, target.ID).MaxRetries)
-	}
-}
-
-// TestTargetEdit_AbsentRetriesLeavesStoredValue is the edit path's
-// absent-versus-invalid case. Retries are only offered by the forms
-// for types that retry, so a submission without the field must leave
-// the stored count alone rather than be rejected or zeroed.
-func TestTargetEdit_AbsentRetriesLeavesStoredValue(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range absentRetries() {
-		webhook, target := seedRetriesTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(retries),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, workingRetries,
-			storedTarget(t, env, target.ID).MaxRetries,
-			"an absent max_retries must leave the stored "+
-				"count alone (%q)", retries)
-	}
-}
-
-// TestTargetRetries_CreateAndEditAgreeOnEveryCase proves the two
-// paths cannot disagree, which is what let the create form and the
-// edit form drift apart in the first place. Every input is submitted
-// to both and the accept/reject verdicts are compared.
-func TestTargetRetries_CreateAndEditAgreeOnEveryCase(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	accepted := []string{
-		"0", "1",
-		strconv.Itoa(handlers.MaxTargetRetriesForTest),
-	}
-	overCeiling := overCeilingRetries()
-	unparseable := unparseableRetries()
-
-	cases := make(
-		[]string, 0,
-		len(accepted)+len(overCeiling)+len(unparseable),
-	)
-	cases = append(cases, accepted...)
-	cases = append(cases, overCeiling...)
-	cases = append(cases, unparseable...)
-
-	for _, retries := range cases {
-		_, createCode, _ := createWithRetries(t, env, retries)
-
-		webhook, target := seedRetriesTarget(t, env)
-		editCode := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(retries),
-		).Code
-
-		assert.Equal(t,
-			createCode == http.StatusBadRequest,
-			editCode == http.StatusBadRequest,
-			"create and edit must agree on max_retries=%q "+
-				"(create %d, edit %d)",
-			retries, createCode, editCode,
-		)
-	}
-}

internal/handlers/target_toggle_test.go

@@ -59,7 +59,7 @@ func TestHandleTargetToggle_DoesNotUndoAnEdit(t *testing.T) {
 	stored := storedTarget(t, env, tgt.ID)
 	assert.False(t, stored.Active)
 	assert.Equal(t, "edited-name", stored.Name)
-	assert.Equal(t, 5, stored.MaxRetries)
+	assert.Equal(t, 5, stored.MaxAttempts)
 	assert.Equal(
 		t, editReplacedURL, storedHTTPConfig(t, env, tgt.ID).URL,
 	)

internal/handlers/ui_copy_test.go

@@ -348,21 +348,19 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 	)
 }
 
-// maxRetriesHelp is the wording both target forms must carry. The
-// delivery core makes max_retries attempts in total, not that many
+// maxAttemptsHelp is the wording both target forms must carry. The
+// delivery core makes max_attempts attempts in total, not that many
 // retries on top of a first try (a fresh delivery starts at attempt 1
 // and target_http gives up once the attempt number reaches
-// max_retries), and 0 is special-cased to a single fire-and-forget
-// attempt with no circuit breaker.
-const maxRetriesHelp = "How many times each delivery is attempted in " +
-	"all, the first attempt included. 0 means a single attempt with no " +
-	"retries and no circuit breaker."
+// max_attempts).
+const maxAttemptsHelp = "How many times each delivery is attempted in " +
+	"all, the first attempt included."
 
-// TestTargetFormMaxRetriesCopyMatchesBehaviour pins the max_retries
+// TestTargetFormMaxAttemptsCopyMatchesBehaviour pins the max_attempts
 // label, "Delivery attempts", and help text on both the create form
 // (the add-target form on the webhook detail page) and the edit form,
 // so the copy cannot drift back to calling the number a retry count.
-func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
+func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {
 	t.Parallel()
 
 	var h *handlers.Handlers
@@ -394,11 +392,11 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 
 	assert.Contains(t, createBody, "Delivery attempts:</label>")
 	assert.Contains(
-		t, createBody, maxRetriesHelp,
-		"the add-target form must explain max_retries as total attempts",
+		t, createBody, maxAttemptsHelp,
+		"the add-target form must explain max_attempts as total attempts",
 	)
 
-	// A slack target exercises the same max_retries field while needing
+	// A slack target exercises the same max_attempts field while needing
 	// only a URL from the edit template, so the test data stays
 	// minimal. The Target and TargetForm keys mirror the field names
 	// the template reads off the handler's values.
@@ -412,8 +410,8 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 				"Active": true,
 			},
 			"TargetForm": map[string]any{
-				"URL":        "https://hooks.slack.com/services/x",
-				"MaxRetries": "3",
+				"URL":         "https://hooks.slack.com/services/x",
+				"MaxAttempts": "3",
 			},
 			dataKeyError: "",
 		},
@@ -421,8 +419,8 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 
 	assert.Contains(t, editBody, `class="label">Delivery attempts</label>`)
 	assert.Contains(
-		t, editBody, maxRetriesHelp,
-		"the target edit form must explain max_retries as total attempts",
+		t, editBody, maxAttemptsHelp,
+		"the target edit form must explain max_attempts as total attempts",
 	)
 }
 

internal/handlers/webhook.go

@@ -442,7 +442,7 @@ func buildDeliveryTasks(
 			TargetName:   targets[i].Name,
 			TargetType:   targets[i].Type,
 			TargetConfig: targets[i].Config,
-			MaxRetries:   targets[i].MaxRetries,
+			MaxAttempts:  targets[i].MaxAttempts,
 			Method:       event.Method,
 			RawQuery:     event.RawQuery,
 			Headers:      event.Headers,