Store a target's number of delivery attempts, at least one (closes #540)

Target.MaxRetries (max_retries) becomes Target.MaxAttempts
(max_attempts), and the form field, parser and ceiling are renamed to
match. The column is NOT NULL and a check constraint refuses a value
below 1, so every target, whatever its type, is stored with at least
1. 1 is a single attempt with no circuit breaker; above 1 retries
behind the breaker up to that many attempts. Both target forms refuse
0 and less; a blank field on the add target form gives 1, and on the
edit form keeps the stored value. The target page shows the plain
number, and the README's two paragraphs on 0 against 1 become one
sentence.

Model: opus-5-5

internal/handlers/delivery_replay.go

@@ -308,7 +308,7 @@ func createReplayDelivery(
 		TargetName:   target.Name,
 		TargetType:   target.Type,
 		TargetConfig: target.Config,
-		MaxRetries:   target.MaxRetries,
+		MaxAttempts:  target.MaxAttempts,
 		Method:       event.Method,
 		RawQuery:     event.RawQuery,
 		Headers:      event.Headers,

internal/handlers/event_log.go

@@ -496,7 +496,7 @@ const deliveryIDChunkSize = 500
 //
 // Each response body is cut by SQLite rather than in Go, for
 // the reason deliveryResultColumns gives. How many attempts a
-// delivery has is the target's MaxRetries, which the
+// delivery has is bounded by the target's MaxAttempts, which the
 // authenticated operator sets; how many of them reach the page
 // is bounded again by maxRenderedAttempts.
 func (h *Handlers) loadDeliveryResults(

internal/handlers/export_test.go

@@ -37,10 +37,10 @@ const MaxRenderedResponseBytesForTest = maxRenderedResponseBytes
 // per-delivery attempt ceiling to the handlers_test package.
 const MaxRenderedAttemptsForTest = maxRenderedAttempts
 
-// MaxTargetRetriesForTest exposes the target max_retries ceiling to
+// MaxTargetAttemptsForTest exposes the target max_attempts ceiling to
 // the handlers_test package, so the tests assert against the constant
 // the handlers enforce rather than a number copied beside it.
-const MaxTargetRetriesForTest = maxTargetRetries
+const MaxTargetAttemptsForTest = maxTargetAttempts
 
 // EventDBLeftMsgForTest and SidecarLeftMsgForTest expose the two
 // messages the webhook delete handler logs when a file of the event

internal/handlers/source_delete_test.go

@@ -64,10 +64,11 @@ func seedTarget(
 	t.Helper()
 
 	tgt := &database.Target{
-		WebhookID: webhookID,
-		Name:      "t-" + string(targetType),
-		Type:      targetType,
-		Active:    true,
+		WebhookID:   webhookID,
+		Name:        "t-" + string(targetType),
+		Type:        targetType,
+		Active:      true,
+		MaxAttempts: 1,
 	}
 
 	require.NoError(

internal/handlers/source_detail_test.go

@@ -37,11 +37,12 @@ func seedConfiguredTarget(
 	t.Helper()
 
 	tgt := &database.Target{
-		WebhookID: webhookID,
-		Name:      "t-" + string(targetType),
-		Type:      targetType,
-		Active:    true,
-		Config:    config,
+		WebhookID:   webhookID,
+		Name:        "t-" + string(targetType),
+		Type:        targetType,
+		Active:      true,
+		Config:      config,
+		MaxAttempts: 1,
 	}
 
 	require.NoError(

internal/handlers/target_attempts.go

@@ -0,0 +1,81 @@
+package handlers
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+// maxTargetAttempts bounds a target's max_attempts.
+//
+// Both target forms already declare max="20" on the input, so this
+// enforces server-side what the UI has always advertised rather than
+// introducing a new limit.
+//
+// The number is not cosmetic. Every attempt writes a delivery_results
+// row that the event log then loads and renders, and the engine backs
+// off by 2^(n-1) seconds, so attempt 20 is already about six days
+// after the first. A value beyond this buys no additional durability
+// and only costs rows.
+const maxTargetAttempts = 20
+
+// Errors returned when a max_attempts form value cannot be turned into
+// a number of attempts.
+var (
+	// errAttemptsInvalid signals a max_attempts form value that is not
+	// a whole number of at least 1.
+	errAttemptsInvalid = errors.New(
+		"must be a whole number, at least 1",
+	)
+
+	// errAttemptsTooLarge signals a max_attempts form value that is a
+	// whole number but above maxTargetAttempts. It is distinguished
+	// from errAttemptsInvalid so the message can name the ceiling
+	// instead of implying the input was not a number.
+	errAttemptsTooLarge = errors.New("out of range")
+)
+
+// parseMaxAttempts interprets a max_attempts form value.
+//
+// An ABSENT value — the field empty or not submitted — yields
+// fallback, which lets the create path apply its default and the edit
+// path leave the stored value alone. A value that is SET BUT INVALID
+// is an error: unparseable, below 1, or above maxTargetAttempts.
+//
+// The distinction is the whole point of this function. Returning a
+// default for input the operator typed but that did not parse would
+// silently turn retries off on a store-and-forward proxy — and on the
+// edit path destroy a working configuration over a typo. A default
+// answers a question that was not asked; it never answers one that
+// was asked badly.
+func parseMaxAttempts(raw string, fallback int) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return fallback, nil
+	}
+
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 1 {
+		return 0, errAttemptsInvalid
+	}
+
+	if v > maxTargetAttempts {
+		return 0, errAttemptsTooLarge
+	}
+
+	return v, nil
+}
+
+// attemptsErrorMessage returns the message the create and edit forms
+// show for a rejected max_attempts value. Any error other than
+// errAttemptsTooLarge falls back to the generic wording, so an
+// unrecognised parse failure still produces a sensible 400.
+func attemptsErrorMessage(err error) string {
+	if errors.Is(err, errAttemptsTooLarge) {
+		return errAttemptsTooLarge.Error() +
+			": at most " + strconv.Itoa(maxTargetAttempts) +
+			" attempts"
+	}
+
+	return errAttemptsInvalid.Error()
+}

internal/handlers/target_attempts_test.go

@@ -0,0 +1,429 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+)
+
+// attemptsTargetURL is the destination the attempts-validation targets
+// point at. It is a literal public address rather than a hostname so
+// the SSRF check resolves nothing and a sandbox without DNS cannot
+// make these cases pass or fail for the wrong reason.
+const attemptsTargetURL = "https://93.184.216.34/hooks/attempts"
+
+const (
+	// wayAboveCeiling is the typo'd-extra-zero case from the report.
+	wayAboveCeiling = "999999999"
+
+	// notANumber is the plainest garbage an operator can type, and
+	// the value the report submitted on the edit form.
+	notANumber = "abc"
+
+	// workingAttempts is the number of attempts a seeded target is
+	// already delivering with, which a rejected submission must not
+	// disturb.
+	workingAttempts = 2
+)
+
+// aboveCeiling is the smallest rejected whole number.
+func aboveCeiling() string {
+	return strconv.Itoa(handlers.MaxTargetAttemptsForTest + 1)
+}
+
+// overCeilingAttempts is whole-number input past the limit, which is
+// rejected with the limit named.
+func overCeilingAttempts() []string {
+	return []string{aboveCeiling(), wayAboveCeiling}
+}
+
+// belowOneAttempts is whole-number input under the floor of one
+// attempt, which is rejected with the floor named.
+func belowOneAttempts() []string {
+	return []string{"0", "-5"}
+}
+
+// unparseableAttempts is input an operator can type into the field
+// that is not a number of attempts. Each must be REJECTED: silently
+// reading any of them as a default turns retries off on a
+// store-and-forward proxy without saying so.
+//
+// The twenty-digit case is here because it parses as digits but
+// overflows int, which is the one failure the field's own min/max
+// attributes cannot describe.
+func unparseableAttempts() []string {
+	return []string{
+		notANumber,
+		"2.7",
+		"12345678901234567890",
+		"1e3",
+	}
+}
+
+// createAttemptsForm is a complete, otherwise-valid HTTP target
+// creation, so the only thing any case below varies is max_attempts.
+func createAttemptsForm(attempts string) url.Values {
+	form := url.Values{}
+	form.Set("name", "attempts-target")
+	form.Set("type", string(database.TargetTypeHTTP))
+	form.Set("url", attemptsTargetURL)
+
+	if attempts != absentField {
+		form.Set("max_attempts", attempts)
+	}
+
+	return form
+}
+
+// absentField marks a field the form does not submit at all, which is
+// the case that legitimately takes a default and must stay distinct
+// from a field submitted with garbage in it.
+const absentField = "\x00absent"
+
+// absentAttempts is every way of saying "the operator did not set
+// this", each of which takes the default rather than a 400. Blank and
+// whitespace-only count as absent here because they do in the timeout
+// and retention controls on the same forms; a rule the fields do not
+// share would be its own surprise.
+func absentAttempts() []string {
+	return []string{absentField, "", "  "}
+}
+
+// createWithAttempts posts the target create form for a fresh webhook
+// and returns the webhook and the response.
+func createWithAttempts(
+	t *testing.T,
+	env *sourceTestEnv,
+	attempts string,
+) (database.Webhook, int, string) {
+	t.Helper()
+
+	webhook := seedWebhookWithRetention(t, env.db, 30)
+
+	w := serveTarget(
+		env, http.MethodPost,
+		"/hook/"+webhook.ID+"/targets",
+		createAttemptsForm(attempts),
+	)
+
+	return webhook, w.Code, w.Body.String()
+}
+
+// TestTargetCreate_AttemptsAboveCeilingRejected proves the create form
+// enforces a ceiling at all, and that the 400 names it — a rejection
+// that does not say what the limit is leaves the operator guessing.
+func TestTargetCreate_AttemptsAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
+
+	for _, attempts := range overCeilingAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%s should be rejected", attempts)
+		assert.Contains(t, body, ceiling,
+			"the rejection for %s should name the ceiling",
+			attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %s", attempts)
+	}
+}
+
+// TestTargetCreate_AttemptsBelowOneRejected proves the create form
+// refuses 0 and less, naming the floor: every delivery is attempted
+// at least once.
+func TestTargetCreate_AttemptsBelowOneRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range belowOneAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%s should be rejected", attempts)
+		assert.Contains(t, body, "at least 1",
+			"the rejection for %s should name the floor",
+			attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %s", attempts)
+	}
+}
+
+// TestTargetCreate_UnparseableAttemptsRejected is the core of the
+// defect: each of these was accepted with HTTP 200 and stored as a
+// default.
+func TestTargetCreate_UnparseableAttemptsRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range unparseableAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_attempts=%q should be rejected, not coerced",
+			attempts)
+		assert.Contains(t, body, "whole number",
+			"the rejection for %q should say why", attempts)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %q", attempts)
+	}
+}
+
+// TestTargetCreate_ValidAttemptsStored covers the accepting half,
+// including both bounds: a bound that rejects its own limit would
+// make the advertised range unreachable.
+func TestTargetCreate_ValidAttemptsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{1, 3, handlers.MaxTargetAttemptsForTest} {
+		webhook, code, body := createWithAttempts(
+			t, env, strconv.Itoa(want),
+		)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, want, targets[0].MaxAttempts)
+	}
+}
+
+// TestTargetCreate_AbsentAttemptsTakesDefault keeps the two cases
+// distinct. An omitted field is not an operator asking for something
+// invalid, so it still gets the default of one attempt rather than a
+// 400 — otherwise the fix above would make the form unusable.
+func TestTargetCreate_AbsentAttemptsTakesDefault(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range absentAttempts() {
+		webhook, code, body := createWithAttempts(t, env, attempts)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, 1, targets[0].MaxAttempts,
+			"an absent max_attempts should take the default")
+	}
+}
+
+// seedAttemptsTarget creates an HTTP target already delivering with
+// workingAttempts attempts, through the real create handler.
+func seedAttemptsTarget(
+	t *testing.T,
+	env *sourceTestEnv,
+) (database.Webhook, database.Target) {
+	t.Helper()
+
+	webhook, code, body := createWithAttempts(
+		t, env, strconv.Itoa(workingAttempts),
+	)
+	require.Equal(t, http.StatusSeeOther, code, body)
+
+	targets := targetsForWebhook(t, env.db, webhook.ID)
+	require.Len(t, targets, 1)
+	require.Equal(t, workingAttempts, targets[0].MaxAttempts)
+
+	return webhook, targets[0]
+}
+
+// editAttemptsForm is a complete edit submission that changes the
+// target's name as well, so a rejected submission can be shown to
+// have written nothing at all rather than merely to have left
+// max_attempts alone.
+func editAttemptsForm(attempts string) url.Values {
+	form := url.Values{}
+	form.Set("name", "renamed-by-edit")
+	form.Set("url", attemptsTargetURL)
+
+	if attempts != absentField {
+		form.Set("max_attempts", attempts)
+	}
+
+	return form
+}
+
+// assertEditRejectedAndUnchanged submits an edit expected to fail and
+// checks both halves of the requirement: the 400 explains itself, and
+// the target it was submitted against is untouched.
+func assertEditRejectedAndUnchanged(
+	t *testing.T,
+	env *sourceTestEnv,
+	attempts, wantReason string,
+) {
+	t.Helper()
+
+	webhook, target := seedAttemptsTarget(t, env)
+
+	w := submitTargetEdit(
+		env, webhook.ID, target.ID, editAttemptsForm(attempts),
+	)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code,
+		"max_attempts=%q should be rejected on edit", attempts)
+	assert.Contains(t, w.Body.String(), wantReason,
+		"the rejection for %q should say why", attempts)
+
+	stored := storedTarget(t, env, target.ID)
+	assert.Equal(t, workingAttempts, stored.MaxAttempts,
+		"a rejected edit must not destroy the working number "+
+			"of attempts with %q", attempts)
+	assert.Equal(t, "attempts-target", stored.Name,
+		"a rejected edit must write nothing at all")
+}
+
+// TestTargetEdit_UnparseableAttemptsRejected is the damaging half of
+// the defect. A target delivering with retries, re-saved with a typo
+// in the field, returned 200 and was left with retries disabled and
+// nothing said.
+func TestTargetEdit_UnparseableAttemptsRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range unparseableAttempts() {
+		assertEditRejectedAndUnchanged(
+			t, env, attempts, "whole number",
+		)
+	}
+}
+
+// TestTargetEdit_AttemptsBelowOneRejected proves the floor applies
+// to the edit path too.
+func TestTargetEdit_AttemptsBelowOneRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range belowOneAttempts() {
+		assertEditRejectedAndUnchanged(t, env, attempts, "at least 1")
+	}
+}
+
+// TestTargetEdit_AttemptsAboveCeilingRejected proves the ceiling
+// applies to the edit path too, naming itself, so the two paths
+// cannot disagree about what is storable.
+func TestTargetEdit_AttemptsAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
+
+	for _, attempts := range overCeilingAttempts() {
+		assertEditRejectedAndUnchanged(t, env, attempts, ceiling)
+	}
+}
+
+// TestTargetEdit_ValidAttemptsStored covers the accepting half of the
+// edit path, so the bounds cannot be enforced by simply refusing
+// every submission.
+func TestTargetEdit_ValidAttemptsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{1, 9, handlers.MaxTargetAttemptsForTest} {
+		webhook, target := seedAttemptsTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(strconv.Itoa(want)),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, want,
+			storedTarget(t, env, target.ID).MaxAttempts)
+	}
+}
+
+// TestTargetEdit_AbsentAttemptsLeavesStoredValue is the edit path's
+// absent-versus-invalid case. The field is only offered by the forms
+// for types that retry, so a submission without it must leave the
+// stored count alone rather than be rejected or reset.
+func TestTargetEdit_AbsentAttemptsLeavesStoredValue(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, attempts := range absentAttempts() {
+		webhook, target := seedAttemptsTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(attempts),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, workingAttempts,
+			storedTarget(t, env, target.ID).MaxAttempts,
+			"an absent max_attempts must leave the stored "+
+				"count alone (%q)", attempts)
+	}
+}
+
+// TestTargetAttempts_CreateAndEditAgreeOnEveryCase proves the two
+// paths cannot disagree, which is what let the create form and the
+// edit form drift apart in the first place. Every input is submitted
+// to both and the accept/reject verdicts are compared.
+func TestTargetAttempts_CreateAndEditAgreeOnEveryCase(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	accepted := []string{
+		"1", "2",
+		strconv.Itoa(handlers.MaxTargetAttemptsForTest),
+	}
+	overCeiling := overCeilingAttempts()
+	belowOne := belowOneAttempts()
+	unparseable := unparseableAttempts()
+
+	cases := make(
+		[]string, 0,
+		len(accepted)+len(overCeiling)+len(belowOne)+
+			len(unparseable),
+	)
+	cases = append(cases, accepted...)
+	cases = append(cases, overCeiling...)
+	cases = append(cases, belowOne...)
+	cases = append(cases, unparseable...)
+
+	for _, attempts := range cases {
+		_, createCode, _ := createWithAttempts(t, env, attempts)
+
+		webhook, target := seedAttemptsTarget(t, env)
+		editCode := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editAttemptsForm(attempts),
+		).Code
+
+		assert.Equal(t,
+			createCode == http.StatusBadRequest,
+			editCode == http.StatusBadRequest,
+			"create and edit must agree on max_attempts=%q "+
+				"(create %d, edit %d)",
+			attempts, createCode, editCode,
+		)
+	}
+}

internal/handlers/target_create.go

@@ -102,9 +102,10 @@ func (h *Handlers) newTarget(
 	in targetFormInput,
 ) (*database.Target, string, error) {
 	target := &database.Target{
-		WebhookID: webhookID,
-		Type:      in.Type,
-		Active:    true,
+		WebhookID:   webhookID,
+		Type:        in.Type,
+		Active:      true,
+		MaxAttempts: 1,
 	}
 
 	errMsg, err := h.setTargetFromForm(ctx, target, in)
@@ -117,9 +118,10 @@ func (h *Handlers) newTarget(
 
 // setTargetFromForm validates a target form against the target's type
 // and, when it accepts it, sets the target's name, configuration and
-// retry count from it. It returns the message the form shows for
-// anything it refuses, an unknown type among them, and then leaves the
-// target unchanged; an error is the server's fault, as for newTarget.
+// number of delivery attempts from it. It returns the message the form
+// shows for anything it refuses, an unknown type among them, and then
+// leaves the target unchanged; an error is the server's fault, as for
+// newTarget.
 // The add target form and the target edit form both go through here,
 // so the two cannot come to disagree about what a target may be.
 func (h *Handlers) setTargetFromForm(
@@ -136,20 +138,20 @@ func (h *Handlers) setTargetFromForm(
 		return errMsg, err
 	}
 
-	// An empty max_retries keeps the target's count: the
-	// fire-and-forget default of 0 for a new target, and the stored
-	// count for an edited one, since the forms for target types that
-	// do not retry have no such field. A value that is filled in but
-	// invalid is refused rather than becoming that count, so a typo
-	// cannot destroy the count a target is delivering with.
-	maxRetries, err := parseMaxRetries(in.MaxRetries, target.MaxRetries)
+	// An empty max_attempts keeps the target's count: the default of
+	// 1 for a new target, and the stored count for an edited one,
+	// since the forms for target types that do not retry have no such
+	// field. A value that is filled in but invalid is refused rather
+	// than becoming that count, so a typo cannot destroy the count a
+	// target is delivering with.
+	maxAttempts, err := parseMaxAttempts(in.MaxAttempts, target.MaxAttempts)
 	if err != nil {
-		return "Invalid delivery attempts: " + retriesErrorMessage(err), nil
+		return "Invalid delivery attempts: " + attemptsErrorMessage(err), nil
 	}
 
 	target.Name = in.Name
 	target.Config = configJSON
-	target.MaxRetries = maxRetries
+	target.MaxAttempts = maxAttempts
 
 	return "", nil
 }
@@ -176,8 +178,8 @@ type targetFormInput struct {
 	// ForwardQuery is an HTTP target's checkbox that passes each
 	// event's query string on to it.
 	ForwardQuery bool
-	// MaxRetries is an HTTP or Slack target's max_retries.
-	MaxRetries string
+	// MaxAttempts is an HTTP or Slack target's max_attempts.
+	MaxAttempts string
 	// Expiry is a database (archive) target's row expiry.
 	Expiry string
 	// Rotation is a database (archive) target's rotation.
@@ -204,7 +206,7 @@ func targetFormInputFrom(r *http.Request) targetFormInput {
 		Headers:      r.PostFormValue("headers"),
 		Timeout:      r.PostFormValue("timeout"),
 		ForwardQuery: r.PostFormValue("forward_query") != "",
-		MaxRetries:   r.PostFormValue("max_retries"),
+		MaxAttempts:  r.PostFormValue("max_attempts"),
 		Expiry:       r.PostFormValue("expiry"),
 		Rotation:     r.PostFormValue("rotation"),
 	}

internal/handlers/target_create_query_test.go

@@ -196,7 +196,7 @@ func TestHandleTargetCreate_QueryStringCannotSupplyNameOrType(
 
 	w, _ := postTargetCreate(
 		t, env, webhook.ID,
-		"name=leaky&type=slack&max_retries=9&expiry=30d&url="+
+		"name=leaky&type=slack&max_attempts=9&expiry=30d&url="+
 			url.QueryEscape(targetSecretURL),
 		url.Values{},
 	)

internal/handlers/target_create_test.go

@@ -21,24 +21,24 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {
 
 	// fields is the rest of each submission, as a query string.
 	cases := []struct {
-		targetType  database.TargetType
-		fields      string
-		wantConfig  string
-		wantRetries int
+		targetType   database.TargetType
+		fields       string
+		wantConfig   string
+		wantAttempts int
 	}{
 		{
-			database.TargetTypeHTTP, "timeout=12&max_retries=3",
+			database.TargetTypeHTTP, "timeout=12&max_attempts=3",
 			`{"url":"` + editOriginalURL + `","timeout":12}`, 3,
 		},
 		{
-			database.TargetTypeSlack, "max_retries=4",
+			database.TargetTypeSlack, "max_attempts=4",
 			`{"webhookUrl":"` + editOriginalURL + `"}`, 4,
 		},
 		{
 			database.TargetTypeDatabase, "expiry=720h",
-			`{"expiry":"720h"}`, 0,
+			`{"expiry":"720h"}`, 1,
 		},
-		{database.TargetTypeLog, "", "", 0},
+		{database.TargetTypeLog, "", "", 1},
 	}
 
 	for _, tc := range cases {
@@ -62,7 +62,7 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {
 			targets := targetsForWebhook(t, env.db, webhook.ID)
 			require.Len(t, targets, 1)
 			assert.Equal(t, tc.targetType, targets[0].Type)
-			assert.Equal(t, tc.wantRetries, targets[0].MaxRetries)
+			assert.Equal(t, tc.wantAttempts, targets[0].MaxAttempts)
 
 			if tc.wantConfig == "" {
 				assert.Empty(t, targets[0].Config)
@@ -90,11 +90,11 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=private&url=" + editBlockedURL +
-				"&timeout=12&max_retries=3",
+				"&timeout=12&max_attempts=3",
 			"Invalid target URL",
 		},
 		{
-			database.TargetTypeSlack, "name=no-url&max_retries=4",
+			database.TargetTypeSlack, "name=no-url&max_attempts=4",
 			"Webhook URL is required for Slack targets",
 		},
 		{
@@ -133,8 +133,8 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 			assert.Contains(t, page, html.EscapeString(tc.reason))
 
 			// Each value comes back in a data attribute of the targets
-			// section named after its field (max_retries as
-			// data-max-retries), except url, which comes back in
+			// section named after its field (max_attempts as
+			// data-max-attempts), except url, which comes back in
 			// data-destination; templates/source_detail.html says why.
 			for field := range typed {
 				attr := "data-" + strings.ReplaceAll(field, "_", "-")

internal/handlers/target_edit.go

@@ -82,7 +82,7 @@ func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 			Headers:      cfg.Headers,
 			Timeout:      cfg.Timeout,
 			ForwardQuery: cfg.ForwardQuery,
-			MaxRetries:   strconv.Itoa(target.MaxRetries),
+			MaxAttempts:  strconv.Itoa(target.MaxAttempts),
 			Expiry:       cfg.Expiry,
 			Rotation:     cfg.Rotation,
 		}

internal/handlers/target_edit_test.go

@@ -117,7 +117,7 @@ func seedHTTPTarget(
 	form.Set("url", editOriginalURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_retries", "3")
+	form.Set("max_attempts", "3")
 
 	w := serveTarget(
 		env, http.MethodPost,
@@ -179,7 +179,7 @@ func editForm(targetURL, headers, timeout string) url.Values {
 	form.Set("url", targetURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_retries", "5")
+	form.Set("max_attempts", "5")
 
 	return form
 }
@@ -280,9 +280,9 @@ func TestHandleTargetEditSubmit_Saves(t *testing.T) {
 		assertEditClearingRemovesThem(t, env)
 	})
 
-	t.Run("absent max_retries is not zeroed", func(t *testing.T) {
+	t.Run("absent max_attempts is kept", func(t *testing.T) {
 		t.Parallel()
-		assertEditKeepsAbsentMaxRetries(t, env)
+		assertEditKeepsAbsentMaxAttempts(t, env)
 	})
 }
 
@@ -307,7 +307,7 @@ func assertEditChangesDestination(
 
 	reloaded := storedTarget(t, env, target.ID)
 	assert.Equal(t, "edited-name", reloaded.Name)
-	assert.Equal(t, 5, reloaded.MaxRetries)
+	assert.Equal(t, 5, reloaded.MaxAttempts)
 	assert.Equal(
 		t, database.TargetTypeHTTP, reloaded.Type,
 		"the edit form must not change a target's type",
@@ -368,25 +368,25 @@ func assertEditClearingRemovesThem(
 	assert.Zero(t, cfg.Timeout)
 }
 
-// Retries are offered only by the forms for target types that retry.
-// An absent field means the form does not edit retries, not that
-// they should be turned off.
-func assertEditKeepsAbsentMaxRetries(
+// Delivery attempts are offered only by the forms for target types
+// that retry. An absent field means the form does not edit them, not
+// that retries should be turned off.
+func assertEditKeepsAbsentMaxAttempts(
 	t *testing.T, env *sourceTestEnv,
 ) {
 	t.Helper()
 
 	webhook, target := seedHTTPTarget(t, env, "", "")
-	require.Equal(t, 3, target.MaxRetries)
+	require.Equal(t, 3, target.MaxAttempts)
 
 	form := editForm(editOriginalURL, "", "")
-	form.Del("max_retries")
+	form.Del("max_attempts")
 
 	w := submitTargetEdit(env, webhook.ID, target.ID, form)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
 
 	assert.Equal(
-		t, 3, storedTarget(t, env, target.ID).MaxRetries,
+		t, 3, storedTarget(t, env, target.ID).MaxAttempts,
 	)
 }
 
@@ -659,12 +659,12 @@ func TestHandleTargetEditSubmit_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=edited&url=" + editBlockedURL +
-				"&headers=X-Edited:+kept&timeout=12&max_retries=3",
+				"&headers=X-Edited:+kept&timeout=12&max_attempts=3",
 			"Invalid target URL",
 		},
 		{
 			database.TargetTypeSlack,
-			"name=edited&url=" + editOriginalURL + "&max_retries=25",
+			"name=edited&url=" + editOriginalURL + "&max_attempts=25",
 			"Invalid delivery attempts",
 		},
 		{

internal/handlers/target_retries.go

@@ -1,83 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"strconv"
-	"strings"
-)
-
-// maxTargetRetries bounds a target's max_retries.
-//
-// Both target forms already declare max="20" on the input, so this
-// enforces server-side what the UI has always advertised rather than
-// introducing a new limit.
-//
-// The number is not cosmetic. Every attempt writes a delivery_results
-// row that the event log then loads and renders, and the engine backs
-// off by 2^(n-1) seconds, so attempt 20 is already about six days
-// after the first. A value beyond this buys no additional durability
-// and only costs rows.
-const maxTargetRetries = 20
-
-// Errors returned when a max_retries form value cannot be turned into
-// a retry count.
-var (
-	// errRetriesInvalid signals a max_retries form value that is not
-	// a non-negative whole number.
-	errRetriesInvalid = errors.New(
-		"must be a whole number",
-	)
-
-	// errRetriesTooLarge signals a max_retries form value that is a
-	// whole number but above maxTargetRetries. It is distinguished
-	// from errRetriesInvalid so the message can name the ceiling
-	// instead of implying the input was not a number.
-	errRetriesTooLarge = errors.New("out of range")
-)
-
-// parseMaxRetries interprets a max_retries form value.
-//
-// An ABSENT value — the field empty or not submitted — yields
-// fallback, which lets the create path apply its default and the edit
-// path leave the stored value alone. A value that is SET BUT INVALID
-// is an error: unparseable, negative, or above maxTargetRetries.
-//
-// The distinction is the whole point of this function. max_retries=0
-// means fire-and-forget, so returning 0 for input the operator typed
-// but that did not parse silently disables retries on a
-// store-and-forward proxy — and on the edit path it destroys a
-// working retry configuration over a typo. A default answers a
-// question that was not asked; it never answers one that was asked
-// badly.
-func parseMaxRetries(raw string, fallback int) (int, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return fallback, nil
-	}
-
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 0 {
-		return 0, errRetriesInvalid
-	}
-
-	if v > maxTargetRetries {
-		return 0, errRetriesTooLarge
-	}
-
-	return v, nil
-}
-
-// retriesErrorMessage returns the message the create and edit forms
-// show for a rejected max_retries value. Any error other than
-// errRetriesTooLarge falls back to the generic wording, so an
-// unrecognised parse failure still produces a sensible 400.
-func retriesErrorMessage(err error) string {
-	if errors.Is(err, errRetriesTooLarge) {
-		return errRetriesTooLarge.Error() +
-			": at most " + strconv.Itoa(maxTargetRetries) +
-			" attempts"
-	}
-
-	return errRetriesInvalid.Error() +
-		", or 0 for fire-and-forget"
-}

internal/handlers/target_retries_test.go

@@ -1,385 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/url"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/handlers"
-)
-
-// retriesTargetURL is the destination the retry-validation targets
-// point at. It is a literal public address rather than a hostname so
-// the SSRF check resolves nothing and a sandbox without DNS cannot
-// make these cases pass or fail for the wrong reason.
-const retriesTargetURL = "https://93.184.216.34/hooks/retries"
-
-const (
-	// wayAboveCeiling is the typo'd-extra-zero case from the report.
-	wayAboveCeiling = "999999999"
-
-	// notANumber is the plainest garbage an operator can type, and
-	// the value the report submitted on the edit form.
-	notANumber = "abc"
-
-	// workingRetries is the retry count a seeded target is already
-	// delivering with, which a rejected submission must not disturb.
-	workingRetries = 2
-)
-
-// aboveCeiling is the smallest rejected whole number.
-func aboveCeiling() string {
-	return strconv.Itoa(handlers.MaxTargetRetriesForTest + 1)
-}
-
-// overCeilingRetries is whole-number input past the limit, which is
-// rejected with the limit named.
-func overCeilingRetries() []string {
-	return []string{aboveCeiling(), wayAboveCeiling}
-}
-
-// unparseableRetries is input an operator can type into the field
-// that is not a retry count. Each must be REJECTED: silently reading
-// any of them as 0 turns a store-and-forward proxy into
-// fire-and-forget without saying so.
-//
-// The twenty-digit case is here because it parses as digits but
-// overflows int, which is the one failure the field's own min/max
-// attributes cannot describe.
-func unparseableRetries() []string {
-	return []string{
-		notANumber,
-		"2.7",
-		"-5",
-		"12345678901234567890",
-		"1e3",
-	}
-}
-
-// createRetriesForm is a complete, otherwise-valid HTTP target
-// creation, so the only thing any case below varies is max_retries.
-func createRetriesForm(retries string) url.Values {
-	form := url.Values{}
-	form.Set("name", "retries-target")
-	form.Set("type", string(database.TargetTypeHTTP))
-	form.Set("url", retriesTargetURL)
-
-	if retries != absentField {
-		form.Set("max_retries", retries)
-	}
-
-	return form
-}
-
-// absentField marks a field the form does not submit at all, which is
-// the case that legitimately takes a default and must stay distinct
-// from a field submitted with garbage in it.
-const absentField = "\x00absent"
-
-// absentRetries is every way of saying "the operator did not set
-// this", each of which takes the default rather than a 400. Blank and
-// whitespace-only count as absent here because they do in the timeout
-// and retention controls on the same forms; a rule the fields do not
-// share would be its own surprise.
-func absentRetries() []string {
-	return []string{absentField, "", "  "}
-}
-
-// createWithRetries posts the target create form for a fresh webhook
-// and returns the webhook and the response.
-func createWithRetries(
-	t *testing.T,
-	env *sourceTestEnv,
-	retries string,
-) (database.Webhook, int, string) {
-	t.Helper()
-
-	webhook := seedWebhookWithRetention(t, env.db, 30)
-
-	w := serveTarget(
-		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets",
-		createRetriesForm(retries),
-	)
-
-	return webhook, w.Code, w.Body.String()
-}
-
-// TestTargetCreate_RetriesAboveCeilingRejected proves the create form
-// enforces a ceiling at all, and that the 400 names it — a rejection
-// that does not say what the limit is leaves the operator guessing.
-func TestTargetCreate_RetriesAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
-
-	for _, retries := range overCeilingRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_retries=%s should be rejected", retries)
-		assert.Contains(t, body, ceiling,
-			"the rejection for %s should name the ceiling",
-			retries)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %s", retries)
-	}
-}
-
-// TestTargetCreate_UnparseableRetriesRejected is the core of the
-// defect: each of these was accepted with HTTP 200 and stored as 0.
-func TestTargetCreate_UnparseableRetriesRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range unparseableRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_retries=%q should be rejected, not coerced",
-			retries)
-		assert.Contains(t, body, "whole number",
-			"the rejection for %q should say why", retries)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %q", retries)
-	}
-}
-
-// TestTargetCreate_ValidRetriesStored covers the accepting half,
-// including the ceiling itself: a bound that rejects its own limit
-// would make the advertised maximum unreachable.
-func TestTargetCreate_ValidRetriesStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{0, 3, handlers.MaxTargetRetriesForTest} {
-		webhook, code, body := createWithRetries(
-			t, env, strconv.Itoa(want),
-		)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, want, targets[0].MaxRetries)
-	}
-}
-
-// TestTargetCreate_AbsentRetriesTakesDefault keeps the two cases
-// distinct. An omitted field is not an operator asking for something
-// invalid, so it still gets the fire-and-forget default rather than a
-// 400 — otherwise the fix above would make the form unusable.
-func TestTargetCreate_AbsentRetriesTakesDefault(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range absentRetries() {
-		webhook, code, body := createWithRetries(t, env, retries)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, 0, targets[0].MaxRetries,
-			"an absent max_retries should take the default")
-	}
-}
-
-// seedRetriesTarget creates an HTTP target already delivering with
-// workingRetries retries, through the real create handler.
-func seedRetriesTarget(
-	t *testing.T,
-	env *sourceTestEnv,
-) (database.Webhook, database.Target) {
-	t.Helper()
-
-	webhook, code, body := createWithRetries(
-		t, env, strconv.Itoa(workingRetries),
-	)
-	require.Equal(t, http.StatusSeeOther, code, body)
-
-	targets := targetsForWebhook(t, env.db, webhook.ID)
-	require.Len(t, targets, 1)
-	require.Equal(t, workingRetries, targets[0].MaxRetries)
-
-	return webhook, targets[0]
-}
-
-// editRetriesForm is a complete edit submission that changes the
-// target's name as well, so a rejected submission can be shown to
-// have written nothing at all rather than merely to have left
-// max_retries alone.
-func editRetriesForm(retries string) url.Values {
-	form := url.Values{}
-	form.Set("name", "renamed-by-edit")
-	form.Set("url", retriesTargetURL)
-
-	if retries != absentField {
-		form.Set("max_retries", retries)
-	}
-
-	return form
-}
-
-// assertEditRejectedAndUnchanged submits an edit expected to fail and
-// checks both halves of the requirement: the 400 explains itself, and
-// the target it was submitted against is untouched.
-func assertEditRejectedAndUnchanged(
-	t *testing.T,
-	env *sourceTestEnv,
-	retries, wantReason string,
-) {
-	t.Helper()
-
-	webhook, target := seedRetriesTarget(t, env)
-
-	w := submitTargetEdit(
-		env, webhook.ID, target.ID, editRetriesForm(retries),
-	)
-
-	assert.Equal(t, http.StatusBadRequest, w.Code,
-		"max_retries=%q should be rejected on edit", retries)
-	assert.Contains(t, w.Body.String(), wantReason,
-		"the rejection for %q should say why", retries)
-
-	stored := storedTarget(t, env, target.ID)
-	assert.Equal(t, workingRetries, stored.MaxRetries,
-		"a rejected edit must not destroy the working retry "+
-			"count with %q", retries)
-	assert.Equal(t, "retries-target", stored.Name,
-		"a rejected edit must write nothing at all")
-}
-
-// TestTargetEdit_UnparseableRetriesRejected is the damaging half of
-// the defect. A target delivering with two retries, re-saved with a
-// typo in the field, returned 200 and was left with retries disabled
-// and nothing said.
-func TestTargetEdit_UnparseableRetriesRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range unparseableRetries() {
-		assertEditRejectedAndUnchanged(
-			t, env, retries, "whole number",
-		)
-	}
-}
-
-// TestTargetEdit_RetriesAboveCeilingRejected proves the ceiling
-// applies to the edit path too, naming itself, so the two paths
-// cannot disagree about what is storable.
-func TestTargetEdit_RetriesAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
-
-	for _, retries := range overCeilingRetries() {
-		assertEditRejectedAndUnchanged(t, env, retries, ceiling)
-	}
-}
-
-// TestTargetEdit_ValidRetriesStored covers the accepting half of the
-// edit path, so the ceiling cannot be enforced by simply refusing
-// every submission.
-func TestTargetEdit_ValidRetriesStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{0, 9, handlers.MaxTargetRetriesForTest} {
-		webhook, target := seedRetriesTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(strconv.Itoa(want)),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, want,
-			storedTarget(t, env, target.ID).MaxRetries)
-	}
-}
-
-// TestTargetEdit_AbsentRetriesLeavesStoredValue is the edit path's
-// absent-versus-invalid case. Retries are only offered by the forms
-// for types that retry, so a submission without the field must leave
-// the stored count alone rather than be rejected or zeroed.
-func TestTargetEdit_AbsentRetriesLeavesStoredValue(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, retries := range absentRetries() {
-		webhook, target := seedRetriesTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(retries),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, workingRetries,
-			storedTarget(t, env, target.ID).MaxRetries,
-			"an absent max_retries must leave the stored "+
-				"count alone (%q)", retries)
-	}
-}
-
-// TestTargetRetries_CreateAndEditAgreeOnEveryCase proves the two
-// paths cannot disagree, which is what let the create form and the
-// edit form drift apart in the first place. Every input is submitted
-// to both and the accept/reject verdicts are compared.
-func TestTargetRetries_CreateAndEditAgreeOnEveryCase(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	accepted := []string{
-		"0", "1",
-		strconv.Itoa(handlers.MaxTargetRetriesForTest),
-	}
-	overCeiling := overCeilingRetries()
-	unparseable := unparseableRetries()
-
-	cases := make(
-		[]string, 0,
-		len(accepted)+len(overCeiling)+len(unparseable),
-	)
-	cases = append(cases, accepted...)
-	cases = append(cases, overCeiling...)
-	cases = append(cases, unparseable...)
-
-	for _, retries := range cases {
-		_, createCode, _ := createWithRetries(t, env, retries)
-
-		webhook, target := seedRetriesTarget(t, env)
-		editCode := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editRetriesForm(retries),
-		).Code
-
-		assert.Equal(t,
-			createCode == http.StatusBadRequest,
-			editCode == http.StatusBadRequest,
-			"create and edit must agree on max_retries=%q "+
-				"(create %d, edit %d)",
-			retries, createCode, editCode,
-		)
-	}
-}

internal/handlers/target_toggle_test.go

@@ -59,7 +59,7 @@ func TestHandleTargetToggle_DoesNotUndoAnEdit(t *testing.T) {
 	stored := storedTarget(t, env, tgt.ID)
 	assert.False(t, stored.Active)
 	assert.Equal(t, "edited-name", stored.Name)
-	assert.Equal(t, 5, stored.MaxRetries)
+	assert.Equal(t, 5, stored.MaxAttempts)
 	assert.Equal(
 		t, editReplacedURL, storedHTTPConfig(t, env, tgt.ID).URL,
 	)

internal/handlers/ui_copy_test.go

@@ -348,21 +348,19 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 	)
 }
 
-// maxRetriesHelp is the wording both target forms must carry. The
-// delivery core makes max_retries attempts in total, not that many
+// maxAttemptsHelp is the wording both target forms must carry. The
+// delivery core makes max_attempts attempts in total, not that many
 // retries on top of a first try (a fresh delivery starts at attempt 1
 // and target_http gives up once the attempt number reaches
-// max_retries), and 0 is special-cased to a single fire-and-forget
-// attempt with no circuit breaker.
-const maxRetriesHelp = "How many times each delivery is attempted in " +
-	"all, the first attempt included. 0 means a single attempt with no " +
-	"retries and no circuit breaker."
+// max_attempts).
+const maxAttemptsHelp = "How many times each delivery is attempted in " +
+	"all, the first attempt included."
 
-// TestTargetFormMaxRetriesCopyMatchesBehaviour pins the max_retries
+// TestTargetFormMaxAttemptsCopyMatchesBehaviour pins the max_attempts
 // label, "Delivery attempts", and help text on both the create form
 // (the add-target form on the webhook detail page) and the edit form,
 // so the copy cannot drift back to calling the number a retry count.
-func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
+func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {
 	t.Parallel()
 
 	var h *handlers.Handlers
@@ -394,11 +392,11 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 
 	assert.Contains(t, createBody, "Delivery attempts:</label>")
 	assert.Contains(
-		t, createBody, maxRetriesHelp,
-		"the add-target form must explain max_retries as total attempts",
+		t, createBody, maxAttemptsHelp,
+		"the add-target form must explain max_attempts as total attempts",
 	)
 
-	// A slack target exercises the same max_retries field while needing
+	// A slack target exercises the same max_attempts field while needing
 	// only a URL from the edit template, so the test data stays
 	// minimal. The Target and TargetForm keys mirror the field names
 	// the template reads off the handler's values.
@@ -412,8 +410,8 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 				"Active": true,
 			},
 			"TargetForm": map[string]any{
-				"URL":        "https://hooks.slack.com/services/x",
-				"MaxRetries": "3",
+				"URL":         "https://hooks.slack.com/services/x",
+				"MaxAttempts": "3",
 			},
 			dataKeyError: "",
 		},
@@ -421,8 +419,8 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 
 	assert.Contains(t, editBody, `class="label">Delivery attempts</label>`)
 	assert.Contains(
-		t, editBody, maxRetriesHelp,
-		"the target edit form must explain max_retries as total attempts",
+		t, editBody, maxAttemptsHelp,
+		"the target edit form must explain max_attempts as total attempts",
 	)
 }
 

internal/handlers/webhook.go

@@ -433,7 +433,7 @@ func buildDeliveryTasks(
 			TargetName:   targets[i].Name,
 			TargetType:   targets[i].Type,
 			TargetConfig: targets[i].Config,
-			MaxRetries:   targets[i].MaxRetries,
+			MaxAttempts:  targets[i].MaxAttempts,
 			Method:       event.Method,
 			RawQuery:     event.RawQuery,
 			Headers:      event.Headers,