Serve an event's full stored body over HTTP (closes #157)

The 8 KB render cap from #135 left storage untouched but no route served
the rest, so a body over the cap was reachable only with filesystem
access to the SQLite files — in a product whose purpose is storing
webhooks so they can be inspected.

GET /source/{sourceID}/logs/{eventID}/body serves the whole body to the
webhook's owner, as application/octet-stream with an attachment
disposition and nosniff. Those are a security control, not formatting:
the bytes come from the public receiver and are handed back inside the
operator's authenticated origin, and the existing CSP would not stop a
stored HTML payload executing there. The truncation marker links to it
only when a body was actually cut.

Accepted deviation, documented rather than glossed: #157's definition of
done asks the route to stream from the row. It buffers whole instead,
because database/sql exposes no incremental handle on a SQLite BLOB and
substr range reads re-materialise the entire column per call — an
earlier revision chunked at 64 KiB and was 11-15x slower for a worse
bound. Three independent reviewers confirmed no streaming path exists.

Independently reviewed three times. Two earlier revisions each asserted
a memory bound the code did not have; the final reviewer measured
2.057x at the ingest cap and pinned the two overlapping allocations from
source — the driver's column buffer and database/sql's convertAssign
clone — confirming the stated "roughly two bodies, and 2x is a floor
not a ceiling" is now accurate, since SQLite's own materialisation sits
outside the Go heap.

internal/server/routes.go

@@ -146,6 +146,15 @@ func (s *Server) setupSourceRoutes() {
 		r.Post("/edit", s.h.HandleSourceEditSubmit())
 		r.Post("/delete", s.h.HandleSourceDelete())
 		r.Get("/logs", s.h.HandleSourceLogs())
+		// The log page renders each body only up to its cap, so
+		// this is the only route that serves a whole one. It
+		// belongs to this group for its RequireAuth and
+		// NoCache; see HandleEventBodyDownload for the headers
+		// that keep the bytes it returns inert.
+		r.Get(
+			"/logs/{eventID}/body",
+			s.h.HandleEventBodyDownload(),
+		)
 		r.Post(
 			"/entrypoints",
 			s.h.HandleEntrypointCreate(),

internal/server/routes_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"regexp"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -14,6 +15,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
+	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
@@ -49,6 +51,7 @@ type testEnv struct {
 	router http.Handler
 	sess   *session.Session
 	db     *database.Database
+	dbMgr  *database.WebhookDBManager
 }
 
 // newTestEnv wires the dependency graph with fx and builds the
@@ -58,12 +61,13 @@ func newTestEnv(t *testing.T) *testEnv {
 	t.Helper()
 
 	var (
-		log  *logger.Logger
-		cfg  *config.Config
-		mw   *middleware.Middleware
-		hnd  *handlers.Handlers
-		sess *session.Session
-		db   *database.Database
+		log   *logger.Logger
+		cfg   *config.Config
+		mw    *middleware.Middleware
+		hnd   *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
 	)
 
 	app := fxtest.New(
@@ -86,7 +90,7 @@ func newTestEnv(t *testing.T) *testEnv {
 			middleware.New,
 			handlers.New,
 		),
-		fx.Populate(&log, &cfg, &mw, &hnd, &sess, &db),
+		fx.Populate(&log, &cfg, &mw, &hnd, &sess, &db, &dbMgr),
 	)
 	app.RequireStart()
 	t.Cleanup(app.RequireStop)
@@ -95,6 +99,7 @@ func newTestEnv(t *testing.T) *testEnv {
 		router: server.NewRouterForTest(log.Get(), cfg, mw, hnd),
 		sess:   sess,
 		db:     db,
+		dbMgr:  dbMgr,
 	}
 }
 
@@ -233,6 +238,49 @@ func (e *testEnv) seedUser(
 	return user.ID, hash
 }
 
+// seedWebhook creates a webhook owned by the given user.
+func (e *testEnv) seedWebhook(
+	t *testing.T,
+	userID string,
+) *database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{UserID: userID, Name: "routed"}
+
+	require.NoError(
+		t,
+		e.db.DB().Omit(clause.Associations).Create(wh).Error,
+	)
+
+	return wh
+}
+
+// seedEvent records one event with the given body in a webhook's
+// own database.
+func (e *testEnv) seedEvent(
+	t *testing.T,
+	webhookID, body string,
+) *database.Event {
+	t.Helper()
+
+	webhookDB, err := e.dbMgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	event := &database.Event{
+		WebhookID:   webhookID,
+		Method:      http.MethodPost,
+		Body:        body,
+		ContentType: "application/octet-stream",
+	}
+
+	require.NoError(
+		t,
+		webhookDB.Omit(clause.Associations).Create(event).Error,
+	)
+
+	return event
+}
+
 // storedHash reads the current password hash for a username.
 func (e *testEnv) storedHash(t *testing.T, username string) string {
 	t.Helper()
@@ -432,3 +480,95 @@ func TestPasswordChange_UnderLimit_Succeeds(t *testing.T) {
 		"an under-limit password change should still apply",
 	)
 }
+
+// --- /source/{sourceID} group ---
+
+// TestSourceLogs_TruncationLinkDownloadsTheBody walks the whole
+// feature the way a user does: render the event log page through
+// the production router, take the download URL out of the markup
+// the template emitted, and fetch that URL through the router
+// again. Nothing here is hand-written, so a typo in either the
+// route pattern or the template href fails this test — the
+// handler-level tests cannot catch that, because they forge
+// their own route context and assert a URL string they wrote
+// themselves.
+func TestSourceLogs_TruncationLinkDownloadsTheBody(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	userID, _ := env.seedUser(t, "loguser", "somepassword")
+	cookies := env.authCookies(t, userID, "loguser")
+
+	// Comfortably over the event log page's render cap, so the
+	// page truncates the body and renders the download link at
+	// all. The exact cap is the handlers package's business and
+	// is pinned by its own tests; this only needs to exceed it.
+	stored := strings.Repeat("Z", 64*1024)
+
+	wh := env.seedWebhook(t, userID)
+	env.seedEvent(t, wh.ID, stored)
+
+	page := env.get("/source/"+wh.ID+"/logs", cookies)
+	require.Equal(t, http.StatusOK, page.Code)
+
+	link := regexp.MustCompile(
+		`href="(/source/[^"]+/body)"`,
+	).FindStringSubmatch(page.Body.String())
+	require.Len(
+		t, link, 2,
+		"truncated body should render a download link",
+	)
+
+	w := env.get(html.UnescapeString(link[1]), cookies)
+
+	require.Equal(
+		t, http.StatusOK, w.Code,
+		"the link the page emits must be a live route",
+	)
+	assert.Equal(t, stored, w.Body.String())
+	assert.Equal(
+		t, strconv.Itoa(len(stored)),
+		w.Header().Get("Content-Length"),
+	)
+	assert.Equal(
+		t, "application/octet-stream",
+		w.Header().Get("Content-Type"),
+	)
+	assert.Contains(
+		t, w.Header().Get("Content-Disposition"), "attachment",
+	)
+	assert.Equal(
+		t, "nosniff", w.Header().Get("X-Content-Type-Options"),
+	)
+}
+
+// TestSourceLogsBody_OtherUser404s pins that the download route
+// as registered is behind the auth the group provides and the
+// ownership check the handler applies: another logged-in user
+// asking the real router for the same URL gets a 404, and an
+// unauthenticated request never reaches the handler at all.
+func TestSourceLogsBody_OtherUser404s(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	ownerID, _ := env.seedUser(t, "owner", "somepassword")
+	wh := env.seedWebhook(t, ownerID)
+
+	const payload = "OWNERS-PAYLOAD-77c1"
+
+	evt := env.seedEvent(t, wh.ID, payload)
+	path := "/source/" + wh.ID + "/logs/" + evt.ID + "/body"
+
+	intruderID, _ := env.seedUser(t, "intruder", "somepassword")
+	intruder := env.authCookies(t, intruderID, "intruder")
+
+	w := env.get(path, intruder)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+	assert.NotContains(t, w.Body.String(), payload)
+
+	anon := env.get(path, nil)
+	assert.Equal(t, http.StatusSeeOther, anon.Code)
+	assert.Equal(t, "/pages/login", anon.Header().Get("Location"))
+}