Name each database target's archive for its webhook and target (closes #376)

Each database target now has its own archive file,
archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, instead of one
archive-WEBHOOKID.db per webhook. delivery.ArchiveFileName builds the
name: each name is lowercased, keeps ASCII letters and digits, turns
every other run of characters into one dash, and is cut to 40
characters.

A change of webhook or target name renames its archive files under the
archive writer's lock, before the new name is saved, and back again if
the save fails. A rename never replaces a file, and one that fails part
way moves back what it moved. Deleting a target evicts only that
target's writer. Archive files are never deleted, and nothing looks for
files under the old name.

Model: opus-5-5

internal/handlers/source_management_test.go

@@ -187,6 +187,7 @@ func storedRetentionDays(
 type sourceTestEnv struct {
 	handlers *handlers.Handlers
 	db       *database.Database
+	archives *recordingArchives
 	cookies  []*http.Cookie
 }
 
@@ -199,7 +200,9 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 
 	var db *database.Database
 
-	app := newTestApp(t, &h, &sess, &db)
+	var archives *recordingArchives
+
+	app := newTestApp(t, &h, &sess, &db, &archives)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -207,6 +210,7 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 	return &sourceTestEnv{
 		handlers: h,
 		db:       db,
+		archives: archives,
 		cookies: authenticatedCookies(
 			t, sess, sourceTestUserID, "sourceuser",
 		),
@@ -498,6 +502,189 @@ func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
 }
 
+// renamedWebhookName is the name the rename tests give a webhook.
+const renamedWebhookName = "Renamed"
+
+// TestHandleSourceEditSubmit_RenamesArchives proves that a save
+// that keeps the webhook's name renames nothing, and that renaming a
+// webhook renames the archive of each of its database targets and
+// asks nothing of its other targets.
+func TestHandleSourceEditSubmit_RenamesArchives(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	second := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	seedTarget(t, env.db, wh.ID, database.TargetTypeLog)
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Empty(t, env.archives.Renames())
+
+	wh.Name = renamedWebhookName
+
+	w = submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	assert.ElementsMatch(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{second.ID, renamedWebhookName, second.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedRenameKeepsTheName proves that a
+// webhook whose archive cannot be renamed keeps its stored name, so
+// the name on disk and the name in the UI do not part, and that the
+// handler puts back what it may already have moved.
+func TestHandleSourceEditSubmit_FailedRenameKeepsTheName(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(tgt.ID, errInjectedRename)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedSaveRenamesBack proves that when
+// the archive is renamed but the new name cannot be saved, the
+// archive is renamed back to the stored name and the stored name
+// stays.
+func TestHandleSourceEditSubmit_FailedSaveRenamesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	failSaveOnTable(t, env.db, "webhooks")
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack proves
+// that when a webhook has three database targets and only the middle
+// one's archive cannot be renamed, the stored name stays and both
+// others are renamed back, the last one included: the move back does
+// not stop at the target it cannot rename. The handler reaches the
+// targets in the order they were created, which the exact sequence
+// below pins, so the refused target always comes before the last.
+func TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	middle := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	last := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(middle.ID, errNameTaken)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusConflict, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{middle.ID, renamedWebhookName, middle.Name},
+			{last.ID, renamedWebhookName, last.Name},
+			{first.ID, oldName, first.Name},
+			{middle.ID, oldName, middle.Name},
+			{last.ID, oldName, last.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_ArchiveNameTaken proves that when a file
+// already has an archive's new name, the edit is refused with an
+// error naming that file, and the webhook keeps its stored name.
+func TestHandleSourceEditSubmit_ArchiveNameTaken(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(tgt.ID, errNameTaken)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusConflict, w.Code)
+	assert.Contains(t, w.Body.String(), "archive-taken.db")
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+}
+
 // TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
 // the removed max="365" cap used to break: render the edit form for a
 // retain-forever webhook, confirm the pre-filled sentinel is not capped