Name each database target's archive for its webhook and target (closes #376)

Each database target now has its own archive file,
archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, instead of one
archive-WEBHOOKID.db per webhook. delivery.ArchiveFileName builds the
name: each name is lowercased, keeps ASCII letters and digits, turns
every other run of characters into one dash, and is cut to 40
characters.

A change of webhook or target name renames its archive files under the
archive writer's lock, before the new name is saved, and back again if
the save fails. A rename never replaces a file, and one that fails part
way moves back what it moved. Deleting a target evicts only that
target's writer. Archive files are never deleted, and nothing looks for
files under the old name.

Model: opus-5-5

internal/delivery/target_database.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -11,22 +12,75 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// databaseTarget is a no-retry target that archives the
-// full inbound event into a per-webhook archive SQLite file,
-// separate from the per-webhook event database. The event is
-// already persisted in the per-webhook event DB by the time
-// delivery runs; the database target additionally writes a
-// durable long-term copy into archive-{webhookID}.db and then
-// records a single attempt whose outcome reflects whether the
-// archive write succeeded. See archiveWriter for the
-// close/reopen, auto-recreate, and expiry semantics.
+// archiveNameMaxLen is how many characters of a webhook or target
+// name an archive file name keeps.
+const archiveNameMaxLen = 40
+
+// databaseTarget is a no-retry target that archives the full
+// inbound event into the target's own archive SQLite file, separate
+// from the per-webhook event database. The event is already
+// persisted in the per-webhook event DB by the time delivery runs;
+// the database target additionally writes a durable long-term copy
+// into the file ArchiveFileName names and then records a single
+// attempt whose outcome reflects whether the archive write
+// succeeded. See archiveWriter for the close/reopen, auto-recreate,
+// and expiry semantics.
 type databaseTarget struct {
 	eng *Engine
 
+	// writers holds one archive writer per database target, keyed
+	// by target ID.
 	mu      sync.Mutex
 	writers map[string]*archiveWriter
 }
 
+// ArchiveFileName returns the file name of a database target's
+// archive: archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, with both
+// names passed through archiveNamePart. The target ID keeps the
+// name unique when two targets' names come out the same.
+func ArchiveFileName(webhookName, targetName, targetID string) string {
+	return "archive-" + archiveNamePart(webhookName) + "-" +
+		archiveNamePart(targetName) + "-" + targetID + ".db"
+}
+
+// archiveNamePart makes a webhook or target name safe to put in a
+// file name. It is lowercased; ASCII letters and digits are kept,
+// every other run of characters becomes a single "-", and no "-" is
+// left at either end. It is cut to archiveNameMaxLen characters, and
+// a name with nothing left is "unnamed".
+func archiveNamePart(name string) string {
+	var b strings.Builder
+
+	dash := false
+
+	for _, r := range strings.ToLower(name) {
+		if (r < 'a' || r > 'z') && (r < '0' || r > '9') {
+			dash = b.Len() > 0
+
+			continue
+		}
+
+		if dash {
+			b.WriteByte('-')
+
+			dash = false
+		}
+
+		b.WriteRune(r)
+	}
+
+	part := b.String()
+	if len(part) > archiveNameMaxLen {
+		part = strings.TrimRight(part[:archiveNameMaxLen], "-")
+	}
+
+	if part == "" {
+		return "unnamed"
+	}
+
+	return part
+}
+
 // Deliver implements Target. It archives the event, then
 // records one successful attempt and marks the delivery
 // delivered. An archiving error fails the delivery: the
@@ -92,7 +146,7 @@ func (t *databaseTarget) Deliver(
 	)
 }
 
-// archive writes the full event as a row into the webhook's
+// archive writes the full event as a row into the target's
 // archive database, honouring the optional per-target expiry
 // parsed from the target config JSON.
 func (t *databaseTarget) archive(d *database.Delivery) error {
@@ -106,7 +160,7 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 		return err
 	}
 
-	w, err := t.writerFor(webhookID)
+	w, err := t.writerFor(d.TargetID)
 	if err != nil {
 		return err
 	}
@@ -124,30 +178,31 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 	return w.write(row, expiry)
 }
 
-// writerFor returns the archiveWriter for a webhook, creating
-// and caching it on first use. Each webhook has one writer so
-// its close/reopen debounce state is shared across concurrent
-// deliveries. The archive file lives beside the per-webhook
-// event database in the data directory.
+// writerFor returns the archive writer for a database target,
+// creating and caching it on first use. Each target has one writer
+// so its close/reopen debounce state is shared across concurrent
+// deliveries, and so a rename and the idle sweep take the same lock
+// as its writes.
 func (t *databaseTarget) writerFor(
-	webhookID string,
+	targetID string,
 ) (*archiveWriter, error) {
-	path, err := t.archivePath(webhookID)
-	if err != nil {
-		return nil, err
-	}
-
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
-	if t.writers == nil {
-		t.writers = make(map[string]*archiveWriter)
-	}
-
-	w, ok := t.writers[webhookID]
+	w, ok := t.writers[targetID]
 	if !ok {
-		w = newArchiveWriter(path, t.eng.log)
-		t.writers[webhookID] = w
+		var err error
+
+		w, err = t.newWriter(targetID)
+		if err != nil {
+			return nil, err
+		}
+
+		if t.writers == nil {
+			t.writers = make(map[string]*archiveWriter)
+		}
+
+		t.writers[targetID] = w
 	}
 
 	// A delivery claims the entry: even if the idle sweep created
@@ -159,40 +214,39 @@ func (t *databaseTarget) writerFor(
 }
 
 // sweepWriterFor returns the archive writer the idle sweep should
-// prune a webhook through, together with whether the sweep itself
-// created the registry entry.
+// prune a target's archive through, together with whether the sweep
+// itself created the registry entry.
 //
 // The sweep must route its prune through the registered writer so
 // the writer's mutex orders it against concurrent writes, but it
 // must never leave a registry entry behind: a sweep that ran
-// concurrently with the webhook's deletion would otherwise
+// concurrently with the target's deletion would otherwise
 // re-create an entry that nothing will ever evict again, which is
 // exactly the leak eviction exists to prevent. An entry the sweep
 // creates is therefore marked sweep-owned and handed back to
 // releaseSweepWriter when the sweep is done.
 func (t *databaseTarget) sweepWriterFor(
-	webhookID string,
+	targetID string,
 ) (*archiveWriter, bool, error) {
-	path, err := t.archivePath(webhookID)
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	w, ok := t.writers[targetID]
+	if ok {
+		return w, false, nil
+	}
+
+	w, err := t.newWriter(targetID)
 	if err != nil {
 		return nil, false, err
 	}
 
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
 	if t.writers == nil {
 		t.writers = make(map[string]*archiveWriter)
 	}
 
-	w, ok := t.writers[webhookID]
-	if ok {
-		return w, false, nil
-	}
-
-	w = newArchiveWriter(path, t.eng.log)
 	w.sweepOwned = true
-	t.writers[webhookID] = w
+	t.writers[targetID] = w
 
 	return w, true, nil
 }
@@ -209,57 +263,95 @@ func (t *databaseTarget) sweepWriterFor(
 // delivery that adopted the writer keeps a registered, evictable
 // one.
 func (t *databaseTarget) releaseSweepWriter(
-	webhookID string, w *archiveWriter,
+	targetID string, w *archiveWriter,
 ) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
-	cur, ok := t.writers[webhookID]
+	cur, ok := t.writers[targetID]
 	if !ok || cur != w || !cur.sweepOwned {
 		return
 	}
 
-	delete(t.writers, webhookID)
+	delete(t.writers, targetID)
 }
 
-// archivePath returns the archive file path for a webhook: it
-// lives beside the per-webhook event database in the data
-// directory. It does not touch the filesystem.
-func (t *databaseTarget) archivePath(
-	webhookID string,
-) (string, error) {
+// newWriter builds the writer for a database target's archive. The
+// file lives beside the webhook's event database in the data
+// directory and is named for the webhook and the target as the main
+// database has them now; from then on only rename changes the name
+// the writer uses. It does not touch the archive file.
+func (t *databaseTarget) newWriter(
+	targetID string,
+) (*archiveWriter, error) {
 	if t.eng.dbManager == nil {
-		return "", errArchiveNoDataDir
+		return nil, errArchiveNoDataDir
 	}
 
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
+	var target database.Target
 
-	return filepath.Join(
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
-	), nil
+	err := t.eng.database.DB().
+		Preload("Webhook").
+		First(&target, "id = ?", targetID).Error
+	if err != nil {
+		return nil, fmt.Errorf(
+			"loading database target %s: %w", targetID, err,
+		)
+	}
+
+	dir := filepath.Dir(t.eng.dbManager.DBPath(target.WebhookID))
+	name := ArchiveFileName(
+		target.Webhook.Name, target.Name, target.ID,
+	)
+
+	w := newArchiveWriter(filepath.Join(dir, name), t.eng.log)
+	w.webhookID = target.WebhookID
+
+	return w, nil
 }
 
-// evict drops a webhook's archive writer from the registry and
-// closes its handle, so a deleted webhook does not leave a
-// writer (and an open archive handle within its debounce
-// window) alive for the process lifetime.
+// rename moves a database target's archive file to the name for
+// webhookName and targetName. It goes through the target's writer,
+// so the move holds the lock that writes and the idle sweep take,
+// and later writes use the new name.
+//
+// The writer is created if there is none, and it stays cached. The
+// handlers rename before they save the new name, so until the save
+// the main database still has the old one; a delivery in that window
+// must find this writer rather than build one from the old name.
+func (t *databaseTarget) rename(
+	targetID, webhookName, targetName string,
+) error {
+	w, err := t.writerFor(targetID)
+	if err != nil {
+		return err
+	}
+
+	return w.rename(ArchiveFileName(webhookName, targetName, targetID))
+}
+
+// evict drops a database target's archive writer from the registry
+// and closes its handle, so a deleted target does not leave a
+// writer (and an open archive handle within its debounce window)
+// alive for the process lifetime.
 //
 // The map entry is removed under the registry lock, which is
 // then released before the handle is closed under the writer's
 // own lock: that ordering keeps the registry available to other
-// webhooks while an in-flight write on this one drains, and
+// targets while an in-flight write on this one drains, and
 // closing under the writer's lock means eviction can never race
 // a write.
 //
-// Eviction is idempotent and silent for a webhook with no
-// writer, which is the common case: a webhook with no database
-// target never creates one. It never deletes the archive file.
-func (t *databaseTarget) evict(webhookID string) {
+// Eviction is idempotent and silent for a target with no writer,
+// which is the common case: only a database target that has
+// received an event or been renamed has one. It never deletes the
+// archive file.
+func (t *databaseTarget) evict(targetID string) {
 	t.mu.Lock()
 
-	w, ok := t.writers[webhookID]
+	w, ok := t.writers[targetID]
 	if ok {
-		delete(t.writers, webhookID)
+		delete(t.writers, targetID)
 	}
 
 	t.mu.Unlock()
@@ -272,13 +364,41 @@ func (t *databaseTarget) evict(webhookID string) {
 
 	t.eng.log.Info(
 		"evicted archive writer",
-		"webhook_id", webhookID,
+		"target_id", targetID,
 		"path", w.path,
 	)
 }
 
+// evictWebhook evicts, exactly as evict does, the writer of every
+// database target of a webhook.
+func (t *databaseTarget) evictWebhook(webhookID string) {
+	t.mu.Lock()
+
+	var gone []*archiveWriter
+
+	for targetID, w := range t.writers {
+		if w.webhookID == webhookID {
+			delete(t.writers, targetID)
+
+			gone = append(gone, w)
+		}
+	}
+
+	t.mu.Unlock()
+
+	for _, w := range gone {
+		w.evict()
+
+		t.eng.log.Info(
+			"evicted archive writer",
+			"webhook_id", webhookID,
+			"path", w.path,
+		)
+	}
+}
+
 // evictAll evicts every cached archive writer, exactly as evict
-// does for one webhook. The engine calls it at shutdown, once its
+// does for one target. The engine calls it at shutdown, once its
 // workers have returned. Closing the last handle on an archive
 // moves the contents of its -wal into the .db and removes the
 // -wal, so a clean stop leaves each archive as a single file.
@@ -295,38 +415,25 @@ func (t *databaseTarget) evictAll() {
 	}
 }
 
-// sweepWebhook prunes one webhook's archive of rows older than
-// expiry, without requiring a write. It returns nil (nothing to
-// do) when the archive file does not exist, so a sweep never
-// creates an archive for a webhook that has a database target
-// but has never received an event.
+// sweepArchive prunes one database target's archive of rows older
+// than expiry, without requiring a write. A missing archive file is
+// left missing (see sweepExpired), so a sweep never creates an
+// archive for a target that has never received an event.
 //
 // It also never leaves a registry entry behind: an entry it had
 // to create to reach the writer's mutex is released again once
-// the prune is done, so a sweep racing a webhook deletion cannot
+// the prune is done, so a sweep racing a target deletion cannot
 // resurrect the writer the eviction just dropped.
-func (t *databaseTarget) sweepWebhook(
-	webhookID string, expiry time.Duration,
+func (t *databaseTarget) sweepArchive(
+	targetID string, expiry time.Duration,
 ) error {
-	path, err := t.archivePath(webhookID)
-	if err != nil {
-		return err
-	}
-
-	// Check before taking a writer at all: a webhook whose
-	// archive has never been created gets no writer, no handle,
-	// and no file.
-	if !fileExists(path) {
-		return nil
-	}
-
-	w, created, err := t.sweepWriterFor(webhookID)
+	w, created, err := t.sweepWriterFor(targetID)
 	if err != nil {
 		return err
 	}
 
 	if created {
-		defer t.releaseSweepWriter(webhookID, w)
+		defer t.releaseSweepWriter(targetID, w)
 	}
 
 	return w.sweepExpired(expiry)