Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/database/model_webhook.go

@@ -4,27 +4,13 @@ import (
 	"math"
 	"strconv"
 	"time"
-
-	"gorm.io/gorm"
 )
 
 const (
-	// DefaultRetentionDays is the event retention period applied to a
-	// webhook created without an explicit retention value. It is the
-	// single source of truth for that policy and must stay in sync
-	// with the `gorm:"default:30"` column default on
-	// Webhook.RetentionDays below; a struct tag cannot reference a
-	// constant, so a test asserts the two agree.
+	// DefaultRetentionDays is the event retention period the new
+	// webhook form applies when its retention field is left blank.
 	DefaultRetentionDays = 30
 
-	// RetentionForeverDays is the sentinel RetentionDays value meaning
-	// "retain events forever". Users express that intent as 0, which
-	// Webhook.BeforeSave rewrites to this value: the column default
-	// substitutes DefaultRetentionDays for a zero value at insert
-	// time, so a zero can never survive a round trip to the database.
-	// Nothing outside this file may hardcode the number.
-	RetentionForeverDays = 365 * 1000
-
 	// MaxFiniteRetentionDays is the largest finite retention period the
 	// reaper's cutoff arithmetic can represent, and therefore the
 	// largest one a caller may request. It is derived from that
@@ -38,9 +24,7 @@ const (
 	// turns the cutoff into a timestamp in the far future that matches
 	// every row in the webhook's database. That is why this bound is
 	// enforced on input and why retentionCutoff saturates underneath
-	// it. Note that RetentionForeverDays deliberately sits above this
-	// ceiling: such webhooks are skipped before any cutoff is
-	// computed, and never reach the arithmetic at all.
+	// it.
 	MaxFiniteRetentionDays = int(
 		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
 	)
@@ -48,12 +32,10 @@ const (
 
 // Webhook represents a webhook processing unit that groups entrypoints and targets
 //
-// Every method below takes a pointer receiver. BeforeSave has to,
-// because it mutates the record and GORM only invokes hooks declared
-// that way; the display helpers follow suit so the receiver kinds do
-// not mix. Handlers therefore put a *Webhook into template data:
-// html/template cannot call a pointer method on a value held in a map,
-// because a map element is not addressable.
+// Every method below takes a pointer receiver, so handlers put a
+// *Webhook into template data: html/template cannot call a pointer
+// method on a value held in a map, because a map element is not
+// addressable.
 type Webhook struct {
 	BaseModel
 
@@ -61,47 +43,28 @@ type Webhook struct {
 	Name        string `gorm:"not null"           json:"name"`
 	Description string `json:"description"`
 
-	// RetentionDays is the number of days to retain events. A value of
-	// RetentionForeverDays means retain forever. The column default
-	// must equal DefaultRetentionDays.
-	RetentionDays int `gorm:"default:30" json:"retentionDays"`
+	// RetentionDays is the number of days to retain events, and 0
+	// means retain them forever.
+	RetentionDays int `json:"retentionDays"`
 
-	// Relations
-	User        User         `json:"user,omitzero"`
+	// Relations. No model marshals the record it belongs to:
+	// User.Webhooks leads back here, and the JSON could loop.
+	User        User         `json:"-"`
 	Entrypoints []Entrypoint `json:"entrypoints,omitempty"`
 	Targets     []Target     `json:"targets,omitempty"`
 }
 
-// BeforeSave normalises RetentionDays on every insert and update. A
-// non-positive value is the user's way of asking for "retain forever",
-// which is stored as the RetentionForeverDays sentinel.
-//
-// This has to happen in a hook rather than at the call sites. GORM
-// substitutes the column default (DefaultRetentionDays) for a zero
-// value while building the insert statement, which runs after
-// BeforeSave; rewriting any later than this loses that race and the
-// row lands at 30 days. Living on the model also means a future call
-// site — a REST API, a fixture, a migration — cannot bypass it.
-func (w *Webhook) BeforeSave(_ *gorm.DB) error {
-	if w.RetentionDays <= 0 {
-		w.RetentionDays = RetentionForeverDays
-	}
-
-	return nil
-}
-
-// retainsForever reports whether a stored RetentionDays value means
-// "keep events indefinitely". It is the single definition of that
-// question, shared by Webhook.RetainsForever and by the reaper's
+// retainsForever reports whether a RetentionDays value means "keep
+// events indefinitely", which 0 does. It is the single definition of
+// that question, shared by Webhook.RetainsForever and by the reaper's
 // cutoff computation so the two cannot disagree about which webhooks
 // are exempt from reaping.
 //
-// It accepts the RetentionForeverDays sentinel written by BeforeSave
-// and, defensively, the non-positive values that rows written before
-// the sentinel existed may still carry.
+// A negative value, which the forms refuse, is read the same way: as a
+// day count it would put the cutoff in the future, where it matches
+// every event the webhook has.
 func retainsForever(retentionDays int) bool {
-	return retentionDays <= 0 ||
-		retentionDays >= RetentionForeverDays
+	return retentionDays <= 0
 }
 
 // RetainsForever reports whether this webhook's events are kept
@@ -110,8 +73,16 @@ func (w *Webhook) RetainsForever() bool {
 	return retainsForever(w.RetentionDays)
 }
 
+// RetentionCutoff returns the time before which this webhook's events
+// have expired, as the reaper computes it, and false when the webhook
+// retains them forever.
+func (w *Webhook) RetentionCutoff(now time.Time) (time.Time, bool) {
+	return retentionCutoff(now, w.RetentionDays)
+}
+
 // RetentionLabel returns the webhook's retention policy as display
-// text, so that no template has to know about the sentinel value.
+// text: "forever" rather than "0 days" for a webhook that keeps its
+// events.
 func (w *Webhook) RetentionLabel() string {
 	if w.RetainsForever() {
 		return "forever"