Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/delivery/target_redact_test.go

@@ -22,8 +22,9 @@ func TestRedactor_RemovesSlackWebhookURL(t *testing.T) {
 	t.Parallel()
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeSlack,
-		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+		Type:        database.TargetTypeSlack,
+		URL:         redactWebhookURL,
+		MaxAttempts: 1,
 	})
 
 	got := r.Redact("no_service for " + redactWebhookURL)
@@ -52,8 +53,9 @@ func TestRedactor_RemovesSecretSeveredByACut(t *testing.T) {
 	t.Parallel()
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeSlack,
-		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+		Type:        database.TargetTypeSlack,
+		URL:         redactWebhookURL,
+		MaxAttempts: 1,
 	})
 
 	// Every cut position inside the credential, not just a
@@ -84,18 +86,20 @@ func TestRedactor_RedactsCredentialShapedHeaderValues(
 
 	r := delivery.NewRedactor(&database.Target{
 		Type: database.TargetTypeHTTP,
-		Config: `{"url":"https://example.com/in",` +
-			`"headers":{` +
-			`"Authorization":"Bearer AAAAAAAAAAAA",` +
-			`"Cookie":"session=BBBBBBBBBBBB",` +
-			`"X-Api-Key":"CCCCCCCCCCCC",` +
-			`"X-Hub-Signature":"sha256=DDDDDDDDDDDD",` +
-			`"X-Sig":"EEEEEEEEEEEE",` +
-			`"X-Pass":"FFFFFFFFFFFF",` +
-			`"X-HMAC":"GGGGGGGGGGGG",` +
-			`"X-Credential":"HHHHHHHHHHHH",` +
-			`"Accept":"application/json",` +
-			`"User-Agent":"webhooker/1.0"}}`,
+		URL:  "https://example.com/in",
+		Headers: map[string]string{
+			headerAuthorization: "Bearer AAAAAAAAAAAA",
+			"Cookie":            "session=BBBBBBBBBBBB",
+			probeHeaderName:     "CCCCCCCCCCCC",
+			"X-Hub-Signature":   "sha256=DDDDDDDDDDDD",
+			"X-Sig":             "EEEEEEEEEEEE",
+			"X-Pass":            "FFFFFFFFFFFF",
+			"X-HMAC":            "GGGGGGGGGGGG",
+			"X-Credential":      "HHHHHHHHHHHH",
+			"Accept":            "application/json",
+			headerUserAgent:     "webhooker/1.0",
+		},
+		MaxAttempts: 1,
 	})
 
 	for _, secret := range []string{
@@ -133,9 +137,10 @@ func TestRedactor_IgnoresVeryShortHeaderValues(t *testing.T) {
 	t.Parallel()
 
 	r := delivery.NewRedactor(&database.Target{
-		Type: database.TargetTypeHTTP,
-		Config: `{"url":"https://example.com/in",` +
-			`"headers":{"X-Api-Key":"ab"}}`,
+		Type:        database.TargetTypeHTTP,
+		URL:         "https://example.com/in",
+		Headers:     map[string]string{probeHeaderName: "ab"},
+		MaxAttempts: 1,
 	})
 
 	const response = "rabbit"
@@ -150,8 +155,9 @@ func TestRedactor_RemovesBarePath(t *testing.T) {
 	t.Parallel()
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeSlack,
-		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+		Type:        database.TargetTypeSlack,
+		URL:         redactWebhookURL,
+		MaxAttempts: 1,
 	})
 
 	got := r.Redact("POST " + redactSecretPath + " 404")
@@ -183,8 +189,9 @@ func TestRedactor_RemovesHTTPURLQueryAndUserinfo(t *testing.T) {
 	raw := dest.String()
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeHTTP,
-		Config: `{"url":"` + raw + `"}`,
+		Type:        database.TargetTypeHTTP,
+		URL:         raw,
+		MaxAttempts: 1,
 	})
 
 	for _, echoed := range []string{
@@ -202,6 +209,49 @@ func TestRedactor_RemovesHTTPURLQueryAndUserinfo(t *testing.T) {
 	}
 }
 
+// TestRedactor_RemovesEchoedQueryOfURLWithoutPath covers an
+// HTTP target URL whose credential is all in its query string.
+// Written with or without the "/", the request line sends it
+// as "/?token=…", and a target passing the event's query string
+// on sends that after an "&". The event's part stays visible:
+// the event's page shows it anyway.
+func TestRedactor_RemovesEchoedQueryOfURLWithoutPath(t *testing.T) {
+	t.Parallel()
+
+	const secret = "s3cr3t"
+
+	marker := delivery.RedactionMarker
+
+	// An echoed request line, and what the event log shows of it.
+	echoes := map[string]string{
+		"POST /?token=" + secret + " HTTP/1.1": "POST " + marker +
+			" HTTP/1.1",
+		"POST ?token=" + secret + " HTTP/1.1": "POST ?" + marker +
+			" HTTP/1.1",
+		"POST /?token=" + secret + "&a=1&b=2 HTTP/1.1": "POST " +
+			marker + "&a=1&b=2 HTTP/1.1",
+		"POST ?token=" + secret + "&a=1&b=2 HTTP/1.1": "POST ?" +
+			marker + "&a=1&b=2 HTTP/1.1",
+	}
+
+	for _, dest := range []string{
+		"https://example.com/?token=" + secret,
+		"https://example.com?token=" + secret,
+	} {
+		r := delivery.NewRedactor(&database.Target{
+			Type:        database.TargetTypeHTTP,
+			URL:         dest,
+			MaxAttempts: 1,
+		})
+
+		for echoed, want := range echoes {
+			assert.Equal(
+				t, want, r.Redact(echoed), "%s: %s", dest, echoed,
+			)
+		}
+	}
+}
+
 // TestRedactor_LeavesUnrelatedTextAlone pins that the
 // redactor matches literally: it does not guess at what a
 // secret looks like, so ordinary response content survives.
@@ -211,8 +261,9 @@ func TestRedactor_LeavesUnrelatedTextAlone(t *testing.T) {
 	const response = "ok=false error=channel_not_found"
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeSlack,
-		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+		Type:        database.TargetTypeSlack,
+		URL:         redactWebhookURL,
+		MaxAttempts: 1,
 	})
 
 	assert.Equal(t, response, r.Redact(response))
@@ -237,8 +288,9 @@ func TestRedactor_EmptyUserinfoDoesNotShredTheBody(t *testing.T) {
 	require.Empty(t, parsed.User.String())
 
 	r := delivery.NewRedactor(&database.Target{
-		Type:   database.TargetTypeHTTP,
-		Config: `{"url":"` + dest + `"}`,
+		Type:        database.TargetTypeHTTP,
+		URL:         dest,
+		MaxAttempts: 1,
 	})
 
 	const body = "ok=false error=channel_not_found"
@@ -255,11 +307,10 @@ func TestRedactor_EmptyUserinfoDoesNotShredTheBody(t *testing.T) {
 	)
 }
 
-// TestRedactor_ZeroValueAndConfiglessTargets pins that a
-// caller with no target, an unparseable config, or a target
-// type with no destination URL gets a redactor that changes
-// nothing rather than one that panics.
-func TestRedactor_ZeroValueAndConfiglessTargets(t *testing.T) {
+// TestRedactor_ZeroValueAndURLlessTargets pins that a caller
+// with no target, or a target with no destination URL, gets a
+// redactor that changes nothing rather than one that panics.
+func TestRedactor_ZeroValueAndURLlessTargets(t *testing.T) {
 	t.Parallel()
 
 	const text = "some response body"
@@ -272,8 +323,8 @@ func TestRedactor_ZeroValueAndConfiglessTargets(t *testing.T) {
 	for _, tgt := range []database.Target{
 		{Type: database.TargetTypeLog},
 		{Type: database.TargetTypeDatabase},
-		{Type: database.TargetTypeSlack, Config: "not json"},
-		{Type: database.TargetTypeHTTP, Config: ""},
+		{Type: database.TargetTypeSlack, MaxAttempts: 1},
+		{Type: database.TargetTypeHTTP, MaxAttempts: 1},
 	} {
 		assert.Equal(
 			t, text,