Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/handlers/source_management_test.go

@@ -2,16 +2,20 @@ package handlers_test
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
@@ -105,7 +109,7 @@ func submitCreate(
 		form.Set("retention_days", *retention)
 	}
 
-	req := formRequest("/sources/new", cookies, form, nil)
+	req := formRequest("/hooks/new", cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -133,8 +137,7 @@ func onlyWebhook(
 }
 
 // seedWebhookWithRetention inserts a webhook owned by the test user
-// with an exact stored retention value, bypassing Webhook.BeforeSave
-// via a column-level update so that legacy rows can be planted too.
+// with the given retention.
 func seedWebhookWithRetention(
 	t *testing.T,
 	db *database.Database,
@@ -151,13 +154,6 @@ func seedWebhookWithRetention(
 		t,
 		db.DB().Omit(clause.Associations).Create(wh).Error,
 	)
-	require.NoError(
-		t,
-		db.DB().Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	wh.RetentionDays = retentionDays
 
 	return *wh
 }
@@ -187,6 +183,8 @@ func storedRetentionDays(
 type sourceTestEnv struct {
 	handlers *handlers.Handlers
 	db       *database.Database
+	dbMgr    *database.WebhookDBManager
+	archives *recordingArchives
 	cookies  []*http.Cookie
 }
 
@@ -199,7 +197,11 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 
 	var db *database.Database
 
-	app := newTestApp(t, &h, &sess, &db)
+	var dbMgr *database.WebhookDBManager
+
+	var archives *recordingArchives
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &archives)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -207,16 +209,17 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 	return &sourceTestEnv{
 		handlers: h,
 		db:       db,
+		dbMgr:    dbMgr,
+		archives: archives,
 		cookies: authenticatedCookies(
 			t, sess, sourceTestUserID, "sourceuser",
 		),
 	}
 }
 
-// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
-// regression test for the bug: the create form's 0 must reach the
-// database as the retain-forever sentinel rather than being replaced by
-// the column's default of 30.
+// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever checks
+// that the create form's 0 reaches the database as 0, which means
+// retain forever.
 func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
 	t *testing.T,
 ) {
@@ -229,35 +232,60 @@ func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 
 	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 	assert.True(t, wh.RetainsForever())
 }
 
-func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
+func TestHandleSourceCreateSubmit_DayCountIsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	days := "45"
+
+	w := submitCreate(t, env.handlers, env.cookies, "finite", &days)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	wh := onlyWebhook(t, env.db)
+	assert.Equal(t, 45, storedRetentionDays(t, env.db, wh.ID))
+}
+
+// TestHandleSourceCreateSubmit_BlankRetentionUsesDefault covers a
+// retention field left empty and one missing from the form: both
+// give the default, not forever.
+func TestHandleSourceCreateSubmit_BlankRetentionUsesDefault(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	env := setupSourceTest(t)
+	blank := ""
 
-	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
-	require.Equal(t, http.StatusSeeOther, w.Code)
+	for name, retention := range map[string]*string{
+		"blank":   &blank,
+		"omitted": nil,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
 
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+			env := setupSourceTest(t)
+
+			w := submitCreate(
+				t, env.handlers, env.cookies, "defaulted", retention,
+			)
+			require.Equal(t, http.StatusSeeOther, w.Code)
+
+			wh := onlyWebhook(t, env.db)
+			assert.Equal(
+				t,
+				database.DefaultRetentionDays,
+				storedRetentionDays(t, env.db, wh.ID),
+			)
+		})
+	}
 }
 
-// TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
-// form's pre-filled retention from becoming a third hardcoded copy of
-// the 30-day policy.
+// TestHandleSourceCreate_PrefillsDefaultFromConstant checks that the
+// create form pre-fills its retention from database.DefaultRetentionDays
+// rather than from a hardcoded 30.
 func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 	t.Parallel()
 
@@ -265,7 +293,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/sources/new", env.cookies, nil),
+		w, getRequest(t, "/hooks/new", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, w.Code)
@@ -278,7 +306,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 	)
 	assert.NotContains(
 		t, body, `max="365"`,
-		"a max below the sentinel would block retain-forever",
+		"a max of 365 would block any longer retention",
 	)
 	assert.Contains(t, body, `min="0"`)
 }
@@ -356,35 +384,12 @@ func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
 	)
 }
 
-// TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
-// boundary between "too large to represent" and "retain forever": the
-// sentinel is above MaxFiniteRetentionDays, but it is the value the
-// edit form pre-fills, so it must be accepted rather than rejected as
-// out of range.
-func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-
-	w := submitCreate(t, env.handlers, env.cookies, "forever", &sentinel)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
 // TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
 // validation failure hands the user's typing back, matching what the
 // edit form already does. Losing a long description to a mistyped
 // retention value is the kind of thing that makes people give up on a
-// form.
+// form. Both values carry HTML-special characters, which must come
+// back escaped rather than as markup.
 func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	t *testing.T,
 ) {
@@ -393,8 +398,8 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	env := setupSourceTest(t)
 
 	const (
-		name        = "kept-name"
-		description = "a description worth not losing"
+		name        = `kept"><b>name`
+		description = `a </textarea> worth not losing`
 	)
 
 	form := url.Values{}
@@ -402,7 +407,7 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	form.Set("description", description)
 	form.Set("retention_days", "nonsense")
 
-	req := formRequest("/sources/new", env.cookies, form, nil)
+	req := formRequest("/hooks/new", env.cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -411,8 +416,10 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 
 	body := w.Body.String()
 
-	assert.Contains(t, body, `value="`+name+`"`)
-	assert.Contains(t, body, description)
+	assert.Contains(t, body, `value="kept&#34;&gt;&lt;b&gt;name"`)
+	assert.Contains(t, body, `a &lt;/textarea&gt; worth not losing`)
+	assert.NotContains(t, body, name)
+	assert.NotContains(t, body, description)
 }
 
 // submitEdit posts the webhook edit form for the given webhook.
@@ -430,7 +437,7 @@ func submitEdit(
 	form.Set("retention_days", retention)
 
 	req := formRequest(
-		"/source/"+wh.ID+"/edit",
+		"/hook/"+wh.ID+"/edit",
 		env.cookies,
 		form,
 		map[string]string{sourceIDParam: wh.ID},
@@ -455,11 +462,7 @@ func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
 	w := submitEdit(t, env, wh, "0")
 	require.Equal(t, http.StatusSeeOther, w.Code)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 }
 
 func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
@@ -484,6 +487,51 @@ func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
 	)
 }
 
+// TestHandleSourceEditSubmit_RefusedFormComesBack refuses an edit for
+// each reason the form can give and checks that the form comes back
+// with the reason and the name, description and retention submitted,
+// that the page still reports the stored retention, and that nothing
+// is saved.
+func TestHandleSourceEditSubmit_RefusedFormComesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	refused := func(name, retention, reason string) {
+		t.Helper()
+
+		wh := seedWebhookWithRetention(t, env.db, 30)
+
+		submitted := wh
+		submitted.Name = name
+		submitted.Description = "a description worth keeping"
+
+		w := submitEdit(t, env, submitted, retention)
+		assert.Equal(t, http.StatusBadRequest, w.Code)
+
+		page := w.Body.String()
+		assert.Contains(t, page, `class="alert-error">`+reason)
+		assert.Contains(t, page, `name="name" value="`+name+`"`)
+		assert.Contains(t, page, ">a description worth keeping</textarea>")
+		assert.Contains(
+			t, page, `name="retention_days" value="`+retention+`"`,
+		)
+		assert.Contains(t, page, "Currently 30 days.")
+
+		var stored database.Webhook
+
+		require.NoError(
+			t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+		)
+		assert.Equal(t, wh.Name, stored.Name)
+		assert.Empty(t, stored.Description)
+		assert.Equal(t, 30, stored.RetentionDays)
+	}
+
+	refused("", "45", "Name is required")
+	refused("kept-name", "nonsense", "Retention must be")
+}
+
 func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	t *testing.T,
 ) {
@@ -498,21 +546,317 @@ func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
 }
 
-// TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
-// the removed max="365" cap used to break: render the edit form for a
-// retain-forever webhook, confirm the pre-filled sentinel is not capped
-// by browser validation, then submit that pre-filled value straight
-// back and confirm the retention policy survives untouched.
+// renamedWebhookName is the name the rename tests give a webhook.
+const renamedWebhookName = "Renamed"
+
+// TestHandleSourceEditSubmit_RenamesArchives proves that a save
+// that keeps the webhook's name renames nothing, and that renaming a
+// webhook renames the archive of each of its database targets and
+// asks nothing of its other targets.
+func TestHandleSourceEditSubmit_RenamesArchives(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	second := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	seedTarget(t, env.db, wh.ID, database.TargetTypeLog)
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Empty(t, env.archives.Renames())
+
+	wh.Name = renamedWebhookName
+
+	w = submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	assert.ElementsMatch(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{second.ID, renamedWebhookName, second.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedRenameKeepsTheName proves that a
+// webhook whose archive cannot be renamed keeps its stored name, so
+// the name on disk and the name in the UI do not part, and that the
+// handler puts back what it may already have moved.
+func TestHandleSourceEditSubmit_FailedRenameKeepsTheName(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(tgt.ID, errInjectedRename)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedSaveRenamesBack proves that when
+// the archive is renamed but the new name cannot be saved, the
+// archive is renamed back to the stored name and the stored name
+// stays.
+func TestHandleSourceEditSubmit_FailedSaveRenamesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	failSaveOnTable(t, env.db, "webhooks")
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// errInjectedRead is the failure a test makes reads of the main
+// database report.
+var errInjectedRead = errors.New("injected read failure")
+
+// TestHandleSourceEditSubmit_FailedSaveRenamesBackWithoutReading
+// proves that when the save fails and every later read of the main
+// database fails too, each archive the rename moved is still renamed
+// back: the move back needs no second read of the webhook's targets.
+func TestHandleSourceEditSubmit_FailedSaveRenamesBackWithoutReading(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	second := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	var saveFailed atomic.Bool
+
+	require.NoError(t, env.db.DB().Callback().Update().
+		Before("gorm:update").
+		Register("test:fail_save", func(tx *gorm.DB) {
+			saveFailed.Store(true)
+
+			_ = tx.AddError(errInjectedSave)
+		}),
+	)
+	require.NoError(t, env.db.DB().Callback().Query().
+		Before("gorm:query").
+		Register("test:fail_reads_after_save", func(tx *gorm.DB) {
+			if saveFailed.Load() {
+				_ = tx.AddError(errInjectedRead)
+			}
+		}),
+	)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{second.ID, renamedWebhookName, second.Name},
+			{first.ID, oldName, first.Name},
+			{second.ID, oldName, second.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_EditsDoNotInterleave proves that a second
+// webhook edit submitted while the first is inside its archive rename
+// does not run until the first is saved, so afterwards the stored
+// names are the ones the archive was last renamed to. The stand-in's
+// last rename is the name the file has on disk.
+func TestHandleSourceEditSubmit_EditsDoNotInterleave(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	entered, release := env.archives.BlockNextRename()
+
+	firstEdit, secondEdit := wh, wh
+	firstEdit.Name = "First"
+	secondEdit.Name = "Second"
+
+	firstCode := make(chan int, 1)
+
+	go func() { firstCode <- submitEdit(t, env, firstEdit, "").Code }()
+
+	<-entered
+
+	secondCode := make(chan int, 1)
+
+	go func() { secondCode <- submitEdit(t, env, secondEdit, "").Code }()
+
+	// Were the edits not ordered, the second would run to its end in
+	// this time, while the first is still inside its rename.
+	time.Sleep(200 * time.Millisecond)
+	release()
+
+	assert.Equal(t, http.StatusSeeOther, <-firstCode)
+	assert.Equal(t, http.StatusSeeOther, <-secondCode)
+
+	var (
+		storedWebhook database.Webhook
+		storedTarget  database.Target
+	)
+
+	require.NoError(
+		t, env.db.DB().First(&storedWebhook, "id = ?", wh.ID).Error,
+	)
+	require.NoError(
+		t, env.db.DB().First(&storedTarget, "id = ?", tgt.ID).Error,
+	)
+
+	renames := env.archives.Renames()
+	require.NotEmpty(t, renames)
+	assert.Equal(
+		t,
+		archiveRename{tgt.ID, storedWebhook.Name, storedTarget.Name},
+		renames[len(renames)-1],
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack proves
+// that when a webhook has three database targets and only the middle
+// one's archive cannot be renamed, the stored name stays and both
+// others are renamed back, the last one included: the move back does
+// not stop at the target it cannot rename. The handler reaches the
+// targets in the order they were created, which the exact sequence
+// below pins, so the refused target always comes before the last.
+func TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	middle := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	last := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(middle.ID, errNameTaken)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusConflict, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{middle.ID, renamedWebhookName, middle.Name},
+			{last.ID, renamedWebhookName, last.Name},
+			{first.ID, oldName, first.Name},
+			{middle.ID, oldName, middle.Name},
+			{last.ID, oldName, last.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_ArchiveNameTaken proves that when a file
+// already has an archive's new name, the edit is refused with an
+// error naming that file, and the webhook keeps its stored name.
+func TestHandleSourceEditSubmit_ArchiveNameTaken(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(tgt.ID, errNameTaken)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusConflict, w.Code)
+	assert.Contains(t, w.Body.String(), "archive-taken.db")
+	assert.Contains(
+		t, w.Body.String(), `name="name" value="`+renamedWebhookName+`"`,
+		"the form comes back with the name submitted",
+	)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+}
+
+// TestSourceEditForm_ForeverWebhookRoundTrips renders the edit form for
+// a retain-forever webhook, confirms it pre-fills 0, then submits that
+// pre-filled value straight back and confirms the retention policy
+// survives untouched.
 func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	t.Parallel()
 
 	env := setupSourceTest(t)
-	wh := seedWebhookWithRetention(
-		t, env.db, database.RetentionForeverDays,
-	)
+	wh := seedWebhookWithRetention(t, env.db, 0)
 
 	req := getRequest(
-		t, "/source/"+wh.ID+"/edit", env.cookies,
+		t, "/hook/"+wh.ID+"/edit", env.cookies,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
@@ -520,17 +864,12 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 
 	require.Equal(t, http.StatusOK, w.Code)
 
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
 	body := w.Body.String()
 
 	assert.Contains(
-		t, body, `value="`+sentinel+`"`,
+		t, body, `name="retention_days" value="0"`,
 		"the edit form pre-fills the stored retention",
 	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block saving any edit",
-	)
 	// "Currently forever." is the rendered RetentionLabel, not the
 	// static hint below the input, which says "Enter 0 to retain events
 	// forever." A bare Contains of "forever" would pass for any
@@ -541,49 +880,40 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	)
 
 	// Submit the pre-filled value back, exactly as a browser would.
-	post := submitEdit(t, env, wh, sentinel)
+	post := submitEdit(t, env, wh, "0")
 	require.Equal(t, http.StatusSeeOther, post.Code)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 }
 
-// TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
-// the retain-forever value is never rendered to the user as a raw day
-// count on either read-only view.
-func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
-	t *testing.T,
-) {
+// TestSourceListAndDetail_ShowForeverNotZeroDays checks that a
+// retention of 0 is shown as forever, never as a day count, on either
+// read-only view.
+func TestSourceListAndDetail_ShowForeverNotZeroDays(t *testing.T) {
 	t.Parallel()
 
 	env := setupSourceTest(t)
-	wh := seedWebhookWithRetention(
-		t, env.db, database.RetentionForeverDays,
-	)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
+	wh := seedWebhookWithRetention(t, env.db, 0)
 
 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/sources", env.cookies, nil),
+		listW, getRequest(t, "/hooks", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, listW.Code)
 	assert.Contains(t, listW.Body.String(), "Retention: forever")
-	assert.NotContains(t, listW.Body.String(), sentinel)
+	assert.NotContains(t, listW.Body.String(), "Retention: 0 days")
 
 	detailW := httptest.NewRecorder()
 	env.handlers.HandleSourceDetail().ServeHTTP(
 		detailW,
 		getRequest(
-			t, "/source/"+wh.ID, env.cookies,
+			t, "/hook/"+wh.ID, env.cookies,
 			map[string]string{sourceIDParam: wh.ID},
 		),
 	)
 
 	require.Equal(t, http.StatusOK, detailW.Code)
 	assert.Contains(t, detailW.Body.String(), "Retention: forever")
-	assert.NotContains(t, detailW.Body.String(), sentinel)
+	assert.NotContains(t, detailW.Body.String(), "Retention: 0 days")
 }