Read form fields from the POST body only (closes #160)

r.FormValue falls back to the query string, so
POST /source/{id}/targets?url=<secret> created a working target from a
value carried on the request line — where proxy logs, browser history
and Referer all record it. Every form read is now r.PostFormValue,
including the login password and both password-change fields, which had
the same defect in a more acute form.

The Sentry leg needed more than the query string. sentryhttp attaches
the whole request to the scope, and ApplyToEvent copies the teed body
into Request.Data with no SendDefaultPII guard — so reading every field
from the body only pointed every credential this change protects at the
one field the first revision did not scrub. Body and query are now
redacted, Cookies and Env cleared, and Headers reduced to an allowlist,
because the SDK's own filter removes four names and would otherwise ship
X-Csrf-Token and the shared secrets senders put on the receiver route.

Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value —
TargetView is the masking barrier for the HTML path only, and the first
handler to marshal a model would serialise a bearer token or the session
encryption key.

Independently reviewed three times. The second review found the Data
leak and proved it with a scratch module; the third disproved the
PR's own claim that BeforeSend gets no request, so the README now
records that redacting unconditionally is a deliberate choice rather
than a limitation — which is what makes #179 cheap to fix.

internal/database/model_apikey.go

@@ -2,12 +2,16 @@ package database
 
 import "time"
 
-// APIKey represents an API key for a user
+// APIKey represents an API key for a user.
+//
+// Key is a bearer credential, so it is never marshalled with the
+// model. A creation handler that has to show it once returns it in its
+// own response type.
 type APIKey struct {
 	BaseModel
 
 	UserID      string     `gorm:"type:uuid;not null"   json:"userId"`
-	Key         string     `gorm:"uniqueIndex;not null" json:"key"`
+	Key         string     `gorm:"uniqueIndex;not null" json:"-"`
 	Description string     `json:"description"`
 	LastUsedAt  *time.Time `json:"lastUsedAt,omitempty"`
 

internal/database/model_secrets_test.go

@@ -0,0 +1,107 @@
+package database_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// keptField is a non-secret value planted alongside each secret, so
+// the assertions below cannot pass by the model marshalling to nothing.
+const keptField = "keepme"
+
+// marshalModel encodes a model the way a future JSON handler would.
+func marshalModel(t *testing.T, v any) string {
+	t.Helper()
+
+	encoded, err := json.Marshal(v)
+	require.NoError(t, err)
+
+	return string(encoded)
+}
+
+// TestModelsDoNotMarshalTheirSecrets pins the barrier for the JSON
+// path. The /api/v1 route group exists and is empty; delivery's
+// TargetView masks the credential for the HTML path only, so without
+// these tags the first handler that marshals a model serialises the
+// secret with it. Each field below is a live credential:
+//
+//   - Target.Config holds an incoming-webhook URL whose path segments
+//     are the bearer token.
+//   - APIKey.Key is a bearer token outright.
+//   - Setting.Value holds the session encryption key.
+//   - User.Password holds the Argon2 hash, and was already tagged.
+func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
+	t.Parallel()
+
+	const marker = "QQMODELMARKERQQ"
+
+	cases := []struct {
+		name  string
+		model any
+	}{
+		{
+			name: "target config",
+			model: database.Target{
+				Name:   keptField,
+				Type:   database.TargetTypeSlack,
+				Config: `{"webhookUrl":"https://h/s/` + marker + `"}`,
+			},
+		},
+		{
+			name: "api key",
+			model: database.APIKey{
+				Description: keptField,
+				Key:         marker,
+			},
+		},
+		{
+			name: "setting value",
+			model: database.Setting{
+				Key:   keptField,
+				Value: marker,
+			},
+		},
+		{
+			name: "user password hash",
+			model: database.User{
+				Username: keptField,
+				Password: marker,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			encoded := marshalModel(t, tc.model)
+
+			assert.NotContains(t, encoded, marker)
+			assert.Contains(t, encoded, keptField)
+		})
+	}
+}
+
+// TestWebhookMarshalsNoTargetConfig covers the nested case: a webhook
+// marshalled with its targets preloaded must not carry the credential
+// through the association either.
+func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
+	t.Parallel()
+
+	const marker = "QQNESTEDMARKERQQ"
+
+	encoded := marshalModel(t, database.Webhook{
+		Name: keptField,
+		Targets: []database.Target{{
+			Name:   "slack",
+			Config: `{"webhookUrl":"https://h/s/` + marker + `"}`,
+		}},
+	})
+
+	assert.NotContains(t, encoded, marker)
+	assert.Contains(t, encoded, keptField)
+}

internal/database/model_setting.go

@@ -3,6 +3,9 @@ package database
 // Setting stores application-level key-value configuration.
 // Used for auto-generated values like the session encryption key.
 type Setting struct {
-	Key   string `gorm:"primaryKey"         json:"key"`
-	Value string `gorm:"type:text;not null" json:"value"`
+	Key string `gorm:"primaryKey" json:"key"`
+
+	// Value holds the session encryption key, so it is never
+	// marshalled with the model.
+	Value string `gorm:"type:text;not null" json:"-"`
 }

internal/database/model_target.go

@@ -20,8 +20,14 @@ type Target struct {
 	Type      TargetType `gorm:"not null"           json:"type"`
 	Active    bool       `gorm:"default:true"       json:"active"`
 
-	// Configuration fields (JSON stored based on type)
-	Config string `gorm:"type:text" json:"config"` // JSON configuration
+	// Configuration fields (JSON stored based on type).
+	//
+	// json:"-" because the blob holds the target's credential — a
+	// Slack incoming-webhook URL, or an http destination whose path
+	// segments are the secret. delivery.TargetView is the masking
+	// barrier for the HTML path; this tag is the barrier for any
+	// handler that marshals the model itself.
+	Config string `gorm:"type:text" json:"-"` // JSON configuration
 
 	// For HTTP targets (max_retries=0 means fire-and-forget,
 	// >0 enables retries with backoff)