Read the expiry form value where the body is bounded (#43)

The pinned CI linter's gosec G120 flagged r.FormValue in
buildDatabaseTargetConfig because the MaxBytesReader guard lives
one function up in processTargetCreate, out of static-analysis
sight. Read the expiry alongside the other form values in
processTargetCreate and pass it down as a string, matching how
the http and slack config builders receive their URL.

internal/handlers/handlers_test.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -189,25 +187,6 @@ func TestRenderTemplate(t *testing.T) {
 	)
 }
 
-// databaseConfigRequest builds a POST request carrying the
-// given expiry as a form value, as the add-target form does.
-func databaseConfigRequest(expiry string) *http.Request {
-	form := url.Values{}
-	if expiry != "" {
-		form.Set("expiry", expiry)
-	}
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/",
-		strings.NewReader(form.Encode()),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	return req
-}
-
 func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
 	t.Parallel()
 
@@ -220,25 +199,19 @@ func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
 
 	// Empty expiry: the keep-forever default, empty config.
 	w := httptest.NewRecorder()
-	cfg, err := h.BuildDatabaseTargetConfigForTest(
-		w, databaseConfigRequest(""),
-	)
+	cfg, err := h.BuildDatabaseTargetConfigForTest(w, "")
 	require.NoError(t, err)
 	assert.Empty(t, cfg)
 
 	// Explicit never is stored as config.
 	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(
-		w, databaseConfigRequest("never"),
-	)
+	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "never")
 	require.NoError(t, err)
 	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
 
 	// A positive duration is stored as config.
 	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(
-		w, databaseConfigRequest("720h"),
-	)
+	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "720h")
 	require.NoError(t, err)
 	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
 }
@@ -257,9 +230,7 @@ func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
 
 	for _, bad := range []string{"nonsense", "7d", "-5h"} {
 		w := httptest.NewRecorder()
-		cfg, err := h.BuildDatabaseTargetConfigForTest(
-			w, databaseConfigRequest(bad),
-		)
+		cfg, err := h.BuildDatabaseTargetConfigForTest(w, bad)
 
 		require.Error(t, err, "expiry %q", bad)
 		assert.Empty(t, cfg)