Store a target's settings as columns (closes #543)

A target's settings move from the per-type JSON string in
targets.config to columns: url, headers, timeout_seconds,
forward_query, archive_expiry and archive_rotation. A column a type
does not use stays empty. headers holds the header map as JSON text
through GORM's JSON serializer, and archive_expiry holds a
time.Duration, 0 meaning never, so nothing that reads a target parses
it. The forms check each setting once, with the same refusals and
messages, and the edit form is filled from the columns, so the
per-type config structs, their parsers and the "could not be read"
branches are gone. A delivery task carries the six settings in place
of the JSON string.

Model: opus-5-5

internal/handlers/target_edit.go

@@ -25,22 +25,15 @@ const (
 	tmplKeyMaxTimeout = "MaxTimeout"
 )
 
-// configUnreadableMessage is shown when a target's stored
-// configuration does not parse. It says plainly that saving replaces
-// the stored value rather than preserving it, because the form
-// cannot pre-fill what it could not read.
-const configUnreadableMessage = "The stored configuration for this " +
-	"target could not be read. Enter the values below; saving " +
-	"replaces the stored configuration."
-
 // targetEditView is the display model for the target edit page: the
 // target's row fields as stored. The values the form shows, the
-// UNMASKED configuration among them, come separately, as a
+// UNMASKED URL and headers among them, come separately, as a
 // targetFormInput.
 //
-// It deliberately omits database.Target's raw Config blob: the form
-// renders named fields, and giving the template the blob as well
-// would put an unreviewed second path to the credential on the page.
+// It deliberately omits database.Target's settings: the form renders
+// them from the targetFormInput, and giving the template the target's
+// URL and headers as well would put an unreviewed second path to the
+// credential on the page.
 type targetEditView struct {
 	ID     string
 	Name   string
@@ -48,13 +41,16 @@ type targetEditView struct {
 	Active bool
 }
 
-// HandleTargetEdit shows the form to edit a target.
+// HandleTargetEdit shows the form to edit a target, filled with the
+// target's settings as stored.
 //
 // This page is the one place the full destination URL and header
-// values are shown. It is reachable only through the
-// /hook/{sourceID} route group, which supplies RequireAuth and
-// NoCache, and only for a target of a webhook the session's user
-// owns; masking (delivery.TargetView) is unchanged everywhere else.
+// values are shown: an operator cannot correct a value they cannot
+// see. It is reachable only through the /hook/{sourceID} route
+// group, which supplies RequireAuth and NoCache, and only for a
+// target of a webhook the session's user owns; masking
+// (delivery.TargetView) is unchanged everywhere else. Do not fill a
+// form like this one on any other page.
 func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		webhook, target, ok := h.ownedTarget(w, r)
@@ -62,34 +58,19 @@ func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 			return
 		}
 
-		cfg, err := delivery.NewTargetConfigForm(target)
-		msg := ""
-
-		if err != nil {
-			// The error carries the parse failure, never the
-			// blob, so it is safe to log against the target id.
-			h.log.Warn(
-				"stored target config could not be read for editing",
-				"target_id", target.ID,
-				"error", err,
-			)
-
-			msg = configUnreadableMessage
-		}
-
 		form := targetFormInput{
 			Name:         target.Name,
-			URL:          cfg.URL,
-			Headers:      cfg.Headers,
-			Timeout:      cfg.Timeout,
-			ForwardQuery: cfg.ForwardQuery,
+			URL:          target.URL,
+			Headers:      delivery.FormatTargetHeaders(target.Headers),
+			Timeout:      delivery.FormatTargetTimeout(target.TimeoutSeconds),
+			ForwardQuery: target.ForwardQuery,
 			MaxAttempts:  strconv.Itoa(target.MaxAttempts),
-			Expiry:       cfg.Expiry,
-			Rotation:     cfg.Rotation,
+			Expiry:       formatArchiveExpiry(target.ArchiveExpiry),
+			Rotation:     target.ArchiveRotation,
 		}
 
 		h.renderTargetEdit(
-			w, r, webhook, target, form, msg, http.StatusOK,
+			w, r, webhook, target, form, "", http.StatusOK,
 		)
 	}
 }
@@ -125,11 +106,11 @@ func (h *Handlers) HandleTargetEditSubmit() http.HandlerFunc {
 // does, so an edited destination is SSRF-validated exactly as a new
 // one is.
 //
-// The target's type is not editable. Each type stores a different
-// configuration shape and its delivery history is recorded against
-// the target row, so changing the type of an existing target is
-// really the creation of a different one. The stored type decides
-// which fields the form offers and which builder runs.
+// The target's type is not editable. Each type uses different
+// settings and its delivery history is recorded against the target
+// row, so changing the type of an existing target is really the
+// creation of a different one. The stored type decides which fields
+// the form offers and which settings are set.
 func (h *Handlers) applyTargetEdit(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -142,13 +123,7 @@ func (h *Handlers) applyTargetEdit(
 	// as stored, for the page shown again when the save is refused.
 	edited := *target
 
-	errMsg, err := h.setTargetFromForm(r.Context(), &edited, in)
-	if err != nil {
-		h.serverError(w, r, "failed to encode target config", err)
-
-		return
-	}
-
+	errMsg := h.setTargetFromForm(r.Context(), &edited, in)
 	if errMsg != "" {
 		h.renderTargetEdit(
 			w, r, webhook, target, in, errMsg, http.StatusBadRequest,
@@ -160,7 +135,7 @@ func (h *Handlers) applyTargetEdit(
 	// A new name renames the archive file before it is saved (see
 	// archive.Writers.Rename). If either step fails, it goes back to
 	// the name that is still stored.
-	err = h.renameTargetArchive(
+	err := h.renameTargetArchive(
 		target, webhook.Name, target.Name, edited.Name,
 	)
 	if err == nil {