Add a Download button that exports a database target's archive as gzipped JSON (closes #374)

Each database target on the webhook page has a Download button that streams its archive as gzipped JSON, archive-WEBHOOKNAME-TARGETNAME-TIME.json.gz, with names made safe by delivery.ArchiveFileName's function. The export reads one consistent snapshot through one cursor in a read-only transaction, so archive writes carry on, and holds the rename lock only while it reads the stored names and opens the file. It extends its write deadline as it writes, so a large archive downloads for as long as the client reads; a failure after the response has started aborts the connection so the browser marks the download failed. The request limit is now the service's own middleware, which no longer writes a 504 over a response already started.

Model: opus-5-5

internal/middleware/timeout.go

@@ -0,0 +1,71 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"time"
+)
+
+// Timeout returns middleware that gives each request limit to finish:
+// it cancels the request's context once limit has passed, and answers
+// 504 when the handler then returns without having started its
+// response.
+//
+// It replaces chi's middleware.Timeout, which writes that 504 even
+// after the handler has sent its own status. A download that outlasts
+// the limit has already sent its 200 and the whole file, so the late
+// 504 changes nothing for the client: the access log and the metrics
+// would record it in place of the 200, and net/http would complain of
+// a superfluous WriteHeader.
+func (s *Middleware) Timeout(
+	limit time.Duration,
+) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			ctx, cancel := context.WithTimeout(r.Context(), limit)
+			defer cancel()
+
+			tw := &timeoutResponseWriter{ResponseWriter: w}
+
+			next.ServeHTTP(tw, r.WithContext(ctx))
+
+			if !tw.started &&
+				errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				w.WriteHeader(http.StatusGatewayTimeout)
+			}
+		})
+	}
+}
+
+// timeoutResponseWriter records whether the handler has started its
+// response.
+type timeoutResponseWriter struct {
+	http.ResponseWriter
+
+	started bool
+}
+
+func (w *timeoutResponseWriter) WriteHeader(code int) {
+	w.started = true
+
+	w.ResponseWriter.WriteHeader(code)
+}
+
+func (w *timeoutResponseWriter) Write(b []byte) (int, error) {
+	// A Write without a WriteHeader starts the response too: net/http
+	// sends 200 in front of it.
+	w.started = true
+
+	//nolint:wrapcheck // Pass the writer's own error through unchanged.
+	return w.ResponseWriter.Write(b)
+}
+
+// Unwrap lets http.ResponseController reach the writer underneath, so
+// a handler can still set a write deadline through this wrapper.
+func (w *timeoutResponseWriter) Unwrap() http.ResponseWriter {
+	return w.ResponseWriter
+}

internal/middleware/timeout_test.go

@@ -0,0 +1,56 @@
+package middleware_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestTimeout proves the request limit answers 504 to a handler that
+// outlasts it without starting its response, and leaves a response the
+// handler has started with the status it sent. Both are what the
+// access log records.
+func TestTimeout(t *testing.T) {
+	t.Parallel()
+
+	const limit = 10 * time.Millisecond
+
+	for _, tc := range []struct {
+		name string
+		sent int // the status the handler sends, or 0 for none
+		want int
+	}{
+		{name: "not started", sent: 0, want: http.StatusGatewayTimeout},
+		{name: "started", sent: http.StatusOK, want: http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			m, buf := capturingMiddleware(t)
+			handler := m.Logging()(m.Timeout(limit)(http.HandlerFunc(
+				func(w http.ResponseWriter, r *http.Request) {
+					if tc.sent != 0 {
+						w.WriteHeader(tc.sent)
+					}
+
+					<-r.Context().Done()
+				},
+			)))
+
+			w := httptest.NewRecorder()
+			handler.ServeHTTP(w, httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, "/", nil,
+			))
+
+			assert.Equal(t, tc.want, w.Code)
+
+			entries := accessLogEntries(t, buf)
+			require.Len(t, entries, 1)
+			assert.EqualValues(t, tc.want, entries[0]["status"])
+		})
+	}
+}