Merge branch 'main' into issue-65-password-change

internal/handlers/auth.go

@@ -19,7 +19,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 
 		// Render login page
 		data := map[string]any{
-			"Error": "",
+			tmplKeyError: "",
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -86,7 +86,7 @@ func (h *Handlers) renderLoginError(
 	status int,
 ) {
 	data := map[string]any{
-		"Error": msg,
+		tmplKeyError: msg,
 	}
 
 	w.WriteHeader(status)

internal/handlers/export_test.go

@@ -13,14 +13,18 @@ func (s *Handlers) RenderTemplateForTest(
 	s.renderTemplate(w, r, pageTemplate, data)
 }
 
-// BuildSlackTargetConfigForTest exposes buildSlackTargetConfig
-// for use in the handlers_test package.
+// BuildSlackTargetConfigForTest exposes buildURLTargetConfig
+// with the Slack target parameters for use in the
+// handlers_test package.
 func (s *Handlers) BuildSlackTargetConfigForTest(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetURL string,
 ) (string, error) {
-	return s.buildSlackTargetConfig(w, r, targetURL)
+	return s.buildURLTargetConfig(
+		w, r, targetURL, "webhookUrl",
+		"Webhook URL is required for Slack targets",
+	)
 }
 
 // BuildDatabaseTargetConfigForTest exposes

internal/handlers/handlers.go

@@ -30,6 +30,11 @@ const (
 	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
+
+	// tmplKeyError is the template data key for an error message.
+	tmplKeyError = "Error"
+	// tmplKeyWebhook is the template data key for a webhook.
+	tmplKeyWebhook = "Webhook"
 )
 
 // errInvalidPassword is returned when a password does not match.

internal/handlers/source_management.go

@@ -107,7 +107,7 @@ func (h *Handlers) buildWebhookListItems(
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		data := map[string]any{
-			"Error": "",
+			tmplKeyError: "",
 		}
 
 		h.renderTemplate(w, r, "sources_new.html", data)
@@ -146,7 +146,7 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 
 		if name == "" {
 			data := map[string]any{
-				"Error": "Name is required",
+				tmplKeyError: "Name is required",
 			}
 
 			w.WriteHeader(http.StatusBadRequest)
@@ -316,11 +316,11 @@ func (h *Handlers) renderSourceDetail(
 	}
 
 	data := map[string]any{
-		"Webhook":     webhook,
-		"Entrypoints": entrypoints,
-		"Targets":     targets,
-		"Events":      events,
-		"BaseURL":     scheme + "://" + host,
+		tmplKeyWebhook: webhook,
+		"Entrypoints":  entrypoints,
+		"Targets":      targets,
+		"Events":       events,
+		"BaseURL":      scheme + "://" + host,
 	}
 
 	h.renderTemplate(w, r, "source_detail.html", data)
@@ -352,8 +352,8 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook": webhook,
-			"Error":   "",
+			tmplKeyWebhook: webhook,
+			tmplKeyError:   "",
 		}
 
 		h.renderTemplate(w, r, "source_edit.html", data)
@@ -416,8 +416,8 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			"Webhook": *webhook,
-			"Error":   "Name is required",
+			tmplKeyWebhook: *webhook,
+			tmplKeyError:   "Name is required",
 		}
 
 		w.WriteHeader(http.StatusBadRequest)
@@ -590,15 +590,15 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook":     webhook,
-			"Events":      evts,
-			"Page":        page,
-			"TotalPages":  totalPages,
-			"TotalEvents": total,
-			"HasPrev":     page > 1,
-			"HasNext":     page < totalPages,
-			"PrevPage":    page - 1,
-			"NextPage":    page + 1,
+			tmplKeyWebhook: webhook,
+			"Events":       evts,
+			"Page":         page,
+			"TotalPages":   totalPages,
+			"TotalEvents":  total,
+			"HasPrev":      page > 1,
+			"HasNext":      page < totalPages,
+			"PrevPage":     page - 1,
+			"NextPage":     page + 1,
 		}
 
 		h.renderTemplate(w, r, "source_logs.html", data)
@@ -904,9 +904,15 @@ func (h *Handlers) buildTargetConfig(
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
-		return h.buildHTTPTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
+			w, r, targetURL, "url",
+			"URL is required for HTTP targets",
+		)
 	case database.TargetTypeSlack:
-		return h.buildSlackTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
+			w, r, targetURL, "webhookUrl",
+			"Webhook URL is required for Slack targets",
+		)
 	case database.TargetTypeDatabase:
 		return h.buildDatabaseTargetConfig(w, expiry)
 	case database.TargetTypeLog:
@@ -921,16 +927,18 @@ func (h *Handlers) buildTargetConfig(
 	}
 }
 
-// buildHTTPTargetConfig builds config JSON for an HTTP target.
-func (h *Handlers) buildHTTPTargetConfig(
+// buildURLTargetConfig builds config JSON for a target whose
+// configuration is a single SSRF-validated URL stored under
+// configKey. missingMsg is the error shown when no URL is given.
+func (h *Handlers) buildURLTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
-	targetURL string,
+	targetURL, configKey, missingMsg string,
 ) (string, error) {
 	if targetURL == "" {
 		http.Error(
 			w,
-			"URL is required for HTTP targets",
+			missingMsg,
 			http.StatusBadRequest,
 		)
 
@@ -955,56 +963,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 		return "", err
 	}
 
-	cfg := map[string]any{"url": targetURL}
-
-	configBytes, err := json.Marshal(cfg)
-	if err != nil {
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
-
-		return "", err
-	}
-
-	return string(configBytes), nil
-}
-
-// buildSlackTargetConfig builds config JSON for a Slack target.
-func (h *Handlers) buildSlackTargetConfig(
-	w http.ResponseWriter,
-	r *http.Request,
-	targetURL string,
-) (string, error) {
-	if targetURL == "" {
-		http.Error(
-			w,
-			"Webhook URL is required for Slack targets",
-			http.StatusBadRequest,
-		)
-
-		return "", errMissingURL
-	}
-
-	err := delivery.ValidateTargetURL(
-		r.Context(), targetURL,
-	)
-	if err != nil {
-		h.log.Warn(
-			"target URL blocked by SSRF protection",
-			"url", targetURL,
-			"error", err,
-		)
-		http.Error(
-			w,
-			"Invalid target URL: "+err.Error(),
-			http.StatusBadRequest,
-		)
-
-		return "", err
-	}
-
-	cfg := map[string]any{"webhookUrl": targetURL}
+	cfg := map[string]any{configKey: targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {