Render delivery attempt detail in the event log (closes #202) (#219)

delivery_results stored status_code, response_body, error, duration and attempt_num, and no template rendered any of it, so a failure read as "target: failed" and diagnosing it meant opening the per-webhook SQLite file by hand. An expanded delivery now lists its attempts with attempt number, status code, duration, error and response body. The body is bounded in the query rather than read whole and truncated in Go (#135), and a body the engine itself cut is no longer presented as complete. The response body and error are untrusted remote content, so target credentials are removed before rendering. Two cases needed care: a secret severed by the 4096-byte cut matches nothing as a whole string, and the engine's io.LimitReader cuts at the same constant the renderer uses, so the guard keys on the body reaching the cap rather than on the stored size exceeding it. Empty secrets are filtered where the secret list is built, because an empty string passed to strings.ReplaceAll inserts the marker at every byte boundary. loadTargetMap builds the redactor half unscoped, so a soft-deleted target's historical deliveries still render redacted. Also regenerates static/css/tailwind.css, which had drifted from the templates: hover:text-red-700, text-red-500, underline and w-28 were in use but absent from the served stylesheet (#236).
2026-08-20 08:36:25 +02:00
parent 3b0ed826bc
commit f0512f1c3c
12 changed files with 1626 additions and 47 deletions
--- a/internal/delivery/target_redact_test.go
+++ b/internal/delivery/target_redact_test.go
@@ -0,0 +1,284 @@
+package delivery_test
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+// The secret path segments of a Slack incoming webhook URL.
+const (
+	redactSecretPath = "/services/T11111111/B11111111/" +
+		"YYYYYYYYYYYYYYYYYYYYYYYY"
+	redactWebhookURL = "https://hooks.slack.com" +
+		redactSecretPath
+)
+
+func TestRedactor_RemovesSlackWebhookURL(t *testing.T) {
+	t.Parallel()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeSlack,
+		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+	})
+
+	got := r.Redact("no_service for " + redactWebhookURL)
+
+	assert.NotContains(t, got, redactSecretPath)
+	assert.NotContains(t, got, "T11111111")
+
+	// One marker, not a marker with the host left in front of
+	// it: the whole URL is replaced before the path it
+	// contains, which is what sorting the secrets longest
+	// first buys.
+	assert.Equal(
+		t,
+		"no_service for "+delivery.RedactionMarker,
+		got,
+	)
+}
+
+// TestRedactor_RemovesSecretSeveredByACut covers the input the
+// redactor exists for: text cut to a byte budget with the
+// credential straddling the cut. The remote chooses the
+// padding, so it chooses where the cut lands inside the
+// credential, and the severed prefix that remains equals no
+// secret.
+func TestRedactor_RemovesSecretSeveredByACut(t *testing.T) {
+	t.Parallel()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeSlack,
+		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+	})
+
+	// Every cut position inside the credential, not just a
+	// convenient one.
+	for n := 1; n < len(redactWebhookURL); n++ {
+		severed := redactWebhookURL[:n]
+		cut := "padding " + severed
+
+		got := r.RedactCut(cut)
+
+		assert.Equal(
+			t,
+			"padding "+delivery.RedactionMarker,
+			got,
+			"cut after %d bytes of the credential", n,
+		)
+	}
+}
+
+// TestRedactor_RedactsCredentialShapedHeaderValues pins the
+// class-based header rule: a header whose name says credential
+// has its value redacted, and a routine header does not, so
+// ordinary response content survives.
+func TestRedactor_RedactsCredentialShapedHeaderValues(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type: database.TargetTypeHTTP,
+		Config: `{"url":"https://example.com/in",` +
+			`"headers":{` +
+			`"Authorization":"Bearer AAAAAAAAAAAA",` +
+			`"Cookie":"session=BBBBBBBBBBBB",` +
+			`"X-Api-Key":"CCCCCCCCCCCC",` +
+			`"X-Hub-Signature":"sha256=DDDDDDDDDDDD",` +
+			`"X-Sig":"EEEEEEEEEEEE",` +
+			`"X-Pass":"FFFFFFFFFFFF",` +
+			`"X-HMAC":"GGGGGGGGGGGG",` +
+			`"X-Credential":"HHHHHHHHHHHH",` +
+			`"Accept":"application/json",` +
+			`"User-Agent":"webhooker/1.0"}}`,
+	})
+
+	for _, secret := range []string{
+		"Bearer AAAAAAAAAAAA",
+		"session=BBBBBBBBBBBB",
+		"CCCCCCCCCCCC",
+		"sha256=DDDDDDDDDDDD",
+		// Abbreviated names an operator might use.
+		"EEEEEEEEEEEE",
+		"FFFFFFFFFFFF",
+		"GGGGGGGGGGGG",
+		"HHHHHHHHHHHH",
+	} {
+		got := r.Redact("echo: " + secret)
+
+		assert.Equal(
+			t,
+			"echo: "+delivery.RedactionMarker,
+			got,
+			secret,
+		)
+	}
+
+	const routine = "Accept: application/json, " +
+		"User-Agent: webhooker/1.0"
+
+	assert.Equal(t, routine, r.Redact(routine))
+}
+
+// TestRedactor_IgnoresVeryShortHeaderValues pins the floor
+// under a header value. Redacting a two-byte value would put
+// the marker through every response that happens to contain
+// those bytes.
+func TestRedactor_IgnoresVeryShortHeaderValues(t *testing.T) {
+	t.Parallel()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type: database.TargetTypeHTTP,
+		Config: `{"url":"https://example.com/in",` +
+			`"headers":{"X-Api-Key":"ab"}}`,
+	})
+
+	const response = "rabbit"
+
+	assert.Equal(t, response, r.Redact(response))
+}
+
+// TestRedactor_RemovesBarePath covers a remote that echoes
+// only the request path rather than the whole URL. The path
+// segments are the credential on their own.
+func TestRedactor_RemovesBarePath(t *testing.T) {
+	t.Parallel()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeSlack,
+		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+	})
+
+	got := r.Redact("POST " + redactSecretPath + " 404")
+
+	assert.NotContains(t, got, redactSecretPath)
+	assert.Equal(
+		t,
+		"POST "+delivery.RedactionMarker+" 404",
+		got,
+	)
+}
+
+// TestRedactor_RemovesHTTPURLQueryAndUserinfo covers the HTTP
+// target, whose destination is an arbitrary URL: the query
+// string and the userinfo carry credentials as readily as the
+// path does.
+func TestRedactor_RemovesHTTPURLQueryAndUserinfo(t *testing.T) {
+	t.Parallel()
+
+	// Assembled rather than written out, so the literal is
+	// not itself a credential-shaped string.
+	dest := url.URL{
+		Scheme:   "https",
+		User:     url.UserPassword("user", "hunter2"),
+		Host:     "example.com",
+		Path:     "/in",
+		RawQuery: "token=s3cr3t",
+	}
+	raw := dest.String()
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeHTTP,
+		Config: `{"url":"` + raw + `"}`,
+	})
+
+	for _, echoed := range []string{
+		raw,
+		"/in?token=s3cr3t",
+		"hunter2",
+	} {
+		got := r.Redact("rejected: " + echoed)
+
+		assert.NotContains(t, got, "s3cr3t", echoed)
+		assert.NotContains(t, got, "hunter2", echoed)
+		assert.Contains(
+			t, got, delivery.RedactionMarker, echoed,
+		)
+	}
+}
+
+// TestRedactor_LeavesUnrelatedTextAlone pins that the
+// redactor matches literally: it does not guess at what a
+// secret looks like, so ordinary response content survives.
+func TestRedactor_LeavesUnrelatedTextAlone(t *testing.T) {
+	t.Parallel()
+
+	const response = "ok=false error=channel_not_found"
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeSlack,
+		Config: `{"webhookUrl":"` + redactWebhookURL + `"}`,
+	})
+
+	assert.Equal(t, response, r.Redact(response))
+}
+
+// TestRedactor_EmptyUserinfoDoesNotShredTheBody covers a
+// destination URL written with a bare "@" and no userinfo:
+// url.Parse returns a non-nil User whose String is empty. An
+// empty secret in the list would make strings.ReplaceAll
+// insert the marker at every byte boundary, destroying every
+// body and error string the target renders.
+func TestRedactor_EmptyUserinfoDoesNotShredTheBody(t *testing.T) {
+	t.Parallel()
+
+	const dest = "https://@example.com/in"
+
+	// The premise: this URL really does parse to a non-nil
+	// User contributing an empty string.
+	parsed, err := url.Parse(dest)
+	require.NoError(t, err)
+	require.NotNil(t, parsed.User)
+	require.Empty(t, parsed.User.String())
+
+	r := delivery.NewRedactor(&database.Target{
+		Type:   database.TargetTypeHTTP,
+		Config: `{"url":"` + dest + `"}`,
+	})
+
+	const body = "ok=false error=channel_not_found"
+
+	assert.Equal(t, body, r.Redact(body))
+	assert.Equal(t, body, r.RedactCut(body))
+
+	// The real credential material still goes, so filtering the
+	// empty string out did not disarm the redactor.
+	assert.Equal(
+		t,
+		"POST "+delivery.RedactionMarker,
+		r.Redact("POST "+dest),
+	)
+}
+
+// TestRedactor_ZeroValueAndConfiglessTargets pins that a
+// caller with no target, an unparseable config, or a target
+// type with no destination URL gets a redactor that changes
+// nothing rather than one that panics.
+func TestRedactor_ZeroValueAndConfiglessTargets(t *testing.T) {
+	t.Parallel()
+
+	const text = "some response body"
+
+	var zero delivery.Redactor
+
+	assert.Equal(t, text, zero.Redact(text))
+	assert.Equal(t, text, delivery.NewRedactor(nil).Redact(text))
+
+	for _, tgt := range []database.Target{
+		{Type: database.TargetTypeLog},
+		{Type: database.TargetTypeDatabase},
+		{Type: database.TargetTypeSlack, Config: "not json"},
+		{Type: database.TargetTypeHTTP, Config: ""},
+	} {
+		assert.Equal(
+			t, text,
+			delivery.NewRedactor(&tgt).Redact(text),
+			tgt.Type,
+		)
+	}
+}