4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	40e8ecaab4	Store a target's number of delivery attempts, at least one (closes #540) ... Target.MaxRetries (max_retries) becomes Target.MaxAttempts (max_attempts), and the form field, parser and ceiling are renamed to match. The column is NOT NULL and a check constraint refuses a value below 1, so every target, whatever its type, is stored with at least 1. 1 is a single attempt with no circuit breaker; above 1 retries behind the breaker up to that many attempts. Both target forms refuse 0 and less; a blank field on the add target form gives 1, and on the edit form keeps the stored value. The target page shows the plain number, and the README's two paragraphs on 0 against 1 become one sentence. Model: opus-5-5	2026-10-15 19:38:14 +02:00
clawbot	37b59f8822	Remove inbound request signature verification (closes #279)	2026-08-24 03:25:09 +02:00
clawbot	fcead5d401	Add optional inbound webhook signature verification (closes #67) (#228) ... The receiver had no inbound authentication of any kind: /webhook/{uuid} was mounted behind a rate limiter alone, so the only thing protecting an entrypoint was the secrecy of a v4 UUID in a URL path. Inbound headers are forwarded almost verbatim to the target, so anyone who learned the URL also chose the headers the downstream service received. Adds an optional per-entrypoint secret with two schemes: github (X-Hub-Signature-256, HMAC-SHA256 hex over the raw body) and gitlab (X-Gitlab-Token, a plain shared token). Comparison is constant-time, the HMAC is computed over the raw body before any parsing, and rejection happens before persistence -- an unauthenticated request creates no event row. An entrypoint with no secret behaves exactly as before, including every row that predates this change. The scheme's credential header is stripped from the header map before it is marshalled into Event.Headers, so the GitLab token reaches neither the event store nor any delivery target. SchemeInfo.HeaderIsDigest defaults to false meaning strip, so a scheme added later is protected unless its header is positively declared a digest.	2026-08-20 08:01:32 +02:00
clawbot	76725cffc4	Read form fields from the POST body only (closes #160) ... r.FormValue falls back to the query string, so POST /source/{id}/targets?url=<secret> created a working target from a value carried on the request line — where proxy logs, browser history and Referer all record it. Every form read is now r.PostFormValue, including the login password and both password-change fields, which had the same defect in a more acute form. The Sentry leg needed more than the query string. sentryhttp attaches the whole request to the scope, and ApplyToEvent copies the teed body into Request.Data with no SendDefaultPII guard — so reading every field from the body only pointed every credential this change protects at the one field the first revision did not scrub. Body and query are now redacted, Cookies and Env cleared, and Headers reduced to an allowlist, because the SDK's own filter removes four names and would otherwise ship X-Csrf-Token and the shared secrets senders put on the receiver route. Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value — TargetView is the masking barrier for the HTML path only, and the first handler to marshal a model would serialise a bearer token or the session encryption key. Independently reviewed three times. The second review found the Data leak and proved it with a scratch module; the third disproved the PR's own claim that BeforeSend gets no request, so the README now records that redacting unconditionally is a deliberate choice rather than a limitation — which is what makes #179 cheap to fix.	2026-08-18 02:04:09 +02:00