4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sneak	84878cd218	Add a target edit form and reachable header/timeout fields (closes #127) ... A target's configuration was write-once: `internal/server/routes.go` registered create, toggle and delete for targets but no edit route, so correcting a typo in a destination meant deleting the target and recreating it. Masking the stored value made that unrecoverable from the UI. Headers and timeout were worse than write-once. `HTTPTargetConfig` has carried `Headers` and `Timeout` and the delivery path has honoured both, but `buildURLTargetConfig` only ever wrote `{"url":...}` and no form offered either field, so a destination needing an `Authorization` header could not be configured through the UI at all. Both paths now build their configuration through `buildTargetConfig`, so an edited destination is SSRF-validated exactly as a new one is. The destination check lives in one helper that both reach, leaving the guard's entry point untouched. The edit form pre-fills the stored destination and header values in full. That is the one intentional exception to the masking rule, narrowed by the route it lives on: `RequireAuth`, `NoCache`, and the webhook's ownership check. `delivery.TargetView` is unchanged, so every other page still masks. A target's type stays fixed at creation: each type stores a different configuration shape and its delivery history is recorded against the row, so changing it is really a different target. Header and timeout input that could not be delivered as written is rejected rather than stored: a malformed line, an invalid name, a control character in a value, a repeated name, a header the delivery engine overwrites regardless, or a timeout that is not a whole number of seconds within the ceiling. Storing input that provably never reaches the wire would report a configuration that did not take effect.	2026-08-20 05:10:49 +00:00
sneak	2cc8723997	scripts-to-rule-them-all (#59) ... Reviewed-on: #59 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:09 +02:00
sneak	e0b1e7cf54	Restore TODO.md and move TODO content out of README (#58) ... Reviewed-on: #58 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-06 21:14:03 +02:00
sneak	1244f3e2d5	initial	2026-03-01 22:52:08 +07:00