4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	d71d3b2b1a	Name the reaper's hard delete in the eventBodyQuery comment (closes #455) ... The comment credited the deleted_at predicate with refusing a reaped event. The retention reaper deletes event rows outright, so a reaped event is simply gone; nothing soft-deletes an event, so the predicate excludes nothing today. Model: opus-5-5	2026-10-02 16:30:44 +00:00
clawbot	2416528b77	Render admin page errors in the normal layout (closes #382) ... Every 400, 403, 404 and 500 on an admin page now answers with an error page in the normal layout: the status, one fixed line explaining it, and a link back to the webhook list, or to sign-in when nobody is signed in. Unknown paths reach it through the router's not-found handler, a refused form token through the CSRF middleware, and a panic through a recoverer each admin page route group installs first. Status codes are unchanged, and the page always sends Cache-Control: no-store. If the error page fails to render, the answer is the same status in plain text; if it panics, the answer is a 500. The receiver, the healthcheck and /metrics keep their plain answers. Model: opus-5-5	2026-10-02 08:15:12 +02:00
clawbot	8d64259283	Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)	2026-08-24 03:49:17 +02:00
clawbot	41ff16a817	Serve an event's full stored body over HTTP (closes #157) ... The 8 KB render cap from #135 left storage untouched but no route served the rest, so a body over the cap was reachable only with filesystem access to the SQLite files — in a product whose purpose is storing webhooks so they can be inspected. GET /source/{sourceID}/logs/{eventID}/body serves the whole body to the webhook's owner, as application/octet-stream with an attachment disposition and nosniff. Those are a security control, not formatting: the bytes come from the public receiver and are handed back inside the operator's authenticated origin, and the existing CSP would not stop a stored HTML payload executing there. The truncation marker links to it only when a body was actually cut. Accepted deviation, documented rather than glossed: #157's definition of done asks the route to stream from the row. It buffers whole instead, because database/sql exposes no incremental handle on a SQLite BLOB and substr range reads re-materialise the entire column per call — an earlier revision chunked at 64 KiB and was 11-15x slower for a worse bound. Three independent reviewers confirmed no streaming path exists. Independently reviewed three times. Two earlier revisions each asserted a memory bound the code did not have; the final reviewer measured 2.057x at the ingest cap and pinned the two overlapping allocations from source — the driver's column buffer and database/sql's convertAssign clone — confirming the stated "roughly two bodies, and 2x is a floor not a ceiling" is now accurate, since SQLite's own materialisation sits outside the Go heap.	2026-08-18 00:41:31 +02:00