feat: add receiver rate limiting (refs #64)

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,7 +14,8 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
+linters-settings:
   lll:
     line-length: 88
   funlen:
@@ -30,5 +27,6 @@ linters:
     threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,8 +1,8 @@
 # Lint stage
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+# golangci/golangci-lint:v2.11.3 (Debian-based), 2026-03-17
 # Using Debian-based image because mattn/go-sqlite3 (CGO) does not
 # compile on Alpine musl (off64_t is a glibc type).
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+FROM golangci/golangci-lint:v2.11.3@sha256:e838e8ab68aaefe83e2408691510867ade9329c0e0b895a3fb35eb93d1c2a4ba AS lint
 
 RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -92,6 +92,7 @@ TTY detection, and security headers are always applied.
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN          | `""`     |
+| `RECEIVER_RATE_LIMIT`   | Receiver requests/minute per IP per entrypoint | `120` |
 
 On first startup, webhooker automatically generates a cryptographically
 secure session encryption key and stores it in the database. This key
@@ -363,12 +364,10 @@ events should be forwarded.
   greater than 0, failed deliveries are retried with exponential backoff
   up to `max_retries` attempts, protected by a per-target circuit
   breaker.
-- **`database`** — Archive the full event as a row into a separate
-  per-webhook archive database (`archive-{webhookID}.db`) for long-term
-  retention, with an optional creation-validated expiry (default: keep
-  forever). No external delivery and no retries; an archive write
-  failure fails the delivery. See the database target section under
-  "Per-Webhook Event Databases" for the full semantics.
+- **`database`** — Confirm the event is stored in the webhook's
+  per-webhook database (no external delivery). Since events are always
+  written to the per-webhook DB on ingestion, this target marks delivery
+  as immediately successful. Useful for ensuring durable event archival.
 - **`log`** — Write the event to the application log (stdout). Useful
   for debugging.
 
@@ -514,22 +513,11 @@ This separation provides:
   page cache, and its own lock, so concurrent event ingestion across
   webhooks won't contend.
 
-The **database target type** builds on this architecture to provide
-long-term archiving, separate from the per-webhook event database (which
-may prune events under its own retention). Delivering to a database
-target writes the full event — body, headers, method, content type, and
-webhook/entrypoint/event identifiers — as a row into a dedicated archive
-database, `archive-{webhookID}.db`, stored under the data directory
-beside the event database. After each write the archive handle is closed
-and reopened, debounced to at most once per second, so an operator can
-move the archive file away for offline archiving without stopping the
-service; a moved or removed archive file is recreated automatically on
-the next write. An optional `expiry` in the target's config JSON (e.g.
-`{"expiry":"720h"}`) is validated when the target is created — the
-default (unset or the literal `never`) keeps rows forever — and rows
-older than the expiry are pruned each time the archive is (re)opened. An
-archive write failure is never silent success: the delivery records a
-failed attempt with the error and is marked failed.
+The **database target type** leverages this architecture: since events
+are already stored in the per-webhook database by design, the database
+target simply marks the delivery as immediately successful. The
+per-webhook DB IS the dedicated event database — that's the whole point
+of the database target type.
 
 The **Slack target type** sends webhook events as formatted messages to
 any Slack-compatible incoming webhook URL (works with Slack, Mattermost,
@@ -689,17 +677,24 @@ just delayed until the target is healthy again.
 
 ### Rate Limiting
 
-Global rate limiting middleware (e.g., per-IP throttling applied at the
-router level) **must not** apply to webhook receiver endpoints. Webhook
-endpoints receive automated traffic from external services at
-unpredictable rates, and blanket rate limits would cause legitimate
-deliveries to be dropped.
+Global blanket rate limiting middleware (e.g., a per-IP throttle shared
+with the web UI) **must not** apply to webhook receiver endpoints.
+Webhook endpoints receive automated traffic from external services at
+unpredictable rates, and blanket limits shared with other routes would
+cause legitimate deliveries to be dropped.
 
-Instead, each webhook has its own individually configurable rate limit,
-applied within the webhook handler itself. By default, no rate limit is
-applied — webhook endpoints accept traffic as fast as it arrives. Rate
-limits can be configured per-webhook when needed (e.g., to protect
-against a misbehaving sender).
+The receiver instead has its own dedicated abuse limit, scoped to the
+`/webhook/{uuid}` route only and keyed per client IP per entrypoint: one
+misbehaving sender is throttled without affecting other senders of the
+same entrypoint or the same sender's other entrypoints. The limit is
+`RECEIVER_RATE_LIMIT` requests per minute (default 120, generous for
+legitimate webhook senders). Requests over the limit receive HTTP 429
+with a `Retry-After` header. A set-but-invalid `RECEIVER_RATE_LIMIT`
+value aborts startup rather than silently falling back to the default.
+
+Finer-grained per-webhook rate limits (configured in the web UI and
+enforced in the webhook handler) can layer on top of this env-level
+abuse limit later; they are tracked as future work.
 
 ### API Endpoints
 

TODO.md

@@ -10,29 +10,27 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (afe88c6) is a working webhook proxy
+pre-1.0. No git tags exist. main (81413c5) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
-policy compliance (#6), and pinned lint tooling (#55). Note: TODO.md was
-deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
-content was folded into the README TODO section, which this draft
-reconstructs as of 2026-07-06.
+policy compliance (#6), pinned lint tooling (#55), a per-webhook event
+retention reaper (#63), and delivery targets behind a Target interface
+(#77). Work is tracked as Gitea issues (the authoritative TODO); this
+file is a summary. Note: TODO.md was deliberately deleted from this
+repo in f9a9569 (2026-03-01, #6); its content was folded into the
+README TODO section, which this draft reconstructs as of 2026-07-06.
 
 # Next Step
 
-Implement automatic event retention cleanup based on retention_days: a
-periodic maintenance job that deletes Events, Deliveries, and
-DeliveryResults older than the parent webhook's retention_days from each
-per-webhook event database. The field exists on the Webhook model and
-the README promises the behavior, but nothing enforces it, so event
-databases currently grow without bound.
+Manual event redelivery from the web UI (replay is a core promised
+capability in the README rationale).
 
 # Completed Steps
 
-- 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
-  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
-  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
-  `lll`/`funlen`/`cyclop`/`dupl` thresholds actually apply), and fix
-  all newly surfaced lint findings
+- 2026-08-07 Rate-limit the public webhook receiver per client IP per
+  entrypoint, env-configurable with fail-loud parsing (#64)
+- 2026-08-07 Per-webhook event retention reaper (#63); NoCache
+  middleware for authenticated pages (#61); Target interface refactor
+  (#77)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)
@@ -56,12 +54,10 @@ databases currently grow without bound.
 
 # Future Steps
 
-- Manual event redelivery from the web UI (replay is a core promised
-  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
-  plus handler enforcement; global limits must not apply to receiver
-  endpoints)
+  plus handler enforcement, layered on the env-level receiver limit
+  from #64; global limits must not apply to receiver endpoints)
 - Webhook signature verification for GitHub and Stripe HMAC formats
 - API key authentication for programmatic access (APIKey model exists;
   Bearer token middleware does not)

internal/config/config.go

@@ -31,12 +31,23 @@ const (
 	// defaultRetentionSweepInterval is how often the retention
 	// reaper deletes events older than each webhook's RetentionDays.
 	defaultRetentionSweepInterval = time.Hour
+
+	// defaultReceiverRateLimit is the default number of requests
+	// per minute each client IP may send to a single webhook
+	// receiver entrypoint. Generous for legitimate webhook
+	// senders while bounding abuse of the one unauthenticated,
+	// internet-exposed endpoint.
+	defaultReceiverRateLimit = 120
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
 // contains an unrecognised value.
 var ErrInvalidEnvironment = errors.New("invalid environment")
 
+// ErrNonPositiveValue is returned when an environment variable that
+// requires a positive integer is set to zero or a negative number.
+var ErrNonPositiveValue = errors.New("value must be positive")
+
 //nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
@@ -60,6 +71,10 @@ type Config struct {
 	// RetentionSweepInterval is how often the retention reaper runs.
 	RetentionSweepInterval time.Duration
 
+	// ReceiverRateLimit is the number of requests per minute each
+	// client IP may send to a single webhook receiver entrypoint.
+	ReceiverRateLimit int
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -104,6 +119,38 @@ func envInt(key string, defaultValue int) int {
 	return defaultValue
 }
 
+// envPositiveInt returns the value of the named environment variable
+// parsed as a positive integer. Returns defaultValue if not set. If
+// the variable is set but cannot be parsed, or parses to less than
+// one, it returns a wrapped error naming the key and the bad value,
+// so startup fails loudly rather than silently falling back to the
+// default.
+func envPositiveInt(
+	key string,
+	defaultValue int,
+) (int, error) {
+	v := os.Getenv(key)
+	if v == "" {
+		return defaultValue, nil
+	}
+
+	i, err := strconv.Atoi(v)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"invalid integer for %s: %q: %w", key, v, err,
+		)
+	}
+
+	if i < 1 {
+		return 0, fmt.Errorf(
+			"%w: %s must be at least 1, got %q",
+			ErrNonPositiveValue, key, v,
+		)
+	}
+
+	return i, nil
+}
+
 // envDuration returns the value of the named environment variable
 // parsed as a Go duration (e.g. "1h", "30m"). Returns defaultValue if
 // not set. If the variable is set but cannot be parsed, it returns a
@@ -162,6 +209,17 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		return nil, err
 	}
 
+	// Parse the receiver rate limit; a set-but-unparseable or
+	// non-positive value is a hard error so fx aborts startup
+	// rather than silently using the default.
+	receiverRateLimit, err := envPositiveInt(
+		"RECEIVER_RATE_LIMIT",
+		defaultReceiverRateLimit,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	// Load configuration values from environment variables
 	s := &Config{
 		DataDir:                envString("DATA_DIR"),
@@ -173,6 +231,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		Port:                   envInt("PORT", defaultPort),
 		SentryDSN:              envString("SENTRY_DSN"),
 		RetentionSweepInterval: retentionSweepInterval,
+		ReceiverRateLimit:      receiverRateLimit,
 		log:                    log,
 		params:                 &params,
 	}
@@ -197,6 +256,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"maintenanceMode", s.MaintenanceMode,
 		"dataDir", s.DataDir,
 		"retentionSweepInterval", s.RetentionSweepInterval.String(),
+		"receiverRateLimit", s.ReceiverRateLimit,
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth",
 		s.MetricsUsername != "" && s.MetricsPassword != "",

internal/config/config_test.go

@@ -258,3 +258,109 @@ func TestDefaultDataDir(t *testing.T) {
 		})
 	}
 }
+
+func TestReceiverRateLimit(t *testing.T) {
+	tests := []struct {
+		name        string
+		set         bool
+		value       string
+		expectError bool
+		expected    int
+	}{
+		{
+			name:     "unset uses default",
+			set:      false,
+			expected: 120,
+		},
+		{
+			name:     "valid value is parsed",
+			set:      true,
+			value:    "30",
+			expected: 30,
+		},
+		{
+			name:        "unparseable value fails startup",
+			set:         true,
+			value:       "not-a-number",
+			expectError: true,
+		},
+		{
+			name:        "zero fails startup",
+			set:         true,
+			value:       "0",
+			expectError: true,
+		},
+		{
+			name:        "negative fails startup",
+			set:         true,
+			value:       "-5",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
+
+			if tt.set {
+				t.Setenv("RECEIVER_RATE_LIMIT", tt.value)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"RECEIVER_RATE_LIMIT",
+				))
+			}
+
+			if tt.expectError {
+				testReceiverRateLimitError(t)
+			} else {
+				testReceiverRateLimitSuccess(t, tt.expected)
+			}
+		})
+	}
+}
+
+func testReceiverRateLimitError(t *testing.T) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fx.New(
+		fx.NopLogger,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+
+	assert.Error(t, app.Err())
+}
+
+func testReceiverRateLimitSuccess(
+	t *testing.T,
+	expected int,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, expected, cfg.ReceiverRateLimit)
+}

internal/database/database_test.go

@@ -11,15 +11,6 @@ import (
 	"sneak.berlin/go/webhooker/internal/logger"
 )
 
-const (
-	// testAppname is the Globals.Appname used in tests.
-	testAppname = "webhooker-test"
-	// testVersion is the Globals.Version used in tests.
-	testVersion = "test"
-	// testContentType is the event content type used in tests.
-	testContentType = "application/json"
-)
-
 func setupTestDB(
 	t *testing.T,
 ) (*database.Database, *fxtest.Lifecycle) {
@@ -28,8 +19,8 @@ func setupTestDB(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
-		Version: testVersion,
+		Appname: "webhooker-test",
+		Version: "test",
 	}
 
 	l, err := logger.New(

internal/database/model_entrypoint.go

@@ -5,10 +5,7 @@ type Entrypoint struct {
 	BaseModel
 
 	WebhookID   string `gorm:"type:uuid;not null"   json:"webhookId"`
-
-	// Path is the URL path for this entrypoint.
-	Path string `gorm:"uniqueIndex;not null" json:"path"`
-
+	Path        string `gorm:"uniqueIndex;not null" json:"path"` // URL path for this entrypoint
 	Description string `json:"description"`
 	Active      bool   `gorm:"default:true"         json:"active"`
 

internal/database/model_target.go

@@ -23,8 +23,7 @@ type Target struct {
 	// Configuration fields (JSON stored based on type)
 	Config string `gorm:"type:text" json:"config"` // JSON configuration
 
-	// For HTTP targets (max_retries=0 means fire-and-forget,
-	// >0 enables retries with backoff)
+	// For HTTP targets (max_retries=0 means fire-and-forget, >0 enables retries with backoff)
 	MaxRetries   int `json:"maxRetries,omitempty"`
 	MaxQueueSize int `json:"maxQueueSize,omitempty"`
 

internal/database/model_webhook.go

@@ -7,9 +7,7 @@ type Webhook struct {
 	UserID        string `gorm:"type:uuid;not null" json:"userId"`
 	Name          string `gorm:"not null"           json:"name"`
 	Description   string `json:"description"`
-
-	// RetentionDays is the number of days to retain events.
-	RetentionDays int `gorm:"default:30" json:"retentionDays"`
+	RetentionDays int    `gorm:"default:30"         json:"retentionDays"` // Days to retain events
 
 	// Relations
 	User        User         `json:"user,omitzero"`

internal/database/retention_test.go

@@ -2,7 +2,6 @@ package database_test
 
 import (
 	"context"
-	"net/http"
 	"testing"
 	"time"
 
@@ -31,8 +30,8 @@ func setupRetentionTest(t *testing.T) *retentionTestEnv {
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
-		Version: testVersion,
+		Appname: "webhooker-test",
+		Version: "test",
 	}
 
 	l, err := logger.New(lc, logger.LoggerParams{Globals: g})
@@ -118,9 +117,9 @@ func seedEventChain(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"seed": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	event.CreatedAt = createdAt
 	require.NoError(t, db.Create(event).Error)

internal/database/testing.go

@@ -14,10 +14,7 @@ import (
 func NewTestDatabase(db *gorm.DB) *Database {
 	return &Database{
 		db:  db,
-		log: slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
+		log: slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
 	}
 }
 
@@ -26,9 +23,6 @@ func NewTestDatabase(db *gorm.DB) *Database {
 func NewTestWebhookDBManager(dataDir string) *WebhookDBManager {
 	return &WebhookDBManager{
 		dataDir: dataDir,
-		log: slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
+		log:     slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
 	}
 }

internal/database/webhook_db_manager_test.go

@@ -2,7 +2,6 @@ package database_test
 
 import (
 	"context"
-	"net/http"
 	"os"
 	"path/filepath"
 	"testing"
@@ -26,8 +25,8 @@ func setupTestWebhookDBManager(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
-		Version: testVersion,
+		Appname: "webhooker-test",
+		Version: "test",
 	}
 
 	l, err := logger.New(
@@ -84,10 +83,10 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"test": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 	assert.NotEmpty(t, event.ID)
@@ -100,7 +99,7 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 		db.First(&readEvent, "id = ?", event.ID).Error,
 	)
 	assert.Equal(t, webhookID, readEvent.WebhookID)
-	assert.Equal(t, http.MethodPost, readEvent.Method)
+	assert.Equal(t, "POST", readEvent.Method)
 	assert.Equal(t, `{"test": true}`, readEvent.Body)
 }
 
@@ -124,9 +123,9 @@ func TestWebhookDBManager_DeleteDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"test": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -197,10 +196,10 @@ func seedDeliveryWorkflow(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"payload": "test"}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -232,7 +231,7 @@ func verifyPendingDeliveries(
 	)
 	require.Len(t, pending, 1)
 	assert.Equal(t, event.ID, pending[0].EventID)
-	assert.Equal(t, http.MethodPost, pending[0].Event.Method)
+	assert.Equal(t, "POST", pending[0].Event.Method)
 }
 
 func completeDelivery(
@@ -304,16 +303,16 @@ func TestWebhookDBManager_MultipleWebhooks(t *testing.T) {
 	event1 := &database.Event{
 		WebhookID:    webhook1,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"webhook": 1}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	event2 := &database.Event{
 		WebhookID:    webhook2,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPut,
+		Method:       "PUT",
 		Body:         `{"webhook": 2}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db1.Create(event1).Error)

internal/delivery/engine_integration_test.go

@@ -126,6 +126,36 @@ func iHTTPConfig(url string) string {
 	return string(data)
 }
 
+func iWebhookDB(t *testing.T) *gorm.DB {
+	t.Helper()
+
+	dbPath := filepath.Join(
+		t.TempDir(), "events-test.db",
+	)
+
+	dsn := fmt.Sprintf(
+		"file:%s?cache=shared&mode=rwc", dbPath,
+	)
+
+	sqlDB, err := sql.Open("sqlite", dsn)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	db, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	require.NoError(t, db.AutoMigrate(
+		&database.Event{},
+		&database.Delivery{},
+		&database.DeliveryResult{},
+	))
+
+	return db
+}
+
 func iEngine(
 	t *testing.T, workers int,
 ) *delivery.Engine {
@@ -152,10 +182,10 @@ func iSeedEvent(
 	event := database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -905,7 +935,7 @@ func TestDeliverHTTP_CustomTargetHeaders(t *testing.T) {
 func TestDeliverHTTP_TargetTimeout(t *testing.T) {
 	t.Parallel()
 
-	db := testWebhookDB(t)
+	db := iWebhookDB(t)
 	e := iEngine(t, 1)
 
 	ts := httptest.NewServer(
@@ -957,10 +987,10 @@ func iSeedEventAndDelivery(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -1037,7 +1067,7 @@ func iAssertResultFailed(
 func TestDeliverHTTP_InvalidConfig(t *testing.T) {
 	t.Parallel()
 
-	db := testWebhookDB(t)
+	db := iWebhookDB(t)
 	e := iEngine(t, 1)
 
 	event, del := iSeedEventAndDelivery(

internal/delivery/engine_test.go

@@ -27,9 +27,6 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-// testContentType is the event content type used in tests.
-const testContentType = "application/json"
-
 func testWebhookDB(t *testing.T) *gorm.DB {
 	t.Helper()
 
@@ -97,10 +94,10 @@ func seedEvent(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -345,29 +342,33 @@ func TestDeliverDatabase_ImmediateSuccess(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-
-	// The database target archives for real now, so the engine
-	// needs a webhook DB manager to locate the data directory.
-	e := delivery.NewTestEngineWithDB(
-		nil,
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
+	e := testEngine(t, 1)
 
 	event := seedEvent(t, db, `{"db":"target"}`)
-	d := seedDatabaseTargetDelivery(t, db, event, "")
+
+	dlv := seedDelivery(
+		t, db, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name: "test-db",
+			Type: database.TargetTypeDatabase,
+		},
+	}
+	d.ID = dlv.ID
 
 	e.ExportDeliverDatabase(db, d)
 
 	var updated database.Delivery
 
 	require.NoError(t, db.First(
-		&updated, "id = ?", d.ID,
+		&updated, "id = ?", dlv.ID,
 	).Error)
 
 	assert.Equal(t,
@@ -378,7 +379,7 @@ func TestDeliverDatabase_ImmediateSuccess(
 	var result database.DeliveryResult
 
 	require.NoError(t, db.Where(
-		"delivery_id = ?", d.ID,
+		"delivery_id = ?", dlv.ID,
 	).First(&result).Error)
 
 	assert.True(t, result.Success)
@@ -1116,10 +1117,10 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	}
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
 		Headers:     `{"X-Custom":["value1"],"Content-Type":["application/json"]}`,
 		Body:        `{"test":true}`,
-		ContentType: testContentType,
+		ContentType: "application/json",
 	}
 
 	statusCode, _, _, err := e.ExportDoHTTPRequest(
@@ -1141,7 +1142,7 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	)
 
 	assert.Equal(t,
-		testContentType,
+		"application/json",
 		receivedHeaders.Get("Content-Type"),
 	)
 
@@ -1157,19 +1158,7 @@ func TestProcessDelivery_RoutesToCorrectHandler(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-
-	// The database target archives for real now, so the engine
-	// needs a webhook DB manager to locate the data directory.
-	e := delivery.NewTestEngineWithDB(
-		nil,
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
+	e := testEngine(t, 1)
 
 	tests := []struct {
 		name       string
@@ -1300,8 +1289,8 @@ func TestFormatSlackMessage_JSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
-		ContentType: testContentType,
+		Method:      "POST",
+		ContentType: "application/json",
 		Body: `{"action":"push",` +
 			`"repo":"test/repo",` +
 			`"ref":"refs/heads/main"}`,
@@ -1326,7 +1315,7 @@ func TestFormatSlackMessage_NonJSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
 		ContentType: "text/plain",
 		Body:        "hello world plain text",
 	}
@@ -1349,8 +1338,8 @@ func TestFormatSlackMessage_EmptyBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
-		ContentType: testContentType,
+		Method:      "POST",
+		ContentType: "application/json",
 		Body:        "",
 	}
 	event.CreatedAt = time.Date(
@@ -1378,8 +1367,8 @@ func TestFormatSlackMessage_LargeJSONTruncated(
 	require.NoError(t, err)
 
 	event := &database.Event{
-		Method:      http.MethodPost,
-		ContentType: testContentType,
+		Method:      "POST",
+		ContentType: "application/json",
 		Body:        string(largeJSON),
 	}
 	event.CreatedAt = time.Date(
@@ -1708,7 +1697,7 @@ func assertLogLineComplete(
 		"log line must contain the webhook id",
 	)
 
-	assert.Contains(t, out, testContentType,
+	assert.Contains(t, out, "application/json",
 		"log line must contain the content type",
 	)
 }

internal/delivery/export_test.go

@@ -273,64 +273,3 @@ func NewTestCircuitBreaker(
 		cooldown:  cooldown,
 	}
 }
-
-// ExportArchivedEvent aliases the archive row type so black-box
-// tests can construct and read archive rows.
-type ExportArchivedEvent = archivedEvent
-
-// ExportArchiveWriter wraps an archiveWriter so black-box tests
-// can exercise the per-webhook archive file mechanics.
-type ExportArchiveWriter struct {
-	w *archiveWriter
-}
-
-// NewExportArchiveWriter builds an archive writer for tests,
-// optionally overriding the reopen debounce (a non-positive
-// debounce keeps the production default).
-func NewExportArchiveWriter(
-	path string, log *slog.Logger, debounce time.Duration,
-) *ExportArchiveWriter {
-	w := newArchiveWriter(path, log)
-	if debounce > 0 {
-		w.debounce = debounce
-	}
-
-	return &ExportArchiveWriter{w: w}
-}
-
-// Write archives a row through the writer.
-func (e *ExportArchiveWriter) Write(
-	row ExportArchivedEvent, expiry time.Duration,
-) error {
-	return e.w.write(row, expiry)
-}
-
-// Open opens the archive file, pruning when expiry is positive.
-func (e *ExportArchiveWriter) Open(expiry time.Duration) error {
-	return e.w.open(expiry)
-}
-
-// Reopen closes and reopens the archive file.
-func (e *ExportArchiveWriter) Reopen(
-	expiry time.Duration,
-) error {
-	return e.w.reopen(expiry)
-}
-
-// Reopens reports how many times the file has been opened.
-func (e *ExportArchiveWriter) Reopens() int {
-	return e.w.reopens
-}
-
-// DB returns the writer's current open handle for row
-// inspection in tests.
-func (e *ExportArchiveWriter) DB() *gorm.DB {
-	return e.w.db
-}
-
-// ExportParseArchiveExpiry exposes parseArchiveExpiry.
-func ExportParseArchiveExpiry(
-	configJSON string,
-) (time.Duration, error) {
-	return parseArchiveExpiry(configJSON)
-}

internal/delivery/target_database.go

@@ -2,38 +2,21 @@ package delivery
 
 import (
 	"context"
-	"fmt"
-	"path/filepath"
-	"sync"
 
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// databaseTarget is a no-retry target that archives the
-// full inbound event into a per-webhook archive SQLite file,
-// separate from the per-webhook event database. The event is
-// already persisted in the per-webhook event DB by the time
-// delivery runs; the database target additionally writes a
-// durable long-term copy into archive-{webhookID}.db and then
-// records a single attempt whose outcome reflects whether the
-// archive write succeeded. See archiveWriter for the
-// close/reopen, auto-recreate, and expiry semantics.
+// databaseTarget is a fire-and-forget target: the event is
+// already persisted in the per-webhook database by the time
+// delivery runs, so the target records a single successful
+// attempt. (Durable archiving to a separate store is tracked
+// as its own work.)
 type databaseTarget struct {
 	eng *Engine
-
-	mu      sync.Mutex
-	writers map[string]*archiveWriter
 }
 
-// Deliver implements Target. It archives the event, then
-// records one successful attempt and marks the delivery
-// delivered. An archiving error fails the delivery: the
-// attempt is recorded as failed with the error and the
-// delivery is marked failed, so a target that could not do
-// its one job (archiving) never reports success. The target
-// does not retry; the event remains durably stored in the
-// per-webhook event database.
+// Deliver implements Target.
 func (t *databaseTarget) Deliver(
 	_ context.Context,
 	webhookDB *gorm.DB,
@@ -41,27 +24,6 @@ func (t *databaseTarget) Deliver(
 	_ *Task,
 	_ Scheduler,
 ) {
-	err := t.archive(d)
-	if err != nil {
-		t.eng.log.Error(
-			"failed to archive event to database target",
-			"delivery_id", d.ID,
-			"event_id", d.EventID,
-			"error", err,
-		)
-
-		t.eng.recordResult(
-			webhookDB, d, 1, false, 0, "",
-			err.Error(), 0,
-		)
-
-		t.eng.updateDeliveryStatus(
-			webhookDB, d, database.DeliveryStatusFailed,
-		)
-
-		return
-	}
-
 	t.eng.recordResult(
 		webhookDB, d, 1, true, 0, "", "", 0,
 	)
@@ -70,68 +32,3 @@ func (t *databaseTarget) Deliver(
 		webhookDB, d, database.DeliveryStatusDelivered,
 	)
 }
-
-// archive writes the full event as a row into the webhook's
-// archive database, honouring the optional per-target expiry
-// parsed from the target config JSON.
-func (t *databaseTarget) archive(d *database.Delivery) error {
-	webhookID := d.Event.WebhookID
-	if webhookID == "" {
-		return errArchiveMissingWebhookID
-	}
-
-	expiry, err := parseArchiveExpiry(d.Target.Config)
-	if err != nil {
-		return err
-	}
-
-	w, err := t.writerFor(webhookID)
-	if err != nil {
-		return err
-	}
-
-	row := archivedEvent{
-		EventID:      d.Event.ID,
-		WebhookID:    webhookID,
-		EntrypointID: d.Event.EntrypointID,
-		Method:       d.Event.Method,
-		Headers:      d.Event.Headers,
-		Body:         d.Event.Body,
-		ContentType:  d.Event.ContentType,
-	}
-
-	return w.write(row, expiry)
-}
-
-// writerFor returns the archiveWriter for a webhook, creating
-// and caching it on first use. Each webhook has one writer so
-// its close/reopen debounce state is shared across concurrent
-// deliveries. The archive file lives beside the per-webhook
-// event database in the data directory.
-func (t *databaseTarget) writerFor(
-	webhookID string,
-) (*archiveWriter, error) {
-	if t.eng.dbManager == nil {
-		return nil, errArchiveNoDataDir
-	}
-
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
-	path := filepath.Join(
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
-	)
-
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	if t.writers == nil {
-		t.writers = make(map[string]*archiveWriter)
-	}
-
-	w, ok := t.writers[webhookID]
-	if !ok {
-		w = newArchiveWriter(path, t.eng.log)
-		t.writers[webhookID] = w
-	}
-
-	return w, nil
-}

internal/delivery/target_database_archive.go

@@ -1,312 +0,0 @@
-package delivery
-
-import (
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log/slog"
-	"os"
-	"sync"
-	"time"
-
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-)
-
-// archiveExpiryNever is the expiry sentinel (and default) that
-// disables pruning so archived rows are kept forever.
-const archiveExpiryNever = "never"
-
-// archiveReopenDebounce bounds how often an archive file is
-// closed and reopened. After each write the handle is closed
-// and reopened so an operator can move the file away for
-// offline archiving, but never more than once per this window.
-const archiveReopenDebounce = time.Second
-
-var (
-	// errArchiveMissingWebhookID is returned when an event to
-	// archive has no webhook id to key its archive file on.
-	errArchiveMissingWebhookID = errors.New(
-		"cannot archive event without a webhook id",
-	)
-
-	// errArchiveNoDataDir is returned when the database target
-	// has no webhook database manager and so cannot locate the
-	// data directory for archive files.
-	errArchiveNoDataDir = errors.New(
-		"database target has no data directory",
-	)
-
-	// errArchiveExpiryNotPositive is returned when a
-	// user-supplied archive expiry parses as a duration but is
-	// zero or negative; "never" is the way to disable pruning.
-	errArchiveExpiryNotPositive = errors.New(
-		"expiry must be a positive duration or \"never\"",
-	)
-)
-
-// databaseTargetConfig is the optional per-target JSON config
-// for a database (archive) target.
-type databaseTargetConfig struct {
-	// Expiry is a Go duration (e.g. "720h") after which
-	// archived rows are pruned, or "never" (the default) to
-	// keep them forever.
-	Expiry string `json:"expiry"`
-}
-
-// archivedEvent is one fully captured webhook event stored in a
-// per-webhook archive database for long-term retention. It is a
-// self-contained copy — independent of the per-webhook event
-// database, which may prune events under its own retention.
-type archivedEvent struct {
-	ID           uint   `gorm:"primaryKey;autoIncrement"`
-	EventID      string `gorm:"index"`
-	WebhookID    string
-	EntrypointID string
-	Method       string
-	Headers      string
-	Body         string
-	ContentType  string
-
-	// ArchivedAt is when the row was archived and is the age
-	// basis for expiry pruning.
-	ArchivedAt time.Time `gorm:"index"`
-}
-
-// parseArchiveExpiry reads the optional expiry from a database
-// target's config JSON. An empty config, an empty expiry, or
-// the literal "never" all mean keep forever, returned as a zero
-// duration. Any other value must parse as a positive Go
-// duration; a set-but-invalid value (unparseable, zero, or
-// negative) is an error rather than a silent default, matching
-// ValidateArchiveExpiry at target creation.
-func parseArchiveExpiry(
-	configJSON string,
-) (time.Duration, error) {
-	if configJSON == "" {
-		return 0, nil
-	}
-
-	var cfg databaseTargetConfig
-
-	err := json.Unmarshal([]byte(configJSON), &cfg)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"parsing database target config: %w", err,
-		)
-	}
-
-	if cfg.Expiry == "" || cfg.Expiry == archiveExpiryNever {
-		return 0, nil
-	}
-
-	dur, err := time.ParseDuration(cfg.Expiry)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"parsing archive expiry %q: %w", cfg.Expiry, err,
-		)
-	}
-
-	if dur <= 0 {
-		return 0, fmt.Errorf(
-			"%w: %q", errArchiveExpiryNotPositive, cfg.Expiry,
-		)
-	}
-
-	return dur, nil
-}
-
-// ValidateArchiveExpiry checks a user-supplied archive expiry
-// for a database target at configuration time. Valid values are
-// empty, "never" (both meaning keep forever), or a positive Go
-// duration such as "720h". Anything else is an error, so a bad
-// expiry is rejected when the target is created rather than
-// failing every subsequent delivery.
-func ValidateArchiveExpiry(expiry string) error {
-	if expiry == "" || expiry == archiveExpiryNever {
-		return nil
-	}
-
-	dur, err := time.ParseDuration(expiry)
-	if err != nil {
-		return fmt.Errorf(
-			"expiry must be %q or a Go duration "+
-				"such as \"720h\": %w",
-			archiveExpiryNever, err,
-		)
-	}
-
-	if dur <= 0 {
-		return fmt.Errorf(
-			"%w: %q", errArchiveExpiryNotPositive, expiry,
-		)
-	}
-
-	return nil
-}
-
-// archiveWriter owns one per-webhook archive SQLite file. It
-// serialises writes, and after each write closes and reopens
-// the file (debounced to at most once per debounce window) so
-// an operator can move the file away for offline archiving. The
-// next write recreates a moved or removed file, because the
-// file is opened create-if-missing and its schema is migrated
-// on every open.
-type archiveWriter struct {
-	mu         sync.Mutex
-	path       string
-	log        *slog.Logger
-	debounce   time.Duration
-	db         *gorm.DB
-	lastReopen time.Time
-	reopens    int
-}
-
-// newArchiveWriter builds an archiveWriter for a file path with
-// the default reopen debounce.
-func newArchiveWriter(
-	path string, log *slog.Logger,
-) *archiveWriter {
-	return &archiveWriter{
-		path:     path,
-		log:      log,
-		debounce: archiveReopenDebounce,
-	}
-}
-
-// write appends the event as a row, then applies the debounced
-// close/reopen. It recreates the archive file if it was moved
-// or removed since the last open. A positive expiry prunes rows
-// older than it on each (re)open.
-func (w *archiveWriter) write(
-	row archivedEvent, expiry time.Duration,
-) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	if w.db == nil || !fileExists(w.path) {
-		err := w.reopen(expiry)
-		if err != nil {
-			return err
-		}
-	}
-
-	row.ArchivedAt = time.Now()
-
-	err := w.db.Create(&row).Error
-	if err != nil {
-		return fmt.Errorf(
-			"archiving event to %s: %w", w.path, err,
-		)
-	}
-
-	if time.Since(w.lastReopen) >= w.debounce {
-		return w.reopen(expiry)
-	}
-
-	return nil
-}
-
-// open opens (creating if missing) the archive file, migrates
-// its schema, records the reopen time, and prunes expired rows
-// when expiry is positive.
-func (w *archiveWriter) open(expiry time.Duration) error {
-	dbURL := fmt.Sprintf("file:%s?mode=rwc", w.path)
-
-	sqlDB, err := sql.Open("sqlite", dbURL)
-	if err != nil {
-		return fmt.Errorf(
-			"opening archive database %s: %w", w.path, err,
-		)
-	}
-
-	gdb, err := gorm.Open(
-		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
-	)
-	if err != nil {
-		_ = sqlDB.Close()
-
-		return fmt.Errorf(
-			"connecting to archive database %s: %w",
-			w.path, err,
-		)
-	}
-
-	err = gdb.AutoMigrate(&archivedEvent{})
-	if err != nil {
-		_ = sqlDB.Close()
-
-		return fmt.Errorf(
-			"migrating archive database %s: %w", w.path, err,
-		)
-	}
-
-	w.db = gdb
-	w.lastReopen = time.Now()
-	w.reopens++
-
-	if expiry > 0 {
-		w.prune(expiry)
-	}
-
-	return nil
-}
-
-// reopen closes any open handle and opens the file afresh. The
-// fresh open recreates the file if it was moved away.
-func (w *archiveWriter) reopen(expiry time.Duration) error {
-	w.close()
-
-	return w.open(expiry)
-}
-
-// close closes the underlying handle, if any.
-func (w *archiveWriter) close() {
-	if w.db == nil {
-		return
-	}
-
-	sqlDB, err := w.db.DB()
-	if err == nil {
-		_ = sqlDB.Close()
-	}
-
-	w.db = nil
-}
-
-// prune deletes archived rows older than expiry, measured from
-// each row's archived time. It runs on every (re)open, and
-// because the file is reopened after writes this keeps the
-// archive swept without a separate background sweeper. Failures
-// are logged, not fatal: a prune error must not stop archiving.
-func (w *archiveWriter) prune(expiry time.Duration) {
-	cutoff := time.Now().Add(-expiry)
-
-	res := w.db.Where("archived_at < ?", cutoff).
-		Delete(&archivedEvent{})
-	if res.Error != nil {
-		w.log.Error(
-			"failed to prune expired archive rows",
-			"path", w.path,
-			"error", res.Error,
-		)
-
-		return
-	}
-
-	if res.RowsAffected > 0 {
-		w.log.Info(
-			"pruned expired archive rows",
-			"path", w.path,
-			"rows_deleted", res.RowsAffected,
-		)
-	}
-}
-
-// fileExists reports whether a path currently exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-
-	return err == nil
-}

internal/delivery/target_database_test.go

@@ -1,395 +0,0 @@
-package delivery_test
-
-import (
-	"database/sql"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-	_ "modernc.org/sqlite" // Pure Go SQLite driver.
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/delivery"
-)
-
-func archiveTestLogger() *slog.Logger {
-	return slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-}
-
-// openArchiveDBForRead opens an archive file read-only so a
-// test can inspect the rows the writer persisted.
-func openArchiveDBForRead(
-	t *testing.T, path string,
-) *gorm.DB {
-	t.Helper()
-
-	sqlDB, err := sql.Open(
-		"sqlite",
-		fmt.Sprintf("file:%s?mode=ro", path),
-	)
-	require.NoError(t, err)
-
-	t.Cleanup(func() { _ = sqlDB.Close() })
-
-	gdb, err := gorm.Open(
-		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
-	)
-	require.NoError(t, err)
-
-	return gdb
-}
-
-// removeArchiveFiles simulates an operator moving the archive
-// away by deleting the SQLite file and its sidecar files.
-func removeArchiveFiles(t *testing.T, path string) {
-	t.Helper()
-
-	for _, suffix := range []string{
-		"", "-wal", "-shm", "-journal",
-	} {
-		err := os.Remove(path + suffix)
-		if err != nil && !os.IsNotExist(err) {
-			t.Fatalf("removing %s%s: %v", path, suffix, err)
-		}
-	}
-}
-
-// TestDeliverDatabase_ArchivesEvent verifies that delivering to
-// a database target marks the delivery delivered and archives
-// the full event into a separate per-webhook archive file.
-func TestDeliverDatabase_ArchivesEvent(t *testing.T) {
-	t.Parallel()
-
-	dataDir := t.TempDir()
-	dbMgr := database.NewTestWebhookDBManager(dataDir)
-
-	e := delivery.NewTestEngineWithDB(
-		nil, dbMgr,
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
-
-	e.ExportDeliverDatabase(webhookDB, d)
-
-	var updated database.Delivery
-
-	require.NoError(t, webhookDB.First(
-		&updated, "id = ?", d.ID,
-	).Error)
-	assert.Equal(t,
-		database.DeliveryStatusDelivered, updated.Status,
-		"database target should mark the delivery delivered",
-	)
-
-	archivePath := filepath.Join(
-		dataDir,
-		fmt.Sprintf("archive-%s.db", event.WebhookID),
-	)
-	assert.FileExists(t, archivePath)
-
-	rdb := openArchiveDBForRead(t, archivePath)
-
-	var rows []delivery.ExportArchivedEvent
-
-	require.NoError(t, rdb.Find(&rows).Error)
-	require.Len(t, rows, 1)
-	assert.Equal(t, event.ID, rows[0].EventID)
-	assert.Equal(t, event.WebhookID, rows[0].WebhookID)
-	assert.Equal(t, event.Method, rows[0].Method)
-	assert.JSONEq(t, `{"archived":true}`, rows[0].Body)
-}
-
-func TestArchiveWriter_WritesRow(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	row := delivery.ExportArchivedEvent{
-		EventID:      "ev-1",
-		WebhookID:    "wh-1",
-		EntrypointID: "ep-1",
-		Method:       "POST",
-		Headers:      `{"X":"Y"}`,
-		Body:         `{"hello":"world"}`,
-		ContentType:  "application/json",
-	}
-
-	require.NoError(t, w.Write(row, 0))
-	assert.FileExists(t, path)
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "ev-1", got[0].EventID)
-	assert.Equal(t, "wh-1", got[0].WebhookID)
-	assert.Equal(t, "ep-1", got[0].EntrypointID)
-	assert.Equal(t, row.Method, got[0].Method)
-	assert.Equal(t, row.ContentType, got[0].ContentType)
-	assert.JSONEq(t, `{"hello":"world"}`, got[0].Body)
-	assert.False(t, got[0].ArchivedAt.IsZero())
-}
-
-func TestArchiveWriter_RecreatesAfterRemoval(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "a"}, 0,
-	))
-	assert.FileExists(t, path)
-
-	// The operator moves the archive away while the handle is
-	// still open.
-	removeArchiveFiles(t, path)
-	require.NoFileExists(t, path)
-
-	// The next write recreates the file with a fresh schema and
-	// only the new row.
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "b"}, 0,
-	))
-	assert.FileExists(t, path)
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "b", got[0].EventID)
-}
-
-func TestArchiveWriter_ReopenDebounce(t *testing.T) {
-	t.Parallel()
-
-	// A generous debounce keeps the two rapid writes inside
-	// the window even on a heavily loaded test machine.
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 2*time.Second,
-	)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "a"}, 0,
-	))
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "b"}, 0,
-	))
-
-	// Two writes inside the debounce window trigger only the
-	// initial open — no extra close/reopen.
-	assert.Equal(t, 1, w.Reopens())
-
-	time.Sleep(2100 * time.Millisecond)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "c"}, 0,
-	))
-
-	// A write after the window elapses closes and reopens once.
-	assert.Equal(t, 2, w.Reopens())
-}
-
-func TestArchiveWriter_ExpiryPrune(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	require.NoError(t, w.Open(0))
-
-	old := delivery.ExportArchivedEvent{
-		EventID:    "old",
-		ArchivedAt: time.Now().Add(-2 * time.Hour),
-	}
-	fresh := delivery.ExportArchivedEvent{
-		EventID:    "fresh",
-		ArchivedAt: time.Now(),
-	}
-
-	require.NoError(t, w.DB().Create(&old).Error)
-	require.NoError(t, w.DB().Create(&fresh).Error)
-
-	// Reopening with a one-hour expiry prunes the old row.
-	require.NoError(t, w.Reopen(time.Hour))
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "fresh", got[0].EventID)
-}
-
-func TestParseArchiveExpiry(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		in      string
-		want    time.Duration
-		wantErr bool
-	}{
-		{"empty config", "", 0, false},
-		{"explicit never", `{"expiry":"never"}`, 0, false},
-		{"empty expiry", `{"expiry":""}`, 0, false},
-		{"duration", `{"expiry":"1h"}`, time.Hour, false},
-		{"unparseable", `{"expiry":"nonsense"}`, 0, true},
-		{"zero duration", `{"expiry":"0s"}`, 0, true},
-		{"negative duration", `{"expiry":"-5h"}`, 0, true},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := delivery.ExportParseArchiveExpiry(tc.in)
-			if tc.wantErr {
-				require.Error(t, err)
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-// seedDatabaseTargetDelivery seeds a pending delivery for a
-// database target with the given config JSON and returns the
-// in-memory delivery the target handler is invoked with.
-func seedDatabaseTargetDelivery(
-	t *testing.T,
-	webhookDB *gorm.DB,
-	event database.Event,
-	config string,
-) *database.Delivery {
-	t.Helper()
-
-	dlv := seedDelivery(
-		t, webhookDB, event.ID, uuid.New().String(),
-		database.DeliveryStatusPending,
-	)
-
-	d := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: dlv.TargetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name:   "test-db",
-			Type:   database.TargetTypeDatabase,
-			Config: config,
-		},
-	}
-	d.ID = dlv.ID
-
-	return d
-}
-
-// TestDeliverDatabase_ArchiveFailureFailsDelivery verifies that
-// an archive error (here: an unparseable expiry in the target
-// config) fails the delivery loudly: the attempt is recorded as
-// failed with the error and the delivery is marked failed, not
-// delivered.
-func TestDeliverDatabase_ArchiveFailureFailsDelivery(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	dataDir := t.TempDir()
-
-	e := delivery.NewTestEngineWithDB(
-		nil, database.NewTestWebhookDBManager(dataDir),
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":false}`)
-	d := seedDatabaseTargetDelivery(
-		t, webhookDB, event, `{"expiry":"nonsense"}`,
-	)
-
-	e.ExportDeliverDatabase(webhookDB, d)
-
-	var updated database.Delivery
-
-	require.NoError(t, webhookDB.First(
-		&updated, "id = ?", d.ID,
-	).Error)
-	assert.Equal(t,
-		database.DeliveryStatusFailed, updated.Status,
-		"archive failure must mark the delivery failed",
-	)
-
-	var results []database.DeliveryResult
-
-	require.NoError(t, webhookDB.Where(
-		"delivery_id = ?", d.ID,
-	).Find(&results).Error)
-	require.Len(t, results, 1)
-	assert.False(t,
-		results[0].Success,
-		"the attempt must be recorded as failed",
-	)
-	assert.Contains(t,
-		results[0].Error, "nonsense",
-		"the archive error must be recorded on the attempt",
-	)
-
-	assert.NoFileExists(t,
-		filepath.Join(
-			dataDir,
-			fmt.Sprintf("archive-%s.db", event.WebhookID),
-		),
-		"no archive file should exist for a failed config",
-	)
-}
-
-func TestValidateArchiveExpiry(t *testing.T) {
-	t.Parallel()
-
-	valid := []string{"", "never", "1h", "720h", "30m"}
-	for _, in := range valid {
-		require.NoError(t,
-			delivery.ValidateArchiveExpiry(in),
-			"expiry %q should be accepted", in,
-		)
-	}
-
-	invalid := []string{"nonsense", "7d", "-5h", "0s", "0"}
-	for _, in := range invalid {
-		require.Error(t,
-			delivery.ValidateArchiveExpiry(in),
-			"expiry %q should be rejected", in,
-		)
-	}
-}

internal/delivery/target_http.go

@@ -495,5 +495,5 @@ func applyRequestHeaders(
 func executeHTTPRequest(
 	client *http.Client, req *http.Request,
 ) (*http.Response, error) {
-	return client.Do(req) //#nosec G704 -- validated URL, SSRF-safe transport
+	return client.Do(req) //#nosec G704 -- URL validated by parseHTTPConfig/parseSlackConfig and SSRF-safe transport
 }

internal/handlers/auth.go

@@ -19,7 +19,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 
 		// Render login page
 		data := map[string]any{
-			tmplKeyError: "",
+			"Error": "",
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -86,7 +86,7 @@ func (h *Handlers) renderLoginError(
 	status int,
 ) {
 	data := map[string]any{
-		tmplKeyError: msg,
+		"Error": msg,
 	}
 
 	w.WriteHeader(status)

internal/handlers/export_test.go

@@ -13,26 +13,12 @@ func (s *Handlers) RenderTemplateForTest(
 	s.renderTemplate(w, r, pageTemplate, data)
 }
 
-// BuildSlackTargetConfigForTest exposes buildURLTargetConfig
-// with the Slack target parameters for use in the
-// handlers_test package.
+// BuildSlackTargetConfigForTest exposes buildSlackTargetConfig
+// for use in the handlers_test package.
 func (s *Handlers) BuildSlackTargetConfigForTest(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetURL string,
 ) (string, error) {
-	return s.buildURLTargetConfig(
-		w, r, targetURL, "webhookUrl",
-		"Webhook URL is required for Slack targets",
-	)
-}
-
-// BuildDatabaseTargetConfigForTest exposes
-// buildDatabaseTargetConfig for use in the handlers_test
-// package.
-func (s *Handlers) BuildDatabaseTargetConfigForTest(
-	w http.ResponseWriter,
-	expiry string,
-) (string, error) {
-	return s.buildDatabaseTargetConfig(w, expiry)
+	return s.buildSlackTargetConfig(w, r, targetURL)
 }

internal/handlers/handlers.go

@@ -30,11 +30,6 @@ const (
 	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
-
-	// tmplKeyError is the template data key for an error message.
-	tmplKeyError = "Error"
-	// tmplKeyWebhook is the template data key for a webhook.
-	tmplKeyWebhook = "Webhook"
 )
 
 // errInvalidPassword is returned when a password does not match.

internal/handlers/handlers_test.go

@@ -186,57 +186,3 @@ func TestRenderTemplate(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 	)
 }
-
-func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	// Empty expiry: the keep-forever default, empty config.
-	w := httptest.NewRecorder()
-	cfg, err := h.BuildDatabaseTargetConfigForTest(w, "")
-	require.NoError(t, err)
-	assert.Empty(t, cfg)
-
-	// Explicit never is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "never")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
-
-	// A positive duration is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "720h")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
-}
-
-func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	for _, bad := range []string{"nonsense", "7d", "-5h"} {
-		w := httptest.NewRecorder()
-		cfg, err := h.BuildDatabaseTargetConfigForTest(w, bad)
-
-		require.Error(t, err, "expiry %q", bad)
-		assert.Empty(t, cfg)
-		assert.Equal(
-			t, http.StatusBadRequest, w.Code,
-			"expiry %q should be rejected with 400", bad,
-		)
-	}
-}

internal/handlers/source_management.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net/http"
 	"strconv"
-	"strings"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -107,7 +106,7 @@ func (h *Handlers) buildWebhookListItems(
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		data := map[string]any{
-			tmplKeyError: "",
+			"Error": "",
 		}
 
 		h.renderTemplate(w, r, "sources_new.html", data)
@@ -146,7 +145,7 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 
 		if name == "" {
 			data := map[string]any{
-				tmplKeyError: "Name is required",
+				"Error": "Name is required",
 			}
 
 			w.WriteHeader(http.StatusBadRequest)
@@ -316,7 +315,7 @@ func (h *Handlers) renderSourceDetail(
 	}
 
 	data := map[string]any{
-		tmplKeyWebhook: webhook,
+		"Webhook":     webhook,
 		"Entrypoints": entrypoints,
 		"Targets":     targets,
 		"Events":      events,
@@ -352,8 +351,8 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: webhook,
-			tmplKeyError:   "",
+			"Webhook": webhook,
+			"Error":   "",
 		}
 
 		h.renderTemplate(w, r, "source_edit.html", data)
@@ -416,8 +415,8 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			tmplKeyWebhook: *webhook,
-			tmplKeyError:   "Name is required",
+			"Webhook": *webhook,
+			"Error":   "Name is required",
 		}
 
 		w.WriteHeader(http.StatusBadRequest)
@@ -590,7 +589,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			"Webhook":     webhook,
 			"Events":      evts,
 			"Page":        page,
 			"TotalPages":  totalPages,
@@ -816,7 +815,6 @@ func (h *Handlers) processTargetCreate(
 	targetType := database.TargetType(r.FormValue("type"))
 	targetURL := r.FormValue("url")
 	maxRetriesStr := r.FormValue("max_retries")
-	expiry := r.FormValue("expiry")
 
 	if name == "" {
 		http.Error(
@@ -836,7 +834,7 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	configJSON, err := h.buildTargetConfig(
-		w, r, targetType, targetURL, expiry,
+		w, r, targetType, targetURL,
 	)
 	if err != nil {
 		return
@@ -894,28 +892,18 @@ func parseNonNegativeInt(s string) int {
 }
 
 // buildTargetConfig builds the JSON config string for a target.
-// The expiry form value is read by the caller (which bounds the
-// request body) and applies to database targets only.
 func (h *Handlers) buildTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetType database.TargetType,
-	targetURL, expiry string,
+	targetURL string,
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
-		return h.buildURLTargetConfig(
-			w, r, targetURL, "url",
-			"URL is required for HTTP targets",
-		)
+		return h.buildHTTPTargetConfig(w, r, targetURL)
 	case database.TargetTypeSlack:
-		return h.buildURLTargetConfig(
-			w, r, targetURL, "webhookUrl",
-			"Webhook URL is required for Slack targets",
-		)
-	case database.TargetTypeDatabase:
-		return h.buildDatabaseTargetConfig(w, expiry)
-	case database.TargetTypeLog:
+		return h.buildSlackTargetConfig(w, r, targetURL)
+	case database.TargetTypeDatabase, database.TargetTypeLog:
 		return "", nil
 	default:
 		http.Error(
@@ -927,18 +915,16 @@ func (h *Handlers) buildTargetConfig(
 	}
 }
 
-// buildURLTargetConfig builds config JSON for a target whose
-// configuration is a single SSRF-validated URL stored under
-// configKey. missingMsg is the error shown when no URL is given.
-func (h *Handlers) buildURLTargetConfig(
+// buildHTTPTargetConfig builds config JSON for an HTTP target.
+func (h *Handlers) buildHTTPTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
-	targetURL, configKey, missingMsg string,
+	targetURL string,
 ) (string, error) {
 	if targetURL == "" {
 		http.Error(
 			w,
-			missingMsg,
+			"URL is required for HTTP targets",
 			http.StatusBadRequest,
 		)
 
@@ -963,7 +949,7 @@ func (h *Handlers) buildURLTargetConfig(
 		return "", err
 	}
 
-	cfg := map[string]any{configKey: targetURL}
+	cfg := map[string]any{"url": targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
@@ -978,33 +964,41 @@ func (h *Handlers) buildURLTargetConfig(
 	return string(configBytes), nil
 }
 
-// buildDatabaseTargetConfig builds config JSON for a database
-// (archive) target. The optional expiry (a form value read by
-// the caller, which bounds the request body) is validated here,
-// at creation time, so an unparseable value is rejected with a
-// 400 instead of failing every subsequent delivery. An empty
-// expiry yields an empty config (the keep-forever default).
-func (h *Handlers) buildDatabaseTargetConfig(
+// buildSlackTargetConfig builds config JSON for a Slack target.
+func (h *Handlers) buildSlackTargetConfig(
 	w http.ResponseWriter,
-	expiry string,
+	r *http.Request,
+	targetURL string,
 ) (string, error) {
-	expiry = strings.TrimSpace(expiry)
-	if expiry == "" {
-		return "", nil
-	}
-
-	err := delivery.ValidateArchiveExpiry(expiry)
-	if err != nil {
+	if targetURL == "" {
 		http.Error(
 			w,
-			"Invalid archive expiry: "+err.Error(),
+			"Webhook URL is required for Slack targets",
+			http.StatusBadRequest,
+		)
+
+		return "", errMissingURL
+	}
+
+	err := delivery.ValidateTargetURL(
+		r.Context(), targetURL,
+	)
+	if err != nil {
+		h.log.Warn(
+			"target URL blocked by SSRF protection",
+			"url", targetURL,
+			"error", err,
+		)
+		http.Error(
+			w,
+			"Invalid target URL: "+err.Error(),
 			http.StatusBadRequest,
 		)
 
 		return "", err
 	}
 
-	cfg := map[string]any{"expiry": expiry}
+	cfg := map[string]any{"webhookUrl": targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {

internal/middleware/middleware_test.go

@@ -484,13 +484,8 @@ func metricsAuthMiddleware(
 	return middleware.NewForTest(log, cfg, sessManager)
 }
 
-// runMetricsAuthRequest sends a GET /metrics request with the
-// given basic-auth password through MetricsAuth and reports
-// whether the wrapped handler ran plus the recorded response.
-func runMetricsAuthRequest(
-	t *testing.T, password string,
-) (bool, *httptest.ResponseRecorder) {
-	t.Helper()
+func TestMetricsAuth_ValidCredentials(t *testing.T) {
+	t.Parallel()
 
 	m := metricsAuthMiddleware(t)
 
@@ -508,20 +503,12 @@ func runMetricsAuthRequest(
 		context.Background(),
 		http.MethodGet, "/metrics", nil,
 	)
-	req.SetBasicAuth("admin", password)
+	req.SetBasicAuth("admin", "secret")
 
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	return called, w
-}
-
-func TestMetricsAuth_ValidCredentials(t *testing.T) {
-	t.Parallel()
-
-	called, w := runMetricsAuthRequest(t, "secret")
-
 	assert.True(
 		t, called,
 		"handler should be called with valid basic auth",
@@ -532,7 +519,27 @@ func TestMetricsAuth_ValidCredentials(t *testing.T) {
 func TestMetricsAuth_InvalidCredentials(t *testing.T) {
 	t.Parallel()
 
-	called, w := runMetricsAuthRequest(t, "wrong-password")
+	m := metricsAuthMiddleware(t)
+
+	var called bool
+
+	handler := m.MetricsAuth()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/metrics", nil,
+	)
+	req.SetBasicAuth("admin", "wrong-password")
+
+	w := httptest.NewRecorder()
+
+	handler.ServeHTTP(w, req)
 
 	assert.False(
 		t, called,

internal/middleware/ratelimit.go

@@ -14,6 +14,11 @@ const (
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
+
+	// receiverRateInterval is the time window for the webhook
+	// receiver rate limit. The configured limit is expressed in
+	// requests per minute.
+	receiverRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -62,3 +67,37 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 		})
 	}
 }
+
+// ReceiverRateLimit returns middleware that rate-limits the
+// public webhook receiver endpoint per client IP per request
+// path (the path contains the entrypoint UUID, so each sender
+// is limited per entrypoint without affecting other senders or
+// other entrypoints). The limit is Config.ReceiverRateLimit
+// requests per minute. Requests over the limit receive a 429;
+// httprate adds the Retry-After header (RFC 6585). IP
+// extraction honours X-Forwarded-For, X-Real-IP, and
+// True-Client-IP headers for reverse-proxy setups.
+func (m *Middleware) ReceiverRateLimit() func(http.Handler) http.Handler {
+	return httprate.Limit(
+		m.params.Config.ReceiverRateLimit,
+		receiverRateInterval,
+		httprate.WithKeyFuncs(
+			httprate.KeyByRealIP,
+			httprate.KeyByEndpoint,
+		),
+		httprate.WithLimitHandler(http.HandlerFunc(
+			func(w http.ResponseWriter, r *http.Request) {
+				m.log.Warn(
+					"webhook receiver rate limit exceeded",
+					"path", r.URL.Path,
+				)
+				http.Error(
+					w,
+					"Too many requests. "+
+						"Please slow down.",
+					http.StatusTooManyRequests,
+				)
+			},
+		)),
+	)
+}

internal/middleware/ratelimit_test.go

@@ -2,8 +2,10 @@ package middleware_test
 
 import (
 	"context"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -145,3 +147,94 @@ func TestLoginRateLimit_IndependentPerIP(t *testing.T) {
 		"different IP should not be affected",
 	)
 }
+
+// receiverLimitedHandler builds a ReceiverRateLimit-wrapped
+// handler with the given per-minute limit.
+func receiverLimitedHandler(
+	t *testing.T, limit int,
+) http.Handler {
+	t.Helper()
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+
+	m := middleware.NewForTest(
+		log,
+		&config.Config{ReceiverRateLimit: limit},
+		nil,
+	)
+
+	return m.ReceiverRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+}
+
+// receiverPost sends one POST to the handler from the given IP
+// and path and returns the recorder.
+func receiverPost(
+	handler http.Handler, ip, path string,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, path, nil,
+	)
+	req.RemoteAddr = ip
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	return w
+}
+
+func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
+	t.Parallel()
+
+	const limit = 3
+
+	handler := receiverLimitedHandler(t, limit)
+
+	// The first limit requests from one IP to one entrypoint
+	// pass.
+	for i := range limit {
+		w := receiverPost(
+			handler, "9.9.9.9:1234", "/webhook/uuid-a",
+		)
+		assert.Equal(
+			t, http.StatusOK, w.Code,
+			"request %d should pass", i,
+		)
+	}
+
+	// The next request over the limit is rejected with a 429
+	// carrying a Retry-After header.
+	w := receiverPost(
+		handler, "9.9.9.9:1234", "/webhook/uuid-a",
+	)
+	assert.Equal(t, http.StatusTooManyRequests, w.Code)
+	assert.NotEmpty(
+		t, w.Header().Get("Retry-After"),
+		"429 must carry a Retry-After header",
+	)
+
+	// The same IP is not limited on a different entrypoint.
+	w = receiverPost(
+		handler, "9.9.9.9:1234", "/webhook/uuid-b",
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a different entrypoint must not be affected",
+	)
+
+	// A different IP is not limited on the same entrypoint.
+	w = receiverPost(
+		handler, "8.8.8.8:1234", "/webhook/uuid-a",
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a different client IP must not be affected",
+	)
+}

internal/server/routes.go

@@ -159,7 +159,7 @@ func (s *Server) setupSourceRoutes() {
 }
 
 func (s *Server) setupWebhookRoutes() {
-	s.router.HandleFunc(
+	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
 		"/webhook/{uuid}",
 		s.h.HandleWebhook(),
 	)

internal/session/session_test.go

@@ -173,18 +173,8 @@ func TestSetUser_SetsAllFields(t *testing.T) {
 	)
 }
 
-// testSessionGetter exercises a session string getter before and
-// after SetUser: it must report false with an empty value on a
-// fresh session, then true with the expected value once
-// SetUser(sess, "user-xyz", "bob") has run.
-func testSessionGetter(
-	t *testing.T,
-	get func(
-		*session.Session, *sessions.Session,
-	) (string, bool),
-	expected string,
-) {
-	t.Helper()
+func TestGetUserID(t *testing.T) {
+	t.Parallel()
 
 	s := testSession(t)
 
@@ -195,46 +185,44 @@ func testSessionGetter(
 	require.NoError(t, err)
 
 	// Before setting user
-	val, ok := get(s, sess)
+	userID, ok := s.GetUserID(sess)
 	assert.False(
-		t, ok, "should return false before SetUser",
+		t, ok, "should return false when no user ID is set",
 	)
-	assert.Empty(t, val)
+	assert.Empty(t, userID)
 
 	// After setting user
 	s.SetUser(sess, "user-xyz", "bob")
 
-	val, ok = get(s, sess)
+	userID, ok = s.GetUserID(sess)
 	assert.True(t, ok)
-	assert.Equal(t, expected, val)
-}
-
-func TestGetUserID(t *testing.T) {
-	t.Parallel()
-
-	testSessionGetter(
-		t,
-		func(
-			s *session.Session, sess *sessions.Session,
-		) (string, bool) {
-			return s.GetUserID(sess)
-		},
-		"user-xyz",
-	)
+	assert.Equal(t, "user-xyz", userID)
 }
 
 func TestGetUsername(t *testing.T) {
 	t.Parallel()
 
-	testSessionGetter(
-		t,
-		func(
-			s *session.Session, sess *sessions.Session,
-		) (string, bool) {
-			return s.GetUsername(sess)
-		},
-		"bob",
+	s := testSession(t)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	sess, err := s.Get(req)
+	require.NoError(t, err)
+
+	// Before setting user
+	username, ok := s.GetUsername(sess)
+	assert.False(
+		t, ok, "should return false when no username is set",
 	)
+	assert.Empty(t, username)
+
+	// After setting user
+	s.SetUser(sess, "user-xyz", "bob")
+
+	username, ok = s.GetUsername(sess)
+	assert.True(t, ok)
+	assert.Equal(t, "bob", username)
 }
 
 // --- IsAuthenticated Tests ---

internal/session/testing.go

@@ -12,12 +12,7 @@ import (
 // middleware and handler tests to use real session functionality. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
-func NewForTest(
-	store *sessions.CookieStore,
-	cfg *config.Config,
-	log *slog.Logger,
-	key []byte,
-) *Session {
+func NewForTest(store *sessions.CookieStore, cfg *config.Config, log *slog.Logger, key []byte) *Session {
 	return &Session{
 		store:  store,
 		key:    key,

script/bootstrap

@@ -10,11 +10,11 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-08-07. Never "latest"; exact versions only.
-GOLANGCI_LINT_VERSION="2.12.2"
-# sha256 of golangci-lint-2.12.2-linux-<arch>.tar.gz release archives
-GOLANGCI_LINT_SHA256_AMD64="8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
-GOLANGCI_LINT_SHA256_ARM64="44cd40a8c76c86755375adfeea52cfd3533cb43d7bd647771e0ae065e166df3a"
+# Pinned versions, 2026-07-07. Never "latest"; exact versions only.
+GOLANGCI_LINT_VERSION="2.11.3"
+# sha256 of golangci-lint-2.11.3-linux-<arch>.tar.gz release archives
+GOLANGCI_LINT_SHA256_AMD64="87bb8cddbcc825d5778b64e8a91b46c0526b247f4e2f2904dea74ec7450475d1"
+GOLANGCI_LINT_SHA256_ARM64="ee3d95f301359e7d578e6d99c8ad5aeadbabc5a13009a30b2b0df11c8058afe9"
 
 PKGMGR=""
 SUDO=""

templates/source_detail.html

@@ -113,10 +113,6 @@
                         <input type="url" name="url" placeholder="https://hooks.slack.com/services/..." :disabled="targetType !== 'slack'" class="input text-sm">
                         <p class="text-xs text-gray-500 mt-1">Slack or Mattermost incoming webhook URL. Payloads are pretty-printed in code blocks.</p>
                     </div>
-                    <div x-show="targetType === 'database'">
-                        <input type="text" name="expiry" placeholder="never" :disabled="targetType !== 'database'" class="input text-sm">
-                        <p class="text-xs text-gray-500 mt-1">Archive expiry: "never" (default) keeps rows forever, or a duration like "720h" prunes older rows.</p>
-                    </div>
                     <button type="submit" class="btn-primary text-sm">Add Target</button>
                 </form>
             </div>