Name each database target's archive for its webhook and target (closes #376)

Each database target now has its own archive file,
archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, instead of one
archive-WEBHOOKID.db per webhook. delivery.ArchiveFileName builds the
name: each name is lowercased, keeps ASCII letters and digits, turns
every other run of characters into one dash, and is cut to 40
characters.

A change of webhook or target name renames its archive files under the
archive writer's lock, before the new name is saved, and back again if
the save fails. A rename never replaces a file, and one that fails part
way moves back what it moved. Deleting a target evicts only that
target's writer. Archive files are never deleted, and nothing looks for
files under the old name.

Model: opus-5-5

README.md

@@ -158,20 +158,19 @@ WireServer, which serves an Azure VM its credentials. Because it is a
 public address, listing it in `ALLOWED_EGRESS_CIDRS` reopens it.
 
 That is all the default blocklist covers: the IPv4 private and reserved
-ranges; of IPv6, only loopback (`::1`), the unspecified address (`::`),
+ranges; of IPv6, only loopback (`::1`), unique local addresses
-unique local addresses (`fc00::/7`), link-local addresses (`fe80::/10`),
+(`fc00::/7`) and link-local addresses (`fe80::/10`); and certain public
-multicast (`ff00::/8`) and documentation space (`2001:db8::/32`); and
+addresses. A public address belongs on the default blocklist only if it
-certain public addresses. A public address belongs on the default
+hands credentials, user data or bootstrap material to whatever can reach
-blocklist only if it hands credentials, user data or bootstrap material
+it, without the caller presenting anything. A provider's other public
-to whatever can reach it, without the caller presenting anything. A
+addresses are not refused. IBM Cloud, for example, serves its package
-provider's other public addresses are not refused. IBM Cloud, for
+mirrors, time servers and object storage on `161.26.0.0/16`, and the
-example, serves its package mirrors, time servers and object storage on
+private endpoints of its own cloud services on `166.8.0.0/14`. Neither
-`161.26.0.0/16`, and the private endpoints of its own cloud services on
+range hands out credentials that way: the token service among those
-`166.8.0.0/14`. Neither range hands out credentials that way: the token
+endpoints issues a token only in exchange for something the caller
-service among those endpoints issues a token only in exchange for
+presents, such as an API key. Reaching these services can be a
-something the caller presents, such as an API key. Reaching these
+legitimate delivery, and every cloud has some, so a partial list would
-services can be a legitimate delivery, and every cloud has some, so a
+promise coverage it does not give.
-partial list would promise coverage it does not give.
 
 That default is also inconvenient for the thing webhooker is mostly
 for: taking a public webhook and forwarding it to something on your own
@@ -211,16 +210,16 @@ Two things this setting cannot do:
   the list is always an allowlist; an empty list (the default) means
   every private and reserved range stays refused. Note that
   `0.0.0.0/0` gets you most of the way there anyway, per above.
-- **It cannot open link-local, the unspecified addresses, or a cloud
+- **It cannot open link-local, or a cloud metadata endpoint at a
-  metadata endpoint at a non-public address that discloses credentials
+  non-public address that discloses credentials or user data.** An
-  or user data.** A metadata address is on the list below when it is not
+  address is on the list below when it is not a public address and both
-  a public address and both of these hold: the provider fixes it, so it
+  of these hold: the provider fixes it, so it cannot collide with
-  cannot collide with anything you run; and reaching it hands out
+  anything you run; and reaching it hands out credentials, user data or
-  credentials, user data or bootstrap material. Those stay blocked no
+  bootstrap material. Those stay blocked no matter what you list,
-  matter what you list, including when you list them outright or list a
+  including when you list them outright or list a supernet such as
-  supernet such as `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`.
+  `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`. Treat this as best
-  Treat this as best effort rather than a guarantee — it is a
+  effort rather than a guarantee — it is a hand-maintained list and the
-  hand-maintained list and the caveat below the table applies:
+  caveat below the table applies:
 
   | Blocked unconditionally | What it is |
   | ----------------------- | ---------- |
@@ -234,25 +233,14 @@ Two things this setting cannot do:
   | `fd00:a9fe:a9fe::1/128` | Linode/Akamai metadata over IPv6 |
   | `100.100.100.200/32` | Alibaba Cloud metadata, inside CGNAT |
   | `192.0.0.192/32` | Oracle Cloud Classic metadata |
-  | `0.0.0.0/32` | IPv4 unspecified address, which reaches this host's loopback on Linux |
-  | `::/128` | IPv6 unspecified address, which reaches this host's loopback on Linux |
   | `::a9fe:a9fe/128` | `169.254.169.254` as an IPv4-compatible IPv6 address |
   | `64:ff9b::a9fe:a9fe/128` | `169.254.169.254` behind the NAT64 well-known prefix |
 
   The IPv4-mapped form `::ffff:169.254.169.254` is covered by the
-  `169.254.0.0/16` entry. Reaching any of these but the two unspecified
+  `169.254.0.0/16` entry. Reaching any of these is credential or
-  addresses is credential or user-data theft rather than delivery to an
+  user-data theft rather than delivery to an internal service. Every
-  internal service. Every entry outside the two link-local blocks is a
+  entry outside the two link-local blocks is a single address, so
-  single address, so blocking it costs you nothing else on the network
+  blocking it costs you nothing else on the network around it.
-  around it.
-
-  The unspecified addresses `0.0.0.0` and `::` hand out nothing
-  themselves, but no host can have either, and on Linux a connection to
-  one reaches this host's own loopback. They are listed so that an
-  allowlist reaches loopback only through an entry that covers a loopback
-  address, such as `127.0.0.0/8`, `::1` or `0.0.0.0/0`, never through one
-  that covers only `0.0.0.0` or `::`; `0.0.0.0/8`, for example, does not
-  open loopback.
 
   The six ULA entries, all inside `fd00::/8`, are why this matters in
   practice: `fd00::/8` is an ordinary block to allowlist for your own
@@ -3135,8 +3123,7 @@ check, see [The login endpoint](#the-login-endpoint).
   route through a single decision function, so they cannot disagree
   about a destination. An operator can permit specific blocks with
   [`ALLOWED_EGRESS_CIDRS`](#allowing-egress-to-your-own-network); the
-  guard cannot be switched off, and link-local, the unspecified
+  guard cannot be switched off, and link-local plus a
-  addresses `0.0.0.0` and `::`, and a
   [pinned set](#allowing-egress-to-your-own-network) of known cloud
   metadata endpoints — several of which are ULAs outside link-local —
   stay blocked whatever is listed, though listing `0.0.0.0/0` or

internal/config/config.go

@@ -196,13 +196,12 @@ type Config struct {
 	// otherwise refuse. The guard itself is always on: there is no
 	// setting that disables SSRF protection, and delivery's
 	// alwaysBlockedNetworks stays blocked no matter what is listed
-	// here. That set is link-local, the unspecified addresses
+	// here. That set is link-local plus the cloud metadata
-	// 0.0.0.0 and ::, and the cloud metadata endpoints outside
+	// endpoints outside it that disclose credentials or user data
-	// link-local that disclose credentials or user data at a
+	// at a provider-fixed, non-public address; it is not
-	// provider-fixed, non-public address; it is not exhaustive of
+	// exhaustive of every cloud's metadata address. See
-	// every cloud's metadata address. See
+	// alwaysBlockedNetworks for the authoritative list and the
-	// alwaysBlockedNetworks for the authoritative list and why
+	// criterion it is built from.
-	// each entry is on it.
 	AllowedEgressCIDRs []netip.Prefix
 
 	params *ConfigParams

internal/config/config_test.go

@@ -124,11 +124,6 @@ func testEnvironmentConfigSuccess(
 
 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned. The same holds for every fxtest.New
-		// below.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -277,7 +272,6 @@ func testRetentionSweepIntervalSuccess(
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -370,7 +364,6 @@ func testSessionIdleTimeoutSuccess(
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -411,7 +404,6 @@ func TestDefaultDataDir(t *testing.T) {
 
 			app := fxtest.New(
 				t,
-				fx.NopLogger,
 				fx.Provide(
 					globals.New,
 					logger.New,
@@ -542,7 +534,6 @@ func testReceiverRateLimitSuccess(
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -659,7 +650,6 @@ func testTrustedProxiesSuccess(
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -773,7 +763,6 @@ func testAllowedEgressCIDRsSuccess(
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -1017,7 +1006,6 @@ func assertMetricsAuthAccepted(t *testing.T, expectAuth bool) {
 
 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(globals.New, logger.New, config.New),
 		fx.Populate(&cfg),
 	)

internal/delivery/ssrf.go

@@ -37,8 +37,8 @@ var (
 		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
-		"blocked link-local, cloud instance metadata or " +
+		"blocked link-local or cloud instance metadata " +
-			"unspecified address: ALLOWED_EGRESS_CIDRS cannot open it",
+			"address: ALLOWED_EGRESS_CIDRS cannot open it",
 	)
 	errInvalidScheme = errors.New(
 		"only http and https are allowed",
@@ -72,17 +72,14 @@ var blockedNetworks []*net.IPNet
 var blockedPublicNetworks []*net.IPNet
 
 // alwaysBlockedNetworks are the ranges no configuration can
-// open, so a supplied CIDR that covers one still leaves it
+// open: the link-local blocks and the cloud instance metadata
-// blocked. An entry is here for one of two reasons: it is a
+// endpoints that live outside them. Reaching one is credential
-// metadata endpoint (the link-local blocks and the cloud
+// or user-data theft rather than delivery to an internal
-// instance metadata endpoints that live outside them), or it is
+// service, so a supplied CIDR that covers such an address still
-// an unspecified address. Reaching a metadata endpoint is
+// leaves it blocked.
-// credential or user-data theft rather than delivery to an
-// internal service.
 //
-// Inclusion criterion for metadata endpoints — one belongs here
+// Inclusion criterion — an address belongs here only if BOTH
-// only if BOTH hold, and every metadata entry below satisfies
+// hold, and every entry below satisfies both:
-// both:
 //
 //  1. It is a fixed address assigned by the provider, or a
 //     range reserved by IANA — never one the operator chose.
@@ -93,8 +90,8 @@ var blockedPublicNetworks []*net.IPNet
 //     not cheaply rotated.
 //
 // Both halves are load-bearing, so use them to refuse a
-// metadata candidate and say why. An endpoint disclosing only
+// candidate and say why. An endpoint disclosing only the
-// the operator's own inventory (instance id, region, disks, NICs)
+// operator's own inventory (instance id, region, disks, NICs)
 // fails (2): letting a delivery target reach the operator's own
 // infrastructure is the feature ALLOWED_EGRESS_CIDRS exists to
 // provide. But (2) is not "IAM credentials only" either —
@@ -115,15 +112,6 @@ var blockedPublicNetworks []*net.IPNet
 // This is a criterion, not an enumeration of every metadata
 // address in existence.
 //
-// The unspecified addresses 0.0.0.0 and :: are here for a
-// separate reason: they disclose nothing, but no host can have
-// either, and on Linux a connection to one reaches this host's
-// own loopback. Listing them means an allowlist reaches loopback
-// only through an entry that covers a loopback address
-// (127.0.0.0/8, ::1/128, 0.0.0.0/0), never through one that
-// covers only 0.0.0.0 or :: (0.0.0.0/8, for example). Nothing
-// else lives at either address, so refusing them costs nothing.
-//
 // Every entry is either already in blockedNetworks — this list is
 // what makes it unconditional — or an alternate encoding of
 // 169.254.169.254 that Contains does not match against
@@ -143,46 +131,23 @@ var alwaysBlockedNetworks []*net.IPNet
 //nolint:gochecknoinits // init is the idiomatic way to parse CIDRs once at startup
 func init() {
 	blockedNetworks = mustParseCIDRs([]string{
-		// IPv4 loopback.
 		"127.0.0.0/8",
-		// RFC 1918 private network.
 		"10.0.0.0/8",
-		// RFC 1918 private network.
 		"172.16.0.0/12",
-		// RFC 1918 private network.
 		"192.168.0.0/16",
-		// IPv4 link-local.
 		"169.254.0.0/16",
-		// "This network", holding the IPv4 unspecified address 0.0.0.0.
 		"0.0.0.0/8",
-		// Carrier-grade NAT shared address space.
 		"100.64.0.0/10",
-		// IETF protocol assignments.
 		"192.0.0.0/24",
-		// IPv4 documentation (TEST-NET-1).
 		"192.0.2.0/24",
-		// Benchmarking.
 		"198.18.0.0/15",
-		// IPv4 documentation (TEST-NET-2).
 		"198.51.100.0/24",
-		// IPv4 documentation (TEST-NET-3).
 		"203.0.113.0/24",
-		// IPv4 multicast.
 		"224.0.0.0/4",
-		// Reserved, including the broadcast address.
 		"240.0.0.0/4",
-		// IPv6 loopback.
 		"::1/128",
-		// IPv6 unspecified address.
-		"::/128",
-		// IPv6 unique local addresses.
 		"fc00::/7",
-		// IPv6 link-local.
 		"fe80::/10",
-		// IPv6 multicast.
-		"ff00::/8",
-		// IPv6 documentation.
-		"2001:db8::/32",
 	})
 
 	blockedPublicNetworks = mustParseCIDRs([]string{
@@ -242,14 +207,6 @@ func init() {
 		// allowlist from opening it.
 		"192.0.0.192/32",
 
-		// The unspecified addresses, each of which reaches this
-		// host's loopback on Linux.
-		//
-		// IPv4 unspecified address, inside the blocked 0.0.0.0/8.
-		"0.0.0.0/32",
-		// IPv6 unspecified address.
-		"::/128",
-
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -386,9 +343,8 @@ func (g *Guard) allows(ip net.IP) bool {
 // The order is the policy:
 //
 //  1. alwaysBlockedNetworks is refused before the allowlist is
-//     consulted, so no configured CIDR reaches link-local, a
+//     consulted, so no configured CIDR reaches link-local or a
-//     cloud metadata endpoint at a non-public address, or an
+//     cloud metadata endpoint at a non-public address.
-//     unspecified address.
 //  2. The allowlist is consulted next, so a listed private
 //     network, or a listed public address on the default
 //     blocklist, becomes reachable.

internal/delivery/ssrf_allowlist_test.go

@@ -168,13 +168,12 @@ func TestGuardAllowlist_UnlistedPrivateStillRefused(t *testing.T) {
 
 // TestGuardAllowlist_MetadataAlwaysRefused is the load-bearing
 // case: cloud instance metadata endpoints are credential theft
-// rather than delivery to an internal service, and the
+// rather than delivery to an internal service, so no allowlist
-// unspecified addresses 0.0.0.0 and :: reach this host's loopback
+// reaches one. Every guard below names a CIDR that covers its
-// on Linux, so no allowlist reaches any of them. Every guard
+// target — including 0.0.0.0/0, ::/0, and the ordinary ULA and
-// below names a CIDR that covers its target — including
+// CGNAT blocks an operator would really list — and the address
-// 0.0.0.0/0, ::/0, and the ordinary ULA and CGNAT blocks an
+// must stay refused anyway, on both the validation and the
-// operator would really list — and the address must stay
+// delivery path.
-// refused anyway, on both the validation and the delivery path.
 func TestGuardAllowlist_MetadataAlwaysRefused(t *testing.T) {
 	t.Parallel()
 
@@ -220,17 +219,15 @@ type metadataAlwaysRefusedCase struct {
 }
 
 // metadataAlwaysRefusedCases enumerates every unconditionally
-// blocked address (link-local, the cloud metadata endpoints and
+// blocked address together with an allowlist entry that would
-// the unspecified addresses) together with an allowlist entry
+// otherwise reach it. Split by family of address only to stay
-// that would otherwise reach it. Split by family of address only
+// under the function-length limit.
-// to stay under the function-length limit.
 func metadataAlwaysRefusedCases() []metadataAlwaysRefusedCase {
 	cases := linkLocalRefusedCases()
 	cases = append(cases, ulaMetadataRefusedCases()...)
 	cases = append(cases, ipv4MetadataRefusedCases()...)
-	cases = append(cases, encodedMetadataRefusedCases()...)
 
-	return append(cases, unspecifiedRefusedCases()...)
+	return append(cases, encodedMetadataRefusedCases()...)
 }
 
 // linkLocalRefusedCases covers the link-local blocks, including
@@ -370,23 +367,6 @@ func encodedMetadataRefusedCases() []metadataAlwaysRefusedCase {
 	}
 }
 
-// unspecifiedRefusedCases covers the unspecified addresses, each
-// of which reaches this host's loopback on Linux.
-func unspecifiedRefusedCases() []metadataAlwaysRefusedCase {
-	return []metadataAlwaysRefusedCase{
-		{
-			name:   "IPv4 unspecified address under 0.0.0.0/0",
-			allow:  allowAllIPv4,
-			target: "http://0.0.0.0:8080/hook",
-		},
-		{
-			name:   "IPv6 unspecified address under ::/0",
-			allow:  allowAllIPv6,
-			target: "http://[::]:8080/hook",
-		},
-	}
-}
-
 // TestGuardAllowlist_PublicUnaffected asserts the allowlist does
 // not narrow anything: public addresses were reachable before it
 // existed and stay reachable, whether or not a list is set.
@@ -544,10 +524,6 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 		// Oracle Cloud Classic metadata, inside the blocked
 		// 192.0.0.0/24.
 		"192.0.0.192/32",
-		// The IPv4 and IPv6 unspecified addresses, each of
-		// which reaches this host's loopback on Linux.
-		"0.0.0.0/32",
-		"::/128",
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -580,8 +556,7 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "172.16.0.0/12", reopenable: true},
 		{cidr: "192.168.0.0/16", reopenable: true},
 		{cidr: linkLocalIPv4, reopenable: false},
-		// Its first address, 0.0.0.0, is in the unconditional set.
+		{cidr: "0.0.0.0/8", reopenable: true},
-		{cidr: "0.0.0.0/8", reopenable: false},
 		{cidr: "100.64.0.0/10", reopenable: true},
 		{cidr: "192.0.0.0/24", reopenable: true},
 		{cidr: "192.0.2.0/24", reopenable: true},
@@ -591,11 +566,8 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "224.0.0.0/4", reopenable: true},
 		{cidr: "240.0.0.0/4", reopenable: true},
 		{cidr: "::1/128", reopenable: true},
-		{cidr: "::/128", reopenable: false},
 		{cidr: "fc00::/7", reopenable: true},
 		{cidr: "fe80::/10", reopenable: false},
-		{cidr: "ff00::/8", reopenable: true},
-		{cidr: "2001:db8::/32", reopenable: true},
 		{cidr: "168.63.129.16/32", public: true, reopenable: true},
 	}
 

internal/delivery/ssrf_test.go

@@ -101,42 +101,6 @@ func TestValidateTargetURL_Blocked(t *testing.T) {
 	}
 }
 
-// TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation
-// covers the unspecified addresses and the IPv6 multicast and
-// documentation ranges: with no allowlist set, each is refused
-// both when a target is created and when a delivery dials it.
-func TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	guard := delivery.NewTestGuard()
-
-	targets := []string{
-		// The unspecified addresses. On Linux a connection to
-		// either reaches this host's loopback.
-		"http://0.0.0.0:8080/hook",
-		"http://[::]:8080/hook",
-		// IPv6 multicast, all nodes.
-		"http://[ff02::1]/hook",
-		// IPv6 documentation.
-		"http://[2001:db8::1]/hook",
-	}
-
-	for _, target := range targets {
-		t.Run(target, func(t *testing.T) {
-			t.Parallel()
-
-			require.Error(t,
-				guard.ValidateTargetURL(context.Background(), target),
-				"%s must be refused at target creation", target,
-			)
-
-			assertDialRefused(t, guard, target)
-		})
-	}
-}
-
 func TestValidateTargetURL_Allowed(t *testing.T) {
 	t.Parallel()
 

internal/gormlog/firstboot_test.go

@@ -137,10 +137,6 @@ func bootAtDebug(t *testing.T, dataDir string) string {
 
 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/handlers/handlers_test.go

@@ -163,10 +163,6 @@ func newTestApp(
 
 	return fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/handlers/source_management.go

@@ -574,18 +574,17 @@ func (h *Handlers) applyWebhookEdit(
 	webhook.RetentionDays = retentionDays
 
 	// A new name renames the archive files before it is saved (see
-	// delivery.Engine.Rename). If either step fails, the same targets'
+	// delivery.Engine.Rename). If either step fails, they go back to
-	// archives go back to the name that is still stored, without
+	// the name that is still stored.
-	// reading the main database again.
+	err := h.renameWebhookArchives(webhook.ID, oldName, webhook.Name)
-	targets, err := h.renameWebhookArchives(
-		webhook.ID, oldName, webhook.Name,
-	)
 	if err == nil {
 		err = h.db.DB().Save(webhook).Error
 	}
 
 	if err != nil {
-		restoreErr := h.renameArchives(targets, oldName)
+		restoreErr := h.renameWebhookArchives(
+			webhook.ID, webhook.Name, oldName,
+		)
 		if restoreErr != nil {
 			h.log.Error(
 				"failed to rename archives back",
@@ -780,13 +779,14 @@ func (h *Handlers) evictTargetArchiveWriter(targetID string) {
 // renameWebhookArchives renames the archive file of every database
 // target of a webhook from the webhook name oldName to newName,
 // keeping each target's own name. It does nothing when the name is
-// unchanged. It returns the targets it read, so that a failed edit can
+// unchanged. It tries every target even after one fails, so that
-// move those same archives back with renameArchives.
+// moving the archives back after a failed edit leaves none under the
+// new name, and returns every failure joined.
 func (h *Handlers) renameWebhookArchives(
 	webhookID, oldName, newName string,
-) ([]database.Target, error) {
+) error {
 	if h.archives == nil || oldName == newName {
-		return nil, nil
+		return nil
 	}
 
 	var targets []database.Target
@@ -798,25 +798,14 @@ func (h *Handlers) renameWebhookArchives(
 		).
 		Find(&targets).Error
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return targets, h.renameArchives(targets, newName)
-}
-
-// renameArchives renames the archive file of each of the given
-// database targets to the webhook name webhookName, keeping each
-// target's own name. It tries every target even after one fails, so
-// that moving the archives back after a failed edit leaves none under
-// the new name, and returns every failure joined.
-func (h *Handlers) renameArchives(
-	targets []database.Target, webhookName string,
-) error {
 	var errs []error
 
 	for i := range targets {
-		err := h.archives.Rename(
+		err = h.archives.Rename(
-			targets[i].ID, webhookName, targets[i].Name,
+			targets[i].ID, newName, targets[i].Name,
 		)
 		if err != nil {
 			errs = append(errs, err)
@@ -1617,11 +1606,10 @@ func (h *Handlers) validateTargetURL(
 		msg := "Invalid target URL: " + err.Error()
 
 		// Only a private or reserved address's refusal says how
-		// to allow it. Other refusals never do: link-local, the
+		// to allow it. Metadata refusals never do: link-local and
-		// unspecified addresses and the unconditional metadata
+		// the other unconditional metadata addresses cannot be
-		// addresses cannot be opened, and the default
+		// opened, and the default blocklist's public addresses,
-		// blocklist's public addresses, which listing does open,
+		// which listing does open, hand out credentials.
-		// hand out credentials.
 		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
 			msg += ". Private and reserved addresses are refused " +
 				"by default; the server's ALLOWED_EGRESS_CIDRS " +

internal/handlers/source_management_test.go

@@ -612,12 +612,10 @@ func TestHandleSourceEditSubmit_FailedSaveRenamesBack(t *testing.T) {
 }
 
 // TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack proves
-// that when a webhook has three database targets and only the middle
+// that when a webhook has two database targets and only the second
-// one's archive cannot be renamed, the stored name stays and both
+// one's archive cannot be renamed, the first is renamed back and the
-// others are renamed back, the last one included: the move back does
+// stored name stays. Every target is tried in each direction, so this
-// not stop at the target it cannot rename. The handler reaches the
+// holds whichever order the two come in.
-// targets in the order they were created, which the exact sequence
-// below pins, so the refused target always comes before the last.
 func TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack(
 	t *testing.T,
 ) {
@@ -626,10 +624,9 @@ func TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack(
 	env := setupSourceTest(t)
 	wh := seedWebhookWithRetention(t, env.db, 7)
 	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
-	middle := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	second := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
-	last := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
 
-	env.archives.FailRenames(middle.ID, errNameTaken)
+	env.archives.FailRenames(second.ID, errNameTaken)
 
 	oldName := wh.Name
 	wh.Name = renamedWebhookName
@@ -644,15 +641,13 @@ func TestHandleSourceEditSubmit_FailedRenameRenamesTheOthersBack(
 	)
 	assert.Equal(t, oldName, stored.Name)
 
-	assert.Equal(
+	assert.ElementsMatch(
 		t,
 		[]archiveRename{
 			{first.ID, renamedWebhookName, first.Name},
-			{middle.ID, renamedWebhookName, middle.Name},
+			{second.ID, renamedWebhookName, second.Name},
-			{last.ID, renamedWebhookName, last.Name},
 			{first.ID, oldName, first.Name},
-			{middle.ID, oldName, middle.Name},
+			{second.ID, oldName, second.Name},
-			{last.ID, oldName, last.Name},
 		},
 		env.archives.Renames(),
 	)

internal/resetpw/resetpw_test.go

@@ -158,10 +158,6 @@ func newServerApp(
 
 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/server/routes_test.go

@@ -110,10 +110,6 @@ func newTestEnvWithConfig(
 
 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,