Show each webhook's activity in the webhook list (closes #394)

Each entry in the webhook list now shows when the webhook's last event
arrived, or "No events yet", and how many of its deliveries failed in
the last 24 hours, in red when that is not zero. The entrypoint and
target counts say how many are inactive.

The figures come from the statistics pane's own reads: the event totals
row, which now also gives the event count, shown as events within
retention, instead of counting every stored event, and the pane's query
over the deliveries finished in the last 24 hours. A webhook whose event
database cannot be read says so in its entry rather than showing zeros.

Model: opus-5-5

README.md

@@ -158,19 +158,20 @@ WireServer, which serves an Azure VM its credentials. Because it is a
 public address, listing it in `ALLOWED_EGRESS_CIDRS` reopens it.
 
 That is all the default blocklist covers: the IPv4 private and reserved
-ranges; of IPv6, only loopback (`::1`), unique local addresses
-(`fc00::/7`) and link-local addresses (`fe80::/10`); and certain public
-addresses. A public address belongs on the default blocklist only if it
-hands credentials, user data or bootstrap material to whatever can reach
-it, without the caller presenting anything. A provider's other public
-addresses are not refused. IBM Cloud, for example, serves its package
-mirrors, time servers and object storage on `161.26.0.0/16`, and the
-private endpoints of its own cloud services on `166.8.0.0/14`. Neither
-range hands out credentials that way: the token service among those
-endpoints issues a token only in exchange for something the caller
-presents, such as an API key. Reaching these services can be a
-legitimate delivery, and every cloud has some, so a partial list would
-promise coverage it does not give.
+ranges; of IPv6, only loopback (`::1`), the unspecified address (`::`),
+unique local addresses (`fc00::/7`), link-local addresses (`fe80::/10`),
+multicast (`ff00::/8`) and documentation space (`2001:db8::/32`); and
+certain public addresses. A public address belongs on the default
+blocklist only if it hands credentials, user data or bootstrap material
+to whatever can reach it, without the caller presenting anything. A
+provider's other public addresses are not refused. IBM Cloud, for
+example, serves its package mirrors, time servers and object storage on
+`161.26.0.0/16`, and the private endpoints of its own cloud services on
+`166.8.0.0/14`. Neither range hands out credentials that way: the token
+service among those endpoints issues a token only in exchange for
+something the caller presents, such as an API key. Reaching these
+services can be a legitimate delivery, and every cloud has some, so a
+partial list would promise coverage it does not give.
 
 That default is also inconvenient for the thing webhooker is mostly
 for: taking a public webhook and forwarding it to something on your own
@@ -210,16 +211,16 @@ Two things this setting cannot do:
   the list is always an allowlist; an empty list (the default) means
   every private and reserved range stays refused. Note that
   `0.0.0.0/0` gets you most of the way there anyway, per above.
-- **It cannot open link-local, or a cloud metadata endpoint at a
-  non-public address that discloses credentials or user data.** An
-  address is on the list below when it is not a public address and both
-  of these hold: the provider fixes it, so it cannot collide with
-  anything you run; and reaching it hands out credentials, user data or
-  bootstrap material. Those stay blocked no matter what you list,
-  including when you list them outright or list a supernet such as
-  `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`. Treat this as best
-  effort rather than a guarantee — it is a hand-maintained list and the
-  caveat below the table applies:
+- **It cannot open link-local, the unspecified addresses, or a cloud
+  metadata endpoint at a non-public address that discloses credentials
+  or user data.** A metadata address is on the list below when it is not
+  a public address and both of these hold: the provider fixes it, so it
+  cannot collide with anything you run; and reaching it hands out
+  credentials, user data or bootstrap material. Those stay blocked no
+  matter what you list, including when you list them outright or list a
+  supernet such as `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`.
+  Treat this as best effort rather than a guarantee — it is a
+  hand-maintained list and the caveat below the table applies:
 
   | Blocked unconditionally | What it is |
   | ----------------------- | ---------- |
@@ -233,14 +234,25 @@ Two things this setting cannot do:
   | `fd00:a9fe:a9fe::1/128` | Linode/Akamai metadata over IPv6 |
   | `100.100.100.200/32` | Alibaba Cloud metadata, inside CGNAT |
   | `192.0.0.192/32` | Oracle Cloud Classic metadata |
+  | `0.0.0.0/32` | IPv4 unspecified address, which reaches this host's loopback on Linux |
+  | `::/128` | IPv6 unspecified address, which reaches this host's loopback on Linux |
   | `::a9fe:a9fe/128` | `169.254.169.254` as an IPv4-compatible IPv6 address |
   | `64:ff9b::a9fe:a9fe/128` | `169.254.169.254` behind the NAT64 well-known prefix |
 
   The IPv4-mapped form `::ffff:169.254.169.254` is covered by the
-  `169.254.0.0/16` entry. Reaching any of these is credential or
-  user-data theft rather than delivery to an internal service. Every
-  entry outside the two link-local blocks is a single address, so
-  blocking it costs you nothing else on the network around it.
+  `169.254.0.0/16` entry. Reaching any of these but the two unspecified
+  addresses is credential or user-data theft rather than delivery to an
+  internal service. Every entry outside the two link-local blocks is a
+  single address, so blocking it costs you nothing else on the network
+  around it.
+
+  The unspecified addresses `0.0.0.0` and `::` hand out nothing
+  themselves, but no host can have either, and on Linux a connection to
+  one reaches this host's own loopback. They are listed so that an
+  allowlist reaches loopback only through an entry that covers a loopback
+  address, such as `127.0.0.0/8`, `::1` or `0.0.0.0/0`, never through one
+  that covers only `0.0.0.0` or `::`; `0.0.0.0/8`, for example, does not
+  open loopback.
 
   The six ULA entries, all inside `fd00::/8`, are why this matters in
   practice: `fd00::/8` is an ordinary block to allowlist for your own
@@ -1768,7 +1780,7 @@ retries) is individually logged for full observability.
 #### EventTotals and TargetTotals
 
 Running counts in each event database, read by the statistics pane at the
-top of the webhook page. `EventTotals` is one row:
+top of the webhook page and by the webhook list. `EventTotals` is one row:
 
 | Field            | Type      | Description |
 | ---------------- | --------- | ----------- |
@@ -1800,6 +1812,14 @@ target. Its failure percentage for a window is the deliveries that became
 `failed` in it out of all that became `delivered` or `failed` in it, and
 a dash when none did.
 
+The webhook list at `/hooks` shows three of the pane's figures for each
+webhook: its events within retention and its last event, both from
+`EventTotals`, and its deliveries that failed in the last 24 hours,
+counted with the pane's query. It opens each webhook's event database once
+(the handle stays open) and runs those two reads there, so its cost grows
+with the number of webhooks and, for each, with the deliveries that
+finished in the last 24 hours, never with the events stored.
+
 #### Event-tier indexes
 
 These indexes on the per-webhook event databases are declared in the model
@@ -1807,7 +1827,7 @@ tags, so `AutoMigrate` creates them on a fresh database:
 
 | Table              | Columns                     | Serves |
 | ------------------ | --------------------------- | ------ |
-| `deliveries`       | `status`, `deleted_at`, `finished_at`, `target_id` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics, which count each target's deliveries by status and when they finished |
+| `deliveries`       | `status`, `deleted_at`, `finished_at`, `target_id` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics and the webhook list, which count each target's deliveries by status and when they finished |
 | `deliveries`       | `event_id`, `deleted_at`    | The event log, which loads each event's deliveries, and retention, which counts and deletes the deliveries of expired events |
 | `delivery_results` | `delivery_id`, `deleted_at` | The event log, which loads the attempts of a page's deliveries, and retention, which deletes the attempts of expired events |
 | `events`           | `deleted_at`, `created_at`  | The webhook page's statistics, which count recent events |
@@ -3093,7 +3113,8 @@ check, see [The login endpoint](#the-login-endpoint).
   route through a single decision function, so they cannot disagree
   about a destination. An operator can permit specific blocks with
   [`ALLOWED_EGRESS_CIDRS`](#allowing-egress-to-your-own-network); the
-  guard cannot be switched off, and link-local plus a
+  guard cannot be switched off, and link-local, the unspecified
+  addresses `0.0.0.0` and `::`, and a
   [pinned set](#allowing-egress-to-your-own-network) of known cloud
   metadata endpoints — several of which are ULAs outside link-local —
   stay blocked whatever is listed, though listing `0.0.0.0/0` or

TODO.md

@@ -40,12 +40,6 @@ duplicate. That is deliberate — the alternative is a silent lost
 delivery — and the README says so under Rationale. It is not a defect
 to re-file.
 
-One caveat on reading a green check: a docs-only commit deliberately
-replays from the layer cache
-(https://git.eeqj.de/sneak/webhooker/issues/119), so a green status on
-such a commit evidences a replay rather than an executed run. A code
-commit invalidates the `COPY` layer and genuinely executes.
-
 # Next Step
 
 Clear the rest of the open 1.0.0 milestone

internal/config/config.go

@@ -196,12 +196,13 @@ type Config struct {
 	// otherwise refuse. The guard itself is always on: there is no
 	// setting that disables SSRF protection, and delivery's
 	// alwaysBlockedNetworks stays blocked no matter what is listed
-	// here. That set is link-local plus the cloud metadata
-	// endpoints outside it that disclose credentials or user data
-	// at a provider-fixed, non-public address; it is not
-	// exhaustive of every cloud's metadata address. See
-	// alwaysBlockedNetworks for the authoritative list and the
-	// criterion it is built from.
+	// here. That set is link-local, the unspecified addresses
+	// 0.0.0.0 and ::, and the cloud metadata endpoints outside
+	// link-local that disclose credentials or user data at a
+	// provider-fixed, non-public address; it is not exhaustive of
+	// every cloud's metadata address. See
+	// alwaysBlockedNetworks for the authoritative list and why
+	// each entry is on it.
 	AllowedEgressCIDRs []netip.Prefix
 
 	params *ConfigParams

internal/config/config_test.go

@@ -124,6 +124,11 @@ func testEnvironmentConfigSuccess(
 
 	app := fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned. The same holds for every fxtest.New
+		// below.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -272,6 +277,7 @@ func testRetentionSweepIntervalSuccess(
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -364,6 +370,7 @@ func testSessionIdleTimeoutSuccess(
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -404,6 +411,7 @@ func TestDefaultDataDir(t *testing.T) {
 
 			app := fxtest.New(
 				t,
+				fx.NopLogger,
 				fx.Provide(
 					globals.New,
 					logger.New,
@@ -534,6 +542,7 @@ func testReceiverRateLimitSuccess(
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -650,6 +659,7 @@ func testTrustedProxiesSuccess(
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -763,6 +773,7 @@ func testAllowedEgressCIDRsSuccess(
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -1006,6 +1017,7 @@ func assertMetricsAuthAccepted(t *testing.T, expectAuth bool) {
 
 	app := fxtest.New(
 		t,
+		fx.NopLogger,
 		fx.Provide(globals.New, logger.New, config.New),
 		fx.Populate(&cfg),
 	)

internal/delivery/engine.go

@@ -14,6 +14,7 @@ import (
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/lifecycle"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/metrics"
@@ -146,6 +147,7 @@ type EngineParams struct {
 
 	DB        *database.Database
 	DBManager *database.WebhookDBManager
+	Globals   *globals.Globals
 	Logger    *logger.Logger
 	SSRFGuard *Guard
 	Metrics   *metrics.Set
@@ -168,6 +170,10 @@ type Engine struct {
 	retryCh    chan Task
 	workers    int
 
+	// version is the running build's version, the one the web UI
+	// footer shows. userAgent puts it on every outbound request.
+	version string
+
 	// mtr is the delivery metric set. Production wires the one
 	// registered on the registry /metrics serves; a test can
 	// substitute a set registered on a registry it holds, so it can
@@ -205,6 +211,7 @@ func New(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    defaultWorkers,
+		version:    params.Globals.Version,
 		mtr:        params.Metrics,
 	}
 
@@ -301,6 +308,13 @@ func (e *Engine) ScheduleRetry(
 	})
 }
 
+// userAgent is the User-Agent header of every http and slack
+// delivery request: the program name and the running build's
+// version.
+func (e *Engine) userAgent() string {
+	return "webhooker/" + e.version
+}
+
 // registerHooks wires the engine's start and stop into the fx
 // lifecycle. The start hook's context is deliberately ignored
 // (see start for why the worker pool must not inherit it); the

internal/delivery/engine_test.go

@@ -1247,11 +1247,6 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 		testContentType,
 		receivedHeaders.Get("Content-Type"),
 	)
-
-	assert.Equal(t,
-		"webhooker/1.0",
-		receivedHeaders.Get("User-Agent"),
-	)
 }
 
 // The event's stored inbound headers carry the same Content-Type the
@@ -1320,6 +1315,7 @@ func TestApplyRequestHeaders_SendsOneContentType(t *testing.T) {
 					ContentType: tc.event,
 				},
 				cfg,
+				"webhooker/dev",
 			)
 
 			assert.Equal(t,

internal/delivery/export_test.go

@@ -83,8 +83,9 @@ func ExportApplyRequestHeaders(
 	req *http.Request,
 	event *database.Event,
 	cfg *HTTPTargetConfig,
+	userAgent string,
 ) []string {
-	return applyRequestHeaders(req, event, cfg)
+	return applyRequestHeaders(req, event, cfg, userAgent)
 }
 
 // ExportTruncate exposes truncate for testing.

internal/delivery/redirect_test.go

@@ -375,6 +375,7 @@ func TestApplyRequestHeaders_ReportsOriginScopedNames(t *testing.T) {
 				"Content-Type":  testContentType,
 			},
 		},
+		"webhooker/dev",
 	)
 
 	assert.Equal(t,

internal/delivery/ssrf.go

@@ -37,8 +37,8 @@ var (
 		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
-		"blocked link-local or cloud instance metadata " +
-			"address: ALLOWED_EGRESS_CIDRS cannot open it",
+		"blocked link-local, cloud instance metadata or " +
+			"unspecified address: ALLOWED_EGRESS_CIDRS cannot open it",
 	)
 	errInvalidScheme = errors.New(
 		"only http and https are allowed",
@@ -72,14 +72,17 @@ var blockedNetworks []*net.IPNet
 var blockedPublicNetworks []*net.IPNet
 
 // alwaysBlockedNetworks are the ranges no configuration can
-// open: the link-local blocks and the cloud instance metadata
-// endpoints that live outside them. Reaching one is credential
-// or user-data theft rather than delivery to an internal
-// service, so a supplied CIDR that covers such an address still
-// leaves it blocked.
+// open, so a supplied CIDR that covers one still leaves it
+// blocked. An entry is here for one of two reasons: it is a
+// metadata endpoint (the link-local blocks and the cloud
+// instance metadata endpoints that live outside them), or it is
+// an unspecified address. Reaching a metadata endpoint is
+// credential or user-data theft rather than delivery to an
+// internal service.
 //
-// Inclusion criterion — an address belongs here only if BOTH
-// hold, and every entry below satisfies both:
+// Inclusion criterion for metadata endpoints — one belongs here
+// only if BOTH hold, and every metadata entry below satisfies
+// both:
 //
 //  1. It is a fixed address assigned by the provider, or a
 //     range reserved by IANA — never one the operator chose.
@@ -90,8 +93,8 @@ var blockedPublicNetworks []*net.IPNet
 //     not cheaply rotated.
 //
 // Both halves are load-bearing, so use them to refuse a
-// candidate and say why. An endpoint disclosing only the
-// operator's own inventory (instance id, region, disks, NICs)
+// metadata candidate and say why. An endpoint disclosing only
+// the operator's own inventory (instance id, region, disks, NICs)
 // fails (2): letting a delivery target reach the operator's own
 // infrastructure is the feature ALLOWED_EGRESS_CIDRS exists to
 // provide. But (2) is not "IAM credentials only" either —
@@ -112,6 +115,15 @@ var blockedPublicNetworks []*net.IPNet
 // This is a criterion, not an enumeration of every metadata
 // address in existence.
 //
+// The unspecified addresses 0.0.0.0 and :: are here for a
+// separate reason: they disclose nothing, but no host can have
+// either, and on Linux a connection to one reaches this host's
+// own loopback. Listing them means an allowlist reaches loopback
+// only through an entry that covers a loopback address
+// (127.0.0.0/8, ::1/128, 0.0.0.0/0), never through one that
+// covers only 0.0.0.0 or :: (0.0.0.0/8, for example). Nothing
+// else lives at either address, so refusing them costs nothing.
+//
 // Every entry is either already in blockedNetworks — this list is
 // what makes it unconditional — or an alternate encoding of
 // 169.254.169.254 that Contains does not match against
@@ -131,23 +143,46 @@ var alwaysBlockedNetworks []*net.IPNet
 //nolint:gochecknoinits // init is the idiomatic way to parse CIDRs once at startup
 func init() {
 	blockedNetworks = mustParseCIDRs([]string{
+		// IPv4 loopback.
 		"127.0.0.0/8",
+		// RFC 1918 private network.
 		"10.0.0.0/8",
+		// RFC 1918 private network.
 		"172.16.0.0/12",
+		// RFC 1918 private network.
 		"192.168.0.0/16",
+		// IPv4 link-local.
 		"169.254.0.0/16",
+		// "This network", holding the IPv4 unspecified address 0.0.0.0.
 		"0.0.0.0/8",
+		// Carrier-grade NAT shared address space.
 		"100.64.0.0/10",
+		// IETF protocol assignments.
 		"192.0.0.0/24",
+		// IPv4 documentation (TEST-NET-1).
 		"192.0.2.0/24",
+		// Benchmarking.
 		"198.18.0.0/15",
+		// IPv4 documentation (TEST-NET-2).
 		"198.51.100.0/24",
+		// IPv4 documentation (TEST-NET-3).
 		"203.0.113.0/24",
+		// IPv4 multicast.
 		"224.0.0.0/4",
+		// Reserved, including the broadcast address.
 		"240.0.0.0/4",
+		// IPv6 loopback.
 		"::1/128",
+		// IPv6 unspecified address.
+		"::/128",
+		// IPv6 unique local addresses.
 		"fc00::/7",
+		// IPv6 link-local.
 		"fe80::/10",
+		// IPv6 multicast.
+		"ff00::/8",
+		// IPv6 documentation.
+		"2001:db8::/32",
 	})
 
 	blockedPublicNetworks = mustParseCIDRs([]string{
@@ -207,6 +242,14 @@ func init() {
 		// allowlist from opening it.
 		"192.0.0.192/32",
 
+		// The unspecified addresses, each of which reaches this
+		// host's loopback on Linux.
+		//
+		// IPv4 unspecified address, inside the blocked 0.0.0.0/8.
+		"0.0.0.0/32",
+		// IPv6 unspecified address.
+		"::/128",
+
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -343,8 +386,9 @@ func (g *Guard) allows(ip net.IP) bool {
 // The order is the policy:
 //
 //  1. alwaysBlockedNetworks is refused before the allowlist is
-//     consulted, so no configured CIDR reaches link-local or a
-//     cloud metadata endpoint at a non-public address.
+//     consulted, so no configured CIDR reaches link-local, a
+//     cloud metadata endpoint at a non-public address, or an
+//     unspecified address.
 //  2. The allowlist is consulted next, so a listed private
 //     network, or a listed public address on the default
 //     blocklist, becomes reachable.

internal/delivery/ssrf_allowlist_test.go

@@ -168,12 +168,13 @@ func TestGuardAllowlist_UnlistedPrivateStillRefused(t *testing.T) {
 
 // TestGuardAllowlist_MetadataAlwaysRefused is the load-bearing
 // case: cloud instance metadata endpoints are credential theft
-// rather than delivery to an internal service, so no allowlist
-// reaches one. Every guard below names a CIDR that covers its
-// target — including 0.0.0.0/0, ::/0, and the ordinary ULA and
-// CGNAT blocks an operator would really list — and the address
-// must stay refused anyway, on both the validation and the
-// delivery path.
+// rather than delivery to an internal service, and the
+// unspecified addresses 0.0.0.0 and :: reach this host's loopback
+// on Linux, so no allowlist reaches any of them. Every guard
+// below names a CIDR that covers its target — including
+// 0.0.0.0/0, ::/0, and the ordinary ULA and CGNAT blocks an
+// operator would really list — and the address must stay
+// refused anyway, on both the validation and the delivery path.
 func TestGuardAllowlist_MetadataAlwaysRefused(t *testing.T) {
 	t.Parallel()
 
@@ -219,15 +220,17 @@ type metadataAlwaysRefusedCase struct {
 }
 
 // metadataAlwaysRefusedCases enumerates every unconditionally
-// blocked address together with an allowlist entry that would
-// otherwise reach it. Split by family of address only to stay
-// under the function-length limit.
+// blocked address (link-local, the cloud metadata endpoints and
+// the unspecified addresses) together with an allowlist entry
+// that would otherwise reach it. Split by family of address only
+// to stay under the function-length limit.
 func metadataAlwaysRefusedCases() []metadataAlwaysRefusedCase {
 	cases := linkLocalRefusedCases()
 	cases = append(cases, ulaMetadataRefusedCases()...)
 	cases = append(cases, ipv4MetadataRefusedCases()...)
+	cases = append(cases, encodedMetadataRefusedCases()...)
 
-	return append(cases, encodedMetadataRefusedCases()...)
+	return append(cases, unspecifiedRefusedCases()...)
 }
 
 // linkLocalRefusedCases covers the link-local blocks, including
@@ -367,6 +370,23 @@ func encodedMetadataRefusedCases() []metadataAlwaysRefusedCase {
 	}
 }
 
+// unspecifiedRefusedCases covers the unspecified addresses, each
+// of which reaches this host's loopback on Linux.
+func unspecifiedRefusedCases() []metadataAlwaysRefusedCase {
+	return []metadataAlwaysRefusedCase{
+		{
+			name:   "IPv4 unspecified address under 0.0.0.0/0",
+			allow:  allowAllIPv4,
+			target: "http://0.0.0.0:8080/hook",
+		},
+		{
+			name:   "IPv6 unspecified address under ::/0",
+			allow:  allowAllIPv6,
+			target: "http://[::]:8080/hook",
+		},
+	}
+}
+
 // TestGuardAllowlist_PublicUnaffected asserts the allowlist does
 // not narrow anything: public addresses were reachable before it
 // existed and stay reachable, whether or not a list is set.
@@ -524,6 +544,10 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 		// Oracle Cloud Classic metadata, inside the blocked
 		// 192.0.0.0/24.
 		"192.0.0.192/32",
+		// The IPv4 and IPv6 unspecified addresses, each of
+		// which reaches this host's loopback on Linux.
+		"0.0.0.0/32",
+		"::/128",
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -556,7 +580,8 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "172.16.0.0/12", reopenable: true},
 		{cidr: "192.168.0.0/16", reopenable: true},
 		{cidr: linkLocalIPv4, reopenable: false},
-		{cidr: "0.0.0.0/8", reopenable: true},
+		// Its first address, 0.0.0.0, is in the unconditional set.
+		{cidr: "0.0.0.0/8", reopenable: false},
 		{cidr: "100.64.0.0/10", reopenable: true},
 		{cidr: "192.0.0.0/24", reopenable: true},
 		{cidr: "192.0.2.0/24", reopenable: true},
@@ -566,8 +591,11 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "224.0.0.0/4", reopenable: true},
 		{cidr: "240.0.0.0/4", reopenable: true},
 		{cidr: "::1/128", reopenable: true},
+		{cidr: "::/128", reopenable: false},
 		{cidr: "fc00::/7", reopenable: true},
 		{cidr: "fe80::/10", reopenable: false},
+		{cidr: "ff00::/8", reopenable: true},
+		{cidr: "2001:db8::/32", reopenable: true},
 		{cidr: "168.63.129.16/32", public: true, reopenable: true},
 	}
 

internal/delivery/ssrf_test.go

@@ -101,6 +101,42 @@ func TestValidateTargetURL_Blocked(t *testing.T) {
 	}
 }
 
+// TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation
+// covers the unspecified addresses and the IPv6 multicast and
+// documentation ranges: with no allowlist set, each is refused
+// both when a target is created and when a delivery dials it.
+func TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	guard := delivery.NewTestGuard()
+
+	targets := []string{
+		// The unspecified addresses. On Linux a connection to
+		// either reaches this host's loopback.
+		"http://0.0.0.0:8080/hook",
+		"http://[::]:8080/hook",
+		// IPv6 multicast, all nodes.
+		"http://[ff02::1]/hook",
+		// IPv6 documentation.
+		"http://[2001:db8::1]/hook",
+	}
+
+	for _, target := range targets {
+		t.Run(target, func(t *testing.T) {
+			t.Parallel()
+
+			require.Error(t,
+				guard.ValidateTargetURL(context.Background(), target),
+				"%s must be refused at target creation", target,
+			)
+
+			assertDialRefused(t, guard, target)
+		})
+	}
+}
+
 func TestValidateTargetURL_Allowed(t *testing.T) {
 	t.Parallel()
 

internal/delivery/target_http.go

@@ -442,7 +442,9 @@ func (t *httpTarget) doHTTPRequest(
 		)
 	}
 
-	originScoped := applyRequestHeaders(req, event, cfg)
+	originScoped := applyRequestHeaders(
+		req, event, cfg, t.eng.userAgent(),
+	)
 
 	client := t.clientForRequest(cfg, originScoped)
 
@@ -562,10 +564,13 @@ func isForwardableHeader(name string) bool {
 // Content-Type goes out once: a Content-Type configured on the target
 // wins, otherwise the event's ContentType, otherwise none. The inbound
 // Content-Type in the event's headers is never forwarded.
+//
+// userAgent is set last, over any configured or inbound User-Agent.
 func applyRequestHeaders(
 	req *http.Request,
 	event *database.Event,
 	cfg *HTTPTargetConfig,
+	userAgent string,
 ) []string {
 	if event.ContentType != "" {
 		req.Header.Set(
@@ -580,7 +585,7 @@ func applyRequestHeaders(
 		originScoped[http.CanonicalHeaderKey(k)] = struct{}{}
 	}
 
-	req.Header.Set("User-Agent", "webhooker/1.0")
+	req.Header.Set("User-Agent", userAgent)
 
 	// A Content-Type configured on the target describes the body
 	// being sent rather than the sender. A 307/308 preserves the

internal/delivery/target_slack.go

@@ -136,7 +136,7 @@ func (t *slackTarget) attempt(
 	}
 
 	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("User-Agent", "webhooker/1.0")
+	req.Header.Set("User-Agent", t.eng.userAgent())
 
 	resp, doErr := executeHTTPRequest(t.client, req)
 	durationMs := time.Since(start).Milliseconds()

internal/delivery/user_agent_test.go

@@ -0,0 +1,91 @@
+package delivery_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+	"sneak.berlin/go/webhooker/internal/globals"
+	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
+)
+
+// Both the http and the slack target send webhooker/ and the version
+// in Globals, the value the web UI footer shows. A User-Agent
+// configured on the target or carried in by the sender does not
+// replace it.
+func TestUserAgent_IsTheBuildVersion(t *testing.T) {
+	t.Parallel()
+
+	const want = "webhooker/1.2.3-test"
+
+	userAgents := make(chan string, 1)
+
+	ts := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			userAgents <- r.Header.Get("User-Agent")
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+	defer ts.Close()
+
+	g := &globals.Globals{Version: "1.2.3-test"}
+	lc := fxtest.NewLifecycle(t)
+
+	log, err := logger.New(lc, logger.LoggerParams{Globals: g})
+	require.NoError(t, err)
+
+	e := delivery.New(lc, delivery.EngineParams{
+		Globals: g,
+		Logger:  log,
+		// httptest listens on loopback, which the default guard
+		// refuses.
+		SSRFGuard: delivery.NewTestGuard(
+			netip.MustParsePrefix("127.0.0.0/8"),
+		),
+		Metrics: metrics.New(prometheus.NewRegistry()),
+	})
+
+	statusCode, _, _, err := e.ExportDoHTTPRequest(
+		context.Background(),
+		&delivery.HTTPTargetConfig{
+			URL:     ts.URL,
+			Headers: map[string]string{"User-Agent": "configured/1"},
+		},
+		&database.Event{Headers: `{"User-Agent":["curl/8"]}`},
+	)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, statusCode)
+	require.Len(t, userAgents, 1, "the http target sent no request")
+	assert.Equal(t, want, <-userAgents, "http target")
+
+	db := testWebhookDB(t)
+	targetID := uuid.New().String()
+
+	slackCfg, err := json.Marshal(
+		delivery.SlackTargetConfig{WebhookURL: ts.URL},
+	)
+	require.NoError(t, err)
+
+	event := seedEvent(t, db, `{"action":"test"}`)
+	dlv := seedDelivery(
+		t, db, event.ID, targetID, database.DeliveryStatusPending,
+	)
+
+	e.ExportDeliverSlack(context.Background(), db, buildSlackDelivery(
+		dlv, event, targetID, "test-slack", string(slackCfg),
+	))
+	require.Len(t, userAgents, 1, "the slack target sent no request")
+	assert.Equal(t, want, <-userAgents, "slack target")
+}

internal/gormlog/firstboot_test.go

@@ -137,6 +137,10 @@ func bootAtDebug(t *testing.T, dataDir string) string {
 
 	app := fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/handlers/auth.go

@@ -333,7 +333,9 @@ func (h *Handlers) HandleLogout() http.HandlerFunc {
 			)
 		}
 
-		// Redirect to login page
-		http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+		http.Redirect(
+			w, r, withNotice("/pages/login", signedOut),
+			http.StatusSeeOther,
+		)
 	}
 }

internal/handlers/delivery_replay.go

@@ -11,72 +11,37 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-// replayOutcomeParam is the query parameter the replay POST redirects
-// with and the event log page reads its banner from.
-const replayOutcomeParam = "replay"
-
-// replayOutcomeCode is the outcome of a replay POST. The redirect
-// carries one of these fixed codes rather than a message, so nothing a
-// client submits can reach the rendered page through it.
-type replayOutcomeCode string
-
+// The outcomes of a replay POST, as the notice codes its redirect
+// carries. noticeFor holds the line each one shows.
 const (
 	// replayQueued reports that a new delivery was created and handed
 	// to the delivery engine.
-	replayQueued replayOutcomeCode = "queued"
+	replayQueued noticeCode = "replay-queued"
 
 	// replayTargetDeleted reports a target that once existed and has
 	// since been deleted. Deletes are soft and deliveries carry no
 	// foreign key to the target row, so the history survives its
 	// target and this is the ordinary case for an old event.
-	replayTargetDeleted replayOutcomeCode = "target-deleted"
+	replayTargetDeleted noticeCode = "replay-target-deleted"
 
 	// replayTargetMissing reports a target id that names no row at
 	// all, deleted or otherwise.
-	replayTargetMissing replayOutcomeCode = "target-missing"
+	replayTargetMissing noticeCode = "replay-target-missing"
 
 	// replayTargetInactive reports a target the operator has
 	// deactivated. A deactivated target receives no new deliveries, so
 	// a replay to it would be a delivery they switched off.
-	replayTargetInactive replayOutcomeCode = "target-inactive"
+	replayTargetInactive noticeCode = "replay-target-inactive"
 
 	// replayNotTerminal reports a delivery the engine has not finished
 	// with.
-	replayNotTerminal replayOutcomeCode = "not-terminal"
+	replayNotTerminal noticeCode = "replay-not-terminal"
 
 	// replayInFlight reports that an earlier replay of this event to
 	// this target is still running.
-	replayInFlight replayOutcomeCode = "in-flight"
+	replayInFlight noticeCode = "replay-in-flight"
 )
 
-// replayOutcome returns the banner the event log page shows for an
-// outcome code, and whether the replay was queued. An unrecognised
-// code yields no banner.
-func replayOutcome(code string) (string, bool) {
-	switch replayOutcomeCode(code) {
-	case replayQueued:
-		return "Replay queued: a new delivery was created against " +
-			"the target's current configuration.", true
-	case replayTargetDeleted:
-		return "Not replayed: the target this delivery was for has " +
-			"been deleted. Recreate the target, then replay.", false
-	case replayTargetMissing:
-		return "Not replayed: the target this delivery was for no " +
-			"longer exists.", false
-	case replayTargetInactive:
-		return "Not replayed: the target this delivery was for is " +
-			"deactivated. Activate it, then replay.", false
-	case replayNotTerminal:
-		return "Not replayed: this delivery has not finished yet.",
-			false
-	case replayInFlight:
-		return "Not replayed: a delivery of this event to this " +
-			"target is already in flight.", false
-	default:
-		return "", false
-	}
-}
-
 // HandleDeliveryReplay re-sends a finished delivery's event to its
 // target.
 //
@@ -140,14 +105,14 @@ func (h *Handlers) replayDelivery(
 	}
 
 	if !original.Status.Terminal() {
-		h.finishReplay(w, r, webhook, replayNotTerminal)
+		redirectToEventLog(w, r, webhook, replayNotTerminal)
 
 		return
 	}
 
 	target, code := h.replayTarget(webhook.ID, original.TargetID)
 	if target == nil {
-		h.finishReplay(w, r, webhook, code)
+		redirectToEventLog(w, r, webhook, code)
 
 		return
 	}
@@ -200,7 +165,7 @@ func (h *Handlers) queueReplay(
 	}
 
 	if inFlight > 0 {
-		h.finishReplay(w, r, webhook, replayInFlight)
+		redirectToEventLog(w, r, webhook, replayInFlight)
 
 		return
 	}
@@ -238,7 +203,7 @@ func (h *Handlers) queueReplay(
 		"delivery_id", task.DeliveryID,
 	)
 
-	h.finishReplay(w, r, webhook, replayQueued)
+	redirectToEventLog(w, r, webhook, replayQueued)
 }
 
 // replayTarget loads the delivery's target as it stands now.
@@ -251,7 +216,7 @@ func (h *Handlers) queueReplay(
 // with the returned code saying why.
 func (h *Handlers) replayTarget(
 	webhookID, targetID string,
-) (*database.Target, replayOutcomeCode) {
+) (*database.Target, noticeCode) {
 	var target database.Target
 
 	err := h.db.DB().Unscoped().Where(
@@ -361,17 +326,16 @@ func replayBody(body string) *string {
 	return &body
 }
 
-// finishReplay redirects back to the event log the replay was
-// triggered from, carrying the outcome code the page turns into a
-// banner and the page number the form submitted.
-func (h *Handlers) finishReplay(
+// redirectToEventLog redirects a replay or resubmit back to the event
+// log it was triggered from, carrying the outcome as its notice and
+// the page number the form submitted.
+func redirectToEventLog(
 	w http.ResponseWriter,
 	r *http.Request,
 	webhook database.Webhook,
-	code replayOutcomeCode,
+	code noticeCode,
 ) {
-	dest := "/hook/" + webhook.ID + "/events?" +
-		replayOutcomeParam + "=" + string(code)
+	dest := withNotice("/hook/"+webhook.ID+"/events", code)
 
 	// The page is read from the form rather than the query string:
 	// this is a POST, and its query string is what logs and Referer

internal/handlers/delivery_replay_test.go

@@ -212,7 +212,7 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=queued",
+		"/hook/"+wh.ID+"/events?notice=replay-queued",
 		w.Header().Get("Location"),
 	)
 
@@ -362,7 +362,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=target-deleted",
+		"/hook/"+wh.ID+"/events?notice=replay-target-deleted",
 		w.Header().Get("Location"),
 	)
 
@@ -390,7 +390,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, missing.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=target-missing",
+		"/hook/"+wh.ID+"/events?notice=replay-target-missing",
 		missing.Header().Get("Location"),
 	)
 }
@@ -431,7 +431,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, first.Code)
 	require.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=queued",
+		"/hook/"+wh.ID+"/events?notice=replay-queued",
 		first.Header().Get("Location"),
 	)
 
@@ -439,7 +439,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, second.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=in-flight",
+		"/hook/"+wh.ID+"/events?notice=replay-in-flight",
 		second.Header().Get("Location"),
 	)
 
@@ -465,7 +465,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, pending.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=not-terminal",
+		"/hook/"+wh.ID+"/events?notice=replay-not-terminal",
 		pending.Header().Get("Location"),
 	)
 }
@@ -509,7 +509,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {
 	assert.Contains(t, body, ">Replay<")
 
 	refused := renderSourceLogsPageWithQuery(
-		t, h, sess, wh.ID, "?replay=target-deleted",
+		t, h, sess, wh.ID, "?notice=replay-target-deleted",
 	)
 
 	assert.Contains(t, refused, "alert-error")
@@ -517,7 +517,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {
 
 	// An outcome code nobody issued renders no banner at all.
 	unknown := renderSourceLogsPageWithQuery(
-		t, h, sess, wh.ID, "?replay=made-up",
+		t, h, sess, wh.ID, "?notice=made-up",
 	)
 
 	assert.NotContains(t, unknown, "alert-error")

internal/handlers/event_resubmit.go

@@ -3,7 +3,6 @@ package handlers
 import (
 	"errors"
 	"net/http"
-	"strconv"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -11,43 +10,19 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// resubmitOutcomeParam is the query parameter the resubmit POST
-// redirects with and the event log page reads its banner from.
-const resubmitOutcomeParam = "resubmit"
-
-// resubmitOutcomeCode is the outcome of a resubmit POST. The redirect
-// carries one of these fixed codes rather than a message, so nothing a
-// client submits can reach the rendered page through it.
-type resubmitOutcomeCode string
-
+// The outcomes of a resubmit POST, as the notice codes its redirect
+// carries. noticeFor holds the line each one shows.
 const (
 	// resubmitQueued reports that a new event was stored and its
 	// deliveries handed to the delivery engine.
-	resubmitQueued resubmitOutcomeCode = "queued"
+	resubmitQueued noticeCode = "resubmit-queued"
 
 	// resubmitNoTargets reports a source with no active targets. The
 	// new event is stored either way, exactly as a received event
 	// with no targets is.
-	resubmitNoTargets resubmitOutcomeCode = "no-targets"
+	resubmitNoTargets noticeCode = "resubmit-no-targets"
 )
 
-// resubmitOutcome returns the banner the event log page shows for an
-// outcome code, and whether the resubmit was queued. An unrecognised
-// code yields no banner.
-func resubmitOutcome(code string) (string, bool) {
-	switch resubmitOutcomeCode(code) {
-	case resubmitQueued:
-		return "Resubmitted: a new event was created from the stored " +
-			"one and queued to every active target.", true
-	case resubmitNoTargets:
-		return "Resubmitted: a new event was created, but this " +
-				"source has no active targets, so nothing was queued.",
-			true
-	default:
-		return "", false
-	}
-}
-
 // resubmitSource is the stored event a resubmit copies. Its body is
 // read as bytes rather than as a string so the copy is byte-identical
 // to what was received, whatever the payload's encoding.
@@ -245,29 +220,5 @@ func (h *Handlers) queueResubmit(
 		code = resubmitNoTargets
 	}
 
-	h.finishResubmit(w, r, webhook, code)
-}
-
-// finishResubmit redirects back to the event log the resubmit was
-// triggered from, carrying the outcome code the page turns into a
-// banner and the page number the form submitted.
-func (h *Handlers) finishResubmit(
-	w http.ResponseWriter,
-	r *http.Request,
-	webhook database.Webhook,
-	code resubmitOutcomeCode,
-) {
-	dest := "/hook/" + webhook.ID + "/events?" +
-		resubmitOutcomeParam + "=" + string(code)
-
-	// The page is read from the form rather than the query string:
-	// this is a POST, and its query string is what logs and Referer
-	// headers record.
-	if page := pageOrFirst(
-		r.PostFormValue("page"),
-	); page > 1 {
-		dest += "&page=" + strconv.Itoa(page)
-	}
-
-	http.Redirect(w, r, dest, http.StatusSeeOther)
+	redirectToEventLog(w, r, webhook, code)
 }

internal/handlers/event_resubmit_test.go

@@ -154,7 +154,7 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=queued",
+		"/hook/"+wh.ID+"/events?notice=resubmit-queued",
 		w.Header().Get("Location"),
 	)
 
@@ -282,7 +282,7 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 		require.Equal(t, http.StatusSeeOther, w.Code)
 		assert.Equal(
 			t,
-			"/hook/"+wh.ID+"/events?resubmit=queued",
+			"/hook/"+wh.ID+"/events?notice=resubmit-queued",
 			w.Header().Get("Location"),
 			"a resubmit must not be refused while an earlier "+
 				"one is in flight",
@@ -436,7 +436,7 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=queued",
+		"/hook/"+wh.ID+"/events?notice=resubmit-queued",
 		w.Header().Get("Location"),
 		"an inactive target is skipped, not an error",
 	)
@@ -482,7 +482,7 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=no-targets",
+		"/hook/"+wh.ID+"/events?notice=resubmit-no-targets",
 		w.Header().Get("Location"),
 	)
 

internal/handlers/handlers.go

@@ -97,10 +97,10 @@ type Handlers struct {
 
 // parsePageTemplate parses a page-specific template set from the
 // embedded FS. Each page template is combined with the shared
-// base, htmlheader, and navbar templates, and with any further files
-// the page includes. The page file must be listed first so that its
-// root action ({{template "base" .}}) becomes the template set's entry
-// point.
+// base, htmlheader, navbar and notice templates, and with any further
+// files the page includes. The page file must be listed first so that
+// its root action ({{template "base" .}}) becomes the template set's
+// entry point.
 func parsePageTemplate(
 	pageFile string, included ...string,
 ) *template.Template {
@@ -109,6 +109,7 @@ func parsePageTemplate(
 		"base.html",
 		"htmlheader.html",
 		"navbar.html",
+		"notice.html",
 	}, included...)
 
 	return template.Must(
@@ -209,11 +210,13 @@ func (s *Handlers) renderError(
 	// served outside the routes where NoCache runs.
 	w.Header().Set("Cache-Control", "no-store")
 
+	// No notice: one would say an action worked above a page saying
+	// the request failed.
 	data := s.pageData(r, map[string]any{
 		"Status":     status,
 		"StatusText": http.StatusText(status),
 		"Message":    errorPageText(status),
-	})
+	}, nil)
 
 	var buf bytes.Buffer
 
@@ -267,6 +270,7 @@ type templateDataWrapper struct {
 	User      *UserInfo
 	CSRFToken string
 	Version   string
+	Notice    *notice
 	Data      any
 }
 
@@ -311,12 +315,15 @@ func (s *Handlers) renderTemplate(
 		return
 	}
 
-	s.executeTemplate(w, r, tmpl, s.pageData(r, data))
+	s.executeTemplate(w, r, tmpl, s.pageData(r, data, noticeFor(r)))
 }
 
 // pageData adds the fields the shared layout renders to a page's own
-// data.
-func (s *Handlers) pageData(r *http.Request, data any) any {
+// data. The layout shows the notice, when there is one, above the
+// page.
+func (s *Handlers) pageData(
+	r *http.Request, data any, pageNotice *notice,
+) any {
 	userInfo := s.getUserInfo(r)
 	csrfToken := middleware.CSRFToken(r)
 
@@ -330,6 +337,7 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
 		m["User"] = userInfo
 		m["CSRFToken"] = csrfToken
 		m["Version"] = version
+		m["Notice"] = pageNotice
 
 		return m
 	}
@@ -338,6 +346,7 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
 		User:      userInfo,
 		CSRFToken: csrfToken,
 		Version:   version,
+		Notice:    pageNotice,
 		Data:      data,
 	}
 }

internal/handlers/handlers_test.go

@@ -86,6 +86,10 @@ func newTestApp(
 
 	return fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/handlers/notice.go

@@ -0,0 +1,109 @@
+package handlers
+
+import "net/http"
+
+// noticeParam is the query parameter an action's redirect carries its
+// notice code in.
+const noticeParam = "notice"
+
+// noticeCode names one of the fixed lines noticeFor knows. An action
+// redirects with the code rather than the line, so nothing a client
+// puts in the URL reaches the page: a code noticeFor does not know
+// shows nothing.
+type noticeCode string
+
+// The codes of the actions on the webhook pages and of signing out.
+// Replay's codes, with the reasons a replay can be refused, and
+// resubmit's codes are defined beside those actions.
+const (
+	webhookCreated        noticeCode = "webhook-created"
+	webhookSaved          noticeCode = "webhook-saved"
+	webhookDeleted        noticeCode = "webhook-deleted"
+	entrypointAdded       noticeCode = "entrypoint-added"
+	entrypointDeleted     noticeCode = "entrypoint-deleted"
+	entrypointActivated   noticeCode = "entrypoint-activated"
+	entrypointDeactivated noticeCode = "entrypoint-deactivated"
+	targetAdded           noticeCode = "target-added"
+	targetSaved           noticeCode = "target-saved"
+	targetDeleted         noticeCode = "target-deleted"
+	targetActivated       noticeCode = "target-activated"
+	targetDeactivated     noticeCode = "target-deactivated"
+	signedOut             noticeCode = "signed-out"
+)
+
+// notice is the line templates/notice.html shows above a page to say
+// what an action did.
+type notice struct {
+	Text string
+
+	// Failed shows the line as an error: the action was refused.
+	Failed bool
+}
+
+// noticeFor returns the notice the request's URL names, or nil when it
+// names none or an unknown code.
+func noticeFor(r *http.Request) *notice {
+	n, ok := map[noticeCode]notice{
+		webhookCreated:        {Text: "Webhook created."},
+		webhookSaved:          {Text: "Webhook saved."},
+		webhookDeleted:        {Text: "Webhook deleted."},
+		entrypointAdded:       {Text: "Entrypoint added."},
+		entrypointDeleted:     {Text: "Entrypoint deleted."},
+		entrypointActivated:   {Text: "Entrypoint activated."},
+		entrypointDeactivated: {Text: "Entrypoint deactivated."},
+		targetAdded:           {Text: "Target added."},
+		targetSaved:           {Text: "Target saved."},
+		targetDeleted:         {Text: "Target deleted."},
+		targetActivated:       {Text: "Target activated."},
+		targetDeactivated:     {Text: "Target deactivated."},
+		signedOut:             {Text: "Signed out."},
+
+		replayQueued: {
+			Text: "Replay queued: a new delivery was created " +
+				"against the target's current configuration.",
+		},
+		replayTargetDeleted: {
+			Text: "Not replayed: the target this delivery was for " +
+				"has been deleted. Recreate the target, then replay.",
+			Failed: true,
+		},
+		replayTargetMissing: {
+			Text: "Not replayed: the target this delivery was for " +
+				"no longer exists.",
+			Failed: true,
+		},
+		replayTargetInactive: {
+			Text: "Not replayed: the target this delivery was for " +
+				"is deactivated. Activate it, then replay.",
+			Failed: true,
+		},
+		replayNotTerminal: {
+			Text:   "Not replayed: this delivery has not finished yet.",
+			Failed: true,
+		},
+		replayInFlight: {
+			Text: "Not replayed: a delivery of this event to this " +
+				"target is already in flight.",
+			Failed: true,
+		},
+
+		resubmitQueued: {
+			Text: "Resubmitted: a new event was created from the " +
+				"stored one and queued to every active target.",
+		},
+		resubmitNoTargets: {
+			Text: "Resubmitted: a new event was created, but this " +
+				"source has no active targets, so nothing was queued.",
+		},
+	}[noticeCode(r.URL.Query().Get(noticeParam))]
+	if !ok {
+		return nil
+	}
+
+	return &n
+}
+
+// withNotice returns path with code added as its notice.
+func withNotice(path string, code noticeCode) string {
+	return path + "?" + noticeParam + "=" + string(code)
+}

internal/handlers/source_delete_test.go

@@ -411,7 +411,9 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	h.HandleSourceDelete().ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/hooks", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/hooks?notice=webhook-deleted", w.Header().Get("Location"),
+	)
 
 	assert.Equal(
 		t, int64(0),

internal/handlers/source_detail_test.go

@@ -241,3 +241,37 @@ func TestHandleSourceDetail_RendersNamedTargetFields(
 	assert.Contains(t, body, "(unavailable)")
 	assert.NotContains(t, body, "beak")
 }
+
+// TestHandleSourceDetail_FitsWideAndNarrowWindows pins the webhook
+// page's maximum width at 108rem (1728 px), half again the 72rem of
+// max-w-6xl that the webhook list and the event log use, so an
+// entrypoint URL fits on one line in a 1920-pixel window; and the
+// wrapping of its title row, so the buttons beside the title do not
+// push a phone-width window into scrolling sideways.
+func TestHandleSourceDetail_FitsWideAndNarrowWindows(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+	)
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	body := renderSourceDetailPage(t, h, sess, wh.ID)
+
+	assert.Contains(
+		t, body,
+		`<div class="mx-auto px-6 py-8" style="max-width: 108rem"`,
+	)
+	assert.Contains(
+		t, body,
+		`<div class="flex flex-wrap justify-between items-center gap-2 mt-2">`,
+	)
+}

internal/handlers/source_list_test.go

@@ -0,0 +1,405 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// failedHighlight is how the list marks a number of failed deliveries
+// that is not zero.
+const failedHighlight = `class="font-medium text-red-600"`
+
+// listWebhook adds a webhook with the given name, owned by the test
+// user.
+func listWebhook(
+	t *testing.T, db *database.Database, name string,
+) *database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{UserID: deleteTestUserID, Name: name}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	return wh
+}
+
+// addEntrypoints adds the given number of entrypoints, all active or
+// all inactive, to a webhook and returns their paths.
+func addEntrypoints(
+	t *testing.T, db *database.Database, webhookID string,
+	count int, active bool,
+) []string {
+	t.Helper()
+
+	paths := make([]string, count)
+	for i := range paths {
+		paths[i] = statsEntrypoint(t, db, webhookID, active)
+	}
+
+	return paths
+}
+
+// addTargets adds the given number of targets, all active or all
+// inactive, to a webhook and returns them.
+func addTargets(
+	t *testing.T, db *database.Database, webhookID string,
+	count int, active bool,
+) []*database.Target {
+	t.Helper()
+
+	targets := make([]*database.Target, count)
+	for i := range targets {
+		targets[i] = seedTarget(t, db, webhookID, database.TargetTypeLog)
+		require.NoError(t, db.DB().Model(targets[i]).
+			Update("active", active).Error)
+	}
+
+	return targets
+}
+
+// renderWebhookList runs the real webhook list handler as the test user
+// and returns the rendered page.
+func renderWebhookList(
+	t *testing.T, h *handlers.Handlers, sess *session.Session,
+) string {
+	t.Helper()
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	w := httptest.NewRecorder()
+	h.HandleSourceList().ServeHTTP(
+		w, getRequest(t, "/hooks", cookies, nil),
+	)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	return w.Body.String()
+}
+
+// listCard returns one webhook's entry in a rendered webhook list, its
+// markup as rendered and its text with the markup taken out and each
+// run of space made one space.
+func listCard(t *testing.T, page, webhookID string) (string, string) {
+	t.Helper()
+
+	_, card, found := strings.Cut(page, `href="/hook/`+webhookID+`"`)
+	require.True(t, found, "the list has no entry for %s", webhookID)
+
+	card, _, _ = strings.Cut(card, "</a>")
+	text := regexp.MustCompile(`<[^>]*>`).ReplaceAllString(card, " ")
+
+	return card, strings.Join(strings.Fields(text), " ")
+}
+
+// receiveEvents posts the given number of events to an entrypoint
+// through the real receiver, and returns the webhook's event database
+// and its events, oldest first.
+func receiveEvents(
+	t *testing.T,
+	h *handlers.Handlers,
+	dbMgr *database.WebhookDBManager,
+	webhookID, path string,
+	count int,
+) (*gorm.DB, []database.Event) {
+	t.Helper()
+
+	router := receiverRouter(h)
+
+	for range count {
+		require.Equal(t, http.StatusOK, postReceiver(t, router, path))
+	}
+
+	webhookDB, err := dbMgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	events := listEvents(t, webhookDB)
+	require.Len(t, events, count)
+
+	return webhookDB, events
+}
+
+// seedFailingWebhook adds a webhook with six entrypoints, two of them
+// inactive, and seven targets, five of them inactive. Four events reach
+// its two active targets, each event arriving at a different time.
+// Three deliveries failed in the last 24 hours, two to the first target
+// and one to the second, one failed 30 hours ago, and one was
+// delivered. It returns the webhook and its newest event.
+func seedFailingWebhook(
+	t *testing.T,
+	h *handlers.Handlers,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+) (*database.Webhook, database.Event) {
+	t.Helper()
+
+	wh := listWebhook(t, db, "failing")
+	paths := addEntrypoints(t, db, wh.ID, 4, true)
+	addEntrypoints(t, db, wh.ID, 2, false)
+
+	active := addTargets(t, db, wh.ID, 2, true)
+	first, second := active[0], active[1]
+
+	addTargets(t, db, wh.ID, 5, false)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, paths[0], 4)
+	now := time.Now()
+
+	statsAge(t, webhookDB, events[0].ID, now.Add(-31*time.Hour))
+	statsAge(t, webhookDB, events[1].ID, now.Add(-2*time.Hour))
+	statsAge(t, webhookDB, events[2].ID, now.Add(-10*time.Minute))
+
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[0].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-30*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[1].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[2].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Minute))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[2].ID, second.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Minute))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[3].ID, second.ID),
+		database.DeliveryStatusDelivered, now.Add(-time.Minute))
+
+	return wh, events[3]
+}
+
+// seedHealthyWebhook adds a webhook with four entrypoints and two
+// targets, all active, and three events, each delivered to both
+// targets. It returns the webhook and its newest event.
+func seedHealthyWebhook(
+	t *testing.T,
+	h *handlers.Handlers,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+) (*database.Webhook, database.Event) {
+	t.Helper()
+
+	wh := listWebhook(t, db, "healthy")
+	paths := addEntrypoints(t, db, wh.ID, 4, true)
+	targets := addTargets(t, db, wh.ID, 2, true)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, paths[0], 3)
+
+	for _, ev := range events {
+		for _, target := range targets {
+			statsFinish(t, webhookDB,
+				statsDelivery(t, webhookDB, ev.ID, target.ID),
+				database.DeliveryStatusDelivered, time.Now())
+		}
+	}
+
+	return wh, events[2]
+}
+
+// lastEventText is how the list shows the arrival of an event.
+func lastEventText(ev database.Event) string {
+	return ev.CreatedAt.UTC().Format("2006-01-02 15:04:05 UTC")
+}
+
+// TestSourceList_ShowsActivityOfEachWebhook checks the figures the list
+// shows for a webhook with recent failures, a healthy one, a new one
+// that has received no event, and one without an event database.
+func TestSourceList_ShowsActivityOfEachWebhook(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	failing, failingNewest := seedFailingWebhook(t, h, db, dbMgr)
+	healthy, healthyNewest := seedHealthyWebhook(t, h, db, dbMgr)
+
+	// Creating a webhook creates its event database.
+	fresh := listWebhook(t, db, "fresh")
+	require.NoError(t, dbMgr.CreateDB(fresh.ID))
+	addEntrypoints(t, db, fresh.ID, 2, true)
+	addTargets(t, db, fresh.ID, 3, true)
+
+	quiet := listWebhook(t, db, "quiet")
+	addEntrypoints(t, db, quiet.ID, 2, true)
+	addTargets(t, db, quiet.ID, 3, true)
+
+	page := renderWebhookList(t, h, sess)
+
+	card, text := listCard(t, page, failing.ID)
+	assert.Contains(t, text, "6 entrypoints, 2 inactive")
+	assert.Contains(t, text, "7 targets, 5 inactive")
+	assert.Contains(t, text, "4 events within retention")
+	assert.Contains(t, text, "Last event "+lastEventText(failingNewest))
+	assert.Contains(t, card,
+		failedHighlight+">3 failed deliveries in the last 24 hours<")
+
+	card, text = listCard(t, page, healthy.ID)
+	assert.Contains(t, text, "4 entrypoints")
+	assert.Contains(t, text, "2 targets")
+	assert.Contains(t, text, "3 events within retention")
+	assert.Contains(t, text, "Last event "+lastEventText(healthyNewest))
+	assert.Contains(t, text, "0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, text, "inactive")
+	assert.NotContains(t, card, failedHighlight)
+
+	card, text = listCard(t, page, fresh.ID)
+	assert.Contains(t, text, "2 entrypoints")
+	assert.Contains(t, text, "3 targets")
+	assert.Contains(t, text, "0 events within retention")
+	assert.Contains(t, text, "No events yet")
+	assert.Contains(t, text, "0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, card, failedHighlight)
+
+	card, text = listCard(t, page, quiet.ID)
+	assert.Contains(t, text, "2 entrypoints")
+	assert.Contains(t, text, "3 targets")
+	assert.Contains(t, text, "0 events within retention")
+	assert.Contains(t, text, "No events yet")
+	assert.Contains(t, text, "0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, card, failedHighlight)
+	assert.False(t, dbMgr.DBExists(quiet.ID),
+		"showing the list must not create an event database")
+}
+
+// TestSourceList_CountsOnlyEventsWithinRetention checks that once
+// retention has removed one of a webhook's three events, the list
+// counts the two still stored.
+func TestSourceList_CountsOnlyEventsWithinRetention(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+		log   *logger.Logger
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &log)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID, Name: "pruned", RetentionDays: 14,
+	}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	paths := addEntrypoints(t, db, wh.ID, 3, true)
+	addTargets(t, db, wh.ID, 4, true)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, paths[0], 3)
+
+	statsAge(t, webhookDB, events[0].ID, time.Now().Add(-15*24*time.Hour))
+	statsPrune(t, db, dbMgr, log, webhookDB)
+	require.Len(t, listEvents(t, webhookDB), 2)
+
+	_, text := listCard(t, renderWebhookList(t, h, sess), wh.ID)
+	assert.Contains(t, text, "3 entrypoints")
+	assert.Contains(t, text, "4 targets")
+	assert.Contains(t, text, "2 events within retention")
+}
+
+// TestSourceList_LastEventSurvivesPruningEveryEvent checks that once
+// retention has removed every event of a webhook, the list still shows
+// when the last one arrived rather than "No events yet".
+func TestSourceList_LastEventSurvivesPruningEveryEvent(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+		log   *logger.Logger
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &log)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID, Name: "emptied", RetentionDays: 1,
+	}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	paths := addEntrypoints(t, db, wh.ID, 2, true)
+	addTargets(t, db, wh.ID, 3, true)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, paths[0], 1)
+
+	statsAge(t, webhookDB, events[0].ID, time.Now().Add(-50*time.Hour))
+	statsPrune(t, db, dbMgr, log, webhookDB)
+	require.Empty(t, listEvents(t, webhookDB))
+
+	_, text := listCard(t, renderWebhookList(t, h, sess), wh.ID)
+	assert.Contains(t, text, "0 events within retention")
+	assert.Contains(t, text, "Last event "+lastEventText(events[0]))
+	assert.NotContains(t, text, "No events yet")
+}
+
+// TestSourceList_UnreadableEventDatabase checks that a webhook whose
+// event database cannot be read says so in its entry instead of
+// showing zeros, and that the rest of the list is still shown.
+func TestSourceList_UnreadableEventDatabase(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	broken := listWebhook(t, db, "broken")
+	addEntrypoints(t, db, broken.ID, 2, true)
+	addTargets(t, db, broken.ID, 3, true)
+
+	brokenDB, err := dbMgr.GetDB(broken.ID)
+	require.NoError(t, err)
+	require.NoError(t,
+		brokenDB.Migrator().DropTable(&database.EventTotals{}))
+
+	quiet := listWebhook(t, db, "quiet")
+	addEntrypoints(t, db, quiet.ID, 2, true)
+	addTargets(t, db, quiet.ID, 3, true)
+
+	page := renderWebhookList(t, h, sess)
+
+	_, text := listCard(t, page, broken.ID)
+	assert.Contains(t, text, "2 entrypoints")
+	assert.Contains(t, text, "3 targets")
+	assert.Contains(t, text, "The event figures could not be read.")
+	assert.NotContains(t, text, "events")
+	assert.NotContains(t, text, "failed")
+
+	_, text = listCard(t, page, quiet.ID)
+	assert.Contains(t, text, "No events yet")
+}

internal/handlers/source_management.go

@@ -3,10 +3,12 @@ package handlers
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -20,9 +22,20 @@ import (
 type WebhookListItem struct {
 	database.Webhook
 
-	EntrypointCount int64
-	TargetCount     int64
-	EventCount      int64
+	EntrypointCount         int
+	InactiveEntrypointCount int
+	TargetCount             int
+	InactiveTargetCount     int
+
+	// EventCount is how many events the webhook holds, LastEventAt
+	// when the newest arrived (nil before the first), and
+	// FailedLast24Hours how many of its deliveries failed in the last
+	// 24 hours. When the webhook's event database could not be read,
+	// EventsUnreadable is set and these three are not known.
+	EventCount        int64
+	LastEventAt       *time.Time
+	FailedLast24Hours int64
+	EventsUnreadable  bool
 }
 
 // errMissingURL signals that a required URL was not provided.
@@ -154,7 +167,12 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 			return
 		}
 
-		items := h.buildWebhookListItems(webhooks)
+		items, err := h.buildWebhookListItems(webhooks)
+		if err != nil {
+			h.serverError(w, r, "failed to list webhooks", err)
+
+			return
+		}
 
 		data := map[string]any{
 			"Webhooks": items,
@@ -164,36 +182,115 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 	}
 }
 
-// buildWebhookListItems builds list items with counts.
+// buildWebhookListItems builds the list's entry for each webhook. It
+// fails when the main database cannot be read. A webhook whose event
+// database cannot be read is marked on its own entry, and the error is
+// logged.
 func (h *Handlers) buildWebhookListItems(
 	webhooks []database.Webhook,
-) []WebhookListItem {
+) ([]WebhookListItem, error) {
 	items := make([]WebhookListItem, len(webhooks))
+	since := time.Now().Add(-longWindow)
 
 	for i := range webhooks {
-		items[i].Webhook = webhooks[i]
+		item := &items[i]
+		item.Webhook = webhooks[i]
 
-		h.db.DB().Model(&database.Entrypoint{}).Where(
-			"webhook_id = ?", webhooks[i].ID,
-		).Count(&items[i].EntrypointCount)
+		var err error
 
-		h.db.DB().Model(&database.Target{}).Where(
-			"webhook_id = ?", webhooks[i].ID,
-		).Count(&items[i].TargetCount)
+		item.EntrypointCount, item.InactiveEntrypointCount, err =
+			h.countWithInactive(&database.Entrypoint{}, item.ID)
+		if err != nil {
+			return nil, err
+		}
 
-		if h.dbMgr.DBExists(webhooks[i].ID) {
-			webhookDB, err := h.dbMgr.GetDB(
-				webhooks[i].ID,
+		item.TargetCount, item.InactiveTargetCount, err =
+			h.countWithInactive(&database.Target{}, item.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		// Opening an event database that does not exist would create
+		// it, and it would hold nothing to count.
+		if !h.dbMgr.DBExists(item.ID) {
+			continue
+		}
+
+		err = h.readListEventFigures(item, since)
+		if err != nil {
+			h.log.Error(
+				"failed to read webhook list figures",
+				"webhook_id", item.ID,
+				"error", err,
 			)
-			if err == nil {
-				webhookDB.Model(
-					&database.Event{},
-				).Count(&items[i].EventCount)
-			}
+
+			item.EventsUnreadable = true
 		}
 	}
 
-	return items
+	return items, nil
+}
+
+// countWithInactive returns how many entrypoints or targets, as model
+// says, a webhook has, and how many of them are inactive.
+func (h *Handlers) countWithInactive(
+	model any, webhookID string,
+) (int, int, error) {
+	var active []bool
+
+	err := h.db.DB().Model(model).
+		Where("webhook_id = ?", webhookID).
+		Pluck("active", &active).Error
+	if err != nil {
+		return 0, 0, fmt.Errorf(
+			"reading active flags of webhook %s: %w", webhookID, err,
+		)
+	}
+
+	inactive := 0
+
+	for _, a := range active {
+		if !a {
+			inactive++
+		}
+	}
+
+	return len(active), inactive, nil
+}
+
+// readListEventFigures fills in the figures the list shows from the
+// webhook's event database, with the statistics pane's own queries:
+// the event count and last arrival from the event totals row, and the
+// deliveries that failed since the given time from the deliveries'
+// status index.
+func (h *Handlers) readListEventFigures(
+	item *WebhookListItem, since time.Time,
+) error {
+	webhookDB, err := h.dbMgr.GetDB(item.ID)
+	if err != nil {
+		return err
+	}
+
+	var totals database.EventTotals
+
+	err = webhookDB.Take(&totals).Error
+	if err != nil {
+		return fmt.Errorf("reading event totals: %w", err)
+	}
+
+	item.EventCount = totals.Events - totals.EventsRemoved
+	item.LastEventAt = totals.LastEventAt
+
+	byTarget, err := finishedByTarget(webhookDB, since)
+	if err != nil {
+		return err
+	}
+
+	for _, f := range byTarget {
+		item.FailedLast24Hours += f.Failed
+	}
+
+	return nil
 }
 
 // HandleSourceCreate shows the form to create a new webhook.
@@ -322,7 +419,8 @@ func (h *Handlers) createWebhookWithEntrypoint(
 	)
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, withNotice("/hook/"+webhook.ID, webhookCreated),
+		http.StatusSeeOther,
 	)
 }
 
@@ -579,7 +677,8 @@ func (h *Handlers) applyWebhookEdit(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, withNotice("/hook/"+webhook.ID, webhookSaved),
+		http.StatusSeeOther,
 	)
 }
 
@@ -662,7 +761,9 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}
 
-	http.Redirect(w, r, "/hooks", http.StatusSeeOther)
+	http.Redirect(
+		w, r, withNotice("/hooks", webhookDeleted), http.StatusSeeOther,
+	)
 }
 
 // commitWebhookDeletion soft-deletes a webhook's entrypoints,
@@ -841,31 +942,16 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 			totalPages++
 		}
 
-		// The banner a replay or resubmit POST redirected back
-		// with. The message comes from a fixed set keyed by the
-		// outcome code, never from the query string itself.
-		replayMsg, replayOK := replayOutcome(
-			r.URL.Query().Get(replayOutcomeParam),
-		)
-
-		resubmitMsg, resubmitOK := resubmitOutcome(
-			r.URL.Query().Get(resubmitOutcomeParam),
-		)
-
 		data := map[string]any{
-			tmplKeyWebhook:    &webhook,
-			"Events":          evts,
-			"ReplayMessage":   replayMsg,
-			"ReplayQueued":    replayOK,
-			"ResubmitMessage": resubmitMsg,
-			"ResubmitQueued":  resubmitOK,
-			"Page":            page,
-			"TotalPages":      totalPages,
-			"TotalEvents":     total,
-			"HasPrev":         page > 1,
-			"HasNext":         page < totalPages,
-			"PrevPage":        page - 1,
-			"NextPage":        page + 1,
+			tmplKeyWebhook: &webhook,
+			"Events":       evts,
+			"Page":         page,
+			"TotalPages":   totalPages,
+			"TotalEvents":  total,
+			"HasPrev":      page > 1,
+			"HasNext":      page < totalPages,
+			"PrevPage":     page - 1,
+			"NextPage":     page + 1,
 		}
 
 		h.renderTemplate(w, r, "source_logs.html", data)
@@ -1254,7 +1340,8 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 		}
 
 		http.Redirect(
-			w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+			w, r, withNotice("/hook/"+webhook.ID, entrypointAdded),
+			http.StatusSeeOther,
 		)
 	}
 }
@@ -1365,7 +1452,8 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, withNotice("/hook/"+webhook.ID, targetAdded),
+		http.StatusSeeOther,
 	)
 }
 
@@ -1569,10 +1657,11 @@ func (h *Handlers) validateTargetURL(
 		msg := "Invalid target URL: " + err.Error()
 
 		// Only a private or reserved address's refusal says how
-		// to allow it. Metadata refusals never do: link-local and
-		// the other unconditional metadata addresses cannot be
-		// opened, and the default blocklist's public addresses,
-		// which listing does open, hand out credentials.
+		// to allow it. Other refusals never do: link-local, the
+		// unspecified addresses and the unconditional metadata
+		// addresses cannot be opened, and the default
+		// blocklist's public addresses, which listing does open,
+		// hand out credentials.
 		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
 			msg += ". Private and reserved addresses are refused " +
 				"by default; the server's ALLOWED_EGRESS_CIDRS " +
@@ -1643,6 +1732,7 @@ func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
 		"entrypointID", &database.Entrypoint{},
 		"failed to delete entrypoint",
 		nil,
+		entrypointDeleted,
 	)
 }
 
@@ -1655,18 +1745,21 @@ func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
 		"targetID", &database.Target{},
 		"failed to delete target",
 		h.evictArchiveWriterIfUnused,
+		targetDeleted,
 	)
 }
 
 // deleteChildResource returns a handler that deletes a child
 // resource (entrypoint or target) belonging to a webhook. The
 // optional afterDelete hook runs with the webhook's id once the
-// delete has succeeded, before the redirect.
+// delete has succeeded, before the redirect, which carries done as
+// its notice.
 func (h *Handlers) deleteChildResource(
 	idParam string,
 	model any,
 	errMsg string,
 	afterDelete func(webhookID string),
+	done noticeCode,
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1708,7 +1801,7 @@ func (h *Handlers) deleteChildResource(
 
 		http.Redirect(
 			w, r,
-			"/hook/"+webhook.ID,
+			withNotice("/hook/"+webhook.ID, done),
 			http.StatusSeeOther,
 		)
 	}
@@ -1719,7 +1812,7 @@ func (h *Handlers) deleteChildResource(
 func (h *Handlers) HandleEntrypointToggle() http.HandlerFunc {
 	return h.toggleChildResource(
 		"entrypointID",
-		func(webhookID, childID string) error {
+		func(webhookID, childID string) (bool, error) {
 			var ep database.Entrypoint
 
 			err := h.db.DB().Where(
@@ -1727,14 +1820,15 @@ func (h *Handlers) HandleEntrypointToggle() http.HandlerFunc {
 				childID, webhookID,
 			).First(&ep).Error
 			if err != nil {
-				return err
+				return false, err
 			}
 
 			ep.Active = !ep.Active
 
-			return h.db.DB().Save(&ep).Error
+			return ep.Active, h.db.DB().Save(&ep).Error
 		},
 		"failed to toggle entrypoint",
+		entrypointActivated, entrypointDeactivated,
 	)
 }
 
@@ -1742,7 +1836,7 @@ func (h *Handlers) HandleEntrypointToggle() http.HandlerFunc {
 func (h *Handlers) HandleTargetToggle() http.HandlerFunc {
 	return h.toggleChildResource(
 		"targetID",
-		func(webhookID, childID string) error {
+		func(webhookID, childID string) (bool, error) {
 			var tgt database.Target
 
 			err := h.db.DB().Where(
@@ -1750,23 +1844,27 @@ func (h *Handlers) HandleTargetToggle() http.HandlerFunc {
 				childID, webhookID,
 			).First(&tgt).Error
 			if err != nil {
-				return err
+				return false, err
 			}
 
 			tgt.Active = !tgt.Active
 
-			return h.db.DB().Save(&tgt).Error
+			return tgt.Active, h.db.DB().Save(&tgt).Error
 		},
 		"failed to toggle target",
+		targetActivated, targetDeactivated,
 	)
 }
 
 // toggleChildResource returns a handler that toggles the active
-// state of a child resource belonging to a webhook.
+// state of a child resource belonging to a webhook. toggleFn returns
+// the new state, and the redirect carries activated or deactivated as
+// its notice to match.
 func (h *Handlers) toggleChildResource(
 	idParam string,
-	toggleFn func(webhookID, childID string) error,
+	toggleFn func(webhookID, childID string) (bool, error),
 	errMsg string,
+	activated, deactivated noticeCode,
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1792,16 +1890,21 @@ func (h *Handlers) toggleChildResource(
 			return
 		}
 
-		err = toggleFn(webhook.ID, childID)
+		active, err := toggleFn(webhook.ID, childID)
 		if err != nil {
 			h.serverError(w, r, errMsg, err)
 
 			return
 		}
 
+		done := deactivated
+		if active {
+			done = activated
+		}
+
 		http.Redirect(
 			w, r,
-			"/hook/"+webhook.ID,
+			withNotice("/hook/"+webhook.ID, done),
 			http.StatusSeeOther,
 		)
 	}

internal/handlers/target_edit.go

@@ -161,7 +161,8 @@ func (h *Handlers) applyTargetEdit(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, withNotice("/hook/"+webhook.ID, targetSaved),
+		http.StatusSeeOther,
 	)
 }
 

internal/resetpw/resetpw_test.go

@@ -152,6 +152,10 @@ func newServerApp(
 
 	app := fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,

internal/server/error_page_test.go

@@ -83,6 +83,22 @@ func TestErrorPage_DeletedTarget(t *testing.T) {
 	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
 }
 
+// TestErrorPage_ShowsNoNotice pins that a notice code in the URL of a
+// page that fails is not shown above the error.
+func TestErrorPage_ShowsNoNotice(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	userID, _ := env.seedUser(t, "owner", "somepassword")
+	cookies := env.authCookies(t, userID, "owner")
+
+	w := env.get("/hook/no-such-webhook?notice=webhook-saved", cookies)
+
+	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
+	assert.NotContains(t, w.Body.String(), "Webhook saved.")
+}
+
 func TestErrorPage_UnknownPath(t *testing.T) {
 	t.Parallel()
 

internal/server/routes_test.go

@@ -104,6 +104,10 @@ func newTestEnvWithConfig(
 
 	app := fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -263,6 +267,24 @@ func (e *testEnv) urlFrom(
 	return html.UnescapeString(match[1])
 }
 
+// requireNotice requires w to redirect to dest carrying the notice
+// code, then renders that page and requires it to show text.
+func (e *testEnv) requireNotice(
+	t *testing.T,
+	w *httptest.ResponseRecorder,
+	dest, code, text string,
+	cookies []*http.Cookie,
+) {
+	t.Helper()
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	require.Equal(t, dest+"?notice="+code, w.Header().Get("Location"))
+
+	page := e.get(w.Header().Get("Location"), cookies)
+	require.Equal(t, http.StatusOK, page.Code)
+	assert.Contains(t, page.Body.String(), text)
+}
+
 // authCookies forges an authenticated session for the given user.
 func (e *testEnv) authCookies(
 	t *testing.T,
@@ -741,6 +763,31 @@ func TestPagesLogin_ReturnsToTheRequestedPage(t *testing.T) {
 	assert.Equal(t, asked, w.Header().Get("Location"))
 }
 
+// TestPagesLogout_SaysSignedOut signs out with the navbar's form and
+// lands on the sign-in page, which says so.
+func TestPagesLogout_SaysSignedOut(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	userID, _ := env.seedUser(t, "leaver", "somepassword")
+	token, cookies := env.csrfFrom(
+		t, "/hooks", env.authCookies(t, userID, "leaver"),
+	)
+
+	form := url.Values{}
+	form.Set("csrf_token", token)
+
+	w := env.post(
+		env.urlFrom(t, "/hooks", `action="(/pages/logout)"`, cookies),
+		form, cookies,
+	)
+
+	// The sign-in page is requested without the session cookie, which
+	// the logout told the browser to delete.
+	env.requireNotice(t, w, "/pages/login", "signed-out", "Signed out.", nil)
+}
+
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -858,9 +905,9 @@ func TestHooks_ListAndNewWebhookForm(t *testing.T) {
 	require.NoError(t,
 		env.db.DB().Where("name = ?", "created").First(&created).Error,
 	)
-	assert.Equal(
-		t, "/hook/"+created.ID, w.Header().Get("Location"),
-		"creating a webhook should redirect to its page",
+	env.requireNotice(
+		t, w, "/hook/"+created.ID, "webhook-created", "Webhook created.",
+		cookies,
 	)
 }
 
@@ -891,8 +938,7 @@ func TestHook_EditFormAndDelete(t *testing.T) {
 		env.urlFrom(t, editPage, `action="(/hook/[^/"]+/edit)"`, cookies),
 		form, cookies,
 	)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, page, w.Header().Get("Location"))
+	env.requireNotice(t, w, page, "webhook-saved", "Webhook saved.", cookies)
 
 	var edited database.Webhook
 
@@ -906,16 +952,17 @@ func TestHook_EditFormAndDelete(t *testing.T) {
 		env.urlFrom(t, page, `action="(/hook/[^/"]+/delete)"`, cookies),
 		form, cookies,
 	)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/hooks", w.Header().Get("Location"))
+	env.requireNotice(
+		t, w, "/hooks", "webhook-deleted", "Webhook deleted.", cookies,
+	)
 	assert.Equal(
 		t, http.StatusNotFound, env.get(page, cookies).Code,
 		"a deleted webhook's page should be gone",
 	)
 }
 
-// TestHook_EntrypointActions adds, deactivates and deletes an
-// entrypoint with the forms on the webhook page, each submitted to
+// TestHook_EntrypointActions adds, deactivates, activates and deletes
+// an entrypoint with the forms on the webhook page, each submitted to
 // the action and with the token the page rendered.
 func TestHook_EntrypointActions(t *testing.T) {
 	t.Parallel()
@@ -933,16 +980,19 @@ func TestHook_EntrypointActions(t *testing.T) {
 	form.Set("csrf_token", token)
 
 	// submit posts the webhook page's form whose action pattern
-	// captures, and requires the redirect back to that page.
-	submit := func(pattern string) {
+	// captures, and requires the redirect back to that page with the
+	// notice code, and the page to show text.
+	submit := func(pattern, code, text string) {
 		t.Helper()
 
 		w := env.post(env.urlFrom(t, page, pattern, cookies), form, cookies)
-		require.Equal(t, http.StatusSeeOther, w.Code)
-		require.Equal(t, page, w.Header().Get("Location"))
+		env.requireNotice(t, w, page, code, text, cookies)
 	}
 
-	submit(`action="(/hook/[^/"]+/entrypoints)"`)
+	toggle := `action="(/hook/[^/"]+/entrypoints/[^/"]+/toggle)"`
+
+	submit(`action="(/hook/[^/"]+/entrypoints)"`,
+		"entrypoint-added", "Entrypoint added.")
 
 	var added database.Entrypoint
 
@@ -951,7 +1001,7 @@ func TestHook_EntrypointActions(t *testing.T) {
 	)
 	require.True(t, added.Active)
 
-	submit(`action="(/hook/[^/"]+/entrypoints/[^/"]+/toggle)"`)
+	submit(toggle, "entrypoint-deactivated", "Entrypoint deactivated.")
 
 	var toggled database.Entrypoint
 
@@ -960,7 +1010,10 @@ func TestHook_EntrypointActions(t *testing.T) {
 	)
 	assert.False(t, toggled.Active, "the toggle should deactivate it")
 
-	submit(`action="(/hook/[^/"]+/entrypoints/[^/"]+/delete)"`)
+	submit(toggle, "entrypoint-activated", "Entrypoint activated.")
+
+	submit(`action="(/hook/[^/"]+/entrypoints/[^/"]+/delete)"`,
+		"entrypoint-deleted", "Entrypoint deleted.")
 
 	var left int64
 
@@ -971,8 +1024,8 @@ func TestHook_EntrypointActions(t *testing.T) {
 
 // TestHook_TargetActions adds a target with the form on the webhook
 // page, follows its Edit link to the target edit form and submits
-// it, then deactivates and deletes it, every URL and token taken from
-// the rendered pages.
+// it, then deactivates, activates and deletes it, every URL and token
+// taken from the rendered pages.
 func TestHook_TargetActions(t *testing.T) {
 	t.Parallel()
 
@@ -987,27 +1040,29 @@ func TestHook_TargetActions(t *testing.T) {
 
 	// submit posts form, with the token, to the action pattern
 	// captures on the page at from, and requires the redirect back to
-	// the webhook page.
-	submit := func(from, pattern string, form url.Values) {
+	// the webhook page with the notice code, and that page to show
+	// text.
+	submit := func(from, pattern string, form url.Values, code, text string) {
 		t.Helper()
 
 		form.Set("csrf_token", token)
 
 		w := env.post(env.urlFrom(t, from, pattern, cookies), form, cookies)
-		require.Equal(t, http.StatusSeeOther, w.Code)
-		require.Equal(t, page, w.Header().Get("Location"))
+		env.requireNotice(t, w, page, code, text, cookies)
 	}
 
+	toggle := `action="(/hook/[^/"]+/targets/[^/"]+/toggle)"`
+
 	submit(page, `action="(/hook/[^/"]+/targets)"`, url.Values{
 		"name": {"added"},
 		"type": {string(database.TargetTypeLog)},
-	})
+	}, "target-added", "Target added.")
 
 	editPage := env.urlFrom(
 		t, page, `href="(/hook/[^/"]+/targets/[^/"]+/edit)"`, cookies,
 	)
 	submit(editPage, `action="(/hook/[^/"]+/targets/[^/"]+/edit)"`,
-		url.Values{"name": {"renamed"}})
+		url.Values{"name": {"renamed"}}, "target-saved", "Target saved.")
 
 	var edited database.Target
 
@@ -1017,8 +1072,8 @@ func TestHook_TargetActions(t *testing.T) {
 	assert.Equal(t, "renamed", edited.Name)
 	require.True(t, edited.Active)
 
-	submit(page, `action="(/hook/[^/"]+/targets/[^/"]+/toggle)"`,
-		url.Values{})
+	submit(page, toggle, url.Values{},
+		"target-deactivated", "Target deactivated.")
 
 	var toggled database.Target
 
@@ -1027,8 +1082,11 @@ func TestHook_TargetActions(t *testing.T) {
 	)
 	assert.False(t, toggled.Active, "the toggle should deactivate it")
 
+	submit(page, toggle, url.Values{},
+		"target-activated", "Target activated.")
+
 	submit(page, `action="(/hook/[^/"]+/targets/[^/"]+/delete)"`,
-		url.Values{})
+		url.Values{}, "target-deleted", "Target deleted.")
 
 	var left int64
 
@@ -1064,9 +1122,9 @@ func TestHook_ResubmitFromEventLog(t *testing.T) {
 		env.urlFrom(t, logsPath, `action="(/hook/[^"]+/resubmit)"`, cookies),
 		form, cookies,
 	)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, logsPath+"?resubmit=no-targets", w.Header().Get("Location"),
+	env.requireNotice(
+		t, w, logsPath, "resubmit-no-targets",
+		"this source has no active targets", cookies,
 	)
 
 	webhookDB, err := env.dbMgr.GetDB(wh.ID)
@@ -1302,10 +1360,8 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 		html.UnescapeString(action[1]), form, cookies,
 	)
 
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, logsPath+"?replay=queued",
-		w.Header().Get("Location"),
+	env.requireNotice(
+		t, w, logsPath, "replay-queued", "Replay queued:", cookies,
 	)
 	assert.Equal(
 		t, int64(2), env.countDeliveries(t, wh.ID),

templates/base.html

@@ -7,6 +7,7 @@
 <body class="bg-gray-50 min-h-screen flex flex-col">
     <div class="flex-grow">
         {{template "navbar" .}}
+        {{template "notice" .}}
         {{block "content" .}}{{end}}
     </div>
     {{template "footer" .}}

templates/notice.html

@@ -0,0 +1,7 @@
+{{define "notice"}}
+{{with .Notice}}
+<div class="max-w-6xl mx-auto px-6 pt-4">
+    <div class="{{if .Failed}}alert-error{{else}}alert-success{{end}}">{{.Text}}</div>
+</div>
+{{end}}
+{{end}}

templates/source_detail.html

@@ -3,10 +3,14 @@
 {{define "title"}}{{.Webhook.Name}} - Webhooker{{end}}
 
 {{define "content"}}
-<div class="max-w-6xl mx-auto px-6 py-8" x-data="{ showAddEntrypoint: false, showAddTarget: false }">
+<!-- 108rem, half again the 72rem (max-w-6xl) of the webhook list, the
+     event log, the navbar and the footer, so an entrypoint URL fits on
+     one line. An inline style, because the committed tailwind.css has
+     no class this wide. -->
+<div class="mx-auto px-6 py-8" style="max-width: 108rem" x-data="{ showAddEntrypoint: false, showAddTarget: false }">
     <div class="mb-6">
         <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
-        <div class="flex justify-between items-center mt-2">
+        <div class="flex flex-wrap justify-between items-center gap-2 mt-2">
             <div>
                 <h1 class="text-2xl font-medium text-gray-900">{{.Webhook.Name}}</h1>
                 {{if .Webhook.Description}}

templates/source_logs.html

@@ -12,14 +12,6 @@
         </div>
     </div>
 
-    {{if .ReplayMessage}}
-    <div class="{{if .ReplayQueued}}alert-success{{else}}alert-error{{end}}">{{.ReplayMessage}}</div>
-    {{end}}
-
-    {{if .ResubmitMessage}}
-    <div class="{{if .ResubmitQueued}}alert-success{{else}}alert-error{{end}}">{{.ResubmitMessage}}</div>
-    {{end}}
-
     <div class="card">
         <div class="divide-y divide-gray-100">
             {{range .Events}}

templates/sources_list.html

@@ -27,10 +27,16 @@
                 </div>
                 <span class="badge-info">Retention: {{.RetentionLabel}}</span>
             </div>
-            <div class="flex gap-6 mt-4 text-sm text-gray-500">
-                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>
-                <span>{{.TargetCount}} target{{if ne .TargetCount 1}}s{{end}}</span>
-                <span>{{.EventCount}} event{{if ne .EventCount 1}}s{{end}}</span>
+            <div class="flex flex-wrap gap-6 mt-4 text-sm text-gray-500">
+                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}{{if .InactiveEntrypointCount}}, {{.InactiveEntrypointCount}} inactive{{end}}</span>
+                <span>{{.TargetCount}} target{{if ne .TargetCount 1}}s{{end}}{{if .InactiveTargetCount}}, {{.InactiveTargetCount}} inactive{{end}}</span>
+                {{if .EventsUnreadable}}
+                <span class="text-red-600">The event figures could not be read.</span>
+                {{else}}
+                <span>{{.EventCount}} event{{if ne .EventCount 1}}s{{end}} within retention</span>
+                <span>{{with .LastEventAt}}Last event {{.UTC.Format "2006-01-02 15:04:05 UTC"}}{{else}}No events yet{{end}}</span>
+                <span class="{{if .FailedLast24Hours}}font-medium text-red-600{{end}}">{{.FailedLast24Hours}} failed deliver{{if eq .FailedLast24Hours 1}}y{{else}}ies{{end}} in the last 24 hours</span>
+                {{end}}
             </div>
         </a>
         {{end}}