Close the two remaining delivery terminal-state gaps (closes #107)

A delivery could reach a bad end without the engine recording why, and
a retrying delivery could fail to reach an end at all.

An unknown target type marked the delivery failed and wrote no
DeliveryResult, so the event log showed "failed" with no attempts and
the only account of why was one line in the server log. It now records
a result naming the type before failing the delivery.

A deleted target left its retrying deliveries stranded. Both recovery
and the sweep began with a scoped loadTarget, which cannot see a soft
deleted row, so both logged and returned: the delivery stayed retrying
for the life of the database while the sweep repeated the same error
every minute. Both now terminalise it with a recorded reason.

Deleting a target also did not stop deliveries to it. A scheduled
retry is a time.AfterFunc holding the target's configuration from when
the chain began, and nothing on that path read the target row, so the
timer kept firing and kept sending to the destination the operator had
removed for the rest of the backoff chain; terminalising in recovery
and the sweep alone would only have caught it after a restart.
processRetryTask now confirms the target still exists before it
attempts, and abandons the chain when it does not.

Only a target confirmed gone stops anything. A lookup that fails for
any other reason is the main database being unreadable, which is
transient, and every path leaves the delivery exactly as it was rather
than failing it.

The reason text comes from one Unscoped lookup confined to these
terminal paths, because a soft deleted row is what distinguishes a
target the operator deleted from an id that never named one. The
engine's normal target loading stays scoped, or deleting a target
would stop nothing.

Terminal writes reached from recovery keep going through the existing
retainIdle ownership gate; the retry path writes directly, as a
target's own Deliver does, because the worker already holds that
delivery. Nothing was added to either sweep dispatch arm.

Retry fixtures that drove processRetryTask for a target id with no row
in the main database now create one. That state is not reachable in
service: the handler reads the target to build the task.

README.md

@@ -7,13 +7,6 @@ services, durably stores them, and delivers them to configured targets
 with retry support, logging, and observability. Category: infrastructure
 / web service. License: MIT.
 
-Each entrypoint is a version 4 UUID served at `/webhook/{uuid}`, and
-that UUID is the entrypoint's only credential. webhooker does not use
-shared secrets, HMAC signatures or token headers on the receiver, and
-will not add them — read
-[The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret)
-before deploying one.
-
 ## Getting Started
 
 ### Prerequisites
@@ -1156,38 +1149,14 @@ backups at rest and restrict who can read them.
 
 ## The entrypoint URL is the authentication secret
 
-**The entrypoint UUID is the credential, and it is the only one.**
-webhooker mints a version 4 UUID per entrypoint and serves it at
-`/webhook/{uuid}`. Possession of that URL is the authentication:
-anyone who holds it can submit events to the entrypoint, and the
-receiver verifies nothing else about the sender.
+The receiver verifies nothing about an inbound request. The UUID in an
+entrypoint's URL is its credential: anyone who holds that URL can
+submit events to it, and the receiver checks nothing else about the
+sender. Treat an entrypoint URL the way you would treat an API token.
 
-There is no shared secret, no HMAC signature, no bearer token and no
-second factor on the receiver, and none will be added. This was
-considered and rejected; the implementation that existed was removed
-in [PR #279](https://git.eeqj.de/sneak/webhooker/pulls/279), closing
-[issue #67](https://git.eeqj.de/sneak/webhooker/issues/67) and
-[issue #241](https://git.eeqj.de/sneak/webhooker/issues/241). A
-proposal to reintroduce any of them — including as "defence in depth"
-alongside the UUID — is answered by this section. Inbound signature
-headers a sender sends anyway (`X-Hub-Signature` and its
-per-provider equivalents) are stored and forwarded as ordinary
-headers; nothing checks them.
-
-What that means for an operator:
-
-- **The URL is a capability, so treat it as a secret.** Keep it out of
-  logs, ticket bodies, chat messages and screenshots. Anyone who reads
-  it anywhere can post events as that sender.
-- **Rotating means minting a new entrypoint, not changing a key.**
-  There is no way to rotate the UUID in place. To retire one, delete
-  the entrypoint (or deactivate it, which answers `410`) and create a
-  new one, then point the sender at the new URL.
-- **A sender that cannot be given a secret URL is a constraint on that
-  integration, not a reason to change this.** If a service only
-  supports signed payloads to a well-known URL, raise it as its own
-  problem — pick a different integration path, or accept that it
-  cannot be used. It is not grounds to reintroduce shared secrets.
+There is no way to rotate the UUID in place. To retire one, delete the
+entrypoint (or deactivate it, which answers `410`) and create a new
+one, then point the sender at the new URL.
 
 ## Entrypoints
 
@@ -1265,16 +1234,6 @@ webhooker solves this by acting as a durable intermediary:
    backoff. Every delivery attempt is logged with status codes, response
    bodies, and timing.
 
-   **That guarantee is at-least-once, not exactly-once.** When a send
-   reaches its target but the write recording that outcome fails, the
-   delivery is deliberately left in a recoverable state rather than
-   marked done — losing a delivery is the worse failure — so the
-   pending sweep picks it up about fifteen minutes later, or the next
-   restart does, and the target receives a payload it already got.
-   webhooker adds no delivery identifier of its own to an outbound
-   request, so **make your receiver idempotent** against whatever the
-   payload itself carries.
-
 3. **Observability** — Full request/response logging for every webhook
    received and every delivery attempted. Prometheus metrics expose
    volume, latency, and error rates. The web UI provides real-time
@@ -2657,15 +2616,12 @@ abuse limit later; they are tracked as future work.
 | `POST` | `/source/{id}/edit`      | Edit webhook submission |
 | `POST` | `/source/{id}/delete`    | Delete webhook |
 | `GET`  | `/source/{id}/logs`      | Webhook event logs |
-| `GET`  | `/source/{id}/logs/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
 | `POST` | `/source/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
 | `POST` | `/source/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
 | `POST` | `/source/{id}/entrypoints` | Add entrypoint to webhook |
 | `POST` | `/source/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
 | `POST` | `/source/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
 | `POST` | `/source/{id}/targets`   | Add target to webhook |
-| `GET`  | `/source/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
-| `POST` | `/source/{id}/targets/{targetID}/edit` | Edit target submission |
 | `POST` | `/source/{id}/targets/{targetID}/delete` | Delete a target |
 | `POST` | `/source/{id}/targets/{targetID}/toggle` | Enable or disable a target |
 
@@ -2704,8 +2660,6 @@ webhooker/
 ├── internal/
 │   ├── banner/
 │   │   └── banner.go          # Ruled block for the one credential shown in the clear
-│   ├── ciscript/
-│   │   └── doc.go             # Tests for the CI shell scripts in script/; no runtime code
 │   ├── resetpw/
 │   │   └── resetpw.go         # `webhooker resetpw`: set an account's password, stopped deployments only
 │   ├── config/
@@ -2775,17 +2729,13 @@ webhooker/
 │   │   ├── ratelimit.go       # Per-IP rate limiting middleware (go-chi/httprate)
 │   │   ├── loginguard.go      # Login failure counters and the Argon2id verification semaphore
 │   │   └── testing.go         # NewForTest: Middleware without the fx lifecycle
-│   ├── reqtls/
-│   │   └── reqtls.go          # IsTLS: the one TLS predicate, r.TLS or X-Forwarded-Proto
 │   ├── server/
 │   │   ├── server.go          # Server struct, fx lifecycle, signal handling
 │   │   ├── http.go            # HTTP server setup with timeouts
 │   │   └── routes.go          # All route definitions
-│   ├── session/
-│   │   ├── session.go         # Cookie-based session management
-│   │   └── testing.go         # NewForTest: Session without the fx lifecycle
-│   └── versionscript/
-│       └── doc.go             # Tests for script/version and the build files that use it
+│   └── session/
+│       ├── session.go         # Cookie-based session management
+│       └── testing.go         # NewForTest: Session without the fx lifecycle
 ├── static/
 │   ├── static.go              # //go:embed directive
 │   ├── css/input.css          # Tailwind input, source for tailwind.css (make css)
@@ -2898,10 +2848,6 @@ check, see [The login endpoint](#the-login-endpoint).
 
 ### Authentication
 
-- **Webhook receiver:** the entrypoint UUID in the URL, and nothing
-  else. No shared secret, no HMAC signature, no token header, and none
-  will be added — see
-  [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret).
 - **Web UI:** Cookie-based sessions using gorilla/sessions with
   encrypted cookies. Sessions are configured with HttpOnly, SameSite
   Lax, and Secure whenever the request is on TLS — the flag follows the
@@ -2941,8 +2887,7 @@ check, see [The login endpoint](#the-login-endpoint).
   mode
 - **The entrypoint URL is the receiver's only credential.** Nothing
   about an inbound request is verified; possession of the UUID
-  authorises submission, and no shared secret or signature check will
-  be added alongside it (see
+  authorises submission (see
   [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret))
 - **SSRF prevention** for HTTP delivery targets: private/reserved IP
   ranges (RFC 1918, loopback, link-local, cloud metadata) are blocked

TODO.md

@@ -18,27 +18,18 @@ Issue branches do NOT touch this file — the manager maintains it on
 
 # Status
 
-The milestone (https://git.eeqj.de/sneak/webhooker/milestone/9) is the
-authoritative list, and the only place to read a count or a state of
-play from. This file records where the project is, not what is in
-flight: a sentence whose truth depends on a branch being unmerged is
-wrong the moment it merges, and this file has been wrong that way
-before.
+1.0.0 is open, with work remaining. The milestone
+(https://git.eeqj.de/sneak/webhooker/milestone/9) is the authoritative
+list, and the only place to read a count or a state of play from. This
+file records where the project is, not what is in flight: a sentence
+whose truth depends on a branch being unmerged is wrong the moment it
+merges, and this file has been wrong that way before.
 
-The durability defect that held the tag has landed
-(https://git.eeqj.de/sneak/webhooker/issues/256, commit `8d64259`).
-Every SQLite handle opens with WAL journaling and a busy timeout, a
-bookkeeping write that fails leaves its delivery in a recoverable
-state rather than a lying one, and recovery skips a delivery that
-already has a successful result row. Final pre-tag verification
-exercised it and confirmed it holds. Whatever the milestone still
-shows open is what remains before `v1.0.0`.
-
-Delivery is at-least-once by design, not by accident: a send whose
-result row does not land is attempted again, so a receiver can see a
-duplicate. That is deliberate — the alternative is a silent lost
-delivery — and the README says so under Rationale. It is not a defect
-to re-file.
+The tag is held on a durability defect
+(https://git.eeqj.de/sneak/webhooker/issues/256): a concurrent reader
+of a per-webhook event database strands delivered webhooks at
+`pending`, and the next restart re-delivers them. That issue gates
+`v1.0.0`, and is where the fix's own state is tracked.
 
 One caveat on reading a green check: a docs-only commit deliberately
 replays from the layer cache
@@ -48,11 +39,11 @@ commit invalidates the `COPY` layer and genuinely executes.
 
 # Next Step
 
-Clear the rest of the open 1.0.0 milestone
-(https://git.eeqj.de/sneak/webhooker/milestone/9) and tag `v1.0.0`.
-Merging `next` into `main` is a separate act from tagging and waits on
-neither of those: `next` is kept mergeable at all times, which is the
-point of the branch.
+Land https://git.eeqj.de/sneak/webhooker/issues/256, then clear the
+rest of the open 1.0.0 milestone and tag `v1.0.0`. Merging `next` into
+`main` is a separate act from tagging and waits on neither of those:
+`next` is kept mergeable at all times, which is the point of the
+branch.
 
 # Completed Steps
 

internal/delivery/engine.go

@@ -440,7 +440,7 @@ func (e *Engine) processNewTask(
 
 	event := buildEventFromTask(task)
 
-	event, err = e.hydrateEvent(
+	event, err = e.resolveEventBody(
 		webhookDB, event, task,
 	)
 	if err != nil {
@@ -512,7 +512,7 @@ func (e *Engine) processRetryTask(
 
 	event := buildEventFromTask(task)
 
-	event, err = e.hydrateEvent(
+	event, err = e.resolveEventBody(
 		webhookDB, event, task,
 	)
 	if err != nil {
@@ -1547,11 +1547,6 @@ func truncate(s string, maxLen int) string {
 
 // --- Helper functions ---
 
-// buildEventFromTask reconstructs the event a Task describes, as far
-// as the Task itself goes. The fields it cannot fill — the body when
-// it was too large to inline, and the receipt time, which no Task
-// carries — come from the stored row in hydrateEvent, which every
-// caller of this function runs next.
 func buildEventFromTask(task *Task) database.Event {
 	event := database.Event{
 		EntrypointID: task.EntrypointID,
@@ -1579,67 +1574,29 @@ func buildTargetFromTask(task *Task) database.Target {
 	return target
 }
 
-// hydrateEvent fills in the event fields a Task does not carry, by
-// reading the stored event row.
-//
-// CreatedAt is the event's receipt time and lives only in that row.
-// The Slack target renders it into every message it sends, so an
-// unhydrated event puts the zero time in front of a human on every
-// notification the product delivers. See
-// https://git.eeqj.de/sneak/webhooker/issues/257.
-//
-// The body comes from the same row when the Task did not inline it,
-// which is the case for a body at or above MaxInlineBodySize.
-//
-// A read failure is fatal to the delivery only when the body depended
-// on it. When the Task inlined the body, the delivery has everything
-// it needs to be sent and goes ahead with the timestamp unset: the row
-// can be gone under a retention reap while a queued delivery still
-// holds its body, and dropping a deliverable event to protect one
-// metadata field would be a worse failure than the one it prevents.
-func (e *Engine) hydrateEvent(
+func (e *Engine) resolveEventBody(
 	webhookDB *gorm.DB,
 	event database.Event,
 	task *Task,
 ) (database.Event, error) {
-	columns := []string{"created_at"}
-
-	if task.Body == nil {
-		columns = append(columns, "body")
-	}
-
-	var dbEvent database.Event
-
-	err := webhookDB.Select(columns).
-		First(&dbEvent, "id = ?", task.EventID).Error
-	if err != nil {
-		if task.Body == nil {
-			return event, fmt.Errorf(
-				"fetching event body: %w", err,
-			)
-		}
-
-		e.log.Warn(
-			"could not read the stored event; delivering "+
-				"the inlined body without its receipt time",
-			"event_id", task.EventID,
-			"delivery_id", task.DeliveryID,
-			"error", err,
-		)
-
+	if task.Body != nil {
 		event.Body = *task.Body
 
 		return event, nil
 	}
 
-	event.CreatedAt = dbEvent.CreatedAt
+	var dbEvent database.Event
 
-	if task.Body != nil {
-		event.Body = *task.Body
-	} else {
-		event.Body = dbEvent.Body
+	err := webhookDB.Select("body").
+		First(&dbEvent, "id = ?", task.EventID).Error
+	if err != nil {
+		return event, fmt.Errorf(
+			"fetching event body: %w", err,
+		)
 	}
 
+	event.Body = dbEvent.Body
+
 	return event, nil
 }
 

internal/delivery/event_timestamp_test.go

@@ -1,442 +0,0 @@
-package delivery_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/delivery"
-)
-
-// tsEventCreatedAt is the receipt time seeded on the events these
-// tests deliver. It is far enough from both the zero time and from
-// now that neither can be mistaken for it.
-func tsEventCreatedAt() time.Time {
-	return time.Date(
-		2026, time.March, 4, 5, 6, 7, 0, time.UTC,
-	)
-}
-
-// tsZeroStamp is what a Slack message renders when the event handed
-// to FormatSlackMessage carries no CreatedAt.
-const tsZeroStamp = "*Timestamp:* `0001-01-01T00:00:00Z`"
-
-// tsEventBody is the body seeded on every event in this file. It is
-// small enough that a Task can inline it.
-const tsEventBody = `{"hello":"world"}`
-
-// tsUndeliverableHook stands in for a Slack incoming webhook on the
-// tests that never send: the config parser requires a URL, but no
-// request is made.
-const tsUndeliverableHook = "https://hooks.slack.com/services/T/B/x"
-
-// tsSink is a stand-in Slack incoming webhook that records the raw
-// body posted to it.
-type tsSink struct {
-	*httptest.Server
-
-	bodies chan []byte
-}
-
-func newTSSink(t *testing.T) *tsSink {
-	t.Helper()
-
-	s := &tsSink{bodies: make(chan []byte, 8)}
-
-	s.Server = httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			body, _ := io.ReadAll(r.Body)
-
-			select {
-			case s.bodies <- body:
-			default:
-			}
-
-			w.WriteHeader(http.StatusOK)
-		},
-	))
-
-	t.Cleanup(s.Close)
-
-	return s
-}
-
-// text returns the Slack message text from the single payload the
-// sink received.
-func (s *tsSink) text(t *testing.T) string {
-	t.Helper()
-
-	select {
-	case raw := <-s.bodies:
-		t.Logf("raw slack payload: %s", raw)
-
-		var payload struct {
-			Text string `json:"text"`
-		}
-
-		require.NoError(t, json.Unmarshal(raw, &payload))
-
-		return payload.Text
-	case <-time.After(5 * time.Second):
-		t.Fatal("slack sink received no payload")
-
-		return ""
-	}
-}
-
-func tsSlackConfig(t *testing.T, url string) string {
-	t.Helper()
-
-	data, err := json.Marshal(
-		delivery.SlackTargetConfig{WebhookURL: url},
-	)
-	require.NoError(t, err)
-
-	return string(data)
-}
-
-// tsSeedEvent writes an event whose CreatedAt is tsEventCreatedAt
-// rather than the write time, so an assertion on the rendered
-// timestamp cannot pass by accident against "roughly now".
-func tsSeedEvent(
-	t *testing.T, db *gorm.DB, webhookID string,
-) database.Event {
-	t.Helper()
-
-	event := database.Event{
-		WebhookID:    webhookID,
-		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
-		Headers:      `{}`,
-		Body:         tsEventBody,
-		ContentType:  "application/json",
-	}
-	event.ID = uuid.New().String()
-	event.CreatedAt = tsEventCreatedAt()
-	event.UpdatedAt = tsEventCreatedAt()
-
-	require.NoError(t, db.Create(&event).Error)
-
-	var stored database.Event
-
-	require.NoError(t,
-		db.First(&stored, "id = ?", event.ID).Error,
-	)
-	require.Equal(t,
-		tsEventCreatedAt().UTC(), stored.CreatedAt.UTC(),
-		"seeded created_at did not round-trip",
-	)
-
-	return event
-}
-
-// tsSeedTarget writes the slack target row into the main database.
-// The retry path confirms the target still exists before sending.
-func tsSeedTarget(
-	t *testing.T, mainDB *gorm.DB, webhookID, config string,
-) database.Target {
-	t.Helper()
-
-	target := database.Target{
-		WebhookID: webhookID,
-		Name:      "slack-sink",
-		Type:      database.TargetTypeSlack,
-		Config:    config,
-		Active:    true,
-	}
-
-	require.NoError(t, mainDB.Create(&target).Error)
-
-	return target
-}
-
-func tsTask(
-	d database.Delivery,
-	event database.Event,
-	webhookID string,
-	target database.Target,
-	attemptNum int,
-	body *string,
-) delivery.Task {
-	return delivery.Task{
-		DeliveryID:   d.ID,
-		EventID:      event.ID,
-		WebhookID:    webhookID,
-		EntrypointID: event.EntrypointID,
-		TargetID:     target.ID,
-		TargetName:   target.Name,
-		TargetType:   database.TargetTypeSlack,
-		TargetConfig: target.Config,
-		MaxRetries:   0,
-		Method:       event.Method,
-		Headers:      event.Headers,
-		ContentType:  event.ContentType,
-		Body:         body,
-		AttemptNum:   attemptNum,
-	}
-}
-
-func tsAssertRealTimestamp(t *testing.T, text string) {
-	t.Helper()
-
-	assert.NotContains(t, text, tsZeroStamp,
-		"slack message carries the zero timestamp",
-	)
-	assert.Contains(t, text,
-		"*Timestamp:* `"+
-			tsEventCreatedAt().UTC().Format(time.RFC3339)+"`",
-		"slack message does not carry the event's receipt time",
-	)
-}
-
-// tsCase is one end-to-end delivery of a seeded event to a slack
-// sink, over whichever engine path `process` names.
-type tsCase struct {
-	// status is the delivery row's status before the engine runs.
-	// The retry path refuses a delivery that is not retrying.
-	status database.DeliveryStatus
-
-	// inlineBody mirrors a Task built for a body under
-	// MaxInlineBodySize. When false the engine reads the body back
-	// from the stored row.
-	inlineBody bool
-
-	attemptNum int
-
-	process func(
-		ctx context.Context, e *delivery.Engine, task *delivery.Task,
-	)
-}
-
-// run delivers one event through the named path and returns the
-// Slack message text the sink received.
-func (c tsCase) run(t *testing.T) (iSetup, database.Delivery, string) {
-	t.Helper()
-
-	s := newISetup(t)
-	sink := newTSSink(t)
-
-	cfg := tsSlackConfig(t, sink.URL)
-	target := tsSeedTarget(t, s.MainDB, s.WebhookID, cfg)
-	event := tsSeedEvent(t, s.WebhookDB, s.WebhookID)
-
-	d := iSeedDelivery(
-		t, s.WebhookDB, event.ID, target.ID, c.status,
-	)
-
-	var body *string
-
-	if c.inlineBody {
-		bodyStr := event.Body
-		body = &bodyStr
-	}
-
-	task := tsTask(
-		d, event, s.WebhookID, target, c.attemptNum, body,
-	)
-
-	c.process(context.TODO(), s.Engine, &task)
-
-	return s, d, sink.text(t)
-}
-
-// TestSlackFirstAttemptCarriesEventTimestamp covers the path an
-// event takes on its first delivery: the task comes from the
-// receiver and the engine reconstructs the event from it.
-func TestSlackFirstAttemptCarriesEventTimestamp(t *testing.T) {
-	t.Parallel()
-
-	s, d, text := tsCase{
-		status:     database.DeliveryStatusPending,
-		inlineBody: true,
-		attemptNum: 1,
-		process: func(
-			ctx context.Context,
-			e *delivery.Engine,
-			task *delivery.Task,
-		) {
-			e.ExportProcessNewTask(ctx, task)
-		},
-	}.run(t)
-
-	tsAssertRealTimestamp(t, text)
-
-	iAssertStatus(t, s.WebhookDB, d.ID,
-		database.DeliveryStatusDelivered,
-	)
-}
-
-// TestSlackFirstAttemptLargeBodyCarriesEventTimestamp covers the
-// first-attempt path for an event whose body exceeded
-// MaxInlineBodySize, so the task carries no body and the engine
-// reads it back from the stored row.
-func TestSlackFirstAttemptLargeBodyCarriesEventTimestamp(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	_, _, text := tsCase{
-		status:     database.DeliveryStatusPending,
-		inlineBody: false,
-		attemptNum: 1,
-		process: func(
-			ctx context.Context,
-			e *delivery.Engine,
-			task *delivery.Task,
-		) {
-			e.ExportProcessNewTask(ctx, task)
-		},
-	}.run(t)
-
-	tsAssertRealTimestamp(t, text)
-}
-
-// TestSlackRetryCarriesEventTimestamp covers the retry path, which
-// reconstructs the event from the same task the first attempt used.
-func TestSlackRetryCarriesEventTimestamp(t *testing.T) {
-	t.Parallel()
-
-	s, d, text := tsCase{
-		status:     database.DeliveryStatusRetrying,
-		inlineBody: true,
-		attemptNum: 2,
-		process: func(
-			ctx context.Context,
-			e *delivery.Engine,
-			task *delivery.Task,
-		) {
-			e.ExportProcessRetryTask(ctx, task)
-		},
-	}.run(t)
-
-	tsAssertRealTimestamp(t, text)
-
-	iAssertStatus(t, s.WebhookDB, d.ID,
-		database.DeliveryStatusDelivered,
-	)
-}
-
-// TestFormatSlackMessageOverTaskReconstructedEvent asserts on the
-// formatted message directly, over the event the delivery paths
-// reconstruct from a Task. It is the unit-level guard under the
-// end-to-end tests: revert the CreatedAt population in hydrateEvent
-// and this fails on the zero timestamp.
-func TestFormatSlackMessageOverTaskReconstructedEvent(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	s := newISetup(t)
-
-	cfg := tsSlackConfig(t, tsUndeliverableHook)
-	target := tsSeedTarget(t, s.MainDB, s.WebhookID, cfg)
-	event := tsSeedEvent(t, s.WebhookDB, s.WebhookID)
-
-	d := iSeedDelivery(
-		t, s.WebhookDB, event.ID, target.ID,
-		database.DeliveryStatusPending,
-	)
-
-	bodyStr := event.Body
-	task := tsTask(d, event, s.WebhookID, target, 1, &bodyStr)
-
-	rebuilt, err := s.Engine.ExportEventForTask(
-		s.WebhookDB, &task,
-	)
-	require.NoError(t, err)
-	assert.False(t, rebuilt.CreatedAt.IsZero(),
-		"reconstructed event carries the zero time",
-	)
-	assert.Equal(t,
-		tsEventCreatedAt().UTC(), rebuilt.CreatedAt.UTC(),
-	)
-
-	tsAssertRealTimestamp(
-		t, delivery.FormatSlackMessage(&rebuilt),
-	)
-}
-
-// TestFormatSlackMessageZeroTimestamp asserts the rendering choice
-// directly, without going through the engine: a zero CreatedAt (the
-// shape a reaped-row fallback produces) renders as "unknown" rather
-// than the year-1 zero time, while a real CreatedAt still renders as
-// RFC3339.
-func TestFormatSlackMessageZeroTimestamp(t *testing.T) {
-	t.Parallel()
-
-	zeroEvent := database.Event{
-		Method:      http.MethodPost,
-		ContentType: testContentType,
-		Body:        tsEventBody,
-	}
-
-	zeroText := delivery.FormatSlackMessage(&zeroEvent)
-
-	assert.NotContains(t, zeroText, "0001-01-01",
-		"slack message carries the zero-time year",
-	)
-	assert.Contains(t, zeroText, "*Timestamp:* `unknown`",
-		"slack message does not mark an unset receipt time as unknown",
-	)
-
-	nonZeroEvent := zeroEvent
-	nonZeroEvent.CreatedAt = tsEventCreatedAt()
-
-	nonZeroText := delivery.FormatSlackMessage(&nonZeroEvent)
-
-	assert.Contains(t, nonZeroText,
-		"*Timestamp:* `"+
-			tsEventCreatedAt().UTC().Format(time.RFC3339)+"`",
-		"slack message does not render a real receipt time as RFC3339",
-	)
-}
-
-// TestEventReconstructionSurvivesAReapedRow pins the fallback: an
-// event row reaped by retention while its delivery still holds the
-// body inline is still delivered, with the receipt time unset,
-// rather than dropped.
-func TestEventReconstructionSurvivesAReapedRow(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-
-	cfg := tsSlackConfig(t, tsUndeliverableHook)
-	target := tsSeedTarget(t, s.MainDB, s.WebhookID, cfg)
-	event := tsSeedEvent(t, s.WebhookDB, s.WebhookID)
-
-	d := iSeedDelivery(
-		t, s.WebhookDB, event.ID, target.ID,
-		database.DeliveryStatusPending,
-	)
-
-	bodyStr := event.Body
-	task := tsTask(d, event, s.WebhookID, target, 1, &bodyStr)
-
-	require.NoError(t, s.WebhookDB.Unscoped().Delete(
-		&database.Event{}, "id = ?", event.ID,
-	).Error)
-
-	rebuilt, err := s.Engine.ExportEventForTask(
-		s.WebhookDB, &task,
-	)
-	require.NoError(t, err)
-	assert.Equal(t, bodyStr, rebuilt.Body)
-	assert.True(t, rebuilt.CreatedAt.IsZero())
-
-	// A task with no inlined body has nothing left to deliver, so
-	// the same reaped row is an error there.
-	noBody := task
-	noBody.Body = nil
-
-	_, err = s.Engine.ExportEventForTask(s.WebhookDB, &noBody)
-	require.Error(t, err)
-}

internal/delivery/export_test.go

@@ -151,16 +151,6 @@ func (e *Engine) ExportProcessRetryTask(
 	e.processRetryTask(ctx, task)
 }
 
-// ExportEventForTask exposes the event reconstruction the delivery
-// paths run: buildEventFromTask followed by hydrateEvent.
-func (e *Engine) ExportEventForTask(
-	webhookDB *gorm.DB, task *Task,
-) (database.Event, error) {
-	return e.hydrateEvent(
-		webhookDB, buildEventFromTask(task), task,
-	)
-}
-
 // ExportProcessDelivery exposes processDelivery.
 func (e *Engine) ExportProcessDelivery(
 	ctx context.Context,

internal/delivery/redirect_test.go

@@ -170,8 +170,7 @@ func TestDelivery_CrossOriginRedirectDropsOriginScopedHeaders(
 // Stripping must not fire within the configured origin, or every
 // destination that redirects its own path would lose its
 // credential and start answering 401 — and would lose the inbound
-// signature header the target endpoint verifies. webhooker's own
-// receiver verifies no signature; it only forwards the header.
+// signature the receiver verifies.
 func TestDelivery_SameOriginRedirectKeepsOriginScopedHeaders(
 	t *testing.T,
 ) {

internal/delivery/target_slack.go

@@ -231,15 +231,10 @@ func FormatSlackMessage(
 		event.ContentType,
 	)
 
-	timestamp := "unknown"
-	if !event.CreatedAt.IsZero() {
-		timestamp = event.CreatedAt.UTC().Format(time.RFC3339)
-	}
-
 	fmt.Fprintf(
 		&b,
 		"*Timestamp:* `%s`\n",
-		timestamp,
+		event.CreatedAt.UTC().Format(time.RFC3339),
 	)
 
 	fmt.Fprintf(