Implement the log delivery target (closes #70)

Slack delivery targets were only checked by the request-time dialer guard, not at creation, giving them a weaker SSRF gate than HTTP targets.

This validates the Slack incoming-webhook URL with `delivery.ValidateTargetURL` in the Slack target creation path (`buildSlackTargetConfig`), before persisting, mirroring the existing HTTP-target path. On failure the create is rejected with the same clear, non-leaking user-facing error the HTTP path uses.

Adds handlers-package tests covering both an accepted public URL and a rejected private/reserved URL. Confined to `internal/handlers/`; `internal/delivery/` is unchanged.

Closes #68

Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #73
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/delivery/engine.go

@@ -1006,8 +1006,11 @@ func (e *Engine) deliverLog(
 		"webhook event delivered to log target",
 		"delivery_id", d.ID,
 		"event_id", d.EventID,
+		"webhook_id", d.Event.WebhookID,
+		"entrypoint_id", d.Event.EntrypointID,
 		"target_id", d.TargetID,
 		"target_name", d.Target.Name,
+		"outcome", database.DeliveryStatusDelivered,
 		"method", d.Event.Method,
 		"content_type", d.Event.ContentType,
 		"body_length", len(d.Event.Body),

internal/delivery/engine_test.go

@@ -1,6 +1,7 @@
 package delivery_test
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/json"
@@ -435,6 +436,91 @@ func TestDeliverLog_ImmediateSuccess(t *testing.T) {
 	assert.True(t, result.Success)
 }
 
+func TestDeliverLog_StructuredLogFields(t *testing.T) {
+	t.Parallel()
+
+	db := testWebhookDB(t)
+
+	var logBuf bytes.Buffer
+
+	e := delivery.NewTestEngine(
+		slog.New(slog.NewTextHandler(
+			&logBuf,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	event := seedEvent(t, db, `{"log":"structured"}`)
+
+	dlv := seedDelivery(
+		t, db, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name: "structured-log",
+			Type: database.TargetTypeLog,
+		},
+	}
+	d.ID = dlv.ID
+
+	e.ExportDeliverLog(db, d)
+
+	// The delivery is marked delivered and a success
+	// DeliveryResult with no HTTP status is recorded,
+	// mirroring the other target types' bookkeeping.
+	var updated database.Delivery
+
+	require.NoError(t, db.First(
+		&updated, "id = ?", dlv.ID,
+	).Error)
+
+	assert.Equal(t,
+		database.DeliveryStatusDelivered, updated.Status,
+		"log target should immediately succeed",
+	)
+
+	var result database.DeliveryResult
+
+	require.NoError(t, db.Where(
+		"delivery_id = ?", dlv.ID,
+	).First(&result).Error)
+
+	assert.True(t, result.Success)
+	assert.Equal(t, 0, result.StatusCode,
+		"log target should not have an HTTP status",
+	)
+
+	assertLogFields(t, logBuf.String(), event, "structured-log")
+}
+
+// assertLogFields checks that a log target's structured
+// log line carries the required fields: event id,
+// webhook/entrypoint, target name, and outcome.
+func assertLogFields(
+	t *testing.T,
+	logged string,
+	event database.Event,
+	targetName string,
+) {
+	t.Helper()
+
+	assert.Contains(t, logged, "event_id="+event.ID)
+	assert.Contains(t, logged, "webhook_id="+event.WebhookID)
+	assert.Contains(t,
+		logged, "entrypoint_id="+event.EntrypointID,
+	)
+	assert.Contains(t, logged, "target_name="+targetName)
+	assert.Contains(t, logged, "outcome=delivered")
+}
+
 func TestDeliverHTTP_WithRetries_Success(t *testing.T) {
 	t.Parallel()
 

internal/handlers/export_test.go

@@ -12,3 +12,13 @@ func (s *Handlers) RenderTemplateForTest(
 ) {
 	s.renderTemplate(w, r, pageTemplate, data)
 }
+
+// BuildSlackTargetConfigForTest exposes buildSlackTargetConfig
+// for use in the handlers_test package.
+func (s *Handlers) BuildSlackTargetConfigForTest(
+	w http.ResponseWriter,
+	r *http.Request,
+	targetURL string,
+) (string, error) {
+	return s.buildSlackTargetConfig(w, r, targetURL)
+}

internal/handlers/handlers_test.go

@@ -116,6 +116,52 @@ func TestHandleIndex_Authenticated(t *testing.T) {
 	)
 }
 
+func TestBuildSlackTargetConfig_AcceptsPublicURL(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, "/", nil)
+	w := httptest.NewRecorder()
+
+	cfg, err := h.BuildSlackTargetConfigForTest(
+		w, req, "http://93.184.216.34/services/T00/B00/xxx",
+	)
+
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, cfg, "webhookUrl")
+}
+
+func TestBuildSlackTargetConfig_RejectsReservedURL(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, "/", nil)
+	w := httptest.NewRecorder()
+
+	cfg, err := h.BuildSlackTargetConfigForTest(
+		w, req, "http://169.254.169.254/latest/meta-data/",
+	)
+
+	require.Error(t, err)
+	assert.Empty(t, cfg)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
 func TestRenderTemplate(t *testing.T) {
 	t.Parallel()
 

internal/handlers/source_management.go

@@ -902,7 +902,7 @@ func (h *Handlers) buildTargetConfig(
 	case database.TargetTypeHTTP:
 		return h.buildHTTPTargetConfig(w, r, targetURL)
 	case database.TargetTypeSlack:
-		return h.buildSlackTargetConfig(w, targetURL)
+		return h.buildSlackTargetConfig(w, r, targetURL)
 	case database.TargetTypeDatabase, database.TargetTypeLog:
 		return "", nil
 	default:
@@ -967,6 +967,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 // buildSlackTargetConfig builds config JSON for a Slack target.
 func (h *Handlers) buildSlackTargetConfig(
 	w http.ResponseWriter,
+	r *http.Request,
 	targetURL string,
 ) (string, error) {
 	if targetURL == "" {
@@ -979,6 +980,24 @@ func (h *Handlers) buildSlackTargetConfig(
 		return "", errMissingURL
 	}
 
+	err := delivery.ValidateTargetURL(
+		r.Context(), targetURL,
+	)
+	if err != nil {
+		h.log.Warn(
+			"target URL blocked by SSRF protection",
+			"url", targetURL,
+			"error", err,
+		)
+		http.Error(
+			w,
+			"Invalid target URL: "+err.Error(),
+			http.StatusBadRequest,
+		)
+
+		return "", err
+	}
+
 	cfg := map[string]any{"webhookUrl": targetURL}
 
 	configBytes, err := json.Marshal(cfg)