Say how to allow a refused private target address (closes #398 )

Adding or editing an http or slack target whose address is private or reserved was refused with no hint that the refusal is deliberate or that it can be lifted. The refusal now adds that such addresses are refused by default and that the server's ALLOWED_EGRESS_CIDRS setting allows named networks, naming the README section "Allowing egress to your own network". Link-local and cloud metadata refusals, which no setting can lift, are unchanged. The delivery package's blocked-address error is exported so the handler can tell this refusal from the others. Model: opus-5-5
2026-10-01 20:49:22 +00:00
15 changed files with 46 additions and 776 deletions
@@ -1642,7 +1642,6 @@ data for auditing, for replay, and for resubmission.
 | `headers`      | JSON   | Complete request headers |
 | `body`         | text   | Raw request body |
 | `content_type` | string | Content-Type header value |
 | `body_bytes`   | integer | The body's size in bytes, recorded when the event is stored, on receipt and on resubmit |
 | `resubmitted_from_id` | UUID | The event this one was copied from by a resubmit (nullable; empty for an event that arrived on the receiver). Not a foreign key: the source event can be reaped by retention while its copies remain |
 **Relations:** Belongs to Webhook. Belongs to Entrypoint. Has many
@@ -4,7 +4,6 @@ go 1.26.1
 require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
 	github.com/dustin/go-humanize v1.0.1
 	github.com/getsentry/sentry-go v0.25.0
 	github.com/go-chi/chi v1.5.5
 	github.com/go-chi/cors v1.2.1
@@ -30,6 +29,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -31,11 +31,6 @@ type Event struct {
 	Body        string `gorm:"type:text"   json:"body"`
 	ContentType string `json:"contentType"`
 	// BodyBytes is the size of Body in bytes, recorded when the event
 	// is stored so the recent events list can show it without reading
 	// the body.
 	BodyBytes int64 `gorm:"not null" json:"bodyBytes"`
 	// ResubmittedFromID names the event this one was copied from by
 	// an operator resubmit. It is nil for an event that arrived on
 	// the receiver, which is every event created before the column
@@ -17,10 +17,6 @@ const (
 	// dnsResolutionTimeout is the maximum time to wait for
 	// DNS resolution during SSRF validation.
 	dnsResolutionTimeout = 5 * time.Second
 	// azureWireServer is Azure's WireServer, a public address that
 	// serves VM credentials.
 	azureWireServer = "168.63.129.16"
 )
 // Sentinel errors for SSRF validation.
@@ -29,14 +25,10 @@ var (
 	errNoIPs      = errors.New(
 		"hostname resolved to no IP addresses",
 	)
-	// ErrBlockedIP reports a private or reserved address the
+	// ErrBlockedIP reports an address the default blocklist
-	// default blocklist refuses, one that ALLOWED_EGRESS_CIDRS
+	// refuses, one that ALLOWED_EGRESS_CIDRS can open.
 	// can open.
 	ErrBlockedIP = errors.New(
-		"blocked private or reserved address",
+		"blocked private, reserved or cloud metadata address",
 	)
 	errBlockedWireServer = errors.New(
 		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
 		"blocked link-local or cloud instance metadata " +
@@ -133,7 +125,8 @@ func init() {
 		"::1/128",
 		"fc00::/7",
 		"fe80::/10",
-		azureWireServer + "/32",
+		// Azure WireServer, a public address that serves VM credentials.
 		"168.63.129.16/32",
 	})
 	// Every entry is named. The set must not grow or shrink
@@ -347,14 +340,6 @@ func (g *Guard) checkIP(ip net.IP) error {
 		return nil
 	}
 	// WireServer is on the default blocklist but is a public
 	// address, so its refusal does not call it private or reserved.
 	if ip.Equal(net.ParseIP(azureWireServer)) {
 		return fmt.Errorf(
 			"target IP %s: %w", ip, errBlockedWireServer,
 		)
 	}
 	if isBlockedIP(ip) {
 		return fmt.Errorf(
 			"target IP %s: %w", ip, ErrBlockedIP,
@@ -204,7 +204,6 @@ func assertEventCopy(
 	assert.Equal(t, original.Method, fresh.Method)
 	assert.Equal(t, original.Headers, fresh.Headers)
 	assert.Equal(t, original.Body, fresh.Body)
 	assert.Equal(t, int64(len(original.Body)), fresh.BodyBytes)
 	assert.Equal(t, original.ContentType, fresh.ContentType)
 	assert.Equal(t, original.EntrypointID, fresh.EntrypointID)
 	assert.Equal(t, original.WebhookID, fresh.WebhookID)
@@ -28,7 +28,7 @@ const (
 	// maxBodyShift is the bit shift for 1 MB body limit.
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
-	recentEventLimit = 50
+	recentEventLimit = 20
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
@@ -88,8 +88,6 @@ func TestHandleProfile_OwnProfile_OK(t *testing.T) {
 	h.HandleProfile().ServeHTTP(w, req)
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Contains(t, w.Body.String(), "Account Information")
 	assert.NotContains(t, w.Body.String(), "Account Type")
 }
 func TestHandleProfile_OtherProfile_Forbidden(t *testing.T) {
@@ -1,293 +0,0 @@
 package handlers
 import (
 	"net/http"
 	"slices"
 	"strconv"
 	"time"
 	"github.com/dustin/go-humanize"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 // recentEventColumns is the recent events list's projection. It
 // leaves out the body, for the reason maxRenderedBodyBytes gives,
 // and reads its size from body_bytes, recorded when the event was
 // stored.
 const recentEventColumns = "id, created_at, method, content_type, " +
 	"resubmitted_from_id, body_bytes"
 // recentAttemptColumns is the part of a recorded attempt the list
 // uses. The event log's deliveryResultColumns also reads response
 // bodies, which the list does not show.
 const recentAttemptColumns = "delivery_id, status_code, created_at"
 // RecentEventView is one row of the recent events list on a
 // webhook's page.
 type RecentEventView struct {
 	Method      string
 	ContentType string
 	// ResubmittedFromID names the event this one was copied from,
 	// empty for an event that arrived on the receiver.
 	ResubmittedFromID string
 	// Received is how long ago the event arrived, and ReceivedUTC
 	// the full timestamp the page shows on hover.
 	Received    string
 	ReceivedUTC string
 	// Size is the size of the stored body.
 	Size string
 	// ProcessingTime is how long the event's slowest delivery
 	// took; see processingTime.
 	ProcessingTime string
 	// Status is what the webhook's HTTP target answered, and
 	// StatusClass its colour; see targetStatus. Both are empty
 	// unless the webhook has exactly one HTTP target.
 	Status      string
 	StatusClass string
 }
 // recentEventRow is one row of recentEventColumns.
 type recentEventRow struct {
 	ID                string
 	CreatedAt         time.Time
 	Method            string
 	ContentType       string
 	ResubmittedFromID *string
 	BodyBytes         uint64
 }
 // recentAttemptRow is one row of recentAttemptColumns. CreatedAt is
 // when the attempt's result was recorded, which is when the attempt
 // finished.
 type recentAttemptRow struct {
 	DeliveryID string
 	StatusCode int
 	CreatedAt  time.Time
 }
 // singleHTTPTargetID returns the ID of the webhook's HTTP target
 // when it has exactly one, and "" when it has none or several.
 func singleHTTPTargetID(targets []database.Target) string {
 	id := ""
 	count := 0
 	for i := range targets {
 		if targets[i].Type == database.TargetTypeHTTP {
 			id = targets[i].ID
 			count++
 		}
 	}
 	if count != 1 {
 		return ""
 	}
 	return id
 }
 // loadRecentEvents loads the webhook's recentEventLimit newest
 // events for its page, newest first. statusTargetID is the
 // webhook's only HTTP target, or "" when the list shows no status.
 func loadRecentEvents(
 	webhookDB *gorm.DB, webhookID, statusTargetID string,
 ) ([]RecentEventView, error) {
 	var rows []recentEventRow
 	err := webhookDB.Model(&database.Event{}).
 		Select(recentEventColumns).
 		Where("webhook_id = ?", webhookID).
 		Order("created_at DESC").
 		Limit(recentEventLimit).
 		Find(&rows).Error
 	if err != nil {
 		return nil, err
 	}
 	eventIDs := make([]string, len(rows))
 	for i := range rows {
 		eventIDs[i] = rows[i].ID
 	}
 	// Oldest first, so an event's last delivery to a target is its
 	// newest: a replay adds a delivery rather than changing the
 	// earlier one.
 	var deliveries []database.Delivery
 	err = webhookDB.
 		Select("id, event_id, target_id, status, created_at").
 		Where("event_id IN ?", eventIDs).
 		Order("created_at ASC").
 		Find(&deliveries).Error
 	if err != nil {
 		return nil, err
 	}
 	byEvent := make(map[string][]database.Delivery, len(rows))
 	deliveryIDs := make([]string, len(deliveries))
 	for i := range deliveries {
 		eventID := deliveries[i].EventID
 		byEvent[eventID] = append(byEvent[eventID], deliveries[i])
 		deliveryIDs[i] = deliveries[i].ID
 	}
 	attempts, err := loadRecentAttempts(webhookDB, deliveryIDs)
 	if err != nil {
 		return nil, err
 	}
 	views := make([]RecentEventView, len(rows))
 	for i := range rows {
 		views[i] = rows[i].view(
 			byEvent[rows[i].ID], attempts, statusTargetID,
 		)
 	}
 	return views, nil
 }
 // loadRecentAttempts loads the recorded attempts of the listed
 // events' deliveries, keyed by delivery ID, each delivery's in
 // attempt order. The IDs go in chunks for the reason
 // deliveryIDChunkSize gives.
 func loadRecentAttempts(
 	webhookDB *gorm.DB, deliveryIDs []string,
 ) (map[string][]recentAttemptRow, error) {
 	byDelivery := make(map[string][]recentAttemptRow)
 	for chunk := range slices.Chunk(deliveryIDs, deliveryIDChunkSize) {
 		var rows []recentAttemptRow
 		err := webhookDB.Model(&database.DeliveryResult{}).
 			Select(recentAttemptColumns).
 			Where("delivery_id IN ?", chunk).
 			Order("attempt_num ASC").
 			Find(&rows).Error
 		if err != nil {
 			return nil, err
 		}
 		for i := range rows {
 			id := rows[i].DeliveryID
 			byDelivery[id] = append(byDelivery[id], rows[i])
 		}
 	}
 	return byDelivery, nil
 }
 // view projects a loaded row for rendering. deliveries is the
 // event's deliveries, oldest first, and attempts their recorded
 // attempts keyed by delivery ID.
 func (r *recentEventRow) view(
 	deliveries []database.Delivery,
 	attempts map[string][]recentAttemptRow,
 	statusTargetID string,
 ) RecentEventView {
 	v := RecentEventView{
 		Method:         r.Method,
 		ContentType:    r.ContentType,
 		Received:       humanize.Time(r.CreatedAt),
 		ReceivedUTC:    r.CreatedAt.UTC().Format(time.DateTime) + " UTC",
 		Size:           humanize.Bytes(r.BodyBytes),
 		ProcessingTime: processingTime(deliveries, attempts),
 	}
 	if r.ResubmittedFromID != nil {
 		v.ResubmittedFromID = *r.ResubmittedFromID
 	}
 	if statusTargetID != "" {
 		v.Status, v.StatusClass = targetStatus(
 			deliveries, attempts, statusTargetID,
 		)
 	}
 	return v
 }
 // processingTime is how long the event's slowest delivery took,
 // from being queued to its last recorded attempt, time spent
 // waiting between retries included. A delivery is queued when its
 // event is received, or when an operator replays it, so a replay
 // is timed from the replay rather than from the event's arrival.
 // It is "in progress" while any delivery is pending or retrying,
 // and empty for an event with no deliveries.
 func processingTime(
 	deliveries []database.Delivery,
 	attempts map[string][]recentAttemptRow,
 ) string {
 	if len(deliveries) == 0 {
 		return ""
 	}
 	var slowest time.Duration
 	for i := range deliveries {
 		if !deliveries[i].Status.Terminal() {
 			return "in progress"
 		}
 		tries := attempts[deliveries[i].ID]
 		if len(tries) == 0 {
 			continue
 		}
 		last := tries[len(tries)-1].CreatedAt
 		slowest = max(slowest, last.Sub(deliveries[i].CreatedAt))
 	}
 	return slowest.Round(time.Millisecond).String()
 }
 // targetStatus is what the target answered for the event, and the
 // colour to show it in: the HTTP status code of the last attempt of
 // the event's newest delivery to the target. Without a code it is
 // "no response" when that attempt failed before a response
 // arrived, the delivery's status ("pending") before any attempt,
 // and "not sent" when the event has no delivery to the target.
 func targetStatus(
 	deliveries []database.Delivery,
 	attempts map[string][]recentAttemptRow,
 	targetID string,
 ) (string, string) {
 	newest := -1
 	for i := range deliveries {
 		if deliveries[i].TargetID == targetID {
 			newest = i
 		}
 	}
 	if newest < 0 {
 		return "not sent", "text-gray-400"
 	}
 	tries := attempts[deliveries[newest].ID]
 	if len(tries) == 0 {
 		return string(deliveries[newest].Status), "text-gray-400"
 	}
 	code := tries[len(tries)-1].StatusCode
 	switch {
 	case code == 0:
 		return "no response", "text-red-600"
 	case code >= http.StatusInternalServerError:
 		return strconv.Itoa(code), "text-red-600"
 	case code >= http.StatusBadRequest:
 		return strconv.Itoa(code), "text-yellow-600"
 	case code >= http.StatusMultipleChoices:
 		return strconv.Itoa(code), "text-gray-500"
 	case code >= http.StatusOK:
 		return strconv.Itoa(code), "text-green-600"
 	default:
 		return strconv.Itoa(code), "text-gray-500"
 	}
 }
@@ -1,362 +0,0 @@
 package handlers_test
 import (
 	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 	"time"
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 // statusTitle marks the status column's cell in a recent events
 // row; it is absent from the page when the column is not shown.
 const statusTitle = `title="HTTP status from the HTTP target"`
 // recentEventsFixture is one started app and a webhook whose
 // recent events list a test fills.
 type recentEventsFixture struct {
 	h         *handlers.Handlers
 	sess      *session.Session
 	db        *database.Database
 	webhook   *database.Webhook
 	webhookDB *gorm.DB
 }
 func newRecentEventsFixture(t *testing.T) *recentEventsFixture {
 	t.Helper()
 	f := &recentEventsFixture{}
 	var dbMgr *database.WebhookDBManager
 	app := newTestApp(t, &f.h, &f.sess, &f.db, &dbMgr)
 	app.RequireStart()
 	t.Cleanup(app.RequireStop)
 	f.webhook = seedWebhook(t, f.db)
 	webhookDB, err := dbMgr.GetDB(f.webhook.ID)
 	require.NoError(t, err)
 	f.webhookDB = webhookDB
 	return f
 }
 func (f *recentEventsFixture) render(t *testing.T) string {
 	t.Helper()
 	return renderSourceDetailPage(t, f.h, f.sess, f.webhook.ID)
 }
 // event records an event received at receivedAt, with its body's
 // size as the receiver records it.
 func (f *recentEventsFixture) event(
 	t *testing.T, contentType, body string, receivedAt time.Time,
 ) *database.Event {
 	t.Helper()
 	event := &database.Event{
 		WebhookID:   f.webhook.ID,
 		Method:      http.MethodPost,
 		Body:        body,
 		BodyBytes:   int64(len(body)),
 		ContentType: contentType,
 	}
 	event.CreatedAt = receivedAt
 	require.NoError(t, f.webhookDB.Omit(
 		clause.Associations,
 	).Create(event).Error)
 	return event
 }
 // delivery records a delivery of the event to the target, queued
 // when the event was received.
 func (f *recentEventsFixture) delivery(
 	t *testing.T,
 	event *database.Event,
 	targetID string,
 	status database.DeliveryStatus,
 ) *database.Delivery {
 	t.Helper()
 	return f.deliveryQueuedAt(
 		t, event, targetID, status, event.CreatedAt,
 	)
 }
 // deliveryQueuedAt records a delivery of the event to the target,
 // queued at queuedAt, as a replay is.
 func (f *recentEventsFixture) deliveryQueuedAt(
 	t *testing.T,
 	event *database.Event,
 	targetID string,
 	status database.DeliveryStatus,
 	queuedAt time.Time,
 ) *database.Delivery {
 	t.Helper()
 	dlv := &database.Delivery{
 		EventID:  event.ID,
 		TargetID: targetID,
 		Status:   status,
 	}
 	dlv.CreatedAt = queuedAt
 	require.NoError(t, f.webhookDB.Omit(
 		clause.Associations,
 	).Create(dlv).Error)
 	return dlv
 }
 // attempt records one attempt of the delivery that finished took
 // after the delivery was queued, with HTTP status code (0 for no
 // response).
 func (f *recentEventsFixture) attempt(
 	t *testing.T, dlv *database.Delivery, code int, took time.Duration,
 ) {
 	t.Helper()
 	result := &database.DeliveryResult{
 		DeliveryID: dlv.ID,
 		AttemptNum: 1,
 		StatusCode: code,
 	}
 	result.CreatedAt = dlv.CreatedAt.Add(took)
 	require.NoError(t, f.webhookDB.Omit(
 		clause.Associations,
 	).Create(result).Error)
 }
 // statusCell is the status column's cell as the page renders it.
 func statusCell(class, text string) string {
 	return `<span class="font-medium ` + class + `" ` + statusTitle +
 		`>` + text + `</span>`
 }
 // TestHandleSourceDetail_ShowsFiftyNewestEvents proves the list is
 // headed "50 Most Recent Events" and holds the 50 newest events,
 // newest first, and not one more.
 func TestHandleSourceDetail_ShowsFiftyNewestEvents(t *testing.T) {
 	t.Parallel()
 	f := newRecentEventsFixture(t)
 	base := time.Now().Add(-time.Hour)
 	for i := range 51 {
 		f.event(
 			t, fmt.Sprintf("application/x-recent-%02d", i), "{}",
 			base.Add(time.Duration(i)*time.Second),
 		)
 	}
 	body := f.render(t)
 	assert.Contains(t, body, ">50 Most Recent Events</h2>")
 	assert.Equal(t, 50, strings.Count(body, `title="Body size"`))
 	assert.NotContains(t, body, "application/x-recent-00")
 	assert.Contains(t, body, "application/x-recent-01")
 	assert.Less(
 		t,
 		strings.Index(body, "application/x-recent-50"),
 		strings.Index(body, "application/x-recent-49"),
 	)
 }
 // TestHandleSourceDetail_RecentEventColumns proves a row shows its
 // time relative with the UTC timestamp on hover, its body size,
 // and its processing time once every delivery has finished.
 func TestHandleSourceDetail_RecentEventColumns(t *testing.T) {
 	t.Parallel()
 	f := newRecentEventsFixture(t)
 	logTarget := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeLog)
 	receivedAt := time.Now().Add(-210 * time.Second).
 		UTC().Truncate(time.Second)
 	done := f.event(
 		t, contentTypeJSON, strings.Repeat("x", 2048), receivedAt,
 	)
 	f.attempt(
 		t,
 		f.delivery(t, done, logTarget.ID, database.DeliveryStatusDelivered),
 		0, 1500*time.Millisecond,
 	)
 	waiting := f.event(t, "text/plain", "{}", receivedAt)
 	f.delivery(t, waiting, logTarget.ID, database.DeliveryStatusPending)
 	body := f.render(t)
 	assert.Contains(
 		t, body,
 		`<span title="`+receivedAt.Format(time.DateTime)+
 			` UTC">3 minutes ago</span>`,
 	)
 	assert.Contains(t, body, `<span title="Body size">2.0 kB</span>`)
 	assert.Contains(t, body, ">1.5s</span>")
 	assert.Contains(t, body, ">in progress</span>")
 }
 // TestHandleSourceDetail_StatusWithSingleHTTPTarget proves that a
 // webhook with exactly one HTTP target shows, colour-coded, what
 // that target answered for each event. The log target beside it
 // does not count against "exactly one".
 func TestHandleSourceDetail_StatusWithSingleHTTPTarget(t *testing.T) {
 	t.Parallel()
 	f := newRecentEventsFixture(t)
 	target := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeHTTP)
 	seedTarget(t, f.db, f.webhook.ID, database.TargetTypeLog)
 	now := time.Now()
 	for _, code := range []int{204, 302, 404, 503, 0} {
 		dlv := f.delivery(
 			t, f.event(t, contentTypeJSON, "{}", now), target.ID,
 			database.DeliveryStatusDelivered,
 		)
 		f.attempt(t, dlv, code, time.Second)
 	}
 	f.delivery(
 		t, f.event(t, contentTypeJSON, "{}", now), target.ID,
 		database.DeliveryStatusPending,
 	)
 	f.event(t, contentTypeJSON, "{}", now)
 	// A replay is a newer delivery, and its answer is the one shown.
 	replayed := f.event(t, contentTypeJSON, "{}", now)
 	f.attempt(t, f.delivery(
 		t, replayed, target.ID, database.DeliveryStatusFailed,
 	), 502, time.Second)
 	f.attempt(t, f.deliveryQueuedAt(
 		t, replayed, target.ID, database.DeliveryStatusDelivered,
 		now.Add(time.Minute),
 	), 200, time.Second)
 	body := f.render(t)
 	assert.Contains(t, body, statusCell("text-green-600", "204"))
 	assert.Contains(t, body, statusCell("text-gray-500", "302"))
 	assert.Contains(t, body, statusCell("text-yellow-600", "404"))
 	assert.Contains(t, body, statusCell("text-red-600", "503"))
 	assert.Contains(t, body, statusCell("text-red-600", "no response"))
 	assert.Contains(t, body, statusCell("text-gray-400", "pending"))
 	assert.Contains(t, body, statusCell("text-gray-400", "not sent"))
 	assert.Contains(t, body, statusCell("text-green-600", "200"))
 	assert.NotContains(t, body, ">502<")
 }
 // TestHandleSourceDetail_NoStatusWithoutSingleHTTPTarget proves the
 // status column is absent when the webhook has no HTTP target or
 // more than one.
 func TestHandleSourceDetail_NoStatusWithoutSingleHTTPTarget(
 	t *testing.T,
 ) {
 	t.Parallel()
 	cases := map[string][]database.TargetType{
 		"none":    {database.TargetTypeLog},
 		"several": {database.TargetTypeHTTP, database.TargetTypeHTTP},
 	}
 	for name, types := range cases {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			f := newRecentEventsFixture(t)
 			event := f.event(t, contentTypeJSON, "{}", time.Now())
 			for _, tt := range types {
 				target := seedTarget(t, f.db, f.webhook.ID, tt)
 				f.attempt(t, f.delivery(
 					t, event, target.ID,
 					database.DeliveryStatusDelivered,
 				), 200, time.Second)
 			}
 			body := f.render(t)
 			assert.Contains(t, body, `title="Body size"`)
 			assert.NotContains(t, body, statusTitle)
 		})
 	}
 }
 // TestHandleWebhook_RecordsBodySize proves the receiver records the
 // body's size in bytes, not characters, with the event it stores.
 func TestHandleWebhook_RecordsBodySize(t *testing.T) {
 	t.Parallel()
 	f := newRecentEventsFixture(t)
 	seedEntrypoint(t, f.db, f.webhook.ID)
 	// Two bytes per character.
 	body := strings.Repeat("é", 1024)
 	req := httptest.NewRequestWithContext(
 		context.Background(), http.MethodPost, "/webhook/x",
 		strings.NewReader(body),
 	)
 	rctx := chi.NewRouteContext()
 	rctx.URLParams.Add("uuid", "ep-"+f.webhook.ID)
 	req = req.WithContext(context.WithValue(
 		req.Context(), chi.RouteCtxKey, rctx,
 	))
 	w := httptest.NewRecorder()
 	f.h.HandleWebhook().ServeHTTP(w, req)
 	require.Equal(t, http.StatusOK, w.Code)
 	var stored database.Event
 	require.NoError(t, f.webhookDB.First(&stored).Error)
 	assert.Equal(t, int64(2048), stored.BodyBytes)
 }
 // TestHandleSourceDetail_FailedLoadIsAnError proves that when the
 // list cannot be loaded the page answers with an error, rather than
 // an empty list claiming the webhook has no events.
 func TestHandleSourceDetail_FailedLoadIsAnError(t *testing.T) {
 	t.Parallel()
 	f := newRecentEventsFixture(t)
 	target := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeHTTP)
 	f.attempt(t, f.delivery(
 		t, f.event(t, contentTypeJSON, "{}", time.Now()), target.ID,
 		database.DeliveryStatusDelivered,
 	), 200, time.Second)
 	// The attempts are the list's last query, so its events and
 	// deliveries have already loaded when it fails.
 	require.NoError(t, f.webhookDB.Exec(
 		"DROP TABLE delivery_results",
 	).Error)
 	w := serveSourceDetailPage(t, f.h, f.sess, f.webhook.ID)
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
 	assert.NotContains(t, w.Body.String(), "No events received yet.")
 }
@@ -62,23 +62,6 @@ func renderSourceDetailPage(
 ) string {
 	t.Helper()
 	w := serveSourceDetailPage(t, h, sess, webhookID)
 	require.Equal(t, http.StatusOK, w.Code)
 	return w.Body.String()
 }
 // serveSourceDetailPage runs the real source detail handler for a
 // webhook and returns its response, whatever its status.
 func serveSourceDetailPage(
 	t *testing.T,
 	h *handlers.Handlers,
 	sess *session.Session,
 	webhookID string,
 ) *httptest.ResponseRecorder {
 	t.Helper()
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
@@ -104,7 +87,9 @@ func serveSourceDetailPage(
 	w := httptest.NewRecorder()
 	h.HandleSourceDetail().ServeHTTP(w, req)
-	return w
+	require.Equal(t, http.StatusOK, w.Code)
 	return w.Body.String()
 }
 // TestHandleSourceDetail_MasksSlackWebhookURL is the
@@ -415,23 +415,16 @@ func (h *Handlers) renderSourceDetail(
 		"webhook_id = ?", webhook.ID,
 	).Find(&targets)
-	var events []RecentEventView
+	var events []database.Event
 	if h.dbMgr.DBExists(webhook.ID) {
-		webhookDB, err := h.dbMgr.GetDB(webhook.ID)
+		webhookDB, dbErr := h.dbMgr.GetDB(webhook.ID)
-		if err != nil {
+		if dbErr == nil {
-			h.serverError(w, "failed to get webhook database", err)
+			webhookDB.Where(
-
+				"webhook_id = ?", webhook.ID,
-			return
+			).Order("created_at DESC").Limit(
-		}
+				recentEventLimit,
-
+			).Find(&events)
 		events, err = loadRecentEvents(
 			webhookDB, webhook.ID, singleHTTPTargetID(targets),
 		)
 		if err != nil {
 			h.serverError(w, "failed to load recent events", err)
 			return
 		}
 	}
@@ -1580,11 +1573,9 @@ func (h *Handlers) validateTargetURL(
 		msg := "Invalid target URL: " + err.Error()
-		// Only a private or reserved address's refusal says how
+		// Only this refusal can be lifted by configuration, so
-		// to allow it. Metadata refusals never do: link-local and
+		// only it says how. Link-local and metadata addresses
-		// the other unconditional metadata addresses cannot be
+		// stay refused whatever is configured.
 		// opened, and Azure's WireServer, which listing does
 		// open, hands out VM credentials.
 		if errors.Is(err, delivery.ErrBlockedIP) {
 			msg += ". Private and reserved addresses are refused " +
 				"by default; the server's ALLOWED_EGRESS_CIDRS " +
@@ -75,25 +75,10 @@ func TestTargetRefusal_PrivateDestinationSaysHowToAllowIt(
 			)
 		})
 	}
 }
-// TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt: no
+	// No setting opens a link-local address, so its refusal must
-// setting opens a link-local address, and Azure's WireServer hands out
+	// not point at one.
-// VM credentials, so neither refusal points at the setting.
+	t.Run("link-local", func(t *testing.T) {
 func TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	metadataURLs := map[string]string{
 		"link-local": "http://169.254.169.254/latest/meta-data/",
 		"wireserver": "http://168.63.129.16/?comp=versions",
 	}
 	for name, metadataURL := range metadataURLs {
 		t.Run(name, func(t *testing.T) {
 		t.Parallel()
 		webhook := seedWebhookWithRetention(t, env.db, 30)
@@ -101,16 +86,13 @@ func TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt(
 		form := url.Values{}
 		form.Set("name", "metadata")
 		form.Set("type", string(database.TargetTypeHTTP))
-			form.Set("url", metadataURL)
+		form.Set("url", "http://169.254.169.254/latest/meta-data/")
 		w := serveTarget(
 			env, http.MethodPost,
 			"/source/"+webhook.ID+"/targets", form,
 		)
 		assert.Equal(t, http.StatusBadRequest, w.Code)
-			assert.NotContains(
+		assert.NotContains(t, w.Body.String(), privateRefusalHint)
 				t, w.Body.String(), privateRefusalHint,
 			)
 	})
 	}
 }
@@ -230,7 +230,6 @@ func (s eventSource) event() *database.Event {
 		Method:            s.Method,
 		Headers:           s.HeadersJSON,
 		Body:              string(s.Body),
 		BodyBytes:         int64(len(s.Body)),
 		ContentType:       s.ContentType,
 		ResubmittedFromID: s.ResubmittedFromID,
 	}
@@ -41,6 +41,10 @@
                    <dt class="w-32 text-sm font-medium text-gray-500">Username</dt>
                    <dd class="text-sm text-gray-900">{{.User.Username}}</dd>
                </div>
                <div class="flex">
                    <dt class="w-32 text-sm font-medium text-gray-500">Account Type</dt>
                    <dd class="text-sm text-gray-900">Standard User</dd>
                </div>
            </dl>
        </div>
    </div>
@@ -181,30 +181,18 @@
    <!-- Recent Events -->
    <div class="card mt-6">
        <div class="p-4 border-b border-gray-200 flex justify-between items-center">
-            <h2 class="text-lg font-medium text-gray-900">50 Most Recent Events</h2>
+            <h2 class="text-lg font-medium text-gray-900">Recent Events</h2>
            <a href="/source/{{.Webhook.ID}}/logs" class="btn-text text-sm">View All</a>
        </div>
        <div class="divide-y divide-gray-100">
            {{range .Events}}
            <div class="p-4">
-                <div class="flex flex-wrap items-center justify-between gap-3">
+                <div class="flex items-center justify-between">
-                    <div class="flex flex-wrap items-center gap-3">
+                    <div class="flex items-center gap-3">
                        <span class="badge-info">{{.Method}}</span>
-                        <span class="text-sm text-gray-500 break-all">{{.ContentType}}</span>
+                        <span class="text-sm text-gray-500">{{.ContentType}}</span>
                        {{if .ResubmittedFromID}}
                        <span class="text-xs text-gray-500" title="This event is a copy of {{.ResubmittedFromID}}">resubmitted copy</span>
                        {{end}}
                    </div>
                    <div class="flex flex-wrap items-center gap-3 text-xs text-gray-400">
                        <span title="Body size">{{.Size}}</span>
                        {{if .ProcessingTime}}
                        <span title="Processing time: how long the slowest delivery took, from being queued to its last attempt">{{.ProcessingTime}}</span>
                        {{end}}
                        {{if .Status}}
                        <span class="font-medium {{.StatusClass}}" title="HTTP status from the HTTP target">{{.Status}}</span>
                        {{end}}
                        <span title="{{.ReceivedUTC}}">{{.Received}}</span>
                    </div>
                    <span class="text-xs text-gray-400">{{.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</span>
                </div>
            </div>
            {{else}}