Implement the log delivery target (closes #70)

README.md

@@ -92,7 +92,6 @@ TTY detection, and security headers are always applied.
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN          | `""`     |
-| `RECEIVER_RATE_LIMIT`   | Receiver requests/minute per IP per entrypoint | `120` |
 
 On first startup, webhooker automatically generates a cryptographically
 secure session encryption key and stores it in the database. This key
@@ -677,24 +676,17 @@ just delayed until the target is healthy again.
 
 ### Rate Limiting
 
-Global blanket rate limiting middleware (e.g., a per-IP throttle shared
+Global rate limiting middleware (e.g., per-IP throttling applied at the
-with the web UI) **must not** apply to webhook receiver endpoints.
+router level) **must not** apply to webhook receiver endpoints. Webhook
-Webhook endpoints receive automated traffic from external services at
+endpoints receive automated traffic from external services at
-unpredictable rates, and blanket limits shared with other routes would
+unpredictable rates, and blanket rate limits would cause legitimate
-cause legitimate deliveries to be dropped.
+deliveries to be dropped.
 
-The receiver instead has its own dedicated abuse limit, scoped to the
+Instead, each webhook has its own individually configurable rate limit,
-`/webhook/{uuid}` route only and keyed per client IP per entrypoint: one
+applied within the webhook handler itself. By default, no rate limit is
-misbehaving sender is throttled without affecting other senders of the
+applied — webhook endpoints accept traffic as fast as it arrives. Rate
-same entrypoint or the same sender's other entrypoints. The limit is
+limits can be configured per-webhook when needed (e.g., to protect
-`RECEIVER_RATE_LIMIT` requests per minute (default 120, generous for
+against a misbehaving sender).
-legitimate webhook senders). Requests over the limit receive HTTP 429
-with a `Retry-After` header. A set-but-invalid `RECEIVER_RATE_LIMIT`
-value aborts startup rather than silently falling back to the default.
-
-Finer-grained per-webhook rate limits (configured in the web UI and
-enforced in the webhook handler) can layer on top of this env-level
-abuse limit later; they are tracked as future work.
 
 ### API Endpoints
 

TODO.md

@@ -10,27 +10,24 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (81413c5) is a working webhook proxy
+pre-1.0. No git tags exist. main (afe88c6) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
-policy compliance (#6), pinned lint tooling (#55), a per-webhook event
+policy compliance (#6), and pinned lint tooling (#55). Note: TODO.md was
-retention reaper (#63), and delivery targets behind a Target interface
+deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
-(#77). Work is tracked as Gitea issues (the authoritative TODO); this
+content was folded into the README TODO section, which this draft
-file is a summary. Note: TODO.md was deliberately deleted from this
+reconstructs as of 2026-07-06.
-repo in f9a9569 (2026-03-01, #6); its content was folded into the
-README TODO section, which this draft reconstructs as of 2026-07-06.
 
 # Next Step
 
-Manual event redelivery from the web UI (replay is a core promised
+Implement automatic event retention cleanup based on retention_days: a
-capability in the README rationale).
+periodic maintenance job that deletes Events, Deliveries, and
+DeliveryResults older than the parent webhook's retention_days from each
+per-webhook event database. The field exists on the Webhook model and
+the README promises the behavior, but nothing enforces it, so event
+databases currently grow without bound.
 
 # Completed Steps
 
-- 2026-08-07 Rate-limit the public webhook receiver per client IP per
-  entrypoint, env-configurable with fail-loud parsing (#64)
-- 2026-08-07 Per-webhook event retention reaper (#63); NoCache
-  middleware for authenticated pages (#61); Target interface refactor
-  (#77)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)
@@ -54,10 +51,12 @@ capability in the README rationale).
 
 # Future Steps
 
+- Manual event redelivery from the web UI (replay is a core promised
+  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
-  plus handler enforcement, layered on the env-level receiver limit
+  plus handler enforcement; global limits must not apply to receiver
-  from #64; global limits must not apply to receiver endpoints)
+  endpoints)
 - Webhook signature verification for GitHub and Stripe HMAC formats
 - API key authentication for programmatic access (APIKey model exists;
   Bearer token middleware does not)

cmd/webhooker/main.go

@@ -34,7 +34,6 @@ func main() {
 			config.New,
 			database.New,
 			database.NewWebhookDBManager,
-			database.NewRetentionReaper,
 			healthcheck.New,
 			session.New,
 			handlers.New,
@@ -45,13 +44,6 @@ func main() {
 			func(e *delivery.Engine) delivery.Notifier { return e },
 			server.New,
 		),
-		fx.Invoke(
+		fx.Invoke(func(*server.Server, *delivery.Engine) {}),
-			func(
-				*server.Server,
-				*delivery.Engine,
-				*database.RetentionReaper,
-			) {
-			},
-		),
 	).Run()
 }

internal/config/config.go

@@ -8,7 +8,6 @@ import (
 	"os"
 	"strconv"
 	"strings"
-	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/globals"
@@ -27,27 +26,12 @@ const (
 
 	// defaultPort is the default HTTP listen port.
 	defaultPort = 8080
-
-	// defaultRetentionSweepInterval is how often the retention
-	// reaper deletes events older than each webhook's RetentionDays.
-	defaultRetentionSweepInterval = time.Hour
-
-	// defaultReceiverRateLimit is the default number of requests
-	// per minute each client IP may send to a single webhook
-	// receiver entrypoint. Generous for legitimate webhook
-	// senders while bounding abuse of the one unauthenticated,
-	// internet-exposed endpoint.
-	defaultReceiverRateLimit = 120
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
 // contains an unrecognised value.
 var ErrInvalidEnvironment = errors.New("invalid environment")
 
-// ErrNonPositiveValue is returned when an environment variable that
-// requires a positive integer is set to zero or a negative number.
-var ErrNonPositiveValue = errors.New("value must be positive")
-
 //nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
@@ -67,16 +51,8 @@ type Config struct {
 	MetricsUsername string
 	Port            int
 	SentryDSN       string
-
+	params          *ConfigParams
-	// RetentionSweepInterval is how often the retention reaper runs.
+	log             *slog.Logger
-	RetentionSweepInterval time.Duration
-
-	// ReceiverRateLimit is the number of requests per minute each
-	// client IP may send to a single webhook receiver entrypoint.
-	ReceiverRateLimit int
-
-	params *ConfigParams
-	log    *slog.Logger
 }
 
 // IsDev returns true if running in development environment.
@@ -119,62 +95,6 @@ func envInt(key string, defaultValue int) int {
 	return defaultValue
 }
 
-// envPositiveInt returns the value of the named environment variable
-// parsed as a positive integer. Returns defaultValue if not set. If
-// the variable is set but cannot be parsed, or parses to less than
-// one, it returns a wrapped error naming the key and the bad value,
-// so startup fails loudly rather than silently falling back to the
-// default.
-func envPositiveInt(
-	key string,
-	defaultValue int,
-) (int, error) {
-	v := os.Getenv(key)
-	if v == "" {
-		return defaultValue, nil
-	}
-
-	i, err := strconv.Atoi(v)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"invalid integer for %s: %q: %w", key, v, err,
-		)
-	}
-
-	if i < 1 {
-		return 0, fmt.Errorf(
-			"%w: %s must be at least 1, got %q",
-			ErrNonPositiveValue, key, v,
-		)
-	}
-
-	return i, nil
-}
-
-// envDuration returns the value of the named environment variable
-// parsed as a Go duration (e.g. "1h", "30m"). Returns defaultValue if
-// not set. If the variable is set but cannot be parsed, it returns a
-// wrapped error naming the key and the bad value, so startup fails
-// loudly rather than silently falling back to the default.
-func envDuration(
-	key string,
-	defaultValue time.Duration,
-) (time.Duration, error) {
-	v := os.Getenv(key)
-	if v == "" {
-		return defaultValue, nil
-	}
-
-	d, err := time.ParseDuration(v)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"invalid duration for %s: %q: %w", key, v, err,
-		)
-	}
-
-	return d, nil
-}
-
 // New creates a Config by reading environment variables.
 //
 //nolint:revive // lc parameter is required by fx even if unused.
@@ -198,42 +118,18 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		)
 	}
 
-	// Parse the retention sweep interval; a set-but-unparseable value
-	// is a hard error so fx aborts startup rather than silently using
-	// the default.
-	retentionSweepInterval, err := envDuration(
-		"RETENTION_SWEEP_INTERVAL",
-		defaultRetentionSweepInterval,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	// Parse the receiver rate limit; a set-but-unparseable or
-	// non-positive value is a hard error so fx aborts startup
-	// rather than silently using the default.
-	receiverRateLimit, err := envPositiveInt(
-		"RECEIVER_RATE_LIMIT",
-		defaultReceiverRateLimit,
-	)
-	if err != nil {
-		return nil, err
-	}
-
 	// Load configuration values from environment variables
 	s := &Config{
-		DataDir:                envString("DATA_DIR"),
+		DataDir:         envString("DATA_DIR"),
-		Debug:                  envBool("DEBUG", false),
+		Debug:           envBool("DEBUG", false),
-		MaintenanceMode:        envBool("MAINTENANCE_MODE", false),
+		MaintenanceMode: envBool("MAINTENANCE_MODE", false),
-		Environment:            environment,
+		Environment:     environment,
-		MetricsUsername:        envString("METRICS_USERNAME"),
+		MetricsUsername: envString("METRICS_USERNAME"),
-		MetricsPassword:        envString("METRICS_PASSWORD"),
+		MetricsPassword: envString("METRICS_PASSWORD"),
-		Port:                   envInt("PORT", defaultPort),
+		Port:            envInt("PORT", defaultPort),
-		SentryDSN:              envString("SENTRY_DSN"),
+		SentryDSN:       envString("SENTRY_DSN"),
-		RetentionSweepInterval: retentionSweepInterval,
+		log:             log,
-		ReceiverRateLimit:      receiverRateLimit,
+		params:          &params,
-		log:                    log,
-		params:                 &params,
 	}
 
 	// Set default DataDir. All SQLite databases (main application
@@ -255,8 +151,6 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"debug", s.Debug,
 		"maintenanceMode", s.MaintenanceMode,
 		"dataDir", s.DataDir,
-		"retentionSweepInterval", s.RetentionSweepInterval.String(),
-		"receiverRateLimit", s.ReceiverRateLimit,
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth",
 		s.MetricsUsername != "" && s.MetricsPassword != "",

internal/config/config_test.go

@@ -3,7 +3,6 @@ package config_test
 import (
 	"os"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -121,100 +120,6 @@ func testEnvironmentConfigSuccess(
 	assert.Equal(t, isProd, cfg.IsProd())
 }
 
-func TestRetentionSweepInterval(t *testing.T) {
-	tests := []struct {
-		name        string
-		set         bool
-		value       string
-		expectError bool
-		expected    time.Duration
-	}{
-		{
-			name:     "unset uses default",
-			set:      false,
-			expected: time.Hour,
-		},
-		{
-			name:     "valid value is parsed",
-			set:      true,
-			value:    "15m",
-			expected: 15 * time.Minute,
-		},
-		{
-			name:        "unparseable value fails startup",
-			set:         true,
-			value:       "not-a-duration",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
-
-			if tt.set {
-				t.Setenv("RETENTION_SWEEP_INTERVAL", tt.value)
-			} else {
-				require.NoError(t, os.Unsetenv(
-					"RETENTION_SWEEP_INTERVAL",
-				))
-			}
-
-			if tt.expectError {
-				testRetentionSweepIntervalError(t)
-			} else {
-				testRetentionSweepIntervalSuccess(t, tt.expected)
-			}
-		})
-	}
-}
-
-func testRetentionSweepIntervalError(t *testing.T) {
-	t.Helper()
-
-	var cfg *config.Config
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-		),
-		fx.Populate(&cfg),
-	)
-
-	assert.Error(t, app.Err())
-}
-
-func testRetentionSweepIntervalSuccess(
-	t *testing.T,
-	expected time.Duration,
-) {
-	t.Helper()
-
-	var cfg *config.Config
-
-	app := fxtest.New(
-		t,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-		),
-		fx.Populate(&cfg),
-	)
-	require.NoError(t, app.Err())
-
-	app.RequireStart()
-
-	defer app.RequireStop()
-
-	assert.Equal(t, expected, cfg.RetentionSweepInterval)
-}
-
 func TestDefaultDataDir(t *testing.T) {
 	for _, env := range []string{"", "dev", "prod"} {
 		name := env
@@ -258,109 +163,3 @@ func TestDefaultDataDir(t *testing.T) {
 		})
 	}
 }
-
-func TestReceiverRateLimit(t *testing.T) {
-	tests := []struct {
-		name        string
-		set         bool
-		value       string
-		expectError bool
-		expected    int
-	}{
-		{
-			name:     "unset uses default",
-			set:      false,
-			expected: 120,
-		},
-		{
-			name:     "valid value is parsed",
-			set:      true,
-			value:    "30",
-			expected: 30,
-		},
-		{
-			name:        "unparseable value fails startup",
-			set:         true,
-			value:       "not-a-number",
-			expectError: true,
-		},
-		{
-			name:        "zero fails startup",
-			set:         true,
-			value:       "0",
-			expectError: true,
-		},
-		{
-			name:        "negative fails startup",
-			set:         true,
-			value:       "-5",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
-
-			if tt.set {
-				t.Setenv("RECEIVER_RATE_LIMIT", tt.value)
-			} else {
-				require.NoError(t, os.Unsetenv(
-					"RECEIVER_RATE_LIMIT",
-				))
-			}
-
-			if tt.expectError {
-				testReceiverRateLimitError(t)
-			} else {
-				testReceiverRateLimitSuccess(t, tt.expected)
-			}
-		})
-	}
-}
-
-func testReceiverRateLimitError(t *testing.T) {
-	t.Helper()
-
-	var cfg *config.Config
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-		),
-		fx.Populate(&cfg),
-	)
-
-	assert.Error(t, app.Err())
-}
-
-func testReceiverRateLimitSuccess(
-	t *testing.T,
-	expected int,
-) {
-	t.Helper()
-
-	var cfg *config.Config
-
-	app := fxtest.New(
-		t,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-		),
-		fx.Populate(&cfg),
-	)
-	require.NoError(t, app.Err())
-
-	app.RequireStart()
-
-	defer app.RequireStop()
-
-	assert.Equal(t, expected, cfg.ReceiverRateLimit)
-}

internal/database/export_test.go

@@ -1,31 +0,0 @@
-package database
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"time"
-)
-
-// NewTestRetentionReaper builds a RetentionReaper backed by the given
-// main database and per-webhook database manager, without the fx
-// lifecycle. Intended for tests.
-func NewTestRetentionReaper(
-	db *Database,
-	mgr *WebhookDBManager,
-) *RetentionReaper {
-	return &RetentionReaper{
-		db:        db,
-		dbManager: mgr,
-		log: slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		interval: time.Hour,
-	}
-}
-
-// ExportSweep runs a single retention sweep synchronously for tests.
-func (r *RetentionReaper) ExportSweep(ctx context.Context) {
-	r.sweep(ctx)
-}

internal/database/retention.go

@@ -1,252 +0,0 @@
-package database
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"sync"
-	"time"
-
-	"go.uber.org/fx"
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/logger"
-)
-
-// hoursPerDay converts a RetentionDays count into hours for cutoff
-// computation.
-const hoursPerDay = 24
-
-// RetentionReaperParams holds the fx dependencies for the
-// RetentionReaper.
-type RetentionReaperParams struct {
-	fx.In
-
-	Config    *config.Config
-	Database  *Database
-	DBManager *WebhookDBManager
-	Logger    *logger.Logger
-}
-
-// RetentionReaper periodically deletes expired events (and their
-// dependent deliveries and delivery results) from each per-webhook
-// database, enforcing every webhook's RetentionDays. Rows are removed
-// permanently so that per-webhook SQLite files do not grow without
-// bound.
-type RetentionReaper struct {
-	db        *Database
-	dbManager *WebhookDBManager
-	log       *slog.Logger
-	interval  time.Duration
-	cancel    context.CancelFunc
-	wg        sync.WaitGroup
-}
-
-// NewRetentionReaper creates the retention reaper and registers its
-// fx lifecycle hooks. The background sweep loop starts on OnStart and
-// stops cleanly on OnStop via context cancellation.
-func NewRetentionReaper(
-	lc fx.Lifecycle,
-	params RetentionReaperParams,
-) *RetentionReaper {
-	r := &RetentionReaper{
-		db:        params.Database,
-		dbManager: params.DBManager,
-		log:       params.Logger.Get(),
-		interval:  params.Config.RetentionSweepInterval,
-	}
-
-	lc.Append(fx.Hook{
-		OnStart: func(ctx context.Context) error {
-			r.start(ctx)
-
-			return nil
-		},
-		OnStop: func(_ context.Context) error {
-			r.stop()
-
-			return nil
-		},
-	})
-
-	return r
-}
-
-func (r *RetentionReaper) start(ctx context.Context) {
-	ctx, cancel := context.WithCancel(ctx)
-	r.cancel = cancel
-
-	r.wg.Add(1)
-
-	go r.run(ctx)
-
-	r.log.Info(
-		"retention reaper started",
-		"interval", r.interval.String(),
-	)
-}
-
-func (r *RetentionReaper) stop() {
-	r.log.Info("retention reaper stopping")
-
-	if r.cancel != nil {
-		r.cancel()
-	}
-
-	r.wg.Wait()
-	r.log.Info("retention reaper stopped")
-}
-
-func (r *RetentionReaper) run(ctx context.Context) {
-	defer r.wg.Done()
-
-	ticker := time.NewTicker(r.interval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			r.sweep(ctx)
-		}
-	}
-}
-
-// sweep lists every webhook from the main database and reaps expired
-// rows from each per-webhook database whose RetentionDays is positive.
-func (r *RetentionReaper) sweep(ctx context.Context) {
-	var webhooks []Webhook
-
-	err := r.db.DB().
-		Model(&Webhook{}).
-		Find(&webhooks).Error
-	if err != nil {
-		r.log.Error(
-			"retention sweep: failed to list webhooks",
-			"error", err,
-		)
-
-		return
-	}
-
-	for i := range webhooks {
-		select {
-		case <-ctx.Done():
-			return
-		default:
-		}
-
-		wh := webhooks[i]
-
-		// RetentionDays of zero or less means retain forever.
-		if wh.RetentionDays <= 0 {
-			continue
-		}
-
-		// Nothing to reap if the per-webhook database has never
-		// been created.
-		if !r.dbManager.DBExists(wh.ID) {
-			continue
-		}
-
-		r.reapWebhook(wh.ID, wh.RetentionDays)
-	}
-}
-
-// reapWebhook removes every expired event (and its dependents) from a
-// single webhook's database.
-func (r *RetentionReaper) reapWebhook(
-	webhookID string,
-	retentionDays int,
-) {
-	db, err := r.dbManager.GetDB(webhookID)
-	if err != nil {
-		r.log.Error(
-			"retention sweep: failed to open webhook database",
-			"webhook_id", webhookID,
-			"error", err,
-		)
-
-		return
-	}
-
-	cutoff := time.Now().Add(
-		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-	)
-
-	deleted, err := reapExpired(db, cutoff)
-	if err != nil {
-		r.log.Error(
-			"retention sweep: failed to reap expired events",
-			"webhook_id", webhookID,
-			"error", err,
-		)
-
-		return
-	}
-
-	if deleted > 0 {
-		r.log.Info(
-			"retention sweep: reaped expired events",
-			"webhook_id", webhookID,
-			"retention_days", retentionDays,
-			"events_deleted", deleted,
-		)
-	}
-}
-
-// reapExpired hard-deletes, in foreign-key-safe order, the delivery
-// results, deliveries, and events associated with events older than
-// cutoff. Deletes are unscoped so rows are physically removed rather
-// than soft-deleted, reclaiming disk. It returns the number of events
-// deleted.
-func reapExpired(db *gorm.DB, cutoff time.Time) (int64, error) {
-	// Fresh subqueries are built per statement to avoid reusing a
-	// mutated builder across executions.
-	expiredEventIDs := func() *gorm.DB {
-		return db.Model(&Event{}).
-			Select("id").
-			Where("created_at < ?", cutoff)
-	}
-	expiredDeliveryIDs := func() *gorm.DB {
-		return db.Model(&Delivery{}).
-			Select("id").
-			Where("event_id IN (?)", expiredEventIDs())
-	}
-
-	// 1. Delivery results whose delivery belongs to an expired event.
-	res := db.Unscoped().
-		Where("delivery_id IN (?)", expiredDeliveryIDs()).
-		Delete(&DeliveryResult{})
-	if res.Error != nil {
-		return 0, fmt.Errorf(
-			"deleting expired delivery results: %w",
-			res.Error,
-		)
-	}
-
-	// 2. Deliveries belonging to an expired event.
-	del := db.Unscoped().
-		Where("event_id IN (?)", expiredEventIDs()).
-		Delete(&Delivery{})
-	if del.Error != nil {
-		return 0, fmt.Errorf(
-			"deleting expired deliveries: %w",
-			del.Error,
-		)
-	}
-
-	// 3. The expired events themselves.
-	ev := db.Unscoped().
-		Where("created_at < ?", cutoff).
-		Delete(&Event{})
-	if ev.Error != nil {
-		return 0, fmt.Errorf(
-			"deleting expired events: %w",
-			ev.Error,
-		)
-	}
-
-	return ev.RowsAffected, nil
-}

internal/database/retention_test.go

@@ -1,277 +0,0 @@
-package database_test
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/fx/fxtest"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/globals"
-	"sneak.berlin/go/webhooker/internal/logger"
-)
-
-// retentionTestEnv bundles the pieces a retention test drives.
-type retentionTestEnv struct {
-	reaper *database.RetentionReaper
-	mainDB *database.Database
-	mgr    *database.WebhookDBManager
-}
-
-func setupRetentionTest(t *testing.T) *retentionTestEnv {
-	t.Helper()
-
-	lc := fxtest.NewLifecycle(t)
-
-	g := &globals.Globals{
-		Appname: "webhooker-test",
-		Version: "test",
-	}
-
-	l, err := logger.New(lc, logger.LoggerParams{Globals: g})
-	require.NoError(t, err)
-
-	cfg := &config.Config{
-		DataDir:     t.TempDir(),
-		Environment: "dev",
-	}
-
-	mainDB, err := database.New(lc, database.DatabaseParams{
-		Config: cfg,
-		Logger: l,
-	})
-	require.NoError(t, err)
-
-	mgr, err := database.NewWebhookDBManager(
-		lc,
-		database.WebhookDBManagerParams{Config: cfg, Logger: l},
-	)
-	require.NoError(t, err)
-
-	ctx := context.Background()
-	require.NoError(t, lc.Start(ctx))
-	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
-
-	return &retentionTestEnv{
-		reaper: database.NewTestRetentionReaper(mainDB, mgr),
-		mainDB: mainDB,
-		mgr:    mgr,
-	}
-}
-
-// createWebhook inserts a webhook row into the main database with the
-// given retention policy and returns its ID.
-func createWebhook(
-	t *testing.T,
-	db *gorm.DB,
-	retentionDays int,
-) string {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        uuid.New().String(),
-		Name:          "test-webhook",
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
-	// The RetentionDays column carries a GORM default of 30, so a
-	// zero (or negative) value passed to Create is replaced by that
-	// default. Force the requested value explicitly so the
-	// retain-forever (<= 0) path can be exercised.
-	require.NoError(
-		t,
-		db.Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	return wh.ID
-}
-
-// eventChain is the set of row IDs seeded for a single event.
-type eventChain struct {
-	eventID    string
-	deliveryID string
-	resultID   string
-}
-
-// seedEventChain creates an event with one delivery and one delivery
-// result, all stamped with createdAt, and returns their IDs.
-func seedEventChain(
-	t *testing.T,
-	db *gorm.DB,
-	webhookID string,
-	createdAt time.Time,
-) eventChain {
-	t.Helper()
-
-	event := &database.Event{
-		WebhookID:    webhookID,
-		EntrypointID: uuid.New().String(),
-		Method:       "POST",
-		Body:         `{"seed": true}`,
-		ContentType:  "application/json",
-	}
-	event.CreatedAt = createdAt
-	require.NoError(t, db.Create(event).Error)
-
-	delivery := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: uuid.New().String(),
-		Status:   database.DeliveryStatusDelivered,
-	}
-	delivery.CreatedAt = createdAt
-	require.NoError(t, db.Create(delivery).Error)
-
-	result := &database.DeliveryResult{
-		DeliveryID: delivery.ID,
-		AttemptNum: 1,
-		Success:    true,
-		StatusCode: 200,
-		Duration:   10,
-	}
-	result.CreatedAt = createdAt
-	require.NoError(t, db.Create(result).Error)
-
-	return eventChain{
-		eventID:    event.ID,
-		deliveryID: delivery.ID,
-		resultID:   result.ID,
-	}
-}
-
-// countByID returns how many rows of model match the given id,
-// counting even hard-deletable rows via Unscoped.
-func countByID(
-	t *testing.T,
-	db *gorm.DB,
-	model any,
-	id string,
-) int64 {
-	t.Helper()
-
-	var n int64
-
-	require.NoError(
-		t,
-		db.Unscoped().Model(model).
-			Where("id = ?", id).Count(&n).Error,
-	)
-
-	return n
-}
-
-func assertChainGone(
-	t *testing.T,
-	db *gorm.DB,
-	chain eventChain,
-) {
-	t.Helper()
-
-	assert.Zero(
-		t,
-		countByID(t, db, &database.Event{}, chain.eventID),
-		"expired event should be removed",
-	)
-	assert.Zero(
-		t,
-		countByID(t, db, &database.Delivery{}, chain.deliveryID),
-		"expired delivery should be removed",
-	)
-	assert.Zero(
-		t,
-		countByID(
-			t, db, &database.DeliveryResult{}, chain.resultID,
-		),
-		"expired delivery result should be removed",
-	)
-}
-
-func assertChainPresent(
-	t *testing.T,
-	db *gorm.DB,
-	chain eventChain,
-) {
-	t.Helper()
-
-	assert.Equal(
-		t,
-		int64(1),
-		countByID(t, db, &database.Event{}, chain.eventID),
-		"recent event should be retained",
-	)
-	assert.Equal(
-		t,
-		int64(1),
-		countByID(t, db, &database.Delivery{}, chain.deliveryID),
-		"recent delivery should be retained",
-	)
-	assert.Equal(
-		t,
-		int64(1),
-		countByID(
-			t, db, &database.DeliveryResult{}, chain.resultID,
-		),
-		"recent delivery result should be retained",
-	)
-}
-
-func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	const retentionDays = 30
-
-	webhookID := createWebhook(
-		t, env.mainDB.DB(), retentionDays,
-	)
-
-	db, err := env.mgr.GetDB(webhookID)
-	require.NoError(t, err)
-
-	now := time.Now()
-	old := seedEventChain(
-		t, db, webhookID,
-		now.Add(-40*24*time.Hour),
-	)
-	recent := seedEventChain(
-		t, db, webhookID,
-		now.Add(-1*24*time.Hour),
-	)
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainGone(t, db, old)
-	assertChainPresent(t, db, recent)
-}
-
-func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	// RetentionDays of zero means retain forever.
-	webhookID := createWebhook(t, env.mainDB.DB(), 0)
-
-	db, err := env.mgr.GetDB(webhookID)
-	require.NoError(t, err)
-
-	ancient := seedEventChain(
-		t, db, webhookID,
-		time.Now().Add(-365*24*time.Hour),
-	)
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainPresent(t, db, ancient)
-}

internal/delivery/engine_test.go

@@ -436,6 +436,91 @@ func TestDeliverLog_ImmediateSuccess(t *testing.T) {
 	assert.True(t, result.Success)
 }
 
+func TestDeliverLog_StructuredLogFields(t *testing.T) {
+	t.Parallel()
+
+	db := testWebhookDB(t)
+
+	var logBuf bytes.Buffer
+
+	e := delivery.NewTestEngine(
+		slog.New(slog.NewTextHandler(
+			&logBuf,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	event := seedEvent(t, db, `{"log":"structured"}`)
+
+	dlv := seedDelivery(
+		t, db, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name: "structured-log",
+			Type: database.TargetTypeLog,
+		},
+	}
+	d.ID = dlv.ID
+
+	e.ExportDeliverLog(db, d)
+
+	// The delivery is marked delivered and a success
+	// DeliveryResult with no HTTP status is recorded,
+	// mirroring the other target types' bookkeeping.
+	var updated database.Delivery
+
+	require.NoError(t, db.First(
+		&updated, "id = ?", dlv.ID,
+	).Error)
+
+	assert.Equal(t,
+		database.DeliveryStatusDelivered, updated.Status,
+		"log target should immediately succeed",
+	)
+
+	var result database.DeliveryResult
+
+	require.NoError(t, db.Where(
+		"delivery_id = ?", dlv.ID,
+	).First(&result).Error)
+
+	assert.True(t, result.Success)
+	assert.Equal(t, 0, result.StatusCode,
+		"log target should not have an HTTP status",
+	)
+
+	assertLogFields(t, logBuf.String(), event, "structured-log")
+}
+
+// assertLogFields checks that a log target's structured
+// log line carries the required fields: event id,
+// webhook/entrypoint, target name, and outcome.
+func assertLogFields(
+	t *testing.T,
+	logged string,
+	event database.Event,
+	targetName string,
+) {
+	t.Helper()
+
+	assert.Contains(t, logged, "event_id="+event.ID)
+	assert.Contains(t, logged, "webhook_id="+event.WebhookID)
+	assert.Contains(t,
+		logged, "entrypoint_id="+event.EntrypointID,
+	)
+	assert.Contains(t, logged, "target_name="+targetName)
+	assert.Contains(t, logged, "outcome=delivered")
+}
+
 func TestDeliverHTTP_WithRetries_Success(t *testing.T) {
 	t.Parallel()
 
@@ -1653,179 +1738,6 @@ func TestProcessDelivery_RoutesToSlack(t *testing.T) {
 	)
 }
 
-// newLogCaptureEngine builds a test engine whose logger
-// writes to the returned buffer, for inspecting log output.
-func newLogCaptureEngine(
-	t *testing.T,
-) (*delivery.Engine, *bytes.Buffer) {
-	t.Helper()
-
-	var buf bytes.Buffer
-
-	log := slog.New(slog.NewTextHandler(
-		&buf,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-
-	e := delivery.NewTestEngine(
-		log, &http.Client{Timeout: 5 * time.Second}, 1,
-	)
-
-	return e, &buf
-}
-
-// assertLogLineComplete asserts the captured log output
-// carries the full inbound webhook content and ids.
-func assertLogLineComplete(
-	t *testing.T, out string, event database.Event,
-) {
-	t.Helper()
-
-	assert.Contains(t, out, "log-body-marker",
-		"log line must contain the full request body",
-	)
-
-	assert.Contains(t, out, "Content-Type",
-		"log line must contain the full request headers",
-	)
-
-	assert.Contains(t, out, event.EntrypointID,
-		"log line must contain the entrypoint id",
-	)
-
-	assert.Contains(t, out, event.WebhookID,
-		"log line must contain the webhook id",
-	)
-
-	assert.Contains(t, out, "application/json",
-		"log line must contain the content type",
-	)
-}
-
-func TestDeliverLog_LogsFullContent(t *testing.T) {
-	t.Parallel()
-
-	db := testWebhookDB(t)
-	e, buf := newLogCaptureEngine(t)
-
-	event := seedEvent(
-		t, db, `{"log-body-marker":"abc123"}`,
-	)
-
-	dlv := seedDelivery(
-		t, db, event.ID, uuid.New().String(),
-		database.DeliveryStatusPending,
-	)
-
-	d := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: dlv.TargetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name: "test-log-full",
-			Type: database.TargetTypeLog,
-		},
-	}
-	d.ID = dlv.ID
-
-	e.ExportDeliverLog(db, d)
-
-	assertLogLineComplete(t, buf.String(), event)
-
-	assertDeliveryStatus(t, db, dlv.ID,
-		database.DeliveryStatusDelivered,
-	)
-}
-
-// buildSlackRetryDelivery builds a Slack delivery whose
-// target is configured with retries enabled.
-func buildSlackRetryDelivery(
-	dlv database.Delivery,
-	event database.Event,
-	targetID, cfg string,
-) *database.Delivery {
-	d := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: targetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name:       "test-slack-retry",
-			Type:       database.TargetTypeSlack,
-			Config:     cfg,
-			MaxRetries: 5,
-		},
-	}
-	d.ID = dlv.ID
-
-	return d
-}
-
-func TestDeliverSlack_WithRetries_SchedulesRetry(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	db := testWebhookDB(t)
-	ts := newStatusServer(t, http.StatusServiceUnavailable)
-	e := testEngine(t, 1)
-	targetID := uuid.New().String()
-
-	slackCfg, err := json.Marshal(
-		delivery.SlackTargetConfig{WebhookURL: ts.URL},
-	)
-	require.NoError(t, err)
-
-	event := seedEvent(t, db, `{"slack":"retry"}`)
-
-	dlv := seedDelivery(
-		t, db, event.ID, targetID,
-		database.DeliveryStatusPending,
-	)
-
-	d := buildSlackRetryDelivery(
-		dlv, event, targetID, string(slackCfg),
-	)
-
-	task := &delivery.Task{
-		DeliveryID: dlv.ID,
-		TargetID:   targetID,
-		TargetType: database.TargetTypeSlack,
-		MaxRetries: 5,
-		AttemptNum: 1,
-	}
-
-	e.ExportProcessDelivery(context.TODO(), db, d, task)
-
-	assertDeliveryStatus(t, db, dlv.ID,
-		database.DeliveryStatusRetrying,
-	)
-
-	assertDeliveryResult(
-		t, db, dlv.ID, false,
-		http.StatusServiceUnavailable,
-	)
-}
-
-// newStatusServer starts a test server that always responds
-// with the given status code.
-func newStatusServer(
-	t *testing.T, code int,
-) *httptest.Server {
-	t.Helper()
-
-	ts := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(code)
-		},
-	))
-
-	t.Cleanup(ts.Close)
-
-	return ts
-}
-
 // readAll is a small helper to avoid importing io in
 // a test handler inline.
 func readAll(r interface {

internal/delivery/export_test.go

@@ -39,50 +39,37 @@ func ExportTruncate(s string, maxLen int) string {
 	return truncate(s, maxLen)
 }
 
-// ExportDeliverHTTP delivers via the http target for testing.
+// ExportDeliverHTTP exposes deliverHTTP for testing.
 func (e *Engine) ExportDeliverHTTP(
 	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 	task *Task,
 ) {
-	e.httpTarget.Deliver(ctx, webhookDB, d, task, e)
+	e.deliverHTTP(ctx, webhookDB, d, task)
 }
 
-// ExportDeliverDatabase delivers via the database target.
+// ExportDeliverDatabase exposes deliverDatabase.
 func (e *Engine) ExportDeliverDatabase(
 	webhookDB *gorm.DB, d *database.Delivery,
 ) {
-	e.targets[database.TargetTypeDatabase].Deliver(
+	e.deliverDatabase(webhookDB, d)
-		context.Background(), webhookDB, d, &Task{}, e,
-	)
 }
 
-// ExportDeliverLog delivers via the log target for testing.
+// ExportDeliverLog exposes deliverLog for testing.
 func (e *Engine) ExportDeliverLog(
 	webhookDB *gorm.DB, d *database.Delivery,
 ) {
-	e.targets[database.TargetTypeLog].Deliver(
+	e.deliverLog(webhookDB, d)
-		context.Background(), webhookDB, d, &Task{}, e,
-	)
 }
 
-// ExportDeliverSlack delivers via the slack target for
+// ExportDeliverSlack exposes deliverSlack for testing.
-// testing.
 func (e *Engine) ExportDeliverSlack(
 	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 ) {
-	task := &Task{
+	e.deliverSlack(ctx, webhookDB, d)
-		DeliveryID: d.ID,
-		TargetID:   d.TargetID,
-		AttemptNum: 1,
-	}
-
-	e.targets[database.TargetTypeSlack].Deliver(
-		ctx, webhookDB, d, task, e,
-	)
 }
 
 // ExportProcessNewTask exposes processNewTask.
@@ -109,56 +96,53 @@ func (e *Engine) ExportProcessDelivery(
 	e.processDelivery(ctx, webhookDB, d, task)
 }
 
-// ExportGetCircuitBreaker exposes the http target's
+// ExportGetCircuitBreaker exposes getCircuitBreaker.
-// getCircuitBreaker.
 func (e *Engine) ExportGetCircuitBreaker(
 	targetID string,
 ) *CircuitBreaker {
-	return e.httpTarget.getCircuitBreaker(targetID)
+	return e.getCircuitBreaker(targetID)
 }
 
 // ExportParseHTTPConfig exposes parseHTTPConfig.
 func (e *Engine) ExportParseHTTPConfig(
 	configJSON string,
 ) (*HTTPTargetConfig, error) {
-	return parseHTTPConfig(configJSON)
+	return e.parseHTTPConfig(configJSON)
 }
 
 // ExportParseSlackConfig exposes parseSlackConfig.
 func (e *Engine) ExportParseSlackConfig(
 	configJSON string,
 ) (*SlackTargetConfig, error) {
-	return parseSlackConfig(configJSON)
+	return e.parseSlackConfig(configJSON)
 }
 
-// ExportDoHTTPRequest exposes the http target's
+// ExportDoHTTPRequest exposes doHTTPRequest.
-// doHTTPRequest.
 func (e *Engine) ExportDoHTTPRequest(
 	ctx context.Context,
 	cfg *HTTPTargetConfig,
 	event *database.Event,
 ) (int, string, int64, error) {
-	return e.httpTarget.doHTTPRequest(ctx, cfg, event)
+	return e.doHTTPRequest(ctx, cfg, event)
 }
 
-// ExportClientForConfig exposes the http target's
+// ExportClientForConfig exposes clientForConfig.
-// clientForConfig.
 func (e *Engine) ExportClientForConfig(
 	cfg *HTTPTargetConfig,
 ) *http.Client {
-	return e.httpTarget.clientForConfig(cfg)
+	return e.clientForConfig(cfg)
 }
 
-// ExportClient returns the http target's shared HTTP client.
+// ExportClient returns the engine's shared HTTP client.
 func (e *Engine) ExportClient() *http.Client {
-	return e.httpTarget.client
+	return e.client
 }
 
-// ExportScheduleRetry exposes ScheduleRetry.
+// ExportScheduleRetry exposes scheduleRetry.
 func (e *Engine) ExportScheduleRetry(
 	task Task, delay time.Duration,
 ) {
-	e.ScheduleRetry(task, delay)
+	e.scheduleRetry(task, delay)
 }
 
 // ExportRecoverPendingDeliveries exposes
@@ -215,15 +199,13 @@ func NewTestEngine(
 	client *http.Client,
 	workers int,
 ) *Engine {
-	e := &Engine{
+	return &Engine{
 		log:        log,
+		client:     client,
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
 	}
-	e.initTargets(client)
-
-	return e
 }
 
 // NewTestEngineSmallRetry creates an Engine with a tiny
@@ -231,13 +213,10 @@ func NewTestEngine(
 func NewTestEngineSmallRetry(
 	log *slog.Logger,
 ) *Engine {
-	e := &Engine{
+	return &Engine{
 		log:     log,
 		retryCh: make(chan Task, 1),
 	}
-	e.initTargets(nil)
-
-	return e
 }
 
 // NewTestEngineWithDB creates an Engine with a real
@@ -249,17 +228,15 @@ func NewTestEngineWithDB(
 	client *http.Client,
 	workers int,
 ) *Engine {
-	e := &Engine{
+	return &Engine{
 		database:   db,
 		dbManager:  dbMgr,
 		log:        log,
+		client:     client,
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
 	}
-	e.initTargets(client)
-
-	return e
 }
 
 // NewTestCircuitBreaker creates a CircuitBreaker with

internal/delivery/target.go

@@ -1,101 +0,0 @@
-package delivery
-
-import (
-	"context"
-	"net/http"
-	"time"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// Scheduler re-enqueues a task for a future delivery attempt.
-// The engine provides one to each target so a target can own
-// its retries durably: it records the attempt, marks the
-// delivery retrying, and asks the Scheduler to deliver the
-// next attempt after delay — exactly what the engine does for
-// its own restart recovery.
-type Scheduler interface {
-	ScheduleRetry(task Task, delay time.Duration)
-}
-
-// Target delivers an event to one target type. Each type is
-// an implementation. A Target owns its whole delivery: it
-// makes the attempt, records the DeliveryResult and updates
-// the DeliveryStatus, and — for targets that retry — decides
-// whether to retry, computes its own backoff, gates with its
-// own circuit breaker, and reschedules via the injected
-// Scheduler. Fire-and-forget targets simply record a single
-// attempt.
-type Target interface {
-	Deliver(
-		ctx context.Context,
-		webhookDB *gorm.DB,
-		d *database.Delivery,
-		task *Task,
-		sched Scheduler,
-	)
-}
-
-// rescheduler is implemented by targets that own durable
-// retries. The engine's restart recovery and periodic sweep
-// use it to let the target recompute the schedule for an
-// orphaned retrying delivery, keeping the retry schedule
-// target-owned. Fire-and-forget targets do not implement it
-// and their (never-occurring) retrying deliveries are
-// skipped.
-type rescheduler interface {
-	// remainingBackoff returns how long to wait before the
-	// next attempt of a recovered retrying delivery.
-	remainingBackoff(
-		webhookDB *gorm.DB,
-		deliveryID string,
-		attemptNum int,
-	) time.Duration
-
-	// backoffElapsed reports whether the backoff window for
-	// the last attempt has already passed, so the periodic
-	// sweep can re-enqueue the delivery now.
-	backoffElapsed(
-		webhookDB *gorm.DB,
-		deliveryID string,
-		attemptNum int,
-	) bool
-}
-
-// attemptResult is the outcome of a single delivery attempt,
-// as reported by a target's per-attempt function to the
-// shared retry core.
-type attemptResult struct {
-	statusCode int
-	respBody   string
-	duration   int64
-	success    bool
-	errMsg     string
-}
-
-// initTargets builds the target registry, wiring each target
-// to the engine's persistence helpers and giving the HTTP and
-// Slack targets the shared SSRF-safe client. It is called by
-// both New and the test constructors so the registry is
-// always populated.
-func (e *Engine) initTargets(client *http.Client) {
-	httpT := &httpTarget{
-		httpCore: &httpCore{eng: e},
-		client:   client,
-	}
-
-	slackT := &slackTarget{
-		httpCore: &httpCore{eng: e},
-		client:   client,
-	}
-
-	e.httpTarget = httpT
-
-	e.targets = map[database.TargetType]Target{
-		database.TargetTypeHTTP:     httpT,
-		database.TargetTypeSlack:    slackT,
-		database.TargetTypeDatabase: &databaseTarget{eng: e},
-		database.TargetTypeLog:      &logTarget{eng: e},
-	}
-}

internal/delivery/target_database.go

@@ -1,34 +0,0 @@
-package delivery
-
-import (
-	"context"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// databaseTarget is a fire-and-forget target: the event is
-// already persisted in the per-webhook database by the time
-// delivery runs, so the target records a single successful
-// attempt. (Durable archiving to a separate store is tracked
-// as its own work.)
-type databaseTarget struct {
-	eng *Engine
-}
-
-// Deliver implements Target.
-func (t *databaseTarget) Deliver(
-	_ context.Context,
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	_ *Task,
-	_ Scheduler,
-) {
-	t.eng.recordResult(
-		webhookDB, d, 1, true, 0, "", "", 0,
-	)
-
-	t.eng.updateDeliveryStatus(
-		webhookDB, d, database.DeliveryStatusDelivered,
-	)
-}

internal/delivery/target_http.go

@@ -1,499 +0,0 @@
-package delivery
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"sync"
-	"time"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// Sentinel errors returned by the config parsers.
-var (
-	errEmptyTargetConfig = errors.New(
-		"empty target config",
-	)
-	errMissingTargetURL = errors.New(
-		"target URL is required",
-	)
-)
-
-// HTTPTargetConfig holds configuration for http target
-// types.
-type HTTPTargetConfig struct {
-	URL     string            `json:"url"`
-	Headers map[string]string `json:"headers,omitempty"`
-	Timeout int               `json:"timeout,omitempty"`
-}
-
-// httpCore holds the retry, backoff, and circuit-breaker
-// machinery shared by the HTTP and Slack targets. Each of
-// those targets owns its own httpCore instance (and thus its
-// own circuit breakers); the per-attempt request differs
-// between them and is supplied as a closure.
-type httpCore struct {
-	eng *Engine
-
-	// circuitBreakers stores a *CircuitBreaker per target ID.
-	circuitBreakers sync.Map
-}
-
-// deliver runs one delivery attempt through the retry core.
-// A maxRetries of 0 is fire-and-forget: a single attempt is
-// recorded and no circuit breaker is consulted. A positive
-// maxRetries gates the attempt on the circuit breaker and
-// schedules a backed-off retry on failure.
-func (c *httpCore) deliver(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-	maxRetries int,
-	attempt func() attemptResult,
-) {
-	if maxRetries == 0 {
-		c.fireAndForget(webhookDB, d, attempt())
-
-		return
-	}
-
-	c.withRetry(
-		webhookDB, d, task, sched, maxRetries, attempt,
-	)
-}
-
-func (c *httpCore) fireAndForget(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	res attemptResult,
-) {
-	c.eng.recordResult(
-		webhookDB, d, 1, res.success,
-		res.statusCode, res.respBody, res.errMsg,
-		res.duration,
-	)
-
-	if res.success {
-		c.eng.updateDeliveryStatus(
-			webhookDB, d,
-			database.DeliveryStatusDelivered,
-		)
-
-		return
-	}
-
-	c.eng.updateDeliveryStatus(
-		webhookDB, d, database.DeliveryStatusFailed,
-	)
-}
-
-func (c *httpCore) withRetry(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-	maxRetries int,
-	attempt func() attemptResult,
-) {
-	cb := c.getCircuitBreaker(task.TargetID)
-	if c.circuitBreakerBlock(webhookDB, d, task, sched, cb) {
-		return
-	}
-
-	attemptNum := task.AttemptNum
-
-	res := attempt()
-
-	c.eng.recordResult(
-		webhookDB, d, attemptNum, res.success,
-		res.statusCode, res.respBody, res.errMsg,
-		res.duration,
-	)
-
-	if res.success {
-		cb.RecordSuccess()
-
-		c.eng.updateDeliveryStatus(
-			webhookDB, d,
-			database.DeliveryStatusDelivered,
-		)
-
-		return
-	}
-
-	cb.RecordFailure()
-
-	c.handleRetry(
-		webhookDB, d, task, sched, maxRetries, attemptNum,
-	)
-}
-
-func (c *httpCore) circuitBreakerBlock(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-	cb *CircuitBreaker,
-) bool {
-	if cb.Allow() {
-		return false
-	}
-
-	remaining := cb.CooldownRemaining()
-
-	c.eng.log.Info(
-		"circuit breaker open, skipping delivery",
-		"target_id", task.TargetID,
-		"target_name", task.TargetName,
-		"delivery_id", d.ID,
-		"cooldown_remaining", remaining,
-	)
-
-	c.eng.updateDeliveryStatus(
-		webhookDB, d,
-		database.DeliveryStatusRetrying,
-	)
-
-	retryTask := *task
-	sched.ScheduleRetry(retryTask, remaining)
-
-	return true
-}
-
-func (c *httpCore) handleRetry(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-	maxRetries int,
-	attemptNum int,
-) {
-	if attemptNum >= maxRetries {
-		c.eng.updateDeliveryStatus(
-			webhookDB, d,
-			database.DeliveryStatusFailed,
-		)
-
-		return
-	}
-
-	c.eng.updateDeliveryStatus(
-		webhookDB, d, database.DeliveryStatusRetrying,
-	)
-
-	backoff := calcBackoff(attemptNum)
-
-	retryTask := *task
-	retryTask.AttemptNum = attemptNum + 1
-	sched.ScheduleRetry(retryTask, backoff)
-}
-
-func (c *httpCore) getCircuitBreaker(
-	targetID string,
-) *CircuitBreaker {
-	if val, ok := c.circuitBreakers.Load(targetID); ok {
-		cb, _ := val.(*CircuitBreaker)
-
-		return cb
-	}
-
-	fresh := NewCircuitBreaker()
-
-	actual, _ := c.circuitBreakers.LoadOrStore(
-		targetID, fresh,
-	)
-
-	cb, _ := actual.(*CircuitBreaker)
-
-	return cb
-}
-
-// remainingBackoff returns how long remains of the backoff
-// window for the last attempt of a recovered retrying
-// delivery. It implements rescheduler.
-func (c *httpCore) remainingBackoff(
-	webhookDB *gorm.DB,
-	deliveryID string,
-	attemptNum int,
-) time.Duration {
-	var lastResult database.DeliveryResult
-
-	err := webhookDB.
-		Where("delivery_id = ?", deliveryID).
-		Order("created_at DESC").
-		First(&lastResult).Error
-	if err != nil {
-		return 0
-	}
-
-	backoff := calcBackoff(attemptNum)
-	elapsed := time.Since(lastResult.CreatedAt)
-	remaining := backoff - elapsed
-
-	return max(remaining, 0)
-}
-
-// backoffElapsed reports whether the backoff window for the
-// last attempt of a retrying delivery has passed. It
-// implements rescheduler.
-func (c *httpCore) backoffElapsed(
-	webhookDB *gorm.DB,
-	deliveryID string,
-	attemptNum int,
-) bool {
-	var lastResult database.DeliveryResult
-
-	err := webhookDB.
-		Where("delivery_id = ?", deliveryID).
-		Order("created_at DESC").
-		First(&lastResult).Error
-	if err != nil {
-		return true
-	}
-
-	backoff := calcBackoff(attemptNum)
-
-	return time.Since(lastResult.CreatedAt) >= backoff
-}
-
-func calcBackoff(attemptNum int) time.Duration {
-	shift := max(attemptNum-1, 0)
-	shift = min(shift, maxBackoffShift)
-
-	return time.Duration(1<<uint(shift)) * time.Second
-}
-
-// httpTarget delivers events to http targets. It forwards the
-// event body and (filtered) request headers to the configured
-// URL and owns retry, backoff, and circuit breaking through
-// the shared httpCore.
-type httpTarget struct {
-	*httpCore
-
-	client *http.Client
-}
-
-// Deliver implements Target.
-func (t *httpTarget) Deliver(
-	ctx context.Context,
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-) {
-	cfg, err := parseHTTPConfig(d.Target.Config)
-	if err != nil {
-		t.eng.log.Error(
-			"invalid HTTP target config",
-			"target_id", d.TargetID,
-			"error", err,
-		)
-
-		t.eng.recordResult(
-			webhookDB, d, task.AttemptNum,
-			false, 0, "", err.Error(), 0,
-		)
-
-		t.eng.updateDeliveryStatus(
-			webhookDB, d, database.DeliveryStatusFailed,
-		)
-
-		return
-	}
-
-	attempt := func() attemptResult {
-		return t.attempt(ctx, cfg, &d.Event)
-	}
-
-	t.deliver(
-		webhookDB, d, task, sched,
-		d.Target.MaxRetries, attempt,
-	)
-}
-
-// attempt performs a single HTTP delivery attempt and derives
-// the success flag and error message the same way the engine
-// did: a non-2xx response is a failure but carries no error
-// string; only a transport-level error does.
-func (t *httpTarget) attempt(
-	ctx context.Context,
-	cfg *HTTPTargetConfig,
-	event *database.Event,
-) attemptResult {
-	statusCode, respBody, duration, reqErr :=
-		t.doHTTPRequest(ctx, cfg, event)
-
-	success := reqErr == nil &&
-		statusCode >= httpSuccessMin &&
-		statusCode < httpSuccessMax
-
-	errMsg := ""
-	if reqErr != nil {
-		errMsg = reqErr.Error()
-	}
-
-	return attemptResult{
-		statusCode: statusCode,
-		respBody:   respBody,
-		duration:   duration,
-		success:    success,
-		errMsg:     errMsg,
-	}
-}
-
-func (t *httpTarget) doHTTPRequest(
-	ctx context.Context,
-	cfg *HTTPTargetConfig,
-	event *database.Event,
-) (int, string, int64, error) {
-	start := time.Now()
-
-	req, reqErr := http.NewRequestWithContext(
-		ctx,
-		http.MethodPost,
-		cfg.URL,
-		bytes.NewReader([]byte(event.Body)),
-	)
-	if reqErr != nil {
-		return 0, "", 0, fmt.Errorf(
-			"creating request: %w", reqErr,
-		)
-	}
-
-	applyRequestHeaders(req, event, cfg)
-
-	client := t.clientForConfig(cfg)
-
-	resp, doErr := executeHTTPRequest(client, req)
-
-	dur := time.Since(start).Milliseconds()
-	if doErr != nil {
-		return 0, "", dur, fmt.Errorf(
-			"sending request: %w", doErr,
-		)
-	}
-
-	defer func() { _ = resp.Body.Close() }()
-
-	body, readErr := io.ReadAll(
-		io.LimitReader(resp.Body, maxBodyLog),
-	)
-	if readErr != nil {
-		return resp.StatusCode, "", dur,
-			fmt.Errorf(
-				"reading response body: %w", readErr,
-			)
-	}
-
-	return resp.StatusCode, string(body), dur, nil
-}
-
-func (t *httpTarget) clientForConfig(
-	cfg *HTTPTargetConfig,
-) *http.Client {
-	if cfg.Timeout > 0 {
-		// Reuse the shared client's SSRF-safe transport so
-		// a per-target timeout does not drop the
-		// request-time private-IP guard. Only the timeout
-		// is overridden.
-		return &http.Client{
-			Timeout: time.Duration(
-				cfg.Timeout,
-			) * time.Second,
-			Transport: t.client.Transport,
-		}
-	}
-
-	return t.client
-}
-
-func parseHTTPConfig(
-	configJSON string,
-) (*HTTPTargetConfig, error) {
-	if configJSON == "" {
-		return nil, errEmptyTargetConfig
-	}
-
-	var cfg HTTPTargetConfig
-
-	err := json.Unmarshal(
-		[]byte(configJSON), &cfg,
-	)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"parsing config JSON: %w", err,
-		)
-	}
-
-	if cfg.URL == "" {
-		return nil, errMissingTargetURL
-	}
-
-	return &cfg, nil
-}
-
-// isForwardableHeader returns true if the header should
-// be forwarded to targets.
-func isForwardableHeader(name string) bool {
-	switch http.CanonicalHeaderKey(name) {
-	case "Host", "Connection", "Keep-Alive",
-		"Transfer-Encoding", "Te", "Trailer",
-		"Upgrade", "Proxy-Authorization",
-		"Proxy-Connection", "Content-Length":
-		return false
-	default:
-		return true
-	}
-}
-
-func applyRequestHeaders(
-	req *http.Request,
-	event *database.Event,
-	cfg *HTTPTargetConfig,
-) {
-	if event.ContentType != "" {
-		req.Header.Set(
-			"Content-Type", event.ContentType,
-		)
-	}
-
-	var originalHeaders map[string][]string
-
-	if event.Headers != "" {
-		jsonErr := json.Unmarshal(
-			[]byte(event.Headers),
-			&originalHeaders,
-		)
-		if jsonErr == nil {
-			for k, vals := range originalHeaders {
-				if isForwardableHeader(k) {
-					for _, v := range vals {
-						req.Header.Add(k, v)
-					}
-				}
-			}
-		}
-	}
-
-	for k, v := range cfg.Headers {
-		req.Header.Set(k, v)
-	}
-
-	req.Header.Set("User-Agent", "webhooker/1.0")
-}
-
-// executeHTTPRequest sends an HTTP request using the provided
-// client. URLs are validated by the config parsers and the
-// SSRF-safe transport before reaching here.
-func executeHTTPRequest(
-	client *http.Client, req *http.Request,
-) (*http.Response, error) {
-	return client.Do(req) //#nosec G704 -- URL validated by parseHTTPConfig/parseSlackConfig and SSRF-safe transport
-}

internal/delivery/target_log.go

@@ -1,47 +0,0 @@
-package delivery
-
-import (
-	"context"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// logTarget is a fire-and-forget target that logs the entire
-// inbound webhook — the full request body and headers, plus
-// the method, content type, and the webhook and entrypoint
-// ids — then records a single successful attempt.
-type logTarget struct {
-	eng *Engine
-}
-
-// Deliver implements Target.
-func (t *logTarget) Deliver(
-	_ context.Context,
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	_ *Task,
-	_ Scheduler,
-) {
-	t.eng.log.Info(
-		"webhook event delivered to log target",
-		"delivery_id", d.ID,
-		"event_id", d.EventID,
-		"target_id", d.TargetID,
-		"target_name", d.Target.Name,
-		"webhook_id", d.Event.WebhookID,
-		"entrypoint_id", d.Event.EntrypointID,
-		"method", d.Event.Method,
-		"content_type", d.Event.ContentType,
-		"headers", d.Event.Headers,
-		"body", d.Event.Body,
-	)
-
-	t.eng.recordResult(
-		webhookDB, d, 1, true, 0, "", "", 0,
-	)
-
-	t.eng.updateDeliveryStatus(
-		webhookDB, d, database.DeliveryStatusDelivered,
-	)
-}

internal/delivery/target_slack.go

@@ -1,299 +0,0 @@
-package delivery
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// errMissingWebhookURL is returned when a Slack target config
-// omits its webhook URL.
-var errMissingWebhookURL = errors.New(
-	"webhook_url is required",
-)
-
-// SlackTargetConfig holds configuration for slack target
-// types.
-type SlackTargetConfig struct {
-	WebhookURL string `json:"webhookUrl"`
-}
-
-// slackTarget delivers events to Slack incoming webhooks. It
-// formats the event into a Slack message and posts it as
-// JSON. It shares the retry core with the HTTP target: a
-// MaxRetries of 0 stays single-attempt fire-and-forget
-// (preserving existing Slack targets), while a positive
-// MaxRetries adds backoff and circuit breaking.
-type slackTarget struct {
-	*httpCore
-
-	client *http.Client
-}
-
-// Deliver implements Target.
-func (t *slackTarget) Deliver(
-	ctx context.Context,
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	task *Task,
-	sched Scheduler,
-) {
-	cfg, err := parseSlackConfig(d.Target.Config)
-	if err != nil {
-		t.eng.log.Error(
-			"invalid Slack target config",
-			"target_id", d.TargetID,
-			"error", err,
-		)
-
-		t.failConfig(webhookDB, d, err)
-
-		return
-	}
-
-	msg := FormatSlackMessage(&d.Event)
-
-	payload, err := json.Marshal(
-		map[string]string{"text": msg},
-	)
-	if err != nil {
-		t.eng.log.Error(
-			"failed to marshal Slack payload",
-			"target_id", d.TargetID,
-			"error", err,
-		)
-
-		t.failConfig(webhookDB, d, err)
-
-		return
-	}
-
-	attempt := func() attemptResult {
-		return t.attempt(ctx, cfg, payload)
-	}
-
-	t.deliver(
-		webhookDB, d, task, sched,
-		d.Target.MaxRetries, attempt,
-	)
-}
-
-// failConfig records a first-attempt failure for a delivery
-// that could not be prepared (bad config or unmarshalable
-// payload) and marks it failed.
-func (t *slackTarget) failConfig(
-	webhookDB *gorm.DB,
-	d *database.Delivery,
-	err error,
-) {
-	t.eng.recordResult(
-		webhookDB, d, 1,
-		false, 0, "", err.Error(), 0,
-	)
-
-	t.eng.updateDeliveryStatus(
-		webhookDB, d, database.DeliveryStatusFailed,
-	)
-}
-
-// attempt performs a single Slack POST and derives its
-// outcome, preserving the engine's original semantics: a
-// non-2xx response records an "HTTP <code>" error string and
-// a transport error records a "sending request" error.
-func (t *slackTarget) attempt(
-	ctx context.Context,
-	cfg *SlackTargetConfig,
-	payload []byte,
-) attemptResult {
-	start := time.Now()
-
-	req, err := http.NewRequestWithContext(
-		ctx,
-		http.MethodPost,
-		cfg.WebhookURL,
-		bytes.NewReader(payload),
-	)
-	if err != nil {
-		return attemptResult{
-			success: false,
-			errMsg:  err.Error(),
-		}
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("User-Agent", "webhooker/1.0")
-
-	resp, doErr := executeHTTPRequest(t.client, req)
-	durationMs := time.Since(start).Milliseconds()
-
-	if doErr != nil {
-		return attemptResult{
-			success:  false,
-			duration: durationMs,
-			errMsg: fmt.Errorf(
-				"sending request: %w", doErr,
-			).Error(),
-		}
-	}
-
-	defer func() { _ = resp.Body.Close() }()
-
-	return t.readSlackResponse(resp, durationMs)
-}
-
-func (t *slackTarget) readSlackResponse(
-	resp *http.Response,
-	durationMs int64,
-) attemptResult {
-	body, readErr := io.ReadAll(
-		io.LimitReader(resp.Body, maxBodyLog),
-	)
-	if readErr != nil {
-		t.eng.log.Error(
-			"failed to read Slack response body",
-			"error", readErr,
-		)
-	}
-
-	success := resp.StatusCode >= httpSuccessMin &&
-		resp.StatusCode < httpSuccessMax
-
-	errMsg := ""
-	if !success {
-		errMsg = fmt.Sprintf("HTTP %d", resp.StatusCode)
-	}
-
-	return attemptResult{
-		statusCode: resp.StatusCode,
-		respBody:   string(body),
-		duration:   durationMs,
-		success:    success,
-		errMsg:     errMsg,
-	}
-}
-
-func parseSlackConfig(
-	configJSON string,
-) (*SlackTargetConfig, error) {
-	if configJSON == "" {
-		return nil, errEmptyTargetConfig
-	}
-
-	var cfg SlackTargetConfig
-
-	err := json.Unmarshal(
-		[]byte(configJSON), &cfg,
-	)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"parsing config JSON: %w", err,
-		)
-	}
-
-	if cfg.WebhookURL == "" {
-		return nil, errMissingWebhookURL
-	}
-
-	return &cfg, nil
-}
-
-// FormatSlackMessage builds a Slack-compatible message
-// string from a webhook event.
-func FormatSlackMessage(
-	event *database.Event,
-) string {
-	var b strings.Builder
-
-	b.WriteString("*Webhook Event Received*\n")
-
-	fmt.Fprintf(
-		&b, "*Method:* `%s`\n", event.Method,
-	)
-
-	fmt.Fprintf(
-		&b,
-		"*Content-Type:* `%s`\n",
-		event.ContentType,
-	)
-
-	fmt.Fprintf(
-		&b,
-		"*Timestamp:* `%s`\n",
-		event.CreatedAt.UTC().Format(time.RFC3339),
-	)
-
-	fmt.Fprintf(
-		&b,
-		"*Body Size:* %d bytes\n",
-		len(event.Body),
-	)
-
-	if event.Body == "" {
-		b.WriteString("\n_(empty body)_\n")
-
-		return b.String()
-	}
-
-	if formatted := formatJSONBody(event.Body); formatted != "" {
-		b.WriteString(formatted)
-
-		return b.String()
-	}
-
-	formatRawBody(&b, event.Body)
-
-	return b.String()
-}
-
-func formatJSONBody(body string) string {
-	var parsed json.RawMessage
-	if json.Unmarshal([]byte(body), &parsed) != nil {
-		return ""
-	}
-
-	var pretty bytes.Buffer
-	if json.Indent(&pretty, parsed, "", "  ") != nil {
-		return ""
-	}
-
-	var b strings.Builder
-
-	b.WriteString("\n```\n")
-
-	prettyStr := pretty.String()
-
-	const maxPayloadDisplay = 3500
-	if len(prettyStr) > maxPayloadDisplay {
-		b.WriteString(prettyStr[:maxPayloadDisplay])
-		b.WriteString("\n... (truncated)")
-	} else {
-		b.WriteString(prettyStr)
-	}
-
-	b.WriteString("\n```\n")
-
-	return b.String()
-}
-
-func formatRawBody(b *strings.Builder, body string) {
-	b.WriteString("\n```\n")
-
-	const maxRawDisplay = 3500
-	if len(body) > maxRawDisplay {
-		b.WriteString(body[:maxRawDisplay])
-		b.WriteString("\n... (truncated)")
-	} else {
-		b.WriteString(body)
-	}
-
-	b.WriteString("\n```\n")
-}

internal/handlers/webhook.go

@@ -329,7 +329,6 @@ func (h *Handlers) buildDeliveryTasks(
 			DeliveryID:   dlv.ID,
 			EventID:      event.ID,
 			WebhookID:    entrypoint.WebhookID,
-			EntrypointID: entrypoint.ID,
 			TargetID:     targets[i].ID,
 			TargetName:   targets[i].Name,
 			TargetType:   targets[i].Type,

internal/middleware/middleware.go

@@ -265,26 +265,6 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	}
 }
 
-// NoCache returns middleware that instructs browsers and
-// intermediary proxies not to cache the response. It sets
-// Cache-Control: no-store and Pragma: no-cache (the latter for
-// older HTTP/1.0 intermediaries). Apply it to authenticated pages
-// so webhook configuration and captured event data are not stored
-// by caches.
-func (s *Middleware) NoCache() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(
-			w http.ResponseWriter,
-			r *http.Request,
-		) {
-			w.Header().Set("Cache-Control", "no-store")
-			w.Header().Set("Pragma", "no-cache")
-
-			next.ServeHTTP(w, r)
-		})
-	}
-}
-
 // MaxBodySize returns middleware that limits the request body size
 // for POST requests. If the body exceeds the given limit in
 // bytes, the server returns 413 Request Entity Too Large. This

internal/middleware/middleware_test.go

@@ -387,45 +387,6 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
-// --- NoCache Middleware Tests ---
-
-func TestNoCache_SetsHeaders(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	var called bool
-
-	handler := m.NoCache()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			called = true
-
-			w.WriteHeader(http.StatusOK)
-		},
-	))
-
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodGet, "/sources", nil,
-	)
-	w := httptest.NewRecorder()
-
-	handler.ServeHTTP(w, req)
-
-	assert.True(
-		t, called,
-		"NoCache middleware should call the next handler",
-	)
-	assert.Equal(
-		t, "no-store",
-		w.Header().Get("Cache-Control"),
-	)
-	assert.Equal(
-		t, "no-cache",
-		w.Header().Get("Pragma"),
-	)
-}
-
 // --- Helper Tests ---
 
 func TestIpFromHostPort(t *testing.T) {

internal/middleware/ratelimit.go

@@ -14,11 +14,6 @@ const (
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
-
-	// receiverRateInterval is the time window for the webhook
-	// receiver rate limit. The configured limit is expressed in
-	// requests per minute.
-	receiverRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -67,37 +62,3 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 		})
 	}
 }
-
-// ReceiverRateLimit returns middleware that rate-limits the
-// public webhook receiver endpoint per client IP per request
-// path (the path contains the entrypoint UUID, so each sender
-// is limited per entrypoint without affecting other senders or
-// other entrypoints). The limit is Config.ReceiverRateLimit
-// requests per minute. Requests over the limit receive a 429;
-// httprate adds the Retry-After header (RFC 6585). IP
-// extraction honours X-Forwarded-For, X-Real-IP, and
-// True-Client-IP headers for reverse-proxy setups.
-func (m *Middleware) ReceiverRateLimit() func(http.Handler) http.Handler {
-	return httprate.Limit(
-		m.params.Config.ReceiverRateLimit,
-		receiverRateInterval,
-		httprate.WithKeyFuncs(
-			httprate.KeyByRealIP,
-			httprate.KeyByEndpoint,
-		),
-		httprate.WithLimitHandler(http.HandlerFunc(
-			func(w http.ResponseWriter, r *http.Request) {
-				m.log.Warn(
-					"webhook receiver rate limit exceeded",
-					"path", r.URL.Path,
-				)
-				http.Error(
-					w,
-					"Too many requests. "+
-						"Please slow down.",
-					http.StatusTooManyRequests,
-				)
-			},
-		)),
-	)
-}

internal/middleware/ratelimit_test.go

@@ -2,10 +2,8 @@ package middleware_test
 
 import (
 	"context"
-	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -147,94 +145,3 @@ func TestLoginRateLimit_IndependentPerIP(t *testing.T) {
 		"different IP should not be affected",
 	)
 }
-
-// receiverLimitedHandler builds a ReceiverRateLimit-wrapped
-// handler with the given per-minute limit.
-func receiverLimitedHandler(
-	t *testing.T, limit int,
-) http.Handler {
-	t.Helper()
-
-	log := slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-
-	m := middleware.NewForTest(
-		log,
-		&config.Config{ReceiverRateLimit: limit},
-		nil,
-	)
-
-	return m.ReceiverRateLimit()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	))
-}
-
-// receiverPost sends one POST to the handler from the given IP
-// and path and returns the recorder.
-func receiverPost(
-	handler http.Handler, ip, path string,
-) *httptest.ResponseRecorder {
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost, path, nil,
-	)
-	req.RemoteAddr = ip
-
-	w := httptest.NewRecorder()
-	handler.ServeHTTP(w, req)
-
-	return w
-}
-
-func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
-	t.Parallel()
-
-	const limit = 3
-
-	handler := receiverLimitedHandler(t, limit)
-
-	// The first limit requests from one IP to one entrypoint
-	// pass.
-	for i := range limit {
-		w := receiverPost(
-			handler, "9.9.9.9:1234", "/webhook/uuid-a",
-		)
-		assert.Equal(
-			t, http.StatusOK, w.Code,
-			"request %d should pass", i,
-		)
-	}
-
-	// The next request over the limit is rejected with a 429
-	// carrying a Retry-After header.
-	w := receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-a",
-	)
-	assert.Equal(t, http.StatusTooManyRequests, w.Code)
-	assert.NotEmpty(
-		t, w.Header().Get("Retry-After"),
-		"429 must carry a Retry-After header",
-	)
-
-	// The same IP is not limited on a different entrypoint.
-	w = receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-b",
-	)
-	assert.Equal(
-		t, http.StatusOK, w.Code,
-		"a different entrypoint must not be affected",
-	)
-
-	// A different IP is not limited on the same entrypoint.
-	w = receiverPost(
-		handler, "8.8.8.8:1234", "/webhook/uuid-a",
-	)
-	assert.Equal(
-		t, http.StatusOK, w.Code,
-		"a different client IP must not be affected",
-	)
-}

internal/server/routes.go

@@ -91,7 +91,6 @@ func (s *Server) setupRoutes() {
 func (s *Server) setupPageRoutes() {
 	s.router.Route("/pages", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
-		r.Use(s.mw.NoCache())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 
 		r.Group(func(r chi.Router) {
@@ -107,7 +106,6 @@ func (s *Server) setupPageRoutes() {
 func (s *Server) setupUserRoutes() {
 	s.router.Route("/user/{username}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
-		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
 	})
@@ -116,7 +114,6 @@ func (s *Server) setupUserRoutes() {
 func (s *Server) setupSourceRoutes() {
 	s.router.Route("/sources", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
-		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceList())
@@ -126,7 +123,6 @@ func (s *Server) setupSourceRoutes() {
 
 	s.router.Route("/source/{sourceID}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
-		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceDetail())
@@ -159,7 +155,7 @@ func (s *Server) setupSourceRoutes() {
 }
 
 func (s *Server) setupWebhookRoutes() {
-	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
+	s.router.HandleFunc(
 		"/webhook/{uuid}",
 		s.h.HandleWebhook(),
 	)