Offer archive expiry choices on the target forms, show plain units (closes #396)

A database target's archive expiry was typed by hand as never or a raw duration such as 720h, and the target list showed it back raw. Adding or editing a database target now offers the new-webhook page's list of choices (never, 1h, 12h, 24h, 30d, 90d, 365d), defined once and shared by all three forms. The edit form starts on the stored expiry, or on the submitted one after a refused save; a stored value outside the choices is listed under its own value, so saving unchanged keeps it. The target list shows the expiry in plain units: "30 days", "12 hours", "never".

Model: opus-5-5

README.md

@@ -1350,29 +1350,30 @@ markup. The CSP build runs no expressions, so every Alpine directive in
 `static/js/app.js`: `x-data="collapsible"` and `@click="toggle"`, never
 `x-data="{ open: false }"` or `@click="open = !open"`.
 
-A browser test in `internal/server` loads the webhook page and the event log
-under the real policy and checks that: the add entrypoint form stays hidden
-until Add is clicked; for every target type, the targets section's Add shows
-only a choice of type with Next and Cancel, Next shows only that type's fields
-(no url field for `database` or `log`), Cancel at either step closes the form,
-and saving adds the target; a refused target comes back with its form open, the
-values entered and the reason, and after Cancel the next Add starts with an
-empty form and no reason; the Copy button beside an entrypoint URL reads
-"Copied" once clicked; an entrypoint's Edit button shows its edit form in place
-of its description and hides until the form closes, Cancel hides the form and
-drops what was typed, as does leaving the page and going back to it, and Save
-changes the description; of the recent events on the webhook page only the
-newest starts expanded, each expands and collapses, and Open leads to the
-event's own page; an event in the event log expands and collapses when its
-row's caret or its ID is clicked, and from the keyboard, but not when its ID is
-selected with the mouse, and a delivery's attempts inside it expand and
-collapse; and at phone width the menu button opens and closes the mobile menu.
-It also fails if the browser reports a console warning or error, an uncaught
-exception, or anything the policy refused. `make check` and the image build lint
-it but do not run it, and `make test` leaves it out (its file is built only with
-the `browser` build tag). Run it with `make test-browser` after changing
-`templates/` or `static/js/`: that builds `Dockerfile.browser`, which runs the
-test in a digest-pinned headless browser image, so the host needs no browser.
+A browser test in `internal/server` loads the webhook page, its edit pages and
+the event log under the real policy and checks that: the add entrypoint form
+stays hidden until Add is clicked; for every target type, the targets section's
+Add shows only a choice of type with Next and Cancel, Next shows only that
+type's fields (no url field for `database` or `log`), Cancel at either step
+closes the form, and saving adds the target; a refused target comes back with
+its form open, the values entered and the reason, and after Cancel the next Add
+starts with an empty form and no reason; a refused save on the target edit page
+and on the webhook edit page comes back with the reason and every value
+entered; the Copy button beside an entrypoint URL reads "Copied" once clicked;
+an entrypoint's Edit button shows its edit form in place of its description and
+hides until the form closes, Cancel hides the form and drops what was typed, as
+does leaving the page and going back to it, and Save changes the description;
+of the recent events on the webhook page only the newest starts expanded, each
+expands and collapses, and Open leads to the event's own page; an event in the
+event log expands and collapses, and so do a delivery's attempts inside it; and
+at phone width the menu button opens and closes the mobile menu. It also fails
+if the browser reports a console warning or error, an uncaught exception, or
+anything the policy refused. `make check`
+and the image build lint it but do not run it, and `make test` leaves it out
+(its file is built only with the `browser` build tag). Run it with
+`make test-browser` after changing `templates/` or `static/js/`: that builds
+`Dockerfile.browser`, which runs the test in a digest-pinned headless browser
+image, so the host needs no browser.
 
 The package's tarball is committed as `3p/alpinejs-csp-3.14.9.tgz`, byte for
 byte as the npm registry publishes it. It is a dependency, not this repo's build
@@ -1720,8 +1721,11 @@ events should be forwarded.
   own archive database
   (`archive-{webhook_name}-{target_name}-{target_uuid}.db`) for long-term
   retention, with an optional creation-validated expiry (default: keep
-  forever). No external delivery and no retries; an archive write
-  failure fails the delivery. See the database target section under
+  forever). The new webhook form, the add target form and the target edit
+  form all offer the same expiries: never, 1h, 12h, 24h, 30d, 90d or 365d.
+  The target list shows the expiry in plain units, such as "30 days". No
+  external delivery and no retries; an archive write failure fails the
+  delivery. See the database target section under
   "Per-Webhook Event Databases" for the full semantics.
 - **`log`** — Write the event to the application log (stdout). Useful
   for debugging.

internal/delivery/target_config_edit.go

@@ -86,9 +86,9 @@ func NewTargetConfigForm(
 }
 
 // databaseConfigForm parses an archive target's optional expiry.
-// An absent or empty configuration is the keep-forever default and
-// yields an empty field, so re-saving the form unchanged stores the
-// same empty configuration it started with. An expiry that is set
+// An absent, empty or never expiry yields an empty expiry, on which
+// the edit form starts at never; saving it unchanged stores never,
+// which means the same as an empty expiry. An expiry that is set
 // but not a valid duration is an error, not a blank field.
 func databaseConfigForm(
 	configJSON string,

internal/delivery/target_config_view.go

@@ -1,9 +1,9 @@
 package delivery
 
 import (
-	"encoding/json"
 	"fmt"
 	"strconv"
+	"time"
 
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -197,37 +197,61 @@ func maxRetriesField(t *database.Target) ConfigField {
 	}
 }
 
-// databaseConfigFields describes an archive target. Its
-// configuration is optional, and an absent or empty expiry
-// means the archive is kept forever. An expiry that is set
-// but not a valid duration is reported as unavailable rather
-// than echoed back.
+// databaseConfigFields describes an archive target by its
+// expiry in plain units, such as "30 days", or "never" when
+// the archive is kept forever. An expiry that is set but not
+// a valid duration is reported as unavailable rather than
+// echoed back.
 func databaseConfigFields(configJSON string) []ConfigField {
-	expiry := archiveExpiryNever
+	expiry, err := parseArchiveExpiry(configJSON)
+	if err != nil {
+		return unavailableConfigFields()
+	}
 
-	if configJSON != "" {
-		var cfg databaseTargetConfig
-
-		err := json.Unmarshal([]byte(configJSON), &cfg)
-		if err != nil {
-			return unavailableConfigFields()
-		}
-
-		if cfg.Expiry != "" {
-			if ValidateArchiveExpiry(cfg.Expiry) != nil {
-				return unavailableConfigFields()
-			}
-
-			expiry = cfg.Expiry
-		}
+	value := archiveExpiryNever
+	if expiry > 0 {
+		value = plainDuration(expiry)
 	}
 
 	return []ConfigField{{
 		Label: "Archive Expiry",
-		Value: expiry,
+		Value: value,
 	}}
 }
 
+// plainDuration writes a positive duration as a count of the
+// largest whole unit it divides into: "30 days", "12 hours",
+// "1 minute". A duration with a fraction of a second is
+// written as Go writes it.
+func plainDuration(d time.Duration) string {
+	const day = 24 * time.Hour
+
+	units := []struct {
+		size time.Duration
+		name string
+	}{
+		{day, "day"},
+		{time.Hour, "hour"},
+		{time.Minute, "minute"},
+		{time.Second, "second"},
+	}
+
+	for _, unit := range units {
+		if d%unit.size != 0 {
+			continue
+		}
+
+		count := int64(d / unit.size)
+		if count == 1 {
+			return "1 " + unit.name
+		}
+
+		return fmt.Sprintf("%d %ss", count, unit.name)
+	}
+
+	return d.String()
+}
+
 // MaskedWebhookURL returns the Slack webhook URL reduced to
 // its scheme and host, with the path, query and any userinfo
 // elided. The path segments are the credential, so none of

internal/delivery/target_config_view_test.go

@@ -305,14 +305,20 @@ func TestNewTargetViews_Database(t *testing.T) {
 	}{
 		"empty config": {config: "", want: viewExpiryNever},
 		"empty expiry": {config: `{}`, want: viewExpiryNever},
-		"explicit": {
-			config: `{"expiry":"720h"}`,
-			want:   "720h",
-		},
 		"never literal": {
 			config: `{"expiry":"` + viewExpiryNever + `"}`,
 			want:   viewExpiryNever,
 		},
+		"1h":    {config: `{"expiry":"1h"}`, want: "1 hour"},
+		"12h":   {config: `{"expiry":"12h"}`, want: "12 hours"},
+		"24h":   {config: `{"expiry":"24h"}`, want: "1 day"},
+		"720h":  {config: `{"expiry":"720h"}`, want: "30 days"},
+		"2160h": {config: `{"expiry":"2160h"}`, want: "90 days"},
+		"8760h": {config: `{"expiry":"8760h"}`, want: "365 days"},
+		"36h":   {config: `{"expiry":"36h"}`, want: "36 hours"},
+		"1h30m": {config: `{"expiry":"1h30m"}`, want: "90 minutes"},
+		"45s":   {config: `{"expiry":"45s"}`, want: "45 seconds"},
+		"1.5s":  {config: `{"expiry":"1.5s"}`, want: "1.5s"},
 	}
 
 	for name, tc := range tests {

internal/delivery/target_headers_test.go

@@ -216,8 +216,9 @@ func TestNewTargetConfigForm(t *testing.T) {
 	assert.Empty(t, form.URL)
 }
 
-// A keep-forever archive target must pre-fill as an empty field, so
-// saving the form back unchanged stores the same empty config.
+// A keep-forever archive target yields an empty expiry, so the edit
+// form starts on never; saving it unchanged stores never, which means
+// the same as an empty expiry.
 func TestNewTargetConfigForm_DatabaseNeverIsBlank(t *testing.T) {
 	t.Parallel()
 

internal/handlers/archive_expiry.go

@@ -0,0 +1,58 @@
+package handlers
+
+const (
+	// archiveExpiryNever is the archive expiry that keeps archived
+	// events forever. A stored empty expiry means the same.
+	archiveExpiryNever = "never"
+
+	// tmplKeyArchiveExpiryChoices is the template data key for the
+	// entries of a page's archive expiry select.
+	tmplKeyArchiveExpiryChoices = "ArchiveExpiryChoices"
+)
+
+// archiveExpiryChoice is one entry of a database target's archive
+// expiry select: the expiry stored, the label shown, and whether the
+// select starts on it.
+type archiveExpiryChoice struct {
+	Value    string
+	Label    string
+	Selected bool
+}
+
+// archiveExpiryChoices lists the archive expiries offered by the new
+// webhook page, the add target form and the target edit form.
+func archiveExpiryChoices() []archiveExpiryChoice {
+	return []archiveExpiryChoice{
+		{Value: archiveExpiryNever, Label: archiveExpiryNever},
+		{Value: "1h", Label: "1h"},
+		{Value: "12h", Label: "12h"},
+		{Value: "24h", Label: "24h"},
+		{Value: "720h", Label: "30d"},
+		{Value: "2160h", Label: "90d"},
+		{Value: "8760h", Label: "365d"},
+	}
+}
+
+// archiveExpiryOptions returns the choices with expiry selected; an
+// empty expiry selects never. An expiry that is not one of the
+// choices comes first as its own selected entry, so saving the form
+// unchanged keeps it.
+func archiveExpiryOptions(expiry string) []archiveExpiryChoice {
+	if expiry == "" {
+		expiry = archiveExpiryNever
+	}
+
+	options := archiveExpiryChoices()
+
+	for i := range options {
+		if options[i].Value == expiry {
+			options[i].Selected = true
+
+			return options
+		}
+	}
+
+	own := archiveExpiryChoice{Value: expiry, Label: expiry, Selected: true}
+
+	return append([]archiveExpiryChoice{own}, options...)
+}

internal/handlers/archive_expiry_test.go

@@ -0,0 +1,166 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// expiryNever is the archive expiry that keeps archived events
+// forever.
+const expiryNever = "never"
+
+// matched returns what the one group of pattern matched in page, at
+// each match.
+func matched(pattern, page string) []string {
+	matches := regexp.MustCompile(pattern).FindAllStringSubmatch(page, -1)
+	groups := make([]string, 0, len(matches))
+
+	for _, m := range matches {
+		groups = append(groups, m[1])
+	}
+
+	return groups
+}
+
+// expiryShown returns the archive expiries the webhook page's target
+// list shows.
+func expiryShown(
+	t *testing.T, env *sourceTestEnv, webhookID string,
+) []string {
+	t.Helper()
+
+	w := httptest.NewRecorder()
+	env.handlers.HandleSourceDetail().ServeHTTP(w, getRequest(
+		t, "/hook/"+webhookID, env.cookies,
+		map[string]string{sourceIDParam: webhookID},
+	))
+	require.Equal(t, http.StatusOK, w.Code)
+
+	return matched(
+		`Archive Expiry:</span>\s*<span>([^<]*)</span>`, w.Body.String(),
+	)
+}
+
+// expirySelected returns the target edit page and the expiries its
+// select starts on.
+func expirySelected(
+	t *testing.T, env *sourceTestEnv, webhookID, targetID string,
+) (string, []string) {
+	t.Helper()
+
+	w := serveTarget(
+		env, http.MethodGet,
+		"/hook/"+webhookID+"/targets/"+targetID+"/edit", nil,
+	)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	page := w.Body.String()
+
+	return page, matched(`<option value="([^"]*)" selected>`, page)
+}
+
+// TestArchiveExpiryChoices adds a database target with each archive
+// expiry the forms offer, and checks that it is stored as chosen,
+// shown in plain units in the target list, and that the target edit
+// form starts on it.
+func TestArchiveExpiryChoices(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	choices := []struct{ value, shown string }{
+		{expiryNever, expiryNever},
+		{"1h", "1 hour"},
+		{"12h", "12 hours"},
+		{"24h", "1 day"},
+		{"720h", "30 days"},
+		{"2160h", "90 days"},
+		{"8760h", "365 days"},
+	}
+
+	for _, choice := range choices {
+		t.Run(choice.value, func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+
+			form := url.Values{}
+			form.Set("name", "archive")
+			form.Set("type", string(database.TargetTypeDatabase))
+			form.Set("expiry", choice.value)
+
+			w := serveTarget(
+				env, http.MethodPost, "/hook/"+webhook.ID+"/targets", form,
+			)
+			require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
+
+			targets := targetsForWebhook(t, env.db, webhook.ID)
+			require.Len(t, targets, 1)
+			assert.JSONEq(
+				t, `{"expiry":"`+choice.value+`"}`, targets[0].Config,
+			)
+
+			assert.Equal(
+				t, []string{choice.shown},
+				expiryShown(t, env, webhook.ID),
+			)
+
+			_, selected := expirySelected(t, env, webhook.ID, targets[0].ID)
+			assert.Equal(t, []string{choice.value}, selected)
+		})
+	}
+}
+
+// TestArchiveExpiryEditStartsOnStoredValue checks the edit form of a
+// database target whose stored expiry is empty, which selects never,
+// and of one whose expiry is not one of the choices, which is listed
+// first as its own selected entry and saved unchanged.
+func TestArchiveExpiryEditStartsOnStoredValue(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	webhook := seedWebhookWithRetention(t, env.db, 30)
+	empty := seedConfiguredTarget(
+		t, env.db, webhook.ID, database.TargetTypeDatabase, "",
+	)
+
+	_, selected := expirySelected(t, env, webhook.ID, empty.ID)
+	assert.Equal(t, []string{expiryNever}, selected)
+
+	webhook = seedWebhookWithRetention(t, env.db, 30)
+	unlisted := seedConfiguredTarget(
+		t, env.db, webhook.ID, database.TargetTypeDatabase,
+		`{"expiry":"36h"}`,
+	)
+
+	assert.Equal(t, []string{"36 hours"}, expiryShown(t, env, webhook.ID))
+
+	page, selected := expirySelected(t, env, webhook.ID, unlisted.ID)
+	assert.Equal(t, []string{"36h"}, selected)
+	assert.Regexp(
+		t,
+		`<select id="expiry" name="expiry" class="input">\s*`+
+			`<option value="36h" selected>36h</option>\s*`+
+			`<option value="never">never</option>`,
+		page,
+	)
+	assert.Contains(t, page, `<option value="8760h">365d</option>`)
+
+	form := url.Values{}
+	form.Set("name", unlisted.Name)
+	form.Set("expiry", "36h")
+
+	w := submitTargetEdit(env, webhook.ID, unlisted.ID, form)
+	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
+	assert.JSONEq(
+		t, `{"expiry":"36h"}`, storedTarget(t, env, unlisted.ID).Config,
+	)
+}

internal/handlers/source_detail_test.go

@@ -234,7 +234,7 @@ func TestHandleSourceDetail_RendersNamedTargetFields(
 	assert.NotContains(t, body, "sekrit")
 
 	assert.Contains(t, body, "Archive Expiry")
-	assert.Contains(t, body, "720h")
+	assert.Contains(t, body, "30 days")
 
 	// An unknown type gets the neutral placeholder, never the
 	// stored blob.

internal/handlers/source_management.go

@@ -312,6 +312,9 @@ func newSourceFormData(
 		tmplKeyError:           errMsg,
 		"Form":                 in,
 		"DefaultRetentionDays": database.DefaultRetentionDays,
+		tmplKeyArchiveExpiryChoices: archiveExpiryOptions(
+			in.ArchiveExpiry,
+		),
 	}
 }
 
@@ -616,13 +619,16 @@ func (h *Handlers) renderSourceDetail(
 		// Targets are projected to a display-safe view: a
 		// target's stored config blob holds a credential, and it
 		// must never reach a template.
-		"Entrypoints": entrypointViews,
-		"Targets":     h.targetRows(&webhook, targets),
-		"Events":      events,
-		"BaseURL":     baseURL,
-		"Stats":       h.loadWebhookStats(webhook.ID, entrypoints, targets),
-		"TargetForm":  targetForm,
-		"TargetError": targetErr,
+		"Entrypoints":     entrypointViews,
+		"Targets":         h.targetRows(&webhook, targets),
+		"Events":          events,
+		"BaseURL":         baseURL,
+		"Stats":           h.loadWebhookStats(webhook.ID, entrypoints, targets),
+		tmplKeyTargetForm: targetForm,
+		"TargetError":     targetErr,
+		// The add target form's select starts on its expiry
+		// through Alpine, so no choice is selected here.
+		tmplKeyArchiveExpiryChoices: archiveExpiryChoices(),
 	}
 
 	status := http.StatusOK
@@ -658,12 +664,12 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 			return
 		}
 
-		data := map[string]any{
-			tmplKeyWebhook: &webhook,
-			tmplKeyError:   "",
-		}
-
-		h.renderTemplate(w, r, "source_edit.html", data)
+		h.renderWebhookEdit(
+			w, r, &webhook,
+			webhook.Name, webhook.Description,
+			strconv.Itoa(webhook.RetentionDays),
+			"", http.StatusOK,
+		)
 	}
 }
 
@@ -709,7 +715,8 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 	}
 }
 
-// applyWebhookEdit validates and saves webhook edits.
+// applyWebhookEdit validates and saves webhook edits. A refused save
+// shows the edit form again with the values submitted and the reason.
 func (h *Handlers) applyWebhookEdit(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -718,52 +725,52 @@ func (h *Handlers) applyWebhookEdit(
 	// The body size cap is enforced by the MaxBodySize middleware,
 	// which runs before CSRF parses the form.
 	name := r.PostFormValue("name")
-	if name == "" {
-		data := map[string]any{
-			tmplKeyWebhook: webhook,
-			tmplKeyError:   "Name is required",
-		}
+	description := r.PostFormValue("description")
+	retention := r.PostFormValue("retention_days")
 
-		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)
+	if name == "" {
+		h.renderWebhookEdit(
+			w, r, webhook, name, description, retention,
+			"Name is required", http.StatusBadRequest,
+		)
 
 		return
 	}
 
-	oldName := webhook.Name
-	webhook.Name = name
-	webhook.Description = r.PostFormValue("description")
-
 	// An empty field falls back to the stored value, so submitting the
 	// form without touching retention leaves the policy alone.
 	retentionDays, errMsg := parseRetentionDays(
-		r.PostFormValue("retention_days"), webhook.RetentionDays,
+		retention, webhook.RetentionDays,
 	)
 	if errMsg != "" {
-		data := map[string]any{
-			tmplKeyWebhook: webhook,
-			tmplKeyError:   errMsg,
-		}
-
-		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)
+		h.renderWebhookEdit(
+			w, r, webhook, name, description, retention,
+			errMsg, http.StatusBadRequest,
+		)
 
 		return
 	}
 
-	webhook.RetentionDays = retentionDays
+	// edited is the webhook as the submission leaves it; webhook stays
+	// as stored, for the page shown again when the save is refused.
+	edited := *webhook
+	edited.Name = name
+	edited.Description = description
+	edited.RetentionDays = retentionDays
 
 	// A new name renames the archive files before it is saved (see
 	// delivery.Engine.Rename). If either step fails, the same targets'
 	// archives go back to the name that is still stored, without
 	// reading the main database again.
 	targets, err := h.renameWebhookArchives(
-		webhook.ID, oldName, webhook.Name,
+		webhook.ID, webhook.Name, edited.Name,
 	)
 	if err == nil {
-		err = h.db.DB().Save(webhook).Error
+		err = h.db.DB().Save(&edited).Error
 	}
 
 	if err != nil {
-		restoreErr := h.renameArchives(targets, oldName)
+		restoreErr := h.renameArchives(targets, webhook.Name)
 		if restoreErr != nil {
 			h.log.Error(
 				"failed to rename archives back",
@@ -773,15 +780,14 @@ func (h *Handlers) applyWebhookEdit(
 		}
 
 		if errors.Is(err, delivery.ErrArchiveNameTaken) {
-			data := map[string]any{
-				tmplKeyWebhook: webhook,
-				tmplKeyError: "Not saved: " + err.Error() +
-					". Move that archive out of the data directory, " +
-					"its .db together with any -wal and -shm beside " +
+			h.renderWebhookEdit(
+				w, r, webhook, name, description, retention,
+				"Not saved: "+err.Error()+
+					". Move that archive out of the data directory, "+
+					"its .db together with any -wal and -shm beside "+
 					"it, then save again.",
-			}
-
-			h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusConflict)
+				http.StatusConflict,
+			)
 
 			return
 		}
@@ -797,6 +803,27 @@ func (h *Handlers) applyWebhookEdit(
 	)
 }
 
+// renderWebhookEdit renders the webhook edit page for the webhook as
+// stored, its form showing name, description and retentionDays, with
+// an optional error message above it.
+func (h *Handlers) renderWebhookEdit(
+	w http.ResponseWriter,
+	r *http.Request,
+	webhook *database.Webhook,
+	name, description, retentionDays, errMsg string,
+	status int,
+) {
+	data := map[string]any{
+		tmplKeyWebhook:  webhook,
+		tmplKeyError:    errMsg,
+		"Name":          name,
+		"Description":   description,
+		"RetentionDays": retentionDays,
+	}
+
+	h.renderTemplateStatus(w, r, "source_edit.html", data, status)
+}
+
 // HandleSourceDelete handles webhook deletion.
 func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -1668,49 +1695,57 @@ func (h *Handlers) newTarget(
 	webhookID string,
 	in targetFormInput,
 ) (*database.Target, string, error) {
-	if in.Name == "" {
-		return nil, "Name is required", nil
+	target := &database.Target{
+		WebhookID: webhookID,
+		Type:      in.Type,
+		Active:    true,
 	}
 
-	if !isValidTargetType(in.Type) {
-		return nil, "Invalid target type", nil
-	}
-
-	configJSON, errMsg, err := h.buildTargetConfig(ctx, in.Type, in)
+	errMsg, err := h.setTargetFromForm(ctx, target, in)
 	if err != nil || errMsg != "" {
 		return nil, errMsg, err
 	}
 
-	// A new target has no stored retry count, so an absent field
-	// takes the fire-and-forget default. A field the operator filled
-	// in with something invalid is refused rather than becoming
-	// that default.
-	maxRetries, err := parseMaxRetries(in.MaxRetries, 0)
-	if err != nil {
-		return nil, "Invalid max retries: " + retriesErrorMessage(err), nil
-	}
-
-	return &database.Target{
-		WebhookID:  webhookID,
-		Name:       in.Name,
-		Type:       in.Type,
-		Active:     true,
-		Config:     configJSON,
-		MaxRetries: maxRetries,
-	}, "", nil
+	return target, "", nil
 }
 
-// isValidTargetType checks whether the target type is supported.
-func isValidTargetType(tt database.TargetType) bool {
-	switch tt {
-	case database.TargetTypeHTTP,
-		database.TargetTypeDatabase,
-		database.TargetTypeLog,
-		database.TargetTypeSlack:
-		return true
-	default:
-		return false
+// setTargetFromForm validates a target form against the target's type
+// and, when it accepts it, sets the target's name, configuration and
+// retry count from it. It returns the message the form shows for
+// anything it refuses, an unknown type among them, and then leaves the
+// target unchanged; an error is the server's fault, as for newTarget.
+// The add target form and the target edit form both go through here,
+// so the two cannot come to disagree about what a target may be.
+func (h *Handlers) setTargetFromForm(
+	ctx context.Context,
+	target *database.Target,
+	in targetFormInput,
+) (string, error) {
+	if in.Name == "" {
+		return "Name is required", nil
 	}
+
+	configJSON, errMsg, err := h.buildTargetConfig(ctx, target.Type, in)
+	if err != nil || errMsg != "" {
+		return errMsg, err
+	}
+
+	// An empty max_retries keeps the target's count: the
+	// fire-and-forget default of 0 for a new target, and the stored
+	// count for an edited one, since the forms for target types that
+	// do not retry have no such field. A value that is filled in but
+	// invalid is refused rather than becoming that count, so a typo
+	// cannot destroy the count a target is delivering with.
+	maxRetries, err := parseMaxRetries(in.MaxRetries, target.MaxRetries)
+	if err != nil {
+		return "Invalid max retries: " + retriesErrorMessage(err), nil
+	}
+
+	target.Name = in.Name
+	target.Config = configJSON
+	target.MaxRetries = maxRetries
+
+	return "", nil
 }
 
 // pageOrFirst parses a paginated page number, answering 1 for
@@ -1732,9 +1767,10 @@ func pageOrFirst(s string) int {
 }
 
 // targetFormInput carries the raw values of a target form. Both the
-// create and the edit path fill one and hand it to buildTargetConfig,
-// so neither can come to validate a destination differently from the
-// other. A refused add target form is shown again from it.
+// create and the edit path fill one and hand it to setTargetFromForm,
+// so neither can come to validate a target differently from the
+// other. Both forms are filled from one: the edit form with the
+// stored values, and a refused form with the values submitted.
 type targetFormInput struct {
 	// Name is the target's name.
 	Name string

internal/handlers/source_management_test.go

@@ -509,6 +509,51 @@ func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
 	)
 }
 
+// TestHandleSourceEditSubmit_RefusedFormComesBack refuses an edit for
+// each reason the form can give and checks that the form comes back
+// with the reason and the name, description and retention submitted,
+// that the page still reports the stored retention, and that nothing
+// is saved.
+func TestHandleSourceEditSubmit_RefusedFormComesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	refused := func(name, retention, reason string) {
+		t.Helper()
+
+		wh := seedWebhookWithRetention(t, env.db, 30)
+
+		submitted := wh
+		submitted.Name = name
+		submitted.Description = "a description worth keeping"
+
+		w := submitEdit(t, env, submitted, retention)
+		assert.Equal(t, http.StatusBadRequest, w.Code)
+
+		page := w.Body.String()
+		assert.Contains(t, page, `class="alert-error">`+reason)
+		assert.Contains(t, page, `name="name" value="`+name+`"`)
+		assert.Contains(t, page, ">a description worth keeping</textarea>")
+		assert.Contains(
+			t, page, `name="retention_days" value="`+retention+`"`,
+		)
+		assert.Contains(t, page, "Currently 30 days.")
+
+		var stored database.Webhook
+
+		require.NoError(
+			t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+		)
+		assert.Equal(t, wh.Name, stored.Name)
+		assert.Empty(t, stored.Description)
+		assert.Equal(t, 30, stored.RetentionDays)
+	}
+
+	refused("", "45", "Name is required")
+	refused("kept-name", "nonsense", "Retention must be")
+}
+
 func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	t *testing.T,
 ) {
@@ -809,6 +854,10 @@ func TestHandleSourceEditSubmit_ArchiveNameTaken(t *testing.T) {
 	w := submitEdit(t, env, wh, "")
 	require.Equal(t, http.StatusConflict, w.Code)
 	assert.Contains(t, w.Body.String(), "archive-taken.db")
+	assert.Contains(
+		t, w.Body.String(), `name="name" value="`+renamedWebhookName+`"`,
+		"the form comes back with the name submitted",
+	)
 
 	var stored database.Webhook
 

internal/handlers/target_edit.go

@@ -3,6 +3,7 @@ package handlers
 import (
 	"errors"
 	"net/http"
+	"strconv"
 
 	"github.com/go-chi/chi"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -13,10 +14,13 @@ import (
 const targetEditTemplate = "target_edit.html"
 
 // tmplKeyTarget is the template data key for the target being
-// edited, and tmplKeyMaxTimeout for the timeout ceiling the form
-// tells the user about.
+// edited, tmplKeyTargetForm for the values its form shows, and
+// tmplKeyMaxTimeout for the timeout ceiling the form tells the user
+// about. The add target form on the webhook page takes its values
+// under the same key as the edit form.
 const (
 	tmplKeyTarget     = "Target"
+	tmplKeyTargetForm = "TargetForm"
 	tmplKeyMaxTimeout = "MaxTimeout"
 )
 
@@ -28,20 +32,19 @@ const configUnreadableMessage = "The stored configuration for this " +
 	"target could not be read. Enter the values below; saving " +
 	"replaces the stored configuration."
 
-// targetEditView is the display model for the target edit page.
+// targetEditView is the display model for the target edit page: the
+// target's row fields as stored. The values the form shows, the
+// UNMASKED configuration among them, come separately, as a
+// targetFormInput.
 //
-// It carries the target's row fields alongside its UNMASKED
-// configuration, and deliberately omits database.Target's raw
-// Config blob: the form renders named fields, and giving the
-// template the blob as well would put an unreviewed second path to
-// the credential on the page.
+// It deliberately omits database.Target's raw Config blob: the form
+// renders named fields, and giving the template the blob as well
+// would put an unreviewed second path to the credential on the page.
 type targetEditView struct {
-	ID         string
-	Name       string
-	Type       database.TargetType
-	Active     bool
-	MaxRetries int
-	Config     delivery.TargetConfigForm
+	ID     string
+	Name   string
+	Type   database.TargetType
+	Active bool
 }
 
 // HandleTargetEdit shows the form to edit a target.
@@ -73,7 +76,18 @@ func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 			msg = configUnreadableMessage
 		}
 
-		h.renderTargetEdit(w, r, webhook, target, cfg, msg)
+		form := targetFormInput{
+			Name:       target.Name,
+			URL:        cfg.URL,
+			Headers:    cfg.Headers,
+			Timeout:    cfg.Timeout,
+			MaxRetries: strconv.Itoa(target.MaxRetries),
+			Expiry:     cfg.Expiry,
+		}
+
+		h.renderTargetEdit(
+			w, r, webhook, target, form, msg, http.StatusOK,
+		)
 	}
 }
 
@@ -101,11 +115,12 @@ func (h *Handlers) HandleTargetEditSubmit() http.HandlerFunc {
 	}
 }
 
-// applyTargetEdit validates and saves target edits.
+// applyTargetEdit validates and saves target edits. A refused save
+// shows the edit form again with the values submitted and the reason.
 //
-// The submitted configuration goes through buildTargetConfig, the
-// same builder the create path uses, so an edited destination is
-// SSRF-validated exactly as a new one is.
+// The submission goes through setTargetFromForm, as a new target
+// does, so an edited destination is SSRF-validated exactly as a new
+// one is.
 //
 // The target's type is not editable. Each type stores a different
 // configuration shape and its delivery history is recorded against
@@ -118,16 +133,13 @@ func (h *Handlers) applyTargetEdit(
 	webhook database.Webhook,
 	target *database.Target,
 ) {
-	name := r.PostFormValue("name")
-	if name == "" {
-		http.Error(w, "Name is required", http.StatusBadRequest)
+	in := targetFormInputFrom(r)
 
-		return
-	}
+	// edited is the target as the submission leaves it; target stays
+	// as stored, for the page shown again when the save is refused.
+	edited := *target
 
-	configJSON, errMsg, err := h.buildTargetConfig(
-		r.Context(), target.Type, targetFormInputFrom(r),
-	)
+	errMsg, err := h.setTargetFromForm(r.Context(), &edited, in)
 	if err != nil {
 		h.serverError(w, r, "failed to encode target config", err)
 
@@ -135,45 +147,26 @@ func (h *Handlers) applyTargetEdit(
 	}
 
 	if errMsg != "" {
-		http.Error(w, errMsg, http.StatusBadRequest)
+		h.renderTargetEdit(
+			w, r, webhook, target, in, errMsg, http.StatusBadRequest,
+		)
 
 		return
 	}
 
-	// Retries are offered only by the forms for target types that
-	// retry, so an absent field means "this form does not edit
-	// retries" rather than "set them to zero". Reading it
-	// unconditionally would silently disable retries on any target
-	// saved from a form that does not render the input.
-	//
-	// A field that IS submitted but does not parse is a 400, through
-	// the same validator the create path uses. It is rejected before
-	// anything is written, so a typo cannot destroy the retry count
-	// the target is already delivering with.
-	if r.PostForm.Has("max_retries") {
-		retries, ok := targetMaxRetries(w, r, target.MaxRetries)
-		if !ok {
-			return
-		}
-
-		target.MaxRetries = retries
-	}
-
-	oldName := target.Name
-	target.Name = name
-	target.Config = configJSON
-
 	// A new name renames the archive file before it is saved (see
 	// delivery.Engine.Rename). If either step fails, it goes back to
 	// the name that is still stored.
-	err = h.renameTargetArchive(target, webhook.Name, oldName, name)
+	err = h.renameTargetArchive(
+		target, webhook.Name, target.Name, edited.Name,
+	)
 	if err == nil {
-		err = h.db.DB().Save(target).Error
+		err = h.db.DB().Save(&edited).Error
 	}
 
 	if err != nil {
 		restoreErr := h.renameTargetArchive(
-			target, webhook.Name, name, oldName,
+			target, webhook.Name, edited.Name, target.Name,
 		)
 		if restoreErr != nil {
 			h.log.Error(
@@ -184,8 +177,8 @@ func (h *Handlers) applyTargetEdit(
 		}
 
 		if errors.Is(err, delivery.ErrArchiveNameTaken) {
-			http.Error(
-				w,
+			h.renderTargetEdit(
+				w, r, webhook, target, in,
 				"Not saved: "+err.Error()+
 					". Move that archive out of the data directory, "+
 					"its .db together with any -wal and -shm beside "+
@@ -222,15 +215,17 @@ func (h *Handlers) renameTargetArchive(
 	return h.archives.Rename(target.ID, webhookName, newName)
 }
 
-// renderTargetEdit renders the target edit page with an optional
-// error message.
+// renderTargetEdit renders the target edit page for the target as
+// stored, its form showing form's values, with an optional error
+// message above it.
 func (h *Handlers) renderTargetEdit(
 	w http.ResponseWriter,
 	r *http.Request,
 	webhook database.Webhook,
 	target *database.Target,
-	cfg delivery.TargetConfigForm,
+	form targetFormInput,
 	errMsg string,
+	status int,
 ) {
 	// The template calls Webhook methods, which take pointer
 	// receivers; html/template cannot address a value stored in a
@@ -238,18 +233,18 @@ func (h *Handlers) renderTargetEdit(
 	data := map[string]any{
 		tmplKeyWebhook: &webhook,
 		tmplKeyTarget: targetEditView{
-			ID:         target.ID,
-			Name:       target.Name,
-			Type:       target.Type,
-			Active:     target.Active,
-			MaxRetries: target.MaxRetries,
-			Config:     cfg,
+			ID:     target.ID,
+			Name:   target.Name,
+			Type:   target.Type,
+			Active: target.Active,
 		},
-		tmplKeyMaxTimeout: delivery.MaxTargetTimeoutSeconds,
-		tmplKeyError:      errMsg,
+		tmplKeyTargetForm:           form,
+		tmplKeyMaxTimeout:           delivery.MaxTargetTimeoutSeconds,
+		tmplKeyError:                errMsg,
+		tmplKeyArchiveExpiryChoices: archiveExpiryOptions(form.Expiry),
 	}
 
-	h.renderTemplate(w, r, targetEditTemplate, data)
+	h.renderTemplateStatus(w, r, targetEditTemplate, data, status)
 }
 
 // ownedTarget resolves the request's sourceID and targetID

internal/handlers/target_edit_test.go

@@ -565,6 +565,77 @@ func assertEditRejectsTimeout(
 	)
 }
 
+// TestHandleTargetEditSubmit_RefusedFormComesBack refuses an edit of
+// a target of each type and checks that the edit form comes back with
+// the reason and every value submitted, and that nothing is saved.
+func TestHandleTargetEditSubmit_RefusedFormComesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	// fields is what the operator submitted, as a query string.
+	cases := []struct {
+		targetType database.TargetType
+		fields     string
+		reason     string
+	}{
+		{
+			database.TargetTypeHTTP,
+			"name=edited&url=" + editBlockedURL +
+				"&headers=X-Edited:+kept&timeout=12&max_retries=3",
+			"Invalid target URL",
+		},
+		{
+			database.TargetTypeSlack,
+			"name=edited&url=" + editOriginalURL + "&max_retries=25",
+			"Invalid max retries",
+		},
+		{
+			database.TargetTypeDatabase, "name=edited&expiry=7d",
+			"Invalid archive expiry",
+		},
+		{database.TargetTypeLog, "name=", "Name is required"},
+	}
+
+	for _, tc := range cases {
+		t.Run(string(tc.targetType), func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+			target := seedTarget(t, env.db, webhook.ID, tc.targetType)
+
+			form, err := url.ParseQuery(tc.fields)
+			require.NoError(t, err)
+
+			w := submitTargetEdit(env, webhook.ID, target.ID, form)
+			assert.Equal(t, http.StatusBadRequest, w.Code)
+
+			page := w.Body.String()
+			assert.Contains(t, page, `class="alert-error">`+tc.reason)
+
+			// headers is the form's one textarea and expiry its one
+			// select; every other field is an input.
+			for field := range form {
+				shown := `name="` + field + `" value="` + form.Get(field) + `"`
+
+				switch field {
+				case "headers":
+					shown = ">" + form.Get(field) + "</textarea>"
+				case "expiry":
+					shown = `<option value="` + form.Get(field) + `" selected>`
+				}
+
+				assert.Contains(t, page, shown)
+			}
+
+			assert.Equal(
+				t, target.Name, storedTarget(t, env, target.ID).Name,
+				"a refused edit must save nothing",
+			)
+		})
+	}
+}
+
 // TestHandleTargetEdit_Scoping keeps the edit routes scoped the way
 // the delete and toggle routes are: ownership is decided by the
 // webhook, and the target is then scoped to it.
@@ -700,6 +771,10 @@ func TestHandleTargetEditSubmit_RenamesArchive(t *testing.T) {
 	w = submitTargetEdit(env, wh.ID, archive.ID, again)
 	require.Equal(t, http.StatusConflict, w.Code)
 	assert.Contains(t, w.Body.String(), "archive-taken.db")
+	assert.Contains(
+		t, w.Body.String(), `name="name" value="Again"`,
+		"the form comes back with the name submitted",
+	)
 	assert.Equal(
 		t, renamedTargetName, storedTarget(t, env, archive.ID).Name,
 	)

internal/handlers/target_private_refusal_test.go

@@ -44,9 +44,9 @@ func TestTargetRefusal_PrivateDestinationSaysHowToAllowIt(
 			form.Set("type", string(targetType))
 			form.Set("url", editBlockedURL)
 
-			// A refused add shows the webhook page again, where
-			// the hint is HTML-escaped; a refused edit answers in
-			// plain text.
+			// A refused add shows the webhook page again, and a
+			// refused edit the edit page, where the hint is
+			// HTML-escaped.
 			added := serveTarget(
 				env, http.MethodPost, targetsPath, form,
 			)
@@ -76,7 +76,8 @@ func TestTargetRefusal_PrivateDestinationSaysHowToAllowIt(
 			)
 			assert.Equal(t, http.StatusBadRequest, edited.Code)
 			assert.Contains(
-				t, edited.Body.String(), privateRefusalHint,
+				t, edited.Body.String(),
+				html.EscapeString(privateRefusalHint),
 			)
 		})
 	}

internal/handlers/target_retries.go

@@ -2,7 +2,6 @@ package handlers
 
 import (
 	"errors"
-	"net/http"
 	"strconv"
 	"strings"
 )
@@ -89,32 +88,3 @@ func retriesErrorMessage(err error) string {
 	return errRetriesInvalid.Error() +
 		", or 0 for fire-and-forget"
 }
-
-// targetMaxRetries reads and validates max_retries from a target edit
-// submission, answering the request with a 400 and reporting false
-// when the value is set but invalid.
-//
-// It and the create path (newTarget) both use parseMaxRetries and
-// retriesErrorMessage, so the two cannot come to disagree about what a
-// valid retry count is. The wording matches the timeout control on
-// the same submission.
-func targetMaxRetries(
-	w http.ResponseWriter,
-	r *http.Request,
-	fallback int,
-) (int, bool) {
-	retries, err := parseMaxRetries(
-		r.PostFormValue("max_retries"), fallback,
-	)
-	if err != nil {
-		http.Error(
-			w,
-			"Invalid max retries: "+retriesErrorMessage(err),
-			http.StatusBadRequest,
-		)
-
-		return 0, false
-	}
-
-	return retries, true
-}

internal/handlers/ui_copy_test.go

@@ -396,21 +396,21 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 	)
 
 	// A slack target exercises the same max_retries field while needing
-	// only Config.URL from the edit template, so the test data stays
-	// minimal. The Target key mirrors the field names the template reads
-	// off the handler's view value.
+	// only a URL from the edit template, so the test data stays
+	// minimal. The Target and TargetForm keys mirror the field names
+	// the template reads off the handler's values.
 	editBody := renderPage(
 		t, h, sess, "target_edit.html", map[string]any{
 			dataKeyWebhook: webhook,
 			"Target": map[string]any{
-				"ID":         "tg-1",
-				"Name":       "t",
-				"Type":       "slack",
-				"Active":     true,
-				"MaxRetries": 3,
-				"Config": map[string]any{
-					"URL": "https://hooks.slack.com/services/x",
-				},
+				"ID":     "tg-1",
+				"Name":   "t",
+				"Type":   "slack",
+				"Active": true,
+			},
+			"TargetForm": map[string]any{
+				"URL":        "https://hooks.slack.com/services/x",
+				"MaxRetries": "3",
 			},
 			dataKeyError: "",
 		},

internal/server/alpine_browser_test.go

@@ -18,13 +18,10 @@ import (
 	"time"
 
 	"github.com/chromedp/cdproto/browser"
-	"github.com/chromedp/cdproto/dom"
-	"github.com/chromedp/cdproto/input"
 	"github.com/chromedp/cdproto/log"
 	"github.com/chromedp/cdproto/network"
 	"github.com/chromedp/cdproto/runtime"
 	"github.com/chromedp/chromedp"
-	"github.com/chromedp/chromedp/kb"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gorm.io/gorm/clause"
@@ -43,11 +40,6 @@ const (
 	phoneWidth  = 390
 	phoneHeight = 844
 
-	// A window short enough that the event log scrolls with its last
-	// event expanded, and tall enough to show all of that event.
-	shortWidth  = 1024
-	shortHeight = 450
-
 	// olderBody is the body of the event received before the newest.
 	olderBody = "the older event"
 )
@@ -67,6 +59,45 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	t.Cleanup(srv.Close)
 
 	userID, _ := env.seedUser(t, "browser", "browser-password")
+	webhook, event, target := seedBrowserWebhook(t, env, userID)
+
+	require.NoError(t, chromedp.Run(
+		ctx, setCookies(srv.URL, env.authCookies(t, userID, "browser")),
+	))
+
+	page := srv.URL + "/hook/" + webhook.ID
+
+	// The checks share one browser tab, so they run one at a time, in
+	// this order. A new check is one more line here.
+	checkAddEntrypoint(ctx, t, page)
+	checkAddEachTargetType(ctx, t, page)
+	checkArchiveExpiry(ctx, t, page)
+	checkRefusedTarget(ctx, t, page)
+	checkTargetDeliveries(ctx, t, page, target.Name,
+		"0 in total, 0 in the last 24 hours",
+		"1 in total, 1 in the last 24 hours")
+	checkRefusedEdits(ctx, t, page, target.ID)
+	checkCopy(ctx, t, page)
+	checkEntrypointEdit(ctx, t, page, page+"/events")
+	checkRecentEvents(ctx, t, page)
+	checkEventLog(ctx, t, page+"/events", event.ID, target.Name)
+	checkArchiveChoice(ctx, t, srv.URL+"/hooks/new", page)
+	checkNewWebhookTargets(ctx, t, env, srv.URL+"/hooks/new")
+	checkRefusedNewWebhook(ctx, t, srv.URL+"/hooks/new")
+	checkMobileMenu(ctx, t, page)
+
+	assert.Empty(t, problems(), "the browser reported problems")
+}
+
+// seedBrowserWebhook seeds the webhook the browser test loads, owned by
+// userID: an entrypoint, two events, and a target whose delivery of the
+// newer event failed once with a 502. It returns the webhook, the newer
+// event and the target.
+func seedBrowserWebhook(
+	t *testing.T, env *testEnv, userID string,
+) (*database.Webhook, *database.Event, *database.Target) {
+	t.Helper()
+
 	webhook := env.seedWebhook(t, userID)
 	require.NoError(t, env.db.DB().Omit(clause.Associations).Create(
 		&database.Entrypoint{
@@ -75,7 +106,7 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 			Active:    true,
 		},
 	).Error)
-	older := env.seedEvent(t, webhook.ID, olderBody)
+	env.seedEvent(t, webhook.ID, olderBody)
 	event := env.seedEvent(t, webhook.ID, `{"hello":"browser"}`)
 	target := env.seedTarget(t, webhook.ID)
 	dlv := env.seedFailedDelivery(t, webhook.ID, event.ID, target.ID)
@@ -90,56 +121,7 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 		},
 	).Error)
 
-	require.NoError(t, chromedp.Run(
-		ctx, setCookies(srv.URL, env.authCookies(t, userID, "browser")),
-	))
-
-	page := srv.URL + "/hook/" + webhook.ID
-
-	checkAddEntrypoint(ctx, t, page)
-
-	// Each target type, with the fields its add target form submits, in
-	// page order. Only http and slack have a url field.
-	targetTypes := []struct {
-		name   string
-		fields string
-		values map[string]string
-	}{
-		{
-			"http", "csrf_token name type url headers timeout max_retries",
-			map[string]string{"url": publicTargetURL},
-		},
-		{
-			"slack", "csrf_token name type url max_retries",
-			map[string]string{"url": publicTargetURL},
-		},
-		{
-			"database", "csrf_token name type expiry",
-			map[string]string{"expiry": "720h"},
-		},
-		{"log", "csrf_token name type", nil},
-	}
-
-	for _, tt := range targetTypes {
-		checkAddTarget(
-			ctx, t, page, tt.name, strings.Fields(tt.fields), tt.values,
-		)
-	}
-
-	checkRefusedTarget(ctx, t, page)
-	checkTargetDeliveries(ctx, t, page, target.Name,
-		"0 in total, 0 in the last 24 hours",
-		"1 in total, 1 in the last 24 hours")
-	checkCopy(ctx, t, page)
-	checkEntrypointEdit(ctx, t, page, page+"/events")
-	checkRecentEvents(ctx, t, page)
-	checkArchiveChoice(ctx, t, srv.URL+"/hooks/new", page)
-	checkNewWebhookTargets(ctx, t, env, srv.URL+"/hooks/new")
-	checkRefusedNewWebhook(ctx, t, srv.URL+"/hooks/new")
-	checkEventLog(ctx, t, page+"/events", event.ID, older.ID, target.Name)
-	checkMobileMenu(ctx, t, page)
-
-	assert.Empty(t, problems(), "the browser reported problems")
+	return webhook, event, target
 }
 
 // startBrowser starts a headless browser for one test. It returns the
@@ -318,6 +300,40 @@ const (
 		document.querySelector('form[action$="/targets"]')).keys()]`
 )
 
+// checkAddEachTargetType runs checkAddTarget on a webhook page for each
+// target type, in page order.
+func checkAddEachTargetType(ctx context.Context, t *testing.T, url string) {
+	t.Helper()
+
+	// Each target type, with the fields its add target form submits, in
+	// page order. Only http and slack have a url field.
+	targetTypes := []struct {
+		name   string
+		fields string
+		values map[string]string
+	}{
+		{
+			"http", "csrf_token name type url headers timeout max_retries",
+			map[string]string{"url": publicTargetURL},
+		},
+		{
+			"slack", "csrf_token name type url max_retries",
+			map[string]string{"url": publicTargetURL},
+		},
+		{
+			"database", "csrf_token name type expiry",
+			map[string]string{"expiry": "720h"},
+		},
+		{"log", "csrf_token name type", nil},
+	}
+
+	for _, tt := range targetTypes {
+		checkAddTarget(
+			ctx, t, url, tt.name, strings.Fields(tt.fields), tt.values,
+		)
+	}
+}
+
 // checkAddTarget loads a webhook page and walks the add target form for
 // one target type. The form shows nothing until Add is clicked; Add
 // shows only the type choice; Cancel there closes it; Next shows the
@@ -406,6 +422,43 @@ func chooseTargetType(ctx context.Context, t *testing.T, targetType string) {
 		"%s: Add still shows while the form is open", targetType)
 }
 
+// checkArchiveExpiry loads a webhook page and checks that the add
+// target form's archive expiry starts on never, that the database
+// target checkAddTarget added with 720h is listed as 30 days, and that
+// its edit form starts on 720h.
+func checkArchiveExpiry(ctx context.Context, t *testing.T, url string) {
+	t.Helper()
+
+	const expiry = `form[action$="/targets"] select[name="expiry"]`
+
+	row := `//span[text()="added-database"]/ancestor::div[@class="p-4"][1]`
+
+	require.NoError(t, chromedp.Run(ctx, loadPage(url)))
+
+	chooseTargetType(ctx, t, "database")
+
+	var start, edited string
+
+	require.NoError(t, chromedp.Run(
+		ctx, chromedp.Value(expiry, &start, chromedp.ByQuery),
+	))
+	assert.Equal(t, "never", start,
+		"the add target form's archive expiry does not start on never")
+
+	assert.True(t, shown(ctx, row+`//span[text()="Archive Expiry:"]`+
+		`/following-sibling::span[text()="30 days"]`),
+		"a database target added with 720h is not listed as 30 days")
+
+	click(ctx, t, row+`//a[text()="Edit"]`)
+	require.NoError(t, chromedp.Run(
+		ctx,
+		chromedp.WaitReady("#expiry", chromedp.ByQuery),
+		chromedp.Value("#expiry", &edited, chromedp.ByQuery),
+	))
+	assert.Equal(t, "720h", edited,
+		"the edit form does not start on the stored archive expiry")
+}
+
 // checkRefusedTarget submits an http target the server refuses, a
 // loopback destination, and checks that the page comes back with the
 // form open on the http fields, the values entered and the reason, and
@@ -489,6 +542,64 @@ func checkTargetDeliveries(
 		"the row of %s does not show %q failed", name, failed)
 }
 
+// checkRefusedEdits fills in the target edit page and the webhook edit
+// page of a webhook page with values the server refuses, a loopback
+// destination and a retention above the longest finite one, which the
+// browser lets through. It saves each and checks that the page comes
+// back with the reason and every value still in its field. The values
+// are keyed by the id of their field.
+func checkRefusedEdits(
+	ctx context.Context, t *testing.T, page, targetID string,
+) {
+	t.Helper()
+
+	const reason = `//div[@class="alert-error"]`
+
+	edits := []struct {
+		url    string
+		values map[string]string
+	}{
+		{page + "/targets/" + targetID + "/edit", map[string]string{
+			"#name":        "edited-target",
+			"#url":         "http://127.0.0.1/hook",
+			"#headers":     "X-Edited: kept",
+			"#timeout":     "12",
+			"#max_retries": "3",
+		}},
+		{page + "/edit", map[string]string{
+			"#name":           "edited-webhook",
+			"#description":    "kept description",
+			"#retention_days": "200000",
+		}},
+	}
+
+	for _, edit := range edits {
+		require.NoError(t, chromedp.Run(ctx, loadPage(edit.url)))
+
+		for field, value := range edit.values {
+			require.NoError(t, chromedp.Run(
+				ctx, chromedp.SetValue(field, value, chromedp.ByQuery),
+			))
+		}
+
+		click(ctx, t, `//button[text()="Save Changes"]`)
+
+		assert.Truef(t, shown(ctx, reason),
+			"%s: a refused save does not show the reason", edit.url)
+
+		for field, value := range edit.values {
+			var kept string
+
+			require.NoError(t, chromedp.Run(
+				ctx, chromedp.Value(field, &kept, chromedp.ByQuery),
+			))
+			assert.Equalf(t, value, kept,
+				"%s: a refused save does not keep the %s entered",
+				edit.url, field)
+		}
+	}
+}
+
 // checkCopy loads a webhook page and checks that the Copy control beside
 // its entrypoint's URL is a button, and that clicking it copies the URL
 // and says so: the button reads "Copied" only once the copy succeeded.
@@ -641,30 +752,18 @@ func checkRecentEvents(ctx context.Context, t *testing.T, url string) {
 		"the event's own page does not show its body")
 }
 
-// checkEventLog loads the event log and checks an event's row. Clicking
-// its ID expands the event, and in there clicking its delivery shows the
-// delivery's attempts and clicking again hides them. Clicking the row's
-// caret collapses the event, clicking it again expands it, and clicking
-// the ID again collapses it. While the event is expanded the row says so
-// and its caret is turned up, and while it is collapsed neither. It then
-// runs checkEventSelection on the log's last event, lastEventID, and
-// checkEventKeyboard on eventID.
+// checkEventLog loads the event log and checks that clicking an event's
+// row expands it, that in there clicking its delivery shows the
+// delivery's attempts and clicking again hides them, and that clicking
+// the event's row again collapses it.
 func checkEventLog(
-	ctx context.Context,
-	t *testing.T,
-	url, eventID, lastEventID, targetName string,
+	ctx context.Context, t *testing.T, url, eventID, targetName string,
 ) {
 	t.Helper()
 
-	// The event's row shows its ID and ends with its caret, which turns
-	// up with Tailwind's rotate-180 class, and its Resubmit form is in
-	// the part that expands. The delivery's row there shows the target's
-	// name.
-	id := `//span[text()="` + eventID + `"]`
-	row := id + `/ancestor::div[@role="button"]`
-	caret := row + `//*[local-name()="svg"]`
-	caretUp := caret + `[contains(@class, "rotate-180")]`
-	caretDown := caret + `[not(contains(@class, "rotate-180"))]`
+	// The event's row shows its ID, and its Resubmit form is in the part
+	// that expands. The delivery's row there shows the target's name.
+	eventRow := `//span[text()="` + eventID + `"]`
 	expanded := `form[action$="/` + eventID + `/resubmit"]`
 	deliveryRow := `//span[text()="` + targetName + `"]`
 	attempt := `//span[text()="Attempt 1"]`
@@ -673,13 +772,8 @@ func checkEventLog(
 
 	assert.True(t, hidden(ctx, expanded), "the event starts expanded")
 
-	click(ctx, t, id)
-	assert.True(t, shown(ctx, expanded),
-		"clicking the event's ID does not expand it")
-	assert.True(t, shown(ctx, row+`[@aria-expanded="true"]`),
-		"the expanded event's row does not say it is expanded")
-	assert.True(t, shown(ctx, caretUp),
-		"the expanded event's caret does not turn up")
+	click(ctx, t, eventRow)
+	assert.True(t, shown(ctx, expanded), "clicking the event does not expand it")
 
 	assert.True(t, hidden(ctx, attempt), "the delivery's attempts start shown")
 
@@ -691,169 +785,9 @@ func checkEventLog(
 	assert.True(t, hidden(ctx, attempt),
 		"clicking the delivery again does not hide its attempts")
 
-	click(ctx, t, caret)
+	click(ctx, t, eventRow)
 	assert.True(t, hidden(ctx, expanded),
-		"clicking the caret does not collapse the event")
-	assert.True(t, shown(ctx, row+`[@aria-expanded="false"]`),
-		"the collapsed event's row does not say it is collapsed")
-	assert.True(t, shown(ctx, caretDown),
-		"the collapsed event's caret stays turned up")
-
-	click(ctx, t, caret)
-	assert.True(t, shown(ctx, expanded),
-		"clicking the caret again does not expand the event")
-
-	click(ctx, t, id)
-	assert.True(t, hidden(ctx, expanded),
-		"clicking the event's ID again does not collapse it")
-
-	checkEventSelection(ctx, t, url, lastEventID)
-	checkEventKeyboard(ctx, t, url, eventID)
-}
-
-// checkEventSelection loads the event log in a short window and checks
-// that selecting the ID of its last event, eventID, with the mouse leaves
-// the event as it was: dragging over the ID leaves it collapsed, the
-// caret's next click still expands it, and with the page then scrolled to
-// its end, a triple-click on the ID leaves it expanded and selects that
-// ID. Had the triple-click's first click collapsed the event, the page
-// would have got shorter and moved under the pointer.
-func checkEventSelection(
-	ctx context.Context, t *testing.T, url, eventID string,
-) {
-	t.Helper()
-
-	id := `//span[text()="` + eventID + `"]`
-	row := id + `/ancestor::div[@role="button"]`
-	caret := row + `//*[local-name()="svg"]`
-	expanded := `form[action$="/` + eventID + `/resubmit"]`
-
-	var (
-		selected, state string
-		hasState        bool
-		scrolled        float64
-	)
-
-	// A single click toggles the event half a second later, so this waits
-	// a second before reading the selection and whether it is expanded.
-	read := chromedp.Tasks{
-		chromedp.Sleep(time.Second),
-		chromedp.Evaluate(`window.getSelection().toString()`, &selected),
-		chromedp.AttributeValue(
-			row, "aria-expanded", &state, &hasState, chromedp.BySearch,
-		),
-	}
-
-	require.NoError(t, chromedp.Run(
-		ctx, chromedp.EmulateViewport(shortWidth, shortHeight), loadPage(url),
-	))
-
-	selectText(ctx, t, id)
-	require.NoError(t, chromedp.Run(ctx, read))
-	assert.Equal(t, eventID, selected, "the event's ID cannot be selected")
-	require.True(t, hasState, "the event's row does not say if it is expanded")
-	assert.Equal(t, "false", state, "selecting the event's ID expands it")
-
-	// The caret's click also clears the selection, so the triple-click's
-	// first click finds nothing selected, as a person's would.
-	click(ctx, t, caret)
-	assert.True(t, shown(ctx, expanded),
-		"clicking the caret after selecting the ID does not expand the event")
-
-	require.NoError(t, chromedp.Run(ctx, chromedp.Evaluate(
-		`window.scrollTo(0, document.body.scrollHeight); window.scrollY`,
-		&scrolled,
-	)))
-	require.Positive(t, scrolled, "the event log does not scroll")
-
-	tripleClick(ctx, t, id)
-	require.NoError(t, chromedp.Run(ctx, read))
-	assert.Contains(t, selected, eventID,
-		"a triple-click does not select the event's ID")
-	assert.Equal(t, "true", state,
-		"a triple-click selecting the event's ID collapses it")
-}
-
-// checkEventKeyboard loads the event log and checks that Tab from the
-// page's Back link reaches the event's row, the first after it, and that
-// Enter then expands the event and Space collapses it.
-func checkEventKeyboard(
-	ctx context.Context, t *testing.T, url, eventID string,
-) {
-	t.Helper()
-
-	back := `//a[contains(text(), "Back to")]`
-	expanded := `form[action$="/` + eventID + `/resubmit"]`
-
-	var focused string
-
-	require.NoError(t, chromedp.Run(
-		ctx,
-		loadPage(url),
-		chromedp.Focus(back, chromedp.BySearch),
-		chromedp.KeyEvent(kb.Tab),
-		chromedp.Evaluate(`document.activeElement.textContent`, &focused),
-	))
-	require.Contains(t, focused, eventID,
-		"Tab from the Back link does not reach the event's row")
-
-	require.NoError(t, chromedp.Run(ctx, chromedp.KeyEvent(kb.Enter)))
-	assert.True(t, shown(ctx, expanded), "Enter does not expand the event")
-
-	require.NoError(t, chromedp.Run(ctx, chromedp.KeyEvent(" ")))
-	assert.True(t, hidden(ctx, expanded), "Space does not collapse the event")
-}
-
-// selectText selects the text of the element matching an XPath
-// expression as a person does with the mouse: pressing the button at the
-// text's start, moving to its end and releasing it there.
-func selectText(ctx context.Context, t *testing.T, xpath string) {
-	t.Helper()
-
-	var box *dom.BoxModel
-
-	require.NoError(t, chromedp.Run(
-		ctx, chromedp.Dimensions(xpath, &box, chromedp.BySearch),
-	))
-
-	// The content box's corners, clockwise from its top left.
-	left, right := box.Content[0]+1, box.Content[2]-1
-	middle := (box.Content[1] + box.Content[5]) / 2
-
-	require.NoError(t, chromedp.Run(
-		ctx,
-		input.DispatchMouseEvent(input.MousePressed, left, middle).
-			WithButton(input.Left).WithButtons(1).WithClickCount(1),
-		input.DispatchMouseEvent(input.MouseMoved, right, middle).
-			WithButton(input.Left).WithButtons(1),
-		input.DispatchMouseEvent(input.MouseReleased, right, middle).
-			WithButton(input.Left).WithClickCount(1),
-	))
-}
-
-// tripleClick clicks three times in a row in the middle of the element
-// matching an XPath expression, as a person does to select a whole line
-// of text. The browser selects a word on the second click and the whole
-// paragraph on the third.
-func tripleClick(ctx context.Context, t *testing.T, xpath string) {
-	t.Helper()
-
-	var box *dom.BoxModel
-
-	require.NoError(t, chromedp.Run(
-		ctx, chromedp.Dimensions(xpath, &box, chromedp.BySearch),
-	))
-
-	// The content box's corners, clockwise from its top left.
-	x := (box.Content[0] + box.Content[2]) / 2
-	y := (box.Content[1] + box.Content[5]) / 2
-
-	require.NoError(t, chromedp.Run(
-		ctx,
-		chromedp.MouseClickXY(x, y, chromedp.ClickCount(1)),
-		chromedp.MouseClickXY(x, y, chromedp.ClickCount(2)),
-		chromedp.MouseClickXY(x, y, chromedp.ClickCount(3)),
-	))
+		"clicking the event again does not collapse it")
 }
 
 // The parts of the new webhook page the checks below find and click.

static/js/app.js

@@ -77,26 +77,12 @@ document.addEventListener("alpine:init", function () {
     window.Alpine.data("collapsible", function () {
         return {
             open: false,
-            // The timer of the toggle a single click is waiting to make.
-            pendingToggle: null,
             init() {
                 this.open = this.$root.hasAttribute("data-open");
             },
             toggle() {
                 this.open = !this.open;
             },
-            // Toggles on a click, except one that selects text, such as
-            // selecting an event's ID to copy it. A single click toggles
-            // only after 500 ms, the usual double-click interval, and the
-            // second click of a double- or triple-click cancels that, so
-            // nothing moves under the pointer while it selects text.
-            toggleUnlessSelecting(event) {
-                if (event.detail > 1) {
-                    clearTimeout(this.pendingToggle);
-                } else if (window.getSelection().toString() === "") {
-                    this.pendingToggle = setTimeout(() => this.toggle(), 500);
-                }
-            },
             get closed() {
                 return !this.open;
             },

templates/source_detail.html

@@ -203,8 +203,15 @@
                     <template x-if="isDatabase">
                         <div>
                             <input type="hidden" name="type" value="database">
-                            <input type="text" name="expiry" :value="expiry" placeholder="never" class="input text-sm">
-                            <p class="text-xs text-gray-500 mt-1">Archive expiry: "never" (default) keeps rows forever, or a duration like "720h" prunes older rows.</p>
+                            <div class="flex gap-2 items-center">
+                                <label class="text-sm text-gray-700">Archive expiry:</label>
+                                <select name="expiry" :value="expiry" class="input text-sm w-24">
+                                    {{range .ArchiveExpiryChoices}}
+                                    <option value="{{.Value}}">{{.Label}}</option>
+                                    {{end}}
+                                </select>
+                            </div>
+                            <p class="text-xs text-gray-500 mt-1">Archived events older than this are deleted from the archive; never keeps them all.</p>
                         </div>
                     </template>
                     <template x-if="isLog">

templates/source_edit.html

@@ -18,17 +18,17 @@
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
                 <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" value="{{.Webhook.Name}}" required class="input">
+                <input type="text" id="name" name="name" value="{{.Name}}" required class="input">
             </div>
 
             <div class="form-group">
                 <label for="description" class="label">Description</label>
-                <textarea id="description" name="description" rows="3" class="input">{{.Webhook.Description}}</textarea>
+                <textarea id="description" name="description" rows="3" class="input">{{.Description}}</textarea>
             </div>
 
             <div class="form-group">
                 <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="0" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="{{.RetentionDays}}" min="0" class="input">
                 <p class="text-xs text-gray-500 mt-1">Currently {{.Webhook.RetentionLabel}}.{{if .Webhook.RetainsForever}} No events are deleted while retention is set to forever.{{else}} A periodic cleanup permanently deletes events older than this, along with their delivery records.{{end}} Enter 0 to retain events forever; leave blank to keep the current setting.</p>
             </div>
 

templates/source_logs.html

@@ -16,8 +16,7 @@
         <div class="divide-y divide-gray-100">
             {{range .Events}}
             <div class="p-4" x-data="collapsible">
-                <!-- Not a button element: browsers do not let a button's text be selected, and an event's ID must be. -->
-                <div role="button" tabindex="0" class="btn-small w-full flex flex-wrap justify-between gap-2" :aria-expanded="open" @click="toggleUnlessSelecting" @keydown.enter.prevent="toggle" @keydown.space.prevent="toggle">
+                <button type="button" class="btn-small w-full flex flex-wrap justify-between gap-2 text-left" @click="toggle">
                     <span class="flex flex-wrap items-center gap-3">
                         <span class="badge-info">{{.Method}}</span>
                         <span class="text-sm font-mono text-gray-700">{{.ID}}</span>
@@ -40,7 +39,7 @@
                             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
                         </svg>
                     </span>
-                </div>
+                </button>
 
                 <div x-show="open" x-cloak class="mt-3 p-3 bg-gray-50 rounded-md">
                     <div class="mb-3 flex flex-wrap items-center justify-between gap-2">

templates/sources_new.html

@@ -50,13 +50,9 @@
                 <div x-show="open" x-cloak class="mt-3">
                     <label for="archive_expiry" class="label">Archive pruning</label>
                     <select id="archive_expiry" name="archive_expiry" class="input">
-                        <option value="never"{{if eq .Form.ArchiveExpiry "never"}} selected{{end}}>never</option>
-                        <option value="1h"{{if eq .Form.ArchiveExpiry "1h"}} selected{{end}}>1h</option>
-                        <option value="12h"{{if eq .Form.ArchiveExpiry "12h"}} selected{{end}}>12h</option>
-                        <option value="24h"{{if eq .Form.ArchiveExpiry "24h"}} selected{{end}}>24h</option>
-                        <option value="720h"{{if eq .Form.ArchiveExpiry "720h"}} selected{{end}}>30d</option>
-                        <option value="2160h"{{if eq .Form.ArchiveExpiry "2160h"}} selected{{end}}>90d</option>
-                        <option value="8760h"{{if eq .Form.ArchiveExpiry "8760h"}} selected{{end}}>365d</option>
+                        {{range .ArchiveExpiryChoices}}
+                        <option value="{{.Value}}"{{if .Selected}} selected{{end}}>{{.Label}}</option>
+                        {{end}}
                     </select>
                     <p class="text-xs text-gray-500 mt-1">Archived events older than this are deleted from the archive; never keeps them all.</p>
                 </div>

templates/target_edit.html

@@ -17,7 +17,7 @@
 
         {{if or (eq .Target.Type "http") (eq .Target.Type "slack")}}
         <div class="mb-6 rounded-md bg-gray-50 p-4 text-sm text-gray-700">
-            This form shows the target's stored destination in full, including any credential carried in its URL or headers. It is the only page that does; everywhere else the value is masked.
+            This form shows the target's destination in full, including any credential carried in its URL or headers. It is the only page that does; everywhere else the value is masked.
         </div>
         {{end}}
 
@@ -26,25 +26,25 @@
 
             <div class="form-group">
                 <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" value="{{.Target.Name}}" required class="input">
+                <input type="text" id="name" name="name" value="{{.TargetForm.Name}}" required class="input">
             </div>
 
             {{if eq .Target.Type "http"}}
             <div class="form-group">
                 <label for="url" class="label">Destination URL</label>
-                <input type="url" id="url" name="url" value="{{.Target.Config.URL}}" required class="input">
+                <input type="url" id="url" name="url" value="{{.TargetForm.URL}}" required class="input">
                 <p class="text-xs text-gray-500 mt-1">Revalidated on save; destinations that resolve to private or link-local addresses are rejected.</p>
             </div>
 
             <div class="form-group">
                 <label for="headers" class="label">Headers</label>
-                <textarea id="headers" name="headers" rows="4" class="input" placeholder="Authorization: Bearer ...">{{.Target.Config.Headers}}</textarea>
+                <textarea id="headers" name="headers" rows="4" class="input" placeholder="Authorization: Bearer ...">{{.TargetForm.Headers}}</textarea>
                 <p class="text-xs text-gray-500 mt-1">One <code>Name: value</code> per line, sent with every delivery. Leave blank for none. <code>Host</code>, <code>Content-Length</code>, <code>Transfer-Encoding</code>, <code>Connection</code>, <code>Trailer</code> and <code>User-Agent</code> are set by the delivery engine and are rejected here rather than silently ignored. Headers set here are dropped if a redirect leaves the destination's own origin, so a credential cannot follow one to another host.</p>
             </div>
 
             <div class="form-group">
                 <label for="timeout" class="label">Timeout (seconds)</label>
-                <input type="number" id="timeout" name="timeout" value="{{.Target.Config.Timeout}}" min="0" max="{{.MaxTimeout}}" class="input">
+                <input type="number" id="timeout" name="timeout" value="{{.TargetForm.Timeout}}" min="0" max="{{.MaxTimeout}}" class="input">
                 <p class="text-xs text-gray-500 mt-1">Per-request timeout, at most {{.MaxTimeout}} seconds. Leave blank to use the default.</p>
             </div>
             {{end}}
@@ -52,7 +52,7 @@
             {{if eq .Target.Type "slack"}}
             <div class="form-group">
                 <label for="url" class="label">Webhook URL</label>
-                <input type="url" id="url" name="url" value="{{.Target.Config.URL}}" required class="input">
+                <input type="url" id="url" name="url" value="{{.TargetForm.URL}}" required class="input">
                 <p class="text-xs text-gray-500 mt-1">Slack or Mattermost incoming webhook URL. Revalidated on save.</p>
             </div>
             {{end}}
@@ -60,15 +60,19 @@
             {{if eq .Target.Type "database"}}
             <div class="form-group">
                 <label for="expiry" class="label">Archive Expiry</label>
-                <input type="text" id="expiry" name="expiry" value="{{.Target.Config.Expiry}}" placeholder="never" class="input">
-                <p class="text-xs text-gray-500 mt-1">"never" (the default when blank) keeps archived rows forever, or a Go duration like "720h" prunes older rows.</p>
+                <select id="expiry" name="expiry" class="input">
+                    {{range .ArchiveExpiryChoices}}
+                    <option value="{{.Value}}"{{if .Selected}} selected{{end}}>{{.Label}}</option>
+                    {{end}}
+                </select>
+                <p class="text-xs text-gray-500 mt-1">Archived events older than this are deleted from the archive; never keeps them all.</p>
             </div>
             {{end}}
 
             {{if or (eq .Target.Type "http") (eq .Target.Type "slack")}}
             <div class="form-group">
                 <label for="max_retries" class="label">Max retries</label>
-                <input type="number" id="max_retries" name="max_retries" value="{{.Target.MaxRetries}}" min="0" max="20" class="input">
+                <input type="number" id="max_retries" name="max_retries" value="{{.TargetForm.MaxRetries}}" min="0" max="20" class="input">
                 <p class="text-xs text-gray-500 mt-1">This is the total number of delivery attempts, not retries on top of the first: a value of 3 makes three attempts in all. 0 means a single attempt with no retries and no circuit breaker.</p>
             </div>
             {{end}}