Serve /metrics from a registry of its own (closes #227)

The HTTP metrics recorder, the delivery collectors and the Go and
process collectors now register on one prometheus.Registry that fx
provides, instead of Prometheus's global default registry, and
/metrics serves that registry. A second metrics-enabled router in one
process, or the server tests run with -count=2, no longer panics on a
duplicate registration.

The middleware builds its recorder once, in New, so installing
Metrics() on more than one router over the same graph is also safe;
NewForTest gives its Middleware a recorder on a fresh registry. The
scrape keeps the same series and labels, including go_*, process_*
and promhttp_metric_handler_*.

Model: opus-5-5

README.md

@@ -7,7 +7,7 @@ services, durably stores them, and delivers them to configured targets
 with retry support, logging, and observability. Category: infrastructure
 / web service. License: MIT.
 
-Each entrypoint is a version 4 UUID served at `/h/{uuid}`, and
+Each entrypoint is a version 4 UUID served at `/webhook/{uuid}`, and
 that UUID is the entrypoint's only credential. webhooker does not use
 shared secrets, HMAC signatures or token headers on the receiver, and
 will not add them — read
@@ -1178,7 +1178,7 @@ backups at rest and restrict who can read them.
 
 **The entrypoint UUID is the credential, and it is the only one.**
 webhooker mints a version 4 UUID per entrypoint and serves it at
-`/h/{uuid}`. Possession of that URL is the authentication:
+`/webhook/{uuid}`. Possession of that URL is the authentication:
 anyone who holds it can submit events to the entrypoint, and the
 receiver verifies nothing else about the sender.
 
@@ -1512,7 +1512,7 @@ the full request and creates an Event.
 | -------------- | ------- | ----------- |
 | `id`           | UUID    | Primary key |
 | `webhook_id`   | UUID    | Foreign key → Webhook |
-| `path`         | string  | Unique bare UUID, generated at creation. The `/h/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) |
+| `path`         | string  | Unique bare UUID, generated at creation. The `/webhook/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) |
 | `description`  | string  | Optional description |
 | `active`       | boolean | Whether this entrypoint accepts events (default: true) |
 
@@ -1893,7 +1893,7 @@ runtime, though CGO is required at build time due to the transitive
 ```
 External Service
        │
-       │  POST /h/{uuid}
+       │  POST /webhook/{uuid}
        ▼
 ┌─────────────┐     ┌──────────────┐     ┌──────────────┐
 │  chi Router │────►│  Middleware   │────►│   Webhook    │
@@ -2119,7 +2119,7 @@ The middleware records three more on the same registry:
 Two of those labels are written once per request from bytes the client
 chose, so both are bounded to something this service registers:
 
-- `handler` is the chi route pattern — `/h/{uuid}`, never the
+- `handler` is the chi route pattern — `/webhook/{uuid}`, never the
   concrete path. A request matching no route carries `(unmatched)`,
   and no entrypoint UUID ever reaches a label.
 - `method` is the request method when the router can route it, and
@@ -2149,7 +2149,7 @@ unpredictable rates, and blanket limits shared with other routes would
 cause legitimate deliveries to be dropped.
 
 The receiver instead has its own dedicated abuse limit, scoped to the
-`/h/{uuid}` route only and keyed per client IP per request path
+`/webhook/{uuid}` route only and keyed per client IP per request path
 (`httprate.KeyByEndpoint`): one misbehaving sender is throttled without
 affecting other senders of the same entrypoint or the same sender's
 other entrypoints. Keying on the path rather than on the entrypoint
@@ -2186,7 +2186,7 @@ log spends. The access log is bounded by neither limit: every request
 is recorded once at `INFO`, served or rejected alike.
 
 What the access log does bound is the _content_ of those lines. A 3xx
-or 4xx response logs the chi route pattern — `/h/{uuid}`,
+or 4xx response logs the chi route pattern — `/webhook/{uuid}`,
 `/user/{username}//`, or the literal `(unmatched)` when the request hit
 no route at all — in place of the concrete URL. Those are the outcomes
 an unauthenticated client can drive for free: 404 and 429 on any
@@ -2220,12 +2220,12 @@ reduces the headers to a fixed allowlist — `Accept`, `Content-Length`,
 
 The same hook rewrites the request URL. The SDK builds it as
 `scheme://host/path` from the concrete path, which on the receiver
-route is `/h/<uuid>` in full — and that UUID is a write
+route is `/webhook/<uuid>` in full — and that UUID is a write
 capability, not an identifier: anyone holding it can post events this
 service accepts and its targets then deliver. A tracker has its own
 retention, access control and deletion policy, so the rule the access
 log follows above does not carry across that boundary. What is sent is
-the chi route pattern instead: `http://host/h/{uuid}`.
+the chi route pattern instead: `http://host/webhook/{uuid}`.
 
 The scheme and the host are kept, and everything else in the URL is
 discarded rather than edited, so a future SDK version that starts
@@ -2269,8 +2269,8 @@ fallback is never the concrete path. The path becomes the literal
 rewrite cannot parse into a scheme is withheld whole. A transaction
 event additionally carries the SDK's own `METHOD /path` name, built
 from the concrete path as well; it is rewritten on the same terms, to
-`POST /h/{uuid}` where the pattern is known and `POST /(redacted)`
-where it is not.
+`POST /webhook/{uuid}` where the pattern is known and `POST
+/(redacted)` where it is not.
 
 The headers are an allowlist for the same reason the rules above are
 unconditional: the SDK's own filter removes four names and passes
@@ -2405,7 +2405,7 @@ logger printed the fully interpolated SQL — parameters and all — to
 standard output on every statement that returned an error, including a
 plain record-not-found, at a level no operator setting reached. Two of
 this service's lookups miss by design on unauthenticated routes: the
-entrypoint lookup behind `/h/{uuid}` and the user lookup behind
+entrypoint lookup behind `/webhook/{uuid}` and the user lookup behind
 the login form, whose path segment and submitted username the client
 picks outright. Every
 `gorm.Open` in the service now installs the adapter in
@@ -2683,10 +2683,10 @@ abuse limit later; they are tracked as future work.
 
 | Method | Path                        | Description |
 | ------ | --------------------------- | ----------- |
-| `GET`  | `/`                         | Root redirect, 303 (authenticated → `/hooks`, unauthenticated → `/pages/login`) |
+| `GET`  | `/`                         | Root redirect, 303 (authenticated → `/sources`, unauthenticated → `/pages/login`) |
 | `GET`  | `/.well-known/healthcheck`  | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) |
 | `GET`, `HEAD` | `/s/*`              | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` |
-| `POST` | `/h/{uuid}`                 | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |
+| `POST` | `/webhook/{uuid}`           | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |
 
 #### Authentication Endpoints
 
@@ -2702,25 +2702,25 @@ abuse limit later; they are tracked as future work.
 | ------ | ------------------------ | ----------- |
 | `GET`  | `/user/{username}`       | User profile page |
 | `POST` | `/user/{username}/password` | Change the user's password (5 per minute per bucket, then `429`; `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one) |
-| `GET`  | `/hooks`                 | List user's webhooks |
-| `GET`  | `/hooks/new`             | Create webhook form |
-| `POST` | `/hooks/new`             | Create webhook submission |
-| `GET`  | `/hook/{id}`             | Webhook detail view |
-| `GET`  | `/hook/{id}/edit`        | Edit webhook form |
-| `POST` | `/hook/{id}/edit`        | Edit webhook submission |
-| `POST` | `/hook/{id}/delete`      | Delete webhook |
-| `GET`  | `/hook/{id}/events`      | Full Event Log |
-| `GET`  | `/hook/{id}/events/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
-| `POST` | `/hook/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
-| `POST` | `/hook/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
-| `POST` | `/hook/{id}/entrypoints` | Add entrypoint to webhook |
-| `POST` | `/hook/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
-| `POST` | `/hook/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
-| `POST` | `/hook/{id}/targets`     | Add target to webhook |
-| `GET`  | `/hook/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
-| `POST` | `/hook/{id}/targets/{targetID}/edit` | Edit target submission |
-| `POST` | `/hook/{id}/targets/{targetID}/delete` | Delete a target |
-| `POST` | `/hook/{id}/targets/{targetID}/toggle` | Enable or disable a target |
+| `GET`  | `/sources`               | List user's webhooks |
+| `GET`  | `/sources/new`           | Create webhook form |
+| `POST` | `/sources/new`           | Create webhook submission |
+| `GET`  | `/source/{id}`           | Webhook detail view |
+| `GET`  | `/source/{id}/edit`      | Edit webhook form |
+| `POST` | `/source/{id}/edit`      | Edit webhook submission |
+| `POST` | `/source/{id}/delete`    | Delete webhook |
+| `GET`  | `/source/{id}/logs`      | Webhook event logs |
+| `GET`  | `/source/{id}/logs/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
+| `POST` | `/source/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
+| `POST` | `/source/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
+| `POST` | `/source/{id}/entrypoints` | Add entrypoint to webhook |
+| `POST` | `/source/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
+| `POST` | `/source/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
+| `POST` | `/source/{id}/targets`   | Add target to webhook |
+| `GET`  | `/source/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
+| `POST` | `/source/{id}/targets/{targetID}/edit` | Edit target submission |
+| `POST` | `/source/{id}/targets/{targetID}/delete` | Delete a target |
+| `POST` | `/source/{id}/targets/{targetID}/toggle` | Enable or disable a target |
 
 #### Infrastructure Endpoints
 
@@ -2921,8 +2921,8 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.
 
-Additionally, form endpoints (`/pages`, `/user/*`, `/hooks`,
-`/hook/*`) apply a **MaxBodySize** middleware that limits
+Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
+`/source/*`) apply a **MaxBodySize** middleware that limits
 POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the
 CSRF middleware in every one of those route groups, because
 gorilla/csrf parses the form; if the cap were installed after it, form
@@ -2946,7 +2946,7 @@ Those same four route groups then apply **CSRF** and **NoCache**
 `/pages` applies **RequireAuth**. The rate limiters are per-route
 rather than global: **PasswordChangeRateLimit** on
 `/user/{username}/password` and **ReceiverRateLimit** on
-`/h/{uuid}`. There is deliberately none on `/pages/login` — that
+`/webhook/{uuid}`. There is deliberately none on `/pages/login` — that
 endpoint counts failures inside the handler, after the credential
 check, see [The login endpoint](#the-login-endpoint).
 
@@ -2987,8 +2987,8 @@ check, see [The login endpoint](#the-login-endpoint).
   by middleware that runs before CSRF parses the form
 - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf)
   on all state-changing forms (cookie-based double-submit tokens with
-  HMAC authentication). Applied to `/pages`, `/hooks`, `/hook`, and
-  `/user` routes. Excluded from `/h` (inbound webhook POSTs) and
+  HMAC authentication). Applied to `/pages`, `/sources`, `/source`, and
+  `/user` routes. Excluded from `/webhook` (inbound webhook POSTs) and
   `/api` (stateless API). The middleware detects TLS per-request through
   `internal/reqtls.IsTLS` — the same predicate the session cookie uses —
   to set appropriate cookie security flags and Origin/Referer validation

cmd/webhooker/main.go

@@ -16,6 +16,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/resetpw"
 	"sneak.berlin/go/webhooker/internal/server"
@@ -177,6 +178,10 @@ func newApp() *fx.App {
 			healthcheck.New,
 			session.New,
 			handlers.New,
+			// The registry /metrics serves, and the delivery
+			// collectors registered on it.
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			// The one SSRF guard both target-creation validation
 			// and the delivery dialer consult, so they cannot

internal/delivery/engine.go

@@ -148,6 +148,7 @@ type EngineParams struct {
 	DBManager *database.WebhookDBManager
 	Logger    *logger.Logger
 	SSRFGuard *Guard
+	Metrics   *metrics.Set
 }
 
 // Engine processes queued deliveries in the background
@@ -167,10 +168,10 @@ type Engine struct {
 	retryCh    chan Task
 	workers    int
 
-	// mtr is the delivery metric set. Production wires the
-	// process-wide one; a test can substitute a set registered on
-	// a private registry so its assertions are not disturbed by
-	// deliveries other tests are making at the same time.
+	// mtr is the delivery metric set. Production wires the one
+	// registered on the registry /metrics serves; a test can
+	// substitute a set registered on a registry it holds, so it can
+	// gather what its own deliveries recorded.
 	mtr *metrics.Set
 
 	// targets maps each target type to its implementation.
@@ -204,7 +205,7 @@ func New(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    defaultWorkers,
-		mtr:        metrics.Default(),
+		mtr:        params.Metrics,
 	}
 
 	e.initTargets(&http.Client{

internal/delivery/export_test.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -389,7 +390,7 @@ func NewTestEngine(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -404,7 +405,7 @@ func NewTestEngineSmallRetry(
 	e := &Engine{
 		log:     log,
 		retryCh: make(chan Task, 1),
-		mtr:     metrics.Default(),
+		mtr:     metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(nil)
 
@@ -427,7 +428,7 @@ func NewTestEngineWithDB(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -435,8 +436,7 @@ func NewTestEngineWithDB(
 }
 
 // ExportSetMetrics substitutes the engine's metric set, so a test can
-// assert on collectors registered on a private registry instead of
-// the process-wide ones every other test is also moving.
+// assert on collectors registered on a registry it holds.
 func (e *Engine) ExportSetMetrics(mtr *metrics.Set) {
 	e.mtr = mtr
 }

internal/delivery/metrics_test.go

@@ -35,9 +35,8 @@ const (
 )
 
 // mIsolate gives the setup's engine a metric set registered on a
-// private registry. The process-wide collectors are moved by every
-// other delivery test running in parallel, so exact assertions are
-// only possible against a registry this test owns.
+// registry this test holds, so its exact assertions can gather from
+// it.
 func mIsolate(
 	t *testing.T, s iSetup,
 ) *prometheus.Registry {

internal/gormlog/gormlog.go

@@ -7,7 +7,7 @@
 // SQL — parameters and all — for every statement that returns an
 // error, including gorm.ErrRecordNotFound. Two of this service's
 // lookups miss by design on unauthenticated routes: the entrypoint
-// lookup on /h/{uuid}, whose path segment the client picks
+// lookup on /webhook/{uuid}, whose path segment the client picks
 // outright, and the user lookup behind the login form, whose username
 // the client picks outright. Under the default logger each of those
 // misses printed an unbounded, attacker-chosen string, at no level the

internal/handlers/delivery_replay.go

@@ -362,7 +362,7 @@ func (h *Handlers) finishReplay(
 	webhook database.Webhook,
 	code replayOutcomeCode,
 ) {
-	dest := "/hook/" + webhook.ID + "/events?" +
+	dest := "/source/" + webhook.ID + "/logs?" +
 		replayOutcomeParam + "=" + string(code)
 
 	// The page is read from the form rather than the query string:

internal/handlers/delivery_replay_test.go

@@ -138,7 +138,7 @@ func postReplay(
 	t.Helper()
 
 	req := postRequest(
-		"/hook/"+webhookID+"/deliveries/"+
+		"/source/"+webhookID+"/deliveries/"+
 			deliveryID+"/replay",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
@@ -212,7 +212,7 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=queued",
+		"/source/"+wh.ID+"/logs?replay=queued",
 		w.Header().Get("Location"),
 	)
 
@@ -362,7 +362,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=target-deleted",
+		"/source/"+wh.ID+"/logs?replay=target-deleted",
 		w.Header().Get("Location"),
 	)
 
@@ -390,7 +390,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, missing.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=target-missing",
+		"/source/"+wh.ID+"/logs?replay=target-missing",
 		missing.Header().Get("Location"),
 	)
 }
@@ -431,7 +431,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, first.Code)
 	require.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=queued",
+		"/source/"+wh.ID+"/logs?replay=queued",
 		first.Header().Get("Location"),
 	)
 
@@ -439,7 +439,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, second.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=in-flight",
+		"/source/"+wh.ID+"/logs?replay=in-flight",
 		second.Header().Get("Location"),
 	)
 
@@ -465,7 +465,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, pending.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?replay=not-terminal",
+		"/source/"+wh.ID+"/logs?replay=not-terminal",
 		pending.Header().Get("Location"),
 	)
 }
@@ -501,7 +501,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {
 
 	assert.Contains(
 		t, body,
-		`action="/hook/`+wh.ID+`/deliveries/`+
+		`action="/source/`+wh.ID+`/deliveries/`+
 			original.ID+`/replay"`,
 	)
 	assert.Contains(t, body, `method="POST"`)

internal/handlers/event_body_test.go

@@ -64,8 +64,8 @@ func fetchEventBody(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/hook/"+url.PathEscape(sourceID)+
-			"/events/"+url.PathEscape(eventID)+"/body",
+		"/source/"+url.PathEscape(sourceID)+
+			"/logs/"+url.PathEscape(eventID)+"/body",
 		nil,
 	)
 
@@ -490,7 +490,7 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page := renderSourceLogsPage(t, h, sess, big.ID)
 	assert.Contains(
 		t, page,
-		"/hook/"+big.ID+"/events/"+bigEvt.ID+"/body",
+		"/source/"+big.ID+"/logs/"+bigEvt.ID+"/body",
 	)
 
 	small := seedWebhook(t, db)
@@ -501,6 +501,6 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page = renderSourceLogsPage(t, h, sess, small.ID)
 	assert.NotContains(
 		t, page,
-		"/hook/"+small.ID+"/events/"+smallEvt.ID+"/body",
+		"/source/"+small.ID+"/logs/"+smallEvt.ID+"/body",
 	)
 }

internal/handlers/event_resubmit.go

@@ -257,7 +257,7 @@ func (h *Handlers) finishResubmit(
 	webhook database.Webhook,
 	code resubmitOutcomeCode,
 ) {
-	dest := "/hook/" + webhook.ID + "/events?" +
+	dest := "/source/" + webhook.ID + "/logs?" +
 		resubmitOutcomeParam + "=" + string(code)
 
 	// The page is read from the form rather than the query string:

internal/handlers/event_resubmit_test.go

@@ -65,7 +65,7 @@ func postResubmit(
 	t.Helper()
 
 	req := postRequest(
-		"/hook/"+webhookID+"/events/"+eventID+"/resubmit",
+		"/source/"+webhookID+"/events/"+eventID+"/resubmit",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),
@@ -154,7 +154,7 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=queued",
+		"/source/"+wh.ID+"/logs?resubmit=queued",
 		w.Header().Get("Location"),
 	)
 
@@ -281,7 +281,7 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 		require.Equal(t, http.StatusSeeOther, w.Code)
 		assert.Equal(
 			t,
-			"/hook/"+wh.ID+"/events?resubmit=queued",
+			"/source/"+wh.ID+"/logs?resubmit=queued",
 			w.Header().Get("Location"),
 			"a resubmit must not be refused while an earlier "+
 				"one is in flight",
@@ -435,7 +435,7 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=queued",
+		"/source/"+wh.ID+"/logs?resubmit=queued",
 		w.Header().Get("Location"),
 		"an inactive target is skipped, not an error",
 	)
@@ -481,7 +481,7 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/hook/"+wh.ID+"/events?resubmit=no-targets",
+		"/source/"+wh.ID+"/logs?resubmit=no-targets",
 		w.Header().Get("Location"),
 	)
 
@@ -597,7 +597,7 @@ func TestHandleSourceLogs_ShowsResubmitProvenance(t *testing.T) {
 	)
 	assert.Contains(
 		t, body,
-		"/hook/"+wh.ID+"/events/"+original.ID+"/resubmit",
+		"/source/"+wh.ID+"/events/"+original.ID+"/resubmit",
 		"the log must offer the resubmit action per event",
 	)
 }

internal/handlers/gormlogbound_test.go

@@ -306,7 +306,7 @@ func postWebhook(
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/h/x",
+		context.Background(), http.MethodPost, "/webhook/x",
 		strings.NewReader("{}"),
 	)
 

internal/handlers/handlers.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"sync/atomic"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
@@ -61,6 +62,8 @@ type HandlersParams struct {
 	Notifier     delivery.Notifier
 	Evictor      delivery.WebhookEvictor
 	SSRFGuard    *delivery.Guard
+	Metrics      *metrics.Set
+	Registry     *prometheus.Registry
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -122,7 +125,7 @@ func New(
 	s.mw = params.Middleware
 	s.notifier = params.Notifier
 	s.evictor = params.Evictor
-	s.mtr = metrics.Default()
+	s.mtr = params.Metrics
 	s.ssrf = params.SSRFGuard
 
 	// Parse all page templates once at startup

internal/handlers/handlers_test.go

@@ -20,6 +20,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/session"
 )
@@ -109,6 +110,8 @@ func newTestApp(
 			func(r *recordingEvictor) delivery.WebhookEvictor {
 				return r
 			},
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,
@@ -176,7 +179,7 @@ func TestHandleIndex_Authenticated(t *testing.T) {
 
 	assert.Equal(t, http.StatusSeeOther, w2.Code)
 	assert.Equal(
-		t, "/hooks", w2.Header().Get("Location"),
+		t, "/sources", w2.Header().Get("Location"),
 	)
 }
 

internal/handlers/index.go

@@ -5,13 +5,13 @@ import (
 )
 
 // HandleIndex returns a handler for the root path that redirects
-// based on authentication state: authenticated users go to /hooks
+// based on authentication state: authenticated users go to /sources
 // (the dashboard), unauthenticated users go to the login page.
 func (s *Handlers) HandleIndex() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		sess, err := s.session.Get(r)
 		if err == nil && s.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/hooks", http.StatusSeeOther)
+			http.Redirect(w, r, "/sources", http.StatusSeeOther)
 
 			return
 		}

internal/handlers/logbound_test.go

@@ -4,7 +4,7 @@ package handlers_test
 // this package reach a value an UNAUTHENTICATED client picks outright
 // and of a length it picks outright:
 //
-//   - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
+//   - the unknown-entrypoint DEBUG line on /webhook/{uuid}, whose
 //     path segment matched no stored entrypoint and so is bounded by
 //     nothing;
 //   - the failed-login DEBUG lines, whose username is a form field.
@@ -190,12 +190,12 @@ func assertNoClientText(t *testing.T, buf *bytes.Buffer) {
 // route pattern.
 func receiverRouter(h *handlers.Handlers) *chi.Mux {
 	router := chi.NewRouter()
-	router.Post("/h/{uuid}", h.HandleWebhook())
+	router.Post("/webhook/{uuid}", h.HandleWebhook())
 
 	return router
 }
 
-// postReceiver sends one POST at /h/<segment>.
+// postReceiver sends one POST at /webhook/<segment>.
 //
 // RawPath is cleared after parsing so chi routes on the decoded path
 // and the handler sees the raw bytes rather than their percent-escaped
@@ -210,7 +210,7 @@ func postReceiver(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodPost,
-		"/h/"+url.PathEscape(segment),
+		"/webhook/"+url.PathEscape(segment),
 		strings.NewReader(""),
 	)
 	req.URL.RawPath = ""
@@ -507,7 +507,7 @@ func TestVerificationCapacity_LogLineDoesNotTrackPathSize(
 					http.StatusServiceUnavailable,
 					postLoginAtPath(
 						t, h,
-						"/hook/"+url.PathEscape(
+						"/source/"+url.PathEscape(
 							oversizedFill(fill),
 						)+"/login",
 					),

internal/handlers/metrics.go

@@ -0,0 +1,21 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+// HandleMetrics returns the Prometheus scrape handler for the
+// registry built by metrics.NewRegistry, which the HTTP, delivery, Go
+// runtime and process collectors register on. It is what
+// promhttp.Handler builds for the global default registry, including
+// the promhttp_metric_handler_* series that count scrapes, pointed at
+// that registry instead.
+func (s *Handlers) HandleMetrics() http.HandlerFunc {
+	reg := s.params.Registry
+
+	return promhttp.InstrumentMetricHandler(
+		reg, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}),
+	).ServeHTTP
+}

internal/handlers/source_delete_test.go

@@ -220,7 +220,7 @@ func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/delete",
+		"/source/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -267,7 +267,7 @@ func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/delete",
+		"/source/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -323,7 +323,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/delete",
+		"/source/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -337,7 +337,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)
 	assert.Empty(
 		t, w.Header().Get("Location"),
-		"a failed deletion must not redirect to /hooks",
+		"a failed deletion must not redirect to /sources",
 	)
 
 	assert.Equal(
@@ -402,7 +402,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/delete",
+		"/source/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -411,7 +411,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	h.HandleSourceDelete().ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/hooks", w.Header().Get("Location"))
+	assert.Equal(t, "/sources", w.Header().Get("Location"))
 
 	assert.Equal(
 		t, int64(0),
@@ -465,7 +465,7 @@ func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/targets/"+tgt.ID+"/delete",
+		"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -515,7 +515,7 @@ func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/targets/"+doomed.ID+"/delete",
+		"/source/"+wh.ID+"/targets/"+doomed.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -563,7 +563,7 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 	)
 
 	req := postRequest(
-		"/hook/"+wh.ID+"/targets/"+other.ID+"/delete",
+		"/source/"+wh.ID+"/targets/"+other.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,

internal/handlers/source_detail_baseurl_test.go

@@ -81,7 +81,7 @@ func (f *baseURLFixture) entrypointURL(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/hook/"+f.webhook,
+		"/source/"+f.webhook,
 		nil,
 	)
 	req.Host = host
@@ -213,7 +213,7 @@ func TestSourceDetailBaseURL_ForwardedProtoSpellings(t *testing.T) {
 
 			assert.Equal(
 				t,
-				tc.scheme+"://"+host+"/h/"+fixture.path,
+				tc.scheme+"://"+host+"/webhook/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto(tc.header),
 				),
@@ -244,7 +244,7 @@ func TestSourceDetailBaseURL_DirectTLSBeatsPlaintextHeader(
 
 	assert.Equal(
 		t,
-		"https://"+host+"/h/"+fixture.path,
+		"https://"+host+"/webhook/"+fixture.path,
 		got,
 		"a connection this process terminated with TLS "+
 			"outranks a header claiming plaintext",
@@ -272,7 +272,7 @@ func TestSourceDetailBaseURL_KeepsHostAuthority(t *testing.T) {
 
 			assert.Equal(
 				t,
-				"https://"+host+"/h/"+fixture.path,
+				"https://"+host+"/webhook/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto("HTTPS"),
 				),

internal/handlers/source_detail_test.go

@@ -65,7 +65,7 @@ func renderSourceDetailPage(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/hook/"+webhookID,
+		"/source/"+webhookID,
 		nil,
 	)
 

internal/handlers/source_logs_deleted_target_test.go

@@ -28,7 +28,7 @@ func deleteTargetThroughHandler(
 	t.Helper()
 
 	req := postRequest(
-		"/hook/"+webhookID+"/targets/"+targetID+"/delete",
+		"/source/"+webhookID+"/targets/"+targetID+"/delete",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),

internal/handlers/source_logs_test.go

@@ -84,7 +84,7 @@ func renderSourceLogsPageWithQuery(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/hook/"+webhookID+"/events"+query,
+		"/source/"+webhookID+"/logs"+query,
 		nil,
 	)
 

internal/handlers/source_management.go

@@ -330,7 +330,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
 	)
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -581,7 +581,7 @@ func (h *Handlers) applyWebhookEdit(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -664,7 +664,7 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}
 
-	http.Redirect(w, r, "/hooks", http.StatusSeeOther)
+	http.Redirect(w, r, "/sources", http.StatusSeeOther)
 }
 
 // commitWebhookDeletion soft-deletes a webhook's entrypoints,
@@ -1257,7 +1257,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 		}
 
 		http.Redirect(
-			w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+			w, r, "/source/"+webhook.ID, http.StatusSeeOther,
 		)
 	}
 }
@@ -1313,7 +1313,7 @@ func (h *Handlers) processTargetCreate(
 	//
 	// Every field here is read with PostFormValue, not FormValue.
 	// FormValue falls back to the query string, which would let
-	// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
+	// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
 	// configure a target from a value the request line carries — and
 	// the request line, unlike the body, is what logs, proxies,
 	// Referer headers and error trackers record.
@@ -1370,7 +1370,7 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -1428,7 +1428,7 @@ type targetFormInput struct {
 //
 // Every field is read with PostFormValue, not FormValue. FormValue
 // falls back to the query string, which would let
-// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
+// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
 // configure a target from a value the request line carries — and the
 // request line, unlike the body, is what logs, proxies, Referer
 // headers and error trackers record. The headers field is under the
@@ -1707,7 +1707,7 @@ func (h *Handlers) deleteChildResource(
 
 		http.Redirect(
 			w, r,
-			"/hook/"+webhook.ID,
+			"/source/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}
@@ -1804,7 +1804,7 @@ func (h *Handlers) toggleChildResource(
 
 		http.Redirect(
 			w, r,
-			"/hook/"+webhook.ID,
+			"/source/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}

internal/handlers/source_management_test.go

@@ -105,7 +105,7 @@ func submitCreate(
 		form.Set("retention_days", *retention)
 	}
 
-	req := formRequest("/hooks/new", cookies, form, nil)
+	req := formRequest("/sources/new", cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -265,7 +265,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/hooks/new", env.cookies, nil),
+		w, getRequest(t, "/sources/new", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, w.Code)
@@ -402,7 +402,7 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	form.Set("description", description)
 	form.Set("retention_days", "nonsense")
 
-	req := formRequest("/hooks/new", env.cookies, form, nil)
+	req := formRequest("/sources/new", env.cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -430,7 +430,7 @@ func submitEdit(
 	form.Set("retention_days", retention)
 
 	req := formRequest(
-		"/hook/"+wh.ID+"/edit",
+		"/source/"+wh.ID+"/edit",
 		env.cookies,
 		form,
 		map[string]string{sourceIDParam: wh.ID},
@@ -512,7 +512,7 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	)
 
 	req := getRequest(
-		t, "/hook/"+wh.ID+"/edit", env.cookies,
+		t, "/source/"+wh.ID+"/edit", env.cookies,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
@@ -567,7 +567,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 
 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/hooks", env.cookies, nil),
+		listW, getRequest(t, "/sources", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, listW.Code)
@@ -578,7 +578,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 	env.handlers.HandleSourceDetail().ServeHTTP(
 		detailW,
 		getRequest(
-			t, "/hook/"+wh.ID, env.cookies,
+			t, "/source/"+wh.ID, env.cookies,
 			map[string]string{sourceIDParam: wh.ID},
 		),
 	)

internal/handlers/target_create_query_test.go

@@ -76,11 +76,11 @@ func postTargetCreate(
 	router := chi.NewRouter()
 	router.Use(mw.Logging())
 	router.Post(
-		"/hook/{sourceID}/targets",
+		"/source/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)
 
-	target := "/hook/" + webhookID + "/targets"
+	target := "/source/" + webhookID + "/targets"
 	if query != "" {
 		target += "?" + query
 	}
@@ -114,7 +114,7 @@ func postTargetCreate(
 // regression test for the ingress leak. r.FormValue falls back to the
 // query string when a field is absent from the POST body, so
 //
-//	POST /hook/{id}/targets?url=https://hooks.slack.com/services/...
+//	POST /source/{id}/targets?url=https://hooks.slack.com/services/...
 //
 // with an empty url field used to create a working target from a value
 // carried on the request line — where logs, proxies, Referer headers

internal/handlers/target_edit.go

@@ -47,7 +47,7 @@ type targetEditView struct {
 //
 // This page is the one place the full destination URL and header
 // values are shown. It is reachable only through the
-// /hook/{sourceID} route group, which supplies RequireAuth and
+// /source/{sourceID} route group, which supplies RequireAuth and
 // NoCache, and only for a target of a webhook the session's user
 // owns; masking (delivery.TargetView) is unchanged everywhere else.
 func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
@@ -163,7 +163,7 @@ func (h *Handlers) applyTargetEdit(
 	}
 
 	http.Redirect(
-		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 

internal/handlers/target_edit_test.go

@@ -42,15 +42,15 @@ const (
 func targetRouter(env *sourceTestEnv) *chi.Mux {
 	router := chi.NewRouter()
 	router.Post(
-		"/hook/{sourceID}/targets",
+		"/source/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)
 	router.Get(
-		"/hook/{sourceID}/targets/{targetID}/edit",
+		"/source/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEdit(),
 	)
 	router.Post(
-		"/hook/{sourceID}/targets/{targetID}/edit",
+		"/source/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEditSubmit(),
 	)
 
@@ -117,7 +117,7 @@ func seedHTTPTarget(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets", form,
+		"/source/"+webhook.ID+"/targets", form,
 	)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
 
@@ -188,7 +188,7 @@ func submitTargetEdit(
 ) *httptest.ResponseRecorder {
 	return serveTarget(
 		env, http.MethodPost,
-		"/hook/"+webhookID+"/targets/"+targetID+"/edit",
+		"/source/"+webhookID+"/targets/"+targetID+"/edit",
 		form,
 	)
 }
@@ -401,7 +401,7 @@ func TestHandleTargetEdit_PrefillsTheStoredValuesUnmasked(
 
 	w := serveTarget(
 		env, http.MethodGet,
-		"/hook/"+webhook.ID+"/targets/"+target.ID+"/edit",
+		"/source/"+webhook.ID+"/targets/"+target.ID+"/edit",
 		nil,
 	)
 	require.Equal(t, http.StatusOK, w.Code)
@@ -508,7 +508,7 @@ func assertEditIgnoresQueryString(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets/"+target.ID+
+		"/source/"+webhook.ID+"/targets/"+target.ID+
 			"/edit?url="+url.QueryEscape(editReplacedURL)+
 			"&headers="+url.QueryEscape(editAuthHeader),
 		form,
@@ -592,7 +592,7 @@ func assertTargetOfAnotherWebhook404s(
 
 	get := serveTarget(
 		env, http.MethodGet,
-		"/hook/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
+		"/source/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
 	)
 	assert.Equal(t, http.StatusNotFound, get.Code)
 
@@ -630,7 +630,7 @@ func assertWebhookOfAnotherUser404s(
 
 	w := serveTarget(
 		env, http.MethodGet,
-		"/hook/"+other.ID+"/targets/"+target.ID+"/edit", nil,
+		"/source/"+other.ID+"/targets/"+target.ID+"/edit", nil,
 	)
 
 	assert.Equal(t, http.StatusNotFound, w.Code)

internal/handlers/target_retries_test.go

@@ -102,7 +102,7 @@ func createWithRetries(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets",
+		"/source/"+webhook.ID+"/targets",
 		createRetriesForm(retries),
 	)
 

internal/handlers/ui_copy_test.go

@@ -54,7 +54,8 @@ func renderPage(
 }
 
 // TestNavbarUsesWebhookTerminology pins the user-visible navigation
-// label to "Webhooks" and its link to the webhook list at /hooks.
+// label to "Webhooks". The /sources route is deliberately unchanged, so
+// the assertion targets the link text rather than the href.
 func TestNavbarUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()
 
@@ -94,11 +95,15 @@ func TestNavbarUsesWebhookTerminology(t *testing.T) {
 		t, body, ">Sources<",
 		"no user-visible element may still be labelled Sources",
 	)
-	assert.Contains(t, body, `href="/hooks"`)
+	assert.Contains(
+		t, body, `href="/sources"`,
+		"the /sources route itself must not change",
+	)
 }
 
 // TestEditPageUsesWebhookTerminology pins the edit page's heading and
-// its back link to the webhook page at /hook/{id}.
+// its back link. The link's href still points at /source/{id}, which is
+// intentional: only user-visible copy changes.
 func TestEditPageUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()
 
@@ -125,57 +130,7 @@ func TestEditPageUsesWebhookTerminology(t *testing.T) {
 
 	assert.Contains(t, body, "Edit Webhook")
 	assert.NotContains(t, body, ">Sources<")
-	assert.Contains(t, body, `href="/hook/wh-1"`)
-}
-
-// TestEventLogPageIsCalledFullEventLog pins the one name the event log
-// page at /hook/{id}/events goes by: both links to it on the webhook
-// page, and its own heading, read "Full Event Log".
-func TestEventLogPageIsCalledFullEventLog(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	var sess *session.Session
-
-	app := newTestApp(t, &h, &sess)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	// A pointer, as in the handlers: source_detail.html calls
-	// Webhook.RetentionLabel, a pointer method. Both pages only range
-	// over their lists, and a list left out renders as empty, so the
-	// lists are left out.
-	webhook := &database.Webhook{Name: "wh", RetentionDays: 14}
-	webhook.ID = testWebhookID
-
-	detailBody := renderPage(
-		t, h, sess, "source_detail.html", map[string]any{
-			dataKeyWebhook: webhook,
-		},
-	)
-
-	assert.Contains(
-		t, detailBody,
-		`<a href="/hook/wh-1/events" class="btn-secondary">Full Event Log</a>`,
-		"the button at the top of the webhook page",
-	)
-	assert.Contains(
-		t, detailBody,
-		`<a href="/hook/wh-1/events" class="btn-text text-sm">Full Event Log</a>`,
-		"the link under recent events",
-	)
-
-	logBody := renderPage(t, h, sess, "source_logs.html", map[string]any{
-		dataKeyWebhook: webhook,
-		"TotalEvents":  int64(0),
-	})
-
-	assert.Contains(
-		t, logBody,
-		`<h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>`,
-	)
+	assert.Contains(t, body, `href="/source/wh-1"`)
 }
 
 // TestCreateFormRetentionCopyMatchesBehaviour pins the create form's
@@ -328,7 +283,7 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 		t, body,
 		`<code id="entrypoint-url-ep-1"`,
 	)
-	assert.Contains(t, body, "https://hooks.example.com/h/abc123")
+	assert.Contains(t, body, "https://hooks.example.com/webhook/abc123")
 	assert.Contains(
 		t, body,
 		`hidden data-copy-target="entrypoint-url-ep-1"`,

internal/handlers/webhook.go

@@ -131,7 +131,7 @@ func (h *Handlers) lookupEntrypoint(
 		"path = ?", entrypointUUID,
 	).First(&entrypoint)
 	if result.Error != nil {
-		// The receiver is unauthenticated and /h/{uuid}
+		// The receiver is unauthenticated and /webhook/{uuid}
 		// matches any single segment, so this value is entirely
 		// client-chosen on exactly the branch where the lookup
 		// failed. DEBUG is off by default; the cap is what keeps

internal/logfield/logfield_test.go

@@ -201,7 +201,7 @@ func TestTruncate_LeavesShortValuesAlone(t *testing.T) {
 	t.Parallel()
 
 	for _, s := range []string{
-		"", "GET", "/hook/abc/edit", "Mozilla/5.0 (X11)",
+		"", "GET", "/source/abc/edit", "Mozilla/5.0 (X11)",
 	} {
 		assert.Equal(t, s, logfield.Truncate(s, budget))
 	}

internal/metrics/metrics.go

@@ -3,17 +3,18 @@
 // deliveries are attempted, how they end, how long they take, how
 // deep the queues are, and how many circuit breakers are open.
 //
-// The inbound HTTP metrics come from the go-http-metrics recorder in
-// internal/middleware and land on prometheus.DefaultRegisterer. These
-// collectors register there too, so both surfaces are gathered by the
-// one promhttp handler mounted on the authenticated /metrics route.
+// It also builds the registry the authenticated /metrics route
+// serves. In production, these collectors, the inbound HTTP metrics
+// recorded in internal/middleware, and the Go runtime and process
+// collectors all register on that one registry, never on Prometheus's
+// global default.
 package metrics
 
 import (
-	"sync"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -57,25 +58,31 @@ var knownTargetTypes = []database.TargetType{
 	database.TargetTypeSlack,
 }
 
-// defaultSet is the process-wide metric set, registered on the same
-// registry the HTTP middleware and the /metrics handler already use.
-// It is built on first use rather than in an init so that a test
-// binary that never touches metrics never registers them.
+// NewRegistry returns the registry /metrics serves, carrying the Go
+// runtime and process collectors that Prometheus's global default
+// registry carries, so the go_* and process_* series stay in the
+// scrape.
 //
-//nolint:gochecknoglobals // one process-wide registration, by design
-var defaultSet = sync.OnceValue(func() *Set {
-	return New(prometheus.DefaultRegisterer)
-})
+// A registry of its own, rather than the global default, is what lets
+// two dependency graphs in one process — two tests, say — each
+// register their collectors without the second registration
+// panicking.
+func NewRegistry() *prometheus.Registry {
+	reg := prometheus.NewRegistry()
+	reg.MustRegister(
+		collectors.NewGoCollector(),
+		collectors.NewProcessCollector(
+			collectors.ProcessCollectorOpts{},
+		),
+	)
 
-// Default returns the process-wide metric set.
-func Default() *Set {
-	return defaultSet()
+	return reg
 }
 
 // Set is one registered group of webhooker's delivery collectors.
-// Production uses the single Default set; tests build their own
-// against a private registry so assertions are not disturbed by
-// deliveries other tests are making concurrently.
+// Production builds one on the registry /metrics serves; tests build
+// their own against a private registry so assertions are not
+// disturbed by deliveries other tests are making concurrently.
 type Set struct {
 	eventsReceived      prometheus.Counter
 	deliveryAttempts    *prometheus.CounterVec
@@ -93,7 +100,7 @@ type Set struct {
 // New registers a full set of delivery collectors on reg and returns
 // it. It panics if reg already holds them, which is the intended
 // behaviour for a duplicate registration.
-func New(reg prometheus.Registerer) *Set {
+func New(reg *prometheus.Registry) *Set {
 	factory := promauto.With(reg)
 
 	s := &Set{

internal/middleware/accesslog_test.go

@@ -119,7 +119,7 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
 	)
 
 	router.HandleFunc(
-		"/h/{uuid}",
+		"/webhook/{uuid}",
 		func(w http.ResponseWriter, r *http.Request) {
 			// Stands in for the real handler: an unknown entrypoint
 			// UUID 404s, a known one succeeds.
@@ -271,11 +271,11 @@ func TestAccessLog_InventedReceiverPathsLogRoutePattern(t *testing.T) {
 	assertFloodIsBounded(
 		t,
 		func(i int) string {
-			return "/h/" + attackerMarker +
+			return "/webhook/" + attackerMarker +
 				strings.Repeat("x", i) + "?q=" + attackerMarker
 		},
 		http.StatusNotFound,
-		"/h/{uuid}",
+		"/webhook/{uuid}",
 	)
 }
 
@@ -346,10 +346,10 @@ type sizeCase struct {
 func lineSizeCases() map[string]sizeCase {
 	cases := map[string]sizeCase{
 		"oversized path segment": {
-			target: "/h/" + attackerMarker +
+			target: "/webhook/" + attackerMarker +
 				strings.Repeat("x", oversizedSegmentBytes),
 			wantStatus: http.StatusNotFound,
-			wantURL:    "/h/{uuid}",
+			wantURL:    "/webhook/{uuid}",
 			bound:      maxLineBytes,
 		},
 		// /.well-known/healthcheck answers 200 to anyone and has no
@@ -605,14 +605,14 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
 	router := accessLogRouter(m)
 
 	assert.Equal(
-		t, http.StatusOK, get(t, router, "/h/known?src=ci"),
+		t, http.StatusOK, get(t, router, "/webhook/known?src=ci"),
 	)
 
 	// The path resolved against a stored entrypoint, so it stays. The
 	// query never does: see TestAccessLog_UnauthenticatedSuccess...
 	entries := accessLogEntries(t, buf)
 	require.Len(t, entries, 1)
-	assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
+	assert.Equal(t, "/webhook/known?(redacted)", entries[0]["url"])
 	assert.NotContains(t, buf.String(), "src=ci")
 }
 
@@ -640,7 +640,7 @@ func TestAccessLog_RetainsEveryOtherField(t *testing.T) {
 	assert.Equal(
 		t,
 		http.StatusNotFound,
-		get(t, router, "/h/"+attackerMarker),
+		get(t, router, "/webhook/"+attackerMarker),
 	)
 
 	entries := accessLogEntries(t, buf)

internal/middleware/csrf.go

@@ -41,7 +41,7 @@ func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 		// CSRF is registered ahead of RequireAuth on every route
 		// group that uses it, so this WARN is reachable by an
 		// unauthenticated client: a POST with no token to
-		// /hook/<any length of any text>/edit lands here. The
+		// /source/<any length of any text>/edit lands here. The
 		// method and path are capped against the same budgets as
 		// the access log. remote_addr is set by net/http from the
 		// accepted connection rather than by the client, and

internal/middleware/export_test.go

@@ -10,8 +10,7 @@ import (
 
 // MetricsMiddlewareForTest builds the metrics recording middleware
 // against a caller-supplied recorder, so a test can gather from its
-// own Prometheus registry rather than the process-wide default one
-// that Middleware.Metrics uses.
+// own Prometheus registry without building a whole Middleware.
 func MetricsMiddlewareForTest(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/logbound_test.go

@@ -383,7 +383,7 @@ func TestLogLines_ClientChosenPathDoesNotSizeTheLine(t *testing.T) {
 						t, newHandler,
 					)
 
-					path := "/hook/" +
+					path := "/source/" +
 						oversizedPathSegment(fill) + "/edit"
 
 					assert.Equal(
@@ -434,7 +434,7 @@ func TestLoginThrottle_LogLineDoesNotTrackPathSize(t *testing.T) {
 				req := httptest.NewRequestWithContext(
 					context.Background(),
 					http.MethodPost,
-					"/hook/"+
+					"/source/"+
 						oversizedPathSegment(fill)+"/login",
 					nil,
 				)
@@ -499,7 +499,7 @@ func TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog(
 							http.StatusRequestEntityTooLarge,
 							postOversize(
 								h,
-								"/hook/"+segment(i)+"/edit",
+								"/source/"+segment(i)+"/edit",
 							),
 						)
 					}

internal/middleware/metrics.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/go-chi/chi"
 	httpmetrics "github.com/slok/go-http-metrics/metrics"
-	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	ghmm "github.com/slok/go-http-metrics/middleware"
 	"github.com/slok/go-http-metrics/middleware/std"
 )
@@ -40,7 +39,7 @@ const unmatchedMethod = unmatchedRoute
 //
 // The pattern is what bounds the label's domain to the routes the
 // service registers. The path does not bound it at all — every byte
-// after /h/ is client-chosen, so labelling by path lets any
+// after /webhook/ is client-chosen, so labelling by path lets any
 // unauthenticated client mint permanent series at will, and publishes
 // the entrypoint UUID (the receiver's only credential) in the scrape
 // while doing it.
@@ -151,17 +150,17 @@ func (r boundedLabelRecorder) AddInflightRequests(
 
 var _ httpmetrics.Recorder = boundedLabelRecorder{}
 
-// Metrics returns middleware that records Prometheus HTTP metrics on
-// the default registry, which is the one the /metrics route gathers.
+// Metrics returns middleware that records Prometheus HTTP metrics
+// with the Middleware's one recorder, which New builds on the registry
+// the /metrics route serves and NewForTest on a registry of its own.
+// Every call reuses that recorder, so any number of routers can
+// install it.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {
-	return metricsMiddleware(
-		prommetrics.NewRecorder(prommetrics.Config{}),
-	)
+	return metricsMiddleware(s.metricsRecorder)
 }
 
 // metricsMiddleware builds the recording middleware against a given
-// recorder, so tests can gather from a registry of their own instead
-// of the process-wide default.
+// recorder, so tests can gather from a registry of their own.
 func metricsMiddleware(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/metrics_method_test.go

@@ -50,7 +50,7 @@ func realMethods() []string {
 // dimension varying, so any series growth a probe produces is the
 // method label's and nothing else's.
 func methodProbePath() string {
-	return "/h/" + uuid.NewString()
+	return "/webhook/" + uuid.NewString()
 }
 
 // inventedMethods returns n distinct RFC 9110 method tokens that no

internal/middleware/metrics_test.go

@@ -28,7 +28,7 @@ const (
 
 	// receiverRoutePattern is the one handler label every receiver
 	// request must produce, however the client varies the path.
-	receiverRoutePattern = "/h/{uuid}"
+	receiverRoutePattern = "/webhook/{uuid}"
 
 	// okRoute is a static route used to pin that the response-writer
 	// interceptor still reports status and size after the handler id
@@ -57,9 +57,8 @@ const (
 // Server.setupWebhookRoutes inside it. That ordering is the whole
 // defect, so a test that flattens it would prove nothing.
 //
-// The recorder writes to a registry of the test's own rather than the
-// process-wide default one, so each test observes only its own
-// traffic.
+// The recorder writes to a registry of the test's own, so each test
+// observes only its own traffic.
 func metricsTestRouter(
 	t *testing.T,
 	receiverLimit int,
@@ -143,13 +142,13 @@ func drivePaths(
 	return drive(t, h, probes)
 }
 
-// receiverPaths returns n distinct /h/ paths, each naming a
+// receiverPaths returns n distinct /webhook/ paths, each naming a
 // fresh UUID exactly as an unauthenticated flood would.
 func receiverPaths(n int) []string {
 	paths := make([]string, 0, n)
 
 	for range n {
-		paths = append(paths, "/h/"+uuid.NewString())
+		paths = append(paths, "/webhook/"+uuid.NewString())
 	}
 
 	return paths
@@ -220,7 +219,7 @@ func keys(set map[string]struct{}) []string {
 
 // TestMetrics_DistinctReceiverPathsMintOneLabelSet is the direct
 // assertion the issue asks for: N requests to N distinct
-// /h/<uuid> paths must produce exactly ONE handler label, the
+// /webhook/<uuid> paths must produce exactly ONE handler label, the
 // route pattern. Before the fix this produced N of them.
 func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	t.Parallel()
@@ -250,7 +249,7 @@ func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	// The scrape must not republish the UUIDs it was driven with.
 	// They are the receiver's only credential.
 	for _, p := range paths {
-		id := strings.TrimPrefix(p, "/h/")
+		id := strings.TrimPrefix(p, "/webhook/")
 		for label := range labels {
 			assert.NotContains(
 				t, label, id,
@@ -354,7 +353,7 @@ func TestMetrics_UnmatchedPathsCollapseToTheSentinel(t *testing.T) {
 		if i%2 == 0 {
 			paths = append(paths, "/"+id)
 		} else {
-			paths = append(paths, "/h/"+id+"/"+id)
+			paths = append(paths, "/webhook/"+id+"/"+id)
 		}
 	}
 
@@ -455,3 +454,29 @@ func TestMetrics_StatusAndSizeStillRecorded(t *testing.T) {
 		"the interceptor must still count written bytes",
 	)
 }
+
+// TestMetrics_WorksOnNewForTestMiddleware pins that a Middleware built
+// by NewForTest has a recorder of its own: its Metrics() serves a
+// request instead of panicking, and a second one does not collide
+// with the first.
+func TestMetrics_WorksOnNewForTestMiddleware(t *testing.T) {
+	t.Parallel()
+
+	log := slog.New(slog.DiscardHandler)
+	cfg := &config.Config{Environment: "prod"}
+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(okBody))
+	})
+
+	for range 2 {
+		h := middleware.NewForTest(log, cfg, nil).Metrics()(ok)
+
+		req := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, okRoute, nil,
+		)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusOK, w.Code)
+	}
+}

internal/middleware/middleware.go

@@ -13,6 +13,9 @@ import (
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
+	"github.com/prometheus/client_golang/prometheus"
+	httpmetrics "github.com/slok/go-http-metrics/metrics"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
@@ -148,10 +151,11 @@ const (
 type MiddlewareParams struct {
 	fx.In
 
-	Logger  *logger.Logger
-	Globals *globals.Globals
-	Config  *config.Config
-	Session *session.Session
+	Logger   *logger.Logger
+	Globals  *globals.Globals
+	Config   *config.Config
+	Session  *session.Session
+	Registry *prometheus.Registry
 }
 
 // Middleware provides HTTP middleware for logging, CORS, auth, and
@@ -161,6 +165,14 @@ type Middleware struct {
 	params  *MiddlewareParams
 	session *session.Session
 
+	// metricsRecorder records the inbound HTTP metrics. New builds
+	// it on the registry /metrics serves, NewForTest on a registry
+	// of its own. Either way it is built once per Middleware and
+	// Metrics reuses it, because building it registers its
+	// collectors, and a second registration on the same registry
+	// panics.
+	metricsRecorder httpmetrics.Recorder
+
 	// loginGuard counts failed credential verifications and bounds
 	// concurrent password hashing. It is built on first use so that
 	// every construction path gets one; see guard().
@@ -179,6 +191,9 @@ func New(
 	s.params = &params
 	s.log = params.Logger.Get()
 	s.session = params.Session
+	s.metricsRecorder = prommetrics.NewRecorder(
+		prommetrics.Config{Registry: params.Registry},
+	)
 
 	return s, nil
 }
@@ -257,7 +272,7 @@ func concreteLogURL(r *http.Request) string {
 //
 // 3xx and 4xx responses get the chi route pattern instead. Those are
 // the outcomes an unauthenticated client drives for free: 404 or 429
-// on any invented /h/ path, 303 to the login page on any
+// on any invented /webhook/ path, 303 to the login page on any
 // invented /user/ path. Logging the concrete URL there lets a flood
 // write attacker-chosen text, of attacker-chosen length, into the
 // operator's log at one line per request. The pattern comes from the
@@ -560,7 +575,7 @@ func (s *Middleware) MaxBodySize(
 				// internal/server/routes.go), so an
 				// unauthenticated client reaches it with a path
 				// of its own choosing and its own length —
-				// POST /hook/<8 KB>/edit with an oversize
+				// POST /source/<8 KB>/edit with an oversize
 				// declared Content-Length costs nothing to
 				// send. At WARN, on by default, that is a
 				// write into the operator's log sized by the

internal/middleware/middleware_test.go

@@ -640,7 +640,7 @@ func TestNoCache_SetsHeaders(t *testing.T) {
 
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodGet, "/hooks", nil,
+		http.MethodGet, "/sources", nil,
 	)
 	w := httptest.NewRecorder()
 

internal/middleware/ratelimit.go

@@ -63,7 +63,7 @@ const (
 
 	// receiverAggregateMultiplier scales the configured
 	// per-entrypoint receiver limit into the aggregate limit one
-	// client IP may spend across the whole /h/* route. Ten
+	// client IP may spend across the whole /webhook/* route. Ten
 	// entrypoints' worth lets a single sender address drive several
 	// entrypoints at their full rate, while still capping what one
 	// address costs the unauthenticated receiver.
@@ -390,7 +390,7 @@ func (m *Middleware) postRateLimit(
 // It is Config.ReceiverRateLimit requests per minute.
 //
 // That limit alone bounds nothing in aggregate. The route pattern
-// /h/{uuid} matches any single segment, so a client that
+// /webhook/{uuid} matches any single segment, so a client that
 // invents a fresh path per request mints a fresh bucket per request
 // and never refills one — and every such request still reaches the
 // handler's entrypoint lookup before it 404s. The outer limit is

internal/middleware/ratelimit_test.go

@@ -275,7 +275,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// pass.
 	for i := range limit {
 		w := receiverPost(
-			handler, "9.9.9.9:1234", "/h/uuid-a",
+			handler, "9.9.9.9:1234", "/webhook/uuid-a",
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -286,7 +286,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// The next request over the limit is rejected with a 429
 	// carrying a Retry-After header.
 	w := receiverPost(
-		handler, "9.9.9.9:1234", "/h/uuid-a",
+		handler, "9.9.9.9:1234", "/webhook/uuid-a",
 	)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 	assert.NotEmpty(
@@ -296,7 +296,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 
 	// The same IP is not limited on a different entrypoint.
 	w = receiverPost(
-		handler, "9.9.9.9:1234", "/h/uuid-b",
+		handler, "9.9.9.9:1234", "/webhook/uuid-b",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -305,7 +305,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 
 	// A different IP is not limited on the same entrypoint.
 	w = receiverPost(
-		handler, "8.8.8.8:1234", "/h/uuid-a",
+		handler, "8.8.8.8:1234", "/webhook/uuid-a",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -322,7 +322,7 @@ func TestReceiverRateLimit_CountsEveryMethod(t *testing.T) {
 	const (
 		limit = 2
 		ip    = "7.7.7.7:1234"
-		path  = "/h/uuid-c"
+		path  = "/webhook/uuid-c"
 	)
 
 	handler := receiverLimitedHandler(t, limit)
@@ -715,7 +715,7 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	// none of them shares a per-entrypoint bucket with another.
 	for i := range aggregate {
 		w := receiverPost(
-			handler, ip, fmt.Sprintf("/h/invented-%d", i),
+			handler, ip, fmt.Sprintf("/webhook/invented-%d", i),
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -724,17 +724,17 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	}
 
 	w := receiverPost(
-		handler, ip, fmt.Sprintf("/h/invented-%d", aggregate),
+		handler, ip, fmt.Sprintf("/webhook/invented-%d", aggregate),
 	)
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"a client must not be able to raise its aggregate rate "+
-			"against /h/* by varying the path",
+			"against /webhook/* by varying the path",
 	)
 
 	// The aggregate limit is still per client IP: exhausting one
 	// address must not throttle another.
-	w = receiverPost(handler, "6.6.6.7:1234", "/h/invented-0")
+	w = receiverPost(handler, "6.6.6.7:1234", "/webhook/invented-0")
 	assert.Equal(
 		t, http.StatusOK, w.Code,
 		"a different client IP must not be affected",
@@ -771,7 +771,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 	// limit requests are served; the rest are rejected by the
 	// per-entrypoint limiter but still count against the aggregate.
 	for i := range aggregate {
-		w := receiverPost(handler, ip, "/h/exhausted")
+		w := receiverPost(handler, ip, "/webhook/exhausted")
 
 		want := http.StatusTooManyRequests
 		if i < limit {
@@ -784,7 +784,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 		)
 	}
 
-	w := receiverPost(handler, ip, "/h/never-used")
+	w := receiverPost(handler, ip, "/webhook/never-used")
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"requests rejected per entrypoint must still count "+
@@ -823,7 +823,7 @@ func TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer(
 	const (
 		limit = 3
 		peer  = "203.0.113.10:44444"
-		path  = "/h/uuid-d"
+		path  = "/webhook/uuid-d"
 	)
 
 	handler := receiverLimitedHandler(t, limit)

internal/middleware/testing.go

@@ -3,12 +3,17 @@ package middleware
 import (
 	"log/slog"
 
+	"github.com/prometheus/client_golang/prometheus"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
 // NewForTest creates a Middleware with the minimum dependencies
 // needed for testing. This bypasses the fx lifecycle.
+//
+// Its metrics recorder writes to a fresh registry of its own, so
+// Metrics() works on it and two of them never collide.
 func NewForTest(
 	log *slog.Logger,
 	cfg *config.Config,
@@ -20,5 +25,8 @@ func NewForTest(
 			Config: cfg,
 		},
 		session: sess,
+		metricsRecorder: prommetrics.NewRecorder(
+			prommetrics.Config{Registry: prometheus.NewRegistry()},
+		),
 	}
 }

internal/resetpw/resetpw_test.go

@@ -24,6 +24,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/resetpw"
 	"sneak.berlin/go/webhooker/internal/session"
@@ -163,6 +164,8 @@ func newServerApp(
 			session.New,
 			func() delivery.Notifier { return &noopNotifier{} },
 			func() delivery.WebhookEvictor { return &noopEvictor{} },
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,

internal/server/routes.go

@@ -7,7 +7,6 @@ import (
 	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"sneak.berlin/go/webhooker/static"
 )
 
@@ -130,12 +129,7 @@ func (s *Server) setupRoutes() {
 	if s.params.Config.MetricsAuthEnabled() {
 		s.router.Group(func(r chi.Router) {
 			r.Use(s.mw.MetricsAuth())
-			r.Get(
-				"/metrics",
-				http.HandlerFunc(
-					promhttp.Handler().ServeHTTP,
-				),
-			)
+			r.Get("/metrics", s.h.HandleMetrics())
 		})
 	}
 
@@ -182,7 +176,7 @@ func (s *Server) setupUserRoutes() {
 }
 
 func (s *Server) setupSourceRoutes() {
-	s.router.Route("/hooks", func(r chi.Router) {
+	s.router.Route("/sources", func(r chi.Router) {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
@@ -194,7 +188,7 @@ func (s *Server) setupSourceRoutes() {
 		r.Post("/new", s.h.HandleSourceCreateSubmit())
 	})
 
-	s.router.Route("/hook/{sourceID}", func(r chi.Router) {
+	s.router.Route("/source/{sourceID}", func(r chi.Router) {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
@@ -205,14 +199,14 @@ func (s *Server) setupSourceRoutes() {
 		r.Get("/edit", s.h.HandleSourceEdit())
 		r.Post("/edit", s.h.HandleSourceEditSubmit())
 		r.Post("/delete", s.h.HandleSourceDelete())
-		r.Get("/events", s.h.HandleSourceLogs())
+		r.Get("/logs", s.h.HandleSourceLogs())
 		// The log page renders each body only up to its cap, so
 		// this is the only route that serves a whole one. It
 		// belongs to this group for its RequireAuth and
 		// NoCache; see HandleEventBodyDownload for the headers
 		// that keep the bytes it returns inert.
 		r.Get(
-			"/events/{eventID}/body",
+			"/logs/{eventID}/body",
 			s.h.HandleEventBodyDownload(),
 		)
 		// Replay is the one page action that queues outbound work:
@@ -279,7 +273,7 @@ func (s *Server) setupSourceRoutes() {
 
 func (s *Server) setupWebhookRoutes() {
 	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
-		"/h/{uuid}",
+		"/webhook/{uuid}",
 		s.h.HandleWebhook(),
 	)
 }

internal/server/routes_test.go

@@ -24,6 +24,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/server"
 	"sneak.berlin/go/webhooker/internal/session"
@@ -113,6 +114,8 @@ func newTestEnvWithConfig(
 			session.New,
 			func() delivery.Notifier { return &noopNotifier{} },
 			func() delivery.WebhookEvictor { return &noopEvictor{} },
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,
@@ -674,7 +677,7 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
 
 	require.NotNil(t, fresh, "login must set a session cookie")
 	assert.Equal(
-		t, "/hooks",
+		t, "/sources",
 		env.get("/", []*http.Cookie{fresh}).Header().Get("Location"),
 		"the new session cookie must authenticate",
 	)
@@ -741,7 +744,7 @@ func TestPasswordChange_UnderLimit_Succeeds(t *testing.T) {
 	)
 }
 
-// --- /hook/{sourceID} group ---
+// --- /source/{sourceID} group ---
 
 // TestSourceLogs_TruncationLinkDownloadsTheBody walks the whole
 // feature the way a user does: render the event log page through
@@ -769,11 +772,11 @@ func TestSourceLogs_TruncationLinkDownloadsTheBody(t *testing.T) {
 	wh := env.seedWebhook(t, userID)
 	env.seedEvent(t, wh.ID, stored)
 
-	page := env.get("/hook/"+wh.ID+"/events", cookies)
+	page := env.get("/source/"+wh.ID+"/logs", cookies)
 	require.Equal(t, http.StatusOK, page.Code)
 
 	link := regexp.MustCompile(
-		`href="(/hook/[^"]+/body)"`,
+		`href="(/source/[^"]+/body)"`,
 	).FindStringSubmatch(page.Body.String())
 	require.Len(
 		t, link, 2,
@@ -819,7 +822,7 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 	const payload = "OWNERS-PAYLOAD-77c1"
 
 	evt := env.seedEvent(t, wh.ID, payload)
-	path := "/hook/" + wh.ID + "/events/" + evt.ID + "/body"
+	path := "/source/" + wh.ID + "/logs/" + evt.ID + "/body"
 
 	intruderID, _ := env.seedUser(t, "intruder", "somepassword")
 	intruder := env.authCookies(t, intruderID, "intruder")
@@ -853,7 +856,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	evt := env.seedEvent(t, wh.ID, `{"replay":"me"}`)
 	dlv := env.seedFailedDelivery(t, wh.ID, evt.ID, tgt.ID)
 
-	path := "/hook/" + wh.ID + "/deliveries/" + dlv.ID +
+	path := "/source/" + wh.ID + "/deliveries/" + dlv.ID +
 		"/replay"
 
 	assert.Equal(
@@ -879,7 +882,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	// The token and the action URL both come out of the rendered
 	// page, so a typo in either the route pattern or the template
 	// fails here.
-	logsPath := "/hook/" + wh.ID + "/events"
+	logsPath := "/source/" + wh.ID + "/logs"
 
 	token, cookies := env.csrfFrom(t, logsPath, cookies)
 
@@ -887,7 +890,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	require.Equal(t, http.StatusOK, page.Code)
 
 	action := regexp.MustCompile(
-		`action="(/hook/[^"]+/replay)"`,
+		`action="(/source/[^"]+/replay)"`,
 	).FindStringSubmatch(page.Body.String())
 	require.Len(
 		t, action, 2,
@@ -912,59 +915,6 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	)
 }
 
-// --- /h/{uuid} receiver ---
-
-// TestReceiver_EntrypointURLIsRateLimited takes the entrypoint URL
-// the webhook page shows and posts to it through the production
-// router until the receiver rate limit refuses it. The URL has to
-// reach the receiver, and the limit has to apply to it.
-func TestReceiver_EntrypointURLIsRateLimited(t *testing.T) {
-	t.Parallel()
-
-	const limit = 2
-
-	env := newTestEnvWithConfig(t, &config.Config{
-		DataDir:           t.TempDir(),
-		Environment:       config.EnvironmentDev,
-		ReceiverRateLimit: limit,
-	})
-
-	userID, _ := env.seedUser(t, "receiver", "somepassword")
-	cookies := env.authCookies(t, userID, "receiver")
-
-	wh := env.seedWebhook(t, userID)
-	require.NoError(t, env.db.DB().Omit(clause.Associations).Create(
-		&database.Entrypoint{
-			WebhookID: wh.ID,
-			Path:      "6f1e2a9c-4b7d-4e3a-9c2f-1d8b5a7e3c60",
-			Active:    true,
-		},
-	).Error)
-
-	page := env.get("/hook/"+wh.ID, cookies)
-	require.Equal(t, http.StatusOK, page.Code)
-
-	shown := regexp.MustCompile(`(/h/[^<]+)</code>`).
-		FindStringSubmatch(page.Body.String())
-	require.Len(
-		t, shown, 2, "the webhook page should show the entrypoint URL",
-	)
-
-	for i := range limit {
-		assert.Equal(
-			t, http.StatusOK,
-			env.post(shown[1], url.Values{}, nil).Code,
-			"request %d should reach the receiver", i,
-		)
-	}
-
-	assert.Equal(
-		t, http.StatusTooManyRequests,
-		env.post(shown[1], url.Values{}, nil).Code,
-		"the receiver rate limit must apply to the entrypoint URL",
-	)
-}
-
 // metricsConfig is a Config differing from the routing default only
 // in the two /metrics credentials.
 func metricsConfig(
@@ -1080,3 +1030,46 @@ func TestMetricsRouteUnmountedOnHalfSetConfig(t *testing.T) {
 		})
 	}
 }
+
+// TestTwoMetricsRoutersInOneProcess pins
+// https://git.eeqj.de/sneak/webhooker/issues/227: a second
+// metrics-enabled router in one process used to panic, because the
+// HTTP metrics registered on Prometheus's global default registry.
+// Two routers are built over separate dependency graphs and a third
+// over the first graph again, and each must still serve the HTTP,
+// delivery, Go runtime and process series, and the series counting
+// scrapes of /metrics itself.
+func TestTwoMetricsRoutersInOneProcess(t *testing.T) {
+	t.Parallel()
+
+	first := newTestEnvWithConfig(
+		t, metricsConfig(t, metricsUser, metricsAuthValue),
+	)
+	second := newTestEnvWithConfig(
+		t, metricsConfig(t, metricsUser, metricsAuthValue),
+	)
+	third := &testEnv{
+		router: server.NewRouterForTest(
+			first.log.Get(), first.cfg, first.mw, first.hnd,
+		),
+	}
+
+	for _, env := range []*testEnv{first, second, third} {
+		env.get("/", nil)
+
+		scrape := env.metricsRequest(metricsUser, metricsAuthValue)
+		require.Equal(t, http.StatusOK, scrape.Code)
+
+		for _, series := range []string{
+			"http_request_duration_seconds",
+			"http_response_size_bytes",
+			"http_requests_inflight",
+			"webhooker_events_received_total",
+			"go_goroutines",
+			"process_start_time_seconds",
+			"promhttp_metric_handler_requests_total",
+		} {
+			assert.Contains(t, scrape.Body.String(), series)
+		}
+	}
+}

internal/server/sentry.go

@@ -55,7 +55,7 @@ func sentryClientOptions(dsn, release string) sentry.ClientOptions {
 //
 // URL is the third such field. NewRequest builds it as
 // scheme://host/path (interfaces.go:183), and on the receiver route
-// that path is /h/<uuid> in full — a write capability, not an
+// that path is /webhook/<uuid> in full — a write capability, not an
 // identifier. It is rebuilt here from the chi route pattern, on every
 // route, keeping the scheme and the host.
 //

internal/server/sentry_test.go

@@ -153,7 +153,7 @@ func (c sentryCase) router() http.Handler {
 		sentryhttp.New(sentryhttp.Options{Repanic: true}).Handle,
 	)
 	router.HandleFunc("/pages/login", handler)
-	router.HandleFunc("/h/{uuid}", handler)
+	router.HandleFunc("/webhook/{uuid}", handler)
 
 	return router
 }
@@ -191,7 +191,7 @@ func sentryLoginRequest(client *sentry.Client) *http.Request {
 // concrete path carries the entrypoint capability.
 func sentryReceiverRequest(client *sentry.Client) *http.Request {
 	return sentryRequest(
-		client, "/h/"+sentryReceiverUUID, "payload=hello",
+		client, "/webhook/"+sentryReceiverUUID, "payload=hello",
 	)
 }
 
@@ -316,7 +316,7 @@ func TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern(
 		t, marshalEvent(t, event), sentryReceiverUUID,
 	)
 	assert.Equal(
-		t, "http://example.com/h/{uuid}", event.Request.URL,
+		t, "http://example.com/webhook/{uuid}", event.Request.URL,
 	)
 }
 
@@ -401,7 +401,7 @@ func TestSentryScrub_TransactionDispatchIsUnscrubbedWithoutTheHook(
 func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
 	t.Parallel()
 
-	concrete := "https://example.com/h/" + sentryReceiverUUID
+	concrete := "https://example.com/webhook/" + sentryReceiverUUID
 
 	// A request with no chi routing context on it at all, which is
 	// what an event captured outside the router would carry.
@@ -426,7 +426,7 @@ func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
 
 			event := sentry.NewEvent()
 			event.Request = &sentry.Request{URL: concrete}
-			event.Transaction = "POST /h/" +
+			event.Transaction = "POST /webhook/" +
 				sentryReceiverUUID
 
 			scrubbed := server.ScrubSentryRequestForTest(
@@ -459,9 +459,9 @@ func TestSentryScrub_WithholdsUnparseableValues(t *testing.T) {
 
 	event := sentry.NewEvent()
 	event.Request = &sentry.Request{
-		URL: "/h/" + sentryReceiverUUID,
+		URL: "/webhook/" + sentryReceiverUUID,
 	}
-	event.Transaction = "/h/" + sentryReceiverUUID
+	event.Transaction = "/webhook/" + sentryReceiverUUID
 
 	scrubbed := server.ScrubSentryRequestForTest(event, nil)
 	require.NotNil(t, scrubbed)

templates/navbar.html

@@ -16,7 +16,7 @@
         <!-- Desktop navigation -->
         <div class="hidden md:flex items-center gap-4">
             {{if .User}}
-            <a href="/hooks" class="btn-text">Webhooks</a>
+            <a href="/sources" class="btn-text">Webhooks</a>
             <a href="/user/{{.User.Username}}" class="btn-text">
                 <svg class="w-5 h-5 mr-1" fill="currentColor" viewBox="0 0 16 16">
                     <path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/>
@@ -38,7 +38,7 @@
     <div x-show="open" x-cloak x-transition class="md:hidden mt-4 pt-4 border-t border-gray-200">
         <div class="flex flex-col gap-2">
             {{if .User}}
-            <a href="/hooks" class="btn-text w-full text-left">Webhooks</a>
+            <a href="/sources" class="btn-text w-full text-left">Webhooks</a>
             <a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a>
             <form method="POST" action="/pages/logout">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">

templates/source_detail.html

@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-6xl mx-auto px-6 py-8" x-data="{ showAddEntrypoint: false, showAddTarget: false }">
     <div class="mb-6">
-        <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
+        <a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
         <div class="flex justify-between items-center mt-2">
             <div>
                 <h1 class="text-2xl font-medium text-gray-900">{{.Webhook.Name}}</h1>
@@ -14,9 +14,9 @@
                 {{end}}
             </div>
             <div class="flex gap-2">
-                <a href="/hook/{{.Webhook.ID}}/events" class="btn-secondary">Full Event Log</a>
-                <a href="/hook/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
-                <form method="POST" action="/hook/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')">
+                <a href="/source/{{.Webhook.ID}}/logs" class="btn-secondary">Event Log</a>
+                <a href="/source/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
+                <form method="POST" action="/source/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')">
                     <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                     <button type="submit" class="btn-danger">Delete</button>
                 </form>
@@ -39,7 +39,7 @@
 
             <!-- Add entrypoint form -->
             <div x-show="showAddEntrypoint" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
-                <form method="POST" action="/hook/{{.Webhook.ID}}/entrypoints" class="flex gap-2">
+                <form method="POST" action="/source/{{.Webhook.ID}}/entrypoints" class="flex gap-2">
                     <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                     <input type="text" name="description" placeholder="Description (optional)" class="input text-sm flex-1">
                     <button type="submit" class="btn-primary text-sm">Add</button>
@@ -57,20 +57,20 @@
                             {{else}}
                             <span class="badge-error">Inactive</span>
                             {{end}}
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline">
+                            <form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
                                     {{if .Active}}Deactivate{{else}}Activate{{end}}
                                 </button>
                             </form>
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline">
+                            <form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
                             </form>
                         </div>
                     </div>
                     <div class="flex items-start gap-2 mt-1">
-                        <code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/h/{{.Path}}</code>
+                        <code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/webhook/{{.Path}}</code>
                         <!-- Hidden until app.js reveals it; without the
                              script the URL above stays selectable. -->
                         <button type="button" hidden data-copy-target="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 hover:text-primary-600">Copy</button>
@@ -98,7 +98,7 @@
 
             <!-- Add target form -->
             <div x-show="showAddTarget" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
-                <form method="POST" action="/hook/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3">
+                <form method="POST" action="/source/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3">
                     <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                     <div class="flex gap-2">
                         <input type="text" name="name" placeholder="Target name" required class="input text-sm flex-1">
@@ -151,14 +151,14 @@
                             {{else}}
                             <span class="badge-error">Inactive</span>
                             {{end}}
-                            <a href="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a>
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline">
+                            <a href="/source/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a>
+                            <form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
                                     {{if .Active}}Deactivate{{else}}Activate{{end}}
                                 </button>
                             </form>
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline">
+                            <form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
                             </form>
@@ -182,7 +182,7 @@
     <div class="card mt-6">
         <div class="p-4 border-b border-gray-200 flex justify-between items-center">
             <h2 class="text-lg font-medium text-gray-900">Recent Events</h2>
-            <a href="/hook/{{.Webhook.ID}}/events" class="btn-text text-sm">Full Event Log</a>
+            <a href="/source/{{.Webhook.ID}}/logs" class="btn-text text-sm">View All</a>
         </div>
         <div class="divide-y divide-gray-100">
             {{range .Events}}

templates/source_edit.html

@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
     <div class="mb-6">
-        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
         <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Webhook</h1>
     </div>
 
@@ -14,7 +14,7 @@
         <div class="alert-error">{{.Error}}</div>
         {{end}}
 
-        <form method="POST" action="/hook/{{.Webhook.ID}}/edit" class="space-y-6">
+        <form method="POST" action="/source/{{.Webhook.ID}}/edit" class="space-y-6">
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
                 <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@
 
             <div class="flex gap-3">
                 <button type="submit" class="btn-primary">Save Changes</button>
-                <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
+                <a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
             </div>
         </form>
     </div>

templates/source_logs.html

@@ -1,13 +1,13 @@
 {{template "base" .}}
 
-{{define "title"}}Full Event Log - {{.Webhook.Name}} - Webhooker{{end}}
+{{define "title"}}Event Log - {{.Webhook.Name}} - Webhooker{{end}}
 
 {{define "content"}}
 <div class="max-w-6xl mx-auto px-6 py-8">
     <div class="mb-6">
-        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
         <div class="flex justify-between items-center mt-2">
-            <h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>
+            <h1 class="text-2xl font-medium text-gray-900">Event Log</h1>
             <span class="text-sm text-gray-500">{{.TotalEvents}} total event{{if ne .TotalEvents 1}}s{{end}}</span>
         </div>
     </div>
@@ -55,7 +55,7 @@
                             {{if .ResubmittedFrom}}Resubmitted from event <span class="font-mono">{{.ResubmittedFromID}}</span>.{{end}}
                             {{if .ResubmitCount}}Resubmitted as {{.ResubmitCount}} new event{{if ne .ResubmitCount 1}}s{{end}}.{{end}}
                         </div>
-                        <form method="POST" action="/hook/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline">
+                        <form method="POST" action="/source/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline">
                             <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                             <input type="hidden" name="page" value="{{$.Page}}">
                             <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Submit this event again as a new event, to every currently active target">Resubmit</button>
@@ -63,7 +63,7 @@
                     </div>
                     <pre class="text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all">{{.Body}}</pre>
                     {{if .BodyTruncated}}
-                    <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/hook/{{$.Webhook.ID}}/events/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p>
+                    <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/source/{{$.Webhook.ID}}/logs/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p>
                     {{end}}
 
                     {{if .Deliveries}}
@@ -79,7 +79,7 @@
                                     </div>
                                     <div class="flex items-center gap-3">
                                         {{if .Status.Terminal}}
-                                        <form method="POST" action="/hook/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop>
+                                        <form method="POST" action="/source/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop>
                                             <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                             <input type="hidden" name="page" value="{{$.Page}}">
                                             <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Send this event to the target again">Replay</button>
@@ -139,11 +139,11 @@
     {{if or .HasPrev .HasNext}}
     <div class="flex justify-center gap-2 mt-6">
         {{if .HasPrev}}
-        <a href="/hook/{{.Webhook.ID}}/events?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a>
+        <a href="/source/{{.Webhook.ID}}/logs?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a>
         {{end}}
         <span class="inline-flex items-center px-4 py-2 text-sm text-gray-500">Page {{.Page}} of {{.TotalPages}}</span>
         {{if .HasNext}}
-        <a href="/hook/{{.Webhook.ID}}/events?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a>
+        <a href="/source/{{.Webhook.ID}}/logs?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a>
         {{end}}
     </div>
     {{end}}

templates/sources_list.html

@@ -6,7 +6,7 @@
 <div class="max-w-6xl mx-auto px-6 py-8">
     <div class="flex justify-between items-center mb-6">
         <h1 class="text-2xl font-medium text-gray-900">Webhooks</h1>
-        <a href="/hooks/new" class="btn-primary">
+        <a href="/sources/new" class="btn-primary">
             <svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                 <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
             </svg>
@@ -17,7 +17,7 @@
     {{if .Webhooks}}
     <div class="grid gap-4">
         {{range .Webhooks}}
-        <a href="/hook/{{.ID}}" class="card-elevated p-6 block">
+        <a href="/source/{{.ID}}" class="card-elevated p-6 block">
             <div class="flex justify-between items-start">
                 <div>
                     <h2 class="text-lg font-medium text-gray-900">{{.Name}}</h2>
@@ -42,7 +42,7 @@
         </svg>
         <h2 class="text-lg font-medium text-gray-900 mb-2">No webhooks yet</h2>
         <p class="text-gray-500 mb-6">Create your first webhook to start receiving and forwarding events.</p>
-        <a href="/hooks/new" class="btn-primary">Create Webhook</a>
+        <a href="/sources/new" class="btn-primary">Create Webhook</a>
     </div>
     {{end}}
 </div>

templates/sources_new.html

@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
     <div class="mb-6">
-        <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
+        <a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
         <h1 class="text-2xl font-medium text-gray-900 mt-2">Create Webhook</h1>
     </div>
 
@@ -14,7 +14,7 @@
         <div class="alert-error">{{.Error}}</div>
         {{end}}
 
-        <form method="POST" action="/hooks/new" class="space-y-6">
+        <form method="POST" action="/sources/new" class="space-y-6">
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
                 <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@
 
             <div class="flex gap-3">
                 <button type="submit" class="btn-primary">Create Webhook</button>
-                <a href="/hooks" class="btn-secondary">Cancel</a>
+                <a href="/sources" class="btn-secondary">Cancel</a>
             </div>
         </form>
     </div>

templates/target_edit.html

@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
     <div class="mb-6">
-        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
         <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Target</h1>
         <p class="text-sm text-gray-500 mt-1">Type: {{.Target.Type}}. A target's type cannot be changed; create a new target to deliver a different way.</p>
     </div>
@@ -21,7 +21,7 @@
         </div>
         {{end}}
 
-        <form method="POST" action="/hook/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6">
+        <form method="POST" action="/source/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6">
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
 
             <div class="form-group">
@@ -75,7 +75,7 @@
 
             <div class="flex gap-3">
                 <button type="submit" class="btn-primary">Save Changes</button>
-                <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
+                <a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
             </div>
         </form>
     </div>