Show each webhook's activity in the webhook list (closes #394)

Each entry in the webhook list now shows when the webhook's last event
arrived, or "No events yet", and how many of its deliveries failed in
the last 24 hours, in red when that is not zero. The entrypoint and
target counts say how many are inactive.

The figures come from the statistics pane's own reads: the event totals
row, which now also gives the event count, shown as events within
retention, instead of counting every stored event, and the pane's query
over the deliveries finished in the last 24 hours. A webhook whose event
database cannot be read says so in its entry rather than showing zeros.

Model: opus-5-5

README.md

@@ -1752,7 +1752,7 @@ retries) is individually logged for full observability.
 #### EventTotals and TargetTotals
 
 Running counts in each event database, read by the statistics pane at the
-top of the webhook page. `EventTotals` is one row:
+top of the webhook page and by the webhook list. `EventTotals` is one row:
 
 | Field            | Type      | Description |
 | ---------------- | --------- | ----------- |
@@ -1784,6 +1784,14 @@ target. Its failure percentage for a window is the deliveries that became
 `failed` in it out of all that became `delivered` or `failed` in it, and
 a dash when none did.
 
+The webhook list at `/hooks` shows three of the pane's figures for each
+webhook: its events within retention and its last event, both from
+`EventTotals`, and its deliveries that failed in the last 24 hours,
+counted with the pane's query. It opens each webhook's event database once
+(the handle stays open) and runs those two reads there, so its cost grows
+with the number of webhooks and, for each, with the deliveries that
+finished in the last 24 hours, never with the events stored.
+
 #### Event-tier indexes
 
 These indexes on the per-webhook event databases are declared in the model
@@ -1791,7 +1799,7 @@ tags, so `AutoMigrate` creates them on a fresh database:
 
 | Table              | Columns                     | Serves |
 | ------------------ | --------------------------- | ------ |
-| `deliveries`       | `status`, `deleted_at`, `finished_at`, `target_id` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics, which count each target's deliveries by status and when they finished |
+| `deliveries`       | `status`, `deleted_at`, `finished_at`, `target_id` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics and the webhook list, which count each target's deliveries by status and when they finished |
 | `deliveries`       | `event_id`, `deleted_at`    | The event log, which loads each event's deliveries, and retention, which counts and deletes the deliveries of expired events |
 | `delivery_results` | `delivery_id`, `deleted_at` | The event log, which loads the attempts of a page's deliveries, and retention, which deletes the attempts of expired events |
 | `events`           | `deleted_at`, `created_at`  | The webhook page's statistics, which count recent events |

internal/delivery/export_test.go

@@ -40,11 +40,6 @@ const (
 	ExportPendingSweepMinAge = pendingSweepMinAge
 )
 
-// ExportIsBlockedIP exposes isBlockedIP for testing.
-func ExportIsBlockedIP(ip net.IP) bool {
-	return isBlockedIP(ip)
-}
-
 // NewTestGuard builds an SSRF Guard from an explicit egress
 // allowlist, without going through config. Passing no prefixes
 // yields the default guard, which blocks every private/reserved
@@ -70,6 +65,11 @@ func ExportBlockedNetworks() []*net.IPNet {
 	return blockedNetworks
 }
 
+// ExportBlockedPublicNetworks exposes blockedPublicNetworks.
+func ExportBlockedPublicNetworks() []*net.IPNet {
+	return blockedPublicNetworks
+}
+
 // ExportIsForwardableHeader exposes isForwardableHeader.
 func ExportIsForwardableHeader(name string) bool {
 	return isForwardableHeader(name)

internal/delivery/ssrf.go

@@ -25,8 +25,16 @@ var (
 	errNoIPs      = errors.New(
 		"hostname resolved to no IP addresses",
 	)
-	errBlockedIP = errors.New(
-		"blocked private, reserved or cloud metadata address",
+	// ErrBlockedPrivateOrReservedIP reports an address in the
+	// default blocklist's private and reserved ranges,
+	// blockedNetworks.
+	ErrBlockedPrivateOrReservedIP = errors.New(
+		"blocked private or reserved address",
+	)
+	// errBlockedPublicMetadata reports a public address on the
+	// default blocklist, one in blockedPublicNetworks.
+	errBlockedPublicMetadata = errors.New(
+		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
 		"blocked link-local or cloud instance metadata " +
@@ -37,22 +45,32 @@ var (
 	)
 )
 
-// blockedNetworks is the default blocklist: the private and
-// reserved IP ranges, plus the public cloud metadata addresses,
-// that are blocked to prevent SSRF attacks. An operator can
-// permit specific blocks out of this set with
-// ALLOWED_EGRESS_CIDRS; see Guard.
+// blockedNetworks and blockedPublicNetworks together are the
+// default blocklist: the private and reserved IP ranges, plus
+// the public cloud metadata addresses, that are blocked to
+// prevent SSRF attacks. An operator can permit specific blocks
+// out of this set with ALLOWED_EGRESS_CIDRS; see Guard.
 //
-// A public address belongs on the default blocklist only if it
-// hands credentials, user data or bootstrap material to whatever
-// can reach it, without the caller presenting anything. A
-// provider's other public addresses are not refused, since
-// reaching them can be legitimate and no list of them could be
-// complete.
+// blockedNetworks holds the private and reserved IP ranges.
 //
 //nolint:gochecknoglobals // package-level network list is appropriate here
 var blockedNetworks []*net.IPNet
 
+// blockedPublicNetworks holds the default blocklist's public
+// addresses, kept apart from blockedNetworks so that they are
+// refused as cloud metadata addresses, never as private or
+// reserved ones.
+//
+// A public address belongs on the default blocklist only if it
+// hands credentials, user data or bootstrap material to whatever
+// can reach it, without the caller presenting anything; it goes
+// in this list. A provider's other public addresses are not
+// refused, since reaching them can be legitimate and no list of
+// them could be complete.
+//
+//nolint:gochecknoglobals // package-level network list is appropriate here
+var blockedPublicNetworks []*net.IPNet
+
 // alwaysBlockedNetworks are the ranges no configuration can
 // open: the link-local blocks and the cloud instance metadata
 // endpoints that live outside them. Reaching one is credential
@@ -88,8 +106,8 @@ var blockedNetworks []*net.IPNet
 // when it clears both halves. Nothing in this list can be
 // reopened, so putting a public address here leaves the operator
 // no escape hatch at all — the condition ALLOWED_EGRESS_CIDRS
-// exists to remove. Default-block it in blockedNetworks instead,
-// which an allowlist can override.
+// exists to remove. Default-block it in blockedPublicNetworks
+// instead, which an allowlist can override.
 //
 // This is a criterion, not an enumeration of every metadata
 // address in existence.
@@ -130,6 +148,9 @@ func init() {
 		"::1/128",
 		"fc00::/7",
 		"fe80::/10",
+	})
+
+	blockedPublicNetworks = mustParseCIDRs([]string{
 		// Azure WireServer, a public address that serves VM credentials.
 		"168.63.129.16/32",
 	})
@@ -225,13 +246,6 @@ func matchesAny(networks []*net.IPNet, ip net.IP) bool {
 	return false
 }
 
-// isBlockedIP checks whether an IP address falls within
-// the default blocklist, before any operator allowlist is
-// considered.
-func isBlockedIP(ip net.IP) bool {
-	return matchesAny(blockedNetworks, ip)
-}
-
 // Guard makes every SSRF decision in the process.
 //
 // It holds the operator's ALLOWED_EGRESS_CIDRS allowlist and
@@ -332,7 +346,8 @@ func (g *Guard) allows(ip net.IP) bool {
 //     consulted, so no configured CIDR reaches link-local or a
 //     cloud metadata endpoint at a non-public address.
 //  2. The allowlist is consulted next, so a listed private
-//     network becomes reachable.
+//     network, or a listed public address on the default
+//     blocklist, becomes reachable.
 //  3. Everything else keeps the default blocklist's answer.
 func (g *Guard) checkIP(ip net.IP) error {
 	if matchesAny(alwaysBlockedNetworks, ip) {
@@ -345,9 +360,15 @@ func (g *Guard) checkIP(ip net.IP) error {
 		return nil
 	}
 
-	if isBlockedIP(ip) {
+	if matchesAny(blockedNetworks, ip) {
 		return fmt.Errorf(
-			"target IP %s: %w", ip, errBlockedIP,
+			"target IP %s: %w", ip, ErrBlockedPrivateOrReservedIP,
+		)
+	}
+
+	if matchesAny(blockedPublicNetworks, ip) {
+		return fmt.Errorf(
+			"target IP %s: %w", ip, errBlockedPublicMetadata,
 		)
 	}
 

internal/delivery/ssrf_allowlist_test.go

@@ -23,6 +23,10 @@ const (
 	metadataIP  = "169.254.169.254"
 	metadataURL = "http://" + metadataIP + "/latest/meta-data/"
 
+	// linkLocalIPv4 is the IPv4 link-local block, which holds
+	// metadataIP.
+	linkLocalIPv4 = "169.254.0.0/16"
+
 	// loopbackHookURL is a target on this host: blocked by
 	// default, reachable only once an operator allowlists
 	// loopback.
@@ -237,7 +241,7 @@ func linkLocalRefusedCases() []metadataAlwaysRefusedCase {
 		},
 		{
 			name:   "whole link-local block",
-			allow:  "169.254.0.0/16",
+			allow:  linkLocalIPv4,
 			target: metadataURL,
 		},
 		{
@@ -412,6 +416,9 @@ func TestGuardAllowlist_AzureWireServerReopenable(t *testing.T) {
 		"WireServer must be refused by the default blocklist, "+
 			"which an allowlist can override",
 	)
+	require.NotErrorIs(t, err, delivery.ErrBlockedPrivateOrReservedIP,
+		"WireServer is public, not private or reserved",
+	)
 
 	assertDialRefused(t, defaultGuard, target)
 
@@ -496,7 +503,7 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 	want := []string{
 		// IPv4 link-local: the 169.254.169.254 metadata
 		// service on AWS, Azure and others.
-		"169.254.0.0/16",
+		linkLocalIPv4,
 		// IPv6 link-local.
 		"fe80::/10",
 		// AWS IPv6 IMDS, inside the ULA space an operator may
@@ -526,6 +533,90 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 	assert.Equal(t, want, got)
 }
 
+// TestDefaultBlocklist_PinnedSet pins each list of the default
+// blocklist on its own, the private and reserved ranges in
+// blockedNetworks and the public addresses in
+// blockedPublicNetworks, so moving an entry from one list to the
+// other fails it. For the first address of each entry it then
+// checks that the default guard refuses it, and that listing the
+// entry in ALLOWED_EGRESS_CIDRS opens it unless the unconditional
+// set holds that address.
+func TestDefaultBlocklist_PinnedSet(t *testing.T) {
+	t.Parallel()
+
+	// public marks an entry of blockedPublicNetworks; every other
+	// entry belongs in blockedNetworks.
+	tests := []struct {
+		cidr       string
+		public     bool
+		reopenable bool
+	}{
+		{cidr: "127.0.0.0/8", reopenable: true},
+		{cidr: "10.0.0.0/8", reopenable: true},
+		{cidr: "172.16.0.0/12", reopenable: true},
+		{cidr: "192.168.0.0/16", reopenable: true},
+		{cidr: linkLocalIPv4, reopenable: false},
+		{cidr: "0.0.0.0/8", reopenable: true},
+		{cidr: "100.64.0.0/10", reopenable: true},
+		{cidr: "192.0.0.0/24", reopenable: true},
+		{cidr: "192.0.2.0/24", reopenable: true},
+		{cidr: "198.18.0.0/15", reopenable: true},
+		{cidr: "198.51.100.0/24", reopenable: true},
+		{cidr: "203.0.113.0/24", reopenable: true},
+		{cidr: "224.0.0.0/4", reopenable: true},
+		{cidr: "240.0.0.0/4", reopenable: true},
+		{cidr: "::1/128", reopenable: true},
+		{cidr: "fc00::/7", reopenable: true},
+		{cidr: "fe80::/10", reopenable: false},
+		{cidr: "168.63.129.16/32", public: true, reopenable: true},
+	}
+
+	wantPrivate := make([]string, 0, len(tests))
+	wantPublic := make([]string, 0, len(tests))
+
+	for _, tt := range tests {
+		if tt.public {
+			wantPublic = append(wantPublic, tt.cidr)
+		} else {
+			wantPrivate = append(wantPrivate, tt.cidr)
+		}
+	}
+
+	gotPrivate := make([]string, 0, len(tests))
+	for _, n := range delivery.ExportBlockedNetworks() {
+		gotPrivate = append(gotPrivate, n.String())
+	}
+
+	gotPublic := make([]string, 0, len(tests))
+	for _, n := range delivery.ExportBlockedPublicNetworks() {
+		gotPublic = append(gotPublic, n.String())
+	}
+
+	assert.ElementsMatch(t, wantPrivate, gotPrivate, "blockedNetworks")
+	assert.ElementsMatch(t, wantPublic, gotPublic, "blockedPublicNetworks")
+
+	for _, tt := range tests {
+		t.Run(tt.cidr, func(t *testing.T) {
+			t.Parallel()
+
+			prefix := netip.MustParsePrefix(tt.cidr)
+			ip := net.IP(prefix.Addr().AsSlice())
+
+			require.Error(t,
+				delivery.NewTestGuard().ExportCheckIP(ip),
+				"the default guard must refuse %s", ip,
+			)
+
+			err := delivery.NewTestGuard(prefix).ExportCheckIP(ip)
+			if tt.reopenable {
+				assert.NoError(t, err, "listing %s must open it", tt.cidr)
+			} else {
+				assert.Error(t, err, "listing %s must not open it", tt.cidr)
+			}
+		})
+	}
+}
+
 // requireLoopback fails the test unless rawURL's host is a
 // loopback address, so the allowlist test cannot silently stop
 // exercising a blocked range.

internal/delivery/ssrf_test.go

@@ -10,7 +10,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-func TestIsBlockedIP_PrivateRanges(t *testing.T) {
+func TestGuardCheckIP_PrivateRanges(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -56,12 +56,14 @@ func TestIsBlockedIP_PrivateRanges(t *testing.T) {
 				"failed to parse IP %s", tt.ip,
 			)
 
+			refused := delivery.NewTestGuard().ExportCheckIP(ip) != nil
+
 			assert.Equal(t,
 				tt.blocked,
-				delivery.ExportIsBlockedIP(ip),
-				"isBlockedIP(%s) = %v, want %v",
+				refused,
+				"default guard refuses %s = %v, want %v",
 				tt.ip,
-				delivery.ExportIsBlockedIP(ip),
+				refused,
 				tt.blocked,
 			)
 		})

internal/handlers/source_list_test.go

@@ -0,0 +1,317 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// failedHighlight is how the list marks a number of failed deliveries
+// that is not zero.
+const failedHighlight = `class="font-medium text-red-600"`
+
+// listWebhook adds a webhook with the given name, owned by the test
+// user.
+func listWebhook(
+	t *testing.T, db *database.Database, name string,
+) *database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{UserID: deleteTestUserID, Name: name}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	return wh
+}
+
+// renderWebhookList runs the real webhook list handler as the test user
+// and returns the rendered page.
+func renderWebhookList(
+	t *testing.T, h *handlers.Handlers, sess *session.Session,
+) string {
+	t.Helper()
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	w := httptest.NewRecorder()
+	h.HandleSourceList().ServeHTTP(
+		w, getRequest(t, "/hooks", cookies, nil),
+	)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	return w.Body.String()
+}
+
+// listCard returns one webhook's entry in a rendered webhook list, its
+// markup as rendered and its text with the markup taken out and each
+// run of space made one space.
+func listCard(t *testing.T, page, webhookID string) (string, string) {
+	t.Helper()
+
+	_, card, found := strings.Cut(page, `href="/hook/`+webhookID+`"`)
+	require.True(t, found, "the list has no entry for %s", webhookID)
+
+	card, _, _ = strings.Cut(card, "</a>")
+	text := regexp.MustCompile(`<[^>]*>`).ReplaceAllString(card, " ")
+
+	return card, strings.Join(strings.Fields(text), " ")
+}
+
+// receiveEvents posts the given number of events to an entrypoint
+// through the real receiver, and returns the webhook's event database
+// and its events, oldest first.
+func receiveEvents(
+	t *testing.T,
+	h *handlers.Handlers,
+	dbMgr *database.WebhookDBManager,
+	webhookID, path string,
+	count int,
+) (*gorm.DB, []database.Event) {
+	t.Helper()
+
+	router := receiverRouter(h)
+
+	for range count {
+		require.Equal(t, http.StatusOK, postReceiver(t, router, path))
+	}
+
+	webhookDB, err := dbMgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	events := listEvents(t, webhookDB)
+	require.Len(t, events, count)
+
+	return webhookDB, events
+}
+
+// seedFailingWebhook adds a webhook with two entrypoints, one inactive,
+// and four targets, one inactive. Three events each reach the three
+// active targets. Two deliveries failed in the last 24 hours, one 30
+// hours ago, and one was delivered. It returns the webhook and its
+// newest event.
+func seedFailingWebhook(
+	t *testing.T,
+	h *handlers.Handlers,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+) (*database.Webhook, database.Event) {
+	t.Helper()
+
+	wh := listWebhook(t, db, "failing")
+	path := statsEntrypoint(t, db, wh.ID, true)
+
+	statsEntrypoint(t, db, wh.ID, false)
+
+	first := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+	second := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	inactive := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+	require.NoError(t, db.DB().Model(inactive).
+		Update("active", false).Error)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, path, 3)
+	now := time.Now()
+
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[0].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-30*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[1].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[2].ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Minute))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, events[2].ID, second.ID),
+		database.DeliveryStatusDelivered, now.Add(-time.Minute))
+
+	return wh, events[2]
+}
+
+// seedHealthyWebhook adds a webhook with one entrypoint and one target,
+// both active, and two events, both delivered. It returns the webhook
+// and its newest event.
+func seedHealthyWebhook(
+	t *testing.T,
+	h *handlers.Handlers,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+) (*database.Webhook, database.Event) {
+	t.Helper()
+
+	wh := listWebhook(t, db, "healthy")
+	path := statsEntrypoint(t, db, wh.ID, true)
+	target := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, path, 2)
+
+	for _, ev := range events {
+		statsFinish(t, webhookDB,
+			statsDelivery(t, webhookDB, ev.ID, target.ID),
+			database.DeliveryStatusDelivered, time.Now())
+	}
+
+	return wh, events[1]
+}
+
+// lastEventText is how the list shows the arrival of an event.
+func lastEventText(ev database.Event) string {
+	return ev.CreatedAt.UTC().Format("2006-01-02 15:04:05 UTC")
+}
+
+// TestSourceList_ShowsActivityOfEachWebhook checks the figures the list
+// shows for a webhook with recent failures, a healthy one, a new one
+// that has received no event, and one without an event database.
+func TestSourceList_ShowsActivityOfEachWebhook(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	failing, failingNewest := seedFailingWebhook(t, h, db, dbMgr)
+	healthy, healthyNewest := seedHealthyWebhook(t, h, db, dbMgr)
+
+	// Creating a webhook creates its event database.
+	fresh := listWebhook(t, db, "fresh")
+	require.NoError(t, dbMgr.CreateDB(fresh.ID))
+
+	quiet := listWebhook(t, db, "quiet")
+
+	page := renderWebhookList(t, h, sess)
+
+	card, text := listCard(t, page, failing.ID)
+	assert.Contains(t, text, "2 entrypoints, 1 inactive "+
+		"4 targets, 1 inactive "+
+		"3 events within retention "+
+		"Last event "+lastEventText(failingNewest)+" "+
+		"2 failed deliveries in the last 24 hours")
+	assert.Contains(t, card,
+		failedHighlight+">2 failed deliveries in the last 24 hours<")
+
+	card, text = listCard(t, page, healthy.ID)
+	assert.Contains(t, text, "1 entrypoint "+
+		"1 target "+
+		"2 events within retention "+
+		"Last event "+lastEventText(healthyNewest)+" "+
+		"0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, text, "inactive")
+	assert.NotContains(t, card, failedHighlight)
+
+	card, text = listCard(t, page, fresh.ID)
+	assert.Contains(t, text, "0 entrypoints "+
+		"0 targets "+
+		"0 events within retention "+
+		"No events yet "+
+		"0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, card, failedHighlight)
+
+	card, text = listCard(t, page, quiet.ID)
+	assert.Contains(t, text, "0 entrypoints "+
+		"0 targets "+
+		"0 events within retention "+
+		"No events yet "+
+		"0 failed deliveries in the last 24 hours")
+	assert.NotContains(t, card, failedHighlight)
+	assert.False(t, dbMgr.DBExists(quiet.ID),
+		"showing the list must not create an event database")
+}
+
+// TestSourceList_CountsOnlyEventsWithinRetention checks that once
+// retention has removed one of a webhook's three events, the list
+// counts the two still stored.
+func TestSourceList_CountsOnlyEventsWithinRetention(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+		log   *logger.Logger
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &log)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID, Name: "pruned", RetentionDays: 14,
+	}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	path := statsEntrypoint(t, db, wh.ID, true)
+	webhookDB, events := receiveEvents(t, h, dbMgr, wh.ID, path, 3)
+
+	statsAge(t, webhookDB, events[0].ID, time.Now().Add(-15*24*time.Hour))
+	statsPrune(t, db, dbMgr, log, webhookDB)
+	require.Len(t, listEvents(t, webhookDB), 2)
+
+	_, text := listCard(t, renderWebhookList(t, h, sess), wh.ID)
+	assert.Contains(t, text,
+		"1 entrypoint 0 targets 2 events within retention")
+}
+
+// TestSourceList_UnreadableEventDatabase checks that a webhook whose
+// event database cannot be read says so in its entry instead of
+// showing zeros, and that the rest of the list is still shown.
+func TestSourceList_UnreadableEventDatabase(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	broken := listWebhook(t, db, "broken")
+	statsEntrypoint(t, db, broken.ID, true)
+
+	brokenDB, err := dbMgr.GetDB(broken.ID)
+	require.NoError(t, err)
+	require.NoError(t,
+		brokenDB.Migrator().DropTable(&database.EventTotals{}))
+
+	quiet := listWebhook(t, db, "quiet")
+
+	page := renderWebhookList(t, h, sess)
+
+	_, text := listCard(t, page, broken.ID)
+	assert.Contains(t, text,
+		"1 entrypoint 0 targets The event figures could not be read.")
+	assert.NotContains(t, text, "events")
+	assert.NotContains(t, text, "failed")
+
+	_, text = listCard(t, page, quiet.ID)
+	assert.Contains(t, text, "No events yet")
+}

internal/handlers/source_management.go

@@ -3,10 +3,12 @@ package handlers
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -20,9 +22,20 @@ import (
 type WebhookListItem struct {
 	database.Webhook
 
-	EntrypointCount int64
-	TargetCount     int64
-	EventCount      int64
+	EntrypointCount         int
+	InactiveEntrypointCount int
+	TargetCount             int
+	InactiveTargetCount     int
+
+	// EventCount is how many events the webhook holds, LastEventAt
+	// when the newest arrived (nil before the first), and
+	// FailedLast24Hours how many of its deliveries failed in the last
+	// 24 hours. When the webhook's event database could not be read,
+	// EventsUnreadable is set and these three are not known.
+	EventCount        int64
+	LastEventAt       *time.Time
+	FailedLast24Hours int64
+	EventsUnreadable  bool
 }
 
 // errMissingURL signals that a required URL was not provided.
@@ -160,7 +173,18 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 			return
 		}
 
-		items := h.buildWebhookListItems(webhooks)
+		items, err := h.buildWebhookListItems(webhooks)
+		if err != nil {
+			h.log.Error(
+				"failed to list webhooks", "error", err,
+			)
+			http.Error(
+				w, "Internal server error",
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
 
 		data := map[string]any{
 			"Webhooks": items,
@@ -170,36 +194,115 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 	}
 }
 
-// buildWebhookListItems builds list items with counts.
+// buildWebhookListItems builds the list's entry for each webhook. It
+// fails when the main database cannot be read. A webhook whose event
+// database cannot be read is marked on its own entry, and the error is
+// logged.
 func (h *Handlers) buildWebhookListItems(
 	webhooks []database.Webhook,
-) []WebhookListItem {
+) ([]WebhookListItem, error) {
 	items := make([]WebhookListItem, len(webhooks))
+	since := time.Now().Add(-longWindow)
 
 	for i := range webhooks {
-		items[i].Webhook = webhooks[i]
+		item := &items[i]
+		item.Webhook = webhooks[i]
 
-		h.db.DB().Model(&database.Entrypoint{}).Where(
-			"webhook_id = ?", webhooks[i].ID,
-		).Count(&items[i].EntrypointCount)
+		var err error
 
-		h.db.DB().Model(&database.Target{}).Where(
-			"webhook_id = ?", webhooks[i].ID,
-		).Count(&items[i].TargetCount)
+		item.EntrypointCount, item.InactiveEntrypointCount, err =
+			h.countWithInactive(&database.Entrypoint{}, item.ID)
+		if err != nil {
+			return nil, err
+		}
 
-		if h.dbMgr.DBExists(webhooks[i].ID) {
-			webhookDB, err := h.dbMgr.GetDB(
-				webhooks[i].ID,
+		item.TargetCount, item.InactiveTargetCount, err =
+			h.countWithInactive(&database.Target{}, item.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		// Opening an event database that does not exist would create
+		// it, and it would hold nothing to count.
+		if !h.dbMgr.DBExists(item.ID) {
+			continue
+		}
+
+		err = h.readListEventFigures(item, since)
+		if err != nil {
+			h.log.Error(
+				"failed to read webhook list figures",
+				"webhook_id", item.ID,
+				"error", err,
 			)
-			if err == nil {
-				webhookDB.Model(
-					&database.Event{},
-				).Count(&items[i].EventCount)
-			}
+
+			item.EventsUnreadable = true
 		}
 	}
 
-	return items
+	return items, nil
+}
+
+// countWithInactive returns how many entrypoints or targets, as model
+// says, a webhook has, and how many of them are inactive.
+func (h *Handlers) countWithInactive(
+	model any, webhookID string,
+) (int, int, error) {
+	var active []bool
+
+	err := h.db.DB().Model(model).
+		Where("webhook_id = ?", webhookID).
+		Pluck("active", &active).Error
+	if err != nil {
+		return 0, 0, fmt.Errorf(
+			"reading active flags of webhook %s: %w", webhookID, err,
+		)
+	}
+
+	inactive := 0
+
+	for _, a := range active {
+		if !a {
+			inactive++
+		}
+	}
+
+	return len(active), inactive, nil
+}
+
+// readListEventFigures fills in the figures the list shows from the
+// webhook's event database, with the statistics pane's own queries:
+// the event count and last arrival from the event totals row, and the
+// deliveries that failed since the given time from the deliveries'
+// status index.
+func (h *Handlers) readListEventFigures(
+	item *WebhookListItem, since time.Time,
+) error {
+	webhookDB, err := h.dbMgr.GetDB(item.ID)
+	if err != nil {
+		return err
+	}
+
+	var totals database.EventTotals
+
+	err = webhookDB.Take(&totals).Error
+	if err != nil {
+		return fmt.Errorf("reading event totals: %w", err)
+	}
+
+	item.EventCount = totals.Events - totals.EventsRemoved
+	item.LastEventAt = totals.LastEventAt
+
+	byTarget, err := finishedByTarget(webhookDB, since)
+	if err != nil {
+		return err
+	}
+
+	for _, f := range byTarget {
+		item.FailedLast24Hours += f.Failed
+	}
+
+	return nil
 }
 
 // HandleSourceCreate shows the form to create a new webhook.
@@ -1578,11 +1681,22 @@ func (h *Handlers) validateTargetURL(
 			"url", delivery.MaskURL(targetURL),
 			"error", err,
 		)
-		http.Error(
-			w,
-			"Invalid target URL: "+err.Error(),
-			http.StatusBadRequest,
-		)
+
+		msg := "Invalid target URL: " + err.Error()
+
+		// Only a private or reserved address's refusal says how
+		// to allow it. Metadata refusals never do: link-local and
+		// the other unconditional metadata addresses cannot be
+		// opened, and the default blocklist's public addresses,
+		// which listing does open, hand out credentials.
+		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
+			msg += ". Private and reserved addresses are refused " +
+				"by default; the server's ALLOWED_EGRESS_CIDRS " +
+				"setting allows named networks (see \"Allowing " +
+				"egress to your own network\" in the README)."
+		}
+
+		http.Error(w, msg, http.StatusBadRequest)
 
 		return err
 	}

internal/handlers/target_private_refusal_test.go

@@ -0,0 +1,116 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// privateRefusalHint is the sentence that tells an operator a private
+// destination is refused on purpose, and how to allow one.
+const privateRefusalHint = "Private and reserved addresses are " +
+	"refused by default; the server's ALLOWED_EGRESS_CIDRS setting " +
+	"allows named networks (see \"Allowing egress to your own " +
+	"network\" in the README)."
+
+// TestTargetRefusal_PrivateDestinationSaysHowToAllowIt covers both
+// target types that take a URL, on add and on edit.
+func TestTargetRefusal_PrivateDestinationSaysHowToAllowIt(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	targetTypes := []database.TargetType{
+		database.TargetTypeHTTP,
+		database.TargetTypeSlack,
+	}
+
+	for _, targetType := range targetTypes {
+		t.Run(string(targetType), func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+			targetsPath := "/hook/" + webhook.ID + "/targets"
+
+			form := url.Values{}
+			form.Set("name", "private")
+			form.Set("type", string(targetType))
+			form.Set("url", editBlockedURL)
+
+			added := serveTarget(
+				env, http.MethodPost, targetsPath, form,
+			)
+			assert.Equal(t, http.StatusBadRequest, added.Code)
+			assert.Contains(
+				t, added.Body.String(), privateRefusalHint,
+			)
+
+			form.Set("url", editOriginalURL)
+
+			created := serveTarget(
+				env, http.MethodPost, targetsPath, form,
+			)
+			require.Equal(
+				t, http.StatusSeeOther, created.Code,
+				created.Body.String(),
+			)
+
+			targets := targetsForWebhook(t, env.db, webhook.ID)
+			require.Len(t, targets, 1)
+
+			form.Set("url", editBlockedURL)
+
+			edited := submitTargetEdit(
+				env, webhook.ID, targets[0].ID, form,
+			)
+			assert.Equal(t, http.StatusBadRequest, edited.Code)
+			assert.Contains(
+				t, edited.Body.String(), privateRefusalHint,
+			)
+		})
+	}
+}
+
+// TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt: no
+// setting opens a link-local address, and Azure's WireServer hands out
+// VM credentials, so neither refusal points at the setting.
+func TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	metadataURLs := map[string]string{
+		"link-local": "http://169.254.169.254/latest/meta-data/",
+		"wireserver": "http://168.63.129.16/?comp=versions",
+	}
+
+	for name, metadataURL := range metadataURLs {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+
+			form := url.Values{}
+			form.Set("name", "metadata")
+			form.Set("type", string(database.TargetTypeHTTP))
+			form.Set("url", metadataURL)
+
+			w := serveTarget(
+				env, http.MethodPost,
+				"/hook/"+webhook.ID+"/targets", form,
+			)
+			assert.Equal(t, http.StatusBadRequest, w.Code)
+			assert.NotContains(
+				t, w.Body.String(), privateRefusalHint,
+			)
+		})
+	}
+}

templates/sources_list.html

@@ -27,10 +27,16 @@
                 </div>
                 <span class="badge-info">Retention: {{.RetentionLabel}}</span>
             </div>
-            <div class="flex gap-6 mt-4 text-sm text-gray-500">
-                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>
-                <span>{{.TargetCount}} target{{if ne .TargetCount 1}}s{{end}}</span>
-                <span>{{.EventCount}} event{{if ne .EventCount 1}}s{{end}}</span>
+            <div class="flex flex-wrap gap-6 mt-4 text-sm text-gray-500">
+                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}{{if .InactiveEntrypointCount}}, {{.InactiveEntrypointCount}} inactive{{end}}</span>
+                <span>{{.TargetCount}} target{{if ne .TargetCount 1}}s{{end}}{{if .InactiveTargetCount}}, {{.InactiveTargetCount}} inactive{{end}}</span>
+                {{if .EventsUnreadable}}
+                <span class="text-red-600">The event figures could not be read.</span>
+                {{else}}
+                <span>{{.EventCount}} event{{if ne .EventCount 1}}s{{end}} within retention</span>
+                <span>{{with .LastEventAt}}Last event {{.UTC.Format "2006-01-02 15:04:05 UTC"}}{{else}}No events yet{{end}}</span>
+                <span class="{{if .FailedLast24Hours}}font-medium text-red-600{{end}}">{{.FailedLast24Hours}} failed deliver{{if eq .FailedLast24Hours 1}}y{{else}}ies{{end}} in the last 24 hours</span>
+                {{end}}
             </div>
         </a>
         {{end}}