sneak/webhooker
1
0
Fork 0
Code Issues 92 Pull Requests 10 Actions 34 Packages Projects Releases Wiki Activity

Compare commits

merge into: sneak/webhooker:issue-382-error-pages
Branches Tags
sneak/webhooker:main sneak/webhooker:next sneak/webhooker:issue-368-webhook-stats sneak/webhooker:issue-367-hook-routes sneak/webhooker:issue-414-quiet-test-output sneak/webhooker:issue-382-error-pages sneak/webhooker:issue-384-login-returns sneak/webhooker:issue-402-settings-page sneak/webhooker:issue-398-private-target-hint sneak/webhooker:issue-227-own-metrics-registry sneak/webhooker:issue-371-alpine-csp-build sneak/webhooker:issue-366-version-from-git sneak/webhooker:prod sneak/webhooker:issue-70-log-target
..
pull from: sneak/webhooker:issue-367-hook-routes
Branches Tags
sneak/webhooker:next sneak/webhooker:issue-368-webhook-stats sneak/webhooker:issue-367-hook-routes sneak/webhooker:issue-414-quiet-test-output sneak/webhooker:issue-382-error-pages sneak/webhooker:issue-384-login-returns sneak/webhooker:issue-402-settings-page sneak/webhooker:issue-398-private-target-hint sneak/webhooker:issue-227-own-metrics-registry sneak/webhooker:issue-371-alpine-csp-build sneak/webhooker:issue-366-version-from-git sneak/webhooker:prod sneak/webhooker:main sneak/webhooker:issue-70-log-target
1 Commits
issue-382-error-pages .. issue-367-hook-routes
Author SHA1 Message Date
clawbot e7306684a6 Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)
check / check (push) Waiting to run
Details 
The webhook page and everything under it move from /source/ID to
/hook/ID, the list and new-webhook form to /hooks and /hooks/new, and
the event log from .../logs to /hook/ID/events, body download
included. Entrypoint URLs move from /webhook/UUID to /h/UUID, and the
webhook page shows only that form. The old paths are gone.

Links, redirects, form actions, tests, comments and the README follow.
Both links to the event log page, and its title and heading, now read
"Full Event Log". Go identifiers and template file names are
unchanged. Route tests reach every moved page and form through the
production router, taking each URL and token from the rendered page.

Model: opus-5-5
 2026-10-02 00:41:14 +00:00
60 changed files with 794 additions and 930 deletions
Expand all files Collapse all files
README.md
+38 -44
View File
@@ -7,7 +7,7 @@ services, durably stores them, and delivers them to configured targets
with retry support, logging, and observability. Category: infrastructure with retry support, logging, and observability. Category: infrastructure
/ web service. License: MIT. / web service. License: MIT.
Each entrypoint is a version 4 UUID served at `/webhook/{uuid}`, and Each entrypoint is a version 4 UUID served at `/h/{uuid}`, and
that UUID is the entrypoint's only credential. webhooker does not use that UUID is the entrypoint's only credential. webhooker does not use
shared secrets, HMAC signatures or token headers on the receiver, and shared secrets, HMAC signatures or token headers on the receiver, and
will not add them — read will not add them — read
@@ -1188,7 +1188,7 @@ backups at rest and restrict who can read them.
**The entrypoint UUID is the credential, and it is the only one.** **The entrypoint UUID is the credential, and it is the only one.**
webhooker mints a version 4 UUID per entrypoint and serves it at webhooker mints a version 4 UUID per entrypoint and serves it at
`/webhook/{uuid}`. Possession of that URL is the authentication: `/h/{uuid}`. Possession of that URL is the authentication:
anyone who holds it can submit events to the entrypoint, and the anyone who holds it can submit events to the entrypoint, and the
receiver verifies nothing else about the sender. receiver verifies nothing else about the sender.
@@ -1523,7 +1523,7 @@ the full request and creates an Event.
| -------------- | ------- | ----------- | | -------------- | ------- | ----------- |
| `id` | UUID | Primary key | | `id` | UUID | Primary key |
| `webhook_id` | UUID | Foreign key → Webhook | | `webhook_id` | UUID | Foreign key → Webhook |
| `path` | string | Unique bare UUID, generated at creation. The `/webhook/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) | | `path` | string | Unique bare UUID, generated at creation. The `/h/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) |
| `description` | string | Optional description | | `description` | string | Optional description |
| `active` | boolean | Whether this entrypoint accepts events (default: true) | | `active` | boolean | Whether this entrypoint accepts events (default: true) |
@@ -1905,7 +1905,7 @@ runtime, though CGO is required at build time due to the transitive
``` ```
External Service External Service
│ │
│ POST /webhook/{uuid} │ POST /h/{uuid}
▼ ▼
┌─────────────┐ ┌──────────────┐ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ ┌──────────────┐
│ chi Router │────►│ Middleware │────►│ Webhook │ │ chi Router │────►│ Middleware │────►│ Webhook │
@@ -2131,7 +2131,7 @@ The middleware records three more on the same registry:
Two of those labels are written once per request from bytes the client Two of those labels are written once per request from bytes the client
chose, so both are bounded to something this service registers: chose, so both are bounded to something this service registers:
- `handler` is the chi route pattern — `/webhook/{uuid}`, never the - `handler` is the chi route pattern — `/h/{uuid}`, never the
concrete path. A request matching no route carries `(unmatched)`, concrete path. A request matching no route carries `(unmatched)`,
and no entrypoint UUID ever reaches a label. and no entrypoint UUID ever reaches a label.
- `method` is the request method when the router can route it, and - `method` is the request method when the router can route it, and
@@ -2161,7 +2161,7 @@ unpredictable rates, and blanket limits shared with other routes would
cause legitimate deliveries to be dropped. cause legitimate deliveries to be dropped.
The receiver instead has its own dedicated abuse limit, scoped to the The receiver instead has its own dedicated abuse limit, scoped to the
`/webhook/{uuid}` route only and keyed per client IP per request path `/h/{uuid}` route only and keyed per client IP per request path
(`httprate.KeyByEndpoint`): one misbehaving sender is throttled without (`httprate.KeyByEndpoint`): one misbehaving sender is throttled without
affecting other senders of the same entrypoint or the same sender's affecting other senders of the same entrypoint or the same sender's
other entrypoints. Keying on the path rather than on the entrypoint other entrypoints. Keying on the path rather than on the entrypoint
@@ -2198,7 +2198,7 @@ log spends. The access log is bounded by neither limit: every request
is recorded once at `INFO`, served or rejected alike. is recorded once at `INFO`, served or rejected alike.
What the access log does bound is the _content_ of those lines. A 3xx What the access log does bound is the _content_ of those lines. A 3xx
or 4xx response logs the chi route pattern — `/webhook/{uuid}`, or 4xx response logs the chi route pattern — `/h/{uuid}`,
`/user/{username}//`, or the literal `(unmatched)` when the request hit `/user/{username}//`, or the literal `(unmatched)` when the request hit
no route at all — in place of the concrete URL. Those are the outcomes no route at all — in place of the concrete URL. Those are the outcomes
an unauthenticated client can drive for free: 404 and 429 on any an unauthenticated client can drive for free: 404 and 429 on any
@@ -2232,12 +2232,12 @@ reduces the headers to a fixed allowlist — `Accept`, `Content-Length`,
The same hook rewrites the request URL. The SDK builds it as The same hook rewrites the request URL. The SDK builds it as
`scheme://host/path` from the concrete path, which on the receiver `scheme://host/path` from the concrete path, which on the receiver
route is `/webhook/<uuid>` in full — and that UUID is a write route is `/h/<uuid>` in full — and that UUID is a write
capability, not an identifier: anyone holding it can post events this capability, not an identifier: anyone holding it can post events this
service accepts and its targets then deliver. A tracker has its own service accepts and its targets then deliver. A tracker has its own
retention, access control and deletion policy, so the rule the access retention, access control and deletion policy, so the rule the access
log follows above does not carry across that boundary. What is sent is log follows above does not carry across that boundary. What is sent is
the chi route pattern instead: `http://host/webhook/{uuid}`. the chi route pattern instead: `http://host/h/{uuid}`.
The scheme and the host are kept, and everything else in the URL is The scheme and the host are kept, and everything else in the URL is
discarded rather than edited, so a future SDK version that starts discarded rather than edited, so a future SDK version that starts
@@ -2281,8 +2281,8 @@ fallback is never the concrete path. The path becomes the literal
rewrite cannot parse into a scheme is withheld whole. A transaction rewrite cannot parse into a scheme is withheld whole. A transaction
event additionally carries the SDK's own `METHOD /path` name, built event additionally carries the SDK's own `METHOD /path` name, built
from the concrete path as well; it is rewritten on the same terms, to from the concrete path as well; it is rewritten on the same terms, to
`POST /webhook/{uuid}` where the pattern is known and `POST `POST /h/{uuid}` where the pattern is known and `POST /(redacted)`
/(redacted)` where it is not. where it is not.
The headers are an allowlist for the same reason the rules above are The headers are an allowlist for the same reason the rules above are
unconditional: the SDK's own filter removes four names and passes unconditional: the SDK's own filter removes four names and passes
@@ -2417,7 +2417,7 @@ logger printed the fully interpolated SQL — parameters and all — to
standard output on every statement that returned an error, including a standard output on every statement that returned an error, including a
plain record-not-found, at a level no operator setting reached. Two of plain record-not-found, at a level no operator setting reached. Two of
this service's lookups miss by design on unauthenticated routes: the this service's lookups miss by design on unauthenticated routes: the
entrypoint lookup behind `/webhook/{uuid}` and the user lookup behind entrypoint lookup behind `/h/{uuid}` and the user lookup behind
the login form, whose path segment and submitted username the client the login form, whose path segment and submitted username the client
picks outright. Every picks outright. Every
`gorm.Open` in the service now installs the adapter in `gorm.Open` in the service now installs the adapter in
@@ -2694,10 +2694,10 @@ abuse limit later; they are tracked as future work.
| Method | Path | Description | | Method | Path | Description |
| ------ | --------------------------- | ----------- | | ------ | --------------------------- | ----------- |
| `GET` | `/` | Root redirect, 303 (authenticated → `/sources`, unauthenticated → `/pages/login`) | | `GET` | `/` | Root redirect, 303 (authenticated → `/hooks`, unauthenticated → `/pages/login`) |
| `GET` | `/.well-known/healthcheck` | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) | | `GET` | `/.well-known/healthcheck` | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) |
| `GET`, `HEAD` | `/s/*` | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` | | `GET`, `HEAD` | `/s/*` | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` |
| `POST` | `/webhook/{uuid}` | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) | | `POST` | `/h/{uuid}` | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |
#### Authentication Endpoints #### Authentication Endpoints
@@ -2713,25 +2713,25 @@ abuse limit later; they are tracked as future work.
| ------ | ------------------------ | ----------- | | ------ | ------------------------ | ----------- |
| `GET` | `/user/{username}` | User profile page | | `GET` | `/user/{username}` | User profile page |
| `POST` | `/user/{username}/password` | Change the user's password (5 per minute per bucket, then `429`; `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one) | | `POST` | `/user/{username}/password` | Change the user's password (5 per minute per bucket, then `429`; `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one) |
| `GET` | `/sources` | List user's webhooks | | `GET` | `/hooks` | List user's webhooks |
| `GET` | `/sources/new` | Create webhook form | | `GET` | `/hooks/new` | Create webhook form |
| `POST` | `/sources/new` | Create webhook submission | | `POST` | `/hooks/new` | Create webhook submission |
| `GET` | `/source/{id}` | Webhook detail view | | `GET` | `/hook/{id}` | Webhook detail view |
| `GET` | `/source/{id}/edit` | Edit webhook form | | `GET` | `/hook/{id}/edit` | Edit webhook form |
| `POST` | `/source/{id}/edit` | Edit webhook submission | | `POST` | `/hook/{id}/edit` | Edit webhook submission |
| `POST` | `/source/{id}/delete` | Delete webhook | | `POST` | `/hook/{id}/delete` | Delete webhook |
| `GET` | `/source/{id}/logs` | Webhook event logs | | `GET` | `/hook/{id}/events` | Full Event Log |
| `GET` | `/source/{id}/logs/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated | | `GET` | `/hook/{id}/events/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
| `POST` | `/source/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) | | `POST` | `/hook/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
| `POST` | `/source/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) | | `POST` | `/hook/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
| `POST` | `/source/{id}/entrypoints` | Add entrypoint to webhook | | `POST` | `/hook/{id}/entrypoints` | Add entrypoint to webhook |
| `POST` | `/source/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint | | `POST` | `/hook/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
| `POST` | `/source/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint | | `POST` | `/hook/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
| `POST` | `/source/{id}/targets` | Add target to webhook | | `POST` | `/hook/{id}/targets` | Add target to webhook |
| `GET` | `/source/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked | | `GET` | `/hook/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
| `POST` | `/source/{id}/targets/{targetID}/edit` | Edit target submission | | `POST` | `/hook/{id}/targets/{targetID}/edit` | Edit target submission |
| `POST` | `/source/{id}/targets/{targetID}/delete` | Delete a target | | `POST` | `/hook/{id}/targets/{targetID}/delete` | Delete a target |
| `POST` | `/source/{id}/targets/{targetID}/toggle` | Enable or disable a target | | `POST` | `/hook/{id}/targets/{targetID}/toggle` | Enable or disable a target |
#### Infrastructure Endpoints #### Infrastructure Endpoints
@@ -2932,14 +2932,8 @@ local record instead of nothing. What that placement gives up is
recovery of a panic in the six entries above it, none of which does recovery of a panic in the six entries above it, none of which does
more than set a header or start a timer. more than set a header or start a timer.
Each admin page route group (`/pages`, `/user/*`, `/sources`, Additionally, form endpoints (`/pages`, `/user/*`, `/hooks`,
`/source/*`) starts with its own **Recoverer** and, if `SENTRY_DSN` is `/hook/*`) apply a **MaxBodySize** middleware that limits
set, its own **Sentry** error reporting. That Recoverer answers a panic
with the `500` error page in the normal layout; the global one keeps
the plain-text `500` for every other route.
Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
`/source/*`) apply a **MaxBodySize** middleware that limits
POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the
CSRF middleware in every one of those route groups, because CSRF middleware in every one of those route groups, because
gorilla/csrf parses the form; if the cap were installed after it, form gorilla/csrf parses the form; if the cap were installed after it, form
@@ -2963,7 +2957,7 @@ Those same four route groups then apply **CSRF** and **NoCache**
`/pages` applies **RequireAuth**. The rate limiters are per-route `/pages` applies **RequireAuth**. The rate limiters are per-route
rather than global: **PasswordChangeRateLimit** on rather than global: **PasswordChangeRateLimit** on
`/user/{username}/password` and **ReceiverRateLimit** on `/user/{username}/password` and **ReceiverRateLimit** on
`/webhook/{uuid}`. There is deliberately none on `/pages/login` — that `/h/{uuid}`. There is deliberately none on `/pages/login` — that
endpoint counts failures inside the handler, after the credential endpoint counts failures inside the handler, after the credential
check, see [The login endpoint](#the-login-endpoint). check, see [The login endpoint](#the-login-endpoint).
@@ -3004,8 +2998,8 @@ check, see [The login endpoint](#the-login-endpoint).
by middleware that runs before CSRF parses the form by middleware that runs before CSRF parses the form
- **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf) - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf)
on all state-changing forms (cookie-based double-submit tokens with on all state-changing forms (cookie-based double-submit tokens with
HMAC authentication). Applied to `/pages`, `/sources`, `/source`, and HMAC authentication). Applied to `/pages`, `/hooks`, `/hook`, and
`/user` routes. Excluded from `/webhook` (inbound webhook POSTs) and `/user` routes. Excluded from `/h` (inbound webhook POSTs) and
`/api` (stateless API). The middleware detects TLS per-request through `/api` (stateless API). The middleware detects TLS per-request through
`internal/reqtls.IsTLS` — the same predicate the session cookie uses — `internal/reqtls.IsTLS` — the same predicate the session cookie uses —
to set appropriate cookie security flags and Origin/Referer validation to set appropriate cookie security flags and Origin/Referer validation
internal/gormlog/gormlog.go
+1 -1
View File
@@ -7,7 +7,7 @@
// SQL — parameters and all — for every statement that returns an // SQL — parameters and all — for every statement that returns an
// error, including gorm.ErrRecordNotFound. Two of this service's // error, including gorm.ErrRecordNotFound. Two of this service's
// lookups miss by design on unauthenticated routes: the entrypoint // lookups miss by design on unauthenticated routes: the entrypoint
// lookup on /webhook/{uuid}, whose path segment the client picks // lookup on /h/{uuid}, whose path segment the client picks
// outright, and the user lookup behind the login form, whose username // outright, and the user lookup behind the login form, whose username
// the client picks outright. Under the default logger each of those // the client picks outright. Under the default logger each of those
// misses printed an unbounded, attacker-chosen string, at no level the // misses printed an unbounded, attacker-chosen string, at no level the
internal/handlers/auth.go
+23 -5
View File
@@ -36,7 +36,7 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.log.Error("failed to parse form", "error", err) h.log.Error("failed to parse form", "error", err)
h.renderError(w, r, http.StatusBadRequest) http.Error(w, "Bad request", http.StatusBadRequest)
return return
} }
@@ -166,7 +166,11 @@ func (h *Handlers) authenticateUser(
valid, err := database.VerifyPassword(password, user.Password) valid, err := database.VerifyPassword(password, user.Password)
if err != nil { if err != nil {
h.serverError(w, r, "failed to verify password", err) h.log.Error("failed to verify password", "error", err)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return user, err return user, err
} }
@@ -238,14 +242,24 @@ func (h *Handlers) createAuthenticatedSession(
) error { ) error {
oldSess, err := h.session.Get(r) oldSess, err := h.session.Get(r)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get session", err) h.log.Error("failed to get session", "error", err)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return err return err
} }
sess, err := h.session.Regenerate(r, w, oldSess) sess, err := h.session.Regenerate(r, w, oldSess)
if err != nil { if err != nil {
h.serverError(w, r, "failed to regenerate session", err) h.log.Error(
"failed to regenerate session", "error", err,
)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return err return err
} }
@@ -254,7 +268,11 @@ func (h *Handlers) createAuthenticatedSession(
err = h.session.Save(r, w, sess) err = h.session.Save(r, w, sess)
if err != nil { if err != nil {
h.serverError(w, r, "failed to save session", err) h.log.Error("failed to save session", "error", err)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return err return err
} }
internal/handlers/delivery_replay.go
+10 -8
View File
@@ -105,7 +105,9 @@ func (h *Handlers) HandleDeliveryReplay() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -122,14 +124,14 @@ func (h *Handlers) replayDelivery(
webhook database.Webhook, webhook database.Webhook,
) { ) {
if !h.dbMgr.DBExists(webhook.ID) { if !h.dbMgr.DBExists(webhook.ID) {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
webhookDB, err := h.dbMgr.GetDB(webhook.ID) webhookDB, err := h.dbMgr.GetDB(webhook.ID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get webhook database", err) h.serverError(w, "failed to get webhook database", err)
return return
} }
@@ -171,7 +173,7 @@ func (h *Handlers) loadReplaySource(
&original, "id = ?", chi.URLParam(r, "deliveryID"), &original, "id = ?", chi.URLParam(r, "deliveryID"),
).Error ).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return nil, false return nil, false
} }
@@ -193,7 +195,7 @@ func (h *Handlers) queueReplay(
) )
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to count in-flight deliveries", err, w, "failed to count in-flight deliveries", err,
) )
return return
@@ -210,7 +212,7 @@ func (h *Handlers) queueReplay(
err = webhookDB. err = webhookDB.
First(&event, "id = ?", original.EventID).Error First(&event, "id = ?", original.EventID).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to load event for replay", err) h.serverError(w, "failed to load event for replay", err)
return return
} }
@@ -220,7 +222,7 @@ func (h *Handlers) queueReplay(
) )
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to create replay delivery", err, w, "failed to create replay delivery", err,
) )
return return
@@ -360,7 +362,7 @@ func (h *Handlers) finishReplay(
webhook database.Webhook, webhook database.Webhook,
code replayOutcomeCode, code replayOutcomeCode,
) { ) {
dest := "/source/" + webhook.ID + "/logs?" + dest := "/hook/" + webhook.ID + "/events?" +
replayOutcomeParam + "=" + string(code) replayOutcomeParam + "=" + string(code)
// The page is read from the form rather than the query string: // The page is read from the form rather than the query string:
internal/handlers/delivery_replay_test.go
+8 -8
View File
@@ -138,7 +138,7 @@ func postReplay(
t.Helper() t.Helper()
req := postRequest( req := postRequest(
"/source/"+webhookID+"/deliveries/"+ "/hook/"+webhookID+"/deliveries/"+
deliveryID+"/replay", deliveryID+"/replay",
authenticatedCookies( authenticatedCookies(
t, sess, deleteTestUserID, deleteTestUsername, t, sess, deleteTestUserID, deleteTestUsername,
@@ -212,7 +212,7 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=queued", "/hook/"+wh.ID+"/events?replay=queued",
w.Header().Get("Location"), w.Header().Get("Location"),
) )
@@ -362,7 +362,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=target-deleted", "/hook/"+wh.ID+"/events?replay=target-deleted",
w.Header().Get("Location"), w.Header().Get("Location"),
) )
@@ -390,7 +390,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
require.Equal(t, http.StatusSeeOther, missing.Code) require.Equal(t, http.StatusSeeOther, missing.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=target-missing", "/hook/"+wh.ID+"/events?replay=target-missing",
missing.Header().Get("Location"), missing.Header().Get("Location"),
) )
} }
@@ -431,7 +431,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
require.Equal(t, http.StatusSeeOther, first.Code) require.Equal(t, http.StatusSeeOther, first.Code)
require.Equal( require.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=queued", "/hook/"+wh.ID+"/events?replay=queued",
first.Header().Get("Location"), first.Header().Get("Location"),
) )
@@ -439,7 +439,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
require.Equal(t, http.StatusSeeOther, second.Code) require.Equal(t, http.StatusSeeOther, second.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=in-flight", "/hook/"+wh.ID+"/events?replay=in-flight",
second.Header().Get("Location"), second.Header().Get("Location"),
) )
@@ -465,7 +465,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
require.Equal(t, http.StatusSeeOther, pending.Code) require.Equal(t, http.StatusSeeOther, pending.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?replay=not-terminal", "/hook/"+wh.ID+"/events?replay=not-terminal",
pending.Header().Get("Location"), pending.Header().Get("Location"),
) )
} }
@@ -501,7 +501,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {
assert.Contains( assert.Contains(
t, body, t, body,
`action="/source/`+wh.ID+`/deliveries/`+ `action="/hook/`+wh.ID+`/deliveries/`+
original.ID+`/replay"`, original.ID+`/replay"`,
) )
assert.Contains(t, body, `method="POST"`) assert.Contains(t, body, `method="POST"`)
internal/handlers/error_page_test.go
-53
View File
@@ -1,53 +0,0 @@
package handlers_test
import (
"context"
"html/template"
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"sneak.berlin/go/webhooker/internal/handlers"
)
// TestErrorPage_RenderFailureKeepsStatus proves that an error page
// which cannot render answers with the status it was reporting, as
// plain text, and is not attempted again: a page whose own render
// fails reaches the error page, and the error page failing as well
// ends there with the 500.
func TestErrorPage_RenderFailureKeepsStatus(t *testing.T) {
t.Parallel()
var h *handlers.Handlers
app := newTestApp(t, &h)
app.RequireStart()
t.Cleanup(app.RequireStop)
// .Status is an int, so asking it for a field fails the render.
failing := `{{.Status.Missing}}`
h.AddTemplateForTest("error.html", template.Must(
template.New("error").Parse(failing),
))
h.AddTemplateForTest("failing.html", template.Must(
template.New("failing").Parse(`{{.Data.Missing}}`),
))
req := httptest.NewRequestWithContext(
context.Background(), http.MethodGet, "/", nil,
)
w := httptest.NewRecorder()
h.HandleErrorPage(http.StatusNotFound).ServeHTTP(w, req)
assert.Equal(t, http.StatusNotFound, w.Code)
assert.Equal(t, "Not Found\n", w.Body.String())
w = httptest.NewRecorder()
h.RenderTemplateForTest(w, req, "failing.html", 0)
assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Equal(t, "Internal Server Error\n", w.Body.String())
}
internal/handlers/event_body.go
+5 -5
View File
@@ -52,7 +52,7 @@ func (h *Handlers) HandleEventBodyDownload() http.HandlerFunc {
// steered by a client. // steered by a client.
eventID, err := uuid.Parse(chi.URLParam(r, "eventID")) eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -103,21 +103,21 @@ func (h *Handlers) serveEventBody(
eventID string, eventID string,
) { ) {
if !h.dbMgr.DBExists(webhook.ID) { if !h.dbMgr.DBExists(webhook.ID) {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
webhookDB, err := h.dbMgr.GetDB(webhook.ID) webhookDB, err := h.dbMgr.GetDB(webhook.ID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get webhook database", err) h.serverError(w, "failed to get webhook database", err)
return return
} }
body, found, err := eventBody(webhookDB, webhook.ID, eventID) body, found, err := eventBody(webhookDB, webhook.ID, eventID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to read event body", err) h.serverError(w, "failed to read event body", err)
return return
} }
@@ -130,7 +130,7 @@ func (h *Handlers) serveEventBody(
// row and the whole body is served, or it does not and the // row and the whole body is served, or it does not and the
// response is a clean 404. // response is a clean 404.
if !found { if !found {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
internal/handlers/event_body_test.go
+4 -4
View File
@@ -64,8 +64,8 @@ func fetchEventBody(
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodGet, http.MethodGet,
"/source/"+url.PathEscape(sourceID)+ "/hook/"+url.PathEscape(sourceID)+
"/logs/"+url.PathEscape(eventID)+"/body", "/events/"+url.PathEscape(eventID)+"/body",
nil, nil,
) )
@@ -490,7 +490,7 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
page := renderSourceLogsPage(t, h, sess, big.ID) page := renderSourceLogsPage(t, h, sess, big.ID)
assert.Contains( assert.Contains(
t, page, t, page,
"/source/"+big.ID+"/logs/"+bigEvt.ID+"/body", "/hook/"+big.ID+"/events/"+bigEvt.ID+"/body",
) )
small := seedWebhook(t, db) small := seedWebhook(t, db)
@@ -501,6 +501,6 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
page = renderSourceLogsPage(t, h, sess, small.ID) page = renderSourceLogsPage(t, h, sess, small.ID)
assert.NotContains( assert.NotContains(
t, page, t, page,
"/source/"+small.ID+"/logs/"+smallEvt.ID+"/body", "/hook/"+small.ID+"/events/"+smallEvt.ID+"/body",
) )
} }
internal/handlers/event_resubmit.go
+9 -9
View File
@@ -99,7 +99,7 @@ func (h *Handlers) HandleEventResubmit() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(w, "Bad request", http.StatusBadRequest)
return return
} }
@@ -120,20 +120,20 @@ func (h *Handlers) resubmitEvent(
// alphabet rather than from the request. // alphabet rather than from the request.
eventID, err := uuid.Parse(chi.URLParam(r, "eventID")) eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
if !h.dbMgr.DBExists(webhook.ID) { if !h.dbMgr.DBExists(webhook.ID) {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
webhookDB, err := h.dbMgr.GetDB(webhook.ID) webhookDB, err := h.dbMgr.GetDB(webhook.ID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get webhook database", err) h.serverError(w, "failed to get webhook database", err)
return return
} }
@@ -147,7 +147,7 @@ func (h *Handlers) resubmitEvent(
webhookDB, webhook.ID, eventID.String(), webhookDB, webhook.ID, eventID.String(),
) )
if err != nil { if err != nil {
h.serverError(w, r, "failed to load event to resubmit", err) h.serverError(w, "failed to load event to resubmit", err)
return return
} }
@@ -155,7 +155,7 @@ func (h *Handlers) resubmitEvent(
// A miss is a 404 whether the event was reaped, belongs to // A miss is a 404 whether the event was reaped, belongs to
// another webhook, or never existed. // another webhook, or never existed.
if !found { if !found {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -207,7 +207,7 @@ func (h *Handlers) queueResubmit(
// inactive one is skipped rather than refused. // inactive one is skipped rather than refused.
targets, err := h.loadActiveTargets(webhook.ID) targets, err := h.loadActiveTargets(webhook.ID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to query targets", err) h.serverError(w, "failed to query targets", err)
return return
} }
@@ -225,7 +225,7 @@ func (h *Handlers) queueResubmit(
targets, targets,
) )
if err != nil { if err != nil {
h.serverError(w, r, "failed to store resubmitted event", err) h.serverError(w, "failed to store resubmitted event", err)
return return
} }
@@ -257,7 +257,7 @@ func (h *Handlers) finishResubmit(
webhook database.Webhook, webhook database.Webhook,
code resubmitOutcomeCode, code resubmitOutcomeCode,
) { ) {
dest := "/source/" + webhook.ID + "/logs?" + dest := "/hook/" + webhook.ID + "/events?" +
resubmitOutcomeParam + "=" + string(code) resubmitOutcomeParam + "=" + string(code)
// The page is read from the form rather than the query string: // The page is read from the form rather than the query string:
internal/handlers/event_resubmit_test.go
+6 -6
View File
@@ -65,7 +65,7 @@ func postResubmit(
t.Helper() t.Helper()
req := postRequest( req := postRequest(
"/source/"+webhookID+"/events/"+eventID+"/resubmit", "/hook/"+webhookID+"/events/"+eventID+"/resubmit",
authenticatedCookies( authenticatedCookies(
t, sess, deleteTestUserID, deleteTestUsername, t, sess, deleteTestUserID, deleteTestUsername,
), ),
@@ -154,7 +154,7 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?resubmit=queued", "/hook/"+wh.ID+"/events?resubmit=queued",
w.Header().Get("Location"), w.Header().Get("Location"),
) )
@@ -282,7 +282,7 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?resubmit=queued", "/hook/"+wh.ID+"/events?resubmit=queued",
w.Header().Get("Location"), w.Header().Get("Location"),
"a resubmit must not be refused while an earlier "+ "a resubmit must not be refused while an earlier "+
"one is in flight", "one is in flight",
@@ -436,7 +436,7 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?resubmit=queued", "/hook/"+wh.ID+"/events?resubmit=queued",
w.Header().Get("Location"), w.Header().Get("Location"),
"an inactive target is skipped, not an error", "an inactive target is skipped, not an error",
) )
@@ -482,7 +482,7 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal( assert.Equal(
t, t,
"/source/"+wh.ID+"/logs?resubmit=no-targets", "/hook/"+wh.ID+"/events?resubmit=no-targets",
w.Header().Get("Location"), w.Header().Get("Location"),
) )
@@ -598,7 +598,7 @@ func TestHandleSourceLogs_ShowsResubmitProvenance(t *testing.T) {
) )
assert.Contains( assert.Contains(
t, body, t, body,
"/source/"+wh.ID+"/events/"+original.ID+"/resubmit", "/hook/"+wh.ID+"/events/"+original.ID+"/resubmit",
"the log must offer the resubmit action per event", "the log must offer the resubmit action per event",
) )
} }
internal/handlers/export_test.go
+2 -12
View File
@@ -1,11 +1,9 @@
package handlers package handlers
import ( import (
"context"
"html/template" "html/template"
"log/slog" "log/slog"
"net/http" "net/http"
"net/http/httptest"
"sneak.berlin/go/webhooker/internal/database" "sneak.berlin/go/webhooker/internal/database"
) )
@@ -65,20 +63,12 @@ func (s *Handlers) LoadEventLogViewsForTest(
page int, page int,
) []EventLogView { ) []EventLogView {
views, _, _ := s.loadEventsWithDeliveries( views, _, _ := s.loadEventsWithDeliveries(
w, newRequestForTest(), webhook, nil, page, w, webhook, nil, page,
) )
return views return views
} }
// newRequestForTest is the request the helpers here pass on for
// callers that have none: it is used only to render the error page.
func newRequestForTest() *http.Request {
return httptest.NewRequestWithContext(
context.Background(), http.MethodGet, "/", nil,
)
}
// AddTemplateForTest registers a template under a page name so that // AddTemplateForTest registers a template under a page name so that
// the handlers_test package can drive the render path with a // the handlers_test package can drive the render path with a
// template of its own. // template of its own.
@@ -132,5 +122,5 @@ func (s *Handlers) BuildDatabaseTargetConfigForTest(
w http.ResponseWriter, w http.ResponseWriter,
expiry string, expiry string,
) (string, error) { ) (string, error) {
return s.buildDatabaseTargetConfig(w, newRequestForTest(), expiry) return s.buildDatabaseTargetConfig(w, expiry)
} }
internal/handlers/gormlogbound_test.go
+1 -1
View File
@@ -306,7 +306,7 @@ func postWebhook(
t.Helper() t.Helper()
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), http.MethodPost, "/webhook/x", context.Background(), http.MethodPost, "/h/x",
strings.NewReader("{}"), strings.NewReader("{}"),
) )
internal/handlers/handlers.go
+19 -89
View File
@@ -135,7 +135,6 @@ func New(
"source_edit.html": parsePageTemplate("source_edit.html"), "source_edit.html": parsePageTemplate("source_edit.html"),
"source_logs.html": parsePageTemplate("source_logs.html"), "source_logs.html": parsePageTemplate("source_logs.html"),
"target_edit.html": parsePageTemplate("target_edit.html"), "target_edit.html": parsePageTemplate("target_edit.html"),
"error.html": parsePageTemplate("error.html"),
} }
lc.Append(fx.Hook{ lc.Append(fx.Hook{
@@ -147,16 +146,6 @@ func New(
return s, nil return s, nil
} }
// HandleErrorPage returns a handler that answers every request with
// the error page for status. The router uses it for unknown paths, the
// CSRF middleware for a refused form, and each admin page route
// group's recoverer for a panic.
func (s *Handlers) HandleErrorPage(status int) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
s.renderError(w, r, status)
}
}
func (s *Handlers) respondJSON( func (s *Handlers) respondJSON(
w http.ResponseWriter, w http.ResponseWriter,
_ *http.Request, _ *http.Request,
@@ -174,76 +163,15 @@ func (s *Handlers) respondJSON(
} }
} }
// serverError logs an error and answers with the 500 error page. // serverError logs an error and sends a 500 response.
func (s *Handlers) serverError( func (s *Handlers) serverError(
w http.ResponseWriter, r *http.Request, msg string, err error, w http.ResponseWriter, msg string, err error,
) { ) {
s.log.Error(msg, "error", err) s.log.Error(msg, "error", err)
s.renderError(w, r, http.StatusInternalServerError) http.Error(
} w, "Internal server error",
http.StatusInternalServerError,
// renderError answers with status and the error page: the normal )
// layout, one fixed line explaining the status, and a link back to the
// webhook list, or to sign-in when nobody is signed in.
//
// It renders the page itself rather than through renderTemplate,
// whose own failure comes here. If the error page cannot render
// either, the answer is the same status in plain text: never a second
// attempt, and never a different status.
func (s *Handlers) renderError(
w http.ResponseWriter,
r *http.Request,
status int,
) {
// The page names the signed-in user, and some error pages are
// served outside the routes where NoCache runs.
w.Header().Set("Cache-Control", "no-store")
data := s.pageData(r, map[string]any{
"Status": status,
"StatusText": http.StatusText(status),
"Message": errorPageText(status),
})
var buf bytes.Buffer
err := s.templates["error.html"].Execute(&buf, data)
if err != nil {
s.log.Error("failed to render error page", "error", err)
http.Error(w, http.StatusText(status), status)
return
}
w.Header().Set("Content-Type", "text/html; charset=utf-8")
w.WriteHeader(status)
_, err = buf.WriteTo(w)
if err != nil {
s.log.Error("failed to write error page", "error", err)
}
}
// errorPageText is the line the error page shows for status. It is
// fixed per status, so the page tells the reader no more than the
// plain-text answers it replaced did.
func errorPageText(status int) string {
switch status {
case http.StatusBadRequest:
return "The request could not be read."
case http.StatusForbidden:
return "The request was refused. If it came from a form " +
"left open for a long time, reload the page and try " +
"again."
case http.StatusNotFound:
return "There is nothing here. It may have been deleted, " +
"or the address may be wrong."
case http.StatusServiceUnavailable:
return "The server is busy. Please try again in a moment."
default: // http.StatusInternalServerError
return "Something went wrong on the server. Please try " +
"again."
}
} }
// UserInfo represents user information for templates // UserInfo represents user information for templates
@@ -296,17 +224,14 @@ func (s *Handlers) renderTemplate(
"template not found", "template not found",
"template", pageTemplate, "template", pageTemplate,
) )
s.renderError(w, r, http.StatusInternalServerError) http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return return
} }
s.executeTemplate(w, r, tmpl, s.pageData(r, data))
}
// pageData adds the fields the shared layout renders to a page's own
// data.
func (s *Handlers) pageData(r *http.Request, data any) any {
userInfo := s.getUserInfo(r) userInfo := s.getUserInfo(r)
csrfToken := middleware.CSRFToken(r) csrfToken := middleware.CSRFToken(r)
@@ -320,16 +245,19 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
m["User"] = userInfo m["User"] = userInfo
m["CSRFToken"] = csrfToken m["CSRFToken"] = csrfToken
m["Version"] = version m["Version"] = version
s.executeTemplate(w, tmpl, m)
return m return
} }
return templateDataWrapper{ wrapper := templateDataWrapper{
User: userInfo, User: userInfo,
CSRFToken: csrfToken, CSRFToken: csrfToken,
Version: version, Version: version,
Data: data, Data: data,
} }
s.executeTemplate(w, tmpl, wrapper)
} }
// executeTemplate renders the template into a buffer and writes to // executeTemplate renders the template into a buffer and writes to
@@ -342,7 +270,6 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
// this reason. // this reason.
func (s *Handlers) executeTemplate( func (s *Handlers) executeTemplate(
w http.ResponseWriter, w http.ResponseWriter,
r *http.Request,
tmpl *template.Template, tmpl *template.Template,
data any, data any,
) { ) {
@@ -353,7 +280,10 @@ func (s *Handlers) executeTemplate(
s.log.Error( s.log.Error(
"failed to execute template", "error", err, "failed to execute template", "error", err,
) )
s.renderError(w, r, http.StatusInternalServerError) http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return return
} }
internal/handlers/handlers_test.go
+3 -7
View File
@@ -176,7 +176,7 @@ func TestHandleIndex_Authenticated(t *testing.T) {
assert.Equal(t, http.StatusSeeOther, w2.Code) assert.Equal(t, http.StatusSeeOther, w2.Code)
assert.Equal( assert.Equal(
t, "/sources", w2.Header().Get("Location"), t, "/hooks", w2.Header().Get("Location"),
) )
} }
@@ -307,14 +307,10 @@ func TestRenderTemplateMidRenderErrorSendsNoPartialBody(t *testing.T) {
t, http.StatusInternalServerError, w.Code, t, http.StatusInternalServerError, w.Code,
"a failed render must report a 500", "a failed render must report a 500",
) )
assert.NotContains( assert.Equal(
t, w.Body.String(), partialPageMarker, t, "Internal server error\n", w.Body.String(),
"the response must carry no part of the aborted page", "the response must carry no part of the aborted page",
) )
assert.Contains(
t, w.Body.String(), "500 Internal Server Error",
"a failed render must answer with the error page",
)
} }
func TestBuildDatabaseTargetConfig_Valid(t *testing.T) { func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
internal/handlers/index.go
+2 -2
View File
@@ -5,13 +5,13 @@ import (
) )
// HandleIndex returns a handler for the root path that redirects // HandleIndex returns a handler for the root path that redirects
// based on authentication state: authenticated users go to /sources // based on authentication state: authenticated users go to /hooks
// (the dashboard), unauthenticated users go to the login page. // (the dashboard), unauthenticated users go to the login page.
func (s *Handlers) HandleIndex() http.HandlerFunc { func (s *Handlers) HandleIndex() http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) { return func(w http.ResponseWriter, r *http.Request) {
sess, err := s.session.Get(r) sess, err := s.session.Get(r)
if err == nil && s.session.IsAuthenticated(sess) { if err == nil && s.session.IsAuthenticated(sess) {
http.Redirect(w, r, "/sources", http.StatusSeeOther) http.Redirect(w, r, "/hooks", http.StatusSeeOther)
return return
} }
internal/handlers/logbound_test.go
+5 -5
View File
@@ -4,7 +4,7 @@ package handlers_test
// this package reach a value an UNAUTHENTICATED client picks outright // this package reach a value an UNAUTHENTICATED client picks outright
// and of a length it picks outright: // and of a length it picks outright:
// //
// - the unknown-entrypoint DEBUG line on /webhook/{uuid}, whose // - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
// path segment matched no stored entrypoint and so is bounded by // path segment matched no stored entrypoint and so is bounded by
// nothing; // nothing;
// - the failed-login DEBUG lines, whose username is a form field. // - the failed-login DEBUG lines, whose username is a form field.
@@ -190,12 +190,12 @@ func assertNoClientText(t *testing.T, buf *bytes.Buffer) {
// route pattern. // route pattern.
func receiverRouter(h *handlers.Handlers) *chi.Mux { func receiverRouter(h *handlers.Handlers) *chi.Mux {
router := chi.NewRouter() router := chi.NewRouter()
router.Post("/webhook/{uuid}", h.HandleWebhook()) router.Post("/h/{uuid}", h.HandleWebhook())
return router return router
} }
// postReceiver sends one POST at /webhook/<segment>. // postReceiver sends one POST at /h/<segment>.
// //
// RawPath is cleared after parsing so chi routes on the decoded path // RawPath is cleared after parsing so chi routes on the decoded path
// and the handler sees the raw bytes rather than their percent-escaped // and the handler sees the raw bytes rather than their percent-escaped
@@ -210,7 +210,7 @@ func postReceiver(
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodPost, http.MethodPost,
"/webhook/"+url.PathEscape(segment), "/h/"+url.PathEscape(segment),
strings.NewReader(""), strings.NewReader(""),
) )
req.URL.RawPath = "" req.URL.RawPath = ""
@@ -507,7 +507,7 @@ func TestVerificationCapacity_LogLineDoesNotTrackPathSize(
http.StatusServiceUnavailable, http.StatusServiceUnavailable,
postLoginAtPath( postLoginAtPath(
t, h, t, h,
"/source/"+url.PathEscape( "/hook/"+url.PathEscape(
oversizedFill(fill), oversizedFill(fill),
)+"/login", )+"/login",
), ),
internal/handlers/profile.go
+28 -16
View File
@@ -1,6 +1,7 @@
package handlers package handlers
import ( import (
"context"
"net/http" "net/http"
"github.com/go-chi/chi" "github.com/go-chi/chi"
@@ -36,14 +37,14 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.log.Error("failed to parse form", "error", err) h.log.Error("failed to parse form", "error", err)
h.renderError(w, r, http.StatusBadRequest) http.Error(w, "Bad request", http.StatusBadRequest)
return return
} }
successMessage, errorMessage, handled := h.applyPasswordChange( successMessage, errorMessage, handled := h.applyPasswordChange(
r.Context(),
w, w,
r,
sessionUsername, sessionUsername,
// PostFormValue, not FormValue: the credential must // PostFormValue, not FormValue: the credential must
// come from the body, never from the query string. // come from the body, never from the query string.
@@ -65,12 +66,12 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
// applyPasswordChange verifies the current password and, on success, // applyPasswordChange verifies the current password and, on success,
// persists a fresh hash for the user, reusing the same helpers that // persists a fresh hash for the user, reusing the same helpers that
// bootstrap the admin user. It returns the success and error messages // bootstrap the admin user. It returns the success and error messages
// to display on the profile page. On an internal failure it writes the // to display on the profile page. On an internal failure it writes a
// error page itself and returns handled=false, signalling the caller // 500 response itself and returns handled=false, signalling the caller
// to stop without re-rendering the page. // to stop without re-rendering the page.
func (h *Handlers) applyPasswordChange( func (h *Handlers) applyPasswordChange(
ctx context.Context,
w http.ResponseWriter, w http.ResponseWriter,
r *http.Request,
username, currentPassword, newPassword, confirmPassword string, username, currentPassword, newPassword, confirmPassword string,
) (string, string, bool) { ) (string, string, bool) {
// This endpoint verifies one password and hashes another, at // This endpoint verifies one password and hashes another, at
@@ -78,10 +79,15 @@ func (h *Handlers) applyPasswordChange(
// endpoint uses. The bound is per hash, not per endpoint: leaving // endpoint uses. The bound is per hash, not per endpoint: leaving
// this path outside it would leave a hole in it. The slot is held // this path outside it would leave a hole in it. The slot is held
// across both hashes. // across both hashes.
release, ok := h.mw.BeginPasswordVerification(r.Context()) release, ok := h.mw.BeginPasswordVerification(ctx)
if !ok { if !ok {
h.log.Warn("password verification capacity exhausted") h.log.Warn("password verification capacity exhausted")
h.renderError(w, r, http.StatusServiceUnavailable) http.Error(
w,
"The server is busy verifying credentials. "+
"Please try again.",
http.StatusServiceUnavailable,
)
return "", "", false return "", "", false
} }
@@ -97,7 +103,7 @@ func (h *Handlers) applyPasswordChange(
).First(&user).Error ).First(&user).Error
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to load user for password change", err, w, "failed to load user for password change", err,
) )
return "", "", false return "", "", false
@@ -107,7 +113,7 @@ func (h *Handlers) applyPasswordChange(
currentPassword, user.Password, currentPassword, user.Password,
) )
if err != nil { if err != nil {
h.serverError(w, r, "failed to verify password", err) h.serverError(w, "failed to verify password", err)
return "", "", false return "", "", false
} }
@@ -126,7 +132,7 @@ func (h *Handlers) applyPasswordChange(
hashedPassword, err := database.HashPassword(newPassword) hashedPassword, err := database.HashPassword(newPassword)
if err != nil { if err != nil {
h.serverError(w, r, "failed to hash new password", err) h.serverError(w, "failed to hash new password", err)
return "", "", false return "", "", false
} }
@@ -135,7 +141,7 @@ func (h *Handlers) applyPasswordChange(
"password", hashedPassword, "password", hashedPassword,
).Error ).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to update password", err) h.serverError(w, "failed to update password", err)
return "", "", false return "", "", false
} }
@@ -156,7 +162,7 @@ func (h *Handlers) profileOwnerOrDeny(
) (string, string, bool) { ) (string, string, bool) {
requestedUsername := chi.URLParam(r, "username") requestedUsername := chi.URLParam(r, "username")
if requestedUsername == "" { if requestedUsername == "" {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return "", "", false return "", "", false
} }
@@ -166,7 +172,7 @@ func (h *Handlers) profileOwnerOrDeny(
// unexpected retrieval error. // unexpected retrieval error.
sess, err := h.session.Get(r) sess, err := h.session.Get(r)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get session", err) h.serverError(w, "failed to get session", err)
return "", "", false return "", "", false
} }
@@ -174,7 +180,10 @@ func (h *Handlers) profileOwnerOrDeny(
sessionUsername, ok := h.session.GetUsername(sess) sessionUsername, ok := h.session.GetUsername(sess)
if !ok { if !ok {
h.log.Error("authenticated session missing username") h.log.Error("authenticated session missing username")
h.renderError(w, r, http.StatusInternalServerError) http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return "", "", false return "", "", false
} }
@@ -182,14 +191,17 @@ func (h *Handlers) profileOwnerOrDeny(
sessionUserID, ok := h.session.GetUserID(sess) sessionUserID, ok := h.session.GetUserID(sess)
if !ok { if !ok {
h.log.Error("authenticated session missing user ID") h.log.Error("authenticated session missing user ID")
h.renderError(w, r, http.StatusInternalServerError) http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return "", "", false return "", "", false
} }
// Only allow users to act on their own profile. // Only allow users to act on their own profile.
if requestedUsername != sessionUsername { if requestedUsername != sessionUsername {
h.renderError(w, r, http.StatusForbidden) http.Error(w, "Forbidden", http.StatusForbidden)
return "", "", false return "", "", false
} }
internal/handlers/profile_test.go
+2 -4
View File
@@ -128,9 +128,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
var sess *session.Session var sess *session.Session
var h *handlers.Handlers app := newTestApp(t, &log, &cfg, &sess)
app := newTestApp(t, &log, &cfg, &sess, &h)
app.RequireStart() app.RequireStart()
t.Cleanup(app.RequireStop) t.Cleanup(app.RequireStop)
@@ -141,7 +139,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
router := chi.NewRouter() router := chi.NewRouter()
router.Route("/user/{username}", func(r chi.Router) { router.Route("/user/{username}", func(r chi.Router) {
r.Use(mw.CSRF(h.HandleErrorPage(http.StatusForbidden))) r.Use(mw.CSRF())
r.Use(mw.RequireAuth()) r.Use(mw.RequireAuth())
r.Get("/", func(w http.ResponseWriter, _ *http.Request) { r.Get("/", func(w http.ResponseWriter, _ *http.Request) {
handlerReached = true handlerReached = true
internal/handlers/recent_events_test.go
+1 -1
View File
@@ -313,7 +313,7 @@ func TestHandleWebhook_RecordsBodySize(t *testing.T) {
body := strings.Repeat("é", 1024) body := strings.Repeat("é", 1024)
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), http.MethodPost, "/webhook/x", context.Background(), http.MethodPost, "/h/x",
strings.NewReader(body), strings.NewReader(body),
) )
internal/handlers/source_delete_test.go
+9 -9
View File
@@ -220,7 +220,7 @@ func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/delete", "/hook/"+wh.ID+"/delete",
cookies, cookies,
map[string]string{paramSourceID: wh.ID}, map[string]string{paramSourceID: wh.ID},
) )
@@ -267,7 +267,7 @@ func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/delete", "/hook/"+wh.ID+"/delete",
cookies, cookies,
map[string]string{paramSourceID: wh.ID}, map[string]string{paramSourceID: wh.ID},
) )
@@ -323,7 +323,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/delete", "/hook/"+wh.ID+"/delete",
cookies, cookies,
map[string]string{paramSourceID: wh.ID}, map[string]string{paramSourceID: wh.ID},
) )
@@ -337,7 +337,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
) )
assert.Empty( assert.Empty(
t, w.Header().Get("Location"), t, w.Header().Get("Location"),
"a failed deletion must not redirect to /sources", "a failed deletion must not redirect to /hooks",
) )
assert.Equal( assert.Equal(
@@ -402,7 +402,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/delete", "/hook/"+wh.ID+"/delete",
cookies, cookies,
map[string]string{paramSourceID: wh.ID}, map[string]string{paramSourceID: wh.ID},
) )
@@ -411,7 +411,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
h.HandleSourceDelete().ServeHTTP(w, req) h.HandleSourceDelete().ServeHTTP(w, req)
require.Equal(t, http.StatusSeeOther, w.Code) require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal(t, "/sources", w.Header().Get("Location")) assert.Equal(t, "/hooks", w.Header().Get("Location"))
assert.Equal( assert.Equal(
t, int64(0), t, int64(0),
@@ -465,7 +465,7 @@ func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete", "/hook/"+wh.ID+"/targets/"+tgt.ID+"/delete",
cookies, cookies,
map[string]string{ map[string]string{
paramSourceID: wh.ID, paramSourceID: wh.ID,
@@ -515,7 +515,7 @@ func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/targets/"+doomed.ID+"/delete", "/hook/"+wh.ID+"/targets/"+doomed.ID+"/delete",
cookies, cookies,
map[string]string{ map[string]string{
paramSourceID: wh.ID, paramSourceID: wh.ID,
@@ -563,7 +563,7 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
) )
req := postRequest( req := postRequest(
"/source/"+wh.ID+"/targets/"+other.ID+"/delete", "/hook/"+wh.ID+"/targets/"+other.ID+"/delete",
cookies, cookies,
map[string]string{ map[string]string{
paramSourceID: wh.ID, paramSourceID: wh.ID,
internal/handlers/source_detail_baseurl_test.go
+4 -4
View File
@@ -81,7 +81,7 @@ func (f *baseURLFixture) entrypointURL(
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodGet, http.MethodGet,
"/source/"+f.webhook, "/hook/"+f.webhook,
nil, nil,
) )
req.Host = host req.Host = host
@@ -213,7 +213,7 @@ func TestSourceDetailBaseURL_ForwardedProtoSpellings(t *testing.T) {
assert.Equal( assert.Equal(
t, t,
tc.scheme+"://"+host+"/webhook/"+fixture.path, tc.scheme+"://"+host+"/h/"+fixture.path,
fixture.entrypointURL( fixture.entrypointURL(
t, host, forwardedProto(tc.header), t, host, forwardedProto(tc.header),
), ),
@@ -244,7 +244,7 @@ func TestSourceDetailBaseURL_DirectTLSBeatsPlaintextHeader(
assert.Equal( assert.Equal(
t, t,
"https://"+host+"/webhook/"+fixture.path, "https://"+host+"/h/"+fixture.path,
got, got,
"a connection this process terminated with TLS "+ "a connection this process terminated with TLS "+
"outranks a header claiming plaintext", "outranks a header claiming plaintext",
@@ -272,7 +272,7 @@ func TestSourceDetailBaseURL_KeepsHostAuthority(t *testing.T) {
assert.Equal( assert.Equal(
t, t,
"https://"+host+"/webhook/"+fixture.path, "https://"+host+"/h/"+fixture.path,
fixture.entrypointURL( fixture.entrypointURL(
t, host, forwardedProto("HTTPS"), t, host, forwardedProto("HTTPS"),
), ),
internal/handlers/source_detail_test.go
+1 -1
View File
@@ -82,7 +82,7 @@ func serveSourceDetailPage(
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodGet, http.MethodGet,
"/source/"+webhookID, "/hook/"+webhookID,
nil, nil,
) )
internal/handlers/source_logs_deleted_target_test.go
+1 -1
View File
@@ -28,7 +28,7 @@ func deleteTargetThroughHandler(
t.Helper() t.Helper()
req := postRequest( req := postRequest(
"/source/"+webhookID+"/targets/"+targetID+"/delete", "/hook/"+webhookID+"/targets/"+targetID+"/delete",
authenticatedCookies( authenticatedCookies(
t, sess, deleteTestUserID, deleteTestUsername, t, sess, deleteTestUserID, deleteTestUsername,
), ),
internal/handlers/source_logs_test.go
+1 -1
View File
@@ -84,7 +84,7 @@ func renderSourceLogsPageWithQuery(
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodGet, http.MethodGet,
"/source/"+webhookID+"/logs"+query, "/hook/"+webhookID+"/events"+query,
nil, nil,
) )
internal/handlers/source_management.go
+70 -48
View File
@@ -149,7 +149,13 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
"user_id = ?", userID, "user_id = ?", userID,
).Order("created_at DESC").Find(&webhooks).Error ).Order("created_at DESC").Find(&webhooks).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to list webhooks", err) h.log.Error(
"failed to list webhooks", "error", err,
)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return return
} }
@@ -243,7 +249,9 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -303,7 +311,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
err := h.commitWebhook(webhook) err := h.commitWebhook(webhook)
if err != nil { if err != nil {
h.serverError(w, r, "failed to create webhook", err) h.serverError(w, "failed to create webhook", err)
return return
} }
@@ -322,7 +330,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
) )
http.Redirect( http.Redirect(
w, r, "/source/"+webhook.ID, http.StatusSeeOther, w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
) )
} }
@@ -380,7 +388,7 @@ func (h *Handlers) HandleSourceDetail() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -412,7 +420,7 @@ func (h *Handlers) renderSourceDetail(
if h.dbMgr.DBExists(webhook.ID) { if h.dbMgr.DBExists(webhook.ID) {
webhookDB, err := h.dbMgr.GetDB(webhook.ID) webhookDB, err := h.dbMgr.GetDB(webhook.ID)
if err != nil { if err != nil {
h.serverError(w, r, "failed to get webhook database", err) h.serverError(w, "failed to get webhook database", err)
return return
} }
@@ -421,7 +429,7 @@ func (h *Handlers) renderSourceDetail(
webhookDB, webhook.ID, singleHTTPTargetID(targets), webhookDB, webhook.ID, singleHTTPTargetID(targets),
) )
if err != nil { if err != nil {
h.serverError(w, r, "failed to load recent events", err) h.serverError(w, "failed to load recent events", err)
return return
} }
@@ -474,7 +482,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -509,7 +517,7 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -518,7 +526,9 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err = r.ParseForm() err = r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -572,13 +582,13 @@ func (h *Handlers) applyWebhookEdit(
err := h.db.DB().Save(webhook).Error err := h.db.DB().Save(webhook).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to update webhook", err) h.serverError(w, "failed to update webhook", err)
return return
} }
http.Redirect( http.Redirect(
w, r, "/source/"+webhook.ID, http.StatusSeeOther, w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
) )
} }
@@ -602,7 +612,7 @@ func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -629,7 +639,7 @@ func (h *Handlers) deleteWebhookResources(
// be removed by hand; deleted history cannot be recovered. // be removed by hand; deleted history cannot be recovered.
err := h.commitWebhookDeletion(&webhook) err := h.commitWebhookDeletion(&webhook)
if err != nil { if err != nil {
h.serverError(w, r, "failed to delete webhook", err) h.serverError(w, "failed to delete webhook", err)
return return
} }
@@ -655,13 +665,13 @@ func (h *Handlers) deleteWebhookResources(
// redirecting as though everything succeeded: the file // redirecting as though everything succeeded: the file
// needs removing by hand, and the logged error names it. // needs removing by hand, and the logged error names it.
h.serverError( h.serverError(
w, r, "failed to delete webhook event database", err, w, "failed to delete webhook event database", err,
) )
return return
} }
http.Redirect(w, r, "/sources", http.StatusSeeOther) http.Redirect(w, r, "/hooks", http.StatusSeeOther)
} }
// commitWebhookDeletion soft-deletes a webhook's entrypoints, // commitWebhookDeletion soft-deletes a webhook's entrypoints,
@@ -799,7 +809,7 @@ func (h *Handlers) ownedWebhook(
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return database.Webhook{}, false return database.Webhook{}, false
} }
@@ -821,7 +831,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
// Without the map every delivery renders through a // Without the map every delivery renders through a
// zero redactor, so failing the page is the only // zero redactor, so failing the page is the only
// safe answer. // safe answer.
h.serverError(w, r, "failed to load targets", err) h.serverError(w, "failed to load targets", err)
return return
} }
@@ -829,7 +839,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
page := h.parsePage(r) page := h.parsePage(r)
evts, total, ok := h.loadEventsWithDeliveries( evts, total, ok := h.loadEventsWithDeliveries(
w, r, webhook, targets, page, w, webhook, targets, page,
) )
if !ok { if !ok {
return return
@@ -939,7 +949,6 @@ func (h *Handlers) parsePage(r *http.Request) int {
// caller must then render nothing further. // caller must then render nothing further.
func (h *Handlers) loadEventsWithDeliveries( func (h *Handlers) loadEventsWithDeliveries(
w http.ResponseWriter, w http.ResponseWriter,
r *http.Request,
webhook database.Webhook, webhook database.Webhook,
targetMap map[string]eventLogTarget, targetMap map[string]eventLogTarget,
page int, page int,
@@ -953,7 +962,7 @@ func (h *Handlers) loadEventsWithDeliveries(
webhookDB, err := h.dbMgr.GetDB(webhook.ID) webhookDB, err := h.dbMgr.GetDB(webhook.ID)
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to get webhook database", err, w, "failed to get webhook database", err,
) )
return nil, 0, false return nil, 0, false
@@ -990,7 +999,7 @@ func (h *Handlers) loadEventsWithDeliveries(
) )
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to load delivery attempts", err, w, "failed to load delivery attempts", err,
) )
return nil, 0, false return nil, 0, false
@@ -999,7 +1008,7 @@ func (h *Handlers) loadEventsWithDeliveries(
resubmits, err := resubmitCounts(webhookDB, eventIDs) resubmits, err := resubmitCounts(webhookDB, eventIDs)
if err != nil { if err != nil {
h.serverError( h.serverError(
w, r, "failed to count event resubmissions", err, w, "failed to count event resubmissions", err,
) )
return nil, 0, false return nil, 0, false
@@ -1222,7 +1231,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -1231,7 +1240,9 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err = r.ParseForm() err = r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -1247,13 +1258,13 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
err = h.db.DB().Create(entrypoint).Error err = h.db.DB().Create(entrypoint).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to create entrypoint", err) h.serverError(w, "failed to create entrypoint", err)
return return
} }
http.Redirect( http.Redirect(
w, r, "/source/"+webhook.ID, http.StatusSeeOther, w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
) )
} }
} }
@@ -1278,7 +1289,7 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -1287,7 +1298,9 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err = r.ParseForm() err = r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -1307,7 +1320,7 @@ func (h *Handlers) processTargetCreate(
// //
// Every field here is read with PostFormValue, not FormValue. // Every field here is read with PostFormValue, not FormValue.
// FormValue falls back to the query string, which would let // FormValue falls back to the query string, which would let
// `POST /source/{id}/targets?url=https://hooks.slack.com/...` // `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
// configure a target from a value the request line carries — and // configure a target from a value the request line carries — and
// the request line, unlike the body, is what logs, proxies, // the request line, unlike the body, is what logs, proxies,
// Referer headers and error trackers record. // Referer headers and error trackers record.
@@ -1358,13 +1371,13 @@ func (h *Handlers) processTargetCreate(
err = h.db.DB().Create(target).Error err = h.db.DB().Create(target).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to create target", err) h.serverError(w, "failed to create target", err)
return return
} }
http.Redirect( http.Redirect(
w, r, "/source/"+webhook.ID, http.StatusSeeOther, w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
) )
} }
@@ -1422,7 +1435,7 @@ type targetFormInput struct {
// //
// Every field is read with PostFormValue, not FormValue. FormValue // Every field is read with PostFormValue, not FormValue. FormValue
// falls back to the query string, which would let // falls back to the query string, which would let
// `POST /source/{id}/targets?url=https://hooks.slack.com/...` // `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
// configure a target from a value the request line carries — and the // configure a target from a value the request line carries — and the
// request line, unlike the body, is what logs, proxies, Referer // request line, unlike the body, is what logs, proxies, Referer
// headers and error trackers record. The headers field is under the // headers and error trackers record. The headers field is under the
@@ -1452,7 +1465,7 @@ func (h *Handlers) buildTargetConfig(
case database.TargetTypeSlack: case database.TargetTypeSlack:
return h.buildSlackTargetConfig(w, r, in.URL) return h.buildSlackTargetConfig(w, r, in.URL)
case database.TargetTypeDatabase: case database.TargetTypeDatabase:
return h.buildDatabaseTargetConfig(w, r, in.Expiry) return h.buildDatabaseTargetConfig(w, in.Expiry)
case database.TargetTypeLog: case database.TargetTypeLog:
return "", nil return "", nil
default: default:
@@ -1502,7 +1515,7 @@ func (h *Handlers) buildHTTPTargetConfig(
return "", err return "", err
} }
return h.marshalTargetConfig(w, r, delivery.HTTPTargetConfig{ return marshalTargetConfig(w, delivery.HTTPTargetConfig{
URL: in.URL, URL: in.URL,
Headers: headers, Headers: headers,
Timeout: timeout, Timeout: timeout,
@@ -1524,7 +1537,7 @@ func (h *Handlers) buildSlackTargetConfig(
return "", err return "", err
} }
return h.marshalTargetConfig(w, r, delivery.SlackTargetConfig{ return marshalTargetConfig(w, delivery.SlackTargetConfig{
WebhookURL: targetURL, WebhookURL: targetURL,
}) })
} }
@@ -1578,14 +1591,16 @@ func (h *Handlers) validateTargetURL(
// marshalTargetConfig serialises a target configuration for storage, // marshalTargetConfig serialises a target configuration for storage,
// writing a 500 itself if it cannot. // writing a 500 itself if it cannot.
func (h *Handlers) marshalTargetConfig( func marshalTargetConfig(
w http.ResponseWriter, w http.ResponseWriter,
r *http.Request,
cfg any, cfg any,
) (string, error) { ) (string, error) {
configBytes, err := json.Marshal(cfg) configBytes, err := json.Marshal(cfg)
if err != nil { if err != nil {
h.serverError(w, r, "failed to encode target config", err) http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return "", err return "", err
} }
@@ -1601,7 +1616,6 @@ func (h *Handlers) marshalTargetConfig(
// expiry yields an empty config (the keep-forever default). // expiry yields an empty config (the keep-forever default).
func (h *Handlers) buildDatabaseTargetConfig( func (h *Handlers) buildDatabaseTargetConfig(
w http.ResponseWriter, w http.ResponseWriter,
r *http.Request,
expiry string, expiry string,
) (string, error) { ) (string, error) {
expiry = strings.TrimSpace(expiry) expiry = strings.TrimSpace(expiry)
@@ -1620,8 +1634,8 @@ func (h *Handlers) buildDatabaseTargetConfig(
return "", err return "", err
} }
return h.marshalTargetConfig( return marshalTargetConfig(
w, r, map[string]any{"expiry": expiry}, w, map[string]any{"expiry": expiry},
) )
} }
@@ -1675,7 +1689,7 @@ func (h *Handlers) deleteChildResource(
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
@@ -1685,7 +1699,11 @@ func (h *Handlers) deleteChildResource(
childID, webhook.ID, childID, webhook.ID,
).Delete(model) ).Delete(model)
if result.Error != nil { if result.Error != nil {
h.serverError(w, r, errMsg, result.Error) h.log.Error(errMsg, "error", result.Error)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return return
} }
@@ -1696,7 +1714,7 @@ func (h *Handlers) deleteChildResource(
http.Redirect( http.Redirect(
w, r, w, r,
"/source/"+webhook.ID, "/hook/"+webhook.ID,
http.StatusSeeOther, http.StatusSeeOther,
) )
} }
@@ -1775,21 +1793,25 @@ func (h *Handlers) toggleChildResource(
"id = ? AND user_id = ?", sourceID, userID, "id = ? AND user_id = ?", sourceID, userID,
).First(&webhook).Error ).First(&webhook).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return return
} }
err = toggleFn(webhook.ID, childID) err = toggleFn(webhook.ID, childID)
if err != nil { if err != nil {
h.serverError(w, r, errMsg, err) h.log.Error(errMsg, "error", err)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
return return
} }
http.Redirect( http.Redirect(
w, r, w, r,
"/source/"+webhook.ID, "/hook/"+webhook.ID,
http.StatusSeeOther, http.StatusSeeOther,
) )
} }
internal/handlers/source_management_test.go
+7 -7
View File
@@ -105,7 +105,7 @@ func submitCreate(
form.Set("retention_days", *retention) form.Set("retention_days", *retention)
} }
req := formRequest("/sources/new", cookies, form, nil) req := formRequest("/hooks/new", cookies, form, nil)
w := httptest.NewRecorder() w := httptest.NewRecorder()
h.HandleSourceCreateSubmit().ServeHTTP(w, req) h.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -265,7 +265,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
w := httptest.NewRecorder() w := httptest.NewRecorder()
env.handlers.HandleSourceCreate().ServeHTTP( env.handlers.HandleSourceCreate().ServeHTTP(
w, getRequest(t, "/sources/new", env.cookies, nil), w, getRequest(t, "/hooks/new", env.cookies, nil),
) )
require.Equal(t, http.StatusOK, w.Code) require.Equal(t, http.StatusOK, w.Code)
@@ -402,7 +402,7 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
form.Set("description", description) form.Set("description", description)
form.Set("retention_days", "nonsense") form.Set("retention_days", "nonsense")
req := formRequest("/sources/new", env.cookies, form, nil) req := formRequest("/hooks/new", env.cookies, form, nil)
w := httptest.NewRecorder() w := httptest.NewRecorder()
env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req) env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -430,7 +430,7 @@ func submitEdit(
form.Set("retention_days", retention) form.Set("retention_days", retention)
req := formRequest( req := formRequest(
"/source/"+wh.ID+"/edit", "/hook/"+wh.ID+"/edit",
env.cookies, env.cookies,
form, form,
map[string]string{sourceIDParam: wh.ID}, map[string]string{sourceIDParam: wh.ID},
@@ -512,7 +512,7 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
) )
req := getRequest( req := getRequest(
t, "/source/"+wh.ID+"/edit", env.cookies, t, "/hook/"+wh.ID+"/edit", env.cookies,
map[string]string{sourceIDParam: wh.ID}, map[string]string{sourceIDParam: wh.ID},
) )
w := httptest.NewRecorder() w := httptest.NewRecorder()
@@ -567,7 +567,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
listW := httptest.NewRecorder() listW := httptest.NewRecorder()
env.handlers.HandleSourceList().ServeHTTP( env.handlers.HandleSourceList().ServeHTTP(
listW, getRequest(t, "/sources", env.cookies, nil), listW, getRequest(t, "/hooks", env.cookies, nil),
) )
require.Equal(t, http.StatusOK, listW.Code) require.Equal(t, http.StatusOK, listW.Code)
@@ -578,7 +578,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
env.handlers.HandleSourceDetail().ServeHTTP( env.handlers.HandleSourceDetail().ServeHTTP(
detailW, detailW,
getRequest( getRequest(
t, "/source/"+wh.ID, env.cookies, t, "/hook/"+wh.ID, env.cookies,
map[string]string{sourceIDParam: wh.ID}, map[string]string{sourceIDParam: wh.ID},
), ),
) )
internal/handlers/target_create_query_test.go
+3 -3
View File
@@ -76,11 +76,11 @@ func postTargetCreate(
router := chi.NewRouter() router := chi.NewRouter()
router.Use(mw.Logging()) router.Use(mw.Logging())
router.Post( router.Post(
"/source/{sourceID}/targets", "/hook/{sourceID}/targets",
env.handlers.HandleTargetCreate(), env.handlers.HandleTargetCreate(),
) )
target := "/source/" + webhookID + "/targets" target := "/hook/" + webhookID + "/targets"
if query != "" { if query != "" {
target += "?" + query target += "?" + query
} }
@@ -114,7 +114,7 @@ func postTargetCreate(
// regression test for the ingress leak. r.FormValue falls back to the // regression test for the ingress leak. r.FormValue falls back to the
// query string when a field is absent from the POST body, so // query string when a field is absent from the POST body, so
// //
// POST /source/{id}/targets?url=https://hooks.slack.com/services/... // POST /hook/{id}/targets?url=https://hooks.slack.com/services/...
// //
// with an empty url field used to create a working target from a value // with an empty url field used to create a working target from a value
// carried on the request line — where logs, proxies, Referer headers // carried on the request line — where logs, proxies, Referer headers
internal/handlers/target_edit.go
+7 -5
View File
@@ -47,7 +47,7 @@ type targetEditView struct {
// //
// This page is the one place the full destination URL and header // This page is the one place the full destination URL and header
// values are shown. It is reachable only through the // values are shown. It is reachable only through the
// /source/{sourceID} route group, which supplies RequireAuth and // /hook/{sourceID} route group, which supplies RequireAuth and
// NoCache, and only for a target of a webhook the session's user // NoCache, and only for a target of a webhook the session's user
// owns; masking (delivery.TargetView) is unchanged everywhere else. // owns; masking (delivery.TargetView) is unchanged everywhere else.
func (h *Handlers) HandleTargetEdit() http.HandlerFunc { func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
@@ -88,7 +88,9 @@ func (h *Handlers) HandleTargetEditSubmit() http.HandlerFunc {
// middleware, which runs before CSRF parses the form. // middleware, which runs before CSRF parses the form.
err := r.ParseForm() err := r.ParseForm()
if err != nil { if err != nil {
h.renderError(w, r, http.StatusBadRequest) http.Error(
w, "Bad request", http.StatusBadRequest,
)
return return
} }
@@ -155,13 +157,13 @@ func (h *Handlers) applyTargetEdit(
err = h.db.DB().Save(target).Error err = h.db.DB().Save(target).Error
if err != nil { if err != nil {
h.serverError(w, r, "failed to update target", err) h.serverError(w, "failed to update target", err)
return return
} }
http.Redirect( http.Redirect(
w, r, "/source/"+webhook.ID, http.StatusSeeOther, w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
) )
} }
@@ -218,7 +220,7 @@ func (h *Handlers) ownedTarget(
chi.URLParam(r, "targetID"), webhook.ID, chi.URLParam(r, "targetID"), webhook.ID,
).First(&target).Error ).First(&target).Error
if err != nil { if err != nil {
h.renderError(w, r, http.StatusNotFound) http.NotFound(w, r)
return database.Webhook{}, nil, false return database.Webhook{}, nil, false
} }
internal/handlers/target_edit_test.go
+9 -9
View File
@@ -42,15 +42,15 @@ const (
func targetRouter(env *sourceTestEnv) *chi.Mux { func targetRouter(env *sourceTestEnv) *chi.Mux {
router := chi.NewRouter() router := chi.NewRouter()
router.Post( router.Post(
"/source/{sourceID}/targets", "/hook/{sourceID}/targets",
env.handlers.HandleTargetCreate(), env.handlers.HandleTargetCreate(),
) )
router.Get( router.Get(
"/source/{sourceID}/targets/{targetID}/edit", "/hook/{sourceID}/targets/{targetID}/edit",
env.handlers.HandleTargetEdit(), env.handlers.HandleTargetEdit(),
) )
router.Post( router.Post(
"/source/{sourceID}/targets/{targetID}/edit", "/hook/{sourceID}/targets/{targetID}/edit",
env.handlers.HandleTargetEditSubmit(), env.handlers.HandleTargetEditSubmit(),
) )
@@ -117,7 +117,7 @@ func seedHTTPTarget(
w := serveTarget( w := serveTarget(
env, http.MethodPost, env, http.MethodPost,
"/source/"+webhook.ID+"/targets", form, "/hook/"+webhook.ID+"/targets", form,
) )
require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String()) require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
@@ -188,7 +188,7 @@ func submitTargetEdit(
) *httptest.ResponseRecorder { ) *httptest.ResponseRecorder {
return serveTarget( return serveTarget(
env, http.MethodPost, env, http.MethodPost,
"/source/"+webhookID+"/targets/"+targetID+"/edit", "/hook/"+webhookID+"/targets/"+targetID+"/edit",
form, form,
) )
} }
@@ -401,7 +401,7 @@ func TestHandleTargetEdit_PrefillsTheStoredValuesUnmasked(
w := serveTarget( w := serveTarget(
env, http.MethodGet, env, http.MethodGet,
"/source/"+webhook.ID+"/targets/"+target.ID+"/edit", "/hook/"+webhook.ID+"/targets/"+target.ID+"/edit",
nil, nil,
) )
require.Equal(t, http.StatusOK, w.Code) require.Equal(t, http.StatusOK, w.Code)
@@ -508,7 +508,7 @@ func assertEditIgnoresQueryString(
w := serveTarget( w := serveTarget(
env, http.MethodPost, env, http.MethodPost,
"/source/"+webhook.ID+"/targets/"+target.ID+ "/hook/"+webhook.ID+"/targets/"+target.ID+
"/edit?url="+url.QueryEscape(editReplacedURL)+ "/edit?url="+url.QueryEscape(editReplacedURL)+
"&headers="+url.QueryEscape(editAuthHeader), "&headers="+url.QueryEscape(editAuthHeader),
form, form,
@@ -592,7 +592,7 @@ func assertTargetOfAnotherWebhook404s(
get := serveTarget( get := serveTarget(
env, http.MethodGet, env, http.MethodGet,
"/source/"+mine.ID+"/targets/"+target.ID+"/edit", nil, "/hook/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
) )
assert.Equal(t, http.StatusNotFound, get.Code) assert.Equal(t, http.StatusNotFound, get.Code)
@@ -630,7 +630,7 @@ func assertWebhookOfAnotherUser404s(
w := serveTarget( w := serveTarget(
env, http.MethodGet, env, http.MethodGet,
"/source/"+other.ID+"/targets/"+target.ID+"/edit", nil, "/hook/"+other.ID+"/targets/"+target.ID+"/edit", nil,
) )
assert.Equal(t, http.StatusNotFound, w.Code) assert.Equal(t, http.StatusNotFound, w.Code)
internal/handlers/target_retries_test.go
+1 -1
View File
@@ -102,7 +102,7 @@ func createWithRetries(
w := serveTarget( w := serveTarget(
env, http.MethodPost, env, http.MethodPost,
"/source/"+webhook.ID+"/targets", "/hook/"+webhook.ID+"/targets",
createRetriesForm(retries), createRetriesForm(retries),
) )
internal/handlers/ui_copy_test.go
+55 -10
View File
@@ -54,8 +54,7 @@ func renderPage(
} }
// TestNavbarUsesWebhookTerminology pins the user-visible navigation // TestNavbarUsesWebhookTerminology pins the user-visible navigation
// label to "Webhooks". The /sources route is deliberately unchanged, so // label to "Webhooks" and its link to the webhook list at /hooks.
// the assertion targets the link text rather than the href.
func TestNavbarUsesWebhookTerminology(t *testing.T) { func TestNavbarUsesWebhookTerminology(t *testing.T) {
t.Parallel() t.Parallel()
@@ -95,15 +94,11 @@ func TestNavbarUsesWebhookTerminology(t *testing.T) {
t, body, ">Sources<", t, body, ">Sources<",
"no user-visible element may still be labelled Sources", "no user-visible element may still be labelled Sources",
) )
assert.Contains( assert.Contains(t, body, `href="/hooks"`)
t, body, `href="/sources"`,
"the /sources route itself must not change",
)
} }
// TestEditPageUsesWebhookTerminology pins the edit page's heading and // TestEditPageUsesWebhookTerminology pins the edit page's heading and
// its back link. The link's href still points at /source/{id}, which is // its back link to the webhook page at /hook/{id}.
// intentional: only user-visible copy changes.
func TestEditPageUsesWebhookTerminology(t *testing.T) { func TestEditPageUsesWebhookTerminology(t *testing.T) {
t.Parallel() t.Parallel()
@@ -130,7 +125,57 @@ func TestEditPageUsesWebhookTerminology(t *testing.T) {
assert.Contains(t, body, "Edit Webhook") assert.Contains(t, body, "Edit Webhook")
assert.NotContains(t, body, ">Sources<") assert.NotContains(t, body, ">Sources<")
assert.Contains(t, body, `href="/source/wh-1"`) assert.Contains(t, body, `href="/hook/wh-1"`)
}
// TestEventLogPageIsCalledFullEventLog pins the one name the event log
// page at /hook/{id}/events goes by: both links to it on the webhook
// page, and its own heading, read "Full Event Log".
func TestEventLogPageIsCalledFullEventLog(t *testing.T) {
t.Parallel()
var h *handlers.Handlers
var sess *session.Session
app := newTestApp(t, &h, &sess)
app.RequireStart()
t.Cleanup(app.RequireStop)
// A pointer, as in the handlers: source_detail.html calls
// Webhook.RetentionLabel, a pointer method. Both pages only range
// over their lists, and a list left out renders as empty, so the
// lists are left out.
webhook := &database.Webhook{Name: "wh", RetentionDays: 14}
webhook.ID = testWebhookID
detailBody := renderPage(
t, h, sess, "source_detail.html", map[string]any{
dataKeyWebhook: webhook,
},
)
assert.Contains(
t, detailBody,
`<a href="/hook/wh-1/events" class="btn-secondary">Full Event Log</a>`,
"the button at the top of the webhook page",
)
assert.Contains(
t, detailBody,
`<a href="/hook/wh-1/events" class="btn-text text-sm">Full Event Log</a>`,
"the link under recent events",
)
logBody := renderPage(t, h, sess, "source_logs.html", map[string]any{
dataKeyWebhook: webhook,
"TotalEvents": int64(0),
})
assert.Contains(
t, logBody,
`<h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>`,
)
} }
// TestCreateFormRetentionCopyMatchesBehaviour pins the create form's // TestCreateFormRetentionCopyMatchesBehaviour pins the create form's
@@ -283,7 +328,7 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
t, body, t, body,
`<code id="entrypoint-url-ep-1"`, `<code id="entrypoint-url-ep-1"`,
) )
assert.Contains(t, body, "https://hooks.example.com/webhook/abc123") assert.Contains(t, body, "https://hooks.example.com/h/abc123")
assert.Contains( assert.Contains(
t, body, t, body,
`hidden data-copy-target="entrypoint-url-ep-1"`, `hidden data-copy-target="entrypoint-url-ep-1"`,
internal/handlers/webhook.go
+4 -17
View File
@@ -88,14 +88,14 @@ func (h *Handlers) processWebhookRequest(
headersJSON, err := json.Marshal(r.Header) headersJSON, err := json.Marshal(r.Header)
if err != nil { if err != nil {
h.receiverError(w, "failed to serialize headers", err) h.serverError(w, "failed to serialize headers", err)
return return
} }
targets, err := h.loadActiveTargets(entrypoint.WebhookID) targets, err := h.loadActiveTargets(entrypoint.WebhookID)
if err != nil { if err != nil {
h.receiverError(w, "failed to query targets", err) h.serverError(w, "failed to query targets", err)
return return
} }
@@ -131,7 +131,7 @@ func (h *Handlers) lookupEntrypoint(
"path = ?", entrypointUUID, "path = ?", entrypointUUID,
).First(&entrypoint) ).First(&entrypoint)
if result.Error != nil { if result.Error != nil {
// The receiver is unauthenticated and /webhook/{uuid} // The receiver is unauthenticated and /h/{uuid}
// matches any single segment, so this value is entirely // matches any single segment, so this value is entirely
// client-chosen on exactly the branch where the lookup // client-chosen on exactly the branch where the lookup
// failed. DEBUG is off by default; the cap is what keeps // failed. DEBUG is off by default; the cap is what keeps
@@ -196,7 +196,7 @@ func (h *Handlers) createAndDeliverEvent(
targets, targets,
) )
if err != nil { if err != nil {
h.receiverError(w, "failed to store webhook event", err) h.serverError(w, "failed to store webhook event", err)
return return
} }
@@ -204,19 +204,6 @@ func (h *Handlers) createAndDeliverEvent(
h.finishWebhookResponse(w, event, entrypoint, tasks) h.finishWebhookResponse(w, event, entrypoint, tasks)
} }
// receiverError logs an error and answers the sender with a plain-text
// 500. The receiver's answers are for programs, so it never sends the
// error page the web UI uses.
func (h *Handlers) receiverError(
w http.ResponseWriter, msg string, err error,
) {
h.log.Error(msg, "error", err)
http.Error(
w, "Internal server error",
http.StatusInternalServerError,
)
}
// eventSource carries the fields a new event is built from. The // eventSource carries the fields a new event is built from. The
// receiver fills it from the live request; the resubmit handler fills // receiver fills it from the live request; the resubmit handler fills
// it from a stored event. Both then go through createAndFanOut, so an // it from a stored event. Both then go through createAndFanOut, so an
internal/logfield/logfield_test.go
+1 -1
View File
@@ -201,7 +201,7 @@ func TestTruncate_LeavesShortValuesAlone(t *testing.T) {
t.Parallel() t.Parallel()
for _, s := range []string{ for _, s := range []string{
"", "GET", "/source/abc/edit", "Mozilla/5.0 (X11)", "", "GET", "/hook/abc/edit", "Mozilla/5.0 (X11)",
} { } {
assert.Equal(t, s, logfield.Truncate(s, budget)) assert.Equal(t, s, logfield.Truncate(s, budget))
} }
internal/middleware/accesslog_test.go
+8 -8
View File
@@ -119,7 +119,7 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
) )
router.HandleFunc( router.HandleFunc(
"/webhook/{uuid}", "/h/{uuid}",
func(w http.ResponseWriter, r *http.Request) { func(w http.ResponseWriter, r *http.Request) {
// Stands in for the real handler: an unknown entrypoint // Stands in for the real handler: an unknown entrypoint
// UUID 404s, a known one succeeds. // UUID 404s, a known one succeeds.
@@ -271,11 +271,11 @@ func TestAccessLog_InventedReceiverPathsLogRoutePattern(t *testing.T) {
assertFloodIsBounded( assertFloodIsBounded(
t, t,
func(i int) string { func(i int) string {
return "/webhook/" + attackerMarker + return "/h/" + attackerMarker +
strings.Repeat("x", i) + "?q=" + attackerMarker strings.Repeat("x", i) + "?q=" + attackerMarker
}, },
http.StatusNotFound, http.StatusNotFound,
"/webhook/{uuid}", "/h/{uuid}",
) )
} }
@@ -346,10 +346,10 @@ type sizeCase struct {
func lineSizeCases() map[string]sizeCase { func lineSizeCases() map[string]sizeCase {
cases := map[string]sizeCase{ cases := map[string]sizeCase{
"oversized path segment": { "oversized path segment": {
target: "/webhook/" + attackerMarker + target: "/h/" + attackerMarker +
strings.Repeat("x", oversizedSegmentBytes), strings.Repeat("x", oversizedSegmentBytes),
wantStatus: http.StatusNotFound, wantStatus: http.StatusNotFound,
wantURL: "/webhook/{uuid}", wantURL: "/h/{uuid}",
bound: maxLineBytes, bound: maxLineBytes,
}, },
// /.well-known/healthcheck answers 200 to anyone and has no // /.well-known/healthcheck answers 200 to anyone and has no
@@ -605,14 +605,14 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
router := accessLogRouter(m) router := accessLogRouter(m)
assert.Equal( assert.Equal(
t, http.StatusOK, get(t, router, "/webhook/known?src=ci"), t, http.StatusOK, get(t, router, "/h/known?src=ci"),
) )
// The path resolved against a stored entrypoint, so it stays. The // The path resolved against a stored entrypoint, so it stays. The
// query never does: see TestAccessLog_UnauthenticatedSuccess... // query never does: see TestAccessLog_UnauthenticatedSuccess...
entries := accessLogEntries(t, buf) entries := accessLogEntries(t, buf)
require.Len(t, entries, 1) require.Len(t, entries, 1)
assert.Equal(t, "/webhook/known?(redacted)", entries[0]["url"]) assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
assert.NotContains(t, buf.String(), "src=ci") assert.NotContains(t, buf.String(), "src=ci")
} }
@@ -640,7 +640,7 @@ func TestAccessLog_RetainsEveryOtherField(t *testing.T) {
assert.Equal( assert.Equal(
t, t,
http.StatusNotFound, http.StatusNotFound,
get(t, router, "/webhook/"+attackerMarker), get(t, router, "/h/"+attackerMarker),
) )
entries := accessLogEntries(t, buf) entries := accessLogEntries(t, buf)
internal/middleware/csrf.go
+4 -6
View File
@@ -19,7 +19,7 @@ func CSRFToken(r *http.Request) string {
// key to sign a CSRF cookie and validates a masked token submitted via // key to sign a CSRF cookie and validates a masked token submitted via
// the "csrf_token" form field (or the "X-CSRF-Token" header) on // the "csrf_token" form field (or the "X-CSRF-Token" header) on
// POST/PUT/PATCH/DELETE requests. Requests with an invalid or missing // POST/PUT/PATCH/DELETE requests. Requests with an invalid or missing
// token are logged and answered by forbidden, which must write the 403. // token receive a 403 Forbidden response.
// //
// The middleware detects the client-facing transport protocol // The middleware detects the client-facing transport protocol
// per-request via reqtls.IsTLS, the single TLS predicate the session // per-request via reqtls.IsTLS, the single TLS predicate the session
@@ -36,14 +36,12 @@ func CSRFToken(r *http.Request) string {
// Two gorilla/csrf instances are maintained — one with Secure cookies // Two gorilla/csrf instances are maintained — one with Secure cookies
// (for TLS) and one without (for plaintext HTTP) — because the // (for TLS) and one without (for plaintext HTTP) — because the
// csrf.Secure option is set at creation time, not per-request. // csrf.Secure option is set at creation time, not per-request.
func (m *Middleware) CSRF( func (m *Middleware) CSRF() func(http.Handler) http.Handler {
forbidden http.Handler,
) func(http.Handler) http.Handler {
csrfErrorHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { csrfErrorHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// CSRF is registered ahead of RequireAuth on every route // CSRF is registered ahead of RequireAuth on every route
// group that uses it, so this WARN is reachable by an // group that uses it, so this WARN is reachable by an
// unauthenticated client: a POST with no token to // unauthenticated client: a POST with no token to
// /source/<any length of any text>/edit lands here. The // /hook/<any length of any text>/edit lands here. The
// method and path are capped against the same budgets as // method and path are capped against the same budgets as
// the access log. remote_addr is set by net/http from the // the access log. remote_addr is set by net/http from the
// accepted connection rather than by the client, and // accepted connection rather than by the client, and
@@ -59,7 +57,7 @@ func (m *Middleware) CSRF(
"remote_addr", r.RemoteAddr, "remote_addr", r.RemoteAddr,
"reason", csrf.FailureReason(r), "reason", csrf.FailureReason(r),
) )
forbidden.ServeHTTP(w, r) http.Error(w, "Forbidden - invalid CSRF token", http.StatusForbidden)
}) })
key := m.session.GetKey() key := m.session.GetKey()
internal/middleware/csrf_test.go
+9 -15
View File
@@ -18,12 +18,6 @@ import (
// csrfCookieName is the gorilla/csrf cookie name. // csrfCookieName is the gorilla/csrf cookie name.
const csrfCookieName = "_gorilla_csrf" const csrfCookieName = "_gorilla_csrf"
// forbidden stands in for the error page the server hands CSRF to
// answer a refused request with.
func forbidden(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusForbidden)
}
// csrfGetToken performs a GET request through the CSRF middleware // csrfGetToken performs a GET request through the CSRF middleware
// and returns the token and cookies. // and returns the token and cookies.
func csrfGetToken( func csrfGetToken(
@@ -104,7 +98,7 @@ func TestCSRF_GETSetsToken(t *testing.T) {
var gotToken string var gotToken string
handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc( handler := m.CSRF()(http.HandlerFunc(
func(_ http.ResponseWriter, r *http.Request) { func(_ http.ResponseWriter, r *http.Request) {
gotToken = middleware.CSRFToken(r) gotToken = middleware.CSRFToken(r)
}, },
@@ -126,7 +120,7 @@ func TestCSRF_POSTWithValidToken(t *testing.T) {
t.Parallel() t.Parallel()
m, _ := testMiddleware(t, config.EnvironmentDev) m, _ := testMiddleware(t, config.EnvironmentDev)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
getReq := httptest.NewRequestWithContext( getReq := httptest.NewRequestWithContext(
context.Background(), context.Background(),
@@ -158,7 +152,7 @@ func csrfPOSTWithoutTokenTest(
t.Helper() t.Helper()
m, _ := testMiddleware(t, env) m, _ := testMiddleware(t, env)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
// GET to establish the CSRF cookie // GET to establish the CSRF cookie
getHandler := csrfMW(http.HandlerFunc( getHandler := csrfMW(http.HandlerFunc(
@@ -215,7 +209,7 @@ func TestCSRF_POSTWithInvalidToken(t *testing.T) {
t.Parallel() t.Parallel()
m, _ := testMiddleware(t, config.EnvironmentDev) m, _ := testMiddleware(t, config.EnvironmentDev)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
// GET to establish the CSRF cookie // GET to establish the CSRF cookie
getHandler := csrfMW(http.HandlerFunc( getHandler := csrfMW(http.HandlerFunc(
@@ -271,7 +265,7 @@ func TestCSRF_GETDoesNotValidate(t *testing.T) {
var called bool var called bool
handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc( handler := m.CSRF()(http.HandlerFunc(
func(_ http.ResponseWriter, _ *http.Request) { func(_ http.ResponseWriter, _ *http.Request) {
called = true called = true
}, },
@@ -334,7 +328,7 @@ func csrfTookStrictPath(
t.Helper() t.Helper()
m, _ := testMiddleware(t, env) m, _ := testMiddleware(t, env)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
newReq := func(method string) *http.Request { newReq := func(method string) *http.Request {
r := httptest.NewRequestWithContext( r := httptest.NewRequestWithContext(
@@ -483,7 +477,7 @@ func TestCSRF_ProdMode_PlaintextHTTP_POSTWithValidToken(
t.Parallel() t.Parallel()
m, _ := testMiddleware(t, config.EnvironmentProd) m, _ := testMiddleware(t, config.EnvironmentProd)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
getReq := httptest.NewRequestWithContext( getReq := httptest.NewRequestWithContext(
context.Background(), context.Background(),
@@ -523,7 +517,7 @@ func TestCSRF_ProdMode_BehindProxy_POSTWithValidToken(
t.Parallel() t.Parallel()
m, _ := testMiddleware(t, config.EnvironmentProd) m, _ := testMiddleware(t, config.EnvironmentProd)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
getReq := httptest.NewRequestWithContext( getReq := httptest.NewRequestWithContext(
context.Background(), context.Background(),
@@ -568,7 +562,7 @@ func TestCSRF_ProdMode_DirectTLS_POSTWithValidToken(
t.Parallel() t.Parallel()
m, _ := testMiddleware(t, config.EnvironmentProd) m, _ := testMiddleware(t, config.EnvironmentProd)
csrfMW := m.CSRF(http.HandlerFunc(forbidden)) csrfMW := m.CSRF()
getReq := httptest.NewRequestWithContext( getReq := httptest.NewRequestWithContext(
context.Background(), context.Background(),
internal/middleware/logbound_test.go
+4 -6
View File
@@ -260,9 +260,7 @@ func logSites() map[string]logSite {
) http.Handler { ) http.Handler {
t.Helper() t.Helper()
return m.CSRF(http.HandlerFunc(forbidden))( return m.CSRF()(unreachable(t))
unreachable(t),
)
}, },
send: postNoToken, send: postNoToken,
wantStatus: http.StatusForbidden, wantStatus: http.StatusForbidden,
@@ -385,7 +383,7 @@ func TestLogLines_ClientChosenPathDoesNotSizeTheLine(t *testing.T) {
t, newHandler, t, newHandler,
) )
path := "/source/" + path := "/hook/" +
oversizedPathSegment(fill) + "/edit" oversizedPathSegment(fill) + "/edit"
assert.Equal( assert.Equal(
@@ -436,7 +434,7 @@ func TestLoginThrottle_LogLineDoesNotTrackPathSize(t *testing.T) {
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodPost, http.MethodPost,
"/source/"+ "/hook/"+
oversizedPathSegment(fill)+"/login", oversizedPathSegment(fill)+"/login",
nil, nil,
) )
@@ -501,7 +499,7 @@ func TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog(
http.StatusRequestEntityTooLarge, http.StatusRequestEntityTooLarge,
postOversize( postOversize(
h, h,
"/source/"+segment(i)+"/edit", "/hook/"+segment(i)+"/edit",
), ),
) )
} }
internal/middleware/metrics.go
+1 -1
View File
@@ -40,7 +40,7 @@ const unmatchedMethod = unmatchedRoute
// //
// The pattern is what bounds the label's domain to the routes the // The pattern is what bounds the label's domain to the routes the
// service registers. The path does not bound it at all — every byte // service registers. The path does not bound it at all — every byte
// after /webhook/ is client-chosen, so labelling by path lets any // after /h/ is client-chosen, so labelling by path lets any
// unauthenticated client mint permanent series at will, and publishes // unauthenticated client mint permanent series at will, and publishes
// the entrypoint UUID (the receiver's only credential) in the scrape // the entrypoint UUID (the receiver's only credential) in the scrape
// while doing it. // while doing it.
internal/middleware/metrics_method_test.go
+1 -1
View File
@@ -50,7 +50,7 @@ func realMethods() []string {
// dimension varying, so any series growth a probe produces is the // dimension varying, so any series growth a probe produces is the
// method label's and nothing else's. // method label's and nothing else's.
func methodProbePath() string { func methodProbePath() string {
return "/webhook/" + uuid.NewString() return "/h/" + uuid.NewString()
} }
// inventedMethods returns n distinct RFC 9110 method tokens that no // inventedMethods returns n distinct RFC 9110 method tokens that no
internal/middleware/metrics_test.go
+6 -6
View File
@@ -28,7 +28,7 @@ const (
// receiverRoutePattern is the one handler label every receiver // receiverRoutePattern is the one handler label every receiver
// request must produce, however the client varies the path. // request must produce, however the client varies the path.
receiverRoutePattern = "/webhook/{uuid}" receiverRoutePattern = "/h/{uuid}"
// okRoute is a static route used to pin that the response-writer // okRoute is a static route used to pin that the response-writer
// interceptor still reports status and size after the handler id // interceptor still reports status and size after the handler id
@@ -143,13 +143,13 @@ func drivePaths(
return drive(t, h, probes) return drive(t, h, probes)
} }
// receiverPaths returns n distinct /webhook/ paths, each naming a // receiverPaths returns n distinct /h/ paths, each naming a
// fresh UUID exactly as an unauthenticated flood would. // fresh UUID exactly as an unauthenticated flood would.
func receiverPaths(n int) []string { func receiverPaths(n int) []string {
paths := make([]string, 0, n) paths := make([]string, 0, n)
for range n { for range n {
paths = append(paths, "/webhook/"+uuid.NewString()) paths = append(paths, "/h/"+uuid.NewString())
} }
return paths return paths
@@ -220,7 +220,7 @@ func keys(set map[string]struct{}) []string {
// TestMetrics_DistinctReceiverPathsMintOneLabelSet is the direct // TestMetrics_DistinctReceiverPathsMintOneLabelSet is the direct
// assertion the issue asks for: N requests to N distinct // assertion the issue asks for: N requests to N distinct
// /webhook/<uuid> paths must produce exactly ONE handler label, the // /h/<uuid> paths must produce exactly ONE handler label, the
// route pattern. Before the fix this produced N of them. // route pattern. Before the fix this produced N of them.
func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) { func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
t.Parallel() t.Parallel()
@@ -250,7 +250,7 @@ func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
// The scrape must not republish the UUIDs it was driven with. // The scrape must not republish the UUIDs it was driven with.
// They are the receiver's only credential. // They are the receiver's only credential.
for _, p := range paths { for _, p := range paths {
id := strings.TrimPrefix(p, "/webhook/") id := strings.TrimPrefix(p, "/h/")
for label := range labels { for label := range labels {
assert.NotContains( assert.NotContains(
t, label, id, t, label, id,
@@ -354,7 +354,7 @@ func TestMetrics_UnmatchedPathsCollapseToTheSentinel(t *testing.T) {
if i%2 == 0 { if i%2 == 0 {
paths = append(paths, "/"+id) paths = append(paths, "/"+id)
} else { } else {
paths = append(paths, "/webhook/"+id+"/"+id) paths = append(paths, "/h/"+id+"/"+id)
} }
} }
internal/middleware/middleware.go
+2 -2
View File
@@ -257,7 +257,7 @@ func concreteLogURL(r *http.Request) string {
// //
// 3xx and 4xx responses get the chi route pattern instead. Those are // 3xx and 4xx responses get the chi route pattern instead. Those are
// the outcomes an unauthenticated client drives for free: 404 or 429 // the outcomes an unauthenticated client drives for free: 404 or 429
// on any invented /webhook/ path, 303 to the login page on any // on any invented /h/ path, 303 to the login page on any
// invented /user/ path. Logging the concrete URL there lets a flood // invented /user/ path. Logging the concrete URL there lets a flood
// write attacker-chosen text, of attacker-chosen length, into the // write attacker-chosen text, of attacker-chosen length, into the
// operator's log at one line per request. The pattern comes from the // operator's log at one line per request. The pattern comes from the
@@ -560,7 +560,7 @@ func (s *Middleware) MaxBodySize(
// internal/server/routes.go), so an // internal/server/routes.go), so an
// unauthenticated client reaches it with a path // unauthenticated client reaches it with a path
// of its own choosing and its own length — // of its own choosing and its own length —
// POST /source/<8 KB>/edit with an oversize // POST /hook/<8 KB>/edit with an oversize
// declared Content-Length costs nothing to // declared Content-Length costs nothing to
// send. At WARN, on by default, that is a // send. At WARN, on by default, that is a
// write into the operator's log sized by the // write into the operator's log sized by the
internal/middleware/middleware_test.go
+1 -1
View File
@@ -640,7 +640,7 @@ func TestNoCache_SetsHeaders(t *testing.T) {
req := httptest.NewRequestWithContext( req := httptest.NewRequestWithContext(
context.Background(), context.Background(),
http.MethodGet, "/sources", nil, http.MethodGet, "/hooks", nil,
) )
w := httptest.NewRecorder() w := httptest.NewRecorder()
internal/middleware/ratelimit.go
+2 -2
View File
@@ -63,7 +63,7 @@ const (
// receiverAggregateMultiplier scales the configured // receiverAggregateMultiplier scales the configured
// per-entrypoint receiver limit into the aggregate limit one // per-entrypoint receiver limit into the aggregate limit one
// client IP may spend across the whole /webhook/* route. Ten // client IP may spend across the whole /h/* route. Ten
// entrypoints' worth lets a single sender address drive several // entrypoints' worth lets a single sender address drive several
// entrypoints at their full rate, while still capping what one // entrypoints at their full rate, while still capping what one
// address costs the unauthenticated receiver. // address costs the unauthenticated receiver.
@@ -389,7 +389,7 @@ func (m *Middleware) postRateLimit(
// It is Config.ReceiverRateLimit requests per minute. // It is Config.ReceiverRateLimit requests per minute.
// //
// That limit alone bounds nothing in aggregate. The route pattern // That limit alone bounds nothing in aggregate. The route pattern
// /webhook/{uuid} matches any single segment, so a client that // /h/{uuid} matches any single segment, so a client that
// invents a fresh path per request mints a fresh bucket per request // invents a fresh path per request mints a fresh bucket per request
// and never refills one — and every such request still reaches the // and never refills one — and every such request still reaches the
// handler's entrypoint lookup before it 404s. The outer limit is // handler's entrypoint lookup before it 404s. The outer limit is
internal/middleware/ratelimit_test.go
+12 -12
View File
@@ -275,7 +275,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
// pass. // pass.
for i := range limit { for i := range limit {
w := receiverPost( w := receiverPost(
handler, "9.9.9.9:1234", "/webhook/uuid-a", handler, "9.9.9.9:1234", "/h/uuid-a",
) )
assert.Equal( assert.Equal(
t, http.StatusOK, w.Code, t, http.StatusOK, w.Code,
@@ -286,7 +286,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
// The next request over the limit is rejected with a 429 // The next request over the limit is rejected with a 429
// carrying a Retry-After header. // carrying a Retry-After header.
w := receiverPost( w := receiverPost(
handler, "9.9.9.9:1234", "/webhook/uuid-a", handler, "9.9.9.9:1234", "/h/uuid-a",
) )
assert.Equal(t, http.StatusTooManyRequests, w.Code) assert.Equal(t, http.StatusTooManyRequests, w.Code)
assert.NotEmpty( assert.NotEmpty(
@@ -296,7 +296,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
// The same IP is not limited on a different entrypoint. // The same IP is not limited on a different entrypoint.
w = receiverPost( w = receiverPost(
handler, "9.9.9.9:1234", "/webhook/uuid-b", handler, "9.9.9.9:1234", "/h/uuid-b",
) )
assert.Equal( assert.Equal(
t, http.StatusOK, w.Code, t, http.StatusOK, w.Code,
@@ -305,7 +305,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
// A different IP is not limited on the same entrypoint. // A different IP is not limited on the same entrypoint.
w = receiverPost( w = receiverPost(
handler, "8.8.8.8:1234", "/webhook/uuid-a", handler, "8.8.8.8:1234", "/h/uuid-a",
) )
assert.Equal( assert.Equal(
t, http.StatusOK, w.Code, t, http.StatusOK, w.Code,
@@ -322,7 +322,7 @@ func TestReceiverRateLimit_CountsEveryMethod(t *testing.T) {
const ( const (
limit = 2 limit = 2
ip = "7.7.7.7:1234" ip = "7.7.7.7:1234"
path = "/webhook/uuid-c" path = "/h/uuid-c"
) )
handler := receiverLimitedHandler(t, limit) handler := receiverLimitedHandler(t, limit)
@@ -715,7 +715,7 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
// none of them shares a per-entrypoint bucket with another. // none of them shares a per-entrypoint bucket with another.
for i := range aggregate { for i := range aggregate {
w := receiverPost( w := receiverPost(
handler, ip, fmt.Sprintf("/webhook/invented-%d", i), handler, ip, fmt.Sprintf("/h/invented-%d", i),
) )
assert.Equal( assert.Equal(
t, http.StatusOK, w.Code, t, http.StatusOK, w.Code,
@@ -724,17 +724,17 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
} }
w := receiverPost( w := receiverPost(
handler, ip, fmt.Sprintf("/webhook/invented-%d", aggregate), handler, ip, fmt.Sprintf("/h/invented-%d", aggregate),
) )
assert.Equal( assert.Equal(
t, http.StatusTooManyRequests, w.Code, t, http.StatusTooManyRequests, w.Code,
"a client must not be able to raise its aggregate rate "+ "a client must not be able to raise its aggregate rate "+
"against /webhook/* by varying the path", "against /h/* by varying the path",
) )
// The aggregate limit is still per client IP: exhausting one // The aggregate limit is still per client IP: exhausting one
// address must not throttle another. // address must not throttle another.
w = receiverPost(handler, "6.6.6.7:1234", "/webhook/invented-0") w = receiverPost(handler, "6.6.6.7:1234", "/h/invented-0")
assert.Equal( assert.Equal(
t, http.StatusOK, w.Code, t, http.StatusOK, w.Code,
"a different client IP must not be affected", "a different client IP must not be affected",
@@ -771,7 +771,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
// limit requests are served; the rest are rejected by the // limit requests are served; the rest are rejected by the
// per-entrypoint limiter but still count against the aggregate. // per-entrypoint limiter but still count against the aggregate.
for i := range aggregate { for i := range aggregate {
w := receiverPost(handler, ip, "/webhook/exhausted") w := receiverPost(handler, ip, "/h/exhausted")
want := http.StatusTooManyRequests want := http.StatusTooManyRequests
if i < limit { if i < limit {
@@ -784,7 +784,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
) )
} }
w := receiverPost(handler, ip, "/webhook/never-used") w := receiverPost(handler, ip, "/h/never-used")
assert.Equal( assert.Equal(
t, http.StatusTooManyRequests, w.Code, t, http.StatusTooManyRequests, w.Code,
"requests rejected per entrypoint must still count "+ "requests rejected per entrypoint must still count "+
@@ -823,7 +823,7 @@ func TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer(
const ( const (
limit = 3 limit = 3
peer = "203.0.113.10:44444" peer = "203.0.113.10:44444"
path = "/webhook/uuid-d" path = "/h/uuid-d"
) )
handler := receiverLimitedHandler(t, limit) handler := receiverLimitedHandler(t, limit)
internal/middleware/recoverer.go
+3 -37
View File
@@ -109,8 +109,7 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
// Recoverer returns middleware that turns a handler panic into one // Recoverer returns middleware that turns a handler panic into one
// structured ERROR record and a 500, rather than a dropped // structured ERROR record and a 500, rather than a dropped
// connection. The 500 is page when page is not nil, and plain text // connection.
// when it is nil or when page panics before writing anything.
// //
// It replaces chi's middleware.Recoverer, which does neither on a // It replaces chi's middleware.Recoverer, which does neither on a
// current Go release. chi v1.5.5's pretty-printer scans the stack for // current Go release. chi v1.5.5's pretty-printer scans the stack for
@@ -137,13 +136,9 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
// //
// Unlike http.Error on its own, it deletes any Set-Cookie the handler // Unlike http.Error on its own, it deletes any Set-Cookie the handler
// set before panicking, because a request that failed must not hand // set before panicking, because a request that failed must not hand
// the client a credential. It touches no other header: when page // the client a credential; every other header is left to http.Error.
// answers, every other header the handler set goes out with it, apart
// from any page sets itself; otherwise they are left to http.Error.
// See https://git.eeqj.de/sneak/webhooker/issues/193. // See https://git.eeqj.de/sneak/webhooker/issues/193.
func (s *Middleware) Recoverer( func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
page http.Handler,
) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler {
return http.HandlerFunc(func( return http.HandlerFunc(func(
w http.ResponseWriter, w http.ResponseWriter,
@@ -176,14 +171,6 @@ func (s *Middleware) Recoverer(
rw.Header().Del("Set-Cookie") rw.Header().Del("Set-Cookie")
if page != nil {
s.servePage(rw, r, page)
}
if rw.committed {
return
}
http.Error( http.Error(
rw, rw,
http.StatusText( http.StatusText(
@@ -198,27 +185,6 @@ func (s *Middleware) Recoverer(
} }
} }
// servePage answers with page. A panic in page itself is logged and
// recovered here, so the Recoverer can still send its plain 500.
func (s *Middleware) servePage(
w http.ResponseWriter,
r *http.Request,
page http.Handler,
) {
defer func() {
rvr := recover()
if rvr != nil {
s.log.Error("error page panic",
"panic", logfield.Truncate(
fmt.Sprint(rvr), maxPanicValueBytes,
),
)
}
}()
page.ServeHTTP(w, r)
}
// logPanic writes the record. Every field it can grow is truncated to // logPanic writes the record. Every field it can grow is truncated to
// a fixed budget, so MaxPanicLogLineBytes holds. // a fixed budget, so MaxPanicLogLineBytes holds.
// //
internal/middleware/recoverer_test.go
+2 -58
View File
@@ -76,7 +76,7 @@ func newRecovererProbe(
// Logging outside so the recovered 500 is the status it records. // Logging outside so the recovered 500 is the status it records.
router.Use(chimw.RequestID) router.Use(chimw.RequestID)
router.Use(m.Logging()) router.Use(m.Logging())
router.Use(m.Recoverer(nil)) router.Use(m.Recoverer())
router.Get("/probe", handler) router.Get("/probe", handler)
serverErrors := new(bytes.Buffer) serverErrors := new(bytes.Buffer)
@@ -637,7 +637,7 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
m, _ := capturingMiddleware(t) m, _ := capturingMiddleware(t)
handler := m.Recoverer(nil)(http.HandlerFunc( handler := m.Recoverer()(http.HandlerFunc(
func(w http.ResponseWriter, _ *http.Request) { func(w http.ResponseWriter, _ *http.Request) {
_, _ = w.Write([]byte("chunk")) _, _ = w.Write([]byte("chunk"))
@@ -672,59 +672,3 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
assert.Equal(t, http.StatusOK, resp.StatusCode) assert.Equal(t, http.StatusOK, resp.StatusCode)
assert.Equal(t, "chunk", string(body)) assert.Equal(t, "chunk", string(body))
} }
// TestRecovererAnswersWithThePage covers a recoverer given a page:
// the panic is logged as before, and the 500 is that page.
func TestRecovererAnswersWithThePage(t *testing.T) {
t.Parallel()
m, logs := capturingMiddleware(t)
page := http.HandlerFunc(
func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusInternalServerError)
_, _ = w.Write([]byte("the error page"))
},
)
w := httptest.NewRecorder()
m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
w, httptest.NewRequestWithContext(
t.Context(), http.MethodGet, "/", nil,
),
)
assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Equal(t, "the error page", w.Body.String())
assert.Contains(t, logs.String(), `"msg":"handler panic"`)
assert.Contains(t, logs.String(), panicMarker)
}
// TestRecovererFallsBackWhenThePagePanics covers a page that panics
// before writing anything: both panics are logged, and the client
// still gets the plain 500.
func TestRecovererFallsBackWhenThePagePanics(t *testing.T) {
t.Parallel()
m, logs := capturingMiddleware(t)
const pagePanic = "QQERRORPAGEPANICQQ"
page := http.HandlerFunc(
func(http.ResponseWriter, *http.Request) {
panic(pagePanic)
},
)
w := httptest.NewRecorder()
m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
w, httptest.NewRequestWithContext(
t.Context(), http.MethodGet, "/", nil,
),
)
assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Equal(t, "Internal Server Error\n", w.Body.String())
assert.Contains(t, logs.String(), panicMarker)
assert.Contains(t, logs.String(), pagePanic)
}
internal/server/error_page_test.go
-220
View File
@@ -1,220 +0,0 @@
package server_test
import (
"context"
"net/http"
"net/http/httptest"
"net/url"
"strconv"
"testing"
"github.com/getsentry/sentry-go"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"sneak.berlin/go/webhooker/internal/config"
"sneak.berlin/go/webhooker/internal/server"
)
// The link back the error page offers: to the webhook list for a
// signed-in user, to sign-in for anyone else.
const (
backToWebhooks = `<a href="/sources" class="btn-secondary">` +
`Back to webhooks</a>`
backToSignIn = `<a href="/pages/login" class="btn-primary">` +
`Sign in</a>`
)
// assertErrorPage checks that w is the error page for status, in the
// normal layout, offering link.
func assertErrorPage(
t *testing.T,
w *httptest.ResponseRecorder,
status int,
link string,
) {
t.Helper()
body := w.Body.String()
assert.Equal(t, status, w.Code)
assert.Equal(
t, "text/html; charset=utf-8", w.Header().Get("Content-Type"),
)
assert.Equal(t, "no-store", w.Header().Get("Cache-Control"))
assert.Contains(t, body, `<nav class="app-bar"`)
assert.Contains(
t, body, strconv.Itoa(status)+" "+http.StatusText(status),
)
assert.Contains(t, body, link)
}
func TestErrorPage_DeletedWebhook(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "owner", "somepassword")
cookies := env.authCookies(t, userID, "owner")
wh := env.seedWebhook(t, userID)
require.NoError(t, env.db.DB().Delete(wh).Error)
w := env.get("/source/"+wh.ID, cookies)
assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
}
func TestErrorPage_DeletedTarget(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "owner", "somepassword")
cookies := env.authCookies(t, userID, "owner")
wh := env.seedWebhook(t, userID)
tgt := env.seedTarget(t, wh.ID)
require.NoError(t, env.db.DB().Delete(tgt).Error)
w := env.get(
"/source/"+wh.ID+"/targets/"+tgt.ID+"/edit", cookies,
)
assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
}
func TestErrorPage_UnknownPath(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "owner", "somepassword")
cookies := env.authCookies(t, userID, "owner")
assertErrorPage(
t, env.get("/no-such-page", nil),
http.StatusNotFound, backToSignIn,
)
// Outside every route group there is no form token, so the
// page leaves out the logout form rather than offer one that
// would be refused.
w := env.get("/no-such-page", cookies)
assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
assert.NotContains(t, w.Body.String(), `action="/pages/logout"`)
// Inside a route group the page has a token, and logout works.
wh := env.seedWebhook(t, userID)
w = env.get("/source/"+wh.ID+"/no-such-page", cookies)
assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
assert.Contains(t, w.Body.String(), `action="/pages/logout"`)
}
func TestErrorPage_BadCSRFToken(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
form := url.Values{}
form.Set("username", "someone")
form.Set("password", "irrelevant")
form.Set("csrf_token", "not-a-token")
assertErrorPage(
t, env.post("/pages/login", form, nil),
http.StatusForbidden, backToSignIn,
)
userID, _ := env.seedUser(t, "owner", "somepassword")
cookies := env.authCookies(t, userID, "owner")
wh := env.seedWebhook(t, userID)
edit := url.Values{}
edit.Set("name", "renamed")
assertErrorPage(
t, env.post("/source/"+wh.ID+"/edit", edit, cookies),
http.StatusForbidden, backToWebhooks,
)
}
// TestErrorPage_PanicOnAdminPage sends a panicking handler in an
// admin page route group through the real router, with error
// tracking on: the client gets the 500 error page, and the tracker
// still gets the panic, once. The same panic outside the admin page
// route groups keeps the plain 500.
func TestErrorPage_PanicOnAdminPage(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
transport := &captureTransport{}
opts := server.SentryClientOptionsForTest(
"https://public@sentry.invalid/1", "webhooker-test",
)
opts.Transport = transport
client, err := sentry.NewClient(opts)
require.NoError(t, err)
serve := func(router http.Handler, path string) *httptest.ResponseRecorder {
req := httptest.NewRequestWithContext(
sentry.SetHubOnContext(
context.Background(),
sentry.NewHub(client, sentry.NewScope()),
),
http.MethodGet, path, nil,
)
w := httptest.NewRecorder()
router.ServeHTTP(w, req)
return w
}
w := serve(
server.NewRouterWithPageProbeForTest(
env.log.Get(), env.cfg, env.mw, env.hnd,
true, panicProbeHandler,
),
server.PageProbePattern,
)
assertErrorPage(t, w, http.StatusInternalServerError, backToSignIn)
w = serve(
server.NewRouterWithProbeForTest(
env.log.Get(), env.cfg, env.mw, env.hnd,
true, panicProbeHandler,
),
server.ProbePattern,
)
assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Equal(t, "Internal Server Error\n", w.Body.String())
require.Len(t, transport.events, 2)
for _, event := range transport.events {
assert.Contains(t, marshalEvent(t, event), panicProbeMarker)
}
}
// TestErrorPage_ReceiverStaysPlain pins that the error page is for
// the web UI only: a sender posting to an entrypoint that does not
// exist still gets the plain-text answer.
func TestErrorPage_ReceiverStaysPlain(t *testing.T) {
t.Parallel()
// newTestEnv leaves the receiver rate limit at zero, which
// refuses every request before it reaches the receiver.
env := newTestEnvWithConfig(t, &config.Config{
DataDir: t.TempDir(),
Environment: config.EnvironmentDev,
ReceiverRateLimit: 10,
})
w := env.post("/webhook/no-such-entrypoint", url.Values{}, nil)
assert.Equal(t, http.StatusNotFound, w.Code)
assert.Equal(t, "404 page not found\n", w.Body.String())
}
internal/server/export_test.go
-37
View File
@@ -5,7 +5,6 @@ import (
"net/http" "net/http"
"github.com/getsentry/sentry-go" "github.com/getsentry/sentry-go"
"github.com/go-chi/chi"
"sneak.berlin/go/webhooker/internal/config" "sneak.berlin/go/webhooker/internal/config"
"sneak.berlin/go/webhooker/internal/handlers" "sneak.berlin/go/webhooker/internal/handlers"
"sneak.berlin/go/webhooker/internal/middleware" "sneak.berlin/go/webhooker/internal/middleware"
@@ -102,39 +101,3 @@ func NewRouterWithProbeForTest(
return s.router return s.router
} }
// PageProbePattern is where NewRouterWithPageProbeForTest serves its
// probe: inside the /pages route group, the admin page group a
// request reaches without signing in.
const PageProbePattern = "/pages/probe"
// NewRouterWithPageProbeForTest is NewRouterWithProbeForTest with the
// probe added to the /pages route group once SetupRoutes has built
// it, so the probe runs behind that group's own middleware exactly as
// the group's real routes do.
func NewRouterWithPageProbeForTest(
log *slog.Logger,
cfg *config.Config,
mw *middleware.Middleware,
h *handlers.Handlers,
sentryEnabled bool,
probe http.HandlerFunc,
) http.Handler {
s := &Server{
log: log,
mw: mw,
h: h,
params: ServerParams{Config: cfg},
}
s.sentryEnabled.Store(sentryEnabled)
s.SetupRoutes()
for _, route := range s.router.Routes() {
pages, ok := route.SubRoutes.(chi.Router)
if ok && route.Pattern == "/pages/*" {
pages.Get("/probe", probe)
}
}
return s.router
}
internal/server/routes.go
+18 -49
View File
@@ -15,10 +15,9 @@ import (
// bytes) for form POST endpoints. 1 MB is generous for any form // bytes) for form POST endpoints. 1 MB is generous for any form
// submission while preventing abuse from oversized payloads. // submission while preventing abuse from oversized payloads.
// //
// The four admin page route groups below (/pages, /user/{username}, // Every route group below installs MaxBodySize(maxFormBodySize) as
// /sources and /source/{sourceID}) install MaxBodySize(maxFormBodySize) // its FIRST middleware, ahead of both CSRF and RequireAuth. Both
// right after their recoverer and error reporting, ahead of both CSRF // orderings are deliberate.
// and RequireAuth. Both orderings are deliberate.
// //
// Ahead of CSRF because gorilla/csrf parses the form. The cap has to // Ahead of CSRF because gorilla/csrf parses the form. The cap has to
// be installed before anything reads the body, or the parse runs // be installed before anything reads the body, or the parse runs
@@ -47,14 +46,6 @@ const requestTimeout = 60 * time.Second
// server's router. // server's router.
func (s *Server) SetupRoutes() { func (s *Server) SetupRoutes() {
s.router = chi.NewRouter() s.router = chi.NewRouter()
// An unknown path gets the error page. Registered before the
// global middleware, because chi wraps a not-found handler in the
// middleware already on its router, which would then run twice.
// The route groups below wrap it in their own middleware the same
// way; running theirs twice is harmless.
s.router.NotFound(s.h.HandleErrorPage(http.StatusNotFound))
s.setupGlobalMiddleware() s.setupGlobalMiddleware()
s.setupRoutes() s.setupRoutes()
} }
@@ -78,33 +69,23 @@ func (s *Server) setupGlobalMiddleware() {
// Panic recovery, deliberately here rather than first. It has to // Panic recovery, deliberately here rather than first. It has to
// run inside every middleware that observes the response, so the // run inside every middleware that observes the response, so the
// 500 it writes is the status the access log records and the // 500 it writes is the status the access log records and the
// metrics count, and outside the sentryhttp handler, whose // metrics count, and outside the sentryhttp handler below, whose
// Repanic option needs something further out to catch what it // Repanic option needs something further out to catch what it
// re-raises. chi's own middleware.Recoverer held the first slot // re-raises. chi's own middleware.Recoverer held the first slot
// until it was measured: on a current Go release it crashes // until it was measured: on a current Go release it crashes
// inside its stack pretty-printer instead of recovering, so the // inside its stack pretty-printer instead of recovering, so the
// connection dropped and the original panic was never reported. // connection dropped and the original panic was never reported.
// See https://git.eeqj.de/sneak/webhooker/issues/187. // See https://git.eeqj.de/sneak/webhooker/issues/187.
s.recoverPanics(s.router, nil) s.router.Use(s.mw.Recoverer())
}
// recoverPanics installs on r the recoverer, answering a panic with
// page (a plain 500 when page is nil), and inside it the Sentry error
// reporting (if SENTRY_DSN is set). Repanic is true so panics still
// bubble up to the recoverer.
//
// Each admin page route group installs its own, with the error page,
// as its first middleware. A panic there is logged, reported and
// answered inside the group and never reaches the global recoverer,
// which keeps the plain 500 for every other route.
func (s *Server) recoverPanics(r chi.Router, page http.Handler) {
r.Use(s.mw.Recoverer(page))
// Sentry error reporting (if SENTRY_DSN is set). Repanic is
// true so panics still bubble up to the Recoverer middleware
// registered immediately above.
if s.sentryEnabled.Load() { if s.sentryEnabled.Load() {
sentryHandler := sentryhttp.New(sentryhttp.Options{ sentryHandler := sentryhttp.New(sentryhttp.Options{
Repanic: true, Repanic: true,
}) })
r.Use(sentryHandler.Handle) s.router.Use(sentryHandler.Handle)
} }
} }
@@ -166,13 +147,10 @@ func (s *Server) setupRoutes() {
func (s *Server) setupPageRoutes() { func (s *Server) setupPageRoutes() {
s.router.Route("/pages", func(r chi.Router) { s.router.Route("/pages", func(r chi.Router) {
s.recoverPanics(
r, s.h.HandleErrorPage(http.StatusInternalServerError),
)
// MaxBodySize precedes CSRF and RequireAuth deliberately; // MaxBodySize precedes CSRF and RequireAuth deliberately;
// see maxFormBodySize for why, and for what it costs. // see maxFormBodySize for why, and for what it costs.
r.Use(s.mw.MaxBodySize(maxFormBodySize)) r.Use(s.mw.MaxBodySize(maxFormBodySize))
r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden))) r.Use(s.mw.CSRF())
r.Use(s.mw.NoCache()) r.Use(s.mw.NoCache())
// The login POST carries no pre-emptive rate limiter. Behind // The login POST carries no pre-emptive rate limiter. Behind
@@ -191,13 +169,10 @@ func (s *Server) setupPageRoutes() {
func (s *Server) setupUserRoutes() { func (s *Server) setupUserRoutes() {
s.router.Route("/user/{username}", func(r chi.Router) { s.router.Route("/user/{username}", func(r chi.Router) {
s.recoverPanics(
r, s.h.HandleErrorPage(http.StatusInternalServerError),
)
// MaxBodySize precedes CSRF and RequireAuth deliberately; // MaxBodySize precedes CSRF and RequireAuth deliberately;
// see maxFormBodySize for why, and for what it costs. // see maxFormBodySize for why, and for what it costs.
r.Use(s.mw.MaxBodySize(maxFormBodySize)) r.Use(s.mw.MaxBodySize(maxFormBodySize))
r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden))) r.Use(s.mw.CSRF())
r.Use(s.mw.NoCache()) r.Use(s.mw.NoCache())
r.Use(s.mw.RequireAuth()) r.Use(s.mw.RequireAuth())
r.Get("/", s.h.HandleProfile()) r.Get("/", s.h.HandleProfile())
@@ -208,14 +183,11 @@ func (s *Server) setupUserRoutes() {
} }
func (s *Server) setupSourceRoutes() { func (s *Server) setupSourceRoutes() {
s.router.Route("/sources", func(r chi.Router) { s.router.Route("/hooks", func(r chi.Router) {
s.recoverPanics(
r, s.h.HandleErrorPage(http.StatusInternalServerError),
)
// MaxBodySize precedes CSRF and RequireAuth deliberately; // MaxBodySize precedes CSRF and RequireAuth deliberately;
// see maxFormBodySize for why, and for what it costs. // see maxFormBodySize for why, and for what it costs.
r.Use(s.mw.MaxBodySize(maxFormBodySize)) r.Use(s.mw.MaxBodySize(maxFormBodySize))
r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden))) r.Use(s.mw.CSRF())
r.Use(s.mw.NoCache()) r.Use(s.mw.NoCache())
r.Use(s.mw.RequireAuth()) r.Use(s.mw.RequireAuth())
r.Get("/", s.h.HandleSourceList()) r.Get("/", s.h.HandleSourceList())
@@ -223,28 +195,25 @@ func (s *Server) setupSourceRoutes() {
r.Post("/new", s.h.HandleSourceCreateSubmit()) r.Post("/new", s.h.HandleSourceCreateSubmit())
}) })
s.router.Route("/source/{sourceID}", func(r chi.Router) { s.router.Route("/hook/{sourceID}", func(r chi.Router) {
s.recoverPanics(
r, s.h.HandleErrorPage(http.StatusInternalServerError),
)
// MaxBodySize precedes CSRF and RequireAuth deliberately; // MaxBodySize precedes CSRF and RequireAuth deliberately;
// see maxFormBodySize for why, and for what it costs. // see maxFormBodySize for why, and for what it costs.
r.Use(s.mw.MaxBodySize(maxFormBodySize)) r.Use(s.mw.MaxBodySize(maxFormBodySize))
r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden))) r.Use(s.mw.CSRF())
r.Use(s.mw.NoCache()) r.Use(s.mw.NoCache())
r.Use(s.mw.RequireAuth()) r.Use(s.mw.RequireAuth())
r.Get("/", s.h.HandleSourceDetail()) r.Get("/", s.h.HandleSourceDetail())
r.Get("/edit", s.h.HandleSourceEdit()) r.Get("/edit", s.h.HandleSourceEdit())
r.Post("/edit", s.h.HandleSourceEditSubmit()) r.Post("/edit", s.h.HandleSourceEditSubmit())
r.Post("/delete", s.h.HandleSourceDelete()) r.Post("/delete", s.h.HandleSourceDelete())
r.Get("/logs", s.h.HandleSourceLogs()) r.Get("/events", s.h.HandleSourceLogs())
// The log page renders each body only up to its cap, so // The log page renders each body only up to its cap, so
// this is the only route that serves a whole one. It // this is the only route that serves a whole one. It
// belongs to this group for its RequireAuth and // belongs to this group for its RequireAuth and
// NoCache; see HandleEventBodyDownload for the headers // NoCache; see HandleEventBodyDownload for the headers
// that keep the bytes it returns inert. // that keep the bytes it returns inert.
r.Get( r.Get(
"/logs/{eventID}/body", "/events/{eventID}/body",
s.h.HandleEventBodyDownload(), s.h.HandleEventBodyDownload(),
) )
// Replay is the one page action that queues outbound work: // Replay is the one page action that queues outbound work:
@@ -311,7 +280,7 @@ func (s *Server) setupSourceRoutes() {
func (s *Server) setupWebhookRoutes() { func (s *Server) setupWebhookRoutes() {
s.router.With(s.mw.ReceiverRateLimit()).HandleFunc( s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
"/webhook/{uuid}", "/h/{uuid}",
s.h.HandleWebhook(), s.h.HandleWebhook(),
) )
} }
internal/server/routes_test.go
+338 -8
View File
@@ -240,6 +240,26 @@ func (e *testEnv) csrfFrom(
return token, combined return token, combined
} }
// urlFrom renders the page at path and returns the link or form
// action that pattern's one group captures, so a test requests the
// URL the template emitted rather than one it wrote itself.
func (e *testEnv) urlFrom(
t *testing.T,
path, pattern string,
cookies []*http.Cookie,
) string {
t.Helper()
w := e.get(path, cookies)
require.Equal(t, http.StatusOK, w.Code)
match := regexp.MustCompile(pattern).
FindStringSubmatch(w.Body.String())
require.Len(t, match, 2, "%s should render %s", path, pattern)
return html.UnescapeString(match[1])
}
// authCookies forges an authenticated session for the given user. // authCookies forges an authenticated session for the given user.
func (e *testEnv) authCookies( func (e *testEnv) authCookies(
t *testing.T, t *testing.T,
@@ -674,7 +694,7 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
require.NotNil(t, fresh, "login must set a session cookie") require.NotNil(t, fresh, "login must set a session cookie")
assert.Equal( assert.Equal(
t, "/sources", t, "/hooks",
env.get("/", []*http.Cookie{fresh}).Header().Get("Location"), env.get("/", []*http.Cookie{fresh}).Header().Get("Location"),
"the new session cookie must authenticate", "the new session cookie must authenticate",
) )
@@ -741,7 +761,264 @@ func TestPasswordChange_UnderLimit_Succeeds(t *testing.T) {
) )
} }
// --- /source/{sourceID} group --- // --- /hooks group ---
// TestHooks_ListAndNewWebhookForm gets the webhook list and the
// new-webhook form through the production router, then submits the
// form to the action and with the token the page rendered. A
// mistyped route or form action fails here; the handler tests
// cannot catch either, because they never route a request.
func TestHooks_ListAndNewWebhookForm(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "lister", "somepassword")
cookies := env.authCookies(t, userID, "lister")
existing := env.seedWebhook(t, userID)
list := env.get("/hooks", cookies)
require.Equal(t, http.StatusOK, list.Code)
assert.Contains(
t, list.Body.String(), `href="/hook/`+existing.ID+`"`,
"the list should link the user's webhook",
)
token, cookies := env.csrfFrom(t, "/hooks/new", cookies)
form := url.Values{}
form.Set("csrf_token", token)
form.Set("name", "created")
w := env.post(
env.urlFrom(t, "/hooks/new", `action="(/hooks[^"]*)"`, cookies),
form, cookies,
)
require.Equal(t, http.StatusSeeOther, w.Code)
var created database.Webhook
require.NoError(t,
env.db.DB().Where("name = ?", "created").First(&created).Error,
)
assert.Equal(
t, "/hook/"+created.ID, w.Header().Get("Location"),
"creating a webhook should redirect to its page",
)
}
// --- /hook/{sourceID} group ---
// TestHook_EditFormAndDelete follows the webhook page's Edit link to
// the edit form and submits it, then deletes the webhook with the
// form on its page, every URL and token taken from the rendered
// pages.
func TestHook_EditFormAndDelete(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "editor", "somepassword")
cookies := env.authCookies(t, userID, "editor")
wh := env.seedWebhook(t, userID)
page := "/hook/" + wh.ID
editPage := env.urlFrom(t, page, `href="(/hook/[^/"]+/edit)"`, cookies)
token, cookies := env.csrfFrom(t, editPage, cookies)
form := url.Values{}
form.Set("csrf_token", token)
form.Set("name", "renamed")
w := env.post(
env.urlFrom(t, editPage, `action="(/hook/[^/"]+/edit)"`, cookies),
form, cookies,
)
require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal(t, page, w.Header().Get("Location"))
var edited database.Webhook
require.NoError(t, env.db.DB().First(&edited, "id = ?", wh.ID).Error)
assert.Equal(t, "renamed", edited.Name)
form = url.Values{}
form.Set("csrf_token", token)
w = env.post(
env.urlFrom(t, page, `action="(/hook/[^/"]+/delete)"`, cookies),
form, cookies,
)
require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal(t, "/hooks", w.Header().Get("Location"))
assert.Equal(
t, http.StatusNotFound, env.get(page, cookies).Code,
"a deleted webhook's page should be gone",
)
}
// TestHook_EntrypointActions adds, deactivates and deletes an
// entrypoint with the forms on the webhook page, each submitted to
// the action and with the token the page rendered.
func TestHook_EntrypointActions(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "epuser", "somepassword")
cookies := env.authCookies(t, userID, "epuser")
wh := env.seedWebhook(t, userID)
page := "/hook/" + wh.ID
token, cookies := env.csrfFrom(t, page, cookies)
form := url.Values{}
form.Set("csrf_token", token)
// submit posts the webhook page's form whose action pattern
// captures, and requires the redirect back to that page.
submit := func(pattern string) {
t.Helper()
w := env.post(env.urlFrom(t, page, pattern, cookies), form, cookies)
require.Equal(t, http.StatusSeeOther, w.Code)
require.Equal(t, page, w.Header().Get("Location"))
}
submit(`action="(/hook/[^/"]+/entrypoints)"`)
var added database.Entrypoint
require.NoError(t,
env.db.DB().First(&added, "webhook_id = ?", wh.ID).Error,
)
require.True(t, added.Active)
submit(`action="(/hook/[^/"]+/entrypoints/[^/"]+/toggle)"`)
var toggled database.Entrypoint
require.NoError(t,
env.db.DB().First(&toggled, "id = ?", added.ID).Error,
)
assert.False(t, toggled.Active, "the toggle should deactivate it")
submit(`action="(/hook/[^/"]+/entrypoints/[^/"]+/delete)"`)
var left int64
require.NoError(t, env.db.DB().Model(&database.Entrypoint{}).
Where("webhook_id = ?", wh.ID).Count(&left).Error)
assert.Zero(t, left, "the delete should remove the entrypoint")
}
// TestHook_TargetActions adds a target with the form on the webhook
// page, follows its Edit link to the target edit form and submits
// it, then deactivates and deletes it, every URL and token taken from
// the rendered pages.
func TestHook_TargetActions(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "tgtuser", "somepassword")
cookies := env.authCookies(t, userID, "tgtuser")
wh := env.seedWebhook(t, userID)
page := "/hook/" + wh.ID
token, cookies := env.csrfFrom(t, page, cookies)
// submit posts form, with the token, to the action pattern
// captures on the page at from, and requires the redirect back to
// the webhook page.
submit := func(from, pattern string, form url.Values) {
t.Helper()
form.Set("csrf_token", token)
w := env.post(env.urlFrom(t, from, pattern, cookies), form, cookies)
require.Equal(t, http.StatusSeeOther, w.Code)
require.Equal(t, page, w.Header().Get("Location"))
}
submit(page, `action="(/hook/[^/"]+/targets)"`, url.Values{
"name": {"added"},
"type": {string(database.TargetTypeLog)},
})
editPage := env.urlFrom(
t, page, `href="(/hook/[^/"]+/targets/[^/"]+/edit)"`, cookies,
)
submit(editPage, `action="(/hook/[^/"]+/targets/[^/"]+/edit)"`,
url.Values{"name": {"renamed"}})
var edited database.Target
require.NoError(t,
env.db.DB().First(&edited, "webhook_id = ?", wh.ID).Error,
)
assert.Equal(t, "renamed", edited.Name)
require.True(t, edited.Active)
submit(page, `action="(/hook/[^/"]+/targets/[^/"]+/toggle)"`,
url.Values{})
var toggled database.Target
require.NoError(t,
env.db.DB().First(&toggled, "id = ?", edited.ID).Error,
)
assert.False(t, toggled.Active, "the toggle should deactivate it")
submit(page, `action="(/hook/[^/"]+/targets/[^/"]+/delete)"`,
url.Values{})
var left int64
require.NoError(t, env.db.DB().Model(&database.Target{}).
Where("webhook_id = ?", wh.ID).Count(&left).Error)
assert.Zero(t, left, "the delete should remove the target")
}
// TestHook_ResubmitFromEventLog resubmits a stored event with the
// form on the event log page, submitted to the action and with the
// token the page rendered.
func TestHook_ResubmitFromEventLog(t *testing.T) {
t.Parallel()
env := newTestEnv(t)
userID, _ := env.seedUser(t, "resubmitter", "somepassword")
cookies := env.authCookies(t, userID, "resubmitter")
wh := env.seedWebhook(t, userID)
env.seedEvent(t, wh.ID, `{"resubmit":"me"}`)
logsPath := "/hook/" + wh.ID + "/events"
token, cookies := env.csrfFrom(t, logsPath, cookies)
form := url.Values{}
form.Set("csrf_token", token)
w := env.post(
env.urlFrom(t, logsPath, `action="(/hook/[^"]+/resubmit)"`, cookies),
form, cookies,
)
require.Equal(t, http.StatusSeeOther, w.Code)
assert.Equal(
t, logsPath+"?resubmit=no-targets", w.Header().Get("Location"),
)
webhookDB, err := env.dbMgr.GetDB(wh.ID)
require.NoError(t, err)
var events int64
require.NoError(t,
webhookDB.Model(&database.Event{}).Count(&events).Error,
)
assert.Equal(t, int64(2), events, "the resubmit stores a new event")
}
// TestSourceLogs_TruncationLinkDownloadsTheBody walks the whole // TestSourceLogs_TruncationLinkDownloadsTheBody walks the whole
// feature the way a user does: render the event log page through // feature the way a user does: render the event log page through
@@ -769,11 +1046,11 @@ func TestSourceLogs_TruncationLinkDownloadsTheBody(t *testing.T) {
wh := env.seedWebhook(t, userID) wh := env.seedWebhook(t, userID)
env.seedEvent(t, wh.ID, stored) env.seedEvent(t, wh.ID, stored)
page := env.get("/source/"+wh.ID+"/logs", cookies) page := env.get("/hook/"+wh.ID+"/events", cookies)
require.Equal(t, http.StatusOK, page.Code) require.Equal(t, http.StatusOK, page.Code)
link := regexp.MustCompile( link := regexp.MustCompile(
`href="(/source/[^"]+/body)"`, `href="(/hook/[^"]+/body)"`,
).FindStringSubmatch(page.Body.String()) ).FindStringSubmatch(page.Body.String())
require.Len( require.Len(
t, link, 2, t, link, 2,
@@ -819,7 +1096,7 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
const payload = "OWNERS-PAYLOAD-77c1" const payload = "OWNERS-PAYLOAD-77c1"
evt := env.seedEvent(t, wh.ID, payload) evt := env.seedEvent(t, wh.ID, payload)
path := "/source/" + wh.ID + "/logs/" + evt.ID + "/body" path := "/hook/" + wh.ID + "/events/" + evt.ID + "/body"
intruderID, _ := env.seedUser(t, "intruder", "somepassword") intruderID, _ := env.seedUser(t, "intruder", "somepassword")
intruder := env.authCookies(t, intruderID, "intruder") intruder := env.authCookies(t, intruderID, "intruder")
@@ -853,7 +1130,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
evt := env.seedEvent(t, wh.ID, `{"replay":"me"}`) evt := env.seedEvent(t, wh.ID, `{"replay":"me"}`)
dlv := env.seedFailedDelivery(t, wh.ID, evt.ID, tgt.ID) dlv := env.seedFailedDelivery(t, wh.ID, evt.ID, tgt.ID)
path := "/source/" + wh.ID + "/deliveries/" + dlv.ID + path := "/hook/" + wh.ID + "/deliveries/" + dlv.ID +
"/replay" "/replay"
assert.Equal( assert.Equal(
@@ -879,7 +1156,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
// The token and the action URL both come out of the rendered // The token and the action URL both come out of the rendered
// page, so a typo in either the route pattern or the template // page, so a typo in either the route pattern or the template
// fails here. // fails here.
logsPath := "/source/" + wh.ID + "/logs" logsPath := "/hook/" + wh.ID + "/events"
token, cookies := env.csrfFrom(t, logsPath, cookies) token, cookies := env.csrfFrom(t, logsPath, cookies)
@@ -887,7 +1164,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
require.Equal(t, http.StatusOK, page.Code) require.Equal(t, http.StatusOK, page.Code)
action := regexp.MustCompile( action := regexp.MustCompile(
`action="(/source/[^"]+/replay)"`, `action="(/hook/[^"]+/replay)"`,
).FindStringSubmatch(page.Body.String()) ).FindStringSubmatch(page.Body.String())
require.Len( require.Len(
t, action, 2, t, action, 2,
@@ -912,6 +1189,59 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
) )
} }
// --- /h/{uuid} receiver ---
// TestReceiver_EntrypointURLIsRateLimited takes the entrypoint URL
// the webhook page shows and posts to it through the production
// router until the receiver rate limit refuses it. The URL has to
// reach the receiver, and the limit has to apply to it.
func TestReceiver_EntrypointURLIsRateLimited(t *testing.T) {
t.Parallel()
const limit = 2
env := newTestEnvWithConfig(t, &config.Config{
DataDir: t.TempDir(),
Environment: config.EnvironmentDev,
ReceiverRateLimit: limit,
})
userID, _ := env.seedUser(t, "receiver", "somepassword")
cookies := env.authCookies(t, userID, "receiver")
wh := env.seedWebhook(t, userID)
require.NoError(t, env.db.DB().Omit(clause.Associations).Create(
&database.Entrypoint{
WebhookID: wh.ID,
Path: "6f1e2a9c-4b7d-4e3a-9c2f-1d8b5a7e3c60",
Active: true,
},
).Error)
page := env.get("/hook/"+wh.ID, cookies)
require.Equal(t, http.StatusOK, page.Code)
shown := regexp.MustCompile(`(/h/[^<]+)</code>`).
FindStringSubmatch(page.Body.String())
require.Len(
t, shown, 2, "the webhook page should show the entrypoint URL",
)
for i := range limit {
assert.Equal(
t, http.StatusOK,
env.post(shown[1], url.Values{}, nil).Code,
"request %d should reach the receiver", i,
)
}
assert.Equal(
t, http.StatusTooManyRequests,
env.post(shown[1], url.Values{}, nil).Code,
"the receiver rate limit must apply to the entrypoint URL",
)
}
// metricsConfig is a Config differing from the routing default only // metricsConfig is a Config differing from the routing default only
// in the two /metrics credentials. // in the two /metrics credentials.
func metricsConfig( func metricsConfig(
internal/server/sentry.go
+1 -1
View File
@@ -55,7 +55,7 @@ func sentryClientOptions(dsn, release string) sentry.ClientOptions {
// //
// URL is the third such field. NewRequest builds it as // URL is the third such field. NewRequest builds it as
// scheme://host/path (interfaces.go:183), and on the receiver route // scheme://host/path (interfaces.go:183), and on the receiver route
// that path is /webhook/<uuid> in full — a write capability, not an // that path is /h/<uuid> in full — a write capability, not an
// identifier. It is rebuilt here from the chi route pattern, on every // identifier. It is rebuilt here from the chi route pattern, on every
// route, keeping the scheme and the host. // route, keeping the scheme and the host.
// //
internal/server/sentry_test.go
+7 -7
View File
@@ -153,7 +153,7 @@ func (c sentryCase) router() http.Handler {
sentryhttp.New(sentryhttp.Options{Repanic: true}).Handle, sentryhttp.New(sentryhttp.Options{Repanic: true}).Handle,
) )
router.HandleFunc("/pages/login", handler) router.HandleFunc("/pages/login", handler)
router.HandleFunc("/webhook/{uuid}", handler) router.HandleFunc("/h/{uuid}", handler)
return router return router
} }
@@ -191,7 +191,7 @@ func sentryLoginRequest(client *sentry.Client) *http.Request {
// concrete path carries the entrypoint capability. // concrete path carries the entrypoint capability.
func sentryReceiverRequest(client *sentry.Client) *http.Request { func sentryReceiverRequest(client *sentry.Client) *http.Request {
return sentryRequest( return sentryRequest(
client, "/webhook/"+sentryReceiverUUID, "payload=hello", client, "/h/"+sentryReceiverUUID, "payload=hello",
) )
} }
@@ -316,7 +316,7 @@ func TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern(
t, marshalEvent(t, event), sentryReceiverUUID, t, marshalEvent(t, event), sentryReceiverUUID,
) )
assert.Equal( assert.Equal(
t, "http://example.com/webhook/{uuid}", event.Request.URL, t, "http://example.com/h/{uuid}", event.Request.URL,
) )
} }
@@ -401,7 +401,7 @@ func TestSentryScrub_TransactionDispatchIsUnscrubbedWithoutTheHook(
func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) { func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
t.Parallel() t.Parallel()
concrete := "https://example.com/webhook/" + sentryReceiverUUID concrete := "https://example.com/h/" + sentryReceiverUUID
// A request with no chi routing context on it at all, which is // A request with no chi routing context on it at all, which is
// what an event captured outside the router would carry. // what an event captured outside the router would carry.
@@ -426,7 +426,7 @@ func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
event := sentry.NewEvent() event := sentry.NewEvent()
event.Request = &sentry.Request{URL: concrete} event.Request = &sentry.Request{URL: concrete}
event.Transaction = "POST /webhook/" + event.Transaction = "POST /h/" +
sentryReceiverUUID sentryReceiverUUID
scrubbed := server.ScrubSentryRequestForTest( scrubbed := server.ScrubSentryRequestForTest(
@@ -459,9 +459,9 @@ func TestSentryScrub_WithholdsUnparseableValues(t *testing.T) {
event := sentry.NewEvent() event := sentry.NewEvent()
event.Request = &sentry.Request{ event.Request = &sentry.Request{
URL: "/webhook/" + sentryReceiverUUID, URL: "/h/" + sentryReceiverUUID,
} }
event.Transaction = "/webhook/" + sentryReceiverUUID event.Transaction = "/h/" + sentryReceiverUUID
scrubbed := server.ScrubSentryRequestForTest(event, nil) scrubbed := server.ScrubSentryRequestForTest(event, nil)
require.NotNil(t, scrubbed) require.NotNil(t, scrubbed)
templates/error.html
-15
View File
@@ -1,15 +0,0 @@
{{template "base" .}}
{{define "title"}}{{.StatusText}} - Webhooker{{end}}
{{define "content"}}
<div class="max-w-4xl mx-auto px-6 py-12">
<h1 class="text-2xl font-medium text-gray-900 mb-4">{{.Status}} {{.StatusText}}</h1>
<p class="text-gray-600 mb-6">{{.Message}}</p>
{{if .User}}
<a href="/sources" class="btn-secondary">Back to webhooks</a>
{{else}}
<a href="/pages/login" class="btn-primary">Sign in</a>
{{end}}
</div>
{{end}}
templates/navbar.html
+2 -8
View File
@@ -16,7 +16,7 @@
<!-- Desktop navigation --> <!-- Desktop navigation -->
<div class="hidden md:flex items-center gap-4"> <div class="hidden md:flex items-center gap-4">
{{if .User}} {{if .User}}
<a href="/sources" class="btn-text">Webhooks</a> <a href="/hooks" class="btn-text">Webhooks</a>
<a href="/user/{{.User.Username}}" class="btn-text"> <a href="/user/{{.User.Username}}" class="btn-text">
<svg class="w-5 h-5 mr-1" fill="currentColor" viewBox="0 0 16 16"> <svg class="w-5 h-5 mr-1" fill="currentColor" viewBox="0 0 16 16">
<path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/> <path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/>
@@ -24,14 +24,10 @@
</svg> </svg>
{{.User.Username}} {{.User.Username}}
</a> </a>
{{/* An error page can be served before a form token is issued,
and a logout without one is refused. */}}
{{if .CSRFToken}}
<form method="POST" action="/pages/logout" class="inline"> <form method="POST" action="/pages/logout" class="inline">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<button type="submit" class="btn-text">Logout</button> <button type="submit" class="btn-text">Logout</button>
</form> </form>
{{end}}
{{else}} {{else}}
<a href="/pages/login" class="btn-primary">Login</a> <a href="/pages/login" class="btn-primary">Login</a>
{{end}} {{end}}
@@ -42,14 +38,12 @@
<div x-show="open" x-cloak x-transition class="md:hidden mt-4 pt-4 border-t border-gray-200"> <div x-show="open" x-cloak x-transition class="md:hidden mt-4 pt-4 border-t border-gray-200">
<div class="flex flex-col gap-2"> <div class="flex flex-col gap-2">
{{if .User}} {{if .User}}
<a href="/sources" class="btn-text w-full text-left">Webhooks</a> <a href="/hooks" class="btn-text w-full text-left">Webhooks</a>
<a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a> <a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a>
{{if .CSRFToken}}
<form method="POST" action="/pages/logout"> <form method="POST" action="/pages/logout">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<button type="submit" class="btn-text w-full text-left">Logout</button> <button type="submit" class="btn-text w-full text-left">Logout</button>
</form> </form>
{{end}}
{{else}} {{else}}
<a href="/pages/login" class="btn-primary w-full">Login</a> <a href="/pages/login" class="btn-primary w-full">Login</a>
{{end}} {{end}}
templates/source_detail.html
+13 -13
View File
@@ -5,7 +5,7 @@
{{define "content"}} {{define "content"}}
<div class="max-w-6xl mx-auto px-6 py-8" x-data="{ showAddEntrypoint: false, showAddTarget: false }"> <div class="max-w-6xl mx-auto px-6 py-8" x-data="{ showAddEntrypoint: false, showAddTarget: false }">
<div class="mb-6"> <div class="mb-6">
<a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a> <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
<div class="flex justify-between items-center mt-2"> <div class="flex justify-between items-center mt-2">
<div> <div>
<h1 class="text-2xl font-medium text-gray-900">{{.Webhook.Name}}</h1> <h1 class="text-2xl font-medium text-gray-900">{{.Webhook.Name}}</h1>
@@ -14,9 +14,9 @@
{{end}} {{end}}
</div> </div>
<div class="flex gap-2"> <div class="flex gap-2">
<a href="/source/{{.Webhook.ID}}/logs" class="btn-secondary">Event Log</a> <a href="/hook/{{.Webhook.ID}}/events" class="btn-secondary">Full Event Log</a>
<a href="/source/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a> <a href="/hook/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
<form method="POST" action="/source/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')"> <form method="POST" action="/hook/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<button type="submit" class="btn-danger">Delete</button> <button type="submit" class="btn-danger">Delete</button>
</form> </form>
@@ -39,7 +39,7 @@
<!-- Add entrypoint form --> <!-- Add entrypoint form -->
<div x-show="showAddEntrypoint" x-cloak class="p-4 bg-gray-50 border-b border-gray-200"> <div x-show="showAddEntrypoint" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
<form method="POST" action="/source/{{.Webhook.ID}}/entrypoints" class="flex gap-2"> <form method="POST" action="/hook/{{.Webhook.ID}}/entrypoints" class="flex gap-2">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<input type="text" name="description" placeholder="Description (optional)" class="input text-sm flex-1"> <input type="text" name="description" placeholder="Description (optional)" class="input text-sm flex-1">
<button type="submit" class="btn-primary text-sm">Add</button> <button type="submit" class="btn-primary text-sm">Add</button>
@@ -57,20 +57,20 @@
{{else}} {{else}}
<span class="badge-error">Inactive</span> <span class="badge-error">Inactive</span>
{{end}} {{end}}
<form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline"> <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline">
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}"> <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
{{if .Active}}Deactivate{{else}}Activate{{end}} {{if .Active}}Deactivate{{else}}Activate{{end}}
</button> </button>
</form> </form>
<form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline"> <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline">
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button> <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
</form> </form>
</div> </div>
</div> </div>
<div class="flex items-start gap-2 mt-1"> <div class="flex items-start gap-2 mt-1">
<code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/webhook/{{.Path}}</code> <code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/h/{{.Path}}</code>
<!-- Hidden until app.js reveals it; without the <!-- Hidden until app.js reveals it; without the
script the URL above stays selectable. --> script the URL above stays selectable. -->
<button type="button" hidden data-copy-target="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 hover:text-primary-600">Copy</button> <button type="button" hidden data-copy-target="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 hover:text-primary-600">Copy</button>
@@ -98,7 +98,7 @@
<!-- Add target form --> <!-- Add target form -->
<div x-show="showAddTarget" x-cloak class="p-4 bg-gray-50 border-b border-gray-200"> <div x-show="showAddTarget" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
<form method="POST" action="/source/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3"> <form method="POST" action="/hook/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<div class="flex gap-2"> <div class="flex gap-2">
<input type="text" name="name" placeholder="Target name" required class="input text-sm flex-1"> <input type="text" name="name" placeholder="Target name" required class="input text-sm flex-1">
@@ -151,14 +151,14 @@
{{else}} {{else}}
<span class="badge-error">Inactive</span> <span class="badge-error">Inactive</span>
{{end}} {{end}}
<a href="/source/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a> <a href="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a>
<form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline"> <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline">
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}"> <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
{{if .Active}}Deactivate{{else}}Activate{{end}} {{if .Active}}Deactivate{{else}}Activate{{end}}
</button> </button>
</form> </form>
<form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline"> <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline">
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button> <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
</form> </form>
@@ -182,7 +182,7 @@
<div class="card mt-6"> <div class="card mt-6">
<div class="p-4 border-b border-gray-200 flex justify-between items-center"> <div class="p-4 border-b border-gray-200 flex justify-between items-center">
<h2 class="text-lg font-medium text-gray-900">50 Most Recent Events</h2> <h2 class="text-lg font-medium text-gray-900">50 Most Recent Events</h2>
<a href="/source/{{.Webhook.ID}}/logs" class="btn-text text-sm">View All</a> <a href="/hook/{{.Webhook.ID}}/events" class="btn-text text-sm">Full Event Log</a>
</div> </div>
<div class="divide-y divide-gray-100"> <div class="divide-y divide-gray-100">
{{range .Events}} {{range .Events}}
templates/source_edit.html
+3 -3
View File
@@ -5,7 +5,7 @@
{{define "content"}} {{define "content"}}
<div class="max-w-2xl mx-auto px-6 py-8"> <div class="max-w-2xl mx-auto px-6 py-8">
<div class="mb-6"> <div class="mb-6">
<a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a> <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
<h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Webhook</h1> <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Webhook</h1>
</div> </div>
@@ -14,7 +14,7 @@
<div class="alert-error">{{.Error}}</div> <div class="alert-error">{{.Error}}</div>
{{end}} {{end}}
<form method="POST" action="/source/{{.Webhook.ID}}/edit" class="space-y-6"> <form method="POST" action="/hook/{{.Webhook.ID}}/edit" class="space-y-6">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<div class="form-group"> <div class="form-group">
<label for="name" class="label">Name</label> <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@
<div class="flex gap-3"> <div class="flex gap-3">
<button type="submit" class="btn-primary">Save Changes</button> <button type="submit" class="btn-primary">Save Changes</button>
<a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a> <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
</div> </div>
</form> </form>
</div> </div>
templates/source_logs.html
+8 -8
View File
@@ -1,13 +1,13 @@
{{template "base" .}} {{template "base" .}}
{{define "title"}}Event Log - {{.Webhook.Name}} - Webhooker{{end}} {{define "title"}}Full Event Log - {{.Webhook.Name}} - Webhooker{{end}}
{{define "content"}} {{define "content"}}
<div class="max-w-6xl mx-auto px-6 py-8"> <div class="max-w-6xl mx-auto px-6 py-8">
<div class="mb-6"> <div class="mb-6">
<a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a> <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
<div class="flex justify-between items-center mt-2"> <div class="flex justify-between items-center mt-2">
<h1 class="text-2xl font-medium text-gray-900">Event Log</h1> <h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>
<span class="text-sm text-gray-500">{{.TotalEvents}} total event{{if ne .TotalEvents 1}}s{{end}}</span> <span class="text-sm text-gray-500">{{.TotalEvents}} total event{{if ne .TotalEvents 1}}s{{end}}</span>
</div> </div>
</div> </div>
@@ -55,7 +55,7 @@
{{if .ResubmittedFrom}}Resubmitted from event <span class="font-mono">{{.ResubmittedFromID}}</span>.{{end}} {{if .ResubmittedFrom}}Resubmitted from event <span class="font-mono">{{.ResubmittedFromID}}</span>.{{end}}
{{if .ResubmitCount}}Resubmitted as {{.ResubmitCount}} new event{{if ne .ResubmitCount 1}}s{{end}}.{{end}} {{if .ResubmitCount}}Resubmitted as {{.ResubmitCount}} new event{{if ne .ResubmitCount 1}}s{{end}}.{{end}}
</div> </div>
<form method="POST" action="/source/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline"> <form method="POST" action="/hook/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline">
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<input type="hidden" name="page" value="{{$.Page}}"> <input type="hidden" name="page" value="{{$.Page}}">
<button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Submit this event again as a new event, to every currently active target">Resubmit</button> <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Submit this event again as a new event, to every currently active target">Resubmit</button>
@@ -63,7 +63,7 @@
</div> </div>
<pre class="text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all">{{.Body}}</pre> <pre class="text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all">{{.Body}}</pre>
{{if .BodyTruncated}} {{if .BodyTruncated}}
<p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/source/{{$.Webhook.ID}}/logs/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p> <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/hook/{{$.Webhook.ID}}/events/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p>
{{end}} {{end}}
{{if .Deliveries}} {{if .Deliveries}}
@@ -79,7 +79,7 @@
</div> </div>
<div class="flex items-center gap-3"> <div class="flex items-center gap-3">
{{if .Status.Terminal}} {{if .Status.Terminal}}
<form method="POST" action="/source/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop> <form method="POST" action="/hook/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop>
<input type="hidden" name="csrf_token" value="{{$.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
<input type="hidden" name="page" value="{{$.Page}}"> <input type="hidden" name="page" value="{{$.Page}}">
<button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Send this event to the target again">Replay</button> <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Send this event to the target again">Replay</button>
@@ -139,11 +139,11 @@
{{if or .HasPrev .HasNext}} {{if or .HasPrev .HasNext}}
<div class="flex justify-center gap-2 mt-6"> <div class="flex justify-center gap-2 mt-6">
{{if .HasPrev}} {{if .HasPrev}}
<a href="/source/{{.Webhook.ID}}/logs?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a> <a href="/hook/{{.Webhook.ID}}/events?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a>
{{end}} {{end}}
<span class="inline-flex items-center px-4 py-2 text-sm text-gray-500">Page {{.Page}} of {{.TotalPages}}</span> <span class="inline-flex items-center px-4 py-2 text-sm text-gray-500">Page {{.Page}} of {{.TotalPages}}</span>
{{if .HasNext}} {{if .HasNext}}
<a href="/source/{{.Webhook.ID}}/logs?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a> <a href="/hook/{{.Webhook.ID}}/events?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a>
{{end}} {{end}}
</div> </div>
{{end}} {{end}}
templates/sources_list.html
+3 -3
View File
@@ -6,7 +6,7 @@
<div class="max-w-6xl mx-auto px-6 py-8"> <div class="max-w-6xl mx-auto px-6 py-8">
<div class="flex justify-between items-center mb-6"> <div class="flex justify-between items-center mb-6">
<h1 class="text-2xl font-medium text-gray-900">Webhooks</h1> <h1 class="text-2xl font-medium text-gray-900">Webhooks</h1>
<a href="/sources/new" class="btn-primary"> <a href="/hooks/new" class="btn-primary">
<svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24"> <svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/> <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
</svg> </svg>
@@ -17,7 +17,7 @@
{{if .Webhooks}} {{if .Webhooks}}
<div class="grid gap-4"> <div class="grid gap-4">
{{range .Webhooks}} {{range .Webhooks}}
<a href="/source/{{.ID}}" class="card-elevated p-6 block"> <a href="/hook/{{.ID}}" class="card-elevated p-6 block">
<div class="flex justify-between items-start"> <div class="flex justify-between items-start">
<div> <div>
<h2 class="text-lg font-medium text-gray-900">{{.Name}}</h2> <h2 class="text-lg font-medium text-gray-900">{{.Name}}</h2>
@@ -42,7 +42,7 @@
</svg> </svg>
<h2 class="text-lg font-medium text-gray-900 mb-2">No webhooks yet</h2> <h2 class="text-lg font-medium text-gray-900 mb-2">No webhooks yet</h2>
<p class="text-gray-500 mb-6">Create your first webhook to start receiving and forwarding events.</p> <p class="text-gray-500 mb-6">Create your first webhook to start receiving and forwarding events.</p>
<a href="/sources/new" class="btn-primary">Create Webhook</a> <a href="/hooks/new" class="btn-primary">Create Webhook</a>
</div> </div>
{{end}} {{end}}
</div> </div>
templates/sources_new.html
+3 -3
View File
@@ -5,7 +5,7 @@
{{define "content"}} {{define "content"}}
<div class="max-w-2xl mx-auto px-6 py-8"> <div class="max-w-2xl mx-auto px-6 py-8">
<div class="mb-6"> <div class="mb-6">
<a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a> <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
<h1 class="text-2xl font-medium text-gray-900 mt-2">Create Webhook</h1> <h1 class="text-2xl font-medium text-gray-900 mt-2">Create Webhook</h1>
</div> </div>
@@ -14,7 +14,7 @@
<div class="alert-error">{{.Error}}</div> <div class="alert-error">{{.Error}}</div>
{{end}} {{end}}
<form method="POST" action="/sources/new" class="space-y-6"> <form method="POST" action="/hooks/new" class="space-y-6">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<div class="form-group"> <div class="form-group">
<label for="name" class="label">Name</label> <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@
<div class="flex gap-3"> <div class="flex gap-3">
<button type="submit" class="btn-primary">Create Webhook</button> <button type="submit" class="btn-primary">Create Webhook</button>
<a href="/sources" class="btn-secondary">Cancel</a> <a href="/hooks" class="btn-secondary">Cancel</a>
</div> </div>
</form> </form>
</div> </div>
templates/target_edit.html
+3 -3
View File
@@ -5,7 +5,7 @@
{{define "content"}} {{define "content"}}
<div class="max-w-2xl mx-auto px-6 py-8"> <div class="max-w-2xl mx-auto px-6 py-8">
<div class="mb-6"> <div class="mb-6">
<a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a> <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
<h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Target</h1> <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Target</h1>
<p class="text-sm text-gray-500 mt-1">Type: {{.Target.Type}}. A target's type cannot be changed; create a new target to deliver a different way.</p> <p class="text-sm text-gray-500 mt-1">Type: {{.Target.Type}}. A target's type cannot be changed; create a new target to deliver a different way.</p>
</div> </div>
@@ -21,7 +21,7 @@
</div> </div>
{{end}} {{end}}
<form method="POST" action="/source/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6"> <form method="POST" action="/hook/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<div class="form-group"> <div class="form-group">
@@ -75,7 +75,7 @@
<div class="flex gap-3"> <div class="flex gap-3">
<button type="submit" class="btn-primary">Save Changes</button> <button type="submit" class="btn-primary">Save Changes</button>
<a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a> <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
</div> </div>
</form> </form>
</div> </div>