Name each database target's archive for its webhook and target (closes #376)

Each database target now has its own archive file,
archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, instead of one
archive-WEBHOOKID.db per webhook. delivery.ArchiveFileName builds the
name: each name is lowercased, keeps ASCII letters and digits, turns
every other run of characters into one dash, and is cut to 40
characters.

A change of webhook or target name renames its archive files under the
archive writer's lock, before the new name is saved, and back again if
the save fails. A rename never replaces a file: if one already has the
new name, the edit is refused. Deleting a target evicts only that
target's writer. Archive files are never deleted, and nothing looks for
files under the old name.

Model: opus-5-5

.dockerignore

@@ -1,16 +1,20 @@
+# .git is sent so the build can derive the version it stamps into the binary
+# (script/version). Its config, which can hold a remote URL carrying a
+# credential and which `git describe` does not need, is left out of a
+# directory context. A context sent as a tar is not filtered by this file, so
+# it carries .git/config unless its sender leaves it out.
+.git/config
+
+# No tracked file may be listed here: git in the build would see it as
+# deleted and mark the version -dirty.
+#
 # .ci-fingerprint is deliberately NOT excluded: it is the CI cache barrier
 # that keeps the check stages from replaying a cached pass. See the lint
 # stage of the Dockerfile.
-.git/
 bin/
-# Third-party browser assets are fetched and hash-verified inside the build by
+# Extracted from 3p/ by `make assets` inside the build; a host copy is not
-# script/fetch-assets. Excluding any host copy keeps a developer's working tree
+# needed. The tarball in 3p/ must stay in the context.
-# from supplying the bytes that get shipped. The script and its
-# static/vendor.sha256 manifest stay in the context.
 static/js/alpine.min.js
-*.md
-LICENSE
-.editorconfig
 .env
 .env.*
 *.db

.gitea/workflows/check.yml

@@ -12,9 +12,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 2024-10-23
         with:
-          # The fingerprint step below needs history to find the last commit
+          # The superseded-status step needs history to walk ancestors (it
-          # that touched the Docker build context, and the superseded-status
+          # aborts on a shallow clone).
-          # step needs it to walk ancestors (it aborts on a shallow clone).
           fetch-depth: 0
 
       - name: Mark superseded run statuses
@@ -28,16 +27,11 @@ jobs:
         run: script/ci-mark-superseded
 
       - name: Fingerprint the build context
-        # `.dockerignore` keeps docs out of the build context, so a docs-only
+        # Writes the hash of the commit being checked into the context, which
-        # commit legitimately replays the whole image from cache and stays
+        # invalidates the `COPY . .` layer of both check stages: a commit
-        # cheap. Every other commit writes a new fingerprint into the context,
+        # that was never linted, format-checked, tested and built cannot
-        # which invalidates the `COPY . .` layer of both check stages: a
+        # report success from cache.
-        # commit that was never linted, formatted-checked, tested and built
+        run: git rev-parse HEAD > .ci-fingerprint
-        # cannot report success from cache.
-        run: |
-          set -eu
-          fp="$(git log -1 --format=%H -- . ':!*.md' ':!LICENSE' ':!.editorconfig')"
-          printf '%s\n' "${fp:-$GITHUB_SHA}" > .ci-fingerprint
 
       - name: Build Docker image (runs make check)
         run: script/cibuild

.gitignore

@@ -46,7 +46,6 @@ temp/
 # CI cache barrier, written into the build context by the check workflow
 .ci-fingerprint
 
-# Third-party browser assets, fetched and hash-verified by
+# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
-# script/fetch-assets against static/vendor.sha256. Not committed:
+# what is committed.
-# REPO_POLICIES.md forbids minified bundles in version control.
 /static/js/alpine.min.js

Dockerfile

@@ -12,8 +12,8 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code. In CI the context also carries .ci-fingerprint, whose
+# Copy source code. In CI the context also carries .ci-fingerprint, which
-# value changes with every commit that touches the build context (see
+# holds the hash of the commit being checked (see
 # .gitea/workflows/check.yml). That invalidates this layer, so the checks
 # below cannot report success by replaying a cached pass. Do not add it to
 # .dockerignore.
@@ -38,8 +38,13 @@ FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a349228
 COPY --from=lint /src/go.sum /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
-# suite executes.
+# suite executes. git is what script/version derives the version with.
-RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates jq && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates jq git && rm -rf /var/lib/apt/lists/*
+
+# A build context sent as a tar archive keeps its files' owners, and git
+# refuses to read a checkout owned by another user. Trust this one
+# whoever owns it.
+RUN git config --system --add safe.directory /build
 
 WORKDIR /build
 
@@ -51,25 +56,26 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
-# Fetch the third-party browser assets the UI serves. They are not committed
+# Run tests and build. Both first run script/assets, which extracts Alpine.js
-# (REPO_POLICIES.md forbids minified bundles in version control) and
+# from its tarball in 3p/.
-# .dockerignore keeps any host copy out of the build context, so this step is
-# the only way they enter the image. Each download is checked against a
-# hardcoded sha256 and the build fails on mismatch; make test re-checks the
-# hashes against the bytes go:embed actually put in the binary.
-RUN script/fetch-assets
-
-# Run tests and build
 RUN make test
 
-# Version stamped into the binary. .dockerignore excludes .git/, so
+# Version stamped into the binary: the VERSION build arg when one is
-# nothing in this stage can derive it: script/docker resolves it on the
+# given, otherwise what script/version derives from the .git the build
-# host and passes it in. The default is what a bare `docker build .`
+# context carries, so any `docker build .` of a clone stamps its commit.
-# with no --build-arg gets, and it names no tag the tree may not be at.
+# With neither, as from a source tarball, it is "unknown".
 #
-# Declared here, below the test and asset steps, so a changed version
+# Declared here, below the test step, so a changed version does not
-# does not invalidate their cached layers.
+# invalidate its cached layer.
-ARG VERSION=unknown
+ARG VERSION
+
+# A context that carries .git must not stamp "unknown": that means git is
+# missing here or could not read the checkout, and the image could not be
+# traced back to its commit.
+RUN if [ -d .git ] && [ "$(make version VERSION="$VERSION")" = unknown ]; then \
+        echo "version is unknown although the build context carries .git" >&2; \
+        exit 1; \
+    fi
 
 RUN make build VERSION="$VERSION"
 

Makefile

@@ -4,12 +4,12 @@
 .DEFAULT_GOAL := check
 
 # Version stamped into the binary. Derived from git by script/version;
-# override it (`make build VERSION=v1.2.3`) where git metadata is
+# override it (`make build VERSION=v1.2.3`) to stamp a given value, which is
-# unavailable, which is how the Dockerfile passes its build arg in.
+# how the Dockerfile passes its build arg in.
 VERSION ?= $(shell script/version)
 
-# An empty override (`make build VERSION=`, or a `--build-arg VERSION=`
+# An empty override (`make build VERSION=`, or the Dockerfile's `make build
-# landing on the Dockerfile's `make build VERSION="$VERSION"`) means unset,
+# VERSION="$VERSION"` when no VERSION build arg was given) means unset,
 # exactly as it does in script/version -- stamping "" would leave the binary
 # reporting no version and the footer back on its "dev" fallback. `override`
 # is required: a plain assignment loses to the command-line definition it
@@ -28,7 +28,7 @@ setup:
 	@script/setup
 
 assets:
-	@script/fetch-assets
+	@script/assets
 
 test:
 	@script/test
@@ -45,13 +45,13 @@ fmt-check:
 check:
 	@script/check
 
-build:
+build: assets
 	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-dev:
+dev: assets
 	go run ./cmd/webhooker
 
 deps:

TODO.md

@@ -387,7 +387,7 @@ point of the branch.
 - 2026-03-05 security headers middleware, session regeneration on
   login, request body size limits (#41)
 - 2026-03-04 tests for delivery, middleware, and session packages
-  (#32); removed globals.Buildarch (#31)
+  (#32); removed the build-architecture global (#31)
 - 2026-03-04 1.0 MVP merge: Webhook/Entrypoint/Target rename, core
   delivery engine with bounded worker pool and circuit breaker,
   parallel fan-out, per-webhook event databases, management UI (#16)

cmd/webhooker/main.go

@@ -16,6 +16,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/resetpw"
 	"sneak.berlin/go/webhooker/internal/server"
@@ -177,6 +178,10 @@ func newApp() *fx.App {
 			healthcheck.New,
 			session.New,
 			handlers.New,
+			// The registry /metrics serves, and the delivery
+			// collectors registered on it.
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			// The one SSRF guard both target-creation validation
 			// and the delivery dialer consult, so they cannot
@@ -187,11 +192,10 @@ func newApp() *fx.App {
 			// Wire *delivery.Engine as delivery.Notifier so the
 			// webhook handler can notify the engine of new deliveries.
 			func(e *delivery.Engine) delivery.Notifier { return e },
-			// Wire *delivery.Engine as delivery.WebhookEvictor so
+			// Wire *delivery.Engine as delivery.Archives so deleting
-			// deleting a webhook releases its archive writer.
+			// or renaming a webhook or target reaches its archive
-			func(e *delivery.Engine) delivery.WebhookEvictor {
+			// files.
-				return e
+			func(e *delivery.Engine) delivery.Archives { return e },
-			},
 			server.New,
 		),
 		fx.Invoke(

go.mod

@@ -4,6 +4,7 @@ go 1.26.1
 
 require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
+	github.com/dustin/go-humanize v1.0.1
 	github.com/getsentry/sentry-go v0.25.0
 	github.com/go-chi/chi v1.5.5
 	github.com/go-chi/cors v1.2.1
@@ -29,7 +30,6 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect

internal/config/config.go

@@ -75,6 +75,11 @@ const (
 	// internet-exposed endpoint.
 	defaultReceiverRateLimit = 120
 
+	// defaultTrustedProxies is TRUSTED_PROXIES when it is unset: the
+	// RFC 1918 private ranges, which a reverse proxy reaching the
+	// process over a Docker network or a private LAN connects from.
+	defaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+
 	// maxPort is the highest valid TCP port number. The lower
 	// bound (at least 1) is enforced by envPositiveInt.
 	maxPort = 65535
@@ -172,13 +177,14 @@ type Config struct {
 
 	// TrustedProxies is the set of networks whose members are
 	// allowed to speak for the client with X-Forwarded-For, the
-	// only forwarded header read. It is empty unless
+	// only forwarded header read. Unless TRUSTED_PROXIES is set it
-	// TRUSTED_PROXIES is set, and empty means no peer is
+	// is the RFC 1918 private ranges (defaultTrustedProxies); a set
-	// trusted: forwarded headers are then ignored entirely and
+	// value replaces them. If any client can reach the process, or
-	// clients are identified by the connection's own address.
+	// the proxy in front of it, from an RFC 1918 source address
-	// Members can choose their own rate-limit key, so this must
+	// (directly, or through anything that can rewrite source
-	// name proxy hosts only, never a block that also covers
+	// addresses, such as NAT or a published container port), it
-	// clients.
+	// must be set to the proxy's address alone, or every rate limit
+	// can be bypassed by those clients.
 	TrustedProxies []netip.Prefix
 
 	// AllowedEgressCIDRs is the set of networks a delivery target
@@ -460,14 +466,15 @@ func parseCIDR(entry string) (netip.Prefix, error) {
 
 // envPrefixList returns the value of the named environment variable
 // parsed as a comma-separated list of CIDR blocks (bare addresses
-// allowed). An unset, empty, or blank value yields an empty list. A
+// allowed). An unset, empty, or blank value is read as defaultValue
-// set value containing an unparseable entry is a hard error naming
+// instead. A set value containing an unparseable entry is a hard
-// the key and the bad entry, so startup fails loudly rather than
+// error naming the key and the bad entry, so startup fails loudly
-// silently running with a list the operator did not intend.
+// rather than silently running with a list the operator did not
-func envPrefixList(key string) ([]netip.Prefix, error) {
+// intend.
+func envPrefixList(key, defaultValue string) ([]netip.Prefix, error) {
 	v := strings.TrimSpace(os.Getenv(key))
 	if v == "" {
-		return nil, nil
+		v = defaultValue
 	}
 
 	var prefixes []netip.Prefix
@@ -681,12 +688,12 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
-	trustedProxies, err := envPrefixList("TRUSTED_PROXIES")
+	trustedProxies, err := envPrefixList("TRUSTED_PROXIES", defaultTrustedProxies)
 	if err != nil {
 		return nil, err
 	}
 
-	allowedEgressCIDRs, err := envPrefixList("ALLOWED_EGRESS_CIDRS")
+	allowedEgressCIDRs, err := envPrefixList("ALLOWED_EGRESS_CIDRS", "")
 	if err != nil {
 		return nil, err
 	}
@@ -760,50 +767,6 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 	)
 }
 
-// warnSharedRateLimitBucket logs a startup warning whenever
-// TRUSTED_PROXIES is empty, in any environment.
-//
-// With no trusted proxies every rate limiter keys on the connecting
-// peer's address. Whether that is harmless or dangerous depends on
-// what is in front of the process, which this code cannot observe:
-// with nothing in front, the peer is the client and the limits are
-// per-client as intended; behind a reverse proxy the peer is the proxy
-// for every request, so all clients share one bucket per limiter.
-//
-// The login endpoint no longer spends budget on arrival — it verifies
-// credentials first and charges only failures — so a shared bucket
-// cannot deny the operator a correct password. What it does collapse
-// is the failure counting: one client's wrong passwords throttle
-// everyone else's wrong passwords, and the receiver's limits become
-// service-wide ceilings.
-//
-// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT:
-// behind a proxy every client shares one bucket in dev and prod alike.
-//
-// The default of trusting nobody is deliberate — trusting forwarded
-// headers from arbitrary peers lets any client choose its own bucket —
-// so this warns rather than failing startup or changing the key.
-func (c *Config) warnSharedRateLimitBucket(log *slog.Logger) {
-	if len(c.TrustedProxies) > 0 {
-		return
-	}
-
-	log.Warn(
-		"TRUSTED_PROXIES is empty: every rate limit keys on the "+
-			"connecting peer's address. With nothing proxying to "+
-			"this process that is the client itself and the limits "+
-			"are per-client as intended. Behind a reverse proxy the "+
-			"peer is the proxy on every request, so all clients "+
-			"share one bucket per limit: the receiver limits become "+
-			"service-wide ceilings, and one client's failed logins "+
-			"throttle every other client's failed logins — a "+
-			"correct password still gets in. If anything proxies to "+
-			"this process, set TRUSTED_PROXIES to its address.",
-		"environment", c.Environment,
-		"trustedProxies", len(c.TrustedProxies),
-	)
-}
-
 // New creates a Config by reading environment variables.
 //
 //nolint:revive // lc parameter is required by fx even if unused.
@@ -849,7 +812,6 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"hasMetricsAuth", s.MetricsAuthEnabled(),
 	)
 
-	s.warnSharedRateLimitBucket(log)
 	s.warnEgressAllowlist(log)
 
 	return s, nil

internal/config/config_test.go

@@ -551,6 +551,11 @@ func testReceiverRateLimitSuccess(
 }
 
 func TestTrustedProxies(t *testing.T) {
+	// Unset, the RFC 1918 private ranges are trusted, so a reverse
+	// proxy on a Docker network or a private LAN is covered without
+	// configuration.
+	defaultProxies := []string{cidrPrivateV4, "172.16.0.0/12", "192.168.0.0/16"}
+
 	tests := []struct {
 		name        string
 		set         bool
@@ -559,18 +564,21 @@ func TestTrustedProxies(t *testing.T) {
 		expected    []string
 	}{
 		{
-			// The default must be "trust nobody": an empty list
-			// means forwarded headers are ignored, never that
-			// every peer may speak for the client.
 			name:     caseUnsetUsesDefault,
 			set:      false,
-			expected: []string{},
+			expected: defaultProxies,
 		},
 		{
-			name:     "blank value trusts nothing",
+			name:     "blank value uses default",
 			set:      true,
 			value:    "  ",
-			expected: []string{},
+			expected: defaultProxies,
+		},
+		{
+			name:     "set value replaces the default entirely",
+			set:      true,
+			value:    "203.0.113.7",
+			expected: []string{"203.0.113.7/32"},
 		},
 		{
 			name:  caseValidValueParsed,
@@ -845,101 +853,6 @@ func TestEgressAllowlistWarning(t *testing.T) {
 	}
 }
 
-// TestSharedRateLimitBucketWarning covers the startup warning that
-// tells an operator a deployment behind a reverse proxy shares one
-// rate-limit bucket between every client, which turns the receiver
-// limits into service-wide ceilings and collapses login failure
-// counting. It must fire whenever TRUSTED_PROXIES is empty, in any
-// environment, because behind a proxy every client shares one bucket
-// in dev and prod alike. It stays quiet once proxies are named.
-func TestSharedRateLimitBucketWarning(t *testing.T) {
-	tests := []struct {
-		name           string
-		environment    string
-		trustedProxies string
-		expectWarning  bool
-	}{
-		{
-			name:          "prod without trusted proxies warns",
-			environment:   config.EnvironmentProd,
-			expectWarning: true,
-		},
-		{
-			name:           "prod with trusted proxies is quiet",
-			environment:    config.EnvironmentProd,
-			trustedProxies: cidrPrivateV4,
-			expectWarning:  false,
-		},
-		{
-			name:          "dev without trusted proxies warns",
-			environment:   config.EnvironmentDev,
-			expectWarning: true,
-		},
-		{
-			name:           "dev with trusted proxies is quiet",
-			environment:    config.EnvironmentDev,
-			trustedProxies: cidrPrivateV4,
-			expectWarning:  false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			t.Setenv("WEBHOOKER_ENVIRONMENT", tt.environment)
-
-			if tt.trustedProxies == "" {
-				require.NoError(
-					t, os.Unsetenv("TRUSTED_PROXIES"),
-				)
-			} else {
-				t.Setenv("TRUSTED_PROXIES", tt.trustedProxies)
-			}
-
-			var buf bytes.Buffer
-
-			log := slog.New(slog.NewJSONHandler(
-				&buf, &slog.HandlerOptions{
-					Level: slog.LevelDebug,
-				},
-			))
-
-			require.NoError(
-				t,
-				config.WarnSharedRateLimitBucketForTest(log),
-			)
-
-			if !tt.expectWarning {
-				assert.Empty(t, buf.String())
-
-				return
-			}
-
-			logged := buf.String()
-
-			assert.Contains(t, logged, `"level":"WARN"`)
-			assert.Contains(t, logged, "TRUSTED_PROXIES")
-			assert.Contains(t, logged, "share one bucket")
-			assert.Contains(
-				t, logged, "throttle every other client's failed logins",
-			)
-			// The warning must not claim a lockout the login
-			// endpoint no longer permits: credentials are verified
-			// before any budget is spent.
-			assert.Contains(
-				t, logged, "a correct password still gets in",
-			)
-			// The text must stay accurate for a developer with
-			// nothing in front of the process, where an empty
-			// list costs nothing.
-			assert.Contains(
-				t, logged, "nothing proxying to this process",
-			)
-		})
-	}
-}
-
 // metricsEnv describes what one subtest below puts in the
 // environment for a single METRICS_ variable. A variable that is
 // set to the empty string and one that is not set at all are

internal/config/export_test.go

@@ -6,21 +6,6 @@ import "log/slog"
 // the external config_test package so each helper can be covered by
 // its own table-driven test without weakening the package API.
 
-// WarnSharedRateLimitBucketForTest loads a Config from the current
-// environment and emits its startup warnings to log. The real logger
-// writes to stdout, so this lets the warning's firing condition be
-// asserted against a handler the test controls.
-func WarnSharedRateLimitBucketForTest(log *slog.Logger) error {
-	c, err := loadFromEnv()
-	if err != nil {
-		return err
-	}
-
-	c.warnSharedRateLimitBucket(log)
-
-	return nil
-}
-
 // WarnEgressAllowlistForTest loads a Config from the current
 // environment and emits its egress-allowlist startup warning to
 // log, so a test can assert both that the warning fires only when

internal/database/event_tier_indexes_test.go

@@ -93,11 +93,11 @@ func TestEventTierQueriesUseTheirIndexes(t *testing.T) {
 		deliveries []database.Delivery
 		results    []database.DeliveryResult
 		depths     []struct{ Depth int }
+		removed    []database.TargetTotals
 	)
 
 	byStatus := "idx_deliveries_status (status=? AND deleted_at=?)"
 	byEvent := "idx_deliveries_event_id (event_id=? AND deleted_at=?)"
-	byAge := "idx_events_deleted_at_created_at (deleted_at=? AND created_at<?)"
 
 	// The delivery engine: recovery and the retry sweep, the sweep for
 	// stranded pending deliveries, and the queue depth count.
@@ -123,25 +123,80 @@ func TestEventTierQueriesUseTheirIndexes(t *testing.T) {
 		Order("attempt_num ASC").Find(&results),
 		"idx_delivery_results_delivery_id (delivery_id=? AND deleted_at=?)")
 
-	// Retention's three deletes (reapExpired), whose subqueries are built
+	// Retention (reapExpired, deleteEvents): one batch of expired
-	// afresh for each statement as it builds them.
+	// events, then their attempts, deliveries and the events.
-	expiredEventIDs := func() *gorm.DB {
+	var expired []string
-		return dry.Model(&database.Event{}).Select("id").
-			Where("created_at < ?", cutoff)
-	}
 
+	assertPlanUses(t, db, dry.Unscoped().Model(&database.Event{}).
+		Where("created_at < ?", cutoff).
+		Limit(database.ExportReapBatchSize).Pluck("id", &expired),
+		"idx_events_created_at (created_at<?)")
 	assertPlanUses(t, db, dry.Unscoped().Where(
-		"delivery_id IN (?)", dry.Model(&database.Delivery{}).
+		"delivery_id IN (?)", dry.Unscoped().Model(&database.Delivery{}).
-			Select("id").Where("event_id IN (?)", expiredEventIDs()),
+			Select("id").Where("event_id IN ?", ids),
 	).Delete(&database.DeliveryResult{}),
-		"idx_delivery_results_delivery_id (delivery_id=?)", byEvent, byAge)
+		"idx_delivery_results_delivery_id (delivery_id=?)",
-	assertPlanUses(t, db, dry.Unscoped().Where(
+		"idx_deliveries_event_id (event_id=?)")
-		"event_id IN (?)", expiredEventIDs(),
+	assertPlanUses(t, db, dry.Unscoped().Model(&database.Delivery{}).
-	).Delete(&database.Delivery{}),
+		Select("target_id, count(*) AS deliveries_removed, "+
-		"idx_deliveries_event_id (event_id=?)", byAge)
+			"count(CASE WHEN status = ? THEN 1 END) AS failed_removed",
-	assertPlanUses(t, db, dry.Unscoped().Where(
+			database.DeliveryStatusFailed).
-		"created_at < ?", cutoff,
+		Where("event_id IN ?", ids).Group("target_id").Find(&removed),
-	).Delete(&database.Event{}), "idx_events_created_at (created_at<?)")
+		"idx_deliveries_event_id (event_id=?)")
+	assertPlanUses(t, db, dry.Unscoped().Where("event_id IN ?", ids).
+		Delete(&database.Delivery{}), "idx_deliveries_event_id (event_id=?)")
+	assertPlanUses(t, db, dry.Unscoped().Where("id IN ?", ids).
+		Delete(&database.Event{}), "sqlite_autoindex_events_1 (id=?)")
+}
+
+// TestStatisticsQueriesUseTheirIndexes does the same for the webhook
+// page's statistics (readEventStats in the handlers): deliveries in
+// progress, each target's deliveries finished since a time, which must
+// come from the index alone, and events received since a time.
+func TestStatisticsQueriesUseTheirIndexes(t *testing.T) {
+	t.Parallel()
+
+	mgr, lc := setupTestWebhookDBManager(t)
+	ctx := context.Background()
+	require.NoError(t, lc.Start(ctx))
+
+	defer func() { require.NoError(t, lc.Stop(ctx)) }()
+
+	db, err := mgr.GetDB(uuid.New().String())
+	require.NoError(t, err)
+
+	dry := db.Session(&gorm.Session{DryRun: true})
+	since := time.Now()
+
+	var (
+		count    int64
+		byTarget []struct{ TargetID string }
+	)
+
+	assertPlanUses(t, db, dry.Model(&database.Delivery{}).
+		Where("status IN ?", []database.DeliveryStatus{
+			database.DeliveryStatusPending,
+			database.DeliveryStatusRetrying,
+		}).Count(&count),
+		"idx_deliveries_status (status=? AND deleted_at=?)")
+	assertPlanUses(t, db, dry.Model(&database.Delivery{}).
+		Select("target_id, "+
+			"count(CASE WHEN status = ? THEN 1 END) AS delivered, "+
+			"count(CASE WHEN status = ? THEN 1 END) AS failed",
+			database.DeliveryStatusDelivered,
+			database.DeliveryStatusFailed).
+		Where("status IN ? AND finished_at >= ?",
+			[]database.DeliveryStatus{
+				database.DeliveryStatusDelivered,
+				database.DeliveryStatusFailed,
+			}, since).
+		Group("target_id").Find(&byTarget),
+		"COVERING INDEX idx_deliveries_status "+
+			"(status=? AND deleted_at=? AND finished_at>?)")
+	assertPlanUses(t, db, dry.Model(&database.Event{}).
+		Where("created_at >= ?", since).Count(&count),
+		"idx_events_deleted_at_created_at "+
+			"(deleted_at=? AND created_at>?)")
 }
 
 // assertPlanUses asserts that SQLite's plan for a statement GORM built

internal/database/export_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"log/slog"
 	"os"
+	"testing"
 	"time"
 
 	"go.uber.org/fx"
@@ -28,6 +29,10 @@ func NewTestRetentionReaper(
 	}
 }
 
+// ExportReapBatchSize exposes how many expired events one retention
+// transaction deletes.
+const ExportReapBatchSize = reapBatchSize
+
 // ExportSweep runs a single retention sweep synchronously for tests.
 func (r *RetentionReaper) ExportSweep(ctx context.Context) {
 	r.sweep(ctx)
@@ -79,3 +84,14 @@ func (d *Database) ExportSetBannerOut(w io.Writer) {
 func DummyPasswordHashForTest() string {
 	return dummyPasswordHash()
 }
+
+// HashAtShippedCostForTest makes HashPassword hash at the shipped
+// memory cost until t ends. t must not run in parallel with other
+// tests, which would hash at that cost alongside it.
+func HashAtShippedCostForTest(t *testing.T) {
+	t.Helper()
+
+	hashAtShippedCostInTest = true
+
+	t.Cleanup(func() { hashAtShippedCostInTest = false })
+}

internal/database/model_delivery.go

@@ -1,6 +1,10 @@
 package database
 
-import "gorm.io/gorm"
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
 
 // DeliveryStatus represents the status of a delivery
 type DeliveryStatus string
@@ -37,7 +41,7 @@ type Delivery struct {
 	BaseModel
 
 	EventID  string         `gorm:"type:uuid;not null;index:idx_deliveries_event_id,priority:1"       json:"eventId"`
-	TargetID string         `gorm:"type:uuid;not null"                                                json:"targetId"`
+	TargetID string         `gorm:"type:uuid;not null;index:idx_deliveries_status,priority:4"         json:"targetId"`
 	Status   DeliveryStatus `gorm:"not null;default:'pending';index:idx_deliveries_status,priority:1" json:"status"`
 
 	// DeletedAt repeats the BaseModel field only to be the second column
@@ -45,6 +49,13 @@ type Delivery struct {
 	// gives.
 	DeletedAt gorm.DeletedAt `gorm:"index:idx_deliveries_event_id,priority:2;index:idx_deliveries_status,priority:2" json:"deletedAt,omitzero"`
 
+	// FinishedAt is when the delivery became delivered or failed, and
+	// nil while it is pending or retrying. It and then TargetID end the
+	// status index, so the webhook page counts each target's deliveries
+	// that finished in a recent window by reading just that window from
+	// the index.
+	FinishedAt *time.Time `gorm:"index:idx_deliveries_status,priority:3" json:"finishedAt,omitempty"`
+
 	// Relations
 	Event           Event            `json:"event,omitzero"`
 	Target          Target           `json:"target,omitzero"`

internal/database/model_event.go

@@ -31,6 +31,11 @@ type Event struct {
 	Body        string `gorm:"type:text"   json:"body"`
 	ContentType string `json:"contentType"`
 
+	// BodyBytes is the size of Body in bytes, recorded when the event
+	// is stored so the recent events list can show it without reading
+	// the body.
+	BodyBytes int64 `gorm:"not null" json:"bodyBytes"`
+
 	// ResubmittedFromID names the event this one was copied from by
 	// an operator resubmit. It is nil for an event that arrived on
 	// the receiver, which is every event created before the column

internal/database/model_totals.go

@@ -0,0 +1,99 @@
+package database
+
+import (
+	"fmt"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// The running totals in a webhook's event database keep the webhook
+// page's lifetime figures right after retention has removed the rows
+// they count, and let the page show them without counting every row.
+// Each total changes in the transaction that writes or deletes the
+// rows it counts.
+
+// EventTotals is the single row counting a webhook's events: every
+// event ever stored, how many of them retention has deleted, and when
+// the newest arrived, which retention leaves as it is.
+type EventTotals struct {
+	ID int64 `gorm:"primaryKey"`
+
+	Events        int64 `gorm:"not null"`
+	EventsRemoved int64 `gorm:"not null"`
+
+	// LastEventAt is when the newest event arrived, or nil before the
+	// first.
+	LastEventAt *time.Time
+}
+
+// TableName names the table AddEventTotals updates.
+func (EventTotals) TableName() string {
+	return "event_totals"
+}
+
+// TargetTotals is one row per target counting its deliveries: every
+// delivery ever created, how many became delivered and how many
+// failed, and how many deliveries and failed deliveries retention has
+// deleted. The webhook's delivery figures are these rows summed.
+type TargetTotals struct {
+	TargetID string `gorm:"type:uuid;primaryKey"`
+
+	Deliveries int64 `gorm:"not null"`
+	Delivered  int64 `gorm:"not null"`
+	Failed     int64 `gorm:"not null"`
+
+	DeliveriesRemoved int64 `gorm:"not null"`
+	FailedRemoved     int64 `gorm:"not null"`
+}
+
+// TableName names the table AddTargetTotals updates.
+func (TargetTotals) TableName() string {
+	return "target_totals"
+}
+
+// AddEventTotals adds each count in add to the webhook's event totals,
+// and records add.LastEventAt as when the newest event arrived if it is
+// set. Call it on the transaction that writes or deletes the events it
+// counts.
+func AddEventTotals(tx *gorm.DB, add EventTotals) error {
+	err := tx.Exec(
+		`UPDATE event_totals SET
+			events = events + ?,
+			events_removed = events_removed + ?,
+			last_event_at = coalesce(?, last_event_at)`,
+		add.Events, add.EventsRemoved, add.LastEventAt,
+	).Error
+	if err != nil {
+		return fmt.Errorf("adding to event totals: %w", err)
+	}
+
+	return nil
+}
+
+// AddTargetTotals adds each count in add to the totals of the target
+// add.TargetID names, creating its row the first time. Call it on the
+// transaction that writes or deletes the deliveries it counts.
+func AddTargetTotals(tx *gorm.DB, add TargetTotals) error {
+	err := tx.Exec(
+		`INSERT INTO target_totals (target_id, deliveries, delivered,
+			failed, deliveries_removed, failed_removed)
+		VALUES (?, ?, ?, ?, ?, ?)
+		ON CONFLICT (target_id) DO UPDATE SET
+			deliveries = deliveries + excluded.deliveries,
+			delivered = delivered + excluded.delivered,
+			failed = failed + excluded.failed,
+			deliveries_removed =
+				deliveries_removed + excluded.deliveries_removed,
+			failed_removed = failed_removed + excluded.failed_removed`,
+		add.TargetID, add.Deliveries, add.Delivered,
+		add.Failed, add.DeliveriesRemoved, add.FailedRemoved,
+	).Error
+	if err != nil {
+		return fmt.Errorf(
+			"adding to totals of target %s: %w", add.TargetID, err,
+		)
+	}
+
+	return nil
+}

internal/database/model_user.go

@@ -1,13 +1,58 @@
 package database
 
+import (
+	"errors"
+	"fmt"
+
+	"gorm.io/gorm"
+)
+
+// MaxUsernameBytes is the longest username, in bytes, that a user may
+// have. The same number appears in the check constraint on
+// User.Username, because a struct tag cannot reference a constant.
+//
+// A login stores the username in the session cookie, and both
+// securecookie and browsers refuse a cookie value past about 4096
+// bytes. That value is the session base64-encoded twice, so it holds
+// 4096 × 3/4 × 3/4 = 2304 bytes of session, and the signature,
+// timestamp and the session's other values take about 270 of those: a
+// username longer than about 2030 bytes can never log in. The limit is
+// about half that, so the session can carry more values later without
+// locking out an account whose username is already at the limit.
+const MaxUsernameBytes = 1024
+
+// ErrUsernameTooLong is returned when a user is saved with a username
+// longer than MaxUsernameBytes.
+var ErrUsernameTooLong = errors.New("username is too long")
+
 // User represents a user of the webhooker service
+//
+//nolint:lll // a struct tag cannot wrap
 type User struct {
 	BaseModel
 
-	Username string `gorm:"uniqueIndex;not null" json:"username"`
+	Username string `gorm:"uniqueIndex;not null;check:length(CAST(username AS BLOB)) <= 1024" json:"username"`
 	Password string `gorm:"not null"                                                          json:"-"` // Argon2 hashed
 
 	// Relations
 	Webhooks []Webhook `json:"webhooks,omitempty"`
 	APIKeys  []APIKey  `json:"apiKeys,omitempty"`
 }
+
+// BeforeSave rejects a username longer than MaxUsernameBytes when a whole
+// User is created or saved, so those calls get ErrUsernameTooLong rather
+// than the database's constraint error. A column update such as
+// Update("username", ...) is caught only by the check constraint, as is
+// any path that writes the table without this model.
+func (u *User) BeforeSave(_ *gorm.DB) error {
+	if len(u.Username) > MaxUsernameBytes {
+		return fmt.Errorf(
+			"%w: %d bytes, limit is %d",
+			ErrUsernameTooLong,
+			len(u.Username),
+			MaxUsernameBytes,
+		)
+	}
+
+	return nil
+}

internal/database/model_user_test.go

@@ -0,0 +1,65 @@
+package database_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// usernameAtLimit is exactly MaxUsernameBytes long, built from a
+// two-byte character. A check that counted characters rather than bytes
+// would see half the length and let the one-byte-longer name through.
+func usernameAtLimit() string {
+	return strings.Repeat("é", database.MaxUsernameBytes/2)
+}
+
+func TestUserCreate_RejectsOverlongUsername(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	err := db.Create(&database.User{
+		Username: usernameAtLimit() + "x",
+		Password: "hash",
+	}).Error
+
+	require.ErrorIs(t, err, database.ErrUsernameTooLong)
+}
+
+func TestUserCreate_AcceptsUsernameAtLimit(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	require.NoError(t, db.Create(&database.User{
+		Username: usernameAtLimit(),
+		Password: "hash",
+	}).Error)
+}
+
+// TestUsersTable_EnforcesUsernameLimitWithoutTheModel inserts with raw
+// SQL, as a path that bypassed User.BeforeSave would, so only the
+// table's check constraint stands between it and an over-long
+// username. Accepting the name at the limit and refusing the next byte
+// also pins the constraint's number to MaxUsernameBytes.
+func TestUsersTable_EnforcesUsernameLimitWithoutTheModel(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	insert := "INSERT INTO users (id, username, password) VALUES (?, ?, ?)"
+
+	require.NoError(t, db.Exec(
+		insert, uuid.New().String(), usernameAtLimit(), "hash",
+	).Error)
+
+	err := db.Exec(
+		insert, uuid.New().String(), usernameAtLimit()+"x", "hash",
+	).Error
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "CHECK constraint failed")
+}

internal/database/models.go

@@ -2,7 +2,8 @@ package database
 
 // Migrate runs database migrations for the main application database.
 // Only configuration-tier models are stored in the main database.
-// Event-tier models (Event, Delivery, DeliveryResult) live in
+// Event-tier models (Event, Delivery, DeliveryResult, EventTotals,
+// TargetTotals) live in
 // per-webhook dedicated databases managed by WebhookDBManager.
 func (d *Database) Migrate() error {
 	return d.db.AutoMigrate(

internal/database/password.go

@@ -9,6 +9,7 @@ import (
 	"math/big"
 	"strings"
 	"sync"
+	"testing"
 
 	"golang.org/x/crypto/argon2"
 )
@@ -63,10 +64,30 @@ func DefaultPasswordConfig() *PasswordConfig {
 	}
 }
 
-// HashPassword generates an Argon2id hash of the password
+// testArgon2Memory is the Argon2id memory cost, in KiB, that a test
+// binary hashes with: 1 MB instead of the shipped 64 MB. Every test
+// that starts a database hashes the bootstrap admin password, dozens
+// of them run in parallel, and under the race detector each 64 MB hash
+// holds about 150 MB. VerifyPassword reads the cost from the hash it
+// checks, so verification follows.
+const testArgon2Memory = 1024
+
+// hashAtShippedCostInTest makes a test binary hash at the shipped
+// memory cost. Only TestHashPassword_ShippedParameters sets it.
+//
+//nolint:gochecknoglobals // set by one test, see above
+var hashAtShippedCostInTest bool
+
+// HashPassword generates an Argon2id hash of the password. A binary
+// built by go test hashes at testArgon2Memory; one built by go build
+// always hashes at the defaults.
 func HashPassword(password string) (string, error) {
 	config := DefaultPasswordConfig()
 
+	if testing.Testing() && !hashAtShippedCostInTest {
+		config.Memory = testArgon2Memory
+	}
+
 	// Generate a salt
 	salt := make([]byte, config.SaltLen)
 

internal/database/password_test.go

@@ -192,6 +192,39 @@ func TestHashPasswordUniqueness(t *testing.T) {
 	}
 }
 
+// TestHashPassword_ShippedParameters hashes and verifies through
+// HashPassword at the shipped Argon2id parameters. Every other test
+// hashes at the lower memory cost a test binary uses, so this is the
+// one that keeps production hashing covered. One hash and one
+// verification: each costs 64 MB.
+//
+//nolint:paralleltest // changes the hashing cost for the whole binary
+func TestHashPassword_ShippedParameters(t *testing.T) {
+	database.HashAtShippedCostForTest(t)
+
+	password := "correct horse battery staple"
+
+	hash, err := database.HashPassword(password)
+	if err != nil {
+		t.Fatalf("hashing with the shipped parameters: %v", err)
+	}
+
+	const shipped = "$argon2id$v=19$m=65536,t=1,p=4$"
+
+	if !strings.HasPrefix(hash, shipped) {
+		t.Errorf("hash = %q, want prefix %q", hash, shipped)
+	}
+
+	valid, err := database.VerifyPassword(password, hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword() error = %v", err)
+	}
+
+	if !valid {
+		t.Error("VerifyPassword() returned false for correct password")
+	}
+}
+
 // TestVerifyDummyPassword_DoesRealWork covers the anti-enumeration
 // path. Login charges an unknown username a verification against a
 // dummy hash so that a nonexistent account is not answered in

internal/database/retention.go

@@ -18,6 +18,19 @@ import (
 // computation.
 const hoursPerDay = 24
 
+// reapBatchSize is how many expired events one retention transaction
+// deletes. A transaction holds the event database's write lock, which
+// the receiver and the delivery workers wait for, so a large prune is
+// split into transactions each short enough to finish well inside the
+// busy timeout.
+const reapBatchSize = 1000
+
+// reapBatchPause is how long retention waits after one batch before
+// starting the next. A writer waiting for the write lock checks for it
+// again after at most 100 ms, so a longer pause lets it in between two
+// batches instead of only after the whole prune.
+const reapBatchPause = 200 * time.Millisecond
+
 // RetentionReaperParams holds the fx dependencies for the
 // RetentionReaper.
 type RetentionReaperParams struct {
@@ -187,13 +200,15 @@ func (r *RetentionReaper) sweep(ctx context.Context) {
 			continue
 		}
 
-		r.reapWebhook(wh.ID, wh.RetentionDays)
+		r.reapWebhook(ctx, wh.ID, wh.RetentionDays)
 	}
 }
 
 // reapWebhook removes every expired event (and its dependents) from a
-// single webhook's database.
+// single webhook's database, or as many as it reaches before ctx is
+// cancelled.
 func (r *RetentionReaper) reapWebhook(
+	ctx context.Context,
 	webhookID string,
 	retentionDays int,
 ) {
@@ -213,7 +228,7 @@ func (r *RetentionReaper) reapWebhook(
 		return
 	}
 
-	deleted, err := reapExpired(db, cutoff)
+	deleted, err := reapExpired(ctx, db, cutoff)
 	if err != nil {
 		r.log.Error(
 			"retention sweep: failed to reap expired events",
@@ -265,57 +280,107 @@ func retentionCutoff(
 	), true
 }
 
-// reapExpired hard-deletes, in foreign-key-safe order, the delivery
+// reapExpired hard-deletes the events older than cutoff, with their
-// results, deliveries, and events associated with events older than
+// deliveries and delivery results, reapBatchSize events per
-// cutoff. Deletes are unscoped so rows are physically removed rather
+// transaction with reapBatchPause between transactions, until none is
-// than soft-deleted, reclaiming disk. It returns the number of events
+// left. Once ctx is cancelled it returns after the batch in hand,
-// deleted.
+// leaving the rest to the next sweep, so stopping the app does not
-func reapExpired(db *gorm.DB, cutoff time.Time) (int64, error) {
+// wait for a long prune. It returns the number of events deleted.
-	// Fresh subqueries are built per statement to avoid reusing a
+func reapExpired(
-	// mutated builder across executions.
+	ctx context.Context, db *gorm.DB, cutoff time.Time,
-	expiredEventIDs := func() *gorm.DB {
+) (int64, error) {
-		return db.Model(&Event{}).
+	var total int64
-			Select("id").
-			Where("created_at < ?", cutoff)
-	}
-	expiredDeliveryIDs := func() *gorm.DB {
-		return db.Model(&Delivery{}).
-			Select("id").
-			Where("event_id IN (?)", expiredEventIDs())
-	}
 
-	// 1. Delivery results whose delivery belongs to an expired event.
+	for {
-	res := db.Unscoped().
+		var eventIDs []string
-		Where("delivery_id IN (?)", expiredDeliveryIDs()).
-		Delete(&DeliveryResult{})
-	if res.Error != nil {
-		return 0, fmt.Errorf(
-			"deleting expired delivery results: %w",
-			res.Error,
-		)
-	}
 
-	// 2. Deliveries belonging to an expired event.
+		err := db.Transaction(func(tx *gorm.DB) error {
-	del := db.Unscoped().
+			err := tx.Unscoped().Model(&Event{}).
-		Where("event_id IN (?)", expiredEventIDs()).
-		Delete(&Delivery{})
-	if del.Error != nil {
-		return 0, fmt.Errorf(
-			"deleting expired deliveries: %w",
-			del.Error,
-		)
-	}
-
-	// 3. The expired events themselves.
-	ev := db.Unscoped().
 				Where("created_at < ?", cutoff).
-		Delete(&Event{})
+				Limit(reapBatchSize).
-	if ev.Error != nil {
+				Pluck("id", &eventIDs).Error
-		return 0, fmt.Errorf(
+			if err != nil {
-			"deleting expired events: %w",
+				return fmt.Errorf("selecting expired events: %w", err)
-			ev.Error,
-		)
 			}
 
-	return ev.RowsAffected, nil
+			if len(eventIDs) == 0 {
+				return nil
+			}
+
+			return deleteEvents(tx, eventIDs)
+		})
+		if err != nil {
+			return total, err
+		}
+
+		total += int64(len(eventIDs))
+
+		if len(eventIDs) < reapBatchSize {
+			return total, nil
+		}
+
+		select {
+		case <-ctx.Done():
+			return total, nil
+		case <-time.After(reapBatchPause):
+		}
+	}
+}
+
+// deleteEvents hard-deletes the given events and, in foreign-key-safe
+// order before them, their delivery results and deliveries, then adds
+// what it deleted to the running totals. It runs on reapExpired's
+// transaction, so the totals change exactly when the rows do. Deletes
+// are unscoped so rows are physically removed rather than
+// soft-deleted, reclaiming disk.
+func deleteEvents(tx *gorm.DB, eventIDs []string) error {
+	// 1. The delivery results of the events' deliveries.
+	err := tx.Unscoped().
+		Where("delivery_id IN (?)", tx.Unscoped().Model(&Delivery{}).
+			Select("id").
+			Where("event_id IN ?", eventIDs)).
+		Delete(&DeliveryResult{}).Error
+	if err != nil {
+		return fmt.Errorf("deleting expired delivery results: %w", err)
+	}
+
+	// 2. The events' deliveries, after counting them, and the failed
+	// ones among them, per target. The status is tested in the select
+	// list rather than the WHERE clause: there, SQLite would read every
+	// failed delivery the webhook has through the status index,
+	// instead of only these through the event_id index.
+	var removed []TargetTotals
+
+	err = tx.Unscoped().Model(&Delivery{}).
+		Select("target_id, count(*) AS deliveries_removed, "+
+			"count(CASE WHEN status = ? THEN 1 END) AS failed_removed",
+			DeliveryStatusFailed).
+		Where("event_id IN ?", eventIDs).
+		Group("target_id").
+		Find(&removed).Error
+	if err != nil {
+		return fmt.Errorf("counting expired deliveries: %w", err)
+	}
+
+	err = tx.Unscoped().
+		Where("event_id IN ?", eventIDs).
+		Delete(&Delivery{}).Error
+	if err != nil {
+		return fmt.Errorf("deleting expired deliveries: %w", err)
+	}
+
+	// 3. The events themselves.
+	ev := tx.Unscoped().Where("id IN ?", eventIDs).Delete(&Event{})
+	if ev.Error != nil {
+		return fmt.Errorf("deleting expired events: %w", ev.Error)
+	}
+
+	for i := range removed {
+		err = AddTargetTotals(tx, removed[i])
+		if err != nil {
+			return err
+		}
+	}
+
+	return AddEventTotals(tx, EventTotals{EventsRemoved: ev.RowsAffected})
 }

internal/database/totals_test.go

@@ -0,0 +1,410 @@
+package database_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// readEventTotals reads a webhook database's row of event totals,
+// asserting that it has exactly one.
+func readEventTotals(t *testing.T, db *gorm.DB) database.EventTotals {
+	t.Helper()
+
+	var rows []database.EventTotals
+
+	require.NoError(t, db.Find(&rows).Error)
+	require.Len(t, rows, 1)
+
+	return rows[0]
+}
+
+// readTargetTotals reads a webhook database's target totals, keyed by
+// target.
+func readTargetTotals(
+	t *testing.T, db *gorm.DB,
+) map[string]database.TargetTotals {
+	t.Helper()
+
+	var rows []database.TargetTotals
+
+	require.NoError(t, db.Find(&rows).Error)
+
+	byTarget := make(map[string]database.TargetTotals, len(rows))
+	for _, row := range rows {
+		byTarget[row.TargetID] = row
+	}
+
+	return byTarget
+}
+
+// TestWebhookDBManager_TotalsSurviveReopen verifies that a new event
+// database starts with one row of zero event totals and no target
+// totals, that adding to a target twice adds to the one row, and that
+// opening the database again keeps everything added.
+func TestWebhookDBManager_TotalsSurviveReopen(t *testing.T) {
+	t.Parallel()
+
+	mgr, lc := setupTestWebhookDBManager(t)
+	ctx := context.Background()
+	require.NoError(t, lc.Start(ctx))
+
+	defer func() { require.NoError(t, lc.Stop(ctx)) }()
+
+	webhookID := uuid.New().String()
+
+	db, err := mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	fresh := readEventTotals(t, db)
+	assert.Equal(t, database.EventTotals{ID: fresh.ID}, fresh)
+	assert.Empty(t, readTargetTotals(t, db))
+
+	first, second := uuid.New().String(), uuid.New().String()
+
+	require.NoError(t, database.AddEventTotals(db, database.EventTotals{
+		Events: 2,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: first, Deliveries: 2, Delivered: 1,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: first, Failed: 1,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: second, Deliveries: 1,
+	}))
+
+	// Drop the cached connection so the next open reopens the file,
+	// as a restart would.
+	require.NoError(t, mgr.CloseAll())
+
+	db, err = mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	assert.Equal(t, database.EventTotals{ID: fresh.ID, Events: 2},
+		readEventTotals(t, db))
+	assert.Equal(t, map[string]database.TargetTotals{
+		first: {
+			TargetID: first, Deliveries: 2, Delivered: 1, Failed: 1,
+		},
+		second: {TargetID: second, Deliveries: 1},
+	}, readTargetTotals(t, db))
+}
+
+// seedExpiredEvents stores count events created at the given time,
+// each with a delivered delivery to one target and a failed delivery
+// to the other, and one attempt for each delivery.
+func seedExpiredEvents(
+	t *testing.T,
+	db *gorm.DB,
+	webhookID string,
+	count int,
+	createdAt time.Time,
+	delivered, failed string,
+) {
+	t.Helper()
+
+	events := make([]database.Event, count)
+	deliveries := make([]database.Delivery, 0, 2*count)
+
+	for i := range events {
+		events[i] = database.Event{
+			WebhookID:    webhookID,
+			EntrypointID: uuid.New().String(),
+			Method:       http.MethodPost,
+		}
+		events[i].ID = uuid.New().String()
+		events[i].CreatedAt = createdAt
+
+		deliveries = append(deliveries,
+			database.Delivery{
+				EventID:  events[i].ID,
+				TargetID: delivered,
+				Status:   database.DeliveryStatusDelivered,
+			},
+			database.Delivery{
+				EventID:  events[i].ID,
+				TargetID: failed,
+				Status:   database.DeliveryStatusFailed,
+			},
+		)
+	}
+
+	require.NoError(t, db.CreateInBatches(events, 500).Error)
+	require.NoError(t, db.CreateInBatches(deliveries, 500).Error)
+
+	results := make([]database.DeliveryResult, len(deliveries))
+	for i := range deliveries {
+		results[i] = database.DeliveryResult{
+			DeliveryID: deliveries[i].ID, AttemptNum: 1,
+		}
+	}
+
+	require.NoError(t, db.CreateInBatches(results, 500).Error)
+}
+
+// seedBareEvents stores count events created at the given time, with
+// no deliveries.
+func seedBareEvents(
+	t *testing.T,
+	db *gorm.DB,
+	webhookID string,
+	count int,
+	createdAt time.Time,
+) {
+	t.Helper()
+
+	events := make([]database.Event, count)
+	for i := range events {
+		events[i] = database.Event{
+			WebhookID:    webhookID,
+			EntrypointID: uuid.New().String(),
+			Method:       http.MethodPost,
+		}
+		events[i].CreatedAt = createdAt
+	}
+
+	require.NoError(t, db.CreateInBatches(events, 500).Error)
+}
+
+// TestRetentionReaper_PrunesMoreThanOneBatch verifies that a prune
+// larger than one transaction's batch removes every expired event with
+// its deliveries and delivery results, keeps the recent event, and
+// adds what it removed to the event and target totals, so the totals
+// within retention match the rows still stored.
+func TestRetentionReaper_PrunesMoreThanOneBatch(t *testing.T) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	webhookID := createWebhook(t, env.mainDB.DB(), 30)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	expired := database.ExportReapBatchSize + 1
+	delivered, failed := uuid.New().String(), uuid.New().String()
+	seedExpiredEvents(t, db, webhookID, expired,
+		time.Now().Add(-40*24*time.Hour), delivered, failed)
+
+	// One recent event, delivered to the first target.
+	recent := seedEventChain(t, db, webhookID, time.Now())
+	require.NoError(t, db.Model(&database.Delivery{}).
+		Where("id = ?", recent.deliveryID).
+		Update("target_id", delivered).Error)
+
+	// The totals storing those rows would have left.
+	n := int64(expired)
+	require.NoError(t, database.AddEventTotals(db, database.EventTotals{
+		Events: n + 1,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: delivered, Deliveries: n + 1, Delivered: n + 1,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: failed, Deliveries: n, Failed: n,
+	}))
+
+	env.reaper.ExportSweep(context.Background())
+
+	// Only the recent event's rows are left.
+	for _, model := range []any{
+		&database.Event{}, &database.Delivery{}, &database.DeliveryResult{},
+	} {
+		var count int64
+
+		require.NoError(t, db.Model(model).Count(&count).Error)
+		assert.Equal(t, int64(1), count, "%T rows left", model)
+	}
+
+	assertChainPresent(t, db, recent)
+
+	eventTotals := readEventTotals(t, db)
+	assert.Equal(t, database.EventTotals{
+		ID: eventTotals.ID, Events: n + 1, EventsRemoved: n,
+	}, eventTotals)
+
+	targetTotals := readTargetTotals(t, db)
+	assert.Equal(t, map[string]database.TargetTotals{
+		delivered: {
+			TargetID: delivered, Deliveries: n + 1, Delivered: n + 1,
+			DeliveriesRemoved: n,
+		},
+		failed: {
+			TargetID: failed, Deliveries: n, Failed: n,
+			DeliveriesRemoved: n, FailedRemoved: n,
+		},
+	}, targetTotals)
+
+	// A sweep with nothing left to remove changes nothing.
+	env.reaper.ExportSweep(context.Background())
+
+	assert.Equal(t, eventTotals, readEventTotals(t, db))
+	assert.Equal(t, targetTotals, readTargetTotals(t, db))
+}
+
+// TestRetentionReaper_WriteDuringPruneSucceeds verifies that a prune
+// of several batches lets other writers in between its batches: an
+// event stored once the first batch is deleted is stored while expired
+// events are still left, not only after the prune has finished.
+func TestRetentionReaper_WriteDuringPruneSucceeds(t *testing.T) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	webhookID := createWebhook(t, env.mainDB.DB(), 30)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	// Three batches of expired events, with nothing else stored: only
+	// the number of batches matters here.
+	expired := 3 * database.ExportReapBatchSize
+	seedBareEvents(t, db, webhookID, expired,
+		time.Now().Add(-40*24*time.Hour))
+
+	cutoff := time.Now().Add(-30 * 24 * time.Hour)
+	countExpired := func() int64 {
+		var count int64
+
+		require.NoError(t, db.Model(&database.Event{}).
+			Where("created_at < ?", cutoff).
+			Count(&count).Error)
+
+		return count
+	}
+
+	pruned := make(chan struct{})
+
+	go func() {
+		defer close(pruned)
+
+		env.reaper.ExportSweep(context.Background())
+	}()
+
+	t.Cleanup(func() { <-pruned })
+
+	// Every stored event is expired until the write below.
+	require.Eventually(t, func() bool {
+		var count int64
+
+		err := db.Model(&database.Event{}).Count(&count).Error
+
+		return err == nil && count < int64(expired)
+	}, 10*time.Second, 10*time.Millisecond)
+
+	event := &database.Event{
+		WebhookID:    webhookID,
+		EntrypointID: uuid.New().String(),
+		Method:       http.MethodPost,
+	}
+	require.NoError(t, db.Create(event).Error)
+
+	assert.Positive(t, countExpired(),
+		"the event was stored only after the whole prune")
+
+	<-pruned
+
+	assert.Zero(t, countExpired())
+
+	var stored database.Event
+
+	require.NoError(t, db.First(&stored, "id = ?", event.ID).Error)
+}
+
+// TestRetentionReaper_StopDuringPruneLeavesTheRest verifies that
+// stopping the reaper during a prune of several batches returns
+// between two batches, well inside the stop timeout, leaving the
+// remaining expired events for the next sweep, and that the totals
+// match the rows left.
+func TestRetentionReaper_StopDuringPruneLeavesTheRest(t *testing.T) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	webhookID := createWebhook(t, env.mainDB.DB(), 30)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	// Two batches and one more of expired events, a few of them with a
+	// delivered and a failed delivery for the target totals to count.
+	// Most carry nothing else, to keep the test quick.
+	const withDeliveries = 10
+
+	expiredAt := time.Now().Add(-40 * 24 * time.Hour)
+	delivered, failed := uuid.New().String(), uuid.New().String()
+	seedExpiredEvents(t, db, webhookID, withDeliveries, expiredAt,
+		delivered, failed)
+	seedBareEvents(t, db, webhookID,
+		2*database.ExportReapBatchSize+1-withDeliveries, expiredAt)
+
+	n := int64(2*database.ExportReapBatchSize + 1)
+	require.NoError(t, database.AddEventTotals(db, database.EventTotals{
+		Events: n,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: delivered, Deliveries: withDeliveries,
+		Delivered: withDeliveries,
+	}))
+	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
+		TargetID: failed, Deliveries: withDeliveries,
+		Failed: withDeliveries,
+	}))
+
+	env.reaper.ExportSetInterval(time.Millisecond)
+	env.reaper.ExportStart()
+
+	// Stop once the first batch is deleted. The stop lands in the pause
+	// after it, or at worst during the second batch, so at least the
+	// last event is left.
+	require.Eventually(t, func() bool {
+		var count int64
+
+		err := db.Model(&database.Event{}).Count(&count).Error
+
+		return err == nil && count < n
+	}, 10*time.Second, 10*time.Millisecond)
+
+	// The app's stop timeout.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	require.NoError(t, env.reaper.ExportStop(ctx))
+
+	var events int64
+
+	require.NoError(t, db.Model(&database.Event{}).Count(&events).Error)
+	assert.Positive(t, events, "the stop waited for the whole prune")
+
+	eventTotals := readEventTotals(t, db)
+	assert.Equal(t, events, eventTotals.Events-eventTotals.EventsRemoved)
+
+	targetTotals := readTargetTotals(t, db)
+	require.Len(t, targetTotals, 2)
+
+	for target, totals := range targetTotals {
+		var deliveries, failures int64
+
+		require.NoError(t, db.Model(&database.Delivery{}).
+			Where("target_id = ?", target).
+			Count(&deliveries).Error)
+		require.NoError(t, db.Model(&database.Delivery{}).
+			Where("target_id = ? AND status = ?",
+				target, database.DeliveryStatusFailed).
+			Count(&failures).Error)
+
+		assert.Equal(t, deliveries,
+			totals.Deliveries-totals.DeliveriesRemoved, target)
+		assert.Equal(t, failures, totals.Failed-totals.FailedRemoved,
+			target)
+	}
+}

internal/database/webhook_db_manager.go

@@ -35,7 +35,8 @@ var errInvalidCachedDBType = errors.New(
 
 // WebhookDBManager manages per-webhook SQLite database files
 // for event storage. Each webhook gets its own dedicated
-// database containing Events, Deliveries, and DeliveryResults.
+// database containing Events, Deliveries, DeliveryResults and the
+// running totals of them (EventTotals, TargetTotals).
 // Database connections are opened lazily and cached.
 type WebhookDBManager struct {
 	dataDir string
@@ -295,6 +296,7 @@ func (m *WebhookDBManager) openDB(
 	// Run migrations for event-tier models only
 	err = db.AutoMigrate(
 		&Event{}, &Delivery{}, &DeliveryResult{},
+		&EventTotals{}, &TargetTotals{},
 	)
 	if err != nil {
 		_ = sqlDB.Close()
@@ -305,6 +307,18 @@ func (m *WebhookDBManager) openDB(
 		)
 	}
 
+	// A new database gets its row of event totals, all zero. Target
+	// totals rows are created by the first delivery to each target.
+	err = db.FirstOrCreate(&EventTotals{}).Error
+	if err != nil {
+		_ = sqlDB.Close()
+
+		return nil, fmt.Errorf(
+			"creating event totals for webhook database %s: %w",
+			webhookID, err,
+		)
+	}
+
 	m.log.Info(
 		"opened per-webhook database",
 		"webhook_id", webhookID,

internal/delivery/archive_sweeper.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"go.uber.org/fx"
+	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/lifecycle"
@@ -25,14 +26,14 @@ type ArchiveSweeperParams struct {
 	Logger   *logger.Logger
 }
 
-// ArchiveSweeper periodically prunes expired rows from
+// ArchiveSweeper periodically prunes expired rows from the
-// per-webhook archive databases whose database target carries a
+// archive databases of database targets that carry a positive
-// positive expiry.
+// expiry.
 //
 // Without it, pruning happens only when an archive is
 // (re)opened, and archives are only ever reopened by writes: an
-// archive belonging to a webhook that has stopped receiving
+// archive whose target has stopped receiving events would keep
-// events would keep its expired rows forever. The sweep closes
+// its expired rows forever. The sweep closes
 // that gap without changing anything for archives whose expiry
 // is unset or "never".
 //
@@ -155,7 +156,7 @@ func (s *ArchiveSweeper) run(ctx context.Context) {
 // soft-deleted along with it, so GORM's default scope already
 // excludes them.
 //
-// A failure for one webhook is logged and the sweep continues,
+// A failure for one target is logged and the sweep continues,
 // matching how the write path already treats a prune error as
 // non-fatal.
 func (s *ArchiveSweeper) sweep(ctx context.Context) {
@@ -210,19 +211,20 @@ func (s *ArchiveSweeper) sweepTarget(target *database.Target) {
 		return
 	}
 
-	err = s.eng.dbTarget.sweepWebhook(target.WebhookID, expiry)
+	err = s.eng.dbTarget.sweepArchive(target.ID, expiry)
 	if err == nil {
 		return
 	}
 
-	// A writer evicted underneath the sweep means the operator
+	// A writer evicted, or a target row gone, underneath the sweep
-	// deleted the webhook (or its last database target) while the
+	// means the operator deleted the target or its webhook while
-	// sweep was walking the target list. That is an ordinary
+	// the sweep was walking the target list. That is an ordinary
 	// interleaving, not a failure, so it must not produce an
 	// error line.
-	if errors.Is(err, errArchiveWriterEvicted) {
+	if errors.Is(err, errArchiveWriterEvicted) ||
+		errors.Is(err, gorm.ErrRecordNotFound) {
 		s.log.Debug(
-			"archive sweep: writer evicted mid-sweep",
+			"archive sweep: target deleted mid-sweep",
 			"webhook_id", target.WebhookID,
 			"target_id", target.ID,
 		)

internal/delivery/archive_sweeper_test.go

@@ -34,18 +34,23 @@ const (
 	sweepConcurrentWrites = 20
 )
 
-// sweeperEnv bundles the pieces an archive sweep test drives:
+// archiveTestWebhookName is the name of every webhook
-// a main configuration database holding webhooks and targets, a
+// seedDatabaseTarget creates. It is not safe in a file name as it
-// delivery engine owning the archive writer registry, and the
+// stands, so every archive test goes through archiveNamePart.
-// data directory the archive files live in.
+const archiveTestWebhookName = "Sweep Test!"
-type sweeperEnv struct {
+
+// archiveEnv bundles the pieces an archive test drives: a main
+// configuration database holding webhooks and targets, a delivery
+// engine owning the archive writer registry, the archive sweeper,
+// and the data directory the archive files live in.
+type archiveEnv struct {
 	sweeper *delivery.ArchiveSweeper
 	eng     *delivery.Engine
 	mainDB  *database.Database
 	dataDir string
 }
 
-func setupSweeperTest(t *testing.T) *sweeperEnv {
+func setupArchiveTest(t *testing.T) *archiveEnv {
 	t.Helper()
 
 	dataDir := t.TempDir()
@@ -78,7 +83,7 @@ func setupSweeperTest(t *testing.T) *sweeperEnv {
 		1,
 	)
 
-	return &sweeperEnv{
+	return &archiveEnv{
 		sweeper: delivery.NewTestArchiveSweeper(
 			mainDB, eng, log,
 		),
@@ -88,25 +93,27 @@ func setupSweeperTest(t *testing.T) *sweeperEnv {
 	}
 }
 
-// archivePath returns where the engine keeps a webhook's
+// archivePath returns where the engine keeps a database target's
-// archive file.
+// archive file, for the names seedDatabaseTarget gave it.
-func (env *sweeperEnv) archivePath(webhookID string) string {
+func (env *archiveEnv) archivePath(tgt *database.Target) string {
 	return filepath.Join(
-		env.dataDir, fmt.Sprintf("archive-%s.db", webhookID),
+		env.dataDir,
+		delivery.ArchiveFileName(
+			archiveTestWebhookName, tgt.Name, tgt.ID,
+		),
 	)
 }
 
 // seedDatabaseTarget creates a webhook with one database target
-// carrying the given target config JSON, and returns the
+// carrying the given target config JSON, and returns the target.
-// webhook id.
+func (env *archiveEnv) seedDatabaseTarget(
-func (env *sweeperEnv) seedDatabaseTarget(
 	t *testing.T, configJSON string,
-) string {
+) *database.Target {
 	t.Helper()
 
 	wh := &database.Webhook{
 		UserID: uuid.New().String(),
-		Name:   "sweep-test",
+		Name:   archiveTestWebhookName,
 	}
 	require.NoError(
 		t,
@@ -115,9 +122,19 @@ func (env *sweeperEnv) seedDatabaseTarget(
 			Create(wh).Error,
 	)
 
+	return env.addDatabaseTarget(t, wh.ID, configJSON)
+}
+
+// addDatabaseTarget creates one more database target on an
+// existing webhook and returns it.
+func (env *archiveEnv) addDatabaseTarget(
+	t *testing.T, webhookID, configJSON string,
+) *database.Target {
+	t.Helper()
+
 	tgt := &database.Target{
-		WebhookID: wh.ID,
+		WebhookID: webhookID,
-		Name:      "archive",
+		Name:      "Archive",
 		Type:      database.TargetTypeDatabase,
 		Active:    true,
 		Config:    configJSON,
@@ -129,19 +146,19 @@ func (env *sweeperEnv) seedDatabaseTarget(
 			Create(tgt).Error,
 	)
 
-	return wh.ID
+	return tgt
 }
 
-// seedArchiveRows creates the archive file for a webhook and
+// seedArchiveRows creates the archive file for a target and
 // inserts one row per supplied archived-at timestamp, returning
 // the archive path. The handle is closed before returning, so
 // the archive is idle exactly as it would be with no traffic.
-func (env *sweeperEnv) seedArchiveRows(
+func (env *archiveEnv) seedArchiveRows(
-	t *testing.T, webhookID string, archivedAt ...time.Time,
+	t *testing.T, tgt *database.Target, archivedAt ...time.Time,
 ) string {
 	t.Helper()
 
-	path := env.archivePath(webhookID)
+	path := env.archivePath(tgt)
 
 	sqlDB, err := sql.Open(
 		"sqlite", fmt.Sprintf("file:%s?mode=rwc", path),
@@ -160,7 +177,7 @@ func (env *sweeperEnv) seedArchiveRows(
 	for i, at := range archivedAt {
 		row := delivery.ExportArchivedEvent{
 			EventID:    fmt.Sprintf("ev-%d", i),
-			WebhookID:  webhookID,
+			WebhookID:  tgt.WebhookID,
 			Method:     http.MethodPost,
 			Body:       `{"seeded":true}`,
 			ArchivedAt: at,
@@ -243,13 +260,13 @@ func TestArchiveSweeper_LoopOutlivesStartHookContext(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 
 	now := time.Now()
 	path := env.seedArchiveRows(
-		t, webhookID,
+		t, tgt,
 		now.Add(-48*time.Hour),
 		now.Add(-time.Minute),
 	)
@@ -287,60 +304,60 @@ func TestArchiveSweeper_LoopOutlivesStartHookContext(
 }
 
 // TestArchiveSweep_DoesNotResurrectEvictedWriter covers the
-// interleaving where a sweep tick has already listed a webhook's
+// interleaving where a sweep tick has already listed a target
-// target when the webhook is deleted and its writer evicted. The
+// when the target is deleted and its writer evicted. The sweep
-// sweep must not put a writer back into the registry: nothing
+// must not put a writer back into the registry: nothing would
-// would ever evict it again, which is precisely the leak this
+// ever evict it again, which is precisely the leak this change
-// change exists to close.
+// exists to close.
 func TestArchiveSweep_DoesNotResurrectEvictedWriter(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	// Prime the registry the way a delivery would, then evict as
 	// the deletion path does. The target row is deliberately left
-	// in place: this is the tick that listed the webhook before
+	// in place: this is the tick that listed the target before
 	// the deletion committed.
-	_, err := env.eng.ExportEnsureArchiveWriter(webhookID)
+	_, err := env.eng.ExportEnsureArchiveWriter(tgt.ID)
 	require.NoError(t, err)
 
-	env.eng.EvictWebhook(webhookID)
+	env.eng.EvictTarget(tgt.ID)
-	require.False(t, env.eng.ExportHasArchiveWriter(webhookID))
+	require.False(t, env.eng.ExportHasArchiveWriter(tgt.ID))
 
 	env.sweeper.ExportSweep(context.Background())
 
 	assert.False(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
-		"a sweep must never re-register a writer for a webhook "+
+		"a sweep must never re-register a writer for a target "+
 			"whose registry entry has already been released",
 	)
 }
 
 // TestArchiveSweep_LeavesNoRegistryEntry states the same
 // invariant in its general form: sweeping an archive whose
-// webhook has no cached writer must not leave one behind, so the
+// target has no cached writer must not leave one behind, so the
 // registry keeps holding only writers a delivery created and an
 // eviction can reach.
 func TestArchiveSweep_LeavesNoRegistryEntry(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	path := env.seedArchiveRows(
-		t, webhookID,
+		t, tgt,
 		time.Now().Add(-48*time.Hour),
 		time.Now().Add(-time.Minute),
 	)
 
-	require.False(t, env.eng.ExportHasArchiveWriter(webhookID))
+	require.False(t, env.eng.ExportHasArchiveWriter(tgt.ID))
 
 	env.sweeper.ExportSweep(context.Background())
 
@@ -349,7 +366,7 @@ func TestArchiveSweep_LeavesNoRegistryEntry(t *testing.T) {
 		"the sweep must still prune an idle archive",
 	)
 	assert.False(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"the sweep must release the registry entry it created",
 	)
 }
@@ -364,34 +381,31 @@ func TestArchiveSweep_KeepsWriterAdoptedByDelivery(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"n":1}`)
-	event.WebhookID = webhookID
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, tgt)
-	d := seedDatabaseTargetDelivery(
-		t, webhookDB, event, `{"expiry":"1h"}`,
-	)
 
 	env.sweeper.ExportSweep(context.Background())
-	require.False(t, env.eng.ExportHasArchiveWriter(webhookID))
+	require.False(t, env.eng.ExportHasArchiveWriter(tgt.ID))
 
 	env.eng.ExportDeliverDatabase(webhookDB, d)
 
 	assert.True(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"a delivery's writer must stay registered",
 	)
 
 	env.sweeper.ExportSweep(context.Background())
 
 	assert.True(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"a sweep must not drop a writer a delivery owns",
 	)
 }
@@ -423,15 +437,15 @@ func TestArchiveSweep_KeepsWriterAdoptedDuringSweep(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	sweepWriter, created, err := env.eng.ExportSweepWriterFor(
-		webhookID,
+		tgt.ID,
 	)
 	require.NoError(t, err)
 	require.True(
@@ -442,37 +456,34 @@ func TestArchiveSweep_KeepsWriterAdoptedDuringSweep(
 	// The delivery lands mid-sweep and adopts the entry.
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"n":1}`)
-	event.WebhookID = webhookID
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, tgt)
-	d := seedDatabaseTargetDelivery(
-		t, webhookDB, event, `{"expiry":"1h"}`,
-	)
 
 	env.eng.ExportDeliverDatabase(webhookDB, d)
 
-	adopted := env.eng.ExportArchiveWriterFor(webhookID)
+	adopted := env.eng.ExportArchiveWriterFor(tgt.ID)
 	require.NotNil(t, adopted)
 	require.True(
 		t, sweepWriter.Same(adopted),
 		"the delivery must have adopted the sweep's writer",
 	)
 	require.True(
-		t, env.eng.ExportArchiveHandleOpen(webhookID),
+		t, env.eng.ExportArchiveHandleOpen(tgt.ID),
 		"the delivery leaves the archive handle open",
 	)
 
 	// The sweep finishes.
-	env.eng.ExportReleaseSweepWriter(webhookID, sweepWriter)
+	env.eng.ExportReleaseSweepWriter(tgt.ID, sweepWriter)
 
 	require.True(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"a writer adopted by a delivery during a sweep must "+
 			"stay registered, or its open handle is unreachable",
 	)
 
-	env.eng.EvictWebhook(webhookID)
+	env.eng.EvictTarget(tgt.ID)
 
 	assert.False(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"the adopted writer must still be evictable",
 	)
 	assert.False(
@@ -481,34 +492,34 @@ func TestArchiveSweep_KeepsWriterAdoptedDuringSweep(
 	)
 }
 
-// TestArchiveSweep_ContinuesAfterPerWebhookFailure proves a
+// TestArchiveSweep_ContinuesAfterPerTargetFailure proves a
-// failure for one webhook does not abort the sweep for the
+// failure for one target does not abort the sweep for the
 // others: an unparseable expiry and an unreadable archive both
 // have to be logged and stepped over.
-func TestArchiveSweep_ContinuesAfterPerWebhookFailure(
+func TestArchiveSweep_ContinuesAfterPerTargetFailure(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
 	// Seeded first so the sweep reaches them before the healthy
-	// webhook: targets come back in insertion order.
+	// target: targets come back in insertion order.
-	badConfigID := env.seedDatabaseTarget(t, `{"expiry":"!!!"}`)
+	badConfig := env.seedDatabaseTarget(t, `{"expiry":"!!!"}`)
 	env.seedArchiveRows(
-		t, badConfigID, time.Now().Add(-48*time.Hour),
+		t, badConfig, time.Now().Add(-48*time.Hour),
 	)
 
-	corruptID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	corrupt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	require.NoError(t, os.WriteFile(
-		env.archivePath(corruptID),
+		env.archivePath(corrupt),
 		[]byte("this is not a sqlite database"),
 		0o600,
 	))
 
-	healthyID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	healthy := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	healthyPath := env.seedArchiveRows(
-		t, healthyID,
+		t, healthy,
 		time.Now().Add(-48*time.Hour),
 		time.Now().Add(-time.Minute),
 	)
@@ -518,14 +529,14 @@ func TestArchiveSweep_ContinuesAfterPerWebhookFailure(
 	assert.Equal(
 		t, []string{sweepRowNew},
 		archivedEventIDs(t, healthyPath),
-		"a failure for an earlier webhook must not stop the "+
+		"a failure for an earlier target must not stop the "+
 			"sweep from pruning the ones after it",
 	)
 }
 
 // TestArchiveSweep_OpenExistingDoesNotCreateFile pins the second
 // of the two no-create guards. The first is the stat in
-// sweepWebhook; this one is the SQLite open mode, which is what
+// sweepExpired; this one is the SQLite open mode, which is what
 // protects the window between that stat and the open. Flipping
 // the sweep's mode to create-if-missing makes this fail.
 func TestArchiveSweep_OpenExistingDoesNotCreateFile(
@@ -561,13 +572,13 @@ func TestArchiveSweep_OpenExistingDoesNotCreateFile(
 func TestArchiveSweep_PrunesIdleArchive(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 
 	now := time.Now()
 	path := env.seedArchiveRows(
-		t, webhookID,
+		t, tgt,
 		now.Add(-48*time.Hour),
 		now.Add(-time.Minute),
 	)
@@ -600,11 +611,11 @@ func TestArchiveSweep_PrunesIdleArchive(t *testing.T) {
 func TestArchiveSweep_LeavesArchiveClosed(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	path := env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	w := delivery.NewExportArchiveWriter(
@@ -640,35 +651,32 @@ func TestArchiveSweep_ClosesHandleOfRegisteredWriter(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"n":1}`)
-	event.WebhookID = webhookID
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, tgt)
-	d := seedDatabaseTargetDelivery(
-		t, webhookDB, event, `{"expiry":"1h"}`,
-	)
 
 	env.eng.ExportDeliverDatabase(webhookDB, d)
 
 	require.True(
-		t, env.eng.ExportArchiveHandleOpen(webhookID),
+		t, env.eng.ExportArchiveHandleOpen(tgt.ID),
 		"the delivery must leave the archive handle open",
 	)
 
 	env.sweeper.ExportSweep(context.Background())
 
 	require.True(
-		t, env.eng.ExportHasArchiveWriter(webhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"the delivery's registry entry must survive the sweep",
 	)
 	assert.False(
-		t, env.eng.ExportArchiveHandleOpen(webhookID),
+		t, env.eng.ExportArchiveHandleOpen(tgt.ID),
 		"the sweep must leave the archive closed",
 	)
 }
@@ -684,11 +692,11 @@ func TestArchiveSweep_NeverExpiryUntouched(t *testing.T) {
 		`{"expiry":""}`,
 		"",
 	} {
-		env := setupSweeperTest(t)
+		env := setupArchiveTest(t)
 
-		webhookID := env.seedDatabaseTarget(t, configJSON)
+		tgt := env.seedDatabaseTarget(t, configJSON)
 		path := env.seedArchiveRows(
-			t, webhookID,
+			t, tgt,
 			time.Now().Add(-10000*time.Hour),
 		)
 
@@ -699,7 +707,7 @@ func TestArchiveSweep_NeverExpiryUntouched(t *testing.T) {
 			"config %q must keep rows forever", configJSON,
 		)
 		assert.False(
-			t, env.eng.ExportHasArchiveWriter(webhookID),
+			t, env.eng.ExportHasArchiveWriter(tgt.ID),
 			"config %q must leave no registry entry behind",
 			configJSON,
 		)
@@ -722,10 +730,10 @@ func TestArchiveSweep_NeverExpirySkipsBeforeOpening(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"never"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"never"}`)
-	path := env.archivePath(webhookID)
+	path := env.archivePath(tgt)
 
 	seedUnmigratedArchive(t, path)
 	require.False(t, archiveTableExists(t, path))
@@ -768,16 +776,16 @@ func archiveTableExists(t *testing.T, path string) bool {
 }
 
 // TestArchiveSweep_DoesNotCreateArchiveFile proves the sweep
-// never conjures an archive: a webhook with a database target
+// never conjures an archive: a database target that has never
-// that has never received an event must still have no archive
+// received an event must still have no archive file (nor SQLite
-// file (nor SQLite sidecar) after a sweep.
+// sidecar) after a sweep, and no registry entry either.
 func TestArchiveSweep_DoesNotCreateArchiveFile(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
-	path := env.archivePath(webhookID)
+	path := env.archivePath(tgt)
 
 	require.NoFileExists(t, path)
 
@@ -789,6 +797,11 @@ func TestArchiveSweep_DoesNotCreateArchiveFile(t *testing.T) {
 			"the sweep must not create an archive file",
 		)
 	}
+
+	assert.False(
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
+		"the sweep must leave no registry entry behind",
+	)
 }
 
 // TestArchiveSweep_DoesNotCreateAfterWriterExists covers the
@@ -800,11 +813,11 @@ func TestArchiveSweep_DoesNotCreateAfterWriterExists(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 
-	path, err := env.eng.ExportEnsureArchiveWriter(webhookID)
+	path, err := env.eng.ExportEnsureArchiveWriter(tgt.ID)
 	require.NoError(t, err)
 	require.NoFileExists(t, path)
 
@@ -819,17 +832,17 @@ func TestArchiveSweep_DoesNotCreateAfterWriterExists(
 func TestArchiveSweep_SkipsDeletedWebhookTargets(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	path := env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	require.NoError(
 		t,
 		env.mainDB.DB().
-			Where("webhook_id = ?", webhookID).
+			Where("webhook_id = ?", tgt.WebhookID).
 			Delete(&database.Target{}).Error,
 	)
 
@@ -842,14 +855,14 @@ func TestArchiveSweep_SkipsDeletedWebhookTargets(t *testing.T) {
 }
 
 // TestArchiveSweep_ConcurrentWrites proves the sweep serialises
-// against writes through the per-webhook writer mutex. Run
+// against writes through the target's writer mutex. Run under
-// under -race, an unsynchronised sweep would be caught here.
+// -race, an unsynchronised sweep would be caught here.
 func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 
 	webhookDB := testWebhookDB(t)
 
@@ -862,13 +875,10 @@ func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
 
 	for range sweepConcurrentWrites {
 		event := seedEvent(t, webhookDB, `{"n":1}`)
-		event.WebhookID = webhookID
 
 		deliveries = append(
 			deliveries,
-			seedDatabaseTargetDelivery(
+			seedDatabaseTargetDelivery(t, webhookDB, event, tgt),
-				t, webhookDB, event, `{"expiry":"1h"}`,
-			),
 		)
 	}
 
@@ -894,7 +904,7 @@ func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
 
 	wg.Wait()
 
-	assert.FileExists(t, env.archivePath(webhookID))
+	assert.FileExists(t, env.archivePath(tgt))
 }
 
 // TestArchiveSweeper_StopsCleanly proves the background loop
@@ -902,11 +912,11 @@ func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
 func TestArchiveSweeper_StopsCleanly(t *testing.T) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
-	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
 	env.seedArchiveRows(
-		t, webhookID, time.Now().Add(-48*time.Hour),
+		t, tgt, time.Now().Add(-48*time.Hour),
 	)
 
 	env.sweeper.ExportSetInterval(time.Millisecond)
@@ -930,7 +940,7 @@ func TestArchiveSweeper_StopHookHonoursStopTimeout(
 ) {
 	t.Parallel()
 
-	env := setupSweeperTest(t)
+	env := setupArchiveTest(t)
 
 	lc := &recordingLifecycle{}
 	env.sweeper.ExportRegisterHooks(lc)

internal/delivery/delivery_totals_test.go

@@ -0,0 +1,177 @@
+package delivery_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// targetTotals reads one target's totals from a webhook database, all
+// zero when it has no row.
+func targetTotals(
+	t *testing.T, db *gorm.DB, targetID string,
+) database.TargetTotals {
+	t.Helper()
+
+	var rows []database.TargetTotals
+
+	require.NoError(t, db.Where("target_id = ?", targetID).
+		Find(&rows).Error)
+
+	if len(rows) == 0 {
+		return database.TargetTotals{TargetID: targetID}
+	}
+
+	return rows[0]
+}
+
+// TestUpdateDeliveryStatus_FinishTimeAndTargetTotals pins what a status
+// write records for the webhook page's statistics: the time a delivery
+// finished, set only when it becomes delivered or failed, and one more
+// on its target's delivered or failed total.
+func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		status    database.DeliveryStatus
+		finished  bool
+		delivered int64
+		failed    int64
+	}{
+		{database.DeliveryStatusRetrying, false, 0, 0},
+		{database.DeliveryStatusDelivered, true, 1, 0},
+		{database.DeliveryStatusFailed, true, 0, 1},
+	}
+
+	for _, tt := range tests {
+		t.Run(string(tt.status), func(t *testing.T) {
+			t.Parallel()
+
+			db := testWebhookDB(t)
+			e := testEngine(t, 1)
+			event := seedEvent(t, db, `{}`)
+			targetID := uuid.New().String()
+			d := seedDelivery(
+				t, db, event.ID, targetID,
+				database.DeliveryStatusPending,
+			)
+
+			before := time.Now()
+
+			require.NoError(t, e.ExportUpdateDeliveryStatus(
+				db, &d, tt.status,
+			))
+
+			var stored database.Delivery
+
+			require.NoError(t, db.First(&stored, "id = ?", d.ID).Error)
+			assert.Equal(t, tt.status, stored.Status)
+
+			if tt.finished {
+				require.NotNil(t, stored.FinishedAt)
+				assert.False(t, stored.FinishedAt.Before(before))
+			} else {
+				assert.Nil(t, stored.FinishedAt)
+			}
+
+			assert.Equal(t, database.TargetTotals{
+				TargetID:  targetID,
+				Delivered: tt.delivered,
+				Failed:    tt.failed,
+			}, targetTotals(t, db, targetID))
+		})
+	}
+}
+
+// TestUpdateDeliveryStatus_DeletedDeliveryIsNotCounted covers a
+// delivery retention deleted while the engine still held it. Failing
+// it afterwards writes no row, so it adds no failure either: retention
+// has already counted what it removed.
+func TestUpdateDeliveryStatus_DeletedDeliveryIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	db := testWebhookDB(t)
+	e := testEngine(t, 1)
+	event := seedEvent(t, db, `{}`)
+	targetID := uuid.New().String()
+	d := seedDelivery(
+		t, db, event.ID, targetID,
+		database.DeliveryStatusRetrying,
+	)
+
+	require.NoError(t, db.Unscoped().
+		Delete(&database.Delivery{}, "id = ?", d.ID).Error)
+
+	require.NoError(t, e.ExportUpdateDeliveryStatus(
+		db, &d, database.DeliveryStatusFailed,
+	))
+
+	assert.Equal(t, database.TargetTotals{TargetID: targetID},
+		targetTotals(t, db, targetID))
+}
+
+// TestUpdateDeliveryStatus_FinishedDeliveryIsNotSettledAgain covers a
+// delivery settled a second time, as recovery can do when a worker has
+// settled it since recovery read it. Neither status writes over the
+// first, and the totals do not move.
+func TestUpdateDeliveryStatus_FinishedDeliveryIsNotSettledAgain(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	finished := []database.DeliveryStatus{
+		database.DeliveryStatusDelivered,
+		database.DeliveryStatusFailed,
+	}
+
+	for _, first := range finished {
+		t.Run(string(first), func(t *testing.T) {
+			t.Parallel()
+
+			db := testWebhookDB(t)
+			e := testEngine(t, 1)
+			event := seedEvent(t, db, `{}`)
+			targetID := uuid.New().String()
+			d := seedDelivery(
+				t, db, event.ID, targetID,
+				database.DeliveryStatusRetrying,
+			)
+
+			// The delivery as recovery read it, before the worker
+			// settled it.
+			readBefore := d
+
+			require.NoError(t, e.ExportUpdateDeliveryStatus(
+				db, &d, first,
+			))
+
+			var settled database.Delivery
+
+			require.NoError(t, db.First(&settled, "id = ?", d.ID).Error)
+			require.NotNil(t, settled.FinishedAt)
+
+			totals := targetTotals(t, db, targetID)
+
+			for _, again := range finished {
+				stale := readBefore
+
+				require.NoError(t, e.ExportUpdateDeliveryStatus(
+					db, &stale, again,
+				))
+			}
+
+			var stored database.Delivery
+
+			require.NoError(t, db.First(&stored, "id = ?", d.ID).Error)
+			assert.Equal(t, first, stored.Status)
+			require.NotNil(t, stored.FinishedAt)
+			assert.True(t, settled.FinishedAt.Equal(*stored.FinishedAt))
+			assert.Equal(t, totals, targetTotals(t, db, targetID))
+		})
+	}
+}

internal/delivery/engine.go

@@ -14,6 +14,7 @@ import (
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/lifecycle"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/metrics"
@@ -122,21 +123,24 @@ type Notifier interface {
 	Notify(tasks []Task)
 }
 
-// WebhookEvictor releases the delivery engine's per-webhook
+// Archives is how the handlers keep the database targets' archive
-// state for a webhook that no longer needs it — currently the
+// files in step with the configuration. Deleting a webhook or a
-// cached archive writer of the database target, whose open
+// target releases the cached archive writers, whose open file
-// file handle would otherwise outlive the webhook.
+// handles would otherwise outlive them; renaming one renames the
+// archive files, which are named for the webhook and the target
+// (see ArchiveFileName).
 //
-// It is deliberately separate from Notifier and deliberately
+// It is deliberately separate from Notifier: archiving lifecycle
-// one method wide: archiving lifecycle is not notification, and
+// is not notification, and a small interface keeps the handlers
-// a single-method interface keeps the handlers package free of
+// package free of any dependency on the engine's internals while
-// any dependency on the engine's internals while staying
+// staying trivially fakeable in tests.
-// trivially fakeable in tests.
 //
-// EvictWebhook never deletes an archive file. It is idempotent
+// Neither eviction deletes an archive file. Both are idempotent
-// and is a no-op for a webhook with no engine state.
+// and are no-ops for a webhook or target with no engine state.
-type WebhookEvictor interface {
+type Archives interface {
 	EvictWebhook(webhookID string)
+	EvictTarget(targetID string)
+	Rename(targetID, webhookName, targetName string) error
 }
 
 // EngineParams are the fx dependencies for the delivery
@@ -146,8 +150,10 @@ type EngineParams struct {
 
 	DB        *database.Database
 	DBManager *database.WebhookDBManager
+	Globals   *globals.Globals
 	Logger    *logger.Logger
 	SSRFGuard *Guard
+	Metrics   *metrics.Set
 }
 
 // Engine processes queued deliveries in the background
@@ -167,10 +173,14 @@ type Engine struct {
 	retryCh    chan Task
 	workers    int
 
-	// mtr is the delivery metric set. Production wires the
+	// version is the running build's version, the one the web UI
-	// process-wide one; a test can substitute a set registered on
+	// footer shows. userAgent puts it on every outbound request.
-	// a private registry so its assertions are not disturbed by
+	version string
-	// deliveries other tests are making at the same time.
+
+	// mtr is the delivery metric set. Production wires the one
+	// registered on the registry /metrics serves; a test can
+	// substitute a set registered on a registry it holds, so it can
+	// gather what its own deliveries recorded.
 	mtr *metrics.Set
 
 	// targets maps each target type to its implementation.
@@ -181,7 +191,7 @@ type Engine struct {
 	httpTarget *httpTarget
 
 	// dbTarget is retained so the engine can reach the archive
-	// writer registry for webhook eviction and the idle sweep.
+	// writer registry for eviction, renames and the idle sweep.
 	dbTarget *databaseTarget
 
 	// inflight is the set of deliveries this engine currently owns.
@@ -204,7 +214,8 @@ func New(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    defaultWorkers,
-		mtr:        metrics.Default(),
+		version:    params.Globals.Version,
+		mtr:        params.Metrics,
 	}
 
 	e.initTargets(&http.Client{
@@ -249,17 +260,44 @@ func (e *Engine) Notify(tasks []Task) {
 	}
 }
 
-// EvictWebhook implements WebhookEvictor. It releases the
+// EvictWebhook implements Archives. The cached archive writer of
-// engine's per-webhook archiving state: the database target's
+// every database target of the webhook is dropped from the
-// cached archive writer is dropped from the registry and its
+// registry and its file handle closed. The archive files
-// file handle closed. The archive file itself is left on disk
+// themselves are left on disk — they are long-term storage the
-// — it is long-term storage the operator owns.
+// operator owns.
 func (e *Engine) EvictWebhook(webhookID string) {
 	if e.dbTarget == nil {
 		return
 	}
 
-	e.dbTarget.evict(webhookID)
+	e.dbTarget.evictWebhook(webhookID)
+}
+
+// EvictTarget implements Archives. It is EvictWebhook for a single
+// database target, and leaves the archive file on disk the same
+// way.
+func (e *Engine) EvictTarget(targetID string) {
+	if e.dbTarget == nil {
+		return
+	}
+
+	e.dbTarget.evict(targetID)
+}
+
+// Rename implements Archives. It renames a database target's
+// archive file to ArchiveFileName(webhookName, targetName,
+// targetID), under the lock the target's archive writes and the
+// idle sweep take. It never replaces a file: if one already has the
+// new name, the error is ErrArchiveNameTaken. The caller renames
+// before it saves the new name: see databaseTarget.rename.
+func (e *Engine) Rename(
+	targetID, webhookName, targetName string,
+) error {
+	if e.dbTarget == nil {
+		return nil
+	}
+
+	return e.dbTarget.rename(targetID, webhookName, targetName)
 }
 
 // ScheduleRetry schedules a task to be re-enqueued onto the
@@ -300,6 +338,13 @@ func (e *Engine) ScheduleRetry(
 	})
 }
 
+// userAgent is the User-Agent header of every http and slack
+// delivery request: the program name and the running build's
+// version.
+func (e *Engine) userAgent() string {
+	return "webhooker/" + e.version
+}
+
 // registerHooks wires the engine's start and stop into the fx
 // lifecycle. The start hook's context is deliberately ignored
 // (see start for why the worker pool must not inherit it); the
@@ -366,7 +411,8 @@ func (e *Engine) start() {
 // Once the pool has drained it closes the archive writers, so a
 // clean stop leaves no archive -wal behind. Nothing else holds a
 // writer for long by then: the archive sweeper stops before the
-// engine, and deleting a webhook only closes one. If the pool did
+// engine, and deleting or renaming a webhook or target only closes
+// or moves one. If the pool did
 // not drain in time, the writers are left open, as a kill would
 // leave them. Closing them would wait for any write in progress,
 // and a worker still running would then open new writers that
@@ -531,6 +577,11 @@ func (e *Engine) processRetryTask(
 		return
 	}
 
+	// Set before anything below can fail the delivery: the failure is
+	// added to this target's totals.
+	d.EventID = task.EventID
+	d.TargetID = task.TargetID
+
 	if d.Status != database.DeliveryStatusRetrying {
 		e.log.Debug(
 			"skipping retry for delivery "+
@@ -562,8 +613,6 @@ func (e *Engine) processRetryTask(
 	}
 
 	target := buildTargetFromTask(task)
-	d.EventID = task.EventID
-	d.TargetID = task.TargetID
 	d.Event = event
 	d.Target = target
 
@@ -1554,8 +1603,9 @@ func (e *Engine) updateDeliveryStatus(
 	targetType database.TargetType,
 	status database.DeliveryStatus,
 ) error {
-	err := webhookDB.Model(d).
+	err := webhookDB.Transaction(func(tx *gorm.DB) error {
-		Update("status", status).Error
+		return writeDeliveryStatus(tx, d, status)
+	})
 	if err != nil {
 		return fmt.Errorf(
 			"updating delivery %s to status %s: %w",
@@ -1574,6 +1624,43 @@ func (e *Engine) updateDeliveryStatus(
 	return nil
 }
 
+// writeDeliveryStatus writes a delivery's new status. A delivery that
+// becomes delivered or failed also gets the time it finished, and is
+// added to its target's delivered or failed total. That write changes
+// only a delivery not yet delivered or failed, and the total moves
+// only when it changed a row: retention may have deleted the delivery
+// while the engine was working on it, and a recovery path may settle
+// a delivery that a worker has already settled.
+func writeDeliveryStatus(
+	tx *gorm.DB,
+	d *database.Delivery,
+	status database.DeliveryStatus,
+) error {
+	if !status.Terminal() {
+		return tx.Model(d).Update("status", status).Error
+	}
+
+	res := tx.Model(d).
+		Where("status NOT IN ?", []database.DeliveryStatus{
+			database.DeliveryStatusDelivered,
+			database.DeliveryStatusFailed,
+		}).
+		Updates(map[string]any{
+			"status":      status,
+			"finished_at": time.Now(),
+		})
+	if res.Error != nil || res.RowsAffected == 0 {
+		return res.Error
+	}
+
+	add := database.TargetTotals{TargetID: d.TargetID, Delivered: 1}
+	if status == database.DeliveryStatusFailed {
+		add = database.TargetTotals{TargetID: d.TargetID, Failed: 1}
+	}
+
+	return database.AddTargetTotals(tx, add)
+}
+
 // settleStatus moves a delivery to its outcome status and reports a
 // failed write through bookkeepingFailed, which leaves the row
 // recoverable. It exists so the target call sites read as one

internal/delivery/engine_lifecycle_test.go

@@ -2,7 +2,6 @@ package delivery_test
 
 import (
 	"context"
-	"fmt"
 	"path/filepath"
 	"testing"
 	"time"
@@ -10,6 +9,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
+	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
@@ -272,22 +272,35 @@ func TestEngine_StopHookHonoursStopTimeout(t *testing.T) {
 	requireStopHookExpires(t, lc.hooks[0], "delivery engine")
 }
 
-// deliverToArchive runs one delivery to a database target through
+// deliverToArchive gives the setup's webhook a database target,
-// the running engine and returns the webhook's archive file path.
+// runs one delivery to it through the running engine, and returns
-// The archive writer holds the file open afterwards.
+// the target's ID and archive file path. The archive writer holds
-func deliverToArchive(t *testing.T, s iSetup) string {
+// the file open afterwards.
+func deliverToArchive(t *testing.T, s iSetup) (string, string) {
 	t.Helper()
 
+	iCreateWebhook(t, s.MainDB, s.WebhookID, "hook")
+
+	tgt := &database.Target{
+		WebhookID: s.WebhookID,
+		Name:      "archive",
+		Type:      database.TargetTypeDatabase,
+	}
+	require.NoError(
+		t, s.MainDB.Omit(clause.Associations).Create(tgt).Error,
+	)
+
 	deliveryID, task := seedLogTask(t, s)
+	task.TargetID = tgt.ID
 	task.TargetType = database.TargetTypeDatabase
 
 	s.Engine.Notify([]delivery.Task{task})
 
 	iWaitForDelivered(t, s.WebhookDB, deliveryID)
 
-	return filepath.Join(
+	return tgt.ID, filepath.Join(
 		filepath.Dir(s.DBMgr.DBPath(s.WebhookID)),
-		fmt.Sprintf("archive-%s.db", s.WebhookID),
+		"archive-hook-archive-"+tgt.ID+".db",
 	)
 }
 
@@ -304,7 +317,7 @@ func TestEngine_StopHookClosesArchives(t *testing.T) {
 
 	lc := startEngineViaHook(t, s.Engine)
 
-	path := deliverToArchive(t, s)
+	_, path := deliverToArchive(t, s)
 	require.FileExists(
 		t, path+"-wal",
 		"an open archive should have a -wal for the stop to remove",
@@ -338,7 +351,7 @@ func TestEngine_StopHookTimeoutLeavesArchivesOpen(t *testing.T) {
 
 	lc := startEngineViaHook(t, s.Engine)
 
-	deliverToArchive(t, s)
+	targetID, _ := deliverToArchive(t, s)
 
 	release := make(chan struct{})
 
@@ -352,7 +365,7 @@ func TestEngine_StopHookTimeoutLeavesArchivesOpen(t *testing.T) {
 	requireStopHookExpires(t, lc.hooks[0], "delivery engine")
 
 	require.True(
-		t, s.Engine.ExportArchiveHandleOpen(s.WebhookID),
+		t, s.Engine.ExportArchiveHandleOpen(targetID),
 		"a stop that timed out must not close archive writers",
 	)
 }

internal/delivery/engine_test.go

@@ -57,7 +57,10 @@ func testWebhookDB(t *testing.T) *gorm.DB {
 		&database.Event{},
 		&database.Delivery{},
 		&database.DeliveryResult{},
+		&database.EventTotals{},
+		&database.TargetTotals{},
 	))
+	require.NoError(t, db.Create(&database.EventTotals{}).Error)
 
 	return db
 }
@@ -348,23 +351,15 @@ func TestDeliverDatabase_ImmediateSuccess(
 
 	db := testWebhookDB(t)
 
-	// The database target archives for real now, so the engine
+	// The database target archives for real, so the engine needs
-	// needs a webhook DB manager to locate the data directory.
+	// the target in the main database and a data directory.
-	e := delivery.NewTestEngineWithDB(
+	env := setupArchiveTest(t)
-		nil,
+	tgt := env.seedDatabaseTarget(t, "")
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	event := seedEvent(t, db, `{"db":"target"}`)
-	d := seedDatabaseTargetDelivery(t, db, event, "")
+	d := seedDatabaseTargetDelivery(t, db, event, tgt)
 
-	e.ExportDeliverDatabase(db, d)
+	env.eng.ExportDeliverDatabase(db, d)
 
 	var updated database.Delivery
 
@@ -1244,11 +1239,6 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 		testContentType,
 		receivedHeaders.Get("Content-Type"),
 	)
-
-	assert.Equal(t,
-		"webhooker/1.0",
-		receivedHeaders.Get("User-Agent"),
-	)
 }
 
 // The event's stored inbound headers carry the same Content-Type the
@@ -1317,6 +1307,7 @@ func TestApplyRequestHeaders_SendsOneContentType(t *testing.T) {
 					ContentType: tc.event,
 				},
 				cfg,
+				"webhooker/dev",
 			)
 
 			assert.Equal(t,
@@ -1333,32 +1324,27 @@ func TestProcessDelivery_RoutesToCorrectHandler(
 
 	db := testWebhookDB(t)
 
-	// The database target archives for real now, so the engine
+	// The database target archives for real, so the engine needs
-	// needs a webhook DB manager to locate the data directory.
+	// the target in the main database and a data directory.
-	e := delivery.NewTestEngineWithDB(
+	env := setupArchiveTest(t)
-		nil,
+	archive := env.seedDatabaseTarget(t, "")
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	tests := []struct {
 		name       string
 		targetType database.TargetType
+		targetID   string
 		wantStatus database.DeliveryStatus
 	}{
 		{
 			"database target",
 			database.TargetTypeDatabase,
+			archive.ID,
 			database.DeliveryStatusDelivered,
 		},
 		{
 			"log target",
 			database.TargetTypeLog,
+			uuid.New().String(),
 			database.DeliveryStatusDelivered,
 		},
 	}
@@ -1368,7 +1354,7 @@ func TestProcessDelivery_RoutesToCorrectHandler(
 			t.Parallel()
 
 			runRoutingSubtest(
-				t, db, e, tt.targetType,
+				t, db, env.eng, tt.targetType, tt.targetID,
 				tt.wantStatus,
 			)
 		})
@@ -1380,6 +1366,7 @@ func runRoutingSubtest(
 	db *gorm.DB,
 	e *delivery.Engine,
 	targetType database.TargetType,
+	targetID string,
 	wantStatus database.DeliveryStatus,
 ) {
 	t.Helper()
@@ -1387,8 +1374,7 @@ func runRoutingSubtest(
 	event := seedEvent(t, db, `{"routing":"test"}`)
 
 	dlv := seedDelivery(
-		t, db, event.ID,
+		t, db, event.ID, targetID,
-		uuid.New().String(),
 		database.DeliveryStatusPending,
 	)
 

internal/delivery/export_test.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -40,11 +41,6 @@ const (
 	ExportPendingSweepMinAge = pendingSweepMinAge
 )
 
-// ExportIsBlockedIP exposes isBlockedIP for testing.
-func ExportIsBlockedIP(ip net.IP) bool {
-	return isBlockedIP(ip)
-}
-
 // NewTestGuard builds an SSRF Guard from an explicit egress
 // allowlist, without going through config. Passing no prefixes
 // yields the default guard, which blocks every private/reserved
@@ -70,6 +66,11 @@ func ExportBlockedNetworks() []*net.IPNet {
 	return blockedNetworks
 }
 
+// ExportBlockedPublicNetworks exposes blockedPublicNetworks.
+func ExportBlockedPublicNetworks() []*net.IPNet {
+	return blockedPublicNetworks
+}
+
 // ExportIsForwardableHeader exposes isForwardableHeader.
 func ExportIsForwardableHeader(name string) bool {
 	return isForwardableHeader(name)
@@ -82,8 +83,9 @@ func ExportApplyRequestHeaders(
 	req *http.Request,
 	event *database.Event,
 	cfg *HTTPTargetConfig,
+	userAgent string,
 ) []string {
-	return applyRequestHeaders(req, event, cfg)
+	return applyRequestHeaders(req, event, cfg, userAgent)
 }
 
 // ExportTruncate exposes truncate for testing.
@@ -150,6 +152,16 @@ func (e *Engine) ExportDeliverSlack(
 	)
 }
 
+// ExportUpdateDeliveryStatus exposes updateDeliveryStatus. It passes no
+// target type, so no metric moves.
+func (e *Engine) ExportUpdateDeliveryStatus(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	status database.DeliveryStatus,
+) error {
+	return e.updateDeliveryStatus(webhookDB, d, "", status)
+}
+
 // ExportProcessNewTask exposes processNewTask.
 func (e *Engine) ExportProcessNewTask(
 	ctx context.Context, task *Task,
@@ -389,7 +401,7 @@ func NewTestEngine(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -404,7 +416,7 @@ func NewTestEngineSmallRetry(
 	e := &Engine{
 		log:     log,
 		retryCh: make(chan Task, 1),
-		mtr:     metrics.Default(),
+		mtr:     metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(nil)
 
@@ -427,7 +439,7 @@ func NewTestEngineWithDB(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -435,8 +447,7 @@ func NewTestEngineWithDB(
 }
 
 // ExportSetMetrics substitutes the engine's metric set, so a test can
-// assert on collectors registered on a private registry instead of
+// assert on collectors registered on a registry it holds.
-// the process-wide ones every other test is also moving.
 func (e *Engine) ExportSetMetrics(mtr *metrics.Set) {
 	e.mtr = mtr
 }
@@ -463,7 +474,7 @@ func NewTestCircuitBreaker(
 type ExportArchivedEvent = archivedEvent
 
 // ExportArchiveWriter wraps an archiveWriter so black-box tests
-// can exercise the per-webhook archive file mechanics.
+// can exercise the archive file mechanics.
 type ExportArchiveWriter struct {
 	w *archiveWriter
 }
@@ -538,6 +549,12 @@ func (e *ExportArchiveWriter) Evict() {
 	e.w.evict()
 }
 
+// Rename gives the archive file a new name in the same directory,
+// as a rename of the webhook or target does.
+func (e *ExportArchiveWriter) Rename(name string) error {
+	return e.w.rename(name)
+}
+
 // HandleOpen reports whether the writer currently holds an open
 // archive handle.
 func (e *ExportArchiveWriter) HandleOpen() bool {
@@ -557,16 +574,16 @@ func (e *ExportArchiveWriter) Same(
 }
 
 // ExportArchiveWriterFor returns the archive writer the registry
-// currently caches for a webhook, or nil when none is cached. It
+// currently caches for a database target, or nil when none is
-// never creates one, so a test can hold a reference to the very
+// cached. It never creates one, so a test can hold a reference to
-// writer an eviction is about to detach.
+// the very writer an eviction is about to detach.
 func (e *Engine) ExportArchiveWriterFor(
-	webhookID string,
+	targetID string,
 ) *ExportArchiveWriter {
 	e.dbTarget.mu.Lock()
 	defer e.dbTarget.mu.Unlock()
 
-	w, ok := e.dbTarget.writers[webhookID]
+	w, ok := e.dbTarget.writers[targetID]
 	if !ok {
 		return nil
 	}
@@ -575,26 +592,26 @@ func (e *Engine) ExportArchiveWriterFor(
 }
 
 // ExportHasArchiveWriter reports whether the database target
-// currently caches an archive writer for a webhook.
+// type currently caches an archive writer for a target.
 func (e *Engine) ExportHasArchiveWriter(
-	webhookID string,
+	targetID string,
 ) bool {
 	e.dbTarget.mu.Lock()
 	defer e.dbTarget.mu.Unlock()
 
-	_, ok := e.dbTarget.writers[webhookID]
+	_, ok := e.dbTarget.writers[targetID]
 
 	return ok
 }
 
 // ExportArchiveHandleOpen reports whether the cached archive
-// writer for a webhook holds an open database handle. It
+// writer for a target holds an open database handle. It
 // returns false when no writer is cached.
 func (e *Engine) ExportArchiveHandleOpen(
-	webhookID string,
+	targetID string,
 ) bool {
 	e.dbTarget.mu.Lock()
-	w, ok := e.dbTarget.writers[webhookID]
+	w, ok := e.dbTarget.writers[targetID]
 	e.dbTarget.mu.Unlock()
 
 	if !ok {
@@ -608,12 +625,12 @@ func (e *Engine) ExportArchiveHandleOpen(
 }
 
 // ExportEnsureArchiveWriter creates (if needed) and returns the
-// archive file path of the cached writer for a webhook, so a
+// archive file path of the cached writer for a target, so a
 // test can prime the registry the way a delivery would.
 func (e *Engine) ExportEnsureArchiveWriter(
-	webhookID string,
+	targetID string,
 ) (string, error) {
-	w, err := e.dbTarget.writerFor(webhookID)
+	w, err := e.dbTarget.writerFor(targetID)
 	if err != nil {
 		return "", err
 	}
@@ -621,14 +638,14 @@ func (e *Engine) ExportEnsureArchiveWriter(
 	return w.path, nil
 }
 
-// ExportSweepWriterFor takes a webhook's registry writer exactly
+// ExportSweepWriterFor takes a target's registry writer exactly
 // as the idle sweep does, reporting whether the sweep had to
 // create the entry. It lets a test drive the registry through the
 // sweep's own entry point instead of choreographing goroutines.
 func (e *Engine) ExportSweepWriterFor(
-	webhookID string,
+	targetID string,
 ) (*ExportArchiveWriter, bool, error) {
-	w, created, err := e.dbTarget.sweepWriterFor(webhookID)
+	w, created, err := e.dbTarget.sweepWriterFor(targetID)
 	if err != nil {
 		return nil, false, err
 	}
@@ -639,9 +656,9 @@ func (e *Engine) ExportSweepWriterFor(
 // ExportReleaseSweepWriter releases a sweep-created registry entry
 // exactly as a finished sweep does.
 func (e *Engine) ExportReleaseSweepWriter(
-	webhookID string, w *ExportArchiveWriter,
+	targetID string, w *ExportArchiveWriter,
 ) {
-	e.dbTarget.releaseSweepWriter(webhookID, w.w)
+	e.dbTarget.releaseSweepWriter(targetID, w.w)
 }
 
 // NewTestArchiveSweeper builds an ArchiveSweeper backed by the

internal/delivery/metrics_test.go

@@ -35,9 +35,8 @@ const (
 )
 
 // mIsolate gives the setup's engine a metric set registered on a
-// private registry. The process-wide collectors are moved by every
+// registry this test holds, so its exact assertions can gather from
-// other delivery test running in parallel, so exact assertions are
+// it.
-// only possible against a registry this test owns.
 func mIsolate(
 	t *testing.T, s iSetup,
 ) *prometheus.Registry {

internal/delivery/redirect_test.go

@@ -375,6 +375,7 @@ func TestApplyRequestHeaders_ReportsOriginScopedNames(t *testing.T) {
 				"Content-Type":  testContentType,
 			},
 		},
+		"webhooker/dev",
 	)
 
 	assert.Equal(t,

internal/delivery/ssrf.go

@@ -25,8 +25,16 @@ var (
 	errNoIPs      = errors.New(
 		"hostname resolved to no IP addresses",
 	)
-	errBlockedIP = errors.New(
+	// ErrBlockedPrivateOrReservedIP reports an address in the
-		"blocked private, reserved or cloud metadata address",
+	// default blocklist's private and reserved ranges,
+	// blockedNetworks.
+	ErrBlockedPrivateOrReservedIP = errors.New(
+		"blocked private or reserved address",
+	)
+	// errBlockedPublicMetadata reports a public address on the
+	// default blocklist, one in blockedPublicNetworks.
+	errBlockedPublicMetadata = errors.New(
+		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
 		"blocked link-local or cloud instance metadata " +
@@ -37,15 +45,32 @@ var (
 	)
 )
 
-// blockedNetworks is the default blocklist: the private and
+// blockedNetworks and blockedPublicNetworks together are the
-// reserved IP ranges, plus the public cloud metadata addresses,
+// default blocklist: the private and reserved IP ranges, plus
-// that are blocked to prevent SSRF attacks. An operator can
+// the public cloud metadata addresses, that are blocked to
-// permit specific blocks out of this set with
+// prevent SSRF attacks. An operator can permit specific blocks
-// ALLOWED_EGRESS_CIDRS; see Guard.
+// out of this set with ALLOWED_EGRESS_CIDRS; see Guard.
+//
+// blockedNetworks holds the private and reserved IP ranges.
 //
 //nolint:gochecknoglobals // package-level network list is appropriate here
 var blockedNetworks []*net.IPNet
 
+// blockedPublicNetworks holds the default blocklist's public
+// addresses, kept apart from blockedNetworks so that they are
+// refused as cloud metadata addresses, never as private or
+// reserved ones.
+//
+// A public address belongs on the default blocklist only if it
+// hands credentials, user data or bootstrap material to whatever
+// can reach it, without the caller presenting anything; it goes
+// in this list. A provider's other public addresses are not
+// refused, since reaching them can be legitimate and no list of
+// them could be complete.
+//
+//nolint:gochecknoglobals // package-level network list is appropriate here
+var blockedPublicNetworks []*net.IPNet
+
 // alwaysBlockedNetworks are the ranges no configuration can
 // open: the link-local blocks and the cloud instance metadata
 // endpoints that live outside them. Reaching one is credential
@@ -81,8 +106,8 @@ var blockedNetworks []*net.IPNet
 // when it clears both halves. Nothing in this list can be
 // reopened, so putting a public address here leaves the operator
 // no escape hatch at all — the condition ALLOWED_EGRESS_CIDRS
-// exists to remove. Default-block it in blockedNetworks instead,
+// exists to remove. Default-block it in blockedPublicNetworks
-// which an allowlist can override.
+// instead, which an allowlist can override.
 //
 // This is a criterion, not an enumeration of every metadata
 // address in existence.
@@ -123,6 +148,9 @@ func init() {
 		"::1/128",
 		"fc00::/7",
 		"fe80::/10",
+	})
+
+	blockedPublicNetworks = mustParseCIDRs([]string{
 		// Azure WireServer, a public address that serves VM credentials.
 		"168.63.129.16/32",
 	})
@@ -218,13 +246,6 @@ func matchesAny(networks []*net.IPNet, ip net.IP) bool {
 	return false
 }
 
-// isBlockedIP checks whether an IP address falls within
-// the default blocklist, before any operator allowlist is
-// considered.
-func isBlockedIP(ip net.IP) bool {
-	return matchesAny(blockedNetworks, ip)
-}
-
 // Guard makes every SSRF decision in the process.
 //
 // It holds the operator's ALLOWED_EGRESS_CIDRS allowlist and
@@ -325,7 +346,8 @@ func (g *Guard) allows(ip net.IP) bool {
 //     consulted, so no configured CIDR reaches link-local or a
 //     cloud metadata endpoint at a non-public address.
 //  2. The allowlist is consulted next, so a listed private
-//     network becomes reachable.
+//     network, or a listed public address on the default
+//     blocklist, becomes reachable.
 //  3. Everything else keeps the default blocklist's answer.
 func (g *Guard) checkIP(ip net.IP) error {
 	if matchesAny(alwaysBlockedNetworks, ip) {
@@ -338,9 +360,15 @@ func (g *Guard) checkIP(ip net.IP) error {
 		return nil
 	}
 
-	if isBlockedIP(ip) {
+	if matchesAny(blockedNetworks, ip) {
 		return fmt.Errorf(
-			"target IP %s: %w", ip, errBlockedIP,
+			"target IP %s: %w", ip, ErrBlockedPrivateOrReservedIP,
+		)
+	}
+
+	if matchesAny(blockedPublicNetworks, ip) {
+		return fmt.Errorf(
+			"target IP %s: %w", ip, errBlockedPublicMetadata,
 		)
 	}
 

internal/delivery/ssrf_allowlist_test.go

@@ -23,6 +23,10 @@ const (
 	metadataIP  = "169.254.169.254"
 	metadataURL = "http://" + metadataIP + "/latest/meta-data/"
 
+	// linkLocalIPv4 is the IPv4 link-local block, which holds
+	// metadataIP.
+	linkLocalIPv4 = "169.254.0.0/16"
+
 	// loopbackHookURL is a target on this host: blocked by
 	// default, reachable only once an operator allowlists
 	// loopback.
@@ -237,7 +241,7 @@ func linkLocalRefusedCases() []metadataAlwaysRefusedCase {
 		},
 		{
 			name:   "whole link-local block",
-			allow:  "169.254.0.0/16",
+			allow:  linkLocalIPv4,
 			target: metadataURL,
 		},
 		{
@@ -412,6 +416,9 @@ func TestGuardAllowlist_AzureWireServerReopenable(t *testing.T) {
 		"WireServer must be refused by the default blocklist, "+
 			"which an allowlist can override",
 	)
+	require.NotErrorIs(t, err, delivery.ErrBlockedPrivateOrReservedIP,
+		"WireServer is public, not private or reserved",
+	)
 
 	assertDialRefused(t, defaultGuard, target)
 
@@ -496,7 +503,7 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 	want := []string{
 		// IPv4 link-local: the 169.254.169.254 metadata
 		// service on AWS, Azure and others.
-		"169.254.0.0/16",
+		linkLocalIPv4,
 		// IPv6 link-local.
 		"fe80::/10",
 		// AWS IPv6 IMDS, inside the ULA space an operator may
@@ -526,6 +533,90 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 	assert.Equal(t, want, got)
 }
 
+// TestDefaultBlocklist_PinnedSet pins each list of the default
+// blocklist on its own, the private and reserved ranges in
+// blockedNetworks and the public addresses in
+// blockedPublicNetworks, so moving an entry from one list to the
+// other fails it. For the first address of each entry it then
+// checks that the default guard refuses it, and that listing the
+// entry in ALLOWED_EGRESS_CIDRS opens it unless the unconditional
+// set holds that address.
+func TestDefaultBlocklist_PinnedSet(t *testing.T) {
+	t.Parallel()
+
+	// public marks an entry of blockedPublicNetworks; every other
+	// entry belongs in blockedNetworks.
+	tests := []struct {
+		cidr       string
+		public     bool
+		reopenable bool
+	}{
+		{cidr: "127.0.0.0/8", reopenable: true},
+		{cidr: "10.0.0.0/8", reopenable: true},
+		{cidr: "172.16.0.0/12", reopenable: true},
+		{cidr: "192.168.0.0/16", reopenable: true},
+		{cidr: linkLocalIPv4, reopenable: false},
+		{cidr: "0.0.0.0/8", reopenable: true},
+		{cidr: "100.64.0.0/10", reopenable: true},
+		{cidr: "192.0.0.0/24", reopenable: true},
+		{cidr: "192.0.2.0/24", reopenable: true},
+		{cidr: "198.18.0.0/15", reopenable: true},
+		{cidr: "198.51.100.0/24", reopenable: true},
+		{cidr: "203.0.113.0/24", reopenable: true},
+		{cidr: "224.0.0.0/4", reopenable: true},
+		{cidr: "240.0.0.0/4", reopenable: true},
+		{cidr: "::1/128", reopenable: true},
+		{cidr: "fc00::/7", reopenable: true},
+		{cidr: "fe80::/10", reopenable: false},
+		{cidr: "168.63.129.16/32", public: true, reopenable: true},
+	}
+
+	wantPrivate := make([]string, 0, len(tests))
+	wantPublic := make([]string, 0, len(tests))
+
+	for _, tt := range tests {
+		if tt.public {
+			wantPublic = append(wantPublic, tt.cidr)
+		} else {
+			wantPrivate = append(wantPrivate, tt.cidr)
+		}
+	}
+
+	gotPrivate := make([]string, 0, len(tests))
+	for _, n := range delivery.ExportBlockedNetworks() {
+		gotPrivate = append(gotPrivate, n.String())
+	}
+
+	gotPublic := make([]string, 0, len(tests))
+	for _, n := range delivery.ExportBlockedPublicNetworks() {
+		gotPublic = append(gotPublic, n.String())
+	}
+
+	assert.ElementsMatch(t, wantPrivate, gotPrivate, "blockedNetworks")
+	assert.ElementsMatch(t, wantPublic, gotPublic, "blockedPublicNetworks")
+
+	for _, tt := range tests {
+		t.Run(tt.cidr, func(t *testing.T) {
+			t.Parallel()
+
+			prefix := netip.MustParsePrefix(tt.cidr)
+			ip := net.IP(prefix.Addr().AsSlice())
+
+			require.Error(t,
+				delivery.NewTestGuard().ExportCheckIP(ip),
+				"the default guard must refuse %s", ip,
+			)
+
+			err := delivery.NewTestGuard(prefix).ExportCheckIP(ip)
+			if tt.reopenable {
+				assert.NoError(t, err, "listing %s must open it", tt.cidr)
+			} else {
+				assert.Error(t, err, "listing %s must not open it", tt.cidr)
+			}
+		})
+	}
+}
+
 // requireLoopback fails the test unless rawURL's host is a
 // loopback address, so the allowlist test cannot silently stop
 // exercising a blocked range.

internal/delivery/ssrf_test.go

@@ -10,7 +10,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-func TestIsBlockedIP_PrivateRanges(t *testing.T) {
+func TestGuardCheckIP_PrivateRanges(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -56,12 +56,14 @@ func TestIsBlockedIP_PrivateRanges(t *testing.T) {
 				"failed to parse IP %s", tt.ip,
 			)
 
+			refused := delivery.NewTestGuard().ExportCheckIP(ip) != nil
+
 			assert.Equal(t,
 				tt.blocked,
-				delivery.ExportIsBlockedIP(ip),
+				refused,
-				"isBlockedIP(%s) = %v, want %v",
+				"default guard refuses %s = %v, want %v",
 				tt.ip,
-				delivery.ExportIsBlockedIP(ip),
+				refused,
 				tt.blocked,
 			)
 		})

internal/delivery/target_database.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -11,22 +12,75 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// databaseTarget is a no-retry target that archives the
+// archiveNameMaxLen is how many characters of a webhook or target
-// full inbound event into a per-webhook archive SQLite file,
+// name an archive file name keeps.
-// separate from the per-webhook event database. The event is
+const archiveNameMaxLen = 40
-// already persisted in the per-webhook event DB by the time
+
-// delivery runs; the database target additionally writes a
+// databaseTarget is a no-retry target that archives the full
-// durable long-term copy into archive-{webhookID}.db and then
+// inbound event into the target's own archive SQLite file, separate
-// records a single attempt whose outcome reflects whether the
+// from the per-webhook event database. The event is already
-// archive write succeeded. See archiveWriter for the
+// persisted in the per-webhook event DB by the time delivery runs;
-// close/reopen, auto-recreate, and expiry semantics.
+// the database target additionally writes a durable long-term copy
+// into the file ArchiveFileName names and then records a single
+// attempt whose outcome reflects whether the archive write
+// succeeded. See archiveWriter for the close/reopen, auto-recreate,
+// and expiry semantics.
 type databaseTarget struct {
 	eng *Engine
 
+	// writers holds one archive writer per database target, keyed
+	// by target ID.
 	mu      sync.Mutex
 	writers map[string]*archiveWriter
 }
 
+// ArchiveFileName returns the file name of a database target's
+// archive: archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, with both
+// names passed through archiveNamePart. The target ID keeps the
+// name unique when two targets' names come out the same.
+func ArchiveFileName(webhookName, targetName, targetID string) string {
+	return "archive-" + archiveNamePart(webhookName) + "-" +
+		archiveNamePart(targetName) + "-" + targetID + ".db"
+}
+
+// archiveNamePart makes a webhook or target name safe to put in a
+// file name. It is lowercased; ASCII letters and digits are kept,
+// every other run of characters becomes a single "-", and no "-" is
+// left at either end. It is cut to archiveNameMaxLen characters, and
+// a name with nothing left is "unnamed".
+func archiveNamePart(name string) string {
+	var b strings.Builder
+
+	dash := false
+
+	for _, r := range strings.ToLower(name) {
+		if (r < 'a' || r > 'z') && (r < '0' || r > '9') {
+			dash = b.Len() > 0
+
+			continue
+		}
+
+		if dash {
+			b.WriteByte('-')
+
+			dash = false
+		}
+
+		b.WriteRune(r)
+	}
+
+	part := b.String()
+	if len(part) > archiveNameMaxLen {
+		part = strings.TrimRight(part[:archiveNameMaxLen], "-")
+	}
+
+	if part == "" {
+		return "unnamed"
+	}
+
+	return part
+}
+
 // Deliver implements Target. It archives the event, then
 // records one successful attempt and marks the delivery
 // delivered. An archiving error fails the delivery: the
@@ -92,7 +146,7 @@ func (t *databaseTarget) Deliver(
 	)
 }
 
-// archive writes the full event as a row into the webhook's
+// archive writes the full event as a row into the target's
 // archive database, honouring the optional per-target expiry
 // parsed from the target config JSON.
 func (t *databaseTarget) archive(d *database.Delivery) error {
@@ -106,7 +160,7 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 		return err
 	}
 
-	w, err := t.writerFor(webhookID)
+	w, err := t.writerFor(d.TargetID)
 	if err != nil {
 		return err
 	}
@@ -124,30 +178,31 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 	return w.write(row, expiry)
 }
 
-// writerFor returns the archiveWriter for a webhook, creating
+// writerFor returns the archive writer for a database target,
-// and caching it on first use. Each webhook has one writer so
+// creating and caching it on first use. Each target has one writer
-// its close/reopen debounce state is shared across concurrent
+// so its close/reopen debounce state is shared across concurrent
-// deliveries. The archive file lives beside the per-webhook
+// deliveries, and so a rename and the idle sweep take the same lock
-// event database in the data directory.
+// as its writes.
 func (t *databaseTarget) writerFor(
-	webhookID string,
+	targetID string,
 ) (*archiveWriter, error) {
-	path, err := t.archivePath(webhookID)
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	w, ok := t.writers[targetID]
+	if !ok {
+		var err error
+
+		w, err = t.newWriter(targetID)
 		if err != nil {
 			return nil, err
 		}
 
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
 		if t.writers == nil {
 			t.writers = make(map[string]*archiveWriter)
 		}
 
-	w, ok := t.writers[webhookID]
+		t.writers[targetID] = w
-	if !ok {
-		w = newArchiveWriter(path, t.eng.log)
-		t.writers[webhookID] = w
 	}
 
 	// A delivery claims the entry: even if the idle sweep created
@@ -159,40 +214,39 @@ func (t *databaseTarget) writerFor(
 }
 
 // sweepWriterFor returns the archive writer the idle sweep should
-// prune a webhook through, together with whether the sweep itself
+// prune a target's archive through, together with whether the sweep
-// created the registry entry.
+// itself created the registry entry.
 //
 // The sweep must route its prune through the registered writer so
 // the writer's mutex orders it against concurrent writes, but it
 // must never leave a registry entry behind: a sweep that ran
-// concurrently with the webhook's deletion would otherwise
+// concurrently with the target's deletion would otherwise
 // re-create an entry that nothing will ever evict again, which is
 // exactly the leak eviction exists to prevent. An entry the sweep
 // creates is therefore marked sweep-owned and handed back to
 // releaseSweepWriter when the sweep is done.
 func (t *databaseTarget) sweepWriterFor(
-	webhookID string,
+	targetID string,
 ) (*archiveWriter, bool, error) {
-	path, err := t.archivePath(webhookID)
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	w, ok := t.writers[targetID]
+	if ok {
+		return w, false, nil
+	}
+
+	w, err := t.newWriter(targetID)
 	if err != nil {
 		return nil, false, err
 	}
 
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
 	if t.writers == nil {
 		t.writers = make(map[string]*archiveWriter)
 	}
 
-	w, ok := t.writers[webhookID]
-	if ok {
-		return w, false, nil
-	}
-
-	w = newArchiveWriter(path, t.eng.log)
 	w.sweepOwned = true
-	t.writers[webhookID] = w
+	t.writers[targetID] = w
 
 	return w, true, nil
 }
@@ -209,57 +263,95 @@ func (t *databaseTarget) sweepWriterFor(
 // delivery that adopted the writer keeps a registered, evictable
 // one.
 func (t *databaseTarget) releaseSweepWriter(
-	webhookID string, w *archiveWriter,
+	targetID string, w *archiveWriter,
 ) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
-	cur, ok := t.writers[webhookID]
+	cur, ok := t.writers[targetID]
 	if !ok || cur != w || !cur.sweepOwned {
 		return
 	}
 
-	delete(t.writers, webhookID)
+	delete(t.writers, targetID)
 }
 
-// archivePath returns the archive file path for a webhook: it
+// newWriter builds the writer for a database target's archive. The
-// lives beside the per-webhook event database in the data
+// file lives beside the webhook's event database in the data
-// directory. It does not touch the filesystem.
+// directory and is named for the webhook and the target as the main
-func (t *databaseTarget) archivePath(
+// database has them now; from then on only rename changes the name
-	webhookID string,
+// the writer uses. It does not touch the archive file.
-) (string, error) {
+func (t *databaseTarget) newWriter(
+	targetID string,
+) (*archiveWriter, error) {
 	if t.eng.dbManager == nil {
-		return "", errArchiveNoDataDir
+		return nil, errArchiveNoDataDir
 	}
 
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
+	var target database.Target
 
-	return filepath.Join(
+	err := t.eng.database.DB().
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
+		Preload("Webhook").
-	), nil
+		First(&target, "id = ?", targetID).Error
+	if err != nil {
+		return nil, fmt.Errorf(
+			"loading database target %s: %w", targetID, err,
+		)
+	}
+
+	dir := filepath.Dir(t.eng.dbManager.DBPath(target.WebhookID))
+	name := ArchiveFileName(
+		target.Webhook.Name, target.Name, target.ID,
+	)
+
+	w := newArchiveWriter(filepath.Join(dir, name), t.eng.log)
+	w.webhookID = target.WebhookID
+
+	return w, nil
 }
 
-// evict drops a webhook's archive writer from the registry and
+// rename moves a database target's archive file to the name for
-// closes its handle, so a deleted webhook does not leave a
+// webhookName and targetName. It goes through the target's writer,
-// writer (and an open archive handle within its debounce
+// so the move holds the lock that writes and the idle sweep take,
-// window) alive for the process lifetime.
+// and later writes use the new name.
+//
+// The writer is created if there is none, and it stays cached. The
+// handlers rename before they save the new name, so until the save
+// the main database still has the old one; a delivery in that window
+// must find this writer rather than build one from the old name.
+func (t *databaseTarget) rename(
+	targetID, webhookName, targetName string,
+) error {
+	w, err := t.writerFor(targetID)
+	if err != nil {
+		return err
+	}
+
+	return w.rename(ArchiveFileName(webhookName, targetName, targetID))
+}
+
+// evict drops a database target's archive writer from the registry
+// and closes its handle, so a deleted target does not leave a
+// writer (and an open archive handle within its debounce window)
+// alive for the process lifetime.
 //
 // The map entry is removed under the registry lock, which is
 // then released before the handle is closed under the writer's
 // own lock: that ordering keeps the registry available to other
-// webhooks while an in-flight write on this one drains, and
+// targets while an in-flight write on this one drains, and
 // closing under the writer's lock means eviction can never race
 // a write.
 //
-// Eviction is idempotent and silent for a webhook with no
+// Eviction is idempotent and silent for a target with no writer,
-// writer, which is the common case: a webhook with no database
+// which is the common case: only a database target that has
-// target never creates one. It never deletes the archive file.
+// received an event or been renamed has one. It never deletes the
-func (t *databaseTarget) evict(webhookID string) {
+// archive file.
+func (t *databaseTarget) evict(targetID string) {
 	t.mu.Lock()
 
-	w, ok := t.writers[webhookID]
+	w, ok := t.writers[targetID]
 	if ok {
-		delete(t.writers, webhookID)
+		delete(t.writers, targetID)
 	}
 
 	t.mu.Unlock()
@@ -272,13 +364,41 @@ func (t *databaseTarget) evict(webhookID string) {
 
 	t.eng.log.Info(
 		"evicted archive writer",
-		"webhook_id", webhookID,
+		"target_id", targetID,
 		"path", w.path,
 	)
 }
 
+// evictWebhook evicts, exactly as evict does, the writer of every
+// database target of a webhook.
+func (t *databaseTarget) evictWebhook(webhookID string) {
+	t.mu.Lock()
+
+	var gone []*archiveWriter
+
+	for targetID, w := range t.writers {
+		if w.webhookID == webhookID {
+			delete(t.writers, targetID)
+
+			gone = append(gone, w)
+		}
+	}
+
+	t.mu.Unlock()
+
+	for _, w := range gone {
+		w.evict()
+
+		t.eng.log.Info(
+			"evicted archive writer",
+			"webhook_id", webhookID,
+			"path", w.path,
+		)
+	}
+}
+
 // evictAll evicts every cached archive writer, exactly as evict
-// does for one webhook. The engine calls it at shutdown, once its
+// does for one target. The engine calls it at shutdown, once its
 // workers have returned. Closing the last handle on an archive
 // moves the contents of its -wal into the .db and removes the
 // -wal, so a clean stop leaves each archive as a single file.
@@ -295,38 +415,25 @@ func (t *databaseTarget) evictAll() {
 	}
 }
 
-// sweepWebhook prunes one webhook's archive of rows older than
+// sweepArchive prunes one database target's archive of rows older
-// expiry, without requiring a write. It returns nil (nothing to
+// than expiry, without requiring a write. A missing archive file is
-// do) when the archive file does not exist, so a sweep never
+// left missing (see sweepExpired), so a sweep never creates an
-// creates an archive for a webhook that has a database target
+// archive for a target that has never received an event.
-// but has never received an event.
 //
 // It also never leaves a registry entry behind: an entry it had
 // to create to reach the writer's mutex is released again once
-// the prune is done, so a sweep racing a webhook deletion cannot
+// the prune is done, so a sweep racing a target deletion cannot
 // resurrect the writer the eviction just dropped.
-func (t *databaseTarget) sweepWebhook(
+func (t *databaseTarget) sweepArchive(
-	webhookID string, expiry time.Duration,
+	targetID string, expiry time.Duration,
 ) error {
-	path, err := t.archivePath(webhookID)
+	w, created, err := t.sweepWriterFor(targetID)
-	if err != nil {
-		return err
-	}
-
-	// Check before taking a writer at all: a webhook whose
-	// archive has never been created gets no writer, no handle,
-	// and no file.
-	if !fileExists(path) {
-		return nil
-	}
-
-	w, created, err := t.sweepWriterFor(webhookID)
 	if err != nil {
 		return err
 	}
 
 	if created {
-		defer t.releaseSweepWriter(webhookID, w)
+		defer t.releaseSweepWriter(targetID, w)
 	}
 
 	return w.sweepExpired(expiry)

internal/delivery/target_database_archive.go

@@ -4,8 +4,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"sync"
 	"time"
 
@@ -41,7 +43,7 @@ const (
 
 var (
 	// errArchiveMissingWebhookID is returned when an event to
-	// archive has no webhook id to key its archive file on.
+	// archive has no webhook id to record in its archive row.
 	errArchiveMissingWebhookID = errors.New(
 		"cannot archive event without a webhook id",
 	)
@@ -61,13 +63,19 @@ var (
 	)
 
 	// errArchiveWriterEvicted is returned when a writer that has
-	// been evicted (its webhook was deleted, or its last database
+	// been evicted (its target or its webhook was deleted) is used
-	// target was removed) is used again. An evicted writer is no
+	// again. An evicted writer is no longer in the registry, so
-	// longer in the registry, so reopening its file would leak a
+	// reopening its file would leak a handle nothing owns.
-	// handle nothing owns.
 	errArchiveWriterEvicted = errors.New(
 		"archive writer has been evicted",
 	)
+
+	// ErrArchiveNameTaken is returned when an archive cannot be
+	// renamed because a file already has the new name. That file may
+	// be an archive with rows of its own, so it is never replaced.
+	ErrArchiveNameTaken = errors.New(
+		"a file already has the archive's new name",
+	)
 )
 
 // databaseTargetConfig is the optional per-target JSON config
@@ -80,7 +88,7 @@ type databaseTargetConfig struct {
 }
 
 // archivedEvent is one fully captured webhook event stored in a
-// per-webhook archive database for long-term retention. It is a
+// database target's archive for long-term retention. It is a
 // self-contained copy — independent of the per-webhook event
 // database, which may prune events under its own retention.
 type archivedEvent struct {
@@ -170,8 +178,8 @@ func ValidateArchiveExpiry(expiry string) error {
 	return nil
 }
 
-// archiveWriter owns one per-webhook archive SQLite file. It
+// archiveWriter owns one database target's archive SQLite file.
-// serialises writes, and after each write closes and reopens
+// It serialises writes, and after each write closes and reopens
 // the file (debounced to at most once per debounce window) so
 // an operator can move the file away for offline archiving. The
 // next write recreates a moved or removed file, because the
@@ -187,16 +195,21 @@ type archiveWriter struct {
 	reopens    int
 
 	// evicted marks a writer that has been removed from the
-	// per-webhook registry. Its handle is closed and it must
+	// registry. Its handle is closed and it must never open the
-	// never open the file again: nothing holds it any more, so a
+	// file again: nothing holds it any more, so a reopen would
-	// reopen would leak the handle for the process lifetime.
+	// leak the handle for the process lifetime.
 	evicted bool
 
+	// webhookID is the webhook the archive's target belongs to,
+	// so deleting the webhook can find its writers. It is set
+	// when the writer is created and never changes.
+	webhookID string
+
 	// sweepOwned marks a registry entry that the idle sweep
-	// created because no writer was cached for the webhook. The
+	// created because no writer was cached for the target. The
 	// sweep removes such an entry again when it is done, so a
 	// sweep can never leave — or resurrect — a registry entry
-	// for a webhook that has been deleted. A delivery that adopts
+	// for a target that has been deleted. A delivery that adopts
 	// the writer clears the flag, handing the entry to the
 	// registry proper.
 	//
@@ -385,11 +398,62 @@ func (w *archiveWriter) sweepExpired(expiry time.Duration) error {
 	return nil
 }
 
+// rename gives the archive file a new name in the same directory,
+// and the writer uses the file under that name from now on. The
+// handle is closed first, which folds the -wal into the .db; any
+// -wal or -shm still beside the file (left by a crash) is moved with
+// it, because SQLite finds them by name. A missing file is not an
+// error: the operator may have moved it away, and the next write
+// creates it under the new name.
+//
+// If a file already has the new name, nothing is moved and the
+// error is ErrArchiveNameTaken.
+func (w *archiveWriter) rename(name string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
+	path := filepath.Join(filepath.Dir(w.path), name)
+	if path == w.path {
+		return nil
+	}
+
+	suffixes := []string{"", "-wal", "-shm"}
+
+	for _, suffix := range suffixes {
+		if fileExists(path + suffix) {
+			return fmt.Errorf(
+				"%w: %s", ErrArchiveNameTaken, name+suffix,
+			)
+		}
+	}
+
+	w.close()
+
+	for _, suffix := range suffixes {
+		err := os.Rename(w.path+suffix, path+suffix)
+		if err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf(
+				"renaming archive %s to %s: %w", w.path, path, err,
+			)
+		}
+	}
+
+	w.path = path
+
+	return nil
+}
+
 // evict closes the writer's handle and marks it unusable. It is
-// called when the writer leaves the registry, either because the
+// called when the writer leaves the registry, because its target
-// webhook was deleted or because its last database target was
+// or its webhook was deleted, or at shutdown. The archive FILE is
-// removed. The archive FILE is deliberately left on disk: it is
+// deliberately left on disk: it is long-term storage an operator
-// long-term storage an operator may still want.
+// may still want.
 func (w *archiveWriter) evict() {
 	w.mu.Lock()
 	defer w.mu.Unlock()

internal/delivery/target_database_evict_test.go

@@ -17,85 +17,109 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-// evictTestEngine builds an engine backed by a temporary data
+// deliverTo archives one event to a database target, leaving the
-// directory and returns it along with that directory.
+// target's writer cached with its handle open.
-func evictTestEngine(t *testing.T) (*delivery.Engine, string) {
+func deliverTo(
+	t *testing.T, env *archiveEnv, tgt *database.Target,
+) {
 	t.Helper()
 
-	dataDir := t.TempDir()
-
-	eng := delivery.NewTestEngineWithDB(
-		nil,
-		database.NewTestWebhookDBManager(dataDir),
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	return eng, dataDir
-}
-
-// TestEvictWebhook_ClosesAndRemovesWriter proves that evicting
-// a webhook drops its archive writer from the registry and
-// closes the open archive handle, rather than leaving both
-// alive for the process lifetime.
-func TestEvictWebhook_ClosesAndRemovesWriter(t *testing.T) {
-	t.Parallel()
-
-	eng, dataDir := evictTestEngine(t)
-
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
 
-	eng.ExportDeliverDatabase(webhookDB, d)
+	env.eng.ExportDeliverDatabase(
-
+		webhookDB, seedDatabaseTargetDelivery(t, webhookDB, event, tgt),
-	webhookID := event.WebhookID
-
-	require.True(
-		t, eng.ExportHasArchiveWriter(webhookID),
-		"a delivery should have cached an archive writer",
 	)
+}
+
+// TestEvictWebhook_ClosesAndRemovesWriter proves that evicting
+// a webhook drops the archive writers of its database targets
+// from the registry and closes their open handles, rather than
+// leaving them alive for the process lifetime, and leaves another
+// webhook's writer alone.
+func TestEvictWebhook_ClosesAndRemovesWriter(t *testing.T) {
+	t.Parallel()
+
+	env := setupArchiveTest(t)
+	first := env.seedDatabaseTarget(t, "")
+	second := env.addDatabaseTarget(t, first.WebhookID, "")
+	other := env.seedDatabaseTarget(t, "")
+
+	for _, tgt := range []*database.Target{first, second, other} {
+		deliverTo(t, env, tgt)
+
 		require.True(
-		t, eng.ExportArchiveHandleOpen(webhookID),
+			t, env.eng.ExportArchiveHandleOpen(tgt.ID),
 			"the writer should hold an open handle after a write",
 		)
+	}
 
-	eng.EvictWebhook(webhookID)
+	env.eng.EvictWebhook(first.WebhookID)
 
+	for _, tgt := range []*database.Target{first, second} {
 		assert.False(
-		t, eng.ExportHasArchiveWriter(webhookID),
+			t, env.eng.ExportHasArchiveWriter(tgt.ID),
 			"eviction should remove the registry entry",
 		)
 		assert.False(
-		t, eng.ExportArchiveHandleOpen(webhookID),
+			t, env.eng.ExportArchiveHandleOpen(tgt.ID),
 			"eviction should close the archive handle",
 		)
-
-	archivePath := filepath.Join(
-		dataDir, fmt.Sprintf("archive-%s.db", webhookID),
-	)
 		assert.FileExists(
-		t, archivePath,
+			t, env.archivePath(tgt),
 			"eviction must not delete the archive file",
 		)
+	}
+
+	assert.True(
+		t, env.eng.ExportArchiveHandleOpen(other.ID),
+		"another webhook's writer must be left alone",
+	)
+}
+
+// TestEvictTarget_LeavesOtherTargets proves that evicting one
+// database target leaves the writer of another target of the same
+// webhook in place.
+func TestEvictTarget_LeavesOtherTargets(t *testing.T) {
+	t.Parallel()
+
+	env := setupArchiveTest(t)
+	doomed := env.seedDatabaseTarget(t, "")
+	kept := env.addDatabaseTarget(t, doomed.WebhookID, "")
+
+	deliverTo(t, env, doomed)
+	deliverTo(t, env, kept)
+
+	env.eng.EvictTarget(doomed.ID)
+
+	assert.False(t, env.eng.ExportHasArchiveWriter(doomed.ID))
+	assert.FileExists(
+		t, env.archivePath(doomed),
+		"eviction must not delete the archive file",
+	)
+	assert.True(
+		t, env.eng.ExportArchiveHandleOpen(kept.ID),
+		"the other target's writer must be left alone",
+	)
 }
 
 // TestEvictWebhook_UnknownWebhookIsNoOp proves eviction is safe
-// for the common case of a webhook that never had a database
+// for the common case of a webhook or target that never had an
-// target, and that repeating it does not panic.
+// archive writer, and that repeating it does not panic.
 func TestEvictWebhook_UnknownWebhookIsNoOp(t *testing.T) {
 	t.Parallel()
 
-	eng, _ := evictTestEngine(t)
+	env := setupArchiveTest(t)
 
 	assert.NotPanics(t, func() {
-		eng.EvictWebhook("no-such-webhook")
+		env.eng.EvictWebhook("no-such-webhook")
-		eng.EvictWebhook("no-such-webhook")
+		env.eng.EvictWebhook("no-such-webhook")
+		env.eng.EvictTarget("no-such-target")
+		env.eng.EvictTarget("no-such-target")
 	})
 
 	assert.False(
-		t, eng.ExportHasArchiveWriter("no-such-webhook"),
+		t, env.eng.ExportHasArchiveWriter("no-such-target"),
 		"eviction must not create a writer",
 	)
 }
@@ -289,17 +313,14 @@ func TestEvictWebhook_RacingWriteDoesNotReopenHandle(
 ) {
 	t.Parallel()
 
-	eng, _ := evictTestEngine(t)
+	env := setupArchiveTest(t)
-
+	tgt := env.seedDatabaseTarget(t, "")
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
 
 	// Prime the registry so the test can hold the very writer the
 	// eviction is about to detach.
-	eng.ExportDeliverDatabase(webhookDB, d)
+	deliverTo(t, env, tgt)
 
-	w := eng.ExportArchiveWriterFor(event.WebhookID)
+	w := env.eng.ExportArchiveWriterFor(tgt.ID)
 	require.NotNil(t, w)
 	require.True(t, w.HandleOpen())
 
@@ -309,7 +330,7 @@ func TestEvictWebhook_RacingWriteDoesNotReopenHandle(
 	// eviction has to contend for the writer's mutex.
 	race.awaitFirstWrite()
 
-	eng.EvictWebhook(event.WebhookID)
+	env.eng.EvictWebhook(tgt.WebhookID)
 
 	sawEvicted, otherErr := race.wait()
 
@@ -324,41 +345,33 @@ func TestEvictWebhook_RacingWriteDoesNotReopenHandle(
 			"been evicted",
 	)
 	assert.False(
-		t, eng.ExportHasArchiveWriter(event.WebhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"the registry entry must stay gone",
 	)
 }
 
 // TestEvictWebhook_LaterDeliveryRecreatesWriter proves eviction
-// does not break archiving for a webhook that is still alive: a
+// does not break archiving for a target that is still alive: a
 // subsequent delivery gets a brand new writer from the registry.
 // It says nothing about the evicted writer itself — that is what
 // TestEvictedWriter_WriteDoesNotReopenFile covers.
 func TestEvictWebhook_LaterDeliveryRecreatesWriter(t *testing.T) {
 	t.Parallel()
 
-	eng, _ := evictTestEngine(t)
+	env := setupArchiveTest(t)
+	tgt := env.seedDatabaseTarget(t, "")
 
-	webhookDB := testWebhookDB(t)
+	deliverTo(t, env, tgt)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	require.True(t, env.eng.ExportHasArchiveWriter(tgt.ID))
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
 
-	eng.ExportDeliverDatabase(webhookDB, d)
+	env.eng.EvictWebhook(tgt.WebhookID)
-	require.True(
-		t, eng.ExportHasArchiveWriter(event.WebhookID),
-	)
 
-	eng.EvictWebhook(event.WebhookID)
+	// A fresh delivery for the same target gets a brand new
-
-	// A fresh delivery for the same webhook gets a brand new
 	// writer from the registry, so archiving keeps working.
-	second := seedDatabaseTargetDelivery(
+	deliverTo(t, env, tgt)
-		t, webhookDB, event, "",
-	)
-	eng.ExportDeliverDatabase(webhookDB, second)
 
 	assert.True(
-		t, eng.ExportHasArchiveWriter(event.WebhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"a later delivery should recreate the writer",
 	)
 }
@@ -370,19 +383,16 @@ func TestEvictWebhook_LaterDeliveryRecreatesWriter(t *testing.T) {
 func TestEngineStop_WriteAfterStopIsRefused(t *testing.T) {
 	t.Parallel()
 
-	eng, _ := evictTestEngine(t)
+	env := setupArchiveTest(t)
+	tgt := env.seedDatabaseTarget(t, "")
 
-	webhookDB := testWebhookDB(t)
+	deliverTo(t, env, tgt)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
 
-	eng.ExportDeliverDatabase(webhookDB, d)
+	w := env.eng.ExportArchiveWriterFor(tgt.ID)
-
-	w := eng.ExportArchiveWriterFor(event.WebhookID)
 	require.NotNil(t, w)
 	require.True(t, w.HandleOpen())
 
-	require.NoError(t, eng.ExportStop(context.Background()))
+	require.NoError(t, env.eng.ExportStop(context.Background()))
 
 	err := w.Write(evictTestRow("ev-after-stop"), 0)
 
@@ -395,7 +405,7 @@ func TestEngineStop_WriteAfterStopIsRefused(t *testing.T) {
 		"a refused write must not reopen the archive",
 	)
 	assert.False(
-		t, eng.ExportHasArchiveWriter(event.WebhookID),
+		t, env.eng.ExportHasArchiveWriter(tgt.ID),
 		"the stop should empty the registry",
 	)
 

internal/delivery/target_database_test.go

@@ -4,13 +4,12 @@ import (
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gorm.io/driver/sqlite"
@@ -74,25 +73,18 @@ func removeArchiveFiles(t *testing.T, path string) {
 
 // TestDeliverDatabase_ArchivesEvent verifies that delivering to
 // a database target marks the delivery delivered and archives
-// the full event into a separate per-webhook archive file.
+// the full event into the target's own archive file.
 func TestDeliverDatabase_ArchivesEvent(t *testing.T) {
 	t.Parallel()
 
-	dataDir := t.TempDir()
+	env := setupArchiveTest(t)
-	dbMgr := database.NewTestWebhookDBManager(dataDir)
+	tgt := env.seedDatabaseTarget(t, "")
-
-	e := delivery.NewTestEngineWithDB(
-		nil, dbMgr,
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, tgt)
 
-	e.ExportDeliverDatabase(webhookDB, d)
+	env.eng.ExportDeliverDatabase(webhookDB, d)
 
 	var updated database.Delivery
 
@@ -105,8 +97,7 @@ func TestDeliverDatabase_ArchivesEvent(t *testing.T) {
 	)
 
 	archivePath := filepath.Join(
-		dataDir,
+		env.dataDir, "archive-sweep-test-archive-"+tgt.ID+".db",
-		fmt.Sprintf("archive-%s.db", event.WebhookID),
 	)
 	assert.FileExists(t, archivePath)
 
@@ -288,31 +279,31 @@ func TestParseArchiveExpiry(t *testing.T) {
 	}
 }
 
-// seedDatabaseTargetDelivery seeds a pending delivery for a
+// seedDatabaseTargetDelivery seeds a pending delivery of an event
-// database target with the given config JSON and returns the
+// to a database target and returns the in-memory delivery the
-// in-memory delivery the target handler is invoked with.
+// target handler is invoked with.
 func seedDatabaseTargetDelivery(
 	t *testing.T,
 	webhookDB *gorm.DB,
 	event database.Event,
-	config string,
+	tgt *database.Target,
 ) *database.Delivery {
 	t.Helper()
 
 	dlv := seedDelivery(
-		t, webhookDB, event.ID, uuid.New().String(),
+		t, webhookDB, event.ID, tgt.ID,
 		database.DeliveryStatusPending,
 	)
 
 	d := &database.Delivery{
 		EventID:  event.ID,
-		TargetID: dlv.TargetID,
+		TargetID: tgt.ID,
 		Status:   database.DeliveryStatusPending,
 		Event:    event,
 		Target: database.Target{
-			Name:   "test-db",
+			Name:   tgt.Name,
 			Type:   database.TargetTypeDatabase,
-			Config: config,
+			Config: tgt.Config,
 		},
 	}
 	d.ID = dlv.ID
@@ -330,22 +321,14 @@ func TestDeliverDatabase_ArchiveFailureFailsDelivery(
 ) {
 	t.Parallel()
 
-	dataDir := t.TempDir()
+	env := setupArchiveTest(t)
-
+	tgt := env.seedDatabaseTarget(t, `{"expiry":"nonsense"}`)
-	e := delivery.NewTestEngineWithDB(
-		nil, database.NewTestWebhookDBManager(dataDir),
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	webhookDB := testWebhookDB(t)
 	event := seedEvent(t, webhookDB, `{"archived":false}`)
-	d := seedDatabaseTargetDelivery(
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, tgt)
-		t, webhookDB, event, `{"expiry":"nonsense"}`,
-	)
 
-	e.ExportDeliverDatabase(webhookDB, d)
+	env.eng.ExportDeliverDatabase(webhookDB, d)
 
 	var updated database.Delivery
 
@@ -373,10 +356,7 @@ func TestDeliverDatabase_ArchiveFailureFailsDelivery(
 	)
 
 	assert.NoFileExists(t,
-		filepath.Join(
+		env.archivePath(tgt),
-			dataDir,
-			fmt.Sprintf("archive-%s.db", event.WebhookID),
-		),
 		"no archive file should exist for a failed config",
 	)
 }
@@ -400,3 +380,258 @@ func TestValidateArchiveExpiry(t *testing.T) {
 		)
 	}
 }
+
+// TestArchiveFileName pins the archive file name and the rules
+// that make a webhook or target name safe to put in it.
+func TestArchiveFileName(t *testing.T) {
+	t.Parallel()
+
+	const id = "3f2a1c9e-8d4b-4c1a-9e2f-0a1b2c3d4e5f"
+
+	cases := []struct {
+		name    string
+		webhook string
+		target  string
+		want    string
+	}{
+		{
+			"plain names", "orders", "archive",
+			"archive-orders-archive-" + id + ".db",
+		},
+		{
+			"lowercased", "Orders", "Main Archive",
+			"archive-orders-main-archive-" + id + ".db",
+		},
+		{
+			"a run of other characters is one dash",
+			`a  /\..b`, "c__--d",
+			"archive-a-b-c-d-" + id + ".db",
+		},
+		{
+			"no dash at either end", "  --orders!! ", "(archive)",
+			"archive-orders-archive-" + id + ".db",
+		},
+		{
+			"path separators", "../../etc/passwd", "a/b",
+			"archive-etc-passwd-a-b-" + id + ".db",
+		},
+		{
+			"letters outside ASCII are dropped",
+			"Bestellungen Größe", "café",
+			"archive-bestellungen-gr-e-caf-" + id + ".db",
+		},
+		{
+			"nothing left is unnamed", "", "!!!",
+			"archive-unnamed-unnamed-" + id + ".db",
+		},
+		{
+			"cut to 40 characters", strings.Repeat("a", 50), "x",
+			"archive-" + strings.Repeat("a", 40) + "-x-" + id + ".db",
+		},
+		{
+			"no dash left by the cut",
+			strings.Repeat("a", 39) + " b", "x",
+			"archive-" + strings.Repeat("a", 39) + "-x-" + id + ".db",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(
+				t, tc.want,
+				delivery.ArchiveFileName(tc.webhook, tc.target, id),
+			)
+		})
+	}
+}
+
+// TestDeliverDatabase_EachTargetHasItsOwnArchive proves two
+// database targets of one webhook archive into separate files.
+func TestDeliverDatabase_EachTargetHasItsOwnArchive(t *testing.T) {
+	t.Parallel()
+
+	env := setupArchiveTest(t)
+	first := env.seedDatabaseTarget(t, "")
+	second := env.addDatabaseTarget(t, first.WebhookID, "")
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"n":1}`)
+
+	for _, tgt := range []*database.Target{first, second} {
+		env.eng.ExportDeliverDatabase(
+			webhookDB,
+			seedDatabaseTargetDelivery(t, webhookDB, event, tgt),
+		)
+	}
+
+	require.NotEqual(
+		t, env.archivePath(first), env.archivePath(second),
+	)
+	assert.Equal(
+		t, []string{event.ID},
+		archivedEventIDs(t, env.archivePath(first)),
+	)
+	assert.Equal(
+		t, []string{event.ID},
+		archivedEventIDs(t, env.archivePath(second)),
+	)
+}
+
+// TestRename_MovesTheFile proves a rename moves the archive, rows
+// and all, and that later writes go to the new name.
+func TestRename_MovesTheFile(t *testing.T) {
+	t.Parallel()
+
+	env := setupArchiveTest(t)
+	tgt := env.seedDatabaseTarget(t, "")
+	oldPath := env.archivePath(tgt)
+
+	webhookDB := testWebhookDB(t)
+	first := seedEvent(t, webhookDB, `{"n":1}`)
+	env.eng.ExportDeliverDatabase(
+		webhookDB, seedDatabaseTargetDelivery(t, webhookDB, first, tgt),
+	)
+	require.FileExists(t, oldPath)
+
+	require.NoError(
+		t, env.eng.Rename(tgt.ID, "Orders", "Long Term"),
+	)
+
+	newPath := filepath.Join(
+		env.dataDir, "archive-orders-long-term-"+tgt.ID+".db",
+	)
+
+	assert.NoFileExists(t, oldPath)
+	assert.Equal(t, []string{first.ID}, archivedEventIDs(t, newPath))
+
+	second := seedEvent(t, webhookDB, `{"n":2}`)
+	env.eng.ExportDeliverDatabase(
+		webhookDB,
+		seedDatabaseTargetDelivery(t, webhookDB, second, tgt),
+	)
+
+	assert.ElementsMatch(
+		t, []string{first.ID, second.ID},
+		archivedEventIDs(t, newPath),
+	)
+	assert.NoFileExists(
+		t, oldPath, "a write after the rename must use the new name",
+	)
+}
+
+// TestRename_NeverReplacesAFile plants a file at the new name, once
+// the .db alone, once a lone -wal and once a lone -shm, and proves
+// each time that the rename is refused, the planted file survives,
+// and the archive keeps its name and its rows.
+func TestRename_NeverReplacesAFile(t *testing.T) {
+	t.Parallel()
+
+	for _, suffix := range archiveFileSuffixes() {
+		t.Run("planted .db"+suffix, func(t *testing.T) {
+			t.Parallel()
+
+			env := setupArchiveTest(t)
+			tgt := env.seedDatabaseTarget(t, "")
+			oldPath := env.archivePath(tgt)
+
+			webhookDB := testWebhookDB(t)
+			first := seedEvent(t, webhookDB, `{"n":1}`)
+			env.eng.ExportDeliverDatabase(
+				webhookDB,
+				seedDatabaseTargetDelivery(t, webhookDB, first, tgt),
+			)
+
+			newPath := filepath.Join(
+				env.dataDir, "archive-orders-long-term-"+tgt.ID+".db",
+			)
+			plantedPath := newPath + suffix
+			require.NoError(
+				t, os.WriteFile(plantedPath, []byte("planted"), 0o600),
+			)
+
+			require.ErrorIs(
+				t, env.eng.Rename(tgt.ID, "Orders", "Long Term"),
+				delivery.ErrArchiveNameTaken,
+			)
+
+			//nolint:gosec // reads the file the test planted under t.TempDir()
+			planted, err := os.ReadFile(plantedPath)
+			require.NoError(t, err)
+			assert.Equal(t, "planted", string(planted))
+
+			second := seedEvent(t, webhookDB, `{"n":2}`)
+			env.eng.ExportDeliverDatabase(
+				webhookDB,
+				seedDatabaseTargetDelivery(t, webhookDB, second, tgt),
+			)
+
+			assert.ElementsMatch(
+				t, []string{first.ID, second.ID},
+				archivedEventIDs(t, oldPath),
+			)
+		})
+	}
+}
+
+// TestRename_BeforeTheNameIsSaved covers the order the handlers
+// use: they rename before they save the new name, so a delivery in
+// between must write under the new name although the main database
+// still has the old one. It also shows that renaming an archive that
+// does not exist yet is not an error.
+func TestRename_BeforeTheNameIsSaved(t *testing.T) {
+	t.Parallel()
+
+	env := setupArchiveTest(t)
+	tgt := env.seedDatabaseTarget(t, "")
+
+	require.NoError(
+		t, env.eng.Rename(tgt.ID, "Orders", "Archive"),
+	)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"n":1}`)
+	env.eng.ExportDeliverDatabase(
+		webhookDB, seedDatabaseTargetDelivery(t, webhookDB, event, tgt),
+	)
+
+	assert.FileExists(
+		t,
+		filepath.Join(
+			env.dataDir, "archive-orders-archive-"+tgt.ID+".db",
+		),
+	)
+	assert.NoFileExists(t, env.archivePath(tgt))
+}
+
+// TestArchiveWriter_RenameMovesSidecars proves a rename carries
+// the -wal and -shm a crash can leave beside an archive no handle
+// has opened since. SQLite finds them by name, so a -wal left
+// behind would lose the transactions it holds.
+func TestArchiveWriter_RenameMovesSidecars(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	oldPath := filepath.Join(dir, "archive-old.db")
+	newPath := filepath.Join(dir, "archive-new.db")
+
+	for _, suffix := range archiveFileSuffixes() {
+		require.NoError(
+			t, os.WriteFile(oldPath+suffix, []byte(suffix), 0o600),
+		)
+	}
+
+	w := delivery.NewExportArchiveWriter(
+		oldPath, archiveTestLogger(), 0,
+	)
+
+	require.NoError(t, w.Rename("archive-new.db"))
+
+	for _, suffix := range archiveFileSuffixes() {
+		assert.NoFileExists(t, oldPath+suffix)
+		assert.FileExists(t, newPath+suffix)
+	}
+
+	assert.Equal(t, newPath, w.Path())
+}

internal/delivery/target_http.go

@@ -442,7 +442,9 @@ func (t *httpTarget) doHTTPRequest(
 		)
 	}
 
-	originScoped := applyRequestHeaders(req, event, cfg)
+	originScoped := applyRequestHeaders(
+		req, event, cfg, t.eng.userAgent(),
+	)
 
 	client := t.clientForRequest(cfg, originScoped)
 
@@ -562,10 +564,13 @@ func isForwardableHeader(name string) bool {
 // Content-Type goes out once: a Content-Type configured on the target
 // wins, otherwise the event's ContentType, otherwise none. The inbound
 // Content-Type in the event's headers is never forwarded.
+//
+// userAgent is set last, over any configured or inbound User-Agent.
 func applyRequestHeaders(
 	req *http.Request,
 	event *database.Event,
 	cfg *HTTPTargetConfig,
+	userAgent string,
 ) []string {
 	if event.ContentType != "" {
 		req.Header.Set(
@@ -580,7 +585,7 @@ func applyRequestHeaders(
 		originScoped[http.CanonicalHeaderKey(k)] = struct{}{}
 	}
 
-	req.Header.Set("User-Agent", "webhooker/1.0")
+	req.Header.Set("User-Agent", userAgent)
 
 	// A Content-Type configured on the target describes the body
 	// being sent rather than the sender. A 307/308 preserves the

internal/delivery/target_slack.go

@@ -136,7 +136,7 @@ func (t *slackTarget) attempt(
 	}
 
 	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("User-Agent", "webhooker/1.0")
+	req.Header.Set("User-Agent", t.eng.userAgent())
 
 	resp, doErr := executeHTTPRequest(t.client, req)
 	durationMs := time.Since(start).Milliseconds()

internal/delivery/terminal_state_test.go

@@ -418,6 +418,38 @@ func TestProcessRetryTask_TargetDeleted_MakesNoAttempt(
 	assert.Zero(t, s.Engine.ExportInflightHeld())
 }
 
+// TestProcessRetryTask_TargetDeleted_CountsFailureOnTarget verifies
+// that the failure of a retry abandoned because its target is gone is
+// added to that target's own totals, not to a row with no target.
+func TestProcessRetryTask_TargetDeleted_CountsFailureOnTarget(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s := newISetup(t)
+
+	var hits atomic.Int64
+
+	task, targetID := tRetryChainSetup(
+		t, s, "gone-counted", &hits,
+	)
+
+	require.NoError(t, s.MainDB.Delete(
+		&database.Target{}, "id = ?", targetID,
+	).Error)
+
+	s.Engine.ExportProcessRetryTask(
+		context.Background(), &task,
+	)
+
+	var rows []database.TargetTotals
+
+	require.NoError(t, s.WebhookDB.Find(&rows).Error)
+	assert.Equal(t, []database.TargetTotals{
+		{TargetID: targetID, Failed: 1},
+	}, rows)
+}
+
 // TestProcessRetryTask_TargetPresent_StillDelivers is the guard's
 // mutation check: a liveness check that refused every retry would pass
 // the test above and break every retry there is.

internal/delivery/user_agent_test.go

@@ -0,0 +1,91 @@
+package delivery_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+	"sneak.berlin/go/webhooker/internal/globals"
+	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
+)
+
+// Both the http and the slack target send webhooker/ and the version
+// in Globals, the value the web UI footer shows. A User-Agent
+// configured on the target or carried in by the sender does not
+// replace it.
+func TestUserAgent_IsTheBuildVersion(t *testing.T) {
+	t.Parallel()
+
+	const want = "webhooker/1.2.3-test"
+
+	userAgents := make(chan string, 1)
+
+	ts := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			userAgents <- r.Header.Get("User-Agent")
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+	defer ts.Close()
+
+	g := &globals.Globals{Version: "1.2.3-test"}
+	lc := fxtest.NewLifecycle(t)
+
+	log, err := logger.New(lc, logger.LoggerParams{Globals: g})
+	require.NoError(t, err)
+
+	e := delivery.New(lc, delivery.EngineParams{
+		Globals: g,
+		Logger:  log,
+		// httptest listens on loopback, which the default guard
+		// refuses.
+		SSRFGuard: delivery.NewTestGuard(
+			netip.MustParsePrefix("127.0.0.0/8"),
+		),
+		Metrics: metrics.New(prometheus.NewRegistry()),
+	})
+
+	statusCode, _, _, err := e.ExportDoHTTPRequest(
+		context.Background(),
+		&delivery.HTTPTargetConfig{
+			URL:     ts.URL,
+			Headers: map[string]string{"User-Agent": "configured/1"},
+		},
+		&database.Event{Headers: `{"User-Agent":["curl/8"]}`},
+	)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, statusCode)
+	require.Len(t, userAgents, 1, "the http target sent no request")
+	assert.Equal(t, want, <-userAgents, "http target")
+
+	db := testWebhookDB(t)
+	targetID := uuid.New().String()
+
+	slackCfg, err := json.Marshal(
+		delivery.SlackTargetConfig{WebhookURL: ts.URL},
+	)
+	require.NoError(t, err)
+
+	event := seedEvent(t, db, `{"action":"test"}`)
+	dlv := seedDelivery(
+		t, db, event.ID, targetID, database.DeliveryStatusPending,
+	)
+
+	e.ExportDeliverSlack(context.Background(), db, buildSlackDelivery(
+		dlv, event, targetID, "test-slack", string(slackCfg),
+	))
+	require.Len(t, userAgents, 1, "the slack target sent no request")
+	assert.Equal(t, want, <-userAgents, "slack target")
+}

internal/gormlog/gormlog.go

@@ -7,7 +7,7 @@
 // SQL — parameters and all — for every statement that returns an
 // error, including gorm.ErrRecordNotFound. Two of this service's
 // lookups miss by design on unauthenticated routes: the entrypoint
-// lookup on /webhook/{uuid}, whose path segment the client picks
+// lookup on /h/{uuid}, whose path segment the client picks
 // outright, and the user lookup behind the login form, whose username
 // the client picks outright. Under the default logger each of those
 // misses printed an unbounded, attacker-chosen string, at no level the

internal/handlers/auth.go

@@ -2,19 +2,56 @@ package handlers
 
 import (
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
+	"unicode"
 
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/logfield"
+	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
+// loginDestination returns where a successful login sends the
+// browser: next when it is a path on this site, otherwise "/", which
+// leads to the webhook list.
+//
+// A browser reads "//host" as another site, reads "\" as "/", and
+// drops tabs and newlines before reading at all. So the value must
+// start with exactly one "/" and hold no "\" or control character
+// anywhere: http.Redirect cleans "/a/../\host" down to "/\host". It
+// is checked after percent-decoding, so an encoded form of any of
+// these is refused too.
+func loginDestination(next string) string {
+	if len(next) > middleware.MaxNextBytes {
+		return "/"
+	}
+
+	decoded, err := url.PathUnescape(next)
+	if err != nil ||
+		!strings.HasPrefix(decoded, "/") ||
+		strings.HasPrefix(decoded, "//") ||
+		strings.Contains(decoded, `\`) ||
+		strings.ContainsFunc(decoded, unicode.IsControl) {
+		return "/"
+	}
+
+	return next
+}
+
 // HandleLoginPage returns a handler for the login page (GET)
 func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		next := loginDestination(
+			r.URL.Query().Get(middleware.NextParam),
+		)
+
 		// Check if already logged in
 		sess, err := h.session.Get(r)
 		if err == nil && h.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/", http.StatusSeeOther)
+			http.Redirect( //nolint:gosec // checked by loginDestination
+				w, r, next, http.StatusSeeOther,
+			)
 
 			return
 		}
@@ -22,6 +59,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 		// Render login page
 		data := map[string]any{
 			tmplKeyError: "",
+			tmplKeyNext:  next,
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -36,7 +74,7 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
-			http.Error(w, "Bad request", http.StatusBadRequest)
+			h.renderError(w, r, http.StatusBadRequest)
 
 			return
 		}
@@ -77,8 +115,13 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 			"user_id", user.ID,
 		)
 
-		// Redirect to home page
+		// The form value is the client's to set, so it is checked
-		http.Redirect(w, r, "/", http.StatusSeeOther)
+		// again here rather than trusted from the rendered page.
+		http.Redirect( //nolint:gosec // checked by loginDestination
+			w, r,
+			loginDestination(r.PostFormValue(middleware.NextParam)),
+			http.StatusSeeOther,
+		)
 	}
 }
 
@@ -91,6 +134,9 @@ func (h *Handlers) renderLoginError(
 ) {
 	data := map[string]any{
 		tmplKeyError: msg,
+		tmplKeyNext: loginDestination(
+			r.PostFormValue(middleware.NextParam),
+		),
 	}
 
 	w.WriteHeader(status)
@@ -103,9 +149,10 @@ func (h *Handlers) renderLoginError(
 // The credential check runs BEFORE any rate-limit budget is
 // consulted, and only a failed check spends budget. That is what
 // keeps the single administrative path reachable: behind the reverse
-// proxy this deployment requires, with TRUSTED_PROXIES unset, every
+// proxy this deployment requires, when TRUSTED_PROXIES does not cover
-// client shares one bucket, so a limiter spent on arrival lets any
+// it, every client shares one bucket, so a limiter spent on arrival
-// stranger deny the operator's own correct password indefinitely.
+// lets any stranger deny the operator's own correct password
+// indefinitely.
 //
 // Verifying first means every login POST costs an Argon2id hash, so
 // the work is taken under a bounded number of verification slots.
@@ -165,11 +212,7 @@ func (h *Handlers) authenticateUser(
 
 	valid, err := database.VerifyPassword(password, user.Password)
 	if err != nil {
-		h.log.Error("failed to verify password", "error", err)
+		h.serverError(w, r, "failed to verify password", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return user, err
 	}
@@ -241,24 +284,14 @@ func (h *Handlers) createAuthenticatedSession(
 ) error {
 	oldSess, err := h.session.Get(r)
 	if err != nil {
-		h.log.Error("failed to get session", "error", err)
+		h.serverError(w, r, "failed to get session", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return err
 	}
 
 	sess, err := h.session.Regenerate(r, w, oldSess)
 	if err != nil {
-		h.log.Error(
+		h.serverError(w, r, "failed to regenerate session", err)
-			"failed to regenerate session", "error", err,
-		)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return err
 	}
@@ -267,11 +300,7 @@ func (h *Handlers) createAuthenticatedSession(
 
 	err = h.session.Save(r, w, sess)
 	if err != nil {
-		h.log.Error("failed to save session", "error", err)
+		h.serverError(w, r, "failed to save session", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return err
 	}

internal/handlers/auth_test.go

@@ -25,7 +25,7 @@ const (
 
 	// sharedProxyPeer is the whole point of this file. Production is
 	// required to run behind a TLS-terminating reverse proxy, and
-	// TRUSTED_PROXIES defaults to empty, so every client — attacker
+	// when TRUSTED_PROXIES does not cover it every client — attacker
 	// and operator alike — reaches the process from the proxy's
 	// address and shares one rate-limit bucket. Both parties in
 	// these tests therefore use the same RemoteAddr.
@@ -115,11 +115,11 @@ func floodFailures(
 // done-criterion of https://git.eeqj.de/sneak/webhooker/issues/150.
 //
 // The attacker and the operator share one rate-limit bucket, because
-// behind the mandated reverse proxy with TRUSTED_PROXIES unset every
+// behind the mandated reverse proxy, when TRUSTED_PROXIES does not
-// client keys on the proxy's address. The attacker floods the
+// cover it, every client keys on the proxy's address. The attacker
-// operator's own username — a single-admin product has a predictable
+// floods the operator's own username — a single-admin product has a
-// one — far past the failure limit. The operator must still be able
+// predictable one — far past the failure limit. The operator must
-// to log in with the correct password.
+// still be able to log in with the correct password.
 //
 // This fails if credentials stop being verified ahead of the limiter.
 func TestLogin_StrangersFloodCannotLockOutTheOperator(t *testing.T) {
@@ -453,3 +453,229 @@ func TestLogin_SuccessCreatesSession(t *testing.T) {
 		"the issued cookie must carry an authenticated session",
 	)
 }
+
+// TestLogin_ReturnsOnlyToAPathOnThisSite is the security half of
+// https://git.eeqj.de/sneak/webhooker/issues/384: the page a login
+// returns to is client-chosen, so anything that is not a path on this
+// site, plain or percent-encoded, must land on "/", the webhook list.
+func TestLogin_ReturnsOnlyToAPathOnThisSite(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h  *handlers.Handlers
+		db *database.Database
+	)
+
+	app := newTestApp(t, &h, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	seedOperator(t, db)
+
+	cases := []struct{ next, want string }{
+		{"/hook/abc/events?page=2", "/hook/abc/events?page=2"},
+		{"", "/"},
+		{"https://evil.example/", "/"},
+		{"https%3A%2F%2Fevil.example%2F", "/"},
+		{"//evil.example/", "/"},
+		{"%2F%2Fevil.example/", "/"},
+		{"/%2Fevil.example/", "/"},
+		{`/\evil.example/`, "/"},
+		{"%2F%5Cevil.example/", "/"},
+		{"/%5Cevil.example/", "/"},
+		{`/a/../\evil.example/`, "/"},
+		{"/\t/evil.example/", "/"},
+		{"/%09/evil.example/", "/"},
+		{"/\n/evil.example/", "/"},
+		{"/%0A/evil.example/", "/"},
+		{"/\r/evil.example/", "/"},
+		{"/%0D/evil.example/", "/"},
+		{"/%00/evil.example/", "/"},
+		{"/%7F/evil.example/", "/"},
+		{"%252F%252Fevil.example/", "/"},
+		{"https%253A%252F%252Fevil.example%252F", "/"},
+		{"/" + strings.Repeat("a", 4096), "/"},
+	}
+
+	for _, c := range cases {
+		form := url.Values{}
+		form.Set("username", operatorUser)
+		form.Set("password", operatorPassword)
+		form.Set("next", c.next)
+
+		req := httptest.NewRequestWithContext(
+			context.Background(),
+			http.MethodPost,
+			"/pages/login",
+			strings.NewReader(form.Encode()),
+		)
+		req.Header.Set(
+			"Content-Type", "application/x-www-form-urlencoded",
+		)
+		req.RemoteAddr = sharedProxyPeer
+
+		w := httptest.NewRecorder()
+		h.HandleLoginSubmit().ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
+		assert.Equal(
+			t, c.want, w.Header().Get("Location"), "next %q", c.next,
+		)
+	}
+}
+
+// TestLogin_WrongPasswordKeepsTheRequestedPage: after a wrong
+// password the login page is shown again with the same next, so the
+// next attempt still returns to the page that was asked for.
+func TestLogin_WrongPasswordKeepsTheRequestedPage(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h  *handlers.Handlers
+		db *database.Database
+	)
+
+	app := newTestApp(t, &h, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	seedOperator(t, db)
+
+	form := url.Values{}
+	form.Set("username", operatorUser)
+	form.Set("password", "wrong")
+	form.Set("next", "/hook/abc")
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost,
+		"/pages/login",
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+	req.RemoteAddr = sharedProxyPeer
+
+	w := httptest.NewRecorder()
+	h.HandleLoginSubmit().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Contains(
+		t, w.Body.String(), `name="next" value="/hook/abc"`,
+	)
+}
+
+// loginPageGet renders the login page as a GET with the given next
+// value and cookies.
+func loginPageGet(
+	h *handlers.Handlers, next string, cookies []*http.Cookie,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet,
+		"/pages/login?"+url.Values{"next": {next}}.Encode(), nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	w := httptest.NewRecorder()
+	h.HandleLoginPage().ServeHTTP(w, req)
+
+	return w
+}
+
+// TestLoginPage_CarriesOnlyAPathOnThisSite covers the login page
+// itself: its form carries the requested page only when it is a path
+// on this site, and a browser already logged in goes straight there,
+// or to "/" when it is not.
+func TestLoginPage_CarriesOnlyAPathOnThisSite(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+	)
+
+	app := newTestApp(t, &h, &sess)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	assert.Contains(
+		t, loginPageGet(h, "/hook/abc", nil).Body.String(),
+		`name="next" value="/hook/abc"`,
+	)
+	assert.Contains(
+		t, loginPageGet(h, "//evil.example/", nil).Body.String(),
+		`name="next" value="/"`,
+	)
+
+	cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
+
+	cases := []struct{ next, want string }{
+		{"/hook/abc", "/hook/abc"},
+		{"//evil.example/", "/"},
+		{`/\evil.example/`, "/"},
+	}
+
+	for _, c := range cases {
+		w := loginPageGet(h, c.next, cookies)
+
+		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
+		assert.Equal(
+			t, c.want, w.Header().Get("Location"), "next %q", c.next,
+		)
+	}
+}
+
+// TestLoginPage_HasNoLinkToItself: the navigation bar on the login
+// page offers no link to the login page.
+func TestLoginPage_HasNoLinkToItself(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	w := loginPageGet(h, "", nil)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	assert.NotContains(t, w.Body.String(), `href="/pages/login"`)
+}
+
+// TestLogin_UsernameAtLimitCanLogIn shows that a username of exactly
+// database.MaxUsernameBytes still fits in the session cookie. Past
+// what the cookie can carry, a correct login answers 500.
+func TestLogin_UsernameAtLimitCanLogIn(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h  *handlers.Handlers
+		db *database.Database
+	)
+
+	app := newTestApp(t, &h, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	username := strings.Repeat("a", database.MaxUsernameBytes)
+
+	hash, err := database.HashPassword(operatorPassword)
+	require.NoError(t, err)
+	require.NoError(t, db.DB().Create(&database.User{
+		Username: username,
+		Password: hash,
+	}).Error)
+
+	w := submitLogin(h, sharedProxyPeer, username, operatorPassword)
+
+	assert.Equal(t, http.StatusSeeOther, w.Code)
+}

internal/handlers/delivery_replay.go

@@ -105,9 +105,7 @@ func (h *Handlers) HandleDeliveryReplay() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -124,14 +122,14 @@ func (h *Handlers) replayDelivery(
 	webhook database.Webhook,
 ) {
 	if !h.dbMgr.DBExists(webhook.ID) {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, "failed to get webhook database", err)
+		h.serverError(w, r, "failed to get webhook database", err)
 
 		return
 	}
@@ -173,7 +171,7 @@ func (h *Handlers) loadReplaySource(
 			&original, "id = ?", chi.URLParam(r, "deliveryID"),
 		).Error
 	if err != nil {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return nil, false
 	}
@@ -195,7 +193,7 @@ func (h *Handlers) queueReplay(
 	)
 	if err != nil {
 		h.serverError(
-			w, "failed to count in-flight deliveries", err,
+			w, r, "failed to count in-flight deliveries", err,
 		)
 
 		return
@@ -212,7 +210,7 @@ func (h *Handlers) queueReplay(
 	err = webhookDB.
 		First(&event, "id = ?", original.EventID).Error
 	if err != nil {
-		h.serverError(w, "failed to load event for replay", err)
+		h.serverError(w, r, "failed to load event for replay", err)
 
 		return
 	}
@@ -222,7 +220,7 @@ func (h *Handlers) queueReplay(
 	)
 	if err != nil {
 		h.serverError(
-			w, "failed to create replay delivery", err,
+			w, r, "failed to create replay delivery", err,
 		)
 
 		return
@@ -299,8 +297,9 @@ func countInFlightDeliveries(
 	return count, err
 }
 
-// createReplayDelivery writes the new pending delivery row and returns
+// createReplayDelivery writes the new pending delivery row, adds it to
-// the task that carries it to the delivery engine.
+// its target's totals in the same transaction, and returns the task
+// that carries it to the delivery engine.
 //
 // The row is written with associations omitted, and neither Event nor
 // Target is populated on it: GORM's SaveBeforeAssociations would
@@ -319,7 +318,16 @@ func createReplayDelivery(
 		Status:   database.DeliveryStatusPending,
 	}
 
-	err := webhookDB.Omit(clause.Associations).Create(dlv).Error
+	err := webhookDB.Transaction(func(tx *gorm.DB) error {
+		err := tx.Omit(clause.Associations).Create(dlv).Error
+		if err != nil {
+			return err
+		}
+
+		return database.AddTargetTotals(tx, database.TargetTotals{
+			TargetID: dlv.TargetID, Deliveries: 1,
+		})
+	})
 	if err != nil {
 		return delivery.Task{}, err
 	}
@@ -362,7 +370,7 @@ func (h *Handlers) finishReplay(
 	webhook database.Webhook,
 	code replayOutcomeCode,
 ) {
-	dest := "/source/" + webhook.ID + "/logs?" +
+	dest := "/hook/" + webhook.ID + "/events?" +
 		replayOutcomeParam + "=" + string(code)
 
 	// The page is read from the form rather than the query string:

internal/handlers/delivery_replay_test.go

@@ -138,7 +138,7 @@ func postReplay(
 	t.Helper()
 
 	req := postRequest(
-		"/source/"+webhookID+"/deliveries/"+
+		"/hook/"+webhookID+"/deliveries/"+
 			deliveryID+"/replay",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
@@ -212,7 +212,7 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=queued",
+		"/hook/"+wh.ID+"/events?replay=queued",
 		w.Header().Get("Location"),
 	)
 
@@ -362,7 +362,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=target-deleted",
+		"/hook/"+wh.ID+"/events?replay=target-deleted",
 		w.Header().Get("Location"),
 	)
 
@@ -390,7 +390,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, missing.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=target-missing",
+		"/hook/"+wh.ID+"/events?replay=target-missing",
 		missing.Header().Get("Location"),
 	)
 }
@@ -431,7 +431,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, first.Code)
 	require.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=queued",
+		"/hook/"+wh.ID+"/events?replay=queued",
 		first.Header().Get("Location"),
 	)
 
@@ -439,7 +439,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, second.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=in-flight",
+		"/hook/"+wh.ID+"/events?replay=in-flight",
 		second.Header().Get("Location"),
 	)
 
@@ -465,7 +465,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, pending.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=not-terminal",
+		"/hook/"+wh.ID+"/events?replay=not-terminal",
 		pending.Header().Get("Location"),
 	)
 }
@@ -501,7 +501,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {
 
 	assert.Contains(
 		t, body,
-		`action="/source/`+wh.ID+`/deliveries/`+
+		`action="/hook/`+wh.ID+`/deliveries/`+
 			original.ID+`/replay"`,
 	)
 	assert.Contains(t, body, `method="POST"`)

internal/handlers/error_page_test.go

@@ -0,0 +1,53 @@
+package handlers_test
+
+import (
+	"context"
+	"html/template"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sneak.berlin/go/webhooker/internal/handlers"
+)
+
+// TestErrorPage_RenderFailureKeepsStatus proves that an error page
+// which cannot render answers with the status it was reporting, as
+// plain text, and is not attempted again: a page whose own render
+// fails reaches the error page, and the error page failing as well
+// ends there with the 500.
+func TestErrorPage_RenderFailureKeepsStatus(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	// .Status is an int, so asking it for a field fails the render.
+	failing := `{{.Status.Missing}}`
+	h.AddTemplateForTest("error.html", template.Must(
+		template.New("error").Parse(failing),
+	))
+	h.AddTemplateForTest("failing.html", template.Must(
+		template.New("failing").Parse(`{{.Data.Missing}}`),
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil,
+	)
+
+	w := httptest.NewRecorder()
+	h.HandleErrorPage(http.StatusNotFound).ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusNotFound, w.Code)
+	assert.Equal(t, "Not Found\n", w.Body.String())
+
+	w = httptest.NewRecorder()
+	h.RenderTemplateForTest(w, req, "failing.html", 0)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(t, "Internal Server Error\n", w.Body.String())
+}

internal/handlers/event_body.go

@@ -52,7 +52,7 @@ func (h *Handlers) HandleEventBodyDownload() http.HandlerFunc {
 		// steered by a client.
 		eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -103,21 +103,21 @@ func (h *Handlers) serveEventBody(
 	eventID string,
 ) {
 	if !h.dbMgr.DBExists(webhook.ID) {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, "failed to get webhook database", err)
+		h.serverError(w, r, "failed to get webhook database", err)
 
 		return
 	}
 
 	body, found, err := eventBody(webhookDB, webhook.ID, eventID)
 	if err != nil {
-		h.serverError(w, "failed to read event body", err)
+		h.serverError(w, r, "failed to read event body", err)
 
 		return
 	}
@@ -130,7 +130,7 @@ func (h *Handlers) serveEventBody(
 	// row and the whole body is served, or it does not and the
 	// response is a clean 404.
 	if !found {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}

internal/handlers/event_body_test.go

@@ -64,8 +64,8 @@ func fetchEventBody(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+url.PathEscape(sourceID)+
+		"/hook/"+url.PathEscape(sourceID)+
-			"/logs/"+url.PathEscape(eventID)+"/body",
+			"/events/"+url.PathEscape(eventID)+"/body",
 		nil,
 	)
 
@@ -490,7 +490,7 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page := renderSourceLogsPage(t, h, sess, big.ID)
 	assert.Contains(
 		t, page,
-		"/source/"+big.ID+"/logs/"+bigEvt.ID+"/body",
+		"/hook/"+big.ID+"/events/"+bigEvt.ID+"/body",
 	)
 
 	small := seedWebhook(t, db)
@@ -501,6 +501,6 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page = renderSourceLogsPage(t, h, sess, small.ID)
 	assert.NotContains(
 		t, page,
-		"/source/"+small.ID+"/logs/"+smallEvt.ID+"/body",
+		"/hook/"+small.ID+"/events/"+smallEvt.ID+"/body",
 	)
 }

internal/handlers/event_resubmit.go

@@ -99,7 +99,7 @@ func (h *Handlers) HandleEventResubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			http.Error(w, "Bad request", http.StatusBadRequest)
+			h.renderError(w, r, http.StatusBadRequest)
 
 			return
 		}
@@ -120,20 +120,20 @@ func (h *Handlers) resubmitEvent(
 	// alphabet rather than from the request.
 	eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
 	if err != nil {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}
 
 	if !h.dbMgr.DBExists(webhook.ID) {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, "failed to get webhook database", err)
+		h.serverError(w, r, "failed to get webhook database", err)
 
 		return
 	}
@@ -147,7 +147,7 @@ func (h *Handlers) resubmitEvent(
 		webhookDB, webhook.ID, eventID.String(),
 	)
 	if err != nil {
-		h.serverError(w, "failed to load event to resubmit", err)
+		h.serverError(w, r, "failed to load event to resubmit", err)
 
 		return
 	}
@@ -155,7 +155,7 @@ func (h *Handlers) resubmitEvent(
 	// A miss is a 404 whether the event was reaped, belongs to
 	// another webhook, or never existed.
 	if !found {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return
 	}
@@ -207,7 +207,7 @@ func (h *Handlers) queueResubmit(
 	// inactive one is skipped rather than refused.
 	targets, err := h.loadActiveTargets(webhook.ID)
 	if err != nil {
-		h.serverError(w, "failed to query targets", err)
+		h.serverError(w, r, "failed to query targets", err)
 
 		return
 	}
@@ -225,7 +225,7 @@ func (h *Handlers) queueResubmit(
 		targets,
 	)
 	if err != nil {
-		h.serverError(w, "failed to store resubmitted event", err)
+		h.serverError(w, r, "failed to store resubmitted event", err)
 
 		return
 	}
@@ -257,7 +257,7 @@ func (h *Handlers) finishResubmit(
 	webhook database.Webhook,
 	code resubmitOutcomeCode,
 ) {
-	dest := "/source/" + webhook.ID + "/logs?" +
+	dest := "/hook/" + webhook.ID + "/events?" +
 		resubmitOutcomeParam + "=" + string(code)
 
 	// The page is read from the form rather than the query string:

internal/handlers/event_resubmit_test.go

@@ -65,7 +65,7 @@ func postResubmit(
 	t.Helper()
 
 	req := postRequest(
-		"/source/"+webhookID+"/events/"+eventID+"/resubmit",
+		"/hook/"+webhookID+"/events/"+eventID+"/resubmit",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),
@@ -154,7 +154,7 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=queued",
+		"/hook/"+wh.ID+"/events?resubmit=queued",
 		w.Header().Get("Location"),
 	)
 
@@ -204,6 +204,7 @@ func assertEventCopy(
 	assert.Equal(t, original.Method, fresh.Method)
 	assert.Equal(t, original.Headers, fresh.Headers)
 	assert.Equal(t, original.Body, fresh.Body)
+	assert.Equal(t, int64(len(original.Body)), fresh.BodyBytes)
 	assert.Equal(t, original.ContentType, fresh.ContentType)
 	assert.Equal(t, original.EntrypointID, fresh.EntrypointID)
 	assert.Equal(t, original.WebhookID, fresh.WebhookID)
@@ -281,7 +282,7 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 		require.Equal(t, http.StatusSeeOther, w.Code)
 		assert.Equal(
 			t,
-			"/source/"+wh.ID+"/logs?resubmit=queued",
+			"/hook/"+wh.ID+"/events?resubmit=queued",
 			w.Header().Get("Location"),
 			"a resubmit must not be refused while an earlier "+
 				"one is in flight",
@@ -435,7 +436,7 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=queued",
+		"/hook/"+wh.ID+"/events?resubmit=queued",
 		w.Header().Get("Location"),
 		"an inactive target is skipped, not an error",
 	)
@@ -481,7 +482,7 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=no-targets",
+		"/hook/"+wh.ID+"/events?resubmit=no-targets",
 		w.Header().Get("Location"),
 	)
 
@@ -597,7 +598,7 @@ func TestHandleSourceLogs_ShowsResubmitProvenance(t *testing.T) {
 	)
 	assert.Contains(
 		t, body,
-		"/source/"+wh.ID+"/events/"+original.ID+"/resubmit",
+		"/hook/"+wh.ID+"/events/"+original.ID+"/resubmit",
 		"the log must offer the resubmit action per event",
 	)
 }

internal/handlers/export_test.go

@@ -1,10 +1,14 @@
 package handlers
 
 import (
+	"context"
 	"html/template"
 	"log/slog"
 	"net/http"
+	"net/http/httptest"
+	"time"
 
+	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
@@ -63,12 +67,43 @@ func (s *Handlers) LoadEventLogViewsForTest(
 	page int,
 ) []EventLogView {
 	views, _, _ := s.loadEventsWithDeliveries(
-		w, webhook, nil, page,
+		w, newRequestForTest(), webhook, nil, page,
 	)
 
 	return views
 }
 
+// WebhookStatsForTest returns the figures the statistics pane on a
+// webhook's page shows, from the webhook's entrypoints and targets
+// loaded as that page loads them.
+func (s *Handlers) WebhookStatsForTest(webhookID string) *WebhookStats {
+	var entrypoints []database.Entrypoint
+
+	s.db.DB().Where("webhook_id = ?", webhookID).Find(&entrypoints)
+
+	var targets []database.Target
+
+	s.db.DB().Where("webhook_id = ?", webhookID).Find(&targets)
+
+	return s.loadWebhookStats(webhookID, entrypoints, targets)
+}
+
+// FinishedByTargetForTest exposes finishedByTarget for use in the
+// handlers_test package.
+func FinishedByTargetForTest(
+	webhookDB *gorm.DB, since time.Time,
+) ([]TargetFinished, error) {
+	return finishedByTarget(webhookDB, since)
+}
+
+// newRequestForTest is the request the helpers here pass on for
+// callers that have none: it is used only to render the error page.
+func newRequestForTest() *http.Request {
+	return httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil,
+	)
+}
+
 // AddTemplateForTest registers a template under a page name so that
 // the handlers_test package can drive the render path with a
 // template of its own.
@@ -122,5 +157,5 @@ func (s *Handlers) BuildDatabaseTargetConfigForTest(
 	w http.ResponseWriter,
 	expiry string,
 ) (string, error) {
-	return s.buildDatabaseTargetConfig(w, expiry)
+	return s.buildDatabaseTargetConfig(w, newRequestForTest(), expiry)
 }

internal/handlers/gormlogbound_test.go

@@ -306,7 +306,7 @@ func postWebhook(
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/webhook/x",
+		context.Background(), http.MethodPost, "/h/x",
 		strings.NewReader("{}"),
 	)
 

internal/handlers/handlers.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"sync/atomic"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
@@ -28,7 +29,7 @@ const (
 	// maxBodyShift is the bit shift for 1 MB body limit.
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
-	recentEventLimit = 20
+	recentEventLimit = 50
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
 
@@ -36,6 +37,9 @@ const (
 	tmplKeyError = "Error"
 	// tmplKeyWebhook is the template data key for a webhook.
 	tmplKeyWebhook = "Webhook"
+	// tmplKeyNext is the template data key for the page to return
+	// to after login.
+	tmplKeyNext = "Next"
 )
 
 // errInvalidPassword is returned when a password does not match.
@@ -59,8 +63,10 @@ type HandlersParams struct {
 	Session      *session.Session
 	Middleware   *middleware.Middleware
 	Notifier     delivery.Notifier
-	Evictor      delivery.WebhookEvictor
+	Archives     delivery.Archives
 	SSRFGuard    *delivery.Guard
+	Metrics      *metrics.Set
+	Registry     *prometheus.Registry
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -74,7 +80,7 @@ type Handlers struct {
 	session   *session.Session
 	mw        *middleware.Middleware
 	notifier  delivery.Notifier
-	evictor   delivery.WebhookEvictor
+	archives  delivery.Archives
 	mtr       *metrics.Set
 	templates map[string]*template.Template
 
@@ -91,18 +97,22 @@ type Handlers struct {
 
 // parsePageTemplate parses a page-specific template set from the
 // embedded FS. Each page template is combined with the shared
-// base, htmlheader, and navbar templates. The page file must be
+// base, htmlheader, and navbar templates, and with any further files
-// listed first so that its root action ({{template "base" .}})
+// the page includes. The page file must be listed first so that its
-// becomes the template set's entry point.
+// root action ({{template "base" .}}) becomes the template set's entry
-func parsePageTemplate(pageFile string) *template.Template {
+// point.
-	return template.Must(
+func parsePageTemplate(
-		template.ParseFS(
+	pageFile string, included ...string,
-			templates.Templates,
+) *template.Template {
+	files := append([]string{
 		pageFile,
 		"base.html",
 		"htmlheader.html",
 		"navbar.html",
-		),
+	}, included...)
+
+	return template.Must(
+		template.ParseFS(templates.Templates, files...),
 	)
 }
 
@@ -121,8 +131,8 @@ func New(
 	s.session = params.Session
 	s.mw = params.Middleware
 	s.notifier = params.Notifier
-	s.evictor = params.Evictor
+	s.archives = params.Archives
-	s.mtr = metrics.Default()
+	s.mtr = params.Metrics
 	s.ssrf = params.SSRFGuard
 
 	// Parse all page templates once at startup
@@ -131,10 +141,11 @@ func New(
 		"profile.html":       parsePageTemplate("profile.html"),
 		"sources_list.html":  parsePageTemplate("sources_list.html"),
 		"sources_new.html":   parsePageTemplate("sources_new.html"),
-		"source_detail.html": parsePageTemplate("source_detail.html"),
+		"source_detail.html": parsePageTemplate("source_detail.html", "webhook_stats.html"),
 		"source_edit.html":   parsePageTemplate("source_edit.html"),
 		"source_logs.html":   parsePageTemplate("source_logs.html"),
 		"target_edit.html":   parsePageTemplate("target_edit.html"),
+		"error.html":         parsePageTemplate("error.html"),
 	}
 
 	lc.Append(fx.Hook{
@@ -146,6 +157,16 @@ func New(
 	return s, nil
 }
 
+// HandleErrorPage returns a handler that answers every request with
+// the error page for status. The router uses it for unknown paths, the
+// CSRF middleware for a refused form, and each admin page route
+// group's recoverer for a panic.
+func (s *Handlers) HandleErrorPage(status int) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		s.renderError(w, r, status)
+	}
+}
+
 func (s *Handlers) respondJSON(
 	w http.ResponseWriter,
 	_ *http.Request,
@@ -163,15 +184,76 @@ func (s *Handlers) respondJSON(
 	}
 }
 
-// serverError logs an error and sends a 500 response.
+// serverError logs an error and answers with the 500 error page.
 func (s *Handlers) serverError(
-	w http.ResponseWriter, msg string, err error,
+	w http.ResponseWriter, r *http.Request, msg string, err error,
 ) {
 	s.log.Error(msg, "error", err)
-	http.Error(
+	s.renderError(w, r, http.StatusInternalServerError)
-		w, "Internal server error",
+}
-		http.StatusInternalServerError,
+
-	)
+// renderError answers with status and the error page: the normal
+// layout, one fixed line explaining the status, and a link back to the
+// webhook list, or to sign-in when nobody is signed in.
+//
+// It renders the page itself rather than through renderTemplate,
+// whose own failure comes here. If the error page cannot render
+// either, the answer is the same status in plain text: never a second
+// attempt, and never a different status.
+func (s *Handlers) renderError(
+	w http.ResponseWriter,
+	r *http.Request,
+	status int,
+) {
+	// The page names the signed-in user, and some error pages are
+	// served outside the routes where NoCache runs.
+	w.Header().Set("Cache-Control", "no-store")
+
+	data := s.pageData(r, map[string]any{
+		"Status":     status,
+		"StatusText": http.StatusText(status),
+		"Message":    errorPageText(status),
+	})
+
+	var buf bytes.Buffer
+
+	err := s.templates["error.html"].Execute(&buf, data)
+	if err != nil {
+		s.log.Error("failed to render error page", "error", err)
+		http.Error(w, http.StatusText(status), status)
+
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+
+	_, err = buf.WriteTo(w)
+	if err != nil {
+		s.log.Error("failed to write error page", "error", err)
+	}
+}
+
+// errorPageText is the line the error page shows for status. It is
+// fixed per status, so the page tells the reader no more than the
+// plain-text answers it replaced did.
+func errorPageText(status int) string {
+	switch status {
+	case http.StatusBadRequest:
+		return "The request could not be read."
+	case http.StatusForbidden:
+		return "The request was refused. If it came from a form " +
+			"left open for a long time, reload the page and try " +
+			"again."
+	case http.StatusNotFound:
+		return "There is nothing here. It may have been deleted, " +
+			"or the address may be wrong."
+	case http.StatusServiceUnavailable:
+		return "The server is busy. Please try again in a moment."
+	default: // http.StatusInternalServerError
+		return "Something went wrong on the server. Please try " +
+			"again."
+	}
 }
 
 // UserInfo represents user information for templates
@@ -224,14 +306,17 @@ func (s *Handlers) renderTemplate(
 			"template not found",
 			"template", pageTemplate,
 		)
-		http.Error(
+		s.renderError(w, r, http.StatusInternalServerError)
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return
 	}
 
+	s.executeTemplate(w, r, tmpl, s.pageData(r, data))
+}
+
+// pageData adds the fields the shared layout renders to a page's own
+// data.
+func (s *Handlers) pageData(r *http.Request, data any) any {
 	userInfo := s.getUserInfo(r)
 	csrfToken := middleware.CSRFToken(r)
 
@@ -245,19 +330,16 @@ func (s *Handlers) renderTemplate(
 		m["User"] = userInfo
 		m["CSRFToken"] = csrfToken
 		m["Version"] = version
-		s.executeTemplate(w, tmpl, m)
 
-		return
+		return m
 	}
 
-	wrapper := templateDataWrapper{
+	return templateDataWrapper{
 		User:      userInfo,
 		CSRFToken: csrfToken,
 		Version:   version,
 		Data:      data,
 	}
-
-	s.executeTemplate(w, tmpl, wrapper)
 }
 
 // executeTemplate renders the template into a buffer and writes to
@@ -270,6 +352,7 @@ func (s *Handlers) renderTemplate(
 // this reason.
 func (s *Handlers) executeTemplate(
 	w http.ResponseWriter,
+	r *http.Request,
 	tmpl *template.Template,
 	data any,
 ) {
@@ -280,10 +363,7 @@ func (s *Handlers) executeTemplate(
 		s.log.Error(
 			"failed to execute template", "error", err,
 		)
-		http.Error(
+		s.renderError(w, r, http.StatusInternalServerError)
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return
 	}

internal/handlers/handlers_test.go

@@ -3,6 +3,7 @@ package handlers_test
 import (
 	"context"
 	"errors"
+	"fmt"
 	"html/template"
 	"net/http"
 	"net/http/httptest"
@@ -20,6 +21,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/session"
 )
@@ -51,23 +53,73 @@ func (n *recordingNotifier) Tasks() []delivery.Task {
 	return out
 }
 
-// recordingEvictor is a delivery.WebhookEvictor that records
+// recordingArchives is a delivery.Archives that records what it
-// the webhook ids it was asked to evict, so a test can prove
+// was asked to do, so a test can prove that a deletion or rename
-// that a deletion path reached the delivery engine.
+// path reached the delivery engine. After FailRenames, every
-type recordingEvictor struct {
+// rename fails with the given error.
+type recordingArchives struct {
 	mu             sync.Mutex
 	evicted        []string
+	evictedTargets []string
+	renames        []archiveRename
+	renameErr      error
 }
 
-func (r *recordingEvictor) EvictWebhook(webhookID string) {
+// errInjectedRename is the failure a test hands FailRenames.
+var errInjectedRename = errors.New("injected rename failure")
+
+// errNameTaken is what the delivery engine returns when a file
+// already has an archive's new name, here archive-taken.db.
+var errNameTaken = fmt.Errorf(
+	"%w: archive-taken.db", delivery.ErrArchiveNameTaken,
+)
+
+// archiveRename is one recorded Rename call.
+type archiveRename struct {
+	TargetID    string
+	WebhookName string
+	TargetName  string
+}
+
+func (r *recordingArchives) EvictWebhook(webhookID string) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
 	r.evicted = append(r.evicted, webhookID)
 }
 
+func (r *recordingArchives) EvictTarget(targetID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.evictedTargets = append(r.evictedTargets, targetID)
+}
+
+func (r *recordingArchives) Rename(
+	targetID, webhookName, targetName string,
+) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.renames = append(r.renames, archiveRename{
+		TargetID:    targetID,
+		WebhookName: webhookName,
+		TargetName:  targetName,
+	})
+
+	return r.renameErr
+}
+
+// FailRenames makes every later rename fail with err.
+func (r *recordingArchives) FailRenames(err error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.renameErr = err
+}
+
 // Evicted returns a copy of the recorded webhook ids.
-func (r *recordingEvictor) Evicted() []string {
+func (r *recordingArchives) Evicted() []string {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
@@ -77,6 +129,28 @@ func (r *recordingEvictor) Evicted() []string {
 	return out
 }
 
+// EvictedTargets returns a copy of the recorded target ids.
+func (r *recordingArchives) EvictedTargets() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]string, len(r.evictedTargets))
+	copy(out, r.evictedTargets)
+
+	return out
+}
+
+// Renames returns a copy of the recorded renames.
+func (r *recordingArchives) Renames() []archiveRename {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]archiveRename, len(r.renames))
+	copy(out, r.renames)
+
+	return out
+}
+
 func newTestApp(
 	t *testing.T,
 	targets ...any,
@@ -103,12 +177,14 @@ func newTestApp(
 			func(n *recordingNotifier) delivery.Notifier {
 				return n
 			},
-			func() *recordingEvictor {
+			func() *recordingArchives {
-				return &recordingEvictor{}
+				return &recordingArchives{}
 			},
-			func(r *recordingEvictor) delivery.WebhookEvictor {
+			func(r *recordingArchives) delivery.Archives {
 				return r
 			},
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,
@@ -176,7 +252,7 @@ func TestHandleIndex_Authenticated(t *testing.T) {
 
 	assert.Equal(t, http.StatusSeeOther, w2.Code)
 	assert.Equal(
-		t, "/sources", w2.Header().Get("Location"),
+		t, "/hooks", w2.Header().Get("Location"),
 	)
 }
 
@@ -307,10 +383,14 @@ func TestRenderTemplateMidRenderErrorSendsNoPartialBody(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 		"a failed render must report a 500",
 	)
-	assert.Equal(
+	assert.NotContains(
-		t, "Internal server error\n", w.Body.String(),
+		t, w.Body.String(), partialPageMarker,
 		"the response must carry no part of the aborted page",
 	)
+	assert.Contains(
+		t, w.Body.String(), "500 Internal Server Error",
+		"a failed render must answer with the error page",
+	)
 }
 
 func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {

internal/handlers/index.go

@@ -5,13 +5,13 @@ import (
 )
 
 // HandleIndex returns a handler for the root path that redirects
-// based on authentication state: authenticated users go to /sources
+// based on authentication state: authenticated users go to /hooks
 // (the dashboard), unauthenticated users go to the login page.
 func (s *Handlers) HandleIndex() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		sess, err := s.session.Get(r)
 		if err == nil && s.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/sources", http.StatusSeeOther)
+			http.Redirect(w, r, "/hooks", http.StatusSeeOther)
 
 			return
 		}

internal/handlers/logbound_test.go

@@ -4,7 +4,7 @@ package handlers_test
 // this package reach a value an UNAUTHENTICATED client picks outright
 // and of a length it picks outright:
 //
-//   - the unknown-entrypoint DEBUG line on /webhook/{uuid}, whose
+//   - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
 //     path segment matched no stored entrypoint and so is bounded by
 //     nothing;
 //   - the failed-login DEBUG lines, whose username is a form field.
@@ -190,12 +190,12 @@ func assertNoClientText(t *testing.T, buf *bytes.Buffer) {
 // route pattern.
 func receiverRouter(h *handlers.Handlers) *chi.Mux {
 	router := chi.NewRouter()
-	router.Post("/webhook/{uuid}", h.HandleWebhook())
+	router.Post("/h/{uuid}", h.HandleWebhook())
 
 	return router
 }
 
-// postReceiver sends one POST at /webhook/<segment>.
+// postReceiver sends one POST at /h/<segment>.
 //
 // RawPath is cleared after parsing so chi routes on the decoded path
 // and the handler sees the raw bytes rather than their percent-escaped
@@ -210,7 +210,7 @@ func postReceiver(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodPost,
-		"/webhook/"+url.PathEscape(segment),
+		"/h/"+url.PathEscape(segment),
 		strings.NewReader(""),
 	)
 	req.URL.RawPath = ""
@@ -339,11 +339,9 @@ const storedUserPassword = "correct-horse-battery-staple"
 // storedFillBytes is the raw length of the client-chosen value in
 // those accounts' usernames. It is well past the 512-byte field
 // budget, so the line is still truncated, but short enough that the
-// session cookie a successful login writes stays inside
+// whole username, markers and fill name included, stays within
-// securecookie's 4 KB limit: the cookie is written BEFORE the
+// database.MaxUsernameBytes.
-// "user logged in" line, so an 8 KB username answers 500 and never
+const storedFillBytes = 960
-// reaches it.
-const storedFillBytes = 1024
 
 // storedFill builds a username fill of storedFillBytes raw bytes out
 // of repetitions of ch, with both markers at its far end.
@@ -509,7 +507,7 @@ func TestVerificationCapacity_LogLineDoesNotTrackPathSize(
 					http.StatusServiceUnavailable,
 					postLoginAtPath(
 						t, h,
-						"/source/"+url.PathEscape(
+						"/hook/"+url.PathEscape(
 							oversizedFill(fill),
 						)+"/login",
 					),

internal/handlers/metrics.go

@@ -0,0 +1,21 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+// HandleMetrics returns the Prometheus scrape handler for the
+// registry built by metrics.NewRegistry, which the HTTP, delivery, Go
+// runtime and process collectors register on. It is what
+// promhttp.Handler builds for the global default registry, including
+// the promhttp_metric_handler_* series that count scrapes, pointed at
+// that registry instead.
+func (s *Handlers) HandleMetrics() http.HandlerFunc {
+	reg := s.params.Registry
+
+	return promhttp.InstrumentMetricHandler(
+		reg, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}),
+	).ServeHTTP
+}

internal/handlers/profile.go

@@ -1,7 +1,6 @@
 package handlers
 
 import (
-	"context"
 	"net/http"
 
 	"github.com/go-chi/chi"
@@ -37,14 +36,14 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
-			http.Error(w, "Bad request", http.StatusBadRequest)
+			h.renderError(w, r, http.StatusBadRequest)
 
 			return
 		}
 
 		successMessage, errorMessage, handled := h.applyPasswordChange(
-			r.Context(),
 			w,
+			r,
 			sessionUsername,
 			// PostFormValue, not FormValue: the credential must
 			// come from the body, never from the query string.
@@ -66,12 +65,12 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
 // applyPasswordChange verifies the current password and, on success,
 // persists a fresh hash for the user, reusing the same helpers that
 // bootstrap the admin user. It returns the success and error messages
-// to display on the profile page. On an internal failure it writes a
+// to display on the profile page. On an internal failure it writes the
-// 500 response itself and returns handled=false, signalling the caller
+// error page itself and returns handled=false, signalling the caller
 // to stop without re-rendering the page.
 func (h *Handlers) applyPasswordChange(
-	ctx context.Context,
 	w http.ResponseWriter,
+	r *http.Request,
 	username, currentPassword, newPassword, confirmPassword string,
 ) (string, string, bool) {
 	// This endpoint verifies one password and hashes another, at
@@ -79,15 +78,10 @@ func (h *Handlers) applyPasswordChange(
 	// endpoint uses. The bound is per hash, not per endpoint: leaving
 	// this path outside it would leave a hole in it. The slot is held
 	// across both hashes.
-	release, ok := h.mw.BeginPasswordVerification(ctx)
+	release, ok := h.mw.BeginPasswordVerification(r.Context())
 	if !ok {
 		h.log.Warn("password verification capacity exhausted")
-		http.Error(
+		h.renderError(w, r, http.StatusServiceUnavailable)
-			w,
-			"The server is busy verifying credentials. "+
-				"Please try again.",
-			http.StatusServiceUnavailable,
-		)
 
 		return "", "", false
 	}
@@ -103,7 +97,7 @@ func (h *Handlers) applyPasswordChange(
 	).First(&user).Error
 	if err != nil {
 		h.serverError(
-			w, "failed to load user for password change", err,
+			w, r, "failed to load user for password change", err,
 		)
 
 		return "", "", false
@@ -113,7 +107,7 @@ func (h *Handlers) applyPasswordChange(
 		currentPassword, user.Password,
 	)
 	if err != nil {
-		h.serverError(w, "failed to verify password", err)
+		h.serverError(w, r, "failed to verify password", err)
 
 		return "", "", false
 	}
@@ -132,7 +126,7 @@ func (h *Handlers) applyPasswordChange(
 
 	hashedPassword, err := database.HashPassword(newPassword)
 	if err != nil {
-		h.serverError(w, "failed to hash new password", err)
+		h.serverError(w, r, "failed to hash new password", err)
 
 		return "", "", false
 	}
@@ -141,7 +135,7 @@ func (h *Handlers) applyPasswordChange(
 		"password", hashedPassword,
 	).Error
 	if err != nil {
-		h.serverError(w, "failed to update password", err)
+		h.serverError(w, r, "failed to update password", err)
 
 		return "", "", false
 	}
@@ -162,7 +156,7 @@ func (h *Handlers) profileOwnerOrDeny(
 ) (string, string, bool) {
 	requestedUsername := chi.URLParam(r, "username")
 	if requestedUsername == "" {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return "", "", false
 	}
@@ -172,7 +166,7 @@ func (h *Handlers) profileOwnerOrDeny(
 	// unexpected retrieval error.
 	sess, err := h.session.Get(r)
 	if err != nil {
-		h.serverError(w, "failed to get session", err)
+		h.serverError(w, r, "failed to get session", err)
 
 		return "", "", false
 	}
@@ -180,10 +174,7 @@ func (h *Handlers) profileOwnerOrDeny(
 	sessionUsername, ok := h.session.GetUsername(sess)
 	if !ok {
 		h.log.Error("authenticated session missing username")
-		http.Error(
+		h.renderError(w, r, http.StatusInternalServerError)
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return "", "", false
 	}
@@ -191,17 +182,14 @@ func (h *Handlers) profileOwnerOrDeny(
 	sessionUserID, ok := h.session.GetUserID(sess)
 	if !ok {
 		h.log.Error("authenticated session missing user ID")
-		http.Error(
+		h.renderError(w, r, http.StatusInternalServerError)
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return "", "", false
 	}
 
 	// Only allow users to act on their own profile.
 	if requestedUsername != sessionUsername {
-		http.Error(w, "Forbidden", http.StatusForbidden)
+		h.renderError(w, r, http.StatusForbidden)
 
 		return "", "", false
 	}

internal/handlers/profile_test.go

@@ -88,6 +88,8 @@ func TestHandleProfile_OwnProfile_OK(t *testing.T) {
 	h.HandleProfile().ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Body.String(), "Account Information")
+	assert.NotContains(t, w.Body.String(), "Account Type")
 }
 
 func TestHandleProfile_OtherProfile_Forbidden(t *testing.T) {
@@ -126,7 +128,9 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 
 	var sess *session.Session
 
-	app := newTestApp(t, &log, &cfg, &sess)
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &log, &cfg, &sess, &h)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -137,7 +141,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 
 	router := chi.NewRouter()
 	router.Route("/user/{username}", func(r chi.Router) {
-		r.Use(mw.CSRF())
+		r.Use(mw.CSRF(h.HandleErrorPage(http.StatusForbidden)))
 		r.Use(mw.RequireAuth())
 		r.Get("/", func(w http.ResponseWriter, _ *http.Request) {
 			handlerReached = true
@@ -158,7 +162,10 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 		"handler must not be reached for unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fuser%2Ftestuser",
+		w.Header().Get("Location"),
+	)
 }
 
 // passwordChangeRequest builds a POST request to the password-change

internal/handlers/recent_events.go

@@ -0,0 +1,293 @@
+package handlers
+
+import (
+	"net/http"
+	"slices"
+	"strconv"
+	"time"
+
+	"github.com/dustin/go-humanize"
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// recentEventColumns is the recent events list's projection. It
+// leaves out the body, for the reason maxRenderedBodyBytes gives,
+// and reads its size from body_bytes, recorded when the event was
+// stored.
+const recentEventColumns = "id, created_at, method, content_type, " +
+	"resubmitted_from_id, body_bytes"
+
+// recentAttemptColumns is the part of a recorded attempt the list
+// uses. The event log's deliveryResultColumns also reads response
+// bodies, which the list does not show.
+const recentAttemptColumns = "delivery_id, status_code, created_at"
+
+// RecentEventView is one row of the recent events list on a
+// webhook's page.
+type RecentEventView struct {
+	Method      string
+	ContentType string
+
+	// ResubmittedFromID names the event this one was copied from,
+	// empty for an event that arrived on the receiver.
+	ResubmittedFromID string
+
+	// Received is how long ago the event arrived, and ReceivedUTC
+	// the full timestamp the page shows on hover.
+	Received    string
+	ReceivedUTC string
+
+	// Size is the size of the stored body.
+	Size string
+
+	// ProcessingTime is how long the event's slowest delivery
+	// took; see processingTime.
+	ProcessingTime string
+
+	// Status is what the webhook's HTTP target answered, and
+	// StatusClass its colour; see targetStatus. Both are empty
+	// unless the webhook has exactly one HTTP target.
+	Status      string
+	StatusClass string
+}
+
+// recentEventRow is one row of recentEventColumns.
+type recentEventRow struct {
+	ID                string
+	CreatedAt         time.Time
+	Method            string
+	ContentType       string
+	ResubmittedFromID *string
+	BodyBytes         uint64
+}
+
+// recentAttemptRow is one row of recentAttemptColumns. CreatedAt is
+// when the attempt's result was recorded, which is when the attempt
+// finished.
+type recentAttemptRow struct {
+	DeliveryID string
+	StatusCode int
+	CreatedAt  time.Time
+}
+
+// singleHTTPTargetID returns the ID of the webhook's HTTP target
+// when it has exactly one, and "" when it has none or several.
+func singleHTTPTargetID(targets []database.Target) string {
+	id := ""
+	count := 0
+
+	for i := range targets {
+		if targets[i].Type == database.TargetTypeHTTP {
+			id = targets[i].ID
+			count++
+		}
+	}
+
+	if count != 1 {
+		return ""
+	}
+
+	return id
+}
+
+// loadRecentEvents loads the webhook's recentEventLimit newest
+// events for its page, newest first. statusTargetID is the
+// webhook's only HTTP target, or "" when the list shows no status.
+func loadRecentEvents(
+	webhookDB *gorm.DB, webhookID, statusTargetID string,
+) ([]RecentEventView, error) {
+	var rows []recentEventRow
+
+	err := webhookDB.Model(&database.Event{}).
+		Select(recentEventColumns).
+		Where("webhook_id = ?", webhookID).
+		Order("created_at DESC").
+		Limit(recentEventLimit).
+		Find(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+
+	eventIDs := make([]string, len(rows))
+	for i := range rows {
+		eventIDs[i] = rows[i].ID
+	}
+
+	// Oldest first, so an event's last delivery to a target is its
+	// newest: a replay adds a delivery rather than changing the
+	// earlier one.
+	var deliveries []database.Delivery
+
+	err = webhookDB.
+		Select("id, event_id, target_id, status, created_at").
+		Where("event_id IN ?", eventIDs).
+		Order("created_at ASC").
+		Find(&deliveries).Error
+	if err != nil {
+		return nil, err
+	}
+
+	byEvent := make(map[string][]database.Delivery, len(rows))
+	deliveryIDs := make([]string, len(deliveries))
+
+	for i := range deliveries {
+		eventID := deliveries[i].EventID
+		byEvent[eventID] = append(byEvent[eventID], deliveries[i])
+		deliveryIDs[i] = deliveries[i].ID
+	}
+
+	attempts, err := loadRecentAttempts(webhookDB, deliveryIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	views := make([]RecentEventView, len(rows))
+	for i := range rows {
+		views[i] = rows[i].view(
+			byEvent[rows[i].ID], attempts, statusTargetID,
+		)
+	}
+
+	return views, nil
+}
+
+// loadRecentAttempts loads the recorded attempts of the listed
+// events' deliveries, keyed by delivery ID, each delivery's in
+// attempt order. The IDs go in chunks for the reason
+// deliveryIDChunkSize gives.
+func loadRecentAttempts(
+	webhookDB *gorm.DB, deliveryIDs []string,
+) (map[string][]recentAttemptRow, error) {
+	byDelivery := make(map[string][]recentAttemptRow)
+
+	for chunk := range slices.Chunk(deliveryIDs, deliveryIDChunkSize) {
+		var rows []recentAttemptRow
+
+		err := webhookDB.Model(&database.DeliveryResult{}).
+			Select(recentAttemptColumns).
+			Where("delivery_id IN ?", chunk).
+			Order("attempt_num ASC").
+			Find(&rows).Error
+		if err != nil {
+			return nil, err
+		}
+
+		for i := range rows {
+			id := rows[i].DeliveryID
+			byDelivery[id] = append(byDelivery[id], rows[i])
+		}
+	}
+
+	return byDelivery, nil
+}
+
+// view projects a loaded row for rendering. deliveries is the
+// event's deliveries, oldest first, and attempts their recorded
+// attempts keyed by delivery ID.
+func (r *recentEventRow) view(
+	deliveries []database.Delivery,
+	attempts map[string][]recentAttemptRow,
+	statusTargetID string,
+) RecentEventView {
+	v := RecentEventView{
+		Method:         r.Method,
+		ContentType:    r.ContentType,
+		Received:       humanize.Time(r.CreatedAt),
+		ReceivedUTC:    r.CreatedAt.UTC().Format(time.DateTime) + " UTC",
+		Size:           humanize.Bytes(r.BodyBytes),
+		ProcessingTime: processingTime(deliveries, attempts),
+	}
+
+	if r.ResubmittedFromID != nil {
+		v.ResubmittedFromID = *r.ResubmittedFromID
+	}
+
+	if statusTargetID != "" {
+		v.Status, v.StatusClass = targetStatus(
+			deliveries, attempts, statusTargetID,
+		)
+	}
+
+	return v
+}
+
+// processingTime is how long the event's slowest delivery took,
+// from being queued to its last recorded attempt, time spent
+// waiting between retries included. A delivery is queued when its
+// event is received, or when an operator replays it, so a replay
+// is timed from the replay rather than from the event's arrival.
+// It is "in progress" while any delivery is pending or retrying,
+// and empty for an event with no deliveries.
+func processingTime(
+	deliveries []database.Delivery,
+	attempts map[string][]recentAttemptRow,
+) string {
+	if len(deliveries) == 0 {
+		return ""
+	}
+
+	var slowest time.Duration
+
+	for i := range deliveries {
+		if !deliveries[i].Status.Terminal() {
+			return "in progress"
+		}
+
+		tries := attempts[deliveries[i].ID]
+		if len(tries) == 0 {
+			continue
+		}
+
+		last := tries[len(tries)-1].CreatedAt
+		slowest = max(slowest, last.Sub(deliveries[i].CreatedAt))
+	}
+
+	return slowest.Round(time.Millisecond).String()
+}
+
+// targetStatus is what the target answered for the event, and the
+// colour to show it in: the HTTP status code of the last attempt of
+// the event's newest delivery to the target. Without a code it is
+// "no response" when that attempt failed before a response
+// arrived, the delivery's status ("pending") before any attempt,
+// and "not sent" when the event has no delivery to the target.
+func targetStatus(
+	deliveries []database.Delivery,
+	attempts map[string][]recentAttemptRow,
+	targetID string,
+) (string, string) {
+	newest := -1
+
+	for i := range deliveries {
+		if deliveries[i].TargetID == targetID {
+			newest = i
+		}
+	}
+
+	if newest < 0 {
+		return "not sent", "text-gray-400"
+	}
+
+	tries := attempts[deliveries[newest].ID]
+	if len(tries) == 0 {
+		return string(deliveries[newest].Status), "text-gray-400"
+	}
+
+	code := tries[len(tries)-1].StatusCode
+
+	switch {
+	case code == 0:
+		return "no response", "text-red-600"
+	case code >= http.StatusInternalServerError:
+		return strconv.Itoa(code), "text-red-600"
+	case code >= http.StatusBadRequest:
+		return strconv.Itoa(code), "text-yellow-600"
+	case code >= http.StatusMultipleChoices:
+		return strconv.Itoa(code), "text-gray-500"
+	case code >= http.StatusOK:
+		return strconv.Itoa(code), "text-green-600"
+	default:
+		return strconv.Itoa(code), "text-gray-500"
+	}
+}

internal/handlers/recent_events_test.go

@@ -0,0 +1,362 @@
+package handlers_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// statusTitle marks the status column's cell in a recent events
+// row; it is absent from the page when the column is not shown.
+const statusTitle = `title="HTTP status from the HTTP target"`
+
+// recentEventsFixture is one started app and a webhook whose
+// recent events list a test fills.
+type recentEventsFixture struct {
+	h         *handlers.Handlers
+	sess      *session.Session
+	db        *database.Database
+	webhook   *database.Webhook
+	webhookDB *gorm.DB
+}
+
+func newRecentEventsFixture(t *testing.T) *recentEventsFixture {
+	t.Helper()
+
+	f := &recentEventsFixture{}
+
+	var dbMgr *database.WebhookDBManager
+
+	app := newTestApp(t, &f.h, &f.sess, &f.db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	f.webhook = seedWebhook(t, f.db)
+
+	webhookDB, err := dbMgr.GetDB(f.webhook.ID)
+	require.NoError(t, err)
+
+	f.webhookDB = webhookDB
+
+	return f
+}
+
+func (f *recentEventsFixture) render(t *testing.T) string {
+	t.Helper()
+
+	return renderSourceDetailPage(t, f.h, f.sess, f.webhook.ID)
+}
+
+// event records an event received at receivedAt, with its body's
+// size as the receiver records it.
+func (f *recentEventsFixture) event(
+	t *testing.T, contentType, body string, receivedAt time.Time,
+) *database.Event {
+	t.Helper()
+
+	event := &database.Event{
+		WebhookID:   f.webhook.ID,
+		Method:      http.MethodPost,
+		Body:        body,
+		BodyBytes:   int64(len(body)),
+		ContentType: contentType,
+	}
+	event.CreatedAt = receivedAt
+
+	require.NoError(t, f.webhookDB.Omit(
+		clause.Associations,
+	).Create(event).Error)
+
+	return event
+}
+
+// delivery records a delivery of the event to the target, queued
+// when the event was received.
+func (f *recentEventsFixture) delivery(
+	t *testing.T,
+	event *database.Event,
+	targetID string,
+	status database.DeliveryStatus,
+) *database.Delivery {
+	t.Helper()
+
+	return f.deliveryQueuedAt(
+		t, event, targetID, status, event.CreatedAt,
+	)
+}
+
+// deliveryQueuedAt records a delivery of the event to the target,
+// queued at queuedAt, as a replay is.
+func (f *recentEventsFixture) deliveryQueuedAt(
+	t *testing.T,
+	event *database.Event,
+	targetID string,
+	status database.DeliveryStatus,
+	queuedAt time.Time,
+) *database.Delivery {
+	t.Helper()
+
+	dlv := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: targetID,
+		Status:   status,
+	}
+	dlv.CreatedAt = queuedAt
+
+	require.NoError(t, f.webhookDB.Omit(
+		clause.Associations,
+	).Create(dlv).Error)
+
+	return dlv
+}
+
+// attempt records one attempt of the delivery that finished took
+// after the delivery was queued, with HTTP status code (0 for no
+// response).
+func (f *recentEventsFixture) attempt(
+	t *testing.T, dlv *database.Delivery, code int, took time.Duration,
+) {
+	t.Helper()
+
+	result := &database.DeliveryResult{
+		DeliveryID: dlv.ID,
+		AttemptNum: 1,
+		StatusCode: code,
+	}
+	result.CreatedAt = dlv.CreatedAt.Add(took)
+
+	require.NoError(t, f.webhookDB.Omit(
+		clause.Associations,
+	).Create(result).Error)
+}
+
+// statusCell is the status column's cell as the page renders it.
+func statusCell(class, text string) string {
+	return `<span class="font-medium ` + class + `" ` + statusTitle +
+		`>` + text + `</span>`
+}
+
+// TestHandleSourceDetail_ShowsFiftyNewestEvents proves the list is
+// headed "50 Most Recent Events" and holds the 50 newest events,
+// newest first, and not one more.
+func TestHandleSourceDetail_ShowsFiftyNewestEvents(t *testing.T) {
+	t.Parallel()
+
+	f := newRecentEventsFixture(t)
+	base := time.Now().Add(-time.Hour)
+
+	for i := range 51 {
+		f.event(
+			t, fmt.Sprintf("application/x-recent-%02d", i), "{}",
+			base.Add(time.Duration(i)*time.Second),
+		)
+	}
+
+	body := f.render(t)
+
+	assert.Contains(t, body, ">50 Most Recent Events</h2>")
+	assert.Equal(t, 50, strings.Count(body, `title="Body size"`))
+	assert.NotContains(t, body, "application/x-recent-00")
+	assert.Contains(t, body, "application/x-recent-01")
+	assert.Less(
+		t,
+		strings.Index(body, "application/x-recent-50"),
+		strings.Index(body, "application/x-recent-49"),
+	)
+}
+
+// TestHandleSourceDetail_RecentEventColumns proves a row shows its
+// time relative with the UTC timestamp on hover, its body size,
+// and its processing time once every delivery has finished.
+func TestHandleSourceDetail_RecentEventColumns(t *testing.T) {
+	t.Parallel()
+
+	f := newRecentEventsFixture(t)
+	logTarget := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeLog)
+
+	receivedAt := time.Now().Add(-210 * time.Second).
+		UTC().Truncate(time.Second)
+
+	done := f.event(
+		t, contentTypeJSON, strings.Repeat("x", 2048), receivedAt,
+	)
+	f.attempt(
+		t,
+		f.delivery(t, done, logTarget.ID, database.DeliveryStatusDelivered),
+		0, 1500*time.Millisecond,
+	)
+
+	waiting := f.event(t, "text/plain", "{}", receivedAt)
+	f.delivery(t, waiting, logTarget.ID, database.DeliveryStatusPending)
+
+	body := f.render(t)
+
+	assert.Contains(
+		t, body,
+		`<span title="`+receivedAt.Format(time.DateTime)+
+			` UTC">3 minutes ago</span>`,
+	)
+	assert.Contains(t, body, `<span title="Body size">2.0 kB</span>`)
+	assert.Contains(t, body, ">1.5s</span>")
+	assert.Contains(t, body, ">in progress</span>")
+}
+
+// TestHandleSourceDetail_StatusWithSingleHTTPTarget proves that a
+// webhook with exactly one HTTP target shows, colour-coded, what
+// that target answered for each event. The log target beside it
+// does not count against "exactly one".
+func TestHandleSourceDetail_StatusWithSingleHTTPTarget(t *testing.T) {
+	t.Parallel()
+
+	f := newRecentEventsFixture(t)
+	target := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeHTTP)
+	seedTarget(t, f.db, f.webhook.ID, database.TargetTypeLog)
+
+	now := time.Now()
+
+	for _, code := range []int{204, 302, 404, 503, 0} {
+		dlv := f.delivery(
+			t, f.event(t, contentTypeJSON, "{}", now), target.ID,
+			database.DeliveryStatusDelivered,
+		)
+		f.attempt(t, dlv, code, time.Second)
+	}
+
+	f.delivery(
+		t, f.event(t, contentTypeJSON, "{}", now), target.ID,
+		database.DeliveryStatusPending,
+	)
+	f.event(t, contentTypeJSON, "{}", now)
+
+	// A replay is a newer delivery, and its answer is the one shown.
+	replayed := f.event(t, contentTypeJSON, "{}", now)
+	f.attempt(t, f.delivery(
+		t, replayed, target.ID, database.DeliveryStatusFailed,
+	), 502, time.Second)
+	f.attempt(t, f.deliveryQueuedAt(
+		t, replayed, target.ID, database.DeliveryStatusDelivered,
+		now.Add(time.Minute),
+	), 200, time.Second)
+
+	body := f.render(t)
+
+	assert.Contains(t, body, statusCell("text-green-600", "204"))
+	assert.Contains(t, body, statusCell("text-gray-500", "302"))
+	assert.Contains(t, body, statusCell("text-yellow-600", "404"))
+	assert.Contains(t, body, statusCell("text-red-600", "503"))
+	assert.Contains(t, body, statusCell("text-red-600", "no response"))
+	assert.Contains(t, body, statusCell("text-gray-400", "pending"))
+	assert.Contains(t, body, statusCell("text-gray-400", "not sent"))
+	assert.Contains(t, body, statusCell("text-green-600", "200"))
+	assert.NotContains(t, body, ">502<")
+}
+
+// TestHandleSourceDetail_NoStatusWithoutSingleHTTPTarget proves the
+// status column is absent when the webhook has no HTTP target or
+// more than one.
+func TestHandleSourceDetail_NoStatusWithoutSingleHTTPTarget(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	cases := map[string][]database.TargetType{
+		"none":    {database.TargetTypeLog},
+		"several": {database.TargetTypeHTTP, database.TargetTypeHTTP},
+	}
+
+	for name, types := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			f := newRecentEventsFixture(t)
+			event := f.event(t, contentTypeJSON, "{}", time.Now())
+
+			for _, tt := range types {
+				target := seedTarget(t, f.db, f.webhook.ID, tt)
+				f.attempt(t, f.delivery(
+					t, event, target.ID,
+					database.DeliveryStatusDelivered,
+				), 200, time.Second)
+			}
+
+			body := f.render(t)
+
+			assert.Contains(t, body, `title="Body size"`)
+			assert.NotContains(t, body, statusTitle)
+		})
+	}
+}
+
+// TestHandleWebhook_RecordsBodySize proves the receiver records the
+// body's size in bytes, not characters, with the event it stores.
+func TestHandleWebhook_RecordsBodySize(t *testing.T) {
+	t.Parallel()
+
+	f := newRecentEventsFixture(t)
+	seedEntrypoint(t, f.db, f.webhook.ID)
+
+	// Two bytes per character.
+	body := strings.Repeat("é", 1024)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, "/h/x",
+		strings.NewReader(body),
+	)
+
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("uuid", "ep-"+f.webhook.ID)
+
+	req = req.WithContext(context.WithValue(
+		req.Context(), chi.RouteCtxKey, rctx,
+	))
+
+	w := httptest.NewRecorder()
+	f.h.HandleWebhook().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+
+	var stored database.Event
+
+	require.NoError(t, f.webhookDB.First(&stored).Error)
+	assert.Equal(t, int64(2048), stored.BodyBytes)
+}
+
+// TestHandleSourceDetail_FailedLoadIsAnError proves that when the
+// list cannot be loaded the page answers with an error, rather than
+// an empty list claiming the webhook has no events.
+func TestHandleSourceDetail_FailedLoadIsAnError(t *testing.T) {
+	t.Parallel()
+
+	f := newRecentEventsFixture(t)
+	target := seedTarget(t, f.db, f.webhook.ID, database.TargetTypeHTTP)
+
+	f.attempt(t, f.delivery(
+		t, f.event(t, contentTypeJSON, "{}", time.Now()), target.ID,
+		database.DeliveryStatusDelivered,
+	), 200, time.Second)
+
+	// The attempts are the list's last query, so its events and
+	// deliveries have already loaded when it fails.
+	require.NoError(t, f.webhookDB.Exec(
+		"DROP TABLE delivery_results",
+	).Error)
+
+	w := serveSourceDetailPage(t, f.h, f.sess, f.webhook.ID)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.NotContains(t, w.Body.String(), "No events received yet.")
+}

internal/handlers/source_delete_test.go

@@ -15,6 +15,7 @@ import (
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/session"
 )
@@ -79,6 +80,10 @@ func seedTarget(
 // from a delete statement.
 var errInjectedDelete = errors.New("injected delete failure")
 
+// errInjectedSave is the failure failSaveOnTable reports from a
+// save of an existing row.
+var errInjectedSave = errors.New("injected save failure")
+
 // seedEntrypoint inserts an entrypoint for a webhook.
 func seedEntrypoint(
 	t *testing.T,
@@ -146,19 +151,42 @@ func failDeleteOnTable(
 	)
 }
 
+// failSaveOnTable is failDeleteOnTable for saves: every update of
+// an existing row in the named table fails.
+func failSaveOnTable(
+	t *testing.T,
+	db *database.Database,
+	table string,
+) {
+	t.Helper()
+
+	require.NoError(t, db.DB().Callback().Update().
+		Before("gorm:update").
+		Register(
+			"test:fail_save_"+table,
+			func(tx *gorm.DB) {
+				if tx.Statement.Table == table {
+					_ = tx.AddError(errInjectedSave)
+				}
+			},
+		),
+	)
+}
+
 // archivePathFor returns the archive database path the
-// delivery engine would use for a webhook: beside the webhook's
+// delivery engine would use for a database target: beside the
-// event database in the data directory.
+// webhook's event database in the data directory.
 func archivePathFor(
 	t *testing.T,
 	mgr *database.WebhookDBManager,
-	webhookID string,
+	wh *database.Webhook,
+	tgt *database.Target,
 ) string {
 	t.Helper()
 
 	return filepath.Join(
-		filepath.Dir(mgr.DBPath(webhookID)),
+		filepath.Dir(mgr.DBPath(wh.ID)),
-		"archive-"+webhookID+".db",
+		delivery.ArchiveFileName(wh.Name, tgt.Name, tgt.ID),
 	)
 }
 
@@ -195,8 +223,8 @@ func postRequest(
 
 // TestHandleSourceDelete_EvictsArchiveWriter proves that
 // deleting a webhook reaches the delivery engine and releases
-// the webhook's archive writer, exercised through the real
+// the webhook's archive writers, exercised through the real
-// deletion handler rather than by calling the evictor directly.
+// deletion handler rather than by calling the engine directly.
 func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
 	t.Parallel()
 
@@ -204,7 +232,7 @@ func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
 		h    *handlers.Handlers
 		sess *session.Session
 		db   *database.Database
-		ev   *recordingEvictor
+		ev   *recordingArchives
 	)
 
 	app := newTestApp(t, &h, &sess, &db, &ev)
@@ -220,7 +248,7 @@ func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -254,9 +282,10 @@ func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
 	t.Cleanup(app.RequireStop)
 
 	wh := seedWebhook(t, db)
+	tgt := seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
 
 	// Place an archive file where the delivery engine would.
-	archivePath := archivePathFor(t, mgr, wh.ID)
+	archivePath := archivePathFor(t, mgr, wh, tgt)
 	require.NoError(
 		t,
 		writeArchivePlaceholder(archivePath),
@@ -267,7 +296,7 @@ func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -323,7 +352,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -337,7 +366,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)
 	assert.Empty(
 		t, w.Header().Get("Location"),
-		"a failed deletion must not redirect to /sources",
+		"a failed deletion must not redirect to /hooks",
 	)
 
 	assert.Equal(
@@ -402,7 +431,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -411,7 +440,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	h.HandleSourceDelete().ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/sources", w.Header().Get("Location"))
+	assert.Equal(t, "/hooks", w.Header().Get("Location"))
 
 	assert.Equal(
 		t, int64(0),
@@ -435,68 +464,17 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	)
 }
 
-// TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone
+// TestHandleTargetDelete_EvictsThatTarget proves that deleting a
-// proves that removing the last database target releases the
+// database target releases that target's archive writer and no
-// archive writer.
+// other: the webhook's other database target keeps its own.
-func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
+func TestHandleTargetDelete_EvictsThatTarget(t *testing.T) {
-	t *testing.T,
-) {
 	t.Parallel()
 
 	var (
 		h    *handlers.Handlers
 		sess *session.Session
 		db   *database.Database
-		ev   *recordingEvictor
+		ev   *recordingArchives
-	)
-
-	app := newTestApp(t, &h, &sess, &db, &ev)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	wh := seedWebhook(t, db)
-	tgt := seedTarget(
-		t, db, wh.ID, database.TargetTypeDatabase,
-	)
-
-	cookies := authenticatedCookies(
-		t, sess, deleteTestUserID, deleteTestUsername,
-	)
-
-	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete",
-		cookies,
-		map[string]string{
-			paramSourceID: wh.ID,
-			paramTargetID: tgt.ID,
-		},
-	)
-	w := httptest.NewRecorder()
-
-	h.HandleTargetDelete().ServeHTTP(w, req)
-
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, []string{wh.ID}, ev.Evicted(),
-		"removing the last database target should evict",
-	)
-}
-
-// TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains
-// proves that deleting one of several database targets leaves
-// the still-needed archive writer alone: the surviving target
-// keeps archiving to the same file, so the writer must stay.
-func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	var (
-		h    *handlers.Handlers
-		sess *session.Session
-		db   *database.Database
-		ev   *recordingEvictor
 	)
 
 	app := newTestApp(t, &h, &sess, &db, &ev)
@@ -515,7 +493,7 @@ func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+doomed.ID+"/delete",
+		"/hook/"+wh.ID+"/targets/"+doomed.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -527,17 +505,17 @@ func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
 	h.HandleTargetDelete().ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Empty(
+	assert.Equal(
-		t, ev.Evicted(),
+		t, []string{doomed.ID}, ev.EvictedTargets(),
-		"a second database target still needs the writer",
+		"deleting a database target should evict its writer",
 	)
+	assert.Empty(t, ev.Evicted(), "the webhook is not deleted")
 }
 
-// TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted proves
+// TestHandleTargetDelete_IgnoresAnotherWebhooksTarget proves that
-// that deleting a target of an unrelated type leaves a
+// a target id from the URL that is not a target of the webhook
-// still-needed archive writer alone: the webhook's database
+// deletes nothing and so evicts nothing.
-// target is untouched, so its writer must stay.
+func TestHandleTargetDelete_IgnoresAnotherWebhooksTarget(
-func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -546,7 +524,7 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 		h    *handlers.Handlers
 		sess *session.Session
 		db   *database.Database
-		ev   *recordingEvictor
+		ev   *recordingArchives
 	)
 
 	app := newTestApp(t, &h, &sess, &db, &ev)
@@ -555,19 +533,20 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 	t.Cleanup(app.RequireStop)
 
 	wh := seedWebhook(t, db)
-	seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
+	elsewhere := seedTarget(
-	other := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+		t, db, seedWebhook(t, db).ID, database.TargetTypeDatabase,
+	)
 
 	cookies := authenticatedCookies(
 		t, sess, deleteTestUserID, deleteTestUsername,
 	)
 
 	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+other.ID+"/delete",
+		"/hook/"+wh.ID+"/targets/"+elsewhere.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
-			paramTargetID: other.ID,
+			paramTargetID: elsewhere.ID,
 		},
 	)
 	w := httptest.NewRecorder()
@@ -576,7 +555,7 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Empty(
-		t, ev.Evicted(),
+		t, ev.EvictedTargets(),
-		"a surviving database target must keep its writer",
+		"another webhook's target must not be evicted",
 	)
 }

internal/handlers/source_detail_baseurl_test.go

@@ -81,7 +81,7 @@ func (f *baseURLFixture) entrypointURL(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+f.webhook,
+		"/hook/"+f.webhook,
 		nil,
 	)
 	req.Host = host
@@ -213,7 +213,7 @@ func TestSourceDetailBaseURL_ForwardedProtoSpellings(t *testing.T) {
 
 			assert.Equal(
 				t,
-				tc.scheme+"://"+host+"/webhook/"+fixture.path,
+				tc.scheme+"://"+host+"/h/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto(tc.header),
 				),
@@ -244,7 +244,7 @@ func TestSourceDetailBaseURL_DirectTLSBeatsPlaintextHeader(
 
 	assert.Equal(
 		t,
-		"https://"+host+"/webhook/"+fixture.path,
+		"https://"+host+"/h/"+fixture.path,
 		got,
 		"a connection this process terminated with TLS "+
 			"outranks a header claiming plaintext",
@@ -272,7 +272,7 @@ func TestSourceDetailBaseURL_KeepsHostAuthority(t *testing.T) {
 
 			assert.Equal(
 				t,
-				"https://"+host+"/webhook/"+fixture.path,
+				"https://"+host+"/h/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto("HTTPS"),
 				),

internal/handlers/source_detail_test.go

@@ -62,10 +62,27 @@ func renderSourceDetailPage(
 ) string {
 	t.Helper()
 
+	w := serveSourceDetailPage(t, h, sess, webhookID)
+
+	require.Equal(t, http.StatusOK, w.Code)
+
+	return w.Body.String()
+}
+
+// serveSourceDetailPage runs the real source detail handler for a
+// webhook and returns its response, whatever its status.
+func serveSourceDetailPage(
+	t *testing.T,
+	h *handlers.Handlers,
+	sess *session.Session,
+	webhookID string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+webhookID,
+		"/hook/"+webhookID,
 		nil,
 	)
 
@@ -87,9 +104,7 @@ func renderSourceDetailPage(
 	w := httptest.NewRecorder()
 	h.HandleSourceDetail().ServeHTTP(w, req)
 
-	require.Equal(t, http.StatusOK, w.Code)
+	return w
-
-	return w.Body.String()
 }
 
 // TestHandleSourceDetail_MasksSlackWebhookURL is the
@@ -226,3 +241,37 @@ func TestHandleSourceDetail_RendersNamedTargetFields(
 	assert.Contains(t, body, "(unavailable)")
 	assert.NotContains(t, body, "beak")
 }
+
+// TestHandleSourceDetail_FitsWideAndNarrowWindows pins the webhook
+// page's maximum width at 108rem (1728 px), half again the 72rem of
+// max-w-6xl that the webhook list and the event log use, so an
+// entrypoint URL fits on one line in a 1920-pixel window; and the
+// wrapping of its title row, so the buttons beside the title do not
+// push a phone-width window into scrolling sideways.
+func TestHandleSourceDetail_FitsWideAndNarrowWindows(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+	)
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	body := renderSourceDetailPage(t, h, sess, wh.ID)
+
+	assert.Contains(
+		t, body,
+		`<div class="mx-auto px-6 py-8" style="max-width: 108rem"`,
+	)
+	assert.Contains(
+		t, body,
+		`<div class="flex flex-wrap justify-between items-center gap-2 mt-2">`,
+	)
+}

internal/handlers/source_logs_deleted_target_test.go

@@ -28,7 +28,7 @@ func deleteTargetThroughHandler(
 	t.Helper()
 
 	req := postRequest(
-		"/source/"+webhookID+"/targets/"+targetID+"/delete",
+		"/hook/"+webhookID+"/targets/"+targetID+"/delete",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),

internal/handlers/source_logs_test.go

@@ -84,7 +84,7 @@ func renderSourceLogsPageWithQuery(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+webhookID+"/logs"+query,
+		"/hook/"+webhookID+"/events"+query,
 		nil,
 	)
 

internal/handlers/source_management.go

@@ -149,13 +149,7 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 			"user_id = ?", userID,
 		).Order("created_at DESC").Find(&webhooks).Error
 		if err != nil {
-			h.log.Error(
+			h.serverError(w, r, "failed to list webhooks", err)
-				"failed to list webhooks", "error", err,
-			)
-			http.Error(
-				w, "Internal server error",
-				http.StatusInternalServerError,
-			)
 
 			return
 		}
@@ -249,9 +243,7 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -311,7 +303,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
 
 	err := h.commitWebhook(webhook)
 	if err != nil {
-		h.serverError(w, "failed to create webhook", err)
+		h.serverError(w, r, "failed to create webhook", err)
 
 		return
 	}
@@ -330,7 +322,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
 	)
 
 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -388,7 +380,7 @@ func (h *Handlers) HandleSourceDetail() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -415,16 +407,23 @@ func (h *Handlers) renderSourceDetail(
 		"webhook_id = ?", webhook.ID,
 	).Find(&targets)
 
-	var events []database.Event
+	var events []RecentEventView
 
 	if h.dbMgr.DBExists(webhook.ID) {
-		webhookDB, dbErr := h.dbMgr.GetDB(webhook.ID)
+		webhookDB, err := h.dbMgr.GetDB(webhook.ID)
-		if dbErr == nil {
+		if err != nil {
-			webhookDB.Where(
+			h.serverError(w, r, "failed to get webhook database", err)
-				"webhook_id = ?", webhook.ID,
+
-			).Order("created_at DESC").Limit(
+			return
-				recentEventLimit,
+		}
-			).Find(&events)
+
+		events, err = loadRecentEvents(
+			webhookDB, webhook.ID, singleHTTPTargetID(targets),
+		)
+		if err != nil {
+			h.serverError(w, r, "failed to load recent events", err)
+
+			return
 		}
 	}
 
@@ -450,6 +449,7 @@ func (h *Handlers) renderSourceDetail(
 		"Targets":     delivery.NewTargetViews(targets),
 		"Events":      events,
 		"BaseURL":     baseURL,
+		"Stats":       h.loadWebhookStats(webhook.ID, entrypoints, targets),
 	}
 
 	h.renderTemplate(w, r, "source_detail.html", data)
@@ -475,7 +475,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -510,7 +510,7 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -519,9 +519,7 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -551,6 +549,7 @@ func (h *Handlers) applyWebhookEdit(
 		return
 	}
 
+	oldName := webhook.Name
 	webhook.Name = name
 	webhook.Description = r.PostFormValue("description")
 
@@ -573,15 +572,47 @@ func (h *Handlers) applyWebhookEdit(
 
 	webhook.RetentionDays = retentionDays
 
-	err := h.db.DB().Save(webhook).Error
+	// A new name renames the archive files before it is saved (see
+	// delivery.Engine.Rename). If either step fails, they go back to
+	// the name that is still stored.
+	err := h.renameWebhookArchives(webhook.ID, oldName, webhook.Name)
+	if err == nil {
+		err = h.db.DB().Save(webhook).Error
+	}
+
 	if err != nil {
-		h.serverError(w, "failed to update webhook", err)
+		restoreErr := h.renameWebhookArchives(
+			webhook.ID, webhook.Name, oldName,
+		)
+		if restoreErr != nil {
+			h.log.Error(
+				"failed to rename archives back",
+				"webhook_id", webhook.ID,
+				"error", restoreErr,
+			)
+		}
+
+		if errors.Is(err, delivery.ErrArchiveNameTaken) {
+			data := map[string]any{
+				tmplKeyWebhook: webhook,
+				tmplKeyError: "Not saved: " + err.Error() +
+					". Move that file out of the data directory, " +
+					"then save again.",
+			}
+
+			w.WriteHeader(http.StatusConflict)
+			h.renderTemplate(w, r, "source_edit.html", data)
+
+			return
+		}
+
+		h.serverError(w, r, "failed to update webhook", err)
 
 		return
 	}
 
 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -605,7 +636,7 @@ func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -632,7 +663,7 @@ func (h *Handlers) deleteWebhookResources(
 	// be removed by hand; deleted history cannot be recovered.
 	err := h.commitWebhookDeletion(&webhook)
 	if err != nil {
-		h.serverError(w, "failed to delete webhook", err)
+		h.serverError(w, r, "failed to delete webhook", err)
 
 		return
 	}
@@ -658,13 +689,13 @@ func (h *Handlers) deleteWebhookResources(
 		// redirecting as though everything succeeded: the file
 		// needs removing by hand, and the logged error names it.
 		h.serverError(
-			w, "failed to delete webhook event database", err,
+			w, r, "failed to delete webhook event database", err,
 		)
 
 		return
 	}
 
-	http.Redirect(w, r, "/sources", http.StatusSeeOther)
+	http.Redirect(w, r, "/hooks", http.StatusSeeOther)
 }
 
 // commitWebhookDeletion soft-deletes a webhook's entrypoints,
@@ -709,11 +740,11 @@ func (h *Handlers) commitWebhookDeletion(
 	return tx.Commit().Error
 }
 
-// evictArchiveWriter asks the delivery engine to drop its
+// evictArchiveWriter asks the delivery engine to drop the cached
-// cached archive writer for a webhook, closing the archive file
+// archive writers of a webhook's database targets, closing their
-// handle.
+// archive file handles.
 //
-// The archive database file is NOT deleted. Unlike the event
+// The archive database files are NOT deleted. Unlike the event
 // database — which is per-webhook working storage and is
 // hard-deleted with the webhook — an archive is explicitly
 // long-term storage that an operator may want to keep or move
@@ -721,50 +752,58 @@ func (h *Handlers) commitWebhookDeletion(
 // deleting a webhook would be a surprising and unrecoverable
 // data loss, so the file is left for the operator to handle.
 func (h *Handlers) evictArchiveWriter(webhookID string) {
-	if h.evictor == nil {
+	if h.archives == nil {
 		return
 	}
 
-	h.evictor.EvictWebhook(webhookID)
+	h.archives.EvictWebhook(webhookID)
 }
 
-// evictArchiveWriterIfUnused releases a webhook's archive
+// evictTargetArchiveWriter is evictArchiveWriter for one deleted
-// writer once the webhook has no database target left to feed
+// target, and leaves its archive file on disk for the same reason.
-// it.
+// A target that is not a database target has no writer, and
-//
+// evicting it does nothing.
-// It is called after any child resource of a webhook is
+func (h *Handlers) evictTargetArchiveWriter(targetID string) {
-// deleted, and is correct without knowing which kind was: it
+	if h.archives == nil {
-// evicts only when no database target remains, so deleting one
+		return
-// of several database targets — or deleting an unrelated
+	}
-// target type — leaves a still-needed writer alone. When no
+
-// database target ever existed there is no writer and eviction
+	h.archives.EvictTarget(targetID)
-// is a no-op. Soft-deleted targets are excluded by GORM's
+}
-// default scope, so the row just deleted is not counted.
+
-func (h *Handlers) evictArchiveWriterIfUnused(webhookID string) {
+// renameWebhookArchives renames the archive file of every database
-	var remaining int64
+// target of a webhook from the webhook name oldName to newName,
+// keeping each target's own name. It does nothing when the name is
+// unchanged, and stops at the first failure.
+func (h *Handlers) renameWebhookArchives(
+	webhookID, oldName, newName string,
+) error {
+	if h.archives == nil || oldName == newName {
+		return nil
+	}
+
+	var targets []database.Target
 
 	err := h.db.DB().
-		Model(&database.Target{}).
 		Where(
 			"webhook_id = ? AND type = ?",
 			webhookID, database.TargetTypeDatabase,
 		).
-		Count(&remaining).Error
+		Find(&targets).Error
 	if err != nil {
-		h.log.Error(
+		return err
-			"failed to count remaining database targets",
+	}
-			"webhook_id", webhookID,
+
-			"error", err,
+	for i := range targets {
+		err = h.archives.Rename(
+			targets[i].ID, newName, targets[i].Name,
 		)
-
+		if err != nil {
-		return
+			return err
+		}
 	}
 
-	if remaining > 0 {
+	return nil
-		return
-	}
-
-	h.evictArchiveWriter(webhookID)
 }
 
 // ownedWebhook resolves the request's sourceID parameter to a
@@ -802,7 +841,7 @@ func (h *Handlers) ownedWebhook(
 		"id = ? AND user_id = ?", sourceID, userID,
 	).First(&webhook).Error
 	if err != nil {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return database.Webhook{}, false
 	}
@@ -824,7 +863,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 			// Without the map every delivery renders through a
 			// zero redactor, so failing the page is the only
 			// safe answer.
-			h.serverError(w, "failed to load targets", err)
+			h.serverError(w, r, "failed to load targets", err)
 
 			return
 		}
@@ -832,7 +871,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		page := h.parsePage(r)
 
 		evts, total, ok := h.loadEventsWithDeliveries(
-			w, webhook, targets, page,
+			w, r, webhook, targets, page,
 		)
 		if !ok {
 			return
@@ -942,6 +981,7 @@ func (h *Handlers) parsePage(r *http.Request) int {
 // caller must then render nothing further.
 func (h *Handlers) loadEventsWithDeliveries(
 	w http.ResponseWriter,
+	r *http.Request,
 	webhook database.Webhook,
 	targetMap map[string]eventLogTarget,
 	page int,
@@ -955,7 +995,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
 		h.serverError(
-			w, "failed to get webhook database", err,
+			w, r, "failed to get webhook database", err,
 		)
 
 		return nil, 0, false
@@ -992,7 +1032,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	)
 	if err != nil {
 		h.serverError(
-			w, "failed to load delivery attempts", err,
+			w, r, "failed to load delivery attempts", err,
 		)
 
 		return nil, 0, false
@@ -1001,7 +1041,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	resubmits, err := resubmitCounts(webhookDB, eventIDs)
 	if err != nil {
 		h.serverError(
-			w, "failed to count event resubmissions", err,
+			w, r, "failed to count event resubmissions", err,
 		)
 
 		return nil, 0, false
@@ -1224,7 +1264,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -1233,9 +1273,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -1251,13 +1289,13 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 
 		err = h.db.DB().Create(entrypoint).Error
 		if err != nil {
-			h.serverError(w, "failed to create entrypoint", err)
+			h.serverError(w, r, "failed to create entrypoint", err)
 
 			return
 		}
 
 		http.Redirect(
-			w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+			w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 		)
 	}
 }
@@ -1282,7 +1320,7 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -1291,9 +1329,7 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -1313,7 +1349,7 @@ func (h *Handlers) processTargetCreate(
 	//
 	// Every field here is read with PostFormValue, not FormValue.
 	// FormValue falls back to the query string, which would let
-	// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
+	// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
 	// configure a target from a value the request line carries — and
 	// the request line, unlike the body, is what logs, proxies,
 	// Referer headers and error trackers record.
@@ -1364,13 +1400,13 @@ func (h *Handlers) processTargetCreate(
 
 	err = h.db.DB().Create(target).Error
 	if err != nil {
-		h.serverError(w, "failed to create target", err)
+		h.serverError(w, r, "failed to create target", err)
 
 		return
 	}
 
 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
@@ -1428,7 +1464,7 @@ type targetFormInput struct {
 //
 // Every field is read with PostFormValue, not FormValue. FormValue
 // falls back to the query string, which would let
-// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
+// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
 // configure a target from a value the request line carries — and the
 // request line, unlike the body, is what logs, proxies, Referer
 // headers and error trackers record. The headers field is under the
@@ -1458,7 +1494,7 @@ func (h *Handlers) buildTargetConfig(
 	case database.TargetTypeSlack:
 		return h.buildSlackTargetConfig(w, r, in.URL)
 	case database.TargetTypeDatabase:
-		return h.buildDatabaseTargetConfig(w, in.Expiry)
+		return h.buildDatabaseTargetConfig(w, r, in.Expiry)
 	case database.TargetTypeLog:
 		return "", nil
 	default:
@@ -1508,7 +1544,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 		return "", err
 	}
 
-	return marshalTargetConfig(w, delivery.HTTPTargetConfig{
+	return h.marshalTargetConfig(w, r, delivery.HTTPTargetConfig{
 		URL:     in.URL,
 		Headers: headers,
 		Timeout: timeout,
@@ -1530,7 +1566,7 @@ func (h *Handlers) buildSlackTargetConfig(
 		return "", err
 	}
 
-	return marshalTargetConfig(w, delivery.SlackTargetConfig{
+	return h.marshalTargetConfig(w, r, delivery.SlackTargetConfig{
 		WebhookURL: targetURL,
 	})
 }
@@ -1570,11 +1606,22 @@ func (h *Handlers) validateTargetURL(
 			"url", delivery.MaskURL(targetURL),
 			"error", err,
 		)
-		http.Error(
+
-			w,
+		msg := "Invalid target URL: " + err.Error()
-			"Invalid target URL: "+err.Error(),
+
-			http.StatusBadRequest,
+		// Only a private or reserved address's refusal says how
-		)
+		// to allow it. Metadata refusals never do: link-local and
+		// the other unconditional metadata addresses cannot be
+		// opened, and the default blocklist's public addresses,
+		// which listing does open, hand out credentials.
+		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
+			msg += ". Private and reserved addresses are refused " +
+				"by default; the server's ALLOWED_EGRESS_CIDRS " +
+				"setting allows named networks (see \"Allowing " +
+				"egress to your own network\" in the README)."
+		}
+
+		http.Error(w, msg, http.StatusBadRequest)
 
 		return err
 	}
@@ -1584,16 +1631,14 @@ func (h *Handlers) validateTargetURL(
 
 // marshalTargetConfig serialises a target configuration for storage,
 // writing a 500 itself if it cannot.
-func marshalTargetConfig(
+func (h *Handlers) marshalTargetConfig(
 	w http.ResponseWriter,
+	r *http.Request,
 	cfg any,
 ) (string, error) {
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
-		http.Error(
+		h.serverError(w, r, "failed to encode target config", err)
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
 
 		return "", err
 	}
@@ -1609,6 +1654,7 @@ func marshalTargetConfig(
 // expiry yields an empty config (the keep-forever default).
 func (h *Handlers) buildDatabaseTargetConfig(
 	w http.ResponseWriter,
+	r *http.Request,
 	expiry string,
 ) (string, error) {
 	expiry = strings.TrimSpace(expiry)
@@ -1627,8 +1673,8 @@ func (h *Handlers) buildDatabaseTargetConfig(
 		return "", err
 	}
 
-	return marshalTargetConfig(
+	return h.marshalTargetConfig(
-		w, map[string]any{"expiry": expiry},
+		w, r, map[string]any{"expiry": expiry},
 	)
 }
 
@@ -1641,27 +1687,26 @@ func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
 	)
 }
 
-// HandleTargetDelete handles deleting a target. Deleting the
+// HandleTargetDelete handles deleting a target. A deleted
-// last database target of a webhook leaves its archive writer
+// database target's archive writer is evicted and its handle
-// with nothing to write, so the writer is evicted and its
+// closed; the archive file is left on disk.
-// handle closed; the archive file is left on disk.
 func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"targetID", &database.Target{},
 		"failed to delete target",
-		h.evictArchiveWriterIfUnused,
+		h.evictTargetArchiveWriter,
 	)
 }
 
 // deleteChildResource returns a handler that deletes a child
 // resource (entrypoint or target) belonging to a webhook. The
-// optional afterDelete hook runs with the webhook's id once the
+// optional afterDelete hook runs with the child's id once the
-// delete has succeeded, before the redirect.
+// delete has removed it, before the redirect.
 func (h *Handlers) deleteChildResource(
 	idParam string,
 	model any,
 	errMsg string,
-	afterDelete func(webhookID string),
+	afterDelete func(childID string),
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1682,7 +1727,7 @@ func (h *Handlers) deleteChildResource(
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
@@ -1692,22 +1737,20 @@ func (h *Handlers) deleteChildResource(
 			childID, webhook.ID,
 		).Delete(model)
 		if result.Error != nil {
-			h.log.Error(errMsg, "error", result.Error)
+			h.serverError(w, r, errMsg, result.Error)
-			http.Error(
-				w, "Internal server error",
-				http.StatusInternalServerError,
-			)
 
 			return
 		}
 
-		if afterDelete != nil {
+		// Only for a row this webhook really had: the id came from
-			afterDelete(webhook.ID)
+		// the URL and may name another webhook's child.
+		if afterDelete != nil && result.RowsAffected > 0 {
+			afterDelete(childID)
 		}
 
 		http.Redirect(
 			w, r,
-			"/source/"+webhook.ID,
+			"/hook/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}
@@ -1786,25 +1829,21 @@ func (h *Handlers) toggleChildResource(
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			http.NotFound(w, r)
+			h.renderError(w, r, http.StatusNotFound)
 
 			return
 		}
 
 		err = toggleFn(webhook.ID, childID)
 		if err != nil {
-			h.log.Error(errMsg, "error", err)
+			h.serverError(w, r, errMsg, err)
-			http.Error(
-				w, "Internal server error",
-				http.StatusInternalServerError,
-			)
 
 			return
 		}
 
 		http.Redirect(
 			w, r,
-			"/source/"+webhook.ID,
+			"/hook/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}

internal/handlers/source_management_test.go

@@ -105,7 +105,7 @@ func submitCreate(
 		form.Set("retention_days", *retention)
 	}
 
-	req := formRequest("/sources/new", cookies, form, nil)
+	req := formRequest("/hooks/new", cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -187,6 +187,7 @@ func storedRetentionDays(
 type sourceTestEnv struct {
 	handlers *handlers.Handlers
 	db       *database.Database
+	archives *recordingArchives
 	cookies  []*http.Cookie
 }
 
@@ -199,7 +200,9 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 
 	var db *database.Database
 
-	app := newTestApp(t, &h, &sess, &db)
+	var archives *recordingArchives
+
+	app := newTestApp(t, &h, &sess, &db, &archives)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -207,6 +210,7 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 	return &sourceTestEnv{
 		handlers: h,
 		db:       db,
+		archives: archives,
 		cookies: authenticatedCookies(
 			t, sess, sourceTestUserID, "sourceuser",
 		),
@@ -265,7 +269,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/sources/new", env.cookies, nil),
+		w, getRequest(t, "/hooks/new", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, w.Code)
@@ -402,7 +406,7 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	form.Set("description", description)
 	form.Set("retention_days", "nonsense")
 
-	req := formRequest("/sources/new", env.cookies, form, nil)
+	req := formRequest("/hooks/new", env.cookies, form, nil)
 	w := httptest.NewRecorder()
 
 	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -430,7 +434,7 @@ func submitEdit(
 	form.Set("retention_days", retention)
 
 	req := formRequest(
-		"/source/"+wh.ID+"/edit",
+		"/hook/"+wh.ID+"/edit",
 		env.cookies,
 		form,
 		map[string]string{sourceIDParam: wh.ID},
@@ -498,6 +502,142 @@ func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
 }
 
+// renamedWebhookName is the name the rename tests give a webhook.
+const renamedWebhookName = "Renamed"
+
+// TestHandleSourceEditSubmit_RenamesArchives proves that a save
+// that keeps the webhook's name renames nothing, and that renaming a
+// webhook renames the archive of each of its database targets and
+// asks nothing of its other targets.
+func TestHandleSourceEditSubmit_RenamesArchives(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	first := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	second := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	seedTarget(t, env.db, wh.ID, database.TargetTypeLog)
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Empty(t, env.archives.Renames())
+
+	wh.Name = renamedWebhookName
+
+	w = submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	assert.ElementsMatch(
+		t,
+		[]archiveRename{
+			{first.ID, renamedWebhookName, first.Name},
+			{second.ID, renamedWebhookName, second.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedRenameKeepsTheName proves that a
+// webhook whose archive cannot be renamed keeps its stored name, so
+// the name on disk and the name in the UI do not part, and that the
+// handler puts back what it may already have moved.
+func TestHandleSourceEditSubmit_FailedRenameKeepsTheName(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(errInjectedRename)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_FailedSaveRenamesBack proves that when
+// the archive is renamed but the new name cannot be saved, the
+// archive is renamed back to the stored name and the stored name
+// stays.
+func TestHandleSourceEditSubmit_FailedSaveRenamesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	tgt := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	failSaveOnTable(t, env.db, "webhooks")
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{tgt.ID, renamedWebhookName, tgt.Name},
+			{tgt.ID, oldName, tgt.Name},
+		},
+		env.archives.Renames(),
+	)
+}
+
+// TestHandleSourceEditSubmit_ArchiveNameTaken proves that when a file
+// already has an archive's new name, the edit is refused with an
+// error naming that file, and the webhook keeps its stored name.
+func TestHandleSourceEditSubmit_ArchiveNameTaken(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	env.archives.FailRenames(errNameTaken)
+
+	oldName := wh.Name
+	wh.Name = renamedWebhookName
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusConflict, w.Code)
+	assert.Contains(t, w.Body.String(), "archive-taken.db")
+
+	var stored database.Webhook
+
+	require.NoError(
+		t, env.db.DB().First(&stored, "id = ?", wh.ID).Error,
+	)
+	assert.Equal(t, oldName, stored.Name)
+}
+
 // TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
 // the removed max="365" cap used to break: render the edit form for a
 // retain-forever webhook, confirm the pre-filled sentinel is not capped
@@ -512,7 +652,7 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	)
 
 	req := getRequest(
-		t, "/source/"+wh.ID+"/edit", env.cookies,
+		t, "/hook/"+wh.ID+"/edit", env.cookies,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
@@ -567,7 +707,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 
 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/sources", env.cookies, nil),
+		listW, getRequest(t, "/hooks", env.cookies, nil),
 	)
 
 	require.Equal(t, http.StatusOK, listW.Code)
@@ -578,7 +718,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 	env.handlers.HandleSourceDetail().ServeHTTP(
 		detailW,
 		getRequest(
-			t, "/source/"+wh.ID, env.cookies,
+			t, "/hook/"+wh.ID, env.cookies,
 			map[string]string{sourceIDParam: wh.ID},
 		),
 	)

internal/handlers/target_create_query_test.go

@@ -76,11 +76,11 @@ func postTargetCreate(
 	router := chi.NewRouter()
 	router.Use(mw.Logging())
 	router.Post(
-		"/source/{sourceID}/targets",
+		"/hook/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)
 
-	target := "/source/" + webhookID + "/targets"
+	target := "/hook/" + webhookID + "/targets"
 	if query != "" {
 		target += "?" + query
 	}
@@ -114,7 +114,7 @@ func postTargetCreate(
 // regression test for the ingress leak. r.FormValue falls back to the
 // query string when a field is absent from the POST body, so
 //
-//	POST /source/{id}/targets?url=https://hooks.slack.com/services/...
+//	POST /hook/{id}/targets?url=https://hooks.slack.com/services/...
 //
 // with an empty url field used to create a working target from a value
 // carried on the request line — where logs, proxies, Referer headers

internal/handlers/target_edit.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"errors"
 	"net/http"
 
 	"github.com/go-chi/chi"
@@ -47,7 +48,7 @@ type targetEditView struct {
 //
 // This page is the one place the full destination URL and header
 // values are shown. It is reachable only through the
-// /source/{sourceID} route group, which supplies RequireAuth and
+// /hook/{sourceID} route group, which supplies RequireAuth and
 // NoCache, and only for a target of a webhook the session's user
 // owns; masking (delivery.TargetView) is unchanged everywhere else.
 func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
@@ -88,9 +89,7 @@ func (h *Handlers) HandleTargetEditSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			http.Error(
+			h.renderError(w, r, http.StatusBadRequest)
-				w, "Bad request", http.StatusBadRequest,
-			)
 
 			return
 		}
@@ -152,21 +151,67 @@ func (h *Handlers) applyTargetEdit(
 		target.MaxRetries = retries
 	}
 
+	oldName := target.Name
 	target.Name = name
 	target.Config = configJSON
 
+	// A new name renames the archive file before it is saved (see
+	// delivery.Engine.Rename). If either step fails, it goes back to
+	// the name that is still stored.
+	err = h.renameTargetArchive(target, webhook.Name, oldName, name)
+	if err == nil {
 		err = h.db.DB().Save(target).Error
+	}
+
 	if err != nil {
-		h.serverError(w, "failed to update target", err)
+		restoreErr := h.renameTargetArchive(
+			target, webhook.Name, name, oldName,
+		)
+		if restoreErr != nil {
+			h.log.Error(
+				"failed to rename archive back",
+				"target_id", target.ID,
+				"error", restoreErr,
+			)
+		}
+
+		if errors.Is(err, delivery.ErrArchiveNameTaken) {
+			http.Error(
+				w,
+				"Not saved: "+err.Error()+
+					". Move that file out of the data directory, "+
+					"then save again.",
+				http.StatusConflict,
+			)
+
+			return
+		}
+
+		h.serverError(w, r, "failed to update target", err)
 
 		return
 	}
 
 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }
 
+// renameTargetArchive renames a database target's archive file from
+// the target name oldName to newName. It does nothing when the name
+// is unchanged; other target types have no archive.
+func (h *Handlers) renameTargetArchive(
+	target *database.Target,
+	webhookName, oldName, newName string,
+) error {
+	if h.archives == nil || oldName == newName ||
+		target.Type != database.TargetTypeDatabase {
+		return nil
+	}
+
+	return h.archives.Rename(target.ID, webhookName, newName)
+}
+
 // renderTargetEdit renders the target edit page with an optional
 // error message.
 func (h *Handlers) renderTargetEdit(
@@ -220,7 +265,7 @@ func (h *Handlers) ownedTarget(
 		chi.URLParam(r, "targetID"), webhook.ID,
 	).First(&target).Error
 	if err != nil {
-		http.NotFound(w, r)
+		h.renderError(w, r, http.StatusNotFound)
 
 		return database.Webhook{}, nil, false
 	}

internal/handlers/target_edit_test.go

@@ -42,15 +42,15 @@ const (
 func targetRouter(env *sourceTestEnv) *chi.Mux {
 	router := chi.NewRouter()
 	router.Post(
-		"/source/{sourceID}/targets",
+		"/hook/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)
 	router.Get(
-		"/source/{sourceID}/targets/{targetID}/edit",
+		"/hook/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEdit(),
 	)
 	router.Post(
-		"/source/{sourceID}/targets/{targetID}/edit",
+		"/hook/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEditSubmit(),
 	)
 
@@ -117,7 +117,7 @@ func seedHTTPTarget(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets", form,
+		"/hook/"+webhook.ID+"/targets", form,
 	)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
 
@@ -188,7 +188,7 @@ func submitTargetEdit(
 ) *httptest.ResponseRecorder {
 	return serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhookID+"/targets/"+targetID+"/edit",
+		"/hook/"+webhookID+"/targets/"+targetID+"/edit",
 		form,
 	)
 }
@@ -401,7 +401,7 @@ func TestHandleTargetEdit_PrefillsTheStoredValuesUnmasked(
 
 	w := serveTarget(
 		env, http.MethodGet,
-		"/source/"+webhook.ID+"/targets/"+target.ID+"/edit",
+		"/hook/"+webhook.ID+"/targets/"+target.ID+"/edit",
 		nil,
 	)
 	require.Equal(t, http.StatusOK, w.Code)
@@ -508,7 +508,7 @@ func assertEditIgnoresQueryString(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets/"+target.ID+
+		"/hook/"+webhook.ID+"/targets/"+target.ID+
 			"/edit?url="+url.QueryEscape(editReplacedURL)+
 			"&headers="+url.QueryEscape(editAuthHeader),
 		form,
@@ -592,7 +592,7 @@ func assertTargetOfAnotherWebhook404s(
 
 	get := serveTarget(
 		env, http.MethodGet,
-		"/source/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
+		"/hook/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
 	)
 	assert.Equal(t, http.StatusNotFound, get.Code)
 
@@ -630,8 +630,105 @@ func assertWebhookOfAnotherUser404s(
 
 	w := serveTarget(
 		env, http.MethodGet,
-		"/source/"+other.ID+"/targets/"+target.ID+"/edit", nil,
+		"/hook/"+other.ID+"/targets/"+target.ID+"/edit", nil,
 	)
 
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
+
+// renamedTargetName is the name the rename tests give a target.
+const renamedTargetName = "Long Term"
+
+// TestHandleTargetEditSubmit_RenamesArchive proves that renaming a
+// database target renames its archive, that a save that keeps the
+// name renames nothing, that a target of another type has no archive
+// to rename, and that a target whose archive cannot be renamed keeps
+// its stored name. When a file already has the archive's new name,
+// the edit is refused with an error naming that file.
+func TestHandleTargetEditSubmit_RenamesArchive(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	archive := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	rename := url.Values{"name": {renamedTargetName}}
+
+	w := submitTargetEdit(env, wh.ID, archive.ID, rename)
+	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
+	assert.Equal(
+		t,
+		[]archiveRename{{archive.ID, wh.Name, renamedTargetName}},
+		env.archives.Renames(),
+	)
+
+	w = submitTargetEdit(env, wh.ID, archive.ID, rename)
+	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
+	assert.Len(
+		t, env.archives.Renames(), 1,
+		"a save that keeps the name renames nothing",
+	)
+
+	httpWebhook, httpTarget := seedHTTPTarget(t, env, "", "")
+
+	w = submitTargetEdit(
+		env, httpWebhook.ID, httpTarget.ID,
+		editForm(editOriginalURL, "", ""),
+	)
+	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())
+	assert.Len(
+		t, env.archives.Renames(), 1,
+		"an HTTP target has no archive to rename",
+	)
+
+	again := url.Values{"name": {"Again"}}
+
+	env.archives.FailRenames(errInjectedRename)
+
+	w = submitTargetEdit(env, wh.ID, archive.ID, again)
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(
+		t, renamedTargetName, storedTarget(t, env, archive.ID).Name,
+		"a target whose archive was not renamed keeps its name",
+	)
+
+	env.archives.FailRenames(errNameTaken)
+
+	w = submitTargetEdit(env, wh.ID, archive.ID, again)
+	require.Equal(t, http.StatusConflict, w.Code)
+	assert.Contains(t, w.Body.String(), "archive-taken.db")
+	assert.Equal(
+		t, renamedTargetName, storedTarget(t, env, archive.ID).Name,
+	)
+}
+
+// TestHandleTargetEditSubmit_FailedSaveRenamesBack proves that when a
+// database target's archive is renamed but the new name cannot be
+// saved, the archive is renamed back to the stored name and the
+// stored name stays.
+func TestHandleTargetEditSubmit_FailedSaveRenamesBack(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	archive := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	failSaveOnTable(t, env.db, "targets")
+
+	form := url.Values{}
+	form.Set("name", renamedTargetName)
+
+	w := submitTargetEdit(env, wh.ID, archive.ID, form)
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(
+		t, archive.Name, storedTarget(t, env, archive.ID).Name,
+	)
+
+	assert.Equal(
+		t,
+		[]archiveRename{
+			{archive.ID, wh.Name, renamedTargetName},
+			{archive.ID, wh.Name, archive.Name},
+		},
+		env.archives.Renames(),
+	)
+}

internal/handlers/target_private_refusal_test.go

@@ -0,0 +1,116 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// privateRefusalHint is the sentence that tells an operator a private
+// destination is refused on purpose, and how to allow one.
+const privateRefusalHint = "Private and reserved addresses are " +
+	"refused by default; the server's ALLOWED_EGRESS_CIDRS setting " +
+	"allows named networks (see \"Allowing egress to your own " +
+	"network\" in the README)."
+
+// TestTargetRefusal_PrivateDestinationSaysHowToAllowIt covers both
+// target types that take a URL, on add and on edit.
+func TestTargetRefusal_PrivateDestinationSaysHowToAllowIt(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	targetTypes := []database.TargetType{
+		database.TargetTypeHTTP,
+		database.TargetTypeSlack,
+	}
+
+	for _, targetType := range targetTypes {
+		t.Run(string(targetType), func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+			targetsPath := "/hook/" + webhook.ID + "/targets"
+
+			form := url.Values{}
+			form.Set("name", "private")
+			form.Set("type", string(targetType))
+			form.Set("url", editBlockedURL)
+
+			added := serveTarget(
+				env, http.MethodPost, targetsPath, form,
+			)
+			assert.Equal(t, http.StatusBadRequest, added.Code)
+			assert.Contains(
+				t, added.Body.String(), privateRefusalHint,
+			)
+
+			form.Set("url", editOriginalURL)
+
+			created := serveTarget(
+				env, http.MethodPost, targetsPath, form,
+			)
+			require.Equal(
+				t, http.StatusSeeOther, created.Code,
+				created.Body.String(),
+			)
+
+			targets := targetsForWebhook(t, env.db, webhook.ID)
+			require.Len(t, targets, 1)
+
+			form.Set("url", editBlockedURL)
+
+			edited := submitTargetEdit(
+				env, webhook.ID, targets[0].ID, form,
+			)
+			assert.Equal(t, http.StatusBadRequest, edited.Code)
+			assert.Contains(
+				t, edited.Body.String(), privateRefusalHint,
+			)
+		})
+	}
+}
+
+// TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt: no
+// setting opens a link-local address, and Azure's WireServer hands out
+// VM credentials, so neither refusal points at the setting.
+func TestTargetRefusal_MetadataDestinationDoesNotSayHowToAllowIt(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	metadataURLs := map[string]string{
+		"link-local": "http://169.254.169.254/latest/meta-data/",
+		"wireserver": "http://168.63.129.16/?comp=versions",
+	}
+
+	for name, metadataURL := range metadataURLs {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			webhook := seedWebhookWithRetention(t, env.db, 30)
+
+			form := url.Values{}
+			form.Set("name", "metadata")
+			form.Set("type", string(database.TargetTypeHTTP))
+			form.Set("url", metadataURL)
+
+			w := serveTarget(
+				env, http.MethodPost,
+				"/hook/"+webhook.ID+"/targets", form,
+			)
+			assert.Equal(t, http.StatusBadRequest, w.Code)
+			assert.NotContains(
+				t, w.Body.String(), privateRefusalHint,
+			)
+		})
+	}
+}

internal/handlers/target_retries_test.go

@@ -102,7 +102,7 @@ func createWithRetries(
 
 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets",
+		"/hook/"+webhook.ID+"/targets",
 		createRetriesForm(retries),
 	)
 

internal/handlers/ui_copy_test.go

@@ -54,8 +54,7 @@ func renderPage(
 }
 
 // TestNavbarUsesWebhookTerminology pins the user-visible navigation
-// label to "Webhooks". The /sources route is deliberately unchanged, so
+// label to "Webhooks" and its link to the webhook list at /hooks.
-// the assertion targets the link text rather than the href.
 func TestNavbarUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()
 
@@ -95,15 +94,11 @@ func TestNavbarUsesWebhookTerminology(t *testing.T) {
 		t, body, ">Sources<",
 		"no user-visible element may still be labelled Sources",
 	)
-	assert.Contains(
+	assert.Contains(t, body, `href="/hooks"`)
-		t, body, `href="/sources"`,
-		"the /sources route itself must not change",
-	)
 }
 
 // TestEditPageUsesWebhookTerminology pins the edit page's heading and
-// its back link. The link's href still points at /source/{id}, which is
+// its back link to the webhook page at /hook/{id}.
-// intentional: only user-visible copy changes.
 func TestEditPageUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()
 
@@ -130,7 +125,57 @@ func TestEditPageUsesWebhookTerminology(t *testing.T) {
 
 	assert.Contains(t, body, "Edit Webhook")
 	assert.NotContains(t, body, ">Sources<")
-	assert.Contains(t, body, `href="/source/wh-1"`)
+	assert.Contains(t, body, `href="/hook/wh-1"`)
+}
+
+// TestEventLogPageIsCalledFullEventLog pins the one name the event log
+// page at /hook/{id}/events goes by: both links to it on the webhook
+// page, and its own heading, read "Full Event Log".
+func TestEventLogPageIsCalledFullEventLog(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	app := newTestApp(t, &h, &sess)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	// A pointer, as in the handlers: source_detail.html calls
+	// Webhook.RetentionLabel, a pointer method. Both pages only range
+	// over their lists, and a list left out renders as empty, so the
+	// lists are left out.
+	webhook := &database.Webhook{Name: "wh", RetentionDays: 14}
+	webhook.ID = testWebhookID
+
+	detailBody := renderPage(
+		t, h, sess, "source_detail.html", map[string]any{
+			dataKeyWebhook: webhook,
+		},
+	)
+
+	assert.Contains(
+		t, detailBody,
+		`<a href="/hook/wh-1/events" class="btn-secondary">Full Event Log</a>`,
+		"the button at the top of the webhook page",
+	)
+	assert.Contains(
+		t, detailBody,
+		`<a href="/hook/wh-1/events" class="btn-text text-sm">Full Event Log</a>`,
+		"the link under recent events",
+	)
+
+	logBody := renderPage(t, h, sess, "source_logs.html", map[string]any{
+		dataKeyWebhook: webhook,
+		"TotalEvents":  int64(0),
+	})
+
+	assert.Contains(
+		t, logBody,
+		`<h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>`,
+	)
 }
 
 // TestCreateFormRetentionCopyMatchesBehaviour pins the create form's
@@ -283,7 +328,7 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 		t, body,
 		`<code id="entrypoint-url-ep-1"`,
 	)
-	assert.Contains(t, body, "https://hooks.example.com/webhook/abc123")
+	assert.Contains(t, body, "https://hooks.example.com/h/abc123")
 	assert.Contains(
 		t, body,
 		`hidden data-copy-target="entrypoint-url-ep-1"`,

internal/handlers/webhook.go

@@ -88,14 +88,14 @@ func (h *Handlers) processWebhookRequest(
 
 	headersJSON, err := json.Marshal(r.Header)
 	if err != nil {
-		h.serverError(w, "failed to serialize headers", err)
+		h.receiverError(w, "failed to serialize headers", err)
 
 		return
 	}
 
 	targets, err := h.loadActiveTargets(entrypoint.WebhookID)
 	if err != nil {
-		h.serverError(w, "failed to query targets", err)
+		h.receiverError(w, "failed to query targets", err)
 
 		return
 	}
@@ -131,7 +131,7 @@ func (h *Handlers) lookupEntrypoint(
 		"path = ?", entrypointUUID,
 	).First(&entrypoint)
 	if result.Error != nil {
-		// The receiver is unauthenticated and /webhook/{uuid}
+		// The receiver is unauthenticated and /h/{uuid}
 		// matches any single segment, so this value is entirely
 		// client-chosen on exactly the branch where the lookup
 		// failed. DEBUG is off by default; the cap is what keeps
@@ -196,7 +196,7 @@ func (h *Handlers) createAndDeliverEvent(
 		targets,
 	)
 	if err != nil {
-		h.serverError(w, "failed to store webhook event", err)
+		h.receiverError(w, "failed to store webhook event", err)
 
 		return
 	}
@@ -204,6 +204,19 @@ func (h *Handlers) createAndDeliverEvent(
 	h.finishWebhookResponse(w, event, entrypoint, tasks)
 }
 
+// receiverError logs an error and answers the sender with a plain-text
+// 500. The receiver's answers are for programs, so it never sends the
+// error page the web UI uses.
+func (h *Handlers) receiverError(
+	w http.ResponseWriter, msg string, err error,
+) {
+	h.log.Error(msg, "error", err)
+	http.Error(
+		w, "Internal server error",
+		http.StatusInternalServerError,
+	)
+}
+
 // eventSource carries the fields a new event is built from. The
 // receiver fills it from the live request; the resubmit handler fills
 // it from a stored event. Both then go through createAndFanOut, so an
@@ -230,6 +243,7 @@ func (s eventSource) event() *database.Event {
 		Method:            s.Method,
 		Headers:           s.HeadersJSON,
 		Body:              string(s.Body),
+		BodyBytes:         int64(len(s.Body)),
 		ContentType:       s.ContentType,
 		ResubmittedFromID: s.ResubmittedFromID,
 	}
@@ -252,11 +266,12 @@ func requestEventSource(
 	}
 }
 
-// createAndFanOut writes the event and one pending delivery per target
+// createAndFanOut writes the event and one pending delivery per target,
-// in a single transaction, then hands the tasks to the delivery
+// and adds them to the webhook's running totals, in a single
-// engine. It is the only path by which an event and its deliveries are
+// transaction, then hands the tasks to the delivery engine. It is the
-// created, so a resubmitted event is retried, SSRF-guarded and
+// only path by which an event and its deliveries are created, so a
-// circuit-broken exactly as a received one is.
+// resubmitted event is retried, SSRF-guarded and circuit-broken
+// exactly as a received one is.
 //
 // The tasks are returned as well as queued, so a caller can report how
 // many targets the event went to.
@@ -296,6 +311,15 @@ func (h *Handlers) createAndFanOut(
 		return nil, nil, err
 	}
 
+	err = database.AddEventTotals(tx, database.EventTotals{
+		Events: 1, LastEventAt: &event.CreatedAt,
+	})
+	if err != nil {
+		tx.Rollback()
+
+		return nil, nil, err
+	}
+
 	err = tx.Commit().Error
 	if err != nil {
 		return nil, nil, fmt.Errorf(
@@ -354,8 +378,9 @@ func (h *Handlers) finishWebhookResponse(
 }
 
 // buildDeliveryTasks creates one pending delivery per target in the
-// transaction and returns the tasks for the delivery engine. The
+// transaction, adds each to its target's totals, and returns the tasks
-// caller owns the transaction and rolls it back on error.
+// for the delivery engine. The caller owns the transaction and rolls
+// it back on error.
 func buildDeliveryTasks(
 	tx *gorm.DB,
 	event *database.Event,
@@ -379,6 +404,13 @@ func buildDeliveryTasks(
 			)
 		}
 
+		err = database.AddTargetTotals(tx, database.TargetTotals{
+			TargetID: targets[i].ID, Deliveries: 1,
+		})
+		if err != nil {
+			return nil, err
+		}
+
 		tasks = append(tasks, delivery.Task{
 			DeliveryID:   dlv.ID,
 			EventID:      event.ID,

internal/handlers/webhook_stats.go

@@ -0,0 +1,259 @@
+package handlers
+
+import (
+	"fmt"
+	"time"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// The spans of the two recent windows the statistics pane reports on:
+// the last 10 minutes and the last 24 hours.
+const (
+	shortWindow = 10 * time.Minute
+	longWindow  = 24 * time.Hour
+)
+
+// percent turns a fraction into a percentage.
+const percent = 100
+
+// WebhookStats holds the figures in the statistics pane at the top of
+// the webhook page.
+type WebhookStats struct {
+	Entrypoints       int
+	ActiveEntrypoints int
+	Targets           int
+	ActiveTargets     int
+
+	// Lifetime counts every event, delivery and failure the webhook
+	// has had, and WithinRetention those still stored.
+	Lifetime        Counts
+	WithinRetention Counts
+
+	// InProgress counts the deliveries still pending or retrying.
+	InProgress int64
+
+	// LastEventAt is when the newest event arrived, or nil when none
+	// has. Retention does not change it.
+	LastEventAt *time.Time
+
+	Last10Minutes RecentWindow
+	Last24Hours   RecentWindow
+}
+
+// Counts holds a number of events, of deliveries and of failed
+// deliveries.
+type Counts struct {
+	Events     int64
+	Deliveries int64
+	Failures   int64
+}
+
+// RecentWindow holds what happened in one recent window: the events
+// received in it, and the deliveries that became delivered or failed in
+// it.
+type RecentWindow struct {
+	Events    int64
+	Delivered int64
+	Failed    int64
+}
+
+// TargetFinished is how many of one target's deliveries became
+// delivered, and how many failed, in a recent window.
+type TargetFinished struct {
+	TargetID  string
+	Delivered int64
+	Failed    int64
+}
+
+// FailurePercent is the share of the deliveries finished in the window
+// that failed, or a dash when none finished. Deliveries still pending
+// or retrying are not counted either way.
+func (w RecentWindow) FailurePercent() string {
+	finished := w.Delivered + w.Failed
+	if finished == 0 {
+		return "—"
+	}
+
+	return fmt.Sprintf(
+		"%.1f%%", percent*float64(w.Failed)/float64(finished),
+	)
+}
+
+// loadWebhookStats gathers the figures for the statistics pane from the
+// webhook's entrypoints and targets, as the page has already loaded
+// them, and from its event database. It returns nil, and logs why, when
+// the event database cannot be read.
+func (h *Handlers) loadWebhookStats(
+	webhookID string,
+	entrypoints []database.Entrypoint,
+	targets []database.Target,
+) *WebhookStats {
+	stats := &WebhookStats{
+		Entrypoints: len(entrypoints),
+		Targets:     len(targets),
+	}
+
+	for i := range entrypoints {
+		if entrypoints[i].Active {
+			stats.ActiveEntrypoints++
+		}
+	}
+
+	for i := range targets {
+		if targets[i].Active {
+			stats.ActiveTargets++
+		}
+	}
+
+	// Opening an event database that does not exist would create it,
+	// and it would hold nothing to count.
+	if !h.dbMgr.DBExists(webhookID) {
+		return stats
+	}
+
+	webhookDB, err := h.dbMgr.GetDB(webhookID)
+	if err == nil {
+		err = readEventStats(webhookDB, time.Now(), stats)
+	}
+
+	if err != nil {
+		h.log.Error(
+			"failed to read webhook statistics",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return nil
+	}
+
+	return stats
+}
+
+// readEventStats fills in the figures that come from the webhook's
+// event database. None of them reads every stored row: the totals are
+// one row for the events and one per target for the deliveries, and
+// every other figure is read from an index, over only the rows it
+// counts.
+func readEventStats(
+	db *gorm.DB, now time.Time, stats *WebhookStats,
+) error {
+	err := readTotals(db, stats)
+	if err != nil {
+		return err
+	}
+
+	err = db.Model(&database.Delivery{}).
+		Where("status IN ?", []database.DeliveryStatus{
+			database.DeliveryStatusPending,
+			database.DeliveryStatusRetrying,
+		}).
+		Count(&stats.InProgress).Error
+	if err != nil {
+		return fmt.Errorf("counting deliveries in progress: %w", err)
+	}
+
+	stats.Last10Minutes, err = readRecentWindow(
+		db, now.Add(-shortWindow),
+	)
+	if err != nil {
+		return err
+	}
+
+	stats.Last24Hours, err = readRecentWindow(
+		db, now.Add(-longWindow),
+	)
+
+	return err
+}
+
+// readTotals fills in the lifetime and within-retention figures, and
+// when the last event arrived, from the running totals: the events'
+// row, and the targets' rows summed.
+func readTotals(db *gorm.DB, stats *WebhookStats) error {
+	var events database.EventTotals
+
+	err := db.Take(&events).Error
+	if err != nil {
+		return fmt.Errorf("reading event totals: %w", err)
+	}
+
+	var targets []database.TargetTotals
+
+	err = db.Find(&targets).Error
+	if err != nil {
+		return fmt.Errorf("reading target totals: %w", err)
+	}
+
+	stats.Lifetime.Events = events.Events
+	stats.WithinRetention.Events = events.Events - events.EventsRemoved
+	stats.LastEventAt = events.LastEventAt
+
+	for _, t := range targets {
+		stats.Lifetime.Deliveries += t.Deliveries
+		stats.Lifetime.Failures += t.Failed
+		stats.WithinRetention.Deliveries += t.Deliveries - t.DeliveriesRemoved
+		stats.WithinRetention.Failures += t.Failed - t.FailedRemoved
+	}
+
+	return nil
+}
+
+// readRecentWindow counts the events received, and the deliveries that
+// became delivered or failed, since the given time.
+func readRecentWindow(
+	db *gorm.DB, since time.Time,
+) (RecentWindow, error) {
+	var w RecentWindow
+
+	err := db.Model(&database.Event{}).
+		Where("created_at >= ?", since).
+		Count(&w.Events).Error
+	if err != nil {
+		return w, fmt.Errorf("counting recent events: %w", err)
+	}
+
+	byTarget, err := finishedByTarget(db, since)
+	if err != nil {
+		return w, err
+	}
+
+	for _, f := range byTarget {
+		w.Delivered += f.Delivered
+		w.Failed += f.Failed
+	}
+
+	return w, nil
+}
+
+// finishedByTarget counts, for each target, the deliveries that became
+// delivered and those that failed since the given time, in one query
+// over just that window of the deliveries' status index. A target with
+// neither is left out.
+func finishedByTarget(
+	db *gorm.DB, since time.Time,
+) ([]TargetFinished, error) {
+	var byTarget []TargetFinished
+
+	err := db.Model(&database.Delivery{}).
+		Select("target_id, "+
+			"count(CASE WHEN status = ? THEN 1 END) AS delivered, "+
+			"count(CASE WHEN status = ? THEN 1 END) AS failed",
+			database.DeliveryStatusDelivered,
+			database.DeliveryStatusFailed).
+		Where("status IN ? AND finished_at >= ?",
+			[]database.DeliveryStatus{
+				database.DeliveryStatusDelivered,
+				database.DeliveryStatusFailed,
+			}, since).
+		Group("target_id").
+		Find(&byTarget).Error
+	if err != nil {
+		return nil, fmt.Errorf(
+			"counting deliveries finished by target: %w", err,
+		)
+	}
+
+	return byTarget, nil
+}

internal/handlers/webhook_stats_test.go

@@ -0,0 +1,569 @@
+package handlers_test
+
+import (
+	"net/http"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/fx/fxtest"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// statsEntrypoint adds an entrypoint to a webhook and returns its path.
+func statsEntrypoint(
+	t *testing.T, db *database.Database, webhookID string, active bool,
+) string {
+	t.Helper()
+
+	ep := &database.Entrypoint{
+		WebhookID: webhookID,
+		Path:      uuid.New().String(),
+	}
+
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(ep).Error)
+	require.NoError(t, db.DB().Model(ep).Update("active", active).Error)
+
+	return ep.Path
+}
+
+// statsDelivery returns an event's delivery to a target.
+func statsDelivery(
+	t *testing.T, webhookDB *gorm.DB, eventID, targetID string,
+) database.Delivery {
+	t.Helper()
+
+	var d database.Delivery
+
+	require.NoError(t, webhookDB.Where(
+		"event_id = ? AND target_id = ?", eventID, targetID,
+	).First(&d).Error)
+
+	return d
+}
+
+// statsFinish settles a delivery as the delivery engine does: its
+// final status and the time it finished, and one more on its target's
+// delivered or failed total, in one transaction.
+func statsFinish(
+	t *testing.T,
+	webhookDB *gorm.DB,
+	d database.Delivery,
+	status database.DeliveryStatus,
+	at time.Time,
+) {
+	t.Helper()
+
+	add := database.TargetTotals{TargetID: d.TargetID, Delivered: 1}
+	if status == database.DeliveryStatusFailed {
+		add = database.TargetTotals{TargetID: d.TargetID, Failed: 1}
+	}
+
+	require.NoError(t, webhookDB.Transaction(func(tx *gorm.DB) error {
+		err := tx.Model(&database.Delivery{}).
+			Where("id = ?", d.ID).
+			Updates(map[string]any{"status": status, "finished_at": at}).
+			Error
+		if err != nil {
+			return err
+		}
+
+		return database.AddTargetTotals(tx, add)
+	}))
+}
+
+// statsAge moves an event's arrival back to the given time.
+func statsAge(
+	t *testing.T, webhookDB *gorm.DB, eventID string, at time.Time,
+) {
+	t.Helper()
+
+	require.NoError(t, webhookDB.Model(&database.Event{}).
+		Where("id = ?", eventID).
+		Update("created_at", at).Error)
+}
+
+// statsTargetTotals reads a webhook database's target totals, keyed by
+// target.
+func statsTargetTotals(
+	t *testing.T, webhookDB *gorm.DB,
+) map[string]database.TargetTotals {
+	t.Helper()
+
+	var rows []database.TargetTotals
+
+	require.NoError(t, webhookDB.Find(&rows).Error)
+
+	byTarget := make(map[string]database.TargetTotals, len(rows))
+	for _, row := range rows {
+		byTarget[row.TargetID] = row
+	}
+
+	return byTarget
+}
+
+// statsHistory is the webhook seedStatsHistory builds: its event
+// database, its newest event, and its two active targets.
+type statsHistory struct {
+	webhook       *database.Webhook
+	webhookDB     *gorm.DB
+	newest        database.Event
+	first, second string
+}
+
+// seedStatsHistory builds the webhook the statistics test checks: 14
+// days of retention, twelve entrypoints (one inactive) and six targets
+// (four inactive). Ten events arrive through the receiver, and so each
+// has a delivery to the two active targets. The oldest event is past
+// retention, the next 30 hours old, the next six hours old, the other
+// seven just in. Six deliveries are settled as the delivery engine
+// would, two of them inside a recent window though their event arrived
+// before it. The newest event's delivery to the second target is
+// retrying, the rest are left pending, and a replay adds a pending
+// delivery to the oldest event. Once retention has removed the oldest
+// event, every figure in the pane differs from every other.
+func seedStatsHistory(
+	t *testing.T,
+	h *handlers.Handlers,
+	sess *session.Session,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+) statsHistory {
+	t.Helper()
+
+	wh := &database.Webhook{UserID: deleteTestUserID, Name: "stats", RetentionDays: 14}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	path := statsEntrypoint(t, db, wh.ID, true)
+	for range 10 {
+		statsEntrypoint(t, db, wh.ID, true)
+	}
+
+	statsEntrypoint(t, db, wh.ID, false)
+
+	first := seedConfiguredTarget(
+		t, db, wh.ID, database.TargetTypeHTTP,
+		`{"url":"`+replayTargetURL+`"}`,
+	)
+	second := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	for range 4 {
+		inactive := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+		require.NoError(t, db.DB().Model(inactive).
+			Update("active", false).Error)
+	}
+
+	router := receiverRouter(h)
+
+	for range 10 {
+		require.Equal(t, http.StatusOK, postReceiver(t, router, path))
+	}
+
+	webhookDB, err := dbMgr.GetDB(wh.ID)
+	require.NoError(t, err)
+
+	events := listEvents(t, webhookDB)
+	require.Len(t, events, 10)
+
+	oldest, yesterday, middle, newest := events[0], events[1], events[2], events[9]
+	now := time.Now()
+
+	statsAge(t, webhookDB, oldest.ID, now.Add(-15*24*time.Hour))
+	statsAge(t, webhookDB, yesterday.ID, now.Add(-30*time.Hour))
+	statsAge(t, webhookDB, middle.ID, now.Add(-6*time.Hour))
+
+	oldestFailure := statsDelivery(t, webhookDB, oldest.ID, first.ID)
+	statsFinish(t, webhookDB, oldestFailure,
+		database.DeliveryStatusFailed, now.Add(-14*24*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, yesterday.ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-29*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, yesterday.ID, second.ID),
+		database.DeliveryStatusFailed, now.Add(-23*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, middle.ID, second.ID),
+		database.DeliveryStatusFailed, now.Add(-5*time.Hour))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, middle.ID, first.ID),
+		database.DeliveryStatusFailed, now.Add(-time.Minute))
+	statsFinish(t, webhookDB,
+		statsDelivery(t, webhookDB, newest.ID, first.ID),
+		database.DeliveryStatusDelivered, now.Add(-2*time.Minute))
+
+	retrying := statsDelivery(t, webhookDB, newest.ID, second.ID)
+	require.NoError(t, webhookDB.Model(&retrying).
+		Update("status", database.DeliveryStatusRetrying).Error)
+
+	require.Equal(t, http.StatusSeeOther,
+		postReplay(t, h, sess, wh.ID, oldestFailure.ID).Code)
+
+	return statsHistory{
+		webhook: wh, webhookDB: webhookDB, newest: newest,
+		first: first.ID, second: second.ID,
+	}
+}
+
+// statsPrune runs the real retention reaper until it has removed one
+// event from the webhook's database, then stops it.
+func statsPrune(
+	t *testing.T,
+	db *database.Database,
+	dbMgr *database.WebhookDBManager,
+	log *logger.Logger,
+	webhookDB *gorm.DB,
+) {
+	t.Helper()
+
+	lc := fxtest.NewLifecycle(t)
+	database.NewRetentionReaper(lc, database.RetentionReaperParams{
+		Config: &config.Config{
+			RetentionSweepInterval: 10 * time.Millisecond,
+		},
+		Database:  db,
+		DBManager: dbMgr,
+		Logger:    log,
+	})
+
+	lc.RequireStart()
+
+	require.Eventually(t, func() bool {
+		var totals database.EventTotals
+
+		err := webhookDB.Take(&totals).Error
+
+		return err == nil && totals.EventsRemoved == 1
+	}, 10*time.Second, 10*time.Millisecond)
+
+	lc.RequireStop()
+}
+
+// statsPane returns the text of the statistics pane in a rendered
+// webhook page, everything from its heading to the next heading on the
+// page, with the markup taken out and each run of space made one
+// space. A table then reads header by header and row by row, each
+// row's label followed by its figures in column order.
+func statsPane(t *testing.T, page string) string {
+	t.Helper()
+
+	_, pane, found := strings.Cut(page, ">Statistics</h2>")
+	require.True(t, found, "the page has no statistics pane")
+
+	pane, _, _ = strings.Cut(pane, "<h2")
+	pane = regexp.MustCompile(`<[^>]*>`).ReplaceAllString(pane, " ")
+
+	return strings.Join(strings.Fields(pane), " ")
+}
+
+// assertStatsTargets checks, for the history seedStatsHistory builds,
+// each target's totals and its deliveries finished in the last 24
+// hours. The first target has ten deliveries and the replay, the
+// second ten; the inactive targets have none and so no row.
+func assertStatsTargets(t *testing.T, hist statsHistory) {
+	t.Helper()
+
+	first, second := hist.first, hist.second
+
+	assert.Equal(t, map[string]database.TargetTotals{
+		first:  {TargetID: first, Deliveries: 11, Delivered: 1, Failed: 3},
+		second: {TargetID: second, Deliveries: 10, Failed: 2},
+	}, statsTargetTotals(t, hist.webhookDB))
+
+	lastDay, err := handlers.FinishedByTargetForTest(
+		hist.webhookDB, time.Now().Add(-24*time.Hour),
+	)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []handlers.TargetFinished{
+		{TargetID: first, Delivered: 1, Failed: 1},
+		{TargetID: second, Failed: 2},
+	}, lastDay)
+}
+
+// assertStatsPaneAfterPrune checks the rendered statistics pane for the
+// history seedStatsHistory builds, once retention has removed the
+// oldest event: each figure after its label, in its column.
+func assertStatsPaneAfterPrune(
+	t *testing.T,
+	h *handlers.Handlers,
+	sess *session.Session,
+	hist statsHistory,
+) {
+	t.Helper()
+
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, hist.webhook.ID))
+	lastEvent := hist.newest.CreatedAt.UTC().Format("2006-01-02 15:04:05 UTC")
+
+	assert.Contains(t, pane, "Entrypoints 12 (11 active) "+
+		"Targets 6 (2 active) "+
+		"Deliveries in progress 13 "+
+		"Last event "+lastEvent+" "+
+		"Retention 14 days")
+	assert.Contains(t, pane, "Lifetime Within retention "+
+		"Events 10 9 "+
+		"Deliveries 21 18 "+
+		"Failures 5 4")
+	assert.Contains(t, pane, "Last 10 minutes Last 24 hours "+
+		"Events 7 8 "+
+		"Failures 1 3 "+
+		"Failure percentage 50.0% 75.0%")
+}
+
+// TestWebhookStats_EveryFigureAcrossRetentionPrune checks every figure
+// the statistics pane shows for the history seedStatsHistory builds,
+// and each target's totals and recent figures, before and after the
+// real retention reaper removes the oldest event.
+func TestWebhookStats_EveryFigureAcrossRetentionPrune(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+		log   *logger.Logger
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &log)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	hist := seedStatsHistory(t, h, sess, db, dbMgr)
+	first, second := hist.first, hist.second
+
+	stats := h.WebhookStatsForTest(hist.webhook.ID)
+	require.NotNil(t, stats)
+
+	assert.Equal(t, 12, stats.Entrypoints)
+	assert.Equal(t, 11, stats.ActiveEntrypoints)
+	assert.Equal(t, 6, stats.Targets)
+	assert.Equal(t, 2, stats.ActiveTargets)
+	assert.Equal(t, handlers.Counts{Events: 10, Deliveries: 21, Failures: 5},
+		stats.Lifetime)
+	assert.Equal(t, stats.Lifetime, stats.WithinRetention)
+	assert.Equal(t, int64(15), stats.InProgress)
+	require.NotNil(t, stats.LastEventAt)
+	assert.True(t, hist.newest.CreatedAt.Equal(*stats.LastEventAt))
+	assert.Equal(t, handlers.RecentWindow{
+		Events: 7, Delivered: 1, Failed: 1,
+	}, stats.Last10Minutes)
+	assert.Equal(t, handlers.RecentWindow{
+		Events: 8, Delivered: 1, Failed: 3,
+	}, stats.Last24Hours)
+	assert.Equal(t, "50.0%", stats.Last10Minutes.FailurePercent())
+	assert.Equal(t, "75.0%", stats.Last24Hours.FailurePercent())
+
+	assertStatsTargets(t, hist)
+
+	// Retention removes the oldest event with its three deliveries:
+	// the first target's failed one and the pending replay, and the
+	// second target's pending one.
+	statsPrune(t, db, dbMgr, log, hist.webhookDB)
+
+	after := h.WebhookStatsForTest(hist.webhook.ID)
+	require.NotNil(t, after)
+
+	assert.Equal(t, stats.Lifetime, after.Lifetime)
+	assert.Equal(t, handlers.Counts{Events: 9, Deliveries: 18, Failures: 4},
+		after.WithinRetention)
+	assert.Equal(t, int64(13), after.InProgress)
+	assert.Equal(t, stats.LastEventAt, after.LastEventAt)
+	assert.Equal(t, stats.Last10Minutes, after.Last10Minutes)
+	assert.Equal(t, stats.Last24Hours, after.Last24Hours)
+
+	assert.Equal(t, map[string]database.TargetTotals{
+		first: {
+			TargetID: first, Deliveries: 11, Delivered: 1, Failed: 3,
+			DeliveriesRemoved: 2, FailedRemoved: 1,
+		},
+		second: {
+			TargetID: second, Deliveries: 10, Failed: 2,
+			DeliveriesRemoved: 1,
+		},
+	}, statsTargetTotals(t, hist.webhookDB))
+
+	assertStatsPaneAfterPrune(t, h, sess, hist)
+}
+
+// TestWebhookStats_LastEventSurvivesPruningEveryEvent checks that once
+// retention has removed every event, the pane still shows when the last
+// one arrived rather than "none".
+func TestWebhookStats_LastEventSurvivesPruningEveryEvent(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+		log   *logger.Logger
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &log)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID, Name: "pruned", RetentionDays: 1,
+	}
+	require.NoError(t, db.DB().Omit(clause.Associations).Create(wh).Error)
+
+	path := statsEntrypoint(t, db, wh.ID, true)
+	require.Equal(t, http.StatusOK,
+		postReceiver(t, receiverRouter(h), path))
+
+	webhookDB, err := dbMgr.GetDB(wh.ID)
+	require.NoError(t, err)
+
+	events := listEvents(t, webhookDB)
+	require.Len(t, events, 1)
+
+	arrived := events[0].CreatedAt
+
+	statsAge(t, webhookDB, events[0].ID, time.Now().Add(-50*time.Hour))
+	statsPrune(t, db, dbMgr, log, webhookDB)
+	require.Empty(t, listEvents(t, webhookDB))
+
+	stats := h.WebhookStatsForTest(wh.ID)
+	require.NotNil(t, stats)
+	require.NotNil(t, stats.LastEventAt)
+	assert.True(t, arrived.Equal(*stats.LastEventAt))
+
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
+	assert.Contains(t, pane,
+		"Last event "+arrived.UTC().Format("2006-01-02 15:04:05 UTC"))
+}
+
+// TestWebhookStats_LastEventInUTC checks that the pane shows when the
+// last event arrived in UTC, as the event list does, when the time was
+// stored in another zone, as it is on a host whose local time is not
+// UTC.
+func TestWebhookStats_LastEventInUTC(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	webhookDB, err := dbMgr.GetDB(wh.ID)
+	require.NoError(t, err)
+
+	arrived := time.Date(2026, time.March, 4, 22, 30, 0, 0,
+		time.FixedZone("EST", -5*60*60))
+	require.NoError(t, database.AddEventTotals(webhookDB,
+		database.EventTotals{Events: 1, LastEventAt: &arrived}))
+
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
+	assert.Contains(t, pane, "Last event 2026-03-05 03:30:00 UTC")
+}
+
+// TestWebhookStats_PaneShowsRetentionPeriod checks that the statistics
+// pane itself, not only the line at the foot of the page, shows the
+// webhook's retention period, for a finite one and for forever.
+func TestWebhookStats_PaneShowsRetentionPeriod(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+	)
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	tests := []struct {
+		retentionDays int
+		want          string
+	}{
+		{30, "30 days"},
+		{database.RetentionForeverDays, "forever"},
+	}
+
+	for _, tt := range tests {
+		wh := &database.Webhook{
+			UserID:        deleteTestUserID,
+			Name:          "retention",
+			RetentionDays: tt.retentionDays,
+		}
+		require.NoError(t,
+			db.DB().Omit(clause.Associations).Create(wh).Error)
+
+		pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
+		assert.Contains(t, pane, "Retention "+tt.want)
+	}
+}
+
+// TestWebhookStats_WebhookWithNoEvents covers a webhook whose event
+// database has never been opened: every count is zero, the
+// percentages are a dash, and showing the page does not create the
+// database.
+func TestWebhookStats_WebhookWithNoEvents(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h     *handlers.Handlers
+		sess  *session.Session
+		db    *database.Database
+		dbMgr *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	assert.Equal(t, &handlers.WebhookStats{}, h.WebhookStatsForTest(wh.ID))
+	assert.Equal(t, "—", handlers.RecentWindow{}.FailurePercent())
+
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
+	assert.Contains(t, pane, "Last event none")
+	assert.Contains(t, pane, "Failure percentage — —")
+	assert.False(t, dbMgr.DBExists(wh.ID))
+}
+
+// TestRecentWindow_FailurePercent pins the percentage: failed
+// deliveries out of all that finished in the window.
+func TestRecentWindow_FailurePercent(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		window handlers.RecentWindow
+		want   string
+	}{
+		{handlers.RecentWindow{}, "—"},
+		{handlers.RecentWindow{Events: 4}, "—"},
+		{handlers.RecentWindow{Delivered: 3, Failed: 1}, "25.0%"},
+		{handlers.RecentWindow{Failed: 2}, "100.0%"},
+		{handlers.RecentWindow{Delivered: 2}, "0.0%"},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, tt.window.FailurePercent(), tt.window)
+	}
+}

internal/logfield/logfield_test.go

@@ -201,7 +201,7 @@ func TestTruncate_LeavesShortValuesAlone(t *testing.T) {
 	t.Parallel()
 
 	for _, s := range []string{
-		"", "GET", "/source/abc/edit", "Mozilla/5.0 (X11)",
+		"", "GET", "/hook/abc/edit", "Mozilla/5.0 (X11)",
 	} {
 		assert.Equal(t, s, logfield.Truncate(s, budget))
 	}

internal/metrics/metrics.go

@@ -3,17 +3,18 @@
 // deliveries are attempted, how they end, how long they take, how
 // deep the queues are, and how many circuit breakers are open.
 //
-// The inbound HTTP metrics come from the go-http-metrics recorder in
+// It also builds the registry the authenticated /metrics route
-// internal/middleware and land on prometheus.DefaultRegisterer. These
+// serves. In production, these collectors, the inbound HTTP metrics
-// collectors register there too, so both surfaces are gathered by the
+// recorded in internal/middleware, and the Go runtime and process
-// one promhttp handler mounted on the authenticated /metrics route.
+// collectors all register on that one registry, never on Prometheus's
+// global default.
 package metrics
 
 import (
-	"sync"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -57,25 +58,31 @@ var knownTargetTypes = []database.TargetType{
 	database.TargetTypeSlack,
 }
 
-// defaultSet is the process-wide metric set, registered on the same
+// NewRegistry returns the registry /metrics serves, carrying the Go
-// registry the HTTP middleware and the /metrics handler already use.
+// runtime and process collectors that Prometheus's global default
-// It is built on first use rather than in an init so that a test
+// registry carries, so the go_* and process_* series stay in the
-// binary that never touches metrics never registers them.
+// scrape.
 //
-//nolint:gochecknoglobals // one process-wide registration, by design
+// A registry of its own, rather than the global default, is what lets
-var defaultSet = sync.OnceValue(func() *Set {
+// two dependency graphs in one process — two tests, say — each
-	return New(prometheus.DefaultRegisterer)
+// register their collectors without the second registration
-})
+// panicking.
+func NewRegistry() *prometheus.Registry {
+	reg := prometheus.NewRegistry()
+	reg.MustRegister(
+		collectors.NewGoCollector(),
+		collectors.NewProcessCollector(
+			collectors.ProcessCollectorOpts{},
+		),
+	)
 
-// Default returns the process-wide metric set.
+	return reg
-func Default() *Set {
-	return defaultSet()
 }
 
 // Set is one registered group of webhooker's delivery collectors.
-// Production uses the single Default set; tests build their own
+// Production builds one on the registry /metrics serves; tests build
-// against a private registry so assertions are not disturbed by
+// one on a registry of their own so they can gather what their own
-// deliveries other tests are making concurrently.
+// deliveries recorded.
 type Set struct {
 	eventsReceived      prometheus.Counter
 	deliveryAttempts    *prometheus.CounterVec
@@ -93,7 +100,7 @@ type Set struct {
 // New registers a full set of delivery collectors on reg and returns
 // it. It panics if reg already holds them, which is the intended
 // behaviour for a duplicate registration.
-func New(reg prometheus.Registerer) *Set {
+func New(reg *prometheus.Registry) *Set {
 	factory := promauto.With(reg)
 
 	s := &Set{

internal/middleware/accesslog_test.go

@@ -119,7 +119,7 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
 	)
 
 	router.HandleFunc(
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 		func(w http.ResponseWriter, r *http.Request) {
 			// Stands in for the real handler: an unknown entrypoint
 			// UUID 404s, a known one succeeds.
@@ -271,11 +271,11 @@ func TestAccessLog_InventedReceiverPathsLogRoutePattern(t *testing.T) {
 	assertFloodIsBounded(
 		t,
 		func(i int) string {
-			return "/webhook/" + attackerMarker +
+			return "/h/" + attackerMarker +
 				strings.Repeat("x", i) + "?q=" + attackerMarker
 		},
 		http.StatusNotFound,
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 	)
 }
 
@@ -346,10 +346,10 @@ type sizeCase struct {
 func lineSizeCases() map[string]sizeCase {
 	cases := map[string]sizeCase{
 		"oversized path segment": {
-			target: "/webhook/" + attackerMarker +
+			target: "/h/" + attackerMarker +
 				strings.Repeat("x", oversizedSegmentBytes),
 			wantStatus: http.StatusNotFound,
-			wantURL:    "/webhook/{uuid}",
+			wantURL:    "/h/{uuid}",
 			bound:      maxLineBytes,
 		},
 		// /.well-known/healthcheck answers 200 to anyone and has no
@@ -605,14 +605,14 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
 	router := accessLogRouter(m)
 
 	assert.Equal(
-		t, http.StatusOK, get(t, router, "/webhook/known?src=ci"),
+		t, http.StatusOK, get(t, router, "/h/known?src=ci"),
 	)
 
 	// The path resolved against a stored entrypoint, so it stays. The
 	// query never does: see TestAccessLog_UnauthenticatedSuccess...
 	entries := accessLogEntries(t, buf)
 	require.Len(t, entries, 1)
-	assert.Equal(t, "/webhook/known?(redacted)", entries[0]["url"])
+	assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
 	assert.NotContains(t, buf.String(), "src=ci")
 }
 
@@ -640,7 +640,7 @@ func TestAccessLog_RetainsEveryOtherField(t *testing.T) {
 	assert.Equal(
 		t,
 		http.StatusNotFound,
-		get(t, router, "/webhook/"+attackerMarker),
+		get(t, router, "/h/"+attackerMarker),
 	)
 
 	entries := accessLogEntries(t, buf)

internal/middleware/csrf.go

@@ -19,7 +19,7 @@ func CSRFToken(r *http.Request) string {
 // key to sign a CSRF cookie and validates a masked token submitted via
 // the "csrf_token" form field (or the "X-CSRF-Token" header) on
 // POST/PUT/PATCH/DELETE requests. Requests with an invalid or missing
-// token receive a 403 Forbidden response.
+// token are logged and answered by forbidden, which must write the 403.
 //
 // The middleware detects the client-facing transport protocol
 // per-request via reqtls.IsTLS, the single TLS predicate the session
@@ -36,12 +36,14 @@ func CSRFToken(r *http.Request) string {
 // Two gorilla/csrf instances are maintained — one with Secure cookies
 // (for TLS) and one without (for plaintext HTTP) — because the
 // csrf.Secure option is set at creation time, not per-request.
-func (m *Middleware) CSRF() func(http.Handler) http.Handler {
+func (m *Middleware) CSRF(
+	forbidden http.Handler,
+) func(http.Handler) http.Handler {
 	csrfErrorHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// CSRF is registered ahead of RequireAuth on every route
 		// group that uses it, so this WARN is reachable by an
 		// unauthenticated client: a POST with no token to
-		// /source/<any length of any text>/edit lands here. The
+		// /hook/<any length of any text>/edit lands here. The
 		// method and path are capped against the same budgets as
 		// the access log. remote_addr is set by net/http from the
 		// accepted connection rather than by the client, and
@@ -57,7 +59,7 @@ func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 			"remote_addr", r.RemoteAddr,
 			"reason", csrf.FailureReason(r),
 		)
-		http.Error(w, "Forbidden - invalid CSRF token", http.StatusForbidden)
+		forbidden.ServeHTTP(w, r)
 	})
 
 	key := m.session.GetKey()

internal/middleware/csrf_test.go

@@ -18,6 +18,12 @@ import (
 // csrfCookieName is the gorilla/csrf cookie name.
 const csrfCookieName = "_gorilla_csrf"
 
+// forbidden stands in for the error page the server hands CSRF to
+// answer a refused request with.
+func forbidden(w http.ResponseWriter, _ *http.Request) {
+	w.WriteHeader(http.StatusForbidden)
+}
+
 // csrfGetToken performs a GET request through the CSRF middleware
 // and returns the token and cookies.
 func csrfGetToken(
@@ -98,7 +104,7 @@ func TestCSRF_GETSetsToken(t *testing.T) {
 
 	var gotToken string
 
-	handler := m.CSRF()(http.HandlerFunc(
+	handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc(
 		func(_ http.ResponseWriter, r *http.Request) {
 			gotToken = middleware.CSRFToken(r)
 		},
@@ -120,7 +126,7 @@ func TestCSRF_POSTWithValidToken(t *testing.T) {
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentDev)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -152,7 +158,7 @@ func csrfPOSTWithoutTokenTest(
 	t.Helper()
 
 	m, _ := testMiddleware(t, env)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	// GET to establish the CSRF cookie
 	getHandler := csrfMW(http.HandlerFunc(
@@ -209,7 +215,7 @@ func TestCSRF_POSTWithInvalidToken(t *testing.T) {
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentDev)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	// GET to establish the CSRF cookie
 	getHandler := csrfMW(http.HandlerFunc(
@@ -265,7 +271,7 @@ func TestCSRF_GETDoesNotValidate(t *testing.T) {
 
 	var called bool
 
-	handler := m.CSRF()(http.HandlerFunc(
+	handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc(
 		func(_ http.ResponseWriter, _ *http.Request) {
 			called = true
 		},
@@ -328,7 +334,7 @@ func csrfTookStrictPath(
 	t.Helper()
 
 	m, _ := testMiddleware(t, env)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	newReq := func(method string) *http.Request {
 		r := httptest.NewRequestWithContext(
@@ -477,7 +483,7 @@ func TestCSRF_ProdMode_PlaintextHTTP_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -517,7 +523,7 @@ func TestCSRF_ProdMode_BehindProxy_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -562,7 +568,7 @@ func TestCSRF_ProdMode_DirectTLS_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF()
+	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),

internal/middleware/export_test.go

@@ -10,8 +10,7 @@ import (
 
 // MetricsMiddlewareForTest builds the metrics recording middleware
 // against a caller-supplied recorder, so a test can gather from its
-// own Prometheus registry rather than the process-wide default one
+// own Prometheus registry without building a whole Middleware.
-// that Middleware.Metrics uses.
 func MetricsMiddlewareForTest(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/logbound_test.go

@@ -260,7 +260,9 @@ func logSites() map[string]logSite {
 			) http.Handler {
 				t.Helper()
 
-				return m.CSRF()(unreachable(t))
+				return m.CSRF(http.HandlerFunc(forbidden))(
+					unreachable(t),
+				)
 			},
 			send:       postNoToken,
 			wantStatus: http.StatusForbidden,
@@ -383,7 +385,7 @@ func TestLogLines_ClientChosenPathDoesNotSizeTheLine(t *testing.T) {
 						t, newHandler,
 					)
 
-					path := "/source/" +
+					path := "/hook/" +
 						oversizedPathSegment(fill) + "/edit"
 
 					assert.Equal(
@@ -434,7 +436,7 @@ func TestLoginThrottle_LogLineDoesNotTrackPathSize(t *testing.T) {
 				req := httptest.NewRequestWithContext(
 					context.Background(),
 					http.MethodPost,
-					"/source/"+
+					"/hook/"+
 						oversizedPathSegment(fill)+"/login",
 					nil,
 				)
@@ -499,7 +501,7 @@ func TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog(
 							http.StatusRequestEntityTooLarge,
 							postOversize(
 								h,
-								"/source/"+segment(i)+"/edit",
+								"/hook/"+segment(i)+"/edit",
 							),
 						)
 					}

internal/middleware/loginguard.go

@@ -108,10 +108,10 @@ type failureWindow struct {
 //
 // A limiter that spends budget on arrival cannot protect a
 // single-admin product: behind the reverse proxy the deployment
-// requires, with TRUSTED_PROXIES unset, every client keys on the
+// requires, when TRUSTED_PROXIES does not cover it, every client
-// proxy, so a stranger trickling five POSTs a minute keeps the one
+// keys on the proxy, so a stranger trickling five POSTs a minute
-// bucket full and the operator's own correct password is answered 429
+// keeps the one bucket full and the operator's own correct password
-// forever. There is no second administrative path.
+// is answered 429 forever. There is no second administrative path.
 //
 // So budget is spent only by a FAILED verification. A correct
 // password is never throttled, whatever the counters say, which is

internal/middleware/metrics.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/go-chi/chi"
 	httpmetrics "github.com/slok/go-http-metrics/metrics"
-	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	ghmm "github.com/slok/go-http-metrics/middleware"
 	"github.com/slok/go-http-metrics/middleware/std"
 )
@@ -40,7 +39,7 @@ const unmatchedMethod = unmatchedRoute
 //
 // The pattern is what bounds the label's domain to the routes the
 // service registers. The path does not bound it at all — every byte
-// after /webhook/ is client-chosen, so labelling by path lets any
+// after /h/ is client-chosen, so labelling by path lets any
 // unauthenticated client mint permanent series at will, and publishes
 // the entrypoint UUID (the receiver's only credential) in the scrape
 // while doing it.
@@ -151,17 +150,17 @@ func (r boundedLabelRecorder) AddInflightRequests(
 
 var _ httpmetrics.Recorder = boundedLabelRecorder{}
 
-// Metrics returns middleware that records Prometheus HTTP metrics on
+// Metrics returns middleware that records Prometheus HTTP metrics
-// the default registry, which is the one the /metrics route gathers.
+// with the Middleware's one recorder, which New builds on the registry
+// the /metrics route serves and NewForTest on a registry of its own.
+// Every call reuses that recorder, so any number of routers can
+// install it.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {
-	return metricsMiddleware(
+	return metricsMiddleware(s.metricsRecorder)
-		prommetrics.NewRecorder(prommetrics.Config{}),
-	)
 }
 
 // metricsMiddleware builds the recording middleware against a given
-// recorder, so tests can gather from a registry of their own instead
+// recorder, so tests can gather from a registry of their own.
-// of the process-wide default.
 func metricsMiddleware(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/metrics_method_test.go

@@ -50,7 +50,7 @@ func realMethods() []string {
 // dimension varying, so any series growth a probe produces is the
 // method label's and nothing else's.
 func methodProbePath() string {
-	return "/webhook/" + uuid.NewString()
+	return "/h/" + uuid.NewString()
 }
 
 // inventedMethods returns n distinct RFC 9110 method tokens that no

internal/middleware/metrics_test.go

@@ -28,7 +28,7 @@ const (
 
 	// receiverRoutePattern is the one handler label every receiver
 	// request must produce, however the client varies the path.
-	receiverRoutePattern = "/webhook/{uuid}"
+	receiverRoutePattern = "/h/{uuid}"
 
 	// okRoute is a static route used to pin that the response-writer
 	// interceptor still reports status and size after the handler id
@@ -57,9 +57,8 @@ const (
 // Server.setupWebhookRoutes inside it. That ordering is the whole
 // defect, so a test that flattens it would prove nothing.
 //
-// The recorder writes to a registry of the test's own rather than the
+// The recorder writes to a registry of the test's own, so each test
-// process-wide default one, so each test observes only its own
+// observes only its own traffic.
-// traffic.
 func metricsTestRouter(
 	t *testing.T,
 	receiverLimit int,
@@ -143,13 +142,13 @@ func drivePaths(
 	return drive(t, h, probes)
 }
 
-// receiverPaths returns n distinct /webhook/ paths, each naming a
+// receiverPaths returns n distinct /h/ paths, each naming a
 // fresh UUID exactly as an unauthenticated flood would.
 func receiverPaths(n int) []string {
 	paths := make([]string, 0, n)
 
 	for range n {
-		paths = append(paths, "/webhook/"+uuid.NewString())
+		paths = append(paths, "/h/"+uuid.NewString())
 	}
 
 	return paths
@@ -220,7 +219,7 @@ func keys(set map[string]struct{}) []string {
 
 // TestMetrics_DistinctReceiverPathsMintOneLabelSet is the direct
 // assertion the issue asks for: N requests to N distinct
-// /webhook/<uuid> paths must produce exactly ONE handler label, the
+// /h/<uuid> paths must produce exactly ONE handler label, the
 // route pattern. Before the fix this produced N of them.
 func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	t.Parallel()
@@ -250,7 +249,7 @@ func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	// The scrape must not republish the UUIDs it was driven with.
 	// They are the receiver's only credential.
 	for _, p := range paths {
-		id := strings.TrimPrefix(p, "/webhook/")
+		id := strings.TrimPrefix(p, "/h/")
 		for label := range labels {
 			assert.NotContains(
 				t, label, id,
@@ -354,7 +353,7 @@ func TestMetrics_UnmatchedPathsCollapseToTheSentinel(t *testing.T) {
 		if i%2 == 0 {
 			paths = append(paths, "/"+id)
 		} else {
-			paths = append(paths, "/webhook/"+id+"/"+id)
+			paths = append(paths, "/h/"+id+"/"+id)
 		}
 	}
 
@@ -455,3 +454,29 @@ func TestMetrics_StatusAndSizeStillRecorded(t *testing.T) {
 		"the interceptor must still count written bytes",
 	)
 }
+
+// TestMetrics_WorksOnNewForTestMiddleware pins that a Middleware built
+// by NewForTest has a recorder of its own: its Metrics() serves a
+// request instead of panicking, and a second one does not collide
+// with the first.
+func TestMetrics_WorksOnNewForTestMiddleware(t *testing.T) {
+	t.Parallel()
+
+	log := slog.New(slog.DiscardHandler)
+	cfg := &config.Config{Environment: "prod"}
+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(okBody))
+	})
+
+	for range 2 {
+		h := middleware.NewForTest(log, cfg, nil).Metrics()(ok)
+
+		req := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, okRoute, nil,
+		)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusOK, w.Code)
+	}
+}

internal/middleware/middleware.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 
@@ -13,6 +14,9 @@ import (
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
+	"github.com/prometheus/client_golang/prometheus"
+	httpmetrics "github.com/slok/go-http-metrics/metrics"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
@@ -152,6 +156,7 @@ type MiddlewareParams struct {
 	Globals  *globals.Globals
 	Config   *config.Config
 	Session  *session.Session
+	Registry *prometheus.Registry
 }
 
 // Middleware provides HTTP middleware for logging, CORS, auth, and
@@ -161,6 +166,14 @@ type Middleware struct {
 	params  *MiddlewareParams
 	session *session.Session
 
+	// metricsRecorder records the inbound HTTP metrics. New builds
+	// it on the registry /metrics serves, NewForTest on a registry
+	// of its own. Either way it is built once per Middleware and
+	// Metrics reuses it, because building it registers its
+	// collectors, and a second registration on the same registry
+	// panics.
+	metricsRecorder httpmetrics.Recorder
+
 	// loginGuard counts failed credential verifications and bounds
 	// concurrent password hashing. It is built on first use so that
 	// every construction path gets one; see guard().
@@ -179,6 +192,9 @@ func New(
 	s.params = &params
 	s.log = params.Logger.Get()
 	s.session = params.Session
+	s.metricsRecorder = prommetrics.NewRecorder(
+		prommetrics.Config{Registry: params.Registry},
+	)
 
 	return s, nil
 }
@@ -257,7 +273,7 @@ func concreteLogURL(r *http.Request) string {
 //
 // 3xx and 4xx responses get the chi route pattern instead. Those are
 // the outcomes an unauthenticated client drives for free: 404 or 429
-// on any invented /webhook/ path, 303 to the login page on any
+// on any invented /h/ path, 303 to the login page on any
 // invented /user/ path. Logging the concrete URL there lets a flood
 // write attacker-chosen text, of attacker-chosen length, into the
 // operator's log at one line per request. The pattern comes from the
@@ -366,6 +382,30 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	}
 }
 
+// NextParam is the query parameter on the login redirect, and the
+// login form field, that holds the page to return to after login.
+const NextParam = "next"
+
+// MaxNextBytes bounds the NextParam value. The login page writes it
+// into its form, and every page is rendered into a buffer first, so
+// without a bound a request would choose the size of that buffer.
+const MaxNextBytes = 2048
+
+// loginURL is the login page RequireAuth redirects to. A GET carries
+// its own path and query in NextParam so that logging in returns to
+// it, unless they are longer than MaxNextBytes; loginDestination in
+// the handlers package checks whether that value is safe to follow.
+// Other methods carry nothing, since a redirect cannot repeat them.
+func loginURL(r *http.Request) string {
+	next := r.URL.RequestURI()
+
+	if r.Method != http.MethodGet || len(next) > MaxNextBytes {
+		return "/pages/login"
+	}
+
+	return "/pages/login?" + url.Values{NextParam: {next}}.Encode()
+}
+
 // RequireAuth returns middleware that checks for a valid session.
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
@@ -381,7 +421,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					"error", err,
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return
@@ -409,7 +449,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					),
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return
@@ -560,7 +600,7 @@ func (s *Middleware) MaxBodySize(
 				// internal/server/routes.go), so an
 				// unauthenticated client reaches it with a path
 				// of its own choosing and its own length —
-				// POST /source/<8 KB>/edit with an oversize
+				// POST /hook/<8 KB>/edit with an oversize
 				// declared Content-Length costs nothing to
 				// send. At WARN, on by default, that is a
 				// write into the operator's log sized by the

internal/middleware/middleware_test.go

@@ -338,6 +338,76 @@ func TestRequireAuth_NoSession_RedirectsToLogin(t *testing.T) {
 			"unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
+}
+
+// TestRequireAuth_LoginRedirectCarriesOnlyAGet pins what the login
+// redirect carries: a GET's path and query, so logging in can return
+// there, and nothing for a POST, which a redirect cannot repeat.
+func TestRequireAuth_LoginRedirectCarriesOnlyAGet(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {},
+	))
+
+	get := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/hook/abc/events?page=2", nil,
+	)
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, get)
+
+	assert.Equal(
+		t, "/pages/login?next=%2Fhook%2Fabc%2Fevents%3Fpage%3D2",
+		w.Header().Get("Location"),
+	)
+
+	post := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/hook/abc/delete", nil,
+	)
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, post)
+
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+}
+
+// TestRequireAuth_LoginRedirectLeavesOutALongURL: a GET whose path
+// and query are longer than the login page accepts goes to the plain
+// login page, so a long URL does not make the redirect long.
+func TestRequireAuth_LoginRedirectLeavesOutALongURL(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {},
+	))
+
+	atLimit := "/" + strings.Repeat("a", middleware.MaxNextBytes-1)
+
+	get := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, atLimit, nil,
+	)
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, get)
+
+	assert.Equal(
+		t, "/pages/login?next=%2F"+atLimit[1:],
+		w.Header().Get("Location"),
+	)
+
+	get = httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, atLimit+"a", nil,
+	)
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, get)
+
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
@@ -443,7 +513,9 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 			"unauthenticated session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
 }
 
 // --- RequireAuth Session Expiry Tests ---
@@ -541,7 +613,9 @@ func TestRequireAuth_IdleExpiredSession_RedirectsToLogin(
 		"handler should not run for an idle-expired session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
 	assert.Empty(
 		t, sessionCookies(w),
 		"an expired session must not be refreshed",
@@ -640,7 +714,7 @@ func TestNoCache_SetsHeaders(t *testing.T) {
 
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodGet, "/sources", nil,
+		http.MethodGet, "/hooks", nil,
 	)
 	w := httptest.NewRecorder()
 

internal/middleware/ratelimit.go

@@ -63,7 +63,7 @@ const (
 
 	// receiverAggregateMultiplier scales the configured
 	// per-entrypoint receiver limit into the aggregate limit one
-	// client IP may spend across the whole /webhook/* route. Ten
+	// client IP may spend across the whole /h/* route. Ten
 	// entrypoints' worth lets a single sender address drive several
 	// entrypoints at their full rate, while still capping what one
 	// address costs the unauthenticated receiver.
@@ -123,9 +123,8 @@ func bucketKey(addr netip.Addr) string {
 	return prefix.String()
 }
 
-// isTrustedProxy reports whether addr belongs to a network the
+// isTrustedProxy reports whether addr belongs to a network in
-// operator listed in TRUSTED_PROXIES. The list is empty by default,
+// TRUSTED_PROXIES, which by default is the RFC 1918 private ranges.
-// so by default nothing is trusted.
 func (m *Middleware) isTrustedProxy(addr netip.Addr) bool {
 	for _, prefix := range m.params.Config.TrustedProxies {
 		if prefix.Contains(addr) {
@@ -390,7 +389,7 @@ func (m *Middleware) postRateLimit(
 // It is Config.ReceiverRateLimit requests per minute.
 //
 // That limit alone bounds nothing in aggregate. The route pattern
-// /webhook/{uuid} matches any single segment, so a client that
+// /h/{uuid} matches any single segment, so a client that
 // invents a fresh path per request mints a fresh bucket per request
 // and never refills one — and every such request still reaches the
 // handler's entrypoint lookup before it 404s. The outer limit is

internal/middleware/ratelimit_test.go

@@ -275,7 +275,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// pass.
 	for i := range limit {
 		w := receiverPost(
-			handler, "9.9.9.9:1234", "/webhook/uuid-a",
+			handler, "9.9.9.9:1234", "/h/uuid-a",
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -286,7 +286,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// The next request over the limit is rejected with a 429
 	// carrying a Retry-After header.
 	w := receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-a",
+		handler, "9.9.9.9:1234", "/h/uuid-a",
 	)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 	assert.NotEmpty(
@@ -296,7 +296,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 
 	// The same IP is not limited on a different entrypoint.
 	w = receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-b",
+		handler, "9.9.9.9:1234", "/h/uuid-b",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -305,7 +305,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 
 	// A different IP is not limited on the same entrypoint.
 	w = receiverPost(
-		handler, "8.8.8.8:1234", "/webhook/uuid-a",
+		handler, "8.8.8.8:1234", "/h/uuid-a",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -322,7 +322,7 @@ func TestReceiverRateLimit_CountsEveryMethod(t *testing.T) {
 	const (
 		limit = 2
 		ip    = "7.7.7.7:1234"
-		path  = "/webhook/uuid-c"
+		path  = "/h/uuid-c"
 	)
 
 	handler := receiverLimitedHandler(t, limit)
@@ -384,8 +384,8 @@ const (
 	// trustedProxyCIDR is the proxy network the forwarded-path
 	// tests configure, and trustedPeer an address inside it. A
 	// production deployment is required to run behind a reverse
-	// proxy with TRUSTED_PROXIES set, so this is the shape the
+	// proxy that TRUSTED_PROXIES covers, either by the default or by
-	// bucketing has to hold in.
+	// a set value, so this is the shape the bucketing has to hold in.
 	trustedProxyCIDR = "10.0.0.0/8"
 	trustedPeer      = "10.0.0.1:44444"
 )
@@ -426,8 +426,8 @@ func assertSharedBucket(
 }
 
 // TestRateLimitKey_SpoofedForwardedFromUntrustedPeer is the test
-// this gating exists for: with no trusted proxies configured (the
+// this gating exists for: from a peer that is not a trusted
-// default), a client that rotates a forwarded header on every
+// proxy, a client that rotates a forwarded header on every
 // request must stay in one bucket. If forwarded headers were
 // trusted unconditionally, each spoofed value would mint a fresh
 // bucket and the limit would stop no one.
@@ -715,7 +715,7 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	// none of them shares a per-entrypoint bucket with another.
 	for i := range aggregate {
 		w := receiverPost(
-			handler, ip, fmt.Sprintf("/webhook/invented-%d", i),
+			handler, ip, fmt.Sprintf("/h/invented-%d", i),
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -724,17 +724,17 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	}
 
 	w := receiverPost(
-		handler, ip, fmt.Sprintf("/webhook/invented-%d", aggregate),
+		handler, ip, fmt.Sprintf("/h/invented-%d", aggregate),
 	)
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"a client must not be able to raise its aggregate rate "+
-			"against /webhook/* by varying the path",
+			"against /h/* by varying the path",
 	)
 
 	// The aggregate limit is still per client IP: exhausting one
 	// address must not throttle another.
-	w = receiverPost(handler, "6.6.6.7:1234", "/webhook/invented-0")
+	w = receiverPost(handler, "6.6.6.7:1234", "/h/invented-0")
 	assert.Equal(
 		t, http.StatusOK, w.Code,
 		"a different client IP must not be affected",
@@ -771,7 +771,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 	// limit requests are served; the rest are rejected by the
 	// per-entrypoint limiter but still count against the aggregate.
 	for i := range aggregate {
-		w := receiverPost(handler, ip, "/webhook/exhausted")
+		w := receiverPost(handler, ip, "/h/exhausted")
 
 		want := http.StatusTooManyRequests
 		if i < limit {
@@ -784,7 +784,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 		)
 	}
 
-	w := receiverPost(handler, ip, "/webhook/never-used")
+	w := receiverPost(handler, ip, "/h/never-used")
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"requests rejected per entrypoint must still count "+
@@ -823,7 +823,7 @@ func TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer(
 	const (
 		limit = 3
 		peer  = "203.0.113.10:44444"
-		path  = "/webhook/uuid-d"
+		path  = "/h/uuid-d"
 	)
 
 	handler := receiverLimitedHandler(t, limit)
@@ -1097,8 +1097,9 @@ func TestPostRateLimit_IPv4IndependentPerAddress(t *testing.T) {
 // that arrives from trustedPeer — a configured trusted proxy — and
 // names forwarded as its client in X-Forwarded-For. That is the
 // production path: a deployment is required to run behind a reverse
-// proxy with TRUSTED_PROXIES set, so the forwarded address, not the
+// proxy that TRUSTED_PROXIES covers, either by the default or by a
-// peer, is what the limiters bucket on there.
+// set value, so the forwarded address, not the peer, is what the
+// limiters bucket on there.
 func forwardedKeyFor(
 	t *testing.T, m *middleware.Middleware, forwarded string,
 ) string {
@@ -1178,9 +1179,9 @@ func TestRateLimitKey_ForwardedIPv6BucketsByPrefix(t *testing.T) {
 //
 // Every existing test of this fallback uses an IPv4 proxy, where
 // bucketKey is the identity function, so replacing the call with
-// peer.String() leaves the whole suite green. Only operator-listed
+// peer.String() leaves the whole suite green. Only addresses inside
-// addresses reach this line and the fallback is fail-closed, so this
+// TRUSTED_PROXIES reach this line and the fallback is fail-closed, so
-// pins behaviour rather than fixing a defect.
+// this pins behaviour rather than fixing a defect.
 func TestRateLimitKey_TrustedPeerUnusableForwardedMasksPeer(
 	t *testing.T,
 ) {

internal/middleware/recoverer.go

@@ -109,7 +109,8 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
 
 // Recoverer returns middleware that turns a handler panic into one
 // structured ERROR record and a 500, rather than a dropped
-// connection.
+// connection. The 500 is page when page is not nil, and plain text
+// when it is nil or when page panics before writing anything.
 //
 // It replaces chi's middleware.Recoverer, which does neither on a
 // current Go release. chi v1.5.5's pretty-printer scans the stack for
@@ -136,9 +137,13 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
 //
 // Unlike http.Error on its own, it deletes any Set-Cookie the handler
 // set before panicking, because a request that failed must not hand
-// the client a credential; every other header is left to http.Error.
+// the client a credential. It touches no other header: when page
+// answers, every other header the handler set goes out with it, apart
+// from any page sets itself; otherwise they are left to http.Error.
 // See https://git.eeqj.de/sneak/webhooker/issues/193.
-func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
+func (s *Middleware) Recoverer(
+	page http.Handler,
+) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(
 			w http.ResponseWriter,
@@ -171,6 +176,14 @@ func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
 
 				rw.Header().Del("Set-Cookie")
 
+				if page != nil {
+					s.servePage(rw, r, page)
+				}
+
+				if rw.committed {
+					return
+				}
+
 				http.Error(
 					rw,
 					http.StatusText(
@@ -185,6 +198,27 @@ func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
 	}
 }
 
+// servePage answers with page. A panic in page itself is logged and
+// recovered here, so the Recoverer can still send its plain 500.
+func (s *Middleware) servePage(
+	w http.ResponseWriter,
+	r *http.Request,
+	page http.Handler,
+) {
+	defer func() {
+		rvr := recover()
+		if rvr != nil {
+			s.log.Error("error page panic",
+				"panic", logfield.Truncate(
+					fmt.Sprint(rvr), maxPanicValueBytes,
+				),
+			)
+		}
+	}()
+
+	page.ServeHTTP(w, r)
+}
+
 // logPanic writes the record. Every field it can grow is truncated to
 // a fixed budget, so MaxPanicLogLineBytes holds.
 //

internal/middleware/recoverer_test.go

@@ -76,7 +76,7 @@ func newRecovererProbe(
 	// Logging outside so the recovered 500 is the status it records.
 	router.Use(chimw.RequestID)
 	router.Use(m.Logging())
-	router.Use(m.Recoverer())
+	router.Use(m.Recoverer(nil))
 	router.Get("/probe", handler)
 
 	serverErrors := new(bytes.Buffer)
@@ -637,7 +637,7 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
 
 	m, _ := capturingMiddleware(t)
 
-	handler := m.Recoverer()(http.HandlerFunc(
+	handler := m.Recoverer(nil)(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = w.Write([]byte("chunk"))
 
@@ -672,3 +672,59 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 	assert.Equal(t, "chunk", string(body))
 }
+
+// TestRecovererAnswersWithThePage covers a recoverer given a page:
+// the panic is logged as before, and the 500 is that page.
+func TestRecovererAnswersWithThePage(t *testing.T) {
+	t.Parallel()
+
+	m, logs := capturingMiddleware(t)
+
+	page := http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("the error page"))
+		},
+	)
+
+	w := httptest.NewRecorder()
+	m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
+		w, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		),
+	)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(t, "the error page", w.Body.String())
+	assert.Contains(t, logs.String(), `"msg":"handler panic"`)
+	assert.Contains(t, logs.String(), panicMarker)
+}
+
+// TestRecovererFallsBackWhenThePagePanics covers a page that panics
+// before writing anything: both panics are logged, and the client
+// still gets the plain 500.
+func TestRecovererFallsBackWhenThePagePanics(t *testing.T) {
+	t.Parallel()
+
+	m, logs := capturingMiddleware(t)
+
+	const pagePanic = "QQERRORPAGEPANICQQ"
+
+	page := http.HandlerFunc(
+		func(http.ResponseWriter, *http.Request) {
+			panic(pagePanic)
+		},
+	)
+
+	w := httptest.NewRecorder()
+	m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
+		w, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		),
+	)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(t, "Internal Server Error\n", w.Body.String())
+	assert.Contains(t, logs.String(), panicMarker)
+	assert.Contains(t, logs.String(), pagePanic)
+}