Store a webhook's retention as a plain day count, 0 meaning forever (closes #539)

retention_days loses its column default of 30, and Webhook.RetentionDays
its default tag, so a 0 is stored as 0. The 365000-day stand-in
RetentionForeverDays and the BeforeSave hook that wrote it are gone. The
reaper and the "forever" label read 0 as forever, and the forms accept 0
or 1 to MaxFiniteRetentionDays; a blank field still gives 30 on the new
webhook form and keeps the stored value on the edit form. A negative
value, which the forms refuse, is still read as forever so it cannot put
the reaper's cutoff in the future.

Model: opus-5-5

README.md

@@ -802,12 +802,7 @@ comes up, serves pages, and is broken in a way nothing reports.
    proxy's log names it regardless. nginx's default `combined` format already
    logs `$remote_addr`; do not replace it with one that drops the client
    address, and retain those logs as long as you would want to answer a question
-   about traffic. That log also records the full request path, so it holds the
-   entrypoint UUID of every event a sender posts. webhooker's own log does not,
-   apart from the line a `log` target writes. Protect the proxy's log as you
-   would the entrypoint URLs themselves: anyone who can read it can post events
-   to every entrypoint in it (see
-   [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret)).
+   about traffic.
 
 ### nginx
 
@@ -833,9 +828,7 @@ server {
     client_max_body_size 1m;
 
     # $remote_addr is the client. webhooker's own log names it, as
-    # clientIP, only while TRUSTED_PROXIES covers this proxy. The
-    # request path in this log holds the entrypoint UUID, so protect
-    # the file like the entrypoint URL itself.
+    # clientIP, only while TRUSTED_PROXIES covers this proxy.
     access_log /var/log/nginx/webhooker.access.log combined;
 
     location / {
@@ -1167,16 +1160,7 @@ What that means for an operator:
 
 - **The URL is a capability, so treat it as a secret.** Keep it out of logs,
   ticket bodies, chat messages and screenshots. Anyone who reads it anywhere can
-  post events as that sender. Apart from a `log` target's line, webhooker's own
-  log lines never carry the UUID: they name a request to the receiver by the
-  route pattern `/h/{uuid}`, the `webhook request received` line names the
-  entrypoint by its `entrypoint_id`, and the access log keeps only the scheme
-  and host of a `Referer`. A `log` target writes the request's headers as
-  received, so a `Referer` naming the entrypoint URL appears in its line, as it
-  does when a sender has followed a redirect from `http://` to `https://`. The
-  reverse proxy's access log does carry the UUID, in the request path, so it
-  must be protected like the URL itself (see
-  [Deployment behind a reverse proxy](#deployment-behind-a-reverse-proxy)).
+  post events as that sender.
 - **Rotating means minting a new entrypoint, not changing a key.** There is no
   way to rotate the UUID in place. To retire one, delete the entrypoint (or
   deactivate it, which answers `410`) and create a new one, then point the
@@ -1251,37 +1235,34 @@ markup. The CSP build runs no expressions, so every Alpine directive in
 `static/js/app.js`: `x-data="collapsible"` and `@click="toggle"`, never
 `x-data="{ open: false }"` or `@click="open = !open"`.
 
-A browser test in `internal/server` loads the sign-in page, the webhook page,
-its edit pages, the event log, the webhook list, the settings page, the profile
-page and the `404` error page shown for a path that does not exist, under the
-real policy and checks that: the add entrypoint form stays hidden until Add is
-clicked; for every target type, the targets section's Add shows only a choice of
-type with Next and Cancel, Next shows only that type's fields (no url field for
-`database` or `log`), Cancel at either step closes the form, and saving adds the
-target; a refused target comes back with its form open, the values entered and
-the reason, and after Cancel the next Add starts with an empty form and no
-reason; a refused save on the target edit page and on the webhook edit page
-comes back with the reason and every value entered; the Copy button beside an
-entrypoint URL reads "Copied" once clicked; an entrypoint's Edit button shows
-its edit form in place of its description and hides until the form closes,
-Cancel hides the form and drops what was typed, as does leaving the page and
-going back to it, and Save changes the description; of the recent events on the
-webhook page only the newest starts expanded, each expands and collapses, and
-Open leads to the event's own page; of the events in the event log only the
-newest starts expanded, and an event there expands and collapses when its row's
-caret or its ID is clicked, and from the keyboard, but not when its ID is
-selected with the mouse, and a delivery's attempts inside it expand and
-collapse; at phone width the menu button opens and closes the mobile menu, and
-neither the webhook page nor the event log, with a delivery's attempts open,
-scrolls sideways or cuts anything off at the page's or a card's edge; and a
-target's Delete asks first, naming the target, sends nothing when the answer is
-no and deletes the target when it is yes. It also fails if the browser reports a
-console warning or error, an uncaught exception, or anything the policy refused.
-`make check` and the image build lint it but do not run it, and `make test`
-leaves it out (its file is built only with the `browser` build tag). Run it with
-`make test-browser` after changing `templates/` or `static/js/`: that builds
-`Dockerfile.browser`, which runs the test in a digest-pinned headless browser
-image, so the host needs no browser.
+A browser test in `internal/server` loads the webhook page, its edit pages and
+the event log under the real policy and checks that: the add entrypoint form
+stays hidden until Add is clicked; for every target type, the targets section's
+Add shows only a choice of type with Next and Cancel, Next shows only that
+type's fields (no url field for `database` or `log`), Cancel at either step
+closes the form, and saving adds the target; a refused target comes back with
+its form open, the values entered and the reason, and after Cancel the next Add
+starts with an empty form and no reason; a refused save on the target edit page
+and on the webhook edit page comes back with the reason and every value entered;
+the Copy button beside an entrypoint URL reads "Copied" once clicked; an
+entrypoint's Edit button shows its edit form in place of its description and
+hides until the form closes, Cancel hides the form and drops what was typed, as
+does leaving the page and going back to it, and Save changes the description; of
+the recent events on the webhook page only the newest starts expanded, each
+expands and collapses, and Open leads to the event's own page; of the events in
+the event log only the newest starts expanded, and an event there expands and
+collapses when its row's caret or its ID is clicked, and from the keyboard, but
+not when its ID is selected with the mouse, and a delivery's attempts inside it
+expand and collapse; and at phone width the menu button opens and closes the
+mobile menu, and neither the webhook page nor the event log, with a delivery's
+attempts open, scrolls sideways or cuts anything off at the page's or a card's
+edge. It also fails if the browser reports a console warning or error, an
+uncaught exception, or anything the policy refused. `make check` and the image
+build lint it but do not run it, and `make test` leaves it out (its file is
+built only with the `browser` build tag). Run it with `make test-browser` after
+changing `templates/` or `static/js/`: that builds `Dockerfile.browser`, which
+runs the test in a digest-pinned headless browser image, so the host needs no
+browser.
 
 The package's tarball is committed as `3p/alpinejs-csp-3.14.9.tgz`, byte for
 byte as the npm registry publishes it. It is a dependency, not this repo's build
@@ -1314,9 +1295,7 @@ and commit the regenerated file with the change. Tailwind takes classes only
 from the files that `input.css` names in its `@source` lines; a class written in
 any other file is not generated until that file is named there too. `make check`
 and the image build fail when the committed file differs from what `make css`
-generates. `static/css/style.css` is hand-written and is not generated. The
-pages' Content-Security-Policy refuses inline styles, so a template styles an
-element with a class, never a `style` attribute.
+generates. `static/css/style.css` is hand-written and is not generated.
 
 `make css` runs the Tailwind standalone CLI in Docker, at the version and sha256
 pinned in the Dockerfile's stylesheet stages; it is never installed on the host.
@@ -1517,47 +1496,35 @@ the rotation chosen below that (none, monthly, daily or hourly). Both are
 validated as on the add target form, and the webhook and its targets are created
 together or not at all.
 
-| Field            | Type    | Description                                                 |
-| ---------------- | ------- | ----------------------------------------------------------- |
-| `id`             | UUID    | Primary key                                                 |
-| `user_id`        | UUID    | Foreign key → User                                          |
-| `name`           | string  | Human-readable name                                         |
-| `description`    | string  | Optional description                                        |
-| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |
+| Field            | Type    | Description                                   |
+| ---------------- | ------- | --------------------------------------------- |
+| `id`             | UUID    | Primary key                                   |
+| `user_id`        | UUID    | Foreign key → User                            |
+| `name`           | string  | Human-readable name                           |
+| `description`    | string  | Optional description                          |
+| `retention_days` | integer | Days to retain events; 0 means retain forever |
 
 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.
 
 The `retention_days` field controls how long event data is kept in the webhook's
 dedicated database before automatic cleanup.
 
-Setting `retention_days` to `0` means "retain events forever". Because the
-column carries a default of 30, a literal zero cannot survive an insert, so a
-zero is rewritten on save to a sentinel of `365 * 1000` days
-(`database.RetentionForeverDays`). The retention reaper recognises that sentinel
-and skips the webhook entirely, and the web UI displays such a webhook's
-retention as "forever" rather than as a day count.
+The value is stored as entered. Setting `retention_days` to `0` means "retain
+events forever": the retention reaper skips the webhook entirely, and the web UI
+displays its retention as "forever" rather than as a day count.
 
-Submitted `retention_days` values therefore fall into three bands, not two:
-
-- `1` up to `database.MaxFiniteRetentionDays` (106751 days, about 292 years) is
-  accepted as a finite retention.
-- Above that ceiling but below the retain-forever sentinel of 365000
-  (`database.RetentionForeverDays`) is rejected with a 400. This is the band the
-  cap exists for.
-- `0`, and `365000` or above, are accepted and mean retain forever, collapsing
-  to the sentinel — `0` in `Webhook.BeforeSave`, the large values in
-  `parseRetentionDays`. The large values are not out of range: the edit form
-  pre-fills the sentinel for a retain-forever webhook, so submitting that form
-  back unchanged has to keep meaning "forever".
-
-A negative value is in none of the three: `parseRetentionDays` rejects it with a
-400 before `BeforeSave` ever sees it.
+The new webhook and edit forms accept `0`, or a whole number of days from `1` up
+to `database.MaxFiniteRetentionDays` (106751 days, about 292 years). Anything
+else, a negative value or one above that cap included, is rejected with a 400. A
+blank field gives the default of 30 days (`database.DefaultRetentionDays`) on
+the new webhook form, and leaves the stored value unchanged on the edit form.
 
 The cap is not arbitrary: the reaper computes its cutoff as a `time.Duration`,
 an int64 nanosecond count, and a longer period overflows it. An overflowed
 cutoff lands in the future, where it matches every row, so the sweep would
 delete every event the webhook has instead of none. The reaper also clamps the
-value it reads to the cap, so no stored value can trigger that either.
+value it reads to the cap, and reads a negative value as forever, so no stored
+value can trigger that either.
 
 #### Entrypoint
 
@@ -2443,32 +2410,27 @@ log volume it caps rather than eliminates. A path that names no entrypoint is
 recorded by the handler at `DEBUG`, and the aggregate limiter logs its own
 rejections at `DEBUG` and without the path, so neither appears at all under the
 default level. The per-entrypoint limiter is the loud one: it logs every
-rejection at `WARN`, naming the route pattern `/h/{uuid}` rather than the
-request path. A client hammering a single invented path is served
+rejection at `WARN` with the request path, which on this route is
+attacker-controlled text. A client hammering a single invented path is served
 `RECEIVER_RATE_LIMIT` requests and has the rest of its aggregate budget rejected
 there, so the aggregate limit is what bounds the _number_ of those `WARN` lines
 — to under ten times `RECEIVER_RATE_LIMIT` per minute per client IP, 1080 at the
-defaults, where before it there was no bound at all. The access log is bounded
-by neither limit: every request is recorded once at `INFO`, served or rejected
-alike.
+defaults, where before it there was no bound at all. Their _width_ is bounded by
+the field budgets below, the same ones the access log spends. The access log is
+bounded by neither limit: every request is recorded once at `INFO`, served or
+rejected alike.
 
-What the access log does bound is the _content_ of those lines. On the receiver
-route it logs the route pattern `/h/{uuid}` whatever the status, because the
-concrete path carries the entrypoint UUID, which is the entrypoint's credential
-(see
-[The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret)).
-A request chi never routed, because it matched no route or because a middleware
-answered it first, logs the literal `(unmatched)` whatever the status. In the
-`dev` environment the CORS middleware answers a preflight that way, so a
-preflight to the receiver does not log its UUID either. On every other route, a
-3xx or 4xx response logs the chi route pattern, such as `/user/{username}//`, in
-place of the concrete URL. Those are the outcomes an unauthenticated client can
-drive for free: a 404 on any invented path, a login redirect on any invented
-profile path. Logging the URL there would let a flood write text of its own
-choosing, at a length of its own choosing, into the log. 2xx and 5xx responses
-keep the concrete path — a success resolved against a static route or against
-the operator's own data, and a 5xx is a bug in this service, where the exact
-path is the evidence and no client can provoke one at will.
+What the access log does bound is the _content_ of those lines. A 3xx or 4xx
+response logs the chi route pattern — `/h/{uuid}`, `/user/{username}//`, or the
+literal `(unmatched)` when the request hit no route at all — in place of the
+concrete URL. Those are the outcomes an unauthenticated client can drive for
+free: 404 and 429 on any invented receiver path, a login redirect on any
+invented profile path. Logging the URL there would let a flood write text of its
+own choosing, at a length of its own choosing, into the log. 2xx and 5xx
+responses keep the concrete path — a success resolved against a static route or
+against the operator's own data (on the receiver, against a stored entrypoint
+UUID), and a 5xx is a bug in this service, where the exact path is the evidence
+and no client can provoke one at will.
 
 The query string is never logged; it is replaced by the fixed marker
 `?(redacted)`. It is client-chosen on every route, and
@@ -2480,11 +2442,6 @@ to, `notice`, which names the line a page shows after an action, and the event
 log's `show`, which picks the events it lists. A query string sent to an
 entrypoint is not lost either: the event stores it, and the event log shows it.
 
-The `referer` field keeps only the scheme and host of the request's `Referer`,
-and logs `(redacted)` for one without them, because its path can be an
-entrypoint URL: a sender that follows the `http://` to `https://` redirect in
-the nginx example sends the URL it was redirected from.
-
 Client-supplied request content does not leave the host by the other route
 either. The Sentry SDK attaches the request to every event it captures,
 independently of the access log, and `SendDefaultPII=false` does not cover all
@@ -2499,10 +2456,9 @@ The same hook rewrites the request URL. The SDK builds it as
 `scheme://host/path` from the concrete path, which on the receiver route is
 `/h/<uuid>` in full — and that UUID is a write capability, not an identifier:
 anyone holding it can post events this service accepts and its targets then
-deliver. What is sent is the chi route pattern instead: `http://host/h/{uuid}`.
-A tracker has its own retention, access control and deletion policy, so the
-pattern is sent on every route, including the 2xx and 5xx responses outside the
-receiver for which the access log keeps the concrete path.
+deliver. A tracker has its own retention, access control and deletion policy, so
+the rule the access log follows above does not carry across that boundary. What
+is sent is the chi route pattern instead: `http://host/h/{uuid}`.
 
 The scheme and the host are kept, and everything else in the URL is discarded
 rather than edited, so a future SDK version that starts appending a query string
@@ -2631,7 +2587,9 @@ than it:
 | ------------------------------------------ | ------- | ------------------- | ------------------------------------------ |
 | `request body exceeds limit` (413)         | `WARN`  | path, method        | yes — `MaxBodySize` precedes `RequireAuth` |
 | `csrf: token validation failed` (403)      | `WARN`  | path, method        | yes — `CSRF` precedes `RequireAuth`        |
+| `... rate limit exceeded` (429)            | `WARN`  | path                | yes, on the receiver                       |
 | `auth middleware: unauthenticated request` | `DEBUG` | path, method        | yes, by definition                         |
+| `entrypoint not found`                     | `DEBUG` | entrypoint UUID     | yes, on the receiver                       |
 | `user not found` / `invalid password`      | `DEBUG` | username            | yes, on the sign-in form                   |
 | `login failure limit exceeded` (429)       | `WARN`  | path                | yes, on the sign-in form                   |
 | `password verification capacity exhausted` | `WARN`  | path                | yes, on the sign-in form                   |
@@ -2659,12 +2617,13 @@ wider of the two handlers spends more on than the client spent sending them.
 Every case holds each line to the 2,560-byte ceiling. That per-line ceiling is
 what the figure above states, and every row establishes it.
 
-Two of the sites go further and bound the whole flood's output — the total bytes
-a run of distinct invented values wrote, which is the shape an operator sizing
-storage cares about. They are `request body exceeds limit`
-(`TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog`) and `user not found`
-(through `assertBoundedFlood`). The other rows carry no aggregate assertion; the
-per-line ceiling is what they establish.
+Three of the sites go further and bound the whole flood's output — the total
+bytes a run of distinct invented values wrote, which is the shape an operator
+sizing storage cares about. They are `request body exceeds limit`
+(`TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog`),
+`entrypoint not found` and `user not found` (the last two through
+`assertBoundedFlood`). The other rows carry no aggregate assertion; the per-line
+ceiling is what they establish.
 
 `internal/logfield/logfield_test.go` measures the per-rune charge against what
 the handlers really emit, over roughly 3,000 code points on each, so an
@@ -2682,7 +2641,7 @@ everything else, so its lines take the level the operator set and the handler
 `internal/logger` selected, and every value it emits is spent through the same
 `internal/logfield` budget. A record-not-found is not logged as an error: it is
 the expected outcome on both of those paths, and each handler already records
-its own miss at `DEBUG`, without the SQL and within the ceiling above. Slow
+its own miss at `DEBUG` — bounded, per the table above — without the SQL. Slow
 statements are kept, at `WARN`, above the same 200 ms threshold GORM used and
 with the statement bounded, because that report is the one thing GORM's logger
 gave an operator that nothing else here does. The adapter orders its cases
@@ -3111,8 +3070,8 @@ webhooker/
 │   ├── static.go              # //go:embed directive
 │   ├── css/input.css          # Tailwind input, source for tailwind.css (make css)
 │   ├── css/tailwind.css       # Generated stylesheet the pages load
-│   ├── css/style.css          # Hand-written, loaded after tailwind.css: btn-small, the pointer cursor for input.css's buttons, the webhook list cards' focus outline, the rule hiding x-cloak elements
-│   ├── js/app.js              # Copy-to-clipboard, the delete prompts, and the Alpine.js components
+│   ├── css/style.css          # Hand-written, loaded after tailwind.css: btn-small, the pointer cursor for input.css's buttons, the webhook list cards' focus outline
+│   ├── js/app.js              # Copy-to-clipboard, and the Alpine.js components
 │   └── js/alpine.min.js       # Alpine.js CSP build, extracted from 3p/ by make assets, not committed
 ├── templates/                 # Go HTML templates (base, login, sources, etc.)
 ├── script/                    # Scripts to Rule Them All entrypoints
@@ -3166,9 +3125,8 @@ Applied to all routes in this order:
 
 1. **RequestID** — Generate unique request IDs (chi built-in)
 2. **SecurityHeaders** — Production security headers on every response (HSTS
-   unless `HSTS_MAX_AGE` is `0`, X-Content-Type-Options, X-Frame-Options, CSP
-   `default-src 'self'; script-src 'self'; style-src 'self'`, Referrer-Policy,
-   Permissions-Policy)
+   unless `HSTS_MAX_AGE` is `0`, X-Content-Type-Options, X-Frame-Options, CSP,
+   Referrer-Policy, Permissions-Policy)
 3. **Logging** — Structured request logging (method, URL, status, latency,
    remote IP, client IP, user agent, request ID)
 4. **Metrics** — Prometheus HTTP metrics (if `METRICS_USERNAME` and
@@ -3253,12 +3211,6 @@ credential check, see [The login endpoint](#the-login-endpoint).
 - Production security headers on all responses: HSTS (unless `HSTS_MAX_AGE` is
   `0`), X-Content-Type-Options (`nosniff`), X-Frame-Options (`DENY`),
   Content-Security-Policy, Referrer-Policy, and Permissions-Policy
-- The Content-Security-Policy is
-  `default-src 'self'; script-src 'self'; style-src 'self'`: a page takes
-  scripts and styles only from files webhooker serves, and the browser runs no
-  inline script or event handler and ignores any `<style>` element or `style`
-  attribute in a page. The pages need none: their scripts are in `static/js/`
-  and their styles in `static/css/`
 - Request body size limits (1 MB) on all form POST endpoints, enforced by
   middleware that runs before CSRF parses the form
 - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf) on all

internal/database/model_webhook.go

@@ -4,27 +4,13 @@ import (
 	"math"
 	"strconv"
 	"time"
-
-	"gorm.io/gorm"
 )
 
 const (
-	// DefaultRetentionDays is the event retention period applied to a
-	// webhook created without an explicit retention value. It is the
-	// single source of truth for that policy and must stay in sync
-	// with the `gorm:"default:30"` column default on
-	// Webhook.RetentionDays below; a struct tag cannot reference a
-	// constant, so a test asserts the two agree.
+	// DefaultRetentionDays is the event retention period the new
+	// webhook form applies when its retention field is left blank.
 	DefaultRetentionDays = 30
 
-	// RetentionForeverDays is the sentinel RetentionDays value meaning
-	// "retain events forever". Users express that intent as 0, which
-	// Webhook.BeforeSave rewrites to this value: the column default
-	// substitutes DefaultRetentionDays for a zero value at insert
-	// time, so a zero can never survive a round trip to the database.
-	// Nothing outside this file may hardcode the number.
-	RetentionForeverDays = 365 * 1000
-
 	// MaxFiniteRetentionDays is the largest finite retention period the
 	// reaper's cutoff arithmetic can represent, and therefore the
 	// largest one a caller may request. It is derived from that
@@ -38,9 +24,7 @@ const (
 	// turns the cutoff into a timestamp in the far future that matches
 	// every row in the webhook's database. That is why this bound is
 	// enforced on input and why retentionCutoff saturates underneath
-	// it. Note that RetentionForeverDays deliberately sits above this
-	// ceiling: such webhooks are skipped before any cutoff is
-	// computed, and never reach the arithmetic at all.
+	// it.
 	MaxFiniteRetentionDays = int(
 		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
 	)
@@ -48,12 +32,10 @@ const (
 
 // Webhook represents a webhook processing unit that groups entrypoints and targets
 //
-// Every method below takes a pointer receiver. BeforeSave has to,
-// because it mutates the record and GORM only invokes hooks declared
-// that way; the display helpers follow suit so the receiver kinds do
-// not mix. Handlers therefore put a *Webhook into template data:
-// html/template cannot call a pointer method on a value held in a map,
-// because a map element is not addressable.
+// Every method below takes a pointer receiver, so handlers put a
+// *Webhook into template data: html/template cannot call a pointer
+// method on a value held in a map, because a map element is not
+// addressable.
 type Webhook struct {
 	BaseModel
 
@@ -61,10 +43,9 @@ type Webhook struct {
 	Name        string `gorm:"not null"           json:"name"`
 	Description string `json:"description"`
 
-	// RetentionDays is the number of days to retain events. A value of
-	// RetentionForeverDays means retain forever. The column default
-	// must equal DefaultRetentionDays.
-	RetentionDays int `gorm:"default:30" json:"retentionDays"`
+	// RetentionDays is the number of days to retain events, and 0
+	// means retain them forever.
+	RetentionDays int `json:"retentionDays"`
 
 	// Relations. No model marshals the record it belongs to:
 	// User.Webhooks leads back here, and the JSON could loop.
@@ -73,36 +54,17 @@ type Webhook struct {
 	Targets     []Target     `json:"targets,omitempty"`
 }
 
-// BeforeSave normalises RetentionDays on every insert and update. A
-// non-positive value is the user's way of asking for "retain forever",
-// which is stored as the RetentionForeverDays sentinel.
-//
-// This has to happen in a hook rather than at the call sites. GORM
-// substitutes the column default (DefaultRetentionDays) for a zero
-// value while building the insert statement, which runs after
-// BeforeSave; rewriting any later than this loses that race and the
-// row lands at 30 days. Living on the model also means a future call
-// site, such as a REST API or a fixture, cannot bypass it.
-func (w *Webhook) BeforeSave(_ *gorm.DB) error {
-	if w.RetentionDays <= 0 {
-		w.RetentionDays = RetentionForeverDays
-	}
-
-	return nil
-}
-
-// retainsForever reports whether a stored RetentionDays value means
-// "keep events indefinitely". It is the single definition of that
-// question, shared by Webhook.RetainsForever and by the reaper's
+// retainsForever reports whether a RetentionDays value means "keep
+// events indefinitely", which 0 does. It is the single definition of
+// that question, shared by Webhook.RetainsForever and by the reaper's
 // cutoff computation so the two cannot disagree about which webhooks
 // are exempt from reaping.
 //
-// It accepts the RetentionForeverDays sentinel written by BeforeSave
-// and, defensively, any non-positive value, which BeforeSave treats
-// as a request to retain forever.
+// A negative value, which the forms refuse, is read the same way: as a
+// day count it would put the cutoff in the future, where it matches
+// every event the webhook has.
 func retainsForever(retentionDays int) bool {
-	return retentionDays <= 0 ||
-		retentionDays >= RetentionForeverDays
+	return retentionDays <= 0
 }
 
 // RetainsForever reports whether this webhook's events are kept
@@ -119,7 +81,8 @@ func (w *Webhook) RetentionCutoff(now time.Time) (time.Time, bool) {
 }
 
 // RetentionLabel returns the webhook's retention policy as display
-// text, so that no template has to know about the sentinel value.
+// text: "forever" rather than "0 days" for a webhook that keeps its
+// events.
 func (w *Webhook) RetentionLabel() string {
 	if w.RetainsForever() {
 		return "forever"

internal/database/model_webhook_test.go

@@ -2,8 +2,6 @@ package database_test
 
 import (
 	"context"
-	"reflect"
-	"strconv"
 	"testing"
 	"time"
 
@@ -47,8 +45,7 @@ func storedRetention(t *testing.T, db *gorm.DB, id string) int {
 }
 
 // newWebhookWithRetention creates a webhook through the ordinary Create
-// path, so the BeforeSave hook and the GORM column default both apply
-// exactly as they do in production.
+// path, as the new webhook form does.
 func newWebhookWithRetention(
 	t *testing.T,
 	db *gorm.DB,
@@ -67,7 +64,7 @@ func newWebhookWithRetention(
 	return wh.ID
 }
 
-func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
+func TestWebhookRetentionDays_ZeroIsStoredAsZero(t *testing.T) {
 	t.Parallel()
 
 	db := startedTestDB(t)
@@ -75,31 +72,10 @@ func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
 	wh := &database.Webhook{RetentionDays: 0}
 	id := newWebhookWithRetention(t, db, wh)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-		"a zero retention must be stored as the sentinel, "+
-			"not replaced by the column default",
-	)
+	assert.Equal(t, 0, storedRetention(t, db, id))
 }
 
-func TestWebhookBeforeSave_NegativeBecomesForeverSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: -5}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
+func TestWebhookRetentionDays_DayCountIsStored(t *testing.T) {
 	t.Parallel()
 
 	db := startedTestDB(t)
@@ -110,10 +86,9 @@ func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
 	assert.Equal(t, 7, storedRetention(t, db, id))
 }
 
-// TestWebhookBeforeSave_UpdateToZeroBecomesSentinel proves the hook
-// fires on update as well as insert, via the same Save call the edit
-// handler makes.
-func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
+// TestWebhookRetentionDays_UpdateToZeroIsStoredAsZero changes a day
+// count to 0 through the same Save call the edit handler makes.
+func TestWebhookRetentionDays_UpdateToZeroIsStoredAsZero(t *testing.T) {
 	t.Parallel()
 
 	db := startedTestDB(t)
@@ -125,28 +100,7 @@ func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
 	wh.RetentionDays = 0
 	require.NoError(t, db.Omit(clause.Associations).Save(wh).Error)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-// TestWebhookRetentionColumnDefaultMatchesConstant guards the one place
-// the default lives twice: a struct tag cannot reference a constant, so
-// this asserts the tag and DefaultRetentionDays agree.
-func TestWebhookRetentionColumnDefaultMatchesConstant(t *testing.T) {
-	t.Parallel()
-
-	field, ok := reflect.TypeFor[database.Webhook]().
-		FieldByName("RetentionDays")
-	require.True(t, ok, "Webhook.RetentionDays must exist")
-
-	assert.Equal(
-		t,
-		"default:"+strconv.Itoa(database.DefaultRetentionDays),
-		field.Tag.Get("gorm"),
-	)
+	assert.Equal(t, 0, storedRetention(t, db, id))
 }
 
 // TestMaxFiniteRetentionDaysIsTheOverflowCeiling asserts that the
@@ -176,14 +130,6 @@ func TestMaxFiniteRetentionDaysIsTheOverflowCeiling(t *testing.T) {
 		time.Duration(overCeiling*hoursPerDay)*time.Hour,
 		"one day past the ceiling must overflow",
 	)
-
-	assert.Less(
-		t,
-		database.MaxFiniteRetentionDays,
-		database.RetentionForeverDays,
-		"the sentinel sits above the ceiling and is only safe "+
-			"because retain-forever webhooks skip the arithmetic",
-	)
 }
 
 func TestWebhookRetainsForeverAndLabel(t *testing.T) {
@@ -195,16 +141,8 @@ func TestWebhookRetainsForeverAndLabel(t *testing.T) {
 		forever bool
 		label   string
 	}{
-		{
-			"sentinel",
-			database.RetentionForeverDays, true, testForeverLabel,
-		},
-		{
-			"above sentinel",
-			database.RetentionForeverDays + 1, true, testForeverLabel,
-		},
-		{"legacy zero", 0, true, testForeverLabel},
-		{"legacy negative", -1, true, testForeverLabel},
+		{"zero", 0, true, testForeverLabel},
+		{"negative", -1, true, testForeverLabel},
 		{"default", database.DefaultRetentionDays, false, "30 days"},
 		{"one day", 1, false, "1 day"},
 	}

internal/database/retention.go

@@ -243,7 +243,8 @@ func (r *RetentionReaper) reapWebhook(
 
 // retentionCutoff returns the timestamp before which a webhook's
 // events have expired, and whether any cutoff applies at all. It
-// reports false for a retain-forever policy, so no DELETE is issued.
+// reports false for a retention of 0, which means retain forever, so
+// no DELETE is issued.
 //
 // The day count is clamped to MaxFiniteRetentionDays first. This is
 // defense in depth rather than decoration: a time.Duration is an int64

internal/database/retention_test.go

@@ -85,41 +85,6 @@ func createWebhook(
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
 
-	// Webhook.BeforeSave rewrites a non-positive RetentionDays to the
-	// retain-forever sentinel, and the column's GORM default would
-	// otherwise substitute 30. Force the requested value with a
-	// column-level update so tests can plant legacy rows that predate
-	// the sentinel and still carry a literal 0 or negative value.
-	require.NoError(
-		t,
-		db.Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	return wh.ID
-}
-
-// createWebhookNormally inserts a webhook through the ordinary Create
-// path, with no column-level forcing, so Webhook.BeforeSave applies
-// exactly as it does in production. Passing 0 therefore yields a row
-// holding the RetentionForeverDays sentinel.
-func createWebhookNormally(
-	t *testing.T,
-	db *gorm.DB,
-	retentionDays int,
-) string {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
 	return wh.ID
 }
 
@@ -281,19 +246,19 @@ func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
 	assertChainPresent(t, db, recent)
 }
 
-// TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep covers the
-// end-to-end retain-forever path: a webhook created the normal way with
-// a requested retention of 0 lands on the RetentionForeverDays
-// sentinel, and the reaper leaves its ancient events alone while still
-// reaping a finite-retention webhook in the very same sweep.
-func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
+// TestRetentionReaper_SkipsZeroReapsFiniteInSameSweep covers the
+// end-to-end retain-forever path: a webhook created with a retention
+// of 0 reads back 0, and the reaper leaves its ancient events alone
+// while still reaping a finite-retention webhook in the very same
+// sweep.
+func TestRetentionReaper_SkipsZeroReapsFiniteInSameSweep(
 	t *testing.T,
 ) {
 	t.Parallel()
 
 	env := setupRetentionTest(t)
 
-	foreverID := createWebhookNormally(t, env.mainDB.DB(), 0)
+	foreverID := createWebhook(t, env.mainDB.DB(), 0)
 
 	var stored database.Webhook
 
@@ -302,14 +267,12 @@ func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
 		env.mainDB.DB().Where("id = ?", foreverID).
 			First(&stored).Error,
 	)
-	require.Equal(
-		t,
-		database.RetentionForeverDays,
-		stored.RetentionDays,
-		"a requested retention of 0 must persist as the sentinel",
+	require.Zero(
+		t, stored.RetentionDays,
+		"a retention of 0 must be stored as 0",
 	)
 
-	finiteID := createWebhookNormally(t, env.mainDB.DB(), 30)
+	finiteID := createWebhook(t, env.mainDB.DB(), 30)
 
 	foreverDB, err := env.mgr.GetDB(foreverID)
 	require.NoError(t, err)
@@ -335,14 +298,10 @@ func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
 // negative, so subtracting it moves the cutoff into the far future,
 // where "created_at < cutoff" matches every row: an event created a
 // moment ago, and its delivery and delivery result, were all deleted
-// on the first sweep. 200000 is inside that band and below the
-// retain-forever sentinel, so it is treated as a finite policy and
-// really does reach the arithmetic.
+// on the first sweep. 200000 is inside that band.
 //
-// The row is planted at the column level because such a value can no
-// longer be submitted through the form; the point of the test is that
-// a row from an older version, or a future call site, still cannot
-// trigger the wipe.
+// The form refuses such a value; the point of the test is that a row
+// written by any other path still cannot trigger the wipe.
 func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
 	t *testing.T,
 ) {
@@ -358,12 +317,6 @@ func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
 		database.MaxFiniteRetentionDays,
 		"the test value must exceed what the cutoff can represent",
 	)
-	require.Less(
-		t,
-		overflowingRetentionDays,
-		database.RetentionForeverDays,
-		"the test value must not be treated as retain-forever",
-	)
 
 	webhookID := createWebhook(
 		t, env.mainDB.DB(), overflowingRetentionDays,
@@ -379,14 +332,15 @@ func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
 	assertChainPresent(t, db, fresh)
 }
 
-func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
+// TestRetentionReaper_RetainsForeverWhenNegative checks that a negative
+// retention, which the forms refuse, keeps every event rather than
+// putting the cutoff in the future, where it would match them all.
+func TestRetentionReaper_RetainsForeverWhenNegative(t *testing.T) {
 	t.Parallel()
 
 	env := setupRetentionTest(t)
 
-	// A legacy row written before the sentinel existed still carries a
-	// literal 0; the <= 0 guard must keep honouring it.
-	webhookID := createWebhook(t, env.mainDB.DB(), 0)
+	webhookID := createWebhook(t, env.mainDB.DB(), -1)
 
 	db, err := env.mgr.GetDB(webhookID)
 	require.NoError(t, err)

internal/db/migrations/main/001_schema.sql

@@ -46,7 +46,7 @@ CREATE TABLE webhooks (
     user_id uuid NOT NULL,
     name text NOT NULL,
     description text,
-    retention_days integer DEFAULT 30,
+    retention_days integer,
     PRIMARY KEY (id),
     CONSTRAINT fk_users_webhooks FOREIGN KEY (user_id) REFERENCES users (id)
 );

internal/handlers/delivery_result_view_test.go

@@ -158,7 +158,8 @@ func TestHandleSourceLogs_RendersFailedAttempt(t *testing.T) {
 // TestHandleSourceLogs_EscapesResponseBody proves the
 // response body is treated as the untrusted remote content it
 // is. The remote chooses these bytes and the page is rendered
-// inside the operator's authenticated origin.
+// inside the operator's authenticated origin, where the
+// application's own CSP allows inline script from 'self'.
 func TestHandleSourceLogs_EscapesResponseBody(t *testing.T) {
 	t.Parallel()
 

internal/handlers/event_body.go

@@ -35,10 +35,11 @@ const eventBodyQuery = "SELECT cast(body as blob) " +
 // response is deliberately not renderable. Content-Disposition
 // makes the browser download rather than display it, and the
 // octet-stream type plus nosniff stop it being interpreted as
-// HTML or script. Without those a stored payload would be shown
-// as a page of the operator's own origin. The application's CSP
-// is a second defence behind them: it allows no inline script,
-// so such a page could not run script of its own.
+// HTML or script. Without those a stored payload would execute
+// as the logged-in operator. The application's CSP does not
+// help here: script-src allows 'unsafe-inline' from 'self', so
+// a document served from this origin could run its own inline
+// script.
 func (h *Handlers) HandleEventBodyDownload() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		webhook, ok := h.ownedWebhook(w, r)

internal/handlers/event_detail_test.go

@@ -84,7 +84,7 @@ func TestHandleEventDetail_ShowsEventWholeWithDeliveries(t *testing.T) {
 	assert.Contains(t, page, strconv.Itoa(len(body))+" bytes")
 	assert.Contains(t, page, "{\n  "pad": "xxx")
 	assert.Contains(t, page, ""tail": ""+sentinel+""\n}")
-	assert.Contains(t, page, `break-all max-h-[32rem] overflow-y-auto"`)
+	assert.Contains(t, page, `style="max-height: 32rem; overflow-y: auto"`)
 	assert.NotContains(t, page, "Showing the first")
 	assert.Contains(t, page, target.Name)
 	assert.Contains(t, page, ">failed</span>")

internal/handlers/logbound_test.go

@@ -1,15 +1,19 @@
 package handlers_test
 
-// The handler-side half of the log-field audit. The slog calls in
-// this package that reach a value an UNAUTHENTICATED client picks
-// outright, and of a length it picks outright, are the failed-login
-// DEBUG lines, whose username is a form field.
+// The handler-side half of the log-field audit. Two slog calls in
+// this package reach a value an UNAUTHENTICATED client picks outright
+// and of a length it picks outright:
 //
-// They are at DEBUG, which is off in production by default. That is
+//   - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
+//     path segment matched no stored entrypoint and so is bounded by
+//     nothing;
+//   - the failed-login DEBUG lines, whose username is a form field.
+//
+// Both are at DEBUG, which is off in production by default. That is
 // not a bound: an operator turning DEBUG on to diagnose a flood must
-// not thereby hand the flood an unbounded write. They spend the same
-// internal/logfield budget as the access log, and are held here to
-// middleware.MaxAccessLogLineBytes.
+// not thereby hand the flood an unbounded write. Both spend the same
+// internal/logfield budget as the access log, and both are held here
+// to middleware.MaxAccessLogLineBytes.
 //
 // The two login lines past the username lookup — "invalid password"
 // and "user logged in" — carry the same cap without needing it, since
@@ -256,6 +260,43 @@ func postLoginWithPassword(
 	return w.Code
 }
 
+// TestUnknownEntrypoint_LogLineDoesNotTrackPathSize drives 8 KB of
+// client-chosen path at the unauthenticated receiver's
+// unknown-entrypoint DEBUG line and holds it to the same ceiling the
+// access log states.
+func TestUnknownEntrypoint_LogLineDoesNotTrackPathSize(t *testing.T) {
+	t.Parallel()
+
+	for handlerName, newHandler := range logHandlers() {
+		for fillName, fill := range escapeFills() {
+			t.Run(handlerName+"/"+fillName, func(t *testing.T) {
+				t.Parallel()
+
+				h, buf := capturingHandlers(t, newHandler)
+				router := receiverRouter(h)
+
+				for i := range floodRequests {
+					assert.Equal(
+						t,
+						http.StatusNotFound,
+						postReceiver(
+							t, router,
+							oversizedFill(fill)+
+								strings.Repeat("y", i),
+						),
+					)
+				}
+
+				lines := logLines(t, buf)
+				require.Len(t, lines, floodRequests)
+				assertNoClientText(t, buf)
+
+				assertBoundedFlood(t, buf.Len())
+			})
+		}
+	}
+}
+
 // TestFailedLogin_LogLineDoesNotTrackUsernameSize drives 8 KB of
 // client-chosen username at the unauthenticated login endpoint's
 // DEBUG line and holds it to the same ceiling.

internal/handlers/shared.go

@@ -16,21 +16,16 @@ import (
 //
 // An empty value yields fallback, which lets the create path apply the
 // default and the edit path leave the stored value unchanged. A value
-// of 0 is returned as 0 and is rewritten to the retain-forever
-// sentinel by database.Webhook's BeforeSave hook. Anything unparseable
-// or negative is refused rather than silently given a default.
+// of 0 means retain events forever and is returned as it is. Anything
+// unparseable or negative is refused rather than silently given a
+// default.
 //
 // The upper bound is not cosmetic. The reaper computes its cutoff as a
 // time.Duration, an int64 nanosecond count, so a day count above
 // database.MaxFiniteRetentionDays overflows, puts the cutoff in the
-// future, and deletes every event the webhook has. A finite value
-// above that ceiling is therefore refused, and the message names the
-// ceiling rather than implying the input was not a number.
-//
-// A value at or above the retain-forever sentinel is not out of range:
-// it is what the edit form pre-fills for a retain-forever webhook, so
-// submitting the form back unchanged has to keep meaning "forever"
-// rather than being rejected.
+// future, and deletes every event the webhook has. A value above that
+// ceiling is therefore refused, and the message names the ceiling
+// rather than implying the input was not a number.
 func parseRetentionDays(raw string, fallback int) (int, string) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
@@ -43,10 +38,6 @@ func parseRetentionDays(raw string, fallback int) (int, string) {
 			"retain events forever."
 	}
 
-	if v >= database.RetentionForeverDays {
-		return database.RetentionForeverDays, ""
-	}
-
 	if v > database.MaxFiniteRetentionDays {
 		return 0, "Retention must be at most " +
 			strconv.Itoa(database.MaxFiniteRetentionDays) +

internal/handlers/source_detail_test.go

@@ -273,7 +273,7 @@ func TestHandleSourceDetail_FitsWideAndNarrowWindows(t *testing.T) {
 
 	assert.Contains(
 		t, body,
-		`<div class="max-w-[108rem] mx-auto px-6 py-8">`,
+		`<div class="mx-auto px-6 py-8" style="max-width: 108rem"`,
 	)
 	assert.Contains(
 		t, body,
@@ -286,8 +286,8 @@ func TestHandleSourceDetail_FitsWideAndNarrowWindows(t *testing.T) {
 // target and says what deleting it loses, that the webhook's gives its
 // number of stored events (5 received, 2 removed by retention, so 3,
 // the statistics pane's "Within retention" figure), and that an
-// entrypoint with no description is named by its URL. Each prompt is
-// its form's data-confirm attribute, where &#10; is a line break.
+// entrypoint with no description is named by its URL. The template
+// writes the slashes after http: as \/, which the browser reads as /.
 func TestHandleSourceDetail_DeletePromptsNameWhatIsLost(t *testing.T) {
 	t.Parallel()
 
@@ -325,28 +325,29 @@ func TestHandleSourceDetail_DeletePromptsNameWhatIsLost(t *testing.T) {
 	body := renderSourceDetailPage(t, h, sess, wh.ID)
 
 	assert.Contains(t, body,
-		`data-confirm="Delete webhook &quot;delete-me&quot;?&#10;&#10;`+
+		`Delete webhook &quot;delete-me&quot;?\n\n`+
 			`This deletes its stored events (3) and their deliveries. `+
-			`Any archive files it wrote are kept."`)
+			`Any archive files it wrote are kept.`)
 	assert.Contains(t, body,
-		`data-confirm="Delete entrypoint &quot;Stripe&quot;?&#10;&#10;`+
+		`Delete entrypoint &quot;Stripe&quot;?\n\n`+
 			`Senders using its URL get an error from now on, `+
-			`and the URL cannot be restored."`)
+			`and the URL cannot be restored.`)
 	assert.Contains(t, body,
-		`data-confirm="Delete entrypoint &quot;http://example.com/h/`+
-			unnamed.Path+`&quot;?&#10;&#10;`)
+		`Delete entrypoint &quot;http:\/\/example.com/h/`+
+			unnamed.Path+`&quot;?`)
 	assert.Contains(t, body,
-		`data-confirm="Delete target &quot;t-log&quot;?&#10;&#10;`+
+		`Delete target &quot;t-log&quot;?\n\n`+
 			`Nothing more is delivered to it. `+
-			`Its past deliveries stay in the event log."`)
+			`Its past deliveries stay in the event log.`)
 }
 
 // TestHandleSourceDetail_DeletePromptKeepsQuotesInName checks that a
 // webhook name with quotes, a backslash, a closing script tag and a
-// newline reaches its delete prompt escaped for the attribute, which
-// the browser reads back as the name typed: each quote and angle
-// bracket as a character reference, the rest as typed. An unescaped
-// double quote would end the attribute and cut the prompt short.
+// newline reaches its delete prompt escaped for the script, which the
+// browser reads back as the name typed: each quote and angle bracket
+// as a \u escape, the slash as \/, the newline as \n and the backslash
+// doubled. An unescaped newline would break the prompt's script, and
+// the form would then submit without asking.
 func TestHandleSourceDetail_DeletePromptKeepsQuotesInName(t *testing.T) {
 	t.Parallel()
 
@@ -372,6 +373,6 @@ func TestHandleSourceDetail_DeletePromptKeepsQuotesInName(t *testing.T) {
 	body := renderSourceDetailPage(t, h, sess, wh.ID)
 
 	assert.Contains(t, body,
-		"Delete webhook &quot;Bob&#39;s &#34;best&#34; \\ hook"+
-			"&lt;/script&gt;\nline two&quot;?")
+		"Delete webhook &quot;Bob\\u0027s \\u0022best\\u0022 \\\\ hook"+
+			"\\u003c\\/script\\u003e\\nline two&quot;?")
 }

internal/handlers/source_management_test.go

@@ -137,8 +137,7 @@ func onlyWebhook(
 }
 
 // seedWebhookWithRetention inserts a webhook owned by the test user
-// with an exact stored retention value, bypassing Webhook.BeforeSave
-// via a column-level update so that legacy rows can be planted too.
+// with the given retention.
 func seedWebhookWithRetention(
 	t *testing.T,
 	db *database.Database,
@@ -155,13 +154,6 @@ func seedWebhookWithRetention(
 		t,
 		db.DB().Omit(clause.Associations).Create(wh).Error,
 	)
-	require.NoError(
-		t,
-		db.DB().Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	wh.RetentionDays = retentionDays
 
 	return *wh
 }
@@ -225,10 +217,9 @@ func setupSourceTest(t *testing.T) *sourceTestEnv {
 	}
 }
 
-// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
-// regression test for the bug: the create form's 0 must reach the
-// database as the retain-forever sentinel rather than being replaced by
-// the column's default of 30.
+// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever checks
+// that the create form's 0 reaches the database as 0, which means
+// retain forever.
 func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
 	t *testing.T,
 ) {
@@ -241,30 +232,55 @@ func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 
 	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 	assert.True(t, wh.RetainsForever())
 }
 
-func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
+func TestHandleSourceCreateSubmit_DayCountIsStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	days := "45"
+
+	w := submitCreate(t, env.handlers, env.cookies, "finite", &days)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	wh := onlyWebhook(t, env.db)
+	assert.Equal(t, 45, storedRetentionDays(t, env.db, wh.ID))
+}
+
+// TestHandleSourceCreateSubmit_BlankRetentionUsesDefault covers a
+// retention field left empty and one missing from the form: both
+// give the default, not forever.
+func TestHandleSourceCreateSubmit_BlankRetentionUsesDefault(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	env := setupSourceTest(t)
+	blank := ""
 
-	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
-	require.Equal(t, http.StatusSeeOther, w.Code)
+	for name, retention := range map[string]*string{
+		"blank":   &blank,
+		"omitted": nil,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
 
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+			env := setupSourceTest(t)
+
+			w := submitCreate(
+				t, env.handlers, env.cookies, "defaulted", retention,
+			)
+			require.Equal(t, http.StatusSeeOther, w.Code)
+
+			wh := onlyWebhook(t, env.db)
+			assert.Equal(
+				t,
+				database.DefaultRetentionDays,
+				storedRetentionDays(t, env.db, wh.ID),
+			)
+		})
+	}
 }
 
 // TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
@@ -290,7 +306,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 	)
 	assert.NotContains(
 		t, body, `max="365"`,
-		"a max below the sentinel would block retain-forever",
+		"a max of 365 would block any longer retention",
 	)
 	assert.Contains(t, body, `min="0"`)
 }
@@ -368,40 +384,6 @@ func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
 	)
 }
 
-// TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
-// boundary between "too large to represent" and "retain forever": the
-// sentinel is above MaxFiniteRetentionDays, but it is the value the
-// edit form pre-fills, so it must be accepted rather than rejected as
-// out of range. A value above the sentinel is stored as the sentinel.
-func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	for _, days := range []int{
-		database.RetentionForeverDays,
-		database.RetentionForeverDays + 1,
-	} {
-		raw := strconv.Itoa(days)
-
-		t.Run(raw, func(t *testing.T) {
-			t.Parallel()
-
-			env := setupSourceTest(t)
-
-			w := submitCreate(t, env.handlers, env.cookies, "forever", &raw)
-			require.Equal(t, http.StatusSeeOther, w.Code)
-
-			wh := onlyWebhook(t, env.db)
-			assert.Equal(
-				t,
-				database.RetentionForeverDays,
-				storedRetentionDays(t, env.db, wh.ID),
-			)
-		})
-	}
-}
-
 // TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
 // validation failure hands the user's typing back, matching what the
 // edit form already does. Losing a long description to a mistyped
@@ -480,11 +462,7 @@ func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
 	w := submitEdit(t, env, wh, "0")
 	require.Equal(t, http.StatusSeeOther, w.Code)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 }
 
 func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
@@ -867,18 +845,15 @@ func TestHandleSourceEditSubmit_ArchiveNameTaken(t *testing.T) {
 	assert.Equal(t, oldName, stored.Name)
 }
 
-// TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
-// the removed max="365" cap used to break: render the edit form for a
-// retain-forever webhook, confirm the pre-filled sentinel is not capped
-// by browser validation, then submit that pre-filled value straight
-// back and confirm the retention policy survives untouched.
+// TestSourceEditForm_ForeverWebhookRoundTrips renders the edit form for
+// a retain-forever webhook, confirms it pre-fills 0, then submits that
+// pre-filled value straight back and confirms the retention policy
+// survives untouched.
 func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	t.Parallel()
 
 	env := setupSourceTest(t)
-	wh := seedWebhookWithRetention(
-		t, env.db, database.RetentionForeverDays,
-	)
+	wh := seedWebhookWithRetention(t, env.db, 0)
 
 	req := getRequest(
 		t, "/hook/"+wh.ID+"/edit", env.cookies,
@@ -889,17 +864,12 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 
 	require.Equal(t, http.StatusOK, w.Code)
 
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
 	body := w.Body.String()
 
 	assert.Contains(
-		t, body, `value="`+sentinel+`"`,
+		t, body, `name="retention_days" value="0"`,
 		"the edit form pre-fills the stored retention",
 	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block saving any edit",
-	)
 	// "Currently forever." is the rendered RetentionLabel, not the
 	// static hint below the input, which says "Enter 0 to retain events
 	// forever." A bare Contains of "forever" would pass for any
@@ -910,29 +880,20 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	)
 
 	// Submit the pre-filled value back, exactly as a browser would.
-	post := submitEdit(t, env, wh, sentinel)
+	post := submitEdit(t, env, wh, "0")
 	require.Equal(t, http.StatusSeeOther, post.Code)
 
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
+	assert.Equal(t, 0, storedRetentionDays(t, env.db, wh.ID))
 }
 
-// TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
-// the retain-forever value is never rendered to the user as a raw day
-// count on either read-only view.
-func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
-	t *testing.T,
-) {
+// TestSourceListAndDetail_ShowForeverNotZeroDays checks that a
+// retention of 0 is shown as forever, never as a day count, on either
+// read-only view.
+func TestSourceListAndDetail_ShowForeverNotZeroDays(t *testing.T) {
 	t.Parallel()
 
 	env := setupSourceTest(t)
-	wh := seedWebhookWithRetention(
-		t, env.db, database.RetentionForeverDays,
-	)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
+	wh := seedWebhookWithRetention(t, env.db, 0)
 
 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
@@ -941,7 +902,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 
 	require.Equal(t, http.StatusOK, listW.Code)
 	assert.Contains(t, listW.Body.String(), "Retention: forever")
-	assert.NotContains(t, listW.Body.String(), sentinel)
+	assert.NotContains(t, listW.Body.String(), "Retention: 0 days")
 
 	detailW := httptest.NewRecorder()
 	env.handlers.HandleSourceDetail().ServeHTTP(
@@ -954,5 +915,5 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 
 	require.Equal(t, http.StatusOK, detailW.Code)
 	assert.Contains(t, detailW.Body.String(), "Retention: forever")
-	assert.NotContains(t, detailW.Body.String(), sentinel)
+	assert.NotContains(t, detailW.Body.String(), "Retention: 0 days")
 }

internal/handlers/ui_copy_test.go

@@ -184,8 +184,7 @@ func TestEventLogPageIsCalledFullEventLog(t *testing.T) {
 // TestCreateFormRetentionCopyMatchesBehaviour pins the create form's
 // retention copy to what the code does: the reaper permanently deletes
 // events past the cutoff, an empty field falls back to
-// DefaultRetentionDays, and 0 is rewritten to the retain-forever
-// sentinel by Webhook.BeforeSave.
+// DefaultRetentionDays, and 0 means retain forever.
 func TestCreateFormRetentionCopyMatchesBehaviour(t *testing.T) {
 	t.Parallel()
 
@@ -253,10 +252,7 @@ func TestEditFormRetentionCopyMatchesBehaviour(t *testing.T) {
 		"blank means unchanged, not forever",
 	)
 
-	forever := &database.Webhook{
-		Name:          "wh",
-		RetentionDays: database.RetentionForeverDays,
-	}
+	forever := &database.Webhook{Name: "wh", RetentionDays: 0}
 	forever.ID = "wh-2"
 
 	foreverBody := renderPage(

internal/handlers/webhook.go

@@ -10,6 +10,7 @@ import (
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
+	"sneak.berlin/go/webhooker/internal/logfield"
 	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
@@ -48,13 +49,14 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 			return
 		}
 
-		// Logged only once the lookup has found the entrypoint, so
-		// an invented path writes no INFO line; a miss is logged at
-		// DEBUG. The entrypoint is named by its ID: the UUID is its
-		// credential and is never logged.
+		// Logged only once the UUID is known to name a real
+		// entrypoint. The UUID comes straight out of the path on
+		// the one unauthenticated endpoint, so logging it before
+		// the lookup let a client write an INFO line per invented
+		// path; the request itself is already in the access log
+		// and a miss is already logged at DEBUG.
 		h.log.Info("webhook request received",
-			"entrypoint_id", entrypoint.ID,
-			"webhook_id", entrypoint.WebhookID,
+			"entrypoint_uuid", entrypointUUID,
 			"method", r.Method,
 			"remoteIP", middleware.RemoteIP(r),
 			"clientIP", middleware.ClientIP(r),
@@ -131,10 +133,17 @@ func (h *Handlers) lookupEntrypoint(
 		"path = ?", entrypointUUID,
 	).First(&entrypoint)
 	if result.Error != nil {
-		// Not even an unknown UUID is logged. The receiver's log
-		// lines never carry the path segment, which is a credential
-		// whenever it names an entrypoint.
-		h.log.Debug("entrypoint not found")
+		// The receiver is unauthenticated and /h/{uuid}
+		// matches any single segment, so this value is entirely
+		// client-chosen on exactly the branch where the lookup
+		// failed. DEBUG is off by default; the cap is what keeps
+		// turning it on from restoring an unbounded write.
+		h.log.Debug(
+			"entrypoint not found",
+			"path", logfield.Truncate(
+				entrypointUUID, logfield.MaxBytes,
+			),
+		)
 		http.NotFound(w, r)
 
 		return entrypoint, false

internal/handlers/webhook_stats_test.go

@@ -500,7 +500,7 @@ func TestWebhookStats_PaneShowsRetentionPeriod(t *testing.T) {
 		want          string
 	}{
 		{30, "30 days"},
-		{database.RetentionForeverDays, "forever"},
+		{0, "forever"},
 	}
 
 	for _, tt := range tests {

internal/handlers/webhook_test.go

@@ -12,15 +12,12 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi"
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/middleware"
-	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
 )
 
 // TestHandleWebhook_LogsClientNextToThePeer checks that the
@@ -102,87 +99,6 @@ func TestHandleWebhook_LogsClientNextToThePeer(t *testing.T) {
 	}
 }
 
-// TestHandleWebhook_LogsNoEntrypointUUID sends an accepted event, a
-// request over the receiver rate limit and a request for an unknown
-// UUID through the receiver as routes.go mounts it, and checks that
-// nothing logged, at any level, carries either UUID.
-func TestHandleWebhook_LogsNoEntrypointUUID(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h  *handlers.Handlers
-		db *database.Database
-	)
-
-	cfg := &config.Config{DataDir: t.TempDir(), ReceiverRateLimit: 1}
-
-	app := newTestAppWithConfig(t, cfg, &h, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	buf := new(bytes.Buffer)
-	log := slog.New(slog.NewJSONHandler(
-		buf, &slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-	h.SetLogForTest(log)
-	mw := middlewaretest.New(t, log, cfg, nil)
-
-	webhook := seedWebhook(t, db)
-	entrypoint := &database.Entrypoint{
-		WebhookID: webhook.ID,
-		Path:      uuid.New().String(),
-		Active:    true,
-	}
-	require.NoError(t, db.DB().Omit(clause.Associations).
-		Create(entrypoint).Error)
-
-	unknownUUID := uuid.New().String()
-
-	router := chi.NewRouter()
-	router.Use(mw.Logging())
-	router.With(mw.ReceiverRateLimit()).HandleFunc(
-		middleware.ReceiverRoute, h.HandleWebhook(),
-	)
-
-	// In order: the limit is one request per minute per path, so the
-	// second request for the known UUID is the rejected one.
-	for _, step := range []struct {
-		entrypointUUID string
-		wantStatus     int
-	}{
-		{entrypoint.Path, http.StatusOK},
-		{entrypoint.Path, http.StatusTooManyRequests},
-		{unknownUUID, http.StatusNotFound},
-	} {
-		req := httptest.NewRequestWithContext(
-			context.Background(), http.MethodPost,
-			"/h/"+step.entrypointUUID, strings.NewReader("{}"),
-		)
-		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
-
-		require.Equal(t, step.wantStatus, w.Code)
-	}
-
-	// The lines this test is about were all written, so the checks
-	// below are not passing on an empty log.
-	for _, msg := range []string{
-		"webhook request received",
-		"webhook receiver rate limit exceeded",
-		"entrypoint not found",
-	} {
-		assert.Contains(t, buf.String(), `"msg":"`+msg+`"`)
-	}
-
-	assert.NotContains(t, buf.String(), entrypoint.Path)
-	assert.NotContains(t, buf.String(), unknownUUID)
-
-	line := receivedLine(t, buf)
-	assert.Equal(t, entrypoint.ID, line["entrypoint_id"])
-	assert.Equal(t, webhook.ID, line["webhook_id"])
-}
-
 // receivedLine returns the one "webhook request received" line in the
 // captured JSON log.
 func receivedLine(t *testing.T, buf *bytes.Buffer) map[string]any {

internal/middleware/accesslog_test.go

@@ -7,7 +7,6 @@ import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"strconv"
 	"strings"
 	"testing"
 
@@ -28,13 +27,6 @@ const floodRequests = 64
 // line for a redirected or rejected request may contain it.
 const attackerMarker = "QQATTACKERTEXTQQ"
 
-// knownEntrypointUUID and failingEntrypointUUID are the UUIDs the
-// stand-in receiver in accessLogRouter answers 200 and 500 to.
-const (
-	knownEntrypointUUID   = "6f1e2a9c-4b7d-4e3a-9c2f-1d8b5a7e3c60"
-	failingEntrypointUUID = "0b7c3e5a-2d9f-4a61-8e4b-7c1d6f2a9e35"
-)
-
 // maxLineBytes bounds a single access log line whose client-supplied
 // fields are of ordinary size. Well above what the fixed fields need,
 // well below the length of the oversized input the amplification tests
@@ -140,21 +132,17 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
 	)
 
 	router.HandleFunc(
-		middleware.ReceiverRoute,
+		"/h/{uuid}",
 		func(w http.ResponseWriter, r *http.Request) {
-			// Stands in for the real handler: a known entrypoint
-			// UUID succeeds, a failing one is a server error, and
-			// any other 404s.
-			switch chi.URLParam(r, "uuid") {
-			case knownEntrypointUUID:
-				w.WriteHeader(http.StatusOK)
-			case failingEntrypointUUID:
-				http.Error(
-					w, "boom", http.StatusInternalServerError,
-				)
-			default:
+			// Stands in for the real handler: an unknown entrypoint
+			// UUID 404s, a known one succeeds.
+			if chi.URLParam(r, "uuid") != "known" {
 				http.Error(w, "not found", http.StatusNotFound)
+
+				return
 			}
+
+			w.WriteHeader(http.StatusOK)
 		},
 	)
 
@@ -347,13 +335,11 @@ func oversizedValue(ch string) string {
 }
 
 // oversizedHeaders fills every client-supplied header the access log
-// reads with the same value. The Referer carries it as the host of an
-// absolute URL, because the access log keeps only a Referer's scheme
-// and host.
+// reads with the same value.
 func oversizedHeaders(value string) map[string]string {
 	return map[string]string{
 		"User-Agent":   value,
-		"Referer":      "http://" + value,
+		"Referer":      value,
 		"X-Request-Id": value,
 	}
 }
@@ -663,111 +649,17 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
 	router := accessLogRouter(m)
 
 	assert.Equal(
-		t, http.StatusOK,
-		get(t, router, "/.well-known/healthcheck?src=ci"),
+		t, http.StatusOK, get(t, router, "/h/known?src=ci"),
 	)
 
+	// The path resolved against a stored entrypoint, so it stays. The
+	// query never does: see TestAccessLog_UnauthenticatedSuccess...
 	entries := accessLogEntries(t, buf)
 	require.Len(t, entries, 1)
-	assert.Equal(
-		t, "/.well-known/healthcheck?(redacted)", entries[0]["url"],
-	)
+	assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
 	assert.NotContains(t, buf.String(), "src=ci")
 }
 
-// TestAccessLog_ReceiverNeverLogsTheUUID covers the two statuses that
-// keep the concrete path on every other route. On the receiver that
-// path carries the entrypoint UUID, so the line names the route
-// pattern instead.
-func TestAccessLog_ReceiverNeverLogsTheUUID(t *testing.T) {
-	t.Parallel()
-
-	for entrypointUUID, wantStatus := range map[string]int{
-		knownEntrypointUUID:   http.StatusOK,
-		failingEntrypointUUID: http.StatusInternalServerError,
-	} {
-		t.Run(strconv.Itoa(wantStatus), func(t *testing.T) {
-			t.Parallel()
-
-			m, buf := capturingMiddleware(t)
-			router := accessLogRouter(m)
-
-			assert.Equal(
-				t, wantStatus,
-				get(t, router, "/h/"+entrypointUUID+"?src=ci"),
-			)
-
-			entries := accessLogEntries(t, buf)
-			require.Len(t, entries, 1)
-			assert.Equal(t, middleware.ReceiverRoute, entries[0]["url"])
-			assert.NotContains(t, buf.String(), entrypointUUID)
-		})
-	}
-}
-
-// TestAccessLog_ReceiverPreflightNeverLogsTheUUID sends a CORS
-// preflight to the receiver in dev, in the production middleware
-// order. CORS answers it with 200 before chi routes it, so the line
-// names no route and carries no UUID.
-func TestAccessLog_ReceiverPreflightNeverLogsTheUUID(t *testing.T) {
-	t.Parallel()
-
-	m, buf := capturingMiddleware(t)
-
-	router := chi.NewRouter()
-	router.Use(m.Logging())
-	router.Use(m.CORS())
-	router.HandleFunc(
-		middleware.ReceiverRoute,
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	)
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodOptions,
-		"/h/"+knownEntrypointUUID, nil,
-	)
-	req.Header.Set("Origin", "https://sender.example")
-	req.Header.Set("Access-Control-Request-Method", http.MethodPost)
-
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-	assert.Equal(t, http.StatusOK, w.Code)
-
-	entries := accessLogEntries(t, buf)
-	require.Len(t, entries, 1)
-	assert.Equal(t, unmatchedRouteLiteral, entries[0]["url"])
-	assert.NotContains(t, buf.String(), knownEntrypointUUID)
-}
-
-// TestAccessLog_RefererNeverLogsTheUUID sends receiver requests whose
-// Referer is the entrypoint URL, as a sender's is after it follows a
-// redirect from http:// to https://. The referer field keeps only the
-// scheme and host, and a Referer without them is logged as a marker.
-func TestAccessLog_RefererNeverLogsTheUUID(t *testing.T) {
-	t.Parallel()
-
-	m, buf := capturingMiddleware(t)
-	router := accessLogRouter(m)
-
-	for _, referer := range []string{
-		"http://webhooker.example/h/" + knownEntrypointUUID + "?src=ci",
-		"/h/" + knownEntrypointUUID,
-	} {
-		assert.Equal(t, http.StatusOK, getWithHeaders(
-			t, router, "/h/"+knownEntrypointUUID,
-			map[string]string{"Referer": referer},
-		))
-	}
-
-	entries := accessLogEntries(t, buf)
-	require.Len(t, entries, 2)
-	assert.Equal(t, "http://webhooker.example", entries[0]["referer"])
-	assert.Equal(t, "(redacted)", entries[1]["referer"])
-	assert.NotContains(t, buf.String(), knownEntrypointUUID)
-}
-
 func TestAccessLog_ServerErrorKeepsConcreteURL(t *testing.T) {
 	t.Parallel()
 

internal/middleware/logbound_test.go

@@ -10,10 +10,8 @@ package middleware_test
 //     the client's choosing.
 //   - CSRF's 403 rejection, at WARN, also registered ahead of
 //     RequireAuth.
-//   - The rate limiters' 429 rejection, at WARN. On the receiver
-//     route it names the route pattern rather than the path, and
-//     the limiters that log a path sit behind RequireAuth, so its cap
-//     is defensive.
+//   - The rate limiters' 429 rejection, at WARN, on the
+//     unauthenticated receiver among others.
 //   - RequireAuth's own unauthenticated-request line, at DEBUG.
 //   - RecordLoginFailure's throttle rejection, at WARN. Its cap is
 //     defensive rather than load-bearing today: chi pins the one
@@ -270,14 +268,10 @@ func logSites() map[string]logSite {
 			send:       postNoToken,
 			wantStatus: http.StatusForbidden,
 		},
-		// The 429 line every limiter but the aggregate one shares.
-		// Mounted outside any route, as here, it logs the path, as
-		// it does for the limiters behind RequireAuth; on
-		// ReceiverRoute it names the pattern instead. The
-		// per-entrypoint receiver limiter's bucket is keyed on the
-		// path, so the first request through a fresh path is served
-		// and only the ones after it are rejected; sendUntilLimited
-		// absorbs that.
+		// The per-entrypoint receiver limiter, unauthenticated. Its
+		// bucket is keyed on the path, so the first request through a
+		// fresh path is served and only the ones after it are
+		// rejected; sendUntilLimited absorbs that.
 		"receiver rate limit 429": {
 			build: func(
 				t *testing.T, m *middleware.Middleware,

internal/middleware/metrics.go

@@ -41,8 +41,7 @@ const unmatchedMethod = unmatchedRoute
 // after /h/ is client-chosen, so labelling by path lets any
 // unauthenticated client mint permanent series at will, and publishes
 // the entrypoint UUID (the receiver's only credential) in the scrape
-// while doing it. The access log and the 429 line read it for the
-// same reason: see ReceiverRoute.
+// while doing it.
 //
 // chi populates the route context during routeHTTP, so this is only
 // valid once routing has run. Every caller below is on the recording

internal/middleware/middleware.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
+	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
 	"github.com/prometheus/client_golang/prometheus"
@@ -48,10 +49,6 @@ const (
 	// pick the size of the line it writes.
 	redactedQuery = "?(redacted)"
 
-	// redactedReferer stands in for a Referer the access log cannot
-	// reduce to its scheme and host; see accessLogReferer.
-	redactedReferer = "(redacted)"
-
 	// maxLogRequestIDBytes bounds the request id, which is also
 	// client-supplied: chi's RequestID middleware passes an inbound
 	// X-Request-Id header through verbatim. Its generated form is an
@@ -99,14 +96,14 @@ const (
 	// It is also the ceiling on every OTHER line this service writes
 	// THROUGH SLOG that carries text an UNAUTHENTICATED client
 	// supplies. Those lines — the MaxBodySize rejection, the CSRF
-	// rejection, the unauthenticated-request DEBUG line, the
-	// failed-login DEBUG lines, and the two login-throttle WARN
-	// lines ("login failure limit exceeded" in loginguard.go and
-	// "password verification capacity exhausted" in
-	// internal/handlers/auth.go) — spend the same per-field budgets,
-	// and each carries strictly fewer client-supplied fields than the
-	// access log does, so none of them can reach a width the access
-	// log cannot. That is
+	// rejection, the rate-limit rejection, the unauthenticated-request
+	// and unknown-entrypoint DEBUG lines, the failed-login DEBUG
+	// lines, and the two login-throttle WARN lines ("login failure
+	// limit exceeded" in loginguard.go and "password verification
+	// capacity exhausted" in internal/handlers/auth.go) — spend the
+	// same per-field budgets, and each carries strictly fewer
+	// client-supplied fields than the access log does,
+	// so none of them can reach a width the access log cannot. That is
 	// asserted directly, per line and under both handlers, rather than
 	// left to the reasoning: see logbound_test.go in this package and
 	// in internal/handlers.
@@ -154,12 +151,6 @@ const (
 	MaxAccessLogLineBytes = 2560
 )
 
-// ReceiverRoute is the route pattern the webhook receiver is served
-// at. Its path carries the entrypoint UUID, which is the receiver's
-// only credential, so the log lines this package writes name a
-// request on this route by the pattern, never by its path.
-const ReceiverRoute = "/h/{uuid}"
-
 //nolint:revive // MiddlewareParams is a standard fx naming convention.
 type MiddlewareParams struct {
 	fx.In
@@ -277,14 +268,14 @@ func (lrw *loggingResponseWriter) Unwrap() http.ResponseWriter {
 // marker.
 //
 // The path on those branches is bounded by the service's routes or by
-// the operator's data — a 2xx under /s means the file is in the
-// embedded tree. The query is not bounded by anything:
-// /.well-known/healthcheck and /s/* take no authentication and sit
-// behind no rate limiter, and /pages/login behind only the login
-// limiter, so any of them will answer 200 to a URL carrying an
-// arbitrary number of arbitrary bytes after the '?'. Keeping the path
-// and dropping the query is what makes this branch as bounded as the
-// pattern branches below.
+// the operator's data — a 2xx on the receiver means the UUID named a
+// stored entrypoint, a 2xx under /s means the file is in the embedded
+// tree. The query is not bounded by anything: /.well-known/healthcheck
+// and /s/* take no authentication and sit behind no rate limiter, and
+// /pages/login behind only the login limiter, so any of them will
+// answer 200 to a URL carrying an arbitrary number of arbitrary bytes
+// after the '?'. Keeping the path and dropping the query is what makes
+// this branch as bounded as the pattern branches below.
 //
 // Nothing debuggable is lost. The only query parameters the service
 // reads are the login page's `next`, the page to return to,
@@ -306,61 +297,36 @@ func concreteLogURL(r *http.Request) string {
 
 // accessLogURL returns the value for the access log's url field.
 //
-// On ReceiverRoute it is the route pattern whatever the status, so
-// the entrypoint UUID in the path is never logged. A request chi never
-// routed gets unmatchedRoute whatever the status, for the same reason:
-// in dev, CORS answers a preflight to the receiver before routing.
-//
-// On every other route, 2xx and 5xx responses get the concrete path
-// (see concreteLogURL). A success resolved against a static route or
-// against the operator's own data, and a server error is our own bug,
-// where the exact URL is the primary evidence and which no client can
-// provoke at will.
+// 2xx and 5xx responses get the concrete path (see concreteLogURL). A
+// success resolved against a static route or against the operator's
+// own data — on the receiver, a 2xx means the UUID named a stored
+// entrypoint — and a server error is our own bug, where the exact URL
+// is the primary evidence and which no client can provoke at will.
 //
 // 3xx and 4xx responses get the chi route pattern instead. Those are
-// the outcomes an unauthenticated client drives for free, such as a
-// 303 to the login page on any invented /user/ path. Logging the
-// concrete URL there lets a flood write attacker-chosen text, of
-// attacker-chosen length, into the operator's log at one line per
-// request. The pattern comes from the router's own table, so it is
-// bounded by the service's routes while still naming which class of
-// request was rejected.
+// the outcomes an unauthenticated client drives for free: 404 or 429
+// on any invented /h/ path, 303 to the login page on any
+// invented /user/ path. Logging the concrete URL there lets a flood
+// write attacker-chosen text, of attacker-chosen length, into the
+// operator's log at one line per request. The pattern comes from the
+// router's own table, so it is bounded by the service's routes while
+// still naming which class of request was rejected.
 //
 // The pattern is only populated once routing has run, so this must be
 // called after the handler returns, not before.
 func accessLogURL(r *http.Request, status int) string {
-	pattern := routePatternID(r.Context())
-	if pattern == ReceiverRoute || pattern == unmatchedRoute {
-		return pattern
-	}
-
 	if status < http.StatusMultipleChoices ||
 		status >= http.StatusInternalServerError {
 		return concreteLogURL(r)
 	}
 
-	return pattern
-}
-
-// accessLogReferer returns the value for the access log's referer
-// field: the Referer's scheme and host, never its path or query. The
-// path can be an entrypoint URL, which carries the UUID: a sender that
-// follows a redirect from http:// to https:// sends the URL it was
-// redirected from, and a browser sends the 404 page's URL under /h/
-// when it fetches that page's stylesheet. A Referer without both a
-// scheme and a host is logged as redactedReferer.
-func accessLogReferer(r *http.Request) string {
-	referer := r.Referer()
-	if referer == "" {
-		return ""
+	if rc := chi.RouteContext(r.Context()); rc != nil {
+		if pattern := rc.RoutePattern(); pattern != "" {
+			return pattern
+		}
 	}
 
-	parsed, err := url.Parse(referer)
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return redactedReferer
-	}
-
-	return parsed.Scheme + "://" + parsed.Host
+	return unmatchedRoute
 }
 
 // Logging returns middleware that logs each HTTP request with
@@ -413,7 +379,7 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 						requestID, maxLogRequestIDBytes,
 					),
 					"referer", logfield.Truncate(
-						accessLogReferer(r), logfield.MaxBytes,
+						r.Referer(), logfield.MaxBytes,
 					),
 					"proto", r.Proto,
 					"remoteIP", RemoteIP(r),
@@ -572,9 +538,7 @@ func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 // SecurityHeaders returns middleware that sets production security
 // headers on every response: HSTS (unless HSTS_MAX_AGE is zero),
 // X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, and
-// Permissions-Policy. The CSP takes scripts and styles only from
-// files on this origin, so a template may hold no inline script,
-// event handler or style attribute.
+// Permissions-Policy.
 func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	maxAge := s.params.Config.HSTSMaxAge
 	hsts := "max-age=" + strconv.FormatInt(int64(maxAge/time.Second), 10) +
@@ -596,8 +560,8 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 			w.Header().Set(
 				"Content-Security-Policy",
 				"default-src 'self'; "+
-					"script-src 'self'; "+
-					"style-src 'self'",
+					"script-src 'self' 'unsafe-inline'; "+
+					"style-src 'self' 'unsafe-inline'",
 			)
 			w.Header().Set(
 				"Referrer-Policy",

internal/middleware/middleware_test.go

@@ -747,10 +747,10 @@ func TestNoCache_SetsHeaders(t *testing.T) {
 
 // --- SecurityHeaders Middleware Tests ---
 
-// securityHeaders serves one request through SecurityHeaders built
-// over a Config with the given HSTSMaxAge, and returns the response's
-// headers.
-func securityHeaders(t *testing.T, maxAge time.Duration) http.Header {
+// hstsHeaders serves one request through SecurityHeaders built over
+// a Config with the given HSTSMaxAge, and returns every
+// Strict-Transport-Security value on the response.
+func hstsHeaders(t *testing.T, maxAge time.Duration) []string {
 	t.Helper()
 
 	cfg := &config.Config{HSTSMaxAge: maxAge}
@@ -772,7 +772,7 @@ func securityHeaders(t *testing.T, maxAge time.Duration) http.Header {
 
 	handler.ServeHTTP(w, req)
 
-	return w.Header()
+	return w.Header().Values("Strict-Transport-Security")
 }
 
 func TestSecurityHeaders_HSTS(t *testing.T) {
@@ -804,28 +804,11 @@ func TestSecurityHeaders_HSTS(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			assert.Equal(
-				t, tt.expected,
-				securityHeaders(t, tt.maxAge).Values(
-					"Strict-Transport-Security",
-				),
-			)
+			assert.Equal(t, tt.expected, hstsHeaders(t, tt.maxAge))
 		})
 	}
 }
 
-// TestSecurityHeaders_CSP pins the Content-Security-Policy: a page
-// takes its scripts and styles only from files on its own origin,
-// never from an inline script, event handler or style.
-func TestSecurityHeaders_CSP(t *testing.T) {
-	t.Parallel()
-
-	assert.Equal(
-		t, "default-src 'self'; script-src 'self'; style-src 'self'",
-		securityHeaders(t, 0).Get("Content-Security-Policy"),
-	)
-}
-
 // --- MaxBodySize Middleware Tests ---
 
 const testBodyLimit int64 = 64

internal/middleware/ratelimit.go

@@ -259,28 +259,26 @@ func (m *Middleware) clientAddr(r *http.Request) (netip.Addr, bool) {
 	return peer, true
 }
 
-// tooManyRequests returns the 429 handler used by the postRateLimit
-// limiters and the per-entrypoint receiver limiter: it logs the
+// tooManyRequests returns the 429 handler used by the
+// password-change and per-entrypoint receiver limiters: it logs the
 // rejection with logMessage and answers with responseMessage.
 // httprate adds the Retry-After header (RFC 6585). The aggregate
 // receiver limiter uses floodTooManyRequests instead.
 //
-// On ReceiverRoute the line names the route pattern, so the
-// entrypoint UUID in the path is never logged. Elsewhere it names the
-// path, capped against the same budget as the access log's url field;
-// the limiters there sit behind RequireAuth, so the cap is defensive.
+// The path is capped against the same budget as the access log's url
+// field. The per-entrypoint receiver limiter is unauthenticated and
+// its path is a client-chosen segment of client-chosen length, so at
+// WARN an uncapped path would let a sender pick the size of the line
+// it writes — the same defect the access log capping closed.
 func (m *Middleware) tooManyRequests(
 	logMessage, responseMessage string,
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		path := r.URL.Path
-		if routePatternID(r.Context()) == ReceiverRoute {
-			path = ReceiverRoute
-		}
-
 		m.log.Warn(
 			logMessage,
-			"path", logfield.Truncate(path, logfield.MaxBytes),
+			"path", logfield.Truncate(
+				r.URL.Path, logfield.MaxBytes,
+			),
 			"remoteIP", RemoteIP(r),
 			"clientIP", ClientIP(r),
 		)

internal/server/alpine_browser_test.go

@@ -60,8 +60,8 @@ const (
 // TestAlpineRunsUnderTheSecurityPolicy loads the webhook page and the
 // event log in a headless browser, served by the real router and so
 // under the real Content-Security-Policy, and checks that the pages'
-// Alpine.js directives, the copy control and the delete prompts work,
-// and that a target's row shows its delivery counts.
+// Alpine.js directives and the copy control work, and that a target's
+// row shows its delivery counts.
 func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	t.Parallel()
 
@@ -74,10 +74,6 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	userID, _ := env.seedUser(t, "browser", "browser-password")
 	webhook, older, event, target := seedBrowserWebhook(t, env, userID)
 
-	// The sign-in page is loaded before the browser signs in, since a
-	// signed-in visit to it is sent on to another page.
-	checkOtherPages(ctx, t, srv.URL+"/pages/login")
-
 	require.NoError(t, chromedp.Run(
 		ctx, setCookies(srv.URL, env.authCookies(t, userID, "browser")),
 	))
@@ -103,11 +99,6 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	checkEventLog(ctx, t, page+"/events", event.ID, older.ID, target.Name)
 	checkMobileMenu(ctx, t, page)
 	checkPhoneWidth(ctx, t, page, page+"/events", target.Name)
-	checkOtherPages(ctx, t,
-		srv.URL+"/hooks", srv.URL+"/settings", srv.URL+"/user/browser",
-		// A path that does not exist, which gets the 404 error page.
-		srv.URL+"/no-such-page")
-	checkDeletePrompt(ctx, t, page, target)
 
 	assert.Empty(t, problems(), "the browser reported problems")
 }
@@ -1397,75 +1388,3 @@ func checkPhoneWidth(
 	assert.False(t, sideways, "the event log scrolls sideways on a phone")
 	assert.Empty(t, cutOff, "the event log cuts these off on a phone")
 }
-
-// checkOtherPages loads the pages at urls, which no other check opens,
-// so that anything the browser reports going wrong on them fails the
-// test too.
-func checkOtherPages(ctx context.Context, t *testing.T, urls ...string) {
-	t.Helper()
-
-	for _, url := range urls {
-		require.NoError(t, chromedp.Run(ctx, loadPage(url)))
-	}
-}
-
-// answerPrompt returns a script that stands in for the user at the
-// browser's prompt: it makes window.confirm record the question in
-// window.asked and give answer. It also records in window.sent whether
-// a form is sent once its submit event is handled, from a listener on
-// window, which the event reaches after the listener static/js/app.js
-// adds to document.
-func answerPrompt(answer bool) string {
-	return fmt.Sprintf(`
-		window.asked = "";
-		window.sent = false;
-		window.confirm = (question) => {
-			window.asked = question;
-			return %t;
-		};
-		window.addEventListener("submit", (event) => {
-			window.sent = !event.defaultPrevented;
-		});`, answer)
-}
-
-// checkDeletePrompt loads a webhook page and clicks Delete beside
-// target. It checks that the browser asks first, naming the target,
-// that answering no leaves the form unsent, and that answering yes
-// sends it and the target is deleted.
-func checkDeletePrompt(
-	ctx context.Context, t *testing.T, url string, target *database.Target,
-) {
-	t.Helper()
-
-	form := `form[action$="/targets/` + target.ID + `/delete"]`
-	question := `Delete target "` + target.Name + `"?` + "\n\n" +
-		"Nothing more is delivered to it. " +
-		"Its past deliveries stay in the event log."
-
-	var (
-		asked  string
-		sent   bool
-		listed bool
-	)
-
-	require.NoError(t, chromedp.Run(
-		ctx, loadPage(url), chromedp.Evaluate(answerPrompt(false), nil),
-	))
-	click(ctx, t, form+" button")
-	require.NoError(t, chromedp.Run(
-		ctx,
-		chromedp.Evaluate(`window.asked`, &asked),
-		chromedp.Evaluate(`window.sent`, &sent),
-	))
-	assert.Equal(t, question, asked, "Delete does not ask about the target")
-	assert.False(t, sent, "answering no still sends the delete form")
-
-	require.NoError(t, chromedp.Run(
-		ctx, chromedp.Evaluate(answerPrompt(true), nil),
-	))
-	clickAndLoad(ctx, t, form+" button")
-	require.NoError(t, chromedp.Run(ctx, chromedp.Evaluate(
-		`document.querySelector('`+form+`') !== null`, &listed,
-	)))
-	assert.False(t, listed, "answering yes does not delete the target")
-}

internal/server/routes.go

@@ -6,8 +6,7 @@ import (
 
 	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi"
-	chimw "github.com/go-chi/chi/middleware"
-	"sneak.berlin/go/webhooker/internal/middleware"
+	"github.com/go-chi/chi/middleware"
 	"sneak.berlin/go/webhooker/static"
 )
 
@@ -61,7 +60,7 @@ func (s *Server) SetupRoutes() {
 }
 
 func (s *Server) setupGlobalMiddleware() {
-	s.router.Use(chimw.RequestID)
+	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.SecurityHeaders())
 	s.router.Use(s.mw.Logging())
 
@@ -346,7 +345,7 @@ func (s *Server) setupWebhookRoutes() {
 	// unauthenticated endpoint's body; TestReceiver_OversizeBodyRefused
 	// pins it.
 	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
-		middleware.ReceiverRoute,
+		"/h/{uuid}",
 		s.h.HandleWebhook(),
 	)
 }

static/css/style.css

@@ -1,7 +1,7 @@
 /*
- * The two shared styles for the controls a user clicks, and the rule that
- * hides an element marked x-cloak. Every page loads this file after
- * tailwind.css. It is plain CSS: make css does not build it.
+ * The two shared styles for the controls a user clicks. Every page loads
+ * this file after tailwind.css. It is plain CSS: make css does not build
+ * it.
  *
  * A button is btn-primary, btn-secondary or btn-danger, from input.css.
  * A secondary or inline action, such as Copy beside an entrypoint URL or
@@ -46,11 +46,3 @@
         outline-offset: 2px;
     }
 }
-
-/*
- * Alpine.js removes x-cloak from an element once it has started, so
- * something Alpine hides is not seen on the page while it loads.
- */
-[x-cloak] {
-    display: none !important;
-}

static/js/app.js

@@ -58,18 +58,6 @@
     }
 })();
 
-// Asks before a form with a data-confirm attribute is sent, such as a
-// delete form on the webhook page. The browser's own prompt shows the
-// attribute's text, and the form is sent only if the user accepts.
-document.addEventListener("submit", function (event) {
-    "use strict";
-
-    const message = event.target.getAttribute("data-confirm");
-    if (message !== null && !window.confirm(message)) {
-        event.preventDefault();
-    }
-});
-
 // Alpine.js components.
 //
 // The pages' Content-Security-Policy forbids eval, so the UI loads

templates/event_body.html

@@ -5,7 +5,7 @@
 {{if .Binary}}
 <p class="text-xs text-gray-500">This body is binary ({{.Size}} bytes) and is not shown. <a href="{{.EventURL}}/body" class="btn-small">Download the body</a></p>
 {{else if .Text}}
-<pre class="rounded-md border border-gray-200 bg-white p-2 text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all{{if .Scroll}} max-h-[32rem] overflow-y-auto{{end}}">{{.Text}}</pre>
+<pre class="rounded-md border border-gray-200 bg-white p-2 text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all"{{if .Scroll}} style="max-height: 32rem; overflow-y: auto"{{end}}>{{.Text}}</pre>
 {{if .Cut}}
 <p class="mt-2 text-xs text-gray-500">Showing the first {{.ShownBytes}} of {{.Size}} bytes, unformatted. <a href="{{.EventURL}}" class="btn-small">Show the whole body</a> <a href="{{.EventURL}}/body" class="btn-small">Download the body</a></p>
 {{end}}

templates/htmlheader.html

@@ -4,5 +4,6 @@
 <title>{{block "title" .}}Webhooker{{end}}</title>
 <link rel="stylesheet" href="/s/css/tailwind.css">
 <link rel="stylesheet" href="/s/css/style.css">
+<style>[x-cloak] { display: none !important; }</style>
 {{block "head" .}}{{end}}
 {{end}}

templates/settings.html

@@ -13,11 +13,13 @@
             <div class="p-4">
                 <!-- A value too wide to sit beside its name moves to the
                      next line, where a list breaks only at the spaces
-                     between its entries. wrap-anywhere breaks inside a
-                     value only when it alone is wider than the line. -->
+                     between its entries. overflow-wrap: anywhere breaks
+                     inside a value only when it alone is wider than the
+                     line; an inline style, because the committed
+                     tailwind.css has no class for it. -->
                 <div class="flex flex-wrap justify-between items-start gap-4">
                     <code class="text-sm font-medium text-gray-900">{{.Name}}</code>
-                    <code class="text-sm text-gray-900 wrap-anywhere">{{.Value}}</code>
+                    <code class="text-sm text-gray-900" style="overflow-wrap: anywhere">{{.Value}}</code>
                 </div>
                 <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
             </div>

templates/source_detail.html

@@ -5,10 +5,12 @@
 {{define "content"}}
 <!-- 108rem, half again the 72rem (max-w-6xl) of the webhook list, the
      event log, the navbar and the footer, so an entrypoint URL fits on
-     one line. wrap-anywhere goes only on names and descriptions: a
-     row too wide for a phone must still run past the edge, where the
-     browser test sees it, rather than break its controls mid-word. -->
-<div class="max-w-[108rem] mx-auto px-6 py-8">
+     one line. An inline style, because the committed tailwind.css has
+     no class this wide. wrap-anywhere goes only on names and
+     descriptions: a row too wide for a phone must still run past the
+     edge, where the browser test sees it, rather than break its
+     controls mid-word. -->
+<div class="mx-auto px-6 py-8" style="max-width: 108rem">
     <div class="mb-6">
         <a href="/hooks" class="btn-small">&larr; Back to webhooks</a>
         <div class="flex flex-wrap justify-between items-center gap-2 mt-2">
@@ -21,12 +23,11 @@
             <div class="flex gap-2">
                 <a href="/hook/{{.Webhook.ID}}/events" class="btn-secondary">Full Event Log</a>
                 <a href="/hook/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
-                <!-- Before a delete form is sent, static/js/app.js
-                     asks in the browser's own prompt, with the form's
-                     data-confirm text; &#10; is a line break. The
-                     template escapes each name for the attribute, so a
-                     quote in it shows as typed. -->
-                <form method="POST" action="/hook/{{.Webhook.ID}}/delete" data-confirm="Delete webhook &quot;{{.Webhook.Name}}&quot;?&#10;&#10;This deletes its stored events{{with .Stats}} ({{.WithinRetention.Events}}){{end}} and their deliveries. Any archive files it wrote are kept.">
+                <!-- The delete prompts are the browser's own, so they
+                     work without the page's scripts. The template
+                     escapes each name for the script, so a quote or a
+                     backslash in it shows as typed. -->
+                <form method="POST" action="/hook/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete webhook &quot;{{.Webhook.Name}}&quot;?\n\nThis deletes its stored events{{with .Stats}} ({{.WithinRetention.Events}}){{end}} and their deliveries. Any archive files it wrote are kept.')">
                     <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                     <button type="submit" class="btn-danger">Delete</button>
                 </form>
@@ -89,7 +90,7 @@
                                     {{if .Active}}Deactivate{{else}}Activate{{end}}
                                 </button>
                             </form>
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" data-confirm="Delete entrypoint &quot;{{if .Description}}{{.Description}}{{else}}{{$.BaseURL}}/h/{{.Path}}{{end}}&quot;?&#10;&#10;Senders using its URL get an error from now on, and the URL cannot be restored." class="inline">
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete entrypoint &quot;{{if .Description}}{{.Description}}{{else}}{{$.BaseURL}}/h/{{.Path}}{{end}}&quot;?\n\nSenders using its URL get an error from now on, and the URL cannot be restored.')" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="btn-small text-red-600" title="Delete">Delete</button>
                             </form>
@@ -277,7 +278,7 @@
                                     {{if .Active}}Deactivate{{else}}Activate{{end}}
                                 </button>
                             </form>
-                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/delete" data-confirm="Delete target &quot;{{.Name}}&quot;?&#10;&#10;Nothing more is delivered to it. Its past deliveries stay in the event log." class="inline">
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete target &quot;{{.Name}}&quot;?\n\nNothing more is delivered to it. Its past deliveries stay in the event log.')" class="inline">
                                 <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                 <button type="submit" class="btn-small text-red-600" title="Delete">Delete</button>
                             </form>