Store a target's settings as columns (closes #543)

A target's settings move from the per-type JSON string in
targets.config to columns: url, headers, timeout_seconds,
forward_query, archive_expiry and archive_rotation. A column a type
does not use stays empty. headers holds the header map as JSON text
through GORM's JSON serializer, and archive_expiry holds a
time.Duration, 0 meaning never. The forms check each setting once,
with the same refusals and messages, and the edit form is filled from
the columns, so the per-type config structs, their parsers and the
"could not be read" branches are gone. A delivery task carries the
six settings in place of the JSON string; tests check that each copy
into a task, and back out of one, keeps all six.

Model: opus-5-5

.dockerignore

@@ -72,8 +72,10 @@
 **/*.sublime-*
 
 # This repository's own host-built artifacts: the binary `make build`
-# writes.
+# writes, and the Alpine.js file `make assets` extracts from 3p/ (the
+# build extracts its own).
 /bin
+/static/js/alpine.min.js
 
 # SQLite databases, which hold the session key and webhook payloads, at
 # any depth.

.gitignore

@@ -77,3 +77,7 @@ data/
 # Temporary files
 tmp/
 temp/
+
+# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
+# what is committed.
+/static/js/alpine.min.js

.prettierignore

@@ -1,3 +1,2 @@
 node_modules/
 yarn.lock
-static/js/alpine.min.js

Dockerfile

@@ -92,6 +92,10 @@ COPY . .
 # fmt-check` is the markdown-check stage above.
 RUN if [ -n "$(gofmt -s -l .)" ]; then echo "gofmt needed on:"; gofmt -s -l .; exit 1; fi
 
+# static/static.go embeds the Alpine.js file this extracts from 3p/; without
+# it the static package does not compile and cannot be linted.
+RUN script/assets
+
 # The golangci-lint steps run with --network=none. `golangci-lint config
 # verify` is documented as fetching its JSON schema over HTTPS; this pinned
 # image resolves the schema without any network, and --network=none enforces
@@ -107,16 +111,11 @@ RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser
 # Nothing is wanted from js-lint; the copy is what makes this phase run it.
 COPY --from=js-lint /src/yarn.lock /dev/null
 
-# Test phase. The tests run with cgo off and so without Go's race detector,
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go image
-# which needs cgo on Linux; sneak ruled the race detector out in
+# ships and the alpine one does not. `make test` (script/test) builds this
-# https://git.eeqj.de/sneak/webhooker/issues/538#issuecomment-153273.
+# stage alone; the build stage below depends on it.
-# `make test` (script/test) builds this stage alone; the build stage below
-# depends on it.
 #
-# golang:1.26.1-bookworm (Debian-based), 2026-03-17: the builder stage's
+# golang:1.26.1-bookworm (Debian-based), 2026-03-17
-# image, which that stage needs for its git and make. Its test step runs
-# under the image's bash, and the tests in internal/versionscript use its
-# git, make and sh, and skip when they are missing.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS test
 
 WORKDIR /src
@@ -126,11 +125,14 @@ RUN go mod download
 
 COPY . .
 
+# static/static.go embeds the Alpine.js file this extracts from 3p/.
+RUN script/assets
+
 # -timeout applies to each package on its own, so 90s has only to clear the
 # slowest one. -p 4 -parallel 8 keep the run under 2 GB of memory: at most
 # four test binaries build or run at once, each with at most eight parallel
-# tests. The defaults are one per core, so without these the memory the run
+# tests. Under -race every test binary and every link costs a few hundred MB,
-# needs grows with the host's core count.
+# so the defaults (one per core) add up to several GB on a many-core host.
 #
 # The first run has no -v: go test then prints one result line per package,
 # with its coverage, and for a package that fails, everything its tests
@@ -152,12 +154,12 @@ COPY . .
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN --mount=type=tmpfs,target=/tmp/tests,size=512m \
     export TMPDIR=/tmp/tests GOTMPDIR=/tmp; \
-    CGO_ENABLED=0 go test -cover -p 4 -parallel 8 -timeout 90s ./... 2>&1 | tee /tmp/go-test.log && exit 0; \
+    go test -race -cover -p 4 -parallel 8 -timeout 90s ./... 2>&1 | tee /tmp/go-test.log && exit 0; \
     tests="$(awk '/^--- FAIL: / { print $3 }' /tmp/go-test.log | paste -s -d '|' -)"; \
     packages="$(awk '/^FAIL\t/ { print $2 }' /tmp/go-test.log)"; \
     if [ -n "$tests" ]; then \
         echo "--- Rerunning the failed tests with -v for details ---"; \
-        CGO_ENABLED=0 go test -v -p 4 -parallel 8 -timeout 90s -run "^($tests)\$" $packages; \
+        go test -race -v -p 4 -parallel 8 -timeout 90s -run "^($tests)\$" $packages; \
     fi; \
     exit 1
 
@@ -204,8 +206,10 @@ RUN version="$(make version VERSION="$VERSION")"; \
         esac; \
     fi
 
-# The Makefile's build target builds with cgo off, so the binary is
+# Builds through the Makefile's build target, which runs script/assets
-# statically linked and runs on the Alpine runtime image below.
+# (Alpine.js, extracted from its tarball in 3p/) first. The target builds
+# with cgo off, so the binary is statically linked and runs on the Alpine
+# runtime image below as it is.
 RUN make build VERSION="$VERSION"
 
 # Runtime stage

Dockerfile.browser

@@ -15,9 +15,9 @@ RUN go mod download
 COPY . .
 
 # The test binary embeds the templates and static files, so the browser
-# stage needs nothing else. It is built with cgo off and -p 4 keeps the
+# stage needs nothing else. -p 4 keeps the compile's memory down, as in
-# compile's memory down, both as in the test phase of Dockerfile.
+# the test phase of Dockerfile.
-RUN CGO_ENABLED=0 go test -c -p 4 -tags browser -o /browser.test ./internal/server
+RUN make assets && go test -c -p 4 -tags browser -o /browser.test ./internal/server
 
 # chromedp/headless-shell:151.0.7922.109 (Debian trixie), 2026-08-11. The
 # browser is on PATH as headless-shell, where the test's browser library

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test test-browser lint fmt fmt-check check build run dev deps docker clean hooks css css-check version
+.PHONY: bootstrap setup assets test test-browser lint fmt fmt-check check build run dev deps docker clean hooks css css-check version
 
 # Default target
 .DEFAULT_GOAL := check
@@ -22,6 +22,9 @@ bootstrap:
 setup:
 	@script/setup
 
+assets:
+	@script/assets
+
 test:
 	@script/test
 
@@ -44,13 +47,13 @@ check:
 # REPO_POLICIES.md does: the binary carries no build paths, symbol table or
 # debug information, and on Linux, the image's included, it is statically
 # linked.
-build:
+build: assets
 	CGO_ENABLED=0 go build -trimpath -ldflags '-s -w -X main.version=$(VERSION)' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-dev:
+dev: assets
 	go run ./cmd/webhooker
 
 deps:

TODO.md

@@ -1,77 +1,72 @@
 # Workflow
 
-One issue per unit of work, and one branch and one PR per issue:
+One issue per unit of work, one branch and one PR per issue:
 
-- make sure a tracked issue exists with a definition of done
+- ensure a tracked issue exists with a definition of done
-- branch from `next`, never from `main`
+- branch from `next` (never from `main`)
-- do the work and push the branch
+- do the work; open a PR based on `next` (never on `main`)
-- open a PR with base `next`, never `main`
+- pass an independent review, then the manager squash-merges into `next`
-- pass an independent review
+- push; nothing stays local-only
-- the repository manager squash-merges it into `next`
 
-The repository manager is the role that merges each issue's PR into `next`.
+`next` is the branch for the next milestone and must stay green and mergeable to
-Nothing stays local-only: every commit is pushed.
+`main` without notice. One `next` -> `main` PR accumulates the milestone;
+releases are cut from `main` separately.
 
-`next` is the branch for the next milestone. It must stay green and mergeable
+The tracker (https://git.eeqj.de/sneak/webhooker/issues) is the record of what
-into `main` at all times. A milestone's work reaches `main` through one PR from
+is done and what is under way. This file keeps no list of either.
-`next`. The owner, @sneak, merges that PR. Cutting a release from `main` is a
-separate step after that.
-
-The tracker (https://git.eeqj.de/sneak/webhooker/issues) records what is done
-and what is under way. This file keeps no list of either.
 
 # Status
 
 What is still open for 1.0.0 is in its milestone
-(https://git.eeqj.de/sneak/webhooker/milestone/9). `v1.0.0` is not tagged. Only
+(https://git.eeqj.de/sneak/webhooker/milestone/9). `v1.0.0` is not tagged, and
-@sneak tags it.
+only @sneak tags it.
 
-Delivery is at least once by design. When webhooker cannot record the outcome of
+Delivery is at-least-once by design, not by accident: a send whose result row
-a delivery, it sends that delivery again. The target can then receive the same
+does not land is attempted again, so a receiver can see a duplicate. That is
-event twice. The alternative is a lost delivery that nothing reports. The README
+deliberate — the alternative is a silent lost delivery — and the README says so
-says so. Such a duplicate is not a defect to re-file.
+under Rationale. It is not a defect to re-file.
 
 # Next Step
 
 @sneak runs webhooker in limited production, then tags `v1.0.0`. Merging `next`
-into `main` is a separate act. It waits on neither the production run nor the
+into `main` is a separate act from tagging and waits on neither of those: `next`
-tag.
+is kept mergeable at all times, which is the point of the branch.
 
 # Future Steps
 
-- Per-webhook rate limits, set in the web UI and enforced at the entrypoint.
+- Per-webhook rate limits, set in the web UI and enforced in the receiver
-  Today `RECEIVER_RATE_LIMIT` is the only rate-limit setting. It is how many
+  handler, on top of the receiver's existing limits, which `RECEIVER_RATE_LIMIT`
-  requests per minute one client address may send to one entrypoint. The same
+  sets for the whole server (see Rate Limiting in the README)
-  address is also capped at ten times that across all entrypoints together.
+- API key authentication for programmatic access (the `APIKey` model exists, but
-- API key authentication for programmatic access. The `APIKey` model and its
+  nothing creates a key and no middleware checks one)
-  `api_keys` table exist. Nothing creates a key and nothing checks one.
+- REST API v1
-- REST API v1. `/api/v1` is mounted with no routes today.
+    - CRUD for webhooks, entrypoints, targets
-    - CRUD for webhooks, entrypoints and targets
     - event viewing and filtering endpoints
     - event redelivery endpoint
     - OpenAPI specification
 - Analytics in the web UI: response times summarised per webhook or per target,
-  and figures for all webhooks together. Today the webhook page shows event,
+  and figures for all webhooks together. The webhook page already shows event,
-  delivery and failure counts and failure percentages. The target list counts
+  delivery and failure counts and failure percentages, the target list counts
-  each target's deliveries. The event log shows every attempt's duration.
+  each target's deliveries, the event log and each event's page show every
-  `/metrics` carries server-wide counts and delivery durations.
+  attempt's duration, and `/metrics` carries server-wide counts and delivery
-- A remember-me option at login. Today every session survives a browser restart.
+  durations
-  It lasts up to 7 days. It ends sooner after `SESSION_IDLE_TIMEOUT` (default 24
+- A remember-me option at login. Every session already survives a browser
-  hours) without use.
+  restart: it lasts up to 7 days, and ends sooner after `SESSION_IDLE_TIMEOUT`
-- Password reset over the web for a forgotten password. Today a signed-in user
+  (default 24 hours) without activity
-  can change their password. A lost password is reset from the command line with
+- Password reset flow for a forgotten password over the web. The authenticated
-  `webhooker resetpw` (https://git.eeqj.de/sneak/webhooker/issues/208).
+  password _change_ flow already landed, and a lost password is recoverable from
+  the console with `webhooker resetpw`
+  (https://git.eeqj.de/sneak/webhooker/issues/208)
 - Later, nice to have
     - email delivery target type
     - SNS and S3 delivery targets
-    - data transformations, such as a configurable Slack message format. The
+    - data transformations (e.g. a configurable Slack message format; the Slack
-      Slack target sends one fixed format today.
+      target sends one fixed format today)
-    - JSONL file delivery with periodic S3 upload. Today an archive target
+    - JSONL file delivery with periodic S3 upload (the `database` target already
-      writes events to SQLite files. An archive target can rotate those files
+      archives events to SQLite files, rotated hourly, daily or monthly if set,
-      hourly, daily or monthly. The webhook page offers them as one gzipped JSON
+      and the webhook page offers them as one gzipped JSON download)
-      download.
     - webhook event search, and filtering beyond the event log's failed and
       pending views
-    - multi-user with role-based access control. Today each webhook belongs to
+    - multi-user with role-based access control (each webhook already belongs to
-      one account. Only the account made at first boot exists. There is no way
+      one account, but there is only the account made at first boot and no way
-      to add another.
+      to add another)

cmd/webhooker/main.go

@@ -211,6 +211,9 @@ func newApp() *fx.App {
 			delivery.New,
 			archive.NewWriters,
 			archive.NewSweeper,
+			// Wire *delivery.Engine as delivery.Notifier so the
+			// webhook handler can notify the engine of new deliveries.
+			func(e *delivery.Engine) delivery.Notifier { return e },
 			// Wire *archive.Writers as archive.Archives so deleting
 			// or renaming a webhook or target reaches its archive
 			// files.

eslint.config.mjs

@@ -5,7 +5,7 @@
 // REPO_POLICIES.md states that a linter can check: const for everything,
 // let only for a variable that is reassigned, never var.
 export default [
-    // Alpine.js, committed as published; not ours to lint.
+    // Alpine.js, extracted from 3p/ by make assets; not ours to lint.
     { ignores: ["static/js/alpine.min.js"] },
     {
         // The pages load static/js/app.js as a classic script, not a module.

internal/archive/evict_test.go

@@ -303,7 +303,7 @@ func (r *racingWrites) wait() (bool, error) {
 // contending for the writer's mutex when the eviction takes it.
 // The write that wins the mutex after the eviction must abandon
 // its work rather than reopen the archive, leaving the writer
-// permanently handle-free.
+// permanently handle-free. Run under -race.
 func TestEvictWebhook_RacingWriteDoesNotReopenHandle(
 	t *testing.T,
 ) {

internal/archive/sweeper_test.go

@@ -959,11 +959,9 @@ func TestArchiveSweep_SkipsDeletedWebhookTargets(t *testing.T) {
 	)
 }
 
-// TestArchiveSweep_ConcurrentWrites runs the sweep while writes to
+// TestArchiveSweep_ConcurrentWrites proves the sweep serialises
-// the same target are under way. The sweep serialises against them
+// against writes through the target's writer mutex. Run under
-// through the target's writer mutex; the suite runs without Go's race
+// -race, an unsynchronised sweep would be caught here.
-// detector, so a sweep that did not would fail this test only by
-// panicking, hanging or leaving no archive file.
 func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
 	t.Parallel()
 

internal/database/password.go

@@ -67,10 +67,9 @@ func DefaultPasswordConfig() *PasswordConfig {
 // testArgon2Memory is the Argon2id memory cost, in KiB, that a test
 // binary hashes with: 1 MB instead of the shipped 64 MB. Every test
 // that starts a database hashes the bootstrap admin password, dozens
-// of them run in parallel, and each 64 MB hash holds at least 64 MB
+// of them run in parallel, and under the race detector each 64 MB hash
-// while it runs (about 150 MB when the suite ran under the race
+// holds about 150 MB. VerifyPassword reads the cost from the hash it
-// detector). VerifyPassword reads the cost from the hash it checks, so
+// checks, so verification follows.
-// verification follows.
 const testArgon2Memory = 1024
 
 // hashAtShippedCostInTest makes a test binary hash at the shipped

internal/delivery/engine.go

@@ -1,5 +1,5 @@
-// Package delivery stores each event with its deliveries and delivers
+// Package delivery manages asynchronous event delivery
-// them, asynchronously, to configured targets.
+// to configured targets.
 package delivery
 
 import (
@@ -23,11 +23,10 @@ import (
 
 const (
 	// deliveryChannelSize is the buffer size for the delivery
-	// channel. The Tasks of newly stored deliveries, and of the
+	// channel. New Tasks from the webhook handler are sent
-	// pending deliveries the recovery routine hands back, are
+	// here. Workers drain this channel. Sized large enough
-	// sent here. Workers drain this channel. Sized large enough
+	// that the webhook handler should never block under
-	// that no task should be dropped under normal load: one that
+	// normal load.
-	// does not fit is left for the sweep.
 	deliveryChannelSize = 10000
 
 	// retryChannelSize is the buffer size for the retry
@@ -128,11 +127,17 @@ type Task struct {
 	AttemptNum int
 }
 
+// Notifier is the interface for notifying the delivery
+// engine about new deliveries.
+type Notifier interface {
+	Notify(tasks []Task)
+}
+
 // CircuitBreakers is how the handlers read a target's circuit
 // breaker, so the webhook page and the event log can say that
-// deliveries to the target are paused and until when. The handlers
+// deliveries to the target are paused and until when. It keeps the
-// hold the engine itself as well; they read breakers through this
+// handlers free of the engine's internals and is trivially faked in
-// interface so that a test can make one read as open.
+// tests.
 type CircuitBreakers interface {
 	StateAndCooldown(targetID string) (CircuitState, time.Duration)
 }
@@ -152,13 +157,12 @@ type EngineParams struct {
 }
 
 // Engine processes queued deliveries in the background
-// using a bounded worker pool architecture. It also stores each
+// using a bounded worker pool architecture. It owns only
-// event with its deliveries and creates replay deliveries (see
+// the cross-target machinery: the worker pool, the queue
-// store.go). Beyond that it owns only the cross-target machinery:
+// and retry channels, the recovery routine, and the persistence
-// the worker pool, the delivery and retry channels, the recovery
+// helpers and Scheduler that individual targets rely on.
-// routine, and the persistence helpers and Scheduler that
+// Each target type owns its own delivery, including retries,
-// individual targets rely on. Each target type owns its own
+// backoff, and circuit breaking.
-// delivery, including retries, backoff, and circuit breaking.
 type Engine struct {
 	database   *database.Database
 	dbManager  *database.WebhookDBManager
@@ -228,6 +232,38 @@ func New(
 	return e
 }
 
+// Notify signals the delivery engine that new deliveries
+// are ready.
+func (e *Engine) Notify(tasks []Task) {
+	for i := range tasks {
+		// Owned before it is queued, and until the worker that runs
+		// it returns. A task can sit in a 10000-deep channel for a
+		// long time on a healthy system, and nothing may re-send it
+		// while it waits. See inflight.go.
+		if !e.inflight.retainIdle(tasks[i].DeliveryID) {
+			e.log.Warn(
+				"delivery already in flight, not queued again",
+				"delivery_id", tasks[i].DeliveryID,
+				"event_id", tasks[i].EventID,
+			)
+
+			continue
+		}
+
+		select {
+		case e.deliveryCh <- tasks[i]:
+		default:
+			e.inflight.release(tasks[i].DeliveryID)
+			e.log.Warn(
+				"delivery channel full, "+
+					"task will be recovered by the sweep",
+				"delivery_id", tasks[i].DeliveryID,
+				"event_id", tasks[i].EventID,
+			)
+		}
+	}
+}
+
 // StateAndCooldown implements CircuitBreakers. It returns the state of
 // the target's circuit breaker and, while the breaker is open, what is
 // left of its cooldown; the cooldown is zero once that has passed and
@@ -288,38 +324,6 @@ func (e *Engine) ScheduleRetry(
 	})
 }
 
-// notify queues the tasks of deliveries already stored. StoreEvent and
-// CreateReplay call it once their transaction has committed.
-func (e *Engine) notify(tasks []Task) {
-	for i := range tasks {
-		// Owned before it is queued, and until the worker that runs
-		// it returns. A task can sit in a 10000-deep channel for a
-		// long time on a healthy system, and nothing may re-send it
-		// while it waits. See inflight.go.
-		if !e.inflight.retainIdle(tasks[i].DeliveryID) {
-			e.log.Warn(
-				"delivery already in flight, not queued again",
-				"delivery_id", tasks[i].DeliveryID,
-				"event_id", tasks[i].EventID,
-			)
-
-			continue
-		}
-
-		select {
-		case e.deliveryCh <- tasks[i]:
-		default:
-			e.inflight.release(tasks[i].DeliveryID)
-			e.log.Warn(
-				"delivery channel full, "+
-					"task will be recovered by the sweep",
-				"delivery_id", tasks[i].DeliveryID,
-				"event_id", tasks[i].EventID,
-			)
-		}
-	}
-}
-
 // userAgent is the User-Agent header of every http and slack
 // delivery request: the program name and the running build's
 // version.
@@ -468,9 +472,9 @@ func (e *Engine) processNewTask(
 	}
 
 	// The recovery routine's run at start can send and release this
-	// delivery before StoreEvent or CreateReplay queues it. Ownership
+	// delivery before the receiver's Notify queues it. Ownership cannot
-	// cannot refuse a delivery nobody holds, so the row decides whether
+	// refuse a delivery nobody holds, so the row decides whether it
-	// it still needs sending.
+	// still needs sending.
 	row, err := e.loadDelivery(webhookDB, task.DeliveryID)
 	if err != nil {
 		e.log.Error(
@@ -895,7 +899,7 @@ func (e *Engine) recoverSingleRetry(
 		return
 	}
 
-	e.ScheduleRetry(buildTask(
+	e.ScheduleRetry(buildRecoveryTask(
 		d, webhookID, &event, &target, attemptNum+1,
 	), remaining)
 
@@ -917,7 +921,7 @@ func (e *Engine) recoverSingleRetry(
 // it stopped working on before then: for example one whose bookkeeping
 // write failed, whose attempt a stop cut off, that was still queued
 // when the engine last stopped, whose task was dropped because the
-// delivery channel was full (by notify or by queueRecovered), or whose
+// delivery channel was full (by Notify or by queueRecovered), or whose
 // worker could not open the webhook's database.
 //
 // At start every pending delivery is taken, however recent, so one a
@@ -1818,11 +1822,7 @@ func (e *Engine) loadTarget(
 	return target, nil
 }
 
-// buildTask builds the task that carries delivery d of event to target
+func buildRecoveryTask(
-// through the engine's channels, as attempt attemptNum. The body is
-// carried only when it is under MaxInlineBodySize; a larger one is read
-// from the event row when the attempt runs (see hydrateEvent).
-func buildTask(
 	d *database.Delivery,
 	webhookID string,
 	event *database.Event,
@@ -1998,7 +1998,7 @@ func (e *Engine) sendRecoveredDeliveries(
 			continue
 		}
 
-		task := buildTask(
+		task := buildRecoveryTask(
 			&deliveries[i], webhookID, &event, &target,
 			attempts[deliveries[i].ID]+1,
 		)

internal/delivery/engine_integration_test.go

@@ -492,7 +492,7 @@ func TestWorkerLifecycle_StartStop(t *testing.T) {
 	)
 	task.TargetType = database.TargetTypeLog
 
-	s.Engine.ExportNotify([]delivery.Task{task})
+	s.Engine.Notify([]delivery.Task{task})
 
 	iWaitForDelivered(t, s.WebhookDB, d.ID)
 
@@ -1452,7 +1452,7 @@ func TestDeliverHTTP_NoURL(t *testing.T) {
 	iAssertResultFailed(t, db, del.ID)
 }
 
-// --- notify batching ---
+// --- Notify batching ---
 
 func TestNotify_MultipleTasks(t *testing.T) {
 	t.Parallel()
@@ -1467,7 +1467,7 @@ func TestNotify_MultipleTasks(t *testing.T) {
 		}
 	}
 
-	e.ExportNotify(tasks)
+	e.Notify(tasks)
 
 	for i := range 5 {
 		select {

internal/delivery/engine_lifecycle_test.go

@@ -29,7 +29,7 @@ const (
 	// OnStart before the caller may enqueue work. A worker pool
 	// wrongly rooted in the already-done hook context has nothing
 	// but ctx.Done() ready in its select, so it is deterministically
-	// gone by the end of this window. Without the wait, notify would
+	// gone by the end of this window. Without the wait, Notify would
 	// race the pool's very first select, in which a ready ctx.Done()
 	// and a ready deliveryCh are chosen between at random and a
 	// doomed pool still delivers.
@@ -182,7 +182,7 @@ func TestEngine_WorkersOutliveStartHookContext(t *testing.T) {
 	// routine's run at start cannot enqueue it.
 	deliveryID, task := seedLogTask(t, s)
 
-	s.Engine.ExportNotify([]delivery.Task{task})
+	s.Engine.Notify([]delivery.Task{task})
 
 	iWaitForDelivered(t, s.WebhookDB, deliveryID)
 }
@@ -202,7 +202,7 @@ func TestEngine_StopHookStopsWorkers(t *testing.T) {
 	// Let the pool prove it is running before stopping it, so a
 	// fast OnStop cannot pass by stopping something already dead.
 	firstID, firstTask := seedLogTask(t, s)
-	s.Engine.ExportNotify([]delivery.Task{firstTask})
+	s.Engine.Notify([]delivery.Task{firstTask})
 	iWaitForDelivered(t, s.WebhookDB, firstID)
 
 	var stopErr error
@@ -232,7 +232,7 @@ func TestEngine_StopHookStopsWorkers(t *testing.T) {
 	// With every worker gone, a freshly notified task must sit
 	// untouched in the queue rather than being delivered.
 	secondID, secondTask := seedLogTask(t, s)
-	s.Engine.ExportNotify([]delivery.Task{secondTask})
+	s.Engine.Notify([]delivery.Task{secondTask})
 
 	time.Sleep(200 * time.Millisecond)
 
@@ -383,7 +383,7 @@ func TestEngine_StopLeavesFireAndForgetAttemptPending(t *testing.T) {
 		t, s, 1, database.DeliveryStatusPending, 1,
 	)
 
-	s.Engine.ExportNotify([]delivery.Task{task})
+	s.Engine.Notify([]delivery.Task{task})
 	stopDuringAttempt(t, lc, arrived)
 
 	iAssertStatus(
@@ -448,7 +448,7 @@ func deliverToArchive(t *testing.T, s iSetup) string {
 	task.TargetID = tgt.ID
 	task.TargetType = database.TargetTypeDatabase
 
-	s.Engine.ExportNotify([]delivery.Task{task})
+	s.Engine.Notify([]delivery.Task{task})
 
 	iWaitForDelivered(t, s.WebhookDB, deliveryID)
 

internal/delivery/engine_test.go

@@ -218,7 +218,7 @@ func TestNotify_NonBlocking(t *testing.T) {
 	done := make(chan struct{})
 
 	go func() {
-		e.ExportNotify([]delivery.Task{
+		e.Notify([]delivery.Task{
 			{DeliveryID: "overflow-1"},
 			{DeliveryID: "overflow-2"},
 		})
@@ -229,7 +229,7 @@ func TestNotify_NonBlocking(t *testing.T) {
 	case <-done:
 	case <-time.After(2 * time.Second):
 		t.Fatal(
-			"notify blocked when delivery channel was full",
+			"Notify blocked when delivery channel was full",
 		)
 	}
 }

internal/delivery/export_test.go

@@ -158,11 +158,6 @@ func (e *Engine) ExportUpdateDeliveryStatus(
 	return e.updateDeliveryStatus(webhookDB, d, "", status)
 }
 
-// ExportNotify exposes notify.
-func (e *Engine) ExportNotify(tasks []Task) {
-	e.notify(tasks)
-}
-
 // ExportProcessNewTask exposes processNewTask.
 func (e *Engine) ExportProcessNewTask(
 	ctx context.Context, task *Task,

internal/delivery/inflight.go

@@ -61,7 +61,7 @@ func (s *inflightSet) retain(deliveryID string) {
 
 // retainIdle takes the first reference on a delivery, and reports
 // whether it got it. It fails when the engine already owns the
-// delivery, which is what makes two claimants — notify and the
+// delivery, which is what makes two claimants — Notify and the
 // recovery routine, say — mutually exclusive rather than merely
 // atomic.
 func (s *inflightSet) retainIdle(deliveryID string) bool {

internal/delivery/inflight_test.go

@@ -84,9 +84,9 @@ func TestSweepLeavesAQueuedDeliveryAlone(t *testing.T) {
 	)
 	rAgePending(t, s.WebhookDB, d.ID)
 
-	// Queued exactly as StoreEvent queues it, and never dequeued:
+	// Queued exactly as the receiver queues it, and never dequeued:
 	// no workers are running in this engine.
-	s.Engine.ExportNotify([]delivery.Task{{
+	s.Engine.Notify([]delivery.Task{{
 		DeliveryID: d.ID,
 		EventID:    event.ID,
 		WebhookID:  s.WebhookID,
@@ -109,7 +109,7 @@ func TestSweepLeavesAQueuedDeliveryAlone(t *testing.T) {
 
 // TestRecoveryAndSweepDoNotDoubleDispatch drives the recovery routine's
 // run at start and a tick of the sweep at once against one aged pending
-// row. The engine runs them one after the other, but notify can race
+// row. The engine runs them one after the other, but Notify can race
 // either, and ownership is what keeps any two claimants from both
 // sending. Before ownership the two runs both dispatched the row.
 func TestRecoveryAndSweepDoNotDoubleDispatch(t *testing.T) {
@@ -224,7 +224,7 @@ func TestOwnershipIsReleasedAfterDelivery(t *testing.T) {
 
 	body := `{"released":true}`
 
-	s.Engine.ExportNotify([]delivery.Task{{
+	s.Engine.Notify([]delivery.Task{{
 		DeliveryID:   d.ID,
 		EventID:      event.ID,
 		WebhookID:    s.WebhookID,
@@ -248,10 +248,10 @@ func TestOwnershipIsReleasedAfterDelivery(t *testing.T) {
 }
 
 // TestNotifyAfterRecoveryDoesNotSendAgain is the startup race of
-// https://git.eeqj.de/sneak/webhooker/issues/299. StoreEvent has
+// https://git.eeqj.de/sneak/webhooker/issues/299. The receiver has
 // written a delivery, the recovery routine's run at start finds it
-// pending, sends it and releases it, and only then does StoreEvent's
+// pending, sends it and releases it, and only then does the receiver's
-// notify for it arrive. Nothing owns the delivery by then, so notify
+// Notify for it arrive. Nothing owns the delivery by then, so Notify
 // takes it.
 func TestNotifyAfterRecoveryDoesNotSendAgain(t *testing.T) {
 	t.Parallel()
@@ -289,7 +289,7 @@ func TestNotifyAfterRecoveryDoesNotSendAgain(t *testing.T) {
 
 	body := event.Body
 
-	s.Engine.ExportNotify([]delivery.Task{{
+	s.Engine.Notify([]delivery.Task{{
 		DeliveryID:   d.ID,
 		EventID:      event.ID,
 		WebhookID:    s.WebhookID,
@@ -300,7 +300,7 @@ func TestNotifyAfterRecoveryDoesNotSendAgain(t *testing.T) {
 		EntrypointID: event.EntrypointID,
 	}})
 
-	// notify took the delivery, and a worker releases it once it has
+	// Notify took the delivery, and a worker releases it once it has
 	// run the task.
 	require.Eventually(
 		t,

internal/delivery/store.go

@@ -1,164 +0,0 @@
-package delivery
-
-import (
-	"fmt"
-
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// StoreEvent stores event with one pending delivery for each of its
-// webhook's active targets, and adds them to the totals, in one
-// transaction, then queues the deliveries. It returns how many
-// deliveries it created.
-//
-// The receiver stores every event it accepts through here, and a
-// resubmit stores its copy of a stored event, so every event is
-// stored, retried, SSRF-guarded and circuit-broken the same way however
-// it entered the system. CreateReplay is the only other place a
-// delivery is created.
-//
-// The targets are the webhook's active ones as they stand now: a
-// target created after a resubmitted event first arrived is included,
-// and an inactive one is skipped. An event with no active target is
-// stored with no deliveries.
-func (e *Engine) StoreEvent(event *database.Event) (int, error) {
-	var targets []database.Target
-
-	err := e.database.DB().Where(
-		"webhook_id = ? AND active = ?", event.WebhookID, true,
-	).Find(&targets).Error
-	if err != nil {
-		return 0, fmt.Errorf("loading active targets: %w", err)
-	}
-
-	webhookDB, err := e.dbManager.GetDB(event.WebhookID)
-	if err != nil {
-		return 0, fmt.Errorf("getting webhook database: %w", err)
-	}
-
-	event.BodyBytes = int64(len(event.Body))
-	tasks := make([]Task, 0, len(targets))
-
-	err = webhookDB.Transaction(func(tx *gorm.DB) error {
-		err := tx.Create(event).Error
-		if err != nil {
-			return fmt.Errorf("creating event: %w", err)
-		}
-
-		for i := range targets {
-			dlv, err := createDelivery(tx, event.ID, targets[i].ID, false)
-			if err != nil {
-				return err
-			}
-
-			tasks = append(tasks, buildTask(
-				dlv, event.WebhookID, event, &targets[i], 1,
-			))
-		}
-
-		err = database.AddEventTotals(tx, database.EventTotals{
-			Events: 1, LastEventAt: &event.CreatedAt,
-		})
-		if err != nil {
-			return err
-		}
-
-		// A resubmitted copy did not arrive on its entrypoint's URL, so
-		// it leaves the entrypoint's last event as it is.
-		if event.ResubmittedFromID != nil {
-			return nil
-		}
-
-		return database.AddEntrypointTotals(tx, database.EntrypointTotals{
-			EntrypointID: event.EntrypointID, LastEventAt: event.CreatedAt,
-		})
-	})
-	if err != nil {
-		return 0, err
-	}
-
-	// Counted here, after the commit: an event exists once it is
-	// durably stored, which is what the delivery counters are compared
-	// against on a dashboard. A resubmitted event counts too, because
-	// it produces deliveries that the delivery side counts; the
-	// resubmit counter is what separates the two.
-	e.mtr.EventReceived()
-
-	e.notify(tasks)
-
-	return len(tasks), nil
-}
-
-// CreateReplay creates one more pending delivery of the stored event
-// eventID to target, marked as a replay, adds it to the target's totals
-// in the same transaction, and queues it. It returns the new
-// delivery's id.
-//
-// The caller passes the target as it stands now and has already
-// decided the replay may go ahead. The delivery being replayed is not
-// touched.
-func (e *Engine) CreateReplay(
-	webhookID, eventID string, target *database.Target,
-) (string, error) {
-	webhookDB, err := e.dbManager.GetDB(webhookID)
-	if err != nil {
-		return "", fmt.Errorf("getting webhook database: %w", err)
-	}
-
-	event, err := e.loadEvent(webhookDB, eventID)
-	if err != nil {
-		return "", err
-	}
-
-	var dlv *database.Delivery
-
-	err = webhookDB.Transaction(func(tx *gorm.DB) error {
-		var err error
-
-		dlv, err = createDelivery(tx, event.ID, target.ID, true)
-
-		return err
-	})
-	if err != nil {
-		return "", err
-	}
-
-	e.notify([]Task{buildTask(dlv, webhookID, &event, target, 1)})
-
-	return dlv.ID, nil
-}
-
-// createDelivery writes a pending delivery of the event to the target
-// on the caller's transaction, and adds it to the target's totals.
-//
-// Neither Event nor Target is set on the row, and the per-webhook
-// database omits associations on every write in any case (see
-// internal/database/event_db_isolation.go), so the target's settings
-// are never copied into the event database.
-func createDelivery(
-	tx *gorm.DB, eventID, targetID string, replay bool,
-) (*database.Delivery, error) {
-	dlv := &database.Delivery{
-		EventID:  eventID,
-		TargetID: targetID,
-		Status:   database.DeliveryStatusPending,
-		Replay:   replay,
-	}
-
-	err := tx.Create(dlv).Error
-	if err != nil {
-		return nil, fmt.Errorf(
-			"creating delivery for target %s: %w", targetID, err,
-		)
-	}
-
-	err = database.AddTargetTotals(tx, database.TargetTotals{
-		TargetID: targetID, Deliveries: 1,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return dlv, nil
-}

internal/delivery/store_test.go

@@ -1,386 +0,0 @@
-package delivery_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/delivery"
-)
-
-// storeTestTarget creates an active http target of the setup's webhook
-// with every one of a target's settings set, so a task that drops one
-// of them differs from the target.
-func storeTestTarget(
-	t *testing.T, s iSetup, name string,
-) database.Target {
-	t.Helper()
-
-	target := database.Target{
-		WebhookID:       s.WebhookID,
-		Name:            name,
-		Type:            database.TargetTypeHTTP,
-		Active:          true,
-		URL:             "http://93.184.216.34/" + name,
-		Headers:         map[string]string{"X-Api-Key": "k"},
-		TimeoutSeconds:  7,
-		ForwardQuery:    true,
-		ArchiveExpiry:   time.Hour,
-		ArchiveRotation: rotationDaily,
-		MaxAttempts:     3,
-	}
-
-	require.NoError(t, s.MainDB.Create(&target).Error)
-
-	return target
-}
-
-// newStoreTestEvent returns an event of the setup's webhook as the
-// receiver builds one, not yet stored.
-func newStoreTestEvent(s iSetup, body string) *database.Event {
-	return &database.Event{
-		WebhookID:    s.WebhookID,
-		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
-		RawQuery:     "a=1&b=2",
-		Headers:      `{"X-Test":["yes"]}`,
-		ContentType:  testContentType,
-		Body:         body,
-	}
-}
-
-// queuedTasks takes every task the engine has queued so far. The
-// engine in these tests is never started, so nothing else takes them.
-func queuedTasks(e *delivery.Engine) []delivery.Task {
-	var tasks []delivery.Task
-
-	for {
-		select {
-		case task := <-e.ExportDeliveryCh():
-			tasks = append(tasks, task)
-		default:
-			return tasks
-		}
-	}
-}
-
-// assertTaskFor proves task carries delivery deliveryID of event to
-// target: every one of the target's settings and every event field.
-// They are copied into the task one field at a time, and a field left
-// out is sent empty without any error.
-func assertTaskFor(
-	t *testing.T,
-	task delivery.Task,
-	deliveryID string,
-	event *database.Event,
-	target *database.Target,
-) {
-	t.Helper()
-
-	assert.Equal(t, deliveryID, task.DeliveryID)
-	assert.Equal(t, event.ID, task.EventID)
-	assert.Equal(t, event.WebhookID, task.WebhookID)
-	assert.Equal(t, event.EntrypointID, task.EntrypointID)
-
-	assert.Equal(t, target.ID, task.TargetID)
-	assert.Equal(t, target.Name, task.TargetName)
-	assert.Equal(t, target.Type, task.TargetType)
-	assert.Equal(t, target.URL, task.TargetURL)
-	assert.Equal(t, target.Headers, task.TargetHeaders)
-	assert.Equal(t, target.TimeoutSeconds, task.TimeoutSeconds)
-	assert.Equal(t, target.ForwardQuery, task.ForwardQuery)
-	assert.Equal(t, target.ArchiveExpiry, task.ArchiveExpiry)
-	assert.Equal(t, target.ArchiveRotation, task.ArchiveRotation)
-	assert.Equal(t, target.MaxAttempts, task.MaxAttempts)
-
-	assert.Equal(t, event.Method, task.Method)
-	assert.Equal(t, event.RawQuery, task.RawQuery)
-	assert.Equal(t, event.Headers, task.Headers)
-	assert.Equal(t, event.ContentType, task.ContentType)
-	require.NotNil(t, task.Body)
-	assert.Equal(t, event.Body, *task.Body)
-
-	assert.Equal(t, 1, task.AttemptNum)
-}
-
-// storedDeliveries reads every delivery of an event.
-func storedDeliveries(
-	t *testing.T, db *gorm.DB, eventID string,
-) []database.Delivery {
-	t.Helper()
-
-	var deliveries []database.Delivery
-
-	require.NoError(t, db.Where("event_id = ?", eventID).
-		Find(&deliveries).Error)
-
-	return deliveries
-}
-
-// storedEventTotals reads the webhook's event totals.
-func storedEventTotals(t *testing.T, db *gorm.DB) database.EventTotals {
-	t.Helper()
-
-	var totals database.EventTotals
-
-	require.NoError(t, db.First(&totals).Error)
-
-	return totals
-}
-
-// countRows counts the rows of model in db.
-func countRows(t *testing.T, db *gorm.DB, model any) int64 {
-	t.Helper()
-
-	var n int64
-
-	require.NoError(t, db.Model(model).Count(&n).Error)
-
-	return n
-}
-
-// TestStoreEvent_StoresDeliveriesToActiveTargets proves StoreEvent
-// stores the event with one pending delivery to each active target and
-// none to an inactive one, adds them to the totals, and queues one task
-// per delivery.
-func TestStoreEvent_StoresDeliveriesToActiveTargets(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	targets := []database.Target{
-		storeTestTarget(t, s, "first"),
-		storeTestTarget(t, s, "second"),
-	}
-	off := storeTestTarget(t, s, "off")
-
-	require.NoError(t, s.MainDB.Model(&database.Target{}).
-		Where("id = ?", off.ID).Update("active", false).Error)
-
-	event := newStoreTestEvent(s, `{"hello":"world"}`)
-
-	created, err := s.Engine.StoreEvent(event)
-	require.NoError(t, err)
-	assert.Equal(t, 2, created)
-
-	var stored database.Event
-
-	require.NoError(t, s.WebhookDB.First(&stored, "id = ?", event.ID).Error)
-	assert.Equal(t, event.Body, stored.Body)
-	assert.Equal(t, int64(len(event.Body)), stored.BodyBytes)
-
-	rows := storedDeliveries(t, s.WebhookDB, event.ID)
-	queued := queuedTasks(s.Engine)
-
-	require.Len(t, rows, 2)
-	require.Len(t, queued, 2)
-
-	deliveries := map[string]database.Delivery{}
-	for _, dlv := range rows {
-		deliveries[dlv.TargetID] = dlv
-	}
-
-	tasks := map[string]delivery.Task{}
-	for _, task := range queued {
-		tasks[task.TargetID] = task
-	}
-
-	for i := range targets {
-		dlv, ok := deliveries[targets[i].ID]
-		require.True(t, ok, "no delivery to %s", targets[i].Name)
-		assert.Equal(t, database.DeliveryStatusPending, dlv.Status)
-		assert.False(t, dlv.Replay)
-		assert.Equal(t, int64(1),
-			targetTotals(t, s.WebhookDB, targets[i].ID).Deliveries)
-
-		assertTaskFor(t, tasks[targets[i].ID], dlv.ID, event, &targets[i])
-	}
-
-	totals := storedEventTotals(t, s.WebhookDB)
-	assert.Equal(t, int64(1), totals.Events)
-	require.NotNil(t, totals.LastEventAt)
-	assert.True(t, totals.LastEventAt.Equal(stored.CreatedAt))
-
-	var entrypoint database.EntrypointTotals
-
-	require.NoError(t, s.WebhookDB.First(
-		&entrypoint, "entrypoint_id = ?", event.EntrypointID,
-	).Error)
-	assert.True(t, entrypoint.LastEventAt.Equal(stored.CreatedAt))
-}
-
-// TestStoreEvent_ResubmittedCopyLeavesTheEntrypoint proves a
-// resubmitted copy is counted among the webhook's events but leaves its
-// entrypoint's last event as it is: it did not arrive on that URL.
-func TestStoreEvent_ResubmittedCopyLeavesTheEntrypoint(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	storeTestTarget(t, s, "only")
-
-	sourceID := uuid.New().String()
-	event := newStoreTestEvent(s, `{"copy":true}`)
-	event.ResubmittedFromID = &sourceID
-
-	created, err := s.Engine.StoreEvent(event)
-	require.NoError(t, err)
-	assert.Equal(t, 1, created)
-	assert.Len(t, queuedTasks(s.Engine), 1)
-
-	assert.Equal(t, int64(1), storedEventTotals(t, s.WebhookDB).Events)
-	assert.Zero(t, countRows(t, s.WebhookDB, &database.EntrypointTotals{}))
-}
-
-// TestStoreEvent_NoActiveTarget proves an event of a webhook with no
-// active target is stored with no delivery and nothing queued.
-func TestStoreEvent_NoActiveTarget(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	event := newStoreTestEvent(s, `{"to":"nobody"}`)
-
-	created, err := s.Engine.StoreEvent(event)
-	require.NoError(t, err)
-	assert.Zero(t, created)
-
-	assert.Equal(t, int64(1), countRows(t, s.WebhookDB, &database.Event{}))
-	assert.Empty(t, storedDeliveries(t, s.WebhookDB, event.ID))
-	assert.Empty(t, queuedTasks(s.Engine))
-}
-
-// TestStoreEvent_LargeBodyIsNotCarried proves a body at the inline
-// limit is stored whole but left off the task, for the attempt to read
-// from the event row.
-func TestStoreEvent_LargeBodyIsNotCarried(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	storeTestTarget(t, s, "only")
-
-	event := newStoreTestEvent(
-		s, strings.Repeat("x", delivery.MaxInlineBodySize),
-	)
-
-	_, err := s.Engine.StoreEvent(event)
-	require.NoError(t, err)
-
-	tasks := queuedTasks(s.Engine)
-	require.Len(t, tasks, 1)
-	assert.Nil(t, tasks[0].Body)
-
-	var stored database.Event
-
-	require.NoError(t, s.WebhookDB.First(&stored, "id = ?", event.ID).Error)
-	assert.Equal(t, event.Body, stored.Body)
-}
-
-// TestStoreEvent_RollsBackWhenAWriteFails proves the event, its
-// deliveries and its totals are one transaction: when the entrypoint
-// totals write fails, the last one, after the event, its delivery, the
-// target totals and the event totals were written, none of them is left
-// and nothing is queued.
-func TestStoreEvent_RollsBackWhenAWriteFails(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	storeTestTarget(t, s, "only")
-
-	require.NoError(t,
-		s.WebhookDB.Migrator().DropTable(&database.EntrypointTotals{}))
-
-	_, err := s.Engine.StoreEvent(newStoreTestEvent(s, `{"lost":true}`))
-	require.Error(t, err)
-
-	assert.Zero(t, countRows(t, s.WebhookDB, &database.Event{}))
-	assert.Zero(t, countRows(t, s.WebhookDB, &database.Delivery{}))
-	assert.Zero(t, countRows(t, s.WebhookDB, &database.TargetTotals{}))
-
-	totals := storedEventTotals(t, s.WebhookDB)
-	assert.Zero(t, totals.Events)
-	assert.Nil(t, totals.LastEventAt)
-
-	assert.Empty(t, queuedTasks(s.Engine))
-	assert.Zero(t, s.Engine.ExportInflightHeld())
-}
-
-// TestCreateReplay_CreatesAndQueuesAReplay proves CreateReplay adds a
-// new pending delivery marked as a replay, counts it in the target's
-// totals, queues its task built from the target it was given and the
-// stored event, and leaves the delivery it repeats as it was. The
-// stored event has every event field set, so a task that drops one of
-// them differs from the event.
-func TestCreateReplay_CreatesAndQueuesAReplay(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	target := storeTestTarget(t, s, "replayed")
-	event := newStoreTestEvent(s, `{"replay":"me"}`)
-	require.NoError(t, s.WebhookDB.Create(event).Error)
-
-	original := iSeedDelivery(
-		t, s.WebhookDB, event.ID, target.ID,
-		database.DeliveryStatusFailed,
-	)
-
-	deliveryID, err := s.Engine.CreateReplay(s.WebhookID, event.ID, &target)
-	require.NoError(t, err)
-
-	replay := storedDelivery(t, s.WebhookDB, deliveryID)
-	assert.Equal(t, event.ID, replay.EventID)
-	assert.Equal(t, target.ID, replay.TargetID)
-	assert.Equal(t, database.DeliveryStatusPending, replay.Status)
-	assert.True(t, replay.Replay)
-
-	assert.Equal(t, database.DeliveryStatusFailed,
-		storedDelivery(t, s.WebhookDB, original.ID).Status)
-	assert.Equal(t, int64(1),
-		targetTotals(t, s.WebhookDB, target.ID).Deliveries)
-
-	tasks := queuedTasks(s.Engine)
-	require.Len(t, tasks, 1)
-	assertTaskFor(t, tasks[0], deliveryID, event, &target)
-}
-
-// TestCreateReplay_RollsBackWhenAWriteFails proves the replay delivery
-// and its target totals are one transaction: when the totals write
-// fails, after the delivery was written, no new delivery is left and
-// nothing is queued.
-func TestCreateReplay_RollsBackWhenAWriteFails(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-	target := storeTestTarget(t, s, "replayed")
-	event := iSeedEvent(t, s.WebhookDB, s.WebhookID, `{"replay":"me"}`)
-	iSeedDelivery(
-		t, s.WebhookDB, event.ID, target.ID,
-		database.DeliveryStatusFailed,
-	)
-
-	require.NoError(t,
-		s.WebhookDB.Migrator().DropTable(&database.TargetTotals{}))
-
-	_, err := s.Engine.CreateReplay(s.WebhookID, event.ID, &target)
-	require.Error(t, err)
-
-	assert.Len(t, storedDeliveries(t, s.WebhookDB, event.ID), 1)
-	assert.Empty(t, queuedTasks(s.Engine))
-	assert.Zero(t, s.Engine.ExportInflightHeld())
-}
-
-// storedDelivery reads one delivery back.
-func storedDelivery(
-	t *testing.T, db *gorm.DB, deliveryID string,
-) database.Delivery {
-	t.Helper()
-
-	var dlv database.Delivery
-
-	require.NoError(t, db.First(&dlv, "id = ?", deliveryID).Error)
-
-	return dlv
-}

internal/handlers/delivery_replay.go

@@ -5,7 +5,9 @@ import (
 
 	"github.com/go-chi/chi"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
 // The outcomes of a replay POST, as the notice codes its redirect
@@ -44,12 +46,12 @@ const (
 // HandleDeliveryReplay re-sends a finished delivery's event to its
 // target.
 //
-// A replay never touches the delivery it repeats. The delivery engine
+// A replay never touches the delivery it repeats. It creates a NEW
-// creates a NEW pending delivery row for the same event and target and
+// pending delivery row for the same event and target and hands it to
-// queues it as it queues the receiver's, so the original's status,
+// the delivery engine through the same Notifier the receiver uses, so
-// attempts and timestamps stand as the record of what actually
+// the original's status, attempts and timestamps stand as the record
-// happened, and the replay is retried, SSRF-guarded and circuit-broken
+// of what actually happened, and the replay is retried, SSRF-guarded
-// exactly as a first attempt is.
+// and circuit-broken exactly as a first attempt is.
 //
 // What is re-sent is the stored EVENT body, never the response the
 // original delivery received.
@@ -143,8 +145,7 @@ func (h *Handlers) loadReplaySource(
 	return &original, true
 }
 
-// queueReplay has the delivery engine create and queue the new
+// queueReplay writes the new delivery and hands it to the engine.
-// delivery, unless an earlier replay is still in flight.
 func (h *Handlers) queueReplay(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -170,8 +171,18 @@ func (h *Handlers) queueReplay(
 		return
 	}
 
-	deliveryID, err := h.engine.CreateReplay(
+	var event database.Event
-		webhook.ID, original.EventID, target,
+
+	err = webhookDB.
+		First(&event, "id = ?", original.EventID).Error
+	if err != nil {
+		h.serverError(w, r, "failed to load event for replay", err)
+
+		return
+	}
+
+	task, err := createReplayDelivery(
+		webhookDB, webhook.ID, &event, target,
 	)
 	if err != nil {
 		h.serverError(
@@ -182,14 +193,15 @@ func (h *Handlers) queueReplay(
 	}
 
 	h.mtr.DeliveryReplayed(target.Type)
+	h.notifier.Notify([]delivery.Task{task})
 
 	h.log.Info(
 		"delivery replay queued",
 		"webhook_id", webhook.ID,
-		"event_id", original.EventID,
+		"event_id", event.ID,
 		"target_id", target.ID,
 		"replayed_delivery_id", original.ID,
-		"delivery_id", deliveryID,
+		"delivery_id", task.DeliveryID,
 	)
 
 	redirectToEventLog(w, r, webhook, replayQueued)
@@ -251,6 +263,77 @@ func countInFlightDeliveries(
 	return count, err
 }
 
+// createReplayDelivery writes the new pending delivery row, adds it to
+// its target's totals in the same transaction, and returns the task
+// that carries it to the delivery engine.
+//
+// The row is written with associations omitted, and neither Event nor
+// Target is populated on it: GORM's SaveBeforeAssociations would
+// otherwise upsert the whole target row — plaintext config, which for a
+// Slack target is the credential — into the per-webhook event database.
+// See https://git.eeqj.de/sneak/webhooker/issues/206.
+func createReplayDelivery(
+	webhookDB *gorm.DB,
+	webhookID string,
+	event *database.Event,
+	target *database.Target,
+) (delivery.Task, error) {
+	dlv := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: target.ID,
+		Status:   database.DeliveryStatusPending,
+		Replay:   true,
+	}
+
+	err := webhookDB.Transaction(func(tx *gorm.DB) error {
+		err := tx.Omit(clause.Associations).Create(dlv).Error
+		if err != nil {
+			return err
+		}
+
+		return database.AddTargetTotals(tx, database.TargetTotals{
+			TargetID: dlv.TargetID, Deliveries: 1,
+		})
+	})
+	if err != nil {
+		return delivery.Task{}, err
+	}
+
+	return delivery.Task{
+		DeliveryID:      dlv.ID,
+		EventID:         event.ID,
+		WebhookID:       webhookID,
+		EntrypointID:    event.EntrypointID,
+		TargetID:        target.ID,
+		TargetName:      target.Name,
+		TargetType:      target.Type,
+		TargetURL:       target.URL,
+		TargetHeaders:   target.Headers,
+		TimeoutSeconds:  target.TimeoutSeconds,
+		ForwardQuery:    target.ForwardQuery,
+		ArchiveExpiry:   target.ArchiveExpiry,
+		ArchiveRotation: target.ArchiveRotation,
+		MaxAttempts:     target.MaxAttempts,
+		Method:          event.Method,
+		RawQuery:        event.RawQuery,
+		Headers:         event.Headers,
+		ContentType:     event.ContentType,
+		Body:            replayBody(event.Body),
+		AttemptNum:      1,
+	}, nil
+}
+
+// replayBody returns the stored event body for a replay task to carry
+// inline, or nil when it is large enough that the engine should fetch
+// it from the per-webhook database instead.
+func replayBody(body string) *string {
+	if len(body) >= delivery.MaxInlineBodySize {
+		return nil
+	}
+
+	return &body
+}
+
 // redirectToEventLog redirects a replay or resubmit back to the event
 // log it was triggered from, carrying the outcome as its notice. A
 // Replay form carries the list it was pressed in as show, so a replay

internal/handlers/delivery_replay_test.go

@@ -12,6 +12,7 @@ import (
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/session"
 )
@@ -22,7 +23,7 @@ const paramDeliveryID = "deliveryID"
 
 // replayTargetURL is a public destination, so a target configured with
 // it is one the SSRF guard would accept. Nothing in these tests
-// dispatches to it: the delivery engine is never started.
+// dispatches to it: the notifier is recorded, not run.
 const replayTargetURL = "http://93.184.216.34/hook"
 
 // replayEventQuery is the query string a seeded event arrived with.
@@ -162,8 +163,14 @@ func postReplay(
 
 // TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal is the
 // core requirement: replaying a failed delivery succeeds, appends a
-// new delivery marked as a replay, and leaves the original row and its
+// new delivery, and leaves the original row and its recorded attempt
-// recorded attempt exactly as they were.
+// exactly as they were.
+//
+// It also pins the two things a replay would be wrong to get from the
+// original: the task carries the target's CURRENT configuration, which
+// this test changes between the failure and the replay, and it carries
+// the stored EVENT body rather than anything the failed attempt
+// received back.
 func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	t *testing.T,
 ) {
@@ -174,9 +181,10 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -196,6 +204,15 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 
 	before := loadDelivery(t, webhookDB, original.ID)
 
+	// The operator fixes the destination, which is the whole reason
+	// to replay. The replay must use this, not the URL the original
+	// delivery ran against.
+	const fixedURL = "http://93.184.216.34/fixed"
+
+	require.NoError(t, db.DB().Model(&database.Target{}).
+		Where("id = ?", tgt.ID).
+		Update("url", fixedURL).Error)
+
 	w := postReplay(t, h, sess, wh.ID, original.ID)
 
 	require.Equal(t, http.StatusSeeOther, w.Code)
@@ -217,9 +234,14 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	assert.Equal(
 		t, database.DeliveryStatusPending, replayed.Status,
 	)
-	assert.True(t, replayed.Replay)
 
 	assertDeliveryUntouched(t, webhookDB, before)
+
+	tasks := notif.Tasks()
+	require.Len(t, tasks, 1)
+	assertReplayTask(
+		t, tasks[0], wh.ID, event, tgt, replayed.ID, fixedURL,
+	)
 	assertNoLeakedTarget(t, webhookDB)
 }
 
@@ -253,6 +275,45 @@ func assertDeliveryUntouched(
 	)
 }
 
+// assertReplayTask proves the task handed to the delivery engine is
+// the one the receiver would build for this event and this target, and
+// that it carries wantURL — the target's URL as it stands now rather
+// than as the original delivery ran against it.
+func assertReplayTask(
+	t *testing.T,
+	task delivery.Task,
+	webhookID string,
+	event *database.Event,
+	target *database.Target,
+	wantDeliveryID, wantURL string,
+) {
+	t.Helper()
+
+	assert.Equal(t, wantDeliveryID, task.DeliveryID)
+	assert.Equal(t, event.ID, task.EventID)
+	assert.Equal(t, webhookID, task.WebhookID)
+	assert.Equal(t, event.EntrypointID, task.EntrypointID)
+	assert.Equal(t, target.ID, task.TargetID)
+	assert.Equal(t, target.Type, task.TargetType)
+	assert.Equal(
+		t, wantURL, task.TargetURL,
+		"replay must use the target's current URL",
+	)
+	assert.Equal(t, event.Method, task.Method)
+	assert.Equal(
+		t, replayEventQuery, task.RawQuery,
+		"replay re-sends the stored query string",
+	)
+	assert.Equal(t, event.Headers, task.Headers)
+	assert.Equal(t, event.ContentType, task.ContentType)
+	assert.Equal(t, 1, task.AttemptNum)
+	require.NotNil(t, task.Body)
+	assert.Equal(
+		t, event.Body, *task.Body,
+		"replay re-sends the stored event body",
+	)
+}
+
 // assertNoLeakedTarget proves the per-webhook database holds no
 // target: an association write would have upserted the whole target,
 // plaintext config and all, into the event database. See
@@ -266,10 +327,12 @@ func assertNoLeakedTarget(t *testing.T, webhookDB *gorm.DB) {
 	)
 }
 
-// TestHandleDeliveryReplay_FailedStoreIsAnError proves a replay the
+// TestHandleDeliveryReplay_TaskCarriesEveryTargetSetting proves the
-// engine cannot store answers with the 500 error page and adds no
+// task a replay hands the delivery engine carries every one of the
-// delivery.
+// target's settings.
-func TestHandleDeliveryReplay_FailedStoreIsAnError(t *testing.T) {
+func TestHandleDeliveryReplay_TaskCarriesEveryTargetSetting(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	var (
@@ -277,9 +340,10 @@ func TestHandleDeliveryReplay_FailedStoreIsAnError(t *testing.T) {
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -287,28 +351,22 @@ func TestHandleDeliveryReplay_FailedStoreIsAnError(t *testing.T) {
 	wh := seedWebhook(t, db)
 	tgt := seedConfiguredTarget(
 		t, db, wh.ID, database.TargetTypeHTTP,
-		database.Target{URL: replayTargetURL},
+		targetWithEverySetting(),
 	)
 
-	event, original := seedFailedDelivery(t, dbMgr, wh.ID, tgt.ID)
+	_, original := seedFailedDelivery(t, dbMgr, wh.ID, tgt.ID)
-
-	// Without its target totals table the webhook's database refuses
-	// the totals write, which comes after the delivery row.
-	webhookDB, err := dbMgr.GetDB(wh.ID)
-	require.NoError(t, err)
-	require.NoError(t,
-		webhookDB.Migrator().DropTable(&database.TargetTotals{}))
 
 	w := postReplay(t, h, sess, wh.ID, original.ID)
+	require.Equal(t, http.StatusSeeOther, w.Code)
 
-	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	tasks := notif.Tasks()
-	assert.Contains(t, w.Body.String(), "500 Internal Server Error")
+	require.Len(t, tasks, 1)
-	assert.Len(t, listDeliveries(t, webhookDB, event.ID), 1)
+	assertTaskCarriesTargetSettings(t, tasks[0], tgt)
 }
 
 // TestHandleDeliveryReplay_RefusesDeletedTarget proves the required
 // refusal: a target deleted since the delivery ran is reported as
-// deleted rather than erroring, and nothing is created.
+// deleted rather than erroring, and nothing is created or queued.
 func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	t.Parallel()
 
@@ -317,9 +375,10 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -355,6 +414,10 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 		t, listDeliveries(t, webhookDB, event.ID), 1,
 		"a refused replay must create no delivery",
 	)
+	assert.Empty(
+		t, notif.Tasks(),
+		"a refused replay must queue nothing",
+	)
 
 	// The refusal is specific, which is why the target is looked up
 	// including soft-deleted rows: an id that never named a target
@@ -387,9 +450,10 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -427,6 +491,10 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 		t, listDeliveries(t, webhookDB, event.ID), 2,
 		"the refused second replay must add nothing",
 	)
+	assert.Len(
+		t, notif.Tasks(), 1,
+		"only the first replay reaches the delivery engine",
+	)
 
 	// A delivery the engine has not finished is not replayable
 	// either, which is the same rule seen from the other side.

internal/handlers/event_resubmit.go

@@ -171,29 +171,37 @@ func loadResubmitSource(
 	return src, true, nil
 }
 
-// queueResubmit has the delivery engine store the copy, with a delivery
+// queueResubmit stores the copy and fans it out to the webhook's
-// for each of the webhook's active targets as they stand now, through
+// active targets.
-// the same StoreEvent the receiver uses. The one difference is that the
-// copy leaves its entrypoint's last event as it is, since it did not
-// arrive on that URL.
 func (h *Handlers) queueResubmit(
 	w http.ResponseWriter,
 	r *http.Request,
 	webhook database.Webhook,
 	src resubmitSource,
 ) {
-	event := &database.Event{
+	// The receiver's own query, run now: an active target created
-		WebhookID:         webhook.ID,
+	// after the original event arrived is included, and an
-		EntrypointID:      src.EntrypointID,
+	// inactive one is skipped rather than refused.
-		Method:            src.Method,
+	targets, err := h.loadActiveTargets(webhook.ID)
-		RawQuery:          src.RawQuery,
+	if err != nil {
-		Headers:           src.Headers,
+		h.serverError(w, r, "failed to query targets", err)
-		ContentType:       src.ContentType,
+
-		Body:              string(src.Body),
+		return
-		ResubmittedFromID: &src.ID,
 	}
 
-	deliveries, err := h.engine.StoreEvent(event)
+	event, tasks, err := h.createAndFanOut(
+		eventSource{
+			WebhookID:         webhook.ID,
+			EntrypointID:      src.EntrypointID,
+			Method:            src.Method,
+			RawQuery:          src.RawQuery,
+			HeadersJSON:       src.Headers,
+			ContentType:       src.ContentType,
+			Body:              src.Body,
+			ResubmittedFromID: &src.ID,
+		},
+		targets,
+	)
 	if err != nil {
 		h.serverError(w, r, "failed to store resubmitted event", err)
 
@@ -207,11 +215,11 @@ func (h *Handlers) queueResubmit(
 		"webhook_id", webhook.ID,
 		"event_id", event.ID,
 		"resubmitted_from_id", src.ID,
-		"target_count", deliveries,
+		"target_count", len(tasks),
 	)
 
 	code := resubmitQueued
-	if deliveries == 0 {
+	if len(tasks) == 0 {
 		code = resubmitNoTargets
 	}
 

internal/handlers/event_resubmit_test.go

@@ -19,7 +19,7 @@ import (
 
 // resubmitTargetURL is a public destination, so a target configured
 // with it is one the SSRF guard would accept. Nothing in these tests
-// dispatches to it: the delivery engine is never started.
+// dispatches to it: the notifier is recorded, not run.
 const resubmitTargetURL = "http://93.184.216.34/hook"
 
 // resubmitEventHeaders and resubmitEventQuery are the stored header
@@ -134,9 +134,10 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -188,6 +189,11 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 		t, database.DeliveryStatusPending, deliveries[0].Status,
 	)
 
+	tasks := notif.Tasks()
+	require.Len(t, tasks, 1)
+	assert.Equal(t, deliveries[0].ID, tasks[0].DeliveryID)
+	assertResubmitTask(t, tasks[0], wh.ID, &fresh, tgt)
+
 	assertNoLeakedTarget(t, webhookDB)
 }
 
@@ -219,6 +225,32 @@ func assertEventCopy(
 	)
 }
 
+// assertResubmitTask proves the task handed to the delivery engine is
+// the one the receiver would build for the NEW event and this target.
+func assertResubmitTask(
+	t *testing.T,
+	task delivery.Task,
+	webhookID string,
+	fresh *database.Event,
+	target *database.Target,
+) {
+	t.Helper()
+
+	assert.Equal(t, fresh.ID, task.EventID)
+	assert.Equal(t, webhookID, task.WebhookID)
+	assert.Equal(t, fresh.EntrypointID, task.EntrypointID)
+	assert.Equal(t, target.ID, task.TargetID)
+	assert.Equal(t, target.Type, task.TargetType)
+	assert.Equal(t, fresh.Method, task.Method)
+	assert.Equal(t, fresh.RawQuery, task.RawQuery)
+	assert.Equal(t, fresh.Headers, task.Headers)
+	assert.Equal(t, fresh.ContentType, task.ContentType)
+	assert.Equal(t, 1, task.AttemptNum)
+
+	require.NotNil(t, task.Body)
+	assert.Equal(t, fresh.Body, *task.Body)
+}
+
 // TestHandleEventResubmit_IsRepeatable proves the requirement replay
 // deliberately does not meet: firing the same captured event at a
 // backend over and over must work, with no in-flight refusal, and each
@@ -231,9 +263,10 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -267,18 +300,30 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 	require.NoError(t, err)
 
 	events := listEvents(t, webhookDB)
-	require.Len(
+	require.Len(t, events, presses+1)
-		t, events, presses+1, "each resubmit creates its own event",
-	)
 
-	assert.Empty(
+	tasks := notif.Tasks()
-		t, listDeliveries(t, webhookDB, original.ID),
+	require.Len(t, tasks, presses)
-		"each resubmit delivers its own new event",
-	)
 
-	// Every copy has its own delivery, and names the same source
+	seen := make(map[string]struct{}, presses)
-	// event, so twenty presses stay traceable to the one captured
+
-	// request.
+	for _, task := range tasks {
+		assert.Equal(t, tgt.ID, task.TargetID)
+		assert.NotEqual(
+			t, original.ID, task.EventID,
+			"each resubmit delivers its own new event",
+		)
+
+		_, dup := seen[task.EventID]
+		assert.False(t, dup, "each resubmit creates its own event")
+
+		seen[task.EventID] = struct{}{}
+
+		require.Len(t, listDeliveries(t, webhookDB, task.EventID), 1)
+	}
+
+	// Every copy names the same source event, so twenty presses stay
+	// traceable to the one captured request.
 	for _, e := range events {
 		if e.ID == original.ID {
 			continue
@@ -286,10 +331,6 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 
 		require.NotNil(t, e.ResubmittedFromID)
 		assert.Equal(t, original.ID, *e.ResubmittedFromID)
-
-		deliveries := listDeliveries(t, webhookDB, e.ID)
-		require.Len(t, deliveries, 1)
-		assert.Equal(t, tgt.ID, deliveries[0].TargetID)
 	}
 }
 
@@ -305,9 +346,10 @@ func TestHandleEventResubmit_OversizeBodySurvivesIntact(t *testing.T) {
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -343,7 +385,22 @@ func TestHandleEventResubmit_OversizeBodySurvivesIntact(t *testing.T) {
 		t, stored, fresh.Body,
 		"the stored body must be copied byte for byte",
 	)
-	assert.Len(t, listDeliveries(t, webhookDB, fresh.ID), 1)
+
+	tasks := notif.Tasks()
+	require.Len(t, tasks, 1)
+	assert.Nil(
+		t, tasks[0].Body,
+		"a body over the inline limit is fetched from the new "+
+			"event row rather than carried on the task",
+	)
+
+	// The engine's own read of the body, against the new event id:
+	// what it would send is what was stored.
+	var loaded database.Event
+
+	require.NoError(t, webhookDB.Select("body").
+		First(&loaded, "id = ?", tasks[0].EventID).Error)
+	assert.Equal(t, stored, loaded.Body)
 }
 
 // TestHandleEventResubmit_SkipsInactiveTarget proves a deactivated
@@ -357,9 +414,10 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -390,19 +448,21 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 		"an inactive target is skipped, not an error",
 	)
 
+	tasks := notif.Tasks()
+	require.Len(t, tasks, 1)
+	assert.Equal(t, active.ID, tasks[0].TargetID)
+
 	webhookDB, err := dbMgr.GetDB(wh.ID)
 	require.NoError(t, err)
 
 	fresh := theOtherEvent(t, listEvents(t, webhookDB), original.ID)
-	deliveries := listDeliveries(t, webhookDB, fresh.ID)
+	require.Len(t, listDeliveries(t, webhookDB, fresh.ID), 1)
-	require.Len(t, deliveries, 1)
-	assert.Equal(t, active.ID, deliveries[0].TargetID)
 }
 
 // TestHandleEventResubmit_NoActiveTargetsStillStoresEvent proves a
 // source with nothing to deliver to behaves as the receiver does: the
-// event is stored with no delivery, and the operator is told so rather
+// event is stored, nothing is queued, and the operator is told so
-// than being shown an error.
+// rather than being shown an error.
 func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 	t *testing.T,
 ) {
@@ -413,9 +473,10 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -432,14 +493,12 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 		w.Header().Get("Location"),
 	)
 
+	assert.Empty(t, notif.Tasks())
+
 	webhookDB, err := dbMgr.GetDB(wh.ID)
 	require.NoError(t, err)
 
-	events := listEvents(t, webhookDB)
+	assert.Len(t, listEvents(t, webhookDB), 2)
-	assert.Len(t, events, 2)
-
-	fresh := theOtherEvent(t, events, original.ID)
-	assert.Empty(t, listDeliveries(t, webhookDB, fresh.ID))
 }
 
 // TestHandleEventResubmit_RefusesEventOfAnotherWebhook proves the
@@ -455,9 +514,10 @@ func TestHandleEventResubmit_RefusesEventOfAnotherWebhook(
 		sess  *session.Session
 		db    *database.Database
 		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
+	app := newTestApp(t, &h, &sess, &db, &dbMgr, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -488,49 +548,10 @@ func TestHandleEventResubmit_RefusesEventOfAnotherWebhook(
 	w = postResubmit(t, h, sess, mine.ID, "not-a-uuid")
 	assert.Equal(t, http.StatusNotFound, w.Code)
 
-	for _, webhookID := range []string{theirs.ID, mine.ID} {
+	assert.Empty(
-		webhookDB, err := dbMgr.GetDB(webhookID)
+		t, notif.Tasks(),
-		require.NoError(t, err)
+		"a refused resubmit must queue nothing",
-
-		assert.Len(
-			t, listEvents(t, webhookDB), 1,
-			"a refused resubmit must store nothing",
-		)
-	}
-}
-
-// TestHandleEventResubmit_FailedStoreIsAnError proves a copy the engine
-// cannot store answers with the 500 error page and leaves no new event.
-func TestHandleEventResubmit_FailedStoreIsAnError(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h     *handlers.Handlers
-		sess  *session.Session
-		db    *database.Database
-		dbMgr *database.WebhookDBManager
 	)
-
-	app := newTestApp(t, &h, &sess, &db, &dbMgr)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	wh := seedWebhook(t, db)
-	original := seedStoredEvent(t, dbMgr, wh.ID, `{"not":"stored"}`)
-
-	// Without its event totals table the webhook's database refuses
-	// the totals write, which comes after the event row.
-	webhookDB, err := dbMgr.GetDB(wh.ID)
-	require.NoError(t, err)
-	require.NoError(t,
-		webhookDB.Migrator().DropTable(&database.EventTotals{}))
-
-	w := postResubmit(t, h, sess, wh.ID, original.ID)
-
-	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, w.Body.String(), "500 Internal Server Error")
-	assert.Len(t, listEvents(t, webhookDB), 1)
 }
 
 // TestHandleSourceLogs_ShowsResubmitProvenance proves the event log

internal/handlers/export_test.go

@@ -96,12 +96,6 @@ func (s *Handlers) WebhookStatsForTest(webhookID string) *WebhookStats {
 	return s.loadWebhookStats(webhookID, entrypoints, targets)
 }
 
-// RelativeTimeForTest exposes relativeTime for use in the
-// handlers_test package.
-func RelativeTimeForTest(at, now time.Time) string {
-	return relativeTime(at, now)
-}
-
 // FinishedByTargetForTest exposes finishedByTarget for use in the
 // handlers_test package.
 func FinishedByTargetForTest(

internal/handlers/handlers.go

@@ -64,7 +64,7 @@ type HandlersParams struct {
 	Healthcheck     *healthcheck.Healthcheck
 	Session         *session.Session
 	Middleware      *middleware.Middleware
-	Engine          *delivery.Engine
+	Notifier        delivery.Notifier
 	Archives        archive.Archives
 	CircuitBreakers delivery.CircuitBreakers
 	SSRFGuard       *delivery.Guard
@@ -82,7 +82,7 @@ type Handlers struct {
 	dbMgr     *database.WebhookDBManager
 	session   *session.Session
 	mw        *middleware.Middleware
-	engine    *delivery.Engine
+	notifier  delivery.Notifier
 	archives  archive.Archives
 	breakers  delivery.CircuitBreakers
 	mtr       *metrics.Set
@@ -138,7 +138,7 @@ func New(
 	s.dbMgr = params.WebhookDBMgr
 	s.session = params.Session
 	s.mw = params.Middleware
-	s.engine = params.Engine
+	s.notifier = params.Notifier
 	s.archives = params.Archives
 	s.breakers = params.CircuitBreakers
 	s.mtr = params.Metrics

internal/handlers/handlers_test.go

@@ -30,6 +30,33 @@ import (
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
+// recordingNotifier is a delivery.Notifier that records the tasks it
+// was handed, so a test can prove a handler queued the delivery it
+// claims to have queued — and, on the refusal paths, that it queued
+// nothing.
+type recordingNotifier struct {
+	mu    sync.Mutex
+	tasks []delivery.Task
+}
+
+func (n *recordingNotifier) Notify(tasks []delivery.Task) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+
+	n.tasks = append(n.tasks, tasks...)
+}
+
+// Tasks returns a copy of the recorded tasks.
+func (n *recordingNotifier) Tasks() []delivery.Task {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+
+	out := make([]delivery.Task, len(n.tasks))
+	copy(out, n.tasks)
+
+	return out
+}
+
 // recordingArchives is an archive.Archives that records what it
 // was asked to do, so a test can prove that a deletion or rename
 // path reached the archive writers. After FailRenames, every
@@ -237,12 +264,11 @@ func newTestAppWithConfig(
 			database.NewWebhookDBManager,
 			healthcheck.New,
 			session.New,
-			archive.NewWriters,
+			func() *recordingNotifier {
-			// The engine is built on a lifecycle that is never started,
+				return &recordingNotifier{}
-			// so no worker runs: every delivery the engine creates for a
+			},
-			// handler stays pending, where the test can read it.
+			func(n *recordingNotifier) delivery.Notifier {
-			func(p delivery.EngineParams) *delivery.Engine {
+				return n
-				return delivery.New(fxtest.NewLifecycle(t), p)
 			},
 			func() *recordingArchives {
 				return &recordingArchives{}

internal/handlers/webhook.go

@@ -2,11 +2,14 @@ package handlers
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 
 	"github.com/go-chi/chi"
+	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
 	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
@@ -67,9 +70,8 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	}
 }
 
-// processWebhookRequest reads the request into an event and has the
+// processWebhookRequest reads the body, serializes headers, loads
-// delivery engine store it, with a delivery for each of the webhook's
+// targets, and delivers the event.
-// active targets, and answers the sender.
 //
 // Nothing about the request itself is authenticated: the entrypoint
 // UUID in the path is the credential, and reaching here means it
@@ -91,24 +93,30 @@ func (h *Handlers) processWebhookRequest(
 		return
 	}
 
-	event := &database.Event{
+	targets, err := h.loadActiveTargets(entrypoint.WebhookID)
-		WebhookID:    entrypoint.WebhookID,
-		EntrypointID: entrypoint.ID,
-		Method:       r.Method,
-		RawQuery:     r.URL.RawQuery,
-		Headers:      string(headersJSON),
-		ContentType:  r.Header.Get("Content-Type"),
-		Body:         string(body),
-	}
-
-	deliveries, err := h.engine.StoreEvent(event)
 	if err != nil {
-		h.receiverError(w, "failed to store webhook event", err)
+		h.receiverError(w, "failed to query targets", err)
 
 		return
 	}
 
-	h.finishWebhookResponse(w, event, entrypoint, deliveries)
+	h.createAndDeliverEvent(
+		w, r, entrypoint, body, headersJSON, targets,
+	)
+}
+
+// loadActiveTargets returns all active targets for a webhook.
+func (h *Handlers) loadActiveTargets(
+	webhookID string,
+) ([]database.Target, error) {
+	var targets []database.Target
+
+	err := h.db.DB().Where(
+		"webhook_id = ? AND active = ?",
+		webhookID, true,
+	).Find(&targets).Error
+
+	return targets, err
 }
 
 // lookupEntrypoint finds an entrypoint by UUID path.
@@ -169,6 +177,28 @@ func (h *Handlers) readWebhookBody(
 	return body, true
 }
 
+// createAndDeliverEvent stores the received event, fans it out to the
+// webhook's targets, and answers the sender.
+func (h *Handlers) createAndDeliverEvent(
+	w http.ResponseWriter,
+	r *http.Request,
+	entrypoint database.Entrypoint,
+	body, headersJSON []byte,
+	targets []database.Target,
+) {
+	event, tasks, err := h.createAndFanOut(
+		requestEventSource(r, entrypoint, headersJSON, body),
+		targets,
+	)
+	if err != nil {
+		h.receiverError(w, "failed to store webhook event", err)
+
+		return
+	}
+
+	h.finishWebhookResponse(w, event, entrypoint, tasks)
+}
+
 // receiverError logs an error and answers the sender with a plain-text
 // 500. The receiver's answers are for programs, so it never sends the
 // error page the web UI uses.
@@ -182,19 +212,172 @@ func (h *Handlers) receiverError(
 	)
 }
 
-// finishWebhookResponse logs the stored event, with how many
+// eventSource carries the fields a new event is built from. The
-// deliveries it has, and writes the HTTP response.
+// receiver fills it from the live request; the resubmit handler fills
+// it from a stored event. Both then go through createAndFanOut, so an
+// event is constructed and fanned out in one place however it entered
+// the system.
+type eventSource struct {
+	WebhookID    string
+	EntrypointID string
+	Method       string
+	RawQuery     string
+	HeadersJSON  string
+	ContentType  string
+	Body         []byte
+
+	// ResubmittedFromID names the event this one copies. Only the
+	// resubmit path sets it.
+	ResubmittedFromID *string
+}
+
+// event builds the row this source stores.
+func (s eventSource) event() *database.Event {
+	return &database.Event{
+		WebhookID:         s.WebhookID,
+		EntrypointID:      s.EntrypointID,
+		Method:            s.Method,
+		RawQuery:          s.RawQuery,
+		Headers:           s.HeadersJSON,
+		Body:              string(s.Body),
+		BodyBytes:         int64(len(s.Body)),
+		ContentType:       s.ContentType,
+		ResubmittedFromID: s.ResubmittedFromID,
+	}
+}
+
+// requestEventSource describes the event a live receiver request
+// stores.
+func requestEventSource(
+	r *http.Request,
+	entrypoint database.Entrypoint,
+	headersJSON, body []byte,
+) eventSource {
+	return eventSource{
+		WebhookID:    entrypoint.WebhookID,
+		EntrypointID: entrypoint.ID,
+		Method:       r.Method,
+		RawQuery:     r.URL.RawQuery,
+		HeadersJSON:  string(headersJSON),
+		ContentType:  r.Header.Get("Content-Type"),
+		Body:         body,
+	}
+}
+
+// createAndFanOut writes the event and one pending delivery per target,
+// and adds them to the webhook's running totals, in a single
+// transaction, then hands the tasks to the delivery engine. Every
+// event is created here, received or resubmitted, so a resubmitted
+// event is retried, SSRF-guarded and circuit-broken exactly as a
+// received one is. Per-delivery replay is the one other path that
+// creates a delivery: it adds one to an existing event without
+// coming through here.
+//
+// The tasks are returned as well as queued, so a caller can report how
+// many targets the event went to.
+func (h *Handlers) createAndFanOut(
+	src eventSource,
+	targets []database.Target,
+) (*database.Event, []delivery.Task, error) {
+	webhookDB, err := h.dbMgr.GetDB(src.WebhookID)
+	if err != nil {
+		return nil, nil, fmt.Errorf(
+			"getting webhook database: %w", err,
+		)
+	}
+
+	tx := webhookDB.Begin()
+	if tx.Error != nil {
+		return nil, nil, fmt.Errorf(
+			"beginning transaction: %w", tx.Error,
+		)
+	}
+
+	event := src.event()
+
+	err = tx.Create(event).Error
+	if err != nil {
+		tx.Rollback()
+
+		return nil, nil, fmt.Errorf("creating event: %w", err)
+	}
+
+	tasks, err := buildDeliveryTasks(
+		tx, event, targets, inlineBody(src.Body),
+	)
+	if err != nil {
+		tx.Rollback()
+
+		return nil, nil, err
+	}
+
+	err = database.AddEventTotals(tx, database.EventTotals{
+		Events: 1, LastEventAt: &event.CreatedAt,
+	})
+	if err != nil {
+		tx.Rollback()
+
+		return nil, nil, err
+	}
+
+	// A resubmitted copy did not arrive on its entrypoint's URL, so it
+	// leaves the entrypoint's last event as it is.
+	if src.ResubmittedFromID == nil {
+		err = database.AddEntrypointTotals(tx, database.EntrypointTotals{
+			EntrypointID: event.EntrypointID, LastEventAt: event.CreatedAt,
+		})
+		if err != nil {
+			tx.Rollback()
+
+			return nil, nil, err
+		}
+	}
+
+	err = tx.Commit().Error
+	if err != nil {
+		return nil, nil, fmt.Errorf(
+			"committing transaction: %w", err,
+		)
+	}
+
+	// Counted here, after the commit: an event exists once it is
+	// durably stored, which is what the delivery counters are
+	// compared against on a dashboard. A resubmitted event counts
+	// too, because it produces deliveries that the delivery side
+	// counts; the resubmit counter is what separates the two.
+	h.mtr.EventReceived()
+
+	if len(tasks) > 0 {
+		h.notifier.Notify(tasks)
+	}
+
+	return event, tasks, nil
+}
+
+// inlineBody returns a pointer to body as a string if it fits
+// within the inline size limit, or nil otherwise.
+func inlineBody(body []byte) *string {
+	if len(body) < delivery.MaxInlineBodySize {
+		s := string(body)
+
+		return &s
+	}
+
+	return nil
+}
+
+// finishWebhookResponse logs the event and writes the HTTP response.
 func (h *Handlers) finishWebhookResponse(
 	w http.ResponseWriter,
 	event *database.Event,
 	entrypoint database.Entrypoint,
-	deliveries int,
+	tasks []delivery.Task,
 ) {
 	h.log.Info("webhook event created",
 		"event_id", event.ID,
 		"webhook_id", entrypoint.WebhookID,
 		"entrypoint_id", entrypoint.ID,
-		"target_count", deliveries,
+		"target_count", len(tasks),
 	)
 
 	w.WriteHeader(http.StatusOK)
@@ -206,3 +389,64 @@ func (h *Handlers) finishWebhookResponse(
 		)
 	}
 }
+
+// buildDeliveryTasks creates one pending delivery per target in the
+// transaction, adds each to its target's totals, and returns the tasks
+// for the delivery engine. The caller owns the transaction and rolls
+// it back on error.
+func buildDeliveryTasks(
+	tx *gorm.DB,
+	event *database.Event,
+	targets []database.Target,
+	bodyPtr *string,
+) ([]delivery.Task, error) {
+	tasks := make([]delivery.Task, 0, len(targets))
+
+	for i := range targets {
+		dlv := &database.Delivery{
+			EventID:  event.ID,
+			TargetID: targets[i].ID,
+			Status:   database.DeliveryStatusPending,
+		}
+
+		err := tx.Create(dlv).Error
+		if err != nil {
+			return nil, fmt.Errorf(
+				"creating delivery for target %s: %w",
+				targets[i].ID, err,
+			)
+		}
+
+		err = database.AddTargetTotals(tx, database.TargetTotals{
+			TargetID: targets[i].ID, Deliveries: 1,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		tasks = append(tasks, delivery.Task{
+			DeliveryID:      dlv.ID,
+			EventID:         event.ID,
+			WebhookID:       event.WebhookID,
+			EntrypointID:    event.EntrypointID,
+			TargetID:        targets[i].ID,
+			TargetName:      targets[i].Name,
+			TargetType:      targets[i].Type,
+			TargetURL:       targets[i].URL,
+			TargetHeaders:   targets[i].Headers,
+			TimeoutSeconds:  targets[i].TimeoutSeconds,
+			ForwardQuery:    targets[i].ForwardQuery,
+			ArchiveExpiry:   targets[i].ArchiveExpiry,
+			ArchiveRotation: targets[i].ArchiveRotation,
+			MaxAttempts:     targets[i].MaxAttempts,
+			Method:          event.Method,
+			RawQuery:        event.RawQuery,
+			Headers:         event.Headers,
+			ContentType:     event.ContentType,
+			Body:            bodyPtr,
+			AttemptNum:      1,
+		})
+	}
+
+	return tasks, nil
+}

internal/handlers/webhook_stats.go

@@ -15,9 +15,6 @@ const (
 	longWindow  = 24 * time.Hour
 )
 
-// day is the largest unit relativeTime writes.
-const day = 24 * time.Hour
-
 // percent turns a fraction into a percentage.
 const percent = 100
 
@@ -38,12 +35,8 @@ type WebhookStats struct {
 	InProgress int64
 
 	// LastEventAt is when the newest event arrived, or nil when none
-	// has. Retention does not change it. LastEvent is how long ago
+	// has. Retention does not change it.
-	// that was, as relativeTime writes it, and LastEventUTC the full
+	LastEventAt *time.Time
-	// time; both are empty when no event has arrived.
-	LastEventAt  *time.Time
-	LastEvent    string
-	LastEventUTC string
 
 	Last10Minutes RecentWindow
 	Last24Hours   RecentWindow
@@ -88,42 +81,6 @@ func (w RecentWindow) FailurePercent() string {
 	)
 }
 
-// relativeTime is how long before now the time at was, in whole
-// seconds, written as its two largest units out of d, h, m and s:
-// "59s", "1m1s", "23h59m", "3d4h". A second unit of zero is left off,
-// as in "5m". A time after now is "0s".
-func relativeTime(at, now time.Time) string {
-	elapsed := max(now.Sub(at), 0)
-
-	days := int64(elapsed / day)
-	hours := int64(elapsed % day / time.Hour)
-	minutes := int64(elapsed % time.Hour / time.Minute)
-	seconds := int64(elapsed % time.Minute / time.Second)
-
-	switch {
-	case days > 0:
-		return twoUnits(days, "d", hours, "h")
-	case hours > 0:
-		return twoUnits(hours, "h", minutes, "m")
-	case minutes > 0:
-		return twoUnits(minutes, "m", seconds, "s")
-	default:
-		return fmt.Sprintf("%ds", seconds)
-	}
-}
-
-// twoUnits writes a count of a larger unit followed by a count of the
-// next smaller one, leaving the smaller off when it is zero.
-func twoUnits(
-	larger int64, largerUnit string, smaller int64, smallerUnit string,
-) string {
-	if smaller == 0 {
-		return fmt.Sprintf("%d%s", larger, largerUnit)
-	}
-
-	return fmt.Sprintf("%d%s%d%s", larger, largerUnit, smaller, smallerUnit)
-}
-
 // loadWebhookStats gathers the figures for the statistics pane from the
 // webhook's entrypoints and targets, as the page has already loaded
 // them, and from its event database. It returns nil, and logs why, when
@@ -182,7 +139,7 @@ func (h *Handlers) loadWebhookStats(
 func readEventStats(
 	db *gorm.DB, now time.Time, stats *WebhookStats,
 ) error {
-	err := readTotals(db, now, stats)
+	err := readTotals(db, stats)
 	if err != nil {
 		return err
 	}
@@ -212,9 +169,9 @@ func readEventStats(
 }
 
 // readTotals fills in the lifetime and within-retention figures, and
-// when the last event arrived and how long before now that was, from
+// when the last event arrived, from the running totals: the events'
-// the running totals: the events' row, and the targets' rows summed.
+// row, and the targets' rows summed.
-func readTotals(db *gorm.DB, now time.Time, stats *WebhookStats) error {
+func readTotals(db *gorm.DB, stats *WebhookStats) error {
 	var events database.EventTotals
 
 	err := db.Take(&events).Error
@@ -233,12 +190,6 @@ func readTotals(db *gorm.DB, now time.Time, stats *WebhookStats) error {
 	stats.WithinRetention.Events = events.Events - events.EventsRemoved
 	stats.LastEventAt = events.LastEventAt
 
-	if events.LastEventAt != nil {
-		stats.LastEvent = relativeTime(*events.LastEventAt, now)
-		stats.LastEventUTC =
-			events.LastEventAt.UTC().Format(time.DateTime) + " UTC"
-	}
-
 	for _, t := range targets {
 		stats.Lifetime.Deliveries += t.Deliveries
 		stats.Lifetime.Failures += t.Failed

internal/handlers/webhook_stats_test.go

@@ -265,13 +265,6 @@ func statsPane(t *testing.T, page string) string {
 	return strings.Join(strings.Fields(pane), " ")
 }
 
-// statsLastEventShown matches the pane's last event for an event that
-// arrived at at: a figure with the full time in UTC as its tooltip.
-func statsLastEventShown(at time.Time) string {
-	return `Last event</span>\s*<span [^>]*title="` +
-		at.UTC().Format(time.DateTime) + ` UTC">[^<]+</span>`
-}
-
 // assertStatsTargets checks, for the history seedStatsHistory builds,
 // each target's totals and its deliveries finished in the last 24
 // hours. The first target has ten deliveries and the replay, the
@@ -307,17 +300,14 @@ func assertStatsPaneAfterPrune(
 ) {
 	t.Helper()
 
-	page := renderSourceDetailPage(t, h, sess, hist.webhook.ID)
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, hist.webhook.ID))
-	pane := statsPane(t, page)
+	lastEvent := hist.newest.CreatedAt.UTC().Format("2006-01-02 15:04:05 UTC")
 
-	// The newest event arrived moments ago, so the last event is a
+	assert.Contains(t, pane, "Entrypoints 12 (11 active) "+
-	// few seconds ago.
+		"Targets 6 (2 active) "+
-	assert.Regexp(t, `Entrypoints 12 \(11 active\) `+
+		"Deliveries in progress 13 "+
-		`Targets 6 \(2 active\) `+
+		"Last event "+lastEvent+" "+
-		`Deliveries in progress 13 `+
+		"Retention 14 days")
-		`Last event \d+s `+
-		`Retention 14 days`, pane)
-	assert.Regexp(t, statsLastEventShown(hist.newest.CreatedAt), page)
 	assert.Contains(t, pane, "Lifetime Within retention "+
 		"Events 10 9 "+
 		"Deliveries 21 18 "+
@@ -450,14 +440,15 @@ func TestWebhookStats_LastEventSurvivesPruningEveryEvent(t *testing.T) {
 	require.NotNil(t, stats.LastEventAt)
 	assert.True(t, arrived.Equal(*stats.LastEventAt))
 
-	assert.Regexp(t, statsLastEventShown(arrived),
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
-		renderSourceDetailPage(t, h, sess, wh.ID))
+	assert.Contains(t, pane,
+		"Last event "+arrived.UTC().Format("2006-01-02 15:04:05 UTC"))
 }
 
-// TestWebhookStats_LastEventInUTC checks that the tooltip of the pane's
+// TestWebhookStats_LastEventInUTC checks that the pane shows when the
-// last event gives the time in UTC, as the event list does, when the
+// last event arrived in UTC, as the event list does, when the time was
-// time was stored in another zone, as it is on a host whose local time
+// stored in another zone, as it is on a host whose local time is not
-// is not UTC.
+// UTC.
 func TestWebhookStats_LastEventInUTC(t *testing.T) {
 	t.Parallel()
 
@@ -483,9 +474,8 @@ func TestWebhookStats_LastEventInUTC(t *testing.T) {
 	require.NoError(t, database.AddEventTotals(webhookDB,
 		database.EventTotals{Events: 1, LastEventAt: &arrived}))
 
-	assert.Regexp(t,
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
-		`Last event</span>\s*<span [^>]*title="2026-03-05 03:30:00 UTC">`,
+	assert.Contains(t, pane, "Last event 2026-03-05 03:30:00 UTC")
-		renderSourceDetailPage(t, h, sess, wh.ID))
 }
 
 // TestWebhookStats_PaneShowsRetentionPeriod checks that the statistics
@@ -551,11 +541,8 @@ func TestWebhookStats_WebhookWithNoEvents(t *testing.T) {
 	assert.Equal(t, &handlers.WebhookStats{}, h.WebhookStatsForTest(wh.ID))
 	assert.Equal(t, "—", handlers.RecentWindow{}.FailurePercent())
 
-	page := renderSourceDetailPage(t, h, sess, wh.ID)
+	pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
-	pane := statsPane(t, page)
 	assert.Contains(t, pane, "Last event none")
-	assert.Regexp(t, `Last event</span>\s*<span class="[^"]*">none</span>`,
-		page, "a last event of none has a tooltip")
 	assert.Contains(t, pane, "Failure percentage — —")
 	assert.False(t, dbMgr.DBExists(wh.ID))
 }
@@ -580,35 +567,3 @@ func TestRecentWindow_FailurePercent(t *testing.T) {
 		assert.Equal(t, tt.want, tt.window.FailurePercent(), tt.window)
 	}
 }
-
-// TestRelativeTime pins how the pane writes the time since the last
-// event, at each boundary between its units.
-func TestRelativeTime(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, time.October, 26, 12, 0, 0, 0, time.UTC)
-
-	tests := []struct {
-		ago  time.Duration
-		want string
-	}{
-		{0, "0s"},
-		{59900 * time.Millisecond, "59s"},
-		{60 * time.Second, "1m"},
-		{61 * time.Second, "1m1s"},
-		{3599 * time.Second, "59m59s"},
-		{3600 * time.Second, "1h"},
-		{3660 * time.Second, "1h1m"},
-		{86399 * time.Second, "23h59m"},
-		{86400 * time.Second, "1d"},
-		{90000 * time.Second, "1d1h"},
-		{400*24*time.Hour + 3*time.Hour, "400d3h"},
-		// An event time ahead of the server clock.
-		{-time.Hour, "0s"},
-	}
-
-	for _, tt := range tests {
-		assert.Equal(t, tt.want,
-			handlers.RelativeTimeForTest(now.Add(-tt.ago), now), tt.ago)
-	}
-}

internal/handlers/webhook_test.go

@@ -10,6 +10,7 @@ import (
 	"net/netip"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -18,6 +19,7 @@ import (
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
@@ -207,19 +209,50 @@ func receivedLine(t *testing.T, buf *bytes.Buffer) map[string]any {
 	return found[0]
 }
 
-// TestHandleWebhook_StoresTheEvent proves an accepted request is
+// targetWithEverySetting returns target settings with all six set, the
-// answered with the receiver's 200 and body, and that the event is
+// archive ones included, so a task that drops one of them differs from
-// stored with a pending delivery to the webhook's active target.
+// the target.
-func TestHandleWebhook_StoresTheEvent(t *testing.T) {
+func targetWithEverySetting() database.Target {
+	return database.Target{
+		URL:             replayTargetURL,
+		Headers:         map[string]string{"X-Api-Key": "k"},
+		TimeoutSeconds:  7,
+		ForwardQuery:    true,
+		ArchiveExpiry:   time.Hour,
+		ArchiveRotation: "daily",
+	}
+}
+
+// assertTaskCarriesTargetSettings proves a delivery task carries every
+// one of the target's settings. They are copied into the task one field
+// at a time, and a field left out is sent empty without any error.
+func assertTaskCarriesTargetSettings(
+	t *testing.T, task delivery.Task, target *database.Target,
+) {
+	t.Helper()
+
+	assert.Equal(t, target.ID, task.TargetID)
+	assert.Equal(t, target.URL, task.TargetURL)
+	assert.Equal(t, target.Headers, task.TargetHeaders)
+	assert.Equal(t, target.TimeoutSeconds, task.TimeoutSeconds)
+	assert.Equal(t, target.ForwardQuery, task.ForwardQuery)
+	assert.Equal(t, target.ArchiveExpiry, task.ArchiveExpiry)
+	assert.Equal(t, target.ArchiveRotation, task.ArchiveRotation)
+}
+
+// TestHandleWebhook_TaskCarriesEveryTargetSetting proves the task a
+// received event hands the delivery engine carries every one of the
+// target's settings.
+func TestHandleWebhook_TaskCarriesEveryTargetSetting(t *testing.T) {
 	t.Parallel()
 
 	var (
 		h     *handlers.Handlers
 		db    *database.Database
-		dbMgr *database.WebhookDBManager
+		notif *recordingNotifier
 	)
 
-	app := newTestApp(t, &h, &db, &dbMgr)
+	app := newTestApp(t, &h, &db, &notif)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -228,7 +261,7 @@ func TestHandleWebhook_StoresTheEvent(t *testing.T) {
 	entrypoint := seedEntrypoint(t, db, webhook.ID)
 	target := seedConfiguredTarget(
 		t, db, webhook.ID, database.TargetTypeHTTP,
-		database.Target{URL: replayTargetURL},
+		targetWithEverySetting(),
 	)
 
 	w := httptest.NewRecorder()
@@ -238,55 +271,8 @@ func TestHandleWebhook_StoresTheEvent(t *testing.T) {
 	))
 
 	require.Equal(t, http.StatusOK, w.Code)
-	assert.JSONEq(t, `{"status":"ok"}`, w.Body.String())
 
-	webhookDB, err := dbMgr.GetDB(webhook.ID)
+	tasks := notif.Tasks()
-	require.NoError(t, err)
+	require.Len(t, tasks, 1)
-
+	assertTaskCarriesTargetSettings(t, tasks[0], target)
-	events := listEvents(t, webhookDB)
-	require.Len(t, events, 1)
-	assert.Equal(t, entrypoint.ID, events[0].EntrypointID)
-
-	deliveries := listDeliveries(t, webhookDB, events[0].ID)
-	require.Len(t, deliveries, 1)
-	assert.Equal(t, target.ID, deliveries[0].TargetID)
-	assert.Equal(t, database.DeliveryStatusPending, deliveries[0].Status)
-}
-
-// TestHandleWebhook_FailedStoreAnswersPlainError proves that an event
-// the engine cannot store is answered with the receiver's plain-text
-// 500, and that nothing of it is left stored.
-func TestHandleWebhook_FailedStoreAnswersPlainError(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h     *handlers.Handlers
-		db    *database.Database
-		dbMgr *database.WebhookDBManager
-	)
-
-	app := newTestApp(t, &h, &db, &dbMgr)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	webhook := seedWebhook(t, db)
-	entrypoint := seedEntrypoint(t, db, webhook.ID)
-
-	// Without its event totals table the webhook's database refuses
-	// the totals write, which comes after the event row.
-	webhookDB, err := dbMgr.GetDB(webhook.ID)
-	require.NoError(t, err)
-	require.NoError(t,
-		webhookDB.Migrator().DropTable(&database.EventTotals{}))
-
-	w := httptest.NewRecorder()
-	h.HandleWebhook().ServeHTTP(w, postRequest(
-		"/h/"+entrypoint.Path, nil,
-		map[string]string{"uuid": entrypoint.Path},
-	))
-
-	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Equal(t, "Internal server error\n", w.Body.String())
-	assert.Empty(t, listEvents(t, webhookDB))
 }

internal/logfield/logfield_test.go

@@ -21,9 +21,8 @@ const budget = 64
 
 // batchRunes is how many consecutive code points the charge test logs
 // in one value from U+1000 up. Logging each of those on its own line
-// was too slow for the suite when it ran under the race detector;
+// is too slow for the suite under the race detector; 4,096 at a time
-// 4,096 at a time is 271 batches, each logged on two lines, so 542
+// is 271 batches, each logged on two lines, so 542 lines per handler.
-// lines per handler.
 const batchRunes = 4096
 
 // newHandlers are the two handlers internal/logger can install. Time
@@ -153,10 +152,10 @@ func TestEncodedBytes_ChargesAtLeastWhatTheHandlersEmit(t *testing.T) {
 		batches = append(batches, batch.String())
 	}
 
-	// What EncodedBytes charges for each batch. When the suite ran
+	// What EncodedBytes charges for each batch. Under -race -cover this
-	// under -race -cover this took longer than logging the batches, so
+	// takes longer than logging the batches, so it is worked out once,
-	// it is worked out once, by whichever handler finishes logging
+	// by whichever handler finishes logging first, while the other is
-	// first, while the other is still logging.
+	// still logging.
 	charged := sync.OnceValue(func() []int {
 		costs := make([]int, len(batches))
 

internal/resetpw/resetpw_test.go

@@ -131,6 +131,10 @@ func run(
 	return code, stdout.String(), stderr.String()
 }
 
+type noopNotifier struct{}
+
+func (n *noopNotifier) Notify([]delivery.Task) {}
+
 type noopArchives struct {
 	renameMu sync.Mutex
 }
@@ -186,12 +190,7 @@ func newServerApp(
 			database.NewWebhookDBManager,
 			healthcheck.New,
 			session.New,
-			archive.NewWriters,
+			func() delivery.Notifier { return &noopNotifier{} },
-			// The engine is built on a lifecycle that is never started,
-			// so no worker runs.
-			func(p delivery.EngineParams) *delivery.Engine {
-				return delivery.New(fxtest.NewLifecycle(t), p)
-			},
 			func() archive.Archives { return &noopArchives{} },
 			func() delivery.CircuitBreakers {
 				return &noopCircuitBreakers{}

internal/server/alpine_browser_test.go

@@ -61,8 +61,7 @@ const (
 // event log in a headless browser, served by the real router and so
 // under the real Content-Security-Policy, and checks that the pages'
 // Alpine.js directives, the copy control and the delete prompts work,
-// that a target's row shows its delivery counts, and that the
+// and that a target's row shows its delivery counts.
-// Statistics block shows how long ago the last event arrived.
 func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	t.Parallel()
 
@@ -98,7 +97,6 @@ func TestAlpineRunsUnderTheSecurityPolicy(t *testing.T) {
 	checkCopy(ctx, t, page)
 	checkEntrypointEdit(ctx, t, page, page+"/events")
 	checkRecentEvents(ctx, t, page)
-	checkStatsLastEvent(ctx, t, env, webhook.ID, page)
 	checkArchiveChoice(ctx, t, srv.URL+"/hooks/new", page)
 	checkNewWebhookTargets(ctx, t, env, srv.URL+"/hooks/new")
 	checkRefusedNewWebhook(ctx, t, srv.URL+"/hooks/new")
@@ -833,41 +831,6 @@ func checkRecentEvents(ctx context.Context, t *testing.T, url string) {
 		"the event's own page does not show its body")
 }
 
-// checkStatsLastEvent records that the last event of the webhook
-// webhookID arrived 3 days, 4 hours and 30 minutes ago, loads its page,
-// and checks that the Statistics block shows the last event as "3d4h"
-// with the full time in UTC as its tooltip.
-func checkStatsLastEvent(
-	ctx context.Context, t *testing.T, env *testEnv, webhookID, url string,
-) {
-	t.Helper()
-
-	webhookDB, err := env.dbMgr.GetDB(webhookID)
-	require.NoError(t, err)
-
-	ago := 3*24*time.Hour + 4*time.Hour + 30*time.Minute
-	arrived := time.Now().Add(-ago)
-	require.NoError(t, database.AddEventTotals(webhookDB,
-		database.EventTotals{LastEventAt: &arrived}))
-
-	figure := `//span[text()="Last event"]` +
-		`/following-sibling::span[text()="3d4h"]`
-
-	var (
-		title string
-		found bool
-	)
-
-	require.NoError(t, chromedp.Run(ctx, loadPage(url)))
-	require.True(t, shown(ctx, figure),
-		`the Statistics block does not show the last event as "3d4h"`)
-	require.NoError(t, chromedp.Run(ctx, chromedp.AttributeValue(
-		figure, "title", &title, &found, chromedp.BySearch,
-	)))
-	assert.Equal(t, arrived.UTC().Format(time.DateTime)+" UTC", title,
-		"the last event's tooltip is not the full time in UTC")
-}
-
 // checkEventLog loads the event log and checks that of its events only
 // the newest, eventID, starts expanded: its row says so and its caret is
 // turned up, and the log's last event, lastEventID, starts collapsed. In

internal/server/early_shutdown_test.go

@@ -10,12 +10,14 @@ import (
 	"sneak.berlin/go/webhooker/internal/server"
 )
 
-// earlyStopIterations is how many start/stop cycles the test below
+// earlyStopIterations is how many start/stop cycles the race test
 // runs. The window it aims at is the gap between the OnStart hook
 // returning and the serving goroutine reaching its first field
-// access, which is microseconds wide, so a single cycle can miss it
+// access, which is microseconds wide. The race detector reports an
-// purely on scheduling. Repetition makes hitting it reliable; the
+// unsynchronised pair whenever it observes one, but it has to observe
-// collaborators are built once, so the cycles themselves are cheap.
+// one, so a single cycle can miss purely on scheduling. Repetition
+// makes the observation reliable; the collaborators are built once,
+// so the cycles themselves are cheap.
 const earlyStopIterations = 25
 
 // TestEarlyShutdown_NoPanicAndNoRace stops the application
@@ -36,9 +38,8 @@ const earlyStopIterations = 25
 //
 // httpServer is now built in New, on the constructing goroutine, so
 // it is written before any hook exists and can never be nil.
-// sentryEnabled is atomic. This test catches the nil dereference
+// sentryEnabled is atomic. This test is what catches either one
-// coming back, as a panic. The suite runs without Go's race
+// coming back — under -race, which is how the suite runs.
-// detector, so the data race coming back would go unreported here.
 func TestEarlyShutdown_NoPanicAndNoRace(t *testing.T) {
 	t.Parallel()
 

internal/server/routes_test.go

@@ -48,6 +48,10 @@ const (
 	metricsAuthValue = "s3cret"
 )
 
+type noopNotifier struct{}
+
+func (n *noopNotifier) Notify([]delivery.Task) {}
+
 // noopArchives satisfies handlers.New's archive.Archives
 // dependency. No test here checks what gets evicted or renamed, so
 // it records nothing. Its rename lock is a plain mutex.
@@ -141,12 +145,7 @@ func newTestEnvWithConfig(
 			database.NewWebhookDBManager,
 			healthcheck.New,
 			session.New,
-			archive.NewWriters,
+			func() delivery.Notifier { return &noopNotifier{} },
-			// The engine is built on a lifecycle that is never started,
-			// so no worker runs and nothing is sent anywhere.
-			func(p delivery.EngineParams) *delivery.Engine {
-				return delivery.New(fxtest.NewLifecycle(t), p)
-			},
 			func() archive.Archives { return &noopArchives{} },
 			func() delivery.CircuitBreakers {
 				return &noopCircuitBreakers{}

internal/server/static_assets_test.go

@@ -13,6 +13,9 @@ import (
 
 // TestBaseTemplateScriptsAreServed walks every /s/ script the base
 // template loads on each page and fetches it through the real router.
+// Alpine.js is extracted from its tarball in 3p/ at build time, so the
+// file is not in the tree: this is the check that the page still gets
+// the JavaScript it asks for.
 func TestBaseTemplateScriptsAreServed(t *testing.T) {
 	t.Parallel()
 

script/assets

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/assets: extract Alpine.js from its npm package tarball, committed
+# in 3p/, to static/js/alpine.min.js, where go:embed reads it. The package
+# is @alpinejs/csp, Alpine's build for pages whose Content-Security-Policy
+# forbids eval. The extracted file is not committed. make build, make dev
+# and the Dockerfile's lint, test and build stages run this first.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    tar -xzOf 3p/alpinejs-csp-3.14.9.tgz package/dist/cdn.min.js \
+        >static/js/alpine.min.js
+}
+
+main "$@"

static/static.go

@@ -6,11 +6,9 @@ import (
 )
 
 // Static holds the CSS and JavaScript files the web UI's pages load. They
-// are named one by one, so a missing file fails the build instead of
+// are named one by one so that a missing js/alpine.min.js, which make
-// leaving the pages without it.
+// assets extracts and git does not track, fails the build instead of
-//
+// leaving the pages without Alpine.js.
-// js/alpine.min.js is Alpine.js, committed unchanged. It is
-// package/dist/cdn.min.js from the npm package @alpinejs/csp 3.14.9.
 //
 //go:embed css/tailwind.css css/style.css js/app.js js/alpine.min.js
 var Static embed.FS

templates/webhook_stats.html

@@ -22,11 +22,7 @@
         </div>
         <div>
             <span class="text-gray-500">Last event</span>
-            {{if .LastEvent}}
+            <span class="font-medium text-gray-900">{{with .LastEventAt}}{{.UTC.Format "2006-01-02 15:04:05 UTC"}}{{else}}none{{end}}</span>
-            <span class="font-medium text-gray-900" title="{{.LastEventUTC}}">{{.LastEvent}}</span>
-            {{else}}
-            <span class="font-medium text-gray-900">none</span>
-            {{end}}
         </div>
         <div>
             <span class="text-gray-500">Retention</span>