Evict archive writers on deletion and sweep idle archives (closes #89)

The per-webhook archiveWriter registry in the database delivery target
was never evicted, so a deleted webhook's writer -- and any archive
file handle open within its debounce window -- lingered for the process
lifetime. Separately, expiry pruning ran only when an archive was
(re)opened, and reopens only happen on writes, so an archive belonging
to a webhook that stopped receiving events kept its expired rows
forever.

Eviction: a new one-method delivery.WebhookEvictor interface (kept
separate from Notifier: archiving lifecycle is not notification) is
implemented by the Engine and injected into the handlers. Deleting a
webhook, or deleting its last database target, drops the writer from
the registry and closes its handle under the writer's own mutex, so
eviction can never race an in-flight write. An evicted writer refuses
further writes rather than reopening a file nothing holds. The archive
file is deliberately left on disk: it is long-term storage an operator
may want to keep or move away, and destroying it as a side effect of
deleting a webhook would be unrecoverable.

Idle sweep: a new ArchiveSweeper, modelled on the event RetentionReaper
(fx lifecycle hooks, cancellable context, WaitGroup, ticker loop),
prunes archives whose database target declares a positive expiry. It
reuses the existing RETENTION_SWEEP_INTERVAL rather than adding a
config key. It never creates an archive -- a missing file is skipped,
and the reopen uses SQLite mode=rw so the file cannot be conjured even
if it disappears mid-sweep -- routes the prune through the per-webhook
writer so its mutex orders the sweep against concurrent writes, and
leaves the archive closed so the move-the-file-away workflow keeps
working. A failure for one webhook is logged and the sweep continues.
Archives with no expiry or the expiry "never" are untouched.

.golangci.yml

@@ -1,5 +1,9 @@
 version: "2"
 
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -14,19 +18,17 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-
+  settings:
-linters-settings:
+    lll:
-  lll:
+      line-length: 88
-    line-length: 88
+    funlen:
-  funlen:
+      lines: 80
-    lines: 80
+      statements: 50
-    statements: 50
+    cyclop:
-  cyclop:
+      max-complexity: 15
-    max-complexity: 15
+    dupl:
-  dupl:
+      threshold: 100
-    threshold: 100
 
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,8 +1,8 @@
 # Lint stage
-# golangci/golangci-lint:v2.11.3 (Debian-based), 2026-03-17
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
 # Using Debian-based image because mattn/go-sqlite3 (CGO) does not
 # compile on Alpine musl (off64_t is a glibc type).
-FROM golangci/golangci-lint:v2.11.3@sha256:e838e8ab68aaefe83e2408691510867ade9329c0e0b895a3fb35eb93d1c2a4ba AS lint
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 
 RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -363,10 +363,12 @@ events should be forwarded.
   greater than 0, failed deliveries are retried with exponential backoff
   up to `max_retries` attempts, protected by a per-target circuit
   breaker.
-- **`database`** — Confirm the event is stored in the webhook's
+- **`database`** — Archive the full event as a row into a separate
-  per-webhook database (no external delivery). Since events are always
+  per-webhook archive database (`archive-{webhookID}.db`) for long-term
-  written to the per-webhook DB on ingestion, this target marks delivery
+  retention, with an optional creation-validated expiry (default: keep
-  as immediately successful. Useful for ensuring durable event archival.
+  forever). No external delivery and no retries; an archive write
+  failure fails the delivery. See the database target section under
+  "Per-Webhook Event Databases" for the full semantics.
 - **`log`** — Write the event to the application log (stdout). Useful
   for debugging.
 
@@ -512,11 +514,46 @@ This separation provides:
   page cache, and its own lock, so concurrent event ingestion across
   webhooks won't contend.
 
-The **database target type** leverages this architecture: since events
+The **database target type** builds on this architecture to provide
-are already stored in the per-webhook database by design, the database
+long-term archiving, separate from the per-webhook event database (which
-target simply marks the delivery as immediately successful. The
+may prune events under its own retention). Delivering to a database
-per-webhook DB IS the dedicated event database — that's the whole point
+target writes the full event — body, headers, method, content type, and
-of the database target type.
+webhook/entrypoint/event identifiers — as a row into a dedicated archive
+database, `archive-{webhookID}.db`, stored under the data directory
+beside the event database. After each write the archive handle is closed
+and reopened, debounced to at most once per second, so an operator can
+move the archive file away for offline archiving without stopping the
+service; a moved or removed archive file is recreated automatically on
+the next write. An optional `expiry` in the target's config JSON (e.g.
+`{"expiry":"720h"}`) is validated when the target is created — the
+default (unset or the literal `never`) keeps rows forever — and rows
+older than the expiry are pruned each time the archive is (re)opened. An
+archive write failure is never silent success: the delivery records a
+failed attempt with the error and is marked failed.
+
+Because reopens only happen on writes, an archive belonging to a webhook
+that has stopped receiving events would never be pruned. A background
+**archive sweeper** closes that gap: on the same interval as the event
+retention reaper (`RETENTION_SWEEP_INTERVAL`) it prunes every archive
+whose database target declares a positive expiry, whether or not the
+webhook is still receiving traffic. The sweep never creates an archive —
+a webhook whose archive file does not yet exist is skipped, not
+initialised — it takes the same per-webhook lock the write path uses, so
+it can never interleave with a write, and it leaves the archive closed
+afterwards so the move-the-file-away workflow keeps working. Archives
+with no expiry, or the expiry `never`, are not touched by the sweep at
+all.
+
+Deleting a webhook releases its archive: the delivery engine's cached
+archive writer is dropped and its file handle closed, so nothing lingers
+after the webhook is gone. The archive **file itself is deliberately
+left on disk**. Unlike the event database — per-webhook working storage
+that is hard-deleted with the webhook — an archive is long-term storage
+an operator may still want to keep or move away for offline retention,
+and destroying it as a side effect of deleting a webhook would be
+unrecoverable. Removing `archive-{webhookID}.db` is the operator's call.
+Deleting a webhook's last `database` target releases the writer the same
+way, and for the same reason leaves the file alone.
 
 The **Slack target type** sends webhook events as formatted messages to
 any Slack-compatible incoming webhook URL (works with Slack, Mattermost,

TODO.md

@@ -28,6 +28,16 @@ databases currently grow without bound.
 
 # Completed Steps
 
+- 2026-08-09 Archive writer lifecycle (#89): deleting a webhook (or its
+  last `database` target) evicts the cached archive writer and closes
+  its handle while deliberately leaving `archive-{webhookID}.db` on
+  disk, and a new `ArchiveSweeper` prunes idle archives on the existing
+  `RETENTION_SWEEP_INTERVAL` without ever creating an archive file
+- 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
+  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
+  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
+  `lll`/`funlen`/`cyclop`/`dupl` thresholds actually apply), and fix
+  all newly surfaced lint findings
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)

cmd/webhooker/main.go

@@ -40,9 +40,15 @@ func main() {
 			handlers.New,
 			middleware.New,
 			delivery.New,
+			delivery.NewArchiveSweeper,
 			// Wire *delivery.Engine as delivery.Notifier so the
 			// webhook handler can notify the engine of new deliveries.
 			func(e *delivery.Engine) delivery.Notifier { return e },
+			// Wire *delivery.Engine as delivery.WebhookEvictor so
+			// deleting a webhook releases its archive writer.
+			func(e *delivery.Engine) delivery.WebhookEvictor {
+				return e
+			},
 			server.New,
 		),
 		fx.Invoke(
@@ -50,6 +56,7 @@ func main() {
 				*server.Server,
 				*delivery.Engine,
 				*database.RetentionReaper,
+				*delivery.ArchiveSweeper,
 			) {
 			},
 		),

internal/database/database_test.go

@@ -11,6 +11,15 @@ import (
 	"sneak.berlin/go/webhooker/internal/logger"
 )
 
+const (
+	// testAppname is the Globals.Appname used in tests.
+	testAppname = "webhooker-test"
+	// testVersion is the Globals.Version used in tests.
+	testVersion = "test"
+	// testContentType is the event content type used in tests.
+	testContentType = "application/json"
+)
+
 func setupTestDB(
 	t *testing.T,
 ) (*database.Database, *fxtest.Lifecycle) {
@@ -19,8 +28,8 @@ func setupTestDB(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: "webhooker-test",
+		Appname: testAppname,
-		Version: "test",
+		Version: testVersion,
 	}
 
 	l, err := logger.New(

internal/database/model_entrypoint.go

@@ -4,10 +4,13 @@ package database
 type Entrypoint struct {
 	BaseModel
 
-	WebhookID   string `gorm:"type:uuid;not null"   json:"webhookId"`
+	WebhookID string `gorm:"type:uuid;not null" json:"webhookId"`
-	Path        string `gorm:"uniqueIndex;not null" json:"path"` // URL path for this entrypoint
+
+	// Path is the URL path for this entrypoint.
+	Path string `gorm:"uniqueIndex;not null" json:"path"`
+
 	Description string `json:"description"`
-	Active      bool   `gorm:"default:true"         json:"active"`
+	Active      bool   `gorm:"default:true" json:"active"`
 
 	// Relations
 	Webhook Webhook `json:"webhook,omitzero"`

internal/database/model_target.go

@@ -23,7 +23,8 @@ type Target struct {
 	// Configuration fields (JSON stored based on type)
 	Config string `gorm:"type:text" json:"config"` // JSON configuration
 
-	// For HTTP targets (max_retries=0 means fire-and-forget, >0 enables retries with backoff)
+	// For HTTP targets (max_retries=0 means fire-and-forget,
+	// >0 enables retries with backoff)
 	MaxRetries   int `json:"maxRetries,omitempty"`
 	MaxQueueSize int `json:"maxQueueSize,omitempty"`
 

internal/database/model_webhook.go

@@ -4,10 +4,12 @@ package database
 type Webhook struct {
 	BaseModel
 
-	UserID        string `gorm:"type:uuid;not null" json:"userId"`
+	UserID      string `gorm:"type:uuid;not null" json:"userId"`
-	Name          string `gorm:"not null"           json:"name"`
+	Name        string `gorm:"not null"           json:"name"`
-	Description   string `json:"description"`
+	Description string `json:"description"`
-	RetentionDays int    `gorm:"default:30"         json:"retentionDays"` // Days to retain events
+
+	// RetentionDays is the number of days to retain events.
+	RetentionDays int `gorm:"default:30" json:"retentionDays"`
 
 	// Relations
 	User        User         `json:"user,omitzero"`

internal/database/retention_test.go

@@ -2,6 +2,7 @@ package database_test
 
 import (
 	"context"
+	"net/http"
 	"testing"
 	"time"
 
@@ -30,8 +31,8 @@ func setupRetentionTest(t *testing.T) *retentionTestEnv {
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: "webhooker-test",
+		Appname: testAppname,
-		Version: "test",
+		Version: testVersion,
 	}
 
 	l, err := logger.New(lc, logger.LoggerParams{Globals: g})
@@ -117,9 +118,9 @@ func seedEventChain(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Body:         `{"seed": true}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 	event.CreatedAt = createdAt
 	require.NoError(t, db.Create(event).Error)

internal/database/testing.go

@@ -13,8 +13,11 @@ import (
 // sql.DB connection.
 func NewTestDatabase(db *gorm.DB) *Database {
 	return &Database{
-		db:  db,
+		db: db,
-		log: slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
+		log: slog.New(slog.NewTextHandler(
+			os.Stderr,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
 	}
 }
 
@@ -23,6 +26,9 @@ func NewTestDatabase(db *gorm.DB) *Database {
 func NewTestWebhookDBManager(dataDir string) *WebhookDBManager {
 	return &WebhookDBManager{
 		dataDir: dataDir,
-		log:     slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
+		log: slog.New(slog.NewTextHandler(
+			os.Stderr,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
 	}
 }

internal/database/webhook_db_manager_test.go

@@ -2,6 +2,7 @@ package database_test
 
 import (
 	"context"
+	"net/http"
 	"os"
 	"path/filepath"
 	"testing"
@@ -25,8 +26,8 @@ func setupTestWebhookDBManager(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: "webhooker-test",
+		Appname: testAppname,
-		Version: "test",
+		Version: testVersion,
 	}
 
 	l, err := logger.New(
@@ -83,10 +84,10 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"test": true}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 	require.NoError(t, db.Create(event).Error)
 	assert.NotEmpty(t, event.ID)
@@ -99,7 +100,7 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 		db.First(&readEvent, "id = ?", event.ID).Error,
 	)
 	assert.Equal(t, webhookID, readEvent.WebhookID)
-	assert.Equal(t, "POST", readEvent.Method)
+	assert.Equal(t, http.MethodPost, readEvent.Method)
 	assert.Equal(t, `{"test": true}`, readEvent.Body)
 }
 
@@ -123,9 +124,9 @@ func TestWebhookDBManager_DeleteDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Body:         `{"test": true}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -196,10 +197,10 @@ func seedDeliveryWorkflow(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"payload": "test"}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -231,7 +232,7 @@ func verifyPendingDeliveries(
 	)
 	require.Len(t, pending, 1)
 	assert.Equal(t, event.ID, pending[0].EventID)
-	assert.Equal(t, "POST", pending[0].Event.Method)
+	assert.Equal(t, http.MethodPost, pending[0].Event.Method)
 }
 
 func completeDelivery(
@@ -303,16 +304,16 @@ func TestWebhookDBManager_MultipleWebhooks(t *testing.T) {
 	event1 := &database.Event{
 		WebhookID:    webhook1,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Body:         `{"webhook": 1}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 	event2 := &database.Event{
 		WebhookID:    webhook2,
 		EntrypointID: uuid.New().String(),
-		Method:       "PUT",
+		Method:       http.MethodPut,
 		Body:         `{"webhook": 2}`,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 
 	require.NoError(t, db1.Create(event1).Error)

internal/delivery/archive_sweeper.go

@@ -0,0 +1,189 @@
+package delivery
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"time"
+
+	"go.uber.org/fx"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/logger"
+)
+
+// ArchiveSweeperParams holds the fx dependencies for the
+// ArchiveSweeper.
+type ArchiveSweeperParams struct {
+	fx.In
+
+	Config   *config.Config
+	Database *database.Database
+	Engine   *Engine
+	Logger   *logger.Logger
+}
+
+// ArchiveSweeper periodically prunes expired rows from
+// per-webhook archive databases whose database target carries a
+// positive expiry.
+//
+// Without it, pruning happens only when an archive is
+// (re)opened, and archives are only ever reopened by writes: an
+// archive belonging to a webhook that has stopped receiving
+// events would keep its expired rows forever. The sweep closes
+// that gap without changing anything for archives whose expiry
+// is unset or "never".
+//
+// It reuses Config.RetentionSweepInterval rather than
+// introducing a second interval: this is a retention sweep with
+// the same semantics as the event retention reaper.
+type ArchiveSweeper struct {
+	db       *database.Database
+	eng      *Engine
+	log      *slog.Logger
+	interval time.Duration
+	cancel   context.CancelFunc
+	wg       sync.WaitGroup
+}
+
+// NewArchiveSweeper creates the archive sweeper and registers
+// its fx lifecycle hooks. The background sweep loop starts on
+// OnStart and stops cleanly on OnStop via context cancellation.
+func NewArchiveSweeper(
+	lc fx.Lifecycle,
+	params ArchiveSweeperParams,
+) *ArchiveSweeper {
+	s := &ArchiveSweeper{
+		db:       params.Database,
+		eng:      params.Engine,
+		log:      params.Logger.Get(),
+		interval: params.Config.RetentionSweepInterval,
+	}
+
+	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			s.start(ctx)
+
+			return nil
+		},
+		OnStop: func(_ context.Context) error {
+			s.stop()
+
+			return nil
+		},
+	})
+
+	return s
+}
+
+func (s *ArchiveSweeper) start(ctx context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	s.cancel = cancel
+
+	s.wg.Add(1)
+
+	go s.run(ctx)
+
+	s.log.Info(
+		"archive sweeper started",
+		"interval", s.interval.String(),
+	)
+}
+
+func (s *ArchiveSweeper) stop() {
+	s.log.Info("archive sweeper stopping")
+
+	if s.cancel != nil {
+		s.cancel()
+	}
+
+	s.wg.Wait()
+	s.log.Info("archive sweeper stopped")
+}
+
+func (s *ArchiveSweeper) run(ctx context.Context) {
+	defer s.wg.Done()
+
+	ticker := time.NewTicker(s.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.sweep(ctx)
+		}
+	}
+}
+
+// sweep prunes every archive whose database target declares a
+// positive expiry. Targets belonging to a deleted webhook are
+// soft-deleted along with it, so GORM's default scope already
+// excludes them.
+//
+// A failure for one webhook is logged and the sweep continues,
+// matching how the write path already treats a prune error as
+// non-fatal.
+func (s *ArchiveSweeper) sweep(ctx context.Context) {
+	var targets []database.Target
+
+	err := s.db.DB().
+		Model(&database.Target{}).
+		Where("type = ?", database.TargetTypeDatabase).
+		Find(&targets).Error
+	if err != nil {
+		s.log.Error(
+			"archive sweep: failed to list database targets",
+			"error", err,
+		)
+
+		return
+	}
+
+	for i := range targets {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		s.sweepTarget(&targets[i])
+	}
+}
+
+// sweepTarget prunes the archive of a single database target.
+// A missing, empty, or "never" expiry parses as a zero duration
+// and is skipped entirely, so those archives keep exactly the
+// behaviour they had before the sweep existed.
+func (s *ArchiveSweeper) sweepTarget(target *database.Target) {
+	expiry, err := parseArchiveExpiry(target.Config)
+	if err != nil {
+		s.log.Error(
+			"archive sweep: invalid database target config",
+			"webhook_id", target.WebhookID,
+			"target_id", target.ID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if expiry <= 0 {
+		return
+	}
+
+	if s.eng == nil || s.eng.dbTarget == nil {
+		return
+	}
+
+	err = s.eng.dbTarget.sweepWebhook(target.WebhookID, expiry)
+	if err != nil {
+		s.log.Error(
+			"archive sweep: failed to prune archive",
+			"webhook_id", target.WebhookID,
+			"target_id", target.ID,
+			"error", err,
+		)
+	}
+}

internal/delivery/archive_sweeper_test.go

@@ -0,0 +1,425 @@
+package delivery_test
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	_ "modernc.org/sqlite" // Pure Go SQLite driver.
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+const (
+	// sweepRowOld and sweepRowNew are the event ids
+	// seedArchiveRows assigns to the first and second seeded
+	// rows.
+	sweepRowOld = "ev-0"
+	sweepRowNew = "ev-1"
+
+	// sweepConcurrentWrites is how many deliveries the
+	// concurrent write-plus-sweep test races against the sweep.
+	sweepConcurrentWrites = 20
+)
+
+// sweeperEnv bundles the pieces an archive sweep test drives:
+// a main configuration database holding webhooks and targets, a
+// delivery engine owning the archive writer registry, and the
+// data directory the archive files live in.
+type sweeperEnv struct {
+	sweeper *delivery.ArchiveSweeper
+	eng     *delivery.Engine
+	mainDB  *database.Database
+	dataDir string
+}
+
+func setupSweeperTest(t *testing.T) *sweeperEnv {
+	t.Helper()
+
+	dataDir := t.TempDir()
+	log := archiveTestLogger()
+
+	sqlDB, err := sql.Open(
+		"sqlite",
+		fmt.Sprintf(
+			"file:%s?mode=rwc",
+			filepath.Join(dataDir, "main.db"),
+		),
+	)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	mainDB := database.NewTestDatabase(gdb)
+	require.NoError(t, mainDB.Migrate())
+
+	eng := delivery.NewTestEngineWithDB(
+		mainDB,
+		database.NewTestWebhookDBManager(dataDir),
+		log,
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	return &sweeperEnv{
+		sweeper: delivery.NewTestArchiveSweeper(
+			mainDB, eng, log,
+		),
+		eng:     eng,
+		mainDB:  mainDB,
+		dataDir: dataDir,
+	}
+}
+
+// archivePath returns where the engine keeps a webhook's
+// archive file.
+func (env *sweeperEnv) archivePath(webhookID string) string {
+	return filepath.Join(
+		env.dataDir, fmt.Sprintf("archive-%s.db", webhookID),
+	)
+}
+
+// seedDatabaseTarget creates a webhook with one database target
+// carrying the given target config JSON, and returns the
+// webhook id.
+func (env *sweeperEnv) seedDatabaseTarget(
+	t *testing.T, configJSON string,
+) string {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID: uuid.New().String(),
+		Name:   "sweep-test",
+	}
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Omit(clause.Associations).
+			Create(wh).Error,
+	)
+
+	tgt := &database.Target{
+		WebhookID: wh.ID,
+		Name:      "archive",
+		Type:      database.TargetTypeDatabase,
+		Active:    true,
+		Config:    configJSON,
+	}
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Omit(clause.Associations).
+			Create(tgt).Error,
+	)
+
+	return wh.ID
+}
+
+// seedArchiveRows creates the archive file for a webhook and
+// inserts one row per supplied archived-at timestamp, returning
+// the archive path. The handle is closed before returning, so
+// the archive is idle exactly as it would be with no traffic.
+func (env *sweeperEnv) seedArchiveRows(
+	t *testing.T, webhookID string, archivedAt ...time.Time,
+) string {
+	t.Helper()
+
+	path := env.archivePath(webhookID)
+
+	sqlDB, err := sql.Open(
+		"sqlite", fmt.Sprintf("file:%s?mode=rwc", path),
+	)
+	require.NoError(t, err)
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	require.NoError(
+		t, gdb.AutoMigrate(&delivery.ExportArchivedEvent{}),
+	)
+
+	for i, at := range archivedAt {
+		row := delivery.ExportArchivedEvent{
+			EventID:    fmt.Sprintf("ev-%d", i),
+			WebhookID:  webhookID,
+			Method:     http.MethodPost,
+			Body:       `{"seeded":true}`,
+			ArchivedAt: at,
+		}
+		require.NoError(t, gdb.Create(&row).Error)
+	}
+
+	require.NoError(t, sqlDB.Close())
+
+	return path
+}
+
+// archivedEventIDs returns the event ids currently stored in an
+// archive file, read through a separate read-only handle.
+func archivedEventIDs(
+	t *testing.T, path string,
+) []string {
+	t.Helper()
+
+	var rows []delivery.ExportArchivedEvent
+
+	rdb := openArchiveDBForRead(t, path)
+	require.NoError(t, rdb.Order("event_id").Find(&rows).Error)
+
+	ids := make([]string, 0, len(rows))
+	for i := range rows {
+		ids = append(ids, rows[i].EventID)
+	}
+
+	return ids
+}
+
+// TestArchiveSweep_PrunesIdleArchive is the core regression
+// test for this issue: an archive that receives no further
+// writes must still lose its expired rows. Before the sweeper
+// existed, pruning only ever ran on a write-triggered reopen,
+// so an idle archive kept expired rows forever.
+func TestArchiveSweep_PrunesIdleArchive(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	now := time.Now()
+	path := env.seedArchiveRows(
+		t, webhookID,
+		now.Add(-48*time.Hour),
+		now.Add(-time.Minute),
+	)
+
+	require.Equal(
+		t, []string{sweepRowOld, sweepRowNew},
+		archivedEventIDs(t, path),
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.Equal(
+		t, []string{sweepRowNew}, archivedEventIDs(t, path),
+		"the sweep should prune rows older than the expiry "+
+			"from an idle archive and keep the rest",
+	)
+}
+
+// TestArchiveSweep_LeavesArchiveClosed proves the sweep does
+// not hold the archive open afterwards, so an operator can
+// still move the file away for offline retention.
+func TestArchiveSweep_LeavesArchiveClosed(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.False(
+		t, env.eng.ExportArchiveHandleOpen(webhookID),
+		"an idle archive must end the sweep closed",
+	)
+}
+
+// TestArchiveSweep_NeverExpiryUntouched proves the sweep is a
+// no-op for the default retention policy, so archives with no
+// expiry (or the literal "never") behave exactly as before.
+func TestArchiveSweep_NeverExpiryUntouched(t *testing.T) {
+	t.Parallel()
+
+	for _, configJSON := range []string{
+		`{"expiry":"never"}`,
+		`{"expiry":""}`,
+		"",
+	} {
+		env := setupSweeperTest(t)
+
+		webhookID := env.seedDatabaseTarget(t, configJSON)
+		path := env.seedArchiveRows(
+			t, webhookID,
+			time.Now().Add(-10000*time.Hour),
+		)
+
+		env.sweeper.ExportSweep(context.Background())
+
+		assert.Equal(
+			t, []string{sweepRowOld}, archivedEventIDs(t, path),
+			"config %q must keep rows forever", configJSON,
+		)
+	}
+}
+
+// TestArchiveSweep_DoesNotCreateArchiveFile proves the sweep
+// never conjures an archive: a webhook with a database target
+// that has never received an event must still have no archive
+// file (nor SQLite sidecar) after a sweep.
+func TestArchiveSweep_DoesNotCreateArchiveFile(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	path := env.archivePath(webhookID)
+
+	require.NoFileExists(t, path)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	for _, suffix := range []string{"", "-wal", "-shm"} {
+		assert.NoFileExists(
+			t, path+suffix,
+			"the sweep must not create an archive file",
+		)
+	}
+}
+
+// TestArchiveSweep_DoesNotCreateAfterWriterExists covers the
+// same guarantee once a writer is cached in the registry but
+// the file itself is still absent (for instance because the
+// operator moved the archive away).
+func TestArchiveSweep_DoesNotCreateAfterWriterExists(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	path, err := env.eng.ExportEnsureArchiveWriter(webhookID)
+	require.NoError(t, err)
+	require.NoFileExists(t, path)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.NoFileExists(t, path)
+}
+
+// TestArchiveSweep_SkipsDeletedWebhookTargets proves that the
+// sweep ignores targets soft-deleted along with their webhook,
+// so a deleted webhook's archive is never reopened.
+func TestArchiveSweep_SkipsDeletedWebhookTargets(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	path := env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Where("webhook_id = ?", webhookID).
+			Delete(&database.Target{}).Error,
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.Equal(
+		t, []string{sweepRowOld}, archivedEventIDs(t, path),
+		"a deleted target's archive must be left alone",
+	)
+}
+
+// TestArchiveSweep_ConcurrentWrites proves the sweep serialises
+// against writes through the per-webhook writer mutex. Run
+// under -race, an unsynchronised sweep would be caught here.
+func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	webhookDB := testWebhookDB(t)
+
+	// The deliveries are seeded up front, on the test's own
+	// goroutine: the seed helpers assert, and testify assertions
+	// must not run off the test goroutine.
+	deliveries := make(
+		[]*database.Delivery, 0, sweepConcurrentWrites,
+	)
+
+	for range sweepConcurrentWrites {
+		event := seedEvent(t, webhookDB, `{"n":1}`)
+		event.WebhookID = webhookID
+
+		deliveries = append(
+			deliveries,
+			seedDatabaseTargetDelivery(
+				t, webhookDB, event, `{"expiry":"1h"}`,
+			),
+		)
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+
+		for _, d := range deliveries {
+			env.eng.ExportDeliverDatabase(webhookDB, d)
+		}
+	}()
+
+	go func() {
+		defer wg.Done()
+
+		for range sweepConcurrentWrites {
+			env.sweeper.ExportSweep(context.Background())
+		}
+	}()
+
+	wg.Wait()
+
+	assert.FileExists(t, env.archivePath(webhookID))
+}
+
+// TestArchiveSweeper_StopsCleanly proves the background loop
+// exits on OnStop rather than leaking a goroutine.
+func TestArchiveSweeper_StopsCleanly(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	env.sweeper.ExportSetInterval(time.Millisecond)
+	env.sweeper.ExportStart(context.Background())
+
+	// stop blocks on the loop's WaitGroup, so returning at all
+	// proves the loop observed the cancellation and exited.
+	env.sweeper.ExportStop()
+}

internal/delivery/engine.go

@@ -94,6 +94,23 @@ type Notifier interface {
 	Notify(tasks []Task)
 }
 
+// WebhookEvictor releases the delivery engine's per-webhook
+// state for a webhook that no longer needs it — currently the
+// cached archive writer of the database target, whose open
+// file handle would otherwise outlive the webhook.
+//
+// It is deliberately separate from Notifier and deliberately
+// one method wide: archiving lifecycle is not notification, and
+// a single-method interface keeps the handlers package free of
+// any dependency on the engine's internals while staying
+// trivially fakeable in tests.
+//
+// EvictWebhook never deletes an archive file. It is idempotent
+// and is a no-op for a webhook with no engine state.
+type WebhookEvictor interface {
+	EvictWebhook(webhookID string)
+}
+
 // EngineParams are the fx dependencies for the delivery
 // engine.
 type EngineParams struct {
@@ -127,6 +144,10 @@ type Engine struct {
 	// httpTarget is retained so tests can reach the HTTP
 	// target's shared client and circuit breakers.
 	httpTarget *httpTarget
+
+	// dbTarget is retained so the engine can reach the archive
+	// writer registry for webhook eviction and the idle sweep.
+	dbTarget *databaseTarget
 }
 
 // New creates and registers the delivery engine with the
@@ -182,6 +203,19 @@ func (e *Engine) Notify(tasks []Task) {
 	}
 }
 
+// EvictWebhook implements WebhookEvictor. It releases the
+// engine's per-webhook archiving state: the database target's
+// cached archive writer is dropped from the registry and its
+// file handle closed. The archive file itself is left on disk
+// — it is long-term storage the operator owns.
+func (e *Engine) EvictWebhook(webhookID string) {
+	if e.dbTarget == nil {
+		return
+	}
+
+	e.dbTarget.evict(webhookID)
+}
+
 // ScheduleRetry schedules a task to be re-enqueued onto the
 // retry channel after delay. It implements the Scheduler
 // interface the targets use to own their durable retries.

internal/delivery/engine_integration_test.go

@@ -126,36 +126,6 @@ func iHTTPConfig(url string) string {
 	return string(data)
 }
 
-func iWebhookDB(t *testing.T) *gorm.DB {
-	t.Helper()
-
-	dbPath := filepath.Join(
-		t.TempDir(), "events-test.db",
-	)
-
-	dsn := fmt.Sprintf(
-		"file:%s?cache=shared&mode=rwc", dbPath,
-	)
-
-	sqlDB, err := sql.Open("sqlite", dsn)
-	require.NoError(t, err)
-
-	t.Cleanup(func() { _ = sqlDB.Close() })
-
-	db, err := gorm.Open(
-		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
-	)
-	require.NoError(t, err)
-
-	require.NoError(t, db.AutoMigrate(
-		&database.Event{},
-		&database.Delivery{},
-		&database.DeliveryResult{},
-	))
-
-	return db
-}
-
 func iEngine(
 	t *testing.T, workers int,
 ) *delivery.Engine {
@@ -182,10 +152,10 @@ func iSeedEvent(
 	event := database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Headers:      `{}`,
 		Body:         body,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -935,7 +905,7 @@ func TestDeliverHTTP_CustomTargetHeaders(t *testing.T) {
 func TestDeliverHTTP_TargetTimeout(t *testing.T) {
 	t.Parallel()
 
-	db := iWebhookDB(t)
+	db := testWebhookDB(t)
 	e := iEngine(t, 1)
 
 	ts := httptest.NewServer(
@@ -987,10 +957,10 @@ func iSeedEventAndDelivery(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -1067,7 +1037,7 @@ func iAssertResultFailed(
 func TestDeliverHTTP_InvalidConfig(t *testing.T) {
 	t.Parallel()
 
-	db := iWebhookDB(t)
+	db := testWebhookDB(t)
 	e := iEngine(t, 1)
 
 	event, del := iSeedEventAndDelivery(

internal/delivery/engine_test.go

@@ -27,6 +27,9 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
+// testContentType is the event content type used in tests.
+const testContentType = "application/json"
+
 func testWebhookDB(t *testing.T) *gorm.DB {
 	t.Helper()
 
@@ -94,10 +97,10 @@ func seedEvent(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       "POST",
+		Method:       http.MethodPost,
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  "application/json",
+		ContentType:  testContentType,
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -342,33 +345,29 @@ func TestDeliverDatabase_ImmediateSuccess(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-	e := testEngine(t, 1)
 
-	event := seedEvent(t, db, `{"db":"target"}`)
+	// The database target archives for real now, so the engine
-
+	// needs a webhook DB manager to locate the data directory.
-	dlv := seedDelivery(
+	e := delivery.NewTestEngineWithDB(
-		t, db, event.ID, uuid.New().String(),
+		nil,
-		database.DeliveryStatusPending,
+		database.NewTestWebhookDBManager(t.TempDir()),
+		slog.New(slog.NewTextHandler(
+			os.Stderr,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
 	)
 
-	d := &database.Delivery{
+	event := seedEvent(t, db, `{"db":"target"}`)
-		EventID:  event.ID,
+	d := seedDatabaseTargetDelivery(t, db, event, "")
-		TargetID: dlv.TargetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name: "test-db",
-			Type: database.TargetTypeDatabase,
-		},
-	}
-	d.ID = dlv.ID
 
 	e.ExportDeliverDatabase(db, d)
 
 	var updated database.Delivery
 
 	require.NoError(t, db.First(
-		&updated, "id = ?", dlv.ID,
+		&updated, "id = ?", d.ID,
 	).Error)
 
 	assert.Equal(t,
@@ -379,7 +378,7 @@ func TestDeliverDatabase_ImmediateSuccess(
 	var result database.DeliveryResult
 
 	require.NoError(t, db.Where(
-		"delivery_id = ?", dlv.ID,
+		"delivery_id = ?", d.ID,
 	).First(&result).Error)
 
 	assert.True(t, result.Success)
@@ -1117,10 +1116,10 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	}
 
 	event := &database.Event{
-		Method:      "POST",
+		Method:      http.MethodPost,
 		Headers:     `{"X-Custom":["value1"],"Content-Type":["application/json"]}`,
 		Body:        `{"test":true}`,
-		ContentType: "application/json",
+		ContentType: testContentType,
 	}
 
 	statusCode, _, _, err := e.ExportDoHTTPRequest(
@@ -1142,7 +1141,7 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	)
 
 	assert.Equal(t,
-		"application/json",
+		testContentType,
 		receivedHeaders.Get("Content-Type"),
 	)
 
@@ -1158,7 +1157,19 @@ func TestProcessDelivery_RoutesToCorrectHandler(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-	e := testEngine(t, 1)
+
+	// The database target archives for real now, so the engine
+	// needs a webhook DB manager to locate the data directory.
+	e := delivery.NewTestEngineWithDB(
+		nil,
+		database.NewTestWebhookDBManager(t.TempDir()),
+		slog.New(slog.NewTextHandler(
+			os.Stderr,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
 
 	tests := []struct {
 		name       string
@@ -1289,8 +1300,8 @@ func TestFormatSlackMessage_JSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      "POST",
+		Method:      http.MethodPost,
-		ContentType: "application/json",
+		ContentType: testContentType,
 		Body: `{"action":"push",` +
 			`"repo":"test/repo",` +
 			`"ref":"refs/heads/main"}`,
@@ -1315,7 +1326,7 @@ func TestFormatSlackMessage_NonJSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      "POST",
+		Method:      http.MethodPost,
 		ContentType: "text/plain",
 		Body:        "hello world plain text",
 	}
@@ -1338,8 +1349,8 @@ func TestFormatSlackMessage_EmptyBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      "POST",
+		Method:      http.MethodPost,
-		ContentType: "application/json",
+		ContentType: testContentType,
 		Body:        "",
 	}
 	event.CreatedAt = time.Date(
@@ -1367,8 +1378,8 @@ func TestFormatSlackMessage_LargeJSONTruncated(
 	require.NoError(t, err)
 
 	event := &database.Event{
-		Method:      "POST",
+		Method:      http.MethodPost,
-		ContentType: "application/json",
+		ContentType: testContentType,
 		Body:        string(largeJSON),
 	}
 	event.CreatedAt = time.Date(
@@ -1697,7 +1708,7 @@ func assertLogLineComplete(
 		"log line must contain the webhook id",
 	)
 
-	assert.Contains(t, out, "application/json",
+	assert.Contains(t, out, testContentType,
 		"log line must contain the content type",
 	)
 }

internal/delivery/export_test.go

@@ -273,3 +273,148 @@ func NewTestCircuitBreaker(
 		cooldown:  cooldown,
 	}
 }
+
+// ExportArchivedEvent aliases the archive row type so black-box
+// tests can construct and read archive rows.
+type ExportArchivedEvent = archivedEvent
+
+// ExportArchiveWriter wraps an archiveWriter so black-box tests
+// can exercise the per-webhook archive file mechanics.
+type ExportArchiveWriter struct {
+	w *archiveWriter
+}
+
+// NewExportArchiveWriter builds an archive writer for tests,
+// optionally overriding the reopen debounce (a non-positive
+// debounce keeps the production default).
+func NewExportArchiveWriter(
+	path string, log *slog.Logger, debounce time.Duration,
+) *ExportArchiveWriter {
+	w := newArchiveWriter(path, log)
+	if debounce > 0 {
+		w.debounce = debounce
+	}
+
+	return &ExportArchiveWriter{w: w}
+}
+
+// Write archives a row through the writer.
+func (e *ExportArchiveWriter) Write(
+	row ExportArchivedEvent, expiry time.Duration,
+) error {
+	return e.w.write(row, expiry)
+}
+
+// Open opens the archive file, pruning when expiry is positive.
+func (e *ExportArchiveWriter) Open(expiry time.Duration) error {
+	return e.w.open(expiry)
+}
+
+// Reopen closes and reopens the archive file.
+func (e *ExportArchiveWriter) Reopen(
+	expiry time.Duration,
+) error {
+	return e.w.reopen(expiry)
+}
+
+// Reopens reports how many times the file has been opened.
+func (e *ExportArchiveWriter) Reopens() int {
+	return e.w.reopens
+}
+
+// DB returns the writer's current open handle for row
+// inspection in tests.
+func (e *ExportArchiveWriter) DB() *gorm.DB {
+	return e.w.db
+}
+
+// ExportHasArchiveWriter reports whether the database target
+// currently caches an archive writer for a webhook.
+func (e *Engine) ExportHasArchiveWriter(
+	webhookID string,
+) bool {
+	e.dbTarget.mu.Lock()
+	defer e.dbTarget.mu.Unlock()
+
+	_, ok := e.dbTarget.writers[webhookID]
+
+	return ok
+}
+
+// ExportArchiveHandleOpen reports whether the cached archive
+// writer for a webhook holds an open database handle. It
+// returns false when no writer is cached.
+func (e *Engine) ExportArchiveHandleOpen(
+	webhookID string,
+) bool {
+	e.dbTarget.mu.Lock()
+	w, ok := e.dbTarget.writers[webhookID]
+	e.dbTarget.mu.Unlock()
+
+	if !ok {
+		return false
+	}
+
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	return w.db != nil
+}
+
+// ExportEnsureArchiveWriter creates (if needed) and returns the
+// archive file path of the cached writer for a webhook, so a
+// test can prime the registry the way a delivery would.
+func (e *Engine) ExportEnsureArchiveWriter(
+	webhookID string,
+) (string, error) {
+	w, err := e.dbTarget.writerFor(webhookID)
+	if err != nil {
+		return "", err
+	}
+
+	return w.path, nil
+}
+
+// NewTestArchiveSweeper builds an ArchiveSweeper backed by the
+// given main database and engine, without the fx lifecycle.
+// Intended for tests.
+func NewTestArchiveSweeper(
+	db *database.Database,
+	eng *Engine,
+	log *slog.Logger,
+) *ArchiveSweeper {
+	return &ArchiveSweeper{
+		db:       db,
+		eng:      eng,
+		log:      log,
+		interval: time.Hour,
+	}
+}
+
+// ExportSweep runs a single archive sweep synchronously for
+// tests.
+func (s *ArchiveSweeper) ExportSweep(ctx context.Context) {
+	s.sweep(ctx)
+}
+
+// ExportStart starts the sweeper's background loop for tests.
+func (s *ArchiveSweeper) ExportStart(ctx context.Context) {
+	s.start(ctx)
+}
+
+// ExportStop stops the sweeper's background loop for tests.
+func (s *ArchiveSweeper) ExportStop() {
+	s.stop()
+}
+
+// ExportSetInterval overrides the sweep interval for tests.
+func (s *ArchiveSweeper) ExportSetInterval(d time.Duration) {
+	s.interval = d
+}
+
+// ExportParseArchiveExpiry exposes parseArchiveExpiry.
+func ExportParseArchiveExpiry(
+	configJSON string,
+) (time.Duration, error) {
+	return parseArchiveExpiry(configJSON)
+}

internal/delivery/target.go

@@ -90,12 +90,15 @@ func (e *Engine) initTargets(client *http.Client) {
 		client:   client,
 	}
 
+	dbT := &databaseTarget{eng: e}
+
 	e.httpTarget = httpT
+	e.dbTarget = dbT
 
 	e.targets = map[database.TargetType]Target{
 		database.TargetTypeHTTP:     httpT,
 		database.TargetTypeSlack:    slackT,
-		database.TargetTypeDatabase: &databaseTarget{eng: e},
+		database.TargetTypeDatabase: dbT,
 		database.TargetTypeLog:      &logTarget{eng: e},
 	}
 }

internal/delivery/target_database.go

@@ -2,21 +2,39 @@ package delivery
 
 import (
 	"context"
+	"fmt"
+	"path/filepath"
+	"sync"
+	"time"
 
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// databaseTarget is a fire-and-forget target: the event is
+// databaseTarget is a no-retry target that archives the
-// already persisted in the per-webhook database by the time
+// full inbound event into a per-webhook archive SQLite file,
-// delivery runs, so the target records a single successful
+// separate from the per-webhook event database. The event is
-// attempt. (Durable archiving to a separate store is tracked
+// already persisted in the per-webhook event DB by the time
-// as its own work.)
+// delivery runs; the database target additionally writes a
+// durable long-term copy into archive-{webhookID}.db and then
+// records a single attempt whose outcome reflects whether the
+// archive write succeeded. See archiveWriter for the
+// close/reopen, auto-recreate, and expiry semantics.
 type databaseTarget struct {
 	eng *Engine
+
+	mu      sync.Mutex
+	writers map[string]*archiveWriter
 }
 
-// Deliver implements Target.
+// Deliver implements Target. It archives the event, then
+// records one successful attempt and marks the delivery
+// delivered. An archiving error fails the delivery: the
+// attempt is recorded as failed with the error and the
+// delivery is marked failed, so a target that could not do
+// its one job (archiving) never reports success. The target
+// does not retry; the event remains durably stored in the
+// per-webhook event database.
 func (t *databaseTarget) Deliver(
 	_ context.Context,
 	webhookDB *gorm.DB,
@@ -24,6 +42,27 @@ func (t *databaseTarget) Deliver(
 	_ *Task,
 	_ Scheduler,
 ) {
+	err := t.archive(d)
+	if err != nil {
+		t.eng.log.Error(
+			"failed to archive event to database target",
+			"delivery_id", d.ID,
+			"event_id", d.EventID,
+			"error", err,
+		)
+
+		t.eng.recordResult(
+			webhookDB, d, 1, false, 0, "",
+			err.Error(), 0,
+		)
+
+		t.eng.updateDeliveryStatus(
+			webhookDB, d, database.DeliveryStatusFailed,
+		)
+
+		return
+	}
+
 	t.eng.recordResult(
 		webhookDB, d, 1, true, 0, "", "", 0,
 	)
@@ -32,3 +71,147 @@ func (t *databaseTarget) Deliver(
 		webhookDB, d, database.DeliveryStatusDelivered,
 	)
 }
+
+// archive writes the full event as a row into the webhook's
+// archive database, honouring the optional per-target expiry
+// parsed from the target config JSON.
+func (t *databaseTarget) archive(d *database.Delivery) error {
+	webhookID := d.Event.WebhookID
+	if webhookID == "" {
+		return errArchiveMissingWebhookID
+	}
+
+	expiry, err := parseArchiveExpiry(d.Target.Config)
+	if err != nil {
+		return err
+	}
+
+	w, err := t.writerFor(webhookID)
+	if err != nil {
+		return err
+	}
+
+	row := archivedEvent{
+		EventID:      d.Event.ID,
+		WebhookID:    webhookID,
+		EntrypointID: d.Event.EntrypointID,
+		Method:       d.Event.Method,
+		Headers:      d.Event.Headers,
+		Body:         d.Event.Body,
+		ContentType:  d.Event.ContentType,
+	}
+
+	return w.write(row, expiry)
+}
+
+// writerFor returns the archiveWriter for a webhook, creating
+// and caching it on first use. Each webhook has one writer so
+// its close/reopen debounce state is shared across concurrent
+// deliveries. The archive file lives beside the per-webhook
+// event database in the data directory.
+func (t *databaseTarget) writerFor(
+	webhookID string,
+) (*archiveWriter, error) {
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return nil, err
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	if t.writers == nil {
+		t.writers = make(map[string]*archiveWriter)
+	}
+
+	w, ok := t.writers[webhookID]
+	if !ok {
+		w = newArchiveWriter(path, t.eng.log)
+		t.writers[webhookID] = w
+	}
+
+	return w, nil
+}
+
+// archivePath returns the archive file path for a webhook: it
+// lives beside the per-webhook event database in the data
+// directory. It does not touch the filesystem.
+func (t *databaseTarget) archivePath(
+	webhookID string,
+) (string, error) {
+	if t.eng.dbManager == nil {
+		return "", errArchiveNoDataDir
+	}
+
+	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
+
+	return filepath.Join(
+		dir, fmt.Sprintf("archive-%s.db", webhookID),
+	), nil
+}
+
+// evict drops a webhook's archive writer from the registry and
+// closes its handle, so a deleted webhook does not leave a
+// writer (and an open archive handle within its debounce
+// window) alive for the process lifetime.
+//
+// The map entry is removed under the registry lock, which is
+// then released before the handle is closed under the writer's
+// own lock: that ordering keeps the registry available to other
+// webhooks while an in-flight write on this one drains, and
+// closing under the writer's lock means eviction can never race
+// a write.
+//
+// Eviction is idempotent and silent for a webhook with no
+// writer, which is the common case: a webhook with no database
+// target never creates one. It never deletes the archive file.
+func (t *databaseTarget) evict(webhookID string) {
+	t.mu.Lock()
+
+	w, ok := t.writers[webhookID]
+	if ok {
+		delete(t.writers, webhookID)
+	}
+
+	t.mu.Unlock()
+
+	if !ok {
+		return
+	}
+
+	w.evict()
+
+	t.eng.log.Info(
+		"evicted archive writer",
+		"webhook_id", webhookID,
+		"path", w.path,
+	)
+}
+
+// sweepWebhook prunes one webhook's archive of rows older than
+// expiry, without requiring a write. It returns nil (nothing to
+// do) when the archive file does not exist, so a sweep never
+// creates an archive for a webhook that has a database target
+// but has never received an event.
+func (t *databaseTarget) sweepWebhook(
+	webhookID string, expiry time.Duration,
+) error {
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return err
+	}
+
+	// Check before taking a writer at all: a webhook whose
+	// archive has never been created gets no writer, no handle,
+	// and no file.
+	if !fileExists(path) {
+		return nil
+	}
+
+	w, err := t.writerFor(webhookID)
+	if err != nil {
+		return err
+	}
+
+	return w.sweepExpired(expiry)
+}

internal/delivery/target_database_archive.go

@@ -0,0 +1,416 @@
+package delivery
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"sync"
+	"time"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+// archiveExpiryNever is the expiry sentinel (and default) that
+// disables pruning so archived rows are kept forever.
+const archiveExpiryNever = "never"
+
+// archiveReopenDebounce bounds how often an archive file is
+// closed and reopened. After each write the handle is closed
+// and reopened so an operator can move the file away for
+// offline archiving, but never more than once per this window.
+const archiveReopenDebounce = time.Second
+
+const (
+	// archiveModeCreate is the SQLite URI mode used by the write
+	// path: open the archive file, creating it if missing, so a
+	// first write (or a write after the operator moved the file
+	// away) recreates it.
+	archiveModeCreate = "rwc"
+
+	// archiveModeExisting is the SQLite URI mode used by the idle
+	// sweep: open read-write but never create. A sweep must never
+	// conjure an empty archive file for a webhook that has a
+	// database target but has never received an event.
+	archiveModeExisting = "rw"
+)
+
+var (
+	// errArchiveMissingWebhookID is returned when an event to
+	// archive has no webhook id to key its archive file on.
+	errArchiveMissingWebhookID = errors.New(
+		"cannot archive event without a webhook id",
+	)
+
+	// errArchiveNoDataDir is returned when the database target
+	// has no webhook database manager and so cannot locate the
+	// data directory for archive files.
+	errArchiveNoDataDir = errors.New(
+		"database target has no data directory",
+	)
+
+	// errArchiveExpiryNotPositive is returned when a
+	// user-supplied archive expiry parses as a duration but is
+	// zero or negative; "never" is the way to disable pruning.
+	errArchiveExpiryNotPositive = errors.New(
+		"expiry must be a positive duration or \"never\"",
+	)
+
+	// errArchiveWriterEvicted is returned when a writer that has
+	// been evicted (its webhook was deleted, or its last database
+	// target was removed) is used again. An evicted writer is no
+	// longer in the registry, so reopening its file would leak a
+	// handle nothing owns.
+	errArchiveWriterEvicted = errors.New(
+		"archive writer has been evicted",
+	)
+)
+
+// databaseTargetConfig is the optional per-target JSON config
+// for a database (archive) target.
+type databaseTargetConfig struct {
+	// Expiry is a Go duration (e.g. "720h") after which
+	// archived rows are pruned, or "never" (the default) to
+	// keep them forever.
+	Expiry string `json:"expiry"`
+}
+
+// archivedEvent is one fully captured webhook event stored in a
+// per-webhook archive database for long-term retention. It is a
+// self-contained copy — independent of the per-webhook event
+// database, which may prune events under its own retention.
+type archivedEvent struct {
+	ID           uint   `gorm:"primaryKey;autoIncrement"`
+	EventID      string `gorm:"index"`
+	WebhookID    string
+	EntrypointID string
+	Method       string
+	Headers      string
+	Body         string
+	ContentType  string
+
+	// ArchivedAt is when the row was archived and is the age
+	// basis for expiry pruning.
+	ArchivedAt time.Time `gorm:"index"`
+}
+
+// parseArchiveExpiry reads the optional expiry from a database
+// target's config JSON. An empty config, an empty expiry, or
+// the literal "never" all mean keep forever, returned as a zero
+// duration. Any other value must parse as a positive Go
+// duration; a set-but-invalid value (unparseable, zero, or
+// negative) is an error rather than a silent default, matching
+// ValidateArchiveExpiry at target creation.
+func parseArchiveExpiry(
+	configJSON string,
+) (time.Duration, error) {
+	if configJSON == "" {
+		return 0, nil
+	}
+
+	var cfg databaseTargetConfig
+
+	err := json.Unmarshal([]byte(configJSON), &cfg)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"parsing database target config: %w", err,
+		)
+	}
+
+	if cfg.Expiry == "" || cfg.Expiry == archiveExpiryNever {
+		return 0, nil
+	}
+
+	dur, err := time.ParseDuration(cfg.Expiry)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"parsing archive expiry %q: %w", cfg.Expiry, err,
+		)
+	}
+
+	if dur <= 0 {
+		return 0, fmt.Errorf(
+			"%w: %q", errArchiveExpiryNotPositive, cfg.Expiry,
+		)
+	}
+
+	return dur, nil
+}
+
+// ValidateArchiveExpiry checks a user-supplied archive expiry
+// for a database target at configuration time. Valid values are
+// empty, "never" (both meaning keep forever), or a positive Go
+// duration such as "720h". Anything else is an error, so a bad
+// expiry is rejected when the target is created rather than
+// failing every subsequent delivery.
+func ValidateArchiveExpiry(expiry string) error {
+	if expiry == "" || expiry == archiveExpiryNever {
+		return nil
+	}
+
+	dur, err := time.ParseDuration(expiry)
+	if err != nil {
+		return fmt.Errorf(
+			"expiry must be %q or a Go duration "+
+				"such as \"720h\": %w",
+			archiveExpiryNever, err,
+		)
+	}
+
+	if dur <= 0 {
+		return fmt.Errorf(
+			"%w: %q", errArchiveExpiryNotPositive, expiry,
+		)
+	}
+
+	return nil
+}
+
+// archiveWriter owns one per-webhook archive SQLite file. It
+// serialises writes, and after each write closes and reopens
+// the file (debounced to at most once per debounce window) so
+// an operator can move the file away for offline archiving. The
+// next write recreates a moved or removed file, because the
+// file is opened create-if-missing and its schema is migrated
+// on every open.
+type archiveWriter struct {
+	mu         sync.Mutex
+	path       string
+	log        *slog.Logger
+	debounce   time.Duration
+	db         *gorm.DB
+	lastReopen time.Time
+	reopens    int
+
+	// evicted marks a writer that has been removed from the
+	// per-webhook registry. Its handle is closed and it must
+	// never open the file again: nothing holds it any more, so a
+	// reopen would leak the handle for the process lifetime.
+	evicted bool
+}
+
+// newArchiveWriter builds an archiveWriter for a file path with
+// the default reopen debounce.
+func newArchiveWriter(
+	path string, log *slog.Logger,
+) *archiveWriter {
+	return &archiveWriter{
+		path:     path,
+		log:      log,
+		debounce: archiveReopenDebounce,
+	}
+}
+
+// write appends the event as a row, then applies the debounced
+// close/reopen. It recreates the archive file if it was moved
+// or removed since the last open. A positive expiry prunes rows
+// older than it on each (re)open.
+func (w *archiveWriter) write(
+	row archivedEvent, expiry time.Duration,
+) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
+	if w.db == nil || !fileExists(w.path) {
+		err := w.reopen(expiry)
+		if err != nil {
+			return err
+		}
+	}
+
+	row.ArchivedAt = time.Now()
+
+	err := w.db.Create(&row).Error
+	if err != nil {
+		return fmt.Errorf(
+			"archiving event to %s: %w", w.path, err,
+		)
+	}
+
+	if time.Since(w.lastReopen) >= w.debounce {
+		return w.reopen(expiry)
+	}
+
+	return nil
+}
+
+// open opens (creating if missing) the archive file, migrates
+// its schema, records the reopen time, and prunes expired rows
+// when expiry is positive.
+func (w *archiveWriter) open(expiry time.Duration) error {
+	return w.openMode(archiveModeCreate, expiry)
+}
+
+// openMode opens the archive file with the given SQLite URI
+// mode, migrates its schema, records the reopen time, and
+// prunes expired rows when expiry is positive. The write path
+// passes archiveModeCreate so a missing file is recreated; the
+// idle sweep passes archiveModeExisting so a missing file is an
+// error rather than a newly conjured empty archive.
+func (w *archiveWriter) openMode(
+	mode string, expiry time.Duration,
+) error {
+	dbURL := fmt.Sprintf("file:%s?mode=%s", w.path, mode)
+
+	sqlDB, err := sql.Open("sqlite", dbURL)
+	if err != nil {
+		return fmt.Errorf(
+			"opening archive database %s: %w", w.path, err,
+		)
+	}
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	if err != nil {
+		_ = sqlDB.Close()
+
+		return fmt.Errorf(
+			"connecting to archive database %s: %w",
+			w.path, err,
+		)
+	}
+
+	err = gdb.AutoMigrate(&archivedEvent{})
+	if err != nil {
+		_ = sqlDB.Close()
+
+		return fmt.Errorf(
+			"migrating archive database %s: %w", w.path, err,
+		)
+	}
+
+	w.db = gdb
+	w.lastReopen = time.Now()
+	w.reopens++
+
+	if expiry > 0 {
+		w.prune(expiry)
+	}
+
+	return nil
+}
+
+// reopen closes any open handle and opens the file afresh. The
+// fresh open recreates the file if it was moved away.
+func (w *archiveWriter) reopen(expiry time.Duration) error {
+	w.close()
+
+	return w.open(expiry)
+}
+
+// close closes the underlying handle, if any.
+func (w *archiveWriter) close() {
+	if w.db == nil {
+		return
+	}
+
+	sqlDB, err := w.db.DB()
+	if err == nil {
+		_ = sqlDB.Close()
+	}
+
+	w.db = nil
+}
+
+// sweepExpired prunes an archive that may have gone idle, with
+// no write to trigger the usual on-reopen prune. It takes the
+// writer's own mutex for the whole operation, so a sweep is
+// ordered against concurrent writes rather than reaching around
+// them to the file.
+//
+// It never creates the archive file: a missing file is skipped,
+// and the reopen uses archiveModeExisting so SQLite itself
+// refuses to create one if the file disappears between the
+// check and the open.
+//
+// The archive is left CLOSED afterwards. An idle archive holding
+// no handle is what keeps the operator's move-the-file-away
+// workflow working; the next write reopens (and recreates) the
+// file as it always has.
+func (w *archiveWriter) sweepExpired(expiry time.Duration) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
+	if !fileExists(w.path) {
+		return nil
+	}
+
+	// Drop any live handle first so the prune runs against a
+	// freshly opened file, matching the write path's semantics.
+	w.close()
+
+	err := w.openMode(archiveModeExisting, expiry)
+	if err != nil {
+		return err
+	}
+
+	w.close()
+
+	return nil
+}
+
+// evict closes the writer's handle and marks it unusable. It is
+// called when the writer leaves the registry, either because the
+// webhook was deleted or because its last database target was
+// removed. The archive FILE is deliberately left on disk: it is
+// long-term storage an operator may still want.
+func (w *archiveWriter) evict() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	w.evicted = true
+
+	w.close()
+}
+
+// prune deletes archived rows older than expiry, measured from
+// each row's archived time. It runs on every (re)open, and
+// because the file is reopened after writes this keeps the
+// archive swept without a separate background sweeper. Failures
+// are logged, not fatal: a prune error must not stop archiving.
+func (w *archiveWriter) prune(expiry time.Duration) {
+	cutoff := time.Now().Add(-expiry)
+
+	res := w.db.Where("archived_at < ?", cutoff).
+		Delete(&archivedEvent{})
+	if res.Error != nil {
+		w.log.Error(
+			"failed to prune expired archive rows",
+			"path", w.path,
+			"error", res.Error,
+		)
+
+		return
+	}
+
+	if res.RowsAffected > 0 {
+		w.log.Info(
+			"pruned expired archive rows",
+			"path", w.path,
+			"rows_deleted", res.RowsAffected,
+		)
+	}
+}
+
+// fileExists reports whether a path currently exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+
+	return err == nil
+}

internal/delivery/target_database_evict_test.go

@@ -0,0 +1,130 @@
+package delivery_test
+
+import (
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+// evictTestEngine builds an engine backed by a temporary data
+// directory and returns it along with that directory.
+func evictTestEngine(t *testing.T) (*delivery.Engine, string) {
+	t.Helper()
+
+	dataDir := t.TempDir()
+
+	eng := delivery.NewTestEngineWithDB(
+		nil,
+		database.NewTestWebhookDBManager(dataDir),
+		archiveTestLogger(),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	return eng, dataDir
+}
+
+// TestEvictWebhook_ClosesAndRemovesWriter proves that evicting
+// a webhook drops its archive writer from the registry and
+// closes the open archive handle, rather than leaving both
+// alive for the process lifetime.
+func TestEvictWebhook_ClosesAndRemovesWriter(t *testing.T) {
+	t.Parallel()
+
+	eng, dataDir := evictTestEngine(t)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+
+	eng.ExportDeliverDatabase(webhookDB, d)
+
+	webhookID := event.WebhookID
+
+	require.True(
+		t, eng.ExportHasArchiveWriter(webhookID),
+		"a delivery should have cached an archive writer",
+	)
+	require.True(
+		t, eng.ExportArchiveHandleOpen(webhookID),
+		"the writer should hold an open handle after a write",
+	)
+
+	eng.EvictWebhook(webhookID)
+
+	assert.False(
+		t, eng.ExportHasArchiveWriter(webhookID),
+		"eviction should remove the registry entry",
+	)
+	assert.False(
+		t, eng.ExportArchiveHandleOpen(webhookID),
+		"eviction should close the archive handle",
+	)
+
+	archivePath := filepath.Join(
+		dataDir, fmt.Sprintf("archive-%s.db", webhookID),
+	)
+	assert.FileExists(
+		t, archivePath,
+		"eviction must not delete the archive file",
+	)
+}
+
+// TestEvictWebhook_UnknownWebhookIsNoOp proves eviction is safe
+// for the common case of a webhook that never had a database
+// target, and that repeating it does not panic.
+func TestEvictWebhook_UnknownWebhookIsNoOp(t *testing.T) {
+	t.Parallel()
+
+	eng, _ := evictTestEngine(t)
+
+	assert.NotPanics(t, func() {
+		eng.EvictWebhook("no-such-webhook")
+		eng.EvictWebhook("no-such-webhook")
+	})
+
+	assert.False(
+		t, eng.ExportHasArchiveWriter("no-such-webhook"),
+		"eviction must not create a writer",
+	)
+}
+
+// TestEvictWebhook_EvictedWriterDoesNotReopen proves an evicted
+// writer refuses further writes instead of silently reopening
+// the archive file: nothing holds it any more, so a reopened
+// handle would leak.
+func TestEvictWebhook_EvictedWriterDoesNotReopen(t *testing.T) {
+	t.Parallel()
+
+	eng, _ := evictTestEngine(t)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+
+	eng.ExportDeliverDatabase(webhookDB, d)
+	require.True(
+		t, eng.ExportHasArchiveWriter(event.WebhookID),
+	)
+
+	eng.EvictWebhook(event.WebhookID)
+
+	// A fresh delivery for the same webhook gets a brand new
+	// writer from the registry, so archiving keeps working.
+	second := seedDatabaseTargetDelivery(
+		t, webhookDB, event, "",
+	)
+	eng.ExportDeliverDatabase(webhookDB, second)
+
+	assert.True(
+		t, eng.ExportHasArchiveWriter(event.WebhookID),
+		"a later delivery should recreate the writer",
+	)
+}

internal/delivery/target_database_test.go

@@ -0,0 +1,395 @@
+package delivery_test
+
+import (
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	_ "modernc.org/sqlite" // Pure Go SQLite driver.
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+func archiveTestLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+}
+
+// openArchiveDBForRead opens an archive file read-only so a
+// test can inspect the rows the writer persisted.
+func openArchiveDBForRead(
+	t *testing.T, path string,
+) *gorm.DB {
+	t.Helper()
+
+	sqlDB, err := sql.Open(
+		"sqlite",
+		fmt.Sprintf("file:%s?mode=ro", path),
+	)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	return gdb
+}
+
+// removeArchiveFiles simulates an operator moving the archive
+// away by deleting the SQLite file and its sidecar files.
+func removeArchiveFiles(t *testing.T, path string) {
+	t.Helper()
+
+	for _, suffix := range []string{
+		"", "-wal", "-shm", "-journal",
+	} {
+		err := os.Remove(path + suffix)
+		if err != nil && !os.IsNotExist(err) {
+			t.Fatalf("removing %s%s: %v", path, suffix, err)
+		}
+	}
+}
+
+// TestDeliverDatabase_ArchivesEvent verifies that delivering to
+// a database target marks the delivery delivered and archives
+// the full event into a separate per-webhook archive file.
+func TestDeliverDatabase_ArchivesEvent(t *testing.T) {
+	t.Parallel()
+
+	dataDir := t.TempDir()
+	dbMgr := database.NewTestWebhookDBManager(dataDir)
+
+	e := delivery.NewTestEngineWithDB(
+		nil, dbMgr,
+		archiveTestLogger(),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+
+	e.ExportDeliverDatabase(webhookDB, d)
+
+	var updated database.Delivery
+
+	require.NoError(t, webhookDB.First(
+		&updated, "id = ?", d.ID,
+	).Error)
+	assert.Equal(t,
+		database.DeliveryStatusDelivered, updated.Status,
+		"database target should mark the delivery delivered",
+	)
+
+	archivePath := filepath.Join(
+		dataDir,
+		fmt.Sprintf("archive-%s.db", event.WebhookID),
+	)
+	assert.FileExists(t, archivePath)
+
+	rdb := openArchiveDBForRead(t, archivePath)
+
+	var rows []delivery.ExportArchivedEvent
+
+	require.NoError(t, rdb.Find(&rows).Error)
+	require.Len(t, rows, 1)
+	assert.Equal(t, event.ID, rows[0].EventID)
+	assert.Equal(t, event.WebhookID, rows[0].WebhookID)
+	assert.Equal(t, event.Method, rows[0].Method)
+	assert.JSONEq(t, `{"archived":true}`, rows[0].Body)
+}
+
+func TestArchiveWriter_WritesRow(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "archive-wh.db")
+	w := delivery.NewExportArchiveWriter(
+		path, archiveTestLogger(), 0,
+	)
+
+	row := delivery.ExportArchivedEvent{
+		EventID:      "ev-1",
+		WebhookID:    "wh-1",
+		EntrypointID: "ep-1",
+		Method:       "POST",
+		Headers:      `{"X":"Y"}`,
+		Body:         `{"hello":"world"}`,
+		ContentType:  "application/json",
+	}
+
+	require.NoError(t, w.Write(row, 0))
+	assert.FileExists(t, path)
+
+	var got []delivery.ExportArchivedEvent
+
+	require.NoError(t, w.DB().Find(&got).Error)
+	require.Len(t, got, 1)
+	assert.Equal(t, "ev-1", got[0].EventID)
+	assert.Equal(t, "wh-1", got[0].WebhookID)
+	assert.Equal(t, "ep-1", got[0].EntrypointID)
+	assert.Equal(t, row.Method, got[0].Method)
+	assert.Equal(t, row.ContentType, got[0].ContentType)
+	assert.JSONEq(t, `{"hello":"world"}`, got[0].Body)
+	assert.False(t, got[0].ArchivedAt.IsZero())
+}
+
+func TestArchiveWriter_RecreatesAfterRemoval(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "archive-wh.db")
+	w := delivery.NewExportArchiveWriter(
+		path, archiveTestLogger(), 0,
+	)
+
+	require.NoError(t, w.Write(
+		delivery.ExportArchivedEvent{EventID: "a"}, 0,
+	))
+	assert.FileExists(t, path)
+
+	// The operator moves the archive away while the handle is
+	// still open.
+	removeArchiveFiles(t, path)
+	require.NoFileExists(t, path)
+
+	// The next write recreates the file with a fresh schema and
+	// only the new row.
+	require.NoError(t, w.Write(
+		delivery.ExportArchivedEvent{EventID: "b"}, 0,
+	))
+	assert.FileExists(t, path)
+
+	var got []delivery.ExportArchivedEvent
+
+	require.NoError(t, w.DB().Find(&got).Error)
+	require.Len(t, got, 1)
+	assert.Equal(t, "b", got[0].EventID)
+}
+
+func TestArchiveWriter_ReopenDebounce(t *testing.T) {
+	t.Parallel()
+
+	// A generous debounce keeps the two rapid writes inside
+	// the window even on a heavily loaded test machine.
+	path := filepath.Join(t.TempDir(), "archive-wh.db")
+	w := delivery.NewExportArchiveWriter(
+		path, archiveTestLogger(), 2*time.Second,
+	)
+
+	require.NoError(t, w.Write(
+		delivery.ExportArchivedEvent{EventID: "a"}, 0,
+	))
+	require.NoError(t, w.Write(
+		delivery.ExportArchivedEvent{EventID: "b"}, 0,
+	))
+
+	// Two writes inside the debounce window trigger only the
+	// initial open — no extra close/reopen.
+	assert.Equal(t, 1, w.Reopens())
+
+	time.Sleep(2100 * time.Millisecond)
+
+	require.NoError(t, w.Write(
+		delivery.ExportArchivedEvent{EventID: "c"}, 0,
+	))
+
+	// A write after the window elapses closes and reopens once.
+	assert.Equal(t, 2, w.Reopens())
+}
+
+func TestArchiveWriter_ExpiryPrune(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "archive-wh.db")
+	w := delivery.NewExportArchiveWriter(
+		path, archiveTestLogger(), 0,
+	)
+
+	require.NoError(t, w.Open(0))
+
+	old := delivery.ExportArchivedEvent{
+		EventID:    "old",
+		ArchivedAt: time.Now().Add(-2 * time.Hour),
+	}
+	fresh := delivery.ExportArchivedEvent{
+		EventID:    "fresh",
+		ArchivedAt: time.Now(),
+	}
+
+	require.NoError(t, w.DB().Create(&old).Error)
+	require.NoError(t, w.DB().Create(&fresh).Error)
+
+	// Reopening with a one-hour expiry prunes the old row.
+	require.NoError(t, w.Reopen(time.Hour))
+
+	var got []delivery.ExportArchivedEvent
+
+	require.NoError(t, w.DB().Find(&got).Error)
+	require.Len(t, got, 1)
+	assert.Equal(t, "fresh", got[0].EventID)
+}
+
+func TestParseArchiveExpiry(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name    string
+		in      string
+		want    time.Duration
+		wantErr bool
+	}{
+		{"empty config", "", 0, false},
+		{"explicit never", `{"expiry":"never"}`, 0, false},
+		{"empty expiry", `{"expiry":""}`, 0, false},
+		{"duration", `{"expiry":"1h"}`, time.Hour, false},
+		{"unparseable", `{"expiry":"nonsense"}`, 0, true},
+		{"zero duration", `{"expiry":"0s"}`, 0, true},
+		{"negative duration", `{"expiry":"-5h"}`, 0, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := delivery.ExportParseArchiveExpiry(tc.in)
+			if tc.wantErr {
+				require.Error(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// seedDatabaseTargetDelivery seeds a pending delivery for a
+// database target with the given config JSON and returns the
+// in-memory delivery the target handler is invoked with.
+func seedDatabaseTargetDelivery(
+	t *testing.T,
+	webhookDB *gorm.DB,
+	event database.Event,
+	config string,
+) *database.Delivery {
+	t.Helper()
+
+	dlv := seedDelivery(
+		t, webhookDB, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name:   "test-db",
+			Type:   database.TargetTypeDatabase,
+			Config: config,
+		},
+	}
+	d.ID = dlv.ID
+
+	return d
+}
+
+// TestDeliverDatabase_ArchiveFailureFailsDelivery verifies that
+// an archive error (here: an unparseable expiry in the target
+// config) fails the delivery loudly: the attempt is recorded as
+// failed with the error and the delivery is marked failed, not
+// delivered.
+func TestDeliverDatabase_ArchiveFailureFailsDelivery(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	dataDir := t.TempDir()
+
+	e := delivery.NewTestEngineWithDB(
+		nil, database.NewTestWebhookDBManager(dataDir),
+		archiveTestLogger(),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":false}`)
+	d := seedDatabaseTargetDelivery(
+		t, webhookDB, event, `{"expiry":"nonsense"}`,
+	)
+
+	e.ExportDeliverDatabase(webhookDB, d)
+
+	var updated database.Delivery
+
+	require.NoError(t, webhookDB.First(
+		&updated, "id = ?", d.ID,
+	).Error)
+	assert.Equal(t,
+		database.DeliveryStatusFailed, updated.Status,
+		"archive failure must mark the delivery failed",
+	)
+
+	var results []database.DeliveryResult
+
+	require.NoError(t, webhookDB.Where(
+		"delivery_id = ?", d.ID,
+	).Find(&results).Error)
+	require.Len(t, results, 1)
+	assert.False(t,
+		results[0].Success,
+		"the attempt must be recorded as failed",
+	)
+	assert.Contains(t,
+		results[0].Error, "nonsense",
+		"the archive error must be recorded on the attempt",
+	)
+
+	assert.NoFileExists(t,
+		filepath.Join(
+			dataDir,
+			fmt.Sprintf("archive-%s.db", event.WebhookID),
+		),
+		"no archive file should exist for a failed config",
+	)
+}
+
+func TestValidateArchiveExpiry(t *testing.T) {
+	t.Parallel()
+
+	valid := []string{"", "never", "1h", "720h", "30m"}
+	for _, in := range valid {
+		require.NoError(t,
+			delivery.ValidateArchiveExpiry(in),
+			"expiry %q should be accepted", in,
+		)
+	}
+
+	invalid := []string{"nonsense", "7d", "-5h", "0s", "0"}
+	for _, in := range invalid {
+		require.Error(t,
+			delivery.ValidateArchiveExpiry(in),
+			"expiry %q should be rejected", in,
+		)
+	}
+}

internal/delivery/target_http.go

@@ -495,5 +495,5 @@ func applyRequestHeaders(
 func executeHTTPRequest(
 	client *http.Client, req *http.Request,
 ) (*http.Response, error) {
-	return client.Do(req) //#nosec G704 -- URL validated by parseHTTPConfig/parseSlackConfig and SSRF-safe transport
+	return client.Do(req) //#nosec G704 -- validated URL, SSRF-safe transport
 }

internal/handlers/auth.go

@@ -19,7 +19,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 
 		// Render login page
 		data := map[string]any{
-			"Error": "",
+			tmplKeyError: "",
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -86,7 +86,7 @@ func (h *Handlers) renderLoginError(
 	status int,
 ) {
 	data := map[string]any{
-		"Error": msg,
+		tmplKeyError: msg,
 	}
 
 	w.WriteHeader(status)

internal/handlers/export_test.go

@@ -13,12 +13,26 @@ func (s *Handlers) RenderTemplateForTest(
 	s.renderTemplate(w, r, pageTemplate, data)
 }
 
-// BuildSlackTargetConfigForTest exposes buildSlackTargetConfig
+// BuildSlackTargetConfigForTest exposes buildURLTargetConfig
-// for use in the handlers_test package.
+// with the Slack target parameters for use in the
+// handlers_test package.
 func (s *Handlers) BuildSlackTargetConfigForTest(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetURL string,
 ) (string, error) {
-	return s.buildSlackTargetConfig(w, r, targetURL)
+	return s.buildURLTargetConfig(
+		w, r, targetURL, "webhookUrl",
+		"Webhook URL is required for Slack targets",
+	)
+}
+
+// BuildDatabaseTargetConfigForTest exposes
+// buildDatabaseTargetConfig for use in the handlers_test
+// package.
+func (s *Handlers) BuildDatabaseTargetConfigForTest(
+	w http.ResponseWriter,
+	expiry string,
+) (string, error) {
+	return s.buildDatabaseTargetConfig(w, expiry)
 }

internal/handlers/handlers.go

@@ -30,6 +30,11 @@ const (
 	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
+
+	// tmplKeyError is the template data key for an error message.
+	tmplKeyError = "Error"
+	// tmplKeyWebhook is the template data key for a webhook.
+	tmplKeyWebhook = "Webhook"
 )
 
 // errInvalidPassword is returned when a password does not match.
@@ -46,6 +51,7 @@ type HandlersParams struct {
 	Healthcheck  *healthcheck.Healthcheck
 	Session      *session.Session
 	Notifier     delivery.Notifier
+	Evictor      delivery.WebhookEvictor
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -58,6 +64,7 @@ type Handlers struct {
 	dbMgr     *database.WebhookDBManager
 	session   *session.Session
 	notifier  delivery.Notifier
+	evictor   delivery.WebhookEvictor
 	templates map[string]*template.Template
 }
 
@@ -92,6 +99,7 @@ func New(
 	s.dbMgr = params.WebhookDBMgr
 	s.session = params.Session
 	s.notifier = params.Notifier
+	s.evictor = params.Evictor
 
 	// Parse all page templates once at startup
 	s.templates = map[string]*template.Template{

internal/handlers/handlers_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -24,6 +25,32 @@ type noopNotifier struct{}
 
 func (n *noopNotifier) Notify([]delivery.Task) {}
 
+// recordingEvictor is a delivery.WebhookEvictor that records
+// the webhook ids it was asked to evict, so a test can prove
+// that a deletion path reached the delivery engine.
+type recordingEvictor struct {
+	mu      sync.Mutex
+	evicted []string
+}
+
+func (r *recordingEvictor) EvictWebhook(webhookID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.evicted = append(r.evicted, webhookID)
+}
+
+// Evicted returns a copy of the recorded webhook ids.
+func (r *recordingEvictor) Evicted() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]string, len(r.evicted))
+	copy(out, r.evicted)
+
+	return out
+}
+
 func newTestApp(
 	t *testing.T,
 	targets ...any,
@@ -47,6 +74,12 @@ func newTestApp(
 			func() delivery.Notifier {
 				return &noopNotifier{}
 			},
+			func() *recordingEvictor {
+				return &recordingEvictor{}
+			},
+			func(r *recordingEvictor) delivery.WebhookEvictor {
+				return r
+			},
 			handlers.New,
 		),
 		fx.Populate(targets...),
@@ -186,3 +219,57 @@ func TestRenderTemplate(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 	)
 }
+
+func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	// Empty expiry: the keep-forever default, empty config.
+	w := httptest.NewRecorder()
+	cfg, err := h.BuildDatabaseTargetConfigForTest(w, "")
+	require.NoError(t, err)
+	assert.Empty(t, cfg)
+
+	// Explicit never is stored as config.
+	w = httptest.NewRecorder()
+	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "never")
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
+
+	// A positive duration is stored as config.
+	w = httptest.NewRecorder()
+	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "720h")
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
+}
+
+func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	for _, bad := range []string{"nonsense", "7d", "-5h"} {
+		w := httptest.NewRecorder()
+		cfg, err := h.BuildDatabaseTargetConfigForTest(w, bad)
+
+		require.Error(t, err, "expiry %q", bad)
+		assert.Empty(t, cfg)
+		assert.Equal(
+			t, http.StatusBadRequest, w.Code,
+			"expiry %q should be rejected with 400", bad,
+		)
+	}
+}

internal/handlers/profile.go

@@ -4,63 +4,202 @@ import (
 	"net/http"
 
 	"github.com/go-chi/chi"
+	"sneak.berlin/go/webhooker/internal/database"
 )
 
 // HandleProfile returns a handler for the user profile page
 func (h *Handlers) HandleProfile() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Get username from URL
+		sessionUserID, sessionUsername, ok :=
-		requestedUsername := chi.URLParam(r, "username")
+			h.profileOwnerOrDeny(w, r)
-		if requestedUsername == "" {
-			http.NotFound(w, r)
-
-			return
-		}
-
-		// Get session. RequireAuth middleware guarantees an
-		// authenticated session before this handler runs, so we
-		// only need to guard against an unexpected retrieval error.
-		sess, err := h.session.Get(r)
-		if err != nil {
-			h.log.Error("failed to get session", "error", err)
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
-			return
-		}
-
-		// Get user info from session
-		sessionUsername, ok := h.session.GetUsername(sess)
 		if !ok {
-			h.log.Error("authenticated session missing username")
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
 			return
 		}
 
-		sessionUserID, ok := h.session.GetUserID(sess)
+		h.renderProfile(w, r, sessionUserID, sessionUsername, "", "")
-		if !ok {
-			h.log.Error("authenticated session missing user ID")
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
-			return
-		}
-
-		// For now, only allow users to view their own profile
-		if requestedUsername != sessionUsername {
-			http.Error(w, "Forbidden", http.StatusForbidden)
-
-			return
-		}
-
-		// Prepare data for template
-		data := map[string]any{
-			"User": &UserInfo{
-				ID:       sessionUserID,
-				Username: sessionUsername,
-			},
-		}
-
-		// Render the profile page
-		h.renderTemplate(w, r, "profile.html", data)
 	}
 }
+
+// HandlePasswordChange returns a handler that lets an authenticated
+// user change their own password. It is served by the CSRF- and
+// auth-protected POST /password route under /user/{username}.
+func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		sessionUserID, sessionUsername, ok :=
+			h.profileOwnerOrDeny(w, r)
+		if !ok {
+			return
+		}
+
+		// Limit request body to prevent memory exhaustion.
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<maxBodyShift)
+
+		err := r.ParseForm()
+		if err != nil {
+			h.log.Error("failed to parse form", "error", err)
+			http.Error(w, "Bad request", http.StatusBadRequest)
+
+			return
+		}
+
+		successMessage, errorMessage, handled := h.applyPasswordChange(
+			w,
+			sessionUsername,
+			r.FormValue("current_password"),
+			r.FormValue("new_password"),
+			r.FormValue("confirm_password"),
+		)
+		if !handled {
+			return
+		}
+
+		h.renderProfile(
+			w, r, sessionUserID, sessionUsername,
+			successMessage, errorMessage,
+		)
+	}
+}
+
+// applyPasswordChange verifies the current password and, on success,
+// persists a fresh hash for the user, reusing the same helpers that
+// bootstrap the admin user. It returns the success and error messages
+// to display on the profile page. On an internal failure it writes a
+// 500 response itself and returns handled=false, signalling the caller
+// to stop without re-rendering the page.
+func (h *Handlers) applyPasswordChange(
+	w http.ResponseWriter,
+	username, currentPassword, newPassword, confirmPassword string,
+) (string, string, bool) {
+	// Load the user row so we can verify the current password and
+	// persist the new hash.
+	var user database.User
+
+	err := h.db.DB().Where(
+		"username = ?", username,
+	).First(&user).Error
+	if err != nil {
+		h.serverError(
+			w, "failed to load user for password change", err,
+		)
+
+		return "", "", false
+	}
+
+	valid, err := database.VerifyPassword(
+		currentPassword, user.Password,
+	)
+	if err != nil {
+		h.serverError(w, "failed to verify password", err)
+
+		return "", "", false
+	}
+
+	if !valid {
+		return "", "Current password is incorrect.", true
+	}
+
+	if newPassword == "" {
+		return "", "New password must not be empty.", true
+	}
+
+	if newPassword != confirmPassword {
+		return "", "New password and confirmation do not match.", true
+	}
+
+	hashedPassword, err := database.HashPassword(newPassword)
+	if err != nil {
+		h.serverError(w, "failed to hash new password", err)
+
+		return "", "", false
+	}
+
+	err = h.db.DB().Model(&user).Update(
+		"password", hashedPassword,
+	).Error
+	if err != nil {
+		h.serverError(w, "failed to update password", err)
+
+		return "", "", false
+	}
+
+	h.log.Info("user changed password", "username", username)
+
+	return "Password changed successfully.", "", true
+}
+
+// profileOwnerOrDeny resolves the session identity and enforces that a
+// user may only act on their own profile (the requested username in the
+// URL must equal the session username). On any failure it writes the
+// appropriate HTTP response and returns ok=false; callers must stop
+// when ok is false.
+func (h *Handlers) profileOwnerOrDeny(
+	w http.ResponseWriter,
+	r *http.Request,
+) (string, string, bool) {
+	requestedUsername := chi.URLParam(r, "username")
+	if requestedUsername == "" {
+		http.NotFound(w, r)
+
+		return "", "", false
+	}
+
+	// RequireAuth middleware guarantees an authenticated session
+	// before this handler runs, so we only need to guard against an
+	// unexpected retrieval error.
+	sess, err := h.session.Get(r)
+	if err != nil {
+		h.serverError(w, "failed to get session", err)
+
+		return "", "", false
+	}
+
+	sessionUsername, ok := h.session.GetUsername(sess)
+	if !ok {
+		h.log.Error("authenticated session missing username")
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
+
+		return "", "", false
+	}
+
+	sessionUserID, ok := h.session.GetUserID(sess)
+	if !ok {
+		h.log.Error("authenticated session missing user ID")
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
+
+		return "", "", false
+	}
+
+	// Only allow users to act on their own profile.
+	if requestedUsername != sessionUsername {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+
+		return "", "", false
+	}
+
+	return sessionUserID, sessionUsername, true
+}
+
+// renderProfile renders the profile page for the given user,
+// optionally including a success or error message.
+func (h *Handlers) renderProfile(
+	w http.ResponseWriter,
+	r *http.Request,
+	userID, username, successMessage, errorMessage string,
+) {
+	data := map[string]any{
+		"User": &UserInfo{
+			ID:       userID,
+			Username: username,
+		},
+		"SuccessMessage": successMessage,
+		"ErrorMessage":   errorMessage,
+	}
+
+	h.renderTemplate(w, r, "profile.html", data)
+}

internal/handlers/profile_test.go

@@ -4,12 +4,15 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/middleware"
@@ -157,3 +160,134 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
+
+// passwordChangeRequest builds a POST request to the password-change
+// endpoint for the given username, attaching the supplied cookies, an
+// urlencoded form body, and the chi URL parameter the handler reads.
+func passwordChangeRequest(
+	username string,
+	cookies []*http.Cookie,
+	form url.Values,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost,
+		"/user/"+username+"/password",
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("username", username)
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+func TestHandlePasswordChange_Success(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser")
+
+	form := url.Values{}
+	form.Set("current_password", "oldpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Password changed successfully.",
+	)
+
+	var updated database.User
+
+	require.NoError(t,
+		db.DB().Where("username = ?", "pwuser").First(&updated).Error,
+	)
+	assert.NotEqual(t, oldHash, updated.Password)
+
+	valid, err := database.VerifyPassword(
+		"newpassword", updated.Password,
+	)
+	require.NoError(t, err)
+	assert.True(t, valid, "new password should verify against new hash")
+}
+
+func TestHandlePasswordChange_WrongCurrentPassword(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser2", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser2")
+
+	form := url.Values{}
+	form.Set("current_password", "wrongpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser2", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Current password is incorrect.",
+	)
+
+	var unchanged database.User
+
+	require.NoError(t,
+		db.DB().Where(
+			"username = ?", "pwuser2",
+		).First(&unchanged).Error,
+	)
+	assert.Equal(
+		t, oldHash, unchanged.Password,
+		"stored hash must be unchanged after a rejected change",
+	)
+}

internal/handlers/source_delete_test.go

@@ -0,0 +1,305 @@
+package handlers_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+const (
+	deleteTestUserID   = "test-user-id"
+	deleteTestUsername = "testuser"
+
+	// paramSourceID and paramTargetID are the chi URL parameter
+	// names the deletion handlers read.
+	paramSourceID = "sourceID"
+	paramTargetID = "targetID"
+)
+
+// seedWebhook inserts a webhook owned by the test user and
+// returns it.
+func seedWebhook(
+	t *testing.T,
+	db *database.Database,
+) *database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID,
+		Name:   "delete-me",
+	}
+
+	require.NoError(
+		t,
+		db.DB().Omit(clause.Associations).Create(wh).Error,
+	)
+
+	return wh
+}
+
+// seedTarget inserts a target of the given type for a webhook
+// and returns it.
+func seedTarget(
+	t *testing.T,
+	db *database.Database,
+	webhookID string,
+	targetType database.TargetType,
+) *database.Target {
+	t.Helper()
+
+	tgt := &database.Target{
+		WebhookID: webhookID,
+		Name:      "t-" + string(targetType),
+		Type:      targetType,
+		Active:    true,
+	}
+
+	require.NoError(
+		t,
+		db.DB().Omit(clause.Associations).Create(tgt).Error,
+	)
+
+	return tgt
+}
+
+// archivePathFor returns the archive database path the
+// delivery engine would use for a webhook: beside the webhook's
+// event database in the data directory.
+func archivePathFor(
+	t *testing.T,
+	mgr *database.WebhookDBManager,
+	webhookID string,
+) string {
+	t.Helper()
+
+	return filepath.Join(
+		filepath.Dir(mgr.DBPath(webhookID)),
+		"archive-"+webhookID+".db",
+	)
+}
+
+// writeArchivePlaceholder creates a stand-in archive file so a
+// test can assert the file survives webhook deletion.
+func writeArchivePlaceholder(path string) error {
+	return os.WriteFile(path, []byte("archive"), 0o600)
+}
+
+// postRequest builds an authenticated POST request carrying the
+// given chi URL parameters.
+func postRequest(
+	path string,
+	cookies []*http.Cookie,
+	params map[string]string,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, path, nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	for k, v := range params {
+		rctx.URLParams.Add(k, v)
+	}
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+// TestHandleSourceDelete_EvictsArchiveWriter proves that
+// deleting a webhook reaches the delivery engine and releases
+// the webhook's archive writer, exercised through the real
+// deletion handler rather than by calling the evictor directly.
+func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/delete",
+		cookies,
+		map[string]string{paramSourceID: wh.ID},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleSourceDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, []string{wh.ID}, ev.Evicted(),
+		"deleting a webhook should evict its archive writer",
+	)
+}
+
+// TestHandleSourceDelete_KeepsArchiveFile proves that deleting
+// a webhook does not remove its archive database file: the
+// archive is long-term storage the operator owns.
+func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		mgr  *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &mgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	// Place an archive file where the delivery engine would.
+	archivePath := archivePathFor(t, mgr, wh.ID)
+	require.NoError(
+		t,
+		writeArchivePlaceholder(archivePath),
+	)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/delete",
+		cookies,
+		map[string]string{paramSourceID: wh.ID},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleSourceDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.FileExists(
+		t, archivePath,
+		"webhook deletion must not destroy the archive file",
+	)
+}
+
+// TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone
+// proves that removing the last database target releases the
+// archive writer.
+func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	tgt := seedTarget(
+		t, db, wh.ID, database.TargetTypeDatabase,
+	)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete",
+		cookies,
+		map[string]string{
+			paramSourceID: wh.ID,
+			paramTargetID: tgt.ID,
+		},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleTargetDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, []string{wh.ID}, ev.Evicted(),
+		"removing the last database target should evict",
+	)
+}
+
+// TestHandleTargetDelete_KeepsWriterWhileDatabaseTargetRemains
+// proves that deleting an unrelated target, or one of several
+// database targets, leaves a still-needed archive writer alone.
+func TestHandleTargetDelete_KeepsWriterWhileDatabaseTargetRemains(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
+	other := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/targets/"+other.ID+"/delete",
+		cookies,
+		map[string]string{
+			paramSourceID: wh.ID,
+			paramTargetID: other.ID,
+		},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleTargetDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Empty(
+		t, ev.Evicted(),
+		"a surviving database target must keep its writer",
+	)
+}

internal/handlers/source_management.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net/http"
 	"strconv"
+	"strings"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -106,7 +107,7 @@ func (h *Handlers) buildWebhookListItems(
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		data := map[string]any{
-			"Error": "",
+			tmplKeyError: "",
 		}
 
 		h.renderTemplate(w, r, "sources_new.html", data)
@@ -145,7 +146,7 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 
 		if name == "" {
 			data := map[string]any{
-				"Error": "Name is required",
+				tmplKeyError: "Name is required",
 			}
 
 			w.WriteHeader(http.StatusBadRequest)
@@ -315,11 +316,11 @@ func (h *Handlers) renderSourceDetail(
 	}
 
 	data := map[string]any{
-		"Webhook":     webhook,
+		tmplKeyWebhook: webhook,
-		"Entrypoints": entrypoints,
+		"Entrypoints":  entrypoints,
-		"Targets":     targets,
+		"Targets":      targets,
-		"Events":      events,
+		"Events":       events,
-		"BaseURL":     scheme + "://" + host,
+		"BaseURL":      scheme + "://" + host,
 	}
 
 	h.renderTemplate(w, r, "source_detail.html", data)
@@ -351,8 +352,8 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook": webhook,
+			tmplKeyWebhook: webhook,
-			"Error":   "",
+			tmplKeyError:   "",
 		}
 
 		h.renderTemplate(w, r, "source_edit.html", data)
@@ -415,8 +416,8 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			"Webhook": *webhook,
+			tmplKeyWebhook: *webhook,
-			"Error":   "Name is required",
+			tmplKeyError:   "Name is required",
 		}
 
 		w.WriteHeader(http.StatusBadRequest)
@@ -532,6 +533,13 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}
 
+	// Release the delivery engine's per-webhook archiving state
+	// so a deleted webhook's archive writer (and any handle open
+	// within its debounce window) does not linger for the
+	// process lifetime. The archive file itself is deliberately
+	// left on disk; see evictArchiveWriter.
+	h.evictArchiveWriter(webhook.ID)
+
 	err = h.dbMgr.DeleteDB(webhook.ID)
 	if err != nil {
 		h.log.Error(
@@ -550,6 +558,64 @@ func (h *Handlers) deleteWebhookResources(
 	http.Redirect(w, r, "/sources", http.StatusSeeOther)
 }
 
+// evictArchiveWriter asks the delivery engine to drop its
+// cached archive writer for a webhook, closing the archive file
+// handle.
+//
+// The archive database file is NOT deleted. Unlike the event
+// database — which is per-webhook working storage and is
+// hard-deleted with the webhook — an archive is explicitly
+// long-term storage that an operator may want to keep or move
+// away for offline retention. Destroying it as a side effect of
+// deleting a webhook would be a surprising and unrecoverable
+// data loss, so the file is left for the operator to handle.
+func (h *Handlers) evictArchiveWriter(webhookID string) {
+	if h.evictor == nil {
+		return
+	}
+
+	h.evictor.EvictWebhook(webhookID)
+}
+
+// evictArchiveWriterIfUnused releases a webhook's archive
+// writer once the webhook has no database target left to feed
+// it.
+//
+// It is called after any child resource of a webhook is
+// deleted, and is correct without knowing which kind was: it
+// evicts only when no database target remains, so deleting one
+// of several database targets — or deleting an unrelated
+// target type — leaves a still-needed writer alone. When no
+// database target ever existed there is no writer and eviction
+// is a no-op. Soft-deleted targets are excluded by GORM's
+// default scope, so the row just deleted is not counted.
+func (h *Handlers) evictArchiveWriterIfUnused(webhookID string) {
+	var remaining int64
+
+	err := h.db.DB().
+		Model(&database.Target{}).
+		Where(
+			"webhook_id = ? AND type = ?",
+			webhookID, database.TargetTypeDatabase,
+		).
+		Count(&remaining).Error
+	if err != nil {
+		h.log.Error(
+			"failed to count remaining database targets",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if remaining > 0 {
+		return
+	}
+
+	h.evictArchiveWriter(webhookID)
+}
+
 // HandleSourceLogs shows the request/response logs for a
 // webhook.
 func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
@@ -589,15 +655,15 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook":     webhook,
+			tmplKeyWebhook: webhook,
-			"Events":      evts,
+			"Events":       evts,
-			"Page":        page,
+			"Page":         page,
-			"TotalPages":  totalPages,
+			"TotalPages":   totalPages,
-			"TotalEvents": total,
+			"TotalEvents":  total,
-			"HasPrev":     page > 1,
+			"HasPrev":      page > 1,
-			"HasNext":     page < totalPages,
+			"HasNext":      page < totalPages,
-			"PrevPage":    page - 1,
+			"PrevPage":     page - 1,
-			"NextPage":    page + 1,
+			"NextPage":     page + 1,
 		}
 
 		h.renderTemplate(w, r, "source_logs.html", data)
@@ -815,6 +881,7 @@ func (h *Handlers) processTargetCreate(
 	targetType := database.TargetType(r.FormValue("type"))
 	targetURL := r.FormValue("url")
 	maxRetriesStr := r.FormValue("max_retries")
+	expiry := r.FormValue("expiry")
 
 	if name == "" {
 		http.Error(
@@ -834,7 +901,7 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	configJSON, err := h.buildTargetConfig(
-		w, r, targetType, targetURL,
+		w, r, targetType, targetURL, expiry,
 	)
 	if err != nil {
 		return
@@ -892,18 +959,28 @@ func parseNonNegativeInt(s string) int {
 }
 
 // buildTargetConfig builds the JSON config string for a target.
+// The expiry form value is read by the caller (which bounds the
+// request body) and applies to database targets only.
 func (h *Handlers) buildTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetType database.TargetType,
-	targetURL string,
+	targetURL, expiry string,
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
-		return h.buildHTTPTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
+			w, r, targetURL, "url",
+			"URL is required for HTTP targets",
+		)
 	case database.TargetTypeSlack:
-		return h.buildSlackTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
-	case database.TargetTypeDatabase, database.TargetTypeLog:
+			w, r, targetURL, "webhookUrl",
+			"Webhook URL is required for Slack targets",
+		)
+	case database.TargetTypeDatabase:
+		return h.buildDatabaseTargetConfig(w, expiry)
+	case database.TargetTypeLog:
 		return "", nil
 	default:
 		http.Error(
@@ -915,16 +992,18 @@ func (h *Handlers) buildTargetConfig(
 	}
 }
 
-// buildHTTPTargetConfig builds config JSON for an HTTP target.
+// buildURLTargetConfig builds config JSON for a target whose
-func (h *Handlers) buildHTTPTargetConfig(
+// configuration is a single SSRF-validated URL stored under
+// configKey. missingMsg is the error shown when no URL is given.
+func (h *Handlers) buildURLTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
-	targetURL string,
+	targetURL, configKey, missingMsg string,
 ) (string, error) {
 	if targetURL == "" {
 		http.Error(
 			w,
-			"URL is required for HTTP targets",
+			missingMsg,
 			http.StatusBadRequest,
 		)
 
@@ -949,7 +1028,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 		return "", err
 	}
 
-	cfg := map[string]any{"url": targetURL}
+	cfg := map[string]any{configKey: targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
@@ -964,41 +1043,33 @@ func (h *Handlers) buildHTTPTargetConfig(
 	return string(configBytes), nil
 }
 
-// buildSlackTargetConfig builds config JSON for a Slack target.
+// buildDatabaseTargetConfig builds config JSON for a database
-func (h *Handlers) buildSlackTargetConfig(
+// (archive) target. The optional expiry (a form value read by
+// the caller, which bounds the request body) is validated here,
+// at creation time, so an unparseable value is rejected with a
+// 400 instead of failing every subsequent delivery. An empty
+// expiry yields an empty config (the keep-forever default).
+func (h *Handlers) buildDatabaseTargetConfig(
 	w http.ResponseWriter,
-	r *http.Request,
+	expiry string,
-	targetURL string,
 ) (string, error) {
-	if targetURL == "" {
+	expiry = strings.TrimSpace(expiry)
-		http.Error(
+	if expiry == "" {
-			w,
+		return "", nil
-			"Webhook URL is required for Slack targets",
-			http.StatusBadRequest,
-		)
-
-		return "", errMissingURL
 	}
 
-	err := delivery.ValidateTargetURL(
+	err := delivery.ValidateArchiveExpiry(expiry)
-		r.Context(), targetURL,
-	)
 	if err != nil {
-		h.log.Warn(
-			"target URL blocked by SSRF protection",
-			"url", targetURL,
-			"error", err,
-		)
 		http.Error(
 			w,
-			"Invalid target URL: "+err.Error(),
+			"Invalid archive expiry: "+err.Error(),
 			http.StatusBadRequest,
 		)
 
 		return "", err
 	}
 
-	cfg := map[string]any{"webhookUrl": targetURL}
+	cfg := map[string]any{"expiry": expiry}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
@@ -1018,23 +1089,31 @@ func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"entrypointID", &database.Entrypoint{},
 		"failed to delete entrypoint",
+		nil,
 	)
 }
 
-// HandleTargetDelete handles deleting a target.
+// HandleTargetDelete handles deleting a target. Deleting the
+// last database target of a webhook leaves its archive writer
+// with nothing to write, so the writer is evicted and its
+// handle closed; the archive file is left on disk.
 func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"targetID", &database.Target{},
 		"failed to delete target",
+		h.evictArchiveWriterIfUnused,
 	)
 }
 
 // deleteChildResource returns a handler that deletes a child
-// resource (entrypoint or target) belonging to a webhook.
+// resource (entrypoint or target) belonging to a webhook. The
+// optional afterDelete hook runs with the webhook's id once the
+// delete has succeeded, before the redirect.
 func (h *Handlers) deleteChildResource(
 	idParam string,
 	model any,
 	errMsg string,
+	afterDelete func(webhookID string),
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1074,6 +1153,10 @@ func (h *Handlers) deleteChildResource(
 			return
 		}
 
+		if afterDelete != nil {
+			afterDelete(webhook.ID)
+		}
+
 		http.Redirect(
 			w, r,
 			"/source/"+webhook.ID,

internal/middleware/export_test.go

@@ -32,3 +32,7 @@ func IsClientTLS(r *http.Request) bool {
 
 // LoginRateLimitConst exposes the loginRateLimit constant.
 const LoginRateLimitConst = loginRateLimit
+
+// PasswordChangeRateLimitConst exposes the
+// passwordChangeRateLimit constant.
+const PasswordChangeRateLimitConst = passwordChangeRateLimit

internal/middleware/middleware_test.go

@@ -484,8 +484,13 @@ func metricsAuthMiddleware(
 	return middleware.NewForTest(log, cfg, sessManager)
 }
 
-func TestMetricsAuth_ValidCredentials(t *testing.T) {
+// runMetricsAuthRequest sends a GET /metrics request with the
-	t.Parallel()
+// given basic-auth password through MetricsAuth and reports
+// whether the wrapped handler ran plus the recorded response.
+func runMetricsAuthRequest(
+	t *testing.T, password string,
+) (bool, *httptest.ResponseRecorder) {
+	t.Helper()
 
 	m := metricsAuthMiddleware(t)
 
@@ -503,12 +508,20 @@ func TestMetricsAuth_ValidCredentials(t *testing.T) {
 		context.Background(),
 		http.MethodGet, "/metrics", nil,
 	)
-	req.SetBasicAuth("admin", "secret")
+	req.SetBasicAuth("admin", password)
 
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
+	return called, w
+}
+
+func TestMetricsAuth_ValidCredentials(t *testing.T) {
+	t.Parallel()
+
+	called, w := runMetricsAuthRequest(t, "secret")
+
 	assert.True(
 		t, called,
 		"handler should be called with valid basic auth",
@@ -519,27 +532,7 @@ func TestMetricsAuth_ValidCredentials(t *testing.T) {
 func TestMetricsAuth_InvalidCredentials(t *testing.T) {
 	t.Parallel()
 
-	m := metricsAuthMiddleware(t)
+	called, w := runMetricsAuthRequest(t, "wrong-password")
-
-	var called bool
-
-	handler := m.MetricsAuth()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			called = true
-
-			w.WriteHeader(http.StatusOK)
-		},
-	))
-
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodGet, "/metrics", nil,
-	)
-	req.SetBasicAuth("admin", "wrong-password")
-
-	w := httptest.NewRecorder()
-
-	handler.ServeHTTP(w, req)
 
 	assert.False(
 		t, called,

internal/middleware/ratelimit.go

@@ -14,6 +14,16 @@ const (
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
+
+	// passwordChangeRateLimit is the maximum number of password
+	// change attempts per interval. Each attempt verifies the
+	// current password, so the endpoint must be rate-limited
+	// like any other password-based authentication endpoint.
+	passwordChangeRateLimit = 5
+
+	// passwordChangeRateInterval is the time window for the
+	// password change rate limit.
+	passwordChangeRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -24,19 +34,53 @@ const (
 // honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
 // for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
-	limiter := httprate.Limit(
+	return m.postRateLimit(
 		loginRateLimit,
 		loginRateInterval,
+		"login rate limit exceeded",
+		"Too many login attempts. Please try again later.",
+	)
+}
+
+// PasswordChangeRateLimit returns middleware that enforces
+// per-IP rate limiting on password change attempts. The change
+// endpoint verifies the current password, so without a limit a
+// stolen session could be used to brute-force it; the limit
+// matches the login endpoint's.
+func (m *Middleware) PasswordChangeRateLimit() func(http.Handler) http.Handler {
+	return m.postRateLimit(
+		passwordChangeRateLimit,
+		passwordChangeRateInterval,
+		"password change rate limit exceeded",
+		"Too many password change attempts. "+
+			"Please try again later.",
+	)
+}
+
+// postRateLimit builds middleware that enforces a per-IP rate
+// limit on POST requests only; all other methods pass through
+// unaffected. Requests over the limit receive a 429 with the
+// given response message, and each rejection is logged with the
+// given log message. IP extraction honours X-Forwarded-For,
+// X-Real-IP, and True-Client-IP headers for reverse-proxy
+// setups.
+func (m *Middleware) postRateLimit(
+	limit int,
+	interval time.Duration,
+	logMessage, responseMessage string,
+) func(http.Handler) http.Handler {
+	limiter := httprate.Limit(
+		limit,
+		interval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
 		httprate.WithLimitHandler(http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				m.log.Warn("login rate limit exceeded",
+				m.log.Warn(logMessage,
 					"path", r.URL.Path,
 				)
 				http.Error(
 					w,
-					"Too many login attempts. "+
+					responseMessage,
-						"Please try again later.",
 					http.StatusTooManyRequests,
 				)
 			},
@@ -50,8 +94,7 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			// Only rate-limit POST requests (actual login
+			// Only rate-limit POST requests.
-			// attempts)
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)
 

internal/middleware/ratelimit_test.go

@@ -46,14 +46,20 @@ func TestLoginRateLimit_AllowsGET(t *testing.T) {
 	assert.Equal(t, 20, callCount)
 }
 
-func TestLoginRateLimit_LimitsPOST(t *testing.T) {
+// runPostLimitTest exercises a POST-only rate limit middleware:
-	t.Parallel()
+// the first limit POSTs to path from ip must pass, and the next
-
+// one must be rejected with 429 without reaching the handler.
-	m, _ := testMiddleware(t, config.EnvironmentDev)
+func runPostLimitTest(
+	t *testing.T,
+	mw func(http.Handler) http.Handler,
+	limit int,
+	path, ip string,
+) {
+	t.Helper()
 
 	var callCount int
 
-	handler := m.LoginRateLimit()(http.HandlerFunc(
+	handler := mw(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			callCount++
 
@@ -61,13 +67,13 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		},
 	))
 
-	// First loginRateLimit POST requests should succeed
+	// The first limit POST requests should succeed
-	for i := range middleware.LoginRateLimitConst {
+	for i := range limit {
 		req := httptest.NewRequestWithContext(
 			context.Background(),
-			http.MethodPost, "/pages/login", nil,
+			http.MethodPost, path, nil,
 		)
-		req.RemoteAddr = "10.0.0.1:12345"
+		req.RemoteAddr = ip
 
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
@@ -81,9 +87,9 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 	// Next POST should be rate-limited
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodPost, "/pages/login", nil,
+		http.MethodPost, path, nil,
 	)
-	req.RemoteAddr = "10.0.0.1:12345"
+	req.RemoteAddr = ip
 
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
@@ -92,7 +98,35 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		t, http.StatusTooManyRequests, w.Code,
 		"POST after limit should be 429",
 	)
-	assert.Equal(t, middleware.LoginRateLimitConst, callCount)
+	assert.Equal(t, limit, callCount)
+}
+
+func TestLoginRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.LoginRateLimit(),
+		middleware.LoginRateLimitConst,
+		"/pages/login",
+		"10.0.0.1:12345",
+	)
+}
+
+func TestPasswordChangeRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.PasswordChangeRateLimit(),
+		middleware.PasswordChangeRateLimitConst,
+		"/user/admin/password",
+		"10.0.0.2:12345",
+	)
 }
 
 func TestLoginRateLimit_IndependentPerIP(t *testing.T) {

internal/server/routes.go

@@ -110,6 +110,9 @@ func (s *Server) setupUserRoutes() {
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
+		r.With(s.mw.PasswordChangeRateLimit()).Post(
+			"/password", s.h.HandlePasswordChange(),
+		)
 	})
 }
 

internal/session/session_test.go

@@ -173,8 +173,18 @@ func TestSetUser_SetsAllFields(t *testing.T) {
 	)
 }
 
-func TestGetUserID(t *testing.T) {
+// testSessionGetter exercises a session string getter before and
-	t.Parallel()
+// after SetUser: it must report false with an empty value on a
+// fresh session, then true with the expected value once
+// SetUser(sess, "user-xyz", "bob") has run.
+func testSessionGetter(
+	t *testing.T,
+	get func(
+		*session.Session, *sessions.Session,
+	) (string, bool),
+	expected string,
+) {
+	t.Helper()
 
 	s := testSession(t)
 
@@ -185,44 +195,46 @@ func TestGetUserID(t *testing.T) {
 	require.NoError(t, err)
 
 	// Before setting user
-	userID, ok := s.GetUserID(sess)
+	val, ok := get(s, sess)
 	assert.False(
-		t, ok, "should return false when no user ID is set",
+		t, ok, "should return false before SetUser",
 	)
-	assert.Empty(t, userID)
+	assert.Empty(t, val)
 
 	// After setting user
 	s.SetUser(sess, "user-xyz", "bob")
 
-	userID, ok = s.GetUserID(sess)
+	val, ok = get(s, sess)
 	assert.True(t, ok)
-	assert.Equal(t, "user-xyz", userID)
+	assert.Equal(t, expected, val)
+}
+
+func TestGetUserID(t *testing.T) {
+	t.Parallel()
+
+	testSessionGetter(
+		t,
+		func(
+			s *session.Session, sess *sessions.Session,
+		) (string, bool) {
+			return s.GetUserID(sess)
+		},
+		"user-xyz",
+	)
 }
 
 func TestGetUsername(t *testing.T) {
 	t.Parallel()
 
-	s := testSession(t)
+	testSessionGetter(
-
+		t,
-	req := httptest.NewRequestWithContext(
+		func(
-		context.Background(), http.MethodGet, "/", nil)
+			s *session.Session, sess *sessions.Session,
-
+		) (string, bool) {
-	sess, err := s.Get(req)
+			return s.GetUsername(sess)
-	require.NoError(t, err)
+		},
-
+		"bob",
-	// Before setting user
-	username, ok := s.GetUsername(sess)
-	assert.False(
-		t, ok, "should return false when no username is set",
 	)
-	assert.Empty(t, username)
-
-	// After setting user
-	s.SetUser(sess, "user-xyz", "bob")
-
-	username, ok = s.GetUsername(sess)
-	assert.True(t, ok)
-	assert.Equal(t, "bob", username)
 }
 
 // --- IsAuthenticated Tests ---

internal/session/testing.go

@@ -12,7 +12,12 @@ import (
 // middleware and handler tests to use real session functionality. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
-func NewForTest(store *sessions.CookieStore, cfg *config.Config, log *slog.Logger, key []byte) *Session {
+func NewForTest(
+	store *sessions.CookieStore,
+	cfg *config.Config,
+	log *slog.Logger,
+	key []byte,
+) *Session {
 	return &Session{
 		store:  store,
 		key:    key,

script/bootstrap

@@ -10,11 +10,11 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-07-07. Never "latest"; exact versions only.
+# Pinned versions, 2026-08-07. Never "latest"; exact versions only.
-GOLANGCI_LINT_VERSION="2.11.3"
+GOLANGCI_LINT_VERSION="2.12.2"
-# sha256 of golangci-lint-2.11.3-linux-<arch>.tar.gz release archives
+# sha256 of golangci-lint-2.12.2-linux-<arch>.tar.gz release archives
-GOLANGCI_LINT_SHA256_AMD64="87bb8cddbcc825d5778b64e8a91b46c0526b247f4e2f2904dea74ec7450475d1"
+GOLANGCI_LINT_SHA256_AMD64="8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
-GOLANGCI_LINT_SHA256_ARM64="ee3d95f301359e7d578e6d99c8ad5aeadbabc5a13009a30b2b0df11c8058afe9"
+GOLANGCI_LINT_SHA256_ARM64="44cd40a8c76c86755375adfeea52cfd3533cb43d7bd647771e0ae065e166df3a"
 
 PKGMGR=""
 SUDO=""

templates/profile.html

@@ -6,6 +6,18 @@
 <div class="max-w-4xl mx-auto px-6 py-12">
     <h1 class="text-2xl font-medium text-gray-900 mb-6">User Profile</h1>
 
+    {{if .SuccessMessage}}
+    <div class="alert-success">
+        <span>{{.SuccessMessage}}</span>
+    </div>
+    {{end}}
+
+    {{if .ErrorMessage}}
+    <div class="alert-error">
+        <span>{{.ErrorMessage}}</span>
+    </div>
+    {{end}}
+
     <div class="card p-6">
         <div class="flex items-center mb-6">
             <div class="mr-4">
@@ -43,6 +55,50 @@
         </div>
     </div>
 
+    <div class="card p-6 mt-6">
+        <h3 class="text-lg font-medium text-gray-900 mb-3">Change Password</h3>
+        <form method="POST" action="/user/{{.User.Username}}/password" class="space-y-6">
+            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+            <div class="form-group">
+                <label for="current_password" class="label">Current Password</label>
+                <input
+                    type="password"
+                    id="current_password"
+                    name="current_password"
+                    required
+                    autocomplete="current-password"
+                    class="input"
+                >
+            </div>
+
+            <div class="form-group">
+                <label for="new_password" class="label">New Password</label>
+                <input
+                    type="password"
+                    id="new_password"
+                    name="new_password"
+                    required
+                    autocomplete="new-password"
+                    class="input"
+                >
+            </div>
+
+            <div class="form-group">
+                <label for="confirm_password" class="label">Confirm New Password</label>
+                <input
+                    type="password"
+                    id="confirm_password"
+                    name="confirm_password"
+                    required
+                    autocomplete="new-password"
+                    class="input"
+                >
+            </div>
+
+            <button type="submit" class="btn-primary">Change Password</button>
+        </form>
+    </div>
+
     <div class="mt-6">
         <a href="/" class="btn-secondary">Back to Home</a>
     </div>

templates/source_detail.html

@@ -113,6 +113,10 @@
                         <input type="url" name="url" placeholder="https://hooks.slack.com/services/..." :disabled="targetType !== 'slack'" class="input text-sm">
                         <p class="text-xs text-gray-500 mt-1">Slack or Mattermost incoming webhook URL. Payloads are pretty-printed in code blocks.</p>
                     </div>
+                    <div x-show="targetType === 'database'">
+                        <input type="text" name="expiry" placeholder="never" :disabled="targetType !== 'database'" class="input text-sm">
+                        <p class="text-xs text-gray-500 mt-1">Archive expiry: "never" (default) keeps rows forever, or a duration like "720h" prunes older rows.</p>
+                    </div>
                     <button type="submit" class="btn-primary text-sm">Add Target</button>
                 </form>
             </div>