Rate-limit the password change endpoint (#65)

The password change POST verifies the current password, making it
a password-based authentication endpoint that REPO_POLICIES.md
requires rate limiting on. Extract the login limiter's POST-only
per-IP pattern into a shared postRateLimit helper and apply the
same 5-per-minute limit to POST /user/{username}/password.

cmd/webhooker/main.go

@@ -34,6 +34,7 @@ func main() {
 			config.New,
 			database.New,
 			database.NewWebhookDBManager,
+			database.NewRetentionReaper,
 			healthcheck.New,
 			session.New,
 			handlers.New,
@@ -44,6 +45,13 @@ func main() {
 			func(e *delivery.Engine) delivery.Notifier { return e },
 			server.New,
 		),
-		fx.Invoke(func(*server.Server, *delivery.Engine) {}),
+		fx.Invoke(
+			func(
+				*server.Server,
+				*delivery.Engine,
+				*database.RetentionReaper,
+			) {
+			},
+		),
 	).Run()
 }

internal/config/config.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/globals"
@@ -26,6 +27,10 @@ const (
 
 	// defaultPort is the default HTTP listen port.
 	defaultPort = 8080
+
+	// defaultRetentionSweepInterval is how often the retention
+	// reaper deletes events older than each webhook's RetentionDays.
+	defaultRetentionSweepInterval = time.Hour
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
@@ -51,8 +56,12 @@ type Config struct {
 	MetricsUsername string
 	Port            int
 	SentryDSN       string
-	params          *ConfigParams
+
-	log             *slog.Logger
+	// RetentionSweepInterval is how often the retention reaper runs.
+	RetentionSweepInterval time.Duration
+
+	params *ConfigParams
+	log    *slog.Logger
 }
 
 // IsDev returns true if running in development environment.
@@ -95,6 +104,30 @@ func envInt(key string, defaultValue int) int {
 	return defaultValue
 }
 
+// envDuration returns the value of the named environment variable
+// parsed as a Go duration (e.g. "1h", "30m"). Returns defaultValue if
+// not set. If the variable is set but cannot be parsed, it returns a
+// wrapped error naming the key and the bad value, so startup fails
+// loudly rather than silently falling back to the default.
+func envDuration(
+	key string,
+	defaultValue time.Duration,
+) (time.Duration, error) {
+	v := os.Getenv(key)
+	if v == "" {
+		return defaultValue, nil
+	}
+
+	d, err := time.ParseDuration(v)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"invalid duration for %s: %q: %w", key, v, err,
+		)
+	}
+
+	return d, nil
+}
+
 // New creates a Config by reading environment variables.
 //
 //nolint:revive // lc parameter is required by fx even if unused.
@@ -118,18 +151,30 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		)
 	}
 
+	// Parse the retention sweep interval; a set-but-unparseable value
+	// is a hard error so fx aborts startup rather than silently using
+	// the default.
+	retentionSweepInterval, err := envDuration(
+		"RETENTION_SWEEP_INTERVAL",
+		defaultRetentionSweepInterval,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	// Load configuration values from environment variables
 	s := &Config{
-		DataDir:         envString("DATA_DIR"),
+		DataDir:                envString("DATA_DIR"),
-		Debug:           envBool("DEBUG", false),
+		Debug:                  envBool("DEBUG", false),
-		MaintenanceMode: envBool("MAINTENANCE_MODE", false),
+		MaintenanceMode:        envBool("MAINTENANCE_MODE", false),
-		Environment:     environment,
+		Environment:            environment,
-		MetricsUsername: envString("METRICS_USERNAME"),
+		MetricsUsername:        envString("METRICS_USERNAME"),
-		MetricsPassword: envString("METRICS_PASSWORD"),
+		MetricsPassword:        envString("METRICS_PASSWORD"),
-		Port:            envInt("PORT", defaultPort),
+		Port:                   envInt("PORT", defaultPort),
-		SentryDSN:       envString("SENTRY_DSN"),
+		SentryDSN:              envString("SENTRY_DSN"),
-		log:             log,
+		RetentionSweepInterval: retentionSweepInterval,
-		params:          &params,
+		log:                    log,
+		params:                 &params,
 	}
 
 	// Set default DataDir. All SQLite databases (main application
@@ -151,6 +196,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"debug", s.Debug,
 		"maintenanceMode", s.MaintenanceMode,
 		"dataDir", s.DataDir,
+		"retentionSweepInterval", s.RetentionSweepInterval.String(),
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth",
 		s.MetricsUsername != "" && s.MetricsPassword != "",

internal/config/config_test.go

@@ -3,6 +3,7 @@ package config_test
 import (
 	"os"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -120,6 +121,100 @@ func testEnvironmentConfigSuccess(
 	assert.Equal(t, isProd, cfg.IsProd())
 }
 
+func TestRetentionSweepInterval(t *testing.T) {
+	tests := []struct {
+		name        string
+		set         bool
+		value       string
+		expectError bool
+		expected    time.Duration
+	}{
+		{
+			name:     "unset uses default",
+			set:      false,
+			expected: time.Hour,
+		},
+		{
+			name:     "valid value is parsed",
+			set:      true,
+			value:    "15m",
+			expected: 15 * time.Minute,
+		},
+		{
+			name:        "unparseable value fails startup",
+			set:         true,
+			value:       "not-a-duration",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
+
+			if tt.set {
+				t.Setenv("RETENTION_SWEEP_INTERVAL", tt.value)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"RETENTION_SWEEP_INTERVAL",
+				))
+			}
+
+			if tt.expectError {
+				testRetentionSweepIntervalError(t)
+			} else {
+				testRetentionSweepIntervalSuccess(t, tt.expected)
+			}
+		})
+	}
+}
+
+func testRetentionSweepIntervalError(t *testing.T) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fx.New(
+		fx.NopLogger,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+
+	assert.Error(t, app.Err())
+}
+
+func testRetentionSweepIntervalSuccess(
+	t *testing.T,
+	expected time.Duration,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, expected, cfg.RetentionSweepInterval)
+}
+
 func TestDefaultDataDir(t *testing.T) {
 	for _, env := range []string{"", "dev", "prod"} {
 		name := env

internal/database/export_test.go

@@ -0,0 +1,31 @@
+package database
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"time"
+)
+
+// NewTestRetentionReaper builds a RetentionReaper backed by the given
+// main database and per-webhook database manager, without the fx
+// lifecycle. Intended for tests.
+func NewTestRetentionReaper(
+	db *Database,
+	mgr *WebhookDBManager,
+) *RetentionReaper {
+	return &RetentionReaper{
+		db:        db,
+		dbManager: mgr,
+		log: slog.New(slog.NewTextHandler(
+			os.Stderr,
+			&slog.HandlerOptions{Level: slog.LevelDebug},
+		)),
+		interval: time.Hour,
+	}
+}
+
+// ExportSweep runs a single retention sweep synchronously for tests.
+func (r *RetentionReaper) ExportSweep(ctx context.Context) {
+	r.sweep(ctx)
+}

internal/database/retention.go

@@ -0,0 +1,252 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"sync"
+	"time"
+
+	"go.uber.org/fx"
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/logger"
+)
+
+// hoursPerDay converts a RetentionDays count into hours for cutoff
+// computation.
+const hoursPerDay = 24
+
+// RetentionReaperParams holds the fx dependencies for the
+// RetentionReaper.
+type RetentionReaperParams struct {
+	fx.In
+
+	Config    *config.Config
+	Database  *Database
+	DBManager *WebhookDBManager
+	Logger    *logger.Logger
+}
+
+// RetentionReaper periodically deletes expired events (and their
+// dependent deliveries and delivery results) from each per-webhook
+// database, enforcing every webhook's RetentionDays. Rows are removed
+// permanently so that per-webhook SQLite files do not grow without
+// bound.
+type RetentionReaper struct {
+	db        *Database
+	dbManager *WebhookDBManager
+	log       *slog.Logger
+	interval  time.Duration
+	cancel    context.CancelFunc
+	wg        sync.WaitGroup
+}
+
+// NewRetentionReaper creates the retention reaper and registers its
+// fx lifecycle hooks. The background sweep loop starts on OnStart and
+// stops cleanly on OnStop via context cancellation.
+func NewRetentionReaper(
+	lc fx.Lifecycle,
+	params RetentionReaperParams,
+) *RetentionReaper {
+	r := &RetentionReaper{
+		db:        params.Database,
+		dbManager: params.DBManager,
+		log:       params.Logger.Get(),
+		interval:  params.Config.RetentionSweepInterval,
+	}
+
+	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			r.start(ctx)
+
+			return nil
+		},
+		OnStop: func(_ context.Context) error {
+			r.stop()
+
+			return nil
+		},
+	})
+
+	return r
+}
+
+func (r *RetentionReaper) start(ctx context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	r.cancel = cancel
+
+	r.wg.Add(1)
+
+	go r.run(ctx)
+
+	r.log.Info(
+		"retention reaper started",
+		"interval", r.interval.String(),
+	)
+}
+
+func (r *RetentionReaper) stop() {
+	r.log.Info("retention reaper stopping")
+
+	if r.cancel != nil {
+		r.cancel()
+	}
+
+	r.wg.Wait()
+	r.log.Info("retention reaper stopped")
+}
+
+func (r *RetentionReaper) run(ctx context.Context) {
+	defer r.wg.Done()
+
+	ticker := time.NewTicker(r.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			r.sweep(ctx)
+		}
+	}
+}
+
+// sweep lists every webhook from the main database and reaps expired
+// rows from each per-webhook database whose RetentionDays is positive.
+func (r *RetentionReaper) sweep(ctx context.Context) {
+	var webhooks []Webhook
+
+	err := r.db.DB().
+		Model(&Webhook{}).
+		Find(&webhooks).Error
+	if err != nil {
+		r.log.Error(
+			"retention sweep: failed to list webhooks",
+			"error", err,
+		)
+
+		return
+	}
+
+	for i := range webhooks {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		wh := webhooks[i]
+
+		// RetentionDays of zero or less means retain forever.
+		if wh.RetentionDays <= 0 {
+			continue
+		}
+
+		// Nothing to reap if the per-webhook database has never
+		// been created.
+		if !r.dbManager.DBExists(wh.ID) {
+			continue
+		}
+
+		r.reapWebhook(wh.ID, wh.RetentionDays)
+	}
+}
+
+// reapWebhook removes every expired event (and its dependents) from a
+// single webhook's database.
+func (r *RetentionReaper) reapWebhook(
+	webhookID string,
+	retentionDays int,
+) {
+	db, err := r.dbManager.GetDB(webhookID)
+	if err != nil {
+		r.log.Error(
+			"retention sweep: failed to open webhook database",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return
+	}
+
+	cutoff := time.Now().Add(
+		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
+	)
+
+	deleted, err := reapExpired(db, cutoff)
+	if err != nil {
+		r.log.Error(
+			"retention sweep: failed to reap expired events",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if deleted > 0 {
+		r.log.Info(
+			"retention sweep: reaped expired events",
+			"webhook_id", webhookID,
+			"retention_days", retentionDays,
+			"events_deleted", deleted,
+		)
+	}
+}
+
+// reapExpired hard-deletes, in foreign-key-safe order, the delivery
+// results, deliveries, and events associated with events older than
+// cutoff. Deletes are unscoped so rows are physically removed rather
+// than soft-deleted, reclaiming disk. It returns the number of events
+// deleted.
+func reapExpired(db *gorm.DB, cutoff time.Time) (int64, error) {
+	// Fresh subqueries are built per statement to avoid reusing a
+	// mutated builder across executions.
+	expiredEventIDs := func() *gorm.DB {
+		return db.Model(&Event{}).
+			Select("id").
+			Where("created_at < ?", cutoff)
+	}
+	expiredDeliveryIDs := func() *gorm.DB {
+		return db.Model(&Delivery{}).
+			Select("id").
+			Where("event_id IN (?)", expiredEventIDs())
+	}
+
+	// 1. Delivery results whose delivery belongs to an expired event.
+	res := db.Unscoped().
+		Where("delivery_id IN (?)", expiredDeliveryIDs()).
+		Delete(&DeliveryResult{})
+	if res.Error != nil {
+		return 0, fmt.Errorf(
+			"deleting expired delivery results: %w",
+			res.Error,
+		)
+	}
+
+	// 2. Deliveries belonging to an expired event.
+	del := db.Unscoped().
+		Where("event_id IN (?)", expiredEventIDs()).
+		Delete(&Delivery{})
+	if del.Error != nil {
+		return 0, fmt.Errorf(
+			"deleting expired deliveries: %w",
+			del.Error,
+		)
+	}
+
+	// 3. The expired events themselves.
+	ev := db.Unscoped().
+		Where("created_at < ?", cutoff).
+		Delete(&Event{})
+	if ev.Error != nil {
+		return 0, fmt.Errorf(
+			"deleting expired events: %w",
+			ev.Error,
+		)
+	}
+
+	return ev.RowsAffected, nil
+}

internal/database/retention_test.go

@@ -0,0 +1,277 @@
+package database_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/fx/fxtest"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/globals"
+	"sneak.berlin/go/webhooker/internal/logger"
+)
+
+// retentionTestEnv bundles the pieces a retention test drives.
+type retentionTestEnv struct {
+	reaper *database.RetentionReaper
+	mainDB *database.Database
+	mgr    *database.WebhookDBManager
+}
+
+func setupRetentionTest(t *testing.T) *retentionTestEnv {
+	t.Helper()
+
+	lc := fxtest.NewLifecycle(t)
+
+	g := &globals.Globals{
+		Appname: "webhooker-test",
+		Version: "test",
+	}
+
+	l, err := logger.New(lc, logger.LoggerParams{Globals: g})
+	require.NoError(t, err)
+
+	cfg := &config.Config{
+		DataDir:     t.TempDir(),
+		Environment: "dev",
+	}
+
+	mainDB, err := database.New(lc, database.DatabaseParams{
+		Config: cfg,
+		Logger: l,
+	})
+	require.NoError(t, err)
+
+	mgr, err := database.NewWebhookDBManager(
+		lc,
+		database.WebhookDBManagerParams{Config: cfg, Logger: l},
+	)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+	require.NoError(t, lc.Start(ctx))
+	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
+
+	return &retentionTestEnv{
+		reaper: database.NewTestRetentionReaper(mainDB, mgr),
+		mainDB: mainDB,
+		mgr:    mgr,
+	}
+}
+
+// createWebhook inserts a webhook row into the main database with the
+// given retention policy and returns its ID.
+func createWebhook(
+	t *testing.T,
+	db *gorm.DB,
+	retentionDays int,
+) string {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID:        uuid.New().String(),
+		Name:          "test-webhook",
+		RetentionDays: retentionDays,
+	}
+	require.NoError(
+		t,
+		db.Omit(clause.Associations).Create(wh).Error,
+	)
+
+	// The RetentionDays column carries a GORM default of 30, so a
+	// zero (or negative) value passed to Create is replaced by that
+	// default. Force the requested value explicitly so the
+	// retain-forever (<= 0) path can be exercised.
+	require.NoError(
+		t,
+		db.Model(wh).
+			Update("retention_days", retentionDays).Error,
+	)
+
+	return wh.ID
+}
+
+// eventChain is the set of row IDs seeded for a single event.
+type eventChain struct {
+	eventID    string
+	deliveryID string
+	resultID   string
+}
+
+// seedEventChain creates an event with one delivery and one delivery
+// result, all stamped with createdAt, and returns their IDs.
+func seedEventChain(
+	t *testing.T,
+	db *gorm.DB,
+	webhookID string,
+	createdAt time.Time,
+) eventChain {
+	t.Helper()
+
+	event := &database.Event{
+		WebhookID:    webhookID,
+		EntrypointID: uuid.New().String(),
+		Method:       "POST",
+		Body:         `{"seed": true}`,
+		ContentType:  "application/json",
+	}
+	event.CreatedAt = createdAt
+	require.NoError(t, db.Create(event).Error)
+
+	delivery := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: uuid.New().String(),
+		Status:   database.DeliveryStatusDelivered,
+	}
+	delivery.CreatedAt = createdAt
+	require.NoError(t, db.Create(delivery).Error)
+
+	result := &database.DeliveryResult{
+		DeliveryID: delivery.ID,
+		AttemptNum: 1,
+		Success:    true,
+		StatusCode: 200,
+		Duration:   10,
+	}
+	result.CreatedAt = createdAt
+	require.NoError(t, db.Create(result).Error)
+
+	return eventChain{
+		eventID:    event.ID,
+		deliveryID: delivery.ID,
+		resultID:   result.ID,
+	}
+}
+
+// countByID returns how many rows of model match the given id,
+// counting even hard-deletable rows via Unscoped.
+func countByID(
+	t *testing.T,
+	db *gorm.DB,
+	model any,
+	id string,
+) int64 {
+	t.Helper()
+
+	var n int64
+
+	require.NoError(
+		t,
+		db.Unscoped().Model(model).
+			Where("id = ?", id).Count(&n).Error,
+	)
+
+	return n
+}
+
+func assertChainGone(
+	t *testing.T,
+	db *gorm.DB,
+	chain eventChain,
+) {
+	t.Helper()
+
+	assert.Zero(
+		t,
+		countByID(t, db, &database.Event{}, chain.eventID),
+		"expired event should be removed",
+	)
+	assert.Zero(
+		t,
+		countByID(t, db, &database.Delivery{}, chain.deliveryID),
+		"expired delivery should be removed",
+	)
+	assert.Zero(
+		t,
+		countByID(
+			t, db, &database.DeliveryResult{}, chain.resultID,
+		),
+		"expired delivery result should be removed",
+	)
+}
+
+func assertChainPresent(
+	t *testing.T,
+	db *gorm.DB,
+	chain eventChain,
+) {
+	t.Helper()
+
+	assert.Equal(
+		t,
+		int64(1),
+		countByID(t, db, &database.Event{}, chain.eventID),
+		"recent event should be retained",
+	)
+	assert.Equal(
+		t,
+		int64(1),
+		countByID(t, db, &database.Delivery{}, chain.deliveryID),
+		"recent delivery should be retained",
+	)
+	assert.Equal(
+		t,
+		int64(1),
+		countByID(
+			t, db, &database.DeliveryResult{}, chain.resultID,
+		),
+		"recent delivery result should be retained",
+	)
+}
+
+func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	const retentionDays = 30
+
+	webhookID := createWebhook(
+		t, env.mainDB.DB(), retentionDays,
+	)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	now := time.Now()
+	old := seedEventChain(
+		t, db, webhookID,
+		now.Add(-40*24*time.Hour),
+	)
+	recent := seedEventChain(
+		t, db, webhookID,
+		now.Add(-1*24*time.Hour),
+	)
+
+	env.reaper.ExportSweep(context.Background())
+
+	assertChainGone(t, db, old)
+	assertChainPresent(t, db, recent)
+}
+
+func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	// RetentionDays of zero means retain forever.
+	webhookID := createWebhook(t, env.mainDB.DB(), 0)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	ancient := seedEventChain(
+		t, db, webhookID,
+		time.Now().Add(-365*24*time.Hour),
+	)
+
+	env.reaper.ExportSweep(context.Background())
+
+	assertChainPresent(t, db, ancient)
+}

internal/delivery/engine_test.go

@@ -436,91 +436,6 @@ func TestDeliverLog_ImmediateSuccess(t *testing.T) {
 	assert.True(t, result.Success)
 }
 
-func TestDeliverLog_StructuredLogFields(t *testing.T) {
-	t.Parallel()
-
-	db := testWebhookDB(t)
-
-	var logBuf bytes.Buffer
-
-	e := delivery.NewTestEngine(
-		slog.New(slog.NewTextHandler(
-			&logBuf,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	event := seedEvent(t, db, `{"log":"structured"}`)
-
-	dlv := seedDelivery(
-		t, db, event.ID, uuid.New().String(),
-		database.DeliveryStatusPending,
-	)
-
-	d := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: dlv.TargetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name: "structured-log",
-			Type: database.TargetTypeLog,
-		},
-	}
-	d.ID = dlv.ID
-
-	e.ExportDeliverLog(db, d)
-
-	// The delivery is marked delivered and a success
-	// DeliveryResult with no HTTP status is recorded,
-	// mirroring the other target types' bookkeeping.
-	var updated database.Delivery
-
-	require.NoError(t, db.First(
-		&updated, "id = ?", dlv.ID,
-	).Error)
-
-	assert.Equal(t,
-		database.DeliveryStatusDelivered, updated.Status,
-		"log target should immediately succeed",
-	)
-
-	var result database.DeliveryResult
-
-	require.NoError(t, db.Where(
-		"delivery_id = ?", dlv.ID,
-	).First(&result).Error)
-
-	assert.True(t, result.Success)
-	assert.Equal(t, 0, result.StatusCode,
-		"log target should not have an HTTP status",
-	)
-
-	assertLogFields(t, logBuf.String(), event, "structured-log")
-}
-
-// assertLogFields checks that a log target's structured
-// log line carries the required fields: event id,
-// webhook/entrypoint, target name, and outcome.
-func assertLogFields(
-	t *testing.T,
-	logged string,
-	event database.Event,
-	targetName string,
-) {
-	t.Helper()
-
-	assert.Contains(t, logged, "event_id="+event.ID)
-	assert.Contains(t, logged, "webhook_id="+event.WebhookID)
-	assert.Contains(t,
-		logged, "entrypoint_id="+event.EntrypointID,
-	)
-	assert.Contains(t, logged, "target_name="+targetName)
-	assert.Contains(t, logged, "outcome=delivered")
-}
-
 func TestDeliverHTTP_WithRetries_Success(t *testing.T) {
 	t.Parallel()
 
@@ -1738,6 +1653,179 @@ func TestProcessDelivery_RoutesToSlack(t *testing.T) {
 	)
 }
 
+// newLogCaptureEngine builds a test engine whose logger
+// writes to the returned buffer, for inspecting log output.
+func newLogCaptureEngine(
+	t *testing.T,
+) (*delivery.Engine, *bytes.Buffer) {
+	t.Helper()
+
+	var buf bytes.Buffer
+
+	log := slog.New(slog.NewTextHandler(
+		&buf,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+
+	e := delivery.NewTestEngine(
+		log, &http.Client{Timeout: 5 * time.Second}, 1,
+	)
+
+	return e, &buf
+}
+
+// assertLogLineComplete asserts the captured log output
+// carries the full inbound webhook content and ids.
+func assertLogLineComplete(
+	t *testing.T, out string, event database.Event,
+) {
+	t.Helper()
+
+	assert.Contains(t, out, "log-body-marker",
+		"log line must contain the full request body",
+	)
+
+	assert.Contains(t, out, "Content-Type",
+		"log line must contain the full request headers",
+	)
+
+	assert.Contains(t, out, event.EntrypointID,
+		"log line must contain the entrypoint id",
+	)
+
+	assert.Contains(t, out, event.WebhookID,
+		"log line must contain the webhook id",
+	)
+
+	assert.Contains(t, out, "application/json",
+		"log line must contain the content type",
+	)
+}
+
+func TestDeliverLog_LogsFullContent(t *testing.T) {
+	t.Parallel()
+
+	db := testWebhookDB(t)
+	e, buf := newLogCaptureEngine(t)
+
+	event := seedEvent(
+		t, db, `{"log-body-marker":"abc123"}`,
+	)
+
+	dlv := seedDelivery(
+		t, db, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name: "test-log-full",
+			Type: database.TargetTypeLog,
+		},
+	}
+	d.ID = dlv.ID
+
+	e.ExportDeliverLog(db, d)
+
+	assertLogLineComplete(t, buf.String(), event)
+
+	assertDeliveryStatus(t, db, dlv.ID,
+		database.DeliveryStatusDelivered,
+	)
+}
+
+// buildSlackRetryDelivery builds a Slack delivery whose
+// target is configured with retries enabled.
+func buildSlackRetryDelivery(
+	dlv database.Delivery,
+	event database.Event,
+	targetID, cfg string,
+) *database.Delivery {
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: targetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name:       "test-slack-retry",
+			Type:       database.TargetTypeSlack,
+			Config:     cfg,
+			MaxRetries: 5,
+		},
+	}
+	d.ID = dlv.ID
+
+	return d
+}
+
+func TestDeliverSlack_WithRetries_SchedulesRetry(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	db := testWebhookDB(t)
+	ts := newStatusServer(t, http.StatusServiceUnavailable)
+	e := testEngine(t, 1)
+	targetID := uuid.New().String()
+
+	slackCfg, err := json.Marshal(
+		delivery.SlackTargetConfig{WebhookURL: ts.URL},
+	)
+	require.NoError(t, err)
+
+	event := seedEvent(t, db, `{"slack":"retry"}`)
+
+	dlv := seedDelivery(
+		t, db, event.ID, targetID,
+		database.DeliveryStatusPending,
+	)
+
+	d := buildSlackRetryDelivery(
+		dlv, event, targetID, string(slackCfg),
+	)
+
+	task := &delivery.Task{
+		DeliveryID: dlv.ID,
+		TargetID:   targetID,
+		TargetType: database.TargetTypeSlack,
+		MaxRetries: 5,
+		AttemptNum: 1,
+	}
+
+	e.ExportProcessDelivery(context.TODO(), db, d, task)
+
+	assertDeliveryStatus(t, db, dlv.ID,
+		database.DeliveryStatusRetrying,
+	)
+
+	assertDeliveryResult(
+		t, db, dlv.ID, false,
+		http.StatusServiceUnavailable,
+	)
+}
+
+// newStatusServer starts a test server that always responds
+// with the given status code.
+func newStatusServer(
+	t *testing.T, code int,
+) *httptest.Server {
+	t.Helper()
+
+	ts := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(code)
+		},
+	))
+
+	t.Cleanup(ts.Close)
+
+	return ts
+}
+
 // readAll is a small helper to avoid importing io in
 // a test handler inline.
 func readAll(r interface {

internal/delivery/export_test.go

@@ -39,37 +39,50 @@ func ExportTruncate(s string, maxLen int) string {
 	return truncate(s, maxLen)
 }
 
-// ExportDeliverHTTP exposes deliverHTTP for testing.
+// ExportDeliverHTTP delivers via the http target for testing.
 func (e *Engine) ExportDeliverHTTP(
 	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 	task *Task,
 ) {
-	e.deliverHTTP(ctx, webhookDB, d, task)
+	e.httpTarget.Deliver(ctx, webhookDB, d, task, e)
 }
 
-// ExportDeliverDatabase exposes deliverDatabase.
+// ExportDeliverDatabase delivers via the database target.
 func (e *Engine) ExportDeliverDatabase(
 	webhookDB *gorm.DB, d *database.Delivery,
 ) {
-	e.deliverDatabase(webhookDB, d)
+	e.targets[database.TargetTypeDatabase].Deliver(
+		context.Background(), webhookDB, d, &Task{}, e,
+	)
 }
 
-// ExportDeliverLog exposes deliverLog for testing.
+// ExportDeliverLog delivers via the log target for testing.
 func (e *Engine) ExportDeliverLog(
 	webhookDB *gorm.DB, d *database.Delivery,
 ) {
-	e.deliverLog(webhookDB, d)
+	e.targets[database.TargetTypeLog].Deliver(
+		context.Background(), webhookDB, d, &Task{}, e,
+	)
 }
 
-// ExportDeliverSlack exposes deliverSlack for testing.
+// ExportDeliverSlack delivers via the slack target for
+// testing.
 func (e *Engine) ExportDeliverSlack(
 	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 ) {
-	e.deliverSlack(ctx, webhookDB, d)
+	task := &Task{
+		DeliveryID: d.ID,
+		TargetID:   d.TargetID,
+		AttemptNum: 1,
+	}
+
+	e.targets[database.TargetTypeSlack].Deliver(
+		ctx, webhookDB, d, task, e,
+	)
 }
 
 // ExportProcessNewTask exposes processNewTask.
@@ -96,53 +109,56 @@ func (e *Engine) ExportProcessDelivery(
 	e.processDelivery(ctx, webhookDB, d, task)
 }
 
-// ExportGetCircuitBreaker exposes getCircuitBreaker.
+// ExportGetCircuitBreaker exposes the http target's
+// getCircuitBreaker.
 func (e *Engine) ExportGetCircuitBreaker(
 	targetID string,
 ) *CircuitBreaker {
-	return e.getCircuitBreaker(targetID)
+	return e.httpTarget.getCircuitBreaker(targetID)
 }
 
 // ExportParseHTTPConfig exposes parseHTTPConfig.
 func (e *Engine) ExportParseHTTPConfig(
 	configJSON string,
 ) (*HTTPTargetConfig, error) {
-	return e.parseHTTPConfig(configJSON)
+	return parseHTTPConfig(configJSON)
 }
 
 // ExportParseSlackConfig exposes parseSlackConfig.
 func (e *Engine) ExportParseSlackConfig(
 	configJSON string,
 ) (*SlackTargetConfig, error) {
-	return e.parseSlackConfig(configJSON)
+	return parseSlackConfig(configJSON)
 }
 
-// ExportDoHTTPRequest exposes doHTTPRequest.
+// ExportDoHTTPRequest exposes the http target's
+// doHTTPRequest.
 func (e *Engine) ExportDoHTTPRequest(
 	ctx context.Context,
 	cfg *HTTPTargetConfig,
 	event *database.Event,
 ) (int, string, int64, error) {
-	return e.doHTTPRequest(ctx, cfg, event)
+	return e.httpTarget.doHTTPRequest(ctx, cfg, event)
 }
 
-// ExportClientForConfig exposes clientForConfig.
+// ExportClientForConfig exposes the http target's
+// clientForConfig.
 func (e *Engine) ExportClientForConfig(
 	cfg *HTTPTargetConfig,
 ) *http.Client {
-	return e.clientForConfig(cfg)
+	return e.httpTarget.clientForConfig(cfg)
 }
 
-// ExportClient returns the engine's shared HTTP client.
+// ExportClient returns the http target's shared HTTP client.
 func (e *Engine) ExportClient() *http.Client {
-	return e.client
+	return e.httpTarget.client
 }
 
-// ExportScheduleRetry exposes scheduleRetry.
+// ExportScheduleRetry exposes ScheduleRetry.
 func (e *Engine) ExportScheduleRetry(
 	task Task, delay time.Duration,
 ) {
-	e.scheduleRetry(task, delay)
+	e.ScheduleRetry(task, delay)
 }
 
 // ExportRecoverPendingDeliveries exposes
@@ -199,13 +215,15 @@ func NewTestEngine(
 	client *http.Client,
 	workers int,
 ) *Engine {
-	return &Engine{
+	e := &Engine{
 		log:        log,
-		client:     client,
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
 	}
+	e.initTargets(client)
+
+	return e
 }
 
 // NewTestEngineSmallRetry creates an Engine with a tiny
@@ -213,10 +231,13 @@ func NewTestEngine(
 func NewTestEngineSmallRetry(
 	log *slog.Logger,
 ) *Engine {
-	return &Engine{
+	e := &Engine{
 		log:     log,
 		retryCh: make(chan Task, 1),
 	}
+	e.initTargets(nil)
+
+	return e
 }
 
 // NewTestEngineWithDB creates an Engine with a real
@@ -228,15 +249,17 @@ func NewTestEngineWithDB(
 	client *http.Client,
 	workers int,
 ) *Engine {
-	return &Engine{
+	e := &Engine{
 		database:   db,
 		dbManager:  dbMgr,
 		log:        log,
-		client:     client,
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
 	}
+	e.initTargets(client)
+
+	return e
 }
 
 // NewTestCircuitBreaker creates a CircuitBreaker with

internal/delivery/target.go

@@ -0,0 +1,101 @@
+package delivery
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// Scheduler re-enqueues a task for a future delivery attempt.
+// The engine provides one to each target so a target can own
+// its retries durably: it records the attempt, marks the
+// delivery retrying, and asks the Scheduler to deliver the
+// next attempt after delay — exactly what the engine does for
+// its own restart recovery.
+type Scheduler interface {
+	ScheduleRetry(task Task, delay time.Duration)
+}
+
+// Target delivers an event to one target type. Each type is
+// an implementation. A Target owns its whole delivery: it
+// makes the attempt, records the DeliveryResult and updates
+// the DeliveryStatus, and — for targets that retry — decides
+// whether to retry, computes its own backoff, gates with its
+// own circuit breaker, and reschedules via the injected
+// Scheduler. Fire-and-forget targets simply record a single
+// attempt.
+type Target interface {
+	Deliver(
+		ctx context.Context,
+		webhookDB *gorm.DB,
+		d *database.Delivery,
+		task *Task,
+		sched Scheduler,
+	)
+}
+
+// rescheduler is implemented by targets that own durable
+// retries. The engine's restart recovery and periodic sweep
+// use it to let the target recompute the schedule for an
+// orphaned retrying delivery, keeping the retry schedule
+// target-owned. Fire-and-forget targets do not implement it
+// and their (never-occurring) retrying deliveries are
+// skipped.
+type rescheduler interface {
+	// remainingBackoff returns how long to wait before the
+	// next attempt of a recovered retrying delivery.
+	remainingBackoff(
+		webhookDB *gorm.DB,
+		deliveryID string,
+		attemptNum int,
+	) time.Duration
+
+	// backoffElapsed reports whether the backoff window for
+	// the last attempt has already passed, so the periodic
+	// sweep can re-enqueue the delivery now.
+	backoffElapsed(
+		webhookDB *gorm.DB,
+		deliveryID string,
+		attemptNum int,
+	) bool
+}
+
+// attemptResult is the outcome of a single delivery attempt,
+// as reported by a target's per-attempt function to the
+// shared retry core.
+type attemptResult struct {
+	statusCode int
+	respBody   string
+	duration   int64
+	success    bool
+	errMsg     string
+}
+
+// initTargets builds the target registry, wiring each target
+// to the engine's persistence helpers and giving the HTTP and
+// Slack targets the shared SSRF-safe client. It is called by
+// both New and the test constructors so the registry is
+// always populated.
+func (e *Engine) initTargets(client *http.Client) {
+	httpT := &httpTarget{
+		httpCore: &httpCore{eng: e},
+		client:   client,
+	}
+
+	slackT := &slackTarget{
+		httpCore: &httpCore{eng: e},
+		client:   client,
+	}
+
+	e.httpTarget = httpT
+
+	e.targets = map[database.TargetType]Target{
+		database.TargetTypeHTTP:     httpT,
+		database.TargetTypeSlack:    slackT,
+		database.TargetTypeDatabase: &databaseTarget{eng: e},
+		database.TargetTypeLog:      &logTarget{eng: e},
+	}
+}

internal/delivery/target_database.go

@@ -0,0 +1,34 @@
+package delivery
+
+import (
+	"context"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// databaseTarget is a fire-and-forget target: the event is
+// already persisted in the per-webhook database by the time
+// delivery runs, so the target records a single successful
+// attempt. (Durable archiving to a separate store is tracked
+// as its own work.)
+type databaseTarget struct {
+	eng *Engine
+}
+
+// Deliver implements Target.
+func (t *databaseTarget) Deliver(
+	_ context.Context,
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	_ *Task,
+	_ Scheduler,
+) {
+	t.eng.recordResult(
+		webhookDB, d, 1, true, 0, "", "", 0,
+	)
+
+	t.eng.updateDeliveryStatus(
+		webhookDB, d, database.DeliveryStatusDelivered,
+	)
+}

internal/delivery/target_http.go

@@ -0,0 +1,499 @@
+package delivery
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// Sentinel errors returned by the config parsers.
+var (
+	errEmptyTargetConfig = errors.New(
+		"empty target config",
+	)
+	errMissingTargetURL = errors.New(
+		"target URL is required",
+	)
+)
+
+// HTTPTargetConfig holds configuration for http target
+// types.
+type HTTPTargetConfig struct {
+	URL     string            `json:"url"`
+	Headers map[string]string `json:"headers,omitempty"`
+	Timeout int               `json:"timeout,omitempty"`
+}
+
+// httpCore holds the retry, backoff, and circuit-breaker
+// machinery shared by the HTTP and Slack targets. Each of
+// those targets owns its own httpCore instance (and thus its
+// own circuit breakers); the per-attempt request differs
+// between them and is supplied as a closure.
+type httpCore struct {
+	eng *Engine
+
+	// circuitBreakers stores a *CircuitBreaker per target ID.
+	circuitBreakers sync.Map
+}
+
+// deliver runs one delivery attempt through the retry core.
+// A maxRetries of 0 is fire-and-forget: a single attempt is
+// recorded and no circuit breaker is consulted. A positive
+// maxRetries gates the attempt on the circuit breaker and
+// schedules a backed-off retry on failure.
+func (c *httpCore) deliver(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+	maxRetries int,
+	attempt func() attemptResult,
+) {
+	if maxRetries == 0 {
+		c.fireAndForget(webhookDB, d, attempt())
+
+		return
+	}
+
+	c.withRetry(
+		webhookDB, d, task, sched, maxRetries, attempt,
+	)
+}
+
+func (c *httpCore) fireAndForget(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	res attemptResult,
+) {
+	c.eng.recordResult(
+		webhookDB, d, 1, res.success,
+		res.statusCode, res.respBody, res.errMsg,
+		res.duration,
+	)
+
+	if res.success {
+		c.eng.updateDeliveryStatus(
+			webhookDB, d,
+			database.DeliveryStatusDelivered,
+		)
+
+		return
+	}
+
+	c.eng.updateDeliveryStatus(
+		webhookDB, d, database.DeliveryStatusFailed,
+	)
+}
+
+func (c *httpCore) withRetry(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+	maxRetries int,
+	attempt func() attemptResult,
+) {
+	cb := c.getCircuitBreaker(task.TargetID)
+	if c.circuitBreakerBlock(webhookDB, d, task, sched, cb) {
+		return
+	}
+
+	attemptNum := task.AttemptNum
+
+	res := attempt()
+
+	c.eng.recordResult(
+		webhookDB, d, attemptNum, res.success,
+		res.statusCode, res.respBody, res.errMsg,
+		res.duration,
+	)
+
+	if res.success {
+		cb.RecordSuccess()
+
+		c.eng.updateDeliveryStatus(
+			webhookDB, d,
+			database.DeliveryStatusDelivered,
+		)
+
+		return
+	}
+
+	cb.RecordFailure()
+
+	c.handleRetry(
+		webhookDB, d, task, sched, maxRetries, attemptNum,
+	)
+}
+
+func (c *httpCore) circuitBreakerBlock(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+	cb *CircuitBreaker,
+) bool {
+	if cb.Allow() {
+		return false
+	}
+
+	remaining := cb.CooldownRemaining()
+
+	c.eng.log.Info(
+		"circuit breaker open, skipping delivery",
+		"target_id", task.TargetID,
+		"target_name", task.TargetName,
+		"delivery_id", d.ID,
+		"cooldown_remaining", remaining,
+	)
+
+	c.eng.updateDeliveryStatus(
+		webhookDB, d,
+		database.DeliveryStatusRetrying,
+	)
+
+	retryTask := *task
+	sched.ScheduleRetry(retryTask, remaining)
+
+	return true
+}
+
+func (c *httpCore) handleRetry(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+	maxRetries int,
+	attemptNum int,
+) {
+	if attemptNum >= maxRetries {
+		c.eng.updateDeliveryStatus(
+			webhookDB, d,
+			database.DeliveryStatusFailed,
+		)
+
+		return
+	}
+
+	c.eng.updateDeliveryStatus(
+		webhookDB, d, database.DeliveryStatusRetrying,
+	)
+
+	backoff := calcBackoff(attemptNum)
+
+	retryTask := *task
+	retryTask.AttemptNum = attemptNum + 1
+	sched.ScheduleRetry(retryTask, backoff)
+}
+
+func (c *httpCore) getCircuitBreaker(
+	targetID string,
+) *CircuitBreaker {
+	if val, ok := c.circuitBreakers.Load(targetID); ok {
+		cb, _ := val.(*CircuitBreaker)
+
+		return cb
+	}
+
+	fresh := NewCircuitBreaker()
+
+	actual, _ := c.circuitBreakers.LoadOrStore(
+		targetID, fresh,
+	)
+
+	cb, _ := actual.(*CircuitBreaker)
+
+	return cb
+}
+
+// remainingBackoff returns how long remains of the backoff
+// window for the last attempt of a recovered retrying
+// delivery. It implements rescheduler.
+func (c *httpCore) remainingBackoff(
+	webhookDB *gorm.DB,
+	deliveryID string,
+	attemptNum int,
+) time.Duration {
+	var lastResult database.DeliveryResult
+
+	err := webhookDB.
+		Where("delivery_id = ?", deliveryID).
+		Order("created_at DESC").
+		First(&lastResult).Error
+	if err != nil {
+		return 0
+	}
+
+	backoff := calcBackoff(attemptNum)
+	elapsed := time.Since(lastResult.CreatedAt)
+	remaining := backoff - elapsed
+
+	return max(remaining, 0)
+}
+
+// backoffElapsed reports whether the backoff window for the
+// last attempt of a retrying delivery has passed. It
+// implements rescheduler.
+func (c *httpCore) backoffElapsed(
+	webhookDB *gorm.DB,
+	deliveryID string,
+	attemptNum int,
+) bool {
+	var lastResult database.DeliveryResult
+
+	err := webhookDB.
+		Where("delivery_id = ?", deliveryID).
+		Order("created_at DESC").
+		First(&lastResult).Error
+	if err != nil {
+		return true
+	}
+
+	backoff := calcBackoff(attemptNum)
+
+	return time.Since(lastResult.CreatedAt) >= backoff
+}
+
+func calcBackoff(attemptNum int) time.Duration {
+	shift := max(attemptNum-1, 0)
+	shift = min(shift, maxBackoffShift)
+
+	return time.Duration(1<<uint(shift)) * time.Second
+}
+
+// httpTarget delivers events to http targets. It forwards the
+// event body and (filtered) request headers to the configured
+// URL and owns retry, backoff, and circuit breaking through
+// the shared httpCore.
+type httpTarget struct {
+	*httpCore
+
+	client *http.Client
+}
+
+// Deliver implements Target.
+func (t *httpTarget) Deliver(
+	ctx context.Context,
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+) {
+	cfg, err := parseHTTPConfig(d.Target.Config)
+	if err != nil {
+		t.eng.log.Error(
+			"invalid HTTP target config",
+			"target_id", d.TargetID,
+			"error", err,
+		)
+
+		t.eng.recordResult(
+			webhookDB, d, task.AttemptNum,
+			false, 0, "", err.Error(), 0,
+		)
+
+		t.eng.updateDeliveryStatus(
+			webhookDB, d, database.DeliveryStatusFailed,
+		)
+
+		return
+	}
+
+	attempt := func() attemptResult {
+		return t.attempt(ctx, cfg, &d.Event)
+	}
+
+	t.deliver(
+		webhookDB, d, task, sched,
+		d.Target.MaxRetries, attempt,
+	)
+}
+
+// attempt performs a single HTTP delivery attempt and derives
+// the success flag and error message the same way the engine
+// did: a non-2xx response is a failure but carries no error
+// string; only a transport-level error does.
+func (t *httpTarget) attempt(
+	ctx context.Context,
+	cfg *HTTPTargetConfig,
+	event *database.Event,
+) attemptResult {
+	statusCode, respBody, duration, reqErr :=
+		t.doHTTPRequest(ctx, cfg, event)
+
+	success := reqErr == nil &&
+		statusCode >= httpSuccessMin &&
+		statusCode < httpSuccessMax
+
+	errMsg := ""
+	if reqErr != nil {
+		errMsg = reqErr.Error()
+	}
+
+	return attemptResult{
+		statusCode: statusCode,
+		respBody:   respBody,
+		duration:   duration,
+		success:    success,
+		errMsg:     errMsg,
+	}
+}
+
+func (t *httpTarget) doHTTPRequest(
+	ctx context.Context,
+	cfg *HTTPTargetConfig,
+	event *database.Event,
+) (int, string, int64, error) {
+	start := time.Now()
+
+	req, reqErr := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		cfg.URL,
+		bytes.NewReader([]byte(event.Body)),
+	)
+	if reqErr != nil {
+		return 0, "", 0, fmt.Errorf(
+			"creating request: %w", reqErr,
+		)
+	}
+
+	applyRequestHeaders(req, event, cfg)
+
+	client := t.clientForConfig(cfg)
+
+	resp, doErr := executeHTTPRequest(client, req)
+
+	dur := time.Since(start).Milliseconds()
+	if doErr != nil {
+		return 0, "", dur, fmt.Errorf(
+			"sending request: %w", doErr,
+		)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	body, readErr := io.ReadAll(
+		io.LimitReader(resp.Body, maxBodyLog),
+	)
+	if readErr != nil {
+		return resp.StatusCode, "", dur,
+			fmt.Errorf(
+				"reading response body: %w", readErr,
+			)
+	}
+
+	return resp.StatusCode, string(body), dur, nil
+}
+
+func (t *httpTarget) clientForConfig(
+	cfg *HTTPTargetConfig,
+) *http.Client {
+	if cfg.Timeout > 0 {
+		// Reuse the shared client's SSRF-safe transport so
+		// a per-target timeout does not drop the
+		// request-time private-IP guard. Only the timeout
+		// is overridden.
+		return &http.Client{
+			Timeout: time.Duration(
+				cfg.Timeout,
+			) * time.Second,
+			Transport: t.client.Transport,
+		}
+	}
+
+	return t.client
+}
+
+func parseHTTPConfig(
+	configJSON string,
+) (*HTTPTargetConfig, error) {
+	if configJSON == "" {
+		return nil, errEmptyTargetConfig
+	}
+
+	var cfg HTTPTargetConfig
+
+	err := json.Unmarshal(
+		[]byte(configJSON), &cfg,
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"parsing config JSON: %w", err,
+		)
+	}
+
+	if cfg.URL == "" {
+		return nil, errMissingTargetURL
+	}
+
+	return &cfg, nil
+}
+
+// isForwardableHeader returns true if the header should
+// be forwarded to targets.
+func isForwardableHeader(name string) bool {
+	switch http.CanonicalHeaderKey(name) {
+	case "Host", "Connection", "Keep-Alive",
+		"Transfer-Encoding", "Te", "Trailer",
+		"Upgrade", "Proxy-Authorization",
+		"Proxy-Connection", "Content-Length":
+		return false
+	default:
+		return true
+	}
+}
+
+func applyRequestHeaders(
+	req *http.Request,
+	event *database.Event,
+	cfg *HTTPTargetConfig,
+) {
+	if event.ContentType != "" {
+		req.Header.Set(
+			"Content-Type", event.ContentType,
+		)
+	}
+
+	var originalHeaders map[string][]string
+
+	if event.Headers != "" {
+		jsonErr := json.Unmarshal(
+			[]byte(event.Headers),
+			&originalHeaders,
+		)
+		if jsonErr == nil {
+			for k, vals := range originalHeaders {
+				if isForwardableHeader(k) {
+					for _, v := range vals {
+						req.Header.Add(k, v)
+					}
+				}
+			}
+		}
+	}
+
+	for k, v := range cfg.Headers {
+		req.Header.Set(k, v)
+	}
+
+	req.Header.Set("User-Agent", "webhooker/1.0")
+}
+
+// executeHTTPRequest sends an HTTP request using the provided
+// client. URLs are validated by the config parsers and the
+// SSRF-safe transport before reaching here.
+func executeHTTPRequest(
+	client *http.Client, req *http.Request,
+) (*http.Response, error) {
+	return client.Do(req) //#nosec G704 -- URL validated by parseHTTPConfig/parseSlackConfig and SSRF-safe transport
+}

internal/delivery/target_log.go

@@ -0,0 +1,47 @@
+package delivery
+
+import (
+	"context"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// logTarget is a fire-and-forget target that logs the entire
+// inbound webhook — the full request body and headers, plus
+// the method, content type, and the webhook and entrypoint
+// ids — then records a single successful attempt.
+type logTarget struct {
+	eng *Engine
+}
+
+// Deliver implements Target.
+func (t *logTarget) Deliver(
+	_ context.Context,
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	_ *Task,
+	_ Scheduler,
+) {
+	t.eng.log.Info(
+		"webhook event delivered to log target",
+		"delivery_id", d.ID,
+		"event_id", d.EventID,
+		"target_id", d.TargetID,
+		"target_name", d.Target.Name,
+		"webhook_id", d.Event.WebhookID,
+		"entrypoint_id", d.Event.EntrypointID,
+		"method", d.Event.Method,
+		"content_type", d.Event.ContentType,
+		"headers", d.Event.Headers,
+		"body", d.Event.Body,
+	)
+
+	t.eng.recordResult(
+		webhookDB, d, 1, true, 0, "", "", 0,
+	)
+
+	t.eng.updateDeliveryStatus(
+		webhookDB, d, database.DeliveryStatusDelivered,
+	)
+}

internal/delivery/target_slack.go

@@ -0,0 +1,299 @@
+package delivery
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// errMissingWebhookURL is returned when a Slack target config
+// omits its webhook URL.
+var errMissingWebhookURL = errors.New(
+	"webhook_url is required",
+)
+
+// SlackTargetConfig holds configuration for slack target
+// types.
+type SlackTargetConfig struct {
+	WebhookURL string `json:"webhookUrl"`
+}
+
+// slackTarget delivers events to Slack incoming webhooks. It
+// formats the event into a Slack message and posts it as
+// JSON. It shares the retry core with the HTTP target: a
+// MaxRetries of 0 stays single-attempt fire-and-forget
+// (preserving existing Slack targets), while a positive
+// MaxRetries adds backoff and circuit breaking.
+type slackTarget struct {
+	*httpCore
+
+	client *http.Client
+}
+
+// Deliver implements Target.
+func (t *slackTarget) Deliver(
+	ctx context.Context,
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	task *Task,
+	sched Scheduler,
+) {
+	cfg, err := parseSlackConfig(d.Target.Config)
+	if err != nil {
+		t.eng.log.Error(
+			"invalid Slack target config",
+			"target_id", d.TargetID,
+			"error", err,
+		)
+
+		t.failConfig(webhookDB, d, err)
+
+		return
+	}
+
+	msg := FormatSlackMessage(&d.Event)
+
+	payload, err := json.Marshal(
+		map[string]string{"text": msg},
+	)
+	if err != nil {
+		t.eng.log.Error(
+			"failed to marshal Slack payload",
+			"target_id", d.TargetID,
+			"error", err,
+		)
+
+		t.failConfig(webhookDB, d, err)
+
+		return
+	}
+
+	attempt := func() attemptResult {
+		return t.attempt(ctx, cfg, payload)
+	}
+
+	t.deliver(
+		webhookDB, d, task, sched,
+		d.Target.MaxRetries, attempt,
+	)
+}
+
+// failConfig records a first-attempt failure for a delivery
+// that could not be prepared (bad config or unmarshalable
+// payload) and marks it failed.
+func (t *slackTarget) failConfig(
+	webhookDB *gorm.DB,
+	d *database.Delivery,
+	err error,
+) {
+	t.eng.recordResult(
+		webhookDB, d, 1,
+		false, 0, "", err.Error(), 0,
+	)
+
+	t.eng.updateDeliveryStatus(
+		webhookDB, d, database.DeliveryStatusFailed,
+	)
+}
+
+// attempt performs a single Slack POST and derives its
+// outcome, preserving the engine's original semantics: a
+// non-2xx response records an "HTTP <code>" error string and
+// a transport error records a "sending request" error.
+func (t *slackTarget) attempt(
+	ctx context.Context,
+	cfg *SlackTargetConfig,
+	payload []byte,
+) attemptResult {
+	start := time.Now()
+
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		cfg.WebhookURL,
+		bytes.NewReader(payload),
+	)
+	if err != nil {
+		return attemptResult{
+			success: false,
+			errMsg:  err.Error(),
+		}
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "webhooker/1.0")
+
+	resp, doErr := executeHTTPRequest(t.client, req)
+	durationMs := time.Since(start).Milliseconds()
+
+	if doErr != nil {
+		return attemptResult{
+			success:  false,
+			duration: durationMs,
+			errMsg: fmt.Errorf(
+				"sending request: %w", doErr,
+			).Error(),
+		}
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	return t.readSlackResponse(resp, durationMs)
+}
+
+func (t *slackTarget) readSlackResponse(
+	resp *http.Response,
+	durationMs int64,
+) attemptResult {
+	body, readErr := io.ReadAll(
+		io.LimitReader(resp.Body, maxBodyLog),
+	)
+	if readErr != nil {
+		t.eng.log.Error(
+			"failed to read Slack response body",
+			"error", readErr,
+		)
+	}
+
+	success := resp.StatusCode >= httpSuccessMin &&
+		resp.StatusCode < httpSuccessMax
+
+	errMsg := ""
+	if !success {
+		errMsg = fmt.Sprintf("HTTP %d", resp.StatusCode)
+	}
+
+	return attemptResult{
+		statusCode: resp.StatusCode,
+		respBody:   string(body),
+		duration:   durationMs,
+		success:    success,
+		errMsg:     errMsg,
+	}
+}
+
+func parseSlackConfig(
+	configJSON string,
+) (*SlackTargetConfig, error) {
+	if configJSON == "" {
+		return nil, errEmptyTargetConfig
+	}
+
+	var cfg SlackTargetConfig
+
+	err := json.Unmarshal(
+		[]byte(configJSON), &cfg,
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"parsing config JSON: %w", err,
+		)
+	}
+
+	if cfg.WebhookURL == "" {
+		return nil, errMissingWebhookURL
+	}
+
+	return &cfg, nil
+}
+
+// FormatSlackMessage builds a Slack-compatible message
+// string from a webhook event.
+func FormatSlackMessage(
+	event *database.Event,
+) string {
+	var b strings.Builder
+
+	b.WriteString("*Webhook Event Received*\n")
+
+	fmt.Fprintf(
+		&b, "*Method:* `%s`\n", event.Method,
+	)
+
+	fmt.Fprintf(
+		&b,
+		"*Content-Type:* `%s`\n",
+		event.ContentType,
+	)
+
+	fmt.Fprintf(
+		&b,
+		"*Timestamp:* `%s`\n",
+		event.CreatedAt.UTC().Format(time.RFC3339),
+	)
+
+	fmt.Fprintf(
+		&b,
+		"*Body Size:* %d bytes\n",
+		len(event.Body),
+	)
+
+	if event.Body == "" {
+		b.WriteString("\n_(empty body)_\n")
+
+		return b.String()
+	}
+
+	if formatted := formatJSONBody(event.Body); formatted != "" {
+		b.WriteString(formatted)
+
+		return b.String()
+	}
+
+	formatRawBody(&b, event.Body)
+
+	return b.String()
+}
+
+func formatJSONBody(body string) string {
+	var parsed json.RawMessage
+	if json.Unmarshal([]byte(body), &parsed) != nil {
+		return ""
+	}
+
+	var pretty bytes.Buffer
+	if json.Indent(&pretty, parsed, "", "  ") != nil {
+		return ""
+	}
+
+	var b strings.Builder
+
+	b.WriteString("\n```\n")
+
+	prettyStr := pretty.String()
+
+	const maxPayloadDisplay = 3500
+	if len(prettyStr) > maxPayloadDisplay {
+		b.WriteString(prettyStr[:maxPayloadDisplay])
+		b.WriteString("\n... (truncated)")
+	} else {
+		b.WriteString(prettyStr)
+	}
+
+	b.WriteString("\n```\n")
+
+	return b.String()
+}
+
+func formatRawBody(b *strings.Builder, body string) {
+	b.WriteString("\n```\n")
+
+	const maxRawDisplay = 3500
+	if len(body) > maxRawDisplay {
+		b.WriteString(body[:maxRawDisplay])
+		b.WriteString("\n... (truncated)")
+	} else {
+		b.WriteString(body)
+	}
+
+	b.WriteString("\n```\n")
+}

internal/handlers/profile.go

@@ -4,63 +4,202 @@ import (
 	"net/http"
 
 	"github.com/go-chi/chi"
+	"sneak.berlin/go/webhooker/internal/database"
 )
 
 // HandleProfile returns a handler for the user profile page
 func (h *Handlers) HandleProfile() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Get username from URL
+		sessionUserID, sessionUsername, ok :=
-		requestedUsername := chi.URLParam(r, "username")
+			h.profileOwnerOrDeny(w, r)
-		if requestedUsername == "" {
-			http.NotFound(w, r)
-
-			return
-		}
-
-		// Get session. RequireAuth middleware guarantees an
-		// authenticated session before this handler runs, so we
-		// only need to guard against an unexpected retrieval error.
-		sess, err := h.session.Get(r)
-		if err != nil {
-			h.log.Error("failed to get session", "error", err)
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
-			return
-		}
-
-		// Get user info from session
-		sessionUsername, ok := h.session.GetUsername(sess)
 		if !ok {
-			h.log.Error("authenticated session missing username")
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
 			return
 		}
 
-		sessionUserID, ok := h.session.GetUserID(sess)
+		h.renderProfile(w, r, sessionUserID, sessionUsername, "", "")
-		if !ok {
-			h.log.Error("authenticated session missing user ID")
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-
-			return
-		}
-
-		// For now, only allow users to view their own profile
-		if requestedUsername != sessionUsername {
-			http.Error(w, "Forbidden", http.StatusForbidden)
-
-			return
-		}
-
-		// Prepare data for template
-		data := map[string]any{
-			"User": &UserInfo{
-				ID:       sessionUserID,
-				Username: sessionUsername,
-			},
-		}
-
-		// Render the profile page
-		h.renderTemplate(w, r, "profile.html", data)
 	}
 }
+
+// HandlePasswordChange returns a handler that lets an authenticated
+// user change their own password. It is served by the CSRF- and
+// auth-protected POST /password route under /user/{username}.
+func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		sessionUserID, sessionUsername, ok :=
+			h.profileOwnerOrDeny(w, r)
+		if !ok {
+			return
+		}
+
+		// Limit request body to prevent memory exhaustion.
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<maxBodyShift)
+
+		err := r.ParseForm()
+		if err != nil {
+			h.log.Error("failed to parse form", "error", err)
+			http.Error(w, "Bad request", http.StatusBadRequest)
+
+			return
+		}
+
+		successMessage, errorMessage, handled := h.applyPasswordChange(
+			w,
+			sessionUsername,
+			r.FormValue("current_password"),
+			r.FormValue("new_password"),
+			r.FormValue("confirm_password"),
+		)
+		if !handled {
+			return
+		}
+
+		h.renderProfile(
+			w, r, sessionUserID, sessionUsername,
+			successMessage, errorMessage,
+		)
+	}
+}
+
+// applyPasswordChange verifies the current password and, on success,
+// persists a fresh hash for the user, reusing the same helpers that
+// bootstrap the admin user. It returns the success and error messages
+// to display on the profile page. On an internal failure it writes a
+// 500 response itself and returns handled=false, signalling the caller
+// to stop without re-rendering the page.
+func (h *Handlers) applyPasswordChange(
+	w http.ResponseWriter,
+	username, currentPassword, newPassword, confirmPassword string,
+) (string, string, bool) {
+	// Load the user row so we can verify the current password and
+	// persist the new hash.
+	var user database.User
+
+	err := h.db.DB().Where(
+		"username = ?", username,
+	).First(&user).Error
+	if err != nil {
+		h.serverError(
+			w, "failed to load user for password change", err,
+		)
+
+		return "", "", false
+	}
+
+	valid, err := database.VerifyPassword(
+		currentPassword, user.Password,
+	)
+	if err != nil {
+		h.serverError(w, "failed to verify password", err)
+
+		return "", "", false
+	}
+
+	if !valid {
+		return "", "Current password is incorrect.", true
+	}
+
+	if newPassword == "" {
+		return "", "New password must not be empty.", true
+	}
+
+	if newPassword != confirmPassword {
+		return "", "New password and confirmation do not match.", true
+	}
+
+	hashedPassword, err := database.HashPassword(newPassword)
+	if err != nil {
+		h.serverError(w, "failed to hash new password", err)
+
+		return "", "", false
+	}
+
+	err = h.db.DB().Model(&user).Update(
+		"password", hashedPassword,
+	).Error
+	if err != nil {
+		h.serverError(w, "failed to update password", err)
+
+		return "", "", false
+	}
+
+	h.log.Info("user changed password", "username", username)
+
+	return "Password changed successfully.", "", true
+}
+
+// profileOwnerOrDeny resolves the session identity and enforces that a
+// user may only act on their own profile (the requested username in the
+// URL must equal the session username). On any failure it writes the
+// appropriate HTTP response and returns ok=false; callers must stop
+// when ok is false.
+func (h *Handlers) profileOwnerOrDeny(
+	w http.ResponseWriter,
+	r *http.Request,
+) (string, string, bool) {
+	requestedUsername := chi.URLParam(r, "username")
+	if requestedUsername == "" {
+		http.NotFound(w, r)
+
+		return "", "", false
+	}
+
+	// RequireAuth middleware guarantees an authenticated session
+	// before this handler runs, so we only need to guard against an
+	// unexpected retrieval error.
+	sess, err := h.session.Get(r)
+	if err != nil {
+		h.serverError(w, "failed to get session", err)
+
+		return "", "", false
+	}
+
+	sessionUsername, ok := h.session.GetUsername(sess)
+	if !ok {
+		h.log.Error("authenticated session missing username")
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
+
+		return "", "", false
+	}
+
+	sessionUserID, ok := h.session.GetUserID(sess)
+	if !ok {
+		h.log.Error("authenticated session missing user ID")
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
+
+		return "", "", false
+	}
+
+	// Only allow users to act on their own profile.
+	if requestedUsername != sessionUsername {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+
+		return "", "", false
+	}
+
+	return sessionUserID, sessionUsername, true
+}
+
+// renderProfile renders the profile page for the given user,
+// optionally including a success or error message.
+func (h *Handlers) renderProfile(
+	w http.ResponseWriter,
+	r *http.Request,
+	userID, username, successMessage, errorMessage string,
+) {
+	data := map[string]any{
+		"User": &UserInfo{
+			ID:       userID,
+			Username: username,
+		},
+		"SuccessMessage": successMessage,
+		"ErrorMessage":   errorMessage,
+	}
+
+	h.renderTemplate(w, r, "profile.html", data)
+}

internal/handlers/profile_test.go

@@ -4,12 +4,15 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/middleware"
@@ -157,3 +160,134 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
+
+// passwordChangeRequest builds a POST request to the password-change
+// endpoint for the given username, attaching the supplied cookies, an
+// urlencoded form body, and the chi URL parameter the handler reads.
+func passwordChangeRequest(
+	username string,
+	cookies []*http.Cookie,
+	form url.Values,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost,
+		"/user/"+username+"/password",
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("username", username)
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+func TestHandlePasswordChange_Success(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser")
+
+	form := url.Values{}
+	form.Set("current_password", "oldpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Password changed successfully.",
+	)
+
+	var updated database.User
+
+	require.NoError(t,
+		db.DB().Where("username = ?", "pwuser").First(&updated).Error,
+	)
+	assert.NotEqual(t, oldHash, updated.Password)
+
+	valid, err := database.VerifyPassword(
+		"newpassword", updated.Password,
+	)
+	require.NoError(t, err)
+	assert.True(t, valid, "new password should verify against new hash")
+}
+
+func TestHandlePasswordChange_WrongCurrentPassword(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser2", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser2")
+
+	form := url.Values{}
+	form.Set("current_password", "wrongpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser2", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Current password is incorrect.",
+	)
+
+	var unchanged database.User
+
+	require.NoError(t,
+		db.DB().Where(
+			"username = ?", "pwuser2",
+		).First(&unchanged).Error,
+	)
+	assert.Equal(
+		t, oldHash, unchanged.Password,
+		"stored hash must be unchanged after a rejected change",
+	)
+}

internal/handlers/webhook.go

@@ -329,6 +329,7 @@ func (h *Handlers) buildDeliveryTasks(
 			DeliveryID:   dlv.ID,
 			EventID:      event.ID,
 			WebhookID:    entrypoint.WebhookID,
+			EntrypointID: entrypoint.ID,
 			TargetID:     targets[i].ID,
 			TargetName:   targets[i].Name,
 			TargetType:   targets[i].Type,

internal/middleware/export_test.go

@@ -32,3 +32,7 @@ func IsClientTLS(r *http.Request) bool {
 
 // LoginRateLimitConst exposes the loginRateLimit constant.
 const LoginRateLimitConst = loginRateLimit
+
+// PasswordChangeRateLimitConst exposes the
+// passwordChangeRateLimit constant.
+const PasswordChangeRateLimitConst = passwordChangeRateLimit

internal/middleware/middleware.go

@@ -265,6 +265,26 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	}
 }
 
+// NoCache returns middleware that instructs browsers and
+// intermediary proxies not to cache the response. It sets
+// Cache-Control: no-store and Pragma: no-cache (the latter for
+// older HTTP/1.0 intermediaries). Apply it to authenticated pages
+// so webhook configuration and captured event data are not stored
+// by caches.
+func (s *Middleware) NoCache() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			w.Header().Set("Cache-Control", "no-store")
+			w.Header().Set("Pragma", "no-cache")
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
 // MaxBodySize returns middleware that limits the request body size
 // for POST requests. If the body exceeds the given limit in
 // bytes, the server returns 413 Request Entity Too Large. This

internal/middleware/middleware_test.go

@@ -387,6 +387,45 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
+// --- NoCache Middleware Tests ---
+
+func TestNoCache_SetsHeaders(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	var called bool
+
+	handler := m.NoCache()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/sources", nil,
+	)
+	w := httptest.NewRecorder()
+
+	handler.ServeHTTP(w, req)
+
+	assert.True(
+		t, called,
+		"NoCache middleware should call the next handler",
+	)
+	assert.Equal(
+		t, "no-store",
+		w.Header().Get("Cache-Control"),
+	)
+	assert.Equal(
+		t, "no-cache",
+		w.Header().Get("Pragma"),
+	)
+}
+
 // --- Helper Tests ---
 
 func TestIpFromHostPort(t *testing.T) {

internal/middleware/ratelimit.go

@@ -14,6 +14,16 @@ const (
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
+
+	// passwordChangeRateLimit is the maximum number of password
+	// change attempts per interval. Each attempt verifies the
+	// current password, so the endpoint must be rate-limited
+	// like any other password-based authentication endpoint.
+	passwordChangeRateLimit = 5
+
+	// passwordChangeRateInterval is the time window for the
+	// password change rate limit.
+	passwordChangeRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -24,19 +34,53 @@ const (
 // honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
 // for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
-	limiter := httprate.Limit(
+	return m.postRateLimit(
 		loginRateLimit,
 		loginRateInterval,
+		"login rate limit exceeded",
+		"Too many login attempts. Please try again later.",
+	)
+}
+
+// PasswordChangeRateLimit returns middleware that enforces
+// per-IP rate limiting on password change attempts. The change
+// endpoint verifies the current password, so without a limit a
+// stolen session could be used to brute-force it; the limit
+// matches the login endpoint's.
+func (m *Middleware) PasswordChangeRateLimit() func(http.Handler) http.Handler {
+	return m.postRateLimit(
+		passwordChangeRateLimit,
+		passwordChangeRateInterval,
+		"password change rate limit exceeded",
+		"Too many password change attempts. "+
+			"Please try again later.",
+	)
+}
+
+// postRateLimit builds middleware that enforces a per-IP rate
+// limit on POST requests only; all other methods pass through
+// unaffected. Requests over the limit receive a 429 with the
+// given response message, and each rejection is logged with the
+// given log message. IP extraction honours X-Forwarded-For,
+// X-Real-IP, and True-Client-IP headers for reverse-proxy
+// setups.
+func (m *Middleware) postRateLimit(
+	limit int,
+	interval time.Duration,
+	logMessage, responseMessage string,
+) func(http.Handler) http.Handler {
+	limiter := httprate.Limit(
+		limit,
+		interval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
 		httprate.WithLimitHandler(http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				m.log.Warn("login rate limit exceeded",
+				m.log.Warn(logMessage,
 					"path", r.URL.Path,
 				)
 				http.Error(
 					w,
-					"Too many login attempts. "+
+					responseMessage,
-						"Please try again later.",
 					http.StatusTooManyRequests,
 				)
 			},
@@ -50,8 +94,7 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			// Only rate-limit POST requests (actual login
+			// Only rate-limit POST requests.
-			// attempts)
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)
 

internal/middleware/ratelimit_test.go

@@ -46,14 +46,20 @@ func TestLoginRateLimit_AllowsGET(t *testing.T) {
 	assert.Equal(t, 20, callCount)
 }
 
-func TestLoginRateLimit_LimitsPOST(t *testing.T) {
+// runPostLimitTest exercises a POST-only rate limit middleware:
-	t.Parallel()
+// the first limit POSTs to path from ip must pass, and the next
-
+// one must be rejected with 429 without reaching the handler.
-	m, _ := testMiddleware(t, config.EnvironmentDev)
+func runPostLimitTest(
+	t *testing.T,
+	mw func(http.Handler) http.Handler,
+	limit int,
+	path, ip string,
+) {
+	t.Helper()
 
 	var callCount int
 
-	handler := m.LoginRateLimit()(http.HandlerFunc(
+	handler := mw(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			callCount++
 
@@ -61,13 +67,13 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		},
 	))
 
-	// First loginRateLimit POST requests should succeed
+	// The first limit POST requests should succeed
-	for i := range middleware.LoginRateLimitConst {
+	for i := range limit {
 		req := httptest.NewRequestWithContext(
 			context.Background(),
-			http.MethodPost, "/pages/login", nil,
+			http.MethodPost, path, nil,
 		)
-		req.RemoteAddr = "10.0.0.1:12345"
+		req.RemoteAddr = ip
 
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
@@ -81,9 +87,9 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 	// Next POST should be rate-limited
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodPost, "/pages/login", nil,
+		http.MethodPost, path, nil,
 	)
-	req.RemoteAddr = "10.0.0.1:12345"
+	req.RemoteAddr = ip
 
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
@@ -92,7 +98,35 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		t, http.StatusTooManyRequests, w.Code,
 		"POST after limit should be 429",
 	)
-	assert.Equal(t, middleware.LoginRateLimitConst, callCount)
+	assert.Equal(t, limit, callCount)
+}
+
+func TestLoginRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.LoginRateLimit(),
+		middleware.LoginRateLimitConst,
+		"/pages/login",
+		"10.0.0.1:12345",
+	)
+}
+
+func TestPasswordChangeRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.PasswordChangeRateLimit(),
+		middleware.PasswordChangeRateLimitConst,
+		"/user/admin/password",
+		"10.0.0.2:12345",
+	)
 }
 
 func TestLoginRateLimit_IndependentPerIP(t *testing.T) {

internal/server/routes.go

@@ -91,6 +91,7 @@ func (s *Server) setupRoutes() {
 func (s *Server) setupPageRoutes() {
 	s.router.Route("/pages", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
+		r.Use(s.mw.NoCache())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 
 		r.Group(func(r chi.Router) {
@@ -106,14 +107,19 @@ func (s *Server) setupPageRoutes() {
 func (s *Server) setupUserRoutes() {
 	s.router.Route("/user/{username}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
+		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
+		r.With(s.mw.PasswordChangeRateLimit()).Post(
+			"/password", s.h.HandlePasswordChange(),
+		)
 	})
 }
 
 func (s *Server) setupSourceRoutes() {
 	s.router.Route("/sources", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
+		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceList())
@@ -123,6 +129,7 @@ func (s *Server) setupSourceRoutes() {
 
 	s.router.Route("/source/{sourceID}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
+		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceDetail())

templates/profile.html

@@ -6,6 +6,18 @@
 <div class="max-w-4xl mx-auto px-6 py-12">
     <h1 class="text-2xl font-medium text-gray-900 mb-6">User Profile</h1>
 
+    {{if .SuccessMessage}}
+    <div class="alert-success">
+        <span>{{.SuccessMessage}}</span>
+    </div>
+    {{end}}
+
+    {{if .ErrorMessage}}
+    <div class="alert-error">
+        <span>{{.ErrorMessage}}</span>
+    </div>
+    {{end}}
+
     <div class="card p-6">
         <div class="flex items-center mb-6">
             <div class="mr-4">
@@ -43,6 +55,50 @@
         </div>
     </div>
 
+    <div class="card p-6 mt-6">
+        <h3 class="text-lg font-medium text-gray-900 mb-3">Change Password</h3>
+        <form method="POST" action="/user/{{.User.Username}}/password" class="space-y-6">
+            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+            <div class="form-group">
+                <label for="current_password" class="label">Current Password</label>
+                <input
+                    type="password"
+                    id="current_password"
+                    name="current_password"
+                    required
+                    autocomplete="current-password"
+                    class="input"
+                >
+            </div>
+
+            <div class="form-group">
+                <label for="new_password" class="label">New Password</label>
+                <input
+                    type="password"
+                    id="new_password"
+                    name="new_password"
+                    required
+                    autocomplete="new-password"
+                    class="input"
+                >
+            </div>
+
+            <div class="form-group">
+                <label for="confirm_password" class="label">Confirm New Password</label>
+                <input
+                    type="password"
+                    id="confirm_password"
+                    name="confirm_password"
+                    required
+                    autocomplete="new-password"
+                    class="input"
+                >
+            </div>
+
+            <button type="submit" class="btn-primary">Change Password</button>
+        </form>
+    </div>
+
     <div class="mt-6">
         <a href="/" class="btn-secondary">Back to Home</a>
     </div>