Rate-limit the public webhook receiver endpoint (closes #64)

The public receiver /webhook/{uuid} had no rate limiting: anyone
who learns an entrypoint UUID can flood it, inflating the
per-webhook database and the delivery queue.

Add a dedicated limit scoped to the receiver route, keyed per
client IP per request path (the path contains the entrypoint
UUID), so one misbehaving sender is throttled without affecting
other senders of the same entrypoint or other entrypoints.
Requests over the limit get a 429; httprate adds the Retry-After
header per RFC 6585. IP extraction honours X-Forwarded-For,
X-Real-IP, and True-Client-IP for reverse-proxy deployments.

The limit is RECEIVER_RATE_LIMIT requests per minute, default
120. A set-but-unparseable or non-positive value aborts startup
via the new envPositiveInt strict parser rather than silently
falling back to the default. envInt's other callers are
unchanged; converting them is tracked in #80.

Also update the README env table and Rate Limiting design
section, and sync TODO.md.

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,17 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
-    lll:
+linters-settings:
-      line-length: 88
+  lll:
-    funlen:
+    line-length: 88
-      lines: 80
+  funlen:
-      statements: 50
+    lines: 80
-    cyclop:
+    statements: 50
-      max-complexity: 15
+  cyclop:
-    dupl:
+    max-complexity: 15
-      threshold: 100
+  dupl:
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,8 +1,8 @@
 # Lint stage
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+# golangci/golangci-lint:v2.11.3 (Debian-based), 2026-03-17
 # Using Debian-based image because mattn/go-sqlite3 (CGO) does not
 # compile on Alpine musl (off64_t is a glibc type).
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+FROM golangci/golangci-lint:v2.11.3@sha256:e838e8ab68aaefe83e2408691510867ade9329c0e0b895a3fb35eb93d1c2a4ba AS lint
 
 RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -92,6 +92,7 @@ TTY detection, and security headers are always applied.
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN          | `""`     |
+| `RECEIVER_RATE_LIMIT`   | Receiver requests/minute per IP per entrypoint | `120` |
 
 On first startup, webhooker automatically generates a cryptographically
 secure session encryption key and stores it in the database. This key
@@ -307,29 +308,13 @@ event routing.
 | `user_id`        | UUID    | Foreign key → User |
 | `name`           | string  | Human-readable name |
 | `description`    | string  | Optional description |
-| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |
+| `retention_days` | integer | Days to retain events (default: 30) |
 
 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.
 
 The `retention_days` field controls how long event data is kept in the
 webhook's dedicated database before automatic cleanup.
 
-Setting `retention_days` to `0` means "retain events forever". Because
-the column carries a default of 30, a literal zero cannot survive an
-insert, so a zero is rewritten on save to a sentinel of `365 * 1000`
-days (`database.RetentionForeverDays`). The retention reaper recognises
-that sentinel and skips the webhook entirely, and the web UI displays
-such a webhook's retention as "forever" rather than as a day count.
-
-A *finite* retention is capped at `database.MaxFiniteRetentionDays`
-(106751 days, about 292 years), and a larger one is rejected with a
-400. The cap is not arbitrary: the reaper computes its cutoff as a
-`time.Duration`, an int64 nanosecond count, and a longer period
-overflows it. An overflowed cutoff lands in the future, where it
-matches every row, so the sweep would delete every event the webhook
-has instead of none. The reaper also clamps the value it is given, so a
-row written by an older version cannot trigger that either.
-
 #### Entrypoint
 
 A receiver URL where external services POST webhook events. Each
@@ -379,12 +364,10 @@ events should be forwarded.
   greater than 0, failed deliveries are retried with exponential backoff
   up to `max_retries` attempts, protected by a per-target circuit
   breaker.
-- **`database`** — Archive the full event as a row into a separate
+- **`database`** — Confirm the event is stored in the webhook's
-  per-webhook archive database (`archive-{webhookID}.db`) for long-term
+  per-webhook database (no external delivery). Since events are always
-  retention, with an optional creation-validated expiry (default: keep
+  written to the per-webhook DB on ingestion, this target marks delivery
-  forever). No external delivery and no retries; an archive write
+  as immediately successful. Useful for ensuring durable event archival.
-  failure fails the delivery. See the database target section under
-  "Per-Webhook Event Databases" for the full semantics.
 - **`log`** — Write the event to the application log (stdout). Useful
   for debugging.
 
@@ -525,27 +508,16 @@ This separation provides:
   DB; the event database file is hard-deleted (permanently removed).
 - **Per-webhook retention** — the `retention_days` field on each webhook
   controls automatic cleanup of old events in that webhook's database
-  only, or disables cleanup entirely when set to `0` (retain forever).
+  only.
 - **Performance** — each webhook's database has its own WAL, its own
   page cache, and its own lock, so concurrent event ingestion across
   webhooks won't contend.
 
-The **database target type** builds on this architecture to provide
+The **database target type** leverages this architecture: since events
-long-term archiving, separate from the per-webhook event database (which
+are already stored in the per-webhook database by design, the database
-may prune events under its own retention). Delivering to a database
+target simply marks the delivery as immediately successful. The
-target writes the full event — body, headers, method, content type, and
+per-webhook DB IS the dedicated event database — that's the whole point
-webhook/entrypoint/event identifiers — as a row into a dedicated archive
+of the database target type.
-database, `archive-{webhookID}.db`, stored under the data directory
-beside the event database. After each write the archive handle is closed
-and reopened, debounced to at most once per second, so an operator can
-move the archive file away for offline archiving without stopping the
-service; a moved or removed archive file is recreated automatically on
-the next write. An optional `expiry` in the target's config JSON (e.g.
-`{"expiry":"720h"}`) is validated when the target is created — the
-default (unset or the literal `never`) keeps rows forever — and rows
-older than the expiry are pruned each time the archive is (re)opened. An
-archive write failure is never silent success: the delivery records a
-failed attempt with the error and is marked failed.
 
 The **Slack target type** sends webhook events as formatted messages to
 any Slack-compatible incoming webhook URL (works with Slack, Mattermost,
@@ -705,17 +677,24 @@ just delayed until the target is healthy again.
 
 ### Rate Limiting
 
-Global rate limiting middleware (e.g., per-IP throttling applied at the
+Global blanket rate limiting middleware (e.g., a per-IP throttle shared
-router level) **must not** apply to webhook receiver endpoints. Webhook
+with the web UI) **must not** apply to webhook receiver endpoints.
-endpoints receive automated traffic from external services at
+Webhook endpoints receive automated traffic from external services at
-unpredictable rates, and blanket rate limits would cause legitimate
+unpredictable rates, and blanket limits shared with other routes would
-deliveries to be dropped.
+cause legitimate deliveries to be dropped.
 
-Instead, each webhook has its own individually configurable rate limit,
+The receiver instead has its own dedicated abuse limit, scoped to the
-applied within the webhook handler itself. By default, no rate limit is
+`/webhook/{uuid}` route only and keyed per client IP per entrypoint: one
-applied — webhook endpoints accept traffic as fast as it arrives. Rate
+misbehaving sender is throttled without affecting other senders of the
-limits can be configured per-webhook when needed (e.g., to protect
+same entrypoint or the same sender's other entrypoints. The limit is
-against a misbehaving sender).
+`RECEIVER_RATE_LIMIT` requests per minute (default 120, generous for
+legitimate webhook senders). Requests over the limit receive HTTP 429
+with a `Retry-After` header. A set-but-invalid `RECEIVER_RATE_LIMIT`
+value aborts startup rather than silently falling back to the default.
+
+Finer-grained per-webhook rate limits (configured in the web UI and
+enforced in the webhook handler) can layer on top of this env-level
+abuse limit later; they are tracked as future work.
 
 ### API Endpoints
 

TODO.md

@@ -10,40 +10,27 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (afe88c6) is a working webhook proxy
+pre-1.0. No git tags exist. main (81413c5) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
-policy compliance (#6), and pinned lint tooling (#55). Note: TODO.md was
+policy compliance (#6), pinned lint tooling (#55), a per-webhook event
-deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
+retention reaper (#63), and delivery targets behind a Target interface
-content was folded into the README TODO section, which this draft
+(#77). Work is tracked as Gitea issues (the authoritative TODO); this
-reconstructs as of 2026-07-06.
+file is a summary. Note: TODO.md was deliberately deleted from this
+repo in f9a9569 (2026-03-01, #6); its content was folded into the
+README TODO section, which this draft reconstructs as of 2026-07-06.
 
 # Next Step
 
-Implement automatic event retention cleanup based on retention_days: a
+Manual event redelivery from the web UI (replay is a core promised
-periodic maintenance job that deletes Events, Deliveries, and
+capability in the README rationale).
-DeliveryResults older than the parent webhook's retention_days from each
-per-webhook event database. The field exists on the Webhook model and
-the README promises the behavior, but nothing enforces it, so event
-databases currently grow without bound.
 
 # Completed Steps
 
-- 2026-08-09 Make retain-forever reachable from the normal create and
+- 2026-08-07 Rate-limit the public webhook receiver per client IP per
-  edit flows (#79): a `RetentionForeverDays = 365 * 1000` sentinel, a
+  entrypoint, env-configurable with fail-loud parsing (#64)
-  `Webhook.BeforeSave` hook rewriting any non-positive `retention_days`
+- 2026-08-07 Per-webhook event retention reaper (#63); NoCache
-  to it ahead of GORM's own column defaulting, a reaper that skips such
+  middleware for authenticated pages (#61); Target interface refactor
-  webhooks outright, form validation that honours `0` and rejects
+  (#77)
-  garbage with a 400, and a retention UI that says "forever". Also
-  closes the overflow the same code path exposed: a finite
-  `retention_days` above `MaxFiniteRetentionDays` (106751, derived from
-  what an int64 `time.Duration` can hold) wrapped the reaper's cutoff
-  into the future and deleted every event, so it is now rejected at the
-  form and clamped in the reaper
-- 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
-  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
-  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
-  `lll`/`funlen`/`cyclop`/`dupl` thresholds actually apply), and fix
-  all newly surfaced lint findings
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)
@@ -67,12 +54,10 @@ databases currently grow without bound.
 
 # Future Steps
 
-- Manual event redelivery from the web UI (replay is a core promised
-  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
-  plus handler enforcement; global limits must not apply to receiver
+  plus handler enforcement, layered on the env-level receiver limit
-  endpoints)
+  from #64; global limits must not apply to receiver endpoints)
 - Webhook signature verification for GitHub and Stripe HMAC formats
 - API key authentication for programmatic access (APIKey model exists;
   Bearer token middleware does not)

internal/config/config.go

@@ -31,12 +31,23 @@ const (
 	// defaultRetentionSweepInterval is how often the retention
 	// reaper deletes events older than each webhook's RetentionDays.
 	defaultRetentionSweepInterval = time.Hour
+
+	// defaultReceiverRateLimit is the default number of requests
+	// per minute each client IP may send to a single webhook
+	// receiver entrypoint. Generous for legitimate webhook
+	// senders while bounding abuse of the one unauthenticated,
+	// internet-exposed endpoint.
+	defaultReceiverRateLimit = 120
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
 // contains an unrecognised value.
 var ErrInvalidEnvironment = errors.New("invalid environment")
 
+// ErrNonPositiveValue is returned when an environment variable that
+// requires a positive integer is set to zero or a negative number.
+var ErrNonPositiveValue = errors.New("value must be positive")
+
 //nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
@@ -60,6 +71,10 @@ type Config struct {
 	// RetentionSweepInterval is how often the retention reaper runs.
 	RetentionSweepInterval time.Duration
 
+	// ReceiverRateLimit is the number of requests per minute each
+	// client IP may send to a single webhook receiver entrypoint.
+	ReceiverRateLimit int
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -104,6 +119,38 @@ func envInt(key string, defaultValue int) int {
 	return defaultValue
 }
 
+// envPositiveInt returns the value of the named environment variable
+// parsed as a positive integer. Returns defaultValue if not set. If
+// the variable is set but cannot be parsed, or parses to less than
+// one, it returns a wrapped error naming the key and the bad value,
+// so startup fails loudly rather than silently falling back to the
+// default.
+func envPositiveInt(
+	key string,
+	defaultValue int,
+) (int, error) {
+	v := os.Getenv(key)
+	if v == "" {
+		return defaultValue, nil
+	}
+
+	i, err := strconv.Atoi(v)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"invalid integer for %s: %q: %w", key, v, err,
+		)
+	}
+
+	if i < 1 {
+		return 0, fmt.Errorf(
+			"%w: %s must be at least 1, got %q",
+			ErrNonPositiveValue, key, v,
+		)
+	}
+
+	return i, nil
+}
+
 // envDuration returns the value of the named environment variable
 // parsed as a Go duration (e.g. "1h", "30m"). Returns defaultValue if
 // not set. If the variable is set but cannot be parsed, it returns a
@@ -128,27 +175,35 @@ func envDuration(
 	return d, nil
 }
 
+// resolveEnvironment reads WEBHOOKER_ENVIRONMENT, defaulting to
+// dev, and rejects unrecognised values.
+func resolveEnvironment() (string, error) {
+	environment := os.Getenv("WEBHOOKER_ENVIRONMENT")
+	if environment == "" {
+		environment = EnvironmentDev
+	}
+
+	if environment != EnvironmentDev &&
+		environment != EnvironmentProd {
+		return "", fmt.Errorf(
+			"%w: WEBHOOKER_ENVIRONMENT must be '%s' or '%s', got '%s'",
+			ErrInvalidEnvironment,
+			EnvironmentDev, EnvironmentProd, environment,
+		)
+	}
+
+	return environment, nil
+}
+
 // New creates a Config by reading environment variables.
 //
 //nolint:revive // lc parameter is required by fx even if unused.
 func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 	log := params.Logger.Get()
 
-	// Determine environment from WEBHOOKER_ENVIRONMENT env var,
+	environment, err := resolveEnvironment()
-	// default to dev
+	if err != nil {
-	environment := os.Getenv("WEBHOOKER_ENVIRONMENT")
+		return nil, err
-	if environment == "" {
-		environment = EnvironmentDev
-	}
-
-	// Validate environment
-	if environment != EnvironmentDev &&
-		environment != EnvironmentProd {
-		return nil, fmt.Errorf(
-			"%w: WEBHOOKER_ENVIRONMENT must be '%s' or '%s', got '%s'",
-			ErrInvalidEnvironment,
-			EnvironmentDev, EnvironmentProd, environment,
-		)
 	}
 
 	// Parse the retention sweep interval; a set-but-unparseable value
@@ -162,6 +217,17 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		return nil, err
 	}
 
+	// Parse the receiver rate limit; a set-but-unparseable or
+	// non-positive value is a hard error so fx aborts startup
+	// rather than silently using the default.
+	receiverRateLimit, err := envPositiveInt(
+		"RECEIVER_RATE_LIMIT",
+		defaultReceiverRateLimit,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	// Load configuration values from environment variables
 	s := &Config{
 		DataDir:                envString("DATA_DIR"),
@@ -173,6 +239,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		Port:                   envInt("PORT", defaultPort),
 		SentryDSN:              envString("SENTRY_DSN"),
 		RetentionSweepInterval: retentionSweepInterval,
+		ReceiverRateLimit:      receiverRateLimit,
 		log:                    log,
 		params:                 &params,
 	}
@@ -197,6 +264,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"maintenanceMode", s.MaintenanceMode,
 		"dataDir", s.DataDir,
 		"retentionSweepInterval", s.RetentionSweepInterval.String(),
+		"receiverRateLimit", s.ReceiverRateLimit,
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth",
 		s.MetricsUsername != "" && s.MetricsPassword != "",

internal/config/config_test.go

@@ -258,3 +258,109 @@ func TestDefaultDataDir(t *testing.T) {
 		})
 	}
 }
+
+func TestReceiverRateLimit(t *testing.T) {
+	tests := []struct {
+		name        string
+		set         bool
+		value       string
+		expectError bool
+		expected    int
+	}{
+		{
+			name:     "unset uses default",
+			set:      false,
+			expected: 120,
+		},
+		{
+			name:     "valid value is parsed",
+			set:      true,
+			value:    "30",
+			expected: 30,
+		},
+		{
+			name:        "unparseable value fails startup",
+			set:         true,
+			value:       "not-a-number",
+			expectError: true,
+		},
+		{
+			name:        "zero fails startup",
+			set:         true,
+			value:       "0",
+			expectError: true,
+		},
+		{
+			name:        "negative fails startup",
+			set:         true,
+			value:       "-5",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
+
+			if tt.set {
+				t.Setenv("RECEIVER_RATE_LIMIT", tt.value)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"RECEIVER_RATE_LIMIT",
+				))
+			}
+
+			if tt.expectError {
+				testReceiverRateLimitError(t)
+			} else {
+				testReceiverRateLimitSuccess(t, tt.expected)
+			}
+		})
+	}
+}
+
+func testReceiverRateLimitError(t *testing.T) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fx.New(
+		fx.NopLogger,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+
+	assert.Error(t, app.Err())
+}
+
+func testReceiverRateLimitSuccess(
+	t *testing.T,
+	expected int,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, expected, cfg.ReceiverRateLimit)
+}

internal/database/database_test.go

@@ -11,20 +11,6 @@ import (
 	"sneak.berlin/go/webhooker/internal/logger"
 )
 
-const (
-	// testAppname is the Globals.Appname used in tests.
-	testAppname = "webhooker-test"
-	// testVersion is the Globals.Version used in tests.
-	testVersion = "test"
-	// testContentType is the event content type used in tests.
-	testContentType = "application/json"
-	// testWebhookName is the Webhook.Name used in tests.
-	testWebhookName = "test-webhook"
-	// testForeverLabel is Webhook.RetentionLabel for a retain-forever
-	// webhook.
-	testForeverLabel = "forever"
-)
-
 func setupTestDB(
 	t *testing.T,
 ) (*database.Database, *fxtest.Lifecycle) {
@@ -33,8 +19,8 @@ func setupTestDB(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
+		Appname: "webhooker-test",
-		Version: testVersion,
+		Version: "test",
 	}
 
 	l, err := logger.New(

internal/database/model_entrypoint.go

@@ -4,13 +4,10 @@ package database
 type Entrypoint struct {
 	BaseModel
 
-	WebhookID string `gorm:"type:uuid;not null" json:"webhookId"`
+	WebhookID   string `gorm:"type:uuid;not null"   json:"webhookId"`
-
+	Path        string `gorm:"uniqueIndex;not null" json:"path"` // URL path for this entrypoint
-	// Path is the URL path for this entrypoint.
-	Path string `gorm:"uniqueIndex;not null" json:"path"`
-
 	Description string `json:"description"`
-	Active      bool   `gorm:"default:true" json:"active"`
+	Active      bool   `gorm:"default:true"         json:"active"`
 
 	// Relations
 	Webhook Webhook `json:"webhook,omitzero"`

internal/database/model_target.go

@@ -23,8 +23,7 @@ type Target struct {
 	// Configuration fields (JSON stored based on type)
 	Config string `gorm:"type:text" json:"config"` // JSON configuration
 
-	// For HTTP targets (max_retries=0 means fire-and-forget,
+	// For HTTP targets (max_retries=0 means fire-and-forget, >0 enables retries with backoff)
-	// >0 enables retries with backoff)
 	MaxRetries   int `json:"maxRetries,omitempty"`
 	MaxQueueSize int `json:"maxQueueSize,omitempty"`
 

internal/database/model_webhook.go

@@ -1,125 +1,16 @@
 package database
 
-import (
-	"math"
-	"strconv"
-	"time"
-
-	"gorm.io/gorm"
-)
-
-const (
-	// DefaultRetentionDays is the event retention period applied to a
-	// webhook created without an explicit retention value. It is the
-	// single source of truth for that policy and must stay in sync
-	// with the `gorm:"default:30"` column default on
-	// Webhook.RetentionDays below; a struct tag cannot reference a
-	// constant, so a test asserts the two agree.
-	DefaultRetentionDays = 30
-
-	// RetentionForeverDays is the sentinel RetentionDays value meaning
-	// "retain events forever". Users express that intent as 0, which
-	// Webhook.BeforeSave rewrites to this value: the column default
-	// substitutes DefaultRetentionDays for a zero value at insert
-	// time, so a zero can never survive a round trip to the database.
-	// Nothing outside this file may hardcode the number.
-	RetentionForeverDays = 365 * 1000
-
-	// MaxFiniteRetentionDays is the largest finite retention period the
-	// reaper's cutoff arithmetic can represent, and therefore the
-	// largest one a caller may request. It is derived from that
-	// arithmetic rather than picked: retentionCutoff computes
-	// retentionDays * hoursPerDay * time.Hour, and a time.Duration is
-	// an int64 nanosecond count, so math.MaxInt64 nanoseconds divided
-	// by an hour and then by a day is the exact ceiling — 106751 days,
-	// a little over 292 years.
-	//
-	// One day more overflows int64, wraps the product negative, and
-	// turns the cutoff into a timestamp in the far future that matches
-	// every row in the webhook's database. That is why this bound is
-	// enforced on input and why retentionCutoff saturates underneath
-	// it. Note that RetentionForeverDays deliberately sits above this
-	// ceiling: such webhooks are skipped before any cutoff is
-	// computed, and never reach the arithmetic at all.
-	MaxFiniteRetentionDays = int(
-		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
-	)
-)
-
 // Webhook represents a webhook processing unit that groups entrypoints and targets
-//
-// Every method below takes a pointer receiver. BeforeSave has to,
-// because it mutates the record and GORM only invokes hooks declared
-// that way; the display helpers follow suit so the receiver kinds do
-// not mix. Handlers therefore put a *Webhook into template data:
-// html/template cannot call a pointer method on a value held in a map,
-// because a map element is not addressable.
 type Webhook struct {
 	BaseModel
 
-	UserID      string `gorm:"type:uuid;not null" json:"userId"`
+	UserID        string `gorm:"type:uuid;not null" json:"userId"`
-	Name        string `gorm:"not null"           json:"name"`
+	Name          string `gorm:"not null"           json:"name"`
-	Description string `json:"description"`
+	Description   string `json:"description"`
-
+	RetentionDays int    `gorm:"default:30"         json:"retentionDays"` // Days to retain events
-	// RetentionDays is the number of days to retain events. A value of
-	// RetentionForeverDays means retain forever. The column default
-	// must equal DefaultRetentionDays.
-	RetentionDays int `gorm:"default:30" json:"retentionDays"`
 
 	// Relations
 	User        User         `json:"user,omitzero"`
 	Entrypoints []Entrypoint `json:"entrypoints,omitempty"`
 	Targets     []Target     `json:"targets,omitempty"`
 }
-
-// BeforeSave normalises RetentionDays on every insert and update. A
-// non-positive value is the user's way of asking for "retain forever",
-// which is stored as the RetentionForeverDays sentinel.
-//
-// This has to happen in a hook rather than at the call sites. GORM
-// substitutes the column default (DefaultRetentionDays) for a zero
-// value while building the insert statement, which runs after
-// BeforeSave; rewriting any later than this loses that race and the
-// row lands at 30 days. Living on the model also means a future call
-// site — a REST API, a fixture, a migration — cannot bypass it.
-func (w *Webhook) BeforeSave(_ *gorm.DB) error {
-	if w.RetentionDays <= 0 {
-		w.RetentionDays = RetentionForeverDays
-	}
-
-	return nil
-}
-
-// retainsForever reports whether a stored RetentionDays value means
-// "keep events indefinitely". It is the single definition of that
-// question, shared by Webhook.RetainsForever and by the reaper's
-// cutoff computation so the two cannot disagree about which webhooks
-// are exempt from reaping.
-//
-// It accepts the RetentionForeverDays sentinel written by BeforeSave
-// and, defensively, the non-positive values that rows written before
-// the sentinel existed may still carry.
-func retainsForever(retentionDays int) bool {
-	return retentionDays <= 0 ||
-		retentionDays >= RetentionForeverDays
-}
-
-// RetainsForever reports whether this webhook's events are kept
-// indefinitely.
-func (w *Webhook) RetainsForever() bool {
-	return retainsForever(w.RetentionDays)
-}
-
-// RetentionLabel returns the webhook's retention policy as display
-// text, so that no template has to know about the sentinel value.
-func (w *Webhook) RetentionLabel() string {
-	if w.RetainsForever() {
-		return "forever"
-	}
-
-	if w.RetentionDays == 1 {
-		return "1 day"
-	}
-
-	return strconv.Itoa(w.RetentionDays) + " days"
-}

internal/database/model_webhook_test.go

@@ -1,222 +0,0 @@
-package database_test
-
-import (
-	"context"
-	"reflect"
-	"strconv"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// startedTestDB returns a started main database for model-level tests.
-func startedTestDB(t *testing.T) *gorm.DB {
-	t.Helper()
-
-	db, lc := setupTestDB(t)
-
-	ctx := context.Background()
-	require.NoError(t, lc.Start(ctx))
-	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
-
-	return db.DB()
-}
-
-// storedRetention reads the retention_days column straight out of the
-// row, so the assertion is about what was persisted rather than about
-// whatever the in-memory struct happens to hold.
-func storedRetention(t *testing.T, db *gorm.DB, id string) int {
-	t.Helper()
-
-	var got int
-
-	require.NoError(
-		t,
-		db.Model(&database.Webhook{}).
-			Where("id = ?", id).
-			Pluck("retention_days", &got).Error,
-	)
-
-	return got
-}
-
-// newWebhookWithRetention creates a webhook through the ordinary Create
-// path, so the BeforeSave hook and the GORM column default both apply
-// exactly as they do in production.
-func newWebhookWithRetention(
-	t *testing.T,
-	db *gorm.DB,
-	wh *database.Webhook,
-) string {
-	t.Helper()
-
-	wh.UserID = uuid.New().String()
-	wh.Name = testWebhookName
-
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
-	return wh.ID
-}
-
-func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 0}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-		"a zero retention must be stored as the sentinel, "+
-			"not replaced by the column default",
-	)
-}
-
-func TestWebhookBeforeSave_NegativeBecomesForeverSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: -5}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 7}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(t, 7, storedRetention(t, db, id))
-}
-
-// TestWebhookBeforeSave_UpdateToZeroBecomesSentinel proves the hook
-// fires on update as well as insert, via the same Save call the edit
-// handler makes.
-func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 30}
-	id := newWebhookWithRetention(t, db, wh)
-	require.Equal(t, 30, storedRetention(t, db, id))
-
-	wh.RetentionDays = 0
-	require.NoError(t, db.Omit(clause.Associations).Save(wh).Error)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-// TestWebhookRetentionColumnDefaultMatchesConstant guards the one place
-// the default lives twice: a struct tag cannot reference a constant, so
-// this asserts the tag and DefaultRetentionDays agree.
-func TestWebhookRetentionColumnDefaultMatchesConstant(t *testing.T) {
-	t.Parallel()
-
-	field, ok := reflect.TypeFor[database.Webhook]().
-		FieldByName("RetentionDays")
-	require.True(t, ok, "Webhook.RetentionDays must exist")
-
-	assert.Equal(
-		t,
-		"default:"+strconv.Itoa(database.DefaultRetentionDays),
-		field.Tag.Get("gorm"),
-	)
-}
-
-// TestMaxFiniteRetentionDaysIsTheOverflowCeiling asserts that the
-// constant is exactly where the cutoff arithmetic stops working, which
-// is what makes it a derived bound rather than a round number someone
-// liked. One day more wraps the int64 nanosecond count negative, and a
-// negative span is precisely what turned a cutoff into a future
-// timestamp that matched — and deleted — every row.
-//
-// The multiplications are done through variables on purpose: as
-// constant expressions the overflowing one would not compile.
-func TestMaxFiniteRetentionDaysIsTheOverflowCeiling(t *testing.T) {
-	t.Parallel()
-
-	const hoursPerDay = 24
-
-	atCeiling := database.MaxFiniteRetentionDays
-	overCeiling := database.MaxFiniteRetentionDays + 1
-
-	assert.Positive(
-		t,
-		time.Duration(atCeiling*hoursPerDay)*time.Hour,
-		"the ceiling itself must still be representable",
-	)
-	assert.Negative(
-		t,
-		time.Duration(overCeiling*hoursPerDay)*time.Hour,
-		"one day past the ceiling must overflow",
-	)
-
-	assert.Less(
-		t,
-		database.MaxFiniteRetentionDays,
-		database.RetentionForeverDays,
-		"the sentinel sits above the ceiling and is only safe "+
-			"because retain-forever webhooks skip the arithmetic",
-	)
-}
-
-func TestWebhookRetainsForeverAndLabel(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		days    int
-		forever bool
-		label   string
-	}{
-		{
-			"sentinel",
-			database.RetentionForeverDays, true, testForeverLabel,
-		},
-		{
-			"above sentinel",
-			database.RetentionForeverDays + 1, true, testForeverLabel,
-		},
-		{"legacy zero", 0, true, testForeverLabel},
-		{"legacy negative", -1, true, testForeverLabel},
-		{"default", database.DefaultRetentionDays, false, "30 days"},
-		{"one day", 1, false, "1 day"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			wh := database.Webhook{RetentionDays: tc.days}
-
-			assert.Equal(t, tc.forever, wh.RetainsForever())
-			assert.Equal(t, tc.label, wh.RetentionLabel())
-		})
-	}
-}

internal/database/retention.go

@@ -114,8 +114,7 @@ func (r *RetentionReaper) run(ctx context.Context) {
 }
 
 // sweep lists every webhook from the main database and reaps expired
-// rows from each per-webhook database that has a finite retention
+// rows from each per-webhook database whose RetentionDays is positive.
-// policy. Webhooks set to retain forever are skipped entirely.
 func (r *RetentionReaper) sweep(ctx context.Context) {
 	var webhooks []Webhook
 
@@ -140,13 +139,8 @@ func (r *RetentionReaper) sweep(ctx context.Context) {
 
 		wh := webhooks[i]
 
-		// Skip retain-forever webhooks before building any query.
+		// RetentionDays of zero or less means retain forever.
-		// RetainsForever covers both the RetentionForeverDays
+		if wh.RetentionDays <= 0 {
-		// sentinel and the non-positive values that predate it: the
-		// sentinel is a positive number, so without this the reaper
-		// would compute a cutoff a thousand years in the past and
-		// issue a DELETE matching nothing on every single sweep.
-		if wh.RetainsForever() {
 			continue
 		}
 
@@ -177,10 +171,9 @@ func (r *RetentionReaper) reapWebhook(
 		return
 	}
 
-	cutoff, ok := retentionCutoff(time.Now(), retentionDays)
+	cutoff := time.Now().Add(
-	if !ok {
+		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-		return
+	)
-	}
 
 	deleted, err := reapExpired(db, cutoff)
 	if err != nil {
@@ -203,37 +196,6 @@ func (r *RetentionReaper) reapWebhook(
 	}
 }
 
-// retentionCutoff returns the timestamp before which a webhook's
-// events have expired, and whether any cutoff applies at all. It
-// reports false for a retain-forever policy, so no DELETE is issued.
-//
-// The day count is clamped to MaxFiniteRetentionDays first. This is
-// defense in depth rather than decoration: a time.Duration is an int64
-// nanosecond count, so an unclamped multiplication overflows above
-// that ceiling and wraps the span negative. Subtracting a negative
-// span moves the cutoff into the far future, where it matches every
-// row in the database: the sweep then deletes every event, delivery,
-// and delivery result, including ones created seconds ago. Rejecting
-// out-of-range input at the form is the primary guard; saturating here
-// means an old row, a migration, or a future call site cannot turn a
-// too-large retention into total data loss.
-func retentionCutoff(
-	now time.Time,
-	retentionDays int,
-) (time.Time, bool) {
-	if retainsForever(retentionDays) {
-		return time.Time{}, false
-	}
-
-	if retentionDays > MaxFiniteRetentionDays {
-		retentionDays = MaxFiniteRetentionDays
-	}
-
-	return now.Add(
-		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-	), true
-}
-
 // reapExpired hard-deletes, in foreign-key-safe order, the delivery
 // results, deliveries, and events associated with events older than
 // cutoff. Deletes are unscoped so rows are physically removed rather

internal/database/retention_test.go

@@ -2,7 +2,6 @@ package database_test
 
 import (
 	"context"
-	"net/http"
 	"testing"
 	"time"
 
@@ -31,8 +30,8 @@ func setupRetentionTest(t *testing.T) *retentionTestEnv {
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
+		Appname: "webhooker-test",
-		Version: testVersion,
+		Version: "test",
 	}
 
 	l, err := logger.New(lc, logger.LoggerParams{Globals: g})
@@ -77,7 +76,7 @@ func createWebhook(
 
 	wh := &database.Webhook{
 		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
+		Name:          "test-webhook",
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
@@ -85,11 +84,10 @@ func createWebhook(
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
 
-	// Webhook.BeforeSave rewrites a non-positive RetentionDays to the
+	// The RetentionDays column carries a GORM default of 30, so a
-	// retain-forever sentinel, and the column's GORM default would
+	// zero (or negative) value passed to Create is replaced by that
-	// otherwise substitute 30. Force the requested value with a
+	// default. Force the requested value explicitly so the
-	// column-level update so tests can plant legacy rows that predate
+	// retain-forever (<= 0) path can be exercised.
-	// the sentinel and still carry a literal 0 or negative value.
 	require.NoError(
 		t,
 		db.Model(wh).
@@ -99,30 +97,6 @@ func createWebhook(
 	return wh.ID
 }
 
-// createWebhookNormally inserts a webhook through the ordinary Create
-// path, with no column-level forcing, so Webhook.BeforeSave applies
-// exactly as it does in production. Passing 0 therefore yields a row
-// holding the RetentionForeverDays sentinel.
-func createWebhookNormally(
-	t *testing.T,
-	db *gorm.DB,
-	retentionDays int,
-) string {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
-	return wh.ID
-}
-
 // eventChain is the set of row IDs seeded for a single event.
 type eventChain struct {
 	eventID    string
@@ -143,9 +117,9 @@ func seedEventChain(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"seed": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	event.CreatedAt = createdAt
 	require.NoError(t, db.Create(event).Error)
@@ -281,111 +255,12 @@ func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
 	assertChainPresent(t, db, recent)
 }
 
-// TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep covers the
-// end-to-end retain-forever path: a webhook created the normal way with
-// a requested retention of 0 lands on the RetentionForeverDays
-// sentinel, and the reaper leaves its ancient events alone while still
-// reaping a finite-retention webhook in the very same sweep.
-func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	foreverID := createWebhookNormally(t, env.mainDB.DB(), 0)
-
-	var stored database.Webhook
-
-	require.NoError(
-		t,
-		env.mainDB.DB().Where("id = ?", foreverID).
-			First(&stored).Error,
-	)
-	require.Equal(
-		t,
-		database.RetentionForeverDays,
-		stored.RetentionDays,
-		"a requested retention of 0 must persist as the sentinel",
-	)
-
-	finiteID := createWebhookNormally(t, env.mainDB.DB(), 30)
-
-	foreverDB, err := env.mgr.GetDB(foreverID)
-	require.NoError(t, err)
-
-	finiteDB, err := env.mgr.GetDB(finiteID)
-	require.NoError(t, err)
-
-	ancient := time.Now().Add(-365 * 24 * time.Hour)
-	kept := seedEventChain(t, foreverDB, foreverID, ancient)
-	doomed := seedEventChain(t, finiteDB, finiteID, ancient)
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainPresent(t, foreverDB, kept)
-	assertChainGone(t, finiteDB, doomed)
-}
-
-// TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents pins the
-// overflow that made a large finite retention destroy everything.
-//
-// The cutoff is a time.Duration, an int64 nanosecond count. A day
-// count above MaxFiniteRetentionDays multiplied out unclamped wraps
-// negative, so subtracting it moves the cutoff into the far future,
-// where "created_at < cutoff" matches every row: an event created a
-// moment ago, and its delivery and delivery result, were all deleted
-// on the first sweep. 200000 is inside that band and below the
-// retain-forever sentinel, so it is treated as a finite policy and
-// really does reach the arithmetic.
-//
-// The row is planted at the column level because such a value can no
-// longer be submitted through the form; the point of the test is that
-// a row from an older version, or a future call site, still cannot
-// trigger the wipe.
-func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	const overflowingRetentionDays = 200000
-
-	require.Greater(
-		t,
-		overflowingRetentionDays,
-		database.MaxFiniteRetentionDays,
-		"the test value must exceed what the cutoff can represent",
-	)
-	require.Less(
-		t,
-		overflowingRetentionDays,
-		database.RetentionForeverDays,
-		"the test value must not be rescued by the forever skip",
-	)
-
-	webhookID := createWebhook(
-		t, env.mainDB.DB(), overflowingRetentionDays,
-	)
-
-	db, err := env.mgr.GetDB(webhookID)
-	require.NoError(t, err)
-
-	fresh := seedEventChain(t, db, webhookID, time.Now())
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainPresent(t, db, fresh)
-}
-
 func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
 	t.Parallel()
 
 	env := setupRetentionTest(t)
 
-	// A legacy row written before the sentinel existed still carries a
+	// RetentionDays of zero means retain forever.
-	// literal 0; the <= 0 guard must keep honouring it.
 	webhookID := createWebhook(t, env.mainDB.DB(), 0)
 
 	db, err := env.mgr.GetDB(webhookID)

internal/database/testing.go

@@ -13,11 +13,8 @@ import (
 // sql.DB connection.
 func NewTestDatabase(db *gorm.DB) *Database {
 	return &Database{
-		db: db,
+		db:  db,
-		log: slog.New(slog.NewTextHandler(
+		log: slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
 	}
 }
 
@@ -26,9 +23,6 @@ func NewTestDatabase(db *gorm.DB) *Database {
 func NewTestWebhookDBManager(dataDir string) *WebhookDBManager {
 	return &WebhookDBManager{
 		dataDir: dataDir,
-		log: slog.New(slog.NewTextHandler(
+		log:     slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})),
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
 	}
 }

internal/database/webhook_db_manager_test.go

@@ -2,7 +2,6 @@ package database_test
 
 import (
 	"context"
-	"net/http"
 	"os"
 	"path/filepath"
 	"testing"
@@ -26,8 +25,8 @@ func setupTestWebhookDBManager(
 	lc := fxtest.NewLifecycle(t)
 
 	g := &globals.Globals{
-		Appname: testAppname,
+		Appname: "webhooker-test",
-		Version: testVersion,
+		Version: "test",
 	}
 
 	l, err := logger.New(
@@ -84,10 +83,10 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"test": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 	assert.NotEmpty(t, event.ID)
@@ -100,7 +99,7 @@ func TestWebhookDBManager_CreateAndGetDB(t *testing.T) {
 		db.First(&readEvent, "id = ?", event.ID).Error,
 	)
 	assert.Equal(t, webhookID, readEvent.WebhookID)
-	assert.Equal(t, http.MethodPost, readEvent.Method)
+	assert.Equal(t, "POST", readEvent.Method)
 	assert.Equal(t, `{"test": true}`, readEvent.Body)
 }
 
@@ -124,9 +123,9 @@ func TestWebhookDBManager_DeleteDB(t *testing.T) {
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"test": true}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -197,10 +196,10 @@ func seedDeliveryWorkflow(
 	event := &database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         `{"payload": "test"}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	require.NoError(t, db.Create(event).Error)
 
@@ -232,7 +231,7 @@ func verifyPendingDeliveries(
 	)
 	require.Len(t, pending, 1)
 	assert.Equal(t, event.ID, pending[0].EventID)
-	assert.Equal(t, http.MethodPost, pending[0].Event.Method)
+	assert.Equal(t, "POST", pending[0].Event.Method)
 }
 
 func completeDelivery(
@@ -304,16 +303,16 @@ func TestWebhookDBManager_MultipleWebhooks(t *testing.T) {
 	event1 := &database.Event{
 		WebhookID:    webhook1,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Body:         `{"webhook": 1}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 	event2 := &database.Event{
 		WebhookID:    webhook2,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPut,
+		Method:       "PUT",
 		Body:         `{"webhook": 2}`,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db1.Create(event1).Error)

internal/delivery/engine_integration_test.go

@@ -126,6 +126,36 @@ func iHTTPConfig(url string) string {
 	return string(data)
 }
 
+func iWebhookDB(t *testing.T) *gorm.DB {
+	t.Helper()
+
+	dbPath := filepath.Join(
+		t.TempDir(), "events-test.db",
+	)
+
+	dsn := fmt.Sprintf(
+		"file:%s?cache=shared&mode=rwc", dbPath,
+	)
+
+	sqlDB, err := sql.Open("sqlite", dsn)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	db, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	require.NoError(t, db.AutoMigrate(
+		&database.Event{},
+		&database.Delivery{},
+		&database.DeliveryResult{},
+	))
+
+	return db
+}
+
 func iEngine(
 	t *testing.T, workers int,
 ) *delivery.Engine {
@@ -152,10 +182,10 @@ func iSeedEvent(
 	event := database.Event{
 		WebhookID:    webhookID,
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -905,7 +935,7 @@ func TestDeliverHTTP_CustomTargetHeaders(t *testing.T) {
 func TestDeliverHTTP_TargetTimeout(t *testing.T) {
 	t.Parallel()
 
-	db := testWebhookDB(t)
+	db := iWebhookDB(t)
 	e := iEngine(t, 1)
 
 	ts := httptest.NewServer(
@@ -957,10 +987,10 @@ func iSeedEventAndDelivery(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -1037,7 +1067,7 @@ func iAssertResultFailed(
 func TestDeliverHTTP_InvalidConfig(t *testing.T) {
 	t.Parallel()
 
-	db := testWebhookDB(t)
+	db := iWebhookDB(t)
 	e := iEngine(t, 1)
 
 	event, del := iSeedEventAndDelivery(

internal/delivery/engine_test.go

@@ -27,9 +27,6 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-// testContentType is the event content type used in tests.
-const testContentType = "application/json"
-
 func testWebhookDB(t *testing.T) *gorm.DB {
 	t.Helper()
 
@@ -97,10 +94,10 @@ func seedEvent(
 	event := database.Event{
 		WebhookID:    uuid.New().String(),
 		EntrypointID: uuid.New().String(),
-		Method:       http.MethodPost,
+		Method:       "POST",
 		Headers:      `{"Content-Type":["application/json"]}`,
 		Body:         body,
-		ContentType:  testContentType,
+		ContentType:  "application/json",
 	}
 
 	require.NoError(t, db.Create(&event).Error)
@@ -345,29 +342,33 @@ func TestDeliverDatabase_ImmediateSuccess(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-
+	e := testEngine(t, 1)
-	// The database target archives for real now, so the engine
-	// needs a webhook DB manager to locate the data directory.
-	e := delivery.NewTestEngineWithDB(
-		nil,
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	event := seedEvent(t, db, `{"db":"target"}`)
-	d := seedDatabaseTargetDelivery(t, db, event, "")
+
+	dlv := seedDelivery(
+		t, db, event.ID, uuid.New().String(),
+		database.DeliveryStatusPending,
+	)
+
+	d := &database.Delivery{
+		EventID:  event.ID,
+		TargetID: dlv.TargetID,
+		Status:   database.DeliveryStatusPending,
+		Event:    event,
+		Target: database.Target{
+			Name: "test-db",
+			Type: database.TargetTypeDatabase,
+		},
+	}
+	d.ID = dlv.ID
 
 	e.ExportDeliverDatabase(db, d)
 
 	var updated database.Delivery
 
 	require.NoError(t, db.First(
-		&updated, "id = ?", d.ID,
+		&updated, "id = ?", dlv.ID,
 	).Error)
 
 	assert.Equal(t,
@@ -378,7 +379,7 @@ func TestDeliverDatabase_ImmediateSuccess(
 	var result database.DeliveryResult
 
 	require.NoError(t, db.Where(
-		"delivery_id = ?", d.ID,
+		"delivery_id = ?", dlv.ID,
 	).First(&result).Error)
 
 	assert.True(t, result.Success)
@@ -1116,10 +1117,10 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	}
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
 		Headers:     `{"X-Custom":["value1"],"Content-Type":["application/json"]}`,
 		Body:        `{"test":true}`,
-		ContentType: testContentType,
+		ContentType: "application/json",
 	}
 
 	statusCode, _, _, err := e.ExportDoHTTPRequest(
@@ -1141,7 +1142,7 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	)
 
 	assert.Equal(t,
-		testContentType,
+		"application/json",
 		receivedHeaders.Get("Content-Type"),
 	)
 
@@ -1157,19 +1158,7 @@ func TestProcessDelivery_RoutesToCorrectHandler(
 	t.Parallel()
 
 	db := testWebhookDB(t)
-
+	e := testEngine(t, 1)
-	// The database target archives for real now, so the engine
-	// needs a webhook DB manager to locate the data directory.
-	e := delivery.NewTestEngineWithDB(
-		nil,
-		database.NewTestWebhookDBManager(t.TempDir()),
-		slog.New(slog.NewTextHandler(
-			os.Stderr,
-			&slog.HandlerOptions{Level: slog.LevelDebug},
-		)),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
 
 	tests := []struct {
 		name       string
@@ -1300,8 +1289,8 @@ func TestFormatSlackMessage_JSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
-		ContentType: testContentType,
+		ContentType: "application/json",
 		Body: `{"action":"push",` +
 			`"repo":"test/repo",` +
 			`"ref":"refs/heads/main"}`,
@@ -1326,7 +1315,7 @@ func TestFormatSlackMessage_NonJSONBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
 		ContentType: "text/plain",
 		Body:        "hello world plain text",
 	}
@@ -1349,8 +1338,8 @@ func TestFormatSlackMessage_EmptyBody(t *testing.T) {
 	t.Parallel()
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
-		ContentType: testContentType,
+		ContentType: "application/json",
 		Body:        "",
 	}
 	event.CreatedAt = time.Date(
@@ -1378,8 +1367,8 @@ func TestFormatSlackMessage_LargeJSONTruncated(
 	require.NoError(t, err)
 
 	event := &database.Event{
-		Method:      http.MethodPost,
+		Method:      "POST",
-		ContentType: testContentType,
+		ContentType: "application/json",
 		Body:        string(largeJSON),
 	}
 	event.CreatedAt = time.Date(
@@ -1708,7 +1697,7 @@ func assertLogLineComplete(
 		"log line must contain the webhook id",
 	)
 
-	assert.Contains(t, out, testContentType,
+	assert.Contains(t, out, "application/json",
 		"log line must contain the content type",
 	)
 }

internal/delivery/export_test.go

@@ -273,64 +273,3 @@ func NewTestCircuitBreaker(
 		cooldown:  cooldown,
 	}
 }
-
-// ExportArchivedEvent aliases the archive row type so black-box
-// tests can construct and read archive rows.
-type ExportArchivedEvent = archivedEvent
-
-// ExportArchiveWriter wraps an archiveWriter so black-box tests
-// can exercise the per-webhook archive file mechanics.
-type ExportArchiveWriter struct {
-	w *archiveWriter
-}
-
-// NewExportArchiveWriter builds an archive writer for tests,
-// optionally overriding the reopen debounce (a non-positive
-// debounce keeps the production default).
-func NewExportArchiveWriter(
-	path string, log *slog.Logger, debounce time.Duration,
-) *ExportArchiveWriter {
-	w := newArchiveWriter(path, log)
-	if debounce > 0 {
-		w.debounce = debounce
-	}
-
-	return &ExportArchiveWriter{w: w}
-}
-
-// Write archives a row through the writer.
-func (e *ExportArchiveWriter) Write(
-	row ExportArchivedEvent, expiry time.Duration,
-) error {
-	return e.w.write(row, expiry)
-}
-
-// Open opens the archive file, pruning when expiry is positive.
-func (e *ExportArchiveWriter) Open(expiry time.Duration) error {
-	return e.w.open(expiry)
-}
-
-// Reopen closes and reopens the archive file.
-func (e *ExportArchiveWriter) Reopen(
-	expiry time.Duration,
-) error {
-	return e.w.reopen(expiry)
-}
-
-// Reopens reports how many times the file has been opened.
-func (e *ExportArchiveWriter) Reopens() int {
-	return e.w.reopens
-}
-
-// DB returns the writer's current open handle for row
-// inspection in tests.
-func (e *ExportArchiveWriter) DB() *gorm.DB {
-	return e.w.db
-}
-
-// ExportParseArchiveExpiry exposes parseArchiveExpiry.
-func ExportParseArchiveExpiry(
-	configJSON string,
-) (time.Duration, error) {
-	return parseArchiveExpiry(configJSON)
-}

internal/delivery/target_database.go

@@ -2,38 +2,21 @@ package delivery
 
 import (
 	"context"
-	"fmt"
-	"path/filepath"
-	"sync"
 
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// databaseTarget is a no-retry target that archives the
+// databaseTarget is a fire-and-forget target: the event is
-// full inbound event into a per-webhook archive SQLite file,
+// already persisted in the per-webhook database by the time
-// separate from the per-webhook event database. The event is
+// delivery runs, so the target records a single successful
-// already persisted in the per-webhook event DB by the time
+// attempt. (Durable archiving to a separate store is tracked
-// delivery runs; the database target additionally writes a
+// as its own work.)
-// durable long-term copy into archive-{webhookID}.db and then
-// records a single attempt whose outcome reflects whether the
-// archive write succeeded. See archiveWriter for the
-// close/reopen, auto-recreate, and expiry semantics.
 type databaseTarget struct {
 	eng *Engine
-
-	mu      sync.Mutex
-	writers map[string]*archiveWriter
 }
 
-// Deliver implements Target. It archives the event, then
+// Deliver implements Target.
-// records one successful attempt and marks the delivery
-// delivered. An archiving error fails the delivery: the
-// attempt is recorded as failed with the error and the
-// delivery is marked failed, so a target that could not do
-// its one job (archiving) never reports success. The target
-// does not retry; the event remains durably stored in the
-// per-webhook event database.
 func (t *databaseTarget) Deliver(
 	_ context.Context,
 	webhookDB *gorm.DB,
@@ -41,27 +24,6 @@ func (t *databaseTarget) Deliver(
 	_ *Task,
 	_ Scheduler,
 ) {
-	err := t.archive(d)
-	if err != nil {
-		t.eng.log.Error(
-			"failed to archive event to database target",
-			"delivery_id", d.ID,
-			"event_id", d.EventID,
-			"error", err,
-		)
-
-		t.eng.recordResult(
-			webhookDB, d, 1, false, 0, "",
-			err.Error(), 0,
-		)
-
-		t.eng.updateDeliveryStatus(
-			webhookDB, d, database.DeliveryStatusFailed,
-		)
-
-		return
-	}
-
 	t.eng.recordResult(
 		webhookDB, d, 1, true, 0, "", "", 0,
 	)
@@ -70,68 +32,3 @@ func (t *databaseTarget) Deliver(
 		webhookDB, d, database.DeliveryStatusDelivered,
 	)
 }
-
-// archive writes the full event as a row into the webhook's
-// archive database, honouring the optional per-target expiry
-// parsed from the target config JSON.
-func (t *databaseTarget) archive(d *database.Delivery) error {
-	webhookID := d.Event.WebhookID
-	if webhookID == "" {
-		return errArchiveMissingWebhookID
-	}
-
-	expiry, err := parseArchiveExpiry(d.Target.Config)
-	if err != nil {
-		return err
-	}
-
-	w, err := t.writerFor(webhookID)
-	if err != nil {
-		return err
-	}
-
-	row := archivedEvent{
-		EventID:      d.Event.ID,
-		WebhookID:    webhookID,
-		EntrypointID: d.Event.EntrypointID,
-		Method:       d.Event.Method,
-		Headers:      d.Event.Headers,
-		Body:         d.Event.Body,
-		ContentType:  d.Event.ContentType,
-	}
-
-	return w.write(row, expiry)
-}
-
-// writerFor returns the archiveWriter for a webhook, creating
-// and caching it on first use. Each webhook has one writer so
-// its close/reopen debounce state is shared across concurrent
-// deliveries. The archive file lives beside the per-webhook
-// event database in the data directory.
-func (t *databaseTarget) writerFor(
-	webhookID string,
-) (*archiveWriter, error) {
-	if t.eng.dbManager == nil {
-		return nil, errArchiveNoDataDir
-	}
-
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
-	path := filepath.Join(
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
-	)
-
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	if t.writers == nil {
-		t.writers = make(map[string]*archiveWriter)
-	}
-
-	w, ok := t.writers[webhookID]
-	if !ok {
-		w = newArchiveWriter(path, t.eng.log)
-		t.writers[webhookID] = w
-	}
-
-	return w, nil
-}

internal/delivery/target_database_archive.go

@@ -1,312 +0,0 @@
-package delivery
-
-import (
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log/slog"
-	"os"
-	"sync"
-	"time"
-
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-)
-
-// archiveExpiryNever is the expiry sentinel (and default) that
-// disables pruning so archived rows are kept forever.
-const archiveExpiryNever = "never"
-
-// archiveReopenDebounce bounds how often an archive file is
-// closed and reopened. After each write the handle is closed
-// and reopened so an operator can move the file away for
-// offline archiving, but never more than once per this window.
-const archiveReopenDebounce = time.Second
-
-var (
-	// errArchiveMissingWebhookID is returned when an event to
-	// archive has no webhook id to key its archive file on.
-	errArchiveMissingWebhookID = errors.New(
-		"cannot archive event without a webhook id",
-	)
-
-	// errArchiveNoDataDir is returned when the database target
-	// has no webhook database manager and so cannot locate the
-	// data directory for archive files.
-	errArchiveNoDataDir = errors.New(
-		"database target has no data directory",
-	)
-
-	// errArchiveExpiryNotPositive is returned when a
-	// user-supplied archive expiry parses as a duration but is
-	// zero or negative; "never" is the way to disable pruning.
-	errArchiveExpiryNotPositive = errors.New(
-		"expiry must be a positive duration or \"never\"",
-	)
-)
-
-// databaseTargetConfig is the optional per-target JSON config
-// for a database (archive) target.
-type databaseTargetConfig struct {
-	// Expiry is a Go duration (e.g. "720h") after which
-	// archived rows are pruned, or "never" (the default) to
-	// keep them forever.
-	Expiry string `json:"expiry"`
-}
-
-// archivedEvent is one fully captured webhook event stored in a
-// per-webhook archive database for long-term retention. It is a
-// self-contained copy — independent of the per-webhook event
-// database, which may prune events under its own retention.
-type archivedEvent struct {
-	ID           uint   `gorm:"primaryKey;autoIncrement"`
-	EventID      string `gorm:"index"`
-	WebhookID    string
-	EntrypointID string
-	Method       string
-	Headers      string
-	Body         string
-	ContentType  string
-
-	// ArchivedAt is when the row was archived and is the age
-	// basis for expiry pruning.
-	ArchivedAt time.Time `gorm:"index"`
-}
-
-// parseArchiveExpiry reads the optional expiry from a database
-// target's config JSON. An empty config, an empty expiry, or
-// the literal "never" all mean keep forever, returned as a zero
-// duration. Any other value must parse as a positive Go
-// duration; a set-but-invalid value (unparseable, zero, or
-// negative) is an error rather than a silent default, matching
-// ValidateArchiveExpiry at target creation.
-func parseArchiveExpiry(
-	configJSON string,
-) (time.Duration, error) {
-	if configJSON == "" {
-		return 0, nil
-	}
-
-	var cfg databaseTargetConfig
-
-	err := json.Unmarshal([]byte(configJSON), &cfg)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"parsing database target config: %w", err,
-		)
-	}
-
-	if cfg.Expiry == "" || cfg.Expiry == archiveExpiryNever {
-		return 0, nil
-	}
-
-	dur, err := time.ParseDuration(cfg.Expiry)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"parsing archive expiry %q: %w", cfg.Expiry, err,
-		)
-	}
-
-	if dur <= 0 {
-		return 0, fmt.Errorf(
-			"%w: %q", errArchiveExpiryNotPositive, cfg.Expiry,
-		)
-	}
-
-	return dur, nil
-}
-
-// ValidateArchiveExpiry checks a user-supplied archive expiry
-// for a database target at configuration time. Valid values are
-// empty, "never" (both meaning keep forever), or a positive Go
-// duration such as "720h". Anything else is an error, so a bad
-// expiry is rejected when the target is created rather than
-// failing every subsequent delivery.
-func ValidateArchiveExpiry(expiry string) error {
-	if expiry == "" || expiry == archiveExpiryNever {
-		return nil
-	}
-
-	dur, err := time.ParseDuration(expiry)
-	if err != nil {
-		return fmt.Errorf(
-			"expiry must be %q or a Go duration "+
-				"such as \"720h\": %w",
-			archiveExpiryNever, err,
-		)
-	}
-
-	if dur <= 0 {
-		return fmt.Errorf(
-			"%w: %q", errArchiveExpiryNotPositive, expiry,
-		)
-	}
-
-	return nil
-}
-
-// archiveWriter owns one per-webhook archive SQLite file. It
-// serialises writes, and after each write closes and reopens
-// the file (debounced to at most once per debounce window) so
-// an operator can move the file away for offline archiving. The
-// next write recreates a moved or removed file, because the
-// file is opened create-if-missing and its schema is migrated
-// on every open.
-type archiveWriter struct {
-	mu         sync.Mutex
-	path       string
-	log        *slog.Logger
-	debounce   time.Duration
-	db         *gorm.DB
-	lastReopen time.Time
-	reopens    int
-}
-
-// newArchiveWriter builds an archiveWriter for a file path with
-// the default reopen debounce.
-func newArchiveWriter(
-	path string, log *slog.Logger,
-) *archiveWriter {
-	return &archiveWriter{
-		path:     path,
-		log:      log,
-		debounce: archiveReopenDebounce,
-	}
-}
-
-// write appends the event as a row, then applies the debounced
-// close/reopen. It recreates the archive file if it was moved
-// or removed since the last open. A positive expiry prunes rows
-// older than it on each (re)open.
-func (w *archiveWriter) write(
-	row archivedEvent, expiry time.Duration,
-) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	if w.db == nil || !fileExists(w.path) {
-		err := w.reopen(expiry)
-		if err != nil {
-			return err
-		}
-	}
-
-	row.ArchivedAt = time.Now()
-
-	err := w.db.Create(&row).Error
-	if err != nil {
-		return fmt.Errorf(
-			"archiving event to %s: %w", w.path, err,
-		)
-	}
-
-	if time.Since(w.lastReopen) >= w.debounce {
-		return w.reopen(expiry)
-	}
-
-	return nil
-}
-
-// open opens (creating if missing) the archive file, migrates
-// its schema, records the reopen time, and prunes expired rows
-// when expiry is positive.
-func (w *archiveWriter) open(expiry time.Duration) error {
-	dbURL := fmt.Sprintf("file:%s?mode=rwc", w.path)
-
-	sqlDB, err := sql.Open("sqlite", dbURL)
-	if err != nil {
-		return fmt.Errorf(
-			"opening archive database %s: %w", w.path, err,
-		)
-	}
-
-	gdb, err := gorm.Open(
-		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
-	)
-	if err != nil {
-		_ = sqlDB.Close()
-
-		return fmt.Errorf(
-			"connecting to archive database %s: %w",
-			w.path, err,
-		)
-	}
-
-	err = gdb.AutoMigrate(&archivedEvent{})
-	if err != nil {
-		_ = sqlDB.Close()
-
-		return fmt.Errorf(
-			"migrating archive database %s: %w", w.path, err,
-		)
-	}
-
-	w.db = gdb
-	w.lastReopen = time.Now()
-	w.reopens++
-
-	if expiry > 0 {
-		w.prune(expiry)
-	}
-
-	return nil
-}
-
-// reopen closes any open handle and opens the file afresh. The
-// fresh open recreates the file if it was moved away.
-func (w *archiveWriter) reopen(expiry time.Duration) error {
-	w.close()
-
-	return w.open(expiry)
-}
-
-// close closes the underlying handle, if any.
-func (w *archiveWriter) close() {
-	if w.db == nil {
-		return
-	}
-
-	sqlDB, err := w.db.DB()
-	if err == nil {
-		_ = sqlDB.Close()
-	}
-
-	w.db = nil
-}
-
-// prune deletes archived rows older than expiry, measured from
-// each row's archived time. It runs on every (re)open, and
-// because the file is reopened after writes this keeps the
-// archive swept without a separate background sweeper. Failures
-// are logged, not fatal: a prune error must not stop archiving.
-func (w *archiveWriter) prune(expiry time.Duration) {
-	cutoff := time.Now().Add(-expiry)
-
-	res := w.db.Where("archived_at < ?", cutoff).
-		Delete(&archivedEvent{})
-	if res.Error != nil {
-		w.log.Error(
-			"failed to prune expired archive rows",
-			"path", w.path,
-			"error", res.Error,
-		)
-
-		return
-	}
-
-	if res.RowsAffected > 0 {
-		w.log.Info(
-			"pruned expired archive rows",
-			"path", w.path,
-			"rows_deleted", res.RowsAffected,
-		)
-	}
-}
-
-// fileExists reports whether a path currently exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-
-	return err == nil
-}

internal/delivery/target_database_test.go

@@ -1,395 +0,0 @@
-package delivery_test
-
-import (
-	"database/sql"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-	_ "modernc.org/sqlite" // Pure Go SQLite driver.
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/delivery"
-)
-
-func archiveTestLogger() *slog.Logger {
-	return slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-}
-
-// openArchiveDBForRead opens an archive file read-only so a
-// test can inspect the rows the writer persisted.
-func openArchiveDBForRead(
-	t *testing.T, path string,
-) *gorm.DB {
-	t.Helper()
-
-	sqlDB, err := sql.Open(
-		"sqlite",
-		fmt.Sprintf("file:%s?mode=ro", path),
-	)
-	require.NoError(t, err)
-
-	t.Cleanup(func() { _ = sqlDB.Close() })
-
-	gdb, err := gorm.Open(
-		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
-	)
-	require.NoError(t, err)
-
-	return gdb
-}
-
-// removeArchiveFiles simulates an operator moving the archive
-// away by deleting the SQLite file and its sidecar files.
-func removeArchiveFiles(t *testing.T, path string) {
-	t.Helper()
-
-	for _, suffix := range []string{
-		"", "-wal", "-shm", "-journal",
-	} {
-		err := os.Remove(path + suffix)
-		if err != nil && !os.IsNotExist(err) {
-			t.Fatalf("removing %s%s: %v", path, suffix, err)
-		}
-	}
-}
-
-// TestDeliverDatabase_ArchivesEvent verifies that delivering to
-// a database target marks the delivery delivered and archives
-// the full event into a separate per-webhook archive file.
-func TestDeliverDatabase_ArchivesEvent(t *testing.T) {
-	t.Parallel()
-
-	dataDir := t.TempDir()
-	dbMgr := database.NewTestWebhookDBManager(dataDir)
-
-	e := delivery.NewTestEngineWithDB(
-		nil, dbMgr,
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
-
-	e.ExportDeliverDatabase(webhookDB, d)
-
-	var updated database.Delivery
-
-	require.NoError(t, webhookDB.First(
-		&updated, "id = ?", d.ID,
-	).Error)
-	assert.Equal(t,
-		database.DeliveryStatusDelivered, updated.Status,
-		"database target should mark the delivery delivered",
-	)
-
-	archivePath := filepath.Join(
-		dataDir,
-		fmt.Sprintf("archive-%s.db", event.WebhookID),
-	)
-	assert.FileExists(t, archivePath)
-
-	rdb := openArchiveDBForRead(t, archivePath)
-
-	var rows []delivery.ExportArchivedEvent
-
-	require.NoError(t, rdb.Find(&rows).Error)
-	require.Len(t, rows, 1)
-	assert.Equal(t, event.ID, rows[0].EventID)
-	assert.Equal(t, event.WebhookID, rows[0].WebhookID)
-	assert.Equal(t, event.Method, rows[0].Method)
-	assert.JSONEq(t, `{"archived":true}`, rows[0].Body)
-}
-
-func TestArchiveWriter_WritesRow(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	row := delivery.ExportArchivedEvent{
-		EventID:      "ev-1",
-		WebhookID:    "wh-1",
-		EntrypointID: "ep-1",
-		Method:       "POST",
-		Headers:      `{"X":"Y"}`,
-		Body:         `{"hello":"world"}`,
-		ContentType:  "application/json",
-	}
-
-	require.NoError(t, w.Write(row, 0))
-	assert.FileExists(t, path)
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "ev-1", got[0].EventID)
-	assert.Equal(t, "wh-1", got[0].WebhookID)
-	assert.Equal(t, "ep-1", got[0].EntrypointID)
-	assert.Equal(t, row.Method, got[0].Method)
-	assert.Equal(t, row.ContentType, got[0].ContentType)
-	assert.JSONEq(t, `{"hello":"world"}`, got[0].Body)
-	assert.False(t, got[0].ArchivedAt.IsZero())
-}
-
-func TestArchiveWriter_RecreatesAfterRemoval(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "a"}, 0,
-	))
-	assert.FileExists(t, path)
-
-	// The operator moves the archive away while the handle is
-	// still open.
-	removeArchiveFiles(t, path)
-	require.NoFileExists(t, path)
-
-	// The next write recreates the file with a fresh schema and
-	// only the new row.
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "b"}, 0,
-	))
-	assert.FileExists(t, path)
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "b", got[0].EventID)
-}
-
-func TestArchiveWriter_ReopenDebounce(t *testing.T) {
-	t.Parallel()
-
-	// A generous debounce keeps the two rapid writes inside
-	// the window even on a heavily loaded test machine.
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 2*time.Second,
-	)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "a"}, 0,
-	))
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "b"}, 0,
-	))
-
-	// Two writes inside the debounce window trigger only the
-	// initial open — no extra close/reopen.
-	assert.Equal(t, 1, w.Reopens())
-
-	time.Sleep(2100 * time.Millisecond)
-
-	require.NoError(t, w.Write(
-		delivery.ExportArchivedEvent{EventID: "c"}, 0,
-	))
-
-	// A write after the window elapses closes and reopens once.
-	assert.Equal(t, 2, w.Reopens())
-}
-
-func TestArchiveWriter_ExpiryPrune(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "archive-wh.db")
-	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 0,
-	)
-
-	require.NoError(t, w.Open(0))
-
-	old := delivery.ExportArchivedEvent{
-		EventID:    "old",
-		ArchivedAt: time.Now().Add(-2 * time.Hour),
-	}
-	fresh := delivery.ExportArchivedEvent{
-		EventID:    "fresh",
-		ArchivedAt: time.Now(),
-	}
-
-	require.NoError(t, w.DB().Create(&old).Error)
-	require.NoError(t, w.DB().Create(&fresh).Error)
-
-	// Reopening with a one-hour expiry prunes the old row.
-	require.NoError(t, w.Reopen(time.Hour))
-
-	var got []delivery.ExportArchivedEvent
-
-	require.NoError(t, w.DB().Find(&got).Error)
-	require.Len(t, got, 1)
-	assert.Equal(t, "fresh", got[0].EventID)
-}
-
-func TestParseArchiveExpiry(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		in      string
-		want    time.Duration
-		wantErr bool
-	}{
-		{"empty config", "", 0, false},
-		{"explicit never", `{"expiry":"never"}`, 0, false},
-		{"empty expiry", `{"expiry":""}`, 0, false},
-		{"duration", `{"expiry":"1h"}`, time.Hour, false},
-		{"unparseable", `{"expiry":"nonsense"}`, 0, true},
-		{"zero duration", `{"expiry":"0s"}`, 0, true},
-		{"negative duration", `{"expiry":"-5h"}`, 0, true},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := delivery.ExportParseArchiveExpiry(tc.in)
-			if tc.wantErr {
-				require.Error(t, err)
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-// seedDatabaseTargetDelivery seeds a pending delivery for a
-// database target with the given config JSON and returns the
-// in-memory delivery the target handler is invoked with.
-func seedDatabaseTargetDelivery(
-	t *testing.T,
-	webhookDB *gorm.DB,
-	event database.Event,
-	config string,
-) *database.Delivery {
-	t.Helper()
-
-	dlv := seedDelivery(
-		t, webhookDB, event.ID, uuid.New().String(),
-		database.DeliveryStatusPending,
-	)
-
-	d := &database.Delivery{
-		EventID:  event.ID,
-		TargetID: dlv.TargetID,
-		Status:   database.DeliveryStatusPending,
-		Event:    event,
-		Target: database.Target{
-			Name:   "test-db",
-			Type:   database.TargetTypeDatabase,
-			Config: config,
-		},
-	}
-	d.ID = dlv.ID
-
-	return d
-}
-
-// TestDeliverDatabase_ArchiveFailureFailsDelivery verifies that
-// an archive error (here: an unparseable expiry in the target
-// config) fails the delivery loudly: the attempt is recorded as
-// failed with the error and the delivery is marked failed, not
-// delivered.
-func TestDeliverDatabase_ArchiveFailureFailsDelivery(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	dataDir := t.TempDir()
-
-	e := delivery.NewTestEngineWithDB(
-		nil, database.NewTestWebhookDBManager(dataDir),
-		archiveTestLogger(),
-		&http.Client{Timeout: 5 * time.Second},
-		1,
-	)
-
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":false}`)
-	d := seedDatabaseTargetDelivery(
-		t, webhookDB, event, `{"expiry":"nonsense"}`,
-	)
-
-	e.ExportDeliverDatabase(webhookDB, d)
-
-	var updated database.Delivery
-
-	require.NoError(t, webhookDB.First(
-		&updated, "id = ?", d.ID,
-	).Error)
-	assert.Equal(t,
-		database.DeliveryStatusFailed, updated.Status,
-		"archive failure must mark the delivery failed",
-	)
-
-	var results []database.DeliveryResult
-
-	require.NoError(t, webhookDB.Where(
-		"delivery_id = ?", d.ID,
-	).Find(&results).Error)
-	require.Len(t, results, 1)
-	assert.False(t,
-		results[0].Success,
-		"the attempt must be recorded as failed",
-	)
-	assert.Contains(t,
-		results[0].Error, "nonsense",
-		"the archive error must be recorded on the attempt",
-	)
-
-	assert.NoFileExists(t,
-		filepath.Join(
-			dataDir,
-			fmt.Sprintf("archive-%s.db", event.WebhookID),
-		),
-		"no archive file should exist for a failed config",
-	)
-}
-
-func TestValidateArchiveExpiry(t *testing.T) {
-	t.Parallel()
-
-	valid := []string{"", "never", "1h", "720h", "30m"}
-	for _, in := range valid {
-		require.NoError(t,
-			delivery.ValidateArchiveExpiry(in),
-			"expiry %q should be accepted", in,
-		)
-	}
-
-	invalid := []string{"nonsense", "7d", "-5h", "0s", "0"}
-	for _, in := range invalid {
-		require.Error(t,
-			delivery.ValidateArchiveExpiry(in),
-			"expiry %q should be rejected", in,
-		)
-	}
-}

internal/delivery/target_http.go

@@ -495,5 +495,5 @@ func applyRequestHeaders(
 func executeHTTPRequest(
 	client *http.Client, req *http.Request,
 ) (*http.Response, error) {
-	return client.Do(req) //#nosec G704 -- validated URL, SSRF-safe transport
+	return client.Do(req) //#nosec G704 -- URL validated by parseHTTPConfig/parseSlackConfig and SSRF-safe transport
 }

internal/handlers/auth.go

@@ -19,7 +19,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 
 		// Render login page
 		data := map[string]any{
-			tmplKeyError: "",
+			"Error": "",
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -86,7 +86,7 @@ func (h *Handlers) renderLoginError(
 	status int,
 ) {
 	data := map[string]any{
-		tmplKeyError: msg,
+		"Error": msg,
 	}
 
 	w.WriteHeader(status)

internal/handlers/export_test.go

@@ -13,26 +13,12 @@ func (s *Handlers) RenderTemplateForTest(
 	s.renderTemplate(w, r, pageTemplate, data)
 }
 
-// BuildSlackTargetConfigForTest exposes buildURLTargetConfig
+// BuildSlackTargetConfigForTest exposes buildSlackTargetConfig
-// with the Slack target parameters for use in the
+// for use in the handlers_test package.
-// handlers_test package.
 func (s *Handlers) BuildSlackTargetConfigForTest(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetURL string,
 ) (string, error) {
-	return s.buildURLTargetConfig(
+	return s.buildSlackTargetConfig(w, r, targetURL)
-		w, r, targetURL, "webhookUrl",
-		"Webhook URL is required for Slack targets",
-	)
-}
-
-// BuildDatabaseTargetConfigForTest exposes
-// buildDatabaseTargetConfig for use in the handlers_test
-// package.
-func (s *Handlers) BuildDatabaseTargetConfigForTest(
-	w http.ResponseWriter,
-	expiry string,
-) (string, error) {
-	return s.buildDatabaseTargetConfig(w, expiry)
 }

internal/handlers/handlers.go

@@ -26,13 +26,10 @@ const (
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
 	recentEventLimit = 20
+	// defaultRetentionDays is the default event retention period.
+	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
-
-	// tmplKeyError is the template data key for an error message.
-	tmplKeyError = "Error"
-	// tmplKeyWebhook is the template data key for a webhook.
-	tmplKeyWebhook = "Webhook"
 )
 
 // errInvalidPassword is returned when a password does not match.

internal/handlers/handlers_test.go

@@ -186,57 +186,3 @@ func TestRenderTemplate(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 	)
 }
-
-func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	// Empty expiry: the keep-forever default, empty config.
-	w := httptest.NewRecorder()
-	cfg, err := h.BuildDatabaseTargetConfigForTest(w, "")
-	require.NoError(t, err)
-	assert.Empty(t, cfg)
-
-	// Explicit never is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "never")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
-
-	// A positive duration is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "720h")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
-}
-
-func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	for _, bad := range []string{"nonsense", "7d", "-5h"} {
-		w := httptest.NewRecorder()
-		cfg, err := h.BuildDatabaseTargetConfigForTest(w, bad)
-
-		require.Error(t, err, "expiry %q", bad)
-		assert.Empty(t, cfg)
-		assert.Equal(
-			t, http.StatusBadRequest, w.Code,
-			"expiry %q should be rejected with 400", bad,
-		)
-	}
-}

internal/handlers/profile.go

@@ -4,202 +4,63 @@ import (
 	"net/http"
 
 	"github.com/go-chi/chi"
-	"sneak.berlin/go/webhooker/internal/database"
 )
 
 // HandleProfile returns a handler for the user profile page
 func (h *Handlers) HandleProfile() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		sessionUserID, sessionUsername, ok :=
+		// Get username from URL
-			h.profileOwnerOrDeny(w, r)
+		requestedUsername := chi.URLParam(r, "username")
-		if !ok {
+		if requestedUsername == "" {
+			http.NotFound(w, r)
+
 			return
 		}
 
-		h.renderProfile(w, r, sessionUserID, sessionUsername, "", "")
+		// Get session. RequireAuth middleware guarantees an
-	}
+		// authenticated session before this handler runs, so we
-}
+		// only need to guard against an unexpected retrieval error.
-
+		sess, err := h.session.Get(r)
-// HandlePasswordChange returns a handler that lets an authenticated
-// user change their own password. It is served by the CSRF- and
-// auth-protected POST /password route under /user/{username}.
-func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		sessionUserID, sessionUsername, ok :=
-			h.profileOwnerOrDeny(w, r)
-		if !ok {
-			return
-		}
-
-		// Limit request body to prevent memory exhaustion.
-		r.Body = http.MaxBytesReader(w, r.Body, 1<<maxBodyShift)
-
-		err := r.ParseForm()
 		if err != nil {
-			h.log.Error("failed to parse form", "error", err)
+			h.log.Error("failed to get session", "error", err)
-			http.Error(w, "Bad request", http.StatusBadRequest)
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
 
 			return
 		}
 
-		successMessage, errorMessage, handled := h.applyPasswordChange(
+		// Get user info from session
-			w,
+		sessionUsername, ok := h.session.GetUsername(sess)
-			sessionUsername,
+		if !ok {
-			r.FormValue("current_password"),
+			h.log.Error("authenticated session missing username")
-			r.FormValue("new_password"),
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
-			r.FormValue("confirm_password"),
+
-		)
-		if !handled {
 			return
 		}
 
-		h.renderProfile(
+		sessionUserID, ok := h.session.GetUserID(sess)
-			w, r, sessionUserID, sessionUsername,
+		if !ok {
-			successMessage, errorMessage,
+			h.log.Error("authenticated session missing user ID")
-		)
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+
+			return
+		}
+
+		// For now, only allow users to view their own profile
+		if requestedUsername != sessionUsername {
+			http.Error(w, "Forbidden", http.StatusForbidden)
+
+			return
+		}
+
+		// Prepare data for template
+		data := map[string]any{
+			"User": &UserInfo{
+				ID:       sessionUserID,
+				Username: sessionUsername,
+			},
+		}
+
+		// Render the profile page
+		h.renderTemplate(w, r, "profile.html", data)
 	}
 }
-
-// applyPasswordChange verifies the current password and, on success,
-// persists a fresh hash for the user, reusing the same helpers that
-// bootstrap the admin user. It returns the success and error messages
-// to display on the profile page. On an internal failure it writes a
-// 500 response itself and returns handled=false, signalling the caller
-// to stop without re-rendering the page.
-func (h *Handlers) applyPasswordChange(
-	w http.ResponseWriter,
-	username, currentPassword, newPassword, confirmPassword string,
-) (string, string, bool) {
-	// Load the user row so we can verify the current password and
-	// persist the new hash.
-	var user database.User
-
-	err := h.db.DB().Where(
-		"username = ?", username,
-	).First(&user).Error
-	if err != nil {
-		h.serverError(
-			w, "failed to load user for password change", err,
-		)
-
-		return "", "", false
-	}
-
-	valid, err := database.VerifyPassword(
-		currentPassword, user.Password,
-	)
-	if err != nil {
-		h.serverError(w, "failed to verify password", err)
-
-		return "", "", false
-	}
-
-	if !valid {
-		return "", "Current password is incorrect.", true
-	}
-
-	if newPassword == "" {
-		return "", "New password must not be empty.", true
-	}
-
-	if newPassword != confirmPassword {
-		return "", "New password and confirmation do not match.", true
-	}
-
-	hashedPassword, err := database.HashPassword(newPassword)
-	if err != nil {
-		h.serverError(w, "failed to hash new password", err)
-
-		return "", "", false
-	}
-
-	err = h.db.DB().Model(&user).Update(
-		"password", hashedPassword,
-	).Error
-	if err != nil {
-		h.serverError(w, "failed to update password", err)
-
-		return "", "", false
-	}
-
-	h.log.Info("user changed password", "username", username)
-
-	return "Password changed successfully.", "", true
-}
-
-// profileOwnerOrDeny resolves the session identity and enforces that a
-// user may only act on their own profile (the requested username in the
-// URL must equal the session username). On any failure it writes the
-// appropriate HTTP response and returns ok=false; callers must stop
-// when ok is false.
-func (h *Handlers) profileOwnerOrDeny(
-	w http.ResponseWriter,
-	r *http.Request,
-) (string, string, bool) {
-	requestedUsername := chi.URLParam(r, "username")
-	if requestedUsername == "" {
-		http.NotFound(w, r)
-
-		return "", "", false
-	}
-
-	// RequireAuth middleware guarantees an authenticated session
-	// before this handler runs, so we only need to guard against an
-	// unexpected retrieval error.
-	sess, err := h.session.Get(r)
-	if err != nil {
-		h.serverError(w, "failed to get session", err)
-
-		return "", "", false
-	}
-
-	sessionUsername, ok := h.session.GetUsername(sess)
-	if !ok {
-		h.log.Error("authenticated session missing username")
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
-
-		return "", "", false
-	}
-
-	sessionUserID, ok := h.session.GetUserID(sess)
-	if !ok {
-		h.log.Error("authenticated session missing user ID")
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
-
-		return "", "", false
-	}
-
-	// Only allow users to act on their own profile.
-	if requestedUsername != sessionUsername {
-		http.Error(w, "Forbidden", http.StatusForbidden)
-
-		return "", "", false
-	}
-
-	return sessionUserID, sessionUsername, true
-}
-
-// renderProfile renders the profile page for the given user,
-// optionally including a success or error message.
-func (h *Handlers) renderProfile(
-	w http.ResponseWriter,
-	r *http.Request,
-	userID, username, successMessage, errorMessage string,
-) {
-	data := map[string]any{
-		"User": &UserInfo{
-			ID:       userID,
-			Username: username,
-		},
-		"SuccessMessage": successMessage,
-		"ErrorMessage":   errorMessage,
-	}
-
-	h.renderTemplate(w, r, "profile.html", data)
-}

internal/handlers/profile_test.go

@@ -4,15 +4,12 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
-	"strings"
 	"testing"
 
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/middleware"
@@ -160,134 +157,3 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
-
-// passwordChangeRequest builds a POST request to the password-change
-// endpoint for the given username, attaching the supplied cookies, an
-// urlencoded form body, and the chi URL parameter the handler reads.
-func passwordChangeRequest(
-	username string,
-	cookies []*http.Cookie,
-	form url.Values,
-) *http.Request {
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost,
-		"/user/"+username+"/password",
-		strings.NewReader(form.Encode()),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rctx := chi.NewRouteContext()
-	rctx.URLParams.Add("username", username)
-
-	return req.WithContext(
-		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
-	)
-}
-
-func TestHandlePasswordChange_Success(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	var sess *session.Session
-
-	var db *database.Database
-
-	app := newTestApp(t, &h, &sess, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	oldHash, err := database.HashPassword("oldpassword")
-	require.NoError(t, err)
-
-	user := &database.User{Username: "pwuser", Password: oldHash}
-	require.NoError(t, db.DB().Create(user).Error)
-
-	cookies := authenticatedCookies(t, sess, user.ID, "pwuser")
-
-	form := url.Values{}
-	form.Set("current_password", "oldpassword")
-	form.Set("new_password", "newpassword")
-	form.Set("confirm_password", "newpassword")
-
-	req := passwordChangeRequest("pwuser", cookies, form)
-	w := httptest.NewRecorder()
-
-	h.HandlePasswordChange().ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(
-		t, w.Body.String(), "Password changed successfully.",
-	)
-
-	var updated database.User
-
-	require.NoError(t,
-		db.DB().Where("username = ?", "pwuser").First(&updated).Error,
-	)
-	assert.NotEqual(t, oldHash, updated.Password)
-
-	valid, err := database.VerifyPassword(
-		"newpassword", updated.Password,
-	)
-	require.NoError(t, err)
-	assert.True(t, valid, "new password should verify against new hash")
-}
-
-func TestHandlePasswordChange_WrongCurrentPassword(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	var sess *session.Session
-
-	var db *database.Database
-
-	app := newTestApp(t, &h, &sess, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	oldHash, err := database.HashPassword("oldpassword")
-	require.NoError(t, err)
-
-	user := &database.User{Username: "pwuser2", Password: oldHash}
-	require.NoError(t, db.DB().Create(user).Error)
-
-	cookies := authenticatedCookies(t, sess, user.ID, "pwuser2")
-
-	form := url.Values{}
-	form.Set("current_password", "wrongpassword")
-	form.Set("new_password", "newpassword")
-	form.Set("confirm_password", "newpassword")
-
-	req := passwordChangeRequest("pwuser2", cookies, form)
-	w := httptest.NewRecorder()
-
-	h.HandlePasswordChange().ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(
-		t, w.Body.String(), "Current password is incorrect.",
-	)
-
-	var unchanged database.User
-
-	require.NoError(t,
-		db.DB().Where(
-			"username = ?", "pwuser2",
-		).First(&unchanged).Error,
-	)
-	assert.Equal(
-		t, oldHash, unchanged.Password,
-		"stored hash must be unchanged after a rejected change",
-	)
-}

internal/handlers/source_management.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net/http"
 	"strconv"
-	"strings"
 
 	"github.com/go-chi/chi"
 	"github.com/google/uuid"
@@ -25,73 +24,6 @@ type WebhookListItem struct {
 // errMissingURL signals that a required URL was not provided.
 var errMissingURL = errors.New("missing URL")
 
-// errInvalidRetention signals a retention_days form value that is not
-// a non-negative whole number.
-var errInvalidRetention = errors.New("invalid retention days")
-
-// errRetentionTooLarge signals a retention_days form value that is a
-// whole number but larger than the reaper's cutoff arithmetic can
-// represent. It is distinguished from errInvalidRetention so the form
-// can tell the user the actual ceiling instead of implying their input
-// was not a number.
-var errRetentionTooLarge = errors.New("retention days out of range")
-
-// retentionErrorMessage returns the message the create and edit forms
-// show the user for a rejected retention_days value. Any error other
-// than errRetentionTooLarge falls back to the generic wording, so an
-// unrecognised parse failure still produces a sensible 400 rather than
-// an empty alert.
-func retentionErrorMessage(err error) string {
-	if errors.Is(err, errRetentionTooLarge) {
-		return "Retention must be at most " +
-			strconv.Itoa(database.MaxFiniteRetentionDays) +
-			" days, or 0 to retain events forever."
-	}
-
-	return "Retention must be a whole number of days, or 0 to " +
-		"retain events forever."
-}
-
-// parseRetentionDays interprets a retention_days form value.
-//
-// An empty value yields fallback, which lets the create path apply the
-// default and the edit path leave the stored value unchanged. A value
-// of 0 is returned as 0 and is rewritten to the retain-forever
-// sentinel by database.Webhook's BeforeSave hook. Anything unparseable
-// or negative is an error rather than a silently substituted default.
-//
-// The upper bound is not cosmetic. The reaper computes its cutoff as a
-// time.Duration, an int64 nanosecond count, so a day count above
-// database.MaxFiniteRetentionDays overflows, puts the cutoff in the
-// future, and deletes every event the webhook has. A finite value
-// above that ceiling is therefore a 400.
-//
-// A value at or above the retain-forever sentinel is not out of range:
-// it is what the edit form pre-fills for a retain-forever webhook, so
-// submitting the form back unchanged has to keep meaning "forever"
-// rather than being rejected.
-func parseRetentionDays(raw string, fallback int) (int, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return fallback, nil
-	}
-
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 0 {
-		return 0, errInvalidRetention
-	}
-
-	if v >= database.RetentionForeverDays {
-		return database.RetentionForeverDays, nil
-	}
-
-	if v > database.MaxFiniteRetentionDays {
-		return 0, errRetentionTooLarge
-	}
-
-	return v, nil
-}
-
 // EventWithDeliveries holds an event and its deliveries.
 type EventWithDeliveries struct {
 	database.Event
@@ -173,30 +105,11 @@ func (h *Handlers) buildWebhookListItems(
 // HandleSourceCreate shows the form to create a new webhook.
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		h.renderTemplate(
+		data := map[string]any{
-			w, r, "sources_new.html",
+			"Error": "",
-			newSourceFormData("", "", ""),
+		}
-		)
-	}
-}
 
-// newSourceFormData builds the template data for the webhook creation
+		h.renderTemplate(w, r, "sources_new.html", data)
-// form.
-//
-// It carries the retention default so the pre-filled value comes from
-// database.DefaultRetentionDays rather than being a third hardcoded
-// copy of the same policy, and it carries the submitted name and
-// description so that re-rendering the form after a validation failure
-// gives the user their input back instead of a blank form. The edit
-// form already behaves that way; create now matches it.
-func newSourceFormData(
-	errMsg, name, description string,
-) map[string]any {
-	return map[string]any{
-		tmplKeyError:           errMsg,
-		"Name":                 name,
-		"Description":          description,
-		"DefaultRetentionDays": database.DefaultRetentionDays,
 	}
 }
 
@@ -231,31 +144,23 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		retentionStr := r.FormValue("retention_days")
 
 		if name == "" {
+			data := map[string]any{
+				"Error": "Name is required",
+			}
+
 			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
+			h.renderTemplate(w, r, "sources_new.html", data)
-				w, r, "sources_new.html",
-				newSourceFormData(
-					"Name is required", name, description,
-				),
-			)
 
 			return
 		}
 
-		retentionDays, retErr := parseRetentionDays(
+		retentionDays := defaultRetentionDays
-			retentionStr, database.DefaultRetentionDays,
-		)
-		if retErr != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
-				w, r, "sources_new.html",
-				newSourceFormData(
-					retentionErrorMessage(retErr),
-					name, description,
-				),
-			)
 
-			return
+		if retentionStr != "" {
+			v, convErr := strconv.Atoi(retentionStr)
+			if convErr == nil && v > 0 {
+				retentionDays = v
+			}
 		}
 
 		h.createWebhookWithEntrypoint(
@@ -409,14 +314,12 @@ func (h *Handlers) renderSourceDetail(
 		scheme = fwdProto
 	}
 
-	// The template calls Webhook methods, which take pointer
-	// receivers; html/template cannot address a value stored in a map.
 	data := map[string]any{
-		tmplKeyWebhook: &webhook,
+		"Webhook":     webhook,
-		"Entrypoints":  entrypoints,
+		"Entrypoints": entrypoints,
-		"Targets":      targets,
+		"Targets":     targets,
-		"Events":       events,
+		"Events":      events,
-		"BaseURL":      scheme + "://" + host,
+		"BaseURL":     scheme + "://" + host,
 	}
 
 	h.renderTemplate(w, r, "source_detail.html", data)
@@ -448,8 +351,8 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			"Webhook": webhook,
-			tmplKeyError:   "",
+			"Error":   "",
 		}
 
 		h.renderTemplate(w, r, "source_edit.html", data)
@@ -512,8 +415,8 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			"Webhook": *webhook,
-			tmplKeyError:   "Name is required",
+			"Error":   "Name is required",
 		}
 
 		w.WriteHeader(http.StatusBadRequest)
@@ -524,25 +427,7 @@ func (h *Handlers) applyWebhookEdit(
 
 	webhook.Name = name
 	webhook.Description = r.FormValue("description")
-
+	h.parseRetention(r, webhook)
-	// An empty field falls back to the stored value, so submitting the
-	// form without touching retention leaves the policy alone.
-	retentionDays, retErr := parseRetentionDays(
-		r.FormValue("retention_days"), webhook.RetentionDays,
-	)
-	if retErr != nil {
-		data := map[string]any{
-			tmplKeyWebhook: webhook,
-			tmplKeyError:   retentionErrorMessage(retErr),
-		}
-
-		w.WriteHeader(http.StatusBadRequest)
-		h.renderTemplate(w, r, "source_edit.html", data)
-
-		return
-	}
-
-	webhook.RetentionDays = retentionDays
 
 	err := h.db.DB().Save(webhook).Error
 	if err != nil {
@@ -556,6 +441,23 @@ func (h *Handlers) applyWebhookEdit(
 	)
 }
 
+// parseRetention parses and applies retention_days from the
+// form.
+func (h *Handlers) parseRetention(
+	r *http.Request,
+	webhook *database.Webhook,
+) {
+	retStr := r.FormValue("retention_days")
+	if retStr == "" {
+		return
+	}
+
+	v, err := strconv.Atoi(retStr)
+	if err == nil && v > 0 {
+		webhook.RetentionDays = v
+	}
+}
+
 // HandleSourceDelete handles webhook deletion.
 func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -687,15 +589,15 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			"Webhook":     webhook,
-			"Events":       evts,
+			"Events":      evts,
-			"Page":         page,
+			"Page":        page,
-			"TotalPages":   totalPages,
+			"TotalPages":  totalPages,
-			"TotalEvents":  total,
+			"TotalEvents": total,
-			"HasPrev":      page > 1,
+			"HasPrev":     page > 1,
-			"HasNext":      page < totalPages,
+			"HasNext":     page < totalPages,
-			"PrevPage":     page - 1,
+			"PrevPage":    page - 1,
-			"NextPage":     page + 1,
+			"NextPage":    page + 1,
 		}
 
 		h.renderTemplate(w, r, "source_logs.html", data)
@@ -913,7 +815,6 @@ func (h *Handlers) processTargetCreate(
 	targetType := database.TargetType(r.FormValue("type"))
 	targetURL := r.FormValue("url")
 	maxRetriesStr := r.FormValue("max_retries")
-	expiry := r.FormValue("expiry")
 
 	if name == "" {
 		http.Error(
@@ -933,7 +834,7 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	configJSON, err := h.buildTargetConfig(
-		w, r, targetType, targetURL, expiry,
+		w, r, targetType, targetURL,
 	)
 	if err != nil {
 		return
@@ -991,28 +892,18 @@ func parseNonNegativeInt(s string) int {
 }
 
 // buildTargetConfig builds the JSON config string for a target.
-// The expiry form value is read by the caller (which bounds the
-// request body) and applies to database targets only.
 func (h *Handlers) buildTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetType database.TargetType,
-	targetURL, expiry string,
+	targetURL string,
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
-		return h.buildURLTargetConfig(
+		return h.buildHTTPTargetConfig(w, r, targetURL)
-			w, r, targetURL, "url",
-			"URL is required for HTTP targets",
-		)
 	case database.TargetTypeSlack:
-		return h.buildURLTargetConfig(
+		return h.buildSlackTargetConfig(w, r, targetURL)
-			w, r, targetURL, "webhookUrl",
+	case database.TargetTypeDatabase, database.TargetTypeLog:
-			"Webhook URL is required for Slack targets",
-		)
-	case database.TargetTypeDatabase:
-		return h.buildDatabaseTargetConfig(w, expiry)
-	case database.TargetTypeLog:
 		return "", nil
 	default:
 		http.Error(
@@ -1024,18 +915,16 @@ func (h *Handlers) buildTargetConfig(
 	}
 }
 
-// buildURLTargetConfig builds config JSON for a target whose
+// buildHTTPTargetConfig builds config JSON for an HTTP target.
-// configuration is a single SSRF-validated URL stored under
+func (h *Handlers) buildHTTPTargetConfig(
-// configKey. missingMsg is the error shown when no URL is given.
-func (h *Handlers) buildURLTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
-	targetURL, configKey, missingMsg string,
+	targetURL string,
 ) (string, error) {
 	if targetURL == "" {
 		http.Error(
 			w,
-			missingMsg,
+			"URL is required for HTTP targets",
 			http.StatusBadRequest,
 		)
 
@@ -1060,7 +949,7 @@ func (h *Handlers) buildURLTargetConfig(
 		return "", err
 	}
 
-	cfg := map[string]any{configKey: targetURL}
+	cfg := map[string]any{"url": targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
@@ -1075,33 +964,41 @@ func (h *Handlers) buildURLTargetConfig(
 	return string(configBytes), nil
 }
 
-// buildDatabaseTargetConfig builds config JSON for a database
+// buildSlackTargetConfig builds config JSON for a Slack target.
-// (archive) target. The optional expiry (a form value read by
+func (h *Handlers) buildSlackTargetConfig(
-// the caller, which bounds the request body) is validated here,
-// at creation time, so an unparseable value is rejected with a
-// 400 instead of failing every subsequent delivery. An empty
-// expiry yields an empty config (the keep-forever default).
-func (h *Handlers) buildDatabaseTargetConfig(
 	w http.ResponseWriter,
-	expiry string,
+	r *http.Request,
+	targetURL string,
 ) (string, error) {
-	expiry = strings.TrimSpace(expiry)
+	if targetURL == "" {
-	if expiry == "" {
-		return "", nil
-	}
-
-	err := delivery.ValidateArchiveExpiry(expiry)
-	if err != nil {
 		http.Error(
 			w,
-			"Invalid archive expiry: "+err.Error(),
+			"Webhook URL is required for Slack targets",
+			http.StatusBadRequest,
+		)
+
+		return "", errMissingURL
+	}
+
+	err := delivery.ValidateTargetURL(
+		r.Context(), targetURL,
+	)
+	if err != nil {
+		h.log.Warn(
+			"target URL blocked by SSRF protection",
+			"url", targetURL,
+			"error", err,
+		)
+		http.Error(
+			w,
+			"Invalid target URL: "+err.Error(),
 			http.StatusBadRequest,
 		)
 
 		return "", err
 	}
 
-	cfg := map[string]any{"expiry": expiry}
+	cfg := map[string]any{"webhookUrl": targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {

internal/handlers/source_management_test.go

@@ -1,581 +0,0 @@
-package handlers_test
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm/clause"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/handlers"
-	"sneak.berlin/go/webhooker/internal/session"
-)
-
-const (
-	// sourceTestUserID is the session user id used by the webhook
-	// management tests.
-	sourceTestUserID = "source-test-user"
-	// sourceIDParam is the chi URL parameter naming a webhook.
-	sourceIDParam = "sourceID"
-)
-
-// formRequest builds an urlencoded POST to path carrying the given
-// cookies, plus any chi URL parameters the handler reads.
-func formRequest(
-	path string,
-	cookies []*http.Cookie,
-	form url.Values,
-	urlParams map[string]string,
-) *http.Request {
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost,
-		path,
-		strings.NewReader(form.Encode()),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rctx := chi.NewRouteContext()
-	for k, v := range urlParams {
-		rctx.URLParams.Add(k, v)
-	}
-
-	return req.WithContext(
-		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
-	)
-}
-
-// getRequest builds a GET to path carrying the given cookies, plus any
-// chi URL parameters the handler reads.
-func getRequest(
-	t *testing.T,
-	path string,
-	cookies []*http.Cookie,
-	urlParams map[string]string,
-) *http.Request {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, path, nil,
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rctx := chi.NewRouteContext()
-	for k, v := range urlParams {
-		rctx.URLParams.Add(k, v)
-	}
-
-	return req.WithContext(
-		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
-	)
-}
-
-// submitCreate posts the webhook creation form with the given
-// retention_days value (omitted entirely when retention is nil) and
-// returns the recorder.
-func submitCreate(
-	t *testing.T,
-	h *handlers.Handlers,
-	cookies []*http.Cookie,
-	name string,
-	retention *string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	form := url.Values{}
-	form.Set("name", name)
-
-	if retention != nil {
-		form.Set("retention_days", *retention)
-	}
-
-	req := formRequest("/sources/new", cookies, form, nil)
-	w := httptest.NewRecorder()
-
-	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
-
-	return w
-}
-
-// onlyWebhook loads the single webhook belonging to the test user.
-func onlyWebhook(
-	t *testing.T,
-	db *database.Database,
-) database.Webhook {
-	t.Helper()
-
-	var webhooks []database.Webhook
-
-	require.NoError(
-		t,
-		db.DB().Where("user_id = ?", sourceTestUserID).
-			Find(&webhooks).Error,
-	)
-	require.Len(t, webhooks, 1)
-
-	return webhooks[0]
-}
-
-// seedWebhook inserts a webhook owned by the test user with an exact
-// stored retention value, bypassing Webhook.BeforeSave via a
-// column-level update so that legacy rows can be planted too.
-func seedWebhook(
-	t *testing.T,
-	db *database.Database,
-	retentionDays int,
-) database.Webhook {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        sourceTestUserID,
-		Name:          "seeded",
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.DB().Omit(clause.Associations).Create(wh).Error,
-	)
-	require.NoError(
-		t,
-		db.DB().Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	wh.RetentionDays = retentionDays
-
-	return *wh
-}
-
-// storedRetentionDays reads the retention_days column for a webhook.
-func storedRetentionDays(
-	t *testing.T,
-	db *database.Database,
-	id string,
-) int {
-	t.Helper()
-
-	var got int
-
-	require.NoError(
-		t,
-		db.DB().Model(&database.Webhook{}).
-			Where("id = ?", id).
-			Pluck("retention_days", &got).Error,
-	)
-
-	return got
-}
-
-// sourceTestEnv bundles the handler, session, and database a webhook
-// management test drives.
-type sourceTestEnv struct {
-	handlers *handlers.Handlers
-	db       *database.Database
-	cookies  []*http.Cookie
-}
-
-func setupSourceTest(t *testing.T) *sourceTestEnv {
-	t.Helper()
-
-	var h *handlers.Handlers
-
-	var sess *session.Session
-
-	var db *database.Database
-
-	app := newTestApp(t, &h, &sess, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	return &sourceTestEnv{
-		handlers: h,
-		db:       db,
-		cookies: authenticatedCookies(
-			t, sess, sourceTestUserID, "sourceuser",
-		),
-	}
-}
-
-// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
-// regression test for the bug: the create form's 0 must reach the
-// database as the retain-forever sentinel rather than being replaced by
-// the column's default of 30.
-func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	zero := "0"
-
-	w := submitCreate(t, env.handlers, env.cookies, "forever", &zero)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-	assert.True(t, wh.RetainsForever())
-}
-
-func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
-// form's pre-filled retention from becoming a third hardcoded copy of
-// the 30-day policy.
-func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	w := httptest.NewRecorder()
-	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/sources/new", env.cookies, nil),
-	)
-
-	require.Equal(t, http.StatusOK, w.Code)
-
-	body := w.Body.String()
-
-	assert.Contains(
-		t, body,
-		`value="`+strconv.Itoa(database.DefaultRetentionDays)+`"`,
-	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block retain-forever",
-	)
-	assert.Contains(t, body, `min="0"`)
-}
-
-func TestHandleSourceCreateSubmit_InvalidRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	for _, raw := range []string{"abc", "-1", "3.5"} {
-		t.Run(raw, func(t *testing.T) {
-			t.Parallel()
-
-			env := setupSourceTest(t)
-
-			w := submitCreate(
-				t, env.handlers, env.cookies, "bad", &raw,
-			)
-
-			assert.Equal(t, http.StatusBadRequest, w.Code)
-			assert.Contains(
-				t, w.Body.String(), "Retention must be",
-			)
-
-			var count int64
-
-			require.NoError(
-				t,
-				env.db.DB().Model(&database.Webhook{}).
-					Where("user_id = ?", sourceTestUserID).
-					Count(&count).Error,
-			)
-			assert.Zero(
-				t, count,
-				"no webhook may be created from a rejected form",
-			)
-		})
-	}
-}
-
-// TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected covers
-// the data-loss path directly: a finite retention above the largest one
-// the reaper's cutoff arithmetic can represent must never reach the
-// database, because the sweep would compute a future cutoff and delete
-// every event the webhook has.
-func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	tooBig := strconv.Itoa(database.MaxFiniteRetentionDays + 1)
-
-	env := setupSourceTest(t)
-
-	w := submitCreate(t, env.handlers, env.cookies, "huge", &tooBig)
-
-	assert.Equal(t, http.StatusBadRequest, w.Code)
-	assert.Contains(
-		t, w.Body.String(),
-		strconv.Itoa(database.MaxFiniteRetentionDays),
-		"the form tells the user the actual ceiling",
-	)
-
-	var count int64
-
-	require.NoError(
-		t,
-		env.db.DB().Model(&database.Webhook{}).
-			Where("user_id = ?", sourceTestUserID).
-			Count(&count).Error,
-	)
-	assert.Zero(
-		t, count,
-		"no webhook may be created from a rejected form",
-	)
-}
-
-// TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
-// boundary between "too large to represent" and "retain forever": the
-// sentinel is above MaxFiniteRetentionDays, but it is the value the
-// edit form pre-fills, so it must be accepted rather than rejected as
-// out of range.
-func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-
-	w := submitCreate(t, env.handlers, env.cookies, "forever", &sentinel)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
-// validation failure hands the user's typing back, matching what the
-// edit form already does. Losing a long description to a mistyped
-// retention value is the kind of thing that makes people give up on a
-// form.
-func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	const (
-		name        = "kept-name"
-		description = "a description worth not losing"
-	)
-
-	form := url.Values{}
-	form.Set("name", name)
-	form.Set("description", description)
-	form.Set("retention_days", "nonsense")
-
-	req := formRequest("/sources/new", env.cookies, form, nil)
-	w := httptest.NewRecorder()
-
-	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
-
-	require.Equal(t, http.StatusBadRequest, w.Code)
-
-	body := w.Body.String()
-
-	assert.Contains(t, body, `value="`+name+`"`)
-	assert.Contains(t, body, description)
-}
-
-// submitEdit posts the webhook edit form for the given webhook.
-func submitEdit(
-	t *testing.T,
-	env *sourceTestEnv,
-	wh database.Webhook,
-	retention string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	form := url.Values{}
-	form.Set("name", wh.Name)
-	form.Set("description", wh.Description)
-	form.Set("retention_days", retention)
-
-	req := formRequest(
-		"/source/"+wh.ID+"/edit",
-		env.cookies,
-		form,
-		map[string]string{sourceIDParam: wh.ID},
-	)
-	w := httptest.NewRecorder()
-
-	env.handlers.HandleSourceEditSubmit().ServeHTTP(w, req)
-
-	return w
-}
-
-func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
-
-	w := submitEdit(t, env, wh, "0")
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
-
-	w := submitEdit(t, env, wh, "not-a-number")
-
-	assert.Equal(t, http.StatusBadRequest, w.Code)
-	assert.Contains(t, w.Body.String(), "Retention must be")
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-		"a rejected form must not change the stored retention",
-	)
-}
-
-func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, 7)
-
-	w := submitEdit(t, env, wh, "")
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
-}
-
-// TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
-// the removed max="365" cap used to break: render the edit form for a
-// retain-forever webhook, confirm the pre-filled sentinel is not capped
-// by browser validation, then submit that pre-filled value straight
-// back and confirm the retention policy survives untouched.
-func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
-
-	req := getRequest(
-		t, "/source/"+wh.ID+"/edit", env.cookies,
-		map[string]string{sourceIDParam: wh.ID},
-	)
-	w := httptest.NewRecorder()
-	env.handlers.HandleSourceEdit().ServeHTTP(w, req)
-
-	require.Equal(t, http.StatusOK, w.Code)
-
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-	body := w.Body.String()
-
-	assert.Contains(
-		t, body, `value="`+sentinel+`"`,
-		"the edit form pre-fills the stored retention",
-	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block saving any edit",
-	)
-	// "Currently forever." is the rendered RetentionLabel, not the
-	// static hint below the input, which says "Enter 0 to retain events
-	// forever." A bare Contains of "forever" would pass for any
-	// webhook and would assert nothing about this one.
-	assert.Contains(
-		t, body, "Currently forever.",
-		"the form reports this webhook's policy as forever",
-	)
-
-	// Submit the pre-filled value back, exactly as a browser would.
-	post := submitEdit(t, env, wh, sentinel)
-	require.Equal(t, http.StatusSeeOther, post.Code)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
-// the retain-forever value is never rendered to the user as a raw day
-// count on either read-only view.
-func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-
-	listW := httptest.NewRecorder()
-	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/sources", env.cookies, nil),
-	)
-
-	require.Equal(t, http.StatusOK, listW.Code)
-	assert.Contains(t, listW.Body.String(), "Retention: forever")
-	assert.NotContains(t, listW.Body.String(), sentinel)
-
-	detailW := httptest.NewRecorder()
-	env.handlers.HandleSourceDetail().ServeHTTP(
-		detailW,
-		getRequest(
-			t, "/source/"+wh.ID, env.cookies,
-			map[string]string{sourceIDParam: wh.ID},
-		),
-	)
-
-	require.Equal(t, http.StatusOK, detailW.Code)
-	assert.Contains(t, detailW.Body.String(), "Retention: forever")
-	assert.NotContains(t, detailW.Body.String(), sentinel)
-}

internal/middleware/export_test.go

@@ -32,7 +32,3 @@ func IsClientTLS(r *http.Request) bool {
 
 // LoginRateLimitConst exposes the loginRateLimit constant.
 const LoginRateLimitConst = loginRateLimit
-
-// PasswordChangeRateLimitConst exposes the
-// passwordChangeRateLimit constant.
-const PasswordChangeRateLimitConst = passwordChangeRateLimit

internal/middleware/middleware_test.go

@@ -484,13 +484,8 @@ func metricsAuthMiddleware(
 	return middleware.NewForTest(log, cfg, sessManager)
 }
 
-// runMetricsAuthRequest sends a GET /metrics request with the
+func TestMetricsAuth_ValidCredentials(t *testing.T) {
-// given basic-auth password through MetricsAuth and reports
+	t.Parallel()
-// whether the wrapped handler ran plus the recorded response.
-func runMetricsAuthRequest(
-	t *testing.T, password string,
-) (bool, *httptest.ResponseRecorder) {
-	t.Helper()
 
 	m := metricsAuthMiddleware(t)
 
@@ -508,20 +503,12 @@ func runMetricsAuthRequest(
 		context.Background(),
 		http.MethodGet, "/metrics", nil,
 	)
-	req.SetBasicAuth("admin", password)
+	req.SetBasicAuth("admin", "secret")
 
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	return called, w
-}
-
-func TestMetricsAuth_ValidCredentials(t *testing.T) {
-	t.Parallel()
-
-	called, w := runMetricsAuthRequest(t, "secret")
-
 	assert.True(
 		t, called,
 		"handler should be called with valid basic auth",
@@ -532,7 +519,27 @@ func TestMetricsAuth_ValidCredentials(t *testing.T) {
 func TestMetricsAuth_InvalidCredentials(t *testing.T) {
 	t.Parallel()
 
-	called, w := runMetricsAuthRequest(t, "wrong-password")
+	m := metricsAuthMiddleware(t)
+
+	var called bool
+
+	handler := m.MetricsAuth()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/metrics", nil,
+	)
+	req.SetBasicAuth("admin", "wrong-password")
+
+	w := httptest.NewRecorder()
+
+	handler.ServeHTTP(w, req)
 
 	assert.False(
 		t, called,

internal/middleware/ratelimit.go

@@ -15,15 +15,10 @@ const (
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
 
-	// passwordChangeRateLimit is the maximum number of password
+	// receiverRateInterval is the time window for the webhook
-	// change attempts per interval. Each attempt verifies the
+	// receiver rate limit. The configured limit is expressed in
-	// current password, so the endpoint must be rate-limited
+	// requests per minute.
-	// like any other password-based authentication endpoint.
+	receiverRateInterval = 1 * time.Minute
-	passwordChangeRateLimit = 5
-
-	// passwordChangeRateInterval is the time window for the
-	// password change rate limit.
-	passwordChangeRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -34,53 +29,19 @@ const (
 // honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
 // for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
-	return m.postRateLimit(
+	limiter := httprate.Limit(
 		loginRateLimit,
 		loginRateInterval,
-		"login rate limit exceeded",
-		"Too many login attempts. Please try again later.",
-	)
-}
-
-// PasswordChangeRateLimit returns middleware that enforces
-// per-IP rate limiting on password change attempts. The change
-// endpoint verifies the current password, so without a limit a
-// stolen session could be used to brute-force it; the limit
-// matches the login endpoint's.
-func (m *Middleware) PasswordChangeRateLimit() func(http.Handler) http.Handler {
-	return m.postRateLimit(
-		passwordChangeRateLimit,
-		passwordChangeRateInterval,
-		"password change rate limit exceeded",
-		"Too many password change attempts. "+
-			"Please try again later.",
-	)
-}
-
-// postRateLimit builds middleware that enforces a per-IP rate
-// limit on POST requests only; all other methods pass through
-// unaffected. Requests over the limit receive a 429 with the
-// given response message, and each rejection is logged with the
-// given log message. IP extraction honours X-Forwarded-For,
-// X-Real-IP, and True-Client-IP headers for reverse-proxy
-// setups.
-func (m *Middleware) postRateLimit(
-	limit int,
-	interval time.Duration,
-	logMessage, responseMessage string,
-) func(http.Handler) http.Handler {
-	limiter := httprate.Limit(
-		limit,
-		interval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
 		httprate.WithLimitHandler(http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				m.log.Warn(logMessage,
+				m.log.Warn("login rate limit exceeded",
 					"path", r.URL.Path,
 				)
 				http.Error(
 					w,
-					responseMessage,
+					"Too many login attempts. "+
+						"Please try again later.",
 					http.StatusTooManyRequests,
 				)
 			},
@@ -94,7 +55,8 @@ func (m *Middleware) postRateLimit(
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			// Only rate-limit POST requests.
+			// Only rate-limit POST requests (actual login
+			// attempts)
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)
 
@@ -105,3 +67,37 @@ func (m *Middleware) postRateLimit(
 		})
 	}
 }
+
+// ReceiverRateLimit returns middleware that rate-limits the
+// public webhook receiver endpoint per client IP per request
+// path (the path contains the entrypoint UUID, so each sender
+// is limited per entrypoint without affecting other senders or
+// other entrypoints). The limit is Config.ReceiverRateLimit
+// requests per minute. Requests over the limit receive a 429;
+// httprate adds the Retry-After header (RFC 6585). IP
+// extraction honours X-Forwarded-For, X-Real-IP, and
+// True-Client-IP headers for reverse-proxy setups.
+func (m *Middleware) ReceiverRateLimit() func(http.Handler) http.Handler {
+	return httprate.Limit(
+		m.params.Config.ReceiverRateLimit,
+		receiverRateInterval,
+		httprate.WithKeyFuncs(
+			httprate.KeyByRealIP,
+			httprate.KeyByEndpoint,
+		),
+		httprate.WithLimitHandler(http.HandlerFunc(
+			func(w http.ResponseWriter, r *http.Request) {
+				m.log.Warn(
+					"webhook receiver rate limit exceeded",
+					"path", r.URL.Path,
+				)
+				http.Error(
+					w,
+					"Too many requests. "+
+						"Please slow down.",
+					http.StatusTooManyRequests,
+				)
+			},
+		)),
+	)
+}

internal/middleware/ratelimit_test.go

@@ -2,8 +2,10 @@ package middleware_test
 
 import (
 	"context"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -46,20 +48,14 @@ func TestLoginRateLimit_AllowsGET(t *testing.T) {
 	assert.Equal(t, 20, callCount)
 }
 
-// runPostLimitTest exercises a POST-only rate limit middleware:
+func TestLoginRateLimit_LimitsPOST(t *testing.T) {
-// the first limit POSTs to path from ip must pass, and the next
+	t.Parallel()
-// one must be rejected with 429 without reaching the handler.
+
-func runPostLimitTest(
+	m, _ := testMiddleware(t, config.EnvironmentDev)
-	t *testing.T,
-	mw func(http.Handler) http.Handler,
-	limit int,
-	path, ip string,
-) {
-	t.Helper()
 
 	var callCount int
 
-	handler := mw(http.HandlerFunc(
+	handler := m.LoginRateLimit()(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			callCount++
 
@@ -67,13 +63,13 @@ func runPostLimitTest(
 		},
 	))
 
-	// The first limit POST requests should succeed
+	// First loginRateLimit POST requests should succeed
-	for i := range limit {
+	for i := range middleware.LoginRateLimitConst {
 		req := httptest.NewRequestWithContext(
 			context.Background(),
-			http.MethodPost, path, nil,
+			http.MethodPost, "/pages/login", nil,
 		)
-		req.RemoteAddr = ip
+		req.RemoteAddr = "10.0.0.1:12345"
 
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
@@ -87,9 +83,9 @@ func runPostLimitTest(
 	// Next POST should be rate-limited
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodPost, path, nil,
+		http.MethodPost, "/pages/login", nil,
 	)
-	req.RemoteAddr = ip
+	req.RemoteAddr = "10.0.0.1:12345"
 
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
@@ -98,35 +94,7 @@ func runPostLimitTest(
 		t, http.StatusTooManyRequests, w.Code,
 		"POST after limit should be 429",
 	)
-	assert.Equal(t, limit, callCount)
+	assert.Equal(t, middleware.LoginRateLimitConst, callCount)
-}
-
-func TestLoginRateLimit_LimitsPOST(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	runPostLimitTest(
-		t,
-		m.LoginRateLimit(),
-		middleware.LoginRateLimitConst,
-		"/pages/login",
-		"10.0.0.1:12345",
-	)
-}
-
-func TestPasswordChangeRateLimit_LimitsPOST(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	runPostLimitTest(
-		t,
-		m.PasswordChangeRateLimit(),
-		middleware.PasswordChangeRateLimitConst,
-		"/user/admin/password",
-		"10.0.0.2:12345",
-	)
 }
 
 func TestLoginRateLimit_IndependentPerIP(t *testing.T) {
@@ -179,3 +147,94 @@ func TestLoginRateLimit_IndependentPerIP(t *testing.T) {
 		"different IP should not be affected",
 	)
 }
+
+// receiverLimitedHandler builds a ReceiverRateLimit-wrapped
+// handler with the given per-minute limit.
+func receiverLimitedHandler(
+	t *testing.T, limit int,
+) http.Handler {
+	t.Helper()
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+
+	m := middleware.NewForTest(
+		log,
+		&config.Config{ReceiverRateLimit: limit},
+		nil,
+	)
+
+	return m.ReceiverRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+}
+
+// receiverPost sends one POST to the handler from the given IP
+// and path and returns the recorder.
+func receiverPost(
+	handler http.Handler, ip, path string,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, path, nil,
+	)
+	req.RemoteAddr = ip
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	return w
+}
+
+func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
+	t.Parallel()
+
+	const limit = 3
+
+	handler := receiverLimitedHandler(t, limit)
+
+	// The first limit requests from one IP to one entrypoint
+	// pass.
+	for i := range limit {
+		w := receiverPost(
+			handler, "9.9.9.9:1234", "/webhook/uuid-a",
+		)
+		assert.Equal(
+			t, http.StatusOK, w.Code,
+			"request %d should pass", i,
+		)
+	}
+
+	// The next request over the limit is rejected with a 429
+	// carrying a Retry-After header.
+	w := receiverPost(
+		handler, "9.9.9.9:1234", "/webhook/uuid-a",
+	)
+	assert.Equal(t, http.StatusTooManyRequests, w.Code)
+	assert.NotEmpty(
+		t, w.Header().Get("Retry-After"),
+		"429 must carry a Retry-After header",
+	)
+
+	// The same IP is not limited on a different entrypoint.
+	w = receiverPost(
+		handler, "9.9.9.9:1234", "/webhook/uuid-b",
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a different entrypoint must not be affected",
+	)
+
+	// A different IP is not limited on the same entrypoint.
+	w = receiverPost(
+		handler, "8.8.8.8:1234", "/webhook/uuid-a",
+	)
+	assert.Equal(
+		t, http.StatusOK, w.Code,
+		"a different client IP must not be affected",
+	)
+}

internal/server/routes.go

@@ -110,9 +110,6 @@ func (s *Server) setupUserRoutes() {
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
-		r.With(s.mw.PasswordChangeRateLimit()).Post(
-			"/password", s.h.HandlePasswordChange(),
-		)
 	})
 }
 
@@ -162,7 +159,7 @@ func (s *Server) setupSourceRoutes() {
 }
 
 func (s *Server) setupWebhookRoutes() {
-	s.router.HandleFunc(
+	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
 		"/webhook/{uuid}",
 		s.h.HandleWebhook(),
 	)

internal/session/session_test.go

@@ -173,18 +173,8 @@ func TestSetUser_SetsAllFields(t *testing.T) {
 	)
 }
 
-// testSessionGetter exercises a session string getter before and
+func TestGetUserID(t *testing.T) {
-// after SetUser: it must report false with an empty value on a
+	t.Parallel()
-// fresh session, then true with the expected value once
-// SetUser(sess, "user-xyz", "bob") has run.
-func testSessionGetter(
-	t *testing.T,
-	get func(
-		*session.Session, *sessions.Session,
-	) (string, bool),
-	expected string,
-) {
-	t.Helper()
 
 	s := testSession(t)
 
@@ -195,46 +185,44 @@ func testSessionGetter(
 	require.NoError(t, err)
 
 	// Before setting user
-	val, ok := get(s, sess)
+	userID, ok := s.GetUserID(sess)
 	assert.False(
-		t, ok, "should return false before SetUser",
+		t, ok, "should return false when no user ID is set",
 	)
-	assert.Empty(t, val)
+	assert.Empty(t, userID)
 
 	// After setting user
 	s.SetUser(sess, "user-xyz", "bob")
 
-	val, ok = get(s, sess)
+	userID, ok = s.GetUserID(sess)
 	assert.True(t, ok)
-	assert.Equal(t, expected, val)
+	assert.Equal(t, "user-xyz", userID)
-}
-
-func TestGetUserID(t *testing.T) {
-	t.Parallel()
-
-	testSessionGetter(
-		t,
-		func(
-			s *session.Session, sess *sessions.Session,
-		) (string, bool) {
-			return s.GetUserID(sess)
-		},
-		"user-xyz",
-	)
 }
 
 func TestGetUsername(t *testing.T) {
 	t.Parallel()
 
-	testSessionGetter(
+	s := testSession(t)
-		t,
+
-		func(
+	req := httptest.NewRequestWithContext(
-			s *session.Session, sess *sessions.Session,
+		context.Background(), http.MethodGet, "/", nil)
-		) (string, bool) {
+
-			return s.GetUsername(sess)
+	sess, err := s.Get(req)
-		},
+	require.NoError(t, err)
-		"bob",
+
+	// Before setting user
+	username, ok := s.GetUsername(sess)
+	assert.False(
+		t, ok, "should return false when no username is set",
 	)
+	assert.Empty(t, username)
+
+	// After setting user
+	s.SetUser(sess, "user-xyz", "bob")
+
+	username, ok = s.GetUsername(sess)
+	assert.True(t, ok)
+	assert.Equal(t, "bob", username)
 }
 
 // --- IsAuthenticated Tests ---

internal/session/testing.go

@@ -12,12 +12,7 @@ import (
 // middleware and handler tests to use real session functionality. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
-func NewForTest(
+func NewForTest(store *sessions.CookieStore, cfg *config.Config, log *slog.Logger, key []byte) *Session {
-	store *sessions.CookieStore,
-	cfg *config.Config,
-	log *slog.Logger,
-	key []byte,
-) *Session {
 	return &Session{
 		store:  store,
 		key:    key,

script/bootstrap

@@ -10,11 +10,11 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-08-07. Never "latest"; exact versions only.
+# Pinned versions, 2026-07-07. Never "latest"; exact versions only.
-GOLANGCI_LINT_VERSION="2.12.2"
+GOLANGCI_LINT_VERSION="2.11.3"
-# sha256 of golangci-lint-2.12.2-linux-<arch>.tar.gz release archives
+# sha256 of golangci-lint-2.11.3-linux-<arch>.tar.gz release archives
-GOLANGCI_LINT_SHA256_AMD64="8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
+GOLANGCI_LINT_SHA256_AMD64="87bb8cddbcc825d5778b64e8a91b46c0526b247f4e2f2904dea74ec7450475d1"
-GOLANGCI_LINT_SHA256_ARM64="44cd40a8c76c86755375adfeea52cfd3533cb43d7bd647771e0ae065e166df3a"
+GOLANGCI_LINT_SHA256_ARM64="ee3d95f301359e7d578e6d99c8ad5aeadbabc5a13009a30b2b0df11c8058afe9"
 
 PKGMGR=""
 SUDO=""

templates/profile.html

@@ -6,18 +6,6 @@
 <div class="max-w-4xl mx-auto px-6 py-12">
     <h1 class="text-2xl font-medium text-gray-900 mb-6">User Profile</h1>
 
-    {{if .SuccessMessage}}
-    <div class="alert-success">
-        <span>{{.SuccessMessage}}</span>
-    </div>
-    {{end}}
-
-    {{if .ErrorMessage}}
-    <div class="alert-error">
-        <span>{{.ErrorMessage}}</span>
-    </div>
-    {{end}}
-
     <div class="card p-6">
         <div class="flex items-center mb-6">
             <div class="mr-4">
@@ -55,50 +43,6 @@
         </div>
     </div>
 
-    <div class="card p-6 mt-6">
-        <h3 class="text-lg font-medium text-gray-900 mb-3">Change Password</h3>
-        <form method="POST" action="/user/{{.User.Username}}/password" class="space-y-6">
-            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
-            <div class="form-group">
-                <label for="current_password" class="label">Current Password</label>
-                <input
-                    type="password"
-                    id="current_password"
-                    name="current_password"
-                    required
-                    autocomplete="current-password"
-                    class="input"
-                >
-            </div>
-
-            <div class="form-group">
-                <label for="new_password" class="label">New Password</label>
-                <input
-                    type="password"
-                    id="new_password"
-                    name="new_password"
-                    required
-                    autocomplete="new-password"
-                    class="input"
-                >
-            </div>
-
-            <div class="form-group">
-                <label for="confirm_password" class="label">Confirm New Password</label>
-                <input
-                    type="password"
-                    id="confirm_password"
-                    name="confirm_password"
-                    required
-                    autocomplete="new-password"
-                    class="input"
-                >
-            </div>
-
-            <button type="submit" class="btn-primary">Change Password</button>
-        </form>
-    </div>
-
     <div class="mt-6">
         <a href="/" class="btn-secondary">Back to Home</a>
     </div>

templates/source_detail.html

@@ -113,10 +113,6 @@
                         <input type="url" name="url" placeholder="https://hooks.slack.com/services/..." :disabled="targetType !== 'slack'" class="input text-sm">
                         <p class="text-xs text-gray-500 mt-1">Slack or Mattermost incoming webhook URL. Payloads are pretty-printed in code blocks.</p>
                     </div>
-                    <div x-show="targetType === 'database'">
-                        <input type="text" name="expiry" placeholder="never" :disabled="targetType !== 'database'" class="input text-sm">
-                        <p class="text-xs text-gray-500 mt-1">Archive expiry: "never" (default) keeps rows forever, or a duration like "720h" prunes older rows.</p>
-                    </div>
                     <button type="submit" class="btn-primary text-sm">Add Target</button>
                 </form>
             </div>
@@ -181,7 +177,7 @@
 
     <!-- Info -->
     <div class="mt-4 text-sm text-gray-400">
-        <p>Retention: {{.Webhook.RetentionLabel}} &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
+        <p>Retention: {{.Webhook.RetentionDays}} days &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
     </div>
 </div>
 {{end}}

templates/source_edit.html

@@ -28,8 +28,7 @@
 
             <div class="form-group">
                 <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="0" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="1" max="365" class="input">
-                <p class="text-xs text-gray-500 mt-1">Currently {{.Webhook.RetentionLabel}}. Enter 0 to retain events forever.</p>
             </div>
 
             <div class="flex gap-3">

templates/sources_list.html

@@ -25,7 +25,7 @@
                     <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
                     {{end}}
                 </div>
-                <span class="badge-info">Retention: {{.RetentionLabel}}</span>
+                <span class="badge-info">{{.RetentionDays}}d retention</span>
             </div>
             <div class="flex gap-6 mt-4 text-sm text-gray-500">
                 <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>

templates/sources_new.html

@@ -18,18 +18,18 @@
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
                 <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" value="{{.Name}}" required autofocus placeholder="My Webhook" class="input">
+                <input type="text" id="name" name="name" required autofocus placeholder="My Webhook" class="input">
             </div>
 
             <div class="form-group">
                 <label for="description" class="label">Description</label>
-                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input">{{.Description}}</textarea>
+                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input"></textarea>
             </div>
 
             <div class="form-group">
                 <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.DefaultRetentionDays}}" min="0" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="30" min="1" max="365" class="input">
-                <p class="text-xs text-gray-500 mt-1">How long to keep event data. Enter 0 to retain events forever.</p>
+                <p class="text-xs text-gray-500 mt-1">How long to keep event data.</p>
             </div>
 
             <div class="flex gap-3">