Allow retention_days of 0 to mean retain forever (closes #79 )

RetentionDays carried gorm:"default:30", so GORM substituted 30 for a zero value while building the insert. A webhook could therefore never be configured to keep its events indefinitely: the reaper's retain-forever branch existed but was unreachable from the normal create and edit flows. Introduce database.RetentionForeverDays = 365 * 1000 as the sentinel for "retain forever" and a Webhook.BeforeSave hook that rewrites any non-positive RetentionDays to it. The rewrite has to live in the hook rather than at the call sites: GORM applies the column default while converting the model to insert values, which happens after BeforeSave, so anything later loses that race. Putting it on the model also means a future call site, such as the planned REST API, cannot bypass it. The reaper now skips a webhook when Webhook.RetainsForever reports true, which recognises the sentinel and keeps honouring the old <= 0 values for rows written before it existed. Without this the sentinel, being positive, would have produced a cutoff a thousand years in the past and a DELETE matching nothing on every sweep. Bound the finite retention range, which was previously unbounded on the server. The reaper computes its cutoff as a time.Duration, an int64 nanosecond count, so a day count above 106751 overflows, wraps the span negative, and moves the cutoff into the far future — where it matches every row and the sweep deletes every event, delivery, and delivery result the webhook has, including ones created seconds ago. Nothing rejected such a value: parseRetention accepted any v > 0, and max="365" was a client-side attribute a direct POST ignored, so the wipe was already reachable on main and removing that attribute would have made it reachable by ordinary use. The bound is database.MaxFiniteRetentionDays, derived from the arithmetic itself as math.MaxInt64 / time.Hour / hoursPerDay rather than picked as a round number, and a finite value above it is now a 400 that names the ceiling. retentionCutoff additionally clamps the day count it is given and reports whether any cutoff applies at all, so a row written by an older version, a migration, or a future call site cannot reach the overflow either. A value at or above the retain-forever sentinel stays accepted, because that is what the edit form pre-fills for a retain-forever webhook. Form handling is shared by create and edit through parseRetentionDays so the two cannot drift: an empty field keeps the previous behaviour (default on create, unchanged on edit), 0 is honoured, and an unparseable, negative, or out-of-range value is a 400 that re-renders the form rather than a silently substituted default. The two rejection reasons are distinct sentinel errors so the message can name the ceiling, and the create form now carries the submitted name and description back into the re-rendered inputs, which the edit form already did. The retention inputs drop max="365". That cap was not cosmetic: the edit form pre-fills the stored value, so a retain-forever webhook rendered 365000 into an input capped at 365 and browser validation would have blocked saving any edit to it. min becomes 0 with a hint explaining what 0 does, and the list and detail views render a RetentionLabel of "forever" instead of a raw day count. All three Webhook methods take pointer receivers, so there is no receiver mix and no lint suppression: BeforeSave must take a pointer to mutate the record, and the handlers hand templates a *Webhook because html/template cannot call a pointer method on a value held in a map. The 30-day default is consolidated into database.DefaultRetentionDays, referenced from the handler and from the create form's pre-filled value, with a test asserting it agrees with the struct tag that cannot reference it.
2026-08-09 02:57:28 +00:00
21 changed files with 1308 additions and 721 deletions
--- a/README.md
+++ b/README.md
@@ -307,13 +307,29 @@ event routing.
 | `user_id`        | UUID    | Foreign key → User |
 | `name`           | string  | Human-readable name |
 | `description`    | string  | Optional description |
-| `retention_days` | integer | Days to retain events (default: 30) |
+| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |

 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.

 The `retention_days` field controls how long event data is kept in the
 webhook's dedicated database before automatic cleanup.

+Setting `retention_days` to `0` means "retain events forever". Because
+the column carries a default of 30, a literal zero cannot survive an
+insert, so a zero is rewritten on save to a sentinel of `365 * 1000`
+days (`database.RetentionForeverDays`). The retention reaper recognises
+that sentinel and skips the webhook entirely, and the web UI displays
+such a webhook's retention as "forever" rather than as a day count.
+
+A *finite* retention is capped at `database.MaxFiniteRetentionDays`
+(106751 days, about 292 years), and a larger one is rejected with a
+400. The cap is not arbitrary: the reaper computes its cutoff as a
+`time.Duration`, an int64 nanosecond count, and a longer period
+overflows it. An overflowed cutoff lands in the future, where it
+matches every row, so the sweep would delete every event the webhook
+has instead of none. The reaper also clamps the value it is given, so a
+row written by an older version cannot trigger that either.
+
 #### Entrypoint

 A receiver URL where external services POST webhook events. Each
@@ -509,7 +525,7 @@ This separation provides:
  DB; the event database file is hard-deleted (permanently removed).
 - **Per-webhook retention** — the `retention_days` field on each webhook
  controls automatic cleanup of old events in that webhook's database
-  only.
+  only, or disables cleanup entirely when set to `0` (retain forever).
 - **Performance** — each webhook's database has its own WAL, its own
  page cache, and its own lock, so concurrent event ingestion across
  webhooks won't contend.
@@ -867,17 +883,9 @@ Applied to all routes in this order:
 8. **Sentry** — Error reporting to Sentry (if `SENTRY_DSN` is set;
   configured with `Repanic: true` so panics still reach Recoverer)

-Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
-`/source/*`) apply a **MaxBodySize** middleware that limits
-POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the
-CSRF middleware in every one of those route groups, because
-gorilla/csrf parses the form; if the cap were installed after it, form
-parsing would run under net/http's 10 MB default and the 1 MB limit
-would never apply. A request that declares a `Content-Length` over the
-limit is answered with `413 Request Entity Too Large` before any other
-middleware or handler runs; a chunked request, or one that lies about
-its length, is hard-capped by `http.MaxBytesReader` and fails
-downstream at form-parse time.
+Additionally, form endpoints (`/pages`, `/sources`, `/source/*`) apply a
+**MaxBodySize** middleware that limits POST/PUT/PATCH request bodies to
+1 MB using `http.MaxBytesReader`, preventing oversized form submissions.

 ### Authentication

@@ -899,8 +907,7 @@ downstream at form-parse time.
 - Production security headers on all responses: HSTS, X-Content-Type-Options
  (`nosniff`), X-Frame-Options (`DENY`), Content-Security-Policy, Referrer-Policy,
  and Permissions-Policy
- Request body size limits (1 MB) on all form POST endpoints, enforced
-  by middleware that runs before CSRF parses the form
+- Request body size limits (1 MB) on all form POST endpoints
 - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf)
  on all state-changing forms (cookie-based double-submit tokens with
  HMAC authentication). Applied to `/pages`, `/sources`, `/source`, and
--- a/TODO.md
+++ b/TODO.md
@@ -28,13 +28,17 @@ databases currently grow without bound.

 # Completed Steps

- 2026-08-09 Enforce the request body size limit before the CSRF
-  middleware parses the form (#90): `MaxBodySize` is now registered
-  ahead of `CSRF()` in every form route group, the `/user/{username}`
-  group gained the cap it never had (which is where `POST /password`
-  lives), the middleware rejects a declared-oversize body with a real
-  413 up front, and the redundant handler-local
-  `http.MaxBytesReader` calls were removed
+- 2026-08-09 Make retain-forever reachable from the normal create and
+  edit flows (#79): a `RetentionForeverDays = 365 * 1000` sentinel, a
+  `Webhook.BeforeSave` hook rewriting any non-positive `retention_days`
+  to it ahead of GORM's own column defaulting, a reaper that skips such
+  webhooks outright, form validation that honours `0` and rejects
+  garbage with a 400, and a retention UI that says "forever". Also
+  closes the overflow the same code path exposed: a finite
+  `retention_days` above `MaxFiniteRetentionDays` (106751, derived from
+  what an int64 `time.Duration` can hold) wrapped the reaper's cutoff
+  into the future and deleted every event, so it is now rejected at the
+  form and clamped in the reaper
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
--- a/internal/database/database_test.go
+++ b/internal/database/database_test.go
@@ -18,6 +18,11 @@ const (
 	testVersion = "test"
 	// testContentType is the event content type used in tests.
 	testContentType = "application/json"
+	// testWebhookName is the Webhook.Name used in tests.
+	testWebhookName = "test-webhook"
+	// testForeverLabel is Webhook.RetentionLabel for a retain-forever
+	// webhook.
+	testForeverLabel = "forever"
 )

 func setupTestDB(
--- a/internal/database/model_webhook.go
+++ b/internal/database/model_webhook.go
@@ -1,6 +1,59 @@
 package database

+import (
+	"math"
+	"strconv"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	// DefaultRetentionDays is the event retention period applied to a
+	// webhook created without an explicit retention value. It is the
+	// single source of truth for that policy and must stay in sync
+	// with the `gorm:"default:30"` column default on
+	// Webhook.RetentionDays below; a struct tag cannot reference a
+	// constant, so a test asserts the two agree.
+	DefaultRetentionDays = 30
+
+	// RetentionForeverDays is the sentinel RetentionDays value meaning
+	// "retain events forever". Users express that intent as 0, which
+	// Webhook.BeforeSave rewrites to this value: the column default
+	// substitutes DefaultRetentionDays for a zero value at insert
+	// time, so a zero can never survive a round trip to the database.
+	// Nothing outside this file may hardcode the number.
+	RetentionForeverDays = 365 * 1000
+
+	// MaxFiniteRetentionDays is the largest finite retention period the
+	// reaper's cutoff arithmetic can represent, and therefore the
+	// largest one a caller may request. It is derived from that
+	// arithmetic rather than picked: retentionCutoff computes
+	// retentionDays * hoursPerDay * time.Hour, and a time.Duration is
+	// an int64 nanosecond count, so math.MaxInt64 nanoseconds divided
+	// by an hour and then by a day is the exact ceiling — 106751 days,
+	// a little over 292 years.
+	//
+	// One day more overflows int64, wraps the product negative, and
+	// turns the cutoff into a timestamp in the far future that matches
+	// every row in the webhook's database. That is why this bound is
+	// enforced on input and why retentionCutoff saturates underneath
+	// it. Note that RetentionForeverDays deliberately sits above this
+	// ceiling: such webhooks are skipped before any cutoff is
+	// computed, and never reach the arithmetic at all.
+	MaxFiniteRetentionDays = int(
+		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
+	)
+)
+
 // Webhook represents a webhook processing unit that groups entrypoints and targets
+//
+// Every method below takes a pointer receiver. BeforeSave has to,
+// because it mutates the record and GORM only invokes hooks declared
+// that way; the display helpers follow suit so the receiver kinds do
+// not mix. Handlers therefore put a *Webhook into template data:
+// html/template cannot call a pointer method on a value held in a map,
+// because a map element is not addressable.
 type Webhook struct {
 	BaseModel

@@ -8,7 +61,9 @@ type Webhook struct {
 	Name        string `gorm:"not null"           json:"name"`
 	Description string `json:"description"`

-	// RetentionDays is the number of days to retain events.
+	// RetentionDays is the number of days to retain events. A value of
+	// RetentionForeverDays means retain forever. The column default
+	// must equal DefaultRetentionDays.
 	RetentionDays int `gorm:"default:30" json:"retentionDays"`

 	// Relations
@@ -16,3 +71,55 @@ type Webhook struct {
 	Entrypoints []Entrypoint `json:"entrypoints,omitempty"`
 	Targets     []Target     `json:"targets,omitempty"`
 }
+
+// BeforeSave normalises RetentionDays on every insert and update. A
+// non-positive value is the user's way of asking for "retain forever",
+// which is stored as the RetentionForeverDays sentinel.
+//
+// This has to happen in a hook rather than at the call sites. GORM
+// substitutes the column default (DefaultRetentionDays) for a zero
+// value while building the insert statement, which runs after
+// BeforeSave; rewriting any later than this loses that race and the
+// row lands at 30 days. Living on the model also means a future call
+// site — a REST API, a fixture, a migration — cannot bypass it.
+func (w *Webhook) BeforeSave(_ *gorm.DB) error {
+	if w.RetentionDays <= 0 {
+		w.RetentionDays = RetentionForeverDays
+	}
+
+	return nil
+}
+
+// retainsForever reports whether a stored RetentionDays value means
+// "keep events indefinitely". It is the single definition of that
+// question, shared by Webhook.RetainsForever and by the reaper's
+// cutoff computation so the two cannot disagree about which webhooks
+// are exempt from reaping.
+//
+// It accepts the RetentionForeverDays sentinel written by BeforeSave
+// and, defensively, the non-positive values that rows written before
+// the sentinel existed may still carry.
+func retainsForever(retentionDays int) bool {
+	return retentionDays <= 0 ||
+		retentionDays >= RetentionForeverDays
+}
+
+// RetainsForever reports whether this webhook's events are kept
+// indefinitely.
+func (w *Webhook) RetainsForever() bool {
+	return retainsForever(w.RetentionDays)
+}
+
+// RetentionLabel returns the webhook's retention policy as display
+// text, so that no template has to know about the sentinel value.
+func (w *Webhook) RetentionLabel() string {
+	if w.RetainsForever() {
+		return "forever"
+	}
+
+	if w.RetentionDays == 1 {
+		return "1 day"
+	}
+
+	return strconv.Itoa(w.RetentionDays) + " days"
+}
--- a/internal/database/model_webhook_test.go
+++ b/internal/database/model_webhook_test.go
@@ -0,0 +1,222 @@
+package database_test
+
+import (
+	"context"
+	"reflect"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// startedTestDB returns a started main database for model-level tests.
+func startedTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
+
+	db, lc := setupTestDB(t)
+
+	ctx := context.Background()
+	require.NoError(t, lc.Start(ctx))
+	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
+
+	return db.DB()
+}
+
+// storedRetention reads the retention_days column straight out of the
+// row, so the assertion is about what was persisted rather than about
+// whatever the in-memory struct happens to hold.
+func storedRetention(t *testing.T, db *gorm.DB, id string) int {
+	t.Helper()
+
+	var got int
+
+	require.NoError(
+		t,
+		db.Model(&database.Webhook{}).
+			Where("id = ?", id).
+			Pluck("retention_days", &got).Error,
+	)
+
+	return got
+}
+
+// newWebhookWithRetention creates a webhook through the ordinary Create
+// path, so the BeforeSave hook and the GORM column default both apply
+// exactly as they do in production.
+func newWebhookWithRetention(
+	t *testing.T,
+	db *gorm.DB,
+	wh *database.Webhook,
+) string {
+	t.Helper()
+
+	wh.UserID = uuid.New().String()
+	wh.Name = testWebhookName
+
+	require.NoError(
+		t,
+		db.Omit(clause.Associations).Create(wh).Error,
+	)
+
+	return wh.ID
+}
+
+func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	wh := &database.Webhook{RetentionDays: 0}
+	id := newWebhookWithRetention(t, db, wh)
+
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetention(t, db, id),
+		"a zero retention must be stored as the sentinel, "+
+			"not replaced by the column default",
+	)
+}
+
+func TestWebhookBeforeSave_NegativeBecomesForeverSentinel(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	wh := &database.Webhook{RetentionDays: -5}
+	id := newWebhookWithRetention(t, db, wh)
+
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetention(t, db, id),
+	)
+}
+
+func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	wh := &database.Webhook{RetentionDays: 7}
+	id := newWebhookWithRetention(t, db, wh)
+
+	assert.Equal(t, 7, storedRetention(t, db, id))
+}
+
+// TestWebhookBeforeSave_UpdateToZeroBecomesSentinel proves the hook
+// fires on update as well as insert, via the same Save call the edit
+// handler makes.
+func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	wh := &database.Webhook{RetentionDays: 30}
+	id := newWebhookWithRetention(t, db, wh)
+	require.Equal(t, 30, storedRetention(t, db, id))
+
+	wh.RetentionDays = 0
+	require.NoError(t, db.Omit(clause.Associations).Save(wh).Error)
+
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetention(t, db, id),
+	)
+}
+
+// TestWebhookRetentionColumnDefaultMatchesConstant guards the one place
+// the default lives twice: a struct tag cannot reference a constant, so
+// this asserts the tag and DefaultRetentionDays agree.
+func TestWebhookRetentionColumnDefaultMatchesConstant(t *testing.T) {
+	t.Parallel()
+
+	field, ok := reflect.TypeFor[database.Webhook]().
+		FieldByName("RetentionDays")
+	require.True(t, ok, "Webhook.RetentionDays must exist")
+
+	assert.Equal(
+		t,
+		"default:"+strconv.Itoa(database.DefaultRetentionDays),
+		field.Tag.Get("gorm"),
+	)
+}
+
+// TestMaxFiniteRetentionDaysIsTheOverflowCeiling asserts that the
+// constant is exactly where the cutoff arithmetic stops working, which
+// is what makes it a derived bound rather than a round number someone
+// liked. One day more wraps the int64 nanosecond count negative, and a
+// negative span is precisely what turned a cutoff into a future
+// timestamp that matched — and deleted — every row.
+//
+// The multiplications are done through variables on purpose: as
+// constant expressions the overflowing one would not compile.
+func TestMaxFiniteRetentionDaysIsTheOverflowCeiling(t *testing.T) {
+	t.Parallel()
+
+	const hoursPerDay = 24
+
+	atCeiling := database.MaxFiniteRetentionDays
+	overCeiling := database.MaxFiniteRetentionDays + 1
+
+	assert.Positive(
+		t,
+		time.Duration(atCeiling*hoursPerDay)*time.Hour,
+		"the ceiling itself must still be representable",
+	)
+	assert.Negative(
+		t,
+		time.Duration(overCeiling*hoursPerDay)*time.Hour,
+		"one day past the ceiling must overflow",
+	)
+
+	assert.Less(
+		t,
+		database.MaxFiniteRetentionDays,
+		database.RetentionForeverDays,
+		"the sentinel sits above the ceiling and is only safe "+
+			"because retain-forever webhooks skip the arithmetic",
+	)
+}
+
+func TestWebhookRetainsForeverAndLabel(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name    string
+		days    int
+		forever bool
+		label   string
+	}{
+		{
+			"sentinel",
+			database.RetentionForeverDays, true, testForeverLabel,
+		},
+		{
+			"above sentinel",
+			database.RetentionForeverDays + 1, true, testForeverLabel,
+		},
+		{"legacy zero", 0, true, testForeverLabel},
+		{"legacy negative", -1, true, testForeverLabel},
+		{"default", database.DefaultRetentionDays, false, "30 days"},
+		{"one day", 1, false, "1 day"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			wh := database.Webhook{RetentionDays: tc.days}
+
+			assert.Equal(t, tc.forever, wh.RetainsForever())
+			assert.Equal(t, tc.label, wh.RetentionLabel())
+		})
+	}
+}
--- a/internal/database/retention.go
+++ b/internal/database/retention.go
@@ -114,7 +114,8 @@ func (r *RetentionReaper) run(ctx context.Context) {
 }

 // sweep lists every webhook from the main database and reaps expired
-// rows from each per-webhook database whose RetentionDays is positive.
+// rows from each per-webhook database that has a finite retention
+// policy. Webhooks set to retain forever are skipped entirely.
 func (r *RetentionReaper) sweep(ctx context.Context) {
 	var webhooks []Webhook

@@ -139,8 +140,13 @@ func (r *RetentionReaper) sweep(ctx context.Context) {

 		wh := webhooks[i]

-		// RetentionDays of zero or less means retain forever.
-		if wh.RetentionDays <= 0 {
+		// Skip retain-forever webhooks before building any query.
+		// RetainsForever covers both the RetentionForeverDays
+		// sentinel and the non-positive values that predate it: the
+		// sentinel is a positive number, so without this the reaper
+		// would compute a cutoff a thousand years in the past and
+		// issue a DELETE matching nothing on every single sweep.
+		if wh.RetainsForever() {
 			continue
 		}

@@ -171,9 +177,10 @@ func (r *RetentionReaper) reapWebhook(
 		return
 	}

-	cutoff := time.Now().Add(
-		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-	)
+	cutoff, ok := retentionCutoff(time.Now(), retentionDays)
+	if !ok {
+		return
+	}

 	deleted, err := reapExpired(db, cutoff)
 	if err != nil {
@@ -196,6 +203,37 @@ func (r *RetentionReaper) reapWebhook(
 	}
 }

+// retentionCutoff returns the timestamp before which a webhook's
+// events have expired, and whether any cutoff applies at all. It
+// reports false for a retain-forever policy, so no DELETE is issued.
+//
+// The day count is clamped to MaxFiniteRetentionDays first. This is
+// defense in depth rather than decoration: a time.Duration is an int64
+// nanosecond count, so an unclamped multiplication overflows above
+// that ceiling and wraps the span negative. Subtracting a negative
+// span moves the cutoff into the far future, where it matches every
+// row in the database: the sweep then deletes every event, delivery,
+// and delivery result, including ones created seconds ago. Rejecting
+// out-of-range input at the form is the primary guard; saturating here
+// means an old row, a migration, or a future call site cannot turn a
+// too-large retention into total data loss.
+func retentionCutoff(
+	now time.Time,
+	retentionDays int,
+) (time.Time, bool) {
+	if retainsForever(retentionDays) {
+		return time.Time{}, false
+	}
+
+	if retentionDays > MaxFiniteRetentionDays {
+		retentionDays = MaxFiniteRetentionDays
+	}
+
+	return now.Add(
+		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
+	), true
+}
+
 // reapExpired hard-deletes, in foreign-key-safe order, the delivery
 // results, deliveries, and events associated with events older than
 // cutoff. Deletes are unscoped so rows are physically removed rather
--- a/internal/database/retention_test.go
+++ b/internal/database/retention_test.go
@@ -77,7 +77,7 @@ func createWebhook(

 	wh := &database.Webhook{
 		UserID:        uuid.New().String(),
-		Name:          "test-webhook",
+		Name:          testWebhookName,
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
@@ -85,10 +85,11 @@ func createWebhook(
 		db.Omit(clause.Associations).Create(wh).Error,
 	)

-	// The RetentionDays column carries a GORM default of 30, so a
-	// zero (or negative) value passed to Create is replaced by that
-	// default. Force the requested value explicitly so the
-	// retain-forever (<= 0) path can be exercised.
+	// Webhook.BeforeSave rewrites a non-positive RetentionDays to the
+	// retain-forever sentinel, and the column's GORM default would
+	// otherwise substitute 30. Force the requested value with a
+	// column-level update so tests can plant legacy rows that predate
+	// the sentinel and still carry a literal 0 or negative value.
 	require.NoError(
 		t,
 		db.Model(wh).
@@ -98,6 +99,30 @@ func createWebhook(
 	return wh.ID
 }

+// createWebhookNormally inserts a webhook through the ordinary Create
+// path, with no column-level forcing, so Webhook.BeforeSave applies
+// exactly as it does in production. Passing 0 therefore yields a row
+// holding the RetentionForeverDays sentinel.
+func createWebhookNormally(
+	t *testing.T,
+	db *gorm.DB,
+	retentionDays int,
+) string {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID:        uuid.New().String(),
+		Name:          testWebhookName,
+		RetentionDays: retentionDays,
+	}
+	require.NoError(
+		t,
+		db.Omit(clause.Associations).Create(wh).Error,
+	)
+
+	return wh.ID
+}
+
 // eventChain is the set of row IDs seeded for a single event.
 type eventChain struct {
 	eventID    string
@@ -256,12 +281,111 @@ func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
 	assertChainPresent(t, db, recent)
 }

+// TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep covers the
+// end-to-end retain-forever path: a webhook created the normal way with
+// a requested retention of 0 lands on the RetentionForeverDays
+// sentinel, and the reaper leaves its ancient events alone while still
+// reaping a finite-retention webhook in the very same sweep.
+func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	foreverID := createWebhookNormally(t, env.mainDB.DB(), 0)
+
+	var stored database.Webhook
+
+	require.NoError(
+		t,
+		env.mainDB.DB().Where("id = ?", foreverID).
+			First(&stored).Error,
+	)
+	require.Equal(
+		t,
+		database.RetentionForeverDays,
+		stored.RetentionDays,
+		"a requested retention of 0 must persist as the sentinel",
+	)
+
+	finiteID := createWebhookNormally(t, env.mainDB.DB(), 30)
+
+	foreverDB, err := env.mgr.GetDB(foreverID)
+	require.NoError(t, err)
+
+	finiteDB, err := env.mgr.GetDB(finiteID)
+	require.NoError(t, err)
+
+	ancient := time.Now().Add(-365 * 24 * time.Hour)
+	kept := seedEventChain(t, foreverDB, foreverID, ancient)
+	doomed := seedEventChain(t, finiteDB, finiteID, ancient)
+
+	env.reaper.ExportSweep(context.Background())
+
+	assertChainPresent(t, foreverDB, kept)
+	assertChainGone(t, finiteDB, doomed)
+}
+
+// TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents pins the
+// overflow that made a large finite retention destroy everything.
+//
+// The cutoff is a time.Duration, an int64 nanosecond count. A day
+// count above MaxFiniteRetentionDays multiplied out unclamped wraps
+// negative, so subtracting it moves the cutoff into the far future,
+// where "created_at < cutoff" matches every row: an event created a
+// moment ago, and its delivery and delivery result, were all deleted
+// on the first sweep. 200000 is inside that band and below the
+// retain-forever sentinel, so it is treated as a finite policy and
+// really does reach the arithmetic.
+//
+// The row is planted at the column level because such a value can no
+// longer be submitted through the form; the point of the test is that
+// a row from an older version, or a future call site, still cannot
+// trigger the wipe.
+func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupRetentionTest(t)
+
+	const overflowingRetentionDays = 200000
+
+	require.Greater(
+		t,
+		overflowingRetentionDays,
+		database.MaxFiniteRetentionDays,
+		"the test value must exceed what the cutoff can represent",
+	)
+	require.Less(
+		t,
+		overflowingRetentionDays,
+		database.RetentionForeverDays,
+		"the test value must not be rescued by the forever skip",
+	)
+
+	webhookID := createWebhook(
+		t, env.mainDB.DB(), overflowingRetentionDays,
+	)
+
+	db, err := env.mgr.GetDB(webhookID)
+	require.NoError(t, err)
+
+	fresh := seedEventChain(t, db, webhookID, time.Now())
+
+	env.reaper.ExportSweep(context.Background())
+
+	assertChainPresent(t, db, fresh)
+}
+
 func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
 	t.Parallel()

 	env := setupRetentionTest(t)

-	// RetentionDays of zero means retain forever.
+	// A legacy row written before the sentinel existed still carries a
+	// literal 0; the <= 0 guard must keep honouring it.
 	webhookID := createWebhook(t, env.mainDB.DB(), 0)

 	db, err := env.mgr.GetDB(webhookID)
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -29,8 +29,10 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 // HandleLoginSubmit handles the login form submission (POST)
 func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		// Limit request body to prevent memory exhaustion
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<maxBodyShift)
+
+		// Parse form data
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -26,8 +26,6 @@ const (
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
 	recentEventLimit = 20
-	// defaultRetentionDays is the default event retention period.
-	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25

--- a/internal/handlers/profile.go
+++ b/internal/handlers/profile.go
@@ -31,8 +31,9 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
 			return
 		}

-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		// Limit request body to prevent memory exhaustion.
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<maxBodyShift)
+
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
--- a/internal/handlers/source_management.go
+++ b/internal/handlers/source_management.go
@@ -25,6 +25,73 @@ type WebhookListItem struct {
 // errMissingURL signals that a required URL was not provided.
 var errMissingURL = errors.New("missing URL")

+// errInvalidRetention signals a retention_days form value that is not
+// a non-negative whole number.
+var errInvalidRetention = errors.New("invalid retention days")
+
+// errRetentionTooLarge signals a retention_days form value that is a
+// whole number but larger than the reaper's cutoff arithmetic can
+// represent. It is distinguished from errInvalidRetention so the form
+// can tell the user the actual ceiling instead of implying their input
+// was not a number.
+var errRetentionTooLarge = errors.New("retention days out of range")
+
+// retentionErrorMessage returns the message the create and edit forms
+// show the user for a rejected retention_days value. Any error other
+// than errRetentionTooLarge falls back to the generic wording, so an
+// unrecognised parse failure still produces a sensible 400 rather than
+// an empty alert.
+func retentionErrorMessage(err error) string {
+	if errors.Is(err, errRetentionTooLarge) {
+		return "Retention must be at most " +
+			strconv.Itoa(database.MaxFiniteRetentionDays) +
+			" days, or 0 to retain events forever."
+	}
+
+	return "Retention must be a whole number of days, or 0 to " +
+		"retain events forever."
+}
+
+// parseRetentionDays interprets a retention_days form value.
+//
+// An empty value yields fallback, which lets the create path apply the
+// default and the edit path leave the stored value unchanged. A value
+// of 0 is returned as 0 and is rewritten to the retain-forever
+// sentinel by database.Webhook's BeforeSave hook. Anything unparseable
+// or negative is an error rather than a silently substituted default.
+//
+// The upper bound is not cosmetic. The reaper computes its cutoff as a
+// time.Duration, an int64 nanosecond count, so a day count above
+// database.MaxFiniteRetentionDays overflows, puts the cutoff in the
+// future, and deletes every event the webhook has. A finite value
+// above that ceiling is therefore a 400.
+//
+// A value at or above the retain-forever sentinel is not out of range:
+// it is what the edit form pre-fills for a retain-forever webhook, so
+// submitting the form back unchanged has to keep meaning "forever"
+// rather than being rejected.
+func parseRetentionDays(raw string, fallback int) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return fallback, nil
+	}
+
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 0 {
+		return 0, errInvalidRetention
+	}
+
+	if v >= database.RetentionForeverDays {
+		return database.RetentionForeverDays, nil
+	}
+
+	if v > database.MaxFiniteRetentionDays {
+		return 0, errRetentionTooLarge
+	}
+
+	return v, nil
+}
+
 // EventWithDeliveries holds an event and its deliveries.
 type EventWithDeliveries struct {
 	database.Event
@@ -106,11 +173,30 @@ func (h *Handlers) buildWebhookListItems(
 // HandleSourceCreate shows the form to create a new webhook.
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		data := map[string]any{
-			tmplKeyError: "",
-		}
+		h.renderTemplate(
+			w, r, "sources_new.html",
+			newSourceFormData("", "", ""),
+		)
+	}
+}

-		h.renderTemplate(w, r, "sources_new.html", data)
+// newSourceFormData builds the template data for the webhook creation
+// form.
+//
+// It carries the retention default so the pre-filled value comes from
+// database.DefaultRetentionDays rather than being a third hardcoded
+// copy of the same policy, and it carries the submitted name and
+// description so that re-rendering the form after a validation failure
+// gives the user their input back instead of a blank form. The edit
+// form already behaves that way; create now matches it.
+func newSourceFormData(
+	errMsg, name, description string,
+) map[string]any {
+	return map[string]any{
+		tmplKeyError:           errMsg,
+		"Name":                 name,
+		"Description":          description,
+		"DefaultRetentionDays": database.DefaultRetentionDays,
 	}
 }

@@ -127,8 +213,10 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 			return
 		}

-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		r.Body = http.MaxBytesReader(
+			w, r.Body, 1<<maxBodyShift,
+		)
+
 		err := r.ParseForm()
 		if err != nil {
 			http.Error(
@@ -143,23 +231,31 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		retentionStr := r.FormValue("retention_days")

 		if name == "" {
-			data := map[string]any{
-				tmplKeyError: "Name is required",
-			}
-
 			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(w, r, "sources_new.html", data)
+			h.renderTemplate(
+				w, r, "sources_new.html",
+				newSourceFormData(
+					"Name is required", name, description,
+				),
+			)

 			return
 		}

-		retentionDays := defaultRetentionDays
+		retentionDays, retErr := parseRetentionDays(
+			retentionStr, database.DefaultRetentionDays,
+		)
+		if retErr != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			h.renderTemplate(
+				w, r, "sources_new.html",
+				newSourceFormData(
+					retentionErrorMessage(retErr),
+					name, description,
+				),
+			)

-		if retentionStr != "" {
-			v, convErr := strconv.Atoi(retentionStr)
-			if convErr == nil && v > 0 {
-				retentionDays = v
-			}
+			return
 		}

 		h.createWebhookWithEntrypoint(
@@ -313,8 +409,10 @@ func (h *Handlers) renderSourceDetail(
 		scheme = fwdProto
 	}

+	// The template calls Webhook methods, which take pointer
+	// receivers; html/template cannot address a value stored in a map.
 	data := map[string]any{
-		tmplKeyWebhook: webhook,
+		tmplKeyWebhook: &webhook,
 		"Entrypoints":  entrypoints,
 		"Targets":      targets,
 		"Events":       events,
@@ -350,7 +448,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}

 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			tmplKeyWebhook: &webhook,
 			tmplKeyError:   "",
 		}

@@ -384,8 +482,10 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 			return
 		}

-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		r.Body = http.MaxBytesReader(
+			w, r.Body, 1<<maxBodyShift,
+		)
+
 		err = r.ParseForm()
 		if err != nil {
 			http.Error(
@@ -405,12 +505,14 @@ func (h *Handlers) applyWebhookEdit(
 	r *http.Request,
 	webhook *database.Webhook,
 ) {
-	// The body size cap is enforced by the MaxBodySize middleware,
-	// which runs before CSRF parses the form.
+	r.Body = http.MaxBytesReader(
+		w, r.Body, 1<<maxBodyShift,
+	)
+
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			tmplKeyWebhook: *webhook,
+			tmplKeyWebhook: webhook,
 			tmplKeyError:   "Name is required",
 		}

@@ -422,7 +524,25 @@ func (h *Handlers) applyWebhookEdit(

 	webhook.Name = name
 	webhook.Description = r.FormValue("description")
-	h.parseRetention(r, webhook)
+
+	// An empty field falls back to the stored value, so submitting the
+	// form without touching retention leaves the policy alone.
+	retentionDays, retErr := parseRetentionDays(
+		r.FormValue("retention_days"), webhook.RetentionDays,
+	)
+	if retErr != nil {
+		data := map[string]any{
+			tmplKeyWebhook: webhook,
+			tmplKeyError:   retentionErrorMessage(retErr),
+		}
+
+		w.WriteHeader(http.StatusBadRequest)
+		h.renderTemplate(w, r, "source_edit.html", data)
+
+		return
+	}
+
+	webhook.RetentionDays = retentionDays

 	err := h.db.DB().Save(webhook).Error
 	if err != nil {
@@ -436,23 +556,6 @@ func (h *Handlers) applyWebhookEdit(
 	)
 }

-// parseRetention parses and applies retention_days from the
-// form.
-func (h *Handlers) parseRetention(
-	r *http.Request,
-	webhook *database.Webhook,
-) {
-	retStr := r.FormValue("retention_days")
-	if retStr == "" {
-		return
-	}
-
-	v, err := strconv.Atoi(retStr)
-	if err == nil && v > 0 {
-		webhook.RetentionDays = v
-	}
-}
-
 // HandleSourceDelete handles webhook deletion.
 func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -584,7 +687,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}

 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			tmplKeyWebhook: &webhook,
 			"Events":       evts,
 			"Page":         page,
 			"TotalPages":   totalPages,
@@ -719,8 +822,10 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 			return
 		}

-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		r.Body = http.MaxBytesReader(
+			w, r.Body, 1<<maxBodyShift,
+		)
+
 		err = r.ParseForm()
 		if err != nil {
 			http.Error(
@@ -777,8 +882,10 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
 			return
 		}

-		// The body size cap is enforced by the MaxBodySize
-		// middleware, which runs before CSRF parses the form.
+		r.Body = http.MaxBytesReader(
+			w, r.Body, 1<<maxBodyShift,
+		)
+
 		err = r.ParseForm()
 		if err != nil {
 			http.Error(
@@ -798,8 +905,10 @@ func (h *Handlers) processTargetCreate(
 	r *http.Request,
 	webhook database.Webhook,
 ) {
-	// The body size cap is enforced by the MaxBodySize middleware,
-	// which runs before CSRF parses the form.
+	r.Body = http.MaxBytesReader(
+		w, r.Body, 1<<maxBodyShift,
+	)
+
 	name := r.FormValue("name")
 	targetType := database.TargetType(r.FormValue("type"))
 	targetURL := r.FormValue("url")
--- a/internal/handlers/source_management_test.go
+++ b/internal/handlers/source_management_test.go
@@ -0,0 +1,581 @@
+package handlers_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+const (
+	// sourceTestUserID is the session user id used by the webhook
+	// management tests.
+	sourceTestUserID = "source-test-user"
+	// sourceIDParam is the chi URL parameter naming a webhook.
+	sourceIDParam = "sourceID"
+)
+
+// formRequest builds an urlencoded POST to path carrying the given
+// cookies, plus any chi URL parameters the handler reads.
+func formRequest(
+	path string,
+	cookies []*http.Cookie,
+	form url.Values,
+	urlParams map[string]string,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost,
+		path,
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	for k, v := range urlParams {
+		rctx.URLParams.Add(k, v)
+	}
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+// getRequest builds a GET to path carrying the given cookies, plus any
+// chi URL parameters the handler reads.
+func getRequest(
+	t *testing.T,
+	path string,
+	cookies []*http.Cookie,
+	urlParams map[string]string,
+) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, path, nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	for k, v := range urlParams {
+		rctx.URLParams.Add(k, v)
+	}
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+// submitCreate posts the webhook creation form with the given
+// retention_days value (omitted entirely when retention is nil) and
+// returns the recorder.
+func submitCreate(
+	t *testing.T,
+	h *handlers.Handlers,
+	cookies []*http.Cookie,
+	name string,
+	retention *string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+
+	form := url.Values{}
+	form.Set("name", name)
+
+	if retention != nil {
+		form.Set("retention_days", *retention)
+	}
+
+	req := formRequest("/sources/new", cookies, form, nil)
+	w := httptest.NewRecorder()
+
+	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
+
+	return w
+}
+
+// onlyWebhook loads the single webhook belonging to the test user.
+func onlyWebhook(
+	t *testing.T,
+	db *database.Database,
+) database.Webhook {
+	t.Helper()
+
+	var webhooks []database.Webhook
+
+	require.NoError(
+		t,
+		db.DB().Where("user_id = ?", sourceTestUserID).
+			Find(&webhooks).Error,
+	)
+	require.Len(t, webhooks, 1)
+
+	return webhooks[0]
+}
+
+// seedWebhook inserts a webhook owned by the test user with an exact
+// stored retention value, bypassing Webhook.BeforeSave via a
+// column-level update so that legacy rows can be planted too.
+func seedWebhook(
+	t *testing.T,
+	db *database.Database,
+	retentionDays int,
+) database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID:        sourceTestUserID,
+		Name:          "seeded",
+		RetentionDays: retentionDays,
+	}
+	require.NoError(
+		t,
+		db.DB().Omit(clause.Associations).Create(wh).Error,
+	)
+	require.NoError(
+		t,
+		db.DB().Model(wh).
+			Update("retention_days", retentionDays).Error,
+	)
+
+	wh.RetentionDays = retentionDays
+
+	return *wh
+}
+
+// storedRetentionDays reads the retention_days column for a webhook.
+func storedRetentionDays(
+	t *testing.T,
+	db *database.Database,
+	id string,
+) int {
+	t.Helper()
+
+	var got int
+
+	require.NoError(
+		t,
+		db.DB().Model(&database.Webhook{}).
+			Where("id = ?", id).
+			Pluck("retention_days", &got).Error,
+	)
+
+	return got
+}
+
+// sourceTestEnv bundles the handler, session, and database a webhook
+// management test drives.
+type sourceTestEnv struct {
+	handlers *handlers.Handlers
+	db       *database.Database
+	cookies  []*http.Cookie
+}
+
+func setupSourceTest(t *testing.T) *sourceTestEnv {
+	t.Helper()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	return &sourceTestEnv{
+		handlers: h,
+		db:       db,
+		cookies: authenticatedCookies(
+			t, sess, sourceTestUserID, "sourceuser",
+		),
+	}
+}
+
+// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
+// regression test for the bug: the create form's 0 must reach the
+// database as the retain-forever sentinel rather than being replaced by
+// the column's default of 30.
+func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	zero := "0"
+
+	w := submitCreate(t, env.handlers, env.cookies, "forever", &zero)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	wh := onlyWebhook(t, env.db)
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetentionDays(t, env.db, wh.ID),
+	)
+	assert.True(t, wh.RetainsForever())
+}
+
+func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	wh := onlyWebhook(t, env.db)
+	assert.Equal(
+		t,
+		database.DefaultRetentionDays,
+		storedRetentionDays(t, env.db, wh.ID),
+	)
+}
+
+// TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
+// form's pre-filled retention from becoming a third hardcoded copy of
+// the 30-day policy.
+func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	w := httptest.NewRecorder()
+	env.handlers.HandleSourceCreate().ServeHTTP(
+		w, getRequest(t, "/sources/new", env.cookies, nil),
+	)
+
+	require.Equal(t, http.StatusOK, w.Code)
+
+	body := w.Body.String()
+
+	assert.Contains(
+		t, body,
+		`value="`+strconv.Itoa(database.DefaultRetentionDays)+`"`,
+	)
+	assert.NotContains(
+		t, body, `max="365"`,
+		"a max below the sentinel would block retain-forever",
+	)
+	assert.Contains(t, body, `min="0"`)
+}
+
+func TestHandleSourceCreateSubmit_InvalidRetentionIsRejected(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	for _, raw := range []string{"abc", "-1", "3.5"} {
+		t.Run(raw, func(t *testing.T) {
+			t.Parallel()
+
+			env := setupSourceTest(t)
+
+			w := submitCreate(
+				t, env.handlers, env.cookies, "bad", &raw,
+			)
+
+			assert.Equal(t, http.StatusBadRequest, w.Code)
+			assert.Contains(
+				t, w.Body.String(), "Retention must be",
+			)
+
+			var count int64
+
+			require.NoError(
+				t,
+				env.db.DB().Model(&database.Webhook{}).
+					Where("user_id = ?", sourceTestUserID).
+					Count(&count).Error,
+			)
+			assert.Zero(
+				t, count,
+				"no webhook may be created from a rejected form",
+			)
+		})
+	}
+}
+
+// TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected covers
+// the data-loss path directly: a finite retention above the largest one
+// the reaper's cutoff arithmetic can represent must never reach the
+// database, because the sweep would compute a future cutoff and delete
+// every event the webhook has.
+func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	tooBig := strconv.Itoa(database.MaxFiniteRetentionDays + 1)
+
+	env := setupSourceTest(t)
+
+	w := submitCreate(t, env.handlers, env.cookies, "huge", &tooBig)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.Contains(
+		t, w.Body.String(),
+		strconv.Itoa(database.MaxFiniteRetentionDays),
+		"the form tells the user the actual ceiling",
+	)
+
+	var count int64
+
+	require.NoError(
+		t,
+		env.db.DB().Model(&database.Webhook{}).
+			Where("user_id = ?", sourceTestUserID).
+			Count(&count).Error,
+	)
+	assert.Zero(
+		t, count,
+		"no webhook may be created from a rejected form",
+	)
+}
+
+// TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
+// boundary between "too large to represent" and "retain forever": the
+// sentinel is above MaxFiniteRetentionDays, but it is the value the
+// edit form pre-fills, so it must be accepted rather than rejected as
+// out of range.
+func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	sentinel := strconv.Itoa(database.RetentionForeverDays)
+
+	w := submitCreate(t, env.handlers, env.cookies, "forever", &sentinel)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	wh := onlyWebhook(t, env.db)
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetentionDays(t, env.db, wh.ID),
+	)
+}
+
+// TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
+// validation failure hands the user's typing back, matching what the
+// edit form already does. Losing a long description to a mistyped
+// retention value is the kind of thing that makes people give up on a
+// form.
+func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	const (
+		name        = "kept-name"
+		description = "a description worth not losing"
+	)
+
+	form := url.Values{}
+	form.Set("name", name)
+	form.Set("description", description)
+	form.Set("retention_days", "nonsense")
+
+	req := formRequest("/sources/new", env.cookies, form, nil)
+	w := httptest.NewRecorder()
+
+	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusBadRequest, w.Code)
+
+	body := w.Body.String()
+
+	assert.Contains(t, body, `value="`+name+`"`)
+	assert.Contains(t, body, description)
+}
+
+// submitEdit posts the webhook edit form for the given webhook.
+func submitEdit(
+	t *testing.T,
+	env *sourceTestEnv,
+	wh database.Webhook,
+	retention string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+
+	form := url.Values{}
+	form.Set("name", wh.Name)
+	form.Set("description", wh.Description)
+	form.Set("retention_days", retention)
+
+	req := formRequest(
+		"/source/"+wh.ID+"/edit",
+		env.cookies,
+		form,
+		map[string]string{sourceIDParam: wh.ID},
+	)
+	w := httptest.NewRecorder()
+
+	env.handlers.HandleSourceEditSubmit().ServeHTTP(w, req)
+
+	return w
+}
+
+func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
+
+	w := submitEdit(t, env, wh, "0")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetentionDays(t, env.db, wh.ID),
+	)
+}
+
+func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
+
+	w := submitEdit(t, env, wh, "not-a-number")
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.Contains(t, w.Body.String(), "Retention must be")
+	assert.Equal(
+		t,
+		database.DefaultRetentionDays,
+		storedRetentionDays(t, env.db, wh.ID),
+		"a rejected form must not change the stored retention",
+	)
+}
+
+func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhook(t, env.db, 7)
+
+	w := submitEdit(t, env, wh, "")
+	require.Equal(t, http.StatusSeeOther, w.Code)
+
+	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
+}
+
+// TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
+// the removed max="365" cap used to break: render the edit form for a
+// retain-forever webhook, confirm the pre-filled sentinel is not capped
+// by browser validation, then submit that pre-filled value straight
+// back and confirm the retention policy survives untouched.
+func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
+
+	req := getRequest(
+		t, "/source/"+wh.ID+"/edit", env.cookies,
+		map[string]string{sourceIDParam: wh.ID},
+	)
+	w := httptest.NewRecorder()
+	env.handlers.HandleSourceEdit().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+
+	sentinel := strconv.Itoa(database.RetentionForeverDays)
+	body := w.Body.String()
+
+	assert.Contains(
+		t, body, `value="`+sentinel+`"`,
+		"the edit form pre-fills the stored retention",
+	)
+	assert.NotContains(
+		t, body, `max="365"`,
+		"a max below the sentinel would block saving any edit",
+	)
+	// "Currently forever." is the rendered RetentionLabel, not the
+	// static hint below the input, which says "Enter 0 to retain events
+	// forever." A bare Contains of "forever" would pass for any
+	// webhook and would assert nothing about this one.
+	assert.Contains(
+		t, body, "Currently forever.",
+		"the form reports this webhook's policy as forever",
+	)
+
+	// Submit the pre-filled value back, exactly as a browser would.
+	post := submitEdit(t, env, wh, sentinel)
+	require.Equal(t, http.StatusSeeOther, post.Code)
+
+	assert.Equal(
+		t,
+		database.RetentionForeverDays,
+		storedRetentionDays(t, env.db, wh.ID),
+	)
+}
+
+// TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
+// the retain-forever value is never rendered to the user as a raw day
+// count on either read-only view.
+func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
+	sentinel := strconv.Itoa(database.RetentionForeverDays)
+
+	listW := httptest.NewRecorder()
+	env.handlers.HandleSourceList().ServeHTTP(
+		listW, getRequest(t, "/sources", env.cookies, nil),
+	)
+
+	require.Equal(t, http.StatusOK, listW.Code)
+	assert.Contains(t, listW.Body.String(), "Retention: forever")
+	assert.NotContains(t, listW.Body.String(), sentinel)
+
+	detailW := httptest.NewRecorder()
+	env.handlers.HandleSourceDetail().ServeHTTP(
+		detailW,
+		getRequest(
+			t, "/source/"+wh.ID, env.cookies,
+			map[string]string{sourceIDParam: wh.ID},
+		),
+	)
+
+	require.Equal(t, http.StatusOK, detailW.Code)
+	assert.Contains(t, detailW.Body.String(), "Retention: forever")
+	assert.NotContains(t, detailW.Body.String(), sentinel)
+}
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -285,36 +285,10 @@ func (s *Middleware) NoCache() func(http.Handler) http.Handler {
 	}
 }

-// bodyLimitedMethod reports whether the request method carries a
-// body that the MaxBodySize middleware should cap.
-func bodyLimitedMethod(method string) bool {
-	return method == http.MethodPost ||
-		method == http.MethodPut ||
-		method == http.MethodPatch
-}
-
-// MaxBodySize returns middleware that limits the size of
-// POST/PUT/PATCH request bodies to maxBytes. It must be registered
-// before any middleware that parses the body — notably CSRF, which
-// calls r.PostFormValue — so that form parsing happens under this
-// cap rather than net/http's 10 MB default.
-//
-// Two enforcement paths exist, because http.MaxBytesReader alone
-// cannot produce a 413: it reports the overflow as an error from
-// Read, by which point the body parser downstream has already
-// converted that error into its own response.
-//
-//   - Declared oversize: the request announces a Content-Length
-//     greater than maxBytes. The middleware answers 413 Request
-//     Entity Too Large immediately and does not call the next
-//     handler, so neither CSRF nor the endpoint handler runs.
-//   - Undeclared oversize: the request is chunked (Content-Length
-//     of -1) or lies about its Content-Length. There is nothing to
-//     check up front, so http.MaxBytesReader hard-caps the body at
-//     maxBytes and the request fails downstream — the form parse
-//     errors out and CSRF rejects it with 403. The response is less
-//     precise than a 413, but the body is still never buffered
-//     beyond the cap, which is the property that matters.
+// MaxBodySize returns middleware that limits the request body size
+// for POST requests. If the body exceeds the given limit in
+// bytes, the server returns 413 Request Entity Too Large. This
+// prevents clients from sending arbitrarily large form bodies.
 func (s *Middleware) MaxBodySize(
 	maxBytes int64,
 ) func(http.Handler) http.Handler {
@@ -323,31 +297,14 @@ func (s *Middleware) MaxBodySize(
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			if !bodyLimitedMethod(r.Method) {
-				next.ServeHTTP(w, r)
-
-				return
-			}
-
-			if r.ContentLength > maxBytes {
-				s.log.Warn(
-					"request body exceeds limit",
-					"method", r.Method,
-					"path", r.URL.Path,
-					"content_length", r.ContentLength,
-					"limit", maxBytes,
+			if r.Method == http.MethodPost ||
+				r.Method == http.MethodPut ||
+				r.Method == http.MethodPatch {
+				r.Body = http.MaxBytesReader(
+					w, r.Body, maxBytes,
 				)
-				http.Error(
-					w,
-					"Request Entity Too Large",
-					http.StatusRequestEntityTooLarge,
-				)
-
-				return
 			}

-			r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
-
 			next.ServeHTTP(w, r)
 		})
 	}
--- a/internal/middleware/middleware_test.go
+++ b/internal/middleware/middleware_test.go
@@ -3,12 +3,10 @@ package middleware_test
 import (
 	"context"
 	"encoding/base64"
-	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"strings"
 	"testing"

 	"github.com/gorilla/sessions"
@@ -428,153 +426,6 @@ func TestNoCache_SetsHeaders(t *testing.T) {
 	)
 }

-// --- MaxBodySize Middleware Tests ---
-
-const testBodyLimit int64 = 64
-
-// maxBodySizeHandler wraps a sentinel handler in MaxBodySize with
-// testBodyLimit. The sentinel records whether it ran and how much of
-// the body it managed to read, so tests can distinguish "never
-// reached" from "reached but truncated".
-type maxBodySizeResult struct {
-	called   bool
-	read     int
-	readErr  error
-	response *httptest.ResponseRecorder
-}
-
-func runMaxBodySize(
-	t *testing.T,
-	req *http.Request,
-) *maxBodySizeResult {
-	t.Helper()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-	res := &maxBodySizeResult{response: httptest.NewRecorder()}
-
-	handler := m.MaxBodySize(testBodyLimit)(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			res.called = true
-
-			body, err := io.ReadAll(r.Body)
-			res.read = len(body)
-			res.readErr = err
-
-			w.WriteHeader(http.StatusOK)
-		},
-	))
-
-	handler.ServeHTTP(res.response, req)
-
-	return res
-}
-
-// postWithBody builds a POST request whose Content-Length is
-// accurate for the given payload size.
-func postWithBody(size int) *http.Request {
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost, "/pages/login",
-		strings.NewReader(strings.Repeat("a", size)),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	return req
-}
-
-func TestMaxBodySize_DeclaredOversize_413AndHandlerNotReached(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	res := runMaxBodySize(t, postWithBody(int(testBodyLimit)+1))
-
-	assert.False(
-		t, res.called,
-		"handler must not be reached for an oversized body",
-	)
-	assert.Equal(
-		t, http.StatusRequestEntityTooLarge, res.response.Code,
-	)
-}
-
-func TestMaxBodySize_AtLimit_PassesThrough(t *testing.T) {
-	t.Parallel()
-
-	res := runMaxBodySize(t, postWithBody(int(testBodyLimit)))
-
-	assert.True(
-		t, res.called,
-		"handler should be reached for a body at the limit",
-	)
-	require.NoError(t, res.readErr)
-	assert.Equal(t, int(testBodyLimit), res.read)
-	assert.Equal(t, http.StatusOK, res.response.Code)
-}
-
-func TestMaxBodySize_UnderLimit_PassesThrough(t *testing.T) {
-	t.Parallel()
-
-	res := runMaxBodySize(t, postWithBody(1))
-
-	assert.True(t, res.called)
-	require.NoError(t, res.readErr)
-	assert.Equal(t, 1, res.read)
-	assert.Equal(t, http.StatusOK, res.response.Code)
-}
-
-func TestMaxBodySize_GetWithOversizeBody_NotCapped(t *testing.T) {
-	t.Parallel()
-
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodGet, "/pages/login",
-		strings.NewReader(
-			strings.Repeat("a", int(testBodyLimit)+1),
-		),
-	)
-
-	res := runMaxBodySize(t, req)
-
-	assert.True(
-		t, res.called,
-		"GET requests are not subject to the POST body cap",
-	)
-	require.NoError(t, res.readErr)
-	assert.Equal(t, int(testBodyLimit)+1, res.read)
-}
-
-// TestMaxBodySize_UndeclaredOversize_TruncatedAtCap covers the
-// chunked / lying-Content-Length case: there is nothing to check up
-// front, so the request reaches the handler but MaxBytesReader
-// hard-caps the body and the read fails at the limit.
-func TestMaxBodySize_UndeclaredOversize_TruncatedAtCap(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	req := postWithBody(int(testBodyLimit) + 1)
-	// Simulate a chunked request: no declared length.
-	req.ContentLength = -1
-
-	res := runMaxBodySize(t, req)
-
-	assert.True(
-		t, res.called,
-		"an undeclared oversize body cannot be rejected up front",
-	)
-	require.Error(
-		t, res.readErr,
-		"reading past the cap must fail",
-	)
-	assert.Equal(
-		t, int(testBodyLimit), res.read,
-		"the handler must not see more than the cap",
-	)
-}
-
 // --- Helper Tests ---

 func TestIpFromHostPort(t *testing.T) {
--- a/internal/server/export_test.go
+++ b/internal/server/export_test.go
@@ -1,36 +0,0 @@
-package server
-
-import (
-	"log/slog"
-	"net/http"
-
-	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/handlers"
-	"sneak.berlin/go/webhooker/internal/middleware"
-)
-
-// MaxFormBodySizeForTest exposes the form body cap so tests can
-// build requests that sit exactly at, below, and above it.
-const MaxFormBodySizeForTest = maxFormBodySize
-
-// NewRouterForTest builds the real route tree via SetupRoutes with
-// the supplied middleware and handlers, bypassing the fx lifecycle
-// and the HTTP listener. Tests use it so that route-group middleware
-// registration order is exercised exactly as it ships, rather than
-// against a hand-rebuilt chain that could drift from routes.go.
-func NewRouterForTest(
-	log *slog.Logger,
-	cfg *config.Config,
-	mw *middleware.Middleware,
-	h *handlers.Handlers,
-) http.Handler {
-	s := &Server{
-		log:    log,
-		mw:     mw,
-		h:      h,
-		params: ServerParams{Config: cfg},
-	}
-	s.SetupRoutes()
-
-	return s.router
-}
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -90,11 +90,9 @@ func (s *Server) setupRoutes() {

 func (s *Server) setupPageRoutes() {
 	s.router.Route("/pages", func(r chi.Router) {
-		// MaxBodySize must precede CSRF: gorilla/csrf parses the
-		// form, so the cap has to be installed before it runs.
-		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
+		r.Use(s.mw.MaxBodySize(maxFormBodySize))

 		r.Group(func(r chi.Router) {
 			r.Use(s.mw.LoginRateLimit())
@@ -108,9 +106,6 @@ func (s *Server) setupPageRoutes() {

 func (s *Server) setupUserRoutes() {
 	s.router.Route("/user/{username}", func(r chi.Router) {
-		// MaxBodySize must precede CSRF: gorilla/csrf parses the
-		// form, so the cap has to be installed before it runs.
-		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
@@ -123,24 +118,20 @@ func (s *Server) setupUserRoutes() {

 func (s *Server) setupSourceRoutes() {
 	s.router.Route("/sources", func(r chi.Router) {
-		// MaxBodySize must precede CSRF: gorilla/csrf parses the
-		// form, so the cap has to be installed before it runs.
-		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
+		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceList())
 		r.Get("/new", s.h.HandleSourceCreate())
 		r.Post("/new", s.h.HandleSourceCreateSubmit())
 	})

 	s.router.Route("/source/{sourceID}", func(r chi.Router) {
-		// MaxBodySize must precede CSRF: gorilla/csrf parses the
-		// form, so the cap has to be installed before it runs.
-		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
+		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 		r.Get("/", s.h.HandleSourceDetail())
 		r.Get("/edit", s.h.HandleSourceEdit())
 		r.Post("/edit", s.h.HandleSourceEditSubmit())
--- a/internal/server/routes_test.go
+++ b/internal/server/routes_test.go
@@ -1,375 +0,0 @@
-package server_test
-
-import (
-	"context"
-	"html"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/delivery"
-	"sneak.berlin/go/webhooker/internal/globals"
-	"sneak.berlin/go/webhooker/internal/handlers"
-	"sneak.berlin/go/webhooker/internal/healthcheck"
-	"sneak.berlin/go/webhooker/internal/logger"
-	"sneak.berlin/go/webhooker/internal/middleware"
-	"sneak.berlin/go/webhooker/internal/server"
-	"sneak.berlin/go/webhooker/internal/session"
-)
-
-// csrfCookieName is the cookie gorilla/csrf issues when it runs. Its
-// presence or absence on a response is how these tests tell whether
-// the CSRF middleware executed.
-const csrfCookieName = "_gorilla_csrf"
-
-type noopNotifier struct{}
-
-func (n *noopNotifier) Notify([]delivery.Task) {}
-
-// testEnv is the real router from routes.go plus the collaborators
-// tests need to seed users and forge sessions.
-type testEnv struct {
-	router http.Handler
-	sess   *session.Session
-	db     *database.Database
-}
-
-// newTestEnv wires the dependency graph with fx and builds the
-// production route tree, so middleware registration order is
-// exercised exactly as it ships.
-func newTestEnv(t *testing.T) *testEnv {
-	t.Helper()
-
-	var (
-		log  *logger.Logger
-		cfg  *config.Config
-		mw   *middleware.Middleware
-		hnd  *handlers.Handlers
-		sess *session.Session
-		db   *database.Database
-	)
-
-	app := fxtest.New(
-		t,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			func() *config.Config {
-				return &config.Config{
-					DataDir:     t.TempDir(),
-					Environment: config.EnvironmentDev,
-				}
-			},
-			database.New,
-			database.NewWebhookDBManager,
-			healthcheck.New,
-			session.New,
-			func() delivery.Notifier { return &noopNotifier{} },
-			middleware.New,
-			handlers.New,
-		),
-		fx.Populate(&log, &cfg, &mw, &hnd, &sess, &db),
-	)
-	app.RequireStart()
-	t.Cleanup(app.RequireStop)
-
-	return &testEnv{
-		router: server.NewRouterForTest(log.Get(), cfg, mw, hnd),
-		sess:   sess,
-		db:     db,
-	}
-}
-
-// oversizeValue returns a form value one byte past the route-group
-// body cap, so an encoded form containing it is guaranteed oversize.
-func oversizeValue() string {
-	return strings.Repeat("a", int(server.MaxFormBodySizeForTest)+1)
-}
-
-// csrfCookieSet reports whether the response issued a gorilla/csrf
-// cookie, which only happens if the CSRF middleware ran.
-func csrfCookieSet(w *httptest.ResponseRecorder) bool {
-	for _, c := range w.Result().Cookies() {
-		if c.Name == csrfCookieName {
-			return true
-		}
-	}
-
-	return false
-}
-
-// get issues a GET through the router with the supplied cookies.
-func (e *testEnv) get(
-	path string,
-	cookies []*http.Cookie,
-) *httptest.ResponseRecorder {
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, path, nil,
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	w := httptest.NewRecorder()
-	e.router.ServeHTTP(w, req)
-
-	return w
-}
-
-// post issues a urlencoded form POST through the router. The body is
-// a strings.Reader, so the request carries an accurate
-// Content-Length — the signal MaxBodySize checks up front.
-func (e *testEnv) post(
-	path string,
-	form url.Values,
-	cookies []*http.Cookie,
-) *httptest.ResponseRecorder {
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, path,
-		strings.NewReader(form.Encode()),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	w := httptest.NewRecorder()
-	e.router.ServeHTTP(w, req)
-
-	return w
-}
-
-// csrfFrom renders the page at path and returns the CSRF token from
-// its form together with every cookie needed for the follow-up POST.
-func (e *testEnv) csrfFrom(
-	t *testing.T,
-	path string,
-	cookies []*http.Cookie,
-) (string, []*http.Cookie) {
-	t.Helper()
-
-	w := e.get(path, cookies)
-	require.Equal(t, http.StatusOK, w.Code)
-
-	pattern := regexp.MustCompile(
-		`name="csrf_token" value="([^"]+)"`,
-	)
-
-	match := pattern.FindStringSubmatch(w.Body.String())
-	require.Len(t, match, 2, "form must embed a CSRF token")
-
-	// html/template escapes "+" and "=" in attribute values, and
-	// gorilla/csrf tokens are standard base64, so the value read
-	// out of the markup has to be unescaped before it is submitted.
-	token := html.UnescapeString(match[1])
-
-	combined := make([]*http.Cookie, 0, len(cookies))
-	combined = append(combined, cookies...)
-	combined = append(combined, w.Result().Cookies()...)
-
-	return token, combined
-}
-
-// authCookies forges an authenticated session for the given user.
-func (e *testEnv) authCookies(
-	t *testing.T,
-	userID, username string,
-) []*http.Cookie {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, "/setup", nil,
-	)
-	w := httptest.NewRecorder()
-
-	s, err := e.sess.Get(req)
-	require.NoError(t, err)
-
-	e.sess.SetUser(s, userID, username)
-	require.NoError(t, e.sess.Save(req, w, s))
-
-	cookies := w.Result().Cookies()
-	require.NotEmpty(t, cookies, "session cookie should be set")
-
-	return cookies
-}
-
-// seedUser creates a user with the given password and returns the
-// stored hash so tests can assert whether it later changed.
-func (e *testEnv) seedUser(
-	t *testing.T,
-	username, password string,
-) (string, string) {
-	t.Helper()
-
-	hash, err := database.HashPassword(password)
-	require.NoError(t, err)
-
-	user := &database.User{Username: username, Password: hash}
-	require.NoError(t, e.db.DB().Create(user).Error)
-
-	return user.ID, hash
-}
-
-// storedHash reads the current password hash for a username.
-func (e *testEnv) storedHash(t *testing.T, username string) string {
-	t.Helper()
-
-	var user database.User
-
-	require.NoError(t,
-		e.db.DB().Where("username = ?", username).
-			First(&user).Error,
-	)
-
-	return user.Password
-}
-
-// --- /pages group ---
-
-// TestPagesLogin_OversizeBody_RejectedBeforeCSRF proves the cap runs
-// ahead of gorilla/csrf: the response is a clean 413 and no CSRF
-// cookie was issued, so neither the CSRF middleware nor the login
-// handler ran.
-func TestPagesLogin_OversizeBody_RejectedBeforeCSRF(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	form := url.Values{}
-	form.Set("username", oversizeValue())
-	form.Set("password", "irrelevant")
-
-	w := env.post("/pages/login", form, nil)
-
-	assert.Equal(
-		t, http.StatusRequestEntityTooLarge, w.Code,
-	)
-	assert.False(
-		t, csrfCookieSet(w),
-		"CSRF middleware must not run for an oversized body",
-	)
-}
-
-// TestPagesLogin_UnderLimit_NoToken_CSRFRejects is the control for
-// the test above: an identically shaped but under-limit POST does
-// reach gorilla/csrf, which rejects it and issues its cookie. Without
-// this, the missing-cookie assertion above would prove nothing.
-func TestPagesLogin_UnderLimit_NoToken_CSRFRejects(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	form := url.Values{}
-	form.Set("username", "someone")
-	form.Set("password", "irrelevant")
-
-	w := env.post("/pages/login", form, nil)
-
-	assert.Equal(t, http.StatusForbidden, w.Code)
-	assert.True(
-		t, csrfCookieSet(w),
-		"CSRF middleware should run for an under-limit body",
-	)
-}
-
-// TestPagesLogin_UnderLimit_ValidToken_ReachesHandler proves the
-// reorder did not break CSRF token handling: a token harvested from
-// the rendered login form is still accepted and the request lands in
-// the handler.
-func TestPagesLogin_UnderLimit_ValidToken_ReachesHandler(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	token, cookies := env.csrfFrom(t, "/pages/login", nil)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("username", "nosuchuser")
-	form.Set("password", "wrongpassword")
-
-	w := env.post("/pages/login", form, cookies)
-
-	assert.Equal(t, http.StatusUnauthorized, w.Code)
-	assert.Contains(
-		t, w.Body.String(), "Invalid username or password",
-		"request should reach the login handler",
-	)
-}
-
-// --- /user/{username} group ---
-
-// TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
-// covers the route that previously had no middleware body cap at
-// all. The request carries a valid session and a valid CSRF token,
-// so the only thing that can stop it is the size cap; the unchanged
-// password hash is the observable proof the handler never ran.
-func TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	userID, originalHash := env.seedUser(t, "pwuser", "oldpassword")
-	cookies := env.authCookies(t, userID, "pwuser")
-	token, cookies := env.csrfFrom(t, "/user/pwuser/", cookies)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("current_password", "oldpassword")
-	form.Set("new_password", oversizeValue())
-	form.Set("confirm_password", oversizeValue())
-
-	w := env.post("/user/pwuser/password", form, cookies)
-
-	assert.Equal(
-		t, http.StatusRequestEntityTooLarge, w.Code,
-	)
-	assert.Equal(
-		t, originalHash, env.storedHash(t, "pwuser"),
-		"handler must not run, so the password must be unchanged",
-	)
-}
-
-// TestPasswordChange_UnderLimit_Succeeds proves that adding the cap
-// to the /user/{username} group did not break the route it guards.
-func TestPasswordChange_UnderLimit_Succeeds(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	userID, originalHash := env.seedUser(t, "okuser", "oldpassword")
-	cookies := env.authCookies(t, userID, "okuser")
-	token, cookies := env.csrfFrom(t, "/user/okuser/", cookies)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("current_password", "oldpassword")
-	form.Set("new_password", "brandnewpassword")
-	form.Set("confirm_password", "brandnewpassword")
-
-	w := env.post("/user/okuser/password", form, cookies)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.NotEqual(
-		t, originalHash, env.storedHash(t, "okuser"),
-		"an under-limit password change should still apply",
-	)
-}
--- a/templates/source_detail.html
+++ b/templates/source_detail.html
@@ -181,7 +181,7 @@

    <!-- Info -->
    <div class="mt-4 text-sm text-gray-400">
-        <p>Retention: {{.Webhook.RetentionDays}} days &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
+        <p>Retention: {{.Webhook.RetentionLabel}} &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
    </div>
 </div>
 {{end}}
--- a/templates/source_edit.html
+++ b/templates/source_edit.html
@@ -28,7 +28,8 @@

            <div class="form-group">
                <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="1" max="365" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="0" class="input">
+                <p class="text-xs text-gray-500 mt-1">Currently {{.Webhook.RetentionLabel}}. Enter 0 to retain events forever.</p>
            </div>

            <div class="flex gap-3">
--- a/templates/sources_list.html
+++ b/templates/sources_list.html
@@ -25,7 +25,7 @@
                    <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
                    {{end}}
                </div>
-                <span class="badge-info">{{.RetentionDays}}d retention</span>
+                <span class="badge-info">Retention: {{.RetentionLabel}}</span>
            </div>
            <div class="flex gap-6 mt-4 text-sm text-gray-500">
                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>
--- a/templates/sources_new.html
+++ b/templates/sources_new.html
@@ -18,18 +18,18 @@
            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
            <div class="form-group">
                <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" required autofocus placeholder="My Webhook" class="input">
+                <input type="text" id="name" name="name" value="{{.Name}}" required autofocus placeholder="My Webhook" class="input">
            </div>

            <div class="form-group">
                <label for="description" class="label">Description</label>
-                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input"></textarea>
+                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input">{{.Description}}</textarea>
            </div>

            <div class="form-group">
                <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="30" min="1" max="365" class="input">
-                <p class="text-xs text-gray-500 mt-1">How long to keep event data.</p>
+                <input type="number" id="retention_days" name="retention_days" value="{{.DefaultRetentionDays}}" min="0" class="input">
+                <p class="text-xs text-gray-500 mt-1">How long to keep event data. Enter 0 to retain events forever.</p>
            </div>

            <div class="flex gap-3">