Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367 )

The webhook page and everything under it move from /source/ID to /hook/ID, the list and new-webhook form to /hooks and /hooks/new, and the event log from .../logs to /hook/ID/events, body download included. Entrypoint URLs move from /webhook/UUID to /h/UUID, and the webhook page shows only that form. The old paths are gone. Links, redirects, form actions, tests, comments and the README follow. Both links to the event log page, and its title and heading, now read "Full Event Log". Go identifiers and template file names are unchanged. A new route test posts to the entrypoint URL the webhook page shows and checks that the receiver rate limit applies to it. Model: opus-5-5
Commit the Alpine.js tarball in 3p/ and extract it at build time (closes #345 )
2026-10-01 20:48:17 +00:00 · 2026-10-01 22:44:41 +02:00 · 2026-10-01 21:38:48 +02:00 · 2026-09-29 13:05:16 +02:00 · 2026-09-29 12:58:44 +02:00 · 2026-09-29 12:01:33 +02:00
67 changed files with 826 additions and 619 deletions
@@ -3,10 +3,8 @@
 # stage of the Dockerfile.
 .git/
 bin/
-# Third-party browser assets are fetched and hash-verified inside the build by
-# script/fetch-assets. Excluding any host copy keeps a developer's working tree
-# from supplying the bytes that get shipped. The script and its
-# static/vendor.sha256 manifest stay in the context.
+# Extracted from 3p/ by `make assets` inside the build; a host copy is not
+# needed. The tarball in 3p/ must stay in the context.
 static/js/alpine.min.js
 *.md
 LICENSE
@@ -46,7 +46,6 @@ temp/
 # CI cache barrier, written into the build context by the check workflow
 .ci-fingerprint

-# Third-party browser assets, fetched and hash-verified by
-# script/fetch-assets against static/vendor.sha256. Not committed:
-# REPO_POLICIES.md forbids minified bundles in version control.
+# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
+# what is committed.
 /static/js/alpine.min.js
@@ -51,15 +51,8 @@ RUN go mod download
 # the lint stage above.
 COPY . .

-# Fetch the third-party browser assets the UI serves. They are not committed
-# (REPO_POLICIES.md forbids minified bundles in version control) and
-# .dockerignore keeps any host copy out of the build context, so this step is
-# the only way they enter the image. Each download is checked against a
-# hardcoded sha256 and the build fails on mismatch; make test re-checks the
-# hashes against the bytes go:embed actually put in the binary.
-RUN script/fetch-assets
-
-# Run tests and build
+# Run tests and build. Both first run script/assets, which extracts Alpine.js
+# from its tarball in 3p/.
 RUN make test

 # Version stamped into the binary. .dockerignore excludes .git/, so
@@ -67,8 +60,8 @@ RUN make test
 # host and passes it in. The default is what a bare `docker build .`
 # with no --build-arg gets, and it names no tag the tree may not be at.
 #
-# Declared here, below the test and asset steps, so a changed version
-# does not invalidate their cached layers.
+# Declared here, below the test step, so a changed version does not
+# invalidate its cached layer.
 ARG VERSION=unknown

 RUN make build VERSION="$VERSION"
@@ -88,7 +81,9 @@ RUN CGO_ENABLED=1 make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static
 # alpine:3.21, 2026-03-17
 FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709

-RUN apk --no-cache add ca-certificates
+# su-exec 0.2-r3 (Alpine 3.21), 2026-09-29: the entrypoint runs the app
+# as webhooker with it.
+RUN apk --no-cache add ca-certificates su-exec=0.2-r3

 # Create non-root user
 RUN addgroup -g 1000 -S webhooker && \
@@ -99,13 +94,17 @@ WORKDIR /app
 # Copy binary from builder
 COPY --from=builder /build/bin/webhooker /app/webhooker

+# Not under /app, which belongs to webhooker: this script runs as root.
+COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+
 # Create data directory for all SQLite databases (main app DB +
 # per-webhook event DBs). DATA_DIR defaults to /var/lib/webhooker.
 RUN mkdir -p /var/lib/webhooker

 RUN chown -R webhooker:webhooker /app /var/lib/webhooker

-USER webhooker
+# No USER: the entrypoint starts as root to make the data directory
+# webhooker's, then runs the app as webhooker.

 EXPOSE 8080

@@ -124,4 +123,5 @@ ENV BIND_ADDRESS=0.0.0.0
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1

+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]
@@ -28,7 +28,7 @@ setup:
 	@script/setup

 assets:
-	@script/fetch-assets
+	@script/assets

 test:
 	@script/test
@@ -45,13 +45,13 @@ fmt-check:
 check:
 	@script/check

-build:
+build: assets
 	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker

 run: build
 	./bin/webhooker

-dev:
+dev: assets
 	go run ./cmd/webhooker

 deps:
@@ -7,7 +7,7 @@ services, durably stores them, and delivers them to configured targets
 with retry support, logging, and observability. Category: infrastructure
 / web service. License: MIT.

-Each entrypoint is a version 4 UUID served at `/webhook/{uuid}`, and
+Each entrypoint is a version 4 UUID served at `/h/{uuid}`, and
 that UUID is the entrypoint's only credential. webhooker does not use
 shared secrets, HMAC signatures or token headers on the receiver, and
 will not add them — read
@@ -21,9 +21,6 @@ before deploying one.
 - Go 1.26.1+ (the version in `go.mod`)
 - Docker (for linting, for the test stage of the CI gate, and for
  containerized deployment)
- `curl`, used by `script/fetch-assets` to download the third-party
-  browser assets, which are not committed (`make bootstrap` installs
-  it if missing)

 golangci-lint is not a prerequisite and must not be installed on the
 host: `script/bootstrap` does not install it, and `make lint` runs the
@@ -36,9 +33,7 @@ digest-pinned linter image via `Dockerfile.lint`.
 git clone https://git.eeqj.de/sneak/webhooker.git
 cd webhooker

-# Install Go dependencies and the third-party browser assets.
-# `make deps` alone is not enough: it only runs go mod download/tidy,
-# and the checks below need the fetched assets.
+# Install the Go toolchain if missing, and the Go dependencies
 make bootstrap

 # Run all checks (test, lint, format check)
@@ -58,7 +53,7 @@ make docker
 ```bash
 make bootstrap  # Install all dependencies (idempotent)
 make setup      # Bootstrap + install git pre-commit hook
-make assets     # Fetch + verify third-party browser assets
+make assets     # Extract Alpine.js from 3p/ (test, check, build, dev run it)
 make fmt        # Format code (gofmt + goimports)
 make fmt-check  # Fail if gofmt would change anything (writes nothing)
 make lint       # Run golangci-lint in Docker (Dockerfile.lint)
@@ -538,6 +533,12 @@ its Argon2id hash. There is no second account and no forgot-password
 flow, so the banner and the reset command below are the only two ways
 in.

+A start that finds no `webhooker.db` in `DATA_DIR` also logs
+`created a new, empty database` at `WARN`, with the file's path,
+shortly before the banner. On a deployment that has run before, that
+line means `DATA_DIR` was empty, most often because its volume is not
+mounted.
+
 #### Recovering a lost admin password

 `webhooker resetpw` sets an existing account's password from the
@@ -552,8 +553,9 @@ printf '%s' "$NEW_PASSWORD" | \
    DATA_DIR=/var/lib/webhooker webhooker resetpw admin
 ```

-In a container it is the same binary, which the image sets as `CMD`
-rather than `ENTRYPOINT`, so the whole command has to be given:
+In a container it is the same binary. The image's `CMD` is
+`/app/webhooker`, and a command given to `docker run` replaces all of
+it, so the whole command has to be given:

 ```bash
 docker run --rm -v webhooker-data:/var/lib/webhooker \
@@ -690,38 +692,22 @@ those three values rather than trusting the figure. Measured at 65s on
 Docker 29.7.2.) A container `unhealthy` with `connection refused` in
 its health log, or a published port that resets connections, is this.

-The container runs as a non-root user (`webhooker`, UID 1000), exposes
-port 8080, and includes a health check against
-`/.well-known/healthcheck`. The `/var/lib/webhooker` volume holds all
-SQLite databases: the main application database (`webhooker.db`), the
-per-webhook event databases (`events-{uuid}.db`), and any archive
-databases written by `database` targets (`archive-{uuid}.db`). Mount
-this as a persistent volume to preserve data across container
-restarts.
+The app runs as a non-root user (`webhooker`, UID 1000), exposes port
+8080, and includes a health check against `/.well-known/healthcheck`.
+The `/var/lib/webhooker` volume holds all SQLite databases: the main
+application database (`webhooker.db`), the per-webhook event databases
+(`events-{uuid}.db`), and any archive databases written by `database`
+targets (`archive-{uuid}.db`). Mount this as a persistent volume to
+preserve data across container restarts.

-**The bind-mounted directory must be owned by UID 1000, or the
-container does not start.** Docker creates a `-v` source path that
-does not exist yet as `root:root`, and the process runs as UID 1000,
-so it cannot take its `DATA_DIR` lock:
-
-```
-webhooker: locking data directory /var/lib/webhooker: open
-/var/lib/webhooker/webhooker.lock: permission denied
-```
-
-It exits non-zero at that point, before opening any database. Create
-the directory ahead of the first `docker run`:
-
-```bash
-mkdir -p /path/to/data
-chown 1000:1000 /path/to/data
-chmod 750 /path/to/data
-```
-
-The same `chown` is what a restore needs — see step 4 of
-[Restore](#restore). A **named volume** does not have this problem:
-Docker copies the image's ownership onto a volume it initializes, and
-the image creates `/var/lib/webhooker` owned by `webhooker`.
+**The container sets its data directory's owner and mode itself
+before the app starts**, so a host directory can be mounted as it is,
+whoever owns it. The image's `ENTRYPOINT`,
+`deploy/docker-entrypoint.sh`, starts as root, creates `DATA_DIR` if
+it is missing, gives the directory and anything in it that belongs to
+another user to `webhooker`, sets the directory to `0750`, and only
+then runs the app as `webhooker`. Started with `--user`, it changes
+nothing and runs the app as that user.

 **The file modes are not yours to set, and do not depend on the
 directory.** `webhooker.db` holds target configuration in plaintext —
@@ -729,13 +715,10 @@ bearer tokens, API keys, Slack webhook URLs — along with the session
 encryption key, so webhooker creates every SQLite file it owns `0600`:
 each database and both of its `-wal` and `-shm` sidecars, across all
 three tiers. Files an earlier build left `0644` are tightened when
-they are opened. A `DATA_DIR` webhooker creates itself is `0750`, but
-a bind mount supplies its own directory and Docker's default for one
-it creates is `0755`; the `0600` files hold there regardless. The
-`chmod 750` above is defence in depth — it stops other local users
-listing the directory and learning your webhook UUIDs from the
-`events-{uuid}.db` filenames — not the barrier protecting the
-credentials.
+they are opened. The directory's `0750` is defence in depth — it stops
+other local users listing the directory and learning your webhook
+UUIDs from the `events-{uuid}.db` filenames — not the barrier
+protecting the credentials.

 ### Running under upaas

@@ -751,17 +734,6 @@ repository's `Dockerfile` and runs it. The app needs:
  app name, port `8080`. Leave `PORT` unset: the image's health check
  probes `8080`.
 - **Volume:** one host directory mounted at `/var/lib/webhooker`.
-  upaas bind-mounts the host path it is given and does not create it,
-  and the container does not start unless UID 1000 owns it (see
-  [Running with Docker](#running-with-docker)). Create it before the
-  first deploy:
-
-    ```bash
-    mkdir -p /path/to/data
-    chown 1000:1000 /path/to/data
-    chmod 750 /path/to/data
-    ```
-
 - **Environment variables:**
    - `WEBHOOKER_ENVIRONMENT=prod`
    - `TRUSTED_PROXIES`: your reverse proxy's address on that Docker
@@ -1020,12 +992,12 @@ done
 `.backup` reads through the WAL and writes a single consistent file with
 no sidecars of its own, so the destination is complete as it stands.
 Two caveats. First, the runtime image is `alpine:3.21` with only
-`ca-certificates` added — the `sqlite3` CLI is **not** in it, so run
-this on the host against the volume path, or from a throwaway container
-that mounts the volume. Second, each file is captured at its own
-instant, so a webhook created or an event delivered between two files
-being copied lands in one and not the other. If you need the whole set
-coherent as of a single moment, stop the service.
+`ca-certificates` and `su-exec` added — the `sqlite3` CLI is **not** in
+it, so run this on the host against the volume path, or from a
+throwaway container that mounts the volume. Second, each file is
+captured at its own instant, so a webhook created or an event delivered
+between two files being copied lands in one and not the other. If you
+need the whole set coherent as of a single moment, stop the service.

 Note that `sqlite3 <db> .dump` is **not** one of these procedures: it is
 an export, it holds a read transaction open for as long as it runs, and
@@ -1079,21 +1051,11 @@ with any `-wal`/`-shm` beside it, or wait until there are none.
   archive not opened since a crash. A copy salvaged from a crashed
   instance has them for everything, and needs all of them.

-4. **Fix ownership.** The container runs as the non-root `webhooker`
-   user, UID 1000 / GID 1000. Restored files must be owned by (or
-   writable by) that UID, and so must the directory itself — SQLite
-   creates the `-wal` and `-shm` sidecars beside the database, so a
-   writable file inside a directory it cannot write is not enough:
-
-    ```bash
-    chown -R 1000:1000 /path/to/data
-    ```
-
-    Restoring as `root` on the host and forgetting this step is the
-    usual way a restore fails.
-
-5. Start the service. `AutoMigrate` runs against each restored database
-   as it is opened.
+4. Start the service. The container gives the directory and the
+   restored files to the `webhooker` user before the app starts,
+   whoever restored them (see
+   [Running with Docker](#running-with-docker)). `AutoMigrate` runs
+   against each restored database as it is opened.

 ### Upgrades

@@ -1216,7 +1178,7 @@ backups at rest and restrict who can read them.

 **The entrypoint UUID is the credential, and it is the only one.**
 webhooker mints a version 4 UUID per entrypoint and serves it at
-`/webhook/{uuid}`. Possession of that URL is the authentication:
+`/h/{uuid}`. Possession of that URL is the authentication:
 anyone who holds it can submit events to the entrypoint, and the
 receiver verifies nothing else about the sender.

@@ -1254,14 +1216,15 @@ This repository adheres to the
 standard: normalized scripts in `script/` are the entrypoints for the
 development workflow. Ten of the Makefile's seventeen targets are thin
 shims that call them; `build`, `run`, `dev`, `deps`, `clean`, `css` and
-`version` are inline commands with no script behind them, though
-`build` and `version` both take their value from `script/version`.
+`version` are inline commands with no script behind them, though `build`,
+`run` and `dev` first run `script/assets`, and `build` and `version` both
+take their value from `script/version`.

-`make check` needs the third-party browser assets in `static/`, which
-are not committed, so run `make bootstrap` (or just `make assets`) once
-after cloning. Without them the tests fail with a message naming that
-remedy. `make check` does not fetch them itself because it must not
-change any files in the repo.
+`script/test`, `make build` and `make dev` each run `script/assets`
+first, which writes the ignored `static/js/alpine.min.js` (see
+[Third-party browser assets](#third-party-browser-assets)), so
+`make test`, `make check` and the pre-commit hook work on a fresh clone
+without a separate step.

 We provide:

@@ -1269,8 +1232,8 @@ We provide:
 - `script/setup` — make a fresh clone ready for development
  (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
- `script/fetch-assets` — download the third-party browser assets into
-  `static/`, verifying each against its pinned sha256
+- `script/assets` — extract Alpine.js from its tarball in `3p/` (see
+  [Third-party browser assets](#third-party-browser-assets))
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint in Docker (see Linting below)
 - `script/fmt` — format all code (writes)
@@ -1292,24 +1255,25 @@ We provide:

 ## Third-party browser assets

-The web UI serves one third-party script, Alpine.js. It is **not** committed:
-a minified bundle in the tree is unreviewable, and `REPO_POLICIES.md` bars
-both committed build artifacts and unpinned external references.
+The web UI serves one third-party script, Alpine.js. Its npm package tarball
+is committed as `3p/alpinejs-3.14.9.tgz`, byte for byte as the npm registry
+publishes it. It is a dependency, not this repo's build output, so
+`REPO_POLICIES.md`'s rule against committed build artifacts does not apply.
+The directory is `3p/` rather than `vendor/` because Go treats a root
+`vendor/` directory as its module vendor directory.

-Instead `script/fetch-assets` downloads it from a pinned URL, checks the
-download against a hardcoded sha256, and installs it under `static/`. The
-sha256 of every installed asset is recorded in `static/vendor.sha256`, and
-`static/vendor_test.go` re-hashes the bytes `go:embed` put in the binary
-against that manifest — so the pin is enforced on what actually ships, not
-merely written down. Any mismatch fails the build.
+`script/assets` (`make assets`) extracts the browser build,
+`package/dist/cdn.min.js`, from the tarball to `static/js/alpine.min.js`,
+where `go:embed` picks it up. `script/test`, `make build` and `make dev` run
+it first, and the Dockerfile builds through `make test` and `make build`, so
+nothing downloads Alpine.js. The extracted file is not committed, and
+`.dockerignore` keeps any host copy out of the build context.

-`make bootstrap` runs the fetch for local development, and the Dockerfile
-runs it in the build stage; `.gitignore` and `.dockerignore` keep the
-artifact out of both the repo and the build context.
-
-To move to a new version: update the version, URL, and tarball sha256 in
-`script/fetch-assets` and the asset sha256 in `static/vendor.sha256`, then
-run `make assets && make check`.
+To move to a new version: download
+`https://registry.npmjs.org/alpinejs/-/alpinejs-<version>.tgz`, check it
+against the `dist.integrity` hash listed at
+`https://registry.npmjs.org/alpinejs/<version>`, replace the tarball in `3p/`
+with it, update its file name in `script/assets`, and run `make check`.

 ## Rationale

@@ -1472,7 +1436,7 @@ A registered user of the webhooker service.
 | Field      | Type     | Description |
 | ---------- | -------- | ----------- |
 | `id`       | UUID     | Primary key |
-| `username` | string   | Unique login name |
+| `username` | string   | Unique login name, at most 1024 bytes so that it fits in the session cookie |
 | `password` | string   | Argon2id hash (never exposed via API) |

 **Relations:** Has many Webhooks. Has many APIKeys.
@@ -1548,7 +1512,7 @@ the full request and creates an Event.
 | -------------- | ------- | ----------- |
 | `id`           | UUID    | Primary key |
 | `webhook_id`   | UUID    | Foreign key → Webhook |
-| `path`         | string  | Unique bare UUID, generated at creation. The `/webhook/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) |
+| `path`         | string  | Unique bare UUID, generated at creation. The `/h/` prefix is route only and is not stored: the receiver matches this column against the raw `{uuid}` path segment. It is also the entrypoint's credential; see [The entrypoint URL is the authentication secret](#the-entrypoint-url-is-the-authentication-secret) |
 | `description`  | string  | Optional description |
 | `active`       | boolean | Whether this entrypoint accepts events (default: true) |

@@ -1929,7 +1893,7 @@ runtime, though CGO is required at build time due to the transitive
 ```
 External Service
       │
-       │  POST /webhook/{uuid}
+       │  POST /h/{uuid}
       ▼
 ┌─────────────┐     ┌──────────────┐     ┌──────────────┐
 │  chi Router │────►│  Middleware   │────►│   Webhook    │
@@ -2155,7 +2119,7 @@ The middleware records three more on the same registry:
 Two of those labels are written once per request from bytes the client
 chose, so both are bounded to something this service registers:

- `handler` is the chi route pattern — `/webhook/{uuid}`, never the
+- `handler` is the chi route pattern — `/h/{uuid}`, never the
  concrete path. A request matching no route carries `(unmatched)`,
  and no entrypoint UUID ever reaches a label.
 - `method` is the request method when the router can route it, and
@@ -2185,7 +2149,7 @@ unpredictable rates, and blanket limits shared with other routes would
 cause legitimate deliveries to be dropped.

 The receiver instead has its own dedicated abuse limit, scoped to the
-`/webhook/{uuid}` route only and keyed per client IP per request path
+`/h/{uuid}` route only and keyed per client IP per request path
 (`httprate.KeyByEndpoint`): one misbehaving sender is throttled without
 affecting other senders of the same entrypoint or the same sender's
 other entrypoints. Keying on the path rather than on the entrypoint
@@ -2222,7 +2186,7 @@ log spends. The access log is bounded by neither limit: every request
 is recorded once at `INFO`, served or rejected alike.

 What the access log does bound is the _content_ of those lines. A 3xx
-or 4xx response logs the chi route pattern — `/webhook/{uuid}`,
+or 4xx response logs the chi route pattern — `/h/{uuid}`,
 `/user/{username}//`, or the literal `(unmatched)` when the request hit
 no route at all — in place of the concrete URL. Those are the outcomes
 an unauthenticated client can drive for free: 404 and 429 on any
@@ -2256,12 +2220,12 @@ reduces the headers to a fixed allowlist — `Accept`, `Content-Length`,

 The same hook rewrites the request URL. The SDK builds it as
 `scheme://host/path` from the concrete path, which on the receiver
-route is `/webhook/<uuid>` in full — and that UUID is a write
+route is `/h/<uuid>` in full — and that UUID is a write
 capability, not an identifier: anyone holding it can post events this
 service accepts and its targets then deliver. A tracker has its own
 retention, access control and deletion policy, so the rule the access
 log follows above does not carry across that boundary. What is sent is
-the chi route pattern instead: `http://host/webhook/{uuid}`.
+the chi route pattern instead: `http://host/h/{uuid}`.

 The scheme and the host are kept, and everything else in the URL is
 discarded rather than edited, so a future SDK version that starts
@@ -2305,8 +2269,8 @@ fallback is never the concrete path. The path becomes the literal
 rewrite cannot parse into a scheme is withheld whole. A transaction
 event additionally carries the SDK's own `METHOD /path` name, built
 from the concrete path as well; it is rewritten on the same terms, to
-`POST /webhook/{uuid}` where the pattern is known and `POST
-/(redacted)` where it is not.
+`POST /h/{uuid}` where the pattern is known and `POST /(redacted)`
+where it is not.

 The headers are an allowlist for the same reason the rules above are
 unconditional: the SDK's own filter removes four names and passes
@@ -2412,14 +2376,14 @@ Removing either cap fails 14 subtests.

 `internal/middleware/logbound_test.go` and
 `internal/handlers/logbound_test.go` drive 8 KB of client-chosen text
-at each of these — 1 KB at `invalid password`, whose accounts are
-shared with the successful-login line, where a username past 4 KB
-overflows the session cookie and answers 500 before that line is
-written — through both handlers, and through seven fills: plain text
-as the baseline, and then the quotation mark, backslash, tab, newline,
-C0 control and astral non-printable, six characters the wider of the
-two handlers spends more on than the client spent sending them. Every
-case holds each line to the 2,560-byte ceiling. That per-line ceiling
+at each of these — just under 1 KB at `invalid password`, whose
+accounts are shared with the successful-login line and so must stay
+within the 1024-byte username limit — through both handlers, and
+through seven fills: plain text as the baseline, and then the
+quotation mark, backslash, tab, newline, C0 control and astral
+non-printable, six characters the wider of the two handlers spends
+more on than the client spent sending them. Every case holds each
+line to the 2,560-byte ceiling. That per-line ceiling
 is what the figure above states, and every row establishes it.

 Three of the sites go further and bound the whole flood's output — the
@@ -2441,7 +2405,7 @@ logger printed the fully interpolated SQL — parameters and all — to
 standard output on every statement that returned an error, including a
 plain record-not-found, at a level no operator setting reached. Two of
 this service's lookups miss by design on unauthenticated routes: the
-entrypoint lookup behind `/webhook/{uuid}` and the user lookup behind
+entrypoint lookup behind `/h/{uuid}` and the user lookup behind
 the login form, whose path segment and submitted username the client
 picks outright. Every
 `gorm.Open` in the service now installs the adapter in
@@ -2719,10 +2683,10 @@ abuse limit later; they are tracked as future work.

 | Method | Path                        | Description |
 | ------ | --------------------------- | ----------- |
-| `GET`  | `/`                         | Root redirect, 303 (authenticated → `/sources`, unauthenticated → `/pages/login`) |
+| `GET`  | `/`                         | Root redirect, 303 (authenticated → `/hooks`, unauthenticated → `/pages/login`) |
 | `GET`  | `/.well-known/healthcheck`  | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) |
-| any    | `/s/*`                      | Static file serving (embedded CSS, JS). Mounted for every method, not just `GET`/`HEAD`: chi's `Mount` registers all methods and `http.FileServer` special-cases only `HEAD` (by omitting the body), so a `POST` or `DELETE` to an asset is answered `200` with the file. Pinned by `TestStaticServesEveryMethod` |
-| `POST` | `/webhook/{uuid}`           | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |
+| `GET`, `HEAD` | `/s/*`              | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` |
+| `POST` | `/h/{uuid}`                 | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |

 #### Authentication Endpoints

@@ -2738,25 +2702,25 @@ abuse limit later; they are tracked as future work.
 | ------ | ------------------------ | ----------- |
 | `GET`  | `/user/{username}`       | User profile page |
 | `POST` | `/user/{username}/password` | Change the user's password (5 per minute per bucket, then `429`; `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one) |
-| `GET`  | `/sources`               | List user's webhooks |
-| `GET`  | `/sources/new`           | Create webhook form |
-| `POST` | `/sources/new`           | Create webhook submission |
-| `GET`  | `/source/{id}`           | Webhook detail view |
-| `GET`  | `/source/{id}/edit`      | Edit webhook form |
-| `POST` | `/source/{id}/edit`      | Edit webhook submission |
-| `POST` | `/source/{id}/delete`    | Delete webhook |
-| `GET`  | `/source/{id}/logs`      | Webhook event logs |
-| `GET`  | `/source/{id}/logs/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
-| `POST` | `/source/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
-| `POST` | `/source/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
-| `POST` | `/source/{id}/entrypoints` | Add entrypoint to webhook |
-| `POST` | `/source/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
-| `POST` | `/source/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
-| `POST` | `/source/{id}/targets`   | Add target to webhook |
-| `GET`  | `/source/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
-| `POST` | `/source/{id}/targets/{targetID}/edit` | Edit target submission |
-| `POST` | `/source/{id}/targets/{targetID}/delete` | Delete a target |
-| `POST` | `/source/{id}/targets/{targetID}/toggle` | Enable or disable a target |
+| `GET`  | `/hooks`                 | List user's webhooks |
+| `GET`  | `/hooks/new`             | Create webhook form |
+| `POST` | `/hooks/new`             | Create webhook submission |
+| `GET`  | `/hook/{id}`             | Webhook detail view |
+| `GET`  | `/hook/{id}/edit`        | Edit webhook form |
+| `POST` | `/hook/{id}/edit`        | Edit webhook submission |
+| `POST` | `/hook/{id}/delete`      | Delete webhook |
+| `GET`  | `/hook/{id}/events`      | Full Event Log |
+| `GET`  | `/hook/{id}/events/{eventID}/body` | Download an event's full stored body. The log page renders each body only up to its cap, so this is the only route that serves a whole one; it is offered wherever a body is shown truncated |
+| `POST` | `/hook/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
+| `POST` | `/hook/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
+| `POST` | `/hook/{id}/entrypoints` | Add entrypoint to webhook |
+| `POST` | `/hook/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
+| `POST` | `/hook/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
+| `POST` | `/hook/{id}/targets`     | Add target to webhook |
+| `GET`  | `/hook/{id}/targets/{targetID}/edit` | Edit target form. The one page that renders a target's destination URL and header values in full, rather than masked |
+| `POST` | `/hook/{id}/targets/{targetID}/edit` | Edit target submission |
+| `POST` | `/hook/{id}/targets/{targetID}/delete` | Delete a target |
+| `POST` | `/hook/{id}/targets/{targetID}/toggle` | Enable or disable a target |

 #### Infrastructure Endpoints

@@ -2788,6 +2752,8 @@ imports. The entry point is `cmd/webhooker/main.go`.

 ```
 webhooker/
+├── 3p/
+│   └── alpinejs-3.14.9.tgz    # Alpine.js npm package, extracted by make assets
 ├── cmd/webhooker/
 │   └── main.go               # Entry point: subcommand dispatch; no args locks DATA_DIR and wires fx
 ├── internal/
@@ -2881,8 +2847,7 @@ webhooker/
 │   ├── css/tailwind.css       # Generated stylesheet the pages load
 │   ├── css/style.css          # Older hand-written stylesheet, no longer loaded
 │   ├── js/app.js              # Progressive-enhancement copy-to-clipboard
-│   ├── js/alpine.min.js       # Alpine.js, fetched by script/fetch-assets, not committed
-│   └── vendor.sha256          # Pinned hashes the fetched assets are verified against
+│   └── js/alpine.min.js       # Alpine.js, extracted from 3p/ by make assets, not committed
 ├── templates/                 # Go HTML templates (base, login, sources, etc.)
 ├── script/                    # Scripts to Rule Them All entrypoints
 ├── Dockerfile                 # Three stages: lint, test+build, Alpine runtime
@@ -2956,8 +2921,8 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.

-Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
-`/source/*`) apply a **MaxBodySize** middleware that limits
+Additionally, form endpoints (`/pages`, `/user/*`, `/hooks`,
+`/hook/*`) apply a **MaxBodySize** middleware that limits
 POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the
 CSRF middleware in every one of those route groups, because
 gorilla/csrf parses the form; if the cap were installed after it, form
@@ -2981,7 +2946,7 @@ Those same four route groups then apply **CSRF** and **NoCache**
 `/pages` applies **RequireAuth**. The rate limiters are per-route
 rather than global: **PasswordChangeRateLimit** on
 `/user/{username}/password` and **ReceiverRateLimit** on
-`/webhook/{uuid}`. There is deliberately none on `/pages/login` — that
+`/h/{uuid}`. There is deliberately none on `/pages/login` — that
 endpoint counts failures inside the handler, after the credential
 check, see [The login endpoint](#the-login-endpoint).

@@ -3022,8 +2987,8 @@ check, see [The login endpoint](#the-login-endpoint).
  by middleware that runs before CSRF parses the form
 - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf)
  on all state-changing forms (cookie-based double-submit tokens with
-  HMAC authentication). Applied to `/pages`, `/sources`, `/source`, and
-  `/user` routes. Excluded from `/webhook` (inbound webhook POSTs) and
+  HMAC authentication). Applied to `/pages`, `/hooks`, `/hook`, and
+  `/user` routes. Excluded from `/h` (inbound webhook POSTs) and
  `/api` (stateless API). The middleware detects TLS per-request through
  `internal/reqtls.IsTLS` — the same predicate the session cookie uses —
  to set appropriate cookie security flags and Origin/Referer validation
@@ -3071,7 +3036,11 @@ check, see [The login endpoint](#the-login-endpoint).
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
  runtime)
- Container runs as non-root user (UID 1000)
+- The app runs as the non-root `webhooker` user (UID 1000) in the
+  container. The image sets no `USER`, so these run as root: the
+  `ENTRYPOINT` script, which sets the data directory's owner and mode
+  before the app starts; the image's health check; and `docker exec`,
+  unless given `--user`
 - GORM soft deletes on every entity that carries `BaseModel`, which is
  all of them but `Setting` (data preserved for audit)

@@ -3190,18 +3159,21 @@ version is fixed independently of the compiler's:
   `make fmt-check`, then `golangci-lint config verify` and
   `golangci-lint run`, both with `--network=none`.
 2. **Builder stage** (`golang:1.26.1-bookworm`) — depends on the lint
-   stage passing (it copies a file from it), runs `script/fetch-assets`
-   to download and verify the third-party browser assets, then runs
-   `make test` and `make build`, and finally rebuilds the binary with
-   `CGO_ENABLED=1` and static linking so it runs on musl. Both builds
-   go through `make build`, the relink adding its `-extldflags` via
-   `GO_LDFLAGS`, so neither can drop the `-X` that stamps the version.
-   The version arrives as the `VERSION` build arg, since the context
-   has no `.git` (see [Version stamping](#version-stamping)).
-3. **Runtime stage** (`alpine:3.21`) — copies the static binary,
-   creates the `/var/lib/webhooker` directory for all SQLite databases,
-   runs as the non-root `webhooker` user (UID 1000), exposes port 8080,
-   and includes a health check against `/.well-known/healthcheck`.
+   stage passing (it copies a file from it), runs `make test` and
+   `make build` (both extract Alpine.js from `3p/` first), and finally
+   rebuilds the binary with `CGO_ENABLED=1` and static linking so it
+   runs on musl. Both builds go through `make build`, the relink adding
+   its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that
+   stamps the version. The version arrives as the `VERSION` build arg,
+   since the context has no `.git` (see
+   [Version stamping](#version-stamping)).
+3. **Runtime stage** (`alpine:3.21`) — copies the static binary and
+   `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker`
+   directory for all SQLite databases, exposes port 8080, and includes
+   a health check against `/.well-known/healthcheck`. It sets no
+   `USER`: the `ENTRYPOINT` script starts as root, sets the data
+   directory's owner and mode, and runs the app as the non-root
+   `webhooker` user (UID 1000) through `su-exec`.

 The lint stage invokes `golangci-lint` directly rather than `make lint`:
 it is already the pinned linter image, and `make lint` builds
@@ -3280,3 +3252,5 @@ MIT
 ## Author

 [@sneak](https://sneak.berlin)
+
+
@@ -0,0 +1,22 @@
+#!/bin/sh
+# deploy/docker-entrypoint.sh: the image's ENTRYPOINT. A bind-mounted
+# data directory keeps its owner from the host, often root, and the app
+# could not write to it. Started as root, this creates DATA_DIR if
+# needed, gives it and everything in it to webhooker, sets its mode, and
+# runs the command as webhooker, so the app never runs as root. Started
+# as another user, it only runs the command.
+set -eu
+
+main() {
+    if [ "$(id -u)" != 0 ]; then
+        exec "$@"
+    fi
+
+    dir="${DATA_DIR:-/var/lib/webhooker}"
+    mkdir -p "$dir"
+    find "$dir" ! -user webhooker -exec chown -h webhooker:webhooker {} +
+    chmod 750 "$dir"
+    exec su-exec webhooker "$@"
+}
+
+main "$@"
@@ -3,6 +3,8 @@ package database_test
 import (
 	"bytes"
 	"context"
+	"log/slog"
+	"path/filepath"
 	"strings"
 	"testing"

@@ -83,3 +85,37 @@ func TestFirstBoot_PrintsTheAdminPasswordAsABanner(t *testing.T) {
 		t, ok, "the printed password must open the seeded account",
 	)
 }
+
+// TestNewDatabase_IsLoggedWithItsPath is the log half of
+// https://git.eeqj.de/sneak/webhooker/issues/359. A DATA_DIR that is
+// unexpectedly empty boots exactly like a first start, so the start
+// that creates the database must say so, and where. Opening that
+// database again must not.
+func TestNewDatabase_IsLoggedWithItsPath(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	open := func() string {
+		var out bytes.Buffer
+
+		db, err := database.Open(dir, slog.New(slog.NewTextHandler(&out, nil)))
+		require.NoError(t, err)
+		require.NoError(t, db.Close())
+
+		return out.String()
+	}
+
+	const created = `level=WARN msg="created a new, empty database"`
+
+	first := open()
+	second := open()
+
+	assert.Contains(
+		t, first,
+		created+" path="+filepath.Join(dir, database.MainDBFileName),
+	)
+	assert.NotContains(
+		t, second, created, "an existing database is not new",
+	)
+}
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -199,6 +200,12 @@ func (d *Database) connectTo(dataDir string) error {
 	// Construct the main application database path inside DATA_DIR.
 	dbPath := filepath.Join(dataDir, MainDBFileName)

+	// Checked before opening, which creates the file. A DATA_DIR that
+	// is unexpectedly empty -- its volume not mounted, say -- looks
+	// exactly like a first start, so a new database is a warning.
+	_, statErr := os.Stat(dbPath)
+	created := errors.Is(statErr, fs.ErrNotExist)
+
 	// Opened through OpenSQLite so this handle carries the same WAL
 	// journaling, busy timeout, immediate-transaction locking, and pool
 	// bounds as every other database file. See sqlite_open.go.
@@ -229,7 +236,12 @@ func (d *Database) connectTo(dataDir string) error {
 	}

 	d.db = db
+
+	if created {
+		d.log.Warn("created a new, empty database", "path", dbPath)
+	} else {
 		d.log.Info("connected to database", "path", dbPath)
+	}

 	// Run migrations
 	return d.migrate()
@@ -1,13 +1,58 @@
 package database

+import (
+	"errors"
+	"fmt"
+
+	"gorm.io/gorm"
+)
+
+// MaxUsernameBytes is the longest username, in bytes, that a user may
+// have. The same number appears in the check constraint on
+// User.Username, because a struct tag cannot reference a constant.
+//
+// A login stores the username in the session cookie, and both
+// securecookie and browsers refuse a cookie value past about 4096
+// bytes. That value is the session base64-encoded twice, so it holds
+// 4096 × 3/4 × 3/4 = 2304 bytes of session, and the signature,
+// timestamp and the session's other values take about 270 of those: a
+// username longer than about 2030 bytes can never log in. The limit is
+// about half that, so the session can carry more values later without
+// locking out an account whose username is already at the limit.
+const MaxUsernameBytes = 1024
+
+// ErrUsernameTooLong is returned when a user is saved with a username
+// longer than MaxUsernameBytes.
+var ErrUsernameTooLong = errors.New("username is too long")
+
 // User represents a user of the webhooker service
+//
+//nolint:lll // a struct tag cannot wrap
 type User struct {
 	BaseModel

-	Username string `gorm:"uniqueIndex;not null" json:"username"`
+	Username string `gorm:"uniqueIndex;not null;check:length(CAST(username AS BLOB)) <= 1024" json:"username"`
 	Password string `gorm:"not null"                                                          json:"-"` // Argon2 hashed

 	// Relations
 	Webhooks []Webhook `json:"webhooks,omitempty"`
 	APIKeys  []APIKey  `json:"apiKeys,omitempty"`
 }
+
+// BeforeSave rejects a username longer than MaxUsernameBytes when a whole
+// User is created or saved, so those calls get ErrUsernameTooLong rather
+// than the database's constraint error. A column update such as
+// Update("username", ...) is caught only by the check constraint, as is
+// any path that writes the table without this model.
+func (u *User) BeforeSave(_ *gorm.DB) error {
+	if len(u.Username) > MaxUsernameBytes {
+		return fmt.Errorf(
+			"%w: %d bytes, limit is %d",
+			ErrUsernameTooLong,
+			len(u.Username),
+			MaxUsernameBytes,
+		)
+	}
+
+	return nil
+}
@@ -0,0 +1,65 @@
+package database_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+)
+
+// usernameAtLimit is exactly MaxUsernameBytes long, built from a
+// two-byte character. A check that counted characters rather than bytes
+// would see half the length and let the one-byte-longer name through.
+func usernameAtLimit() string {
+	return strings.Repeat("é", database.MaxUsernameBytes/2)
+}
+
+func TestUserCreate_RejectsOverlongUsername(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	err := db.Create(&database.User{
+		Username: usernameAtLimit() + "x",
+		Password: "hash",
+	}).Error
+
+	require.ErrorIs(t, err, database.ErrUsernameTooLong)
+}
+
+func TestUserCreate_AcceptsUsernameAtLimit(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	require.NoError(t, db.Create(&database.User{
+		Username: usernameAtLimit(),
+		Password: "hash",
+	}).Error)
+}
+
+// TestUsersTable_EnforcesUsernameLimitWithoutTheModel inserts with raw
+// SQL, as a path that bypassed User.BeforeSave would, so only the
+// table's check constraint stands between it and an over-long
+// username. Accepting the name at the limit and refusing the next byte
+// also pins the constraint's number to MaxUsernameBytes.
+func TestUsersTable_EnforcesUsernameLimitWithoutTheModel(t *testing.T) {
+	t.Parallel()
+
+	db := startedTestDB(t)
+
+	insert := "INSERT INTO users (id, username, password) VALUES (?, ?, ?)"
+
+	require.NoError(t, db.Exec(
+		insert, uuid.New().String(), usernameAtLimit(), "hash",
+	).Error)
+
+	err := db.Exec(
+		insert, uuid.New().String(), usernameAtLimit()+"x", "hash",
+	).Error
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "CHECK constraint failed")
+}
@@ -7,7 +7,7 @@
 // SQL — parameters and all — for every statement that returns an
 // error, including gorm.ErrRecordNotFound. Two of this service's
 // lookups miss by design on unauthenticated routes: the entrypoint
-// lookup on /webhook/{uuid}, whose path segment the client picks
+// lookup on /h/{uuid}, whose path segment the client picks
 // outright, and the user lookup behind the login form, whose username
 // the client picks outright. Under the default logger each of those
 // misses printed an unbounded, attacker-chosen string, at no level the
@@ -453,3 +453,33 @@ func TestLogin_SuccessCreatesSession(t *testing.T) {
 		"the issued cookie must carry an authenticated session",
 	)
 }
+
+// TestLogin_UsernameAtLimitCanLogIn shows that a username of exactly
+// database.MaxUsernameBytes still fits in the session cookie. Past
+// what the cookie can carry, a correct login answers 500.
+func TestLogin_UsernameAtLimitCanLogIn(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h  *handlers.Handlers
+		db *database.Database
+	)
+
+	app := newTestApp(t, &h, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	username := strings.Repeat("a", database.MaxUsernameBytes)
+
+	hash, err := database.HashPassword(operatorPassword)
+	require.NoError(t, err)
+	require.NoError(t, db.DB().Create(&database.User{
+		Username: username,
+		Password: hash,
+	}).Error)
+
+	w := submitLogin(h, sharedProxyPeer, username, operatorPassword)
+
+	assert.Equal(t, http.StatusSeeOther, w.Code)
+}
@@ -362,7 +362,7 @@ func (h *Handlers) finishReplay(
 	webhook database.Webhook,
 	code replayOutcomeCode,
 ) {
-	dest := "/source/" + webhook.ID + "/logs?" +
+	dest := "/hook/" + webhook.ID + "/events?" +
 		replayOutcomeParam + "=" + string(code)

 	// The page is read from the form rather than the query string:
@@ -138,7 +138,7 @@ func postReplay(
 	t.Helper()

 	req := postRequest(
-		"/source/"+webhookID+"/deliveries/"+
+		"/hook/"+webhookID+"/deliveries/"+
 			deliveryID+"/replay",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
@@ -212,7 +212,7 @@ func TestHandleDeliveryReplay_AppendsDeliveryAndLeavesOriginal(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=queued",
+		"/hook/"+wh.ID+"/events?replay=queued",
 		w.Header().Get("Location"),
 	)

@@ -362,7 +362,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=target-deleted",
+		"/hook/"+wh.ID+"/events?replay=target-deleted",
 		w.Header().Get("Location"),
 	)

@@ -390,7 +390,7 @@ func TestHandleDeliveryReplay_RefusesDeletedTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, missing.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=target-missing",
+		"/hook/"+wh.ID+"/events?replay=target-missing",
 		missing.Header().Get("Location"),
 	)
 }
@@ -431,7 +431,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, first.Code)
 	require.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=queued",
+		"/hook/"+wh.ID+"/events?replay=queued",
 		first.Header().Get("Location"),
 	)

@@ -439,7 +439,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, second.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=in-flight",
+		"/hook/"+wh.ID+"/events?replay=in-flight",
 		second.Header().Get("Location"),
 	)

@@ -465,7 +465,7 @@ func TestHandleDeliveryReplay_RefusesWhileEarlierReplayInFlight(
 	require.Equal(t, http.StatusSeeOther, pending.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?replay=not-terminal",
+		"/hook/"+wh.ID+"/events?replay=not-terminal",
 		pending.Header().Get("Location"),
 	)
 }
@@ -501,7 +501,7 @@ func TestHandleSourceLogs_RendersReplayControlAndBanner(t *testing.T) {

 	assert.Contains(
 		t, body,
-		`action="/source/`+wh.ID+`/deliveries/`+
+		`action="/hook/`+wh.ID+`/deliveries/`+
 			original.ID+`/replay"`,
 	)
 	assert.Contains(t, body, `method="POST"`)
@@ -64,8 +64,8 @@ func fetchEventBody(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+url.PathEscape(sourceID)+
-			"/logs/"+url.PathEscape(eventID)+"/body",
+		"/hook/"+url.PathEscape(sourceID)+
+			"/events/"+url.PathEscape(eventID)+"/body",
 		nil,
 	)

@@ -490,7 +490,7 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page := renderSourceLogsPage(t, h, sess, big.ID)
 	assert.Contains(
 		t, page,
-		"/source/"+big.ID+"/logs/"+bigEvt.ID+"/body",
+		"/hook/"+big.ID+"/events/"+bigEvt.ID+"/body",
 	)

 	small := seedWebhook(t, db)
@@ -501,6 +501,6 @@ func TestHandleSourceLogs_TruncationMarkerLinksToDownload(
 	page = renderSourceLogsPage(t, h, sess, small.ID)
 	assert.NotContains(
 		t, page,
-		"/source/"+small.ID+"/logs/"+smallEvt.ID+"/body",
+		"/hook/"+small.ID+"/events/"+smallEvt.ID+"/body",
 	)
 }
@@ -257,7 +257,7 @@ func (h *Handlers) finishResubmit(
 	webhook database.Webhook,
 	code resubmitOutcomeCode,
 ) {
-	dest := "/source/" + webhook.ID + "/logs?" +
+	dest := "/hook/" + webhook.ID + "/events?" +
 		resubmitOutcomeParam + "=" + string(code)

 	// The page is read from the form rather than the query string:
@@ -65,7 +65,7 @@ func postResubmit(
 	t.Helper()

 	req := postRequest(
-		"/source/"+webhookID+"/events/"+eventID+"/resubmit",
+		"/hook/"+webhookID+"/events/"+eventID+"/resubmit",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),
@@ -154,7 +154,7 @@ func TestHandleEventResubmit_DeliversToTargetCreatedAfterTheEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=queued",
+		"/hook/"+wh.ID+"/events?resubmit=queued",
 		w.Header().Get("Location"),
 	)

@@ -281,7 +281,7 @@ func TestHandleEventResubmit_IsRepeatable(t *testing.T) {
 		require.Equal(t, http.StatusSeeOther, w.Code)
 		assert.Equal(
 			t,
-			"/source/"+wh.ID+"/logs?resubmit=queued",
+			"/hook/"+wh.ID+"/events?resubmit=queued",
 			w.Header().Get("Location"),
 			"a resubmit must not be refused while an earlier "+
 				"one is in flight",
@@ -435,7 +435,7 @@ func TestHandleEventResubmit_SkipsInactiveTarget(t *testing.T) {
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=queued",
+		"/hook/"+wh.ID+"/events?resubmit=queued",
 		w.Header().Get("Location"),
 		"an inactive target is skipped, not an error",
 	)
@@ -481,7 +481,7 @@ func TestHandleEventResubmit_NoActiveTargetsStillStoresEvent(
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
-		"/source/"+wh.ID+"/logs?resubmit=no-targets",
+		"/hook/"+wh.ID+"/events?resubmit=no-targets",
 		w.Header().Get("Location"),
 	)

@@ -597,7 +597,7 @@ func TestHandleSourceLogs_ShowsResubmitProvenance(t *testing.T) {
 	)
 	assert.Contains(
 		t, body,
-		"/source/"+wh.ID+"/events/"+original.ID+"/resubmit",
+		"/hook/"+wh.ID+"/events/"+original.ID+"/resubmit",
 		"the log must offer the resubmit action per event",
 	)
 }
@@ -306,7 +306,7 @@ func postWebhook(
 	t.Helper()

 	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/webhook/x",
+		context.Background(), http.MethodPost, "/h/x",
 		strings.NewReader("{}"),
 	)

@@ -176,7 +176,7 @@ func TestHandleIndex_Authenticated(t *testing.T) {

 	assert.Equal(t, http.StatusSeeOther, w2.Code)
 	assert.Equal(
-		t, "/sources", w2.Header().Get("Location"),
+		t, "/hooks", w2.Header().Get("Location"),
 	)
 }

@@ -5,13 +5,13 @@ import (
 )

 // HandleIndex returns a handler for the root path that redirects
-// based on authentication state: authenticated users go to /sources
+// based on authentication state: authenticated users go to /hooks
 // (the dashboard), unauthenticated users go to the login page.
 func (s *Handlers) HandleIndex() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		sess, err := s.session.Get(r)
 		if err == nil && s.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/sources", http.StatusSeeOther)
+			http.Redirect(w, r, "/hooks", http.StatusSeeOther)

 			return
 		}
@@ -4,7 +4,7 @@ package handlers_test
 // this package reach a value an UNAUTHENTICATED client picks outright
 // and of a length it picks outright:
 //
-//   - the unknown-entrypoint DEBUG line on /webhook/{uuid}, whose
+//   - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
 //     path segment matched no stored entrypoint and so is bounded by
 //     nothing;
 //   - the failed-login DEBUG lines, whose username is a form field.
@@ -190,12 +190,12 @@ func assertNoClientText(t *testing.T, buf *bytes.Buffer) {
 // route pattern.
 func receiverRouter(h *handlers.Handlers) *chi.Mux {
 	router := chi.NewRouter()
-	router.Post("/webhook/{uuid}", h.HandleWebhook())
+	router.Post("/h/{uuid}", h.HandleWebhook())

 	return router
 }

-// postReceiver sends one POST at /webhook/<segment>.
+// postReceiver sends one POST at /h/<segment>.
 //
 // RawPath is cleared after parsing so chi routes on the decoded path
 // and the handler sees the raw bytes rather than their percent-escaped
@@ -210,7 +210,7 @@ func postReceiver(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodPost,
-		"/webhook/"+url.PathEscape(segment),
+		"/h/"+url.PathEscape(segment),
 		strings.NewReader(""),
 	)
 	req.URL.RawPath = ""
@@ -339,11 +339,9 @@ const storedUserPassword = "correct-horse-battery-staple"
 // storedFillBytes is the raw length of the client-chosen value in
 // those accounts' usernames. It is well past the 512-byte field
 // budget, so the line is still truncated, but short enough that the
-// session cookie a successful login writes stays inside
-// securecookie's 4 KB limit: the cookie is written BEFORE the
-// "user logged in" line, so an 8 KB username answers 500 and never
-// reaches it.
-const storedFillBytes = 1024
+// whole username, markers and fill name included, stays within
+// database.MaxUsernameBytes.
+const storedFillBytes = 960

 // storedFill builds a username fill of storedFillBytes raw bytes out
 // of repetitions of ch, with both markers at its far end.
@@ -509,7 +507,7 @@ func TestVerificationCapacity_LogLineDoesNotTrackPathSize(
 					http.StatusServiceUnavailable,
 					postLoginAtPath(
 						t, h,
-						"/source/"+url.PathEscape(
+						"/hook/"+url.PathEscape(
 							oversizedFill(fill),
 						)+"/login",
 					),
@@ -220,7 +220,7 @@ func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -267,7 +267,7 @@ func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -323,7 +323,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -337,7 +337,7 @@ func TestHandleSourceDelete_FailedDeleteKeepsEverything(
 	)
 	assert.Empty(
 		t, w.Header().Get("Location"),
-		"a failed deletion must not redirect to /sources",
+		"a failed deletion must not redirect to /hooks",
 	)

 	assert.Equal(
@@ -402,7 +402,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/delete",
+		"/hook/"+wh.ID+"/delete",
 		cookies,
 		map[string]string{paramSourceID: wh.ID},
 	)
@@ -411,7 +411,7 @@ func TestHandleSourceDelete_RemovesConfigAndEventDatabase(
 	h.HandleSourceDelete().ServeHTTP(w, req)

 	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/sources", w.Header().Get("Location"))
+	assert.Equal(t, "/hooks", w.Header().Get("Location"))

 	assert.Equal(
 		t, int64(0),
@@ -465,7 +465,7 @@ func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete",
+		"/hook/"+wh.ID+"/targets/"+tgt.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -515,7 +515,7 @@ func TestHandleTargetDelete_KeepsWriterWhenDatabaseTargetRemains(
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+doomed.ID+"/delete",
+		"/hook/"+wh.ID+"/targets/"+doomed.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -563,7 +563,7 @@ func TestHandleTargetDelete_KeepsWriterWhenOtherTypeDeleted(
 	)

 	req := postRequest(
-		"/source/"+wh.ID+"/targets/"+other.ID+"/delete",
+		"/hook/"+wh.ID+"/targets/"+other.ID+"/delete",
 		cookies,
 		map[string]string{
 			paramSourceID: wh.ID,
@@ -81,7 +81,7 @@ func (f *baseURLFixture) entrypointURL(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+f.webhook,
+		"/hook/"+f.webhook,
 		nil,
 	)
 	req.Host = host
@@ -213,7 +213,7 @@ func TestSourceDetailBaseURL_ForwardedProtoSpellings(t *testing.T) {

 			assert.Equal(
 				t,
-				tc.scheme+"://"+host+"/webhook/"+fixture.path,
+				tc.scheme+"://"+host+"/h/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto(tc.header),
 				),
@@ -244,7 +244,7 @@ func TestSourceDetailBaseURL_DirectTLSBeatsPlaintextHeader(

 	assert.Equal(
 		t,
-		"https://"+host+"/webhook/"+fixture.path,
+		"https://"+host+"/h/"+fixture.path,
 		got,
 		"a connection this process terminated with TLS "+
 			"outranks a header claiming plaintext",
@@ -272,7 +272,7 @@ func TestSourceDetailBaseURL_KeepsHostAuthority(t *testing.T) {

 			assert.Equal(
 				t,
-				"https://"+host+"/webhook/"+fixture.path,
+				"https://"+host+"/h/"+fixture.path,
 				fixture.entrypointURL(
 					t, host, forwardedProto("HTTPS"),
 				),
@@ -65,7 +65,7 @@ func renderSourceDetailPage(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+webhookID,
+		"/hook/"+webhookID,
 		nil,
 	)

@@ -28,7 +28,7 @@ func deleteTargetThroughHandler(
 	t.Helper()

 	req := postRequest(
-		"/source/"+webhookID+"/targets/"+targetID+"/delete",
+		"/hook/"+webhookID+"/targets/"+targetID+"/delete",
 		authenticatedCookies(
 			t, sess, deleteTestUserID, deleteTestUsername,
 		),
@@ -84,7 +84,7 @@ func renderSourceLogsPageWithQuery(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodGet,
-		"/source/"+webhookID+"/logs"+query,
+		"/hook/"+webhookID+"/events"+query,
 		nil,
 	)

@@ -330,7 +330,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
 	)

 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }

@@ -581,7 +581,7 @@ func (h *Handlers) applyWebhookEdit(
 	}

 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }

@@ -664,7 +664,7 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}

-	http.Redirect(w, r, "/sources", http.StatusSeeOther)
+	http.Redirect(w, r, "/hooks", http.StatusSeeOther)
 }

 // commitWebhookDeletion soft-deletes a webhook's entrypoints,
@@ -1257,7 +1257,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 		}

 		http.Redirect(
-			w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+			w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 		)
 	}
 }
@@ -1313,7 +1313,7 @@ func (h *Handlers) processTargetCreate(
 	//
 	// Every field here is read with PostFormValue, not FormValue.
 	// FormValue falls back to the query string, which would let
-	// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
+	// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
 	// configure a target from a value the request line carries — and
 	// the request line, unlike the body, is what logs, proxies,
 	// Referer headers and error trackers record.
@@ -1370,7 +1370,7 @@ func (h *Handlers) processTargetCreate(
 	}

 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }

@@ -1428,7 +1428,7 @@ type targetFormInput struct {
 //
 // Every field is read with PostFormValue, not FormValue. FormValue
 // falls back to the query string, which would let
-// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
+// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
 // configure a target from a value the request line carries — and the
 // request line, unlike the body, is what logs, proxies, Referer
 // headers and error trackers record. The headers field is under the
@@ -1707,7 +1707,7 @@ func (h *Handlers) deleteChildResource(

 		http.Redirect(
 			w, r,
-			"/source/"+webhook.ID,
+			"/hook/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}
@@ -1804,7 +1804,7 @@ func (h *Handlers) toggleChildResource(

 		http.Redirect(
 			w, r,
-			"/source/"+webhook.ID,
+			"/hook/"+webhook.ID,
 			http.StatusSeeOther,
 		)
 	}
@@ -105,7 +105,7 @@ func submitCreate(
 		form.Set("retention_days", *retention)
 	}

-	req := formRequest("/sources/new", cookies, form, nil)
+	req := formRequest("/hooks/new", cookies, form, nil)
 	w := httptest.NewRecorder()

 	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -265,7 +265,7 @@ func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {

 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/sources/new", env.cookies, nil),
+		w, getRequest(t, "/hooks/new", env.cookies, nil),
 	)

 	require.Equal(t, http.StatusOK, w.Code)
@@ -402,7 +402,7 @@ func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	form.Set("description", description)
 	form.Set("retention_days", "nonsense")

-	req := formRequest("/sources/new", env.cookies, form, nil)
+	req := formRequest("/hooks/new", env.cookies, form, nil)
 	w := httptest.NewRecorder()

 	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
@@ -430,7 +430,7 @@ func submitEdit(
 	form.Set("retention_days", retention)

 	req := formRequest(
-		"/source/"+wh.ID+"/edit",
+		"/hook/"+wh.ID+"/edit",
 		env.cookies,
 		form,
 		map[string]string{sourceIDParam: wh.ID},
@@ -512,7 +512,7 @@ func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	)

 	req := getRequest(
-		t, "/source/"+wh.ID+"/edit", env.cookies,
+		t, "/hook/"+wh.ID+"/edit", env.cookies,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
@@ -567,7 +567,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(

 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/sources", env.cookies, nil),
+		listW, getRequest(t, "/hooks", env.cookies, nil),
 	)

 	require.Equal(t, http.StatusOK, listW.Code)
@@ -578,7 +578,7 @@ func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 	env.handlers.HandleSourceDetail().ServeHTTP(
 		detailW,
 		getRequest(
-			t, "/source/"+wh.ID, env.cookies,
+			t, "/hook/"+wh.ID, env.cookies,
 			map[string]string{sourceIDParam: wh.ID},
 		),
 	)
@@ -76,11 +76,11 @@ func postTargetCreate(
 	router := chi.NewRouter()
 	router.Use(mw.Logging())
 	router.Post(
-		"/source/{sourceID}/targets",
+		"/hook/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)

-	target := "/source/" + webhookID + "/targets"
+	target := "/hook/" + webhookID + "/targets"
 	if query != "" {
 		target += "?" + query
 	}
@@ -114,7 +114,7 @@ func postTargetCreate(
 // regression test for the ingress leak. r.FormValue falls back to the
 // query string when a field is absent from the POST body, so
 //
-//	POST /source/{id}/targets?url=https://hooks.slack.com/services/...
+//	POST /hook/{id}/targets?url=https://hooks.slack.com/services/...
 //
 // with an empty url field used to create a working target from a value
 // carried on the request line — where logs, proxies, Referer headers
@@ -47,7 +47,7 @@ type targetEditView struct {
 //
 // This page is the one place the full destination URL and header
 // values are shown. It is reachable only through the
-// /source/{sourceID} route group, which supplies RequireAuth and
+// /hook/{sourceID} route group, which supplies RequireAuth and
 // NoCache, and only for a target of a webhook the session's user
 // owns; masking (delivery.TargetView) is unchanged everywhere else.
 func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
@@ -163,7 +163,7 @@ func (h *Handlers) applyTargetEdit(
 	}

 	http.Redirect(
-		w, r, "/source/"+webhook.ID, http.StatusSeeOther,
+		w, r, "/hook/"+webhook.ID, http.StatusSeeOther,
 	)
 }

@@ -42,15 +42,15 @@ const (
 func targetRouter(env *sourceTestEnv) *chi.Mux {
 	router := chi.NewRouter()
 	router.Post(
-		"/source/{sourceID}/targets",
+		"/hook/{sourceID}/targets",
 		env.handlers.HandleTargetCreate(),
 	)
 	router.Get(
-		"/source/{sourceID}/targets/{targetID}/edit",
+		"/hook/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEdit(),
 	)
 	router.Post(
-		"/source/{sourceID}/targets/{targetID}/edit",
+		"/hook/{sourceID}/targets/{targetID}/edit",
 		env.handlers.HandleTargetEditSubmit(),
 	)

@@ -117,7 +117,7 @@ func seedHTTPTarget(

 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets", form,
+		"/hook/"+webhook.ID+"/targets", form,
 	)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())

@@ -188,7 +188,7 @@ func submitTargetEdit(
 ) *httptest.ResponseRecorder {
 	return serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhookID+"/targets/"+targetID+"/edit",
+		"/hook/"+webhookID+"/targets/"+targetID+"/edit",
 		form,
 	)
 }
@@ -401,7 +401,7 @@ func TestHandleTargetEdit_PrefillsTheStoredValuesUnmasked(

 	w := serveTarget(
 		env, http.MethodGet,
-		"/source/"+webhook.ID+"/targets/"+target.ID+"/edit",
+		"/hook/"+webhook.ID+"/targets/"+target.ID+"/edit",
 		nil,
 	)
 	require.Equal(t, http.StatusOK, w.Code)
@@ -508,7 +508,7 @@ func assertEditIgnoresQueryString(

 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets/"+target.ID+
+		"/hook/"+webhook.ID+"/targets/"+target.ID+
 			"/edit?url="+url.QueryEscape(editReplacedURL)+
 			"&headers="+url.QueryEscape(editAuthHeader),
 		form,
@@ -592,7 +592,7 @@ func assertTargetOfAnotherWebhook404s(

 	get := serveTarget(
 		env, http.MethodGet,
-		"/source/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
+		"/hook/"+mine.ID+"/targets/"+target.ID+"/edit", nil,
 	)
 	assert.Equal(t, http.StatusNotFound, get.Code)

@@ -630,7 +630,7 @@ func assertWebhookOfAnotherUser404s(

 	w := serveTarget(
 		env, http.MethodGet,
-		"/source/"+other.ID+"/targets/"+target.ID+"/edit", nil,
+		"/hook/"+other.ID+"/targets/"+target.ID+"/edit", nil,
 	)

 	assert.Equal(t, http.StatusNotFound, w.Code)
@@ -102,7 +102,7 @@ func createWithRetries(

 	w := serveTarget(
 		env, http.MethodPost,
-		"/source/"+webhook.ID+"/targets",
+		"/hook/"+webhook.ID+"/targets",
 		createRetriesForm(retries),
 	)

@@ -54,8 +54,7 @@ func renderPage(
 }

 // TestNavbarUsesWebhookTerminology pins the user-visible navigation
-// label to "Webhooks". The /sources route is deliberately unchanged, so
-// the assertion targets the link text rather than the href.
+// label to "Webhooks" and its link to the webhook list at /hooks.
 func TestNavbarUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()

@@ -95,15 +94,11 @@ func TestNavbarUsesWebhookTerminology(t *testing.T) {
 		t, body, ">Sources<",
 		"no user-visible element may still be labelled Sources",
 	)
-	assert.Contains(
-		t, body, `href="/sources"`,
-		"the /sources route itself must not change",
-	)
+	assert.Contains(t, body, `href="/hooks"`)
 }

 // TestEditPageUsesWebhookTerminology pins the edit page's heading and
-// its back link. The link's href still points at /source/{id}, which is
-// intentional: only user-visible copy changes.
+// its back link to the webhook page at /hook/{id}.
 func TestEditPageUsesWebhookTerminology(t *testing.T) {
 	t.Parallel()

@@ -130,7 +125,57 @@ func TestEditPageUsesWebhookTerminology(t *testing.T) {

 	assert.Contains(t, body, "Edit Webhook")
 	assert.NotContains(t, body, ">Sources<")
-	assert.Contains(t, body, `href="/source/wh-1"`)
+	assert.Contains(t, body, `href="/hook/wh-1"`)
+}
+
+// TestEventLogPageIsCalledFullEventLog pins the one name the event log
+// page at /hook/{id}/events goes by: both links to it on the webhook
+// page, and its own heading, read "Full Event Log".
+func TestEventLogPageIsCalledFullEventLog(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	app := newTestApp(t, &h, &sess)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	// A pointer, as in the handlers: source_detail.html calls
+	// Webhook.RetentionLabel, a pointer method. Both pages only range
+	// over their lists, and a list left out renders as empty, so the
+	// lists are left out.
+	webhook := &database.Webhook{Name: "wh", RetentionDays: 14}
+	webhook.ID = testWebhookID
+
+	detailBody := renderPage(
+		t, h, sess, "source_detail.html", map[string]any{
+			dataKeyWebhook: webhook,
+		},
+	)
+
+	assert.Contains(
+		t, detailBody,
+		`<a href="/hook/wh-1/events" class="btn-secondary">Full Event Log</a>`,
+		"the button at the top of the webhook page",
+	)
+	assert.Contains(
+		t, detailBody,
+		`<a href="/hook/wh-1/events" class="btn-text text-sm">Full Event Log</a>`,
+		"the link under recent events",
+	)
+
+	logBody := renderPage(t, h, sess, "source_logs.html", map[string]any{
+		dataKeyWebhook: webhook,
+		"TotalEvents":  int64(0),
+	})
+
+	assert.Contains(
+		t, logBody,
+		`<h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>`,
+	)
 }

 // TestCreateFormRetentionCopyMatchesBehaviour pins the create form's
@@ -283,7 +328,7 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 		t, body,
 		`<code id="entrypoint-url-ep-1"`,
 	)
-	assert.Contains(t, body, "https://hooks.example.com/webhook/abc123")
+	assert.Contains(t, body, "https://hooks.example.com/h/abc123")
 	assert.Contains(
 		t, body,
 		`hidden data-copy-target="entrypoint-url-ep-1"`,
@@ -131,7 +131,7 @@ func (h *Handlers) lookupEntrypoint(
 		"path = ?", entrypointUUID,
 	).First(&entrypoint)
 	if result.Error != nil {
-		// The receiver is unauthenticated and /webhook/{uuid}
+		// The receiver is unauthenticated and /h/{uuid}
 		// matches any single segment, so this value is entirely
 		// client-chosen on exactly the branch where the lookup
 		// failed. DEBUG is off by default; the cap is what keeps
@@ -201,7 +201,7 @@ func TestTruncate_LeavesShortValuesAlone(t *testing.T) {
 	t.Parallel()

 	for _, s := range []string{
-		"", "GET", "/source/abc/edit", "Mozilla/5.0 (X11)",
+		"", "GET", "/hook/abc/edit", "Mozilla/5.0 (X11)",
 	} {
 		assert.Equal(t, s, logfield.Truncate(s, budget))
 	}
@@ -119,7 +119,7 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
 	)

 	router.HandleFunc(
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 		func(w http.ResponseWriter, r *http.Request) {
 			// Stands in for the real handler: an unknown entrypoint
 			// UUID 404s, a known one succeeds.
@@ -271,11 +271,11 @@ func TestAccessLog_InventedReceiverPathsLogRoutePattern(t *testing.T) {
 	assertFloodIsBounded(
 		t,
 		func(i int) string {
-			return "/webhook/" + attackerMarker +
+			return "/h/" + attackerMarker +
 				strings.Repeat("x", i) + "?q=" + attackerMarker
 		},
 		http.StatusNotFound,
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 	)
 }

@@ -346,10 +346,10 @@ type sizeCase struct {
 func lineSizeCases() map[string]sizeCase {
 	cases := map[string]sizeCase{
 		"oversized path segment": {
-			target: "/webhook/" + attackerMarker +
+			target: "/h/" + attackerMarker +
 				strings.Repeat("x", oversizedSegmentBytes),
 			wantStatus: http.StatusNotFound,
-			wantURL:    "/webhook/{uuid}",
+			wantURL:    "/h/{uuid}",
 			bound:      maxLineBytes,
 		},
 		// /.well-known/healthcheck answers 200 to anyone and has no
@@ -605,14 +605,14 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
 	router := accessLogRouter(m)

 	assert.Equal(
-		t, http.StatusOK, get(t, router, "/webhook/known?src=ci"),
+		t, http.StatusOK, get(t, router, "/h/known?src=ci"),
 	)

 	// The path resolved against a stored entrypoint, so it stays. The
 	// query never does: see TestAccessLog_UnauthenticatedSuccess...
 	entries := accessLogEntries(t, buf)
 	require.Len(t, entries, 1)
-	assert.Equal(t, "/webhook/known?(redacted)", entries[0]["url"])
+	assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
 	assert.NotContains(t, buf.String(), "src=ci")
 }

@@ -640,7 +640,7 @@ func TestAccessLog_RetainsEveryOtherField(t *testing.T) {
 	assert.Equal(
 		t,
 		http.StatusNotFound,
-		get(t, router, "/webhook/"+attackerMarker),
+		get(t, router, "/h/"+attackerMarker),
 	)

 	entries := accessLogEntries(t, buf)
@@ -41,7 +41,7 @@ func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 		// CSRF is registered ahead of RequireAuth on every route
 		// group that uses it, so this WARN is reachable by an
 		// unauthenticated client: a POST with no token to
-		// /source/<any length of any text>/edit lands here. The
+		// /hook/<any length of any text>/edit lands here. The
 		// method and path are capped against the same budgets as
 		// the access log. remote_addr is set by net/http from the
 		// accepted connection rather than by the client, and
@@ -383,7 +383,7 @@ func TestLogLines_ClientChosenPathDoesNotSizeTheLine(t *testing.T) {
 						t, newHandler,
 					)

-					path := "/source/" +
+					path := "/hook/" +
 						oversizedPathSegment(fill) + "/edit"

 					assert.Equal(
@@ -434,7 +434,7 @@ func TestLoginThrottle_LogLineDoesNotTrackPathSize(t *testing.T) {
 				req := httptest.NewRequestWithContext(
 					context.Background(),
 					http.MethodPost,
-					"/source/"+
+					"/hook/"+
 						oversizedPathSegment(fill)+"/login",
 					nil,
 				)
@@ -499,7 +499,7 @@ func TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog(
 							http.StatusRequestEntityTooLarge,
 							postOversize(
 								h,
-								"/source/"+segment(i)+"/edit",
+								"/hook/"+segment(i)+"/edit",
 							),
 						)
 					}
@@ -40,7 +40,7 @@ const unmatchedMethod = unmatchedRoute
 //
 // The pattern is what bounds the label's domain to the routes the
 // service registers. The path does not bound it at all — every byte
-// after /webhook/ is client-chosen, so labelling by path lets any
+// after /h/ is client-chosen, so labelling by path lets any
 // unauthenticated client mint permanent series at will, and publishes
 // the entrypoint UUID (the receiver's only credential) in the scrape
 // while doing it.
@@ -50,7 +50,7 @@ func realMethods() []string {
 // dimension varying, so any series growth a probe produces is the
 // method label's and nothing else's.
 func methodProbePath() string {
-	return "/webhook/" + uuid.NewString()
+	return "/h/" + uuid.NewString()
 }

 // inventedMethods returns n distinct RFC 9110 method tokens that no
@@ -28,7 +28,7 @@ const (

 	// receiverRoutePattern is the one handler label every receiver
 	// request must produce, however the client varies the path.
-	receiverRoutePattern = "/webhook/{uuid}"
+	receiverRoutePattern = "/h/{uuid}"

 	// okRoute is a static route used to pin that the response-writer
 	// interceptor still reports status and size after the handler id
@@ -143,13 +143,13 @@ func drivePaths(
 	return drive(t, h, probes)
 }

-// receiverPaths returns n distinct /webhook/ paths, each naming a
+// receiverPaths returns n distinct /h/ paths, each naming a
 // fresh UUID exactly as an unauthenticated flood would.
 func receiverPaths(n int) []string {
 	paths := make([]string, 0, n)

 	for range n {
-		paths = append(paths, "/webhook/"+uuid.NewString())
+		paths = append(paths, "/h/"+uuid.NewString())
 	}

 	return paths
@@ -220,7 +220,7 @@ func keys(set map[string]struct{}) []string {

 // TestMetrics_DistinctReceiverPathsMintOneLabelSet is the direct
 // assertion the issue asks for: N requests to N distinct
-// /webhook/<uuid> paths must produce exactly ONE handler label, the
+// /h/<uuid> paths must produce exactly ONE handler label, the
 // route pattern. Before the fix this produced N of them.
 func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	t.Parallel()
@@ -250,7 +250,7 @@ func TestMetrics_DistinctReceiverPathsMintOneLabelSet(t *testing.T) {
 	// The scrape must not republish the UUIDs it was driven with.
 	// They are the receiver's only credential.
 	for _, p := range paths {
-		id := strings.TrimPrefix(p, "/webhook/")
+		id := strings.TrimPrefix(p, "/h/")
 		for label := range labels {
 			assert.NotContains(
 				t, label, id,
@@ -354,7 +354,7 @@ func TestMetrics_UnmatchedPathsCollapseToTheSentinel(t *testing.T) {
 		if i%2 == 0 {
 			paths = append(paths, "/"+id)
 		} else {
-			paths = append(paths, "/webhook/"+id+"/"+id)
+			paths = append(paths, "/h/"+id+"/"+id)
 		}
 	}

@@ -257,7 +257,7 @@ func concreteLogURL(r *http.Request) string {
 //
 // 3xx and 4xx responses get the chi route pattern instead. Those are
 // the outcomes an unauthenticated client drives for free: 404 or 429
-// on any invented /webhook/ path, 303 to the login page on any
+// on any invented /h/ path, 303 to the login page on any
 // invented /user/ path. Logging the concrete URL there lets a flood
 // write attacker-chosen text, of attacker-chosen length, into the
 // operator's log at one line per request. The pattern comes from the
@@ -560,7 +560,7 @@ func (s *Middleware) MaxBodySize(
 				// internal/server/routes.go), so an
 				// unauthenticated client reaches it with a path
 				// of its own choosing and its own length —
-				// POST /source/<8 KB>/edit with an oversize
+				// POST /hook/<8 KB>/edit with an oversize
 				// declared Content-Length costs nothing to
 				// send. At WARN, on by default, that is a
 				// write into the operator's log sized by the
@@ -640,7 +640,7 @@ func TestNoCache_SetsHeaders(t *testing.T) {

 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodGet, "/sources", nil,
+		http.MethodGet, "/hooks", nil,
 	)
 	w := httptest.NewRecorder()

@@ -63,7 +63,7 @@ const (

 	// receiverAggregateMultiplier scales the configured
 	// per-entrypoint receiver limit into the aggregate limit one
-	// client IP may spend across the whole /webhook/* route. Ten
+	// client IP may spend across the whole /h/* route. Ten
 	// entrypoints' worth lets a single sender address drive several
 	// entrypoints at their full rate, while still capping what one
 	// address costs the unauthenticated receiver.
@@ -390,7 +390,7 @@ func (m *Middleware) postRateLimit(
 // It is Config.ReceiverRateLimit requests per minute.
 //
 // That limit alone bounds nothing in aggregate. The route pattern
-// /webhook/{uuid} matches any single segment, so a client that
+// /h/{uuid} matches any single segment, so a client that
 // invents a fresh path per request mints a fresh bucket per request
 // and never refills one — and every such request still reaches the
 // handler's entrypoint lookup before it 404s. The outer limit is
@@ -275,7 +275,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// pass.
 	for i := range limit {
 		w := receiverPost(
-			handler, "9.9.9.9:1234", "/webhook/uuid-a",
+			handler, "9.9.9.9:1234", "/h/uuid-a",
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -286,7 +286,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {
 	// The next request over the limit is rejected with a 429
 	// carrying a Retry-After header.
 	w := receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-a",
+		handler, "9.9.9.9:1234", "/h/uuid-a",
 	)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 	assert.NotEmpty(
@@ -296,7 +296,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {

 	// The same IP is not limited on a different entrypoint.
 	w = receiverPost(
-		handler, "9.9.9.9:1234", "/webhook/uuid-b",
+		handler, "9.9.9.9:1234", "/h/uuid-b",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -305,7 +305,7 @@ func TestReceiverRateLimit_LimitsPerIPAndPath(t *testing.T) {

 	// A different IP is not limited on the same entrypoint.
 	w = receiverPost(
-		handler, "8.8.8.8:1234", "/webhook/uuid-a",
+		handler, "8.8.8.8:1234", "/h/uuid-a",
 	)
 	assert.Equal(
 		t, http.StatusOK, w.Code,
@@ -322,7 +322,7 @@ func TestReceiverRateLimit_CountsEveryMethod(t *testing.T) {
 	const (
 		limit = 2
 		ip    = "7.7.7.7:1234"
-		path  = "/webhook/uuid-c"
+		path  = "/h/uuid-c"
 	)

 	handler := receiverLimitedHandler(t, limit)
@@ -715,7 +715,7 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	// none of them shares a per-entrypoint bucket with another.
 	for i := range aggregate {
 		w := receiverPost(
-			handler, ip, fmt.Sprintf("/webhook/invented-%d", i),
+			handler, ip, fmt.Sprintf("/h/invented-%d", i),
 		)
 		assert.Equal(
 			t, http.StatusOK, w.Code,
@@ -724,17 +724,17 @@ func TestReceiverRateLimit_LimitsAggregateAcrossInventedPaths(
 	}

 	w := receiverPost(
-		handler, ip, fmt.Sprintf("/webhook/invented-%d", aggregate),
+		handler, ip, fmt.Sprintf("/h/invented-%d", aggregate),
 	)
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"a client must not be able to raise its aggregate rate "+
-			"against /webhook/* by varying the path",
+			"against /h/* by varying the path",
 	)

 	// The aggregate limit is still per client IP: exhausting one
 	// address must not throttle another.
-	w = receiverPost(handler, "6.6.6.7:1234", "/webhook/invented-0")
+	w = receiverPost(handler, "6.6.6.7:1234", "/h/invented-0")
 	assert.Equal(
 		t, http.StatusOK, w.Code,
 		"a different client IP must not be affected",
@@ -771,7 +771,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 	// limit requests are served; the rest are rejected by the
 	// per-entrypoint limiter but still count against the aggregate.
 	for i := range aggregate {
-		w := receiverPost(handler, ip, "/webhook/exhausted")
+		w := receiverPost(handler, ip, "/h/exhausted")

 		want := http.StatusTooManyRequests
 		if i < limit {
@@ -784,7 +784,7 @@ func TestReceiverRateLimit_RejectedRequestsCountTowardAggregate(
 		)
 	}

-	w := receiverPost(handler, ip, "/webhook/never-used")
+	w := receiverPost(handler, ip, "/h/never-used")
 	assert.Equal(
 		t, http.StatusTooManyRequests, w.Code,
 		"requests rejected per entrypoint must still count "+
@@ -823,7 +823,7 @@ func TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer(
 	const (
 		limit = 3
 		peer  = "203.0.113.10:44444"
-		path  = "/webhook/uuid-d"
+		path  = "/h/uuid-d"
 	)

 	handler := receiverLimitedHandler(t, limit)
@@ -92,11 +92,25 @@ func (s *Server) setupGlobalMiddleware() {
 func (s *Server) setupRoutes() {
 	s.router.Get("/", s.h.HandleIndex())

-	s.router.Mount(
-		"/s",
-		http.StripPrefix("/s", http.FileServer(http.FS(static.Static))),
+	// Static assets answer GET and HEAD only. chi's default 405
+	// carries no Allow header, so this group supplies its own.
+	staticFiles := http.StripPrefix(
+		"/s", http.FileServer(http.FS(static.Static)),
 	)

+	s.router.Route("/s", func(r chi.Router) {
+		r.MethodNotAllowed(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Allow", "GET, HEAD")
+			http.Error(
+				w,
+				"Method Not Allowed",
+				http.StatusMethodNotAllowed,
+			)
+		})
+		r.Method(http.MethodGet, "/*", staticFiles)
+		r.Method(http.MethodHead, "/*", staticFiles)
+	})
+
 	s.router.Route("/api/v1", func(_ chi.Router) {
 		// API routes will be added here.
 	})
@@ -168,7 +182,7 @@ func (s *Server) setupUserRoutes() {
 }

 func (s *Server) setupSourceRoutes() {
-	s.router.Route("/sources", func(r chi.Router) {
+	s.router.Route("/hooks", func(r chi.Router) {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
@@ -180,7 +194,7 @@ func (s *Server) setupSourceRoutes() {
 		r.Post("/new", s.h.HandleSourceCreateSubmit())
 	})

-	s.router.Route("/source/{sourceID}", func(r chi.Router) {
+	s.router.Route("/hook/{sourceID}", func(r chi.Router) {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
@@ -191,14 +205,14 @@ func (s *Server) setupSourceRoutes() {
 		r.Get("/edit", s.h.HandleSourceEdit())
 		r.Post("/edit", s.h.HandleSourceEditSubmit())
 		r.Post("/delete", s.h.HandleSourceDelete())
-		r.Get("/logs", s.h.HandleSourceLogs())
+		r.Get("/events", s.h.HandleSourceLogs())
 		// The log page renders each body only up to its cap, so
 		// this is the only route that serves a whole one. It
 		// belongs to this group for its RequireAuth and
 		// NoCache; see HandleEventBodyDownload for the headers
 		// that keep the bytes it returns inert.
 		r.Get(
-			"/logs/{eventID}/body",
+			"/events/{eventID}/body",
 			s.h.HandleEventBodyDownload(),
 		)
 		// Replay is the one page action that queues outbound work:
@@ -265,7 +279,7 @@ func (s *Server) setupSourceRoutes() {

 func (s *Server) setupWebhookRoutes() {
 	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 		s.h.HandleWebhook(),
 	)
 }
@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"testing"
@@ -220,9 +221,21 @@ func (e *testEnv) csrfFrom(
 	// out of the markup has to be unescaped before it is submitted.
 	token := html.UnescapeString(match[1])

-	combined := make([]*http.Cookie, 0, len(cookies))
-	combined = append(combined, cookies...)
-	combined = append(combined, w.Result().Cookies()...)
+	// A cookie the page sets replaces the one of the same name, as in
+	// a browser. Sent both, the server would read the first, older one.
+	set := w.Result().Cookies()
+	combined := make([]*http.Cookie, 0, len(cookies)+len(set))
+
+	for _, c := range cookies {
+		replaced := slices.ContainsFunc(set, func(n *http.Cookie) bool {
+			return n.Name == c.Name
+		})
+		if !replaced {
+			combined = append(combined, c)
+		}
+	}
+
+	combined = append(combined, set...)

 	return token, combined
 }
@@ -396,13 +409,15 @@ func (e *testEnv) storedHash(t *testing.T, username string) string {

 // --- /s static group ---

-// TestStaticServesEveryMethod pins what the static mount actually
-// answers. chi's Mount registers the handler for all methods and
-// http.FileServer only special-cases HEAD (by suppressing the body),
-// so a POST or a DELETE to an asset is served the file rather than
-// refused. The README documents this; the test is what keeps the two
-// from drifting.
-func TestStaticServesEveryMethod(t *testing.T) {
+// TestStaticServesOnlyGetAndHead pins the methods the static group
+// answers: GET and HEAD are served the asset, and the other methods
+// chi routes (POST, PUT, DELETE and the rest) are refused with 405
+// and an Allow header naming those two. A method chi does not route,
+// such as PROPFIND, is refused with 405 by the top-level router
+// before it reaches the static group, so it gets no Allow header.
+// The README documents this; the test is what keeps the two from
+// drifting.
+func TestStaticServesOnlyGetAndHead(t *testing.T) {
 	t.Parallel()

 	env := newTestEnv(t)
@@ -417,6 +432,7 @@ func TestStaticServesEveryMethod(t *testing.T) {
 		http.MethodPost,
 		http.MethodPut,
 		http.MethodDelete,
+		"PROPFIND",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
@@ -428,18 +444,38 @@ func TestStaticServesEveryMethod(t *testing.T) {
 			w := httptest.NewRecorder()
 			env.router.ServeHTTP(w, req)

-			assert.Equal(t, http.StatusOK, w.Code,
-				"static mount answers every method")
-
-			if method == http.MethodHead {
-				assert.Empty(t, w.Body.Bytes(),
-					"HEAD must not carry a body")
-
-				return
-			}
-
+			switch method {
+			case http.MethodGet:
+				assert.Equal(t, http.StatusOK, w.Code)
 				assert.Equal(t, body, w.Body.Bytes(),
 					"the asset itself is returned")
+			case http.MethodHead:
+				assert.Equal(t, http.StatusOK, w.Code)
+				assert.Empty(t, w.Body.Bytes(),
+					"HEAD must not carry a body")
+			case "PROPFIND":
+				assert.Equal(
+					t, http.StatusMethodNotAllowed, w.Code,
+				)
+				assert.Empty(t, w.Header().Get("Allow"),
+					"chi refuses a method it does not route "+
+						"before the static group runs")
+				assert.NotContains(
+					t, w.Body.String(), string(body),
+					"a refused method must not get the asset",
+				)
+			default:
+				assert.Equal(
+					t, http.StatusMethodNotAllowed, w.Code,
+				)
+				assert.Equal(
+					t, "GET, HEAD", w.Header().Get("Allow"),
+				)
+				assert.NotContains(
+					t, w.Body.String(), string(body),
+					"a refused method must not get the asset",
+				)
+			}
 		})
 	}
 }
@@ -591,6 +627,59 @@ func TestPagesLogin_CorrectPasswordSurvivesASpentBudget(
 	)
 }

+// TestPagesLogin_CookiesFromAnEarlierDatabase is
+// https://git.eeqj.de/sneak/webhooker/issues/359. A new database
+// brings a new session key, and the operator's browser still holds
+// the session and CSRF cookies signed with the old one. Logging in
+// must work as from a fresh browser and leave cookies the new key
+// accepts.
+func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
+	t.Parallel()
+
+	const (
+		username = "operator"
+		password = "correct-horse-battery-staple"
+	)
+
+	earlier := newTestEnv(t)
+	earlierID, _ := earlier.seedUser(t, username, password)
+	_, stale := earlier.csrfFrom(t, "/pages/login", nil)
+	stale = append(stale, earlier.authCookies(t, earlierID, username)...)
+
+	env := newTestEnv(t)
+	env.seedUser(t, username, password)
+
+	token, cookies := env.csrfFrom(t, "/pages/login", stale)
+
+	form := url.Values{}
+	form.Set("csrf_token", token)
+	form.Set("username", username)
+	form.Set("password", password)
+
+	w := env.post("/pages/login", form, cookies)
+	require.Equal(
+		t, http.StatusSeeOther, w.Code,
+		"a session cookie from another key must not fail the login",
+	)
+
+	// The response deletes the old session cookie and then sets the
+	// new one; a browser keeps the last.
+	var fresh *http.Cookie
+
+	for _, c := range w.Result().Cookies() {
+		if c.Name == session.SessionName {
+			fresh = c
+		}
+	}
+
+	require.NotNil(t, fresh, "login must set a session cookie")
+	assert.Equal(
+		t, "/hooks",
+		env.get("/", []*http.Cookie{fresh}).Header().Get("Location"),
+		"the new session cookie must authenticate",
+	)
+}
+
 // --- /user/{username} group ---

 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -652,7 +741,7 @@ func TestPasswordChange_UnderLimit_Succeeds(t *testing.T) {
 	)
 }

-// --- /source/{sourceID} group ---
+// --- /hook/{sourceID} group ---

 // TestSourceLogs_TruncationLinkDownloadsTheBody walks the whole
 // feature the way a user does: render the event log page through
@@ -680,11 +769,11 @@ func TestSourceLogs_TruncationLinkDownloadsTheBody(t *testing.T) {
 	wh := env.seedWebhook(t, userID)
 	env.seedEvent(t, wh.ID, stored)

-	page := env.get("/source/"+wh.ID+"/logs", cookies)
+	page := env.get("/hook/"+wh.ID+"/events", cookies)
 	require.Equal(t, http.StatusOK, page.Code)

 	link := regexp.MustCompile(
-		`href="(/source/[^"]+/body)"`,
+		`href="(/hook/[^"]+/body)"`,
 	).FindStringSubmatch(page.Body.String())
 	require.Len(
 		t, link, 2,
@@ -730,7 +819,7 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 	const payload = "OWNERS-PAYLOAD-77c1"

 	evt := env.seedEvent(t, wh.ID, payload)
-	path := "/source/" + wh.ID + "/logs/" + evt.ID + "/body"
+	path := "/hook/" + wh.ID + "/events/" + evt.ID + "/body"

 	intruderID, _ := env.seedUser(t, "intruder", "somepassword")
 	intruder := env.authCookies(t, intruderID, "intruder")
@@ -764,7 +853,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	evt := env.seedEvent(t, wh.ID, `{"replay":"me"}`)
 	dlv := env.seedFailedDelivery(t, wh.ID, evt.ID, tgt.ID)

-	path := "/source/" + wh.ID + "/deliveries/" + dlv.ID +
+	path := "/hook/" + wh.ID + "/deliveries/" + dlv.ID +
 		"/replay"

 	assert.Equal(
@@ -790,7 +879,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	// The token and the action URL both come out of the rendered
 	// page, so a typo in either the route pattern or the template
 	// fails here.
-	logsPath := "/source/" + wh.ID + "/logs"
+	logsPath := "/hook/" + wh.ID + "/events"

 	token, cookies := env.csrfFrom(t, logsPath, cookies)

@@ -798,7 +887,7 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	require.Equal(t, http.StatusOK, page.Code)

 	action := regexp.MustCompile(
-		`action="(/source/[^"]+/replay)"`,
+		`action="(/hook/[^"]+/replay)"`,
 	).FindStringSubmatch(page.Body.String())
 	require.Len(
 		t, action, 2,
@@ -823,6 +912,59 @@ func TestDeliveryReplay_PostOnlyAndCSRFProtected(t *testing.T) {
 	)
 }

+// --- /h/{uuid} receiver ---
+
+// TestReceiver_EntrypointURLIsRateLimited takes the entrypoint URL
+// the webhook page shows and posts to it through the production
+// router until the receiver rate limit refuses it. The URL has to
+// reach the receiver, and the limit has to apply to it.
+func TestReceiver_EntrypointURLIsRateLimited(t *testing.T) {
+	t.Parallel()
+
+	const limit = 2
+
+	env := newTestEnvWithConfig(t, &config.Config{
+		DataDir:           t.TempDir(),
+		Environment:       config.EnvironmentDev,
+		ReceiverRateLimit: limit,
+	})
+
+	userID, _ := env.seedUser(t, "receiver", "somepassword")
+	cookies := env.authCookies(t, userID, "receiver")
+
+	wh := env.seedWebhook(t, userID)
+	require.NoError(t, env.db.DB().Omit(clause.Associations).Create(
+		&database.Entrypoint{
+			WebhookID: wh.ID,
+			Path:      "6f1e2a9c-4b7d-4e3a-9c2f-1d8b5a7e3c60",
+			Active:    true,
+		},
+	).Error)
+
+	page := env.get("/hook/"+wh.ID, cookies)
+	require.Equal(t, http.StatusOK, page.Code)
+
+	shown := regexp.MustCompile(`(/h/[^<]+)</code>`).
+		FindStringSubmatch(page.Body.String())
+	require.Len(
+		t, shown, 2, "the webhook page should show the entrypoint URL",
+	)
+
+	for i := range limit {
+		assert.Equal(
+			t, http.StatusOK,
+			env.post(shown[1], url.Values{}, nil).Code,
+			"request %d should reach the receiver", i,
+		)
+	}
+
+	assert.Equal(
+		t, http.StatusTooManyRequests,
+		env.post(shown[1], url.Values{}, nil).Code,
+		"the receiver rate limit must apply to the entrypoint URL",
+	)
+}
+
 // metricsConfig is a Config differing from the routing default only
 // in the two /metrics credentials.
 func metricsConfig(
@@ -55,7 +55,7 @@ func sentryClientOptions(dsn, release string) sentry.ClientOptions {
 //
 // URL is the third such field. NewRequest builds it as
 // scheme://host/path (interfaces.go:183), and on the receiver route
-// that path is /webhook/<uuid> in full — a write capability, not an
+// that path is /h/<uuid> in full — a write capability, not an
 // identifier. It is rebuilt here from the chi route pattern, on every
 // route, keeping the scheme and the host.
 //
@@ -153,7 +153,7 @@ func (c sentryCase) router() http.Handler {
 		sentryhttp.New(sentryhttp.Options{Repanic: true}).Handle,
 	)
 	router.HandleFunc("/pages/login", handler)
-	router.HandleFunc("/webhook/{uuid}", handler)
+	router.HandleFunc("/h/{uuid}", handler)

 	return router
 }
@@ -191,7 +191,7 @@ func sentryLoginRequest(client *sentry.Client) *http.Request {
 // concrete path carries the entrypoint capability.
 func sentryReceiverRequest(client *sentry.Client) *http.Request {
 	return sentryRequest(
-		client, "/webhook/"+sentryReceiverUUID, "payload=hello",
+		client, "/h/"+sentryReceiverUUID, "payload=hello",
 	)
 }

@@ -316,7 +316,7 @@ func TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern(
 		t, marshalEvent(t, event), sentryReceiverUUID,
 	)
 	assert.Equal(
-		t, "http://example.com/webhook/{uuid}", event.Request.URL,
+		t, "http://example.com/h/{uuid}", event.Request.URL,
 	)
 }

@@ -401,7 +401,7 @@ func TestSentryScrub_TransactionDispatchIsUnscrubbedWithoutTheHook(
 func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {
 	t.Parallel()

-	concrete := "https://example.com/webhook/" + sentryReceiverUUID
+	concrete := "https://example.com/h/" + sentryReceiverUUID

 	// A request with no chi routing context on it at all, which is
 	// what an event captured outside the router would carry.
@@ -426,7 +426,7 @@ func TestSentryScrub_FallsBackWithoutARoutePattern(t *testing.T) {

 			event := sentry.NewEvent()
 			event.Request = &sentry.Request{URL: concrete}
-			event.Transaction = "POST /webhook/" +
+			event.Transaction = "POST /h/" +
 				sentryReceiverUUID

 			scrubbed := server.ScrubSentryRequestForTest(
@@ -459,9 +459,9 @@ func TestSentryScrub_WithholdsUnparseableValues(t *testing.T) {

 	event := sentry.NewEvent()
 	event.Request = &sentry.Request{
-		URL: "/webhook/" + sentryReceiverUUID,
+		URL: "/h/" + sentryReceiverUUID,
 	}
-	event.Transaction = "/webhook/" + sentryReceiverUUID
+	event.Transaction = "/h/" + sentryReceiverUUID

 	scrubbed := server.ScrubSentryRequestForTest(event, nil)
 	require.NotNil(t, scrubbed)
@@ -13,9 +13,9 @@ import (

 // TestBaseTemplateScriptsAreServed walks every /s/ script the base
 // template loads on each page and fetches it through the real router.
-// Alpine.js is fetched at build time rather than committed, so nothing
-// in the repo guarantees it is present: this is the check that the page
-// still gets the JavaScript it asks for.
+// Alpine.js is extracted from its tarball in 3p/ at build time, so the
+// file is not in the tree: this is the check that the page still gets
+// the JavaScript it asks for.
 func TestBaseTemplateScriptsAreServed(t *testing.T) {
 	t.Parallel()

@@ -19,8 +19,8 @@ import (
 )

 // The tests below exercise the securecookie codecs underneath the
-// store and nothing else: Session.Get only decodes, so no server-side
-// expiry check takes part in the result. They exist because
+// store and nothing else: they decode through the store itself, so no
+// server-side expiry check takes part in the result. They exist because
 // NewCookieStore gives its codecs a 30-day max age that assigning
 // store.Options does not override, which would let the codec accept a
 // cookie weeks past the cap the cookie attribute advertises.
@@ -75,10 +75,11 @@ func restamp(
 	return base64.URLEncoding.EncodeToString(payload)
 }

-// decodeCookie feeds value back through the store's decode path.
+// decodeCookie feeds value back through the store's decode path. It
+// asks the store rather than Session.Get, which treats a cookie that
+// does not decode as absent and so hides the codec's reason.
 func decodeCookie(
 	t *testing.T,
-	s *session.Session,
 	value string,
 ) (*sessions.Session, error) {
 	t.Helper()
@@ -94,7 +95,7 @@ func decodeCookie(
 		SameSite: http.SameSiteLaxMode,
 	})

-	sess, err := s.Get(req)
+	sess, err := session.NewStore(testKey()).Get(req, session.SessionName)
 	require.NotNil(t, sess)

 	return sess, err
@@ -105,7 +106,7 @@ func TestCodec_AcceptsCookieInsideAbsoluteCap(t *testing.T) {

 	s := testSession(t)

-	sess, err := decodeCookie(t, s, restamp(
+	sess, err := decodeCookie(t, restamp(
 		t,
 		issuedCookie(t, s),
 		time.Now().Add(-(testAbsoluteMaxAge-time.Hour)),
@@ -126,7 +127,7 @@ func TestCodec_RejectsCookiePastAbsoluteCap(t *testing.T) {

 	s := testSession(t)

-	sess, err := decodeCookie(t, s, restamp(
+	sess, err := decodeCookie(t, restamp(
 		t,
 		issuedCookie(t, s),
 		time.Now().Add(-(testAbsoluteMaxAge+time.Hour)),
@@ -224,10 +224,22 @@ func New(
 }

 // Get retrieves a session for the request.
+//
+// A session cookie that does not decode -- one signed with an earlier
+// session key, say, because the database was made anew -- is treated
+// as absent: the caller gets a new, empty session and no error, and
+// the next save replaces the cookie.
 func (s *Session) Get(
 	r *http.Request,
 ) (*sessions.Session, error) {
-	return s.store.Get(r, SessionName)
+	sess, err := s.store.Get(r, SessionName)
+	if sess == nil {
+		return nil, err
+	}
+
+	// For a cookie that does not decode, gorilla/sessions returns a
+	// new, empty session alongside the error that is dropped here.
+	return sess, nil
 }

 // GetKey returns the raw 32-byte authentication key used for
@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/assets: extract Alpine.js from its npm package tarball, committed
+# in 3p/, to static/js/alpine.min.js, where go:embed reads it. The
+# extracted file is not committed. script/test, make build and make dev run
+# this first.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js \
+        >static/js/alpine.min.js
+}
+
+main "$@"
@@ -4,9 +4,7 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is deliberately not installed: linting runs
-# only in docker, via script/lint and Dockerfile.lint. Finishes by running
-# script/fetch-assets, which installs the hash-pinned third-party browser
-# assets the repo does not commit.
+# only in docker, via script/lint and Dockerfile.lint.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -69,11 +67,6 @@ main() {

    go mod download

-    # Third-party browser assets are not committed; fetch and verify them
-    # so a fresh clone can build and test.
-    if missing curl; then pkg_install curl curl curl curl; fi
-    "$ROOT/script/fetch-assets"
-
    echo "bootstrap complete"
 }

@@ -1,6 +1,7 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
+# extension to scripts-to-rule-them-all.
+# Writes only the ignored static/js/alpine.min.js, through script/test.
 # Generic: usually needs no adaptation.
 set -eu

@@ -1,104 +0,0 @@
-#!/bin/sh
-# script/fetch-assets: download the third-party browser assets the web UI
-# ships and install them under static/. Minified bundles are not committed
-# (REPO_POLICIES.md: no build artifacts in version control), so the build
-# fetches them here. Every download is verified against a hardcoded sha256
-# before it is installed, and any mismatch aborts. Idempotent: an asset
-# already present with its pinned hash is left alone.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# The sha256 of each installed asset lives in static/vendor.sha256, in
-# sha256sum(1) format, with paths relative to static/. That file is the
-# single source of truth: this script verifies against it, and
-# static/vendor_test.go asserts the bytes embedded into the binary match
-# it, so the hash cannot rot into a value nothing checks.
-MANIFEST="static/vendor.sha256"
-
-# Alpine.js 3.14.9, 2026-08-17. Fetched from registry.npmjs.org, the
-# publisher of record; the jsDelivr and unpkg copies are mirrors of this
-# same tarball. dist/cdn.min.js is the browser build Alpine publishes for
-# a <script> tag.
-ALPINE_VERSION="3.14.9"
-ALPINE_URL="https://registry.npmjs.org/alpinejs/-/alpinejs-${ALPINE_VERSION}.tgz"
-# sha256 of alpinejs-3.14.9.tgz
-ALPINE_TARBALL_SHA256="97dad7c0c81e659cfc8e7700055da9770f8186187cb9a8a76efb57e00d5ce52a"
-ALPINE_MEMBER="package/dist/cdn.min.js"
-ALPINE_DEST="js/alpine.min.js"
-
-sha256_of() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$1" | cut -d' ' -f1
-    else
-        shasum -a 256 "$1" | cut -d' ' -f1
-    fi
-}
-
-# expected_sha256 <path-relative-to-static>
-expected_sha256() {
-    awk -v want="$1" '$2 == want { print $1; found = 1 }
-        END { if (!found) exit 1 }' "$ROOT/$MANIFEST"
-}
-
-# verify <file> <expected-sha256> <what>
-verify() {
-    actual="$(sha256_of "$1")"
-    if [ "$actual" != "$2" ]; then
-        echo "fetch-assets: sha256 mismatch for $3" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# up_to_date <path-relative-to-static> <expected-sha256>
-up_to_date() {
-    [ -f "$ROOT/static/$1" ] || return 1
-    [ "$(sha256_of "$ROOT/static/$1")" = "$2" ]
-}
-
-fetch_alpine() {
-    want="$(expected_sha256 "$ALPINE_DEST")"
-
-    if up_to_date "$ALPINE_DEST" "$want"; then
-        echo "fetch-assets: static/$ALPINE_DEST already at $want"
-        return 0
-    fi
-
-    echo "fetch-assets: fetching Alpine.js $ALPINE_VERSION from $ALPINE_URL"
-    tmp="$(mktemp -d)"
-    trap 'rm -rf "$tmp"' EXIT INT TERM
-    curl -fsSL -o "$tmp/alpine.tgz" "$ALPINE_URL"
-    verify "$tmp/alpine.tgz" "$ALPINE_TARBALL_SHA256" "alpinejs-${ALPINE_VERSION}.tgz"
-    tar -xzOf "$tmp/alpine.tgz" "$ALPINE_MEMBER" >"$tmp/alpine.min.js"
-    verify "$tmp/alpine.min.js" "$want" "$ALPINE_MEMBER from alpinejs-${ALPINE_VERSION}.tgz"
-
-    mkdir -p "$(dirname "$ROOT/static/$ALPINE_DEST")"
-    cp "$tmp/alpine.min.js" "$ROOT/static/$ALPINE_DEST"
-    rm -rf "$tmp"
-    trap - EXIT INT TERM
-    echo "fetch-assets: installed static/$ALPINE_DEST ($want)"
-}
-
-# Re-check every manifest entry against what is now on disk, so an entry
-# no script installs fails loudly instead of passing silently.
-verify_manifest() {
-    while read -r want path; do
-        case "$want" in '' | '#'*) continue ;; esac
-        if [ ! -f "$ROOT/static/$path" ]; then
-            echo "fetch-assets: $MANIFEST lists static/$path, which is missing" >&2
-            exit 1
-        fi
-        verify "$ROOT/static/$path" "$want" "static/$path"
-    done <"$ROOT/$MANIFEST"
-}
-
-main() {
-    cd "$ROOT"
-    fetch_alpine
-    verify_manifest
-    echo "fetch-assets: all assets in $MANIFEST verified"
-}
-
-main "$@"
@@ -28,6 +28,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

 main() {
    cd "$ROOT"
+    "$ROOT/script/assets"
    go test -v -race -timeout 90s ./...
 }

@@ -1 +0,0 @@
-3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3  js/alpine.min.js
@@ -1,92 +0,0 @@
-package static_test
-
-import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/webhooker/static"
-)
-
-const manifestPath = "vendor.sha256"
-
-// fetchHint is appended to every failure here: the assets the manifest
-// covers are fetched by the build, not committed, so a fresh clone that
-// has not run script/fetch-assets fails this test and should be told why.
-const fetchHint = "run `script/fetch-assets` (or `make assets`) to install " +
-	"the pinned third-party assets"
-
-// TestVendoredAssetsMatchManifest asserts that every asset listed in
-// static/vendor.sha256 is embedded in the binary with exactly the pinned
-// bytes. script/fetch-assets verifies the same hashes at download time;
-// this test verifies them again on what actually ships, so a build that
-// skipped, cached, or subverted the fetch cannot produce a binary serving
-// unpinned third-party JavaScript.
-func TestVendoredAssetsMatchManifest(t *testing.T) {
-	t.Parallel()
-
-	entries := readManifest(t)
-	require.NotEmpty(t, entries, "%s lists no assets", manifestPath)
-
-	for path, want := range entries {
-		t.Run(path, func(t *testing.T) {
-			t.Parallel()
-
-			data, err := static.Static.ReadFile(path)
-			require.NoErrorf(
-				t, err,
-				"%s is listed in %s but is not embedded; %s",
-				path, manifestPath, fetchHint,
-			)
-
-			sum := sha256.Sum256(data)
-			got := hex.EncodeToString(sum[:])
-			require.Equalf(
-				t, want, got,
-				"embedded %s does not match its pinned sha256 in %s; %s",
-				path, manifestPath, fetchHint,
-			)
-		})
-	}
-}
-
-// readManifest parses static/vendor.sha256, which is in sha256sum(1)
-// format with paths relative to static/.
-func readManifest(t *testing.T) map[string]string {
-	t.Helper()
-
-	f, err := os.Open(manifestPath)
-	require.NoError(t, err, "opening %s", manifestPath)
-
-	defer func() { require.NoError(t, f.Close()) }()
-
-	entries := make(map[string]string)
-	scanner := bufio.NewScanner(f)
-
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-
-		fields := strings.Fields(line)
-		require.Lenf(
-			t, fields, 2,
-			"%s: malformed entry %q, want \"<sha256>  <path>\"",
-			manifestPath, line,
-		)
-
-		sum, path := fields[0], fields[1]
-		require.Lenf(t, sum, 64, "%s: %q is not a sha256", manifestPath, sum)
-		entries[path] = sum
-	}
-
-	require.NoError(t, scanner.Err(), "reading %s", manifestPath)
-
-	return entries
-}
@@ -16,7 +16,7 @@
        <!-- Desktop navigation -->
        <div class="hidden md:flex items-center gap-4">
            {{if .User}}
-            <a href="/sources" class="btn-text">Webhooks</a>
+            <a href="/hooks" class="btn-text">Webhooks</a>
            <a href="/user/{{.User.Username}}" class="btn-text">
                <svg class="w-5 h-5 mr-1" fill="currentColor" viewBox="0 0 16 16">
                    <path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/>
@@ -38,7 +38,7 @@
    <div x-show="open" x-cloak x-transition class="md:hidden mt-4 pt-4 border-t border-gray-200">
        <div class="flex flex-col gap-2">
            {{if .User}}
-            <a href="/sources" class="btn-text w-full text-left">Webhooks</a>
+            <a href="/hooks" class="btn-text w-full text-left">Webhooks</a>
            <a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a>
            <form method="POST" action="/pages/logout">
                <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-6xl mx-auto px-6 py-8" x-data="{ showAddEntrypoint: false, showAddTarget: false }">
    <div class="mb-6">
-        <a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
+        <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
        <div class="flex justify-between items-center mt-2">
            <div>
                <h1 class="text-2xl font-medium text-gray-900">{{.Webhook.Name}}</h1>
@@ -14,9 +14,9 @@
                {{end}}
            </div>
            <div class="flex gap-2">
-                <a href="/source/{{.Webhook.ID}}/logs" class="btn-secondary">Event Log</a>
-                <a href="/source/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
-                <form method="POST" action="/source/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')">
+                <a href="/hook/{{.Webhook.ID}}/events" class="btn-secondary">Full Event Log</a>
+                <a href="/hook/{{.Webhook.ID}}/edit" class="btn-secondary">Edit</a>
+                <form method="POST" action="/hook/{{.Webhook.ID}}/delete" onsubmit="return confirm('Delete this webhook and all its data?')">
                    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                    <button type="submit" class="btn-danger">Delete</button>
                </form>
@@ -39,7 +39,7 @@

            <!-- Add entrypoint form -->
            <div x-show="showAddEntrypoint" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
-                <form method="POST" action="/source/{{.Webhook.ID}}/entrypoints" class="flex gap-2">
+                <form method="POST" action="/hook/{{.Webhook.ID}}/entrypoints" class="flex gap-2">
                    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                    <input type="text" name="description" placeholder="Description (optional)" class="input text-sm flex-1">
                    <button type="submit" class="btn-primary text-sm">Add</button>
@@ -57,20 +57,20 @@
                            {{else}}
                            <span class="badge-error">Inactive</span>
                            {{end}}
-                            <form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline">
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/toggle" class="inline">
                                <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
                                    {{if .Active}}Deactivate{{else}}Activate{{end}}
                                </button>
                            </form>
-                            <form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline">
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/entrypoints/{{.ID}}/delete" onsubmit="return confirm('Delete this entrypoint?')" class="inline">
                                <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
                            </form>
                        </div>
                    </div>
                    <div class="flex items-start gap-2 mt-1">
-                        <code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/webhook/{{.Path}}</code>
+                        <code id="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 break-all block flex-1">{{$.BaseURL}}/h/{{.Path}}</code>
                        <!-- Hidden until app.js reveals it; without the
                             script the URL above stays selectable. -->
                        <button type="button" hidden data-copy-target="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 hover:text-primary-600">Copy</button>
@@ -98,7 +98,7 @@

            <!-- Add target form -->
            <div x-show="showAddTarget" x-cloak class="p-4 bg-gray-50 border-b border-gray-200">
-                <form method="POST" action="/source/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3">
+                <form method="POST" action="/hook/{{.Webhook.ID}}/targets" x-data="{ targetType: 'http' }" class="space-y-3">
                    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                    <div class="flex gap-2">
                        <input type="text" name="name" placeholder="Target name" required class="input text-sm flex-1">
@@ -151,14 +151,14 @@
                            {{else}}
                            <span class="badge-error">Inactive</span>
                            {{end}}
-                            <a href="/source/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a>
-                            <form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline">
+                            <a href="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/edit" class="text-xs text-gray-500 hover:text-primary-600" title="Edit">Edit</a>
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/toggle" class="inline">
                                <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                <button type="submit" class="text-xs text-gray-500 hover:text-primary-600" title="{{if .Active}}Deactivate{{else}}Activate{{end}}">
                                    {{if .Active}}Deactivate{{else}}Activate{{end}}
                                </button>
                            </form>
-                            <form method="POST" action="/source/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline">
+                            <form method="POST" action="/hook/{{$.Webhook.ID}}/targets/{{.ID}}/delete" onsubmit="return confirm('Delete this target?')" class="inline">
                                <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                <button type="submit" class="text-xs text-red-500 hover:text-red-700" title="Delete">Delete</button>
                            </form>
@@ -182,7 +182,7 @@
    <div class="card mt-6">
        <div class="p-4 border-b border-gray-200 flex justify-between items-center">
            <h2 class="text-lg font-medium text-gray-900">Recent Events</h2>
-            <a href="/source/{{.Webhook.ID}}/logs" class="btn-text text-sm">View All</a>
+            <a href="/hook/{{.Webhook.ID}}/events" class="btn-text text-sm">Full Event Log</a>
        </div>
        <div class="divide-y divide-gray-100">
            {{range .Events}}
@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
    <div class="mb-6">
-        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
        <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Webhook</h1>
    </div>

@@ -14,7 +14,7 @@
        <div class="alert-error">{{.Error}}</div>
        {{end}}

-        <form method="POST" action="/source/{{.Webhook.ID}}/edit" class="space-y-6">
+        <form method="POST" action="/hook/{{.Webhook.ID}}/edit" class="space-y-6">
            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
            <div class="form-group">
                <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@

            <div class="flex gap-3">
                <button type="submit" class="btn-primary">Save Changes</button>
-                <a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
+                <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
            </div>
        </form>
    </div>
@@ -1,13 +1,13 @@
 {{template "base" .}}

-{{define "title"}}Event Log - {{.Webhook.Name}} - Webhooker{{end}}
+{{define "title"}}Full Event Log - {{.Webhook.Name}} - Webhooker{{end}}

 {{define "content"}}
 <div class="max-w-6xl mx-auto px-6 py-8">
    <div class="mb-6">
-        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
        <div class="flex justify-between items-center mt-2">
-            <h1 class="text-2xl font-medium text-gray-900">Event Log</h1>
+            <h1 class="text-2xl font-medium text-gray-900">Full Event Log</h1>
            <span class="text-sm text-gray-500">{{.TotalEvents}} total event{{if ne .TotalEvents 1}}s{{end}}</span>
        </div>
    </div>
@@ -55,7 +55,7 @@
                            {{if .ResubmittedFrom}}Resubmitted from event <span class="font-mono">{{.ResubmittedFromID}}</span>.{{end}}
                            {{if .ResubmitCount}}Resubmitted as {{.ResubmitCount}} new event{{if ne .ResubmitCount 1}}s{{end}}.{{end}}
                        </div>
-                        <form method="POST" action="/source/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline">
+                        <form method="POST" action="/hook/{{$.Webhook.ID}}/events/{{.ID}}/resubmit" class="inline">
                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                            <input type="hidden" name="page" value="{{$.Page}}">
                            <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Submit this event again as a new event, to every currently active target">Resubmit</button>
@@ -63,7 +63,7 @@
                    </div>
                    <pre class="text-xs text-gray-700 overflow-x-auto whitespace-pre-wrap break-all">{{.Body}}</pre>
                    {{if .BodyTruncated}}
-                    <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/source/{{$.Webhook.ID}}/logs/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p>
+                    <p class="mt-2 text-xs text-gray-500">Body truncated for display: showing {{.BodyShownBytes}} of {{.BodyBytes}} bytes. The stored body is unchanged &mdash; <a href="/hook/{{$.Webhook.ID}}/events/{{.ID}}/body" class="text-primary-600 hover:text-primary-700 underline">download the full body</a>.</p>
                    {{end}}

                    {{if .Deliveries}}
@@ -79,7 +79,7 @@
                                    </div>
                                    <div class="flex items-center gap-3">
                                        {{if .Status.Terminal}}
-                                        <form method="POST" action="/source/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop>
+                                        <form method="POST" action="/hook/{{$.Webhook.ID}}/deliveries/{{.ID}}/replay" class="inline" @click.stop>
                                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
                                            <input type="hidden" name="page" value="{{$.Page}}">
                                            <button type="submit" class="text-xs text-primary-600 hover:text-primary-700" title="Send this event to the target again">Replay</button>
@@ -139,11 +139,11 @@
    {{if or .HasPrev .HasNext}}
    <div class="flex justify-center gap-2 mt-6">
        {{if .HasPrev}}
-        <a href="/source/{{.Webhook.ID}}/logs?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a>
+        <a href="/hook/{{.Webhook.ID}}/events?page={{.PrevPage}}" class="btn-secondary text-sm">&larr; Previous</a>
        {{end}}
        <span class="inline-flex items-center px-4 py-2 text-sm text-gray-500">Page {{.Page}} of {{.TotalPages}}</span>
        {{if .HasNext}}
-        <a href="/source/{{.Webhook.ID}}/logs?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a>
+        <a href="/hook/{{.Webhook.ID}}/events?page={{.NextPage}}" class="btn-secondary text-sm">Next &rarr;</a>
        {{end}}
    </div>
    {{end}}
@@ -6,7 +6,7 @@
 <div class="max-w-6xl mx-auto px-6 py-8">
    <div class="flex justify-between items-center mb-6">
        <h1 class="text-2xl font-medium text-gray-900">Webhooks</h1>
-        <a href="/sources/new" class="btn-primary">
+        <a href="/hooks/new" class="btn-primary">
            <svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
            </svg>
@@ -17,7 +17,7 @@
    {{if .Webhooks}}
    <div class="grid gap-4">
        {{range .Webhooks}}
-        <a href="/source/{{.ID}}" class="card-elevated p-6 block">
+        <a href="/hook/{{.ID}}" class="card-elevated p-6 block">
            <div class="flex justify-between items-start">
                <div>
                    <h2 class="text-lg font-medium text-gray-900">{{.Name}}</h2>
@@ -42,7 +42,7 @@
        </svg>
        <h2 class="text-lg font-medium text-gray-900 mb-2">No webhooks yet</h2>
        <p class="text-gray-500 mb-6">Create your first webhook to start receiving and forwarding events.</p>
-        <a href="/sources/new" class="btn-primary">Create Webhook</a>
+        <a href="/hooks/new" class="btn-primary">Create Webhook</a>
    </div>
    {{end}}
 </div>
@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
    <div class="mb-6">
-        <a href="/sources" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
+        <a href="/hooks" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to webhooks</a>
        <h1 class="text-2xl font-medium text-gray-900 mt-2">Create Webhook</h1>
    </div>

@@ -14,7 +14,7 @@
        <div class="alert-error">{{.Error}}</div>
        {{end}}

-        <form method="POST" action="/sources/new" class="space-y-6">
+        <form method="POST" action="/hooks/new" class="space-y-6">
            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
            <div class="form-group">
                <label for="name" class="label">Name</label>
@@ -34,7 +34,7 @@

            <div class="flex gap-3">
                <button type="submit" class="btn-primary">Create Webhook</button>
-                <a href="/sources" class="btn-secondary">Cancel</a>
+                <a href="/hooks" class="btn-secondary">Cancel</a>
            </div>
        </form>
    </div>
@@ -5,7 +5,7 @@
 {{define "content"}}
 <div class="max-w-2xl mx-auto px-6 py-8">
    <div class="mb-6">
-        <a href="/source/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
+        <a href="/hook/{{.Webhook.ID}}" class="text-sm text-primary-600 hover:text-primary-700">&larr; Back to {{.Webhook.Name}}</a>
        <h1 class="text-2xl font-medium text-gray-900 mt-2">Edit Target</h1>
        <p class="text-sm text-gray-500 mt-1">Type: {{.Target.Type}}. A target's type cannot be changed; create a new target to deliver a different way.</p>
    </div>
@@ -21,7 +21,7 @@
        </div>
        {{end}}

-        <form method="POST" action="/source/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6">
+        <form method="POST" action="/hook/{{.Webhook.ID}}/targets/{{.Target.ID}}/edit" class="space-y-6">
            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">

            <div class="form-group">
@@ -75,7 +75,7 @@

            <div class="flex gap-3">
                <button type="submit" class="btn-primary">Save Changes</button>
-                <a href="/source/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
+                <a href="/hook/{{.Webhook.ID}}" class="btn-secondary">Cancel</a>
            </div>
        </form>
    </div>
Author	SHA1	Message	Date
clawbot	d2ce961fe5	Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367 ) check / check (push) Waiting to run Details The webhook page and everything under it move from /source/ID to /hook/ID, the list and new-webhook form to /hooks and /hooks/new, and the event log from .../logs to /hook/ID/events, body download included. Entrypoint URLs move from /webhook/UUID to /h/UUID, and the webhook page shows only that form. The old paths are gone. Links, redirects, form actions, tests, comments and the README follow. Both links to the event log page, and its title and heading, now read "Full Event Log". Go identifiers and template file names are unchanged. A new route test posts to the entrypoint URL the webhook page shows and checks that the receiver rate limit applies to it. Model: opus-5-5	2026-10-01 20:48:17 +00:00
clawbot	9d29baaa2d	Commit the Alpine.js tarball in 3p/ and extract it at build time (closes #345 ) check / check (push) Waiting to run Details The build no longer downloads Alpine.js. Its npm package tarball is committed as 3p/alpinejs-3.14.9.tgz, byte for byte the file script/fetch-assets downloaded, with the sha256 that script pinned. script/assets (make assets) extracts package/dist/cdn.min.js to the ignored static/js/alpine.min.js; script/test runs it, so make test, make check, the pre-commit hook and the Dockerfile get the file with no network access, and make build, run and dev run it too. Removed: script/fetch-assets, its Dockerfile step, static/vendor.sha256 and static/vendor_test.go. The README describes the new flow. Model: opus-5-5	2026-10-01 22:44:41 +02:00
clawbot	507980a347	Bound username length at creation (closes #184 ) check / check (push) Waiting to run Details Usernames are limited to 1024 bytes, so no account can exist that is unable to log in. The username rides in the session cookie, which browsers and securecookie refuse past about 4 KB, leaving room for roughly 2000 bytes of username; the limit is about half that. User.BeforeSave returns ErrUsernameTooLong when a whole User is created or saved. A byte-counting check constraint on users.username catches every other write, including a column update. The limit appears in the constant and in the struct tag; a test fails if they disagree. Model: opus-5-5	2026-10-01 21:38:48 +02:00
clawbot	b79e4649a1	Container sets its data directory's owner and mode itself (#353 ) check / check (push) Canceled after 0s Details Closes #340. The image no longer sets `USER`. Its new `ENTRYPOINT`, `deploy/docker-entrypoint.sh`, starts as root, creates `DATA_DIR` if missing, gives the directory and anything in it owned by another user to `webhooker` (UID 1000), sets the directory to `0750`, and runs the command as `webhooker` through `su-exec`. An empty root-owned bind mount, or data left by another UID, now works as mounted; the app never runs as root and is still PID 1. `CMD` is still `/app/webhooker`, so the `resetpw` commands are unchanged. Started with `--user`, the script only runs the command. It is in `/usr/local/bin`, not `/app`, which belongs to `webhooker`. README: the UID 1000 ownership block, the upaas pre-deploy commands and the restore ownership step are gone; the upaas volume bullet names only the path. - Judgement call: `su-exec` over `setpriv`: Alpine's small tool for this, needing only musl; busybox's `setpriv` cannot change user, and util-linux's adds `libcap-ng`. - Deviation: `su-exec` is pinned by version (`0.2-r3`), not by hash; `ca-certificates` beside it is unpinned. - Judgement call: each start reads every entry's owner but changes only entries owned by someone else. - `docker exec` and the health check now run as root, since the image sets no `USER`. - No automated test covers the script: the suite runs inside `docker build`, which cannot start a container. - A missing host directory under upaas is sneak/upaas#235. Model: opus-5-5 Reviewed-on: #353 Co-authored-by: clawbot <35+clawbot@noreply.example.org>	2026-09-29 13:05:16 +02:00
clawbot	1428154bbd	Let a browser with cookies from an earlier database log in (closes #359 ) check / check (push) Canceled after 0s Details A new database brings a new session key. A browser still holding the old session cookie got a 500 on a correct login: Session.Get returned the cookie's decode error and the login handler answered it with a 500. Get now treats a cookie that does not decode as absent, and logging in replaces it. gorilla/csrf already did the same for the CSRF cookie. A start that creates webhooker.db now logs "created a new, empty database" at WARN with its path, shortly before the first-boot banner, so an unexpectedly empty DATA_DIR is noticed. The codec tests now decode through the store, since Get no longer reports the codec's reason. Model: opus-5-5	2026-09-29 12:58:44 +02:00
sneak	8ad2a86e4b	Sneak/testdeploy (#356 ) check / check (push) Successful in 11s Details Reviewed-on: #356	2026-09-29 12:01:33 +02:00
sneak	a891b726e5	Milestone: next into main (#342 ) check / check (push) Successful in 9s Details Reviewed-on: #342	2026-09-29 11:53:19 +02:00
clawbot	ab63b5f777	Restrict /s/* to GET and HEAD (closes #169 ) check / check (push) Successful in 3m37s Details The static file server was attached with Mount, which registers every method, so POST, PUT and DELETE on an asset were answered 200 with the file. It is now registered for GET and HEAD only, inside a /s group whose method-not-allowed handler answers 405 with Allow: GET, HEAD. A method chi does not route at all, such as PROPFIND, still gets 405 from the top-level router, without Allow. The inverted test and the README route table say the same. Model: opus-5-5	2026-09-29 11:10:27 +02:00
				`@@ -1 +0,0 @@`
				`3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3 js/alpine.min.js`