Test a pending delivery whose target is found only on lookup

When the batch's target map lacks a delivery's target, as it does
for every delivery when the batch query fails, sendRecoveredDeliveries
looks the target up on its own. The new test hands it an empty map
and checks the healthy delivery is queued once, with its real target
id and type.

Model: opus-5-5

Dockerfile

@@ -88,9 +88,7 @@ RUN CGO_ENABLED=1 make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static
 # alpine:3.21, 2026-03-17
 FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
-# su-exec 0.2-r3 (Alpine 3.21), 2026-09-29: the entrypoint runs the app
+RUN apk --no-cache add ca-certificates
-# as webhooker with it.
-RUN apk --no-cache add ca-certificates su-exec=0.2-r3
 
 # Create non-root user
 RUN addgroup -g 1000 -S webhooker && \
@@ -101,17 +99,13 @@ WORKDIR /app
 # Copy binary from builder
 COPY --from=builder /build/bin/webhooker /app/webhooker
 
-# Not under /app, which belongs to webhooker: this script runs as root.
-COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-
 # Create data directory for all SQLite databases (main app DB +
 # per-webhook event DBs). DATA_DIR defaults to /var/lib/webhooker.
 RUN mkdir -p /var/lib/webhooker
 
 RUN chown -R webhooker:webhooker /app /var/lib/webhooker
 
-# No USER: the entrypoint starts as root to make the data directory
+USER webhooker
-# webhooker's, then runs the app as webhooker.
 
 EXPOSE 8080
 
@@ -130,5 +124,4 @@ ENV BIND_ADDRESS=0.0.0.0
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
 
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]

README.md

@@ -157,11 +157,6 @@ private and reserved ranges — RFC 1918, loopback, CGNAT, link-local and
 the rest — are refused, which stops a target from being used to make
 webhooker probe the network it sits in.
 
-Besides the private and reserved ranges, the default blocklist refuses
-public cloud metadata addresses: currently only `168.63.129.16`, Azure's
-WireServer, which serves an Azure VM its credentials. Because it is a
-public address, listing it in `ALLOWED_EGRESS_CIDRS` reopens it.
-
 That default is also inconvenient for the thing webhooker is mostly
 for: taking a public webhook and forwarding it to something on your own
 network. A container on the same Docker network, a box on `10.x`, a
@@ -200,16 +195,15 @@ Two things this setting cannot do:
   the list is always an allowlist; an empty list (the default) means
   every private and reserved range stays refused. Note that
   `0.0.0.0/0` gets you most of the way there anyway, per above.
-- **It cannot open link-local, or a cloud metadata endpoint at a
+- **It cannot open link-local, or a cloud metadata endpoint that
-  non-public address that discloses credentials or user data.** An
+  discloses credentials or user data.** An address is on the list below
-  address is on the list below when it is not a public address and both
+  when both of these hold: the provider fixes it, so it cannot collide
-  of these hold: the provider fixes it, so it cannot collide with
+  with anything you run; and reaching it hands out credentials, user
-  anything you run; and reaching it hands out credentials, user data or
+  data or bootstrap material. Those stay blocked no matter what you
-  bootstrap material. Those stay blocked no matter what you list,
+  list, including when you list them outright or list a supernet such
-  including when you list them outright or list a supernet such as
+  as `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`. Treat this as
-  `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`. Treat this as best
+  best effort rather than a guarantee — it is a hand-maintained list
-  effort rather than a guarantee — it is a hand-maintained list and the
+  and the caveat below the table applies:
-  caveat below the table applies:
 
   | Blocked unconditionally | What it is |
   | ----------------------- | ---------- |
@@ -248,8 +242,7 @@ Two things this setting cannot do:
   encodings, which the default blocklist does not match. A publicly
   routable metadata address is not listed here, because nothing on this
   list can be reopened and blocking one that way would leave you no
-  escape hatch at all; Azure's `168.63.129.16` is refused by the default
+  escape hatch at all.
-  blocklist instead, as described above.
 
   This list is not exhaustive of every cloud's metadata address — if
   yours is not here, do not allowlist the block that contains it.
@@ -538,12 +531,6 @@ its Argon2id hash. There is no second account and no forgot-password
 flow, so the banner and the reset command below are the only two ways
 in.
 
-A start that finds no `webhooker.db` in `DATA_DIR` also logs
-`created a new, empty database` at `WARN`, with the file's path,
-shortly before the banner. On a deployment that has run before, that
-line means `DATA_DIR` was empty, most often because its volume is not
-mounted.
-
 #### Recovering a lost admin password
 
 `webhooker resetpw` sets an existing account's password from the
@@ -558,9 +545,8 @@ printf '%s' "$NEW_PASSWORD" | \
     DATA_DIR=/var/lib/webhooker webhooker resetpw admin
 ```
 
-In a container it is the same binary. The image's `CMD` is
+In a container it is the same binary, which the image sets as `CMD`
-`/app/webhooker`, and a command given to `docker run` replaces all of
+rather than `ENTRYPOINT`, so the whole command has to be given:
-it, so the whole command has to be given:
 
 ```bash
 docker run --rm -v webhooker-data:/var/lib/webhooker \
@@ -697,22 +683,38 @@ those three values rather than trusting the figure. Measured at 65s on
 Docker 29.7.2.) A container `unhealthy` with `connection refused` in
 its health log, or a published port that resets connections, is this.
 
-The app runs as a non-root user (`webhooker`, UID 1000), exposes port
+The container runs as a non-root user (`webhooker`, UID 1000), exposes
-8080, and includes a health check against `/.well-known/healthcheck`.
+port 8080, and includes a health check against
-The `/var/lib/webhooker` volume holds all SQLite databases: the main
+`/.well-known/healthcheck`. The `/var/lib/webhooker` volume holds all
-application database (`webhooker.db`), the per-webhook event databases
+SQLite databases: the main application database (`webhooker.db`), the
-(`events-{uuid}.db`), and any archive databases written by `database`
+per-webhook event databases (`events-{uuid}.db`), and any archive
-targets (`archive-{uuid}.db`). Mount this as a persistent volume to
+databases written by `database` targets (`archive-{uuid}.db`). Mount
-preserve data across container restarts.
+this as a persistent volume to preserve data across container
+restarts.
 
-**The container sets its data directory's owner and mode itself
+**The bind-mounted directory must be owned by UID 1000, or the
-before the app starts**, so a host directory can be mounted as it is,
+container does not start.** Docker creates a `-v` source path that
-whoever owns it. The image's `ENTRYPOINT`,
+does not exist yet as `root:root`, and the process runs as UID 1000,
-`deploy/docker-entrypoint.sh`, starts as root, creates `DATA_DIR` if
+so it cannot take its `DATA_DIR` lock:
-it is missing, gives the directory and anything in it that belongs to
+
-another user to `webhooker`, sets the directory to `0750`, and only
+```
-then runs the app as `webhooker`. Started with `--user`, it changes
+webhooker: locking data directory /var/lib/webhooker: open
-nothing and runs the app as that user.
+/var/lib/webhooker/webhooker.lock: permission denied
+```
+
+It exits non-zero at that point, before opening any database. Create
+the directory ahead of the first `docker run`:
+
+```bash
+mkdir -p /path/to/data
+chown 1000:1000 /path/to/data
+chmod 750 /path/to/data
+```
+
+The same `chown` is what a restore needs — see step 4 of
+[Restore](#restore). A **named volume** does not have this problem:
+Docker copies the image's ownership onto a volume it initializes, and
+the image creates `/var/lib/webhooker` owned by `webhooker`.
 
 **The file modes are not yours to set, and do not depend on the
 directory.** `webhooker.db` holds target configuration in plaintext —
@@ -720,10 +722,13 @@ bearer tokens, API keys, Slack webhook URLs — along with the session
 encryption key, so webhooker creates every SQLite file it owns `0600`:
 each database and both of its `-wal` and `-shm` sidecars, across all
 three tiers. Files an earlier build left `0644` are tightened when
-they are opened. The directory's `0750` is defence in depth — it stops
+they are opened. A `DATA_DIR` webhooker creates itself is `0750`, but
-other local users listing the directory and learning your webhook
+a bind mount supplies its own directory and Docker's default for one
-UUIDs from the `events-{uuid}.db` filenames — not the barrier
+it creates is `0755`; the `0600` files hold there regardless. The
-protecting the credentials.
+`chmod 750` above is defence in depth — it stops other local users
+listing the directory and learning your webhook UUIDs from the
+`events-{uuid}.db` filenames — not the barrier protecting the
+credentials.
 
 ### Running under upaas
 
@@ -739,6 +744,17 @@ repository's `Dockerfile` and runs it. The app needs:
   app name, port `8080`. Leave `PORT` unset: the image's health check
   probes `8080`.
 - **Volume:** one host directory mounted at `/var/lib/webhooker`.
+  upaas bind-mounts the host path it is given and does not create it,
+  and the container does not start unless UID 1000 owns it (see
+  [Running with Docker](#running-with-docker)). Create it before the
+  first deploy:
+
+    ```bash
+    mkdir -p /path/to/data
+    chown 1000:1000 /path/to/data
+    chmod 750 /path/to/data
+    ```
+
 - **Environment variables:**
     - `WEBHOOKER_ENVIRONMENT=prod`
     - `TRUSTED_PROXIES`: your reverse proxy's address on that Docker
@@ -952,10 +968,15 @@ scratch file**: it holds committed transactions that are not yet in the
 have no readable schema at all. `-shm` is regenerable, but there is no
 reason to separate the two — copy the directory and you have them.
 
-A clean shutdown closes every database, which checkpoints and removes
+A clean shutdown closes `webhooker.db` and every `events-*.db`, which
-its sidecars; a killed or crashed instance leaves them, and they must be
+checkpoints and removes their sidecars; a killed or crashed instance
-carried with the `.db`. An archive the service has not opened since a
+leaves them, and they must be carried with the `.db`. **Archive
-crash keeps that crash's sidecars, even across a later clean stop.
+databases are different**: their handle is not closed at shutdown, so
+`archive-*.db-wal` and `-shm` normally survive a clean stop and the
+`-wal` can hold every row the archive has. Measured on a stopped
+instance: `archive-….db` 4096 bytes with no table, its `-wal` 157 KB
+holding all 8 archived events. Copying `DATA_DIR` in full is what makes
+this a non-issue; copying `.db` files out of it by name is not.
 
 Configuration is **not** in `DATA_DIR` — it comes from the environment
 and from a `.env` file read out of the process working directory. Back
@@ -997,12 +1018,12 @@ done
 `.backup` reads through the WAL and writes a single consistent file with
 no sidecars of its own, so the destination is complete as it stands.
 Two caveats. First, the runtime image is `alpine:3.21` with only
-`ca-certificates` and `su-exec` added — the `sqlite3` CLI is **not** in
+`ca-certificates` added — the `sqlite3` CLI is **not** in it, so run
-it, so run this on the host against the volume path, or from a
+this on the host against the volume path, or from a throwaway container
-throwaway container that mounts the volume. Second, each file is
+that mounts the volume. Second, each file is captured at its own
-captured at its own instant, so a webhook created or an event delivered
+instant, so a webhook created or an event delivered between two files
-between two files being copied lands in one and not the other. If you
+being copied lands in one and not the other. If you need the whole set
-need the whole set coherent as of a single moment, stop the service.
+coherent as of a single moment, stop the service.
 
 Note that `sqlite3 <db> .dump` is **not** one of these procedures: it is
 an export, it holds a read transaction open for as long as it runs, and
@@ -1030,9 +1051,10 @@ The file becomes self-contained again when the handle closes, which
 happens on the next write past the debounce window, when the connection
 pool retires the idle connection (about a minute after the last write),
 or at the idle archive sweep — measured, the same file was a complete
-20 KB `.db` with no sidecars about a minute after its last write. A
+20 KB `.db` with no sidecars about a minute after its last write.
-clean stop closes it too. So either move `archive-{uuid}.db` together
+Shutdown is **not** on that list: the archive handle is not closed when
-with any `-wal`/`-shm` beside it, or wait until there are none.
+the service stops. So either move `archive-{uuid}.db` together with any
+`-wal`/`-shm` beside it, or wait until there are none.
 
 ### Restore
 
@@ -1051,16 +1073,28 @@ with any `-wal`/`-shm` beside it, or wait until there are none.
    They are part of the database, and dropping a `-wal` silently
    discards every transaction it still holds. An `.backup` set will not
    contain any: it writes a single consolidated file per database. A
-   stop-and-copy set normally has none, because a clean stop closes
+   stop-and-copy set has none for `webhooker.db` or the `events-*.db`,
-   every database and checkpoints its sidecars away; the exception is an
+   because a clean stop closes those and checkpoints their sidecars
-   archive not opened since a crash. A copy salvaged from a crashed
+   away — but it will normally have them for `archive-*.db`, whose
-   instance has them for everything, and needs all of them.
+   handle stays open across shutdown, and those carry the archive's
+   rows. A copy salvaged from a crashed instance has them for
+   everything, and needs all of them.
 
-4. Start the service. The container gives the directory and the
+4. **Fix ownership.** The container runs as the non-root `webhooker`
-   restored files to the `webhooker` user before the app starts,
+   user, UID 1000 / GID 1000. Restored files must be owned by (or
-   whoever restored them (see
+   writable by) that UID, and so must the directory itself — SQLite
-   [Running with Docker](#running-with-docker)). `AutoMigrate` runs
+   creates the `-wal` and `-shm` sidecars beside the database, so a
-   against each restored database as it is opened.
+   writable file inside a directory it cannot write is not enough:
+
+    ```bash
+    chown -R 1000:1000 /path/to/data
+    ```
+
+    Restoring as `root` on the host and forgetting this step is the
+    usual way a restore fails.
+
+5. Start the service. `AutoMigrate` runs against each restored database
+   as it is opened.
 
 ### Upgrades
 
@@ -2688,7 +2722,7 @@ abuse limit later; they are tracked as future work.
 | ------ | --------------------------- | ----------- |
 | `GET`  | `/`                         | Root redirect, 303 (authenticated → `/sources`, unauthenticated → `/pages/login`) |
 | `GET`  | `/.well-known/healthcheck`  | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) |
-| `GET`, `HEAD` | `/s/*`              | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` |
+| any    | `/s/*`                      | Static file serving (embedded CSS, JS). Mounted for every method, not just `GET`/`HEAD`: chi's `Mount` registers all methods and `http.FileServer` special-cases only `HEAD` (by omitting the body), so a `POST` or `DELETE` to an asset is answered `200` with the file. Pinned by `TestStaticServesEveryMethod` |
 | `POST` | `/webhook/{uuid}`           | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |
 
 #### Authentication Endpoints
@@ -3038,11 +3072,7 @@ check, see [The login endpoint](#the-login-endpoint).
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
   runtime)
-- The app runs as the non-root `webhooker` user (UID 1000) in the
+- Container runs as non-root user (UID 1000)
-  container. The image sets no `USER`, so these run as root: the
-  `ENTRYPOINT` script, which sets the data directory's owner and mode
-  before the app starts; the image's health check; and `docker exec`,
-  unless given `--user`
 - GORM soft deletes on every entity that carries `BaseModel`, which is
   all of them but `Setting` (data preserved for audit)
 
@@ -3058,8 +3088,7 @@ each hook. The order, read off the fx stop-hook log:
 3. `server` — the HTTP drain, bounded separately by
    `server.ShutdownTimeout` (**3 seconds**), then a Sentry flush if
    `SENTRY_DSN` is set
-4. `delivery.Engine` — waits for its workers, then closes the archive
+4. `delivery.Engine`
-   databases
 5. `healthcheck`
 6. `WebhookDBManager`
 7. the database close
@@ -3169,13 +3198,10 @@ version is fixed independently of the compiler's:
    `GO_LDFLAGS`, so neither can drop the `-X` that stamps the version.
    The version arrives as the `VERSION` build arg, since the context
    has no `.git` (see [Version stamping](#version-stamping)).
-3. **Runtime stage** (`alpine:3.21`) — copies the static binary and
+3. **Runtime stage** (`alpine:3.21`) — copies the static binary,
-   `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker`
+   creates the `/var/lib/webhooker` directory for all SQLite databases,
-   directory for all SQLite databases, exposes port 8080, and includes
+   runs as the non-root `webhooker` user (UID 1000), exposes port 8080,
-   a health check against `/.well-known/healthcheck`. It sets no
+   and includes a health check against `/.well-known/healthcheck`.
-   `USER`: the `ENTRYPOINT` script starts as root, sets the data
-   directory's owner and mode, and runs the app as the non-root
-   `webhooker` user (UID 1000) through `su-exec`.
 
 The lint stage invokes `golangci-lint` directly rather than `make lint`:
 it is already the pinned linter image, and `make lint` builds
@@ -3254,5 +3280,3 @@ MIT
 ## Author
 
 [@sneak](https://sneak.berlin)
-
-

deploy/docker-entrypoint.sh

@@ -1,22 +0,0 @@
-#!/bin/sh
-# deploy/docker-entrypoint.sh: the image's ENTRYPOINT. A bind-mounted
-# data directory keeps its owner from the host, often root, and the app
-# could not write to it. Started as root, this creates DATA_DIR if
-# needed, gives it and everything in it to webhooker, sets its mode, and
-# runs the command as webhooker, so the app never runs as root. Started
-# as another user, it only runs the command.
-set -eu
-
-main() {
-    if [ "$(id -u)" != 0 ]; then
-        exec "$@"
-    fi
-
-    dir="${DATA_DIR:-/var/lib/webhooker}"
-    mkdir -p "$dir"
-    find "$dir" ! -user webhooker -exec chown -h webhooker:webhooker {} +
-    chmod 750 "$dir"
-    exec su-exec webhooker "$@"
-}
-
-main "$@"

internal/config/config.go

@@ -192,10 +192,9 @@ type Config struct {
 	// alwaysBlockedNetworks stays blocked no matter what is listed
 	// here. That set is link-local plus the cloud metadata
 	// endpoints outside it that disclose credentials or user data
-	// at a provider-fixed, non-public address; it is not
+	// at a provider-fixed address; it is not exhaustive of every
-	// exhaustive of every cloud's metadata address. See
+	// cloud's metadata address. See alwaysBlockedNetworks for the
-	// alwaysBlockedNetworks for the authoritative list and the
+	// authoritative list and the criterion it is built from.
-	// criterion it is built from.
 	AllowedEgressCIDRs []netip.Prefix
 
 	params *ConfigParams
@@ -747,14 +746,12 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 
 	log.Warn(
 		"ALLOWED_EGRESS_CIDRS lets delivery targets reach these "+
-			"otherwise-blocked networks. Anyone who can create a "+
+			"otherwise-blocked private/reserved networks. Anyone "+
-			"delivery target can now make this process issue "+
+			"who can create a delivery target can now make this "+
-			"requests into them, and read back the response. Only "+
+			"process issue requests into them, and read back the "+
-			"the addresses the README lists as blocked "+
+			"response. Link-local and the known cloud instance "+
-			"unconditionally stay blocked regardless of what is "+
+			"metadata endpoints outside it stay blocked "+
-			"listed here; a public cloud metadata address such as "+
+			"regardless of what is listed here.",
-			"168.63.129.16 is reachable once it, or a block "+
-			"covering it, is listed.",
 		"allowedEgressCIDRs",
 		strings.Join(PrefixStrings(c.AllowedEgressCIDRs), ","),
 	)

internal/config/config_test.go

@@ -834,13 +834,12 @@ func TestEgressAllowlistWarning(t *testing.T) {
 			// to be able to read back which networks are open.
 			assert.Contains(t, logged, "10.0.0.0/8")
 			assert.Contains(t, logged, "127.0.0.0/8")
-			// What stays shut is the whole unconditional set, not
+			// What stays shut. Asserted on the clause naming the
-			// link-local alone; a public metadata address is not in
+			// wider set rather than on "Link-local" alone, so the
-			// it, so a listed block covering it opens it.
+			// string cannot narrow back to link-local only while
-			assert.Contains(t, logged, "blocked unconditionally")
+			// the always-blocked set covers ULA, CGNAT and two
-			assert.Contains(t, logged, "168.63.129.16 is reachable")
+			// public metadata addresses as well.
-			// The listed blocks need not be private or reserved.
+			assert.Contains(t, logged, "metadata endpoints outside it")
-			assert.NotContains(t, logged, "private/reserved")
 		})
 	}
 }

internal/database/bootstrap_banner_test.go

@@ -3,8 +3,6 @@ package database_test
 import (
 	"bytes"
 	"context"
-	"log/slog"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -85,37 +83,3 @@ func TestFirstBoot_PrintsTheAdminPasswordAsABanner(t *testing.T) {
 		t, ok, "the printed password must open the seeded account",
 	)
 }
-
-// TestNewDatabase_IsLoggedWithItsPath is the log half of
-// https://git.eeqj.de/sneak/webhooker/issues/359. A DATA_DIR that is
-// unexpectedly empty boots exactly like a first start, so the start
-// that creates the database must say so, and where. Opening that
-// database again must not.
-func TestNewDatabase_IsLoggedWithItsPath(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	open := func() string {
-		var out bytes.Buffer
-
-		db, err := database.Open(dir, slog.New(slog.NewTextHandler(&out, nil)))
-		require.NoError(t, err)
-		require.NoError(t, db.Close())
-
-		return out.String()
-	}
-
-	const created = `level=WARN msg="created a new, empty database"`
-
-	first := open()
-	second := open()
-
-	assert.Contains(
-		t, first,
-		created+" path="+filepath.Join(dir, database.MainDBFileName),
-	)
-	assert.NotContains(
-		t, second, created, "an existing database is not new",
-	)
-}

internal/database/database.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/fs"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -200,12 +199,6 @@ func (d *Database) connectTo(dataDir string) error {
 	// Construct the main application database path inside DATA_DIR.
 	dbPath := filepath.Join(dataDir, MainDBFileName)
 
-	// Checked before opening, which creates the file. A DATA_DIR that
-	// is unexpectedly empty -- its volume not mounted, say -- looks
-	// exactly like a first start, so a new database is a warning.
-	_, statErr := os.Stat(dbPath)
-	created := errors.Is(statErr, fs.ErrNotExist)
-
 	// Opened through OpenSQLite so this handle carries the same WAL
 	// journaling, busy timeout, immediate-transaction locking, and pool
 	// bounds as every other database file. See sqlite_open.go.
@@ -236,12 +229,7 @@ func (d *Database) connectTo(dataDir string) error {
 	}
 
 	d.db = db
-
+	d.log.Info("connected to database", "path", dbPath)
-	if created {
-		d.log.Warn("created a new, empty database", "path", dbPath)
-	} else {
-		d.log.Info("connected to database", "path", dbPath)
-	}
 
 	// Run migrations
 	return d.migrate()

internal/delivery/engine.go

@@ -362,15 +362,6 @@ func (e *Engine) start() {
 // stop cancels the worker pool's context and waits for the pool
 // to drain, bounded by the stop hook's context: a wedged worker
 // must not hang the process past fx's stop timeout.
-//
-// Once the pool has drained it closes the archive writers, so a
-// clean stop leaves no archive -wal behind. Nothing else holds a
-// writer for long by then: the archive sweeper stops before the
-// engine, and deleting a webhook only closes one. If the pool did
-// not drain in time, the writers are left open, as a kill would
-// leave them. Closing them would wait for any write in progress,
-// and a worker still running would then open new writers that
-// nothing closes, so it gains nothing over a kill.
 func (e *Engine) stop(ctx context.Context) error {
 	e.log.Info("delivery engine stopping")
 
@@ -385,8 +376,6 @@ func (e *Engine) stop(ctx context.Context) error {
 		return err
 	}
 
-	e.dbTarget.evictAll()
-
 	e.log.Info("delivery engine stopped")
 
 	return nil

internal/delivery/engine_lifecycle_test.go

@@ -2,8 +2,6 @@ package delivery_test
 
 import (
 	"context"
-	"fmt"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -271,88 +269,3 @@ func TestEngine_StopHookHonoursStopTimeout(t *testing.T) {
 
 	requireStopHookExpires(t, lc.hooks[0], "delivery engine")
 }
-
-// deliverToArchive runs one delivery to a database target through
-// the running engine and returns the webhook's archive file path.
-// The archive writer holds the file open afterwards.
-func deliverToArchive(t *testing.T, s iSetup) string {
-	t.Helper()
-
-	deliveryID, task := seedLogTask(t, s)
-	task.TargetType = database.TargetTypeDatabase
-
-	s.Engine.Notify([]delivery.Task{task})
-
-	iWaitForDelivered(t, s.WebhookDB, deliveryID)
-
-	return filepath.Join(
-		filepath.Dir(s.DBMgr.DBPath(s.WebhookID)),
-		fmt.Sprintf("archive-%s.db", s.WebhookID),
-	)
-}
-
-// TestEngine_StopHookClosesArchives is the regression test for an
-// archive split across two files by a clean stop. The engine never
-// closed its archive writers, so after a stop the archived rows
-// could sit in archive-{id}.db-wal while archive-{id}.db held no
-// table at all, and copying the .db on its own gave an empty
-// database.
-func TestEngine_StopHookClosesArchives(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-
-	lc := startEngineViaHook(t, s.Engine)
-
-	path := deliverToArchive(t, s)
-	require.FileExists(
-		t, path+"-wal",
-		"an open archive should have a -wal for the stop to remove",
-	)
-
-	require.NoError(t, lc.hooks[0].OnStop(context.Background()))
-
-	wals, err := filepath.Glob(
-		filepath.Join(filepath.Dir(path), "archive-*.db-wal"),
-	)
-	require.NoError(t, err)
-	require.Empty(
-		t, wals, "a clean stop must leave no archive -wal behind",
-	)
-
-	// With no -wal beside it, the row can only be in the .db.
-	count, err := countArchivedRows(path)
-	require.NoError(t, err)
-	require.Equal(t, int64(1), count)
-}
-
-// TestEngine_StopHookTimeoutLeavesArchivesOpen covers a stop whose
-// budget runs out while a worker is still running. The archive
-// writers are left open, as a kill would leave them: closing them
-// would wait for any write in progress, and that worker would then
-// open new writers that nothing closes.
-func TestEngine_StopHookTimeoutLeavesArchivesOpen(t *testing.T) {
-	t.Parallel()
-
-	s := newISetup(t)
-
-	lc := startEngineViaHook(t, s.Engine)
-
-	deliverToArchive(t, s)
-
-	release := make(chan struct{})
-
-	t.Cleanup(func() {
-		close(release)
-		s.Engine.EvictWebhook(s.WebhookID)
-	})
-
-	s.Engine.ExportWedgeWorker(release)
-
-	requireStopHookExpires(t, lc.hooks[0], "delivery engine")
-
-	require.True(
-		t, s.Engine.ExportArchiveHandleOpen(s.WebhookID),
-		"a stop that timed out must not close archive writers",
-	)
-}

internal/delivery/engine_test.go

@@ -1166,10 +1166,6 @@ func TestIsForwardableHeader(t *testing.T) {
 	assert.False(t,
 		delivery.ExportIsForwardableHeader("Content-Length"),
 	)
-
-	assert.False(t,
-		delivery.ExportIsForwardableHeader("Content-Type"),
-	)
 }
 
 func TestTruncate(t *testing.T) {
@@ -1251,81 +1247,6 @@ func TestDoHTTPRequest_ForwardsHeaders(t *testing.T) {
 	)
 }
 
-// The event's stored inbound headers carry the same Content-Type the
-// receiver saved as the event's ContentType, so a delivery could send
-// it twice. It must go out exactly once, with a Content-Type configured
-// on the target winning, then the event's ContentType.
-func TestApplyRequestHeaders_SendsOneContentType(t *testing.T) {
-	t.Parallel()
-
-	cases := map[string]struct {
-		inbound    string
-		event      string
-		configured string
-		want       []string
-	}{
-		"inbound and event agree": {
-			inbound: testContentType,
-			event:   testContentType,
-			want:    []string{testContentType},
-		},
-		"inbound and event disagree": {
-			inbound: "text/plain",
-			event:   testContentType,
-			want:    []string{testContentType},
-		},
-		"event has none": {
-			inbound: testContentType,
-			want:    nil,
-		},
-		"target configures its own": {
-			inbound:    testContentType,
-			event:      testContentType,
-			configured: "application/xml",
-			want:       []string{"application/xml"},
-		},
-	}
-
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			inbound, err := json.Marshal(map[string][]string{
-				headerContentType: {tc.inbound},
-			})
-			require.NoError(t, err)
-
-			cfg := &delivery.HTTPTargetConfig{}
-			if tc.configured != "" {
-				cfg.Headers = map[string]string{
-					headerContentType: tc.configured,
-				}
-			}
-
-			req, err := http.NewRequestWithContext(
-				context.Background(),
-				http.MethodPost,
-				"https://target.example.com/hook",
-				http.NoBody,
-			)
-			require.NoError(t, err)
-
-			delivery.ExportApplyRequestHeaders(
-				req,
-				&database.Event{
-					Headers:     string(inbound),
-					ContentType: tc.event,
-				},
-				cfg,
-			)
-
-			assert.Equal(t,
-				tc.want, req.Header.Values(headerContentType),
-			)
-		})
-	}
-}
-
 func TestProcessDelivery_RoutesToCorrectHandler(
 	t *testing.T,
 ) {

internal/delivery/redirect_test.go

@@ -339,11 +339,10 @@ func TestRedirectPolicy_StopsAtHopCap(t *testing.T) {
 // The set the redirect policy strips is whatever the delivery path
 // actually put on the wire, so a header added to the forward set is
 // covered without a second edit. A header the event never carried
-// is not in the set, and neither is the inbound Content-Type, because
+// is not in the set, and the delivery path's own two are deliberately
-// it is not forwarded. Two more are deliberately excluded: a
+// excluded: Content-Type describes the body, which a 307 carries
-// Content-Type configured on the target describes the body, which a
+// across hosts, and the inbound User-Agent every real sender supplies
-// 307 carries across hosts, and the inbound User-Agent every real
+// is overwritten before the request goes out.
-// sender supplies is overwritten before the request goes out.
 func TestApplyRequestHeaders_ReportsOriginScopedNames(t *testing.T) {
 	t.Parallel()
 
@@ -372,7 +371,6 @@ func TestApplyRequestHeaders_ReportsOriginScopedNames(t *testing.T) {
 		&delivery.HTTPTargetConfig{
 			Headers: map[string]string{
 				probeHeaderName: probeHeaderValue,
-				"Content-Type":  testContentType,
 			},
 		},
 	)
@@ -380,11 +378,7 @@ func TestApplyRequestHeaders_ReportsOriginScopedNames(t *testing.T) {
 	assert.Equal(t,
 		[]string{probeHeaderName, inboundHeaderName}, names,
 		"both header classes are reported, and only those: "+
-			"Host and the inbound Content-Type are never "+
+			"Host is never forwarded, Content-Type and "+
-			"forwarded, User-Agent is the delivery path's own",
+			"User-Agent are the delivery path's own",
-	)
-	assert.NotContains(t, names, "Content-Type",
-		"a Content-Type configured on the target must survive "+
-			"a cross-origin 307/308 with the body it describes",
 	)
 }

internal/delivery/ssrf.go

@@ -26,7 +26,7 @@ var (
 		"hostname resolved to no IP addresses",
 	)
 	errBlockedIP = errors.New(
-		"blocked private, reserved or cloud metadata address",
+		"blocked private/reserved IP range",
 	)
 	errBlockedMetadata = errors.New(
 		"blocked link-local or cloud instance metadata " +
@@ -37,10 +37,9 @@ var (
 	)
 )
 
-// blockedNetworks is the default blocklist: the private and
+// blockedNetworks contains all private/reserved IP ranges
-// reserved IP ranges, plus the public cloud metadata addresses,
+// that should be blocked to prevent SSRF attacks. An operator
-// that are blocked to prevent SSRF attacks. An operator can
+// can permit specific blocks out of this set with
-// permit specific blocks out of this set with
 // ALLOWED_EGRESS_CIDRS; see Guard.
 //
 //nolint:gochecknoglobals // package-level network list is appropriate here
@@ -123,8 +122,6 @@ func init() {
 		"::1/128",
 		"fc00::/7",
 		"fe80::/10",
-		// Azure WireServer, a public address that serves VM credentials.
-		"168.63.129.16/32",
 	})
 
 	// Every entry is named. The set must not grow or shrink
@@ -219,8 +216,8 @@ func matchesAny(networks []*net.IPNet, ip net.IP) bool {
 }
 
 // isBlockedIP checks whether an IP address falls within
-// the default blocklist, before any operator allowlist is
+// any blocked private/reserved network range, before any
-// considered.
+// operator allowlist is considered.
 func isBlockedIP(ip net.IP) bool {
 	return matchesAny(blockedNetworks, ip)
 }
@@ -323,7 +320,7 @@ func (g *Guard) allows(ip net.IP) bool {
 //
 //  1. alwaysBlockedNetworks is refused before the allowlist is
 //     consulted, so no configured CIDR reaches link-local or a
-//     cloud metadata endpoint at a non-public address.
+//     cloud instance metadata endpoint.
 //  2. The allowlist is consulted next, so a listed private
 //     network becomes reachable.
 //  3. Everything else keeps the default blocklist's answer.

internal/delivery/ssrf_allowlist_test.go

@@ -390,41 +390,6 @@ func TestGuardAllowlist_PublicUnaffected(t *testing.T) {
 	}
 }
 
-// TestGuardAllowlist_AzureWireServerReopenable covers Azure's
-// WireServer, a public address that serves VM credentials. The
-// default guard refuses it, but because it is public it sits in
-// the default blocklist rather than the unconditional set, so an
-// operator who lists it can reach it.
-func TestGuardAllowlist_AzureWireServerReopenable(t *testing.T) {
-	t.Parallel()
-
-	const wireServerIP = "168.63.129.16"
-
-	target := "http://" + wireServerIP + "/?comp=versions"
-
-	defaultGuard := delivery.NewTestGuard()
-
-	err := defaultGuard.ValidateTargetURL(context.Background(), target)
-	require.Error(t, err,
-		"WireServer must be refused with no allowlist set",
-	)
-	assert.NotContains(t, err.Error(), metadataRefusalClause,
-		"WireServer must be refused by the default blocklist, "+
-			"which an allowlist can override",
-	)
-
-	assertDialRefused(t, defaultGuard, target)
-
-	listed := delivery.NewTestGuard(
-		netip.MustParsePrefix(wireServerIP + "/32"),
-	)
-
-	assert.NoError(t,
-		listed.ValidateTargetURL(context.Background(), target),
-		"an operator who lists WireServer must be able to reach it",
-	)
-}
-
 // TestGuardCheckIP_BothPathsShareOneDecision asserts that the
 // validator and the dialer are not two policies that happen to
 // agree: both are defined in terms of checkIP, so the exported

internal/delivery/target_database.go

@@ -277,24 +277,6 @@ func (t *databaseTarget) evict(webhookID string) {
 	)
 }
 
-// evictAll evicts every cached archive writer, exactly as evict
-// does for one webhook. The engine calls it at shutdown, once its
-// workers have returned. Closing the last handle on an archive
-// moves the contents of its -wal into the .db and removes the
-// -wal, so a clean stop leaves each archive as a single file.
-func (t *databaseTarget) evictAll() {
-	t.mu.Lock()
-
-	writers := t.writers
-	t.writers = nil
-
-	t.mu.Unlock()
-
-	for _, w := range writers {
-		w.evict()
-	}
-}
-
 // sweepWebhook prunes one webhook's archive of rows older than
 // expiry, without requiring a write. It returns nil (nothing to
 // do) when the archive file does not exist, so a sweep never

internal/delivery/target_database_evict_test.go

@@ -1,7 +1,6 @@
 package delivery_test
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"net/http"
@@ -362,46 +361,3 @@ func TestEvictWebhook_LaterDeliveryRecreatesWriter(t *testing.T) {
 		"a later delivery should recreate the writer",
 	)
 }
-
-// TestEngineStop_WriteAfterStopIsRefused proves the engine's stop
-// closes each archive writer the way deleting its webhook does: a
-// write that reaches a writer after the stop is refused, reopens
-// nothing and adds no row.
-func TestEngineStop_WriteAfterStopIsRefused(t *testing.T) {
-	t.Parallel()
-
-	eng, _ := evictTestEngine(t)
-
-	webhookDB := testWebhookDB(t)
-	event := seedEvent(t, webhookDB, `{"archived":true}`)
-	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
-
-	eng.ExportDeliverDatabase(webhookDB, d)
-
-	w := eng.ExportArchiveWriterFor(event.WebhookID)
-	require.NotNil(t, w)
-	require.True(t, w.HandleOpen())
-
-	require.NoError(t, eng.ExportStop(context.Background()))
-
-	err := w.Write(evictTestRow("ev-after-stop"), 0)
-
-	require.ErrorIs(
-		t, err, delivery.ErrExportArchiveWriterEvicted,
-		"a write after the stop must be refused",
-	)
-	assert.False(
-		t, w.HandleOpen(),
-		"a refused write must not reopen the archive",
-	)
-	assert.False(
-		t, eng.ExportHasArchiveWriter(event.WebhookID),
-		"the stop should empty the registry",
-	)
-
-	count, err := countArchivedRows(w.Path())
-	require.NoError(t, err)
-	assert.Equal(
-		t, int64(1), count, "the refused row must not be written",
-	)
-}

internal/delivery/target_headers_test.go

@@ -11,11 +11,10 @@ import (
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 
-// Literals these tests repeat, named so that the header names and the
+// Literals these tests repeat, named so that the header name and the
 // keep-forever archive config each have one definition.
 const (
 	headerAuthorization = "Authorization"
-	headerContentType   = "Content-Type"
 	bearerValue         = "Bearer abc"
 	archiveConfigNever  = "{\"expiry\":\"never\"}"
 )

internal/delivery/target_http.go

@@ -541,11 +541,6 @@ func isForwardableHeader(name string) bool {
 		"Upgrade", "Proxy-Authorization",
 		"Proxy-Connection", "Content-Length":
 		return false
-	case "Content-Type":
-		// applyRequestHeaders sets Content-Type itself. The receiver
-		// already stored this inbound value as the event's
-		// ContentType, so forwarding it too would send it twice.
-		return false
 	default:
 		return true
 	}
@@ -558,10 +553,6 @@ func isForwardableHeader(name string) bool {
 // policy strips exactly that set on a hop that leaves the origin,
 // so the forward set is decided here and only here — a header added
 // to it is covered off-origin without a second edit elsewhere.
-//
-// Content-Type goes out once: a Content-Type configured on the target
-// wins, otherwise the event's ContentType, otherwise none. The inbound
-// Content-Type in the event's headers is never forwarded.
 func applyRequestHeaders(
 	req *http.Request,
 	event *database.Event,
@@ -582,10 +573,10 @@ func applyRequestHeaders(
 
 	req.Header.Set("User-Agent", "webhooker/1.0")
 
-	// A Content-Type configured on the target describes the body
+	// Content-Type describes the body being sent rather than the
-	// being sent rather than the sender. A 307/308 preserves the
+	// sender, and the delivery path sets it from the event itself.
-	// body across hosts, so stripping it would send that body
+	// A 307/308 preserves the body across hosts, so stripping it
-	// untyped.
+	// would send that body untyped.
 	delete(originScoped, "Content-Type")
 
 	// User-Agent is overwritten just above, so an inbound one never

internal/middleware/recoverer.go

@@ -133,11 +133,6 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
 // what the access log records and the metrics count, and outside the
 // sentryhttp handler, whose Repanic option depends on something
 // further out recovering what it re-raises.
-//
-// Unlike http.Error on its own, it deletes any Set-Cookie the handler
-// set before panicking, because a request that failed must not hand
-// the client a credential; every other header is left to http.Error.
-// See https://git.eeqj.de/sneak/webhooker/issues/193.
 func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(
@@ -169,8 +164,6 @@ func (s *Middleware) Recoverer() func(http.Handler) http.Handler {
 					return
 				}
 
-				rw.Header().Del("Set-Cookie")
-
 				http.Error(
 					rw,
 					http.StatusText(

internal/middleware/recoverer_test.go

@@ -304,44 +304,16 @@ func TestRecovererRepanicsErrAbortHandler(t *testing.T) {
 	)
 }
 
-// TestRecovererDropsSetCookieFromTheRecovered500 covers a handler that
-// sets a cookie and a redirect target and then panics before sending
-// anything. A request that failed must not hand the client a
-// credential, so the 500 carries no cookie; Location is left alone.
-func TestRecovererDropsSetCookieFromTheRecovered500(t *testing.T) {
-	t.Parallel()
-
-	probe := newRecovererProbe(
-		t, false,
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set("Set-Cookie", "session=x")
-			w.Header().Set("Location", "/after")
-
-			panic(panicMarker)
-		},
-	)
-
-	resp, err := probe.get(t)
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-
-	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
-	assert.Empty(t, resp.Cookies())
-	assert.Equal(t, "/after", resp.Header.Get("Location"))
-}
-
 // TestRecovererKeepsAnAlreadyCommittedResponse covers a handler that
 // panics after sending its status. The bytes are already on the wire,
-// cookie included, so a second WriteHeader would change nothing the
+// so a second WriteHeader would change nothing the client sees and
-// client sees and would draw net/http's "superfluous
+// would draw net/http's "superfluous response.WriteHeader" report.
-// response.WriteHeader" report.
 func TestRecovererKeepsAnAlreadyCommittedResponse(t *testing.T) {
 	t.Parallel()
 
 	probe := newRecovererProbe(
 		t, false,
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set("Set-Cookie", "session=x")
 			w.WriteHeader(committedStatus)
 			_, _ = w.Write([]byte("partial"))
 
@@ -359,7 +331,6 @@ func TestRecovererKeepsAnAlreadyCommittedResponse(t *testing.T) {
 
 	assert.Equal(t, committedStatus, resp.StatusCode)
 	assert.Equal(t, "partial", string(body))
-	assert.Len(t, resp.Cookies(), 1)
 
 	record := probe.panicRecord(t)
 	assert.Equal(t, panicMarker, record["panic"])

internal/server/routes.go

@@ -92,25 +92,11 @@ func (s *Server) setupGlobalMiddleware() {
 func (s *Server) setupRoutes() {
 	s.router.Get("/", s.h.HandleIndex())
 
-	// Static assets answer GET and HEAD only. chi's default 405
+	s.router.Mount(
-	// carries no Allow header, so this group supplies its own.
+		"/s",
-	staticFiles := http.StripPrefix(
+		http.StripPrefix("/s", http.FileServer(http.FS(static.Static))),
-		"/s", http.FileServer(http.FS(static.Static)),
 	)
 
-	s.router.Route("/s", func(r chi.Router) {
-		r.MethodNotAllowed(func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set("Allow", "GET, HEAD")
-			http.Error(
-				w,
-				"Method Not Allowed",
-				http.StatusMethodNotAllowed,
-			)
-		})
-		r.Method(http.MethodGet, "/*", staticFiles)
-		r.Method(http.MethodHead, "/*", staticFiles)
-	})
-
 	s.router.Route("/api/v1", func(_ chi.Router) {
 		// API routes will be added here.
 	})

internal/server/routes_test.go

@@ -7,7 +7,6 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 	"testing"
@@ -221,21 +220,9 @@ func (e *testEnv) csrfFrom(
 	// out of the markup has to be unescaped before it is submitted.
 	token := html.UnescapeString(match[1])
 
-	// A cookie the page sets replaces the one of the same name, as in
+	combined := make([]*http.Cookie, 0, len(cookies))
-	// a browser. Sent both, the server would read the first, older one.
+	combined = append(combined, cookies...)
-	set := w.Result().Cookies()
+	combined = append(combined, w.Result().Cookies()...)
-	combined := make([]*http.Cookie, 0, len(cookies)+len(set))
-
-	for _, c := range cookies {
-		replaced := slices.ContainsFunc(set, func(n *http.Cookie) bool {
-			return n.Name == c.Name
-		})
-		if !replaced {
-			combined = append(combined, c)
-		}
-	}
-
-	combined = append(combined, set...)
 
 	return token, combined
 }
@@ -409,15 +396,13 @@ func (e *testEnv) storedHash(t *testing.T, username string) string {
 
 // --- /s static group ---
 
-// TestStaticServesOnlyGetAndHead pins the methods the static group
+// TestStaticServesEveryMethod pins what the static mount actually
-// answers: GET and HEAD are served the asset, and the other methods
+// answers. chi's Mount registers the handler for all methods and
-// chi routes (POST, PUT, DELETE and the rest) are refused with 405
+// http.FileServer only special-cases HEAD (by suppressing the body),
-// and an Allow header naming those two. A method chi does not route,
+// so a POST or a DELETE to an asset is served the file rather than
-// such as PROPFIND, is refused with 405 by the top-level router
+// refused. The README documents this; the test is what keeps the two
-// before it reaches the static group, so it gets no Allow header.
+// from drifting.
-// The README documents this; the test is what keeps the two from
+func TestStaticServesEveryMethod(t *testing.T) {
-// drifting.
-func TestStaticServesOnlyGetAndHead(t *testing.T) {
 	t.Parallel()
 
 	env := newTestEnv(t)
@@ -432,7 +417,6 @@ func TestStaticServesOnlyGetAndHead(t *testing.T) {
 		http.MethodPost,
 		http.MethodPut,
 		http.MethodDelete,
-		"PROPFIND",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
@@ -444,38 +428,18 @@ func TestStaticServesOnlyGetAndHead(t *testing.T) {
 			w := httptest.NewRecorder()
 			env.router.ServeHTTP(w, req)
 
-			switch method {
+			assert.Equal(t, http.StatusOK, w.Code,
-			case http.MethodGet:
+				"static mount answers every method")
-				assert.Equal(t, http.StatusOK, w.Code)
+
-				assert.Equal(t, body, w.Body.Bytes(),
+			if method == http.MethodHead {
-					"the asset itself is returned")
-			case http.MethodHead:
-				assert.Equal(t, http.StatusOK, w.Code)
 				assert.Empty(t, w.Body.Bytes(),
 					"HEAD must not carry a body")
-			case "PROPFIND":
+
-				assert.Equal(
+				return
-					t, http.StatusMethodNotAllowed, w.Code,
-				)
-				assert.Empty(t, w.Header().Get("Allow"),
-					"chi refuses a method it does not route "+
-						"before the static group runs")
-				assert.NotContains(
-					t, w.Body.String(), string(body),
-					"a refused method must not get the asset",
-				)
-			default:
-				assert.Equal(
-					t, http.StatusMethodNotAllowed, w.Code,
-				)
-				assert.Equal(
-					t, "GET, HEAD", w.Header().Get("Allow"),
-				)
-				assert.NotContains(
-					t, w.Body.String(), string(body),
-					"a refused method must not get the asset",
-				)
 			}
+
+			assert.Equal(t, body, w.Body.Bytes(),
+				"the asset itself is returned")
 		})
 	}
 }
@@ -627,59 +591,6 @@ func TestPagesLogin_CorrectPasswordSurvivesASpentBudget(
 	)
 }
 
-// TestPagesLogin_CookiesFromAnEarlierDatabase is
-// https://git.eeqj.de/sneak/webhooker/issues/359. A new database
-// brings a new session key, and the operator's browser still holds
-// the session and CSRF cookies signed with the old one. Logging in
-// must work as from a fresh browser and leave cookies the new key
-// accepts.
-func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
-	t.Parallel()
-
-	const (
-		username = "operator"
-		password = "correct-horse-battery-staple"
-	)
-
-	earlier := newTestEnv(t)
-	earlierID, _ := earlier.seedUser(t, username, password)
-	_, stale := earlier.csrfFrom(t, "/pages/login", nil)
-	stale = append(stale, earlier.authCookies(t, earlierID, username)...)
-
-	env := newTestEnv(t)
-	env.seedUser(t, username, password)
-
-	token, cookies := env.csrfFrom(t, "/pages/login", stale)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("username", username)
-	form.Set("password", password)
-
-	w := env.post("/pages/login", form, cookies)
-	require.Equal(
-		t, http.StatusSeeOther, w.Code,
-		"a session cookie from another key must not fail the login",
-	)
-
-	// The response deletes the old session cookie and then sets the
-	// new one; a browser keeps the last.
-	var fresh *http.Cookie
-
-	for _, c := range w.Result().Cookies() {
-		if c.Name == session.SessionName {
-			fresh = c
-		}
-	}
-
-	require.NotNil(t, fresh, "login must set a session cookie")
-	assert.Equal(
-		t, "/sources",
-		env.get("/", []*http.Cookie{fresh}).Header().Get("Location"),
-		"the new session cookie must authenticate",
-	)
-}
-
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged

internal/session/codec_test.go

@@ -19,8 +19,8 @@ import (
 )
 
 // The tests below exercise the securecookie codecs underneath the
-// store and nothing else: they decode through the store itself, so no
+// store and nothing else: Session.Get only decodes, so no server-side
-// server-side expiry check takes part in the result. They exist because
+// expiry check takes part in the result. They exist because
 // NewCookieStore gives its codecs a 30-day max age that assigning
 // store.Options does not override, which would let the codec accept a
 // cookie weeks past the cap the cookie attribute advertises.
@@ -75,11 +75,10 @@ func restamp(
 	return base64.URLEncoding.EncodeToString(payload)
 }
 
-// decodeCookie feeds value back through the store's decode path. It
+// decodeCookie feeds value back through the store's decode path.
-// asks the store rather than Session.Get, which treats a cookie that
-// does not decode as absent and so hides the codec's reason.
 func decodeCookie(
 	t *testing.T,
+	s *session.Session,
 	value string,
 ) (*sessions.Session, error) {
 	t.Helper()
@@ -95,7 +94,7 @@ func decodeCookie(
 		SameSite: http.SameSiteLaxMode,
 	})
 
-	sess, err := session.NewStore(testKey()).Get(req, session.SessionName)
+	sess, err := s.Get(req)
 	require.NotNil(t, sess)
 
 	return sess, err
@@ -106,7 +105,7 @@ func TestCodec_AcceptsCookieInsideAbsoluteCap(t *testing.T) {
 
 	s := testSession(t)
 
-	sess, err := decodeCookie(t, restamp(
+	sess, err := decodeCookie(t, s, restamp(
 		t,
 		issuedCookie(t, s),
 		time.Now().Add(-(testAbsoluteMaxAge-time.Hour)),
@@ -127,7 +126,7 @@ func TestCodec_RejectsCookiePastAbsoluteCap(t *testing.T) {
 
 	s := testSession(t)
 
-	sess, err := decodeCookie(t, restamp(
+	sess, err := decodeCookie(t, s, restamp(
 		t,
 		issuedCookie(t, s),
 		time.Now().Add(-(testAbsoluteMaxAge+time.Hour)),

internal/session/session.go

@@ -224,22 +224,10 @@ func New(
 }
 
 // Get retrieves a session for the request.
-//
-// A session cookie that does not decode -- one signed with an earlier
-// session key, say, because the database was made anew -- is treated
-// as absent: the caller gets a new, empty session and no error, and
-// the next save replaces the cookie.
 func (s *Session) Get(
 	r *http.Request,
 ) (*sessions.Session, error) {
-	sess, err := s.store.Get(r, SessionName)
+	return s.store.Get(r, SessionName)
-	if sess == nil {
-		return nil, err
-	}
-
-	// For a cookie that does not decode, gorilla/sessions returns a
-	// new, empty session alongside the error that is dropped here.
-	return sess, nil
 }
 
 // GetKey returns the raw 32-byte authentication key used for