audit the whole app for stupid cases of missing functionality or basic things like this (like the stats panel at the top that i requested).
What is wrong: the three delete confirmations on the webhook page (templates/source_detail.html) are generic: "Delete this webhook and all its data?", "Delete this entrypoint?" and "Delete this target?". None of them names the thing being deleted.
The webhook prompt says all its data goes, but its archive files stay on disk (owner-confirmed, #376). It also does not say how many stored events are about to be destroyed.
The entrypoint prompt does not say that its URL stops working for good. A new entrypoint gets a new URL, so a deleted one cannot be restored.
Definition of done:
Each confirmation names the item, for example: Delete webhook "Orders"?
Each one says what is lost:
webhook: its stored events and their deliveries, with the number of events, while its archive files are kept;
entrypoint: senders using this URL get an error from now on, and the URL cannot be restored;
target: nothing more is delivered to it, and its past deliveries stay in the event log.
Each confirmation works without the page's script library, as the current browser prompt does.
Tests: each prompt's text contains the item's name and the event count where it applies.
PRIORITY: from the owner's audit request of 1 October (#377), in the tier of #367 to #376.
Model: opus-5-5
Owner's request, https://git.eeqj.de/sneak/webhooker/issues/377 (chat, 2026-10-01):
> audit the whole app for stupid cases of missing functionality or basic things like this (like the stats panel at the top that i requested).
What is wrong: the three delete confirmations on the webhook page (`templates/source_detail.html`) are generic: "Delete this webhook and all its data?", "Delete this entrypoint?" and "Delete this target?". None of them names the thing being deleted.
- The webhook prompt says all its data goes, but its archive files stay on disk (owner-confirmed, https://git.eeqj.de/sneak/webhooker/issues/376). It also does not say how many stored events are about to be destroyed.
- The entrypoint prompt does not say that its URL stops working for good. A new entrypoint gets a new URL, so a deleted one cannot be restored.
Definition of done:
- Each confirmation names the item, for example: Delete webhook "Orders"?
- Each one says what is lost:
- webhook: its stored events and their deliveries, with the number of events, while its archive files are kept;
- entrypoint: senders using this URL get an error from now on, and the URL cannot be restored;
- target: nothing more is delivered to it, and its past deliveries stay in the event log.
- Each confirmation works without the page's script library, as the current browser prompt does.
- Tests: each prompt's text contains the item's name and the event count where it applies.
PRIORITY: from the owner's audit request of 1 October (https://git.eeqj.de/sneak/webhooker/issues/377), in the tier of https://git.eeqj.de/sneak/webhooker/issues/367 to https://git.eeqj.de/sneak/webhooker/issues/376.
Model: opus-5-5
clawbot
self-assigned this 2026-10-01 22:06:26 +02:00
The three confirmations in templates/source_detail.html stay the browser prompts they are now (inline onsubmit confirm, which works without the page's script library), with new text:
webhook: names it and says that its N stored events and their deliveries are deleted while its archive files are kept; N is the count the statistics pane at the top of the page already shows, with no new query;
entrypoint: names it by its description (or its URL when it has none) and says that senders using this URL get an error from now on and the URL cannot be restored;
target: names it and says nothing more is delivered to it and its past deliveries stay in the event log.
A name is put into the prompt through the template's own escaping for script text, so a name with a quote, a backslash or </script> neither breaks the prompt nor runs.
Tests: each prompt contains the item's name, the webhook's contains its event count, and a name with a quote and a backslash comes through intact.
Model: opus-5-5
Plan.
- The three confirmations in `templates/source_detail.html` stay the browser prompts they are now (inline `onsubmit` confirm, which works without the page's script library), with new text:
- webhook: names it and says that its N stored events and their deliveries are deleted while its archive files are kept; N is the count the statistics pane at the top of the page already shows, with no new query;
- entrypoint: names it by its description (or its URL when it has none) and says that senders using this URL get an error from now on and the URL cannot be restored;
- target: names it and says nothing more is delivered to it and its past deliveries stay in the event log.
- A name is put into the prompt through the template's own escaping for script text, so a name with a quote, a backslash or `</script>` neither breaks the prompt nor runs.
- Tests: each prompt contains the item's name, the webhook's contains its event count, and a name with a quote and a backslash comes through intact.
Model: opus-5-5
Done in #485. The webhook, entrypoint and target delete prompts now name the item and say what is lost: the webhook's stored events, with their number, and their deliveries, while any archive files are kept; the entrypoint's URL, which stops working for good; the target's future deliveries, while its past ones stay in the event log. They stay the browser's own prompts, and a quote or a backslash in a name shows as typed.
Judgement call: the number is in parentheses, "its stored events (42)", so the sentence reads right for one event too.
Judgement call: "any archive files it wrote are kept", since a webhook without a database target has none.
Judgement call: when the statistics cannot be read, the webhook prompt leaves the number out.
Model: opus-5-5
Done in https://git.eeqj.de/sneak/webhooker/pulls/485. The webhook, entrypoint and target delete prompts now name the item and say what is lost: the webhook's stored events, with their number, and their deliveries, while any archive files are kept; the entrypoint's URL, which stops working for good; the target's future deliveries, while its past ones stay in the event log. They stay the browser's own prompts, and a quote or a backslash in a name shows as typed.
- Judgement call: the number is in parentheses, "its stored events (42)", so the sentence reads right for one event too.
- Judgement call: "any archive files it wrote are kept", since a webhook without a database target has none.
- Judgement call: when the statistics cannot be read, the webhook prompt leaves the number out.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Owner's request, #377 (chat, 2026-10-01):
What is wrong: the three delete confirmations on the webhook page (
templates/source_detail.html) are generic: "Delete this webhook and all its data?", "Delete this entrypoint?" and "Delete this target?". None of them names the thing being deleted.Definition of done:
PRIORITY: from the owner's audit request of 1 October (#377), in the tier of #367 to #376.
Model: opus-5-5
Plan.
templates/source_detail.htmlstay the browser prompts they are now (inlineonsubmitconfirm, which works without the page's script library), with new text:</script>neither breaks the prompt nor runs.Model: opus-5-5
Done in #485. The webhook, entrypoint and target delete prompts now name the item and say what is lost: the webhook's stored events, with their number, and their deliveries, while any archive files are kept; the entrypoint's URL, which stops working for good; the target's future deliveries, while its past ones stay in the event log. They stay the browser's own prompts, and a quote or a backslash in a name shows as typed.
Model: opus-5-5