sneak/webhooker
1
0
Fork 0
Code Issues 22 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

WIP: Milestone: delivery lifecycle, retention, config and session hardening #111

Draft
clawbot wants to merge 11 commits from next into main
pull from: next
merge into: sneak:main
Conversation 0 Commits 11 Files Changed 59 +8596 -294
clawbot commented 2026-08-10 15:45:30 +02:00
Collaborator
Copy Link

Milestone branch for 1.0.0. Issue PRs land here by squash-merge as each passes independent review; this PR is the single unit main takes.

WIP: comes off, and this gets merge-ready and assigned, once the 1.0.0 milestone is empty and next is verified green. Until then it is deliberately unmergeable.

Landed

  • Root background loops at context.Background() — the delivery engine and retention reaper no longer die ~15s after startup (#97)
  • Evict archive writers on deletion and sweep idle archives (#89)
  • Terminally fail retrying deliveries with a non-retry target type (#82)
  • Fail loudly on set-but-unparseable env config values (#80)
  • Add inactivity-based session timeout (#66)
  • Allow retention_days of 0 to mean retain forever, and bound the reaper's cutoff arithmetic against int64 overflow (#79)
  • Mask target config on the source detail page, closing a Slack webhook credential exposure (#113)
  • Enforce the body size limit before CSRF parses the form (#90)
  • Rate-limit the public webhook receiver endpoint (#64)

Still open in the milestone

  • #57 — web UI cleanup
  • #88 — gate forwarded-header trust behind trusted-proxy config. Until this lands, the receiver rate limit above is evadable by rotating X-Forwarded-For, and REPO_POLICIES.md requires trusted-proxy gating.
  • #118 — the same Slack credential still leaks via delivery errors, SSRF logs, and source_logs template data
Milestone branch for 1.0.0. Issue PRs land here by squash-merge as each passes independent review; this PR is the single unit `main` takes. `WIP: ` comes off, and this gets `merge-ready` and assigned, once the 1.0.0 milestone is empty and `next` is verified green. Until then it is deliberately unmergeable. ## Landed - Root background loops at `context.Background()` — the delivery engine and retention reaper no longer die ~15s after startup (#97) - Evict archive writers on deletion and sweep idle archives (#89) - Terminally fail retrying deliveries with a non-retry target type (#82) - Fail loudly on set-but-unparseable env config values (#80) - Add inactivity-based session timeout (#66) - Allow `retention_days` of 0 to mean retain forever, and bound the reaper's cutoff arithmetic against int64 overflow (#79) - Mask target config on the source detail page, closing a Slack webhook credential exposure (#113) - Enforce the body size limit before CSRF parses the form (#90) - Rate-limit the public webhook receiver endpoint (#64) ## Still open in the milestone - https://git.eeqj.de/sneak/webhooker/issues/57 — web UI cleanup - https://git.eeqj.de/sneak/webhooker/issues/88 — gate forwarded-header trust behind trusted-proxy config. Until this lands, the receiver rate limit above is evadable by rotating `X-Forwarded-For`, and `REPO_POLICIES.md` requires trusted-proxy gating. - https://git.eeqj.de/sneak/webhooker/issues/118 — the same Slack credential still leaks via delivery errors, SSRF logs, and `source_logs` template data
clawbot added 1 commit 2026-08-10 15:45:30 +02:00
Root background loops at context.Background() (closes #97) (#100)
All checks were successful
check / check (push) Successful in 5s
Details
62481a6f1a 
The delivery engine worker pool and the retention reaper both rooted their
goroutines in the fx OnStart hook context, which fx cancels 15s into startup.
Both now use context.WithCancel(context.Background()), bounded by OnStop.
clawbot self-assigned this 2026-08-10 15:45:42 +02:00
clawbot added the needs-checks label 2026-08-10 15:45:42 +02:00
clawbot added 1 commit 2026-08-10 15:52:22 +02:00
Evict archive writers on deletion and sweep idle archives (closes #89) (#95)
Some checks failed
check / check (push) Has been cancelled
Details
3e261d2f01 
Per-webhook archive writers are now evicted when the webhook or its last
database target is deleted, and a background sweeper prunes expired rows from
idle archives that no longer receive writes. Archive files themselves are never
deleted.
clawbot added 1 commit 2026-08-10 16:00:05 +02:00
Terminally fail retrying deliveries with a non-retry target type (closes #82) (#104)
Some checks failed
check / check (push) Has been cancelled
Details
0ce8565f51 
A delivery left in `retrying` whose target type was edited to a fire-and-forget
or unknown type was skipped forever by both restart recovery and the retry
sweep. Both paths now record a result row and mark it `failed`.
clawbot added 1 commit 2026-08-10 16:06:13 +02:00
Fail loudly on set-but-unparseable env config values (closes #80) (#92)
Some checks failed
check / check (push) Has been cancelled
Details
45890d4f82 
Defaults now apply only to unset or empty environment variables; a set-but-
unparseable value aborts startup with an error naming the key and the value.
envInt is gone, envBool parses with strconv.ParseBool, and PORT is bounded.
clawbot added 1 commit 2026-08-10 16:12:42 +02:00
Add inactivity-based session timeout (closes #66) (#105)
All checks were successful
check / check (push) Successful in 4s
Details
c2cd2c440b 
Sessions now carry a server-enforced idle deadline (SESSION_IDLE_TIMEOUT,
default 24h) alongside the 7-day absolute cap, refreshed on authenticated
activity. Activity never extends the absolute cap.
clawbot added 1 commit 2026-08-11 14:35:35 +02:00
Allow retention_days of 0 to mean retain forever (closes #79)
Some checks failed
check / check (push) Has been cancelled
Details
e50a79ced9 
Rewrites retention_days=0 to the RetentionForeverDays sentinel (365 * 1000)
in Webhook.BeforeSave, so the GORM column default cannot win the race. The
reaper skips retain-forever webhooks before building any query.

Also bounds the reaper's cutoff arithmetic: a time.Duration is int64
nanoseconds, so day counts above MaxFiniteRetentionDays (106751) overflowed
and wrapped the cutoff into the future, where created_at < cutoff matched
every row and the sweep deleted everything. parseRetentionDays now rejects
finite values above the ceiling, and retentionCutoff saturates so rows
written by older versions cannot reach it either.

Views render RetentionLabel() rather than the raw sentinel.
clawbot added 1 commit 2026-08-11 14:37:11 +02:00
Mask target config on the source detail page (closes #113)
Some checks failed
check / check (push) Has been cancelled
Details
15a61173fc 
The page rendered the stored target config verbatim, exposing the Slack
incoming-webhook URL, which is a bearer credential: anyone holding it can
post to the channel indefinitely, and it cannot be scoped or revoked
per-holder.

Target config now reaches the template only as a TargetView carrying
labelled fields, so no code path can render the raw blob. maskURL keeps
scheme and host and elides the path, and drops query, fragment and
userinfo; every parse failure yields a neutral placeholder rather than
falling back to the stored string. HTTP header values are never rendered,
only a count.

Rendering change only: the stored config format and the delivery path are
unchanged.
clawbot added 1 commit 2026-08-11 14:37:41 +02:00
Enforce the body size limit before CSRF parses the form (closes #90)
Some checks failed
check / check (push) Has been cancelled
Details
d51cd0fd29 
CSRF ran before MaxBodySize, so the CSRF middleware parsed the form body
before any cap applied and an oversized request was read in full before
being rejected. MaxBodySize is now the first middleware in all four route
groups that parse forms, ahead of CSRF and RequireAuth.

An oversize request therefore gets 413 without the handler running and
without state changing, including the password-change route.

Note the ordering trade: an unauthenticated client now receives 413 rather
than an auth redirect on /user/{username}/password.
clawbot added 1 commit 2026-08-11 14:47:22 +02:00
Rate-limit the public webhook receiver endpoint (closes #64)
All checks were successful
check / check (push) Successful in 5s
Details
84b758b785 
The receiver was the one unauthenticated, internet-facing endpoint with no
rate limit, so a misbehaving or hostile sender could flood a webhook
without bound. RECEIVER_RATE_LIMIT (default 120/min) now caps it, keyed on
client IP plus entrypoint path so one entrypoint cannot exhaust another's
budget. Over-limit requests get 429 with Retry-After.

The limiter deliberately does not reuse postRateLimit: that helper is
POST-only and keys on IP alone, whereas the receiver must count every
method. A test locks that property in.

Config parsing follows the fail-loudly idiom: a set-but-unparseable or
non-positive value aborts startup rather than falling back to the default.

Known limitation, tracked in #88: the key still trusts forwarded headers
unconditionally, so the limit is evadable by rotating X-Forwarded-For until
trusted-proxy gating lands.
clawbot added 1 commit 2026-08-11 15:12:00 +02:00
Mask the webhook credential in delivery errors and logs (closes #118)
All checks were successful
check / check (push) Successful in 9s
Details
7c43e095a6 
Go embeds the request URL in *url.Error, so any transport failure — DNS,
TLS, refused, timeout, SSRF dial block — persisted the full Slack webhook
URL into the per-webhook SQLite database via DeliveryResult.Error. That
field is tagged json:"error,omitempty", so a future REST API would have
served it.

maskURLError rebuilds the error preserving Op and the wrapped cause, so DNS
vs TLS vs timeout still read differently and errors.Is/As and Timeout()
keep working; only path, query and userinfo are dropped. Applied where the
errors are born, which covers both the Slack and HTTP targets. url.Parse
embeds the URL too, so ValidateTargetURL's parse branch gets the same
treatment.

The SSRF rejection log now logs the masked URL, and source_logs.html
receives view types rather than raw rows, so no config blob is reachable
from that template.

MaskURL is now the single masker for the whole tree.
clawbot added 1 commit 2026-08-11 15:42:09 +02:00
Clarify web UI terminology, copy, and the entrypoint URL (closes #57)
All checks were successful
check / check (push) Successful in 4s
Details
aab448b076 
Unifies user-visible copy on "Webhook" (routes and URLs unchanged), drops
the placeholder Profile settings section, and adds a copy-to-clipboard
affordance for the entrypoint URL as progressive enhancement — the button
stays hidden unless both the target element and the Clipboard API resolve,
so no dead control appears without JavaScript and the URL stays selectable.

Retention copy now matches what the code does: deletion is permanent, 0
retains forever, and a blank field means the default on create or the
current value on edit. The permanent-deletion sentence is suppressed for a
retain-forever webhook, which the reaper exempts before computing a cutoff.

Template tests gained a render-completed assertion. Without it, a page that
aborted mid-render still satisfied assertions matching the already-flushed
prefix, because renderTemplate streams to the ResponseWriter (#123).
All checks were successful
check / check (push) Successful in 4s
Details
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin next:next
git checkout next
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label needs-checks
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees clawbot
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#111
Delete Branch "next"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?