webhooker/internal/handlers/source_management.go

package handlers

import (
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"slices"
	"strconv"
	"strings"
	"time"

	"github.com/go-chi/chi"
	"github.com/google/uuid"
	"gorm.io/gorm"
	"sneak.berlin/go/webhooker/internal/database"
	"sneak.berlin/go/webhooker/internal/delivery"
	"sneak.berlin/go/webhooker/internal/reqtls"
)

// WebhookListItem holds data for the webhook list view.
type WebhookListItem struct {
	database.Webhook

	EntrypointCount         int
	InactiveEntrypointCount int
	TargetCount             int
	InactiveTargetCount     int

	// EventCount is how many events the webhook holds, LastEventAt
	// when the newest arrived (nil before the first), and
	// FailedLast24Hours how many of its deliveries failed in the last
	// 24 hours. When the webhook's event database could not be read,
	// EventsUnreadable is set and these three are not known.
	EventCount        int64
	LastEventAt       *time.Time
	FailedLast24Hours int64
	EventsUnreadable  bool
}

// errMissingURL signals that a required URL was not provided.
var errMissingURL = errors.New("missing URL")

// parseRetentionDays interprets a retention_days form value. It
// returns the number of days, or, for a value it refuses, the message
// the create and edit forms show; the message is empty when the value
// is accepted.
//
// An empty value yields fallback, which lets the create path apply the
// default and the edit path leave the stored value unchanged. A value
// of 0 is returned as 0 and is rewritten to the retain-forever
// sentinel by database.Webhook's BeforeSave hook. Anything unparseable
// or negative is refused rather than silently given a default.
//
// The upper bound is not cosmetic. The reaper computes its cutoff as a
// time.Duration, an int64 nanosecond count, so a day count above
// database.MaxFiniteRetentionDays overflows, puts the cutoff in the
// future, and deletes every event the webhook has. A finite value
// above that ceiling is therefore refused, and the message names the
// ceiling rather than implying the input was not a number.
//
// A value at or above the retain-forever sentinel is not out of range:
// it is what the edit form pre-fills for a retain-forever webhook, so
// submitting the form back unchanged has to keep meaning "forever"
// rather than being rejected.
func parseRetentionDays(raw string, fallback int) (int, string) {
	raw = strings.TrimSpace(raw)
	if raw == "" {
		return fallback, ""
	}

	v, err := strconv.Atoi(raw)
	if err != nil || v < 0 {
		return 0, "Retention must be a whole number of days, or 0 to " +
			"retain events forever."
	}

	if v >= database.RetentionForeverDays {
		return database.RetentionForeverDays, ""
	}

	if v > database.MaxFiniteRetentionDays {
		return 0, "Retention must be at most " +
			strconv.Itoa(database.MaxFiniteRetentionDays) +
			" days, or 0 to retain events forever."
	}

	return v, ""
}

// DeliveryView is the display-safe projection of a delivery
// for the event log page. Its target is a TargetView, so the
// stored configuration blob — which holds the target's
// credential — has no path to the template.
type DeliveryView struct {
	ID     string
	Status database.DeliveryStatus
	Target delivery.TargetView

	// Results is this delivery's attempts in attempt order,
	// bounded by maxRenderedAttempts. Without them a failure
	// renders as the status word alone and says nothing about
	// why.
	Results []DeliveryResultView

	// AttemptCount is how many attempts were recorded, which
	// is more than len(Results) once the middle was dropped.
	AttemptCount int

	// AttemptsOmitted is how many attempts were dropped from
	// the middle of Results. The page must show it, or the
	// bound would hide history rather than fold it.
	AttemptsOmitted int
}

// eventLogTarget is what the event log needs to know about
// one target: the display-safe view its template renders, and
// the redactor that keeps that target's own credential out of
// the text its remote peer chose. The two are kept together
// so a caller cannot pick up one without the other, and apart
// from TargetView so the secrets never reach a template.
type eventLogTarget struct {
	View     delivery.TargetView
	Redactor delivery.Redactor
}

// HandleSourceList shows a list of user's webhooks.
func (h *Handlers) HandleSourceList() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		var webhooks []database.Webhook

		err := h.db.DB().Where(
			"user_id = ?", userID,
		).Order("created_at DESC").Find(&webhooks).Error
		if err != nil {
			h.serverError(w, r, "failed to list webhooks", err)

			return
		}

		items, err := h.buildWebhookListItems(webhooks)
		if err != nil {
			h.serverError(w, r, "failed to list webhooks", err)

			return
		}

		data := map[string]any{
			"Webhooks": items,
		}

		h.renderTemplate(w, r, "sources_list.html", data)
	}
}

// buildWebhookListItems builds the list's entry for each webhook. It
// fails when the main database cannot be read. A webhook whose event
// database cannot be read is marked on its own entry, and the error is
// logged.
func (h *Handlers) buildWebhookListItems(
	webhooks []database.Webhook,
) ([]WebhookListItem, error) {
	items := make([]WebhookListItem, len(webhooks))
	since := time.Now().Add(-longWindow)

	for i := range webhooks {
		item := &items[i]
		item.Webhook = webhooks[i]

		var err error

		item.EntrypointCount, item.InactiveEntrypointCount, err =
			h.countWithInactive(&database.Entrypoint{}, item.ID)
		if err != nil {
			return nil, err
		}

		item.TargetCount, item.InactiveTargetCount, err =
			h.countWithInactive(&database.Target{}, item.ID)
		if err != nil {
			return nil, err
		}

		// Opening an event database that does not exist would create
		// it, and it would hold nothing to count.
		if !h.dbMgr.DBExists(item.ID) {
			continue
		}

		err = h.readListEventFigures(item, since)
		if err != nil {
			h.log.Error(
				"failed to read webhook list figures",
				"webhook_id", item.ID,
				"error", err,
			)

			item.EventsUnreadable = true
		}
	}

	return items, nil
}

// countWithInactive returns how many entrypoints or targets, as model
// says, a webhook has, and how many of them are inactive.
func (h *Handlers) countWithInactive(
	model any, webhookID string,
) (int, int, error) {
	var active []bool

	err := h.db.DB().Model(model).
		Where("webhook_id = ?", webhookID).
		Pluck("active", &active).Error
	if err != nil {
		return 0, 0, fmt.Errorf(
			"reading active flags of webhook %s: %w", webhookID, err,
		)
	}

	inactive := 0

	for _, a := range active {
		if !a {
			inactive++
		}
	}

	return len(active), inactive, nil
}

// readListEventFigures fills in the figures the list shows from the
// webhook's event database, with the statistics pane's own queries:
// the event count and last arrival from the event totals row, and the
// deliveries that failed since the given time from the deliveries'
// status index.
func (h *Handlers) readListEventFigures(
	item *WebhookListItem, since time.Time,
) error {
	webhookDB, err := h.dbMgr.GetDB(item.ID)
	if err != nil {
		return err
	}

	var totals database.EventTotals

	err = webhookDB.Take(&totals).Error
	if err != nil {
		return fmt.Errorf("reading event totals: %w", err)
	}

	item.EventCount = totals.Events - totals.EventsRemoved
	item.LastEventAt = totals.LastEventAt

	byTarget, err := finishedByTarget(webhookDB, since)
	if err != nil {
		return err
	}

	for _, f := range byTarget {
		item.FailedLast24Hours += f.Failed
	}

	return nil
}

// HandleSourceCreate shows the form to create a new webhook.
func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		h.renderTemplate(
			w, r, "sources_new.html",
			newSourceFormData("", "", ""),
		)
	}
}

// newSourceFormData builds the template data for the webhook creation
// form.
//
// It carries the retention default so the pre-filled value comes from
// database.DefaultRetentionDays rather than being a third hardcoded
// copy of the same policy, and it carries the submitted name and
// description so that re-rendering the form after a validation failure
// gives the user their input back instead of a blank form. The edit
// form already behaves that way; create now matches it.
func newSourceFormData(
	errMsg, name, description string,
) map[string]any {
	return map[string]any{
		tmplKeyError:           errMsg,
		"Name":                 name,
		"Description":          description,
		"DefaultRetentionDays": database.DefaultRetentionDays,
	}
}

// HandleSourceCreateSubmit handles the webhook creation form
// submission.
func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		// The body size cap is enforced by the MaxBodySize
		// middleware, which runs before CSRF parses the form.
		err := r.ParseForm()
		if err != nil {
			h.renderError(w, r, http.StatusBadRequest)

			return
		}

		name := r.PostFormValue("name")
		description := r.PostFormValue("description")
		retentionStr := r.PostFormValue("retention_days")

		if name == "" {
			h.renderTemplateStatus(
				w, r, "sources_new.html",
				newSourceFormData(
					"Name is required", name, description,
				),
				http.StatusBadRequest,
			)

			return
		}

		retentionDays, errMsg := parseRetentionDays(
			retentionStr, database.DefaultRetentionDays,
		)
		if errMsg != "" {
			h.renderTemplateStatus(
				w, r, "sources_new.html",
				newSourceFormData(errMsg, name, description),
				http.StatusBadRequest,
			)

			return
		}

		h.createWebhookWithEntrypoint(
			w, r, userID, name, description, retentionDays,
		)
	}
}

// createWebhookWithEntrypoint creates a webhook and its default
// entrypoint in a transaction.
func (h *Handlers) createWebhookWithEntrypoint(
	w http.ResponseWriter,
	r *http.Request,
	userID, name, description string,
	retentionDays int,
) {
	webhook := &database.Webhook{
		UserID:        userID,
		Name:          name,
		Description:   description,
		RetentionDays: retentionDays,
	}

	err := h.commitWebhook(webhook)
	if err != nil {
		h.serverError(w, r, "failed to create webhook", err)

		return
	}

	err = h.dbMgr.CreateDB(webhook.ID)
	if err != nil {
		h.log.Error(
			"failed to create webhook event database",
			"webhook_id", webhook.ID, "error", err,
		)
	}

	h.log.Info("webhook created",
		"webhook_id", webhook.ID,
		"name", name, "user_id", userID,
	)

	http.Redirect(
		w, r, withNotice("/hook/"+webhook.ID, webhookCreated),
		http.StatusSeeOther,
	)
}

// commitWebhook creates a webhook and default entrypoint in
// a transaction. Returns an error on failure (rolls back).
func (h *Handlers) commitWebhook(
	webhook *database.Webhook,
) error {
	tx := h.db.DB().Begin()
	if tx.Error != nil {
		return tx.Error
	}

	err := tx.Create(webhook).Error
	if err != nil {
		tx.Rollback()

		return err
	}

	entrypoint := &database.Entrypoint{
		WebhookID:   webhook.ID,
		Path:        uuid.New().String(),
		Description: "Default entrypoint",
		Active:      true,
	}

	err = tx.Create(entrypoint).Error
	if err != nil {
		tx.Rollback()

		return err
	}

	return tx.Commit().Error
}

// HandleSourceDetail shows details for a specific webhook.
func (h *Handlers) HandleSourceDetail() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		h.renderSourceDetail(w, r, webhook)
	}
}

// renderSourceDetail loads and renders a source detail page.
func (h *Handlers) renderSourceDetail(
	w http.ResponseWriter,
	r *http.Request,
	webhook database.Webhook,
) {
	var entrypoints []database.Entrypoint

	h.db.DB().Where(
		"webhook_id = ?", webhook.ID,
	).Find(&entrypoints)

	var targets []database.Target

	h.db.DB().Where(
		"webhook_id = ?", webhook.ID,
	).Find(&targets)

	var events []RecentEventView

	if h.dbMgr.DBExists(webhook.ID) {
		webhookDB, err := h.dbMgr.GetDB(webhook.ID)
		if err != nil {
			h.serverError(w, r, "failed to get webhook database", err)

			return
		}

		events, err = loadRecentEvents(
			webhookDB, webhook.ID, singleHTTPTargetID(targets),
		)
		if err != nil {
			h.serverError(w, r, "failed to load recent events", err)

			return
		}
	}

	scheme := "http"
	if reqtls.IsTLS(r) {
		scheme = "https"
	}

	// The host is the client's Host header, unvalidated. It is
	// inert only because source_detail.html renders BaseURL as
	// text inside a <code> element; putting it in an href or any
	// other URL context needs it constrained first.
	baseURL := scheme + "://" + r.Host

	// The template calls Webhook methods, which take pointer
	// receivers; html/template cannot address a value stored in a map.
	data := map[string]any{
		tmplKeyWebhook: &webhook,
		// Targets are projected to a display-safe view: a
		// target's stored config blob holds a credential, and it
		// must never reach a template.
		"Entrypoints": NewEntrypointViews(entrypoints),
		"Targets":     delivery.NewTargetViews(targets),
		"Events":      events,
		"BaseURL":     baseURL,
		"Stats":       h.loadWebhookStats(webhook.ID, entrypoints, targets),
	}

	h.renderTemplate(w, r, "source_detail.html", data)
}

// HandleSourceEdit shows the form to edit a webhook.
func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		data := map[string]any{
			tmplKeyWebhook: &webhook,
			tmplKeyError:   "",
		}

		h.renderTemplate(w, r, "source_edit.html", data)
	}
}

// HandleSourceEditSubmit handles the webhook edit form
// submission.
func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		h.renameMu.Lock()
		defer h.renameMu.Unlock()

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		// The body size cap is enforced by the MaxBodySize
		// middleware, which runs before CSRF parses the form.
		err = r.ParseForm()
		if err != nil {
			h.renderError(w, r, http.StatusBadRequest)

			return
		}

		h.applyWebhookEdit(w, r, &webhook)
	}
}

// applyWebhookEdit validates and saves webhook edits.
func (h *Handlers) applyWebhookEdit(
	w http.ResponseWriter,
	r *http.Request,
	webhook *database.Webhook,
) {
	// The body size cap is enforced by the MaxBodySize middleware,
	// which runs before CSRF parses the form.
	name := r.PostFormValue("name")
	if name == "" {
		data := map[string]any{
			tmplKeyWebhook: webhook,
			tmplKeyError:   "Name is required",
		}

		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)

		return
	}

	oldName := webhook.Name
	webhook.Name = name
	webhook.Description = r.PostFormValue("description")

	// An empty field falls back to the stored value, so submitting the
	// form without touching retention leaves the policy alone.
	retentionDays, errMsg := parseRetentionDays(
		r.PostFormValue("retention_days"), webhook.RetentionDays,
	)
	if errMsg != "" {
		data := map[string]any{
			tmplKeyWebhook: webhook,
			tmplKeyError:   errMsg,
		}

		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)

		return
	}

	webhook.RetentionDays = retentionDays

	// A new name renames the archive files before it is saved (see
	// delivery.Engine.Rename). If either step fails, the same targets'
	// archives go back to the name that is still stored, without
	// reading the main database again.
	targets, err := h.renameWebhookArchives(
		webhook.ID, oldName, webhook.Name,
	)
	if err == nil {
		err = h.db.DB().Save(webhook).Error
	}

	if err != nil {
		restoreErr := h.renameArchives(targets, oldName)
		if restoreErr != nil {
			h.log.Error(
				"failed to rename archives back",
				"webhook_id", webhook.ID,
				"error", restoreErr,
			)
		}

		if errors.Is(err, delivery.ErrArchiveNameTaken) {
			data := map[string]any{
				tmplKeyWebhook: webhook,
				tmplKeyError: "Not saved: " + err.Error() +
					". Move that archive out of the data directory, " +
					"its .db together with any -wal and -shm beside " +
					"it, then save again.",
			}

			h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusConflict)

			return
		}

		h.serverError(w, r, "failed to update webhook", err)

		return
	}

	http.Redirect(
		w, r, withNotice("/hook/"+webhook.ID, webhookSaved),
		http.StatusSeeOther,
	)
}

// HandleSourceDelete handles webhook deletion.
func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		h.deleteWebhookResources(w, r, webhook, userID)
	}
}

// The messages deleteWebhookResources logs when a file of the event
// database cannot be removed: the database file itself, or only a
// sidecar once the database file is gone.
const (
	eventDBLeftMsg = "webhook deleted, but its event database file is " +
		"still on disk; remove it by hand"
	sidecarLeftMsg = "webhook deleted and its events are gone, but a " +
		"-wal or -shm sidecar of its event database is " +
		"still on disk; remove it by hand"
)

// deleteWebhookResources soft-deletes config and hard-deletes
// the per-webhook event database.
func (h *Handlers) deleteWebhookResources(
	w http.ResponseWriter,
	r *http.Request,
	webhook database.Webhook,
	userID string,
) {
	// The configuration delete commits before the event database
	// is touched. No transaction spans the main database and the
	// filesystem, so one side has to go first: committing the
	// configuration first means a later failure leaves an unused
	// event database file on disk, while removing the event
	// database first would mean a failed commit destroys the
	// history of a webhook that still exists. A leftover file can
	// be removed by hand; deleted history cannot be recovered.
	err := h.commitWebhookDeletion(&webhook)
	if err != nil {
		h.serverError(w, r, "failed to delete webhook", err)

		return
	}

	h.log.Info(
		"webhook deleted",
		"webhook_id", webhook.ID,
		"user_id", userID,
	)

	// Release the delivery engine's per-webhook archiving state
	// so a deleted webhook's archive writer (and any handle open
	// within its debounce window) does not linger for the
	// process lifetime. The archive file itself is deliberately
	// left on disk; see evictArchiveWriter.
	h.evictArchiveWriter(webhook.ID)

	err = h.dbMgr.DeleteDB(webhook.ID)
	if err != nil {
		// The configuration is committed, so the webhook is gone,
		// but a file of its event database is still on disk with
		// nothing referencing it. Report the failure rather than
		// redirecting as though everything succeeded: the file
		// needs removing by hand, and the logged error names it.
		// When only a sidecar is left, the events are already
		// gone, and the message must not suggest they survive.
		msg := eventDBLeftMsg
		if errors.Is(err, database.ErrSidecarNotRemoved) {
			msg = sidecarLeftMsg
		}

		h.serverError(w, r, msg, err)

		return
	}

	http.Redirect(
		w, r, withNotice("/hooks", webhookDeleted), http.StatusSeeOther,
	)
}

// commitWebhookDeletion soft-deletes a webhook's entrypoints,
// targets and the webhook row in one transaction. Every
// statement is checked and any failure rolls the whole
// transaction back, so a caller that gets an error knows the
// configuration is untouched and the event database must be
// left alone.
func (h *Handlers) commitWebhookDeletion(
	webhook *database.Webhook,
) error {
	tx := h.db.DB().Begin()
	if tx.Error != nil {
		return tx.Error
	}

	err := tx.Where(
		"webhook_id = ?", webhook.ID,
	).Delete(&database.Entrypoint{}).Error
	if err != nil {
		tx.Rollback()

		return err
	}

	err = tx.Where(
		"webhook_id = ?", webhook.ID,
	).Delete(&database.Target{}).Error
	if err != nil {
		tx.Rollback()

		return err
	}

	err = tx.Delete(webhook).Error
	if err != nil {
		tx.Rollback()

		return err
	}

	return tx.Commit().Error
}

// evictArchiveWriter asks the delivery engine to drop the cached
// archive writers of a webhook's database targets, closing their
// archive file handles.
//
// The archive database files are NOT deleted. Unlike the event
// database — which is per-webhook working storage and is
// hard-deleted with the webhook — an archive is explicitly
// long-term storage that an operator may want to keep or move
// away for offline retention. Destroying it as a side effect of
// deleting a webhook would be a surprising and unrecoverable
// data loss, so the file is left for the operator to handle.
func (h *Handlers) evictArchiveWriter(webhookID string) {
	if h.archives == nil {
		return
	}

	h.archives.EvictWebhook(webhookID)
}

// evictTargetArchiveWriter is evictArchiveWriter for one deleted
// target, and leaves its archive file on disk for the same reason.
// A target that is not a database target has no writer, and
// evicting it does nothing.
func (h *Handlers) evictTargetArchiveWriter(targetID string) {
	if h.archives == nil {
		return
	}

	h.archives.EvictTarget(targetID)
}

// renameWebhookArchives renames the archive file of every database
// target of a webhook from the webhook name oldName to newName,
// keeping each target's own name. It does nothing when the name is
// unchanged. It returns the targets it read, so that a failed edit can
// move those same archives back with renameArchives.
func (h *Handlers) renameWebhookArchives(
	webhookID, oldName, newName string,
) ([]database.Target, error) {
	if h.archives == nil || oldName == newName {
		return nil, nil
	}

	var targets []database.Target

	err := h.db.DB().
		Where(
			"webhook_id = ? AND type = ?",
			webhookID, database.TargetTypeDatabase,
		).
		Find(&targets).Error
	if err != nil {
		return nil, err
	}

	return targets, h.renameArchives(targets, newName)
}

// renameArchives renames the archive file of each of the given
// database targets to the webhook name webhookName, keeping each
// target's own name. It tries every target even after one fails, so
// that moving the archives back after a failed edit leaves none under
// the new name, and returns every failure joined.
func (h *Handlers) renameArchives(
	targets []database.Target, webhookName string,
) error {
	var errs []error

	for i := range targets {
		err := h.archives.Rename(
			targets[i].ID, webhookName, targets[i].Name,
		)
		if err != nil {
			errs = append(errs, err)
		}
	}

	return errors.Join(errs...)
}

// ownedWebhook resolves the request's sourceID parameter to a
// webhook the session's user owns.
//
// Ownership and existence are decided by one query, so a
// webhook belonging to another user is indistinguishable from
// one that does not exist: both are a 404, and neither confirms
// the id. Callers that reach further into a webhook's data —
// the event log page and the event body download — share this
// one check rather than restating it, so the download cannot
// come to authorize differently from the page that links to it.
//
// It reports false once it has written the response, which is a
// redirect to the login page for an unauthenticated request and
// a 404 otherwise. The caller returns without writing more.
func (h *Handlers) ownedWebhook(
	w http.ResponseWriter,
	r *http.Request,
) (database.Webhook, bool) {
	var webhook database.Webhook

	userID, ok := h.getUserID(r)
	if !ok {
		http.Redirect(
			w, r, "/pages/login", http.StatusSeeOther,
		)

		return database.Webhook{}, false
	}

	sourceID := chi.URLParam(r, "sourceID")

	err := h.db.DB().Where(
		"id = ? AND user_id = ?", sourceID, userID,
	).First(&webhook).Error
	if err != nil {
		h.renderError(w, r, http.StatusNotFound)

		return database.Webhook{}, false
	}

	return webhook, true
}

// HandleSourceLogs shows the request/response logs for a
// webhook.
func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		webhook, ok := h.ownedWebhook(w, r)
		if !ok {
			return
		}

		targets, err := h.loadTargetMap(webhook.ID)
		if err != nil {
			// Without the map every delivery renders through a
			// zero redactor, so failing the page is the only
			// safe answer.
			h.serverError(w, r, "failed to load targets", err)

			return
		}

		page := h.parsePage(r)

		evts, total, ok := h.loadEventsWithDeliveries(
			w, r, webhook, targets, page,
		)
		if !ok {
			return
		}

		totalPages := int(total) / paginationPerPage
		if int(total)%paginationPerPage != 0 {
			totalPages++
		}

		data := map[string]any{
			tmplKeyWebhook: &webhook,
			"Events":       evts,
			"Page":         page,
			"TotalPages":   totalPages,
			"TotalEvents":  total,
			"HasPrev":      page > 1,
			"HasNext":      page < totalPages,
			"PrevPage":     page - 1,
			"NextPage":     page + 1,
		}

		h.renderTemplate(w, r, "source_logs.html", data)
	}
}

// loadTargetMap loads targets into a map of display-safe
// views keyed by target ID, each paired with its redactor.
// The projection happens here so that no caller can hand a
// raw target, configuration blob and all, to a template: the
// raw rows do not leave this function.
//
// The load is Unscoped because deleting a target only soft
// deletes the row while its deliveries survive in the
// per-webhook database. Both halves of the map need those rows:
// a scoped load leaves an old delivery with a zero redactor,
// which renders its response bodies unredacted, and with a zero
// view, which renders its target as a blank name.
//
// This map is historical display only. It is built for the event
// log page and reaches nothing but DeliveryView.Target: the
// target list on the source detail page, the edit form and the
// replay path each resolve targets themselves, and a deleted row
// is refused there as before.
func (h *Handlers) loadTargetMap(
	webhookID string,
) (map[string]eventLogTarget, error) {
	var targets []database.Target

	err := h.db.DB().Unscoped().Where(
		"webhook_id = ?", webhookID,
	).Find(&targets).Error
	if err != nil {
		return nil, err
	}

	targetMap := make(
		map[string]eventLogTarget, len(targets),
	)

	for i := range targets {
		targetMap[targets[i].ID] = eventLogTarget{
			Redactor: delivery.NewRedactor(&targets[i]),
		}
	}

	// The views come from NewTargetViews rather than being
	// rebuilt here, so the masking rules stay in one place and a
	// deleted target's configuration is masked by the same code
	// that masks a live one's.
	for _, v := range delivery.NewTargetViews(targets) {
		entry := targetMap[v.ID]
		entry.View = v
		targetMap[v.ID] = entry
	}

	return targetMap, nil
}

// parsePage extracts a page number from the query string.
func (h *Handlers) parsePage(r *http.Request) int {
	return pageOrFirst(r.URL.Query().Get("page"))
}

// loadEventsWithDeliveries loads paginated events and their
// deliveries from the per-webhook database. Events come back
// as capped projections rather than database.Event rows: see
// eventLogColumns for why the cut happens in SQL.
//
// The bool reports whether the load succeeded. It is false
// once this has answered the request with an error, and the
// caller must then render nothing further.
func (h *Handlers) loadEventsWithDeliveries(
	w http.ResponseWriter,
	r *http.Request,
	webhook database.Webhook,
	targetMap map[string]eventLogTarget,
	page int,
) ([]EventLogView, int64, bool) {
	var result []EventLogView

	if !h.dbMgr.DBExists(webhook.ID) {
		return result, 0, true
	}

	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
	if err != nil {
		h.serverError(
			w, r, "failed to get webhook database", err,
		)

		return nil, 0, false
	}

	rows, totalEvents := loadEventLogRows(
		webhookDB, webhook.ID, page,
	)

	result = make([]EventLogView, len(rows))
	eventDeliveries := make([][]database.Delivery, len(rows))

	var deliveryIDs []string

	eventIDs := make([]string, len(rows))

	for i := range rows {
		result[i] = rows[i].view()
		eventIDs[i] = rows[i].ID

		webhookDB.Where(
			"event_id = ?", rows[i].ID,
		).Find(&eventDeliveries[i])

		for j := range eventDeliveries[i] {
			deliveryIDs = append(
				deliveryIDs, eventDeliveries[i][j].ID,
			)
		}
	}

	attempts, err := h.loadDeliveryResults(
		webhookDB, deliveryIDs,
	)
	if err != nil {
		h.serverError(
			w, r, "failed to load delivery attempts", err,
		)

		return nil, 0, false
	}

	resubmits, err := resubmitCounts(webhookDB, eventIDs)
	if err != nil {
		h.serverError(
			w, r, "failed to count event resubmissions", err,
		)

		return nil, 0, false
	}

	for i := range rows {
		result[i].Deliveries = newDeliveryViews(
			eventDeliveries[i], targetMap, attempts,
		)
		result[i].ResubmitCount = resubmits[rows[i].ID]
	}

	return result, totalEvents, true
}

// loadEventLogRows reads one page of the event log projection, newest
// first, and the total number of events the pager counts against.
func loadEventLogRows(
	webhookDB *gorm.DB, webhookID string, page int,
) ([]eventLogRow, int64) {
	var totalEvents int64

	webhookDB.Model(&database.Event{}).Where(
		"webhook_id = ?", webhookID,
	).Count(&totalEvents)

	var rows []eventLogRow

	webhookDB.Model(&database.Event{}).Select(
		eventLogColumns, maxRenderedBodyBytes,
	).Where(
		"webhook_id = ?", webhookID,
	).Order("created_at DESC").Offset(
		(page - 1) * paginationPerPage,
	).Limit(paginationPerPage).Find(&rows)

	return rows, totalEvents
}

// resubmitCounts reports, for each of the page's events, how many
// events have been resubmitted from it.
//
// One grouped query covers the page rather than one query per event.
// A page holds paginationPerPage ids, far below SQLite's bound
// parameter ceiling, so it needs no chunking as the delivery result
// load does.
func resubmitCounts(
	webhookDB *gorm.DB, eventIDs []string,
) (map[string]int, error) {
	counts := make(map[string]int, len(eventIDs))

	if len(eventIDs) == 0 {
		return counts, nil
	}

	var rows []struct {
		ResubmittedFromID string
		Total             int
	}

	err := webhookDB.Model(&database.Event{}).
		Select("resubmitted_from_id, count(*) AS total").
		Where("resubmitted_from_id IN ?", eventIDs).
		Group("resubmitted_from_id").
		Find(&rows).Error
	if err != nil {
		return nil, err
	}

	for _, row := range rows {
		counts[row.ResubmittedFromID] = row.Total
	}

	return counts, nil
}

// deliveryIDChunkSize bounds how many delivery IDs go into one
// IN clause. SQLite refuses a statement carrying more than
// SQLITE_MAX_VARIABLE_NUMBER (32766) bound parameters, and a
// page holds one delivery per target per event, so a webhook
// with enough targets would turn the whole query into an error
// and the page into zero attempts.
const deliveryIDChunkSize = 500

// loadDeliveryResults loads the recorded attempts for the
// page's deliveries, keyed by delivery ID.
//
// Each response body is cut by SQLite rather than in Go, for
// the reason deliveryResultColumns gives. How many attempts a
// delivery has is the target's MaxRetries, which the
// authenticated operator sets; how many of them reach the page
// is bounded again by maxRenderedAttempts.
func (h *Handlers) loadDeliveryResults(
	webhookDB *gorm.DB,
	deliveryIDs []string,
) (map[string][]deliveryResultRow, error) {
	byDelivery := make(map[string][]deliveryResultRow)

	for chunk := range slices.Chunk(
		deliveryIDs, deliveryIDChunkSize,
	) {
		var rows []deliveryResultRow

		err := webhookDB.Model(
			&database.DeliveryResult{},
		).Select(
			deliveryResultColumns, maxRenderedResponseBytes,
		).Where(
			"delivery_id IN ?", chunk,
		).Order("attempt_num ASC").Find(&rows).Error
		if err != nil {
			// Returning what was loaded so far renders the
			// deliveries in the failed chunk as never having run,
			// which is indistinguishable from ones that really
			// never ran. The page fails instead.
			return nil, err
		}

		for i := range rows {
			byDelivery[rows[i].DeliveryID] = append(
				byDelivery[rows[i].DeliveryID], rows[i],
			)
		}
	}

	return byDelivery, nil
}

// newDeliveryViews projects deliveries for rendering,
// resolving each one's target to its display-safe view and
// each one's attempts through that target's redactor.
func newDeliveryViews(
	deliveries []database.Delivery,
	targetMap map[string]eventLogTarget,
	attempts map[string][]deliveryResultRow,
) []DeliveryView {
	views := make([]DeliveryView, len(deliveries))

	for i := range deliveries {
		target := targetMap[deliveries[i].TargetID]
		rows := attempts[deliveries[i].ID]

		results, omitted := renderedAttempts(
			rows, target.Redactor,
		)

		views[i] = DeliveryView{
			ID:              deliveries[i].ID,
			Status:          deliveries[i].Status,
			Target:          target.View,
			Results:         results,
			AttemptCount:    len(rows),
			AttemptsOmitted: omitted,
		}
	}

	return views
}

// maxRenderedAttempts bounds how many of one delivery's
// attempts the page renders. Past it the middle is dropped and
// counted, keeping the first attempts and the last ones: how
// the delivery started failing and how it ended are what a
// reader needs, and the count says plainly that the rest was
// dropped rather than never recorded.
const (
	renderedAttemptsHead = 10
	renderedAttemptsTail = 10
	maxRenderedAttempts  = renderedAttemptsHead +
		renderedAttemptsTail
)

// renderedAttempts projects a delivery's attempts through the
// target's redactor, at most maxRenderedAttempts of them, and
// reports how many it dropped.
func renderedAttempts(
	rows []deliveryResultRow,
	redactor delivery.Redactor,
) ([]DeliveryResultView, int) {
	omitted := 0

	if len(rows) > maxRenderedAttempts {
		omitted = len(rows) - maxRenderedAttempts

		kept := make(
			[]deliveryResultRow, 0, maxRenderedAttempts,
		)
		kept = append(kept, rows[:renderedAttemptsHead]...)
		kept = append(
			kept, rows[len(rows)-renderedAttemptsTail:]...,
		)
		rows = kept
	}

	views := make([]DeliveryResultView, len(rows))
	for i := range rows {
		views[i] = rows[i].view(redactor)
	}

	return views, omitted
}

// HandleEntrypointCreate handles adding a new entrypoint.
func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		// The body size cap is enforced by the MaxBodySize
		// middleware, which runs before CSRF parses the form.
		err = r.ParseForm()
		if err != nil {
			h.renderError(w, r, http.StatusBadRequest)

			return
		}

		description := r.PostFormValue("description")

		entrypoint := &database.Entrypoint{
			WebhookID:   webhook.ID,
			Path:        uuid.New().String(),
			Description: description,
			Active:      true,
		}

		err = h.db.DB().Create(entrypoint).Error
		if err != nil {
			h.serverError(w, r, "failed to create entrypoint", err)

			return
		}

		http.Redirect(
			w, r, withNotice("/hook/"+webhook.ID, entrypointAdded),
			http.StatusSeeOther,
		)
	}
}

// HandleTargetCreate handles adding a new target to a webhook.
func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")

		h.renameMu.Lock()
		defer h.renameMu.Unlock()

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		// The body size cap is enforced by the MaxBodySize
		// middleware, which runs before CSRF parses the form.
		err = r.ParseForm()
		if err != nil {
			h.renderError(w, r, http.StatusBadRequest)

			return
		}

		h.processTargetCreate(w, r, webhook)
	}
}

// processTargetCreate validates and creates a new target.
func (h *Handlers) processTargetCreate(
	w http.ResponseWriter,
	r *http.Request,
	webhook database.Webhook,
) {
	// The body size cap is enforced by the MaxBodySize middleware,
	// which runs before CSRF parses the form.
	//
	// Every field here is read with PostFormValue, not FormValue.
	// FormValue falls back to the query string, which would let
	// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
	// configure a target from a value the request line carries — and
	// the request line, unlike the body, is what logs, proxies,
	// Referer headers and error trackers record.
	name := r.PostFormValue("name")
	targetType := database.TargetType(r.PostFormValue("type"))

	if name == "" {
		http.Error(
			w, "Name is required", http.StatusBadRequest,
		)

		return
	}

	if !isValidTargetType(targetType) {
		http.Error(
			w, "Invalid target type",
			http.StatusBadRequest,
		)

		return
	}

	configJSON, err := h.buildTargetConfig(
		w, r, targetType, targetFormInputFrom(r),
	)
	if err != nil {
		return
	}

	// A new target has no stored retry count, so an absent field
	// takes the fire-and-forget default. A field the operator filled
	// in with something invalid is rejected rather than becoming
	// that default.
	maxRetries, ok := targetMaxRetries(w, r, 0)
	if !ok {
		return
	}

	target := &database.Target{
		WebhookID:  webhook.ID,
		Name:       name,
		Type:       targetType,
		Active:     true,
		Config:     configJSON,
		MaxRetries: maxRetries,
	}

	err = h.db.DB().Create(target).Error
	if err != nil {
		h.serverError(w, r, "failed to create target", err)

		return
	}

	http.Redirect(
		w, r, withNotice("/hook/"+webhook.ID, targetAdded),
		http.StatusSeeOther,
	)
}

// isValidTargetType checks whether the target type is supported.
func isValidTargetType(tt database.TargetType) bool {
	switch tt {
	case database.TargetTypeHTTP,
		database.TargetTypeDatabase,
		database.TargetTypeLog,
		database.TargetTypeSlack:
		return true
	default:
		return false
	}
}

// pageOrFirst parses a paginated page number, answering 1 for
// anything empty, unparseable or out of range.
//
// Falling back rather than rejecting is correct here and only here:
// a page number is where to send the browser next, not configuration
// the operator is storing, and the actions that submit one have
// already completed by the time it is read — answering 400 would
// report a failure that did not happen. Anything an operator SETS
// must be validated instead; see parseMaxRetries.
func pageOrFirst(s string) int {
	v, err := strconv.Atoi(strings.TrimSpace(s))
	if err != nil || v < 1 {
		return 1
	}

	return v
}

// targetFormInput carries the raw form values describing a target's
// configuration. Both the create and the edit path fill one and hand
// it to buildTargetConfig, so neither can come to validate a
// destination differently from the other.
type targetFormInput struct {
	// URL is the destination for an HTTP target and the webhook URL
	// for a Slack target.
	URL string
	// Headers is an HTTP target's headers, one "Name: value" per
	// line.
	Headers string
	// Timeout is an HTTP target's per-request timeout in seconds.
	Timeout string
	// Expiry is a database (archive) target's row expiry.
	Expiry string
}

// targetFormInputFrom reads the configuration fields from a request
// body. The body size cap is enforced by the MaxBodySize middleware,
// which runs before CSRF parses the form.
//
// Every field is read with PostFormValue, not FormValue. FormValue
// falls back to the query string, which would let
// `POST /hook/{id}/targets?url=https://hooks.slack.com/...`
// configure a target from a value the request line carries — and the
// request line, unlike the body, is what logs, proxies, Referer
// headers and error trackers record. The headers field is under the
// same rule and for the same reason: its values are authorization
// tokens.
func targetFormInputFrom(r *http.Request) targetFormInput {
	return targetFormInput{
		URL:     r.PostFormValue("url"),
		Headers: r.PostFormValue("headers"),
		Timeout: r.PostFormValue("timeout"),
		Expiry:  r.PostFormValue("expiry"),
	}
}

// buildTargetConfig builds the JSON config string for a target from
// the submitted form values, writing its own 4xx response on
// rejection. Which fields of in apply depends on the target type.
func (h *Handlers) buildTargetConfig(
	w http.ResponseWriter,
	r *http.Request,
	targetType database.TargetType,
	in targetFormInput,
) (string, error) {
	switch targetType {
	case database.TargetTypeHTTP:
		return h.buildHTTPTargetConfig(w, r, in)
	case database.TargetTypeSlack:
		return h.buildSlackTargetConfig(w, r, in.URL)
	case database.TargetTypeDatabase:
		return h.buildDatabaseTargetConfig(w, r, in.Expiry)
	case database.TargetTypeLog:
		return "", nil
	default:
		http.Error(
			w, "Invalid target type",
			http.StatusBadRequest,
		)

		return "", errMissingURL
	}
}

// buildHTTPTargetConfig builds config JSON for an HTTP target: an
// SSRF-validated destination plus the optional headers and timeout
// the delivery path honours.
func (h *Handlers) buildHTTPTargetConfig(
	w http.ResponseWriter,
	r *http.Request,
	in targetFormInput,
) (string, error) {
	err := h.validateTargetURL(
		w, r, in.URL, "URL is required for HTTP targets",
	)
	if err != nil {
		return "", err
	}

	headers, err := delivery.ParseTargetHeaders(in.Headers)
	if err != nil {
		http.Error(
			w,
			"Invalid headers: "+err.Error(),
			http.StatusBadRequest,
		)

		return "", err
	}

	timeout, err := delivery.ParseTargetTimeout(in.Timeout)
	if err != nil {
		http.Error(
			w,
			"Invalid timeout: "+err.Error(),
			http.StatusBadRequest,
		)

		return "", err
	}

	return h.marshalTargetConfig(w, r, delivery.HTTPTargetConfig{
		URL:     in.URL,
		Headers: headers,
		Timeout: timeout,
	})
}

// buildSlackTargetConfig builds config JSON for a Slack target,
// whose whole configuration is one SSRF-validated webhook URL.
func (h *Handlers) buildSlackTargetConfig(
	w http.ResponseWriter,
	r *http.Request,
	targetURL string,
) (string, error) {
	err := h.validateTargetURL(
		w, r, targetURL,
		"Webhook URL is required for Slack targets",
	)
	if err != nil {
		return "", err
	}

	return h.marshalTargetConfig(w, r, delivery.SlackTargetConfig{
		WebhookURL: targetURL,
	})
}

// validateTargetURL rejects an empty or SSRF-blocked destination,
// writing the 400 itself. missingMsg is the error shown when no URL
// is given.
//
// It is the single point at which a user-supplied destination enters
// the SSRF guard, on create and on edit alike. An edit path that
// reached storage without passing through here would reopen the hole
// the guard closes.
func (h *Handlers) validateTargetURL(
	w http.ResponseWriter,
	r *http.Request,
	targetURL, missingMsg string,
) error {
	if targetURL == "" {
		http.Error(
			w,
			missingMsg,
			http.StatusBadRequest,
		)

		return errMissingURL
	}

	err := h.ssrf.ValidateTargetURL(
		r.Context(), targetURL,
	)
	if err != nil {
		// The submitted URL can be a credential (a Slack
		// incoming webhook URL is a bearer token), so the log
		// records only its scheme and host.
		h.log.Warn(
			"target URL blocked by SSRF protection",
			"url", delivery.MaskURL(targetURL),
			"error", err,
		)

		msg := "Invalid target URL: " + err.Error()

		// Only a private or reserved address's refusal says how
		// to allow it. Other refusals never do: link-local, the
		// unspecified addresses and the unconditional metadata
		// addresses cannot be opened, and the default
		// blocklist's public addresses, which listing does open,
		// hand out credentials.
		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
			msg += ". Private and reserved addresses are refused " +
				"by default; the server's ALLOWED_EGRESS_CIDRS " +
				"setting allows named networks (see \"Allowing " +
				"egress to your own network\" in the README)."
		}

		http.Error(w, msg, http.StatusBadRequest)

		return err
	}

	return nil
}

// marshalTargetConfig serialises a target configuration for storage,
// writing a 500 itself if it cannot.
func (h *Handlers) marshalTargetConfig(
	w http.ResponseWriter,
	r *http.Request,
	cfg any,
) (string, error) {
	configBytes, err := json.Marshal(cfg)
	if err != nil {
		h.serverError(w, r, "failed to encode target config", err)

		return "", err
	}

	return string(configBytes), nil
}

// buildDatabaseTargetConfig builds config JSON for a database
// (archive) target. The optional expiry (a form value read by
// the caller, which bounds the request body) is validated here,
// at creation time, so an unparseable value is rejected with a
// 400 instead of failing every subsequent delivery. An empty
// expiry yields an empty config (the keep-forever default).
func (h *Handlers) buildDatabaseTargetConfig(
	w http.ResponseWriter,
	r *http.Request,
	expiry string,
) (string, error) {
	expiry = strings.TrimSpace(expiry)
	if expiry == "" {
		return "", nil
	}

	err := delivery.ValidateArchiveExpiry(expiry)
	if err != nil {
		http.Error(
			w,
			"Invalid archive expiry: "+err.Error(),
			http.StatusBadRequest,
		)

		return "", err
	}

	return h.marshalTargetConfig(
		w, r, map[string]any{"expiry": expiry},
	)
}

// HandleEntrypointDelete handles deleting an entrypoint.
func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
	return h.deleteChildResource(
		"entrypointID", &database.Entrypoint{},
		"failed to delete entrypoint",
		nil,
		entrypointDeleted,
	)
}

// HandleTargetDelete handles deleting a target. A deleted
// database target's archive writer is evicted and its handle
// closed; the archive file is left on disk.
func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
	return h.deleteChildResource(
		"targetID", &database.Target{},
		"failed to delete target",
		h.evictTargetArchiveWriter,
		targetDeleted,
	)
}

// deleteChildResource returns a handler that deletes a child
// resource (entrypoint or target) belonging to a webhook. The
// optional afterDelete hook runs with the child's id once the
// delete has removed it, before the redirect, which carries done as
// its notice.
func (h *Handlers) deleteChildResource(
	idParam string,
	model any,
	errMsg string,
	afterDelete func(childID string),
	done noticeCode,
) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")
		childID := chi.URLParam(r, idParam)

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		result := h.db.DB().Where(
			"id = ? AND webhook_id = ?",
			childID, webhook.ID,
		).Delete(model)
		if result.Error != nil {
			h.serverError(w, r, errMsg, result.Error)

			return
		}

		// Only for a row this webhook really had: the id came from
		// the URL and may name another webhook's child.
		if afterDelete != nil && result.RowsAffected > 0 {
			afterDelete(childID)
		}

		http.Redirect(
			w, r,
			withNotice("/hook/"+webhook.ID, done),
			http.StatusSeeOther,
		)
	}
}

// HandleEntrypointToggle handles toggling an entrypoint's
// active state.
func (h *Handlers) HandleEntrypointToggle() http.HandlerFunc {
	return h.toggleChildResource(
		"entrypointID",
		func(webhookID, childID string) (bool, error) {
			var ep database.Entrypoint

			err := h.db.DB().Where(
				"id = ? AND webhook_id = ?",
				childID, webhookID,
			).First(&ep).Error
			if err != nil {
				return false, err
			}

			ep.Active = !ep.Active

			return ep.Active, h.db.DB().Save(&ep).Error
		},
		"failed to toggle entrypoint",
		entrypointActivated, entrypointDeactivated,
	)
}

// HandleTargetToggle handles toggling a target's active state.
func (h *Handlers) HandleTargetToggle() http.HandlerFunc {
	return h.toggleChildResource(
		"targetID",
		func(webhookID, childID string) (bool, error) {
			var tgt database.Target

			err := h.db.DB().Where(
				"id = ? AND webhook_id = ?",
				childID, webhookID,
			).First(&tgt).Error
			if err != nil {
				return false, err
			}

			// Only the active column: saving the whole row would
			// write back the name and settings read above over an
			// edit saved since.
			active := !tgt.Active

			return active, h.db.DB().Model(&tgt).
				Update("active", active).Error
		},
		"failed to toggle target",
		targetActivated, targetDeactivated,
	)
}

// toggleChildResource returns a handler that toggles the active
// state of a child resource belonging to a webhook. toggleFn returns
// the new state, and the redirect carries activated or deactivated as
// its notice to match.
func (h *Handlers) toggleChildResource(
	idParam string,
	toggleFn func(webhookID, childID string) (bool, error),
	errMsg string,
	activated, deactivated noticeCode,
) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID, ok := h.getUserID(r)
		if !ok {
			http.Redirect(
				w, r, "/pages/login", http.StatusSeeOther,
			)

			return
		}

		sourceID := chi.URLParam(r, "sourceID")
		childID := chi.URLParam(r, idParam)

		var webhook database.Webhook

		err := h.db.DB().Where(
			"id = ? AND user_id = ?", sourceID, userID,
		).First(&webhook).Error
		if err != nil {
			h.renderError(w, r, http.StatusNotFound)

			return
		}

		active, err := toggleFn(webhook.ID, childID)
		if err != nil {
			h.serverError(w, r, errMsg, err)

			return
		}

		done := deactivated
		if active {
			done = activated
		}

		http.Redirect(
			w, r,
			withNotice("/hook/"+webhook.ID, done),
			http.StatusSeeOther,
		)
	}
}

// getUserID extracts the user ID from the session.
func (h *Handlers) getUserID(
	r *http.Request,
) (string, bool) {
	sess, err := h.session.Get(r)
	if err != nil {
		return "", false
	}

	if !h.session.IsAuthenticated(sess) {
		return "", false
	}

	return h.session.GetUserID(sess)
}