webhooker/TODO.md

Status

pre-1.0. Single initial commit on main (2026-03-01), no tags. Early stage; most of the feature plan is unimplemented and the policy scaffold is incomplete.

Next Step

Full policy scaffold in one commit:

• Add LICENSE, REPO_POLICIES.md, .editorconfig, .dockerignore.
• Add .gitea/workflows/check.yml running make check.
• Extend the Makefile with fmt-check, check, docker, and hooks targets (test/lint/fmt exist; docker-build/docker-run exist but not the required docker target).
• Make the Dockerfile run make check and pin base images by sha256.

Completed Steps

• 2026-03-01: Initial commit: Go module (git.eeqj.de/sneak/webhooker), cmd/internal/pkg layout, config.yaml, Dockerfile, Makefile with test/lint/fmt, templates and static assets, README describing the processor/target delivery design, .gitignore and .golangci.yml.

Future Steps

• Compliance (after Next Step):
  • Rework README.md into the required sections: Description, Getting Started, Rationale, Design, TODO, License, Author.
  • Keep main green under the new workflow.
• Phase 1, security and infrastructure hardening (also required for 1.0 as an HTTP service): security headers (HSTS, CSP, X-Frame-Options), request timeouts and context handling, max request/response body sizes, rate limiting middleware, CSRF protection on forms, restricted CORS, request ID tracking through the request lifecycle, panic recovery with proper error reporting.
• Phase 2, authentication and authorization: session-checking auth middleware, session expiration, remember-me, password reset, optional registration, authorization middleware for protected routes, API key auth for programmatic access. Use bcrypt or argon2 for passwords and secure cookies per policy.
• Phase 3, database models and migrations: webhook source model, request log model, retry model for failed deliveries, indexes, migration system.
• Phase 4, source management UI: source list, create form, detail page, edit, delete with confirmation, webhook URL generation, secret key management, webhook testing.
• Phase 5, processing engine: reception at /webhook/{uuid}, request validation, forwarding to targets, request/response logging, signature verification (GitHub, Stripe formats), transformation of headers and body, outbound timeouts, retry with exponential backoff.
• Phase 6, logs and analytics: log viewer per source, filtering and search, body viewer, analytics dashboard (success rates, response times), health monitoring, alerting on failures, retention policies.
• Phase 7, advanced features: request replay, batching, queuing, multiple targets per source, conditional forwarding, transformation templates, debugging tools, scheduled or delayed delivery.
• Phase 8, API: RESTful source management API, API auth and rate limiting, OpenAPI docs, client libraries, webhooks-as-a-service API.
• Phase 9, performance and scalability: Redis caching, background job processing, horizontal scaling, delivery parallelization, Prometheus metrics, performance dashboard.
• Phase 10, operations: comprehensive logging, admin dashboard for user management, backup and restore, health checks and monitoring, deployment automation (Docker, K8s), zero-downtime deploys, feature flags.
• Nice-to-have: webhook marketplace/templates, team collaboration, webhook versioning, A/B testing, analytics export, mobile monitoring app, Slack/Discord/email notifications, documentation generator, GraphQL subscriptions, WebSocket real-time updates.