webhukhs 0.6.0 → 0.8.0

data/test/admin_test.rb

@@ -0,0 +1,334 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class AdminTest < ActionDispatch::IntegrationTest
+  cover "Webhukhs::Admin*"
+
+  self.app = WebhukhsTestApp
+
+  teardown { Webhukhs::ReceivedWebhook.delete_all }
+
+  def create_webhook(**attributes)
+    Webhukhs::ReceivedWebhook.create!(
+      handler_module_name: "WebhookTestHandler",
+      handler_event_id: SecureRandom.uuid,
+      status: "processed",
+      body: '{"event":"thing.happened"}',
+      **attributes
+    )
+  end
+
+  def listed_event_ids
+    css_select("table.admin-table tbody tr td:nth-child(5) code").map(&:text)
+  end
+
+  test "lists webhooks newest first by default" do
+    create_webhook(handler_event_id: "old", created_at: 2.days.ago)
+    create_webhook(handler_event_id: "new", created_at: 1.day.ago)
+
+    get "/admin/received"
+
+    assert_response :ok
+    assert_equal ["new", "old"], listed_event_ids
+    # The whole row is the link, so it has to be there in the first cell
+    assert_select "tbody tr td:first-child a.row-link[href^='/admin/received/']", count: 2
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=asc&sort=created_at", text: "Received ▼"
+    assert_select "th a.sort-link span.sort-arrow", text: "▼", count: 1
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status", text: "Status"
+  end
+
+  test "offers an auto-refresh switch, off by default, for the listing it refetches" do
+    create_webhook
+
+    get "/admin/received"
+
+    assert_select ".page-heading label.switch input#auto-refresh[type=checkbox][role=switch]:not([checked])"
+    # admin.js swaps this element for the one in the refetched page
+    assert_select "#received-webhooks table.admin-table tbody tr", count: 1
+    assert_select "#received-webhooks nav.pagination"
+  end
+
+  test "serves the index at the engine root" do
+    create_webhook(handler_event_id: "at-root")
+
+    get "/admin"
+
+    assert_response :ok
+    assert_equal ["at-root"], listed_event_ids
+  end
+
+  test "sorts by a whitelisted column in either direction" do
+    create_webhook(handler_event_id: "b", status: "skipped")
+    create_webhook(handler_event_id: "a", status: "error")
+
+    get "/admin/received", params: {sort: "status", direction: "asc"}
+    assert_equal ["a", "b"], listed_event_ids
+    # Clicking the active column again flips the direction
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status", text: "Status ▲"
+
+    get "/admin/received", params: {sort: "status", direction: "desc"}
+    assert_equal ["b", "a"], listed_event_ids
+  end
+
+  test "breaks ties by id in the sort direction, so pages do not overlap" do
+    # Event ids run opposite to ids: SQLite walks the dedup index on (handler_module_name,
+    # handler_event_id) to sort by handler, and would order the ties by event id otherwise
+    first = create_webhook(handler_event_id: "z")
+    second = create_webhook(handler_event_id: "a")
+    assert_operator first.id, :<, second.id
+
+    get "/admin/received", params: {sort: "handler_module_name", direction: "desc"}
+    assert_equal ["a", "z"], listed_event_ids
+
+    get "/admin/received", params: {sort: "handler_module_name", direction: "asc"}
+    assert_equal ["z", "a"], listed_event_ids
+  end
+
+  test "ignores sort columns and directions it does not know" do
+    # Created out of order, so that falling back to anything but created_at shows
+    create_webhook(handler_event_id: "new", created_at: 1.day.ago, status: "skipped")
+    create_webhook(handler_event_id: "old", created_at: 2.days.ago, status: "error")
+
+    get "/admin/received", params: {sort: "no_such_column", direction: "sideways"}
+
+    assert_response :ok
+    assert_equal ["new", "old"], listed_event_ids
+  end
+
+  test "filters by handler and status, and treats blank filters as no filter" do
+    create_webhook(handler_event_id: "test-processed")
+    create_webhook(handler_event_id: "test-error", status: "error")
+    create_webhook(handler_event_id: "private-processed", handler_module_name: "PrivateHandler")
+
+    get "/admin/received", params: {handler: "WebhookTestHandler"}
+    assert_equal ["test-error", "test-processed"], listed_event_ids.sort
+
+    get "/admin/received", params: {status: "error"}
+    assert_equal ["test-error"], listed_event_ids
+
+    get "/admin/received", params: {handler: "", status: ""}
+    assert_equal 3, listed_event_ids.length
+  end
+
+  test "offers every configured handler and status as a filter" do
+    get "/admin/received", params: {handler: "PrivateHandler"}
+
+    handlers = css_select("select[name=handler] option").map { |option| option["value"] }
+    assert_equal ["", *Webhukhs.configuration.active_handlers.values.uniq.sort], handlers
+    assert_select "select[name=handler] option[value='']", text: "Any handler"
+    assert_select "select[name=status] option[value='']", text: "Any status"
+    # Clearing the filters keeps the sort
+    assert_select "form.filters a[href=?]", "/admin/received?direction=desc&sort=created_at", text: "Clear"
+    assert_select "select[name=handler] option[selected]", text: "PrivateHandler"
+
+    statuses = css_select("select[name=status] option").map { |option| option["value"] }
+    assert_equal ["", *Webhukhs::ReceivedWebhook.statuses.keys], statuses
+  end
+
+  test "lists a handler configured as a class once, by name" do
+    original_handlers = Webhukhs.configuration.active_handlers
+    Webhukhs.configuration.active_handlers = {a: WebhookTestHandler, b: "WebhookTestHandler"}
+
+    get "/admin/received"
+
+    handlers = css_select("select[name=handler] option").map { |option| option["value"] }
+    assert_equal ["", "WebhookTestHandler"], handlers
+  ensure
+    Webhukhs.configuration.active_handlers = original_handlers
+  end
+
+  test "paginates by #{Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE}" do
+    page_size = Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE
+    (page_size + 1).times { |i| create_webhook(handler_event_id: "evt-#{i}", created_at: i.minutes.ago) }
+
+    get "/admin/received", params: {sort: "status"}
+    assert_equal page_size, listed_event_ids.length
+    assert_equal "evt-#{page_size}", listed_event_ids.first # all ties on status, so by id
+    assert_select "a[rel=prev]", count: 0
+    assert_select "a[rel=next][href=?]", "/admin/received?page=2&sort=status"
+
+    get "/admin/received", params: {sort: "status", page: 2}
+    assert_equal ["evt-0"], listed_event_ids
+    assert_select "a[rel=next]", count: 0
+    assert_select "a[rel=prev][href=?]", "/admin/received?page=1&sort=status"
+  end
+
+  test "loads one row past the page and no more" do
+    page_size = Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE
+    (page_size + 5).times { create_webhook }
+
+    loaded = 0
+    counter = ->(*, payload) { loaded += payload[:record_count] if payload[:class_name] == "Webhukhs::ReceivedWebhook" }
+    ActiveSupport::Notifications.subscribed(counter, "instantiation.active_record") do
+      get "/admin/received"
+    end
+
+    assert_equal page_size + 1, loaded
+  end
+
+  test "shows no next page when the last page is exactly full" do
+    Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE.times { create_webhook }
+
+    get "/admin/received"
+
+    assert_select "a[rel=next]", count: 0
+  end
+
+  test "treats a page below 1 as the first page" do
+    create_webhook(handler_event_id: "only")
+
+    get "/admin/received", params: {page: -3}
+
+    assert_equal ["only"], listed_event_ids
+    assert_select "a[rel=prev]", count: 0
+  end
+
+  test "drops the page when changing the sort" do
+    get "/admin/received", params: {page: 3}
+
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status"
+  end
+
+  test "says so when there is nothing to list" do
+    get "/admin/received"
+
+    assert_select "div.table-scroll > table.admin-table > thead > tr > th", count: 6
+    assert_select "table.admin-table > tbody > tr > td.empty[colspan='6']", text: "No records."
+  end
+
+  test "colors the status badges" do
+    {
+      "processed" => "status-ok",
+      "error" => "status-bad",
+      "failed_validation" => "status-bad",
+      "received" => "status-waiting",
+      "processing" => "status-waiting",
+      "skipped" => "status-neutral"
+    }.each do |status, css_class|
+      assert_equal css_class, Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(status: status)).status_class
+    end
+  end
+
+  test "shows a JSON body pretty-printed, with the body as sent in a second tab" do
+    create_webhook(handler_event_id: "decoy", body: "not this one")
+    webhook = create_webhook(body: '{"event":"thing.happened","data":{"id":1}}')
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "h1", text: /WebhookTestHandler/
+    assert_select "[role=tab][aria-selected=true]", text: "Pretty"
+    assert_select "[role=tab][aria-selected=false]", text: "As sent"
+    # assert_select squashes whitespace, which is the very thing under test here
+    assert_equal JSON.pretty_generate({"event" => "thing.happened", "data" => {"id" => 1}}),
+      css_select("#body-pretty:not([hidden]) code").text
+    assert_equal '{"event":"thing.happened","data":{"id":1}}', css_select("#body-raw[hidden] code").text
+    assert_select ".flash.alert", count: 0
+  end
+
+  test "shows a body that is not JSON as sent, replacing invalid UTF-8" do
+    webhook = create_webhook(body: "event=thing&broken=\xFF".b)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "[role=tab]", count: 0
+    assert_select ".flash.alert", text: /not valid JSON/
+    assert_select "pre.body-raw code", text: "event=thing&broken=\u{FFFD}"
+  end
+
+  test "shows a body over the display limit cut off, without pretty-printing it" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    json = %({"padding":"#{"x" * limit}"})
+    webhook = create_webhook(body: json)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "[role=tab]", count: 0
+    assert_select ".flash.alert", text: "The body was 256 KB, display is truncated"
+    assert_equal json.byteslice(0, limit), css_select("pre.body-raw code").text
+  end
+
+  test "displays a body of exactly the display limit in full" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: "x" * limit))
+
+    assert_false presenter.truncated?
+    assert_equal limit, presenter.body_text.bytesize
+    assert_true Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: "x" * (limit + 1))).truncated?
+  end
+
+  test "replaces a character the display limit cuts through" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: ("x" * (limit - 1)) + "é"))
+
+    assert_equal ("x" * (limit - 1)) + "\u{FFFD}", presenter.body_text
+  end
+
+  test "decodes the body without touching the stored bytes" do
+    webhook = create_webhook(body: "caf\xC3\xA9".b).reload
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(webhook)
+
+    assert_equal "café", presenter.body_text
+    assert_equal Encoding::UTF_8, presenter.body_text.encoding
+    assert_equal Encoding::BINARY, webhook.body.encoding
+  end
+
+  test "shows the request headers sorted by name, with the path parameters as JSON" do
+    webhook = create_webhook(request_headers: {
+      "HTTP_X_SIGNATURE" => "sig",
+      "CONTENT_TYPE" => "application/json",
+      "action_dispatch.request.path_parameters" => {"service_id" => "test"}
+    })
+
+    get "/admin/received/#{webhook.id}"
+
+    rows = css_select("table.admin-table thead:has(th:contains('Header')) + tbody tr").map do |row|
+      row.css("td").map(&:text)
+    end
+    assert_equal [
+      ["CONTENT_TYPE", "application/json"],
+      ["HTTP_X_SIGNATURE", "sig"],
+      ["action_dispatch.request.path_parameters", '{"service_id":"test"}']
+    ], rows
+  end
+
+  test "shows webhooks stored before headers were recorded" do
+    webhook = create_webhook(request_headers: nil)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "td.empty[colspan='2']", text: "No records."
+  end
+
+  test "renders copy buttons for the identifiers" do
+    webhook = create_webhook(handler_event_id: "evt_123")
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_select "button.btn-copy[type=button][title='Copy to clipboard'][data-copy=?]", webhook.id.to_s
+    assert_select "button.btn-copy[data-copy=?]", "evt_123"
+  end
+
+  test "locks the pages down with a content security policy" do
+    get "/admin/received"
+
+    assert_equal "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; " \
+      "connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+      response.headers["Content-Security-Policy"]
+  end
+
+  test "serves its own assets, fingerprinted, from under the mount point" do
+    get "/admin/received"
+
+    assert_select "link[rel=stylesheet][href^='/admin/admin.css?s='][integrity^='sha256-']"
+    assert_select "script[type=module][src^='/admin/admin.js?s='][integrity^='sha256-']"
+
+    get "/admin/admin.css"
+    assert_response :ok
+    assert_includes response.body, ".admin-table"
+  end
+end

data/test/base_handler_test.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class EnqueueProbeJob
+  class << self
+    attr_accessor :received_webhook
+  end
+
+  def self.perform_later(webhook)
+    self.received_webhook = webhook
+  end
+end
+
+class HandleProbeHandler < Webhukhs::BaseHandler
+  attr_reader :enqueued_webhook
+
+  def enqueue(webhook)
+    @enqueued_webhook = webhook
+  end
+end
+
+class BaseHandlerTest < ActiveSupport::TestCase
+  cover "Webhukhs::BaseHandler*"
+
+  teardown { Webhukhs::ReceivedWebhook.delete_all }
+
+  test "process is a no-op by default" do
+    assert_nil Webhukhs::BaseHandler.new.process(nil)
+  end
+
+  test "defaults to active, valid and exposing errors" do
+    handler = Webhukhs::BaseHandler.new
+
+    assert_true handler.active?
+    assert_true handler.valid?(nil)
+    assert_true handler.expose_errors_to_sender?
+  end
+
+  test "generates unique UUID event ids by default" do
+    handler = Webhukhs::BaseHandler.new
+
+    first_id = handler.extract_event_id_from_request(nil)
+    second_id = handler.extract_event_id_from_request(nil)
+
+    assert_match(/\A[0-9a-f-]{36}\z/, first_id)
+    assert_match(/\A[0-9a-f-]{36}\z/, second_id)
+    refute_equal first_id, second_id
+  end
+
+  test "handle passes the handler class name into received webhooks" do
+    captured_attributes = nil
+    request = ActionDispatch::Request.new(
+      "rack.input" => StringIO.new("{}"),
+      "REQUEST_METHOD" => "POST",
+      "CONTENT_TYPE" => "application/json",
+      "action_dispatch.request.path_parameters" => {}
+    )
+    webhook = Object.new
+    handler = HandleProbeHandler.new
+
+    def webhook.save!
+    end
+
+    with_overridden_singleton_method(Webhukhs::ReceivedWebhook, :new, ->(**attributes) {
+      captured_attributes = attributes
+      webhook
+    }) do
+      handler.handle(request)
+
+      assert_same webhook, handler.enqueued_webhook
+      assert_equal "HandleProbeHandler", captured_attributes.fetch(:handler_module_name)
+    end
+  end
+
+  test "handle logs duplicate deliveries" do
+    handler = ExtractIdHandler.new
+    request_headers = {
+      "CONTENT_TYPE" => "application/json",
+      "action_dispatch.request.path_parameters" => {}
+    }
+    payload = {event_id: "duplicate-event"}.to_json
+
+    first_request = ActionDispatch::Request.new(request_headers.merge("rack.input" => StringIO.new(payload)))
+    second_request = ActionDispatch::Request.new(request_headers.merge("rack.input" => StringIO.new(payload)))
+
+    handler.handle(first_request)
+
+    with_captured_info_logs(Rails) do |messages|
+      handler.handle(second_request)
+
+      assert_equal ["#{handler.inspect} Webhook duplicate-event is a duplicate delivery and will not be stored."], messages
+    end
+  end
+
+  test "enqueue uses configured processing job classes directly" do
+    original_job_class = Webhukhs.configuration.processing_job_class
+    webhook = Object.new
+
+    Webhukhs.configuration.processing_job_class = EnqueueProbeJob
+    EnqueueProbeJob.received_webhook = nil
+
+    Webhukhs::BaseHandler.new.enqueue(webhook)
+
+    assert_same webhook, EnqueueProbeJob.received_webhook
+  ensure
+    Webhukhs.configuration.processing_job_class = original_job_class
+    EnqueueProbeJob.received_webhook = nil
+  end
+
+  test "enqueue constantizes configured processing job class names" do
+    original_job_class = Webhukhs.configuration.processing_job_class
+    webhook = Object.new
+
+    Webhukhs.configuration.processing_job_class = "EnqueueProbeJob"
+    EnqueueProbeJob.received_webhook = nil
+
+    Webhukhs::BaseHandler.new.enqueue(webhook)
+
+    assert_same webhook, EnqueueProbeJob.received_webhook
+  ensure
+    Webhukhs.configuration.processing_job_class = original_job_class
+    EnqueueProbeJob.received_webhook = nil
+  end
+end

data/test/browser/admin_click_through.rb

@@ -0,0 +1,208 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "ferrum"
+require "puma"
+require "puma/server"
+
+# Clicks through the admin in a real Chrome, so that what the request tests cannot see - the JS, the
+# CSP letting it run, assets resolving under the mount point - is exercised too. Not part of `rake test`,
+# run it with `rake test:browser`.
+class AdminClickThrough < ActiveSupport::TestCase
+  # The app answers from Puma threads with connections of their own, which would not see rows
+  # created inside a test transaction
+  self.use_transactional_tests = false
+
+  PAGE_SIZE = Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE
+
+  def self.server
+    @server ||= Puma::Server.new(WebhukhsTestApp, nil, min_threads: 0, max_threads: 4, log_writer: Puma::LogWriter.null).tap do |server|
+      server.add_tcp_listener("127.0.0.1", 0)
+      server.run
+      Minitest.after_run { server.stop(true) }
+    end
+  end
+
+  setup do
+    @base_url = "http://127.0.0.1:#{self.class.server.connected_ports.first}/admin"
+    @console_errors = []
+    # GitHub's Ubuntu runners do not let Chrome set up its sandbox
+    browser_options = ENV["CI"] ? {"no-sandbox" => nil} : {}
+    @browser = Ferrum::Browser.new(timeout: 10, js_errors: true, browser_options: browser_options)
+    @browser.on("Log.entryAdded") { |params| @console_errors << params.dig("entry", "text") if params.dig("entry", "level") == "error" }
+    @browser.on("Runtime.consoleAPICalled") { |params| @console_errors << params["args"].map { |arg| arg["value"] }.join(" ") if params["type"] == "error" }
+    @browser.page.command("Log.enable")
+  end
+
+  teardown do
+    failed = @browser.network.traffic.filter_map do |exchange|
+      "#{exchange.response.status} #{exchange.request.url}" if exchange.response && exchange.response.status >= 400
+    end
+    @browser.quit
+    Webhukhs::ReceivedWebhook.delete_all
+
+    assert_empty failed, "Requests failed"
+    assert_empty @console_errors, "The browser logged errors"
+  end
+
+  def create_webhook(**attributes)
+    Webhukhs::ReceivedWebhook.create!(
+      handler_module_name: "WebhookTestHandler",
+      handler_event_id: SecureRandom.uuid,
+      status: "processed",
+      body: '{"event":"thing.happened"}',
+      **attributes
+    )
+  end
+
+  def visit(path)
+    @browser.go_to(@base_url + path)
+  end
+
+  def wait_for(what, timeout: 5)
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+    until (result = yield)
+      flunk "Timed out waiting for #{what}" if Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+      sleep 0.05
+    end
+    result
+  end
+
+  def click_and_wait_for_page(node)
+    url = @browser.current_url
+    label = node.text.strip
+    # Ferrum clicks at the node's coordinates as they are, and a click below the fold hits nothing
+    node.scroll_into_view
+    node.click
+    wait_for("#{label.inspect} to leave #{url}") { @browser.current_url != url }
+    # The URL changes as soon as the navigation commits, while the new document may still be parsing
+    wait_for("the page after #{label.inspect} to load") { @browser.evaluate("document.readyState") == "complete" }
+    @browser.network.wait_for_idle
+  end
+
+  # In one evaluate, so that auto-refresh swapping the table cannot pull the nodes out from under us
+  def texts(selector)
+    @browser.evaluate("Array.from(document.querySelectorAll(#{selector.to_json}), (node) => node.textContent.trim())")
+  end
+
+  test "lists, sorts, filters and pages through webhooks" do
+    PAGE_SIZE.times { |i| create_webhook(handler_event_id: "evt-#{i}", created_at: i.minutes.ago) }
+    create_webhook(handler_event_id: "the-failed-one", status: "error", created_at: 2.days.ago)
+
+    visit "/received"
+    assert_equal "Received webhooks", @browser.at_css("h1").text
+    # The stylesheet must have made it through the CSP - unstyled, the header would not be a flexbox
+    assert_equal "flex", @browser.evaluate("getComputedStyle(document.querySelector('.admin-header')).display")
+    assert_equal PAGE_SIZE, @browser.css("tbody tr").length
+    assert_equal "evt-0", texts("tbody tr td:nth-child(5)").first
+
+    click_and_wait_for_page(@browser.at_xpath("//th/a[contains(., 'Received')]"))
+    assert_includes @browser.current_url, "direction=asc"
+    assert_equal "the-failed-one", texts("tbody tr td:nth-child(5)").first
+
+    # Not Ferrum's Node#select: it blanks the select by assigning it `undefined` first, which
+    # left it blank on the Chromium snapshot CI got
+    @browser.execute(<<~JS)
+      const select = document.querySelector("select[name=status]")
+      select.value = "error"
+      select.dispatchEvent(new Event("change", {bubbles: true}))
+    JS
+    assert_equal "error", @browser.evaluate("document.querySelector('select[name=status]').value")
+    click_and_wait_for_page(@browser.at_css("form.filters input[type=submit]"))
+    assert_equal ["the-failed-one"], texts("tbody tr td:nth-child(5)")
+    # The sort survives filtering
+    assert_includes @browser.current_url, "direction=asc"
+
+    click_and_wait_for_page(@browser.at_xpath("//form//a[text()='Clear']"))
+    assert_equal "Any status", @browser.evaluate("document.querySelector('select[name=status]').selectedOptions[0].text")
+
+    click_and_wait_for_page(@browser.at_css("a[rel=next]"))
+    assert_equal 1, @browser.css("tbody tr").length
+    click_and_wait_for_page(@browser.at_css("a[rel=prev]"))
+    assert_equal PAGE_SIZE, @browser.css("tbody tr").length
+  end
+
+  test "opens a webhook by clicking anywhere on its row" do
+    webhook = create_webhook(handler_event_id: "evt-clicked")
+
+    visit "/received"
+    # The status cell is not a link, but the row link stretched over it takes the click
+    click_and_wait_for_page(@browser.at_css("tbody tr td:nth-child(4)"))
+
+    assert @browser.current_url.end_with?("/received/#{webhook.id}"), @browser.current_url
+    assert_includes @browser.at_css("h1").text, "WebhookTestHandler"
+  end
+
+  test "switches between the pretty and the as-sent body" do
+    webhook = create_webhook(body: '{"event":"thing.happened","data":{"id":1}}')
+
+    visit "/received/#{webhook.id}"
+    pretty = -> { @browser.evaluate("document.getElementById('body-pretty').hidden") == false }
+    raw = -> { @browser.evaluate("document.getElementById('body-raw').hidden") == false }
+    assert pretty.call
+    refute raw.call
+
+    @browser.at_css("#body-tab-raw").click
+    wait_for("the as-sent tab") { raw.call }
+    refute pretty.call
+    assert_equal "true", @browser.at_css("#body-tab-raw").attribute("aria-selected")
+    assert_equal '{"event":"thing.happened","data":{"id":1}}', @browser.at_css("#body-raw code").text
+
+    @browser.at_css("#body-tab-raw").focus
+    @browser.keyboard.type(:Left)
+    wait_for("the arrow key to go back to the pretty tab") { pretty.call }
+    assert_equal "body-tab-pretty", @browser.evaluate("document.activeElement.id")
+  end
+
+  test "copies to the clipboard" do
+    webhook = create_webhook(handler_event_id: "evt-to-copy")
+
+    visit "/received/#{webhook.id}"
+    # Headless Chrome has no clipboard to grant, so we only check that the right text gets handed to it
+    @browser.execute("navigator.clipboard.writeText = (text) => { window.copied = text; return Promise.resolve() }")
+
+    @browser.at_css("button.btn-copy[data-copy='evt-to-copy']").click
+    wait_for("the copy button to flash") { @browser.at_css("button.btn-copy.copied[data-copy='evt-to-copy']") }
+    assert_equal "evt-to-copy", @browser.evaluate("window.copied")
+
+    @browser.at_css("button.btn-copy-panel").click
+    wait_for("the body to be copied") { @browser.evaluate("window.copied") != "evt-to-copy" }
+    assert_equal JSON.pretty_generate({"event" => "thing.happened"}), @browser.evaluate("window.copied")
+  end
+
+  test "shows bodies that are not JSON, or too large to display" do
+    form = create_webhook(body: "event=paid&amount=12.50")
+    large = create_webhook(body: "x" * (Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT + 1))
+
+    visit "/received/#{form.id}"
+    assert_equal "This body is not valid JSON, so it is shown as it was sent", @browser.at_css(".flash.alert").text
+    assert_equal "event=paid&amount=12.50", @browser.at_css("pre.body-raw code").text
+    assert_empty @browser.css("[role=tab]")
+
+    visit "/received/#{large.id}"
+    assert_equal "The body was 256 KB, display is truncated", @browser.at_css(".flash.alert").text
+  end
+
+  test "picks up new webhooks while auto-refresh is on, and remembers the switch" do
+    create_webhook(handler_event_id: "evt-before")
+
+    visit "/received"
+    switch = -> { @browser.evaluate("document.getElementById('auto-refresh').checked") }
+    refute switch.call
+    @browser.at_css("label.switch").click
+    wait_for("the switch to turn on") { switch.call }
+
+    create_webhook(handler_event_id: "evt-arrived")
+    # One poll interval, with some slack
+    wait_for("the new webhook to show up", timeout: 8) { texts("tbody tr td:nth-child(5)").include?("evt-arrived") }
+    assert_equal ["evt-arrived", "evt-before"], texts("tbody tr td:nth-child(5)")
+
+    visit "/received"
+    assert switch.call, "The switch should stay on after a reload"
+    # After a page load only the timer refetches, so this one has to come in through a poll
+    create_webhook(handler_event_id: "evt-polled")
+    wait_for("the polled webhook to show up", timeout: 8) { texts("tbody tr td:nth-child(5)").include?("evt-polled") }
+    @browser.at_css("label.switch").click
+    wait_for("the switch to turn off") { !switch.call }
+  end
+end