webhukhs 0.7.0 → 0.8.0

data/lib/webhukhs/admin/received_webhooks_controller.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Webhukhs
+  module Admin
+    # Lists and shows stored webhooks. Read-only: the lifecycle belongs to Webhukhs::ProcessingJob.
+    class ReceivedWebhooksController < ApplicationController
+      # Webhooks per index page
+      PAGE_SIZE = 50
+      # Columns the index can be sorted by
+      SORTABLE_COLUMNS = %w[created_at updated_at handler_module_name handler_event_id status].freeze
+
+      helper_method :handler_options, :status_options
+
+      # Renders a filtered, sorted page of webhooks.
+      #
+      # @return [void]
+      def index
+        @sort = params[:sort].presence_in(SORTABLE_COLUMNS) || "created_at"
+        @direction = (params[:direction] == "asc") ? "asc" : "desc"
+        @page = [params[:page].to_i, 1].max
+
+        filters = {handler_module_name: params[:handler], status: params[:status]}.compact_blank
+
+        # Most columns have plenty of ties (status especially), and without a tiebreaker the DB is free
+        # to return them in a different order for every OFFSET - rows then repeat or vanish between pages
+        rows = ReceivedWebhook
+          .where(filters)
+          .order(@sort => @direction, :id => @direction)
+          .offset((@page - 1) * PAGE_SIZE)
+          .limit(PAGE_SIZE + 1)
+        @next_page = @page + 1 if rows.length > PAGE_SIZE
+        @webhooks = rows.first(PAGE_SIZE).map { |webhook| ReceivedWebhookPresenter.new(webhook) }
+      end
+
+      # Renders one webhook with its body and headers.
+      #
+      # @return [void]
+      def show
+        @webhook = ReceivedWebhookPresenter.new(ReceivedWebhook.find(params.fetch(:id)))
+      end
+
+      private
+
+      # The configured handlers rather than a DISTINCT over the table, so that a handler which has
+      # not received anything yet can still be picked - "nothing arrived" is an answer too.
+      #
+      # @return [Array<String>] handler class names
+      def handler_options
+        Webhukhs.configuration.active_handlers.values.map(&:to_s).uniq.sort
+      end
+
+      # Statuses a webhook can be in, to filter by.
+      #
+      # @return [Hash{String => String}]
+      def status_options
+        ReceivedWebhook.statuses
+      end
+    end
+  end
+end

data/lib/webhukhs/admin/view_helper.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Webhukhs
+  module Admin
+    # Table-building helpers for the admin views.
+    module ViewHelper
+      # Renders a table inside a scroll container. Cells are `white-space: nowrap`, so one long
+      # column would otherwise take the whole page sideways with it.
+      #
+      # @param columns [Array<String>] header cell contents
+      # @param records [Array] rows to render
+      # @yieldparam record [Object] one of the records
+      # @yieldreturn [Array] cell contents for that record
+      # @return [ActiveSupport::SafeBuffer]
+      def admin_table(columns, records)
+        rows = records.map do |record|
+          tag.tr { safe_join(yield(record).map { |cell| tag.td(cell) }) }
+        end
+        rows = [tag.tr(tag.td("No records.", colspan: columns.length, class: "empty"))] if rows.empty?
+
+        thead = tag.thead(tag.tr(safe_join(columns.map { |column| tag.th(column) })))
+        tag.div(tag.table(safe_join([thead, tag.tbody(safe_join(rows))]), class: "admin-table"), class: "table-scroll")
+      end
+
+      # Column header linking to the index sorted by that column. Clicking the active column
+      # flips the direction, any other column starts out descending.
+      #
+      # @param label [String] header text
+      # @param column [String] column to sort by
+      # @param sort [String] currently sorted column
+      # @param direction [String] current direction, "asc" or "desc"
+      # @return [ActiveSupport::SafeBuffer]
+      def sort_link(label, column, sort:, direction:)
+        active = column == sort
+        next_direction = (active && direction == "desc") ? "asc" : "desc"
+        query = request.query_parameters.except("page").merge("sort" => column, "direction" => next_direction)
+        label = safe_join([label, tag.span((direction == "asc") ? "▲" : "▼", class: "sort-arrow")], " ") if active
+        link_to(label, query, class: "sort-link")
+      end
+
+      # Button copying a value to the clipboard (see admin.js).
+      #
+      # @param value [String] text to copy
+      # @return [ActiveSupport::SafeBuffer]
+      def copy_button(value)
+        tag.button(class: "btn-copy", type: "button", title: "Copy to clipboard", data: {copy: value})
+      end
+    end
+  end
+end

data/lib/webhukhs/admin/views/layouts/webhukhs/admin/application.html.erb

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title><%= content_for?(:title) ? "#{yield(:title)} · Webhukhs" : "Webhukhs" %></title>
+  <link rel="icon" href="data:,">
+  <%= assiette_stylesheet_tag "/admin.css" %>
+  <script type="module" src="<%= assiette_asset_path "/admin.js" %>" integrity="<%= assiette_asset_integrity "/admin.js" %>" crossorigin="anonymous"></script>
+</head>
+<body>
+  <header class="admin-header">
+    <strong><%= link_to "Webhukhs", root_path %></strong>
+    <nav>
+      <%= link_to "Received webhooks", received_webhooks_path %>
+    </nav>
+  </header>
+  <main>
+    <%= yield %>
+  </main>
+</body>
+</html>

data/lib/webhukhs/admin/views/webhukhs/admin/received_webhooks/index.html.erb

@@ -0,0 +1,50 @@
+<% content_for :title, "Received webhooks" %>
+<div class="page-heading">
+  <h1>Received webhooks</h1>
+  <%# Off by default, admin.js remembers the choice and refetches the listing while it is on %>
+  <label class="switch">
+    <input type="checkbox" id="auto-refresh" role="switch">
+    Auto-refresh
+  </label>
+</div>
+
+<%= form_tag received_webhooks_path, method: :get, class: "filters" do %>
+  <%= hidden_field_tag :sort, @sort, id: nil %>
+  <%= hidden_field_tag :direction, @direction, id: nil %>
+  <%= select_tag :handler, options_for_select([["Any handler", ""]] + handler_options, params[:handler]), "aria-label": "Handler" %>
+  <%= select_tag :status, options_for_select([["Any status", ""]] + status_options.map { |status, _| [status.humanize, status] }, params[:status]), "aria-label": "Status" %>
+  <%= submit_tag "Filter", name: nil %>
+  <%= link_to "Clear", received_webhooks_path(sort: @sort, direction: @direction) %>
+<% end %>
+
+<%
+  columns = [
+    ["Received", "created_at"],
+    ["Handler", "handler_module_name"],
+    ["Status", "status"],
+    ["Event id", "handler_event_id"],
+    ["Updated", "updated_at"]
+  ].map { |label, column| sort_link(label, column, sort: @sort, direction: @direction) }
+%>
+<div id="received-webhooks">
+<%# The id cell carries the link, and the CSS stretches it over the whole row %>
+<%= admin_table(["Id"] + columns, @webhooks) do |webhook|
+  [
+    link_to(tag.code(webhook.id, class: "cell-ellipsis cell-id", title: webhook.id), received_webhook_path(webhook), class: "row-link"),
+    time_tag(webhook.created_at, webhook.created_at.iso8601),
+    webhook.handler_module_name,
+    tag.span(webhook.status, class: ["badge", webhook.status_class]),
+    tag.code(webhook.handler_event_id, class: "cell-ellipsis", title: webhook.handler_event_id),
+    time_tag(webhook.updated_at, webhook.updated_at.iso8601)
+  ]
+end %>
+
+<nav class="pagination">
+  <% if @page > 1 %>
+    <%= link_to "← Previous", request.query_parameters.merge("page" => @page - 1), rel: "prev" %>
+  <% end %>
+  <% if @next_page %>
+    <%= link_to "Next →", request.query_parameters.merge("page" => @next_page), rel: "next" %>
+  <% end %>
+</nav>
+</div>

data/lib/webhukhs/admin/views/webhukhs/admin/received_webhooks/show.html.erb

@@ -0,0 +1,55 @@
+<% content_for :title, "Webhook #{@webhook.id}" %>
+<nav class="breadcrumb">
+  <%= link_to "Received webhooks", received_webhooks_path %> / <code><%= @webhook.id %></code>
+</nav>
+
+<h1><%= @webhook.handler_module_name %> <span class="badge <%= @webhook.status_class %>"><%= @webhook.status %></span></h1>
+
+<h2>Attributes</h2>
+<div class="table-scroll attr-scroll">
+  <table class="admin-table attr-table">
+    <tbody>
+      <tr><th>Id</th><td><code><%= @webhook.id %></code> <%= copy_button(@webhook.id.to_s) %></td></tr>
+      <tr><th>Handler</th><td><code><%= @webhook.handler_module_name %></code></td></tr>
+      <tr><th>Event id</th><td><code><%= @webhook.handler_event_id %></code> <%= copy_button(@webhook.handler_event_id) %></td></tr>
+      <tr><th>Status</th><td><span class="badge <%= @webhook.status_class %>"><%= @webhook.status %></span></td></tr>
+      <tr><th>Received</th><td><%= time_tag(@webhook.created_at, @webhook.created_at.iso8601) %></td></tr>
+      <tr><th>Updated</th><td><%= time_tag(@webhook.updated_at, @webhook.updated_at.iso8601) %></td></tr>
+    </tbody>
+  </table>
+</div>
+
+<h2>Body <span class="muted">(<%= number_to_human_size(@webhook.body.bytesize) %>)</span></h2>
+<% if @webhook.truncated? %>
+  <p class="flash alert">The body was <%= number_to_human_size(@webhook.body.bytesize) %>, display is truncated</p>
+  <pre class="body-detail body-raw"><code><%= @webhook.body_text %></code></pre>
+<% elsif (pretty_json = @webhook.pretty_json) %>
+  <div class="tabs">
+    <div class="tab-bar">
+      <div role="tablist" aria-label="Body">
+        <button type="button" role="tab" id="body-tab-pretty" aria-controls="body-pretty" aria-selected="true">Pretty</button>
+        <button type="button" role="tab" id="body-tab-raw" aria-controls="body-raw" aria-selected="false" tabindex="-1">As sent</button>
+      </div>
+      <button type="button" class="btn-copy-panel" title="Copy the visible body to the clipboard">Copy</button>
+    </div>
+    <div role="tabpanel" id="body-pretty" aria-labelledby="body-tab-pretty">
+      <pre class="body-detail"><code><%= pretty_json %></code></pre>
+    </div>
+    <div role="tabpanel" id="body-raw" aria-labelledby="body-tab-raw" hidden>
+      <pre class="body-detail body-raw"><code><%= @webhook.body_text %></code></pre>
+    </div>
+  </div>
+<% else %>
+  <p class="flash alert">This body is not valid JSON, so it is shown as it was sent</p>
+  <pre class="body-detail body-raw"><code><%= @webhook.body_text %></code></pre>
+<% end %>
+
+<h2>Request headers</h2>
+<p class="muted">
+  As presented by the web server and any proxies in front of it.
+  <code>action_dispatch.request.path_parameters</code> is not a header, but the parameters
+  the router matched for the request.
+</p>
+<%= admin_table(["Header", "Value"], @webhook.header_rows) do |name, value|
+  [tag.code(name), tag.code(value, class: "header-value")]
+end %>

data/lib/webhukhs/admin.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "assiette"
+require_relative "../webhukhs"
+require_relative "admin/engine"
+require_relative "admin/view_helper"
+require_relative "admin/received_webhook_presenter"
+require_relative "admin/application_controller"
+require_relative "admin/received_webhooks_controller"
+
+# Public namespace for Webhukhs runtime and configuration.
+module Webhukhs
+  # Optional, read-only admin UI for received webhooks. It is not loaded by `require "webhukhs"` -
+  # require "webhukhs/admin" and mount {Webhukhs::Admin::Engine} yourself, behind your own authentication.
+  module Admin
+  end
+end

data/lib/webhukhs/engine.rb

@@ -17,9 +17,5 @@ module Webhukhs
     generators do
       require_relative "install_generator"
     end
-
-    routes do
-      post "/:service_id" => "received_webhooks#create"
-    end
   end
 end

data/lib/webhukhs/models/received_webhook.rb

@@ -53,6 +53,9 @@ module Webhukhs
         raise "Cannot accept the webhook as the request body is larger than #{Webhukhs.configuration.request_body_size_limit} bytes"
       end
 
+      # Rails parses a form-encoded body into params before the handler gets the request, and
+      # leaves the stream at its end - we would store an empty body without the rewind
+      request_body_io.rewind
       write_attribute("body", request_body_io.read.b)
       write_attribute("request_headers", headers)
     ensure

data/lib/webhukhs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Webhukhs
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end

data/test/admin_test.rb

@@ -0,0 +1,334 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class AdminTest < ActionDispatch::IntegrationTest
+  cover "Webhukhs::Admin*"
+
+  self.app = WebhukhsTestApp
+
+  teardown { Webhukhs::ReceivedWebhook.delete_all }
+
+  def create_webhook(**attributes)
+    Webhukhs::ReceivedWebhook.create!(
+      handler_module_name: "WebhookTestHandler",
+      handler_event_id: SecureRandom.uuid,
+      status: "processed",
+      body: '{"event":"thing.happened"}',
+      **attributes
+    )
+  end
+
+  def listed_event_ids
+    css_select("table.admin-table tbody tr td:nth-child(5) code").map(&:text)
+  end
+
+  test "lists webhooks newest first by default" do
+    create_webhook(handler_event_id: "old", created_at: 2.days.ago)
+    create_webhook(handler_event_id: "new", created_at: 1.day.ago)
+
+    get "/admin/received"
+
+    assert_response :ok
+    assert_equal ["new", "old"], listed_event_ids
+    # The whole row is the link, so it has to be there in the first cell
+    assert_select "tbody tr td:first-child a.row-link[href^='/admin/received/']", count: 2
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=asc&sort=created_at", text: "Received ▼"
+    assert_select "th a.sort-link span.sort-arrow", text: "▼", count: 1
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status", text: "Status"
+  end
+
+  test "offers an auto-refresh switch, off by default, for the listing it refetches" do
+    create_webhook
+
+    get "/admin/received"
+
+    assert_select ".page-heading label.switch input#auto-refresh[type=checkbox][role=switch]:not([checked])"
+    # admin.js swaps this element for the one in the refetched page
+    assert_select "#received-webhooks table.admin-table tbody tr", count: 1
+    assert_select "#received-webhooks nav.pagination"
+  end
+
+  test "serves the index at the engine root" do
+    create_webhook(handler_event_id: "at-root")
+
+    get "/admin"
+
+    assert_response :ok
+    assert_equal ["at-root"], listed_event_ids
+  end
+
+  test "sorts by a whitelisted column in either direction" do
+    create_webhook(handler_event_id: "b", status: "skipped")
+    create_webhook(handler_event_id: "a", status: "error")
+
+    get "/admin/received", params: {sort: "status", direction: "asc"}
+    assert_equal ["a", "b"], listed_event_ids
+    # Clicking the active column again flips the direction
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status", text: "Status ▲"
+
+    get "/admin/received", params: {sort: "status", direction: "desc"}
+    assert_equal ["b", "a"], listed_event_ids
+  end
+
+  test "breaks ties by id in the sort direction, so pages do not overlap" do
+    # Event ids run opposite to ids: SQLite walks the dedup index on (handler_module_name,
+    # handler_event_id) to sort by handler, and would order the ties by event id otherwise
+    first = create_webhook(handler_event_id: "z")
+    second = create_webhook(handler_event_id: "a")
+    assert_operator first.id, :<, second.id
+
+    get "/admin/received", params: {sort: "handler_module_name", direction: "desc"}
+    assert_equal ["a", "z"], listed_event_ids
+
+    get "/admin/received", params: {sort: "handler_module_name", direction: "asc"}
+    assert_equal ["z", "a"], listed_event_ids
+  end
+
+  test "ignores sort columns and directions it does not know" do
+    # Created out of order, so that falling back to anything but created_at shows
+    create_webhook(handler_event_id: "new", created_at: 1.day.ago, status: "skipped")
+    create_webhook(handler_event_id: "old", created_at: 2.days.ago, status: "error")
+
+    get "/admin/received", params: {sort: "no_such_column", direction: "sideways"}
+
+    assert_response :ok
+    assert_equal ["new", "old"], listed_event_ids
+  end
+
+  test "filters by handler and status, and treats blank filters as no filter" do
+    create_webhook(handler_event_id: "test-processed")
+    create_webhook(handler_event_id: "test-error", status: "error")
+    create_webhook(handler_event_id: "private-processed", handler_module_name: "PrivateHandler")
+
+    get "/admin/received", params: {handler: "WebhookTestHandler"}
+    assert_equal ["test-error", "test-processed"], listed_event_ids.sort
+
+    get "/admin/received", params: {status: "error"}
+    assert_equal ["test-error"], listed_event_ids
+
+    get "/admin/received", params: {handler: "", status: ""}
+    assert_equal 3, listed_event_ids.length
+  end
+
+  test "offers every configured handler and status as a filter" do
+    get "/admin/received", params: {handler: "PrivateHandler"}
+
+    handlers = css_select("select[name=handler] option").map { |option| option["value"] }
+    assert_equal ["", *Webhukhs.configuration.active_handlers.values.uniq.sort], handlers
+    assert_select "select[name=handler] option[value='']", text: "Any handler"
+    assert_select "select[name=status] option[value='']", text: "Any status"
+    # Clearing the filters keeps the sort
+    assert_select "form.filters a[href=?]", "/admin/received?direction=desc&sort=created_at", text: "Clear"
+    assert_select "select[name=handler] option[selected]", text: "PrivateHandler"
+
+    statuses = css_select("select[name=status] option").map { |option| option["value"] }
+    assert_equal ["", *Webhukhs::ReceivedWebhook.statuses.keys], statuses
+  end
+
+  test "lists a handler configured as a class once, by name" do
+    original_handlers = Webhukhs.configuration.active_handlers
+    Webhukhs.configuration.active_handlers = {a: WebhookTestHandler, b: "WebhookTestHandler"}
+
+    get "/admin/received"
+
+    handlers = css_select("select[name=handler] option").map { |option| option["value"] }
+    assert_equal ["", "WebhookTestHandler"], handlers
+  ensure
+    Webhukhs.configuration.active_handlers = original_handlers
+  end
+
+  test "paginates by #{Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE}" do
+    page_size = Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE
+    (page_size + 1).times { |i| create_webhook(handler_event_id: "evt-#{i}", created_at: i.minutes.ago) }
+
+    get "/admin/received", params: {sort: "status"}
+    assert_equal page_size, listed_event_ids.length
+    assert_equal "evt-#{page_size}", listed_event_ids.first # all ties on status, so by id
+    assert_select "a[rel=prev]", count: 0
+    assert_select "a[rel=next][href=?]", "/admin/received?page=2&sort=status"
+
+    get "/admin/received", params: {sort: "status", page: 2}
+    assert_equal ["evt-0"], listed_event_ids
+    assert_select "a[rel=next]", count: 0
+    assert_select "a[rel=prev][href=?]", "/admin/received?page=1&sort=status"
+  end
+
+  test "loads one row past the page and no more" do
+    page_size = Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE
+    (page_size + 5).times { create_webhook }
+
+    loaded = 0
+    counter = ->(*, payload) { loaded += payload[:record_count] if payload[:class_name] == "Webhukhs::ReceivedWebhook" }
+    ActiveSupport::Notifications.subscribed(counter, "instantiation.active_record") do
+      get "/admin/received"
+    end
+
+    assert_equal page_size + 1, loaded
+  end
+
+  test "shows no next page when the last page is exactly full" do
+    Webhukhs::Admin::ReceivedWebhooksController::PAGE_SIZE.times { create_webhook }
+
+    get "/admin/received"
+
+    assert_select "a[rel=next]", count: 0
+  end
+
+  test "treats a page below 1 as the first page" do
+    create_webhook(handler_event_id: "only")
+
+    get "/admin/received", params: {page: -3}
+
+    assert_equal ["only"], listed_event_ids
+    assert_select "a[rel=prev]", count: 0
+  end
+
+  test "drops the page when changing the sort" do
+    get "/admin/received", params: {page: 3}
+
+    assert_select "th a.sort-link[href=?]", "/admin/received?direction=desc&sort=status"
+  end
+
+  test "says so when there is nothing to list" do
+    get "/admin/received"
+
+    assert_select "div.table-scroll > table.admin-table > thead > tr > th", count: 6
+    assert_select "table.admin-table > tbody > tr > td.empty[colspan='6']", text: "No records."
+  end
+
+  test "colors the status badges" do
+    {
+      "processed" => "status-ok",
+      "error" => "status-bad",
+      "failed_validation" => "status-bad",
+      "received" => "status-waiting",
+      "processing" => "status-waiting",
+      "skipped" => "status-neutral"
+    }.each do |status, css_class|
+      assert_equal css_class, Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(status: status)).status_class
+    end
+  end
+
+  test "shows a JSON body pretty-printed, with the body as sent in a second tab" do
+    create_webhook(handler_event_id: "decoy", body: "not this one")
+    webhook = create_webhook(body: '{"event":"thing.happened","data":{"id":1}}')
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "h1", text: /WebhookTestHandler/
+    assert_select "[role=tab][aria-selected=true]", text: "Pretty"
+    assert_select "[role=tab][aria-selected=false]", text: "As sent"
+    # assert_select squashes whitespace, which is the very thing under test here
+    assert_equal JSON.pretty_generate({"event" => "thing.happened", "data" => {"id" => 1}}),
+      css_select("#body-pretty:not([hidden]) code").text
+    assert_equal '{"event":"thing.happened","data":{"id":1}}', css_select("#body-raw[hidden] code").text
+    assert_select ".flash.alert", count: 0
+  end
+
+  test "shows a body that is not JSON as sent, replacing invalid UTF-8" do
+    webhook = create_webhook(body: "event=thing&broken=\xFF".b)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "[role=tab]", count: 0
+    assert_select ".flash.alert", text: /not valid JSON/
+    assert_select "pre.body-raw code", text: "event=thing&broken=\u{FFFD}"
+  end
+
+  test "shows a body over the display limit cut off, without pretty-printing it" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    json = %({"padding":"#{"x" * limit}"})
+    webhook = create_webhook(body: json)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "[role=tab]", count: 0
+    assert_select ".flash.alert", text: "The body was 256 KB, display is truncated"
+    assert_equal json.byteslice(0, limit), css_select("pre.body-raw code").text
+  end
+
+  test "displays a body of exactly the display limit in full" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: "x" * limit))
+
+    assert_false presenter.truncated?
+    assert_equal limit, presenter.body_text.bytesize
+    assert_true Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: "x" * (limit + 1))).truncated?
+  end
+
+  test "replaces a character the display limit cuts through" do
+    limit = Webhukhs::Admin::ReceivedWebhookPresenter::DISPLAY_LIMIT
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(create_webhook(body: ("x" * (limit - 1)) + "é"))
+
+    assert_equal ("x" * (limit - 1)) + "\u{FFFD}", presenter.body_text
+  end
+
+  test "decodes the body without touching the stored bytes" do
+    webhook = create_webhook(body: "caf\xC3\xA9".b).reload
+    presenter = Webhukhs::Admin::ReceivedWebhookPresenter.new(webhook)
+
+    assert_equal "café", presenter.body_text
+    assert_equal Encoding::UTF_8, presenter.body_text.encoding
+    assert_equal Encoding::BINARY, webhook.body.encoding
+  end
+
+  test "shows the request headers sorted by name, with the path parameters as JSON" do
+    webhook = create_webhook(request_headers: {
+      "HTTP_X_SIGNATURE" => "sig",
+      "CONTENT_TYPE" => "application/json",
+      "action_dispatch.request.path_parameters" => {"service_id" => "test"}
+    })
+
+    get "/admin/received/#{webhook.id}"
+
+    rows = css_select("table.admin-table thead:has(th:contains('Header')) + tbody tr").map do |row|
+      row.css("td").map(&:text)
+    end
+    assert_equal [
+      ["CONTENT_TYPE", "application/json"],
+      ["HTTP_X_SIGNATURE", "sig"],
+      ["action_dispatch.request.path_parameters", '{"service_id":"test"}']
+    ], rows
+  end
+
+  test "shows webhooks stored before headers were recorded" do
+    webhook = create_webhook(request_headers: nil)
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_response :ok
+    assert_select "td.empty[colspan='2']", text: "No records."
+  end
+
+  test "renders copy buttons for the identifiers" do
+    webhook = create_webhook(handler_event_id: "evt_123")
+
+    get "/admin/received/#{webhook.id}"
+
+    assert_select "button.btn-copy[type=button][title='Copy to clipboard'][data-copy=?]", webhook.id.to_s
+    assert_select "button.btn-copy[data-copy=?]", "evt_123"
+  end
+
+  test "locks the pages down with a content security policy" do
+    get "/admin/received"
+
+    assert_equal "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; " \
+      "connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+      response.headers["Content-Security-Policy"]
+  end
+
+  test "serves its own assets, fingerprinted, from under the mount point" do
+    get "/admin/received"
+
+    assert_select "link[rel=stylesheet][href^='/admin/admin.css?s='][integrity^='sha256-']"
+    assert_select "script[type=module][src^='/admin/admin.js?s='][integrity^='sha256-']"
+
+    get "/admin/admin.css"
+    assert_response :ok
+    assert_includes response.body, ".admin-table"
+  end
+end

data/test/base_handler_test.rb

@@ -32,9 +32,9 @@ class BaseHandlerTest < ActiveSupport::TestCase
   test "defaults to active, valid and exposing errors" do
     handler = Webhukhs::BaseHandler.new
 
-    assert_equal true, handler.active?
-    assert_equal true, handler.valid?(nil)
-    assert_equal true, handler.expose_errors_to_sender?
+    assert_true handler.active?
+    assert_true handler.valid?(nil)
+    assert_true handler.expose_errors_to_sender?
   end
 
   test "generates unique UUID event ids by default" do