webhook

const (
	HeaderEvent     = "X-LinkCtrl-Event"
	HeaderDelivery  = "X-LinkCtrl-Delivery"
	HeaderTimestamp = "X-LinkCtrl-Timestamp"
	HeaderSignature = "X-LinkCtrl-Signature"
)

const (
	// MaxAttempts is how many deliveries one event gets before it is abandoned.
	// Counted at claim time, so a process that dies mid-delivery spends an
	// attempt — otherwise a crash loop would retry the same event forever.
	//
	// Seven rather than the mailer's five, and the extra two are the hour
	// boundary: with the backoff below, seven attempts span 61 minutes, which is
	// long enough to ride out a receiver's deploy and short enough that "we were
	// down this morning, did we lose events" has the answer "anything older than
	// an hour, yes" rather than a calculation.
	//
	// TestBackoffDoublesAndCaps holds the arithmetic to that sentence. It is
	// there because the first draft of this comment said six attempts and an
	// hour, and six is thirty-one minutes.
	MaxAttempts = 7
	// BackoffBase is the delay before the second attempt, doubling up to
	// BackoffMax. With these values the seven attempts span 61 minutes:
	// 1m, 2m, 4m, 8m, 16m, 30m.
	BackoffBase = time.Minute
	BackoffMax  = 30 * time.Minute

	// DrainBatch bounds one drain. Each row is a network round trip to somebody
	// else's server and the scheduler runs every half minute, so a backlog
	// drains over several runs instead of holding the job for minutes.
	DrainBatch = 20

	// DeliveryConcurrency is how many of a claimed batch are dialled at once,
	// and it is DrainBatch because that is what makes the sentence above true.
	//
	// There was no such constant before and the value it replaces was one, which
	// is what M42 was reopened for. A batch delivered one row after another costs
	// DrainBatch times the per-attempt timeout — twenty times ten seconds at the
	// shipped defaults, with no misconfiguration — and that time is spent on the
	// scheduler's single goroutine, where every other job's tick is dropped rather
	// than queued. The cost never landed on webhooks: it landed on invitation
	// mail, on automation's advertised clock, and on domain re-verification.
	// Delivered together, one drain costs one attempt, and the arithmetic no
	// longer has a batch size in it.
	//
	// Equal to DrainBatch rather than smaller, deliberately. Any value below it
	// puts the batch size back into the wall-clock cost — a limit of eight is
	// three waves, which at the default timeout is thirty seconds and back inside
	// the tick it is meant to fit under. What keeps the number small is the claim
	// itself: a drain never holds more than DrainBatch rows, so it can never dial
	// more than that at once.
	DeliveryConcurrency = DrainBatch

	// DefaultRetentionDays is how long a delivered or abandoned row is kept when
	// the operator has not said. The setting is WEBHOOK_RETENTION_DAYS; this is
	// the fallback, not a second policy.
	DefaultRetentionDays = 30
)

const DefaultTimeout = 10 * time.Second

const SignatureVersion = "v1"